unjwt 0.5.39 → 0.6.0

package/dist/_chunks/_crypto.mjs

@@ -0,0 +1,1014 @@
+import { a as base64UrlEncode, c as isCryptoKey, i as base64UrlDecode, n as base64Decode, o as concatUint8Arrays, r as base64Encode, s as isAsymmetricJWK, t as assertCryptoKey, u as isJWK, v as textEncoder, y as sanitizeObject } from "./utils.mjs";
+//#region src/core/_crypto/_sign-verify.ts
+async function sign(alg, key, data) {
+	checkSigCryptoKey(key, alg, "sign");
+	const signature = await crypto.subtle.sign(subtleAlgorithm(alg, key.algorithm), key, data);
+	return new Uint8Array(signature);
+}
+async function verify(alg, key, signature, data) {
+	checkSigCryptoKey(key, alg, "verify");
+	try {
+		return await crypto.subtle.verify(subtleAlgorithm(alg, key.algorithm), key, signature, data);
+	} catch {
+		return false;
+	}
+}
+function checkSigCryptoKey(key, alg, usage) {
+	switch (alg) {
+		case "HS256":
+		case "HS384":
+		case "HS512": {
+			if (!isAlgorithm$3(key.algorithm, "HMAC")) throw unusable$4("HMAC");
+			const expected = Number.parseInt(alg.slice(2), 10);
+			if (getHashLength$1(key.algorithm.hash) !== expected) throw unusable$4(`SHA-${expected}`, "algorithm.hash");
+			break;
+		}
+		case "RS256":
+		case "RS384":
+		case "RS512": {
+			if (!isAlgorithm$3(key.algorithm, "RSASSA-PKCS1-v1_5")) throw unusable$4("RSASSA-PKCS1-v1_5");
+			const expected = Number.parseInt(alg.slice(2), 10);
+			if (getHashLength$1(key.algorithm.hash) !== expected) throw unusable$4(`SHA-${expected}`, "algorithm.hash");
+			break;
+		}
+		case "PS256":
+		case "PS384":
+		case "PS512": {
+			if (!isAlgorithm$3(key.algorithm, "RSA-PSS")) throw unusable$4("RSA-PSS");
+			const expected = Number.parseInt(alg.slice(2), 10);
+			if (getHashLength$1(key.algorithm.hash) !== expected) throw unusable$4(`SHA-${expected}`, "algorithm.hash");
+			break;
+		}
+		case "Ed25519":
+		case "EdDSA":
+			if (!isAlgorithm$3(key.algorithm, "Ed25519")) throw unusable$4("Ed25519");
+			break;
+		case "ES256":
+		case "ES384":
+		case "ES512": {
+			if (!isAlgorithm$3(key.algorithm, "ECDSA")) throw unusable$4("ECDSA");
+			const expected = getNamedCurve$1(alg);
+			if (key.algorithm.namedCurve !== expected) throw unusable$4(expected, "algorithm.namedCurve");
+			break;
+		}
+		default: throw new TypeError("CryptoKey does not support this operation");
+	}
+	checkUsage$4(key, usage);
+}
+function subtleAlgorithm(alg, algorithm) {
+	const hash = `SHA-${alg.slice(-3)}`;
+	switch (alg) {
+		case "HS256":
+		case "HS384":
+		case "HS512": return {
+			hash,
+			name: "HMAC"
+		};
+		case "PS256":
+		case "PS384":
+		case "PS512": return {
+			hash,
+			name: "RSA-PSS",
+			saltLength: Number.parseInt(alg.slice(-3), 10) >> 3
+		};
+		case "RS256":
+		case "RS384":
+		case "RS512": return {
+			hash,
+			name: "RSASSA-PKCS1-v1_5"
+		};
+		case "ES256":
+		case "ES384":
+		case "ES512": return {
+			hash,
+			name: "ECDSA",
+			namedCurve: algorithm.namedCurve
+		};
+		case "Ed25519":
+		case "EdDSA": return { name: "Ed25519" };
+		default: throw new Error(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
+	}
+}
+function unusable$4(name, prop = "algorithm.name") {
+	return /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+}
+function isAlgorithm$3(algorithm, name) {
+	return algorithm.name === name;
+}
+function getHashLength$1(hash) {
+	return Number.parseInt(hash.name.slice(4), 10);
+}
+function getNamedCurve$1(alg) {
+	switch (alg) {
+		case "ES256": return "P-256";
+		case "ES384": return "P-384";
+		case "ES512": return "P-521";
+		default: throw new Error("unreachable");
+	}
+}
+function checkUsage$4(key, usage) {
+	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+}
+//#endregion
+//#region src/core/_crypto/_aes.ts
+const IV_BIT_LENGTHS = {
+	A128GCM: 96,
+	A128GCMKW: 96,
+	A192GCM: 96,
+	A192GCMKW: 96,
+	A256GCM: 96,
+	A256GCMKW: 96,
+	"A128CBC-HS256": 128,
+	"A192CBC-HS384": 128,
+	"A256CBC-HS512": 128
+};
+const CEK_BIT_LENGTHS = {
+	A128GCM: 128,
+	A192GCM: 192,
+	A256GCM: 256,
+	"A128CBC-HS256": 256,
+	"A192CBC-HS384": 384,
+	"A256CBC-HS512": 512
+};
+function bitLengthIV(alg) {
+	const length = IV_BIT_LENGTHS[alg];
+	if (length === void 0) throw new Error(`Unsupported JWE Algorithm: ${alg}`);
+	return length;
+}
+function generateIV(alg) {
