mcp-use 2.0.0-beta.2 → 2.0.0-beta.21

package/node_modules/jose/dist/webapi/lib/is_key_like.js

@@ -0,0 +1,17 @@
+export function assertCryptoKey(key) {
+    if (!isCryptoKey(key)) {
+        throw new Error('CryptoKey instance expected');
+    }
+}
+export const isCryptoKey = (key) => {
+    if (key?.[Symbol.toStringTag] === 'CryptoKey')
+        return true;
+    try {
+        return key instanceof CryptoKey;
+    }
+    catch {
+        return false;
+    }
+};
+export const isKeyObject = (key) => key?.[Symbol.toStringTag] === 'KeyObject';
+export const isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);

package/node_modules/jose/dist/webapi/lib/is_object.js

@@ -0,0 +1,14 @@
+const isObjectLike = (value) => typeof value === 'object' && value !== null;
+export function isObject(input) {
+    if (!isObjectLike(input) || Object.prototype.toString.call(input) !== '[object Object]') {
+        return false;
+    }
+    if (Object.getPrototypeOf(input) === null) {
+        return true;
+    }
+    let proto = input;
+    while (Object.getPrototypeOf(proto) !== null) {
+        proto = Object.getPrototypeOf(proto);
+    }
+    return Object.getPrototypeOf(input) === proto;
+}

package/node_modules/jose/dist/webapi/lib/iv.js

@@ -0,0 +1,19 @@
+import { JOSENotSupported } from '../util/errors.js';
+export function bitLength(alg) {
+    switch (alg) {
+        case 'A128GCM':
+        case 'A128GCMKW':
+        case 'A192GCM':
+        case 'A192GCMKW':
+        case 'A256GCM':
+        case 'A256GCMKW':
+            return 96;
+        case 'A128CBC-HS256':
+        case 'A192CBC-HS384':
+        case 'A256CBC-HS512':
+            return 128;
+        default:
+            throw new JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
+    }
+}
+export const generateIv = (alg) => crypto.getRandomValues(new Uint8Array(bitLength(alg) >> 3));

package/node_modules/jose/dist/webapi/lib/jwk_to_key.js

@@ -0,0 +1,109 @@
+import { JOSENotSupported } from '../util/errors.js';
+function subtleMapping(jwk) {
+    let algorithm;
+    let keyUsages;
+    switch (jwk.kty) {
+        case 'AKP': {
+            switch (jwk.alg) {
+                case 'ML-DSA-44':
+                case 'ML-DSA-65':
+                case 'ML-DSA-87':
+                    algorithm = { name: jwk.alg };
+                    keyUsages = jwk.priv ? ['sign'] : ['verify'];
+                    break;
+                default:
+                    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+            }
+            break;
+        }
+        case 'RSA': {
+            switch (jwk.alg) {
+                case 'PS256':
+                case 'PS384':
+                case 'PS512':
+                    algorithm = { name: 'RSA-PSS', hash: `SHA-${jwk.alg.slice(-3)}` };
+                    keyUsages = jwk.d ? ['sign'] : ['verify'];
+                    break;
+                case 'RS256':
+                case 'RS384':
+                case 'RS512':
+                    algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${jwk.alg.slice(-3)}` };
+                    keyUsages = jwk.d ? ['sign'] : ['verify'];
+                    break;
+                case 'RSA-OAEP':
+                case 'RSA-OAEP-256':
+                case 'RSA-OAEP-384':
+                case 'RSA-OAEP-512':
+                    algorithm = {
+                        name: 'RSA-OAEP',
+                        hash: `SHA-${parseInt(jwk.alg.slice(-3), 10) || 1}`,
+                    };
+                    keyUsages = jwk.d ? ['decrypt', 'unwrapKey'] : ['encrypt', 'wrapKey'];
+                    break;
+                default:
+                    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+            }
+            break;
+        }
+        case 'EC': {
+            switch (jwk.alg) {
+                case 'ES256':
+                    algorithm = { name: 'ECDSA', namedCurve: 'P-256' };
+                    keyUsages = jwk.d ? ['sign'] : ['verify'];
+                    break;
+                case 'ES384':
+                    algorithm = { name: 'ECDSA', namedCurve: 'P-384' };
+                    keyUsages = jwk.d ? ['sign'] : ['verify'];
+                    break;
+                case 'ES512':
+                    algorithm = { name: 'ECDSA', namedCurve: 'P-521' };
+                    keyUsages = jwk.d ? ['sign'] : ['verify'];
+                    break;
+                case 'ECDH-ES':
+                case 'ECDH-ES+A128KW':
+                case 'ECDH-ES+A192KW':
+                case 'ECDH-ES+A256KW':
+                    algorithm = { name: 'ECDH', namedCurve: jwk.crv };
+                    keyUsages = jwk.d ? ['deriveBits'] : [];
+                    break;
+                default:
+                    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+            }
+            break;
+        }
+        case 'OKP': {
+            switch (jwk.alg) {
+                case 'Ed25519':
+                case 'EdDSA':
+                    algorithm = { name: 'Ed25519' };
+                    keyUsages = jwk.d ? ['sign'] : ['verify'];
+                    break;
+                case 'ECDH-ES':
+                case 'ECDH-ES+A128KW':
+                case 'ECDH-ES+A192KW':
+                case 'ECDH-ES+A256KW':
+                    algorithm = { name: jwk.crv };
+                    keyUsages = jwk.d ? ['deriveBits'] : [];
+                    break;
+                default:
+                    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+            }
+            break;
+        }
+        default:
+            throw new JOSENotSupported('Invalid or unsupported JWK "kty" (Key Type) Parameter value');
+    }
+    return { algorithm, keyUsages };
+}
+export async function jwkToKey(jwk) {
+    if (!jwk.alg) {
+        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
+    }
+    const { algorithm, keyUsages } = subtleMapping(jwk);
+    const keyData = { ...jwk };
+    if (keyData.kty !== 'AKP') {
+        delete keyData.alg;
+    }
+    delete keyData.use;
+    return crypto.subtle.importKey('jwk', keyData, algorithm, jwk.ext ?? (jwk.d || jwk.priv ? false : true), jwk.key_ops ?? keyUsages);
+}

