unjwt 0.5.38 → 0.5.39

package/dist/shared/unjwt.Dpl__ZAR.mjs

@@ -1,2121 +0,0 @@
-import { k as isCryptoKey, x as concatUint8Arrays, d as base64UrlEncode, y as base64Decode, z as base64Encode, t as textEncoder, s as sanitizeObject, A as assertCryptoKey, a as isJWK, e as base64UrlDecode, B as isAsymmetricJWK, r as randomBytes, m as isJWKSet } from './unjwt.Be8NxwFK.mjs';
-
-/**
- * This is a fork of Jose library's utility functions.
- * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/buffer_utils.ts
- * @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
- */
-const MAX_INT32 = 2 ** 32;
-function writeUInt32BE(buf, value, offset) {
-  if (value < 0 || value >= MAX_INT32) {
-    throw new RangeError(
-      `value must be >= 0 and <= ${MAX_INT32 - 1}. Received ${value}`
-    );
-  }
-  buf.set([value >>> 24, value >>> 16, value >>> 8, value & 255], offset);
-}
-function uint64be(value) {
-  const high = Math.floor(value / MAX_INT32);
-  const low = value % MAX_INT32;
-  const buf = new Uint8Array(8);
-  writeUInt32BE(buf, high, 0);
-  writeUInt32BE(buf, low, 4);
-  return buf;
-}
-function uint32be(value) {
-  const buf = new Uint8Array(4);
-  writeUInt32BE(buf, value);
-  return buf;
-}
-
-/**
- * This is a fork of Jose library's utility functions.
- * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/cek.ts
- * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/iv.ts
- * @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
- */
-function bitLengthIV(alg) {
-  switch (alg) {
-    case "A128GCM":
-    case "A128GCMKW":
-    case "A192GCM":
-    case "A192GCMKW":
-    case "A256GCM":
-    case "A256GCMKW": {
-      return 96;
-    }
-    case "A128CBC-HS256":
-    case "A192CBC-HS384":
-    case "A256CBC-HS512": {
-      return 128;
-    }
-    default: {
-      throw new Error(`Unsupported JWE Algorithm: ${alg}`);
-    }
-  }
-}
-function generateIV(alg) {
-  return crypto.getRandomValues(new Uint8Array(bitLengthIV(alg) >> 3));
-}
-function checkIvLength(enc, iv) {
-  if (iv.length << 3 !== bitLengthIV(enc)) {
-    throw new Error("Invalid Initialization Vector length");
-  }
-}
-function bitLengthCEK(alg) {
-  switch (alg) {
-    case "A128GCM": {
-      return 128;
-    }
-    case "A192GCM": {
-      return 192;
-    }
-    case "A256GCM":
-    case "A128CBC-HS256": {
-      return 256;
-    }
-    case "A192CBC-HS384": {
-      return 384;
-    }
-    case "A256CBC-HS512": {
-      return 512;
-    }
-    default: {
-      throw new Error(`Unsupported JWE Algorithm: ${alg}`);
-    }
-  }
-}
-function generateCEK(alg) {
-  return crypto.getRandomValues(new Uint8Array(bitLengthCEK(alg) >> 3));
-}
-function checkCEKLength(cek, expected) {
-  const actual = cek.byteLength << 3;
-  if (actual !== expected) {
-    throw new Error(
-      `Invalid Content Encryption Key length. Expected ${expected} bits, got ${actual} bits`
-    );
-  }
-}
-
-/**
- * This is a fork of Jose library's utility functions.
- * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/crypto_key.ts
- * @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
- */
-function unusable(name, prop = "algorithm.name") {
-  return new TypeError(
-    `CryptoKey does not support this operation, its ${prop} must be ${name}`
-  );
-}
-function isAlgorithm(algorithm, name) {
-  return algorithm.name === name;
-}
-function getHashLength(hash) {
-  return Number.parseInt(hash.name.slice(4), 10);
-}
-function getNamedCurve$1(alg) {
-  switch (alg) {
-    case "ES256": {
-      return "P-256";
-    }
-    case "ES384": {
-      return "P-384";
-    }
-    case "ES512": {
-      return "P-521";
-    }
-    default: {
-      throw new Error("unreachable");
-    }
-  }
-}
-function checkUsage(key, usage) {
-  if (usage && !key.usages.includes(usage)) {
-    throw new TypeError(
-      `CryptoKey does not support this operation, its usages must include ${usage}.`
-    );
-  }
-}
-function checkSigCryptoKey(key, alg, usage) {
-  switch (alg) {
-    case "HS256":
-    case "HS384":
-    case "HS512": {
-      if (!isAlgorithm(key.algorithm, "HMAC"))
-        throw unusable("HMAC");
-      const expected = Number.parseInt(alg.slice(2), 10);
-      const actual = getHashLength(key.algorithm.hash);
-      if (actual !== expected)
-        throw unusable(`SHA-${expected}`, "algorithm.hash");
-      break;
-    }
-    case "RS256":
-    case "RS384":
-    case "RS512": {
-      if (!isAlgorithm(key.algorithm, "RSASSA-PKCS1-v1_5"))
-        throw unusable("RSASSA-PKCS1-v1_5");
-      const expected = Number.parseInt(alg.slice(2), 10);
-      const actual = getHashLength(key.algorithm.hash);
-      if (actual !== expected)
-        throw unusable(`SHA-${expected}`, "algorithm.hash");
-      break;
-    }
-    case "PS256":
-    case "PS384":
-    case "PS512": {
-      if (!isAlgorithm(key.algorithm, "RSA-PSS"))
-        throw unusable("RSA-PSS");
-      const expected = Number.parseInt(alg.slice(2), 10);
-      const actual = getHashLength(key.algorithm.hash);
-      if (actual !== expected)
-        throw unusable(`SHA-${expected}`, "algorithm.hash");
-      break;
-    }
-    case "Ed25519":
-    // Fall through
-    case "EdDSA": {
-      if (!isAlgorithm(key.algorithm, "Ed25519")) throw unusable("Ed25519");
-      break;
-    }
-    case "ES256":
-    case "ES384":
-    case "ES512": {
-      if (!isAlgorithm(key.algorithm, "ECDSA"))
-        throw unusable("ECDSA");
-      const expected = getNamedCurve$1(alg);
-      const actual = key.algorithm.namedCurve;
-      if (actual !== expected) throw unusable(expected, "algorithm.namedCurve");
-      break;
-    }
-    default: {
-      throw new TypeError("CryptoKey does not support this operation");
-    }
-  }
-  checkUsage(key, usage);
-}
-function checkEncCryptoKey(key, alg, usage) {
-  switch (alg) {
-    case "A128GCM":
-    case "A192GCM":
-    case "A256GCM": {
-      if (!isAlgorithm(key.algorithm, "AES-GCM"))
-        throw unusable("AES-GCM");
-      const expected = Number.parseInt(alg.slice(1, 4), 10);
-      const actual = key.algorithm.length;
-      if (actual !== expected) throw unusable(expected, "algorithm.length");
-      break;
-    }
-    case "A128KW":
-    case "A192KW":
-    case "A256KW": {
-      if (!isAlgorithm(key.algorithm, "AES-KW"))
-        throw unusable("AES-KW");
-      const expected = Number.parseInt(alg.slice(1, 4), 10);
-      const actual = key.algorithm.length;
-      if (actual !== expected) throw unusable(expected, "algorithm.length");
-      break;
-    }
-    case "ECDH": {
-      switch (key.algorithm.name) {
-        case "ECDH":
-        case "X25519": {
-          break;
-        }
-        default: {
-          throw unusable("ECDH or X25519");
-        }
-      }
-      break;
-    }
-    case "PBES2-HS256+A128KW":
-    case "PBES2-HS384+A192KW":
-    case "PBES2-HS512+A256KW": {
-      if (!isAlgorithm(key.algorithm, "PBKDF2")) throw unusable("PBKDF2");
-      break;
-    }
-    case "RSA-OAEP":
-    case "RSA-OAEP-256":
-    case "RSA-OAEP-384":
-    case "RSA-OAEP-512": {
-      if (!isAlgorithm(key.algorithm, "RSA-OAEP"))
-        throw unusable("RSA-OAEP");
-      const expected = Number.parseInt(alg.slice(9), 10) || 1;
-      const actual = getHashLength(key.algorithm.hash);
-      if (actual !== expected)
-        throw unusable(`SHA-${expected}`, "algorithm.hash");
-      break;
-    }
-    default: {
-      throw new TypeError("CryptoKey does not support this operation");
-    }
-  }
-  checkUsage(key, usage);
-}
-
-/**
- * This is a fork of Jose library's utility functions.
- * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/encrypt.ts
- * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/decrypt.ts
- * @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
- */
-async function cbcEncrypt(enc, plaintext, cek, iv, aad) {
-  if (!(cek instanceof Uint8Array)) {
-    throw new TypeError(`Key must be ${cek} of type: Uint8Array`);
-  }
-  const keySize = Number.parseInt(enc.slice(1, 4), 10);
-  const encKey = await crypto.subtle.importKey(
-    "raw",
-    cek.subarray(keySize >> 3),
-    "AES-CBC",
-    false,
-    ["encrypt"]
-  );
-  const macKey = await crypto.subtle.importKey(
-    "raw",
-    cek.subarray(0, keySize >> 3),
-    {
-      hash: `SHA-${keySize << 1}`,
-      name: "HMAC"
-    },
-    false,
-    ["sign"]
-  );
-  const ciphertext = new Uint8Array(
-    await crypto.subtle.encrypt(
-      {
-        iv,
-        name: "AES-CBC"
-      },
-      encKey,
-      plaintext
-    )
-  );
-  const macData = concatUint8Arrays(
-    aad,
-    iv,
-    ciphertext,
-    uint64be(aad.length << 3)
-  );
-  const tag = new Uint8Array(
-    (await crypto.subtle.sign("HMAC", macKey, macData)).slice(0, keySize >> 3)
-  );
-  return { ciphertext, tag, iv };
-}
-async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
-  let encKey;
-  if (cek instanceof Uint8Array) {
-    encKey = await crypto.subtle.importKey("raw", cek, "AES-GCM", false, [
-      "encrypt"
-    ]);
-  } else {
-    checkEncCryptoKey(cek, enc, "encrypt");
-    encKey = cek;
-  }
-  const encrypted = new Uint8Array(
-    await crypto.subtle.encrypt(
-      {
-        additionalData: aad,
-        iv,
-        name: "AES-GCM",
-        tagLength: 128
-      },
-      encKey,
-      plaintext
-    )
-  );
-  const tag = encrypted.slice(-16);
-  const ciphertext = encrypted.slice(0, -16);
-  return { ciphertext, tag, iv };
-}
-async function encrypt(enc, plaintext, cek, iv, aad) {
-  if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) {
-    throw new TypeError(
-      `Key must be ${cek} one of type: CryptoKey or Uint8Array`
-    );
-  }
-  if (iv) {
-    checkIvLength(enc, iv);
-  } else {
-    iv = generateIV(enc);
-  }
-  switch (enc) {
-    case "A128CBC-HS256":
-    case "A192CBC-HS384":
-    case "A256CBC-HS512": {
-      if (cek instanceof Uint8Array) {
-        checkCEKLength(cek, Number.parseInt(enc.slice(-3), 10));
-      }
-      return cbcEncrypt(enc, plaintext, cek, iv, aad);
-    }
-    case "A128GCM":
-    case "A192GCM":
-    case "A256GCM": {
-      if (cek instanceof Uint8Array) {
-        checkCEKLength(cek, Number.parseInt(enc.slice(1, 4), 10));
-      }
-      return gcmEncrypt(enc, plaintext, cek, iv, aad);
-    }
-    default: {
-      throw new Error("Unsupported JWE Content Encryption Algorithm");
-    }
-  }
-}
-async function timingSafeEqual(a, b) {
-  if (!(a instanceof Uint8Array)) {
-    throw new TypeError("First argument must be a buffer");
-  }
-  if (!(b instanceof Uint8Array)) {
-    throw new TypeError("Second argument must be a buffer");
-  }
-  const algorithm = { name: "HMAC", hash: "SHA-256" };
-  const key = await crypto.subtle.generateKey(algorithm, false, [
-    "sign"
-  ]);
-  const aHmac = new Uint8Array(await crypto.subtle.sign(algorithm, key, a));
-  const bHmac = new Uint8Array(await crypto.subtle.sign(algorithm, key, b));
-  let out = 0;
-  let i = -1;
-  while (++i < 32) {
-    out |= aHmac[i] ^ bHmac[i];
-  }
-  return out === 0;
-}
-async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
-  if (!(cek instanceof Uint8Array)) {
-    throw new TypeError(`Key must be ${cek} of type: Uint8Array`);
-  }
-  const keySize = Number.parseInt(enc.slice(1, 4), 10);
-  const encKey = await crypto.subtle.importKey(
-    "raw",
-    cek.subarray(keySize >> 3),
-    "AES-CBC",
-    false,
-    ["decrypt"]
-  );
-  const macKey = await crypto.subtle.importKey(
-    "raw",
-    cek.subarray(0, keySize >> 3),
-    {
-      hash: `SHA-${keySize << 1}`,
-      name: "HMAC"
-    },
-    false,
-    ["sign"]
-  );
-  const macData = concatUint8Arrays(
-    aad,
-    iv,
-    ciphertext,
-    uint64be(aad.length << 3)
-  );
-  const expectedTag = new Uint8Array(
-    (await crypto.subtle.sign("HMAC", macKey, macData)).slice(0, keySize >> 3)
-  );
-  let macCheckPassed;
-  try {
-    macCheckPassed = await timingSafeEqual(tag, expectedTag);
-  } catch {
-  }
-  if (!macCheckPassed) {
-    throw new Error("JWE Decryption Failed");
-  }
-  let plaintext;
-  try {
-    plaintext = new Uint8Array(
-      await crypto.subtle.decrypt({ iv, name: "AES-CBC" }, encKey, ciphertext)
-    );
-  } catch {
-  }
-  if (!plaintext) {
-    throw new Error("JWE Decryption Failed");
-  }
-  return plaintext;
-}
-async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
-  let encKey;
-  if (cek instanceof Uint8Array) {
-    encKey = await crypto.subtle.importKey("raw", cek, "AES-GCM", false, [
-      "decrypt"
-    ]);
-  } else {
-    checkEncCryptoKey(cek, enc, "decrypt");
-    encKey = cek;
-  }
-  try {
-    return new Uint8Array(
-      await crypto.subtle.decrypt(
-        {
-          additionalData: aad,
-          iv,
-          name: "AES-GCM",
-          tagLength: 128
-        },
-        encKey,
-        concatUint8Arrays(ciphertext, tag)
-      )
-    );
-  } catch {
-    throw new Error("JWE Decryption Failed");
-  }
-}
-async function decrypt(enc, cek, ciphertext, iv, tag, aad) {
-  if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) {
-    throw new TypeError(
-      `Key must be ${cek} one of type: CryptoKey or Uint8Array`
-    );
-  }
-  if (!iv) {
-    throw new Error("JWE Initialization Vector missing");
-  }
-  if (!tag) {
-    throw new Error("JWE Authentication Tag missing");
-  }
-  checkIvLength(enc, iv);
-  switch (enc) {
-    case "A128CBC-HS256":
-    case "A192CBC-HS384":
-    case "A256CBC-HS512": {
-      if (cek instanceof Uint8Array)
-        checkCEKLength(cek, Number.parseInt(enc.slice(-3), 10));
-      return cbcDecrypt(enc, cek, ciphertext, iv, tag, aad);
-    }
-    case "A128GCM":
-    case "A192GCM":
-    case "A256GCM": {
-      if (cek instanceof Uint8Array)
-        checkCEKLength(cek, Number.parseInt(enc.slice(1, 4), 10));
-      return gcmDecrypt(enc, cek, ciphertext, iv, tag, aad);
-    }
-    default: {
-      throw new Error("Unsupported JWE Content Encryption Algorithm");
-    }
-  }
-}
-
-/**
- * This is a fork of Jose library's utility functions.
- * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/aesgcmkw.ts
- * @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
- */
-async function encryptIV(alg, key, plaintext, iv) {
-  const jweAlgorithm = alg.slice(0, 7);
-  const wrapped = await encrypt(
-    jweAlgorithm,
-    plaintext,
-    key,
-    iv,
-    new Uint8Array(0)
-  );
-  return {
-    encryptedKey: wrapped.ciphertext,
-    iv: base64UrlEncode(wrapped.iv),
-    tag: base64UrlEncode(wrapped.tag)
-  };
-}
-async function decryptIV(alg, key, ciphertext, iv, tag) {
-  const jweAlgorithm = alg.slice(0, 7);
-  return decrypt(jweAlgorithm, key, ciphertext, iv, tag, new Uint8Array(0));
-}
-
-/**
- * This is a fork of Jose library's utility functions.
- * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/asn1.ts
- * @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
- */
-const formatPEM = (b64, descriptor) => {
-  const newlined = (b64.match(/.{1,64}/g) || []).join("\n");
-  return `-----BEGIN ${descriptor}-----
-${newlined}
------END ${descriptor}-----`;
-};
-const genericExport = async (keyType, keyFormat, key) => {
-  if (!isCryptoKey(key)) {
-    throw new TypeError(`Key must be ${key} of type CryptoKey`);
-  }
-  if (!key.extractable) {
-    throw new TypeError("CryptoKey is not extractable");
-  }
-  if (key.type !== keyType) {
-    throw new TypeError(`key is not a ${keyType} key`);
-  }
-  return formatPEM(
-    base64Encode(new Uint8Array(await crypto.subtle.exportKey(keyFormat, key))),
-    `${keyType.toUpperCase()} KEY`
-  );
-};
-const toSPKI = (key) => {
-  return genericExport("public", "spki", key);
-};
-const toPKCS8 = (key) => {
-  return genericExport("private", "pkcs8", key);
-};
-const findOid = (keyData, oid, from = 0) => {
-  if (from === 0) {
-    oid.unshift(oid.length);
-    oid.unshift(6);
-  }
-  const i = keyData.indexOf(oid[0], from);
-  if (i === -1) return false;
-  const sub = keyData.subarray(i, i + oid.length);
-  if (sub.length !== oid.length) return false;
-  return sub.every((value, index) => value === oid[index]) || findOid(keyData, oid, i + 1);
-};
-const getNamedCurve = (keyData) => {
-  switch (true) {
-    case findOid(keyData, [42, 134, 72, 206, 61, 3, 1, 7]): {
-      return "P-256";
-    }
-    case findOid(keyData, [43, 129, 4, 0, 34]): {
-      return "P-384";
-    }
-    case findOid(keyData, [43, 129, 4, 0, 35]): {
-      return "P-521";
-    }
-    default: {
-      return void 0;
-    }
-  }
-};
-const genericImport = async (replace, keyFormat, pem, alg, options) => {
-  let algorithm;
-  let keyUsages;
-  const cleanedPem = pem.replace(replace, "");
-  const keyData = base64Decode(cleanedPem, false);
-  const isPublic = keyFormat === "spki";
-  switch (alg) {
-    case "PS256":
-    case "PS384":
-    case "PS512": {
-      algorithm = { name: "RSA-PSS", hash: `SHA-${alg.slice(-3)}` };
-      keyUsages = isPublic ? ["verify"] : ["sign"];
-      break;
-    }
-    case "RS256":
-    case "RS384":
-    case "RS512": {
-      algorithm = { name: "RSASSA-PKCS1-v1_5", hash: `SHA-${alg.slice(-3)}` };
-      keyUsages = isPublic ? ["verify"] : ["sign"];
-      break;
-    }
-    case "RSA-OAEP":
-    case "RSA-OAEP-256":
-    case "RSA-OAEP-384":
-    case "RSA-OAEP-512": {
-      algorithm = {
-        name: "RSA-OAEP",
-        hash: `SHA-${Number.parseInt(alg.slice(-3), 10) || 1}`
-      };
-      keyUsages = isPublic ? ["encrypt", "wrapKey"] : ["decrypt", "unwrapKey"];
-      break;
-    }
-    case "ES256": {
-      algorithm = { name: "ECDSA", namedCurve: "P-256" };
-      keyUsages = isPublic ? ["verify"] : ["sign"];
-      break;
-    }
-    case "ES384": {
-      algorithm = { name: "ECDSA", namedCurve: "P-384" };
-      keyUsages = isPublic ? ["verify"] : ["sign"];
-      break;
-    }
-    case "ES512": {
-      algorithm = { name: "ECDSA", namedCurve: "P-521" };
-      keyUsages = isPublic ? ["verify"] : ["sign"];
-      break;
-    }
-    case "ECDH-ES":
-    case "ECDH-ES+A128KW":
-    case "ECDH-ES+A192KW":
-    case "ECDH-ES+A256KW": {
-      const namedCurve = getNamedCurve(keyData);
-      algorithm = namedCurve?.startsWith("P-") ? { name: "ECDH", namedCurve } : { name: "X25519" };
-      keyUsages = isPublic ? [] : ["deriveBits"];
-      break;
-    }
-    case "Ed25519":
-    case "EdDSA": {
-      algorithm = { name: "Ed25519" };
-      keyUsages = isPublic ? ["verify"] : ["sign"];
-      break;
-    }
-    default: {
-      throw new Error('Invalid or unsupported "alg" (Algorithm) value');
-    }
-  }
-  return crypto.subtle.importKey(
-    keyFormat,
-    keyData,
-    algorithm,
-    options?.extractable ?? (isPublic ? true : false),
-    keyUsages
-  );
-};
-const fromPKCS8 = (pem, alg, options) => {
-  return genericImport(
-    /(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g,
-    "pkcs8",
-    pem,
-    alg,
-    options
-  );
-};
-const fromSPKI = (pem, alg, options) => {
-  return genericImport(
-    /(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g,
-    "spki",
-    pem,
-    alg,
-    options
-  );
-};
-function getElement(seq) {
-  const result = [];
-  let next = 0;
-  while (next < seq.length) {
-    const nextPart = parseElement(seq.subarray(next));
-    result.push(nextPart);
-    next += nextPart.byteLength;
-  }
-  return result;
-}
-function parseElement(bytes) {
-  let position = 0;
-  let tag = bytes[0] & 31;
-  position++;
-  if (tag === 31) {
-    tag = 0;
-    while (bytes[position] >= 128) {
-      tag = tag * 128 + bytes[position] - 128;
-      position++;
-    }
-    tag = tag * 128 + bytes[position] - 128;
-    position++;
-  }
-  let length = 0;
-  if (bytes[position] < 128) {
-    length = bytes[position];
-    position++;
-  } else if (length === 128) {
-    length = 0;
-    while (bytes[position + length] !== 0 || bytes[position + length + 1] !== 0) {
-      if (length > bytes.byteLength) {
-        throw new TypeError("invalid indefinite form length");
-      }
-      length++;
-    }
-    const byteLength2 = position + length + 2;
-    return {
-      byteLength: byteLength2,
-      contents: bytes.subarray(position, position + length),
-      raw: bytes.subarray(0, byteLength2)
-    };
-  } else {
-    const numberOfDigits = bytes[position] & 127;
-    position++;
-    length = 0;
-    for (let i = 0; i < numberOfDigits; i++) {
-      length = length * 256 + bytes[position];
-      position++;
-    }
-  }
-  const byteLength = position + length;
-  return {
-    byteLength,
-    contents: bytes.subarray(position, byteLength),
-    raw: bytes.subarray(0, byteLength)
-  };
-}
-function spkiFromX509(buf) {
-  const tbsCertificate = getElement(
-    getElement(parseElement(buf).contents)[0].contents
-  );
-  return base64Encode(
-    tbsCertificate[tbsCertificate[0].raw[0] === 160 ? 6 : 5].raw
-  );
-}
-let createPublicKey;
-function getSPKI(x509) {
-  try {
-    createPublicKey ??= globalThis.process?.getBuiltinModule?.("node:crypto")?.createPublicKey;
-  } catch {
-    createPublicKey = 0;
-  }
-  if (createPublicKey) {
-    try {
-      return new createPublicKey(x509).export({ format: "pem", type: "spki" });
-    } catch {
-    }
-  }
-  const pem = x509.replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g, "");
-  const raw = base64Decode(pem, false);
-  return formatPEM(spkiFromX509(raw), "PUBLIC KEY");
-}
-const fromX509 = (pem, alg, options) => {
-  let spki;
-  try {
-    spki = getSPKI(pem);
-  } catch (error_) {
-    throw new TypeError("Failed to parse the X.509 certificate", {
-      cause: error_
-    });
-  }
-  return fromSPKI(spki, alg, options);
-};
-
-function lengthAndInput(input) {
-  return concatUint8Arrays(uint32be(input.length), input);
-}
-async function concatKdf(secret, bits, value) {
-  const iterations = Math.ceil((bits >> 3) / 32);
-  const res = new Uint8Array(iterations * 32);
-  for (let iter = 0; iter < iterations; iter++) {
-    const buf = new Uint8Array(4 + secret.length + value.length);
-    buf.set(uint32be(iter + 1));
-    buf.set(secret, 4);
-    buf.set(value, 4 + secret.length);
-    res.set(await digest("sha256", buf), iter * 32);
-  }
-  return res.slice(0, bits >> 3);
-}
-async function deriveECDHESKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) {
-  checkEncCryptoKey(publicKey, "ECDH");
-  checkEncCryptoKey(privateKey, "ECDH", "deriveBits");
-  const value = concatUint8Arrays(
-    lengthAndInput(textEncoder.encode(algorithm)),
-    lengthAndInput(apu),
-    lengthAndInput(apv),
-    uint32be(keyLength)
-  );
-  const length = publicKey.algorithm.name === "X25519" ? 256 : Math.ceil(
-    Number.parseInt(
-      publicKey.algorithm.namedCurve.slice(-3),
-      10
-    ) / 8
-  ) << 3;
-  const sharedSecret = new Uint8Array(
-    await crypto.subtle.deriveBits(
-      {
-        name: publicKey.algorithm.name,
-        public: publicKey
-      },
-      privateKey,
-      length
-    )
-  );
-  return concatKdf(sharedSecret, keyLength, value);
-}
-function allowed(key) {
-  switch (key.algorithm.namedCurve) {
-    case "P-256":
-    case "P-384":
-    case "P-521": {
-      return true;
-    }
-    default: {
-      return key.algorithm.name === "X25519";
-    }
-  }
-}
-async function digest(algorithm, data) {
-  const subtleDigest = `SHA-${algorithm.slice(-3)}`;
-  return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));
-}
-
-/**
- * This is a fork of Jose library's utility functions.
- * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/jwt_to_key.ts
- * @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
- */
-function subtleMapping(jwk) {
-  let algorithm;
-  let keyUsages;
-  switch (jwk.kty) {
-    case "RSA": {
-      switch (jwk.alg) {
-        case "PS256":
-        case "PS384":
-        case "PS512": {
-          algorithm = { name: "RSA-PSS", hash: `SHA-${jwk.alg.slice(-3)}` };
-          keyUsages = jwk.d ? ["sign"] : ["verify"];
-          break;
-        }
-        case "RS256":
-        case "RS384":
-        case "RS512": {
-          algorithm = {
-            name: "RSASSA-PKCS1-v1_5",
-            hash: `SHA-${jwk.alg.slice(-3)}`
-          };
-          keyUsages = jwk.d ? ["sign"] : ["verify"];
-          break;
-        }
-        case "RSA-OAEP":
-        case "RSA-OAEP-256":
-        case "RSA-OAEP-384":
-        case "RSA-OAEP-512": {
-          algorithm = {
-            name: "RSA-OAEP",
-            hash: `SHA-${Number.parseInt(jwk.alg.slice(-3), 10) || 1}`
-          };
-          keyUsages = jwk.d ? ["decrypt", "unwrapKey"] : ["encrypt", "wrapKey"];
-          break;
-        }
-        default: {
-          throw new Error(
-            'Invalid or unsupported JWK "alg" (Algorithm) Parameter value'
-          );
-        }
-      }
-      break;
-    }
-    case "EC": {
-      switch (jwk.alg) {
-        case "ES256": {
-          algorithm = { name: "ECDSA", namedCurve: "P-256" };
-          keyUsages = jwk.d ? ["sign"] : ["verify"];
-          break;
-        }
-        case "ES384": {
-          algorithm = { name: "ECDSA", namedCurve: "P-384" };
-          keyUsages = jwk.d ? ["sign"] : ["verify"];
-          break;
-        }
-        case "ES512": {
-          algorithm = { name: "ECDSA", namedCurve: "P-521" };
-          keyUsages = jwk.d ? ["sign"] : ["verify"];
-          break;
-        }
-        case "ECDH-ES":
-        case "ECDH-ES+A128KW":
-        case "ECDH-ES+A192KW":
-        case "ECDH-ES+A256KW": {
-          algorithm = {
-            name: "ECDH",
-            namedCurve: jwk.crv
-          };
-          keyUsages = jwk.d ? ["deriveBits"] : [];
-          break;
-        }
-        default: {
-          throw new Error(
-            'Invalid or unsupported JWK "alg" (Algorithm) Parameter value'
-          );
-        }
-      }
-      break;
-    }
-    case "OKP": {
-      switch (jwk.alg) {
-        case "Ed25519":
-        // Fall through
-        case "EdDSA": {
-          algorithm = { name: "Ed25519" };
-          keyUsages = jwk.d ? ["sign"] : ["verify"];
-          break;
-        }
-        case "ECDH-ES":
-        case "ECDH-ES+A128KW":
-        case "ECDH-ES+A192KW":
-        case "ECDH-ES+A256KW": {
-          algorithm = { name: jwk.crv };
-          keyUsages = jwk.d ? ["deriveBits"] : [];
-          break;
-        }
-        default: {
-          throw new Error(
-            'Invalid or unsupported JWK "alg" (Algorithm) Parameter value'
-          );
-        }
-      }
-      break;
-    }
-    default: {
-      throw new Error(
-        'Invalid or unsupported JWK "kty" (Key Type) Parameter value'
-      );
-    }
-  }
-  return { algorithm, keyUsages };
-}
-async function jwkTokey(jwk) {
-  if (!jwk.alg) {
-    throw new TypeError(
-      '"alg" argument is required when "jwk.alg" is not present'
-    );
-  }
-  const { algorithm, keyUsages } = subtleMapping(jwk);
-  const keyData = { ...sanitizeObject(jwk) };
-  delete keyData.alg;
-  delete keyData.use;
-  return crypto.subtle.importKey(
-    "jwk",
-    keyData,
-    algorithm,
-    jwk.ext ?? (jwk.d ? false : true),
-    jwk.key_ops ?? keyUsages
-  );
-}
-
-/**
- * This is a fork of Jose library's utility functions.
- * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/key_to_jwt.ts
- * @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
- */
-async function keyToJWK(key) {
-  if (key instanceof Uint8Array) {
-    return {
-      kty: "oct",
-      k: base64UrlEncode(key)
-    };
-  }
-  if (!isCryptoKey(key)) {
-    throw new TypeError(
-      `Key must be ${key} one of type: CryptoKey, or Uint8Array`
-    );
-  }
-  if (!key.extractable) {
-    throw new TypeError(
-      "non-extractable CryptoKey cannot be exported as a JWK"
-    );
-  }
-  const jwk = await crypto.subtle.exportKey("jwk", key);
-  return jwk;
-}
-
-/**
- * This is a fork of Jose library's utility functions.
- * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/sign.ts
- * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/verify.ts
- * @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
- */
-async function sign(alg, key, data) {
-  const cryptoKey = await getSignVerifyKey(alg, key, "sign");
-  checkKeyLength(alg, cryptoKey);
-  const signature = await crypto.subtle.sign(
-    subtleAlgorithm$1(alg, cryptoKey.algorithm),
-    cryptoKey,
-    data
-  );
-  return new Uint8Array(signature);
-}
-async function verify(alg, key, signature, data) {
-  const cryptoKey = await getSignVerifyKey(alg, key, "verify");
-  checkKeyLength(alg, cryptoKey);
-  const algorithm = subtleAlgorithm$1(alg, cryptoKey.algorithm);
-  try {
-    return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);
-  } catch {
-    return false;
-  }
-}
-function checkKeyLength(alg, key) {
-  if (alg.startsWith("RS") || alg.startsWith("PS")) {
-    const { modulusLength } = key.algorithm;
-    if (typeof modulusLength !== "number" || modulusLength < 2048) {
-      throw new TypeError(
-        `${alg} requires key modulusLength to be 2048 bits or larger`
-      );
-    }
-  }
-}
-async function getSignVerifyKey(alg, key, usage) {
-  if (key instanceof Uint8Array) {
-    if (!alg.startsWith("HS")) {
-      throw new TypeError(
-        `Key must be ${key} of type: CryptoKey or JSON Web Key`
-      );
-    }
-    return crypto.subtle.importKey(
-      "raw",
-      key,
-      { hash: `SHA-${alg.slice(-3)}`, name: "HMAC" },
-      false,
-      [usage]
-    );
-  }
-  checkSigCryptoKey(key, alg, usage);
-  return key;
-}
-function subtleAlgorithm$1(alg, algorithm) {
-  const hash = `SHA-${alg.slice(-3)}`;
-  switch (alg) {
-    case "HS256":
-    case "HS384":
-    case "HS512": {
-      return { hash, name: "HMAC" };
-    }
-    case "PS256":
-    case "PS384":
-    case "PS512": {
-      return {
-        hash,
-        name: "RSA-PSS",
-        saltLength: Number.parseInt(alg.slice(-3), 10) >> 3
-      };
-    }
-    case "RS256":
-    case "RS384":
-    case "RS512": {
-      return { hash, name: "RSASSA-PKCS1-v1_5" };
-    }
-    case "ES256":
-    case "ES384":
-    case "ES512": {
-      return {
-        hash,
-        name: "ECDSA",
-        namedCurve: algorithm.namedCurve
-      };
-    }
-    case "Ed25519":
-    // Fall through
-    case "EdDSA": {
-      return { name: "Ed25519" };
-    }
-    default: {
-      throw new Error(
-        `alg ${alg} is not supported either by JOSE or your javascript runtime`
-      );
-    }
-  }
-}
-
-const subtleAlgorithm = (alg) => {
-  switch (alg) {
-    case "RSA-OAEP":
-    case "RSA-OAEP-256":
-    case "RSA-OAEP-384":
-    case "RSA-OAEP-512": {
-      return "RSA-OAEP";
-    }
-    default: {
-      throw new Error(
-        `alg ${alg} is not supported either by JOSE or your javascript runtime`
-      );
-    }
-  }
-};
-async function encryptRSAES(alg, key, cek) {
-  checkEncCryptoKey(key, alg, "encrypt");
-  checkKeyLength(alg, key);
-  return new Uint8Array(
-    await crypto.subtle.encrypt(subtleAlgorithm(alg), key, cek)
-  );
-}
-async function decryptRSAES(alg, key, encryptedKey) {
-  checkEncCryptoKey(key, alg, "decrypt");
-  checkKeyLength(alg, key);
-  return new Uint8Array(
-    await crypto.subtle.decrypt(subtleAlgorithm(alg), key, encryptedKey)
-  );
-}
-
-/**
- * This is a fork of Jose library's utility functions.
- * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/pbes2kw.ts
- * @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
- */
-async function wrap(alg, key, cek, p2c, p2s) {
-  if (p2c && p2s) {
-    const derived = await deriveKey(p2s, alg, p2c, key);
-    const encryptedKey = await _wrap(alg.slice(-6), derived, cek);
-    return { encryptedKey, p2c, p2s: base64UrlEncode(p2s) };
-  } else {
-    const encryptedKey = await _wrap(alg, key, cek);
-    return { encryptedKey };
-  }
-}
-async function unwrap(alg, key, encryptedKey, p2c, p2s) {
-  if (p2c && p2s) {
-    const derived = await deriveKey(p2s, alg, p2c, key);
-    return _unwrap(alg.slice(-6), derived, encryptedKey);
-  } else {
-    return _unwrap(alg, key, encryptedKey);
-  }
-}
-function getCryptoKey(key, alg, options = {}) {
-  const {
-    importAlg = "PBKDF2",
-    extractable = false,
-    usage = "deriveBits"
-  } = options;
-  if (key instanceof Uint8Array) {
-    return crypto.subtle.importKey("raw", key, importAlg, extractable, [usage]);
-  }
-  checkEncCryptoKey(key, alg, usage);
-  return key;
-}
-async function deriveKey(p2s, alg, p2c, key) {
-  if (!(p2s instanceof Uint8Array) || p2s.length < 8) {
-    throw new Error("PBES2 Salt Input must be 8 or more octets");
-  }
-  if (p2c === void 0 || p2c < 1) {
-    throw new Error(
-      "PBES2 Iteration Count Parameter must be a positive integer"
-    );
-  }
-  const salt = concatUint8Arrays(
-    textEncoder.encode(alg),
-    new Uint8Array([0]),
-    p2s
-  );
-  const keylen = Number.parseInt(alg.slice(13, 16), 10);
-  const subtleAlg = {
-    hash: `SHA-${alg.slice(8, 11)}`,
-    iterations: p2c,
-    name: "PBKDF2",
-    salt
-  };
-  const cryptoKey = await getCryptoKey(key, alg);
-  return new Uint8Array(
-    await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen)
-  );
-}
-function checkKeySize(key, alg) {
-  if (key.algorithm.length !== Number.parseInt(alg.slice(1, 4), 10)) {
-    throw new TypeError(`Invalid key size for alg: ${alg}`);
-  }
-}
-async function _wrap(alg, key, cek) {
-  const cryptoKey = await getCryptoKey(key, alg, {
-    importAlg: "AES-KW",
-    extractable: true,
-    usage: "wrapKey"
-  });
-  checkKeySize(cryptoKey, alg);
-  const cryptoKeyCek = await crypto.subtle.importKey(
-    "raw",
-    cek,
-    { hash: "SHA-256", name: "HMAC" },
-    true,
-    ["sign"]
-  );
-  return new Uint8Array(
-    await crypto.subtle.wrapKey("raw", cryptoKeyCek, cryptoKey, "AES-KW")
-  );
-}
-async function _unwrap(alg, key, encryptedKey) {
-  const cryptoKey = await getCryptoKey(key, alg, {
-    importAlg: "AES-KW",
-    extractable: true,
-    usage: "unwrapKey"
-  });
-  checkKeySize(cryptoKey, alg);
-  const cryptoKeyCek = await crypto.subtle.unwrapKey(
-    "raw",
-    encryptedKey,
-    cryptoKey,
-    "AES-KW",
-    { hash: "SHA-256", name: "HMAC" },
-    true,
-    ["sign"]
-  );
-  return new Uint8Array(await crypto.subtle.exportKey("raw", cryptoKeyCek));
-}
-
-/**
- * This is a fork of Jose library's utility functions.
- * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/encrypt_key_management.ts
- * @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
- */
-const PUBLIC_EPK_FIELDS = /* @__PURE__ */ new Set([
-  "kty",
-  "crv",
-  "x",
-  "y",
-  "kid",
-  "use",
-  "key_ops",
-  "alg",
-  "x5c",
-  "x5t",
-  "x5t#S256",
-  "x5u"
-]);
-function toPublicEpkJwk(jwk) {
-  const filtered = {};
-  for (const [key, value] of Object.entries(jwk)) {
-    if (value !== void 0 && PUBLIC_EPK_FIELDS.has(key)) {
-      filtered[key] = value;
-    }
-  }
-  const { kty, crv, x, y } = filtered;
-  if (typeof kty !== "string") {
-    throw new TypeError(
-      'ECDH-ES ephemeral key JWK must include the "kty" parameter.'
-    );
-  }
-  if (typeof crv !== "string") {
-    throw new TypeError(
-      'ECDH-ES ephemeral key JWK must include the "crv" parameter.'
-    );
-  }
-  if (typeof x !== "string") {
-    throw new TypeError(
-      'ECDH-ES ephemeral key JWK must include the "x" coordinate.'
-    );
-  }
-  if (kty === "EC" && typeof y !== "string") {
-    throw new TypeError(
-      'ECDH-ES EC ephemeral key JWK must include both "x" and "y" coordinates.'
-    );
-  }
-  const publicJwk = {
-    ...filtered,
-    kty,
-    crv,
-    x
-  };
-  if (typeof y === "string") {
-    publicJwk.y = y;
-  } else {
-    delete publicJwk.y;
-  }
-  return sanitizeObject(publicJwk);
-}
-async function ensurePrivateKey(alg, value) {
-  const normalized = await normalizeKey(value, alg);
-  if (!(normalized instanceof CryptoKey)) {
-    throw new TypeError(
-      "ECDH-ES ephemeral private key must be a CryptoKey or convertible JWK."
-    );
-  }
-  if (normalized.type !== "private") {
-    throw new TypeError(
-      'ECDH-ES ephemeral private key must have type "private".'
-    );
-  }
-  return normalized;
-}
-async function exportPublicJwkFrom(alg, value) {
-  if (isCryptoKey(value)) {
-    try {
-      return toPublicEpkJwk(await keyToJWK(value));
-    } catch (error_) {
-      throw new TypeError(
-        "ECDH-ES ephemeral CryptoKey must be extractable to export as JWK.",
-        { cause: error_ instanceof Error ? error_ : void 0 }
-      );
-    }
-  }
-  if (isJWK(value) && isAsymmetricJWK(value) && value.kty === "EC") {
-    return toPublicEpkJwk(value);
-  }
-  const normalized = await normalizeKey(value, alg);
-  if (!(normalized instanceof CryptoKey)) {
-    throw new TypeError(
-      "ECDH-ES ephemeral public key must be a CryptoKey or convertible JWK."
-    );
-  }
-  return exportPublicJwkFrom(alg, normalized);
-}
-async function encryptKey(alg, enc, key, providedCek, providedParameters = {}) {
-  let encryptedKey;
-  let parameters = {};
-  let cek;
-  switch (alg) {
-    case "dir": {
-      cek = key;
-      break;
-    }
-    case "ECDH-ES":
-    case "ECDH-ES+A128KW":
-    case "ECDH-ES+A192KW":
-    case "ECDH-ES+A256KW": {
-      assertCryptoKey(key);
-      if (!allowed(key)) {
-        throw new Error(
-          "ECDH with the provided key is not allowed or not supported by your javascript runtime"
-        );
-      }
-      const { apu, apv, epk: providedEpk, epkPrivateKey } = providedParameters;
-      if (providedEpk && !epkPrivateKey) {
-        throw new TypeError(
-          "ECDH-ES custom ephemeral key material must include the matching private key."
-        );
-      }
-      let ephemeralPrivateKey;
-      let epkHeader;
-      if (epkPrivateKey) {
-        ephemeralPrivateKey = await ensurePrivateKey(alg, epkPrivateKey);
-        const publicSource = providedEpk ?? epkPrivateKey;
-        epkHeader = await exportPublicJwkFrom(alg, publicSource);
-      } else {
-        if (providedEpk) {
-          throw new TypeError(
-            "ECDH-ES custom ephemeral public key requires a matching private key."
