jose 4.0.3 → 4.0.4

package/dist/node/cjs/lib/cek.js

@@ -1,22 +1,25 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.bitLengths = void 0;
+exports.bitLength = void 0;
 const errors_js_1 = require("../util/errors.js");
 const random_js_1 = require("../runtime/random.js");
-const bitLengths = new Map([
-    ['A128CBC-HS256', 256],
-    ['A128GCM', 128],
-    ['A192CBC-HS384', 384],
-    ['A192GCM', 192],
-    ['A256CBC-HS512', 512],
-    ['A256GCM', 256],
-]);
-exports.bitLengths = bitLengths;
-const generateCek = (alg) => {
-    const bitLength = bitLengths.get(alg);
-    if (!bitLength) {
-        throw new errors_js_1.JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
+function bitLength(alg) {
+    switch (alg) {
+        case 'A128CBC-HS256':
+            return 256;
+        case 'A192CBC-HS384':
+            return 384;
+        case 'A256CBC-HS512':
+            return 512;
+        case 'A128GCM':
+            return 128;
+        case 'A192GCM':
+            return 192;
+        case 'A256GCM':
+            return 256;
+        default:
+            throw new errors_js_1.JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }
-    return (0, random_js_1.default)(new Uint8Array(bitLength >> 3));
-};
-exports.default = generateCek;
+}
+exports.bitLength = bitLength;
+exports.default = (alg) => (0, random_js_1.default)(new Uint8Array(bitLength(alg) >> 3));

package/dist/node/cjs/lib/check_iv_length.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const errors_js_1 = require("../util/errors.js");
 const iv_js_1 = require("./iv.js");
 const checkIvLength = (enc, iv) => {
-    if (iv.length << 3 !== iv_js_1.bitLengths.get(enc)) {
+    if (iv.length << 3 !== (0, iv_js_1.bitLength)(enc)) {
         throw new errors_js_1.JWEInvalid('Invalid Initialization Vector length');
     }
 };

