unjwt 0.6.1 → 0.7.0

package/dist/_chunks/{_crypto.mjs → jwk.mjs}

@@ -1,5 +1,5 @@
-import { a as base64UrlEncode, c as isCryptoKey, i as base64UrlDecode, n as base64Decode, o as concatUint8Arrays, r as base64Encode, s as isAsymmetricJWK, t as assertCryptoKey, u as isJWK, v as textEncoder, y as sanitizeObject } from "./utils.mjs";
-//#region src/core/_crypto/_sign-verify.ts
+import { D as JWTError, a as isCryptoKeyPair, i as isCryptoKey, n as concatUint8Arrays, o as isJWK, r as isAsymmetricJWK, s as isJWKSet, t as assertCryptoKey } from "./utils.mjs";
+import { a as base64UrlEncode, i as base64UrlDecode, n as base64Decode, r as base64Encode, s as textEncoder, t as secureRandomBytes, u as sanitizeObjectCopy } from "./libs/unsecure.mjs";
 async function sign(alg, key, data) {
 	checkSigCryptoKey(key, alg, "sign");
 	const signature = await crypto.subtle.sign(subtleAlgorithm(alg, key.algorithm), key, data);
@@ -109,8 +109,6 @@ function getNamedCurve$1(alg) {
 function checkUsage$4(key, usage) {
 	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
 }
-//#endregion
-//#region src/core/_crypto/_aes.ts
 const IV_BIT_LENGTHS = {
 	A128GCM: 96,
 	A128GCMKW: 96,
@@ -386,8 +384,6 @@ function uint64be(value) {
 	writeUInt32BE$1(buf, low, 4);
 	return buf;
 }
-//#endregion
-//#region src/core/_crypto/_key-codec.ts
 async function jwkTokey(jwk) {
 	if (!jwk.alg) throw new TypeError("\"alg\" argument is required when \"jwk.alg\" is not present");
 	const { algorithm, keyUsages } = subtleMapping(jwk);
@@ -499,8 +495,6 @@ function subtleMapping(jwk) {
 		keyUsages
 	};
 }
-//#endregion
-//#region src/core/_crypto/_rsa.ts
 async function encryptRSAES(alg, key, cek) {
 	checkRSACryptoKey(key, alg, "encrypt");
 	checkRSAModulusLength(alg, key);
@@ -535,8 +529,6 @@ function getHashLength(hash) {
 function checkUsage$2(key, usage) {
 	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
 }
-//#endregion
-//#region src/core/_crypto/_ecdh.ts
 async function deriveECDHESKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) {
 	checkECDHCryptoKey(publicKey, "ECDH");
 	checkECDHCryptoKey(privateKey, "ECDH", "deriveBits");
@@ -601,8 +593,8 @@ function uint32be(value) {
 	writeUInt32BE(buf, value, 0);
 	return buf;
 }
-//#endregion
-//#region src/core/_crypto/_pbes2.ts
+const DEFAULT_PBES2_MIN_ITERATIONS = 1e3;
+const DEFAULT_PBES2_MAX_ITERATIONS = 1e6;
 async function pbes2Wrap(alg, key, cek, p2c, p2s) {
 	const derived = await deriveKey(p2s, alg, p2c, key);
 	return {
@@ -611,7 +603,9 @@ async function pbes2Wrap(alg, key, cek, p2c, p2s) {
 		p2s: base64UrlEncode(p2s)
 	};
 }
-async function pbes2Unwrap(alg, key, encryptedKey, p2c, p2s) {
+async function pbes2Unwrap(alg, key, encryptedKey, p2c, p2s, minIterations = DEFAULT_PBES2_MIN_ITERATIONS, maxIterations = DEFAULT_PBES2_MAX_ITERATIONS) {
+	if (p2c < minIterations) throw new JWTError(`PBES2 "p2c" below the minimum of ${minIterations} iterations (got ${p2c}).`, "ERR_JWE_INVALID");
+	if (p2c > maxIterations) throw new JWTError(`PBES2 "p2c" above the maximum of ${maxIterations} iterations (got ${p2c}).`, "ERR_JWE_INVALID");
 	const derived = await deriveKey(p2s, alg, p2c, key);
 	return aesKwUnwrap(alg.slice(-6), derived, encryptedKey);
 }
@@ -648,8 +642,6 @@ async function getPBKDF2CryptoKey(key, alg, options = {}) {
 	checkPBES2CryptoKey(key, alg, usage);
 	return key;
 }
-//#endregion
-//#region src/core/_crypto/_key-encryption.ts
 const PUBLIC_EPK_FIELDS = new Set([
 	"kty",
 	"crv",
@@ -745,7 +737,7 @@ async function normalizeKey(key, alg) {
 	if (key instanceof Uint8Array) return key;
 	if (isCryptoKey(key)) return key;
 	if (isJWK(key)) {
-		if ("k" in key && key.k) return base64UrlDecode(key.k, false);
+		if ("k" in key && key.k) return base64UrlDecode(key.k, { returnAs: "uint8array" });
 		return jwkTokey(key.alg ? key : {
 			...key,
 			alg
@@ -769,7 +761,7 @@ function toPublicEpkJwk(jwk) {
 	};
 	if (typeof y === "string") publicJwk.y = y;
 	else delete publicJwk.y;
-	return sanitizeObject(publicJwk);
+	return sanitizeObjectCopy(publicJwk);
 }
 async function ensurePrivateKey(alg, value) {
 	const normalized = await normalizeKey(value, alg);