+	return crypto.getRandomValues(new Uint8Array(bitLengthIV(alg) >> 3));
+}
+function checkIvLength(enc, iv) {
+	if (iv.length << 3 !== bitLengthIV(enc)) throw new Error("Invalid Initialization Vector length");
+}
+function bitLengthCEK(alg) {
+	const length = CEK_BIT_LENGTHS[alg];
+	if (length === void 0) throw new Error(`Unsupported JWE Algorithm: ${alg}`);
+	return length;
+}
+function generateCEK(alg) {
+	return crypto.getRandomValues(new Uint8Array(bitLengthCEK(alg) >> 3));
+}
+function checkCEKLength(cek, expected) {
+	const actual = cek.byteLength << 3;
+	if (actual !== expected) throw new Error(`Invalid Content Encryption Key length. Expected ${expected} bits, got ${actual} bits`);
+}
+function checkAESCryptoKey(key, alg, usage) {
+	switch (alg) {
+		case "A128GCM":
+		case "A192GCM":
+		case "A256GCM": {
+			if (!isAlgorithm$2(key.algorithm, "AES-GCM")) throw unusable$3("AES-GCM");
+			const expected = Number.parseInt(alg.slice(1, 4), 10);
+			if (key.algorithm.length !== expected) throw unusable$3(expected, "algorithm.length");
+			break;
+		}
+		case "A128KW":
+		case "A192KW":
+		case "A256KW": {
+			if (!isAlgorithm$2(key.algorithm, "AES-KW")) throw unusable$3("AES-KW");
+			const expected = Number.parseInt(alg.slice(1, 4), 10);
+			if (key.algorithm.length !== expected) throw unusable$3(expected, "algorithm.length");
+			break;
+		}
+		default: throw new TypeError("CryptoKey does not support this operation");
+	}
+	checkUsage$3(key, usage);
+}
+async function aesKwWrap(alg, key, cek) {
+	const cryptoKey = await getAESKWCryptoKey(key, alg, { usage: "wrapKey" });
+	checkAESKWKeySize(cryptoKey, alg);
+	const cryptoKeyCek = await crypto.subtle.importKey("raw", cek, {
+		hash: "SHA-256",
+		name: "HMAC"
+	}, true, ["sign"]);
+	return new Uint8Array(await crypto.subtle.wrapKey("raw", cryptoKeyCek, cryptoKey, "AES-KW"));
+}
+async function aesKwUnwrap(alg, key, encryptedKey) {
+	const cryptoKey = await getAESKWCryptoKey(key, alg, { usage: "unwrapKey" });
+	checkAESKWKeySize(cryptoKey, alg);
+	const cryptoKeyCek = await crypto.subtle.unwrapKey("raw", encryptedKey, cryptoKey, "AES-KW", {
+		hash: "SHA-256",
+		name: "HMAC"
+	}, true, ["sign"]);
+	return new Uint8Array(await crypto.subtle.exportKey("raw", cryptoKeyCek));
+}
+async function gcmkwEncrypt(alg, key, plaintext, iv) {
+	const wrapped = await encrypt(alg.slice(0, 7), plaintext, key, iv, new Uint8Array(0));
+	return {
+		encryptedKey: wrapped.ciphertext,
+		iv: base64UrlEncode(wrapped.iv),
+		tag: base64UrlEncode(wrapped.tag)
+	};
+}
+async function gcmkwDecrypt(alg, key, ciphertext, iv, tag) {
+	return decrypt(alg.slice(0, 7), key, ciphertext, iv, tag, new Uint8Array(0));
+}
+async function encrypt(enc, plaintext, cek, iv, aad) {
+	if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) throw new TypeError("Key must be one of type: CryptoKey or Uint8Array");
+	if (iv) checkIvLength(enc, iv);
+	else iv = generateIV(enc);
+	switch (enc) {
+		case "A128CBC-HS256":
+		case "A192CBC-HS384":
+		case "A256CBC-HS512":
+			if (cek instanceof Uint8Array) checkCEKLength(cek, Number.parseInt(enc.slice(-3), 10));
+			return cbcEncrypt(enc, plaintext, cek, iv, aad);
+		case "A128GCM":
+		case "A192GCM":
+		case "A256GCM":
+			if (cek instanceof Uint8Array) checkCEKLength(cek, Number.parseInt(enc.slice(1, 4), 10));
+			return gcmEncrypt(enc, plaintext, cek, iv, aad);
+		default: throw new Error("Unsupported JWE Content Encryption Algorithm");
+	}
+}
+async function decrypt(enc, cek, ciphertext, iv, tag, aad) {
+	if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) throw new TypeError("Key must be one of type: CryptoKey or Uint8Array");
+	if (!iv) throw new Error("JWE Initialization Vector missing");
+	if (!tag) throw new Error("JWE Authentication Tag missing");
+	checkIvLength(enc, iv);
+	switch (enc) {
+		case "A128CBC-HS256":
+		case "A192CBC-HS384":
+		case "A256CBC-HS512":
+			if (cek instanceof Uint8Array) checkCEKLength(cek, Number.parseInt(enc.slice(-3), 10));
+			return cbcDecrypt(enc, cek, ciphertext, iv, tag, aad);
+		case "A128GCM":
+		case "A192GCM":
+		case "A256GCM":
+			if (cek instanceof Uint8Array) checkCEKLength(cek, Number.parseInt(enc.slice(1, 4), 10));
+			return gcmDecrypt(enc, cek, ciphertext, iv, tag, aad);
+		default: throw new Error("Unsupported JWE Content Encryption Algorithm");