package/dist/node/cjs/lib/crypto_key.js

@@ -0,0 +1,165 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkEncCryptoKey = exports.checkSigCryptoKey = void 0;
+const global_js_1 = require("../runtime/global.js");
+function getHashLength(hash) {
+    return parseInt(hash === null || hash === void 0 ? void 0 : hash.name.substr(4), 10);
+}
+function getNamedCurve(alg) {
+    switch (alg) {
+        case 'ES256':
+            return 'P-256';
+        case 'ES384':
+            return 'P-384';
+        case 'ES512':
+            return 'P-521';
+    }
+}
+function checkUsage(key, usages) {
+    if (usages.length && !usages.some((expected) => key.usages.includes(expected))) {
+        let msg = 'CryptoKey does not support this operation, its usages must include ';
+        if (usages.length > 2) {
+            const last = usages.pop();
+            msg += `one of ${usages.join(', ')}, or ${last}.`;
+        }
+        else if (usages.length === 2) {
+            msg += `one of ${usages[0]} or ${usages[1]}.`;
+        }
+        else {
+            msg += `${usages[0]}.`;
+        }
+        throw new TypeError(msg);
+    }
+}
+function checkSigCryptoKey(key, alg, ...usages) {
+    switch (alg) {
+        case 'HS256':
+        case 'HS384':
+        case 'HS512': {
+            if (key.algorithm.name !== 'HMAC') {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be HMAC.`);
+            }
+            const expected = parseInt(alg.substr(2), 10);
+            const actual = getHashLength(key.algorithm.hash);
+            if (actual !== expected) {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.hash must be SHA-${expected}.`);
+            }
+            break;
+        }
+        case 'RS256':
+        case 'RS384':
+        case 'RS512': {
+            if (key.algorithm.name !== 'RSASSA-PKCS1-v1_5') {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be RSASSA-PKCS1-v1_5.`);
+            }
+            const expected = parseInt(alg.substr(2), 10);
+            const actual = getHashLength(key.algorithm.hash);
+            if (actual !== expected) {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.hash must be SHA-${expected}.`);
+            }
+            break;
+        }
+        case 'PS256':
+        case 'PS384':
+        case 'PS512': {
+            if (key.algorithm.name !== 'RSA-PSS') {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be RSA-PSS.`);
+            }
+            const expected = parseInt(alg.substr(2), 10);
+            const actual = getHashLength(key.algorithm.hash);
+            if (actual !== expected) {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.hash must be SHA-${expected}.`);
+            }
+            break;
+        }
+        case (0, global_js_1.isNodeJs)() && 'EdDSA': {
+            if (key.algorithm.name !== 'NODE-ED25519' && key.algorithm.name !== 'NODE-ED448') {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be NODE-ED25519 or NODE-ED448.`);
+            }
+            break;
+        }
+        case (0, global_js_1.isCloudflareWorkers)() && 'EdDSA': {
+            if (key.algorithm.name !== 'NODE-ED25519') {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be NODE-ED25519.`);
+            }
+            break;
+        }
+        case 'ES256':
+        case 'ES384':
+        case 'ES512': {
+            if (key.algorithm.name !== 'ECDSA') {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be ECDSA.`);
+            }
+            const expected = getNamedCurve(alg);
+            const actual = key.algorithm.namedCurve;
+            if (actual !== expected) {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.namedCurve must be ${expected}.`);
+            }
+            break;
+        }
+        default:
+            throw new TypeError('CryptoKey does not support this operation');
+    }
+    checkUsage(key, usages);
+}
+exports.checkSigCryptoKey = checkSigCryptoKey;
+function checkEncCryptoKey(key, alg, ...usages) {
+    switch (alg) {
+        case 'A128GCM':
+        case 'A192GCM':
+        case 'A256GCM': {
+            if (key.algorithm.name !== 'AES-GCM') {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be AES-GCM.`);
+            }
+            const expected = parseInt(alg.substr(1, 3), 10);
+            const actual = key.algorithm.length;
+            if (actual !== expected) {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.length must be ${expected}.`);
+            }
+            break;
+        }
+        case 'A128KW':
+        case 'A192KW':
+        case 'A256KW': {
+            if (key.algorithm.name !== 'AES-KW') {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be AES-KW.`);
+            }
+            const expected = parseInt(alg.substr(1, 3), 10);
+            const actual = key.algorithm.length;
+            if (actual !== expected) {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.length must be ${expected}.`);
+            }
+            break;
+        }
+        case 'ECDH-ES':
+            if (key.algorithm.name !== 'ECDH') {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be ECDH.`);
+            }
+            break;
+        case 'PBES2-HS256+A128KW':
+        case 'PBES2-HS384+A192KW':
+        case 'PBES2-HS512+A256KW':
+            if (key.algorithm.name !== 'PBKDF2') {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be PBKDF2.`);
+            }
+            break;
+        case 'RSA-OAEP':
+        case 'RSA-OAEP-256':
+        case 'RSA-OAEP-384':
+        case 'RSA-OAEP-512': {
+            if (key.algorithm.name !== 'RSA-OAEP') {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be RSA-OAEP.`);
+            }
+            const expected = parseInt(alg.substr(9), 10) || 1;
+            const actual = getHashLength(key.algorithm.hash);
+            if (actual !== expected) {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.hash must be SHA-${expected}.`);
+            }
+            break;
+        }
+        default:
+            throw new TypeError('CryptoKey does not support this operation');
+    }
+    checkUsage(key, usages);
+}
+exports.checkEncCryptoKey = checkEncCryptoKey;

