@vanaheimr/cose 0.9.0

package/dist/index.js

@@ -0,0 +1,4159 @@
+import { cbor } from '@vanaheimr/metrological-cbor';
+export { cbor } from '@vanaheimr/metrological-cbor';
+import { ecdsa, weierstrass } from '@noble/curves/abstract/weierstrass.js';
+import { sha384, sha512, sha256 } from '@noble/hashes/sha2.js';
+import { p521, p384, p256 } from '@noble/curves/nist.js';
+import { brainpoolP512r1, brainpoolP384r1, brainpoolP256r1 } from '@noble/curves/misc.js';
+import { secp256k1 } from '@noble/curves/secp256k1.js';
+import { ed25519 } from '@noble/curves/ed25519.js';
+import { ed448 } from '@noble/curves/ed448.js';
+import { ml_dsa87, ml_dsa65, ml_dsa44 } from '@noble/post-quantum/ml-dsa.js';
+import { hmac as hmac$1 } from '@noble/hashes/hmac.js';
+import { gcm, aeskw } from '@noble/ciphers/aes.js';
+
+// src/errors.ts
+var CoseError = class extends Error {
+  name = "CoseError";
+  constructor(message, options) {
+    super(message, options);
+  }
+};
+var VERIFIED = { verified: true };
+var notVerified = (reason) => ({ verified: false, reason });
+var notDecrypted = (reason) => ({ decrypted: false, reason });
+var PRESERVE = { mapKeys: "preserve", floats: "preserve" };
+var DETERMINISTIC = { mapKeys: "sorted", floats: "shortest" };
+var encode = (value) => cbor.encode(value, PRESERVE);
+var decode = (data) => cbor.decode(data, { strict: false });
+function bytesEqual(left, right) {
+  if (left.length !== right.length)
+    return false;
+  for (let index = 0; index < left.length; index++) {
+    if (left[index] !== right[index])
+      return false;
+  }
+  return true;
+}
+var NO_BYTES = new Uint8Array();
+
+// src/payload.ts
+function canonicalizePayload(payload) {
+  try {
+    return cbor.encode(cbor.decode(payload, { strict: false }), DETERMINISTIC);
+  } catch {
+    return payload;
+  }
+}
+function isCanonicalPayload(payload) {
+  try {
+    return bytesEqual(
+      cbor.encode(cbor.decode(payload, { strict: false }), DETERMINISTIC),
+      payload
+    );
+  } catch {
+    return false;
+  }
+}
+
+// src/labels.ts
+var HeaderLabel = {
+  /** The cryptographic algorithm [RFC 9052]. */
+  algorithm: 1,
+  /** The labels a recipient is required to understand [RFC 9052]. */
+  critical: 2,
+  /** The content type of the payload [RFC 9052]. */
+  contentType: 3,
+  /** The key identifier [RFC 9052]. */
+  keyIdentifier: 4,
+  /** The initialization vector [RFC 9052]. */
+  iv: 5,
+  /** The partial initialization vector [RFC 9052]. */
+  partialIv: 6,
+  /** The countersignature of RFC 8152, superseded by label 11 [RFC 9338]. */
+  counterSignature: 7,
+  /** The countersignature that also covers the signature it signs [RFC 9338]. */
+  counterSignatureV2: 11,
+  /** The abbreviated countersignature, not implemented here [RFC 9338]. */
+  counterSignature0V2: 12,
+  /** An unordered bag of X.509 certificates [RFC 9360]. */
+  x5Bag: 32,
+  /** An ordered X.509 certificate chain [RFC 9360]. */
+  x5Chain: 33,
+  /** The hash of an X.509 certificate [RFC 9360]. */
+  x5T: 34,
+  /** A URI naming an X.509 certificate [RFC 9360]. */
+  x5U: 35
+};
+var label = (value) => cbor.int(value);
+function headerLabelName(value) {
+  if (value.type === "int") {
+    switch (value.value) {
+      case 1n:
+        return "alg";
+      case 2n:
+        return "crit";
+      case 3n:
+        return "content type";
+      case 4n:
+        return "kid";
+      case 5n:
+        return "IV";
+      case 6n:
+        return "Partial IV";
+      case 7n:
+        return "counter signature";
+      case 11n:
+        return "counter signature version 2";
+      case 12n:
+        return "counter signature 0 version 2";
+      case 32n:
+        return "x5bag";
+      case 33n:
+        return "x5chain";
+      case 34n:
+        return "x5t";
+      case 35n:
+        return "x5u";
+    }
+  }
+  if (value.type === "text")
+    return value.value;
+  return cbor.diagnostic(value);
+}
+function isUnderstood(value) {
+  return value.type === "int" && (value.value === 1n || value.value === 2n || value.value === 3n || value.value === 4n);
+}
+function sameLabel(left, right) {
+  if (left.type === "int" && right.type === "int")
+    return left.value === right.value;
+  if (left.type === "text" && right.type === "text")
+    return left.value === right.value;
+  return false;
+}
+
+// src/curve.ts
+var curve = (id, name, keyType, fieldSize, orderSize) => ({ id, name, keyType, fieldSize, orderSize });
+var KEY_TYPE_EC2 = 2;
+var KEY_TYPE_OKP = 1;
+var CoseCurves = {
+  P256: curve(1, "P-256", KEY_TYPE_EC2, 32, 32),
+  P384: curve(2, "P-384", KEY_TYPE_EC2, 48, 48),
+  P521: curve(3, "P-521", KEY_TYPE_EC2, 66, 66),
+  // The two key-agreement curves carry no signature algorithm, so their
+  // widths are recorded as unknown rather than guessed at.
+  X25519: curve(4, "X25519", KEY_TYPE_OKP, null, null),
+  X448: curve(5, "X448", KEY_TYPE_OKP, null, null),
+  Ed25519: curve(6, "Ed25519", KEY_TYPE_OKP, 32, 32),
+  Ed448: curve(7, "Ed448", KEY_TYPE_OKP, 57, 57),
+  secp256k1: curve(8, "secp256k1", KEY_TYPE_EC2, 32, 32),
+  // Registered by ISO/IEC 18013-5 for the mobile driving licence.
+  brainpoolP256r1: curve(256, "brainpoolP256r1", KEY_TYPE_EC2, 32, 32),
+  brainpoolP320r1: curve(257, "brainpoolP320r1", KEY_TYPE_EC2, 40, 40),
+  brainpoolP384r1: curve(258, "brainpoolP384r1", KEY_TYPE_EC2, 48, 48),
+  brainpoolP512r1: curve(259, "brainpoolP512r1", KEY_TYPE_EC2, 64, 64)
+};
+var ALL_CURVES = Object.values(CoseCurves);
+function curveById(id) {
+  return ALL_CURVES.find((each) => each.id === id) ?? null;
+}
+function curveByName(name) {
+  return ALL_CURVES.find((each) => each.name === name) ?? null;
+}
+var brainpoolP320r1 = /* @__PURE__ */ ecdsa(weierstrass({
+  p: BigInt("0xd35e472036bc4fb7e13c785ed201e065f98fcfa6f6f40def4f92b9ec7893ec28fcd412b1f1b32e27"),
+  a: BigInt("0x3ee30b568fbab0f883ccebd46d3f3bb8a2a73513f5eb79da66190eb085ffa9f492f375a97d860eb4"),
+  b: BigInt("0x520883949dfdbc42d3ad198640688a6fe13f41349554b49acc31dccd884539816f5eb4ac8fb1f1a6"),
+  n: BigInt("0xd35e472036bc4fb7e13c785ed201e065f98fcfa5b68f12a32d482ec7ee8658e98691555b44c59311"),
+  Gx: BigInt("0x43bd7e9afb53d8b85289bcc48ee5bfe6f20137d10a087eb6e7871e2a10a599c710af8d0d39e20611"),
+  Gy: BigInt("0x14fdd05545ec1cc8ab4093247f77275e0743ffed117182eaa9c77877aaac6ac7d35245d1692e8ee1"),
+  h: BigInt(1)
+}), sha384);
+var HASHES = { sha256, sha384, sha512 };
+var IMPLEMENTED = {
+  "P-256": p256,
+  "P-384": p384,
+  "P-521": p521,
+  "secp256k1": secp256k1,
+  "brainpoolP256r1": brainpoolP256r1,
+  "brainpoolP320r1": brainpoolP320r1,
+  "brainpoolP384r1": brainpoolP384r1,
+  "brainpoolP512r1": brainpoolP512r1
+};
+var isImplemented = (curve2) => curve2.name in IMPLEMENTED;
+function implementationOf(curve2) {
+  const implementation = IMPLEMENTED[curve2.name];
+  if (implementation === void 0)
+    throw new CoseError(`The elliptic curve '${curve2.name}' is registered by COSE, but this build does not implement it!`);
+  return implementation;
+}
+var digest = (algorithm2, data) => HASHES[algorithm2](data);
+function sign(curve2, messageHash, privateKey) {
+  return implementationOf(curve2).sign(
+    messageHash,
+    privateKey,
+    { prehash: false, lowS: false }
+  );
+}
+function verify(curve2, signature, messageHash, publicKey) {
+  const expected = (curve2.orderSize ?? 0) * 2;
+  if (signature.length !== expected)
+    throw new CoseError(`An ECDSA signature on the curve '${curve2.name}' must be ${expected} bytes wide \u2014 the concatenated components r and s, each zero-padded to the width of the group order [RFC 9053, Section 2.1] \u2014 but was ${signature.length} bytes wide. A signature of a length such as this one is usually a DER encoding that was never converted!`);
+  try {
+    return implementationOf(curve2).verify(
+      signature,
+      messageHash,
+      publicKey,
+      { prehash: false, lowS: false }
+    );
+  } catch {
+    return false;
+  }
+}
+function publicKeyFor(curve2, privateKey) {
+  return implementationOf(curve2).getPublicKey(privateKey, false);
+}
+function decompressY(curve2, x, oddY) {
+  const fieldSize = curve2.fieldSize ?? 0;
+  const compressed = new Uint8Array(1 + x.length);
+  compressed[0] = oddY ? 3 : 2;
+  compressed.set(x, 1);
+  const uncompressed = implementationOf(curve2).Point.fromBytes(compressed).toBytes(false);
+  return uncompressed.slice(1 + fieldSize);
+}
+function isOnCurve(curve2, uncompressed) {
+  try {
+    implementationOf(curve2).Point.fromBytes(uncompressed);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var IMPLEMENTED2 = {
+  "Ed25519": ed25519,
+  "Ed448": ed448
+};
+var isEddsaCurve = (curve2) => curve2.name in IMPLEMENTED2;
+function implementationOf2(curve2) {
+  const implementation = IMPLEMENTED2[curve2.name];
+  if (implementation === void 0)
+    throw new CoseError(`The curve '${curve2.name}' is not an EdDSA signature curve this implementation supports!`);
+  return implementation;
+}
+function eddsaSignatureSize(curve2) {
+  if (curve2.id === CoseCurves.Ed25519.id) return 64;
+  if (curve2.id === CoseCurves.Ed448.id) return 114;
+  throw new CoseError(`The curve '${curve2.name}' has no EdDSA signature size!`);
+}
+function eddsaSign(curve2, message, privateKey) {
+  return implementationOf2(curve2).sign(message, privateKey);
+}
+function eddsaVerify(curve2, signature, message, publicKey) {
+  const expected = eddsaSignatureSize(curve2);
+  if (signature.length !== expected)
+    throw new CoseError(`An EdDSA signature on the curve '${curve2.name}' must be ${String(expected)} bytes wide, but was ${String(signature.length)} bytes wide!`);
+  try {
+    return implementationOf2(curve2).verify(signature, message, publicKey);
+  } catch {
+    return false;
+  }
+}
+function eddsaPublicKeyFor(curve2, privateKey) {
+  return implementationOf2(curve2).getPublicKey(privateKey);
+}
+var MLDSA_PARAMETER_SETS = ["ML-DSA-44", "ML-DSA-65", "ML-DSA-87"];
+var IMPLEMENTED3 = {
+  "ML-DSA-44": ml_dsa44,
+  "ML-DSA-65": ml_dsa65,
+  "ML-DSA-87": ml_dsa87
+};
+var MLDSA_SIZES = {
+  "ML-DSA-44": { publicKey: 1312, signature: 2420 },
+  "ML-DSA-65": { publicKey: 1952, signature: 3309 },
+  "ML-DSA-87": { publicKey: 2592, signature: 4627 }
+};
+var MLDSA_SEED_SIZE = 32;
+function schemeOf(parameterSet) {
+  const scheme = IMPLEMENTED3[parameterSet];
+  if (scheme === void 0)
+    throw new CoseError(`'${parameterSet}' is not an ML-DSA parameter set this implementation supports!`);
+  return scheme;
+}
+var isMldsaParameterSet = (parameterSet) => parameterSet in IMPLEMENTED3;
+function mldsaPublicKeyFor(parameterSet, seed) {
+  requireSeed(seed);
+  return schemeOf(parameterSet).keygen(seed).publicKey;
+}
+function mldsaSign(parameterSet, message, seed) {
+  requireSeed(seed);
+  const scheme = schemeOf(parameterSet);
+  return scheme.sign(message, scheme.keygen(seed).secretKey, { extraEntropy: false });
+}
+function mldsaVerify(parameterSet, signature, message, publicKey) {
+  const sizes = isMldsaParameterSet(parameterSet) ? MLDSA_SIZES[parameterSet] : void 0;
+  if (sizes !== void 0 && signature.length !== sizes.signature)
+    throw new CoseError(`An ${parameterSet} signature must be ${String(sizes.signature)} bytes wide, but was ${String(signature.length)} bytes wide!`);
+  try {
+    return schemeOf(parameterSet).verify(signature, message, publicKey);
+  } catch {
+    return false;
+  }
+}
+function requireSeed(seed) {
+  if (seed.length !== MLDSA_SEED_SIZE)
+    throw new CoseError(`The private key of an ML-DSA COSE key is the seed and must be ${String(MLDSA_SEED_SIZE)} bytes long [RFC 9964], but was ${String(seed.length)} bytes long!`);
+}
+var hmac = (hash, key, message) => hmac$1(HASHES[hash], key, message);
+function macTag(hash, tagSize, key, message) {
+  const full = hmac(hash, key, message);
+  if (tagSize > full.length)
+    throw new CoseError(`An HMAC over ${hash} is ${String(full.length)} bytes long and can not be truncated to ${String(tagSize)}!`);
+  return tagSize === full.length ? full : full.subarray(0, tagSize);
+}
+function tagsEqual(left, right) {
+  if (left.length !== right.length)
+    return false;
+  let difference = 0;
+  for (let index = 0; index < left.length; index++)
+    difference |= (left[index] ?? 0) ^ (right[index] ?? 0);
+  return difference === 0;
+}
+
+// src/algorithm.ts
+var algorithm = (id, name, description, spec = {}) => ({
+  id,
+  name,
+  description,
+  family: spec.family ?? "none",
+  hash: spec.hash ?? null,
+  curve: spec.curve ?? null,
+  parameterSet: spec.parameterSet ?? null,
+  tagSize: spec.tagSize ?? null,
+  keySize: spec.keySize ?? null,
+  signing: spec.signing ?? false,
+  deprecated: spec.deprecated ?? false
+});
+var CoseAlgorithms = {
+  // ECDSA, curve taken from the key [RFC 9053]. Deprecated by RFC 9864.
+  ES256: algorithm(
+    -7,
+    "ES256",
+    "ECDSA w/ SHA-256",
+    { family: "ecdsa", hash: "sha256", signing: true, deprecated: true }
+  ),
+  ES384: algorithm(
+    -35,
+    "ES384",
+    "ECDSA w/ SHA-384",
+    { family: "ecdsa", hash: "sha384", signing: true, deprecated: true }
+  ),
+  ES512: algorithm(
+    -36,
+    "ES512",
+    "ECDSA w/ SHA-512",
+    { family: "ecdsa", hash: "sha512", signing: true, deprecated: true }
+  ),
+  ES256K: algorithm(
+    -47,
+    "ES256K",
+    "ECDSA using secp256k1 curve and SHA-256",
+    { family: "ecdsa", hash: "sha256", curve: CoseCurves.secp256k1, signing: true }
+  ),
+  // Fully-specified ECDSA [RFC 9864].
+  ESP256: algorithm(
+    -9,
+    "ESP256",
+    "ECDSA using P-256 curve and SHA-256",
+    { family: "ecdsa", hash: "sha256", curve: CoseCurves.P256, signing: true }
+  ),
+  ESP384: algorithm(
+    -51,
+    "ESP384",
+    "ECDSA using P-384 curve and SHA-384",
+    { family: "ecdsa", hash: "sha384", curve: CoseCurves.P384, signing: true }
+  ),
+  ESP512: algorithm(
+    -52,
+    "ESP512",
+    "ECDSA using P-521 curve and SHA-512",
+    { family: "ecdsa", hash: "sha512", curve: CoseCurves.P521, signing: true }
+  ),
+  ESB256: algorithm(
+    -265,
+    "ESB256",
+    "ECDSA using BrainpoolP256r1 curve and SHA-256",
+    { family: "ecdsa", hash: "sha256", curve: CoseCurves.brainpoolP256r1, signing: true }
+  ),
+  ESB320: algorithm(
+    -266,
+    "ESB320",
+    "ECDSA using BrainpoolP320r1 curve and SHA-384",
+    { family: "ecdsa", hash: "sha384", curve: CoseCurves.brainpoolP320r1, signing: true }
+  ),
+  ESB384: algorithm(
+    -267,
+    "ESB384",
+    "ECDSA using BrainpoolP384r1 curve and SHA-384",
+    { family: "ecdsa", hash: "sha384", curve: CoseCurves.brainpoolP384r1, signing: true }
+  ),
+  ESB512: algorithm(
+    -268,
+    "ESB512",
+    "ECDSA using BrainpoolP512r1 curve and SHA-512",
+    { family: "ecdsa", hash: "sha512", curve: CoseCurves.brainpoolP512r1, signing: true }
+  ),
+  // EdDSA [RFC 8032]. No digest of its own: the message is signed whole.
+  // The un-suffixed identifier leaves the curve to the key, which is what
+  // RFC 9864 deprecates it for.
+  EdDSA: algorithm(
+    -8,
+    "EdDSA",
+    "EdDSA",
+    { family: "eddsa", signing: true, deprecated: true }
+  ),
+  Ed25519: algorithm(
+    -19,
+    "Ed25519",
+    "EdDSA using the Ed25519 parameter set",
+    { family: "eddsa", curve: CoseCurves.Ed25519, signing: true }
+  ),
+  Ed448: algorithm(
+    -53,
+    "Ed448",
+    "EdDSA using the Ed448 parameter set",
+    { family: "eddsa", curve: CoseCurves.Ed448, signing: true }
+  ),
+  // ML-DSA [FIPS 204, RFC 9964]. Also pure, and also without a curve: an
+  // ML-DSA key is a key pair of an algorithm rather than a point on
+  // something, which is why RFC 9964 gives it a key type of its own.
+  MLDSA44: algorithm(
+    -48,
+    "ML-DSA-44",
+    "CBOR Object Signing Algorithm for ML-DSA-44",
+    { family: "mldsa", parameterSet: "ML-DSA-44", signing: true }
+  ),
+  MLDSA65: algorithm(
+    -49,
+    "ML-DSA-65",
+    "CBOR Object Signing Algorithm for ML-DSA-65",
+    { family: "mldsa", parameterSet: "ML-DSA-65", signing: true }
+  ),
+  MLDSA87: algorithm(
+    -50,
+    "ML-DSA-87",
+    "CBOR Object Signing Algorithm for ML-DSA-87",
+    { family: "mldsa", parameterSet: "ML-DSA-87", signing: true }
+  ),
+  // HMAC [RFC 9053, Section 3.1]. A message authentication code rather than
+  // a signature: symmetric, so whoever verifies one can produce one, and
+  // `signing` is therefore false for all four. The name is "hash size /
+  // tag size", and the tag is the leftmost bits of the full HMAC.
+  HMAC256_64: algorithm(
+    4,
+    "HMAC 256/64",
+    "HMAC w/ SHA-256 truncated to 64 bits",
+    { family: "hmac", hash: "sha256", tagSize: 8 }
+  ),
+  HMAC256_256: algorithm(
+    5,
+    "HMAC 256/256",
+    "HMAC w/ SHA-256",
+    { family: "hmac", hash: "sha256", tagSize: 32 }
+  ),
+  HMAC384_384: algorithm(
+    6,
+    "HMAC 384/384",
+    "HMAC w/ SHA-384",
+    { family: "hmac", hash: "sha384", tagSize: 48 }
+  ),
+  HMAC512_512: algorithm(
+    7,
+    "HMAC 512/512",
+    "HMAC w/ SHA-512",
+    { family: "hmac", hash: "sha512", tagSize: 64 }
+  ),
+  // AES-GCM [RFC 9053, Section 4.1], the content encryption algorithms.
+  // COSE fixes the nonce at 96 bits and the authentication tag at 128, so the
+  // key width is the only thing left for the identifier to name.
+  A128GCM: algorithm(
+    1,
+    "A128GCM",
+    "AES-GCM mode w/ 128-bit key, 128-bit tag",
+    { family: "aesgcm", keySize: 16, tagSize: 16 }
+  ),
+  A192GCM: algorithm(
+    2,
+    "A192GCM",
+    "AES-GCM mode w/ 192-bit key, 128-bit tag",
+    { family: "aesgcm", keySize: 24, tagSize: 16 }
+  ),
+  A256GCM: algorithm(
+    3,
+    "A256GCM",
+    "AES-GCM mode w/ 256-bit key, 128-bit tag",
+    { family: "aesgcm", keySize: 32, tagSize: 16 }
+  ),
+  // AES key wrap [RFC 9053, Section 6.2.1, RFC 3394]. A recipient algorithm:
+  // it carries a content key rather than content, and the width named here is
+  // that of the KEY-ENCRYPTION key, not of the key being wrapped.
+  A128KW: algorithm(
+    -3,
+    "A128KW",
+    "AES Key Wrap w/ 128-bit key",
+    { family: "keywrap", keySize: 16 }
+  ),
+  A192KW: algorithm(
+    -4,
+    "A192KW",
+    "AES Key Wrap w/ 192-bit key",
+    { family: "keywrap", keySize: 24 }
+  ),
+  A256KW: algorithm(
+    -5,
+    "A256KW",
+    "AES Key Wrap w/ 256-bit key",
+    { family: "keywrap", keySize: 32 }
+  ),
+  // The recipient algorithm that transports nothing [RFC 9053, Section
+  // 6.1.1]: the recipient's key IS the content key. Its protected bucket and
+  // its ciphertext must both be empty, which is what makes a COSE_Mac with
+  // one direct recipient a COSE_Mac0 with extra ceremony.