@@ -788,8 +780,6 @@ async function exportPublicJwkFrom(alg, value) {
 	if (!(normalized instanceof CryptoKey)) throw new TypeError("ECDH-ES ephemeral public key must be a CryptoKey or convertible JWK.");
 	return exportPublicJwkFrom(alg, normalized);
 }
-//#endregion
-//#region src/core/_crypto/_pem.ts
 const toSPKI = (key) => {
 	return genericExport("public", "spki", key);
 };
@@ -797,10 +787,10 @@ const toPKCS8 = (key) => {
 	return genericExport("private", "pkcs8", key);
 };
 const fromPKCS8 = (pem, alg, options) => {
-	return genericImport(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, "pkcs8", pem, alg, options);
+	return genericImport(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, "PRIVATE KEY", "pkcs8", pem, alg, options);
 };
 const fromSPKI = (pem, alg, options) => {
-	return genericImport(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g, "spki", pem, alg, options);
+	return genericImport(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g, "PUBLIC KEY", "spki", pem, alg, options);
 };
 const fromX509 = (pem, alg, options) => {
 	let spki;
@@ -814,16 +804,25 @@ const fromX509 = (pem, alg, options) => {
 const formatPEM = (b64, descriptor) => {
 	return `-----BEGIN ${descriptor}-----\n${(b64.match(/.{1,64}/g) || []).join("\n")}\n-----END ${descriptor}-----`;
 };
+const assertPEMLabel = (pem, descriptor) => {
+	const begin = `-----BEGIN ${descriptor}-----`;
+	const end = `-----END ${descriptor}-----`;
+	if (!pem.includes(begin) || !pem.includes(end)) {
+		const found = pem.match(/-----BEGIN [^-]+-----/)?.[0];
+		throw new JWTError(found ? `PEM label mismatch: expected "${begin}", got "${found}".` : `PEM label missing: expected "${begin}".`, "ERR_JWK_INVALID");
+	}
+};
 const genericExport = async (keyType, keyFormat, key) => {
 	if (!isCryptoKey(key)) throw new TypeError(`Key must be ${key} of type CryptoKey`);
 	if (!key.extractable) throw new TypeError("CryptoKey is not extractable");
 	if (key.type !== keyType) throw new TypeError(`key is not a ${keyType} key`);
 	return formatPEM(base64Encode(new Uint8Array(await crypto.subtle.exportKey(keyFormat, key))), `${keyType.toUpperCase()} KEY`);
 };
-const genericImport = async (replace, keyFormat, pem, alg, options) => {
+const genericImport = async (replace, descriptor, keyFormat, pem, alg, options) => {
 	let algorithm;
 	let keyUsages;
-	const keyData = base64Decode(pem.replace(replace, ""), false);
+	assertPEMLabel(pem, descriptor);
+	const keyData = base64Decode(pem.replace(replace, ""), { returnAs: "uint8array" });
 	const isPublic = keyFormat === "spki";
 	switch (alg) {
 		case "PS256":
@@ -1008,7 +1007,619 @@ const getSPKI = (x509) => {
 			type: "spki"
 		});
 	} catch {}
-	return formatPEM(spkiFromX509(base64Decode(x509.replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g, ""), false)), "PUBLIC KEY");
+	return formatPEM(spkiFromX509(base64Decode(x509.replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g, ""), { returnAs: "uint8array" })), "PUBLIC KEY");
+};
+async function generateKey(alg, options = {}) {
+	const exportToJWK = options.toJWK !== void 0 && options.toJWK !== false;
+	const defaultExtractable = options.extractable !== false;
+	if (alg === "A128CBC-HS256" || alg === "A192CBC-HS384" || alg === "A256CBC-HS512") {
+		const keyBytes = secureRandomBytes(bitLengthCEK(alg) >> 3);
+		if (exportToJWK) return keyToJWK(keyBytes);
+		return keyBytes;
+	}
+	const { algorithm, keyUsages } = getGenerateKeyParams(alg, options);
+	const key = await crypto.subtle.generateKey(algorithm, defaultExtractable, keyUsages);
+	if (exportToJWK) if (key instanceof CryptoKey) return {
+		...await exportKey(key),
+		alg
+	};
+	else {
+		const [pub, priv] = await Promise.all([exportKey(key.publicKey), exportKey(key.privateKey)]);
+		return {
+			privateKey: {
+				...priv,
+				alg
+			},
+			publicKey: {
+				...pub,
+				alg
+			}
+		};
+	}
+	return key;
+}
+async function generateJWK(alg, options) {
+	const { keyUsage, extractable, modulusLength, publicExponent, namedCurve, ...jwkParams } = options ?? {};
+	const kid = typeof jwkParams.kid === "string" ? jwkParams.kid : crypto.randomUUID();
+	const extraParams = {
+		...jwkParams,
