jose 6.2.10 → 6.2.12

package/dist/webapi/jws/general/verify.js

@@ -1,74 +1,48 @@
-import { encodeJsonUnencodedPayload, parseProtectedHeader, prepareVerify, snapshotJws, verifySignature, verifyResult, } from '../../lib/jws_verify.js';
-import { JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';
-import { isObject } from '../../lib/type_checks.js';
+import { encodeJsonUnencodedPayload, parseProtectedHeader, prepareVerify, snapshotJws, verifySignature } from "../../lib/jws_verify.js";
+import { JWSInvalid, JWSSignatureVerificationFailed } from "../../util/errors.js";
+import { isObject } from "../../lib/validate.js";
 function snapshotSignature(signature, payload) {
-    try {
-        const jws = snapshotJws(signature, [payload]);
-        const { protected: encodedProtected, header, signature: encodedSignature } = jws;
-        if (encodedProtected === undefined && header === undefined)
-            return undefined;
-        if (encodedProtected !== undefined && typeof encodedProtected !== 'string')
-            return undefined;
-        if (typeof encodedSignature !== 'string')
-            return undefined;
-        if (header !== undefined && !isObject(header))
-            return undefined;
-        const protectedHeader = parseProtectedHeader(encodedProtected);
-        const { b64, crit } = protectedHeader;
-        return [
-            jws,
-            protectedHeader,
-            Array.isArray(crit) && crit.includes('b64')
-                ? typeof b64 === 'boolean'
-                    ? b64
-                        ? 1
-                        : 2
-                    : 0
-                : 1,
-        ];
-    }
-    catch {
-        return undefined;
-    }
+  try {
+    const jws = snapshotJws(signature, [payload]), protectedHeader = parseProtectedHeader(jws.protected), { b64, crit } = protectedHeader;
+    return [
+      jws,
+      protectedHeader,
+      Array.isArray(crit) && crit.includes("b64") ? typeof b64 == "boolean" ? b64 ? 1 : 2 : 0 : 1
+    ];
+  } catch {
+    return;
+  }
 }
-export async function generalVerify(jws, key, options) {
-    if (!isObject(jws)) {
-        throw new JWSInvalid('General JWS must be an object');
-    }
-    const { signatures, payload: inputPayload } = jws;
-    if (!Array.isArray(signatures)) {
-        throw new JWSInvalid('JWS Signatures missing or incorrect type');
-    }
-    const signatureEntries = Array.from(signatures);
-    if (!signatureEntries.every(isObject)) {
-        throw new JWSInvalid('JWS Signatures missing or incorrect type');
-    }
-    let shared;
+async function generalVerify(jws, key, options) {
+  if (!isObject(jws))
+    throw new JWSInvalid("General JWS must be an object");
+  const { signatures, payload: inputPayload } = jws;
+  if (!Array.isArray(signatures))
+    throw new JWSInvalid("JWS Signatures missing or incorrect type");
+  const signatureEntries = Array.from(signatures);
+  if (!signatureEntries.every(isObject))
+    throw new JWSInvalid("JWS Signatures missing or incorrect type");
+  let shared;
+  try {
+    if (inputPayload === void 0)
+      throw new Error();
+    shared = prepareVerify(options);
+  } catch {
+    throw new JWSSignatureVerificationFailed();
+  }
+  const payload = inputPayload instanceof Uint8Array ? new Uint8Array(inputPayload) : inputPayload, candidates = signatureEntries.map((signature) => snapshotSignature(signature, payload)).filter((candidate) => candidate !== void 0);
+  let modes = 0;
+  for (const [, , mode] of candidates)
+    if (modes |= mode, modes === 3)
+      throw new JWSInvalid("inconsistent use of JWS Unencoded Payload (RFC7797)");
+  for (const candidate of candidates)
     try {
-        if (inputPayload === undefined)
-            throw new Error();
-        shared = prepareVerify(options);
-    }
-    catch {
-        throw new JWSSignatureVerificationFailed();
-    }
-    const payload = inputPayload instanceof Uint8Array ? new Uint8Array(inputPayload) : inputPayload;
-    const candidates = signatureEntries
-        .map((signature) => snapshotSignature(signature, payload))
-        .filter((candidate) => candidate !== undefined);
-    let modes = 0;
-    for (const [, , mode] of candidates) {
-        modes |= mode;
-        if (modes === 3) {
-            throw new JWSInvalid('inconsistent use of JWS Unencoded Payload (RFC7797)');
-        }
+      const [result] = await verifySignature(candidate[0], shared, key, encodeJsonUnencodedPayload, candidate[1]);
+      return result;
+    } catch {
     }
-    for (const candidate of candidates) {
-        try {
-            return verifyResult(candidate[0], await verifySignature(candidate[0], shared, key, encodeJsonUnencodedPayload, candidate[1]));
-        }
-        catch {
-        }
-    }
-    throw new JWSSignatureVerificationFailed();
+  throw new JWSSignatureVerificationFailed();
 }
+export {
+  generalVerify
+};