-          );
-        }
-        const generated = await crypto.subtle.generateKey(
-          key.algorithm,
-          true,
-          ["deriveBits"]
-        );
-        ephemeralPrivateKey = generated.privateKey;
-        epkHeader = await exportPublicJwkFrom(alg, generated.publicKey);
-      }
-      const sharedSecret = await deriveECDHESKey(
-        key,
-        ephemeralPrivateKey,
-        alg === "ECDH-ES" ? enc : alg,
-        alg === "ECDH-ES" ? bitLengthCEK(enc) : Number.parseInt(alg.slice(-5, -2), 10),
-        apu,
-        apv
-      );
-      parameters = { epk: epkHeader };
-      if (apu) parameters.apu = base64UrlEncode(apu);
-      if (apv) parameters.apv = base64UrlEncode(apv);
-      if (alg === "ECDH-ES") {
-        cek = sharedSecret;
-        break;
-      }
-      cek = providedCek || generateCEK(enc);
-      const kwAlg = alg.slice(-6);
-      encryptedKey = (await wrap(kwAlg, sharedSecret, cek)).encryptedKey;
-      break;
-    }
-    case "RSA-OAEP":
-    case "RSA-OAEP-256":
-    case "RSA-OAEP-384":
-    case "RSA-OAEP-512": {
-      cek = providedCek || generateCEK(enc);
-      assertCryptoKey(key);
-      encryptedKey = await encryptRSAES(alg, key, cek);
-      break;
-    }
-    case "PBES2-HS256+A128KW":
-    case "PBES2-HS384+A192KW":
-    case "PBES2-HS512+A256KW": {
-      cek = providedCek || generateCEK(enc);
-      const { p2c, p2s } = providedParameters;
-      ({ encryptedKey, ...parameters } = await wrap(alg, key, cek, p2c, p2s));
-      break;
-    }
-    case "A128KW":
-    case "A192KW":
-    case "A256KW": {
-      cek = providedCek || generateCEK(enc);
-      encryptedKey = (await wrap(alg, key, cek)).encryptedKey;
-      break;
-    }
-    case "A128GCMKW":
-    case "A192GCMKW":
-    case "A256GCMKW": {
-      cek = providedCek || generateCEK(enc);
-      const { iv } = providedParameters;
-      ({ encryptedKey, ...parameters } = await encryptIV(alg, key, cek, iv));
-      break;
-    }
-    default: {
-      throw new Error(
-        'Invalid or unsupported "alg" (JWE Algorithm) header value'
-      );
-    }
-  }
-  return { cek, encryptedKey, parameters };
-}
-async function normalizeKey(key, alg) {
-  if (key instanceof Uint8Array) {
-    return key;
-  }
-  if (isCryptoKey(key)) {
-    return key;
-  }
-  if (isJWK(key)) {
-    const safeJwk = sanitizeObject(key);
-    if ("k" in safeJwk && safeJwk.k) {
-      return base64UrlDecode(safeJwk.k, false);
-    }
-    return jwkTokey({ ...safeJwk, alg });
-  }
-  throw new Error("unreachable");
-}
-
-async function generateKey(alg, options = {}) {
-  const exportToJWK = options.toJWK !== void 0 && options.toJWK !== false;
-  const defaultExtractable = options.extractable !== false;
-  if (alg === "A128CBC-HS256" || alg === "A192CBC-HS384" || alg === "A256CBC-HS512") {
-    const keyLength = bitLengthCEK(alg);
-    const keyBytes = randomBytes(keyLength >> 3);
-    if (exportToJWK) {
-      return keyToJWK(keyBytes);
-    }
-    return keyBytes;
-  }
-  const { algorithm, keyUsages } = getGenerateKeyParams(alg, options);
-  const key = await crypto.subtle.generateKey(
-    algorithm,
-    defaultExtractable,
-    keyUsages
-  );
-  if (exportToJWK) {
-    const {
-      alg: _a,
-      kty: _k,
-      key_ops: _ko,
-      ext: _e,
-      ...additionalKeyParams
-    } = typeof options.toJWK === "object" ? options.toJWK : {};
-    if (key instanceof CryptoKey) {
-      return exportKey(key, {
-        ...additionalKeyParams,
-        alg
-      });
-    } else {
-      const [publicKey, privateKey] = await Promise.all([
-        exportKey(key.publicKey, { ...additionalKeyParams, alg }),
-        exportKey(key.privateKey, {
-          ...additionalKeyParams,
-          alg
-        })
-      ]);
-      return { privateKey, publicKey };
-    }
-  }
-  return key;
-}
-async function generateJWK(alg, jwkParams, options = {}) {
-  const {
-    // @ts-expect-error destructuring just to avoid passing it down
-    toJWK: _,
-    ...opts
-  } = options;
-  return generateKey(alg, {
-    ...opts,
-    toJWK: {
-      kid: typeof jwkParams?.kid === "string" ? jwkParams.kid : crypto.randomUUID(),
-      ...jwkParams
-    }
-  });
-}
-async function deriveKeyFromPassword(password, alg, options) {
-  const { salt, iterations, extractable, keyUsage } = options;
-  const exportToJWK = options.toJWK !== void 0 && options.toJWK !== false;
-  if (!(salt instanceof Uint8Array) || salt.length < 8) {
-    throw new Error("PBES2 Salt Input (salt) must be 8 or more octets");
-  }
-  if (typeof iterations !== "number" || iterations < 1) {
-    throw new Error(
-      "PBES2 Iteration Count (iterations) must be a positive integer"
-    );
-  }
-  const passwordBytes = typeof password === "string" ? textEncoder.encode(password) : password;
-  const derivedBytes = await deriveKey(
-    salt,
-    alg,
-    iterations,
-    passwordBytes
-  );
-  const wrappingAlg = alg.slice(-6);
-  const defaultUsages = ["wrapKey", "unwrapKey"];
-  const finalUsages = keyUsage ?? defaultUsages;
-  const finalExtractable = exportToJWK ? true : extractable === true;
-  const derivedKey = await crypto.subtle.importKey(
-    "raw",
-    derivedBytes,
-    { name: "AES-KW" },
-    finalExtractable,
-    finalUsages
-  );
-  if (exportToJWK) {
-    const jwk = await keyToJWK(derivedKey);
-    const {
-      alg: _a,
-      kty: _k,
-      key_ops: _ko,
-      ext: _e,
-      ...additionalKeyParams
-    } = typeof options.toJWK === "object" ? options.toJWK : {};
-    return { ...additionalKeyParams, ...jwk, alg: wrappingAlg, kty: "oct" };
-  }
-  return derivedKey;
-}
-async function deriveJWKFromPassword(password, alg, options, jwkParams) {
-  const {
-    // @ts-expect-error destructuring just to avoid passing it down
-    toJWK: _,
-    ...opts
-  } = options;
-  return deriveKeyFromPassword(password, alg, {
-    ...opts,
-    toJWK: jwkParams || true
-  });
-}
-async function importKey(key, alg) {
-  if (typeof key === "string") {
-    key = textEncoder.encode(key);
-  }
-  if (key instanceof Uint8Array) {
-    return key;
-  }
-  if (isCryptoKey(key)) {
-    return key;
-  }
-  if (isJWK(key)) {
-    if ("k" in key && typeof key.k === "string") {
-      return base64UrlDecode(key.k, false);
-    } else {
-      if (!key.alg && !alg) {
-        throw new TypeError(
-          "Algorithm must be provided when importing non-oct JWK"
-        );
-      }
-      return jwkTokey({
-        ...key,
-        alg: key.alg || alg
-      });
-    }
-  }
-  throw new Error("Invalid key type provided to importKey");
-}
-async function exportKey(key, jwk) {
-  const exportedJwk = await keyToJWK(key);
-  if (jwk) {
-    return { ...sanitizeObject(jwk), ...exportedJwk };
-  }
-  return exportedJwk;
-}
-async function wrapKey(alg, keyToWrap, wrappingKey, options = {}) {
-  const cekBytes = keyToWrap instanceof Uint8Array ? keyToWrap : new Uint8Array(await crypto.subtle.exportKey("raw", keyToWrap));
-  let importedWrappingKey;
-  const isPbes = alg.startsWith("PBES2");
-  const isAesKw = ["A128KW", "A192KW", "A256KW"].includes(alg);
-  if (isPbes && (typeof wrappingKey === "string" || wrappingKey instanceof Uint8Array)) {
-    importedWrappingKey = typeof wrappingKey === "string" ? textEncoder.encode(wrappingKey) : wrappingKey;
-  } else if (isPbes || isAesKw) {
-    if (typeof wrappingKey === "string") {
-      throw new TypeError(
-        "Wrapping key must be a CryptoKey, JWK, or Uint8Array for AES-KW or non-password PBES2"
-      );
-    }
-    importedWrappingKey = await importKey(wrappingKey, alg);
-  } else {
-    if (typeof wrappingKey === "string") {
-      throw new TypeError(
-        "Wrapping key must be a CryptoKey, JWK, or Uint8Array for non-PBES2 algorithms"
-      );
-    }
-    importedWrappingKey = await importKey(wrappingKey, alg);
-  }
-  switch (alg) {
-    // AES Key Wrap and PBES2 are handled by the same helper
-    case "A128KW":
-    case "A192KW":
-    case "A256KW":
-    case "PBES2-HS256+A128KW":
-    case "PBES2-HS384+A192KW":
-    case "PBES2-HS512+A256KW": {
-      const { p2s, p2c } = options;
-      if (isPbes && (!p2s || typeof p2c !== "number")) {
-        throw new Error(
-          "PBES2 requires 'p2s' (salt) and 'p2c' (count) options"
-        );
-      }
-      return wrap(alg, importedWrappingKey, cekBytes, p2c, p2s);
-    }
-    case "A128GCMKW":
-    case "A192GCMKW":
-    case "A256GCMKW": {