+	}
+}
+function unusable$3(name, prop = "algorithm.name") {
+	return /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+}
+function isAlgorithm$2(algorithm, name) {
+	return algorithm.name === name;
+}
+function checkUsage$3(key, usage) {
+	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+}
+async function getAESKWCryptoKey(key, alg, options = {}) {
+	const { extractable = true, usage } = options;
+	if (key instanceof Uint8Array) return crypto.subtle.importKey("raw", key, "AES-KW", extractable, [usage ?? "wrapKey"]);
+	checkAESCryptoKey(key, alg, usage);
+	return key;
+}
+function checkAESKWKeySize(key, alg) {
+	if (key.algorithm.length !== Number.parseInt(alg.slice(1, 4), 10)) throw new TypeError(`Invalid key size for alg: ${alg}`);
+}
+async function importCBCKeys(enc, cek, usage) {
+	const keySize = Number.parseInt(enc.slice(1, 4), 10);
+	const [encKey, macKey] = await Promise.all([crypto.subtle.importKey("raw", cek.subarray(keySize >> 3), "AES-CBC", false, [usage]), crypto.subtle.importKey("raw", cek.subarray(0, keySize >> 3), {
+		hash: `SHA-${keySize << 1}`,
+		name: "HMAC"
+	}, false, ["sign"])]);
+	return {
+		encKey,
+		macKey,
+		keySize
+	};
+}
+function cbcMacData(aad, iv, ciphertext) {
+	return concatUint8Arrays(aad, iv, ciphertext, uint64be(aad.length << 3));
+}
+async function cbcEncrypt(enc, plaintext, cek, iv, aad) {
+	if (!(cek instanceof Uint8Array)) throw new TypeError("CBC key must be of type Uint8Array");
+	const { encKey, macKey, keySize } = await importCBCKeys(enc, cek, "encrypt");
+	const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
+		iv,
+		name: "AES-CBC"
+	}, encKey, plaintext));
+	const macData = cbcMacData(aad, iv, ciphertext);
+	return {
+		ciphertext,
+		tag: new Uint8Array((await crypto.subtle.sign("HMAC", macKey, macData)).slice(0, keySize >> 3)),
+		iv
+	};
+}
+async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
+	let encKey;
+	if (cek instanceof Uint8Array) encKey = await crypto.subtle.importKey("raw", cek, "AES-GCM", false, ["encrypt"]);
+	else {
+		checkAESCryptoKey(cek, enc, "encrypt");
+		encKey = cek;
+	}
+	const encrypted = new Uint8Array(await crypto.subtle.encrypt({
+		additionalData: aad,
+		iv,
+		name: "AES-GCM",
+		tagLength: 128
+	}, encKey, plaintext));
+	const tag = encrypted.subarray(-16);
+	return {
+		ciphertext: encrypted.subarray(0, -16),
+		tag,
+		iv
+	};
+}
+async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
+	if (!(cek instanceof Uint8Array)) throw new TypeError("CBC key must be of type Uint8Array");
+	const { encKey, macKey, keySize } = await importCBCKeys(enc, cek, "decrypt");
+	const macData = cbcMacData(aad, iv, ciphertext);
+	const expectedTag = new Uint8Array((await crypto.subtle.sign("HMAC", macKey, macData)).slice(0, keySize >> 3));
+	let macCheckPassed;
+	try {
+		macCheckPassed = await timingSafeEqual(tag, expectedTag);
+	} catch {}
+	if (!macCheckPassed) throw new Error("JWE Decryption Failed");
+	let plaintext;
+	try {
+		plaintext = new Uint8Array(await crypto.subtle.decrypt({
+			iv,
+			name: "AES-CBC"
+		}, encKey, ciphertext));
+	} catch {}
+	if (!plaintext) throw new Error("JWE Decryption Failed");
+	return plaintext;
+}
+async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
+	let encKey;
+	if (cek instanceof Uint8Array) encKey = await crypto.subtle.importKey("raw", cek, "AES-GCM", false, ["decrypt"]);
+	else {
+		checkAESCryptoKey(cek, enc, "decrypt");
+		encKey = cek;
+	}
+	try {
+		return new Uint8Array(await crypto.subtle.decrypt({
+			additionalData: aad,
+			iv,
+			name: "AES-GCM",
+			tagLength: 128
+		}, encKey, concatUint8Arrays(ciphertext, tag)));
+	} catch {
+		throw new Error("JWE Decryption Failed");
+	}
+}
+let _timingSafeKey;
+function getTimingSafeKey() {
+	if (!_timingSafeKey) _timingSafeKey = crypto.subtle.generateKey({
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	return _timingSafeKey;
+}
+async function timingSafeEqual(a, b) {
+	if (!(a instanceof Uint8Array)) throw new TypeError("First argument must be a buffer");
+	if (!(b instanceof Uint8Array)) throw new TypeError("Second argument must be a buffer");
+	const algorithm = {
+		name: "HMAC",
+		hash: "SHA-256"
+	};
+	const key = await getTimingSafeKey();
+	const aHmac = new Uint8Array(await crypto.subtle.sign(algorithm, key, a));