package/node_modules/jose/dist/webapi/lib/jwt_claims_set.js

@@ -0,0 +1,238 @@
+import { JWTClaimValidationFailed, JWTExpired, JWTInvalid } from '../util/errors.js';
+import { encoder, decoder } from './buffer_utils.js';
+import { isObject } from './is_object.js';
+const epoch = (date) => Math.floor(date.getTime() / 1000);
+const minute = 60;
+const hour = minute * 60;
+const day = hour * 24;
+const week = day * 7;
+const year = day * 365.25;
+const REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
+export function secs(str) {
+    const matched = REGEX.exec(str);
+    if (!matched || (matched[4] && matched[1])) {
+        throw new TypeError('Invalid time period format');
+    }
+    const value = parseFloat(matched[2]);
+    const unit = matched[3].toLowerCase();
+    let numericDate;
+    switch (unit) {
+        case 'sec':
+        case 'secs':
+        case 'second':
+        case 'seconds':
+        case 's':
+            numericDate = Math.round(value);
+            break;
+        case 'minute':
+        case 'minutes':
+        case 'min':
+        case 'mins':
+        case 'm':
+            numericDate = Math.round(value * minute);
+            break;
+        case 'hour':
+        case 'hours':
+        case 'hr':
+        case 'hrs':
+        case 'h':
+            numericDate = Math.round(value * hour);
+            break;
+        case 'day':
+        case 'days':
+        case 'd':
+            numericDate = Math.round(value * day);
+            break;
+        case 'week':
+        case 'weeks':
+        case 'w':
+            numericDate = Math.round(value * week);
+            break;
+        default:
+            numericDate = Math.round(value * year);
+            break;
+    }
+    if (matched[1] === '-' || matched[4] === 'ago') {
+        return -numericDate;
+    }
+    return numericDate;
+}
+function validateInput(label, input) {
+    if (!Number.isFinite(input)) {
+        throw new TypeError(`Invalid ${label} input`);
+    }
+    return input;
+}
+const normalizeTyp = (value) => {
+    if (value.includes('/')) {
+        return value.toLowerCase();
+    }
+    return `application/${value.toLowerCase()}`;
+};
+const checkAudiencePresence = (audPayload, audOption) => {
+    if (typeof audPayload === 'string') {
+        return audOption.includes(audPayload);
+    }
+    if (Array.isArray(audPayload)) {
+        return audOption.some(Set.prototype.has.bind(new Set(audPayload)));
+    }
+    return false;
+};
+export function validateClaimsSet(protectedHeader, encodedPayload, options = {}) {
+    let payload;
+    try {
+        payload = JSON.parse(decoder.decode(encodedPayload));
+    }
+    catch {
+    }
+    if (!isObject(payload)) {
+        throw new JWTInvalid('JWT Claims Set must be a top-level JSON object');
+    }
+    const { typ } = options;
+    if (typ &&
+        (typeof protectedHeader.typ !== 'string' ||
+            normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
+        throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, 'typ', 'check_failed');
+    }
+    const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
+    const presenceCheck = [...requiredClaims];
+    if (maxTokenAge !== undefined)
+        presenceCheck.push('iat');
+    if (audience !== undefined)
+        presenceCheck.push('aud');
+    if (subject !== undefined)
+        presenceCheck.push('sub');
+    if (issuer !== undefined)
+        presenceCheck.push('iss');
+    for (const claim of new Set(presenceCheck.reverse())) {
+        if (!(claim in payload)) {
+            throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, 'missing');
+        }
+    }
+    if (issuer &&
+        !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {
+        throw new JWTClaimValidationFailed('unexpected "iss" claim value', payload, 'iss', 'check_failed');
+    }
+    if (subject && payload.sub !== subject) {
+        throw new JWTClaimValidationFailed('unexpected "sub" claim value', payload, 'sub', 'check_failed');
+    }
+    if (audience &&
+        !checkAudiencePresence(payload.aud, typeof audience === 'string' ? [audience] : audience)) {