package/dist/webapi/jwt/decrypt.js

@@ -1,21 +1,13 @@
-import { prepareDecrypt, decryptCompact } from '../lib/jwe_decrypt.js';
-import { validateClaimsSet } from '../lib/jwt_claims_set.js';
-import { JWTClaimValidationFailed } from '../util/errors.js';
-export async function jwtDecrypt(jwt, key, options) {
-    const decrypted = await decryptCompact(jwt, prepareDecrypt(options), key);
-    const protectedHeader = decrypted[1];
-    const payload = validateClaimsSet(protectedHeader, decrypted[0], options);
-    for (const claim of ['iss', 'sub', 'aud']) {
-        if (protectedHeader[claim] !== undefined &&
-            (claim === 'aud'
-                ? JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud)
-                : protectedHeader[claim] !== payload[claim])) {
-            throw new JWTClaimValidationFailed(`replicated "${claim}" claim header parameter mismatch`, payload, claim, 'mismatch');
-        }
-    }
-    const result = { payload, protectedHeader };
-    if (typeof key === 'function') {
-        return { ...result, key: decrypted[2] };
-    }
-    return result;
+import { prepareDecrypt, decryptCompact } from "../lib/jwe_decrypt.js";
+import { validateClaimsSet } from "../lib/jwt_claims_set.js";
+import { JWTClaimValidationFailed } from "../util/errors.js";
+async function jwtDecrypt(jwt, key, options) {
+  const { plaintext, ...result } = await decryptCompact(jwt, prepareDecrypt(options), key), { protectedHeader } = result, payload = validateClaimsSet(protectedHeader, plaintext, options);
+  for (const claim of ["iss", "sub", "aud"])
+    if (protectedHeader[claim] !== void 0 && (claim === "aud" ? JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud) : protectedHeader[claim] !== payload[claim]))
+      throw new JWTClaimValidationFailed(`replicated "${claim}" claim header parameter mismatch`, payload, claim, "mismatch");
+  return { payload, ...result };
 }
+export {
+  jwtDecrypt
+};