+	const bHmac = new Uint8Array(await crypto.subtle.sign(algorithm, key, b));
+	let out = 0;
+	let i = -1;
+	while (++i < 32) out |= aHmac[i] ^ bHmac[i];
+	return out === 0;
+}
+function writeUInt32BE$1(buf, value, offset) {
+	if (value < 0 || value >= 2 ** 32) throw new RangeError(`value must be >= 0 and <= ${2 ** 32 - 1}. Received ${value}`);
+	buf.set([
+		value >>> 24,
+		value >>> 16,
+		value >>> 8,
+		value & 255
+	], offset);
+}
+function uint64be(value) {
+	const high = Math.floor(value / 2 ** 32);
+	const low = value % 2 ** 32;
+	const buf = new Uint8Array(8);
+	writeUInt32BE$1(buf, high, 0);
+	writeUInt32BE$1(buf, low, 4);
+	return buf;
+}
+//#endregion
+//#region src/core/_crypto/_key-codec.ts
+async function jwkTokey(jwk) {
+	if (!jwk.alg) throw new TypeError("\"alg\" argument is required when \"jwk.alg\" is not present");
+	const { algorithm, keyUsages } = subtleMapping(jwk);
+	return crypto.subtle.importKey("jwk", jwk, algorithm, jwk.ext ?? (jwk.d ? false : true), jwk.key_ops ?? keyUsages);
+}
+async function keyToJWK(key) {
+	if (key instanceof Uint8Array) return {
+		kty: "oct",
+		k: base64UrlEncode(key)
+	};
+	if (!isCryptoKey(key)) throw new TypeError("Key must be one of type: CryptoKey or Uint8Array");
+	if (!key.extractable) throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");
+	return await crypto.subtle.exportKey("jwk", key);
+}
+function subtleMapping(jwk) {
+	let algorithm;
+	let keyUsages;
+	switch (jwk.kty) {
+		case "RSA":
+			switch (jwk.alg) {
+				case "PS256":
+				case "PS384":
+				case "PS512":
+					algorithm = {
+						name: "RSA-PSS",
+						hash: `SHA-${jwk.alg.slice(-3)}`
+					};
+					keyUsages = jwk.d ? ["sign"] : ["verify"];
+					break;
+				case "RS256":
+				case "RS384":
+				case "RS512":
+					algorithm = {
+						name: "RSASSA-PKCS1-v1_5",
+						hash: `SHA-${jwk.alg.slice(-3)}`
+					};
+					keyUsages = jwk.d ? ["sign"] : ["verify"];
+					break;
+				case "RSA-OAEP":
+				case "RSA-OAEP-256":
+				case "RSA-OAEP-384":
+				case "RSA-OAEP-512":
+					algorithm = {
+						name: "RSA-OAEP",
+						hash: `SHA-${Number.parseInt(jwk.alg.slice(-3), 10) || 1}`
+					};
+					keyUsages = jwk.d ? ["decrypt", "unwrapKey"] : ["encrypt", "wrapKey"];
+					break;
+				default: throw new Error("Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value");
+			}
+			break;
+		case "EC":
+			switch (jwk.alg) {
+				case "ES256":
+					algorithm = {
+						name: "ECDSA",
+						namedCurve: "P-256"
+					};
+					keyUsages = jwk.d ? ["sign"] : ["verify"];
+					break;
+				case "ES384":
+					algorithm = {
+						name: "ECDSA",
+						namedCurve: "P-384"
+					};
+					keyUsages = jwk.d ? ["sign"] : ["verify"];
+					break;
+				case "ES512":
+					algorithm = {
+						name: "ECDSA",
+						namedCurve: "P-521"
+					};
+					keyUsages = jwk.d ? ["sign"] : ["verify"];
+					break;
+				case "ECDH-ES":
+				case "ECDH-ES+A128KW":
+				case "ECDH-ES+A192KW":
+				case "ECDH-ES+A256KW":
+					algorithm = {
+						name: "ECDH",
+						namedCurve: jwk.crv
+					};
+					keyUsages = jwk.d ? ["deriveBits"] : [];
+					break;
+				default: throw new Error("Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value");
+			}
+			break;
+		case "OKP":
+			switch (jwk.alg) {
+				case "Ed25519":
+				case "EdDSA":
+					algorithm = { name: "Ed25519" };
+					keyUsages = jwk.d ? ["sign"] : ["verify"];
+					break;
+				case "ECDH-ES":
+				case "ECDH-ES+A128KW":
+				case "ECDH-ES+A192KW":
+				case "ECDH-ES+A256KW":
+					algorithm = { name: jwk.crv };
+					keyUsages = jwk.d ? ["deriveBits"] : [];
+					break;
+				default: throw new Error("Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value");
+			}
+			break;
+		default: throw new Error("Invalid or unsupported JWK \"kty\" (Key Type) Parameter value");
+	}
+	return {
+		algorithm,
+		keyUsages
+	};
+}
+//#endregion
+//#region src/core/_crypto/_rsa.ts
+async function encryptRSAES(alg, key, cek) {
+	checkRSACryptoKey(key, alg, "encrypt");
+	checkRSAModulusLength(alg, key);
+	return new Uint8Array(await crypto.subtle.encrypt("RSA-OAEP", key, cek));
+}
+async function decryptRSAES(alg, key, encryptedKey) {
+	checkRSACryptoKey(key, alg, "decrypt");
+	checkRSAModulusLength(alg, key);