+        throw new JWTClaimValidationFailed('unexpected "aud" claim value', payload, 'aud', 'check_failed');
+    }
+    let tolerance;
+    switch (typeof options.clockTolerance) {
+        case 'string':
+            tolerance = secs(options.clockTolerance);
+            break;
+        case 'number':
+            tolerance = options.clockTolerance;
+            break;
+        case 'undefined':
+            tolerance = 0;
+            break;
+        default:
+            throw new TypeError('Invalid clockTolerance option type');
+    }
+    const { currentDate } = options;
+    const now = epoch(currentDate || new Date());
+    if ((payload.iat !== undefined || maxTokenAge) && typeof payload.iat !== 'number') {
+        throw new JWTClaimValidationFailed('"iat" claim must be a number', payload, 'iat', 'invalid');
+    }
+    if (payload.nbf !== undefined) {
+        if (typeof payload.nbf !== 'number') {
+            throw new JWTClaimValidationFailed('"nbf" claim must be a number', payload, 'nbf', 'invalid');
+        }
+        if (payload.nbf > now + tolerance) {
+            throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, 'nbf', 'check_failed');
+        }
+    }
+    if (payload.exp !== undefined) {
+        if (typeof payload.exp !== 'number') {
+            throw new JWTClaimValidationFailed('"exp" claim must be a number', payload, 'exp', 'invalid');
+        }
+        if (payload.exp <= now - tolerance) {
+            throw new JWTExpired('"exp" claim timestamp check failed', payload, 'exp', 'check_failed');
+        }
+    }
+    if (maxTokenAge) {
+        const age = now - payload.iat;
+        const max = typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge);
+        if (age - tolerance > max) {
+            throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, 'iat', 'check_failed');
+        }
+        if (age < 0 - tolerance) {
+            throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, 'iat', 'check_failed');
+        }
+    }
+    return payload;
+}
+export class JWTClaimsBuilder {
+    #payload;
+    constructor(payload) {
+        if (!isObject(payload)) {
+            throw new TypeError('JWT Claims Set MUST be an object');
+        }
+        this.#payload = structuredClone(payload);
+    }
+    data() {
+        return encoder.encode(JSON.stringify(this.#payload));
+    }
+    get iss() {
+        return this.#payload.iss;
+    }
+    set iss(value) {
+        this.#payload.iss = value;
+    }
+    get sub() {
+        return this.#payload.sub;
+    }
+    set sub(value) {
+        this.#payload.sub = value;
+    }
+    get aud() {
+        return this.#payload.aud;
+    }
+    set aud(value) {
+        this.#payload.aud = value;
+    }
+    set jti(value) {
+        this.#payload.jti = value;
+    }
+    set nbf(value) {
+        if (typeof value === 'number') {
+            this.#payload.nbf = validateInput('setNotBefore', value);
+        }
+        else if (value instanceof Date) {
+            this.#payload.nbf = validateInput('setNotBefore', epoch(value));
+        }
+        else {
+            this.#payload.nbf = epoch(new Date()) + secs(value);
+        }
+    }
+    set exp(value) {
+        if (typeof value === 'number') {
+            this.#payload.exp = validateInput('setExpirationTime', value);
+        }
+        else if (value instanceof Date) {
+            this.#payload.exp = validateInput('setExpirationTime', epoch(value));
+        }
+        else {
+            this.#payload.exp = epoch(new Date()) + secs(value);
+        }
+    }
+    set iat(value) {
+        if (value === undefined) {
+            this.#payload.iat = epoch(new Date());
+        }
+        else if (value instanceof Date) {
+            this.#payload.iat = validateInput('setIssuedAt', epoch(value));
+        }
+        else if (typeof value === 'string') {
+            this.#payload.iat = validateInput('setIssuedAt', epoch(new Date()) + secs(value));
+        }
+        else {
+            this.#payload.iat = validateInput('setIssuedAt', value);
+        }
+    }
+}