package/dist/webapi/jwt/encrypt.js

@@ -1,72 +1,45 @@
-import { createJWE } from '../lib/jwe_encrypt.js';
-import { JWTClaimsBuilder, jwtClaim, jwtData } from '../lib/jwt_claims_set.js';
-import { assertNotSet } from '../lib/helpers.js';
+import { compactJWE, createJWE } from "../lib/jwe_encrypt.js";
+import { JWTClaimsBuilder, jwtClaim, jwtData } from "../lib/jwt_claims_set.js";
+import { assertNotSet } from "../lib/validate.js";
 const EncryptJWT_base = JWTClaimsBuilder;
-export class EncryptJWT extends EncryptJWT_base {
-    #cek;
-    #iv;
-    #keyManagementParameters;
-    #protectedHeader;
-    #replicateIssuerAsHeader;
-    #replicateSubjectAsHeader;
-    #replicateAudienceAsHeader;
-    setProtectedHeader(protectedHeader) {
-        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
-        this.#protectedHeader = protectedHeader;
-        return this;
-    }
-    setKeyManagementParameters(parameters) {
-        assertNotSet(this.#keyManagementParameters, 'setKeyManagementParameters');
-        this.#keyManagementParameters = parameters;
-        return this;
-    }
-    setContentEncryptionKey(cek) {
-        assertNotSet(this.#cek, 'setContentEncryptionKey');
-        this.#cek = cek;
-        return this;
-    }
-    setInitializationVector(iv) {
-        assertNotSet(this.#iv, 'setInitializationVector');
-        this.#iv = iv;
-        return this;
-    }
-    replicateIssuerAsHeader() {
-        this.#replicateIssuerAsHeader = true;
-        return this;
-    }
-    replicateSubjectAsHeader() {
-        this.#replicateSubjectAsHeader = true;
-        return this;
-    }
-    replicateAudienceAsHeader() {
-        this.#replicateAudienceAsHeader = true;
-        return this;
-    }
-    async encrypt(key, options) {
-        const plaintext = jwtData(this);
-        if (this.#protectedHeader &&
-            (this.#replicateIssuerAsHeader ||
-                this.#replicateSubjectAsHeader ||
-                this.#replicateAudienceAsHeader)) {
-            this.#protectedHeader = {
-                ...this.#protectedHeader,
-                iss: this.#replicateIssuerAsHeader ? jwtClaim(this, 'iss') : undefined,
-                sub: this.#replicateSubjectAsHeader ? jwtClaim(this, 'sub') : undefined,
-                aud: this.#replicateAudienceAsHeader ? jwtClaim(this, 'aud') : undefined,
-            };
-        }
-        const jwe = await createJWE([
-            plaintext,
-            this.#protectedHeader,
-            undefined,
-            undefined,
-            undefined,
-            this.#cek,
-            this.#iv,
-            this.#keyManagementParameters,
-            undefined,
-            false,
-        ], key, options);
-        return [jwe.protected, jwe.encrypted_key, jwe.iv, jwe.ciphertext, jwe.tag].join('.');
-    }
+class EncryptJWT extends EncryptJWT_base {
+  #input = [void 0];
+  #replicateIssuerAsHeader;
+  #replicateSubjectAsHeader;
+  #replicateAudienceAsHeader;
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#input[1], "setProtectedHeader"), this.#input[1] = protectedHeader, this;
+  }
+  setKeyManagementParameters(parameters) {
+    return assertNotSet(this.#input[7], "setKeyManagementParameters"), this.#input[7] = parameters, this;
+  }
+  setContentEncryptionKey(cek) {
+    return assertNotSet(this.#input[5], "setContentEncryptionKey"), this.#input[5] = cek, this;
+  }
+  setInitializationVector(iv) {
+    return assertNotSet(this.#input[6], "setInitializationVector"), this.#input[6] = iv, this;
+  }
+  replicateIssuerAsHeader() {
+    return this.#replicateIssuerAsHeader = !0, this;
+  }
+  replicateSubjectAsHeader() {
+    return this.#replicateSubjectAsHeader = !0, this;
+  }
+  replicateAudienceAsHeader() {
+    return this.#replicateAudienceAsHeader = !0, this;
+  }
+  async encrypt(key, options) {
+    const plaintext = jwtData(this);
+    this.#input[1] && (this.#replicateIssuerAsHeader || this.#replicateSubjectAsHeader || this.#replicateAudienceAsHeader) && (this.#input[1] = {
+      ...this.#input[1],
+      iss: this.#replicateIssuerAsHeader ? jwtClaim(this, "iss") : void 0,
+      sub: this.#replicateSubjectAsHeader ? jwtClaim(this, "sub") : void 0,
+      aud: this.#replicateAudienceAsHeader ? jwtClaim(this, "aud") : void 0
+    });
+    const input = [...this.#input];
+    return input[0] = plaintext, compactJWE(await createJWE(input, key, options));
+  }
 }
+export {
+  EncryptJWT
+};