+	return new Uint8Array(await crypto.subtle.decrypt("RSA-OAEP", key, encryptedKey));
+}
+function checkRSACryptoKey(key, alg, usage) {
+	if (!isAlgorithm$1(key.algorithm, "RSA-OAEP")) throw unusable$2("RSA-OAEP");
+	const expected = Number.parseInt(alg.slice(9), 10) || 1;
+	if (getHashLength(key.algorithm.hash) !== expected) throw unusable$2(`SHA-${expected}`, "algorithm.hash");
+	checkUsage$2(key, usage);
+}
+function checkRSAModulusLength(alg, key) {
+	if (alg.startsWith("RS") || alg.startsWith("PS") || alg.startsWith("RSA")) {
+		const { modulusLength } = key.algorithm;
+		if (typeof modulusLength !== "number" || modulusLength < 2048) throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
+	}
+}
+function unusable$2(name, prop = "algorithm.name") {
+	return /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+}
+function isAlgorithm$1(algorithm, name) {
+	return algorithm.name === name;
+}
+function getHashLength(hash) {
+	return Number.parseInt(hash.name.slice(4), 10);
+}
+function checkUsage$2(key, usage) {
+	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+}
+//#endregion
+//#region src/core/_crypto/_ecdh.ts
+async function deriveECDHESKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) {
+	checkECDHCryptoKey(publicKey, "ECDH");
+	checkECDHCryptoKey(privateKey, "ECDH", "deriveBits");
+	const value = concatUint8Arrays(lengthAndInput(textEncoder.encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength));
+	const length = publicKey.algorithm.name === "X25519" ? 256 : Math.ceil(Number.parseInt(publicKey.algorithm.namedCurve.slice(-3), 10) / 8) << 3;
+	return concatKdf(new Uint8Array(await crypto.subtle.deriveBits({
+		name: publicKey.algorithm.name,
+		public: publicKey
+	}, privateKey, length)), keyLength, value);
+}
+function isECDHKeyAllowed(key) {
+	switch (key.algorithm.namedCurve) {
+		case "P-256":
+		case "P-384":
+		case "P-521": return true;
+		default: return key.algorithm.name === "X25519";
+	}
+}
+function checkECDHCryptoKey(key, alg, usage) {
+	switch (key.algorithm.name) {
+		case "ECDH":
+		case "X25519": break;
+		default: throw unusable$1("ECDH or X25519");
+	}
+	checkUsage$1(key, usage);
+}
+function unusable$1(name, prop = "algorithm.name") {
+	return /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+}
+function checkUsage$1(key, usage) {
+	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+}
+async function concatKdf(secret, bits, value) {
+	const iterations = Math.ceil((bits >> 3) / 32);
+	const res = new Uint8Array(iterations * 32);
+	for (let iter = 0; iter < iterations; iter++) {
+		const buf = new Uint8Array(4 + secret.length + value.length);
+		buf.set(uint32be(iter + 1));
+		buf.set(secret, 4);
+		buf.set(value, 4 + secret.length);
+		res.set(await digest("sha256", buf), iter * 32);
+	}
+	return res.slice(0, bits >> 3);
+}
+function lengthAndInput(input) {
+	return concatUint8Arrays(uint32be(input.length), input);
+}
+async function digest(algorithm, data) {
+	return new Uint8Array(await crypto.subtle.digest(`SHA-${algorithm.slice(-3)}`, data));
+}
+function writeUInt32BE(buf, value, offset) {
+	if (value < 0 || value >= 2 ** 32) throw new RangeError(`value must be >= 0 and <= ${2 ** 32 - 1}. Received ${value}`);
+	buf.set([
+		value >>> 24,
+		value >>> 16,
+		value >>> 8,
+		value & 255
+	], offset);
+}
+function uint32be(value) {
+	const buf = new Uint8Array(4);
+	writeUInt32BE(buf, value, 0);
+	return buf;
+}
+//#endregion
+//#region src/core/_crypto/_pbes2.ts
+async function pbes2Wrap(alg, key, cek, p2c, p2s) {
+	const derived = await deriveKey(p2s, alg, p2c, key);
+	return {
+		encryptedKey: await aesKwWrap(alg.slice(-6), derived, cek),
+		p2c,
+		p2s: base64UrlEncode(p2s)
+	};
+}
+async function pbes2Unwrap(alg, key, encryptedKey, p2c, p2s) {
+	const derived = await deriveKey(p2s, alg, p2c, key);
+	return aesKwUnwrap(alg.slice(-6), derived, encryptedKey);
+}
+async function deriveKey(p2s, alg, p2c, key) {
+	if (!(p2s instanceof Uint8Array) || p2s.length < 8) throw new Error("PBES2 Salt Input must be 8 or more octets");
+	if (p2c === void 0 || p2c < 1) throw new Error("PBES2 Iteration Count Parameter must be a positive integer");
+	const salt = concatUint8Arrays(textEncoder.encode(alg), new Uint8Array([0]), p2s);
+	const keylen = Number.parseInt(alg.slice(13, 16), 10);
+	const subtleAlg = {