+		kid
+	};
+	const result = await generateKey(alg, {
+		keyUsage,
+		extractable,
+		modulusLength,
+		publicExponent,
+		namedCurve,
+		toJWK: true
+	});
+	if (result && typeof result === "object" && "privateKey" in result && "publicKey" in result) {
+		const pair = result;
+		return {
+			privateKey: {
+				...extraParams,
+				...pair.privateKey
+			},
+			publicKey: {
+				...extraParams,
+				...pair.publicKey
+			}
+		};
+	}
+	return {
+		...extraParams,
+		...result
+	};
+}
+async function deriveKeyFromPassword(password, alg, options) {
+	const { salt, iterations, extractable, keyUsage } = options;
+	const exportToJWK = options.toJWK !== void 0 && options.toJWK !== false;
+	if (!(salt instanceof Uint8Array) || salt.length < 8) throw new JWTError("PBES2 Salt Input (salt) must be 8 or more octets", "ERR_JWE_INVALID");
+	if (typeof iterations !== "number" || iterations < 1) throw new JWTError("PBES2 Iteration Count (iterations) must be a positive integer", "ERR_JWE_INVALID");
+	const derivedBytes = await deriveKey(salt, alg, iterations, typeof password === "string" ? textEncoder.encode(password) : password);
+	const wrappingAlg = alg.slice(-6);
+	const finalUsages = keyUsage ?? ["wrapKey", "unwrapKey"];
+	const finalExtractable = exportToJWK ? true : extractable === true;
+	const derivedKey = await crypto.subtle.importKey("raw", derivedBytes, { name: "AES-KW" }, finalExtractable, finalUsages);
+	if (exportToJWK) return {
+		...await keyToJWK(derivedKey),
+		alg: wrappingAlg,
+		kty: "oct"
+	};
+	return derivedKey;
+}
+async function deriveJWKFromPassword(password, alg, options) {
+	const { salt, iterations, keyUsage, extractable, ...jwkParams } = options;
+	const result = await deriveKeyFromPassword(password, alg, {
+		salt,
+		iterations,
+		keyUsage,
+		extractable,
+		toJWK: true
+	});
+	return Object.keys(jwkParams).length > 0 ? {
+		...jwkParams,
+		...result
+	} : result;
+}
+var WeakMapJWKCache = class {
+	_map = /* @__PURE__ */ new WeakMap();
+	get(jwk, alg) {
+		return this._map.get(jwk)?.[alg];
+	}
+	set(jwk, alg, key) {
+		let entry = this._map.get(jwk);
+		if (!entry) this._map.set(jwk, { [alg]: key });
+		else entry[alg] = key;
+	}
 };
-//#endregion
-export { gcmkwEncrypt as C, verify as D, sign as E, gcmkwDecrypt as S, generateIV as T, aesKwUnwrap as _, toSPKI as a, decrypt as b, deriveKey as c, deriveECDHESKey as d, isECDHKeyAllowed as f, keyToJWK as g, jwkTokey as h, toPKCS8 as i, pbes2Unwrap as l, encryptRSAES as m, fromSPKI as n, encryptKey as o, decryptRSAES as p, fromX509 as r, normalizeKey as s, fromPKCS8 as t, pbes2Wrap as u, aesKwWrap as v, generateCEK as w, encrypt as x, bitLengthCEK as y };
+let _activeCache = new WeakMapJWKCache();
+function configureJWKCache(cache) {
+	_activeCache = cache;
+}
+function clearJWKCache() {
+	_activeCache = new WeakMapJWKCache();
+}
+async function importKey(key, algOrOptions) {
+	const alg = typeof algOrOptions === "string" ? algOrOptions : algOrOptions?.alg ?? void 0;
+	const expect = typeof algOrOptions === "object" ? algOrOptions.expect ?? void 0 : void 0;
+	if (typeof key === "string") key = textEncoder.encode(key);
+	if (key instanceof Uint8Array) return key;
+	if (isCryptoKey(key)) {
+		assertIntentOnCryptoKey(key, expect);
+		return key;
+	}
+	if (isJWK(key)) if ("k" in key && typeof key.k === "string") {
+		const rawBytes = base64UrlDecode(key.k, { returnAs: "uint8array" });
+		if (typeof algOrOptions === "object" && algOrOptions.asCryptoKey) {
+			const { algorithm, usage, extractable = false } = algOrOptions;
+			if (!algorithm || !usage) throw new JWTError("asCryptoKey option requires `algorithm` and `usage` to be provided.", "ERR_JWK_INVALID");
+			return crypto.subtle.importKey("raw", rawBytes, algorithm, extractable, usage);
+		}
+		return rawBytes;
+	} else {
+		if (!key.alg && !alg) throw new JWTError("Algorithm must be provided when importing non-oct JWK", "ERR_JWK_INVALID");
+		assertIntentOnJWK(key, expect);
+		const effectiveAlg = key.alg || alg;
+		if (_activeCache) {
+			const cached = _activeCache.get(key, effectiveAlg);
+			if (cached) return cached;
+		}
+		const cryptoKey = await jwkTokey(key.alg ? key : {