package/dist/webapi/jwt/sign.js

@@ -1,18 +1,19 @@
-import { createCompactSignature } from '../lib/jws_sign.js';
-import { JWTInvalid } from '../util/errors.js';
-import { JWTClaimsBuilder, jwtData } from '../lib/jwt_claims_set.js';
-import { assertNotSet } from '../lib/helpers.js';
+import { createCompactSignature } from "../lib/jws_sign.js";
+import { JWTInvalid } from "../util/errors.js";
+import { JWTClaimsBuilder, jwtData } from "../lib/jwt_claims_set.js";
+import { assertNotSet } from "../lib/validate.js";
 const SignJWT_base = JWTClaimsBuilder;
-export class SignJWT extends SignJWT_base {
-    #protectedHeader;
-    setProtectedHeader(protectedHeader) {
-        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
-        this.#protectedHeader = protectedHeader;
-        return this;
-    }
-    async sign(key, options) {
-        return createCompactSignature(jwtData(this), this.#protectedHeader, options?.crit, key, () => {
-            throw new JWTInvalid('JWTs MUST NOT use unencoded payload');
-        });
-    }
+class SignJWT extends SignJWT_base {
+  #protectedHeader;
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
+  }
+  async sign(key, options) {
+    return createCompactSignature(jwtData(this), this.#protectedHeader, options?.crit, key, () => {
+      throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+    });
+  }
 }
+export {
+  SignJWT
+};

package/dist/webapi/jwt/unsecured.js

@@ -1,43 +1,34 @@
-import * as b64u from '../util/base64url.js';
-import { decodeBase64url, parseJoseHeader } from '../lib/helpers.js';
-import { JWSInvalid, JWTInvalid } from '../util/errors.js';
-import { validateClaimsSet, JWTClaimsBuilder, jwtData } from '../lib/jwt_claims_set.js';
-import { JWS_RECOGNIZED, validateB64, validateCrit } from '../lib/options.js';
+import * as b64u from "../util/base64url.js";
+import { decodeBase64url, parseJoseHeader, JWS_RECOGNIZED, validateB64, validateCrit } from "../lib/validate.js";
+import { JWSInvalid, JWTInvalid } from "../util/errors.js";
+import { validateClaimsSet, JWTClaimsBuilder, jwtData } from "../lib/jwt_claims_set.js";
 const UnsecuredJWT_base = JWTClaimsBuilder;
-export class UnsecuredJWT extends UnsecuredJWT_base {
-    encode() {
-        const header = b64u.encode(JSON.stringify({ alg: 'none' }));
-        const payload = b64u.encode(jwtData(this));
-        return `${header}.${payload}.`;
-    }
-    static decode(jwt, options) {
-        if (typeof jwt !== 'string') {
-            throw new JWTInvalid('Unsecured JWT must be a string');
-        }
-        const { 0: encodedHeader, 1: encodedPayload, 2: signature, length } = jwt.split('.');
-        if (length !== 3 || signature !== '') {
-            throw new JWTInvalid('Invalid Unsecured JWT');
-        }
-        let header;
-        let b64;
-        try {
-            header = parseJoseHeader(encodedHeader, JWSInvalid, 'JWS Protected Header is invalid');
-            const extensions = validateCrit(JWSInvalid, JWS_RECOGNIZED, undefined, header, header);
-            b64 = validateB64(header, extensions);
-        }
-        catch (cause) {
-            if (!(cause instanceof JWSInvalid)) {
-                throw cause;
-            }
-            throw new JWTInvalid('Invalid Unsecured JWT', { cause });
-        }
-        if (header.alg !== 'none') {
-            throw new JWTInvalid('Invalid Unsecured JWT');
-        }
-        if (!b64) {
-            throw new JWTInvalid('JWTs MUST NOT use unencoded payload');
-        }
-        const payload = validateClaimsSet(header, decodeBase64url(encodedPayload, 'payload', JWTInvalid), options);
-        return { payload, header };
+class UnsecuredJWT extends UnsecuredJWT_base {
+  encode() {
+    const header = b64u.encode(JSON.stringify({ alg: "none" })), payload = b64u.encode(jwtData(this));
+    return `${header}.${payload}.`;
+  }
+  static decode(jwt, options) {
+    if (typeof jwt != "string")
+      throw new JWTInvalid("Unsecured JWT must be a string");
+    const { 0: encodedHeader, 1: encodedPayload, 2: signature, length } = jwt.split(".");
+    if (length !== 3 || signature !== "")
+      throw new JWTInvalid("Invalid Unsecured JWT");
+    let header, b64;
+    try {
+      header = parseJoseHeader(encodedHeader, JWSInvalid, "JWS Protected Header is invalid");
+      const extensions = validateCrit(JWSInvalid, JWS_RECOGNIZED, void 0, header, header);
+      b64 = validateB64(header, extensions);
+    } catch (cause) {
+      throw cause instanceof JWSInvalid ? new JWTInvalid("Invalid Unsecured JWT", { cause }) : cause;
     }
+    if (header.alg !== "none")
+      throw new JWTInvalid("Invalid Unsecured JWT");
+    if (!b64)
+      throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+    return { payload: validateClaimsSet(header, decodeBase64url(encodedPayload, "payload", JWTInvalid), options), header };
+  }
 }
+export {
+  UnsecuredJWT
+};