+		hash: `SHA-${alg.slice(8, 11)}`,
+		iterations: p2c,
+		name: "PBKDF2",
+		salt
+	};
+	const cryptoKey = await getPBKDF2CryptoKey(key, alg);
+	return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
+}
+function checkPBES2CryptoKey(key, alg, usage) {
+	if (!isAlgorithm(key.algorithm, "PBKDF2")) throw unusable("PBKDF2");
+	checkUsage(key, usage);
+}
+function unusable(name, prop = "algorithm.name") {
+	return /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+}
+function isAlgorithm(algorithm, name) {
+	return algorithm.name === name;
+}
+function checkUsage(key, usage) {
+	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+}
+async function getPBKDF2CryptoKey(key, alg, options = {}) {
+	const { extractable = false, usage = "deriveBits" } = options;
+	if (key instanceof Uint8Array) return crypto.subtle.importKey("raw", key, "PBKDF2", extractable, [usage]);
+	checkPBES2CryptoKey(key, alg, usage);
+	return key;
+}
+//#endregion
+//#region src/core/_crypto/_key-encryption.ts
+const PUBLIC_EPK_FIELDS = new Set([
+	"kty",
+	"crv",
+	"x",
+	"y",
+	"kid",
+	"use",
+	"key_ops",
+	"alg",
+	"x5c",
+	"x5t",
+	"x5t#S256",
+	"x5u"
+]);
+async function encryptKey(alg, enc, key, providedCek, providedParameters = {}) {
+	let encryptedKey;
+	let parameters = {};
+	let cek;
+	switch (alg) {
+		case "dir":
+			cek = key;
+			break;
+		case "ECDH-ES":
+		case "ECDH-ES+A128KW":
+		case "ECDH-ES+A192KW":
+		case "ECDH-ES+A256KW": {
+			assertCryptoKey(key);
+			if (!isECDHKeyAllowed(key)) throw new Error("ECDH with the provided key is not allowed or not supported by your javascript runtime");
+			const { apu, apv, epk: providedEpk, epkPrivateKey } = providedParameters;
+			if (providedEpk && !epkPrivateKey) throw new TypeError("ECDH-ES custom ephemeral key material must include the matching private key.");
+			let ephemeralPrivateKey;
+			let epkHeader;
+			if (epkPrivateKey) {
+				ephemeralPrivateKey = await ensurePrivateKey(alg, epkPrivateKey);
+				epkHeader = await exportPublicJwkFrom(alg, providedEpk ?? epkPrivateKey);
+			} else {
+				if (providedEpk) throw new TypeError("ECDH-ES custom ephemeral public key requires a matching private key.");
+				const generated = await crypto.subtle.generateKey(key.algorithm, true, ["deriveBits"]);
+				ephemeralPrivateKey = generated.privateKey;
+				epkHeader = await exportPublicJwkFrom(alg, generated.publicKey);
+			}
+			const sharedSecret = await deriveECDHESKey(key, ephemeralPrivateKey, alg === "ECDH-ES" ? enc : alg, alg === "ECDH-ES" ? bitLengthCEK(enc) : Number.parseInt(alg.slice(-5, -2), 10), apu, apv);
+			parameters = { epk: epkHeader };
+			if (apu) parameters.apu = base64UrlEncode(apu);
+			if (apv) parameters.apv = base64UrlEncode(apv);
+			if (alg === "ECDH-ES") {
+				cek = sharedSecret;
+				break;
+			}
+			cek = providedCek || generateCEK(enc);
+			encryptedKey = await aesKwWrap(alg.slice(-6), sharedSecret, cek);
+			break;
+		}
+		case "RSA-OAEP":
+		case "RSA-OAEP-256":
+		case "RSA-OAEP-384":
+		case "RSA-OAEP-512":
+			cek = providedCek || generateCEK(enc);
+			assertCryptoKey(key);
+			encryptedKey = await encryptRSAES(alg, key, cek);
+			break;
+		case "PBES2-HS256+A128KW":
+		case "PBES2-HS384+A192KW":
+		case "PBES2-HS512+A256KW": {
+			cek = providedCek || generateCEK(enc);
+			const { p2c, p2s } = providedParameters;
+			({encryptedKey, ...parameters} = await pbes2Wrap(alg, key, cek, p2c, p2s));
+			break;
+		}
+		case "A128KW":
+		case "A192KW":
+		case "A256KW":
+			cek = providedCek || generateCEK(enc);
+			encryptedKey = await aesKwWrap(alg, key, cek);
+			break;
+		case "A128GCMKW":
+		case "A192GCMKW":
+		case "A256GCMKW": {
+			cek = providedCek || generateCEK(enc);
+			const { iv } = providedParameters;
+			({encryptedKey, ...parameters} = await gcmkwEncrypt(alg, key, cek, iv));
+			break;
+		}
+		default: throw new Error("Invalid or unsupported \"alg\" (JWE Algorithm) header value");
+	}
+	return {
+		cek,
+		encryptedKey,
+		parameters
+	};
+}
+async function normalizeKey(key, alg) {
+	if (key instanceof Uint8Array) return key;
+	if (isCryptoKey(key)) return key;
+	if (isJWK(key)) {
+		if ("k" in key && key.k) return base64UrlDecode(key.k, false);
+		return jwkTokey(key.alg ? key : {
+			...key,
+			alg
+		});
+	}
+	throw new Error("unreachable");
+}