package/dist/node/cjs/lib/decrypt_key_management.js

@@ -42,7 +42,7 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
                     throw new errors_js_1.JWEInvalid(`JOSE Header "apv" (Agreement PartyVInfo) invalid`);
                 partyVInfo = (0, base64url_js_1.decode)(joseHeader.apv);
             }
-            const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, parseInt(alg.substr(-5, 3), 10) || cek_js_1.bitLengths.get(joseHeader.enc), partyUInfo, partyVInfo);
+            const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, parseInt(alg.substr(-5, 3), 10) || (0, cek_js_1.bitLength)(joseHeader.enc), partyUInfo, partyVInfo);
             if (alg === 'ECDH-ES')
                 return sharedSecret;
             if (encryptedKey === undefined)

package/dist/node/cjs/lib/encrypt_key_management.js

@@ -31,7 +31,7 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
             let { epk: ephemeralKey } = providedParameters;
             ephemeralKey || (ephemeralKey = await ECDH.generateEpk(key));
             const { x, y, crv, kty } = await (0, export_js_1.exportJWK)(ephemeralKey);
-            const sharedSecret = await ECDH.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, parseInt(alg.substr(-5, 3), 10) || cek_js_1.bitLengths.get(enc), apu, apv);
+            const sharedSecret = await ECDH.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, parseInt(alg.substr(-5, 3), 10) || (0, cek_js_1.bitLength)(enc), apu, apv);
             parameters = { epk: { x, y, crv, kty } };
             if (apu)
                 parameters.apu = (0, base64url_js_1.encode)(apu);

package/dist/node/cjs/lib/iv.js

@@ -1,25 +1,31 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.bitLengths = void 0;
+exports.bitLength = void 0;
 const errors_js_1 = require("../util/errors.js");
 const random_js_1 = require("../runtime/random.js");
-const bitLengths = new Map([
-    ['A128CBC-HS256', 128],
-    ['A128GCM', 96],
-    ['A128GCMKW', 96],
-    ['A192CBC-HS384', 128],
-    ['A192GCM', 96],
-    ['A192GCMKW', 96],
-    ['A256CBC-HS512', 128],
-    ['A256GCM', 96],
-    ['A256GCMKW', 96],
-]);
-exports.bitLengths = bitLengths;
-const generateIv = (alg) => {
-    const bitLength = bitLengths.get(alg);
-    if (!bitLength) {
-        throw new errors_js_1.JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
+function bitLength(alg) {
+    switch (alg) {
+        case 'A128CBC-HS256':
+            return 128;
+        case 'A128GCM':
+            return 96;
+        case 'A128GCMKW':
+            return 96;
+        case 'A192CBC-HS384':
+            return 128;
+        case 'A192GCM':
+            return 96;
+        case 'A192GCMKW':
+            return 96;
+        case 'A256CBC-HS512':
+            return 128;
+        case 'A256GCM':
+            return 96;
+        case 'A256GCMKW':
+            return 96;
+        default:
+            throw new errors_js_1.JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }
-    return (0, random_js_1.default)(new Uint8Array(bitLength >> 3));
-};
-exports.default = generateIv;
+}
+exports.bitLength = bitLength;
+exports.default = (alg) => (0, random_js_1.default)(new Uint8Array(bitLength(alg) >> 3));

package/dist/node/cjs/runtime/aeskw.js

@@ -7,6 +7,7 @@ const errors_js_1 = require("../util/errors.js");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
 const secret_key_js_1 = require("./secret_key.js");
 const webcrypto_js_1 = require("./webcrypto.js");
+const crypto_key_js_1 = require("../lib/crypto_key.js");
 const is_key_object_js_1 = require("./is_key_object.js");
 const invalid_key_input_js_1 = require("./invalid_key_input.js");
 const ciphers_js_1 = require("./ciphers.js");
@@ -23,7 +24,8 @@ function ensureKeyObject(key, alg, usage) {
         return (0, secret_key_js_1.default)(key);
     }
     if ((0, webcrypto_js_1.isCryptoKey)(key)) {
-        return (0, webcrypto_js_1.getKeyObject)(key, alg, usage);
+        (0, crypto_key_js_1.checkEncCryptoKey)(key, alg, usage);
+        return crypto_1.KeyObject.from(key);
     }
     throw new TypeError((0, invalid_key_input_js_1.default)(key, 'KeyObject', 'CryptoKey', 'Uint8Array'));
 }