package/node_modules/jose/dist/webapi/lib/key_to_jwk.js

@@ -0,0 +1,31 @@
+import { invalidKeyInput } from './invalid_key_input.js';
+import { encode as b64u } from '../util/base64url.js';
+import { isCryptoKey, isKeyObject } from './is_key_like.js';
+export async function keyToJWK(key) {
+    if (isKeyObject(key)) {
+        if (key.type === 'secret') {
+            key = key.export();
+        }
+        else {
+            return key.export({ format: 'jwk' });
+        }
+    }
+    if (key instanceof Uint8Array) {
+        return {
+            kty: 'oct',
+            k: b64u(key),
+        };
+    }
+    if (!isCryptoKey(key)) {
+        throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject', 'Uint8Array'));
+    }
+    if (!key.extractable) {
+        throw new TypeError('non-extractable CryptoKey cannot be exported as a JWK');
+    }
+    const { ext, key_ops, alg, use, ...jwk } = await crypto.subtle.exportKey('jwk', key);
+    if (jwk.kty === 'AKP') {
+        ;
+        jwk.alg = alg;
+    }
+    return jwk;
+}

package/node_modules/jose/dist/webapi/lib/normalize_key.js

@@ -0,0 +1,176 @@
+import { isJWK } from './is_jwk.js';
+import { decode } from '../util/base64url.js';
+import { jwkToKey } from './jwk_to_key.js';
+import { isCryptoKey, isKeyObject } from './is_key_like.js';
+let cache;
+const handleJWK = async (key, jwk, alg, freeze = false) => {
+    cache ||= new WeakMap();
+    let cached = cache.get(key);
+    if (cached?.[alg]) {
+        return cached[alg];
+    }
+    const cryptoKey = await jwkToKey({ ...jwk, alg });
+    if (freeze)
+        Object.freeze(key);
+    if (!cached) {
+        cache.set(key, { [alg]: cryptoKey });
+    }
+    else {
+        cached[alg] = cryptoKey;
+    }
+    return cryptoKey;
+};
+const handleKeyObject = (keyObject, alg) => {
+    cache ||= new WeakMap();
+    let cached = cache.get(keyObject);
+    if (cached?.[alg]) {
+        return cached[alg];
+    }
+    const isPublic = keyObject.type === 'public';
+    const extractable = isPublic ? true : false;
+    let cryptoKey;
+    if (keyObject.asymmetricKeyType === 'x25519') {
+        switch (alg) {
+            case 'ECDH-ES':
+            case 'ECDH-ES+A128KW':
+            case 'ECDH-ES+A192KW':
+            case 'ECDH-ES+A256KW':
+                break;
+            default:
+                throw new TypeError('given KeyObject instance cannot be used for this algorithm');
+        }
+        cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, isPublic ? [] : ['deriveBits']);
+    }
+    if (keyObject.asymmetricKeyType === 'ed25519') {
+        if (alg !== 'EdDSA' && alg !== 'Ed25519') {
+            throw new TypeError('given KeyObject instance cannot be used for this algorithm');
+        }
+        cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [
+            isPublic ? 'verify' : 'sign',
+        ]);
+    }
+    switch (keyObject.asymmetricKeyType) {
+        case 'ml-dsa-44':
+        case 'ml-dsa-65':
+        case 'ml-dsa-87': {
+            if (alg !== keyObject.asymmetricKeyType.toUpperCase()) {
+                throw new TypeError('given KeyObject instance cannot be used for this algorithm');
+            }
+            cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [
+                isPublic ? 'verify' : 'sign',
+            ]);
+        }
+    }
+    if (keyObject.asymmetricKeyType === 'rsa') {
+        let hash;
+        switch (alg) {
+            case 'RSA-OAEP':
+                hash = 'SHA-1';
+                break;