+function toPublicEpkJwk(jwk) {
+	const filtered = {};
+	for (const [key, value] of Object.entries(jwk)) if (value !== void 0 && PUBLIC_EPK_FIELDS.has(key)) filtered[key] = value;
+	const { kty, crv, x, y } = filtered;
+	if (typeof kty !== "string") throw new TypeError("ECDH-ES ephemeral key JWK must include the \"kty\" parameter.");
+	if (typeof crv !== "string") throw new TypeError("ECDH-ES ephemeral key JWK must include the \"crv\" parameter.");
+	if (typeof x !== "string") throw new TypeError("ECDH-ES ephemeral key JWK must include the \"x\" coordinate.");
+	if (kty === "EC" && typeof y !== "string") throw new TypeError("ECDH-ES EC ephemeral key JWK must include both \"x\" and \"y\" coordinates.");
+	const publicJwk = {
+		...filtered,
+		kty,
+		crv,
+		x
+	};
+	if (typeof y === "string") publicJwk.y = y;
+	else delete publicJwk.y;
+	return sanitizeObject(publicJwk);
+}
+async function ensurePrivateKey(alg, value) {
+	const normalized = await normalizeKey(value, alg);
+	if (!(normalized instanceof CryptoKey)) throw new TypeError("ECDH-ES ephemeral private key must be a CryptoKey or convertible JWK.");
+	if (normalized.type !== "private") throw new TypeError("ECDH-ES ephemeral private key must have type \"private\".");
+	return normalized;
+}
+async function exportPublicJwkFrom(alg, value) {
+	if (isCryptoKey(value)) try {
+		return toPublicEpkJwk(await keyToJWK(value));
+	} catch (error_) {
+		throw new TypeError("ECDH-ES ephemeral CryptoKey must be extractable to export as JWK.", { cause: error_ instanceof Error ? error_ : void 0 });
+	}
+	if (isJWK(value) && isAsymmetricJWK(value) && value.kty === "EC") return toPublicEpkJwk(value);
+	const normalized = await normalizeKey(value, alg);
+	if (!(normalized instanceof CryptoKey)) throw new TypeError("ECDH-ES ephemeral public key must be a CryptoKey or convertible JWK.");
+	return exportPublicJwkFrom(alg, normalized);
+}
+//#endregion
+//#region src/core/_crypto/_pem.ts
+const toSPKI = (key) => {
+	return genericExport("public", "spki", key);
+};
+const toPKCS8 = (key) => {
+	return genericExport("private", "pkcs8", key);
+};
+const fromPKCS8 = (pem, alg, options) => {
+	return genericImport(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, "pkcs8", pem, alg, options);
+};
+const fromSPKI = (pem, alg, options) => {
+	return genericImport(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g, "spki", pem, alg, options);
+};
+const fromX509 = (pem, alg, options) => {
+	let spki;
+	try {
+		spki = getSPKI(pem);
+	} catch (error_) {
+		throw new TypeError("Failed to parse the X.509 certificate", { cause: error_ });
+	}
+	return fromSPKI(spki, alg, options);
+};
+const formatPEM = (b64, descriptor) => {
+	return `-----BEGIN ${descriptor}-----\n${(b64.match(/.{1,64}/g) || []).join("\n")}\n-----END ${descriptor}-----`;
+};
+const genericExport = async (keyType, keyFormat, key) => {
+	if (!isCryptoKey(key)) throw new TypeError(`Key must be ${key} of type CryptoKey`);
+	if (!key.extractable) throw new TypeError("CryptoKey is not extractable");
+	if (key.type !== keyType) throw new TypeError(`key is not a ${keyType} key`);
+	return formatPEM(base64Encode(new Uint8Array(await crypto.subtle.exportKey(keyFormat, key))), `${keyType.toUpperCase()} KEY`);
+};
+const genericImport = async (replace, keyFormat, pem, alg, options) => {
+	let algorithm;
+	let keyUsages;
+	const keyData = base64Decode(pem.replace(replace, ""), false);
+	const isPublic = keyFormat === "spki";
+	switch (alg) {
+		case "PS256":
+		case "PS384":
+		case "PS512":
+			algorithm = {
+				name: "RSA-PSS",
+				hash: `SHA-${alg.slice(-3)}`
+			};
+			keyUsages = isPublic ? ["verify"] : ["sign"];
+			break;
+		case "RS256":
+		case "RS384":
+		case "RS512":
+			algorithm = {
+				name: "RSASSA-PKCS1-v1_5",
+				hash: `SHA-${alg.slice(-3)}`
+			};
+			keyUsages = isPublic ? ["verify"] : ["sign"];
+			break;
+		case "RSA-OAEP":
+		case "RSA-OAEP-256":
+		case "RSA-OAEP-384":
+		case "RSA-OAEP-512":
+			algorithm = {
+				name: "RSA-OAEP",
+				hash: `SHA-${Number.parseInt(alg.slice(-3), 10) || 1}`
+			};
+			keyUsages = isPublic ? ["encrypt", "wrapKey"] : ["decrypt", "unwrapKey"];
+			break;
+		case "ES256":
+			algorithm = {
+				name: "ECDSA",
+				namedCurve: "P-256"
+			};
+			keyUsages = isPublic ? ["verify"] : ["sign"];