+			...key,
+			alg
+		});
+		if (_activeCache) _activeCache.set(key, effectiveAlg, cryptoKey);
+		return cryptoKey;
+	}
+	throw new JWTError("Invalid key type provided to importKey", "ERR_JWK_INVALID");
+}
+function assertIntentOnJWK(jwk, expect) {
+	if (expect === void 0 || jwk.kty === "oct") return;
+	const hasPrivateScalar = "d" in jwk && typeof jwk.d === "string";
+	if (expect === "public" && hasPrivateScalar) throw new JWTError("Private JWK passed where a public key is expected. Strip `d` (and CRT fields on RSA) before import.", "ERR_JWK_INVALID");
+	if (expect === "private" && !hasPrivateScalar) throw new JWTError("Public JWK passed where a private key is expected.", "ERR_JWK_INVALID");
+}
+function assertIntentOnCryptoKey(key, expect) {
+	if (expect === void 0 || key.type === "secret") return;
+	if (expect === "public" && key.type === "private") throw new JWTError("Private CryptoKey passed where a public key is expected.", "ERR_JWK_INVALID");
+	if (expect === "private" && key.type === "public") throw new JWTError("Public CryptoKey passed where a private key is expected.", "ERR_JWK_INVALID");
+}
+async function exportKey(key, jwkParams) {
+	const exportedJwk = await keyToJWK(key);
+	if (jwkParams) return {
+		...exportedJwk,
+		...sanitizeObjectCopy(jwkParams)
+	};
+	return exportedJwk;
+}
+async function resolveWrappingKey(alg, key, expect) {
+	if (alg.startsWith("PBES2") && (typeof key === "string" || key instanceof Uint8Array)) return typeof key === "string" ? textEncoder.encode(key) : key;
+	if (typeof key === "string") throw new TypeError(`Key must be CryptoKey, JWK, or Uint8Array for ${alg}`);
+	if (expect !== void 0) return importKey(key, {
+		alg,
+		expect
+	});
+	return importKey(key, alg);
+}
+async function wrapKey(alg, keyToWrap, wrappingKey, options = {}) {
+	const cekBytes = keyToWrap instanceof Uint8Array ? keyToWrap : new Uint8Array(await crypto.subtle.exportKey("raw", keyToWrap));
+	const importedWrappingKey = await resolveWrappingKey(alg, wrappingKey, "public");
+	switch (alg) {
+		case "dir": return { encryptedKey: new Uint8Array(0) };
+		case "A128KW":
+		case "A192KW":
+		case "A256KW": return { encryptedKey: await aesKwWrap(alg, importedWrappingKey, cekBytes) };
+		case "PBES2-HS256+A128KW":
+		case "PBES2-HS384+A192KW":
+		case "PBES2-HS512+A256KW": {
+			const { p2s, p2c } = options;
+			if (!p2s || typeof p2c !== "number") throw new JWTError("PBES2 requires 'p2s' (salt) and 'p2c' (count) options", "ERR_JWE_INVALID");
+			return pbes2Wrap(alg, importedWrappingKey, cekBytes, p2c, p2s);
+		}
+		case "A128GCMKW":
+		case "A192GCMKW":
+		case "A256GCMKW": {
+			const { encryptedKey, iv, tag } = await gcmkwEncrypt(alg, importedWrappingKey, cekBytes, options.iv);
+			return {
+				encryptedKey,
+				iv,
+				tag
+			};
+		}
+		case "RSA-OAEP":
+		case "RSA-OAEP-256":
+		case "RSA-OAEP-384":
+		case "RSA-OAEP-512": return { encryptedKey: await encryptRSAES(alg, importedWrappingKey, cekBytes) };
+		case "ECDH-ES":
+		case "ECDH-ES+A128KW":
+		case "ECDH-ES+A192KW":
+		case "ECDH-ES+A256KW": {
+			if (!(importedWrappingKey instanceof CryptoKey)) throw new TypeError("ECDH-ES requires the wrapping key to be a CryptoKey (recipient's public key)");
+			if (!isECDHKeyAllowed(importedWrappingKey)) throw new JWTError("ECDH with the provided key is not allowed or not supported", "ERR_JWK_INVALID");
+			const apu = options.ecdh?.partyUInfo ?? new Uint8Array(0);
+			const apv = options.ecdh?.partyVInfo ?? new Uint8Array(0);
+			const { ephemeralPrivateKey, epkJwk } = await resolveECDHEphemeralPair(importedWrappingKey, options.ecdh?.ephemeralKey);
+			const infoAlg = alg === "ECDH-ES" ? (() => {
+				if (!options.ecdh?.enc) throw new JWTError("ECDH-ES direct key agreement requires options.ecdh.enc (the target content encryption algorithm)", "ERR_JWK_INVALID");
+				return options.ecdh.enc;
+			})() : alg;
+			const sharedSecret = await deriveECDHESKey(importedWrappingKey, ephemeralPrivateKey, infoAlg, alg === "ECDH-ES" ? bitLengthCEK(infoAlg) : Number.parseInt(alg.slice(-5, -2), 10), apu, apv);
+			const wrapResult = {
+				encryptedKey: new Uint8Array(0),
+				epk: epkJwk
+			};