+            case 'RS256':
+            case 'PS256':
+            case 'RSA-OAEP-256':
+                hash = 'SHA-256';
+                break;
+            case 'RS384':
+            case 'PS384':
+            case 'RSA-OAEP-384':
+                hash = 'SHA-384';
+                break;
+            case 'RS512':
+            case 'PS512':
+            case 'RSA-OAEP-512':
+                hash = 'SHA-512';
+                break;
+            default:
+                throw new TypeError('given KeyObject instance cannot be used for this algorithm');
+        }
+        if (alg.startsWith('RSA-OAEP')) {
+            return keyObject.toCryptoKey({
+                name: 'RSA-OAEP',
+                hash,
+            }, extractable, isPublic ? ['encrypt'] : ['decrypt']);
+        }
+        cryptoKey = keyObject.toCryptoKey({
+            name: alg.startsWith('PS') ? 'RSA-PSS' : 'RSASSA-PKCS1-v1_5',
+            hash,
+        }, extractable, [isPublic ? 'verify' : 'sign']);
+    }
+    if (keyObject.asymmetricKeyType === 'ec') {
+        const nist = new Map([
+            ['prime256v1', 'P-256'],
+            ['secp384r1', 'P-384'],
+            ['secp521r1', 'P-521'],
+        ]);
+        const namedCurve = nist.get(keyObject.asymmetricKeyDetails?.namedCurve);
+        if (!namedCurve) {
+            throw new TypeError('given KeyObject instance cannot be used for this algorithm');
+        }
+        if (alg === 'ES256' && namedCurve === 'P-256') {
+            cryptoKey = keyObject.toCryptoKey({
+                name: 'ECDSA',
+                namedCurve,
+            }, extractable, [isPublic ? 'verify' : 'sign']);
+        }
+        if (alg === 'ES384' && namedCurve === 'P-384') {
+            cryptoKey = keyObject.toCryptoKey({
+                name: 'ECDSA',
+                namedCurve,
+            }, extractable, [isPublic ? 'verify' : 'sign']);
+        }
+        if (alg === 'ES512' && namedCurve === 'P-521') {
+            cryptoKey = keyObject.toCryptoKey({
+                name: 'ECDSA',
+                namedCurve,
+            }, extractable, [isPublic ? 'verify' : 'sign']);
+        }
+        if (alg.startsWith('ECDH-ES')) {
+            cryptoKey = keyObject.toCryptoKey({
+                name: 'ECDH',
+                namedCurve,
+            }, extractable, isPublic ? [] : ['deriveBits']);
+        }
+    }
+    if (!cryptoKey) {
+        throw new TypeError('given KeyObject instance cannot be used for this algorithm');
+    }
+    if (!cached) {
+        cache.set(keyObject, { [alg]: cryptoKey });
+    }
+    else {
+        cached[alg] = cryptoKey;
+    }
+    return cryptoKey;
+};
+export async function normalizeKey(key, alg) {
+    if (key instanceof Uint8Array) {
+        return key;
+    }
+    if (isCryptoKey(key)) {
+        return key;
+    }
+    if (isKeyObject(key)) {
+        if (key.type === 'secret') {
+            return key.export();
+        }
+        if ('toCryptoKey' in key && typeof key.toCryptoKey === 'function') {
+            try {
+                return handleKeyObject(key, alg);
+            }
+            catch (err) {
+                if (err instanceof TypeError) {
+                    throw err;
+                }
+            }
+        }
+        let jwk = key.export({ format: 'jwk' });
+        return handleJWK(key, jwk, alg);
+    }
+    if (isJWK(key)) {
+        if (key.k) {
+            return decode(key.k);
+        }
+        return handleJWK(key, key, alg, true);
+    }
+    throw new Error('unreachable');
+}