+			break;
+		case "ES384":
+			algorithm = {
+				name: "ECDSA",
+				namedCurve: "P-384"
+			};
+			keyUsages = isPublic ? ["verify"] : ["sign"];
+			break;
+		case "ES512":
+			algorithm = {
+				name: "ECDSA",
+				namedCurve: "P-521"
+			};
+			keyUsages = isPublic ? ["verify"] : ["sign"];
+			break;
+		case "ECDH-ES":
+		case "ECDH-ES+A128KW":
+		case "ECDH-ES+A192KW":
+		case "ECDH-ES+A256KW": {
+			const namedCurve = getNamedCurve(keyData);
+			algorithm = namedCurve?.startsWith("P-") ? {
+				name: "ECDH",
+				namedCurve
+			} : { name: "X25519" };
+			keyUsages = isPublic ? [] : ["deriveBits"];
+			break;
+		}
+		case "Ed25519":
+		case "EdDSA":
+			algorithm = { name: "Ed25519" };
+			keyUsages = isPublic ? ["verify"] : ["sign"];
+			break;
+		default: throw new Error("Invalid or unsupported \"alg\" (Algorithm) value");
+	}
+	return crypto.subtle.importKey(keyFormat, keyData, algorithm, options?.extractable ?? (isPublic ? true : false), keyUsages);
+};
+const findOid = (keyData, oid, from = 0) => {
+	if (from === 0) {
+		oid.unshift(oid.length);
+		oid.unshift(6);
+	}
+	const i = keyData.indexOf(oid[0], from);
+	if (i === -1) return false;
+	const sub = keyData.subarray(i, i + oid.length);
+	if (sub.length !== oid.length) return false;
+	return sub.every((value, index) => value === oid[index]) || findOid(keyData, oid, i + 1);
+};
+const getNamedCurve = (keyData) => {
+	switch (true) {
+		case findOid(keyData, [
+			42,
+			134,
+			72,
+			206,
+			61,
+			3,
+			1,
+			7
+		]): return "P-256";
+		case findOid(keyData, [
+			43,
+			129,
+			4,
+			0,
+			34
+		]): return "P-384";
+		case findOid(keyData, [
+			43,
+			129,
+			4,
+			0,
+			35
+		]): return "P-521";
+		default: return;
+	}
+};
+const getElement = (seq) => {
+	const result = [];
+	let next = 0;
+	while (next < seq.length) {
+		const nextPart = parseElement(seq.subarray(next));
+		result.push(nextPart);
+		next += nextPart.byteLength;
+	}
+	return result;
+};
+const parseElement = (bytes) => {
+	let position = 0;
+	let tag = bytes[0] & 31;
+	position++;
+	if (tag === 31) {
+		tag = 0;
+		while (bytes[position] >= 128) {
+			tag = tag * 128 + bytes[position] - 128;
+			position++;
+		}
+		tag = tag * 128 + bytes[position] - 128;
+		position++;
+	}
+	let length = 0;
+	if (bytes[position] < 128) {
+		length = bytes[position];
+		position++;
+	} else if (length === 128) {
+		length = 0;
+		while (bytes[position + length] !== 0 || bytes[position + length + 1] !== 0) {
+			if (length > bytes.byteLength) throw new TypeError("invalid indefinite form length");
+			length++;
+		}
+		const byteLength = position + length + 2;
+		return {
+			byteLength,
+			contents: bytes.subarray(position, position + length),
+			raw: bytes.subarray(0, byteLength)
+		};
+	} else {
+		const numberOfDigits = bytes[position] & 127;
+		position++;
+		length = 0;
+		for (let i = 0; i < numberOfDigits; i++) {
+			length = length * 256 + bytes[position];
+			position++;
+		}
+	}
+	const byteLength = position + length;
+	return {
+		byteLength,
+		contents: bytes.subarray(position, byteLength),
+		raw: bytes.subarray(0, byteLength)
+	};
+};
+const spkiFromX509 = (buf) => {
+	const tbsCertificate = getElement(getElement(parseElement(buf).contents)[0].contents);
+	return base64Encode(tbsCertificate[tbsCertificate[0].raw[0] === 160 ? 6 : 5].raw);
+};
+let createPublicKey;
+const getSPKI = (x509) => {
+	try {
+		createPublicKey ??= globalThis.process?.getBuiltinModule?.("node:crypto")?.createPublicKey;
+	} catch {
+		createPublicKey = 0;
+	}
+	if (createPublicKey) try {
+		return new createPublicKey(x509).export({
+			format: "pem",
+			type: "spki"
+		});
+	} catch {}
+	return formatPEM(spkiFromX509(base64Decode(x509.replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g, ""), false)), "PUBLIC KEY");
+};
+//#endregion
+export { gcmkwEncrypt as C, verify as D, sign as E, gcmkwDecrypt as S, generateIV as T, aesKwUnwrap as _, toSPKI as a, decrypt as b, deriveKey as c, deriveECDHESKey as d, isECDHKeyAllowed as f, keyToJWK as g, jwkTokey as h, toPKCS8 as i, pbes2Unwrap as l, encryptRSAES as m, fromSPKI as n, encryptKey as o, decryptRSAES as p, fromX509 as r, normalizeKey as s, fromPKCS8 as t, pbes2Wrap as u, aesKwWrap as v, generateCEK as w, encrypt as x, bitLengthCEK as y };