-      const { encryptedKey, iv, tag } = await encryptIV(
-        alg,
-        importedWrappingKey,
-        cekBytes,
-        options.iv
-      );
-      return { encryptedKey, iv, tag };
-    }
-    case "RSA-OAEP":
-    case "RSA-OAEP-256":
-    case "RSA-OAEP-384":
-    case "RSA-OAEP-512": {
-      const keyToWrapImported = await crypto.subtle.importKey(
-        "raw",
-        cekBytes,
-        { name: "AES-GCM", length: cekBytes.length * 8 },
-        true,
-        ["encrypt", "decrypt"]
-      );
-      const encryptedKey = new Uint8Array(
-        await crypto.subtle.wrapKey(
-          "raw",
-          keyToWrapImported,
-          importedWrappingKey,
-          { name: "RSA-OAEP" }
-        )
-      );
-      return { encryptedKey };
-    }
-    case "ECDH-ES":
-    case "ECDH-ES+A128KW":
-    case "ECDH-ES+A192KW":
-    case "ECDH-ES+A256KW": {
-      throw new Error(`Algorithm ${alg} not yet implemented in wrapKey`);
-    }
-    default: {
-      throw new Error(`Unsupported key wrapping algorithm: ${alg}`);
-    }
-  }
-}
-async function unwrapKey(alg, wrappedKey, unwrappingKey, options = {}) {
-  const { returnAs = true } = options;
-  const defaultExtractable = options.extractable !== false;
-  let importedUnwrappingKey;
-  const isPbes = alg.startsWith("PBES2");
-  const isAesKw = ["A128KW", "A192KW", "A256KW"].includes(alg);
-  if (isPbes && (typeof unwrappingKey === "string" || unwrappingKey instanceof Uint8Array)) {
-    importedUnwrappingKey = typeof unwrappingKey === "string" ? textEncoder.encode(unwrappingKey) : unwrappingKey;
-  } else if (isPbes || isAesKw) {
-    if (typeof unwrappingKey === "string") {
-      throw new TypeError(
-        "Unwrapping key must be a CryptoKey, JWK, or Uint8Array for AES-KW or non-password PBES2"
-      );
-    }
-    importedUnwrappingKey = await importKey(unwrappingKey, alg);
-  } else {
-    if (typeof unwrappingKey === "string") {
-      throw new TypeError(
-        "Unwrapping key must be a CryptoKey, JWK, or Uint8Array for non-PBES2 algorithms"
-      );
-    }
-    importedUnwrappingKey = await importKey(unwrappingKey, alg);
-  }
-  let unwrappedCekBytes;
-  switch (alg) {
-    // AES Key Wrap and PBES2 are handled by the same helper
-    case "A128KW":
-    case "A192KW":
-    case "A256KW":
-    case "PBES2-HS256+A128KW":
-    case "PBES2-HS384+A192KW":
-    case "PBES2-HS512+A256KW": {
-      const { p2s, p2c } = options;
-      let p2sBytes;
-      if (isPbes) {
-        if (!p2s || typeof p2c !== "number") {
-          throw new Error(
-            "PBES2 requires 'p2s' (salt) and 'p2c' (count) options"
-          );
-        }
-        p2sBytes = typeof p2s === "string" ? base64UrlDecode(p2s, false) : p2s;
-      }
-      unwrappedCekBytes = await unwrap(
-        alg,
-        importedUnwrappingKey,
-        wrappedKey,
-        p2c,
-        p2sBytes
-      );
-      break;
-    }
-    case "A128GCMKW":
-    case "A192GCMKW":
-    case "A256GCMKW": {
-      if (!options.iv || !options.tag) {
-        throw new Error(
-          "AES-GCMKW requires 'iv' and 'tag' options for unwrapping"
-        );
-      }
-      const ivBytes = typeof options.iv === "string" ? base64UrlDecode(options.iv, false) : options.iv;
-      const tagBytes = typeof options.tag === "string" ? base64UrlDecode(options.tag, false) : options.tag;
-      unwrappedCekBytes = await decryptIV(
-        alg,
-        importedUnwrappingKey,
-        wrappedKey,
-        ivBytes,
-        tagBytes
-      );
-      break;
-    }
-    case "RSA-OAEP":
-    case "RSA-OAEP-256":
-    case "RSA-OAEP-384":
-    case "RSA-OAEP-512": {
-      if (!(importedUnwrappingKey instanceof CryptoKey)) {
-        throw new TypeError(
-          "RSA-OAEP requires the unwrapping key to be provided as a CryptoKey"
-        );
-      }
-      unwrappedCekBytes = await decryptRSAES(
-        alg,
-        importedUnwrappingKey,
-        wrappedKey
-      );
-      if (!returnAs) {
-        break;
-      }
-      const inferredAlgorithm = options.unwrappedKeyAlgorithm || inferAesImportAlgorithm(options.enc, unwrappedCekBytes.length);
-      if (!inferredAlgorithm) {
-        throw new Error(
-          'Unable to infer algorithm for RSA-OAEP unwrapped key. Provide "unwrappedKeyAlgorithm" in options.'
-        );
-      }
-      const keyUsages = options.keyUsage || ["encrypt", "decrypt"];
-      return await crypto.subtle.importKey(
-        "raw",
-        unwrappedCekBytes,
-        inferredAlgorithm,
-        defaultExtractable,
-        keyUsages
-      );
-    }
-    case "ECDH-ES":
-    case "ECDH-ES+A128KW":
-    case "ECDH-ES+A192KW":
-    case "ECDH-ES+A256KW": {
-      if (!options.epk) {
-        throw new Error("ECDH-ES requires 'epk' (Ephemeral Public Key) option");
-      }
-      if (!(importedUnwrappingKey instanceof CryptoKey)) {
-        throw new TypeError(
-          "ECDH-ES requires the unwrapping key to be a CryptoKey"
-        );
-      }
-      if (!allowed(importedUnwrappingKey)) {
-        throw new Error(
-          "ECDH with the provided key is not allowed or not supported"
-        );
-      }
-      const epkCandidate = options.epk instanceof CryptoKey ? options.epk : await normalizeKey(options.epk, alg);
-      if (!(epkCandidate instanceof CryptoKey)) {
-        throw new TypeError("Failed to normalize ECDH ephemeral public key");
-      }
-      const apuBytes = typeof options.apu === "string" ? base64UrlDecode(options.apu, false) : options.apu ?? new Uint8Array(0);
-      const apvBytes = typeof options.apv === "string" ? base64UrlDecode(options.apv, false) : options.apv ?? new Uint8Array(0);
-      const infoAlg = alg === "ECDH-ES" ? options.enc : alg;
-      if (!infoAlg) {
-        throw new Error(
-          "ECDH-ES requires content encryption algorithm ('enc') to derive the shared secret"
-        );
-      }
-      const keyLength = alg === "ECDH-ES" ? bitLengthCEK(infoAlg) : Number.parseInt(alg.slice(-5, -2), 10);
-      const sharedSecret = await deriveECDHESKey(
-        epkCandidate,
-        importedUnwrappingKey,
-        infoAlg,
-        keyLength,
-        apuBytes,
-        apvBytes
-      );
-      if (alg === "ECDH-ES") {
-        unwrappedCekBytes = sharedSecret;
-      } else {
-        const kwAlg = alg.slice(-6);
-        if (!(wrappedKey instanceof Uint8Array) || wrappedKey.length === 0) {
-          throw new Error(
-            "ECDH-ES key agreement with key wrapping requires an encrypted key"
-          );
-        }
-        unwrappedCekBytes = await unwrap(kwAlg, sharedSecret, wrappedKey);
-      }
-      break;
-    }
-    default: {
-      throw new Error(`Unsupported key unwrapping algorithm: ${alg}`);
-    }
-  }
-  if (!returnAs) {
-    return unwrappedCekBytes;
-  }
-  const finalKey = await crypto.subtle.importKey(
-    "raw",
-    unwrappedCekBytes,
-    options.unwrappedKeyAlgorithm || { name: "AES-GCM" },
-    defaultExtractable,
-    options.keyUsage || ["encrypt", "decrypt"]
-  );
-  return finalKey;
-}
-async function importJWKFromPEM(pem, pemType, alg, importOptions, jwkExtras) {
-  let cryptoKey;
-  const defaultExtractable = importOptions?.extractable !== false;
-  switch (pemType) {
-    case "pkcs8": {
-      cryptoKey = await fromPKCS8(pem, alg, {
-        ...importOptions,
-        extractable: defaultExtractable
-      });
-      break;
-    }
-    case "spki": {
-      cryptoKey = await fromSPKI(pem, alg, {
-        ...importOptions,
-        extractable: defaultExtractable
-      });
-      break;
-    }
-    case "x509": {
-      cryptoKey = await fromX509(pem, alg, {
-        ...importOptions,
-        extractable: defaultExtractable
-      });
-      break;
-    }
-    default: {
-      throw new TypeError(`Unsupported PEM type: ${pemType}`);
-    }
-  }
-  const finalJWKExtras = { alg, ...jwkExtras };
-  return exportKey(cryptoKey, finalJWKExtras);
-}
-async function exportJWKToPEM(jwk, pemFormat, algForCryptoKeyImport) {
-  if (jwk.kty === "oct") {
-    throw new TypeError(
-      "Octet (symmetric) JWKs (kty: 'oct') cannot be exported to PKCS8 or SPKI PEM formats."
-    );
-  }
-  const effectiveAlg = jwk.alg || algForCryptoKeyImport;
-  if (!effectiveAlg && (jwk.kty === "RSA" || jwk.kty === "EC" || jwk.kty === "OKP")) {
-    throw new TypeError(
-      "Algorithm (alg) must be provided in the JWK or as a parameter for converting this JWK type to a CryptoKey."