package/dist/node/cjs/runtime/asn1.js

@@ -12,7 +12,7 @@ const genericExport = (keyType, keyFormat, key) => {
         if (!key.extractable) {
             throw new TypeError('CryptoKey is not extractable');
         }
-        keyObject = (0, webcrypto_js_1.getKeyObject)(key);
+        keyObject = crypto_1.KeyObject.from(key);
     }
     else if ((0, is_key_object_js_1.default)(key)) {
         keyObject = key;

package/dist/node/cjs/runtime/decrypt.js

@@ -8,6 +8,7 @@ const errors_js_1 = require("../util/errors.js");
 const timing_safe_equal_js_1 = require("./timing_safe_equal.js");
 const cbc_tag_js_1 = require("./cbc_tag.js");
 const webcrypto_js_1 = require("./webcrypto.js");
+const crypto_key_js_1 = require("../lib/crypto_key.js");
 const is_key_object_js_1 = require("./is_key_object.js");
 const invalid_key_input_js_1 = require("./invalid_key_input.js");
 const ciphers_js_1 = require("./ciphers.js");
@@ -66,7 +67,8 @@ async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
 const decrypt = async (enc, cek, ciphertext, iv, tag, aad) => {
     let key;
     if ((0, webcrypto_js_1.isCryptoKey)(cek)) {
-        key = (0, webcrypto_js_1.getKeyObject)(cek, enc, 'decrypt');
+        (0, crypto_key_js_1.checkEncCryptoKey)(cek, enc, 'decrypt');
+        key = crypto_1.KeyObject.from(cek);
     }
     else if (cek instanceof Uint8Array || (0, is_key_object_js_1.default)(cek)) {
         key = cek;

package/dist/node/cjs/runtime/ecdhes.js

@@ -8,13 +8,15 @@ const buffer_utils_js_1 = require("../lib/buffer_utils.js");
 const digest_js_1 = require("./digest.js");
 const errors_js_1 = require("../util/errors.js");
 const webcrypto_js_1 = require("./webcrypto.js");
+const crypto_key_js_1 = require("../lib/crypto_key.js");
 const is_key_object_js_1 = require("./is_key_object.js");
 const invalid_key_input_js_1 = require("./invalid_key_input.js");
 const generateKeyPair = (0, util_1.promisify)(crypto_1.generateKeyPair);
 const deriveKey = async (publicKee, privateKee, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) => {
     let publicKey;
     if ((0, webcrypto_js_1.isCryptoKey)(publicKee)) {
-        publicKey = (0, webcrypto_js_1.getKeyObject)(publicKee, 'ECDH-ES');
+        (0, crypto_key_js_1.checkEncCryptoKey)(publicKee, 'ECDH-ES');
+        publicKey = crypto_1.KeyObject.from(publicKee);
     }
     else if ((0, is_key_object_js_1.default)(publicKee)) {
         publicKey = publicKee;
@@ -24,7 +26,8 @@ const deriveKey = async (publicKee, privateKee, algorithm, keyLength, apu = new
     }
     let privateKey;
     if ((0, webcrypto_js_1.isCryptoKey)(privateKee)) {
-        privateKey = (0, webcrypto_js_1.getKeyObject)(privateKee, 'ECDH-ES', 'deriveBits', 'deriveKey');
+        (0, crypto_key_js_1.checkEncCryptoKey)(privateKee, 'ECDH-ES', 'deriveBits', 'deriveKey');
+        privateKey = crypto_1.KeyObject.from(privateKee);
     }
     else if ((0, is_key_object_js_1.default)(privateKee)) {
         privateKey = privateKee;
@@ -40,7 +43,7 @@ exports.deriveKey = deriveKey;
 const generateEpk = async (kee) => {
     let key;
     if ((0, webcrypto_js_1.isCryptoKey)(kee)) {
-        key = (0, webcrypto_js_1.getKeyObject)(kee);
+        key = crypto_1.KeyObject.from(kee);
     }
     else if ((0, is_key_object_js_1.default)(kee)) {
         key = kee;