+  direct: algorithm(
+    -6,
+    "direct",
+    "Direct use of content encryption key (CEK)",
+    { family: "direct" }
+  ),
+  // Digests, which are algorithms in the same registry but never sign.
+  SHA256: algorithm(-16, "SHA-256", "SHA-2 256-bit Hash", { hash: "sha256" }),
+  SHA384: algorithm(-43, "SHA-384", "SHA-2 384-bit Hash", { hash: "sha384" }),
+  SHA512: algorithm(-44, "SHA-512", "SHA-2 512-bit Hash", { hash: "sha512" }),
+  SHA1: algorithm(-14, "SHA-1", "SHA-1 Hash", { deprecated: true })
+};
+var ALL_ALGORITHMS = Object.values(CoseAlgorithms);
+function algorithmById(id) {
+  return ALL_ALGORITHMS.find((each) => each.id === id) ?? null;
+}
+function algorithmByName(name) {
+  return ALL_ALGORITHMS.find((each) => each.name === name) ?? null;
+}
+function algorithmFromCbor(value) {
+  if (value.type !== "int")
+    throw new CoseError("The COSE algorithm identifier must be an integer!");
+  const id = Number(value.value);
+  return algorithmById(id) ?? algorithm(id, `unregistered(${String(id)})`, "An algorithm this implementation does not know");
+}
+var algorithmToCbor = (value) => cbor.int(value.id);
+var sameAlgorithm = (left, right) => left.id === right.id;
+function resolveCurve(value, keyCurve) {
+  if (!value.signing)
+    throw new CoseError(`The COSE algorithm '${value.name}' is not a signature algorithm this implementation supports!`);
+  if (value.curve !== null) {
+    if (keyCurve !== null && keyCurve.id !== value.curve.id)
+      throw new CoseError(`The COSE algorithm '${value.name}' is defined on the curve '${value.curve.name}', but the key is on the curve '${keyCurve.name}'!`);
+    return value.curve;
+  }
+  if (keyCurve === null)
+    throw new CoseError(`The COSE algorithm '${value.name}' does not name a curve, therefore the key has to!`);
+  return keyCurve;
+}
+function hashOf(value) {
+  if (value.hash === null)
+    throw new CoseError(`The COSE algorithm '${value.name}' does not define a separate message digest!`);
+  return value.hash;
+}
+function parameterSetOf(value) {
+  if (value.parameterSet === null)
+    throw new CoseError(`The COSE algorithm '${value.name}' does not name an ML-DSA parameter set!`);
+  return value.parameterSet;
+}
+function signWith(value, keyCurve, toBeSigned, privateKey) {
+  switch (value.family) {
+    case "ecdsa":
+      return sign(
+        resolveCurve(value, keyCurve),
+        digest(hashOf(value), toBeSigned),
+        privateKey
+      );
+    case "eddsa":
+      return eddsaSign(resolveCurve(value, keyCurve), toBeSigned, privateKey);
+    case "mldsa":
+      return mldsaSign(parameterSetOf(value), toBeSigned, privateKey);
+    default:
+      throw new CoseError(`The COSE algorithm '${value.name}' is not a signature algorithm this implementation supports!`);
+  }
+}
+function macWith(value, toBeMaced, key) {
+  if (value.family !== "hmac")
+    throw new CoseError(`The COSE algorithm '${value.name}' is not a message authentication algorithm this implementation supports!`);
+  return macTag(hashOf(value), tagSizeOf(value), key, toBeMaced);
+}
+function verifyMacWith(value, toBeMaced, tag, key) {
+  return tagsEqual(macWith(value, toBeMaced, key), tag);
+}
+function tagSizeOf(value) {
+  if (value.tagSize === null)
+    throw new CoseError(`The COSE algorithm '${value.name}' does not define an authentication tag width!`);
+  return value.tagSize;
+}
+function verifyWith(value, keyCurve, toBeSigned, signature, publicKey) {
+  switch (value.family) {
+    case "ecdsa":
+      return verify(
+        resolveCurve(value, keyCurve),
+        signature,
+        digest(hashOf(value), toBeSigned),
+        publicKey
+      );
+    case "eddsa":
+      return eddsaVerify(resolveCurve(value, keyCurve), signature, toBeSigned, publicKey);
+    case "mldsa":
+      return mldsaVerify(parameterSetOf(value), signature, toBeSigned, publicKey);
+    default:
+      throw new CoseError(`The COSE algorithm '${value.name}' is not a signature algorithm this implementation supports!`);
+  }
+}
+
+// src/headers.ts
+var CoseHeaders = class _CoseHeaders {
+  /** The header parameters, in the order they were given or read. */
+  parameters;
+  constructor(parameters = []) {
+    this.parameters = [...parameters];
+    for (let index = 0; index < this.parameters.length; index++) {
+      for (let other = 0; other < index; other++) {
+        if (sameLabel(this.parameters[index][0], this.parameters[other][0]))
+          throw new CoseError(`The COSE header parameter '${headerLabelName(this.parameters[index][0])}' was given more than once!`);
+      }
+    }
+  }
+  /**
+   * A bucket without any header parameters. As a protected bucket it is
+   * serialized as a zero-length byte string.
+   */
+  static empty = new _CoseHeaders();
+  /** How many header parameters this bucket holds. */
+  get count() {
+    return this.parameters.length;
+  }
+  /** Whether this bucket has no header parameters at all. */
+  get isEmpty() {
+    return this.parameters.length === 0;
+  }
+  /**
+   * The bucket holding the two header parameters almost every signed COSE
+   * message uses.
+   */
+  static create(algorithm2, keyIdentifier) {
+    const parameters = [];
+    if (algorithm2 !== void 0 && algorithm2 !== null)
+      parameters.push([label(HeaderLabel.algorithm), algorithmToCbor(algorithm2)]);
+    if (keyIdentifier !== void 0 && keyIdentifier !== null)
+      parameters.push([label(HeaderLabel.keyIdentifier), cbor.bytes(keyIdentifier)]);
+    return new _CoseHeaders(parameters);
+  }
+  /** Parse the given CBOR map as a bucket of header parameters. */
+  static parse(value) {
+    if (value.type !== "map")
+      throw new CoseError(`A bucket of COSE header parameters must be a CBOR map, but was a CBOR ${value.type}!`);
+    return new _CoseHeaders(value.entries);
+  }
+  /**
+   * Parse the serialized protected bucket of a COSE message.
+   *
+   * A zero-length byte string is an empty bucket and *not* an encoded empty
+   * map. It is the one encoding that must never be "repaired" into `A0`,
+   * because the signature covers these exact bytes [RFC 9052, Section 3].
+   *
+   * This is deliberately a separate function rather than an overload: a byte
+   * array is also a perfectly good CBOR byte string, and the two readings of
+   * the same argument mean very different things here.
+   */
+  static parseProtected(protectedBytes) {
+    if (protectedBytes.length === 0)
+      return _CoseHeaders.empty;
+    return _CoseHeaders.parse(decode(protectedBytes));
+  }
+  /** The value of the given header parameter, or null. */
+  get(labelValue) {
+    for (const [key, value] of this.parameters) {
+      if (sameLabel(key, labelValue))
+        return value;
+    }
+    return null;
+  }
+  /** Whether the given header parameter is present within this bucket. */
+  has(labelValue) {
+    return this.get(labelValue) !== null;
+  }
+  /**
+   * Return a copy in which the given header parameter is set, replacing it
+   * in place when it is already present and appending it otherwise.
+   */
+  set(labelValue, value) {
+    const updated = [];
+    let replaced = false;
+    for (const entry of this.parameters) {
+      if (sameLabel(entry[0], labelValue)) {
+        updated.push([labelValue, value]);
+        replaced = true;
+      } else
+        updated.push(entry);
+    }
+    if (!replaced)
+      updated.push([labelValue, value]);
+    return new _CoseHeaders(updated);
+  }
+  /** The cryptographic algorithm (label 1), or null when absent. */
+  get algorithm() {
+    const value = this.get(label(HeaderLabel.algorithm));
+    if (value?.type !== "int")
+      return null;
+    return algorithmFromCbor(value);
+  }
+  /** The key identifier (label 4), or null when absent or not a byte string. */
+  get keyIdentifier() {
+    const value = this.get(label(HeaderLabel.keyIdentifier));
+    return value !== null && value.type === "bytes" ? value.value : null;
+  }
+  /** The content type (label 3), or null when absent. */
+  get contentType() {
+    return this.get(label(HeaderLabel.contentType));
+  }
+  /** The labels a recipient is required to understand (label 2), or null. */
+  get critical() {
+    const value = this.get(label(HeaderLabel.critical));
+    return value !== null && value.type === "array" ? value.items : null;
+  }
+  /** A CBOR map holding these header parameters, in their own order. */
+  toCbor() {
+    return cbor.map(this.parameters);
+  }
+  /**
+   * The serialization of this bucket for use as the PROTECTED bucket of a
+   * COSE message: a zero-length byte string when the bucket is empty, and
+   * the encoded map otherwise [RFC 9052, Section 3].
+   *
+   * These are the exact bytes a signature is computed over, so they have to
+   * be transmitted and stored verbatim.
+   */
+  toProtectedBytes() {
+    return this.isEmpty ? NO_BYTES : encode(this.toCbor());
+  }
+};
+function verifyCriticalHeaderParameters(protectedHeader, unprotectedHeader, alsoUnderstood = []) {
+  if (unprotectedHeader.has(label(HeaderLabel.critical)))
+    return notVerified('The "crit" header parameter must be placed within the protected header bucket!');
+  const critical = protectedHeader.critical;
+  if (critical === null) {
+    if (protectedHeader.has(label(HeaderLabel.critical)))
+      return notVerified('The "crit" header parameter must be an array of header parameter labels!');
+    return VERIFIED;
+  }
+  if (critical.length === 0)
+    return notVerified('The "crit" header parameter must list at least one header parameter label!');
+  for (const each of critical) {
+    if (!protectedHeader.has(each))
+      return notVerified(`The "crit" header parameter lists '${headerLabelName(each)}', which is not present within the protected header bucket!`);
+    if (!isUnderstood(each) && !alsoUnderstood.some((other) => sameLabel(other, each)))
+      return notVerified(`The "crit" header parameter demands that '${headerLabelName(each)}' be understood, which this implementation does not!`);
+  }
+  return VERIFIED;
+}
+
+// src/key.ts
+var KEY_TYPE_AKP = 7;
+var KEY_TYPE_SYMMETRIC = 4;
+var KeyLabel = {
+  keyType: 1,
+  keyIdentifier: 2,
+  algorithm: 3,
+  keyOperations: 4,
+  // EC2 and OKP.
+  curve: -1,
+  x: -2,
+  y: -3,
+  d: -4,
+  // AKP [RFC 9964] — note the collision with the two above.
+  pub: -1,
+  priv: -2,
+  // Symmetric [RFC 9053, Section 7.3] — and that is label −1 meaning a
+  // third thing: the curve on an EC2 or OKP key, the public key on an AKP
+  // one, and here the shared secret itself.
+  k: -1
+};
+function padded(value, width, what) {
+  if (value.length === width)
+    return value;
+  if (value.length > width) {
+    const excess = value.length - width;
+    for (let index = 0; index < excess; index++) {
+      if (value[index] !== 0)
+        throw new CoseError(`The ${what} of a COSE key must be ${String(width)} bytes wide, but a ${String(value.length)}-byte value was given that does not fit!`);
+    }
+    return value.slice(excess);
+  }
+  const result = new Uint8Array(width);
+  result.set(value, width - value.length);
+  return result;
+}
+var CoseKey = class _CoseKey {
+  keyType;
+  keyIdentifier;
+  algorithm;
+  keyOperations;
+  /** The curve identifier as it travels, also when it is not registered. */
+  curveId;
+  /** EC2 and OKP: the coordinates and the private scalar. */
+  x;
+  y;
+  d;
+  /** AKP: the public key, and the private key — which is always the seed. */
+  pub;
+  priv;
+  /** Symmetric: the shared secret. There is no public half of one. */
+  k;
+  /** Header parameters this implementation does not know, kept for the round trip. */
+  additional;
+  constructor(fields) {
+    this.keyType = fields.keyType;
+    this.keyIdentifier = fields.keyIdentifier;
+    this.algorithm = fields.algorithm;
+    this.keyOperations = fields.keyOperations;
+    this.curveId = fields.curveId;
+    this.x = fields.x;
+    this.y = fields.y;
+    this.d = fields.d;
+    this.pub = fields.pub;
+    this.priv = fields.priv;
+    this.k = fields.k;
+    this.additional = fields.additional;
+  }
+  get fields() {
+    return {
+      keyType: this.keyType,
+      keyIdentifier: this.keyIdentifier,
+      algorithm: this.algorithm,
+      keyOperations: this.keyOperations,
+      curveId: this.curveId,
+      x: this.x,
+      y: this.y,
+      d: this.d,
+      pub: this.pub,
+      priv: this.priv,
+      k: this.k,
+      additional: this.additional
+    };
+  }
+  copy(overrides) {
+    return new _CoseKey({ ...this.fields, ...overrides });
+  }
+  /** The curve of this key, or null when it names none or an unregistered one. */
+  get curve() {
+    return this.curveId === null ? null : curveById(this.curveId);
+  }
+  /**
+   * Whether this key carries secret key material.
+   *
+   * A symmetric key is *always* secret — it has nothing else — which is why
+   * `k` counts here beside the two private halves.
+   */
+  get isPrivate() {
+    return this.d !== null || this.priv !== null || this.k !== null;
+  }
+  /**
+   * An elliptic curve key pair from its private scalar.
+   *
+   * The public point is recomputed rather than asked for, which is what the
+   * examples of RFC 9052 do as well: a private COSE key always carries the
+   * full pair, and the two halves cannot disagree.
+   */
+  static fromPrivateScalar(curve2, d, parts = {}) {
+    if (curve2.keyType === KEY_TYPE_OKP)
+      return _CoseKey.fromOkpPrivateKey(curve2, d, parts);
+    const scalar = padded(d, curve2.orderSize ?? d.length, "private key");
+    const uncompressed = publicKeyFor(curve2, scalar);
+    const fieldSize = curve2.fieldSize ?? 0;
+    return new _CoseKey({
+      ...empty(curve2.keyType, parts),
+      curveId: curve2.id,
+      x: uncompressed.slice(1, 1 + fieldSize),
+      y: uncompressed.slice(1 + fieldSize),
+      d: scalar
+    });
+  }
+  /**
+   * An octet key pair from its private key.
+   *
+   * There is no `y`: an EdDSA public key is the whole of `x`.
+   */
+  static fromOkpPrivateKey(curve2, d, parts = {}) {
+    const width = curve2.orderSize ?? d.length;
+    if (d.length !== width)
+      throw new CoseError(`The private key of a COSE key on the curve '${curve2.name}' must be ${String(width)} bytes long, but was ${String(d.length)} bytes long!`);
+    return new _CoseKey({
+      ...empty(KEY_TYPE_OKP, parts),
+      curveId: curve2.id,
+      x: eddsaPublicKeyFor(curve2, d),
+      d
+    });
+  }
+  /**
+   * An algorithm key pair from its seed.
+   *
+   * The private key of an ML-DSA COSE key is the 32-byte seed and nothing
+   * else [RFC 9964] — not the expanded secret key, which is up to 4896 bytes
+   * and derivable from it. The algorithm is not optional here: an ML-DSA
+   * public key does not say which parameter set produced it, so a key that
+   * did not name one could not be used, and could not even be identified,
+   * since its thumbprint covers the algorithm.
+   */
+  static fromAkpSeed(algorithm2, seed, parts = {}) {
+    if (algorithm2.parameterSet === null)
+      throw new CoseError(`The COSE algorithm '${algorithm2.name}' is not an algorithm key pair algorithm!`);
+    if (seed.length !== MLDSA_SEED_SIZE)
+      throw new CoseError(`The private key of an algorithm key pair is the seed and must be ${String(MLDSA_SEED_SIZE)} bytes long [RFC 9964], but was ${String(seed.length)} bytes long!`);
+    return new _CoseKey({
+      ...empty(KEY_TYPE_AKP, { ...parts, algorithm: algorithm2 }),
+      pub: mldsaPublicKeyFor(algorithm2.parameterSet, seed),
+      priv: seed
+    });
+  }
+  /**
+   * A public algorithm key pair, from the public key alone.
+   *
+   * This is the form a certificate hands over: a `SubjectPublicKeyInfo`
+   * carries the public key and names the parameter set in its algorithm
+   * identifier, and there is no seed to be had. The algorithm is required
+   * for the same reason as in {@link fromAkpSeed} — the bytes do not say
+   * which parameter set produced them, and the thumbprint covers `alg`.
+   */
+  static fromAkpPublicKey(algorithm2, pub, parts = {}) {
+    if (algorithm2.parameterSet === null)
+      throw new CoseError(`The COSE algorithm '${algorithm2.name}' is not an algorithm key pair algorithm!`);
+    const expected = MLDSA_SIZES[algorithm2.parameterSet].publicKey;
+    if (pub.length !== expected)
+      throw new CoseError(`The public key of an '${algorithm2.name}' algorithm key pair must be ${String(expected)} bytes long, but was ${String(pub.length)} bytes long!`);
+    return new _CoseKey({
+      ...empty(KEY_TYPE_AKP, { ...parts, algorithm: algorithm2 }),
+      pub
+    });
+  }
+  /**
+   * A symmetric key, which is a shared secret and nothing else.
+   *
+   * No length is enforced. RFC 9053 says an HMAC key SHOULD be as wide as
+   * the hash output, which is advice about key management rather than a rule
+   * about the primitive — RFC 2104 accepts any width and the published test
+   * vectors of RFC 4231 include a four-byte key. What a caller must not do
+   * is derive one from a password, and no length check would catch that.
+   */
+  static fromSymmetricKey(k, parts = {}) {
+    if (k.length === 0)
+      throw new CoseError("A symmetric COSE key must carry a key value!");
+    return new _CoseKey({
+      ...empty(KEY_TYPE_SYMMETRIC, parts),
+      k
+    });
+  }
+  /** A public octet key pair, which is the whole of `x` and nothing else. */
+  static fromOkpPublicKey(curve2, x, parts = {}) {
+    return new _CoseKey({
+      ...empty(KEY_TYPE_OKP, parts),
+      curveId: curve2.id,
+      x
+    });
+  }
+  /** A public elliptic curve key from its coordinates. */
+  static fromCoordinates(curve2, x, y, parts = {}) {
+    const width = curve2.fieldSize ?? x.length;
+    return new _CoseKey({
+      ...empty(curve2.keyType, parts),
+      curveId: curve2.id,
+      x: padded(x, width, "x coordinate"),
+      y: padded(y, width, "y coordinate")
+    });
+  }
+  /**
+   * Parse a COSE key.
+   *
+   * Widths are deliberately not checked here — only that the CBOR types are
+   * what they claim to be. A key with a shortened coordinate is a real key
+   * that a real implementation produced, and reading it is how one finds out
+   * that it is wrong; the refusal belongs at the point where the key would
+   * be used, where the error can say what was expected.
+   *
+   * A duplicate label takes its last value, which is what a lenient CBOR map
+   * does everywhere else in COSE.
+   */
+  static parse(input) {
+    const value = input instanceof Uint8Array ? decode(input) : input;
+    if (value.type !== "map")
+      throw new CoseError(`A COSE key must be a CBOR map, but was a CBOR ${value.type}!`);
+    const keyType = _CoseKey.readKeyType(value.entries);
+    if (keyType === KEY_TYPE_AKP)
+      return _CoseKey.parseAkp(value.entries, keyType);
+    if (keyType === KEY_TYPE_SYMMETRIC)
+      return _CoseKey.parseSymmetric(value.entries, keyType);
+    return _CoseKey.parseCurveKey(value.entries, keyType);
+  }
+  static readKeyType(entries) {
+    for (const [key, item] of entries) {
+      if (key.type === "int" && Number(key.value) === KeyLabel.keyType) {
+        if (item.type !== "int")
+          throw new CoseError("The key type of a COSE key must be an integer!");
+        return Number(item.value);
+      }
+    }
+    throw new CoseError("A COSE key must have a key type!");
+  }
+  static parseCurveKey(entries, keyType) {
+    let keyIdentifier = null;
+    let algorithm2 = null;
+    let keyOperations = null;
+    let curveId = null;
+    let x = null;
+    let yValue = null;
+    let d = null;
+    const additional = [];
+    for (const [key, item] of entries) {
+      if (key.type !== "int") {
+        additional.push([key, item]);
+        continue;
+      }
+      switch (Number(key.value)) {
+        case KeyLabel.keyType:
+          break;
+        case KeyLabel.keyIdentifier:
+          keyIdentifier = bytesOf(item, "The key identifier of a COSE key");
+          break;
+        case KeyLabel.algorithm:
+          algorithm2 = algorithmFromCbor(item);
+          break;
+        case KeyLabel.keyOperations:
+          if (item.type !== "array")
+            throw new CoseError("The key operations of a COSE key must be an array!");
+          keyOperations = item;
+          break;
+        case KeyLabel.curve:
+          if (item.type !== "int")
+            throw new CoseError("The curve of a COSE key must be an integer!");
+          curveId = Number(item.value);
+          break;
+        case KeyLabel.x:
+          x = bytesOf(item, "The x coordinate of a COSE key");
+          break;
+        case KeyLabel.y:
+          yValue = item;
+          break;
+        case KeyLabel.d:
+          d = bytesOf(item, "The private key of a COSE key");
+          break;
+        default:
+          additional.push([key, item]);
+      }
+    }
+    return new _CoseKey({
+      keyType,
+      keyIdentifier,
+      algorithm: algorithm2,
+      keyOperations,
+      curveId,
+      x,
+      y: _CoseKey.resolveY(yValue, x, curveId),
+      d,
+      pub: null,
+      priv: null,
+      k: null,
+      additional
+    });
+  }
+  static parseSymmetric(entries, keyType) {
+    let keyIdentifier = null;
+    let algorithm2 = null;
+    let keyOperations = null;
+    let k = null;
+    const additional = [];
+    for (const [key, item] of entries) {
+      if (key.type !== "int") {
+        additional.push([key, item]);
+        continue;
+      }
+      switch (Number(key.value)) {
+        case KeyLabel.keyType:
+          break;
+        case KeyLabel.keyIdentifier:
+          keyIdentifier = bytesOf(item, "The key identifier of a COSE key");
+          break;
+        case KeyLabel.algorithm:
+          algorithm2 = algorithmFromCbor(item);
+          break;
+        case KeyLabel.keyOperations:
+          if (item.type !== "array")
+            throw new CoseError("The key operations of a COSE key must be an array!");
+          keyOperations = item;
+          break;
+        case KeyLabel.k:
+          k = bytesOf(item, "The key value of a symmetric COSE key");
+          break;
+        default:
+          additional.push([key, item]);
+          break;
+      }
+    }
+    if (k === null)
+      throw new CoseError("A COSE key of key type Symmetric must carry its key value [RFC 9053, Section 7.3]!");
+    return new _CoseKey({
+      keyType,
+      keyIdentifier,
+      algorithm: algorithm2,
+      keyOperations,
+      curveId: null,
+      x: null,
+      y: null,
+      d: null,
+      pub: null,
+      priv: null,
+      k,
+      additional
+    });
+  }
+  static parseAkp(entries, keyType) {
+    let keyIdentifier = null;
+    let algorithm2 = null;
+    let keyOperations = null;
+    let pub = null;
+    let priv = null;
+    const additional = [];
+    for (const [key, item] of entries) {
+      if (key.type !== "int") {
+        additional.push([key, item]);
+        continue;
+      }
+      switch (Number(key.value)) {
+        case KeyLabel.keyType:
+          break;
+        case KeyLabel.keyIdentifier:
+          keyIdentifier = bytesOf(item, "The key identifier of a COSE key");
+          break;
+        case KeyLabel.algorithm:
+          algorithm2 = algorithmFromCbor(item);
+          break;
+        case KeyLabel.keyOperations:
+          if (item.type !== "array")
+            throw new CoseError("The key operations of a COSE key must be an array!");
+          keyOperations = item;
+          break;
+        case KeyLabel.pub:
+          pub = bytesOf(item, "The public key of an algorithm key pair");
+          break;
+        case KeyLabel.priv:
+          priv = bytesOf(item, "The private key of an algorithm key pair");
+          break;
+        default:
+          additional.push([key, item]);
+      }
+    }
+    return new _CoseKey({
+      keyType,
+      keyIdentifier,
+      algorithm: algorithm2,
+      keyOperations,
+      curveId: null,
+      x: null,
+      y: null,
+      d: null,
+      pub,
+      priv,
+      k: null,
+      additional
+    });
+  }
+  /**
+   * The y coordinate, which may travel as a byte string or as the parity bit
+   * of a compressed point.