+			if (apu.length > 0) wrapResult.apu = base64UrlEncode(apu);
+			if (apv.length > 0) wrapResult.apv = base64UrlEncode(apv);
+			if (alg === "ECDH-ES") return wrapResult;
+			wrapResult.encryptedKey = await aesKwWrap(alg.slice(-6), sharedSecret, cekBytes);
+			return wrapResult;
+		}
+		default: throw new JWTError(`Unsupported key wrapping algorithm: ${alg}`, "ERR_JWK_UNSUPPORTED");
+	}
+}
+async function unwrapKey(alg, wrappedKey, unwrappingKey, options = {}) {
+	const returnRaw = options.format === "raw";
+	const defaultExtractable = options.extractable !== false;
+	const importedUnwrappingKey = await resolveWrappingKey(alg, unwrappingKey, "private");
+	let unwrappedCekBytes;
+	switch (alg) {
+		case "dir":
+			if (importedUnwrappingKey instanceof Uint8Array) unwrappedCekBytes = importedUnwrappingKey;
+			else {
+				if (!returnRaw) return importedUnwrappingKey;
+				unwrappedCekBytes = new Uint8Array(await crypto.subtle.exportKey("raw", importedUnwrappingKey));
+			}
+			break;
+		case "A128KW":
+		case "A192KW":
+		case "A256KW":
+			unwrappedCekBytes = await aesKwUnwrap(alg, importedUnwrappingKey, wrappedKey);
+			break;
+		case "PBES2-HS256+A128KW":
+		case "PBES2-HS384+A192KW":
+		case "PBES2-HS512+A256KW": {
+			const { p2s, p2c, minIterations, maxIterations } = options;
+			if (!p2s || typeof p2c !== "number") throw new JWTError("PBES2 requires 'p2s' (salt) and 'p2c' (count) options", "ERR_JWE_INVALID");
+			unwrappedCekBytes = await pbes2Unwrap(alg, importedUnwrappingKey, wrappedKey, p2c, typeof p2s === "string" ? base64UrlDecode(p2s, { returnAs: "uint8array" }) : p2s, minIterations, maxIterations);
+			break;
+		}
+		case "A128GCMKW":
+		case "A192GCMKW":
+		case "A256GCMKW":
+			if (!options.iv || !options.tag) throw new JWTError("AES-GCMKW requires 'iv' and 'tag' options for unwrapping", "ERR_JWE_INVALID");
+			unwrappedCekBytes = await gcmkwDecrypt(alg, importedUnwrappingKey, wrappedKey, typeof options.iv === "string" ? base64UrlDecode(options.iv, { returnAs: "uint8array" }) : options.iv, typeof options.tag === "string" ? base64UrlDecode(options.tag, { returnAs: "uint8array" }) : options.tag);
+			break;
+		case "RSA-OAEP":
+		case "RSA-OAEP-256":
+		case "RSA-OAEP-384":
+		case "RSA-OAEP-512": {
+			if (!(importedUnwrappingKey instanceof CryptoKey)) throw new TypeError("RSA-OAEP requires the unwrapping key to be provided as a CryptoKey");
+			unwrappedCekBytes = await decryptRSAES(alg, importedUnwrappingKey, wrappedKey);
+			if (returnRaw) break;
+			const inferredAlgorithm = options.unwrappedKeyAlgorithm || inferAesImportAlgorithm(options.enc, unwrappedCekBytes.length);
+			if (!inferredAlgorithm) throw new JWTError("Unable to infer algorithm for RSA-OAEP unwrapped key. Provide \"unwrappedKeyAlgorithm\" in options.", "ERR_JWE_INVALID");
+			const keyUsages = options.keyUsage || ["encrypt", "decrypt"];
+			return await crypto.subtle.importKey("raw", unwrappedCekBytes, inferredAlgorithm, defaultExtractable, keyUsages);
+		}
+		case "ECDH-ES":
+		case "ECDH-ES+A128KW":
+		case "ECDH-ES+A192KW":
+		case "ECDH-ES+A256KW": {
+			if (!options.epk) throw new JWTError("ECDH-ES requires 'epk' (Ephemeral Public Key) option", "ERR_JWE_INVALID");
+			if (!(importedUnwrappingKey instanceof CryptoKey)) throw new TypeError("ECDH-ES requires the unwrapping key to be a CryptoKey");
+			if (!isECDHKeyAllowed(importedUnwrappingKey)) throw new JWTError("ECDH with the provided key is not allowed or not supported", "ERR_JWK_INVALID");
+			const epkCandidate = options.epk instanceof CryptoKey ? options.epk : await normalizeKey(options.epk, alg);
+			if (!(epkCandidate instanceof CryptoKey)) throw new JWTError("Failed to normalize ECDH ephemeral public key", "ERR_JWK_INVALID");
+			const apuBytes = typeof options.apu === "string" ? base64UrlDecode(options.apu, { returnAs: "uint8array" }) : options.apu ?? new Uint8Array(0);
+			const apvBytes = typeof options.apv === "string" ? base64UrlDecode(options.apv, { returnAs: "uint8array" }) : options.apv ?? new Uint8Array(0);
+			const infoAlg = alg === "ECDH-ES" ? options.enc : alg;
+			if (!infoAlg) throw new JWTError("ECDH-ES requires content encryption algorithm ('enc') to derive the shared secret", "ERR_JWE_INVALID");