package/dist/node/cjs/runtime/encrypt.js

@@ -6,6 +6,7 @@ const check_cek_length_js_1 = require("./check_cek_length.js");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
 const cbc_tag_js_1 = require("./cbc_tag.js");
 const webcrypto_js_1 = require("./webcrypto.js");
+const crypto_key_js_1 = require("../lib/crypto_key.js");
 const is_key_object_js_1 = require("./is_key_object.js");
 const invalid_key_input_js_1 = require("./invalid_key_input.js");
 const errors_js_1 = require("../util/errors.js");
@@ -44,7 +45,8 @@ async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
 const encrypt = async (enc, plaintext, cek, iv, aad) => {
     let key;
     if ((0, webcrypto_js_1.isCryptoKey)(cek)) {
-        key = (0, webcrypto_js_1.getKeyObject)(cek, enc, 'encrypt');
+        (0, crypto_key_js_1.checkEncCryptoKey)(cek, enc, 'encrypt');
+        key = crypto_1.KeyObject.from(cek);
     }
     else if (cek instanceof Uint8Array || (0, is_key_object_js_1.default)(cek)) {
         key = cek;

package/dist/node/cjs/runtime/get_named_curve.js

@@ -30,7 +30,7 @@ const getNamedCurve = (kee, raw) => {
     var _a;
     let key;
     if ((0, webcrypto_js_1.isCryptoKey)(kee)) {
-        key = (0, webcrypto_js_1.getKeyObject)(kee);
+        key = crypto_1.KeyObject.from(kee);
     }
     else if ((0, is_key_object_js_1.default)(kee)) {
         key = kee;

package/dist/node/cjs/runtime/get_sign_verify_key.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const crypto = require("crypto");
+const crypto_1 = require("crypto");
 const webcrypto_js_1 = require("./webcrypto.js");
+const crypto_key_js_1 = require("../lib/crypto_key.js");
 const secret_key_js_1 = require("./secret_key.js");
 const invalid_key_input_js_1 = require("./invalid_key_input.js");
 function getSignVerifyKey(alg, key, usage) {
@@ -11,11 +12,12 @@ function getSignVerifyKey(alg, key, usage) {
         }
         return (0, secret_key_js_1.default)(key);
     }
-    if (key instanceof crypto.KeyObject) {
+    if (key instanceof crypto_1.KeyObject) {
         return key;
     }
     if ((0, webcrypto_js_1.isCryptoKey)(key)) {
-        return (0, webcrypto_js_1.getKeyObject)(key, alg, usage);
+        (0, crypto_key_js_1.checkSigCryptoKey)(key, alg, usage);
+        return crypto_1.KeyObject.from(key);
     }
     throw new TypeError((0, invalid_key_input_js_1.default)(key, 'KeyObject', 'CryptoKey', 'Uint8Array'));
 }

package/dist/node/cjs/runtime/global.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isNodeJs = exports.isCloudflareWorkers = void 0;
+function isCloudflareWorkers() {
+    return false;
+}
+exports.isCloudflareWorkers = isCloudflareWorkers;
+function isNodeJs() {
+    return true;
+}
+exports.isNodeJs = isNodeJs;

package/dist/node/cjs/runtime/key_to_jwk.js

@@ -19,7 +19,7 @@ const keyToJWK = (key) => {
         if (!key.extractable) {
             throw new TypeError('CryptoKey is not extractable');
         }
-        keyObject = (0, webcrypto_js_1.getKeyObject)(key);
+        keyObject = crypto_1.KeyObject.from(key);
     }
     else if ((0, is_key_object_js_1.default)(key)) {
         keyObject = key;