+   */
+  static resolveY(value, x, curveId) {
+    if (value === null)
+      return null;
+    if (value.type === "bytes")
+      return value.value;
+    if (value.type === "bool") {
+      const curve2 = curveId === null ? null : curveById(curveId);
+      if (curve2 === null)
+        throw new CoseError("The y coordinate of a COSE key is a sign bit, which needs a known curve to be resolved!");
+      if (x === null)
+        throw new CoseError("The y coordinate of a COSE key is a sign bit, which needs the x coordinate to be resolved!");
+      return decompressY(curve2, x, value.value);
+    }
+    throw new CoseError("The y coordinate of a COSE key must be a byte string or a boolean sign bit!");
+  }
+  /**
+   * A CBOR map holding this key.
+   *
+   * The labels are written in ascending encoded order — 1, 2, 3, 4, −1, −2,
+   * −3, −4 — which happens to be exactly the deterministic order of
+   * RFC 8949 Section 4.2.1, so a canonical re-encoding moves nothing.
+   *
+   * A key whose y arrived as a sign bit does *not* round-trip byte for byte:
+   * y is always written as the byte string form, which every implementation
+   * understands.
+   */
+  toCbor() {
+    const entries = [
+      [cbor.int(KeyLabel.keyType), cbor.int(this.keyType)]
+    ];
+    if (this.keyIdentifier !== null)
+      entries.push([cbor.int(KeyLabel.keyIdentifier), cbor.bytes(this.keyIdentifier)]);
+    if (this.algorithm !== null)
+      entries.push([cbor.int(KeyLabel.algorithm), algorithmToCbor(this.algorithm)]);
+    if (this.keyOperations !== null)
+      entries.push([cbor.int(KeyLabel.keyOperations), this.keyOperations]);
+    if (this.keyType === KEY_TYPE_AKP) {
+      if (this.pub !== null)
+        entries.push([cbor.int(KeyLabel.pub), cbor.bytes(this.pub)]);
+      if (this.priv !== null)
+        entries.push([cbor.int(KeyLabel.priv), cbor.bytes(this.priv)]);
+    } else if (this.keyType === KEY_TYPE_SYMMETRIC) {
+      if (this.k !== null)
+        entries.push([cbor.int(KeyLabel.k), cbor.bytes(this.k)]);
+    } else {
+      if (this.curveId !== null)
+        entries.push([cbor.int(KeyLabel.curve), cbor.int(this.curveId)]);
+      if (this.x !== null)
+        entries.push([cbor.int(KeyLabel.x), cbor.bytes(this.x)]);
+      if (this.y !== null)
+        entries.push([cbor.int(KeyLabel.y), cbor.bytes(this.y)]);
+      if (this.d !== null)
+        entries.push([cbor.int(KeyLabel.d), cbor.bytes(this.d)]);
+    }
+    entries.push(...this.additional);
+    return cbor.map(entries);
+  }
+  /** The CBOR encoding of this key. */
+  toBytes() {
+    return encode(this.toCbor());
+  }
+  /**
+   * This key without its private half.
+   *
+   * A symmetric key has no such form, and saying so is the point rather than
+   * a limitation: RFC 9053 states outright that the structure "does not have
+   * a form that contains only public members". Returning the key unchanged
+   * here — which is what stripping `d` and `priv` from it would do — would
+   * hand a caller the shared secret under a name promising the opposite.
+   */
+  publicKey() {
+    if (this.keyType === KEY_TYPE_SYMMETRIC)
+      throw new CoseError("A COSE key of key type Symmetric has no public half [RFC 9053, Section 7.3]!");
+    return this.copy({ d: null, priv: null });
+  }
+  /** A copy of this key carrying the given algorithm. */
+  withAlgorithm(algorithm2) {
+    return this.copy({ algorithm: algorithm2 });
+  }
+  requireCurve() {
+    if (this.keyType !== KEY_TYPE_EC2 && this.keyType !== KEY_TYPE_OKP)
+      throw new CoseError(`A COSE key of key type ${String(this.keyType)} has no elliptic curve!`);
+    const curve2 = this.curve;
+    if (curve2 === null)
+      throw new CoseError(this.curveId === null ? "This COSE key does not name an elliptic curve!" : `The elliptic curve ${String(this.curveId)} of this COSE key is not registered!`);
+    return curve2;
+  }
+  /**
+   * The public key, in whatever form its key type gives it: `04 ‖ x ‖ y` for
+   * EC2, the whole of `x` for OKP, `pub` for AKP.
+   */
+  publicKeyBytes() {
+    if (this.keyType === KEY_TYPE_SYMMETRIC)
+      throw new CoseError("A COSE key of key type Symmetric has no public key [RFC 9053, Section 7.3]!");
+    if (this.keyType === KEY_TYPE_AKP) {
+      if (this.pub === null)
+        throw new CoseError("This COSE key carries no public key!");
+      return this.pub;
+    }
+    const curve2 = this.requireCurve();
+    const fieldSize = curve2.fieldSize ?? 0;
+    if (this.x === null)
+      throw new CoseError(`A COSE key on the curve '${curve2.name}' needs its public key!`);
+    if (this.keyType === KEY_TYPE_OKP) {
+      if (this.x.length !== fieldSize)
+        throw new CoseError(`The public key of a COSE key on the curve '${curve2.name}' must be ${String(fieldSize)} bytes long, but was ${String(this.x.length)} bytes long!`);
+      return this.x;
+    }
+    if (this.y === null)
+      throw new CoseError(`A COSE key on the curve '${curve2.name}' needs both of its coordinates!`);
+    if (this.x.length !== fieldSize || this.y.length !== fieldSize)
+      throw new CoseError(`The coordinates of a COSE key on the curve '${curve2.name}' must be ${String(fieldSize)} bytes wide, including leading zeroes, but were ${String(this.x.length)} and ${String(this.y.length)} bytes wide!`);
+    const uncompressed = new Uint8Array(1 + 2 * fieldSize);
+    uncompressed[0] = 4;
+    uncompressed.set(this.x, 1);
+    uncompressed.set(this.y, 1 + fieldSize);
+    if (!isOnCurve(curve2, uncompressed))
+      throw new CoseError(`The public key of this COSE key does not lie on the curve '${curve2.name}'!`);
+    return uncompressed;
+  }
+  /**
+   * The secret this key holds: the scalar for EC2 and OKP, the seed for AKP,
+   * the shared key itself for a symmetric one.
+   */
+  privateKeyBytes() {
+    if (this.keyType === KEY_TYPE_SYMMETRIC) {
+      if (this.k === null)
+        throw new CoseError("This COSE key carries no key value!");
+      return this.k;
+    }
+    if (this.keyType === KEY_TYPE_AKP) {
+      if (this.priv === null)
+        throw new CoseError("This COSE key carries no private key material!");
+      if (this.priv.length !== MLDSA_SEED_SIZE)
+        throw new CoseError(`The private key of an algorithm key pair is the seed and must be ${String(MLDSA_SEED_SIZE)} bytes long [RFC 9964], but was ${String(this.priv.length)} bytes long!`);
+      return this.priv;
+    }
+    const curve2 = this.requireCurve();
+    const orderSize = curve2.orderSize ?? 0;
+    if (this.d === null)
+      throw new CoseError("This COSE key carries no private key material!");
+    if (this.d.length !== orderSize)
+      throw new CoseError(`The private key of a COSE key on the curve '${curve2.name}' must be ${String(orderSize)} bytes wide, including leading zeroes, but was ${String(this.d.length)} bytes wide!`);
+    if (this.keyType === KEY_TYPE_EC2 && this.d.every((each) => each === 0))
+      throw new CoseError(`The private key of this COSE key is not within the group order of the curve '${curve2.name}'!`);
+    return this.d;
+  }
+  /**
+   * The input of the COSE Key Thumbprint [RFC 9679, Section 3]: the required
+   * parameters of this key, and nothing else, in deterministic encoding.
+   *
+   * Leaving out the optional parameters is what makes the thumbprint an
+   * identity rather than a checksum — the public and the private half of one
+   * key pair produce the same value, and adding a key identifier does not
+   * change it.
+   *
+   * An AKP key is the exception that proves the rule: its algorithm *is*
+   * required [RFC 9964], because an ML-DSA public key does not say which
+   * parameter set produced it, and two keys of different strengths must not
+   * be able to share an identity.
+   */
+  thumbprintInput() {
+    if (this.keyType === KEY_TYPE_EC2) {
+      if (this.curveId === null || this.x === null || this.y === null)
+        throw new CoseError("The thumbprint of a COSE key of key type EC2 needs its curve and both of its coordinates!");
+      return cbor.encode(cbor.map([
+        [cbor.int(KeyLabel.keyType), cbor.int(this.keyType)],
+        [cbor.int(KeyLabel.curve), cbor.int(this.curveId)],
+        [cbor.int(KeyLabel.x), cbor.bytes(this.x)],
+        [cbor.int(KeyLabel.y), cbor.bytes(this.y)]
+      ]), DETERMINISTIC);
+    }
+    if (this.keyType === KEY_TYPE_OKP) {
+      if (this.curveId === null || this.x === null)
+        throw new CoseError("The thumbprint of a COSE key of key type OKP needs its curve and its public key!");
+      return cbor.encode(cbor.map([
+        [cbor.int(KeyLabel.keyType), cbor.int(this.keyType)],
+        [cbor.int(KeyLabel.curve), cbor.int(this.curveId)],
+        [cbor.int(KeyLabel.x), cbor.bytes(this.x)]
+      ]), DETERMINISTIC);
+    }
+    if (this.keyType === KEY_TYPE_AKP) {
+      if (this.algorithm === null || this.pub === null)
+        throw new CoseError("The thumbprint of a COSE key of key type AKP needs its algorithm and its public key!");
+      return cbor.encode(cbor.map([
+        [cbor.int(KeyLabel.keyType), cbor.int(this.keyType)],
+        [cbor.int(KeyLabel.algorithm), algorithmToCbor(this.algorithm)],
+        [cbor.int(KeyLabel.pub), cbor.bytes(this.pub)]
+      ]), DETERMINISTIC);
+    }
+    if (this.keyType === KEY_TYPE_SYMMETRIC) {
+      if (this.k === null)
+        throw new CoseError("The thumbprint of a COSE key of key type Symmetric needs its key value!");
+      return cbor.encode(cbor.map([
+        [cbor.int(KeyLabel.keyType), cbor.int(this.keyType)],
+        [cbor.int(KeyLabel.k), cbor.bytes(this.k)]
+      ]), DETERMINISTIC);
+    }
+    throw new CoseError(`The thumbprint of a COSE key of key type ${String(this.keyType)} is not implemented!`);
+  }
+  /** The COSE Key Thumbprint [RFC 9679], untruncated. */
+  thumbprint(hash = "sha256") {
+    return digest(hash, this.thumbprintInput());
+  }
+  /**
+   * The leading bytes of the thumbprint, for use as a key identifier.
+   *
+   * Two properties make this worth preferring over a self-chosen prefix.
+   * Everyone holding the public key can recompute it, so no registry is
+   * needed beyond an agreement on its length. And because the thumbprint
+   * covers the curve — or, for an algorithm key pair, the algorithm — a
+   * signer who changes strength necessarily has a different key and
+   * therefore a different identifier: a downgrade under an unchanged
+   * identity is not expressible.
+   */
+  thumbprintKeyIdentifier(length = 8, hash = "sha256") {
+    const value = this.thumbprint(hash);
+    if (length < 1 || length > value.length)
+      throw new CoseError(`A thumbprint key identifier must be between 1 and ${String(value.length)} bytes long, but ${String(length)} bytes were asked for!`);
+    return value.slice(0, length);
+  }
+  /** A copy of this key whose key identifier is its own thumbprint. */
+  withThumbprintKeyIdentifier(length = 8, hash = "sha256") {
+    return this.copy({ keyIdentifier: this.thumbprintKeyIdentifier(length, hash) });
+  }
+};
+function empty(keyType, parts) {
+  return {
+    keyType,
+    keyIdentifier: parts.keyIdentifier ?? null,
+    algorithm: parts.algorithm ?? null,
+    keyOperations: null,
+    curveId: null,
+    x: null,
+    y: null,
+    d: null,
+    pub: null,
+    priv: null,
+    k: null,
+    additional: []
+  };
+}
+function bytesOf(value, what) {
+  if (value.type !== "bytes")
+    throw new CoseError(`${what} must be a byte string!`);
+  return value.value;
+}
+
+// src/signature.ts
+var CoseSignature = class _CoseSignature {
+  /** The serialized protected bucket, exactly as signed and as received. */
+  protectedHeaderBytes;
+  /** The protected header parameters, which this signature covers. */
+  protectedHeader;
+  /** The unprotected header parameters, which it does not. */
+  unprotectedHeader;
+  /** The signature: `r ‖ s`, never DER. */
+  signature;
+  constructor(protectedHeaderBytes, unprotectedHeader, signature) {
+    this.protectedHeaderBytes = protectedHeaderBytes;
+    this.protectedHeader = CoseHeaders.parseProtected(protectedHeaderBytes);
+    this.unprotectedHeader = unprotectedHeader ?? CoseHeaders.empty;
+    this.signature = signature;
+  }
+  /**
+   * The signature algorithm, taken from the protected bucket and only
+   * otherwise from the unprotected one.
+   */
+  get algorithm() {
+    return this.protectedHeader.algorithm ?? this.unprotectedHeader.algorithm;
+  }
+  /** The key identifier, protected bucket first. */
+  get keyIdentifier() {
+    return this.protectedHeader.keyIdentifier ?? this.unprotectedHeader.keyIdentifier;
+  }
+  /** Parse a three-element COSE_Signature. */
+  static parse(value) {
+    if (value.type !== "array")
+      throw new CoseError(`A COSE_Signature must be a CBOR array, but was a CBOR ${value.type}!`);
+    if (value.items.length !== 3)
+      throw new CoseError(`A COSE_Signature must be a CBOR array of 3 elements, but had ${String(value.items.length)} element(s)!`);
+    const [protectedBytes, unprotected, signature] = value.items;
+    if (protectedBytes?.type !== "bytes")
+      throw new CoseError("The protected header bucket of a COSE_Signature must be a byte string!");
+    if (unprotected === void 0)
+      throw new CoseError("A COSE_Signature must carry an unprotected header bucket!");
+    if (signature?.type !== "bytes")
+      throw new CoseError("The signature of a COSE_Signature must be a byte string!");
+    return new _CoseSignature(
+      protectedBytes.value,
+      CoseHeaders.parse(unprotected),
+      signature.value
+    );
+  }
+  /** A CBOR representation of this signature. */
+  toCbor() {
+    return cbor.array([
+      cbor.bytes(this.protectedHeaderBytes),
+      this.unprotectedHeader.toCbor(),
+      cbor.bytes(this.signature)
+    ]);
+  }
+  /** The CBOR encoding of this signature. */
+  toBytes() {
+    return encode(this.toCbor());
+  }
+};
+
+// src/resolve.ts
+function resolveAlgorithm(protectedHeader, unprotectedHeader, expected, what) {
+  const algorithm2 = expected ?? protectedHeader.algorithm;
+  if (algorithm2 === null) {
+    const stated2 = unprotectedHeader.algorithm;
+    return {
+      ok: false,
+      reason: stated2 !== null ? `${what} states its algorithm '${stated2.name}' within the unprotected header bucket only, where it is not covered by the signature: pass the expected algorithm explicitly in order to accept it!` : `${what} does not state its signature algorithm: pass the expected algorithm explicitly!`
+    };
+  }
+  const stated = protectedHeader.algorithm ?? unprotectedHeader.algorithm;
+  if (stated !== null && !sameAlgorithm(stated, algorithm2))
+    return {
+      ok: false,
+      reason: `${what} was signed with the algorithm '${stated.name}', but the algorithm '${algorithm2.name}' was expected!`
+    };
+  return { ok: true, value: algorithm2 };
+}
+function resolvePayload(carried, detached, what) {
+  if (carried !== null) {
+    if (detached !== null)
+      return { ok: false, reason: `${what} carries its payload, therefore no detached payload must be supplied!` };
+    return { ok: true, value: carried };
+  }
+  if (detached === null)
+    return { ok: false, reason: `The payload of ${what} is detached, therefore it must be supplied for the signature to be computed!` };
+  return { ok: true, value: detached };
+}
+
+// src/asn1.ts
+var Tag = {
+  boolean: 1,
+  integer: 2,
+  bitString: 3,
+  octetString: 4,
+  null: 5,
+  objectIdentifier: 6,
+  utf8String: 12,
+  printableString: 19,
+  teletexString: 20,
+  ia5String: 22,
+  utcTime: 23,
+  generalizedTime: 24,
+  bmpString: 30,
+  universalString: 28,
+  sequence: 48,
+  set: 49
+};
+var contextTag = (number) => 160 | number;
+var STRING_TAGS = [
+  Tag.utf8String,
+  Tag.printableString,
+  Tag.teletexString,
+  Tag.ia5String,
+  Tag.bmpString,
+  Tag.universalString
+];
+var DerReader = class {
+  data;
+  what;
+  at;
+  constructor(data, what) {
+    this.data = data;
+    this.what = what;
+    this.at = 0;
+  }
+  /** Whether every record has been read. */
+  get atEnd() {
+    return this.at >= this.data.length;
+  }
+  /** The octets not yet read. */
+  get remaining() {
+    return this.data.subarray(this.at);
+  }
+  fail(reason) {
+    throw new CoseError(`${this.what}: ${reason}`);
+  }
+  /**
+   * Read the next record, optionally insisting on a tag.
+   *
+   * The length rules are DER's: definite always, short form below 128,
+   * long form minimally encoded and never longer than eight octets — which
+   * is far more than a certificate can need and still shorter than the point
+   * where a length stops fitting a JavaScript number.