+			const sharedSecret = await deriveECDHESKey(epkCandidate, importedUnwrappingKey, infoAlg, alg === "ECDH-ES" ? bitLengthCEK(infoAlg) : Number.parseInt(alg.slice(-5, -2), 10), apuBytes, apvBytes);
+			if (alg === "ECDH-ES") unwrappedCekBytes = sharedSecret;
+			else {
+				const kwAlg = alg.slice(-6);
+				if (!(wrappedKey instanceof Uint8Array) || wrappedKey.length === 0) throw new JWTError("ECDH-ES key agreement with key wrapping requires an encrypted key", "ERR_JWE_INVALID");
+				unwrappedCekBytes = await aesKwUnwrap(kwAlg, sharedSecret, wrappedKey);
+			}
+			break;
+		}
+		default: throw new JWTError(`Unsupported key unwrapping algorithm: ${alg}`, "ERR_JWK_UNSUPPORTED");
+	}
+	if (returnRaw) return unwrappedCekBytes;
+	return await crypto.subtle.importKey("raw", unwrappedCekBytes, options.unwrappedKeyAlgorithm || { name: "AES-GCM" }, defaultExtractable, options.keyUsage || ["encrypt", "decrypt"]);
+}
+async function importPEM(pem, alg, options) {
+	const extractable = options?.extractable !== false;
+	const pemType = options?.pemType ?? inferPEMType(pem);
+	if (!pemType) throw new JWTError("Cannot infer PEM type from the input; pass \"options.pemType\" explicitly.", "ERR_JWK_INVALID");
+	let cryptoKey;
+	switch (pemType) {
+		case "pkcs8":
+			cryptoKey = await fromPKCS8(pem, alg, { extractable });
+			break;
+		case "spki":
+			cryptoKey = await fromSPKI(pem, alg, { extractable });
+			break;
+		case "x509":
+			cryptoKey = await fromX509(pem, alg, { extractable });
+			break;
+		default: throw new JWTError(`Unsupported PEM type: ${pemType}`, "ERR_JWK_UNSUPPORTED");
+	}
+	return {
+		...await exportKey(cryptoKey, options?.jwkParams),
+		alg
+	};
+}
+async function importFromPEM(pem, pemType, alg, options) {
+	return importPEM(pem, alg, {
+		pemType,
+		...options
+	});
+}
+async function exportPEM(jwk, options) {
+	if (jwk.kty === "oct") throw new JWTError("Octet (symmetric) JWKs (kty: 'oct') cannot be exported to PKCS8 or SPKI PEM formats.", "ERR_JWK_UNSUPPORTED");
+	const effectiveAlg = jwk.alg || options?.alg;
+	if (!effectiveAlg && (jwk.kty === "RSA" || jwk.kty === "EC" || jwk.kty === "OKP")) throw new JWTError("Algorithm (alg) must be provided in the JWK or via options for converting this JWK type to a CryptoKey.", "ERR_JWK_INVALID");
+	const pemFormat = options?.pemFormat ?? ("d" in jwk ? "pkcs8" : "spki");
+	const cryptoKeyCandidate = await importKey({
+		...jwk,
+		ext: true
+	}, {
+		alg: effectiveAlg,
+		expect: pemFormat === "pkcs8" ? "private" : "public"
+	});
+	if (!isCryptoKey(cryptoKeyCandidate)) throw new JWTError("Failed to convert JWK to a CryptoKey instance suitable for PEM export.", "ERR_JWK_INVALID");
+	const cryptoKey = cryptoKeyCandidate;
+	switch (pemFormat) {
+		case "pkcs8":
+			if (cryptoKey.type !== "private") throw new JWTError(`Only 'private' type CryptoKeys can be exported to PKCS8 PEM format. Key type is '${cryptoKey.type}'.`, "ERR_JWK_INVALID");
+			return toPKCS8(cryptoKey);
+		case "spki":
+			if (cryptoKey.type !== "public") throw new JWTError(`Only 'public' type CryptoKeys can be exported to SPKI PEM format. Key type is '${cryptoKey.type}'.`, "ERR_JWK_INVALID");
+			return toSPKI(cryptoKey);
+		default: throw new JWTError(`Unsupported PEM format: ${pemFormat}`, "ERR_JWK_UNSUPPORTED");
+	}
+}
+async function exportToPEM(jwk, pemFormat, algForCryptoKeyImport) {
+	return exportPEM(jwk, {
+		pemFormat,
+		alg: algForCryptoKeyImport
+	});
+}
+function inferPEMType(pem) {
+	if (pem.includes("-----BEGIN PRIVATE KEY-----")) return "pkcs8";
+	if (pem.includes("-----BEGIN PUBLIC KEY-----")) return "spki";
+	if (pem.includes("-----BEGIN CERTIFICATE-----")) return "x509";
+}
+async function deriveSharedSecret(publicKey, privateKey, alg, options) {
+	const pubCryptoKey = isCryptoKey(publicKey) ? publicKey : await importKey(publicKey, {
+		alg: "ECDH-ES",
+		expect: "public"
+	});
+	const privCryptoKey = isCryptoKey(privateKey) ? privateKey : await importKey(privateKey, {
+		alg: "ECDH-ES",
+		expect: "private"
+	});
+	let keyLength;
+	if (options?.keyLength !== void 0) keyLength = options.keyLength;