package/dist/webapi/jwt/verify.js

@@ -1,15 +1,13 @@
-import { prepareVerify, verifyCompact } from '../lib/jws_verify.js';
-import { validateClaimsSet } from '../lib/jwt_claims_set.js';
-import { JWTInvalid } from '../util/errors.js';
-export async function jwtVerify(jwt, key, options) {
-    const verified = await verifyCompact(jwt, prepareVerify(options), key);
-    if (!verified[2]) {
-        throw new JWTInvalid('JWTs MUST NOT use unencoded payload');
-    }
-    const payload = validateClaimsSet(verified[1], verified[0], options);
-    const result = { payload, protectedHeader: verified[1] };
-    if (typeof key === 'function') {
-        return { ...result, key: verified[3] };
-    }
-    return result;
+import { prepareVerify, verifyCompact } from "../lib/jws_verify.js";
+import { validateClaimsSet } from "../lib/jwt_claims_set.js";
+import { JWTInvalid } from "../util/errors.js";
+async function jwtVerify(jwt, key, options) {
+  const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);
+  if (!b64)
+    throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
+  const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);
+  return { ...verified, payload };
 }
+export {
+  jwtVerify
+};

package/dist/webapi/key/export.js

@@ -1,44 +1,35 @@
-import { toSPKI as exportPublic, toPKCS8 as exportPrivate } from '../lib/asn1.js';
-import { invalidKeyInput } from '../lib/invalid_key_input.js';
-import { encode as b64u } from '../util/base64url.js';
-import { isCryptoKey, isKeyObject } from '../lib/is_key_like.js';
-function omitUndefinedProperties(jwk) {
-    return Object.fromEntries(Object.entries(jwk).filter(([, value]) => value !== undefined));
+import { toSPKI as exportPublic, toPKCS8 as exportPrivate } from "../lib/asn1.js";
+import { invalidKeyInput, isCryptoKey, isKeyObject } from "../lib/key.js";
+import { encode as b64u } from "../util/base64url.js";
+function exportSPKI(key) {
+  return exportPublic(key);
 }
-async function keyToJWK(key) {
-    if (isKeyObject(key)) {
-        if (key.type === 'secret') {
-            key = key.export();
-        }
-        else {
-            return key.export({ format: 'jwk' });
-        }
-    }
-    if (key instanceof Uint8Array) {
-        return {
-            kty: 'oct',
-            k: b64u(key),
-        };
-    }
-    if (!isCryptoKey(key)) {
-        throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject', 'Uint8Array'));
-    }
-    if (!key.extractable) {
-        throw new TypeError('non-extractable CryptoKey cannot be exported as a JWK');
-    }
-    const { ext, key_ops, alg, use, ...jwk } = omitUndefinedProperties(await crypto.subtle.exportKey('jwk', key));
-    if (jwk.kty === 'AKP') {
-        ;
-        jwk.alg = alg;
-    }
-    return jwk;
+function exportPKCS8(key) {
+  return exportPrivate(key);
 }
-export function exportSPKI(key) {
-    return exportPublic(key);
-}
-export function exportPKCS8(key) {
-    return exportPrivate(key);
-}
-export function exportJWK(key) {
-    return keyToJWK(key);
+async function exportJWK(key) {
+  if (isKeyObject(key))
+    if (key.type === "secret")
+      key = key.export();
+    else
+      return key.export({ format: "jwk" });
+  if (key instanceof Uint8Array)
+    return {
+      kty: "oct",
+      k: b64u(key)
+    };
+  if (!isCryptoKey(key))
+    throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "Uint8Array"));
+  if (!key.extractable)
+    throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");
+  const jwk = await crypto.subtle.exportKey("jwk", key);
+  delete jwk.ext, delete jwk.key_ops, delete jwk.use, jwk.kty !== "AKP" && delete jwk.alg;
+  for (const parameter of Object.keys(jwk))
+    jwk[parameter] === void 0 && delete jwk[parameter];
+  return jwk;
 }
+export {
+  exportJWK,
+  exportPKCS8,
+  exportSPKI
+};