+   */
+  read(expectedTag) {
+    const start = this.at;
+    if (this.at + 2 > this.data.length)
+      this.fail(`a DER record needs at least two octets, and only ${String(this.data.length - this.at)} remain`);
+    const tag = this.data[this.at++];
+    if ((tag & 31) === 31)
+      this.fail("a DER identifier of more than one octet is not something a certificate contains");
+    if (expectedTag !== void 0 && tag !== expectedTag)
+      this.fail(`expected the DER tag 0x${expectedTag.toString(16).padStart(2, "0")}, but found 0x${tag.toString(16).padStart(2, "0")}`);
+    const first = this.data[this.at++];
+    let length;
+    if (first === 128)
+      this.fail("an indefinite length is BER, not DER, and a certificate is DER");
+    else if (first === 255)
+      this.fail("0xFF is not a valid DER length octet");
+    else if (first < 128)
+      length = first;
+    else {
+      const count = first & 127;
+      if (count > 8)
+        this.fail(`a length of ${String(count)} octets is longer than anything a certificate can hold`);
+      if (this.at + count > this.data.length)
+        this.fail("the long-form length runs past the end of the data");
+      if (this.data[this.at] === 0)
+        this.fail("a DER length must not be encoded with a leading zero octet");
+      length = 0;
+      for (let index = 0; index < count; index++)
+        length = length * 256 + this.data[this.at++];
+      if (length < 128)
+        this.fail(`the length ${String(length)} must be encoded in the short form`);
+      if (!Number.isSafeInteger(length))
+        this.fail("the length is larger than this implementation can address");
+    }
+    if (this.at + length > this.data.length)
+      this.fail(`a record claims ${String(length)} octets, and only ${String(this.data.length - this.at)} remain`);
+    const content = this.data.subarray(this.at, this.at + length);
+    this.at += length;
+    return { tag, content, encoded: this.data.subarray(start, this.at) };
+  }
+  /** Read the next record when it carries the given tag, else read nothing. */
+  readOptional(tag) {
+    if (this.atEnd || this.data[this.at] !== tag)
+      return null;
+    return this.read(tag);
+  }
+  /** Whether a record with the given tag comes next. */
+  peekIs(tag) {
+    return !this.atEnd && this.data[this.at] === tag;
+  }
+  /** Insist that nothing follows, which is how trailing data is caught. */
+  expectEnd() {
+    if (!this.atEnd)
+      this.fail(`${String(this.data.length - this.at)} octets follow the structure and should not`);
+  }
+};
+var contentsOf = (node, what) => new DerReader(node.content, what);
+function derInteger(node, what) {
+  const bytes = node.content;
+  if (bytes.length === 0)
+    throw new CoseError(`${what}: a DER INTEGER must not be empty`);
+  if (bytes.length > 1 && (bytes[0] === 0 && (bytes[1] & 128) === 0 || bytes[0] === 255 && (bytes[1] & 128) !== 0))
+    throw new CoseError(`${what}: a DER INTEGER must be minimally encoded`);
+  let value = 0n;
+  for (const each of bytes)
+    value = value << 8n | BigInt(each);
+  return (bytes[0] & 128) === 0 ? value : value - (1n << BigInt(8 * bytes.length));
+}
+function derBitString(node, what) {
+  const { unusedBits, bytes } = derBitStringRaw(node, what);
+  if (unusedBits !== 0)
+    throw new CoseError(`${what}: expected an octet-aligned BIT STRING, but ${String(unusedBits)} bits are unused`);
+  return bytes;
+}
+function derBitStringRaw(node, what) {
+  if (node.content.length === 0)
+    throw new CoseError(`${what}: a DER BIT STRING needs at least its unused-bit count`);
+  const unusedBits = node.content[0];
+  if (unusedBits > 7)
+    throw new CoseError(`${what}: a DER BIT STRING can not have ${String(unusedBits)} unused bits`);
+  if (unusedBits !== 0 && node.content.length === 1)
+    throw new CoseError(`${what}: an empty DER BIT STRING must declare zero unused bits`);
+  return { unusedBits, bytes: node.content.subarray(1) };
+}
+function derBoolean(node, what) {
+  if (node.content.length !== 1)
+    throw new CoseError(`${what}: a DER BOOLEAN is one octet`);
+  if (node.content[0] === 0)
+    return false;
+  if (node.content[0] === 255)
+    return true;
+  throw new CoseError(`${what}: a DER BOOLEAN is 0x00 or 0xFF, but was 0x${node.content[0].toString(16).padStart(2, "0")}`);
+}
+function derObjectIdentifier(node, what) {
+  const bytes = node.content;
+  if (bytes.length === 0)
+    throw new CoseError(`${what}: a DER OBJECT IDENTIFIER must not be empty`);
+  const arcs = [];
+  let value = 0n;
+  let started = false;
+  for (let index = 0; index < bytes.length; index++) {
+    const octet = bytes[index];
+    if (!started && octet === 128)
+      throw new CoseError(`${what}: an arc of a DER OBJECT IDENTIFIER must be minimally encoded`);
+    started = true;
+    value = value << 7n | BigInt(octet & 127);
+    if ((octet & 128) !== 0) {
+      if (index === bytes.length - 1)
+        throw new CoseError(`${what}: a DER OBJECT IDENTIFIER ends in the middle of an arc`);
+      continue;
+    }
+    if (arcs.length === 0) {
+      const first = value < 40n ? 0n : value < 80n ? 1n : 2n;
+      arcs.push(first.toString());
+      arcs.push((value - first * 40n).toString());
+    } else
+      arcs.push(value.toString());
+    value = 0n;
+    started = false;
+  }
+  return arcs.join(".");
+}
+function derString(node, what) {
+  if (!STRING_TAGS.includes(node.tag))
+    throw new CoseError(`${what}: 0x${node.tag.toString(16).padStart(2, "0")} is not a string type an X.509 name may use`);
+  if (node.tag === Tag.bmpString)
+    return decodeWide(node.content, 2, what);
+  if (node.tag === Tag.universalString)
+    return decodeWide(node.content, 4, what);
+  if (node.tag === Tag.teletexString)
+    return Array.from(node.content, (each) => String.fromCharCode(each)).join("");
+  try {
+    return new TextDecoder("utf-8", { fatal: true }).decode(node.content);
+  } catch {
+    throw new CoseError(`${what}: the content is not valid UTF-8`);
+  }
+}
+function decodeWide(bytes, width, what) {
+  if (bytes.length % width !== 0)
+    throw new CoseError(`${what}: a ${String(width * 8)}-bit string must be a whole number of characters`);
+  let text = "";
+  for (let index = 0; index < bytes.length; index += width) {
+    let point = 0;
+    for (let byte = 0; byte < width; byte++)
+      point = point * 256 + bytes[index + byte];
+    if (point > 1114111)
+      throw new CoseError(`${what}: 0x${point.toString(16)} is not a Unicode code point`);
+    text += String.fromCodePoint(point);
+  }
+  return text;
+}
+function derTime(node, what) {
+  const text = Array.from(node.content, (each) => String.fromCharCode(each)).join("");
+  if (node.tag === Tag.utcTime) {
+    const match = /^(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})Z$/.exec(text);
+    if (match === null)
+      throw new CoseError(`${what}: '${text}' is not a DER UTCTime of the form YYMMDDHHMMSSZ`);
+    const year = Number(match[1]);
+    return utc(
+      year >= 50 ? 1900 + year : 2e3 + year,
+      Number(match[2]),
+      Number(match[3]),
+      Number(match[4]),
+      Number(match[5]),
+      Number(match[6]),
+      text,
+      what
+    );
+  }
+  if (node.tag === Tag.generalizedTime) {
+    const match = /^(\d{4})(\d{2})(\d{2})(\d{2})(\d{2})(\d{2})Z$/.exec(text);
+    if (match === null)
+      throw new CoseError(`${what}: '${text}' is not a DER GeneralizedTime of the form YYYYMMDDHHMMSSZ`);
+    return utc(
+      Number(match[1]),
+      Number(match[2]),
+      Number(match[3]),
+      Number(match[4]),
+      Number(match[5]),
+      Number(match[6]),
+      text,
+      what
+    );
+  }
+  throw new CoseError(`${what}: 0x${node.tag.toString(16).padStart(2, "0")} is not a time type`);
+}
+function utc(year, month, day, hour, minute, second, text, what) {
+  const value = new Date(Date.UTC(year, month - 1, day, hour, minute, second));
+  if (value.getUTCFullYear() !== year || value.getUTCMonth() !== month - 1 || value.getUTCDate() !== day || value.getUTCHours() !== hour || value.getUTCMinutes() !== minute || value.getUTCSeconds() !== second)
+    throw new CoseError(`${what}: '${text}' is not a point in time that exists`);
+  return value;
+}
+
+// src/x509.ts
+var CURVE_OIDS = {
+  "1.2.840.10045.3.1.7": CoseCurves.P256,
+  // prime256v1
+  "1.3.132.0.34": CoseCurves.P384,
+  // secp384r1
+  "1.3.132.0.35": CoseCurves.P521,
+  // secp521r1
+  "1.3.132.0.10": CoseCurves.secp256k1,
+  "1.3.36.3.3.2.8.1.1.7": CoseCurves.brainpoolP256r1,
+  // [RFC 5639, Appendix A]
+  "1.3.36.3.3.2.8.1.1.9": CoseCurves.brainpoolP320r1,
+  "1.3.36.3.3.2.8.1.1.11": CoseCurves.brainpoolP384r1,
+  "1.3.36.3.3.2.8.1.1.13": CoseCurves.brainpoolP512r1
+};
+var OID_EC_PUBLIC_KEY = "1.2.840.10045.2.1";
+var OID_ED25519 = "1.3.101.112";
+var OID_ED448 = "1.3.101.113";
+var OID_MLDSA44 = "2.16.840.1.101.3.4.3.17";
+var OID_MLDSA65 = "2.16.840.1.101.3.4.3.18";
+var OID_MLDSA87 = "2.16.840.1.101.3.4.3.19";
+var SIGNATURE_OIDS = {
+  "1.2.840.10045.4.3.2": CoseAlgorithms.ES256,
+  // ecdsa-with-SHA256
+  "1.2.840.10045.4.3.3": CoseAlgorithms.ES384,
+  // ecdsa-with-SHA384
+  "1.2.840.10045.4.3.4": CoseAlgorithms.ES512,
+  // ecdsa-with-SHA512
+  [OID_ED25519]: CoseAlgorithms.Ed25519,
+  [OID_ED448]: CoseAlgorithms.Ed448,
+  [OID_MLDSA44]: CoseAlgorithms.MLDSA44,
+  [OID_MLDSA65]: CoseAlgorithms.MLDSA65,
+  [OID_MLDSA87]: CoseAlgorithms.MLDSA87
+};
+var NAME_OIDS = {
+  "2.5.4.3": "CN",
+  "2.5.4.4": "SN",
+  "2.5.4.5": "SERIALNUMBER",
+  "2.5.4.6": "C",
+  "2.5.4.7": "L",
+  "2.5.4.8": "ST",
+  "2.5.4.9": "STREET",
+  "2.5.4.10": "O",
+  "2.5.4.11": "OU",
+  "2.5.4.12": "T",
+  "2.5.4.42": "GIVENNAME",
+  "1.2.840.113549.1.9.1": "E",
+  "0.9.2342.19200300.100.1.25": "DC",
+  "0.9.2342.19200300.100.1.1": "UID"
+};
+var OID_BASIC_CONSTRAINTS = "2.5.29.19";
+var OID_KEY_USAGE = "2.5.29.15";
+var X509Name = class _X509Name {
+  /** The attributes, outermost relative name first, as they were encoded. */
+  attributes;
+  /** The DER encoding, kept because a name is also compared by its bytes. */
+  encoded;
+  constructor(attributes, encoded) {
+    this.attributes = attributes;
+    this.encoded = encoded;
+  }
+  /** Parse an X.501 `Name`, which is a `SEQUENCE OF SET OF` attributes. */
+  static parse(node, what) {
+    const attributes = [];
+    const relatives = contentsOf(node, `${what}: the relative distinguished names`);
+    while (!relatives.atEnd) {
+      const set = relatives.read(Tag.set);
+      const members = contentsOf(set, `${what}: a relative distinguished name`);
+      while (!members.atEnd) {
+        const pair = contentsOf(members.read(Tag.sequence), `${what}: an attribute of the name`);
+        const oid = derObjectIdentifier(pair.read(Tag.objectIdentifier), `${what}: an attribute type`);
+        const value = pair.read();
+        pair.expectEnd();
+        attributes.push({ oid, value: derString(value, `${what}: the value of the attribute ${oid}`) });
+      }
+    }
+    return new _X509Name(attributes, node.encoded);
+  }
+  /**
+   * Whether this name and the given one name the same entity.
+   *
+   * The normalization is the practical part of RFC 4518: leading and
+   * trailing whitespace removed, internal runs collapsed to one space, and
+   * case folded. Not implemented, because no certificate in this project's
+   * world uses them: the Unicode mapping and prohibition tables.
+   */
+  equivalentTo(other) {
+    if (bytesEqual2(this.encoded, other.encoded))
+      return true;
+    if (this.attributes.length !== other.attributes.length)
+      return false;
+    return this.attributes.every((each, index) => each.oid === other.attributes[index].oid && normalize(each.value) === normalize(other.attributes[index].value));
+  }
+  /** The name in the usual `CN=…,O=…` notation. */
+  toString() {
+    return this.attributes.map((each) => `${NAME_OIDS[each.oid] ?? each.oid}=${each.value}`).join(",");
+  }
+};
+var normalize = (value) => value.trim().replace(/\s+/gu, " ").toLowerCase();
+var bytesEqual2 = (left, right) => left.length === right.length && left.every((each, index) => each === right[index]);
+var KeyUsage = {
+  digitalSignature: 0,
+  nonRepudiation: 1,
+  keyEncipherment: 2,
+  dataEncipherment: 3,
+  keyAgreement: 4,
+  keyCertSign: 5,
+  cRLSign: 6,
+  encipherOnly: 7,
+  decipherOnly: 8
+};
+var X509Certificate = class _X509Certificate {
+  /** The DER encoding, exactly as it arrived. */
+  encoded;
+  /** The `tbsCertificate`, which is the part the signature covers. */
+  tbsBytes;
+  /** The version, 1 to 3. */
+  version;
+  /** The serial number, which may be negative and is often very large. */
+  serialNumber;
+  /** Who issued this certificate. */
+  issuer;
+  /** Whom it was issued to. */
+  subject;
+  /** The start of the validity period, inclusive. */
+  notBefore;
+  /** The end of the validity period, inclusive. */
+  notAfter;
+  /** The certified public key. */
+  publicKey;
+  /** How this certificate was signed, as the COSE algorithm it corresponds to. */
+  signatureAlgorithm;
+  /** The signature, as it was encoded — DER for ECDSA, raw otherwise. */
+  signatureValue;
+  /** The `basicConstraints` extension, when present. */
+  basicConstraints;
+  /** The `keyUsage` extension as a bit array, when present. */
+  keyUsage;
+  /** The object identifiers of every extension marked critical. */
+  criticalExtensions;
+  constructor(fields) {
+    this.encoded = fields.encoded;
+    this.tbsBytes = fields.tbsBytes;
+    this.version = fields.version;
+    this.serialNumber = fields.serialNumber;
+    this.issuer = fields.issuer;
+    this.subject = fields.subject;
+    this.notBefore = fields.notBefore;
+    this.notAfter = fields.notAfter;
+    this.publicKey = fields.publicKey;
+    this.signatureAlgorithm = fields.signatureAlgorithm;
+    this.signatureValue = fields.signatureValue;
+    this.basicConstraints = fields.basicConstraints;
+    this.keyUsage = fields.keyUsage;
+    this.criticalExtensions = fields.criticalExtensions;
+  }
+  // ------------------------------------------------------------- parsing
+  /**
+   * Parse a DER encoded certificate.
+   *
+   * The `signatureAlgorithm` of the outer structure and the `signature`
+   * field inside the `tbsCertificate` must agree, and it is checked: they
+   * are the same statement written twice, and an implementation that reads
+   * one while verifying with the other can be told two different things at
+   * once.
+   */
+  static parse(der) {
+    const what = "This X.509 certificate";
+    const outer = new DerReader(der, what);
+    const certificate = outer.read(Tag.sequence);
+    outer.expectEnd();
+    const body = contentsOf(certificate, what);
+    const tbs = body.read(Tag.sequence);
+    const outerAlgorithmNode = body.read(Tag.sequence);
+    const signatureNode = body.read(Tag.bitString);
+    body.expectEnd();
+    const outerAlgorithm = algorithmIdentifier(outerAlgorithmNode, `${what}: the signature algorithm`);
+    const fields = contentsOf(tbs, `${what}: the certificate body`);
+    const versionNode = fields.readOptional(contextTag(0));
+    const version = versionNode === null ? 1 : Number(derInteger(
+      contentsOf(versionNode, `${what}: the version`).read(Tag.integer),
+      `${what}: the version`
+    )) + 1;
+    if (version < 1 || version > 3)
+      throw new CoseError(`${what}: the version v${String(version)} is not one X.509 defines`);
+    const serialNumber = derInteger(fields.read(Tag.integer), `${what}: the serial number`);
+    const innerAlgorithm = algorithmIdentifier(fields.read(Tag.sequence), `${what}: the inner signature algorithm`);
+    const issuer = X509Name.parse(fields.read(Tag.sequence), `${what}: the issuer`);
+    const validity = contentsOf(fields.read(Tag.sequence), `${what}: the validity period`);
+    const notBefore = derTime(validity.read(), `${what}: the start of the validity period`);
+    const notAfter = derTime(validity.read(), `${what}: the end of the validity period`);
+    validity.expectEnd();
+    const subject = X509Name.parse(fields.read(Tag.sequence), `${what}: the subject`);
+    const publicKey = subjectPublicKey(fields.read(Tag.sequence), what);
+    if (outerAlgorithm.oid !== innerAlgorithm.oid)
+      throw new CoseError(`${what}: says it was signed with '${outerAlgorithm.oid}' on the outside and with '${innerAlgorithm.oid}' within the body it signed`);
+    const algorithm2 = SIGNATURE_OIDS[outerAlgorithm.oid];
+    if (algorithm2 === void 0)
+      throw new CoseError(`${what}: was signed with '${outerAlgorithm.oid}', which is not a signature algorithm this implementation knows`);
+    fields.readOptional(129);
+    fields.readOptional(130);
+    const extensionsNode = fields.readOptional(contextTag(3));
+    const extensions = extensionsNode === null ? { basicConstraints: null, keyUsage: null, critical: [] } : parseExtensions(extensionsNode, what);
+    fields.expectEnd();
+    if (extensionsNode !== null && version !== 3)
+      throw new CoseError(`${what}: carries extensions, which only a v3 certificate may`);
+    return new _X509Certificate({
+      encoded: certificate.encoded,
+      tbsBytes: tbs.encoded,
+      version,
+      serialNumber,
+      issuer,
+      subject,
+      notBefore,
+      notAfter,
+      publicKey,
+      signatureAlgorithm: algorithm2,
+      signatureValue: derBitString(signatureNode, `${what}: the signature`),
+      basicConstraints: extensions.basicConstraints,
+      keyUsage: extensions.keyUsage,
+      criticalExtensions: extensions.critical
+    });
+  }
+  // -------------------------------------------------------------- checks
+  /** Whether this certificate is within its validity period at the given instant. */
+  isValidAt(at) {
+    if (at.getTime() < this.notBefore.getTime())
+      return notVerified(`The certificate '${this.subject.toString()}' is not valid before ${iso(this.notBefore)}, and was checked at ${iso(at)}!`);
+    if (at.getTime() > this.notAfter.getTime())
+      return notVerified(`The certificate '${this.subject.toString()}' expired at ${iso(this.notAfter)}, and was checked at ${iso(at)}!`);
+    return VERIFIED;
+  }
+  /** Whether the given key usage bit is set, an absent extension meaning unrestricted. */
+  allows(usage) {
+    if (this.keyUsage === null)
+      return true;
+    return this.keyUsage[usage] ?? false;
+  }
+  /** Whether the certified key may sign other certificates. */
+  get isCertificateAuthority() {
+    return this.basicConstraints?.certificateAuthority ?? false;
+  }
+  /**
+   * Whether this certificate was signed by the given one.
+   *
+   * Both halves are checked and neither implies the other: the issuer field
+   * has to name the candidate's subject, and the signature has to verify
+   * with the candidate's key. A name that matches without a signature is a
+   * claim, and a signature that verifies under a different name is somebody
+   * else's certificate.