+	else if (alg === "ECDH-ES") throw new JWTError("deriveSharedSecret with alg \"ECDH-ES\" requires an explicit keyLength in options", "ERR_JWK_INVALID");
+	else if (alg.startsWith("ECDH-ES+")) keyLength = Number.parseInt(alg.slice(-5, -2), 10);
+	else keyLength = bitLengthCEK(alg);
+	return deriveECDHESKey(pubCryptoKey, privCryptoKey, alg, keyLength, options?.partyUInfo ?? new Uint8Array(0), options?.partyVInfo ?? new Uint8Array(0));
+}
+function getJWKFromSet(jwkSet, kidOrProtectedHeader) {
+	if (!jwkSet || !isJWKSet(jwkSet)) throw new JWTError("Invalid JWK Set provided", "ERR_JWK_INVALID");
+	if (typeof kidOrProtectedHeader === "string") {
+		const kid = kidOrProtectedHeader;
+		const selectedKey = jwkSet.keys.find((k) => k.kid === kid);
+		if (!selectedKey) throw new JWTError(`No key found in JWK Set with kid "${kid}".`, "ERR_JWK_KEY_NOT_FOUND");
+		return selectedKey;
+	} else if (typeof kidOrProtectedHeader === "object") {
+		const { kid, alg, kty } = kidOrProtectedHeader;
+		if (!kid) {
+			if (jwkSet.keys.length === 1) return jwkSet.keys[0];
+			throw new JWTError("JWS Protected Header is missing 'kid' (Key ID) and the JWK Set contains multiple keys. Add a 'kid' parameter to the token header and to the matching JWK to enable automatic selection.", "ERR_JWK_KEY_NOT_FOUND");
+		}
+		const selectedKey = jwkSet.keys.find((k) => {
+			return k.kid === kid && (!alg || k.alg === alg) && (!kty || k.kty === kty);
+		});
+		if (!selectedKey) {
+			let errorMessage = `No key found in JWK Set with kid "${kid}"`;
+			if (alg) errorMessage += ` and alg "${alg}"`;
+			if (kty) errorMessage += ` and kty "${kty}"`;
+			errorMessage += ".";
+			throw new JWTError(errorMessage, "ERR_JWK_KEY_NOT_FOUND");
+		}
+		return selectedKey;
+	}
+	throw new TypeError("`kidOrProtectedHeader` must be a string (kid) or an object (JOSE Protected Header).");
+}
+function getJWKsFromSet(jwkSet, filter) {
+	if (!jwkSet || !isJWKSet(jwkSet)) throw new JWTError("Invalid JWK Set provided", "ERR_JWK_INVALID");
+	if (!filter) return [...jwkSet.keys];
+	return jwkSet.keys.filter(filter);
+}
+function getGenerateKeyParams(alg, options) {
+	let algorithm;
+	let keyUsages;
+	const defaultKeyUsage = options?.keyUsage;
+	switch (alg) {
+		case "HS256":
+		case "HS384":
+		case "HS512":
+			algorithm = {
+				name: "HMAC",
+				hash: `SHA-${alg.slice(2)}`
+			};
+			keyUsages = defaultKeyUsage ?? ["sign", "verify"];
+			break;
+		case "RS256":
+		case "RS384":
+		case "RS512":
+			algorithm = {
+				name: "RSASSA-PKCS1-v1_5",
+				modulusLength: options?.modulusLength ?? 2048,
+				publicExponent: options?.publicExponent ?? new Uint8Array([
+					1,
+					0,
+					1
+				]),
+				hash: `SHA-${alg.slice(2)}`
+			};
+			keyUsages = defaultKeyUsage ?? ["sign", "verify"];
+			break;
+		case "PS256":
+		case "PS384":
+		case "PS512":
+			algorithm = {
+				name: "RSA-PSS",
+				modulusLength: options?.modulusLength ?? 2048,
+				publicExponent: options?.publicExponent ?? new Uint8Array([
+					1,
+					0,
+					1
+				]),
+				hash: `SHA-${alg.slice(2)}`
+			};
+			keyUsages = defaultKeyUsage ?? ["sign", "verify"];
+			break;
+		case "RSA-OAEP":
+		case "RSA-OAEP-256":
+		case "RSA-OAEP-384":
+		case "RSA-OAEP-512":
+			algorithm = {
+				name: "RSA-OAEP",
+				modulusLength: options?.modulusLength ?? 2048,
+				publicExponent: options?.publicExponent ?? new Uint8Array([
+					1,
+					0,
+					1
+				]),
+				hash: `SHA-${Number.parseInt(alg.slice(9), 10) || 1}`
+			};
+			keyUsages = defaultKeyUsage ?? [
+				"encrypt",
+				"decrypt",
+				"wrapKey",
+				"unwrapKey"
+			];
+			break;
+		case "A128KW":
+		case "A192KW":
+		case "A256KW":
+			algorithm = {
+				name: "AES-KW",
+				length: Number.parseInt(alg.slice(1, 4), 10)
+			};
+			keyUsages = defaultKeyUsage ?? ["wrapKey", "unwrapKey"];
+			break;
+		case "A128GCM":
+		case "A192GCM":
+		case "A256GCM":
+		case "A128GCMKW":
+		case "A192GCMKW":
+		case "A256GCMKW": {
+			const baseAlg = alg.replace("KW", "");
+			algorithm = {
+				name: "AES-GCM",
+				length: Number.parseInt(baseAlg.slice(1, 4), 10)
+			};
+			keyUsages = defaultKeyUsage ?? (alg.endsWith("KW") ? ["wrapKey", "unwrapKey"] : ["encrypt", "decrypt"]);