package/node_modules/jose/dist/webapi/lib/pbes2kw.js

@@ -0,0 +1,39 @@
+import { encode as b64u } from '../util/base64url.js';
+import * as aeskw from './aeskw.js';
+import { checkEncCryptoKey } from './crypto_key.js';
+import { concat, encode } from './buffer_utils.js';
+import { JWEInvalid } from '../util/errors.js';
+function getCryptoKey(key, alg) {
+    if (key instanceof Uint8Array) {
+        return crypto.subtle.importKey('raw', key, 'PBKDF2', false, [
+            'deriveBits',
+        ]);
+    }
+    checkEncCryptoKey(key, alg, 'deriveBits');
+    return key;
+}
+const concatSalt = (alg, p2sInput) => concat(encode(alg), Uint8Array.of(0x00), p2sInput);
+async function deriveKey(p2s, alg, p2c, key) {
+    if (!(p2s instanceof Uint8Array) || p2s.length < 8) {
+        throw new JWEInvalid('PBES2 Salt Input must be 8 or more octets');
+    }
+    const salt = concatSalt(alg, p2s);
+    const keylen = parseInt(alg.slice(13, 16), 10);
+    const subtleAlg = {
+        hash: `SHA-${alg.slice(8, 11)}`,
+        iterations: p2c,
+        name: 'PBKDF2',
+        salt,
+    };
+    const cryptoKey = await getCryptoKey(key, alg);
+    return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
+}
+export async function wrap(alg, key, cek, p2c = 2048, p2s = crypto.getRandomValues(new Uint8Array(16))) {
+    const derived = await deriveKey(p2s, alg, p2c, key);
+    const encryptedKey = await aeskw.wrap(alg.slice(-6), derived, cek);
+    return { encryptedKey, p2c, p2s: b64u(p2s) };
+}
+export async function unwrap(alg, key, encryptedKey, p2c, p2s) {
+    const derived = await deriveKey(p2s, alg, p2c, key);
+    return aeskw.unwrap(alg.slice(-6), derived, encryptedKey);
+}

package/node_modules/jose/dist/webapi/lib/private_symbols.js

@@ -0,0 +1 @@
+export const unprotected = Symbol();

package/node_modules/jose/dist/webapi/lib/rsaes.js

@@ -0,0 +1,24 @@
+import { checkEncCryptoKey } from './crypto_key.js';
+import { checkKeyLength } from './check_key_length.js';
+import { JOSENotSupported } from '../util/errors.js';
+const subtleAlgorithm = (alg) => {
+    switch (alg) {
+        case 'RSA-OAEP':
+        case 'RSA-OAEP-256':
+        case 'RSA-OAEP-384':
+        case 'RSA-OAEP-512':
+            return 'RSA-OAEP';
+        default:
+            throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
+    }
+};
+export async function encrypt(alg, key, cek) {
+    checkEncCryptoKey(key, alg, 'encrypt');
+    checkKeyLength(alg, key);
+    return new Uint8Array(await crypto.subtle.encrypt(subtleAlgorithm(alg), key, cek));
+}
+export async function decrypt(alg, key, encryptedKey) {
+    checkEncCryptoKey(key, alg, 'decrypt');
+    checkKeyLength(alg, key);
+    return new Uint8Array(await crypto.subtle.decrypt(subtleAlgorithm(alg), key, encryptedKey));
+}

package/node_modules/jose/dist/webapi/lib/sign.js

@@ -0,0 +1,9 @@
+import { subtleAlgorithm } from './subtle_dsa.js';
+import { checkKeyLength } from './check_key_length.js';
+import { getSigKey } from './get_sign_verify_key.js';
+export async function sign(alg, key, data) {
+    const cryptoKey = await getSigKey(alg, key, 'sign');
+    checkKeyLength(alg, cryptoKey);
+    const signature = await crypto.subtle.sign(subtleAlgorithm(alg, cryptoKey.algorithm), cryptoKey, data);
+    return new Uint8Array(signature);
+}