package/dist/node/cjs/runtime/pbes2kw.js

@@ -9,6 +9,7 @@ const base64url_js_1 = require("./base64url.js");
 const aeskw_js_1 = require("./aeskw.js");
 const check_p2s_js_1 = require("../lib/check_p2s.js");
 const webcrypto_js_1 = require("./webcrypto.js");
+const crypto_key_js_1 = require("../lib/crypto_key.js");
 const is_key_object_js_1 = require("./is_key_object.js");
 const invalid_key_input_js_1 = require("./invalid_key_input.js");
 const pbkdf2 = (0, util_1.promisify)(crypto_1.pbkdf2);
@@ -20,7 +21,8 @@ function getPassword(key, alg) {
         return key;
     }
     if ((0, webcrypto_js_1.isCryptoKey)(key)) {
-        return (0, webcrypto_js_1.getKeyObject)(key, alg, 'deriveBits', 'deriveKey').export();
+        (0, crypto_key_js_1.checkEncCryptoKey)(key, alg, 'deriveBits', 'deriveKey');
+        return crypto_1.KeyObject.from(key).export();
     }
     throw new TypeError((0, invalid_key_input_js_1.default)(key, 'KeyObject', 'CryptoKey', 'Uint8Array'));
 }

package/dist/node/cjs/runtime/rsaes.js

@@ -4,6 +4,7 @@ exports.decrypt = exports.encrypt = void 0;
 const crypto_1 = require("crypto");
 const check_modulus_length_js_1 = require("./check_modulus_length.js");
 const webcrypto_js_1 = require("./webcrypto.js");
+const crypto_key_js_1 = require("../lib/crypto_key.js");
 const is_key_object_js_1 = require("./is_key_object.js");
 const invalid_key_input_js_1 = require("./invalid_key_input.js");
 const checkKey = (key, alg) => {
@@ -44,7 +45,8 @@ function ensureKeyObject(key, alg, ...usages) {
         return key;
     }
     if ((0, webcrypto_js_1.isCryptoKey)(key)) {
-        return (0, webcrypto_js_1.getKeyObject)(key, alg, ...usages);
+        (0, crypto_key_js_1.checkEncCryptoKey)(key, alg, ...usages);
+        return crypto_1.KeyObject.from(key);
     }
     throw new TypeError((0, invalid_key_input_js_1.default)(key, 'KeyObject', 'CryptoKey'));
 }