+			break;
+		}
+		case "ES256":
+		case "ES384":
+		case "ES512":
+			algorithm = {
+				name: "ECDSA",
+				namedCurve: `P-${alg.slice(2)}`
+			};
+			keyUsages = defaultKeyUsage ?? ["sign", "verify"];
+			break;
+		case "Ed25519":
+			keyUsages = defaultKeyUsage ?? ["sign", "verify"];
+			algorithm = { name: "Ed25519" };
+			break;
+		case "EdDSA": {
+			keyUsages = defaultKeyUsage ?? ["sign", "verify"];
+			const namedCurve = options?.namedCurve ?? "Ed25519";
+			switch (namedCurve) {
+				case "Ed25519":
+				case "Ed448":
+					algorithm = { name: namedCurve };
+					break;
+				default: throw new JWTError("Unsupported namedCurve provided. Supported values are: Ed25519 and Ed448", "ERR_JWK_UNSUPPORTED");
+			}
+			break;
+		}
+		case "ECDH-ES":
+		case "ECDH-ES+A128KW":
+		case "ECDH-ES+A192KW":
+		case "ECDH-ES+A256KW": {
+			keyUsages = ["deriveBits"];
+			const namedCurve = options?.namedCurve ?? "P-256";
+			switch (namedCurve) {
+				case "P-256":
+				case "P-384":
+				case "P-521":
+					algorithm = {
+						name: "ECDH",
+						namedCurve
+					};
+					break;
+				case "X25519":
+					algorithm = { name: "X25519" };
+					break;
+				default: throw new JWTError("Unsupported namedCurve provided. Supported values are: P-256, P-384, P-521 and X25519", "ERR_JWK_UNSUPPORTED");
+			}
+			break;
+		}
+		default: throw new JWTError(`Unsupported or invalid algorithm for key generation: ${alg}`, "ERR_JWK_UNSUPPORTED");
+	}
+	return {
+		algorithm,
+		keyUsages
+	};
+}
+async function resolveECDHEphemeralPair(recipientPublicKey, ephemeralKeyInput) {
+	if (!ephemeralKeyInput) {
+		const generated = await crypto.subtle.generateKey(recipientPublicKey.algorithm, true, ["deriveBits"]);
+		const rawJwk = await keyToJWK(generated.publicKey);
+		return {
+			ephemeralPrivateKey: generated.privateKey,
+			epkJwk: stripPrivateJwkFields(rawJwk)
+		};
+	}
+	if (isCryptoKeyPair(ephemeralKeyInput)) {
+		const rawJwk = await keyToJWK(ephemeralKeyInput.publicKey);
+		return {
+			ephemeralPrivateKey: ephemeralKeyInput.privateKey,
+			epkJwk: stripPrivateJwkFields(rawJwk)
+		};
+	}
+	if (typeof ephemeralKeyInput === "object" && "publicKey" in ephemeralKeyInput && "privateKey" in ephemeralKeyInput) {
+		const { publicKey, privateKey } = ephemeralKeyInput;
+		return {
+			ephemeralPrivateKey: isCryptoKey(privateKey) ? privateKey : await importKey(privateKey, {
+				alg: "ECDH-ES",
+				expect: "private"
+			}),
+			epkJwk: isCryptoKey(publicKey) ? stripPrivateJwkFields(await keyToJWK(publicKey)) : stripPrivateJwkFields(publicKey)
+		};
+	}
+	if (isCryptoKey(ephemeralKeyInput)) {
+		if (ephemeralKeyInput.type !== "private") throw new JWTError("ECDH-ES ephemeral CryptoKey must be a private key", "ERR_JWK_INVALID");
+		return {
+			ephemeralPrivateKey: ephemeralKeyInput,
+			epkJwk: stripPrivateJwkFields(await keyToJWK(ephemeralKeyInput))
+		};
+	}
+	if (isJWK(ephemeralKeyInput) && "d" in ephemeralKeyInput) return {
+		ephemeralPrivateKey: await importKey(ephemeralKeyInput, {
+			alg: "ECDH-ES",
+			expect: "private"
+		}),
+		epkJwk: stripPrivateJwkFields(ephemeralKeyInput)
+	};
+	throw new JWTError("Unsupported ECDH-ES ephemeral key material", "ERR_JWK_INVALID");
+}
+function stripPrivateJwkFields(jwk) {
+	const { d: _d, ...pub } = jwk;
+	return pub;
+}
+function inferAesImportAlgorithm(enc, cekLengthBytes) {
+	const bitLength = cekLengthBytes << 3;
+	if (enc) {
+		if (enc.includes("GCM")) return {
+			name: "AES-GCM",
+			length: Number.parseInt(enc.slice(1, 4), 10)
+		};
+		if (enc.includes("CBC-HS")) return;
+	}
+	if (bitLength === 128 || bitLength === 192 || bitLength === 256) return {
+		name: "AES-GCM",
+		length: bitLength
+	};
+}
+export { generateIV as C, generateCEK as S, verify as T, unwrapKey as _, deriveKeyFromPassword as a, decrypt as b, exportPEM as c, generateKey as d, getJWKFromSet as f, importPEM as g, importKey as h, deriveJWKFromPassword as i, exportToPEM as l, importFromPEM as m, clearJWKCache as n, deriveSharedSecret as o, getJWKsFromSet as p, configureJWKCache as r, exportKey as s, WeakMapJWKCache as t, generateJWK as u, wrapKey as v, sign as w, encrypt as x, encryptKey as y };