-    );
-  }
-  const jwkForImport = { ...jwk, ext: true };
-  const cryptoKeyCandidate = await importKey(jwkForImport, effectiveAlg);
-  if (!isCryptoKey(cryptoKeyCandidate)) {
-    throw new Error(
-      "Failed to convert JWK to a CryptoKey instance suitable for PEM export."
-    );
-  }
-  const cryptoKey = cryptoKeyCandidate;
-  switch (pemFormat) {
-    case "pkcs8": {
-      if (cryptoKey.type !== "private") {
-        throw new TypeError(
-          `Only 'private' type CryptoKeys can be exported to PKCS8 PEM format. Key type is '${cryptoKey.type}'.`
-        );
-      }
-      return toPKCS8(cryptoKey);
-    }
-    case "spki": {
-      if (cryptoKey.type !== "public") {
-        throw new TypeError(
-          `Only 'public' type CryptoKeys can be exported to SPKI PEM format. Key type is '${cryptoKey.type}'.`
-        );
-      }
-      return toSPKI(cryptoKey);
-    }
-    default: {
-      throw new TypeError(`Unsupported PEM format: ${pemFormat}`);
-    }
-  }
-}
-function getJWKFromSet(jwkSet, kidOrProtectedHeader) {
-  if (!jwkSet || !isJWKSet(jwkSet)) {
-    throw new TypeError("Invalid JWK Set provided");
-  }
-  if (typeof kidOrProtectedHeader === "string") {
-    const kid = kidOrProtectedHeader;
-    const selectedKey = jwkSet.keys.find((k) => k.kid === kid);
-    if (!selectedKey) {
-      throw new Error(`No key found in JWK Set with kid "${kid}".`);
-    }
-    return selectedKey;
-  } else if (typeof kidOrProtectedHeader === "object") {
-    const { kid, alg, kty } = kidOrProtectedHeader;
-    if (!kid) {
-      throw new Error(
-        "JWS Protected Header is missing 'kid' (Key ID) and a JWK Set was provided. Cannot select key from JWK Set automatically."
-      );
-    }
-    const selectedKey = jwkSet.keys.find((k) => {
-      return k.kid === kid && (!alg || k.alg === alg) && (!kty || k.kty === kty);
-    });
-    if (!selectedKey) {
-      let errorMessage = `No key found in JWK Set with kid "${kid}"`;
-      if (alg) {
-        errorMessage += ` and alg "${alg}"`;
-      }
-      if (kty) {
-        errorMessage += ` and kty "${kty}"`;
-      }
-      errorMessage += ".";
-      throw new Error(errorMessage);
-    }
-    return selectedKey;
-  }
-  throw new TypeError(
-    "`kidOrProtectedHeader` must be a string (kid) or an object (JOSE Protected Header)."
-  );
-}
-function getGenerateKeyParams(alg, options) {
-  let algorithm;
-  let keyUsages;
-  const defaultKeyUsage = options?.keyUsage;
-  switch (alg) {
-    // HMAC Signatures
-    case "HS256":
-    case "HS384":
-    case "HS512": {
-      algorithm = {
-        name: "HMAC",
-        hash: `SHA-${alg.slice(2)}`
-      };
-      keyUsages = defaultKeyUsage ?? ["sign", "verify"];
-      break;
-    }
-    // RSA Signatures
-    case "RS256":
-    case "RS384":
-    case "RS512": {
-      algorithm = {
-        name: "RSASSA-PKCS1-v1_5",
-        modulusLength: options?.modulusLength ?? 2048,
-        publicExponent: options?.publicExponent ?? new Uint8Array([1, 0, 1]),
-        hash: `SHA-${alg.slice(2)}`
-      };
-      keyUsages = defaultKeyUsage ?? ["sign", "verify"];
-      break;
-    }
-    // RSA PSS Signatures
-    case "PS256":
-    case "PS384":
-    case "PS512": {
-      algorithm = {
-        name: "RSA-PSS",
-        modulusLength: options?.modulusLength ?? 2048,
-        publicExponent: options?.publicExponent ?? new Uint8Array([1, 0, 1]),
-        hash: `SHA-${alg.slice(2)}`
-      };
-      keyUsages = defaultKeyUsage ?? ["sign", "verify"];
-      break;
-    }
-    // RSA Encryption
-    case "RSA-OAEP":
-    case "RSA-OAEP-256":
-    case "RSA-OAEP-384":
-    case "RSA-OAEP-512": {
-      algorithm = {
-        name: "RSA-OAEP",
-        modulusLength: options?.modulusLength ?? 2048,
-        publicExponent: options?.publicExponent ?? new Uint8Array([1, 0, 1]),
-        hash: `SHA-${Number.parseInt(alg.slice(9), 10) || 1}`
-      };
-      keyUsages = defaultKeyUsage ?? [
-        "encrypt",
-        "decrypt",
-        "wrapKey",
-        "unwrapKey"
-      ];
-      break;
-    }
-    // AES Key Wrap
-    case "A128KW":
-    case "A192KW":
-    case "A256KW": {
-      const length = Number.parseInt(alg.slice(1, 4), 10);
-      algorithm = { name: "AES-KW", length };
-      keyUsages = defaultKeyUsage ?? ["wrapKey", "unwrapKey"];
-      break;
-    }
-    // AES GCM Encryption
-    case "A128GCM":
-    case "A192GCM":
-    case "A256GCM":
-    case "A128GCMKW":
-    case "A192GCMKW":
-    case "A256GCMKW": {
-      const baseAlg = alg.replace("KW", "");
-      const length = Number.parseInt(baseAlg.slice(1, 4), 10);
-      algorithm = { name: "AES-GCM", length };
-      keyUsages = defaultKeyUsage ?? (alg.endsWith("KW") ? ["wrapKey", "unwrapKey"] : ["encrypt", "decrypt"]);
-      break;
-    }
-    // ECDSA Signatures
-    case "ES256":
-    case "ES384":
-    case "ES512": {
-      algorithm = { name: "ECDSA", namedCurve: `P-${alg.slice(2)}` };
-      keyUsages = defaultKeyUsage ?? ["sign", "verify"];
-      break;
-    }
-    case "Ed25519": {
-      keyUsages = defaultKeyUsage ?? ["sign", "verify"];
-      algorithm = { name: "Ed25519" };
-      break;
-    }
-    case "EdDSA": {
-      keyUsages = defaultKeyUsage ?? ["sign", "verify"];
-      const namedCurve = options?.namedCurve ?? "Ed25519";
-      switch (namedCurve) {
-        case "Ed25519":
-        case "Ed448": {
-          algorithm = { name: namedCurve };
-          break;
-        }
-        default: {
-          throw new Error(
-            "Unsupported namedCurve provided. Supported values are: Ed25519 and Ed448"
-          );
-        }
-      }
-      break;
-    }
-    // ECDSA Signatures
-    case "ECDH-ES":
-    case "ECDH-ES+A128KW":
-    case "ECDH-ES+A192KW":
-    case "ECDH-ES+A256KW": {
-      keyUsages = ["deriveBits"];
-      const namedCurve = options?.namedCurve ?? "P-256";
-      switch (namedCurve) {
-        case "P-256":
-        case "P-384":
-        case "P-521": {
-          algorithm = { name: "ECDH", namedCurve };
-          break;
-        }
-        case "X25519": {
-          algorithm = { name: "X25519" };
-          break;
-        }
-        default: {
-          throw new Error(
-            "Unsupported namedCurve provided. Supported values are: P-256, P-384, P-521 and X25519"
-          );
-        }
-      }
-      break;
-    }
-    default: {
-      throw new Error(
-        `Unsupported or invalid algorithm for key generation: ${alg}`
-      );
-    }
-  }
-  return { algorithm, keyUsages };
-}
-function inferAesImportAlgorithm(enc, cekLengthBytes) {
-  const bitLength = cekLengthBytes << 3;
-  if (enc) {
-    if (enc.includes("GCM")) {
-      return {
-        name: "AES-GCM",
-        length: Number.parseInt(enc.slice(1, 4), 10)
-      };
-    }
-    if (enc.includes("CBC-HS")) {
-      return void 0;
-    }
-  }
-  if (bitLength === 128 || bitLength === 192 || bitLength === 256) {
-    return { name: "AES-GCM", length: bitLength };
-  }
-  return void 0;
-}
-
-const jwk = {
-  __proto__: null,
-  deriveJWKFromPassword: deriveJWKFromPassword,
-  deriveKeyFromPassword: deriveKeyFromPassword,
-  exportJWKToPEM: exportJWKToPEM,
-  exportKey: exportKey,
-  generateJWK: generateJWK,
-  generateKey: generateKey,
-  getJWKFromSet: getJWKFromSet,
-  importJWKFromPEM: importJWKFromPEM,
-  importKey: importKey,
-  unwrapKey: unwrapKey,
-  wrapKey: wrapKey
-};
-
-export { encrypt as a, getJWKFromSet as b, generateJWK as c, decrypt as d, encryptKey as e, importJWKFromPEM as f, generateIV as g, exportJWKToPEM as h, importKey as i, jwk as j, deriveJWKFromPassword as k, generateKey as l, deriveKeyFromPassword as m, exportKey as n, sign as s, unwrapKey as u, verify as v, wrapKey as w };