+   */
+  verifySignedBy(issuer) {
+    if (!this.issuer.equivalentTo(issuer.subject))
+      return notVerified(`The certificate '${this.subject.toString()}' names the issuer '${this.issuer.toString()}', which is not the subject of '${issuer.subject.toString()}'!`);
+    const key = issuer.publicKey;
+    let signature;
+    try {
+      signature = this.signatureAlgorithm.family === "ecdsa" ? rawEcdsaSignature(this.signatureValue, key.curve, this.subject.toString()) : this.signatureValue;
+    } catch (exception) {
+      return notVerified(exception instanceof Error ? exception.message : String(exception));
+    }
+    let verified;
+    try {
+      verified = verifyWith(
+        this.signatureAlgorithm,
+        key.curve,
+        this.tbsBytes,
+        signature,
+        key.publicKeyBytes()
+      );
+    } catch (exception) {
+      return notVerified(`The certificate '${this.subject.toString()}' could not be checked against '${issuer.subject.toString()}': ${exception instanceof Error ? exception.message : String(exception)}`);
+    }
+    return verified ? VERIFIED : notVerified(`The certificate '${this.subject.toString()}' was not signed by '${issuer.subject.toString()}'!`);
+  }
+  /** The hash of this certificate's DER encoding, which is what `x5t` carries. */
+  thumbprint(hash = "sha256") {
+    return digest(hash, this.encoded);
+  }
+  /** Whether this is byte for byte the same certificate as the given one. */
+  equals(other) {
+    return bytesEqual2(this.encoded, other.encoded);
+  }
+  toString() {
+    return this.subject.toString();
+  }
+};
+var iso = (value) => value.toISOString().replace(/\.\d{3}Z$/u, "Z");
+function algorithmIdentifier(node, what) {
+  const fields = contentsOf(node, what);
+  const oid = derObjectIdentifier(fields.read(Tag.objectIdentifier), what);
+  const parameters = fields.atEnd ? null : fields.read();
+  fields.expectEnd();
+  return { oid, parameters };
+}
+function subjectPublicKey(node, what) {
+  const fields = contentsOf(node, `${what}: the subject public key info`);
+  const algorithm2 = algorithmIdentifier(fields.read(Tag.sequence), `${what}: the public key algorithm`);
+  const bits = derBitString(fields.read(Tag.bitString), `${what}: the public key`);
+  fields.expectEnd();
+  if (algorithm2.oid === OID_EC_PUBLIC_KEY) {
+    if (algorithm2.parameters === null)
+      throw new CoseError(`${what}: holds an elliptic curve key that does not name its curve, which this implementation does not support`);
+    if (algorithm2.parameters.tag !== Tag.objectIdentifier)
+      throw new CoseError(`${what}: holds an elliptic curve key whose parameters are not a named curve, which this implementation does not support`);
+    const oid = derObjectIdentifier(algorithm2.parameters, `${what}: the curve`);
+    const curve2 = CURVE_OIDS[oid];
+    if (curve2 === void 0)
+      throw new CoseError(`${what}: holds a key on the curve '${oid}', which is not a curve this implementation knows`);
+    return ecPublicKey(curve2, bits, what);
+  }
+  if (algorithm2.oid === OID_ED25519)
+    return CoseKey.fromOkpPublicKey(
+      CoseCurves.Ed25519,
+      bits,
+      { algorithm: CoseAlgorithms.Ed25519 }
+    );
+  if (algorithm2.oid === OID_ED448)
+    return CoseKey.fromOkpPublicKey(
+      CoseCurves.Ed448,
+      bits,
+      { algorithm: CoseAlgorithms.Ed448 }
+    );
+  const mldsa = algorithm2.oid === OID_MLDSA44 ? CoseAlgorithms.MLDSA44 : algorithm2.oid === OID_MLDSA65 ? CoseAlgorithms.MLDSA65 : algorithm2.oid === OID_MLDSA87 ? CoseAlgorithms.MLDSA87 : null;
+  if (mldsa !== null)
+    return CoseKey.fromAkpPublicKey(mldsa, bits);
+  throw new CoseError(`${what}: holds a key of type '${algorithm2.oid}', which is not a key type this implementation knows`);
+}
+function ecPublicKey(curve2, point, what) {
+  const width = curve2.fieldSize;
+  if (width === null)
+    throw new CoseError(`${what}: holds a key on the curve '${curve2.name}', which has no signature algorithm`);
+  if (point.length === 0)
+    throw new CoseError(`${what}: holds an empty elliptic curve point`);
+  if (point[0] === 4) {
+    if (point.length !== 1 + 2 * width)
+      throw new CoseError(`${what}: holds an uncompressed point of ${String(point.length)} octets, where the curve '${curve2.name}' needs ${String(1 + 2 * width)}`);
+    return CoseKey.fromCoordinates(
+      curve2,
+      point.subarray(1, 1 + width),
+      point.subarray(1 + width)
+    );
+  }
+  if (point[0] === 2 || point[0] === 3) {
+    if (point.length !== 1 + width)
+      throw new CoseError(`${what}: holds a compressed point of ${String(point.length)} octets, where the curve '${curve2.name}' needs ${String(1 + width)}`);
+    const x = point.subarray(1);
+    return CoseKey.fromCoordinates(curve2, x, decompressY(curve2, x, point[0] === 3));
+  }
+  throw new CoseError(`${what}: holds an elliptic curve point whose first octet is 0x${point[0].toString(16).padStart(2, "0")}, which is neither 0x04, 0x02 nor 0x03`);
+}
+function rawEcdsaSignature(der, curve2, subject) {
+  const width = curve2?.orderSize ?? null;
+  if (width === null)
+    throw new CoseError(`The signature of the certificate '${subject}' can not be read without knowing the issuer's curve!`);
+  const what = `The ECDSA signature of the certificate '${subject}'`;
+  const outer = new DerReader(der, what);
+  const sequence = contentsOf(outer.read(Tag.sequence), what);
+  outer.expectEnd();
+  const r = derInteger(sequence.read(Tag.integer), `${what}: r`);
+  const s = derInteger(sequence.read(Tag.integer), `${what}: s`);
+  sequence.expectEnd();
+  if (r <= 0n || s <= 0n)
+    throw new CoseError(`${what}: both halves must be positive`);
+  const raw = new Uint8Array(2 * width);
+  writeBigInt(r, raw, 0, width, what, "r");
+  writeBigInt(s, raw, width, width, what, "s");
+  return raw;
+}
+function writeBigInt(value, into, at, width, what, half) {
+  let hex = value.toString(16);
+  if (hex.length % 2 !== 0)
+    hex = `0${hex}`;
+  if (hex.length / 2 > width)
+    throw new CoseError(`${what}: ${half} is ${String(hex.length / 2)} octets, which is wider than the group order`);
+  const offset = at + width - hex.length / 2;
+  for (let index = 0; index < hex.length / 2; index++)
+    into[offset + index] = Number.parseInt(hex.slice(2 * index, 2 * index + 2), 16);
+}
+function parseExtensions(node, what) {
+  const list = contentsOf(
+    contentsOf(node, `${what}: the extensions`).read(Tag.sequence),
+    `${what}: the extensions`
+  );
+  const critical = [];
+  const seen = /* @__PURE__ */ new Set();
+  let basicConstraints = null;
+  let keyUsage = null;
+  while (!list.atEnd) {
+    const extension = contentsOf(list.read(Tag.sequence), `${what}: an extension`);
+    const oid = derObjectIdentifier(extension.read(Tag.objectIdentifier), `${what}: an extension identifier`);
+    if (seen.has(oid))
+      throw new CoseError(`${what}: carries the extension '${oid}' more than once, which RFC 5280 forbids`);
+    seen.add(oid);
+    const criticalNode = extension.peekIs(Tag.boolean) ? extension.read(Tag.boolean) : null;
+    if (criticalNode !== null && derBoolean(criticalNode, `${what}: the criticality of '${oid}'`))
+      critical.push(oid);
+    const value = extension.read(Tag.octetString);
+    extension.expectEnd();
+    if (oid === OID_BASIC_CONSTRAINTS)
+      basicConstraints = parseBasicConstraints(value, what);
+    else if (oid === OID_KEY_USAGE)
+      keyUsage = parseKeyUsage(value, what);
+  }
+  return { basicConstraints, keyUsage, critical };
+}
+function parseBasicConstraints(value, what) {
+  const where = `${what}: the basicConstraints extension`;
+  const outer = new DerReader(value.content, where);
+  const sequence = contentsOf(outer.read(Tag.sequence), where);
+  outer.expectEnd();
+  const caNode = sequence.peekIs(Tag.boolean) ? sequence.read(Tag.boolean) : null;
+  const pathNode = sequence.peekIs(Tag.integer) ? sequence.read(Tag.integer) : null;
+  sequence.expectEnd();
+  return {
+    certificateAuthority: caNode === null ? false : derBoolean(caNode, where),
+    pathLength: pathNode === null ? null : Number(derInteger(pathNode, where))
+  };
+}
+function parseKeyUsage(value, what) {
+  const where = `${what}: the keyUsage extension`;
+  const outer = new DerReader(value.content, where);
+  const { unusedBits, bytes } = derBitStringRaw(outer.read(Tag.bitString), where);
+  outer.expectEnd();
+  const bits = [];
+  for (let index = 0; index < bytes.length * 8 - unusedBits; index++)
+    bits.push((bytes[index >> 3] & 128 >> (index & 7)) !== 0);
+  return bits;
+}
+var signatureAlgorithmByOid = (oid) => SIGNATURE_OIDS[oid] ?? null;
+var curveByOid = (oid) => CURVE_OIDS[oid] ?? null;
+function oidOfCurve(curve2) {
+  for (const [oid, each] of Object.entries(CURVE_OIDS)) {
+    if (each.id === curve2.id)
+      return oid;
+  }
+  return null;
+}
+
+// src/x5chain.ts
+var CoseCertificateChain = class _CoseCertificateChain {
+  /** The certificates, end-entity first. */
+  certificates;
+  constructor(certificates) {
+    if (certificates.length === 0)
+      throw new CoseError("A certificate chain must hold at least one certificate!");
+    this.certificates = [...certificates];
+  }
+  /** The certificate holding the key that is expected to have signed. */
+  get endEntity() {
+    return this.certificates[0];
+  }
+  /** The public key of the end-entity certificate. */
+  publicKey() {
+    return this.endEntity.publicKey;
+  }
+  // ------------------------------------------------------------- parsing
+  /** Read a `COSE_X509` from its CBOR form. */
+  static fromCbor(value) {
+    const encoded = [];
+    if (value.type === "bytes")
+      encoded.push(value.value);
+    else if (value.type === "array") {
+      if (value.items.length < 2)
+        throw new CoseError("A COSE_X509 of fewer than two certificates must be a bare byte string, not an array!");
+      for (const item of value.items) {
+        if (item.type !== "bytes")
+          throw new CoseError("Every certificate of a COSE_X509 must be a byte string!");
+        encoded.push(item.value);
+      }
+    } else
+      throw new CoseError(`A COSE_X509 must be a byte string or an array of them, but was a CBOR ${value.type}!`);
+    return new _CoseCertificateChain(encoded.map((each, index) => {
+      try {
+        return X509Certificate.parse(each);
+      } catch (exception) {
+        throw new CoseError(
+          `The certificate at position ${String(index)} of the COSE_X509 could not be read: ${exception instanceof Error ? exception.message : String(exception)}`,
+          { cause: exception }
+        );
+      }
+    }));
+  }
+  /** The CBOR form: a bare byte string for one certificate, an array for several. */
+  toCbor() {
+    return this.certificates.length === 1 ? cbor.bytes(this.certificates[0].encoded) : cbor.array(this.certificates.map((each) => cbor.bytes(each.encoded)));
+  }
+  // ---------------------------------------------------------- validation
+  /**
+   * Walk this chain to one of the given trust anchors.
+   *
+   * Every certificate within its validity period, every certificate signed
+   * by the next one, every issuing certificate actually allowed to issue,
+   * the last one either an anchor or issued by one, and the end-entity
+   * certificate allowed to sign.
+   *
+   * This answers "does this chain lead somewhere I trust". It does *not*
+   * answer whether the key of the end-entity certificate is the key that
+   * signed the message — without that binding a perfectly valid chain says
+   * nothing about the message it travelled with.
+   *
+   * Not checked, and the same list as Styx so that the two agree about what
+   * a pass means: revocation, name constraints, certificate policies, and
+   * path length beyond the CA flag.
+   */
+  validate(trustAnchors, options = {}) {
+    const at = options.at ?? /* @__PURE__ */ new Date();
+    if (trustAnchors.length === 0)
+      return notVerified("A certificate chain can not be validated without at least one trust anchor!");
+    for (const certificate of this.certificates) {
+      const valid = certificate.isValidAt(at);
+      if (!valid.verified)
+        return valid;
+    }
+    for (let index = 0; index < this.certificates.length - 1; index++) {
+      const issuer = this.certificates[index + 1];
+      const issued = this.certificates[index].verifySignedBy(issuer);
+      if (!issued.verified)
+        return issued;
+      const allowed = mayIssue(issuer);
+      if (!allowed.verified)
+        return allowed;
+    }
+    const last = this.certificates[this.certificates.length - 1];
+    if (!trustAnchors.some((anchor) => anchor.equals(last))) {
+      const issuer = trustAnchors.find((anchor) => last.issuer.equivalentTo(anchor.subject));
+      if (issuer === void 0)
+        return notVerified(`The certificate chain ends at '${last.subject.toString()}', which is neither a trust anchor nor issued by one!`);
+      for (const check of [issuer.isValidAt(at), mayIssue(issuer), last.verifySignedBy(issuer)]) {
+        if (!check.verified)
+          return check;
+      }
+    }
+    if (!this.endEntity.allows(KeyUsage.digitalSignature))
+      return notVerified(`The end-entity certificate '${this.endEntity.subject.toString()}' is not allowed to create digital signatures!`);
+    return VERIFIED;
+  }
+  toString() {
+    return this.certificates.map((each) => each.subject.toString()).join(" <- ");
+  }
+};
+function mayIssue(certificate) {
+  if (!certificate.isCertificateAuthority)
+    return notVerified(`The certificate '${certificate.subject.toString()}' issued another one although it is not a certification authority!`);
+  if (!certificate.allows(KeyUsage.keyCertSign))
+    return notVerified(`The certificate '${certificate.subject.toString()}' issued another one although it is not allowed to sign certificates!`);
+  return VERIFIED;
+}
+var CoseCertificateHash = class _CoseCertificateHash {
+  /** The hash algorithm the thumbprint was computed with. */
+  algorithm;
+  /** The hash of the certificate's DER encoding. */
+  value;
+  constructor(algorithm2, value) {
+    this.algorithm = algorithm2;
+    this.value = value;
+  }
+  /** Compute the thumbprint of a certificate, with SHA-256 unless told otherwise. */
+  static from(certificate, algorithm2 = CoseAlgorithms.SHA256) {
+    if (algorithm2.hash === null)
+      throw new CoseError(`The COSE algorithm '${algorithm2.name}' is not a hash algorithm!`);
+    return new _CoseCertificateHash(algorithm2, certificate.thumbprint(algorithm2.hash));
+  }
+  /** Read a `COSE_CertHash` from its CBOR form. */
+  static fromCbor(value) {
+    if (value.type !== "array")
+      throw new CoseError(`A COSE_CertHash must be a CBOR array, but was a CBOR ${value.type}!`);
+    if (value.items.length !== 2)
+      throw new CoseError(`A COSE_CertHash must hold exactly two elements, but held ${String(value.items.length)}!`);
+    const [algorithmValue, hashValue] = value.items;
+    if (hashValue.type !== "bytes")
+      throw new CoseError("The hash value of a COSE_CertHash must be a byte string!");
+    if (algorithmValue.type !== "int")
+      throw new CoseError("The hash algorithm of a COSE_CertHash must be an integer, as no name is registered for one!");
+    const algorithm2 = algorithmById(Number(algorithmValue.value));
+    if (algorithm2 === null)
+      throw new CoseError(`The COSE algorithm ${String(algorithmValue.value)} of the COSE_CertHash is not registered!`);
+    if (algorithm2.hash === null)
+      throw new CoseError(`The COSE algorithm '${algorithm2.name}' of the COSE_CertHash is not a hash algorithm!`);
+    return new _CoseCertificateHash(algorithm2, hashValue.value);
+  }
+  /** The CBOR form. */
+  toCbor() {
+    return cbor.array([cbor.int(BigInt(this.algorithm.id)), cbor.bytes(this.value)]);
+  }
+  /**
+   * Whether this thumbprint names the given certificate.
+   *
+   * A thumbprint that names a *different* certificate than the one that
+   * travelled is not a detail to shrug at: the message states which
+   * certificate it means, and the chain offers another. One of the two is
+   * wrong and there is no way to tell which.
+   */
+  matches(certificate) {
+    if (this.algorithm.hash === null)
+      return notVerified(`The COSE algorithm '${this.algorithm.name}' of the certificate thumbprint is not a hash algorithm!`);
+    const computed = certificate.thumbprint(this.algorithm.hash);
+    if (computed.length !== this.value.length || !computed.every((each, index) => each === this.value[index]))
+      return notVerified(`The certificate thumbprint of this message does not name the certificate '${certificate.subject.toString()}' that travelled with it!`);
+    return VERIFIED;
+  }
+};
+
+// src/sign1.ts
+var COSE_SIGN1_TAG = 18;
+var SIGNATURE_CONTEXT = "Signature1";
+var COUNTERSIGNATURE_CONTEXT = "CounterSignatureV2";
+var CoseSign1 = class _CoseSign1 {
+  /**
+   * The serialized protected bucket, exactly as signed and as received: a
+   * zero-length byte string when there are no protected header parameters.
+   */
+  protectedHeaderBytes;
+  /** The protected header parameters, which the signature covers. */
+  protectedHeader;
+  /**
+   * The unprotected header parameters, which the signature does not cover
+   * and which therefore must not be trusted after a successful verification.
+   */
+  unprotectedHeader;
+  /** The signed payload, or null when it is detached. */
+  payload;
+  /** The signature: `r ‖ s`, each half zero-padded, never DER. */
+  signature;
+  /**
+   * Whether this message is wrapped within CBOR tag 18. The tag is not
+   * covered by the signature, but it is preserved so that a parsed message
+   * re-encodes to the very same bytes.
+   */
+  isTagged;
+  constructor(protectedHeaderBytes, unprotectedHeader, payload, signature, isTagged = true) {
+    this.protectedHeaderBytes = protectedHeaderBytes;
+    this.protectedHeader = CoseHeaders.parseProtected(protectedHeaderBytes);
+    this.unprotectedHeader = unprotectedHeader ?? CoseHeaders.empty;
+    this.payload = payload;
+    this.signature = signature;
+    this.isTagged = isTagged;
+  }
+  /** Whether the payload is detached. */
+  get isDetached() {
+    return this.payload === null;
+  }
+  /**
+   * The signature algorithm, taken from the protected bucket and only
+   * otherwise from the unprotected one.
+   */
+  get algorithm() {
+    return this.protectedHeader.algorithm ?? this.unprotectedHeader.algorithm;
+  }
+  /** The key identifier, protected bucket first. */
+  get keyIdentifier() {
+    return this.protectedHeader.keyIdentifier ?? this.unprotectedHeader.keyIdentifier;
+  }
+  // ---------------------------------------------------------------- signing
+  /**
+   * The encoded Sig_structure of a COSE_Sign1 message
+   * [RFC 9052, Section 4.4], which is the byte string an ECDSA signer
+   * actually signs:
+   *
+   * <code>
+   * Sig_structure = [
+   *     context      : "Signature1",
+   *     protected    : empty_or_serialized_map,
+   *     external_aad : bstr,
+   *     payload      : bstr
+   * ]
+   * </code>
+   *
+   * This is public on purpose. Whenever the signing key does not live in
+   * this process — a meter, a smart card, a hardware security module — this
+   * is the input to hand over.
+   */
+  static toBeSigned(protectedHeaderBytes, payload, externalAad = null) {
+    return encode(cbor.array([
+      cbor.text(SIGNATURE_CONTEXT),
+      cbor.bytes(protectedHeaderBytes),
+      cbor.bytes(externalAad ?? NO_BYTES),
+      cbor.bytes(payload)
+    ]));
+  }
+  /** The encoded Sig_structure of this message. */
+  toBeSigned(options = {}) {
+    const payload = resolvePayload(
+      this.payload,
+      options.detachedPayload ?? null,
+      "this COSE_Sign1 message"
+    );
+    if (!payload.ok)
+      throw new CoseError(payload.reason);
+    return _CoseSign1.toBeSigned(
+      this.protectedHeaderBytes,
+      payload.value,
+      options.externalAad ?? null
+    );
+  }
+  /**
+   * Sign a payload, placing the algorithm within the protected bucket and
+   * the key identifier within the unprotected one — the layout of the
+   * examples of RFC 9052 and of virtually every deployed COSE message.
+   */
+  static sign(payload, key, options = {}) {
+    const algorithm2 = key.algorithm;
+    if (algorithm2 === null)
+      throw new CoseError("The COSE key does not name the signature algorithm to use!");
+    const keyIdentifier = options.keyIdentifier === void 0 ? key.keyIdentifier : options.keyIdentifier;
+    return _CoseSign1.signWithHeaders(
+      payload,
+      key,
+      CoseHeaders.create(algorithm2),
+      keyIdentifier !== null ? CoseHeaders.create(null, keyIdentifier) : CoseHeaders.empty,
+      options
+    );
+  }
+  /**
+   * Sign a payload with the algorithm taken from the application context
+   * rather than from the message: the protected bucket stays empty and only
+   * the key identifier travels.
+   *
+   * This is the leanest signed COSE message there is, and for a protocol
+   * that already agrees on its algorithm it is also the safest arrangement:
+   * an algorithm that is not in the message cannot be tampered with on the
+   * way, whereas one within the unprotected bucket can. The price is that
+   * agility becomes a property of the profile rather than of the message.
+   */
+  static signWithApplicationAlgorithm(payload, key, options = {}) {
+    const algorithm2 = key.algorithm;
+    if (algorithm2 === null)
+      throw new CoseError("The COSE key does not name the signature algorithm to use!");
+    const keyIdentifier = options.keyIdentifier === void 0 ? key.keyIdentifier : options.keyIdentifier;
+    return _CoseSign1.signWithHeaders(
+      payload,
+      key,
+      CoseHeaders.empty,
+      keyIdentifier !== null ? CoseHeaders.create(null, keyIdentifier) : CoseHeaders.empty,
+      options,
+      algorithm2
+    );
+  }
+  /**
+   * Sign a payload with full control over both header buckets.
+   *
+   * The signature algorithm is taken from the protected bucket, because an
+   * algorithm that is not covered by the signature could be changed by
+   * anyone on the way.
+   */
+  static signWithHeaders(payload, key, protectedHeader, unprotectedHeader = null, options = {}, applicationAlgorithm = null) {
+    const stated = protectedHeader.algorithm;
+    if (applicationAlgorithm !== null && stated !== null && stated.id !== applicationAlgorithm.id)
+      throw new CoseError(`The protected header bucket names the algorithm '${stated.name}', but the application context names '${applicationAlgorithm.name}'!`);
+    const algorithm2 = stated ?? applicationAlgorithm;
+    if (algorithm2 === null)
+      throw new CoseError("Neither the protected header bucket nor the application context names the signature algorithm!");
+    const protectedBytes = protectedHeader.toProtectedBytes();
+    const signed = options.canonicalizePayload === false ? payload : canonicalizePayload(payload);
+    if (options.detachPayload === true && !bytesEqual(signed, payload))
+      throw new CoseError("The payload of this COSE_Sign1 message is detached, so canonicalizing it here would sign bytes that nobody holds: canonicalize the payload yourself (canonicalizePayload), sign and transmit those, or pass canonicalizePayload: false to sign the payload exactly as it is!");
+    const signature = signWith(
+      algorithm2,
+      key.curve,
+      _CoseSign1.toBeSigned(protectedBytes, signed, options.externalAad ?? null),
+      key.privateKeyBytes()
+    );
+    return new _CoseSign1(
+      protectedBytes,
+      unprotectedHeader,
+      options.detachPayload === true ? null : signed,
+      signature,
+      options.tagged ?? true
+    );
+  }
+  // ----------------------------------------------------------- verification
+  /**
+   * Verify the signature of this message.
+   *
+   * A failed verification is not an exception — it is the expected outcome
+   * of checking untrusted data — so the reason travels in the result.
+   */
+  verify(key, options = {}) {
+    const critical = verifyCriticalHeaderParameters(
+      this.protectedHeader,
+      this.unprotectedHeader,
+      options.alsoUnderstood ?? []
+    );
+    if (!critical.verified)
+      return critical;
+    const algorithm2 = resolveAlgorithm(
+      this.protectedHeader,
+      this.unprotectedHeader,
+      options.expectedAlgorithm ?? key.algorithm,
+      "This COSE_Sign1 message"
+    );
+    if (!algorithm2.ok)
+      return notVerified(algorithm2.reason);
+    const payload = resolvePayload(
+      this.payload,
+      options.detachedPayload ?? null,
+      "this COSE_Sign1 message"
+    );
+    if (!payload.ok)
+      return notVerified(payload.reason);
+    return verifySignature(
+      algorithm2.value,
+      key,
+      _CoseSign1.toBeSigned(
+        this.protectedHeaderBytes,
+        payload.value,
+        options.externalAad ?? null
+      ),
+      this.signature
+    );
+  }
+  // -------------------------------------------------- X.509 [RFC 9360]
+  /**
+   * The certificate chain of this message, from either header bucket.
+   *
+   * A chain that travels in a message is untrusted input, and reading one
+   * says nothing at all about it — {@link verifyWithCertificateChain} has to
+   * walk it to an anchor first. Throws when the parameter is present but is
+   * not a `COSE_X509`, rather than pretending there is none.
+   */
+  get certificateChain() {
+    const value = this.protectedHeader.get(label(HeaderLabel.x5Chain)) ?? this.unprotectedHeader.get(label(HeaderLabel.x5Chain));
+    if (value === null)
+      return null;
+    return CoseCertificateChain.fromCbor(value);
+  }
+  /**
+   * The certificate thumbprint of this message, from either header bucket.
+   *
+   * Throws when the parameter is present but is not a `COSE_CertHash`.
+   */
+  get certificateThumbprint() {
+    const value = this.protectedHeader.get(label(HeaderLabel.x5T)) ?? this.unprotectedHeader.get(label(HeaderLabel.x5T));
+    if (value === null)
+      return null;
+    return CoseCertificateHash.fromCbor(value);
+  }
+  /**
+   * Verify this message against a certificate chain rather than against a
+   * public key somebody handed over: the chain travels within the message,
+   * is walked to one of the given trust anchors, and the key of its
+   * end-entity certificate is then the key the signature has to verify with.
+   *
+   * That last step is what turns a chain into an answer. A chain that
+   * validates beautifully says nothing whatsoever about the message it
+   * arrived with unless the key it ends in is the key that signed, so the
+   * two are never checked apart from one another here.
+   *
+   * The X.509 header parameters become understood *by this call* rather than
+   * by the library, which is why a `crit` demanding `x5chain` is accepted
+   * here and refused by {@link verify}: whoever verifies with a bare public
+   * key has not looked at any certificate and must not claim otherwise.
+   */
+  verifyWithCertificateChain(trustAnchors, options = {}) {
+    const understood = [
+      ...options.alsoUnderstood ?? [],
+      label(HeaderLabel.x5Chain),
+      label(HeaderLabel.x5T)
+    ];
+    const critical = verifyCriticalHeaderParameters(
+      this.protectedHeader,
+      this.unprotectedHeader,
+      understood
+    );
+    if (!critical.verified)
+      return critical;
+    let chain;
+    let thumbprint;
+    try {
+      chain = this.certificateChain;
+      thumbprint = this.certificateThumbprint;
+    } catch (exception) {
+      return notVerified(exception instanceof Error ? exception.message : String(exception));
+    }
+    if (chain === null)
+      return notVerified("This COSE_Sign1 message carries no certificate chain!");
+    if (thumbprint !== null) {
+      const names = thumbprint.matches(chain.endEntity);
+      if (!names.verified)
+        return names;
+    }
+    const validated = chain.validate(trustAnchors, { at: options.at });
+    if (!validated.verified)
+      return validated;
+    const signed = this.verify(
+      chain.publicKey(),
+      { ...options, alsoUnderstood: understood }
+    );
+    if (!signed.verified)
+      return signed;
+    return { verified: true, signer: chain.endEntity };
+  }
+  // ------------------------------------------------------- countersignatures
+  /**
+   * The countersignatures of this message [RFC 9338], which live in the
+   * unprotected bucket under label 11.