package/dist/webapi/key/generate_key_pair.js

@@ -1,52 +1,35 @@
-import { JOSENotSupported } from '../util/errors.js';
-import { validateExtractableOption } from '../lib/key_options.js';
-import { keyAlgorithm, unsupportedAlg, algArgument } from '../lib/key_algorithm.js';
+import { JOSENotSupported } from "../util/errors.js";
+import { validateExtractableOption } from "../lib/key.js";
+import { keyAlgorithm, unsupportedAlg, algArgument } from "../lib/key_algorithm.js";
 function getModulusLengthOption(options) {
-    const modulusLength = options?.modulusLength ?? 2048;
-    if (typeof modulusLength !== 'number' ||
-        !Number.isInteger(modulusLength) ||
-        modulusLength < 2048) {
-        throw new JOSENotSupported('Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used');
-    }
-    return modulusLength;
+  const modulusLength = options?.modulusLength ?? 2048;
+  if (typeof modulusLength != "number" || !Number.isInteger(modulusLength) || modulusLength < 2048)
+    throw new JOSENotSupported("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");
+  return modulusLength;
 }
-export async function generateKeyPair(alg, options) {
-    const extractable = validateExtractableOption(options?.extractable);
-    const entry = keyAlgorithm(alg, algArgument);
-    if (entry.secret) {
-        unsupportedAlg(algArgument);
-    }
-    let algorithm;
-    if (entry.resolve) {
-        const crv = options?.crv ?? 'P-256';
-        switch (crv) {
-            case 'P-256':
-            case 'P-384':
-            case 'P-521':
-                algorithm = { name: 'ECDH', namedCurve: crv };
-                break;
-            case 'X25519':
-                algorithm = { name: 'X25519' };
-                break;
-            default:
-                throw new JOSENotSupported('Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519');
-        }
-    }
-    else {
-        if (entry.crv !== undefined && options?.crv !== undefined && options.crv !== entry.crv) {
-            throw new JOSENotSupported(`Invalid or unsupported crv option provided, the only supported value for ${alg} is ${entry.crv}`);
-        }
-        algorithm =
-            entry.kty[0] === 'RSA'
-                ? {
-                    ...entry.subtle,
-                    publicExponent: Uint8Array.of(0x01, 0x00, 0x01),
-                    modulusLength: getModulusLengthOption(options),
-                }
-                : entry.subtle;
-    }
-    return crypto.subtle.generateKey(algorithm, extractable ?? false, [
-        ...entry.usages[1],
-        ...entry.usages[0],
-    ]);
+async function generateKeyPair(alg, options) {
+  const extractable = validateExtractableOption(options?.extractable), entry = keyAlgorithm(alg, algArgument);
+  entry.secret && unsupportedAlg(algArgument);
+  let algorithm;
+  if (entry.resolve) {
+    const crv = options?.crv ?? "P-256";
+    if (!["P-256", "P-384", "P-521", "X25519"].includes(crv))
+      throw new JOSENotSupported("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519");
+    algorithm = entry.resolve({ crv });
+  } else {
+    if (entry.crv !== void 0 && options?.crv !== void 0 && options.crv !== entry.crv)
+      throw new JOSENotSupported(`Invalid or unsupported crv option provided, the only supported value for ${alg} is ${entry.crv}`);
+    algorithm = entry.kty[0] === "RSA" ? {
+      ...entry.subtle,
+      publicExponent: Uint8Array.of(1, 0, 1),
+      modulusLength: getModulusLengthOption(options)
+    } : entry.subtle;
+  }
+  return crypto.subtle.generateKey(algorithm, extractable ?? !1, [
+    ...entry.usages[1],
+    ...entry.usages[0]
+  ]);
 }
+export {
+  generateKeyPair
+};