package/dist/node/cjs/runtime/webcrypto.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getKeyObject = exports.checkCryptoKey = exports.isCryptoKey = void 0;
+exports.isCryptoKey = void 0;
 const crypto = require("crypto");
 const util = require("util");
 const webcrypto = crypto.webcrypto;
@@ -9,154 +9,3 @@ exports.isCryptoKey = util.types.isCryptoKey
     ? (obj) => util.types.isCryptoKey(obj)
     :
         (obj) => false;
-function getHashLength(hash) {
-    return parseInt(hash === null || hash === void 0 ? void 0 : hash.name.substr(4), 10);
-}
-function getNamedCurve(alg) {
-    switch (alg) {
-        case 'ES256':
-            return 'P-256';
-        case 'ES384':
-            return 'P-384';
-        case 'ES512':
-            return 'P-521';
-    }
-}
-function checkCryptoKey(key, alg, ...usages) {
-    switch (alg) {
-        case undefined:
-            break;
-        case 'HS256':
-        case 'HS384':
-        case 'HS512': {
-            if (key.algorithm.name !== 'HMAC') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be HMAC.`);
-            }
-            const expected = parseInt(alg.substr(2), 10);
-            const actual = getHashLength(key.algorithm.hash);
-            if (actual !== expected) {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.hash must be SHA-${expected}.`);
-            }
-            break;
-        }
-        case 'RS256':
-        case 'RS384':
-        case 'RS512': {
-            if (key.algorithm.name !== 'RSASSA-PKCS1-v1_5') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be RSASSA-PKCS1-v1_5.`);
-            }
-            const expected = parseInt(alg.substr(2), 10);
-            const actual = getHashLength(key.algorithm.hash);
-            if (actual !== expected) {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.hash must be SHA-${expected}.`);
-            }
-            break;
-        }
-        case 'PS256':
-        case 'PS384':
-        case 'PS512': {
-            if (key.algorithm.name !== 'RSA-PSS') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be RSA-PSS.`);
-            }
-            const expected = parseInt(alg.substr(2), 10);
-            const actual = getHashLength(key.algorithm.hash);
-            if (actual !== expected) {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.hash must be SHA-${expected}.`);
-            }
-            break;
-        }
-        case 'EdDSA': {
-            if (key.algorithm.name !== 'NODE-ED25519' && key.algorithm.name !== 'NODE-ED448') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be NODE-ED25519 or NODE-ED448.`);
-            }
-            break;
-        }
-        case 'ES256':
-        case 'ES384':
-        case 'ES512': {
-            if (key.algorithm.name !== 'ECDSA') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be ECDSA.`);
-            }
-            const expected = getNamedCurve(alg);
-            const actual = key.algorithm.namedCurve;
-            if (actual !== expected) {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.namedCurve must be ${expected}.`);
-            }
-            break;
-        }
-        case 'A128GCM':
-        case 'A192GCM':
-        case 'A256GCM': {
-            if (key.algorithm.name !== 'AES-GCM') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be AES-GCM.`);
-            }
-            const expected = parseInt(alg.substr(1, 3), 10);
-            const actual = key.algorithm.length;
-            if (actual !== expected) {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.length must be ${expected}.`);
-            }
-            break;
-        }
-        case 'A128KW':
-        case 'A192KW':
-        case 'A256KW': {
-            if (key.algorithm.name !== 'AES-KW') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be AES-KW.`);
-            }
-            const expected = parseInt(alg.substr(1, 3), 10);
-            const actual = key.algorithm.length;
-            if (actual !== expected) {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.length must be ${expected}.`);
-            }
-            break;
-        }
-        case 'ECDH-ES':
-            if (key.algorithm.name !== 'ECDH') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be ECDH.`);
-            }
-            break;
-        case 'PBES2-HS256+A128KW':
-        case 'PBES2-HS384+A192KW':
-        case 'PBES2-HS512+A256KW':
-            if (key.algorithm.name !== 'PBKDF2') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be PBKDF2.`);
-            }
-            break;
-        case 'RSA-OAEP':
-        case 'RSA-OAEP-256':
-        case 'RSA-OAEP-384':
-        case 'RSA-OAEP-512': {
-            if (key.algorithm.name !== 'RSA-OAEP') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be RSA-OAEP.`);
-            }
-            const expected = parseInt(alg.substr(9), 10) || 1;
-            const actual = getHashLength(key.algorithm.hash);
-            if (actual !== expected) {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.hash must be SHA-${expected}.`);
-            }
-            break;
-        }
-        default:
-            throw new TypeError('CryptoKey does not support this operation');
-    }
-    if (usages.length && !usages.some((expected) => key.usages.includes(expected))) {
-        let msg = 'CryptoKey does not support this operation, its usages must include ';
-        if (usages.length > 2) {
-            const last = usages.pop();
-            msg += `one of ${usages.join(', ')}, or ${last}.`;
-        }
-        else if (usages.length === 2) {
-            msg += `one of ${usages[0]} or ${usages[1]}.`;
-        }
-        else {
-            msg += `${usages[0]}.`;
-        }
-        throw new TypeError(msg);
-    }
-}
-exports.checkCryptoKey = checkCryptoKey;
-function getKeyObject(key, alg, ...usages) {
-    checkCryptoKey(key, alg, ...usages);
-    return crypto.KeyObject.from(key);
-}
-exports.getKeyObject = getKeyObject;