+   *
+   * A message carrying one holds it bare; a message carrying several holds
+   * an array of them. The two shapes are told apart by the kind of the first
+   * element, because a bare countersignature starts with its protected
+   * bucket, a byte string, whereas an array of them starts with an array.
+   */
+  get countersignatures() {
+    const value = this.unprotectedHeader.get(label(HeaderLabel.counterSignatureV2));
+    if (value === null)
+      return [];
+    if (value.type !== "array")
+      throw new CoseError("The countersignature header parameter must be a COSE_Countersignature or an array of them!");
+    if (value.items.length > 0 && value.items[0].type === "array")
+      return value.items.map((each) => CoseSignature.parse(each));
+    return [CoseSignature.parse(value)];
+  }
+  /**
+   * The encoded Countersign_structure [RFC 9338, Section 3.3].
+   *
+   * Six elements rather than four, and the difference is not cosmetic. It
+   * names the body's protected bucket *and* the countersigner's, and its
+   * last element carries the signature being countersigned — which is what
+   * makes this "I vouch for that signature" rather than "I signed the same
+   * thing". The countersignature of RFC 8152 covered the payload but not the
+   * signature, so it never actually attested to having seen it.
+   *
+   * `other_fields` is an array holding the one signature, not a bare byte
+   * string.
+   */
+  static toBeCountersigned(bodyProtectedHeaderBytes, countersignatureProtectedHeaderBytes, payload, signature, externalAad = null) {
+    return encode(cbor.array([
+      cbor.text(COUNTERSIGNATURE_CONTEXT),
+      cbor.bytes(bodyProtectedHeaderBytes),
+      cbor.bytes(countersignatureProtectedHeaderBytes),
+      cbor.bytes(externalAad ?? NO_BYTES),
+      cbor.bytes(payload),
+      cbor.array([cbor.bytes(signature)])
+    ]));
+  }
+  /** The encoded Countersign_structure of one countersignature of this message. */
+  toBeCountersigned(countersignature, options = {}) {
+    const payload = resolvePayload(
+      this.payload,
+      options.detachedPayload ?? null,
+      "this COSE_Sign1 message"
+    );
+    if (!payload.ok)
+      throw new CoseError(payload.reason);
+    return _CoseSign1.toBeCountersigned(
+      this.protectedHeaderBytes,
+      countersignature.protectedHeaderBytes,
+      payload.value,
+      this.signature,
+      options.externalAad ?? null
+    );
+  }
+  /**
+   * Return a copy of this message with one more countersignature.
+   *
+   * Countersignatures live in the unprotected bucket, which no signature
+   * covers, so this leaves the body signature, the protected bucket and the
+   * payload byte-identical: the message stays valid for everybody, including
+   * readers that ignore label 11 entirely.
+   */
+  addCountersignature(key, options = {}) {
+    const algorithm2 = key.algorithm;
+    if (algorithm2 === null)
+      throw new CoseError("The COSE key does not name the signature algorithm to use!");
+    const keyIdentifier = options.keyIdentifier === void 0 ? key.keyIdentifier : options.keyIdentifier;
+    const protectedBytes = CoseHeaders.create(algorithm2).toProtectedBytes();
+    const payload = resolvePayload(
+      this.payload,
+      options.detachedPayload ?? null,
+      "this COSE_Sign1 message"
+    );
+    if (!payload.ok)
+      throw new CoseError(payload.reason);
+    const signature = signWith(
+      algorithm2,
+      key.curve,
+      _CoseSign1.toBeCountersigned(
+        this.protectedHeaderBytes,
+        protectedBytes,
+        payload.value,
+        this.signature,
+        options.externalAad ?? null
+      ),
+      key.privateKeyBytes()
+    );
+    const added = new CoseSignature(
+      protectedBytes,
+      keyIdentifier !== null ? CoseHeaders.create(null, keyIdentifier) : CoseHeaders.empty,
+      signature
+    );
+    const all = [...this.countersignatures, added];
+    return new _CoseSign1(
+      this.protectedHeaderBytes,
+      this.unprotectedHeader.set(
+        label(HeaderLabel.counterSignatureV2),
+        all.length === 1 ? all[0].toCbor() : cbor.array(all.map((each) => each.toCbor()))
+      ),
+      this.payload,
+      this.signature,
+      this.isTagged
+    );
+  }
+  /**
+   * Verify one countersignature of this message.
+   *
+   * This says nothing about whether the body signature itself is valid —
+   * that is a separate question with a separate key, and answering both at
+   * once would hide which of the two failed.
+   */
+  verifyCountersignature(countersignature, key, options = {}) {
+    const critical = verifyCriticalHeaderParameters(
+      countersignature.protectedHeader,
+      countersignature.unprotectedHeader,
+      options.alsoUnderstood ?? []
+    );
+    if (!critical.verified)
+      return critical;
+    const algorithm2 = resolveAlgorithm(
+      countersignature.protectedHeader,
+      countersignature.unprotectedHeader,
+      options.expectedAlgorithm ?? key.algorithm,
+      "This countersignature"
+    );
+    if (!algorithm2.ok)
+      return notVerified(algorithm2.reason);
+    const payload = resolvePayload(
+      this.payload,
+      options.detachedPayload ?? null,
+      "this COSE_Sign1 message"
+    );
+    if (!payload.ok)
+      return notVerified(payload.reason);
+    return verifySignature(
+      algorithm2.value,
+      key,
+      _CoseSign1.toBeCountersigned(
+        this.protectedHeaderBytes,
+        countersignature.protectedHeaderBytes,
+        payload.value,
+        this.signature,
+        options.externalAad ?? null
+      ),
+      countersignature.signature
+    );
+  }
+  // ------------------------------------------------------ reading & writing
+  /**
+   * Parse a COSE_Sign1 message.
+   *
+   * Both the tagged and the untagged form are accepted; which one it was is
+   * remembered, as the CBOR tag is not covered by the signature but is part
+   * of the bytes on the wire.
+   */
+  static parse(input) {
+    const value = input instanceof Uint8Array ? decode(input) : input;
+    let isTagged = false;
+    let message = value;
+    if (message.type === "tag") {
+      if (message.tag !== BigInt(COSE_SIGN1_TAG))
+        throw new CoseError(`A COSE_Sign1 message must be tagged with CBOR tag ${String(COSE_SIGN1_TAG)}, but was tagged with CBOR tag ${String(message.tag)}!`);
+      isTagged = true;
+      message = message.value;
+    }
+    if (message.type !== "array")
+      throw new CoseError(`A COSE_Sign1 message must be a CBOR array, but was a CBOR ${message.type}!`);
+    if (message.items.length !== 4)
+      throw new CoseError(`A COSE_Sign1 message must be a CBOR array of 4 elements, but had ${String(message.items.length)} element(s)!`);
+    const [protectedBytes, unprotected, payload, signature] = message.items;
+    if (protectedBytes?.type !== "bytes")
+      throw new CoseError("The protected header bucket of a COSE_Sign1 message must be a byte string!");
+    if (unprotected === void 0)
+      throw new CoseError("A COSE_Sign1 message must carry an unprotected header bucket!");
+    if (payload === void 0 || payload.type !== "null" && payload.type !== "bytes")
+      throw new CoseError("The payload of a COSE_Sign1 message must be a byte string, or null when it is detached!");
+    if (signature?.type !== "bytes")
+      throw new CoseError("The signature of a COSE_Sign1 message must be a byte string!");
+    return new _CoseSign1(
+      protectedBytes.value,
+      CoseHeaders.parse(unprotected),
+      payload.type === "bytes" ? payload.value : null,
+      signature.value,
+      isTagged
+    );
+  }
+  /** A CBOR representation of this message. */
+  toCbor() {
+    const message = cbor.array([
+      cbor.bytes(this.protectedHeaderBytes),
+      this.unprotectedHeader.toCbor(),
+      this.payload !== null ? cbor.bytes(this.payload) : cbor.nullValue,
+      cbor.bytes(this.signature)
+    ]);
+    return this.isTagged ? cbor.tag(COSE_SIGN1_TAG, message) : message;
+  }
+  /** The CBOR encoding of this message. */
+  toBytes() {
+    return encode(this.toCbor());
+  }
+  /**
+   * A copy of this message without its payload, e.g. because the payload
+   * travels elsewhere.
+   *
+   * The signature stays valid: it never covered the message, only the
+   * Sig_structure.
+   */
+  detach() {
+    return new _CoseSign1(
+      this.protectedHeaderBytes,
+      this.unprotectedHeader,
+      null,
+      this.signature,
+      this.isTagged
+    );
+  }
+  /** A copy of this message carrying the given payload again. */
+  attach(payload) {
+    if (this.payload !== null && !bytesEqual(this.payload, payload))
+      throw new CoseError("This COSE_Sign1 message already carries a different payload!");
+    return new _CoseSign1(
+      this.protectedHeaderBytes,
+      this.unprotectedHeader,
+      payload,
+      this.signature,
+      this.isTagged
+    );
+  }
+};
+function verifySignature(algorithm2, key, toBeSigned, signature) {
+  let publicKey;
+  try {
+    publicKey = key.publicKeyBytes();
+  } catch (cause) {
+    return notVerified(cause instanceof Error ? cause.message : String(cause));
+  }
+  try {
+    return verifyWith(algorithm2, key.curve, toBeSigned, signature, publicKey) ? VERIFIED : notVerified("The signature is not valid for this payload and this key!");
+  } catch (cause) {
+    return notVerified(cause instanceof Error ? cause.message : String(cause));
+  }
+}
+
+// src/sign.ts
+var COSE_SIGN_TAG = 98;
+var SIGNATURE_CONTEXT2 = "Signature";
+var CoseSign = class _CoseSign {
+  /** The serialized protected bucket of the body, exactly as signed. */
+  protectedHeaderBytes;
+  /** The protected header parameters of the body, which every signature covers. */
+  protectedHeader;
+  /** The unprotected header parameters of the body, which none of them covers. */
+  unprotectedHeader;
+  /** The signed payload, or null when it is detached. */
+  payload;
+  /** The signatures, in the order they travel. */
+  signatures;
+  /** Whether this message is wrapped within CBOR tag 98. */
+  isTagged;
+  constructor(protectedHeaderBytes, unprotectedHeader, payload, signatures, isTagged = true) {
+    if (signatures.length === 0)
+      throw new CoseError("A COSE_Sign message must carry at least one signature!");
+    this.protectedHeaderBytes = protectedHeaderBytes;
+    this.protectedHeader = CoseHeaders.parseProtected(protectedHeaderBytes);
+    this.unprotectedHeader = unprotectedHeader ?? CoseHeaders.empty;
+    this.payload = payload;
+    this.signatures = [...signatures];
+    this.isTagged = isTagged;
+  }
+  /** Whether the payload is detached. */
+  get isDetached() {
+    return this.payload === null;
+  }
+  /**
+   * The encoded Sig_structure of one signature of a COSE_Sign message
+   * [RFC 9052, Section 4.4]:
+   *
+   * <code>
+   * Sig_structure = [
+   *     context        : "Signature",
+   *     body_protected : empty_or_serialized_map,
+   *     sign_protected : empty_or_serialized_map,
+   *     external_aad   : bstr,
+   *     payload        : bstr
+   * ]
+   * </code>
+   */
+  static toBeSigned(bodyProtectedHeaderBytes, signatureProtectedHeaderBytes, payload, externalAad = null) {
+    return encode(cbor.array([
+      cbor.text(SIGNATURE_CONTEXT2),
+      cbor.bytes(bodyProtectedHeaderBytes),
+      cbor.bytes(signatureProtectedHeaderBytes),
+      cbor.bytes(externalAad ?? NO_BYTES),
+      cbor.bytes(payload)
+    ]));
+  }
+  /** The encoded Sig_structure of one signature of this message. */
+  toBeSigned(signature, options = {}) {
+    const payload = resolvePayload(
+      this.payload,
+      options.detachedPayload ?? null,
+      "this COSE_Sign message"
+    );
+    if (!payload.ok)
+      throw new CoseError(payload.reason);
+    return _CoseSign.toBeSigned(
+      this.protectedHeaderBytes,
+      signature.protectedHeaderBytes,
+      payload.value,
+      options.externalAad ?? null
+    );
+  }
+  /**
+   * Sign a payload, producing a message with one signature.
+   *
+   * The body's protected bucket stays empty: what a signer has to say about
+   * its own signature — its algorithm, its key identifier — belongs to that
+   * signature rather than to the body every other signer shares.
+   */
+  static sign(payload, key, options = {}) {
+    const signed = options.canonicalizePayload === false ? payload : canonicalizePayload(payload);
+    if (options.detachPayload === true && !bytesEqual(signed, payload))
+      throw new CoseError("The payload of this COSE_Sign message is detached, so canonicalizing it here would sign bytes that nobody holds: canonicalize the payload yourself (canonicalizePayload), sign and transmit those, or pass canonicalizePayload: false to sign the payload exactly as it is!");
+    return new _CoseSign(
+      NO_BYTES,
+      CoseHeaders.empty,
+      options.detachPayload === true ? null : signed,
+      [signatureOver(NO_BYTES, signed, key, options)],
+      options.tagged ?? true
+    );
+  }
+  /**
+   * Return a copy of this message with one more signature.
+   *
+   * The existing signatures are untouched and stay valid, because no
+   * signature ever covers another.
+   */
+  addSignature(key, options = {}) {
+    const payload = resolvePayload(
+      this.payload,
+      options.detachedPayload ?? null,
+      "this COSE_Sign message"
+    );
+    if (!payload.ok)
+      throw new CoseError(payload.reason);
+    return new _CoseSign(
+      this.protectedHeaderBytes,
+      this.unprotectedHeader,
+      this.payload,
+      [
+        ...this.signatures,
+        signatureOver(this.protectedHeaderBytes, payload.value, key, options)
+      ],
+      this.isTagged
+    );
+  }
+  /** Verify one signature of this message. */
+  verify(signature, key, options = {}) {
+    if (!this.signatures.includes(signature))
+      return notVerified("The given signature is not one of the signatures of this COSE_Sign message!");
+    const bodyCritical = verifyCriticalHeaderParameters(
+      this.protectedHeader,
+      this.unprotectedHeader,
+      options.alsoUnderstood ?? []
+    );
+    if (!bodyCritical.verified)
+      return bodyCritical;
+    const signatureCritical = verifyCriticalHeaderParameters(
+      signature.protectedHeader,
+      signature.unprotectedHeader,
+      options.alsoUnderstood ?? []
+    );
+    if (!signatureCritical.verified)
+      return signatureCritical;
+    const algorithm2 = resolveAlgorithm(
+      signature.protectedHeader,
+      signature.unprotectedHeader,
+      options.expectedAlgorithm ?? key.algorithm,
+      "This signature of a COSE_Sign message"
+    );
+    if (!algorithm2.ok)
+      return notVerified(algorithm2.reason);
+    const payload = resolvePayload(
+      this.payload,
+      options.detachedPayload ?? null,
+      "this COSE_Sign message"
+    );
+    if (!payload.ok)
+      return notVerified(payload.reason);
+    return verifySignature(
+      algorithm2.value,
+      key,
+      _CoseSign.toBeSigned(
+        this.protectedHeaderBytes,
+        signature.protectedHeaderBytes,
+        payload.value,
+        options.externalAad ?? null
+      ),
+      signature.signature
+    );
+  }
+  /**
+   * The first signature this key verifies, or null.
+   *
+   * Signatures are tried in wire order. A signature that states its
+   * algorithm in the unprotected bucket only still needs an expected
+   * algorithm to be accepted, here as everywhere else — which the key
+   * supplies when it carries one, and otherwise nobody does.
+   */
+  verifyAny(key, options = {}) {
+    for (const signature of this.signatures) {
+      if (this.verify(signature, key, options).verified)
+        return signature;
+    }
+    return null;
+  }
+  /** Parse a COSE_Sign message, tagged or untagged. */
+  static parse(input) {
+    const value = input instanceof Uint8Array ? decode(input) : input;
+    let isTagged = false;
+    let message = value;
+    if (message.type === "tag") {
+      if (message.tag !== BigInt(COSE_SIGN_TAG))
+        throw new CoseError(`A COSE_Sign message must be tagged with CBOR tag ${String(COSE_SIGN_TAG)}, but was tagged with CBOR tag ${String(message.tag)}!`);
+      isTagged = true;
+      message = message.value;
+    }
+    if (message.type !== "array")
+      throw new CoseError(`A COSE_Sign message must be a CBOR array, but was a CBOR ${message.type}!`);
+    if (message.items.length !== 4)
+      throw new CoseError(`A COSE_Sign message must be a CBOR array of 4 elements, but had ${String(message.items.length)} element(s)!`);
+    const [protectedBytes, unprotected, payload, signatures] = message.items;
+    if (protectedBytes?.type !== "bytes")
+      throw new CoseError("The protected header bucket of a COSE_Sign message must be a byte string!");
+    if (unprotected === void 0)
+      throw new CoseError("A COSE_Sign message must carry an unprotected header bucket!");
+    if (payload === void 0 || payload.type !== "null" && payload.type !== "bytes")
+      throw new CoseError("The payload of a COSE_Sign message must be a byte string, or null when it is detached!");
+    if (signatures?.type !== "array")
+      throw new CoseError("The signatures of a COSE_Sign message must be a CBOR array!");
+    return new _CoseSign(
+      protectedBytes.value,
+      CoseHeaders.parse(unprotected),
+      payload.type === "bytes" ? payload.value : null,
+      signatures.items.map((each) => CoseSignature.parse(each)),
+      isTagged
+    );
+  }
+  /** A CBOR representation of this message. */
+  toCbor() {
+    const message = cbor.array([
+      cbor.bytes(this.protectedHeaderBytes),
+      this.unprotectedHeader.toCbor(),
+      this.payload !== null ? cbor.bytes(this.payload) : cbor.nullValue,
+      cbor.array(this.signatures.map((each) => each.toCbor()))
+    ]);
+    return this.isTagged ? cbor.tag(COSE_SIGN_TAG, message) : message;
+  }
+  /** The CBOR encoding of this message. */
+  toBytes() {
+    return encode(this.toCbor());
+  }
+};
+function signatureOver(bodyProtectedHeaderBytes, payload, key, options) {
+  const algorithm2 = key.algorithm;
+  if (algorithm2 === null)
+    throw new CoseError("The COSE key does not name the signature algorithm to use!");
+  const keyIdentifier = options.keyIdentifier === void 0 ? key.keyIdentifier : options.keyIdentifier;
+  const protectedBytes = CoseHeaders.create(algorithm2).toProtectedBytes();
+  const signature = signWith(
+    algorithm2,
+    key.curve,
+    CoseSign.toBeSigned(
+      bodyProtectedHeaderBytes,
+      protectedBytes,
+      payload,
+      options.externalAad ?? null
+    ),
+    key.privateKeyBytes()
+  );
+  return new CoseSignature(
+    protectedBytes,
+    keyIdentifier !== null ? CoseHeaders.create(null, keyIdentifier) : CoseHeaders.empty,
+    signature
+  );
+}
+
+// src/mac0.ts
+var COSE_MAC0_TAG = 17;
+var MAC0_CONTEXT = "MAC0";
+var CoseMac0 = class _CoseMac0 {
+  /**
+   * The serialized protected bucket, exactly as authenticated and as
+   * received: a zero-length byte string when there are no protected header
+   * parameters.
+   */
+  protectedHeaderBytes;
+  /** The protected header parameters, which the authentication tag covers. */
+  protectedHeader;
+  /**
+   * The unprotected header parameters, which the tag does not cover and
+   * which therefore must not be trusted after a successful verification.
+   */
+  unprotectedHeader;
+  /** The authenticated payload, or null when it is detached. */
+  payload;
+  /** The authentication tag — not the CBOR tag. */
+  tag;
+  /**
+   * Whether this message is wrapped within CBOR tag 17. The tag is not
+   * covered by the authentication tag, but it is preserved so that a parsed
+   * message re-encodes to the very same bytes.
+   */
+  isTagged;
+  constructor(protectedHeaderBytes, unprotectedHeader, payload, tag, isTagged = true) {
+    this.protectedHeaderBytes = protectedHeaderBytes;
+    this.protectedHeader = CoseHeaders.parseProtected(protectedHeaderBytes);
+    this.unprotectedHeader = unprotectedHeader ?? CoseHeaders.empty;
+    this.payload = payload;
+    this.tag = tag;
+    this.isTagged = isTagged;
+  }
+  /** Whether the payload is detached. */
+  get isDetached() {
+    return this.payload === null;
+  }
+  /**
+   * The MAC algorithm, taken from the protected bucket and only otherwise
+   * from the unprotected one.
+   */
+  get algorithm() {
+    return this.protectedHeader.algorithm ?? this.unprotectedHeader.algorithm;
+  }
+  /** The key identifier, protected bucket first. */
+  get keyIdentifier() {
+    return this.protectedHeader.keyIdentifier ?? this.unprotectedHeader.keyIdentifier;
+  }
+  // ----------------------------------------------------- the MAC_structure
+  /**
+   * The encoded MAC_structure [RFC 9052, Section 6.3], which is the byte
+   * string the MAC is actually computed over:
+   *
+   * <code>
+   * MAC_structure = [
+   *     context      : "MAC0",
+   *     protected    : empty_or_serialized_map,
+   *     external_aad : bstr,
+   *     payload      : bstr
+   * ]
+   * </code>
+   *
+   * The full payload goes in here regardless of how it travels, so a
+   * detached message and an attached one carry the very same tag.
+   */
+  static toBeMaced(protectedHeaderBytes, payload, externalAad = null) {
+    return encode(cbor.array([
+      cbor.text(MAC0_CONTEXT),
+      cbor.bytes(protectedHeaderBytes),
+      cbor.bytes(externalAad ?? NO_BYTES),
+      cbor.bytes(payload)
+    ]));
+  }
+  /** The encoded MAC_structure of this message. */
+  toBeMaced(options = {}) {
+    const payload = resolvePayload(
+      this.payload,
+      options.detachedPayload ?? null,
+      "this COSE_Mac0 message"
+    );
+    if (!payload.ok)
+      throw new CoseError(payload.reason);
+    return _CoseMac0.toBeMaced(
+      this.protectedHeaderBytes,
+      payload.value,
+      options.externalAad ?? null
+    );
+  }
+  // --------------------------------------------------------------- creating
+  /**
+   * Authenticate a payload, placing the algorithm within the protected
+   * bucket and the key identifier within the unprotected one.
+   */
+  static create(payload, key, options = {}) {
+    const algorithm2 = requireMacAlgorithm(key);
+    const keyIdentifier = options.keyIdentifier === void 0 ? key.keyIdentifier : options.keyIdentifier;
+    const protectedHeader = new CoseHeaders([
+      [label(HeaderLabel.algorithm), cbor.int(algorithm2.id)]
+    ]);
+    return _CoseMac0.createWithHeaders(
+      payload,
+      key,
+      protectedHeader,
+      keyIdentifier === null ? null : new CoseHeaders([[
+        label(HeaderLabel.keyIdentifier),
+        cbor.bytes(keyIdentifier)
+      ]]),
+      options
+    );
+  }
+  /** Authenticate a payload with header buckets the caller composed. */
+  static createWithHeaders(payload, key, protectedHeader, unprotectedHeader = null, options = {}) {
+    const stated = protectedHeader.algorithm;
+    const algorithm2 = stated ?? requireMacAlgorithm(key);
+    requireSymmetric(key, algorithm2);
+    const protectedBytes = protectedHeader.toProtectedBytes();
+    const authenticated = options.canonicalizePayload === false ? payload : canonicalizePayload(payload);
+    if (options.detachPayload === true && !bytesEqual(authenticated, payload))
+      throw new CoseError("The payload of this COSE_Mac0 message is detached, so canonicalizing it here would authenticate bytes that nobody holds: canonicalize the payload yourself (canonicalizePayload), authenticate and transmit those, or pass canonicalizePayload: false to authenticate the payload exactly as it is!");
+    const tag = macWith(
+      algorithm2,
+      _CoseMac0.toBeMaced(protectedBytes, authenticated, options.externalAad ?? null),
+      key.privateKeyBytes()
+    );
+    return new _CoseMac0(
+      protectedBytes,
+      unprotectedHeader,
+      options.detachPayload === true ? null : authenticated,
+      tag,
+      options.tagged ?? true
+    );
+  }
+  // ----------------------------------------------------------- verification
+  /**
+   * Verify the authentication tag of this message.
+   *
+   * A failed verification is not an exception — it is the expected outcome
+   * of checking untrusted data — so the reason travels in the result. The
+   * comparison itself is constant time, which matters here in a way it does
+   * not for a signature: an early-returning compare would tell whoever is
+   * guessing a tag how many of their leading bytes were right.
+   */
+  verify(key, options = {}) {
+    const critical = verifyCriticalHeaderParameters(
+      this.protectedHeader,
+      this.unprotectedHeader,
+      options.alsoUnderstood ?? []
+    );
+    if (!critical.verified)
+      return critical;
+    const algorithm2 = resolveAlgorithm(
+      this.protectedHeader,
+      this.unprotectedHeader,
+      options.expectedAlgorithm ?? key.algorithm,
+      "This COSE_Mac0 message"
+    );
+    if (!algorithm2.ok)
+      return notVerified(algorithm2.reason);
+    const payload = resolvePayload(
+      this.payload,
+      options.detachedPayload ?? null,
+      "this COSE_Mac0 message"
+    );
+    if (!payload.ok)
+      return notVerified(payload.reason);
+    if (algorithm2.value.family !== "hmac")
+      return notVerified(`The COSE algorithm '${algorithm2.value.name}' is not a message authentication algorithm: a COSE_Mac0 message can not be authenticated with a signature algorithm!`);
+    if (key.keyType !== KEY_TYPE_SYMMETRIC)
+      return notVerified(`A COSE_Mac0 message needs a key of key type Symmetric [RFC 9053, Section 3.1], but a key of key type ${String(key.keyType)} was given!`);
+    let verified;
+    try {
+      verified = verifyMacWith(
+        algorithm2.value,
+        _CoseMac0.toBeMaced(
+          this.protectedHeaderBytes,
+          payload.value,
+          options.externalAad ?? null
+        ),
+        this.tag,
+        key.privateKeyBytes()
+      );
+    } catch (exception) {
+      return notVerified(exception instanceof Error ? exception.message : String(exception));
+    }
+    return verified ? VERIFIED : notVerified("The authentication tag is not the right one for this payload and this key!");
+  }
+  // ------------------------------------------------------- serialization
+  /** Read a COSE_Mac0 message, tagged or not. */
+  static parse(input) {
+    const value = input instanceof Uint8Array ? decode(input) : input;
+    let isTagged = false;
+    let message = value;
+    if (message.type === "tag") {
+      if (message.tag !== BigInt(COSE_MAC0_TAG))
+        throw new CoseError(`A COSE_Mac0 message must be tagged with CBOR tag ${String(COSE_MAC0_TAG)}, but was tagged with CBOR tag ${String(message.tag)}!`);
+      isTagged = true;
+      message = message.value;
+    }
+    if (message.type !== "array")
+      throw new CoseError(`A COSE_Mac0 message must be a CBOR array, but was a CBOR ${message.type}!`);
+    if (message.items.length !== 4)
+      throw new CoseError(`A COSE_Mac0 message must be a CBOR array of 4 elements, but had ${String(message.items.length)} element(s)!`);
+    const [protectedBytes, unprotected, payload, tag] = message.items;
+    if (protectedBytes?.type !== "bytes")
+      throw new CoseError("The protected header bucket of a COSE_Mac0 message must be a byte string!");
+    if (unprotected === void 0)
+      throw new CoseError("A COSE_Mac0 message must carry an unprotected header bucket!");
+    if (payload === void 0 || payload.type !== "null" && payload.type !== "bytes")
+      throw new CoseError("The payload of a COSE_Mac0 message must be a byte string, or null when it is detached!");
+    if (tag?.type !== "bytes")
+      throw new CoseError("The authentication tag of a COSE_Mac0 message must be a byte string!");
+    return new _CoseMac0(
+      protectedBytes.value,
+      CoseHeaders.parse(unprotected),
+      payload.type === "bytes" ? payload.value : null,
+      tag.value,
+      isTagged
+    );
+  }
+  /** The CBOR form of this message. */
+  toCbor() {
+    const message = cbor.array([
+      cbor.bytes(this.protectedHeaderBytes),
+      this.unprotectedHeader.toCbor(),
+      this.payload !== null ? cbor.bytes(this.payload) : cbor.nullValue,
+      cbor.bytes(this.tag)
+    ]);
+    return this.isTagged ? cbor.tag(COSE_MAC0_TAG, message) : message;
+  }
+  /** The CBOR encoding of this message. */
+  toBytes() {
+    return encode(this.toCbor());
+  }
+  /**
+   * A copy of this message without its payload.
+   *
+   * The tag stays valid: it never covered the message, only the
+   * MAC_structure, and the MAC_structure always holds the full payload.
+   */
+  detach() {
+    return new _CoseMac0(
+      this.protectedHeaderBytes,
+      this.unprotectedHeader,
+      null,
+      this.tag,
+      this.isTagged
+    );
+  }
+};
+function requireMacAlgorithm(key) {
+  if (key.algorithm === null)
+    throw new CoseError("A COSE_Mac0 message needs a MAC algorithm: either on the key or within the protected header bucket!");
+  if (key.algorithm.family !== "hmac")
+    throw new CoseError(`The COSE algorithm '${key.algorithm.name}' is not a message authentication algorithm!`);
+  return key.algorithm;
+}
+function requireSymmetric(key, algorithm2) {
+  if (algorithm2.family !== "hmac")
+    throw new CoseError(`The COSE algorithm '${algorithm2.name}' is not a message authentication algorithm!`);
+  if (key.keyType !== KEY_TYPE_SYMMETRIC)
+    throw new CoseError(`A COSE_Mac0 message needs a key of key type Symmetric [RFC 9053, Section 3.1], but a key of key type ${String(key.keyType)} was given!`);
+  if (key.algorithm !== null && key.algorithm.id !== algorithm2.id)
+    throw new CoseError(`This message is to be authenticated with '${algorithm2.name}', but the key names '${key.algorithm.name}' [RFC 9053, Section 3.1]!`);
+}
+var GCM_NONCE_SIZE = 12;
+var GCM_TAG_SIZE = 16;
+function checkKeySize(keySize, what) {
+  if (keySize !== 16 && keySize !== 24 && keySize !== 32)
+    throw new CoseError(`${what} needs a key of 16, 24 or 32 bytes, but a ${String(keySize)}-byte key was given!`);
+}
+function aesGcmEncrypt(key, nonce, plaintext, additionalData) {
+  if (nonce.length !== GCM_NONCE_SIZE)
+    throw new CoseError(`AES-GCM within COSE uses a ${String(GCM_NONCE_SIZE)}-byte nonce [RFC 9053, Section 4.1], but a ${String(nonce.length)}-byte one was given!`);
+  checkKeySize(key.length, "AES-GCM");
+  return gcm(key, nonce, additionalData).encrypt(plaintext);
+}
+function aesGcmDecrypt(key, nonce, ciphertext, additionalData) {
+  if (nonce.length !== GCM_NONCE_SIZE)
+    throw new CoseError(`AES-GCM within COSE uses a ${String(GCM_NONCE_SIZE)}-byte nonce [RFC 9053, Section 4.1], but a ${String(nonce.length)}-byte one was given!`);
+  if (ciphertext.length < GCM_TAG_SIZE)
+    return null;
+  checkKeySize(key.length, "AES-GCM");
+  try {
+    return gcm(key, nonce, additionalData).decrypt(ciphertext);
+  } catch {
+    return null;
+  }
+}
+function aesKeyWrap(keyEncryptionKey, contentKey) {
+  if (contentKey.length % 8 !== 0 || contentKey.length < 16)
+    throw new CoseError(`AES key wrap needs a key of at least 16 bytes and a multiple of 8 [RFC 3394], but a ${String(contentKey.length)}-byte key was given!`);
+  checkKeySize(keyEncryptionKey.length, "AES key wrap");
+  return aeskw(keyEncryptionKey).encrypt(contentKey);
+}
+function aesKeyUnwrap(keyEncryptionKey, wrapped) {
+  if (wrapped.length % 8 !== 0 || wrapped.length < 24)
+    return null;
+  try {
+    return aeskw(keyEncryptionKey).decrypt(wrapped);
+  } catch {
+    return null;
+  }
+}
+
+// src/recipient.ts
+var CoseRecipient = class _CoseRecipient {
+  /** The serialized protected bucket — empty for both implemented routes. */
+  protectedHeaderBytes;
+  /** The protected header parameters. */
+  protectedHeader;
+  /** The unprotected header parameters, which is where `alg` and `kid` live here. */
+  unprotectedHeader;
+  /** The wrapped content key, or a zero-length string for `direct`. */
+  ciphertext;
+  /** Recipient structures nested below this one. */
+  recipients;
+  constructor(protectedHeaderBytes, unprotectedHeader, ciphertext, recipients = []) {
+    this.protectedHeaderBytes = protectedHeaderBytes;
+    this.protectedHeader = CoseHeaders.parseProtected(protectedHeaderBytes);
+    this.unprotectedHeader = unprotectedHeader ?? CoseHeaders.empty;
+    this.ciphertext = ciphertext;
+    this.recipients = [...recipients];
+  }
+  /** The recipient algorithm, protected bucket first. */
+  get algorithm() {
+    return this.protectedHeader.algorithm ?? this.unprotectedHeader.algorithm;
+  }
+  /** The key identifier, protected bucket first. */
+  get keyIdentifier() {
+    return this.protectedHeader.keyIdentifier ?? this.unprotectedHeader.keyIdentifier;
+  }
+  // ---------------------------------------------------------- constructing
+  /**
+   * A `direct` recipient: the key it names *is* the content key.
+   *
+   * RFC 9053 §6.1.1 requires the protected bucket to be zero length, and
+   * nothing is carried in the ciphertext either — so this structure conveys
+   * a key identifier and an algorithm and no key material at all.
+   */
+  static direct(key, options = {}) {
+    requireSymmetric2(key, "A direct recipient");
+    return new _CoseRecipient(
+      NO_BYTES,
+      headersFor(
+        CoseAlgorithms.direct,
+        options.keyIdentifier === void 0 ? key.keyIdentifier : options.keyIdentifier
+      ),
+      NO_BYTES,
+      options.recipients ?? []
+    );
+  }
+  /**
+   * A key-wrap recipient: the content key, encrypted under the given
+   * key-encryption key.
+   *
+   * The algorithm follows from the width of the *key-encryption* key rather
+   * than from the content key, which is the direction people get wrong:
+   * `A256KW` wraps a 128-bit content key perfectly well.
+   */
+  static keyWrap(contentKey, keyEncryptionKey, options = {}) {
+    requireSymmetric2(keyEncryptionKey, "A key-wrap recipient");
+    const kek = keyEncryptionKey.privateKeyBytes();
+    const algorithm2 = keyWrapAlgorithmFor(kek.length);
+    if (keyEncryptionKey.algorithm !== null && keyEncryptionKey.algorithm.id !== algorithm2.id && keyEncryptionKey.algorithm.family === "keywrap")
+      throw new CoseError(`The key-encryption key names '${keyEncryptionKey.algorithm.name}', but its ${String(kek.length)} bytes are '${algorithm2.name}'!`);
+    return new _CoseRecipient(
+      NO_BYTES,
+      headersFor(
+        algorithm2,
+        options.keyIdentifier === void 0 ? keyEncryptionKey.keyIdentifier : options.keyIdentifier
+      ),
+      aesKeyWrap(kek, contentKey),
+      options.recipients ?? []
+    );
+  }
+  // ------------------------------------------------------------ recovering
+  /**
+   * The content key this recipient carries, or null when the given key is
+   * not the one it was built for.
+   *
+   * Null rather than an exception, and rather than a reason: a party holding
+   * several keys tries them in turn, and "not this one" is the ordinary
+   * answer rather than an error. For key wrap it is also the *only* honest
+   * answer — RFC 3394's integrity check is what distinguishes a wrong key
+   * from a right one, and saying more about which would say something about
+   * the key.
+   */
+  contentKey(key) {
+    const algorithm2 = this.algorithm;
+    if (algorithm2 === null)
+      return null;
+    if (key.keyType !== KEY_TYPE_SYMMETRIC)
+      return null;
+    if (algorithm2.family === "direct") {
+      if (this.protectedHeaderBytes.length !== 0 || this.ciphertext.length !== 0)
+        return null;
+      return key.privateKeyBytes();
+    }
+    if (algorithm2.family === "keywrap")
+      return aesKeyUnwrap(key.privateKeyBytes(), this.ciphertext);
+    return null;
+  }
+  // --------------------------------------------------------- serialization
+  /** Read a COSE_recipient. */
+  static parse(value) {
+    if (value.type !== "array")
+      throw new CoseError(`A COSE_recipient must be a CBOR array, but was a CBOR ${value.type}!`);
+    if (value.items.length !== 3 && value.items.length !== 4)
+      throw new CoseError(`A COSE_recipient must be a CBOR array of 3 or 4 elements, but had ${String(value.items.length)} element(s)!`);
+    const [protectedBytes, unprotected, ciphertext, nested] = value.items;
+    if (protectedBytes?.type !== "bytes")
+      throw new CoseError("The protected header bucket of a COSE_recipient must be a byte string!");
+    if (unprotected === void 0)
+      throw new CoseError("A COSE_recipient must carry an unprotected header bucket!");
+    if (ciphertext === void 0 || ciphertext.type !== "bytes" && ciphertext.type !== "null")
+      throw new CoseError("The ciphertext of a COSE_recipient must be a byte string, or null!");
+    let recipients = [];
+    if (nested !== void 0) {
+      if (nested.type !== "array" || nested.items.length === 0)
+        throw new CoseError("The nested recipients of a COSE_recipient must be a non-empty CBOR array!");
+      recipients = nested.items.map((each) => _CoseRecipient.parse(each));
+    }
+    return new _CoseRecipient(
+      protectedBytes.value,
+      CoseHeaders.parse(unprotected),
+      ciphertext.type === "bytes" ? ciphertext.value : NO_BYTES,
+      recipients
+    );
+  }
+  /** The CBOR form of this recipient. */
+  toCbor() {
+    const items = [
+      cbor.bytes(this.protectedHeaderBytes),
+      this.unprotectedHeader.toCbor(),
+      cbor.bytes(this.ciphertext)
+    ];
+    if (this.recipients.length > 0)
+      items.push(cbor.array(this.recipients.map((each) => each.toCbor())));
+    return cbor.array(items);
+  }
+  toString() {
+    return `${this.algorithm?.name ?? "unknown"} recipient, ${String(this.ciphertext.length)} bytes`;
+  }
+};
+function keyWrapAlgorithmFor(keySize) {
+  switch (keySize) {
+    case 16:
+      return CoseAlgorithms.A128KW;
+    case 24:
+      return CoseAlgorithms.A192KW;
+    case 32:
+      return CoseAlgorithms.A256KW;
+  }
+  throw new CoseError(`AES key wrap needs a key-encryption key of 16, 24 or 32 bytes, but a ${String(keySize)}-byte key was given!`);
+}
+function requireSymmetric2(key, what) {
+  if (key.keyType !== KEY_TYPE_SYMMETRIC)
+    throw new CoseError(`${what} needs a COSE key of key type Symmetric, but a key of key type ${String(key.keyType)} was given!`);
+}
+function headersFor(algorithm2, keyIdentifier) {
+  const parameters = [
+    [label(HeaderLabel.algorithm), algorithmToCbor(algorithm2)]
+  ];
+  if (keyIdentifier !== null)
+    parameters.push([label(HeaderLabel.keyIdentifier), cbor.bytes(keyIdentifier)]);
+  return new CoseHeaders(parameters);
+}
+
+// src/mac.ts
+var COSE_MAC_TAG = 97;
+var MAC_CONTEXT = "MAC";
+var CoseMac = class _CoseMac {
+  /** The serialized protected bucket, exactly as authenticated and received. */
+  protectedHeaderBytes;
+  /** The protected header parameters, which the authentication tag covers. */
+  protectedHeader;
+  /** The unprotected header parameters, which it does not. */
+  unprotectedHeader;
+  /** The authenticated payload, or null when it is detached. */
+  payload;
+  /** The authentication tag — not the CBOR tag. */
+  tag;
+  /** How the content key reaches each party. */
+  recipients;
+  /** Whether this message is wrapped within CBOR tag 97. */
+  isTagged;
+  constructor(protectedHeaderBytes, unprotectedHeader, payload, tag, recipients, isTagged = true) {
+    if (recipients.length === 0)
+      throw new CoseError("A COSE_Mac message must carry at least one recipient!");
+    this.protectedHeaderBytes = protectedHeaderBytes;
+    this.protectedHeader = CoseHeaders.parseProtected(protectedHeaderBytes);
+    this.unprotectedHeader = unprotectedHeader ?? CoseHeaders.empty;
+    this.payload = payload;
+    this.tag = tag;
+    this.recipients = [...recipients];
+    this.isTagged = isTagged;
+  }
+  /** Whether the payload is detached. */
+  get isDetached() {
+    return this.payload === null;
+  }
+  /** The MAC algorithm, protected bucket first. */
+  get algorithm() {
+    return this.protectedHeader.algorithm ?? this.unprotectedHeader.algorithm;
+  }
+  /**
+   * The encoded MAC_structure [RFC 9052, Section 6.3] with the `"MAC"`
+   * context — the one difference from a COSE_Mac0's.
+   */
+  static toBeMaced(protectedHeaderBytes, payload, externalAad = null) {
+    return encode(cbor.array([
+      cbor.text(MAC_CONTEXT),
+      cbor.bytes(protectedHeaderBytes),
+      cbor.bytes(externalAad ?? NO_BYTES),
+      cbor.bytes(payload)
+    ]));
+  }
+  /** The encoded MAC_structure of this message. */
+  toBeMaced(options = {}) {
+    const payload = resolvePayload(
+      this.payload,
+      options.detachedPayload ?? null,
+      "this COSE_Mac message"
+    );
+    if (!payload.ok)
+      throw new CoseError(payload.reason);
+    return _CoseMac.toBeMaced(
+      this.protectedHeaderBytes,
+      payload.value,
+      options.externalAad ?? null
+    );
+  }
+  /**
+   * Authenticate a payload under a content key, and deliver that key to each
+   * recipient.
+   *
+   * The content key is the caller's rather than generated here, for the same
+   * reason as everywhere else in this package: a generated one would make the
+   * message unreproducible, and whoever has a key management scheme has it
+   * for a reason.
+   */
+  static create(payload, contentKey, recipients, options = {}) {
+    const algorithm2 = contentKey.algorithm ?? (() => {
+      throw new CoseError("A COSE_Mac message needs a MAC algorithm on its content key!");
+    })();
+    if (algorithm2.family !== "hmac")
+      throw new CoseError(`The COSE algorithm '${algorithm2.name}' is not a message authentication algorithm!`);
+    if (contentKey.keyType !== KEY_TYPE_SYMMETRIC)
+      throw new CoseError(`A COSE_Mac message needs a content key of key type Symmetric, but a key of key type ${String(contentKey.keyType)} was given!`);
+    const protectedHeader = new CoseHeaders([
+      [label(HeaderLabel.algorithm), cbor.int(algorithm2.id)]
+    ]);
+    const protectedBytes = protectedHeader.toProtectedBytes();
+    const authenticated = options.canonicalizePayload === false ? payload : canonicalizePayload(payload);
+    if (options.detachPayload === true && !bytesEqual(authenticated, payload))
+      throw new CoseError("The payload of this COSE_Mac message is detached, so canonicalizing it here would authenticate bytes that nobody holds: canonicalize the payload yourself (canonicalizePayload), authenticate and transmit those, or pass canonicalizePayload: false to authenticate the payload exactly as it is!");
+    const tag = macWith(
+      algorithm2,
+      _CoseMac.toBeMaced(protectedBytes, authenticated, options.externalAad ?? null),
+      contentKey.privateKeyBytes()
+    );
+    return new _CoseMac(
+      protectedBytes,
+      null,
+      options.detachPayload === true ? null : authenticated,
+      tag,
+      recipients,
+      options.tagged ?? true
+    );
+  }
+  /**
+   * Verify this message with a key one of its recipients was built for.
+   *
+   * Every recipient is tried, because a party holding one key does not
+   * generally know which entry in the list is theirs.
+   */
+  verify(key, options = {}) {
+    const critical = verifyCriticalHeaderParameters(
+      this.protectedHeader,
+      this.unprotectedHeader,
+      options.alsoUnderstood ?? []
+    );
+    if (!critical.verified)
+      return critical;
+    const algorithm2 = resolveAlgorithm(
+      this.protectedHeader,
+      this.unprotectedHeader,
+      options.expectedAlgorithm ?? null,
+      "This COSE_Mac message"
+    );
+    if (!algorithm2.ok)
+      return notVerified(algorithm2.reason);
+    if (algorithm2.value.family !== "hmac")
+      return notVerified(`The COSE algorithm '${algorithm2.value.name}' is not a message authentication algorithm: a COSE_Mac message can not be authenticated with a signature algorithm!`);
+    const payload = resolvePayload(
+      this.payload,
+      options.detachedPayload ?? null,
+      "this COSE_Mac message"
+    );
+    if (!payload.ok)
+      return notVerified(payload.reason);
+    if (key.keyType !== KEY_TYPE_SYMMETRIC)
+      return notVerified(`A COSE_Mac message needs a key of key type Symmetric, but a key of key type ${String(key.keyType)} was given!`);
+    const toBeMaced = _CoseMac.toBeMaced(
+      this.protectedHeaderBytes,
+      payload.value,
+      options.externalAad ?? null
+    );
+    let tried = 0;
+    for (const recipient of this.recipients) {
+      const contentKey = recipient.contentKey(key);
+      if (contentKey === null)
+        continue;
+      tried++;
+      try {
+        if (verifyMacWith(algorithm2.value, toBeMaced, this.tag, contentKey))
+          return VERIFIED;
+      } catch {
+        continue;
+      }
+    }
+    return notVerified(tried === 0 ? "None of the recipients of this COSE_Mac message yielded a content key for the given key!" : "A recipient yielded a content key, and the authentication tag is not the right one under it!");
+  }
+  // --------------------------------------------------------- serialization
+  /** Read a COSE_Mac message, tagged or not. */
+  static parse(input) {
+    const value = input instanceof Uint8Array ? decode(input) : input;
+    let isTagged = false;
+    let message = value;
+    if (message.type === "tag") {
+      if (message.tag !== BigInt(COSE_MAC_TAG))
+        throw new CoseError(`A COSE_Mac message must be tagged with CBOR tag ${String(COSE_MAC_TAG)}, but was tagged with CBOR tag ${String(message.tag)}!`);
+      isTagged = true;
+      message = message.value;
+    }
+    if (message.type !== "array")
+      throw new CoseError(`A COSE_Mac message must be a CBOR array, but was a CBOR ${message.type}!`);
+    if (message.items.length !== 5)
+      throw new CoseError(`A COSE_Mac message must be a CBOR array of 5 elements, but had ${String(message.items.length)} element(s)!`);
+    const [protectedBytes, unprotected, payload, tag, recipients] = message.items;
+    if (protectedBytes?.type !== "bytes")
+      throw new CoseError("The protected header bucket of a COSE_Mac message must be a byte string!");
+    if (unprotected === void 0)
+      throw new CoseError("A COSE_Mac message must carry an unprotected header bucket!");
+    if (payload === void 0 || payload.type !== "null" && payload.type !== "bytes")
+      throw new CoseError("The payload of a COSE_Mac message must be a byte string, or null when it is detached!");
+    if (tag?.type !== "bytes")
+      throw new CoseError("The authentication tag of a COSE_Mac message must be a byte string!");
+    if (recipients?.type !== "array" || recipients.items.length === 0)
+      throw new CoseError("A COSE_Mac message must carry a non-empty array of recipients!");
+    return new _CoseMac(
+      protectedBytes.value,
+      CoseHeaders.parse(unprotected),
+      payload.type === "bytes" ? payload.value : null,
+      tag.value,
+      recipients.items.map((each) => CoseRecipient.parse(each)),
+      isTagged
+    );
+  }
+  /** The CBOR form of this message. */
+  toCbor() {
+    const message = cbor.array([
+      cbor.bytes(this.protectedHeaderBytes),
+      this.unprotectedHeader.toCbor(),
+      this.payload !== null ? cbor.bytes(this.payload) : cbor.nullValue,
+      cbor.bytes(this.tag),
+      cbor.array(this.recipients.map((each) => each.toCbor()))
+    ]);
+    return this.isTagged ? cbor.tag(COSE_MAC_TAG, message) : message;
+  }
+  /** The CBOR encoding of this message. */
+  toBytes() {
+    return encode(this.toCbor());
+  }
+  toString() {
+    return `COSE_Mac${this.algorithm !== null ? ` ${this.algorithm.name}` : ""}, ${String(this.recipients.length)} recipient(s)`;
+  }
+};
+
+// src/encrypt.ts
+var COSE_ENCRYPT0_TAG = 16;
+var COSE_ENCRYPT_TAG = 96;
+var ENCRYPT0_CONTEXT = "Encrypt0";
+var ENCRYPT_CONTEXT = "Encrypt";
+function encStructure(context, protectedHeaderBytes, externalAad = null) {
+  return encode(cbor.array([
+    cbor.text(context),
+    cbor.bytes(protectedHeaderBytes),
+    cbor.bytes(externalAad ?? NO_BYTES)
+  ]));
+}
+var CoseEncryptedBase = class {
+  /** The serialized protected bucket, exactly as authenticated and received. */
+  protectedHeaderBytes;
+  /** The protected header parameters, which the AEAD tag covers. */
+  protectedHeader;
+  /** The unprotected header parameters, which it does not. */
+  unprotectedHeader;
+  /** The ciphertext with the AEAD tag appended, or null when detached. */
+  ciphertext;
+  /** Whether this message is wrapped within its CBOR tag. */
+  isTagged;
+  constructor(protectedHeaderBytes, unprotectedHeader, ciphertext, isTagged) {
+    this.protectedHeaderBytes = protectedHeaderBytes;
+    this.protectedHeader = CoseHeaders.parseProtected(protectedHeaderBytes);
+    this.unprotectedHeader = unprotectedHeader ?? CoseHeaders.empty;
+    this.ciphertext = ciphertext;
+    this.isTagged = isTagged;
+  }
+  /** The content encryption algorithm, protected bucket first. */
+  get algorithm() {
+    return this.protectedHeader.algorithm ?? this.unprotectedHeader.algorithm;
+  }
+  /** The key identifier, protected bucket first. */
+  get keyIdentifier() {
+    return this.protectedHeader.keyIdentifier ?? this.unprotectedHeader.keyIdentifier;
+  }
+  /** The nonce, from either bucket. It travels in the clear and must never repeat. */
+  get iv() {
+    const value = this.protectedHeader.get(label(HeaderLabel.iv)) ?? this.unprotectedHeader.get(label(HeaderLabel.iv));
+    if (value === null)
+      return null;
+    if (value.type !== "bytes")
+      throw new CoseError("The initialization vector of a COSE message must be a byte string!");
+    return value.value;
+  }
+  /** Whether the ciphertext is detached. */
+  get isDetached() {
+    return this.ciphertext === null;
+  }
+  /**
+   * Decrypt with a content encryption key that has already been established.
+   *
+   * The shared half of both structures: `COSE_Encrypt0` uses it with the key
+   * the caller passed, `COSE_Encrypt` with the one a recipient yielded.
+   */
+  decryptWith(contentKey, context, options) {
+    const critical = verifyCriticalHeaderParameters(
+      this.protectedHeader,
+      this.unprotectedHeader,
+      options.alsoUnderstood ?? []
+    );
+    if (!critical.verified)
+      return notDecrypted(critical.reason);
+    const algorithm2 = options.expectedAlgorithm ?? this.protectedHeader.algorithm ?? this.unprotectedHeader.algorithm;
+    if (algorithm2 === null)
+      return notDecrypted("This COSE message does not state its content encryption algorithm: pass the expected algorithm explicitly!");
+    const stated = this.algorithm;
+    if (stated !== null && stated.id !== algorithm2.id)
+      return notDecrypted(`This COSE message was encrypted with the algorithm '${stated.name}', but the algorithm '${algorithm2.name}' was expected!`);
+    if (algorithm2.family !== "aesgcm")
+      return notDecrypted(`The COSE algorithm '${algorithm2.name}' is not a content encryption algorithm this implementation supports!`);
+    if (algorithm2.keySize !== null && contentKey.length !== algorithm2.keySize)
+      return notDecrypted(`The algorithm '${algorithm2.name}' needs a ${String(algorithm2.keySize)}-byte key, but the content key is ${String(contentKey.length)} bytes long!`);
+    let nonce;
+    try {
+      nonce = this.iv;
+    } catch (exception) {
+      return notDecrypted(exception instanceof Error ? exception.message : String(exception));
+    }
+    if (nonce === null)
+      return notDecrypted("This COSE message carries no initialization vector!");
+    if (nonce.length !== GCM_NONCE_SIZE)
+      return notDecrypted(`AES-GCM within COSE uses a ${String(GCM_NONCE_SIZE)}-byte nonce, but this message carries a ${String(nonce.length)}-byte one!`);
+    const carried = this.ciphertext;
+    const given = options.detachedCiphertext ?? null;
+    if (carried !== null && given !== null)
+      return notDecrypted("This COSE message carries its ciphertext, and a detached ciphertext was supplied as well!");
+    const body = carried ?? given;
+    if (body === null)
+      return notDecrypted("This COSE message carries a detached ciphertext, which has to be supplied in order to decrypt it!");
+    const plaintext = aesGcmDecrypt(
+      contentKey,
+      nonce,
+      body,
+      encStructure(
+        context,
+        this.protectedHeaderBytes,
+        options.externalAad ?? null
+      )
+    );
+    return plaintext === null ? notDecrypted("The ciphertext does not authenticate under this key: it was altered, or the key, the nonce or the additional data is not the right one!") : { decrypted: true, plaintext };
+  }
+};
+var CoseEncrypt0 = class _CoseEncrypt0 extends CoseEncryptedBase {
+  constructor(protectedHeaderBytes, unprotectedHeader, ciphertext, isTagged = true) {
+    super(protectedHeaderBytes, unprotectedHeader, ciphertext, isTagged);
+  }
+  /** The encoded Enc_structure of this message. */
+  toBeEncrypted(externalAad = null) {
+    return encStructure(ENCRYPT0_CONTEXT, this.protectedHeaderBytes, externalAad);
+  }
+  /** Encrypt a payload, with the algorithm in the protected bucket. */
+  static encrypt(plaintext, key, options) {
+    const algorithm2 = requireAesGcm(key);
+    const keyIdentifier = options.keyIdentifier === void 0 ? key.keyIdentifier : options.keyIdentifier;
+    const unprotected = [[label(HeaderLabel.iv), cbor.bytes(options.iv)]];
+    if (keyIdentifier !== null)
+      unprotected.push([label(HeaderLabel.keyIdentifier), cbor.bytes(keyIdentifier)]);
+    return _CoseEncrypt0.encryptWithHeaders(
+      plaintext,
+      key,
+      new CoseHeaders([[label(HeaderLabel.algorithm), algorithmToCbor(algorithm2)]]),
+      new CoseHeaders(unprotected),
+      options
+    );
+  }
+  /** Encrypt a payload with header buckets the caller composed. */
+  static encryptWithHeaders(plaintext, key, protectedHeader, unprotectedHeader, options) {
+    const algorithm2 = protectedHeader.algorithm ?? requireAesGcm(key);
+    requireUsable(key, algorithm2);
+    const protectedBytes = protectedHeader.toProtectedBytes();
+    const ciphertext = aesGcmEncrypt(
+      key.privateKeyBytes(),
+      options.iv,
+      plaintext,
+      encStructure(
+        ENCRYPT0_CONTEXT,
+        protectedBytes,
+        options.externalAad ?? null
+      )
+    );
+    return new _CoseEncrypt0(
+      protectedBytes,
+      unprotectedHeader,
+      options.detachPayload === true ? null : ciphertext,
+      options.tagged ?? true
+    );
+  }
+  /** Decrypt this message with the key it was encrypted for. */
+  decrypt(key, options = {}) {
+    if (key.keyType !== KEY_TYPE_SYMMETRIC)
+      return notDecrypted(`A COSE_Encrypt0 message needs a key of key type Symmetric, but a key of key type ${String(key.keyType)} was given!`);
+    return this.decryptWith(key.privateKeyBytes(), ENCRYPT0_CONTEXT, options);
+  }
+  /** Read a COSE_Encrypt0 message, tagged or not. */
+  static parse(input) {
+    const { isTagged, items } = untag(input, COSE_ENCRYPT0_TAG, 3, "COSE_Encrypt0");
+    const [protectedBytes, unprotected, ciphertext] = items;
+    return new _CoseEncrypt0(
+      bytesOfProtected(protectedBytes, "COSE_Encrypt0"),
+      CoseHeaders.parse(unprotected),
+      ciphertextOf(ciphertext, "COSE_Encrypt0"),
+      isTagged
+    );
+  }
+  /** The CBOR form of this message. */
+  toCbor() {
+    const message = cbor.array([
+      cbor.bytes(this.protectedHeaderBytes),
+      this.unprotectedHeader.toCbor(),
+      this.ciphertext !== null ? cbor.bytes(this.ciphertext) : cbor.nullValue
+    ]);
+    return this.isTagged ? cbor.tag(COSE_ENCRYPT0_TAG, message) : message;
+  }
+  /** The CBOR encoding of this message. */
+  toBytes() {
+    return encode(this.toCbor());
+  }
+  toString() {
+    return `COSE_Encrypt0${this.algorithm !== null ? ` ${this.algorithm.name}` : ""}, ${String(this.ciphertext?.length ?? 0)} bytes`;
+  }
+};
+var CoseEncrypt = class _CoseEncrypt extends CoseEncryptedBase {
+  /** How the content key reaches each party. */
+  recipients;
+  constructor(protectedHeaderBytes, unprotectedHeader, ciphertext, recipients, isTagged = true) {
+    super(protectedHeaderBytes, unprotectedHeader, ciphertext, isTagged);
+    if (recipients.length === 0)
+      throw new CoseError("A COSE_Encrypt message must carry at least one recipient!");
+    this.recipients = [...recipients];
+  }
+  /** The encoded Enc_structure of this message. */
+  toBeEncrypted(externalAad = null) {
+    return encStructure(ENCRYPT_CONTEXT, this.protectedHeaderBytes, externalAad);
+  }
+  /**
+   * Encrypt a payload under a content key, and deliver that key to each
+   * recipient.
+   *
+   * The content key is the caller's, not this method's, for the same reason
+   * the nonce is: generating one here would make the message
+   * unreproducible, and a caller who has a key management scheme has one for
+   * a reason.
+   */
+  static encrypt(plaintext, contentKey, recipients, options) {
+    const algorithm2 = requireAesGcm(contentKey);
+    requireUsable(contentKey, algorithm2);
+    const protectedHeader = new CoseHeaders([
+      [label(HeaderLabel.algorithm), algorithmToCbor(algorithm2)]
+    ]);
+    const protectedBytes = protectedHeader.toProtectedBytes();
+    const ciphertext = aesGcmEncrypt(
+      contentKey.privateKeyBytes(),
+      options.iv,
+      plaintext,
+      encStructure(
+        ENCRYPT_CONTEXT,
+        protectedBytes,
+        options.externalAad ?? null
+      )
+    );
+    return new _CoseEncrypt(
+      protectedBytes,
+      new CoseHeaders([[label(HeaderLabel.iv), cbor.bytes(options.iv)]]),
+      options.detachPayload === true ? null : ciphertext,
+      recipients,
+      options.tagged ?? true
+    );
+  }
+  /**
+   * Decrypt this message with a key one of its recipients was built for.
+   *
+   * Every recipient is tried, because a party holding one key does not
+   * generally know which entry in the list is theirs. A recipient that does
+   * not yield a key is not an error — it is somebody else's.
+   */
+  decrypt(key, options = {}) {
+    if (key.keyType !== KEY_TYPE_SYMMETRIC)
+      return notDecrypted(`A COSE_Encrypt message needs a key of key type Symmetric, but a key of key type ${String(key.keyType)} was given!`);
+    let tried = 0;
+    for (const recipient of this.recipients) {
+      const contentKey = recipient.contentKey(key);
+      if (contentKey === null)
+        continue;
+      tried++;
+      const result = this.decryptWith(contentKey, ENCRYPT_CONTEXT, options);
+      if (result.decrypted)
+        return result;
+    }
+    return notDecrypted(tried === 0 ? "None of the recipients of this COSE_Encrypt message yielded a content key for the given key!" : "A recipient yielded a content key, but the ciphertext did not authenticate under it!");
+  }
+  /** Read a COSE_Encrypt message, tagged or not. */
+  static parse(input) {
+    const { isTagged, items } = untag(input, COSE_ENCRYPT_TAG, 4, "COSE_Encrypt");
+    const [protectedBytes, unprotected, ciphertext, recipients] = items;
+    if (recipients?.type !== "array" || recipients.items.length === 0)
+      throw new CoseError("A COSE_Encrypt message must carry a non-empty array of recipients!");
+    return new _CoseEncrypt(
+      bytesOfProtected(protectedBytes, "COSE_Encrypt"),
+      CoseHeaders.parse(unprotected),
+      ciphertextOf(ciphertext, "COSE_Encrypt"),
+      recipients.items.map((each) => CoseRecipient.parse(each)),
+      isTagged
+    );
+  }
+  /** The CBOR form of this message. */
+  toCbor() {
+    const message = cbor.array([
+      cbor.bytes(this.protectedHeaderBytes),
+      this.unprotectedHeader.toCbor(),
+      this.ciphertext !== null ? cbor.bytes(this.ciphertext) : cbor.nullValue,
+      cbor.array(this.recipients.map((each) => each.toCbor()))
+    ]);
+    return this.isTagged ? cbor.tag(COSE_ENCRYPT_TAG, message) : message;
+  }
+  /** The CBOR encoding of this message. */
+  toBytes() {
+    return encode(this.toCbor());
+  }
+  toString() {
+    return `COSE_Encrypt${this.algorithm !== null ? ` ${this.algorithm.name}` : ""}, ${String(this.recipients.length)} recipient(s)`;
+  }
+};
+function untag(input, tag, elements, what) {
+  const value = input instanceof Uint8Array ? decode(input) : input;
+  let isTagged = false;
+  let message = value;
+  if (message.type === "tag") {
+    if (message.tag !== BigInt(tag))
+      throw new CoseError(`A ${what} message must be tagged with CBOR tag ${String(tag)}, but was tagged with CBOR tag ${String(message.tag)}!`);
+    isTagged = true;
+    message = message.value;
+  }
+  if (message.type !== "array")
+    throw new CoseError(`A ${what} message must be a CBOR array, but was a CBOR ${message.type}!`);
+  if (message.items.length !== elements)
+    throw new CoseError(`A ${what} message must be a CBOR array of ${String(elements)} elements, but had ${String(message.items.length)} element(s)!`);
+  return { isTagged, items: message.items };
+}
+function bytesOfProtected(value, what) {
+  if (value?.type !== "bytes")
+    throw new CoseError(`The protected header bucket of a ${what} message must be a byte string!`);
+  return value.value;
+}
+function ciphertextOf(value, what) {
+  if (value.type === "null")
+    return null;
+  if (value.type !== "bytes")
+    throw new CoseError(`The ciphertext of a ${what} message must be a byte string, or null when it is detached!`);
+  return value.value;
+}
+function requireAesGcm(key) {
+  if (key.algorithm === null)
+    throw new CoseError("An encrypted COSE message needs a content encryption algorithm: either on the key or within the protected header bucket!");
+  if (key.algorithm.family !== "aesgcm")
+    throw new CoseError(`The COSE algorithm '${key.algorithm.name}' is not a content encryption algorithm this implementation supports!`);
+  return key.algorithm;
+}
+function requireUsable(key, algorithm2) {
+  if (algorithm2.family !== "aesgcm")
+    throw new CoseError(`The COSE algorithm '${algorithm2.name}' is not a content encryption algorithm this implementation supports!`);
+  if (key.keyType !== KEY_TYPE_SYMMETRIC)
+    throw new CoseError(`An encrypted COSE message needs a key of key type Symmetric [RFC 9053, Section 4.1], but a key of key type ${String(key.keyType)} was given!`);
+  if (key.algorithm !== null && key.algorithm.id !== algorithm2.id)
+    throw new CoseError(`This message is to be encrypted with '${algorithm2.name}', but the key names '${key.algorithm.name}' [RFC 9053, Section 4.1]!`);
+  const width = key.privateKeyBytes().length;
+  if (algorithm2.keySize !== null && width !== algorithm2.keySize)
+    throw new CoseError(`The algorithm '${algorithm2.name}' needs a ${String(algorithm2.keySize)}-byte key, but a ${String(width)}-byte key was given!`);
+}
+
+export { ALL_ALGORITHMS, ALL_CURVES, COSE_ENCRYPT0_TAG, COSE_ENCRYPT_TAG, COSE_MAC0_TAG, COSE_MAC_TAG, COSE_SIGN1_TAG, COSE_SIGN_TAG, COUNTERSIGNATURE_CONTEXT, CoseAlgorithms, CoseCertificateChain, CoseCertificateHash, CoseCurves, CoseEncrypt, CoseEncrypt0, CoseError, CoseHeaders, CoseKey, CoseMac, CoseMac0, CoseRecipient, CoseSign, CoseSign1, CoseSignature, DETERMINISTIC, DerReader, ENCRYPT0_CONTEXT, ENCRYPT_CONTEXT, GCM_NONCE_SIZE, GCM_TAG_SIZE, HeaderLabel, KEY_TYPE_AKP, KEY_TYPE_EC2, KEY_TYPE_OKP, KEY_TYPE_SYMMETRIC, KeyLabel, KeyUsage, MAC0_CONTEXT, MAC_CONTEXT, MLDSA_PARAMETER_SETS, MLDSA_SEED_SIZE, MLDSA_SIZES, NO_BYTES, PRESERVE, SIGNATURE_CONTEXT, Tag, VERIFIED, X509Certificate, X509Name, aesGcmDecrypt, aesGcmEncrypt, aesKeyUnwrap, aesKeyWrap, algorithmById, algorithmByName, algorithmFromCbor, algorithmToCbor, bytesEqual, canonicalizePayload, contentsOf, contextTag, curveById, curveByName, curveByOid, decompressY, derBitString, derBitStringRaw, derBoolean, derInteger, derObjectIdentifier, derString, derTime, digest, eddsaPublicKeyFor, eddsaSign, eddsaSignatureSize, eddsaVerify, encStructure, headerLabelName, hmac, isCanonicalPayload, isEddsaCurve, isImplemented, isMldsaParameterSet, isOnCurve, isUnderstood, keyWrapAlgorithmFor, label, macTag, macWith, mldsaPublicKeyFor, mldsaSign, mldsaVerify, notDecrypted, notVerified, oidOfCurve, publicKeyFor, resolveCurve, sameAlgorithm, sameLabel, signWith, signatureAlgorithmByOid, tagsEqual, verifyCriticalHeaderParameters, verifyMacWith, verifyWith };
+//# sourceMappingURL=index.js.map