unjwt 0.7.2 → 0.8.0

package/dist/_chunks/jwk.mjs

@@ -1,5 +1,16 @@
-import { JWTError, assertCryptoKey, concatUint8Arrays, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet } from "./utils.mjs";
-import { base64Decode, base64Encode, base64UrlDecode, base64UrlEncode, sanitizeObjectCopy, secureRandomBytes, textEncoder } from "./libs/unsecure.mjs";
+import { safeJsonParse, sanitizeObjectCopy, secureRandomBytes, textEncoder } from "./libs/unsecure.mjs";
+import { JWTError, assertClaimValidationOptions, assertCritShape, assertCryptoKey, assertPlainObject, assertStringList, base64Parse, base64Stringify, base64UrlParse, base64UrlStringify, concatUint8Arrays, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isPlainObject, parsePayloadBytes, parsePayloadSegment, uint32be, validateJwtClaims } from "./_jwt-internal.mjs";
+import { ECDSA_CURVES, PBES2_ALGORITHMS, aesBitsOf, checkKeyUsage, cryptoKeyCurve, hashBitsOf, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, innerKeyWrapAlg, isAlgorithm, isContentEncryptionAlgorithm, isEd25519Signature, jwsHashOf, lengthOf, modulusLengthOf, namedCurveOf, rsaOaepHashOf, unusableKey } from "./algorithms.mjs";
+const MAX_QUOTED_VALUE = 64;
+function quoteTokenValue(value) {
+	const text = String(value);
+	return JSON.stringify(text.length > MAX_QUOTED_VALUE ? `${text.slice(0, MAX_QUOTED_VALUE)}…` : text);
+}
+const HASHED_SIGNATURE_ALGORITHMS = {
+	HS: "HMAC",
+	RS: "RSASSA-PKCS1-v1_5",
+	PS: "RSA-PSS"
+};
 async function sign(alg, key, data) {
 	checkSigCryptoKey(key, alg, "sign");
 	const signature = await crypto.subtle.sign(subtleAlgorithm(alg, key.algorithm), key, data);
@@ -17,46 +28,37 @@ function checkSigCryptoKey(key, alg, usage) {
 	switch (alg) {
 		case "HS256":
 		case "HS384":
-		case "HS512": {
-			if (!isAlgorithm$3(key.algorithm, "HMAC")) throw unusable$4("HMAC");
-			const expected = Number.parseInt(alg.slice(2), 10);
-			if (getHashLength$1(key.algorithm.hash) !== expected) throw unusable$4(`SHA-${expected}`, "algorithm.hash");
-			break;
-		}
+		case "HS512":
 		case "RS256":
 		case "RS384":
-		case "RS512": {
-			if (!isAlgorithm$3(key.algorithm, "RSASSA-PKCS1-v1_5")) throw unusable$4("RSASSA-PKCS1-v1_5");
-			const expected = Number.parseInt(alg.slice(2), 10);
-			if (getHashLength$1(key.algorithm.hash) !== expected) throw unusable$4(`SHA-${expected}`, "algorithm.hash");
-			break;
-		}
+		case "RS512":
 		case "PS256":
 		case "PS384":
 		case "PS512": {
-			if (!isAlgorithm$3(key.algorithm, "RSA-PSS")) throw unusable$4("RSA-PSS");
+			const name = HASHED_SIGNATURE_ALGORITHMS[alg.slice(0, 2)];
+			if (!isAlgorithm(key.algorithm, name)) throw unusableKey(name);
 			const expected = Number.parseInt(alg.slice(2), 10);
-			if (getHashLength$1(key.algorithm.hash) !== expected) throw unusable$4(`SHA-${expected}`, "algorithm.hash");
+			if (hashBitsOf(key.algorithm.hash) !== expected) throw unusableKey(`SHA-${expected}`, "algorithm.hash");
 			break;
 		}
 		case "Ed25519":
 		case "EdDSA":
-			if (!isAlgorithm$3(key.algorithm, "Ed25519")) throw unusable$4("Ed25519");
+			if (!isAlgorithm(key.algorithm, "Ed25519")) throw unusableKey("Ed25519");
 			break;
 		case "ES256":
 		case "ES384":
 		case "ES512": {
-			if (!isAlgorithm$3(key.algorithm, "ECDSA")) throw unusable$4("ECDSA");
-			const expected = getNamedCurve$1(alg);
-			if (key.algorithm.namedCurve !== expected) throw unusable$4(expected, "algorithm.namedCurve");
+			if (!isAlgorithm(key.algorithm, "ECDSA")) throw unusableKey("ECDSA");
+			const expected = ECDSA_CURVES[alg];
+			if (key.algorithm.namedCurve !== expected) throw unusableKey(expected, "algorithm.namedCurve");
 			break;
 		}
-		default: throw new TypeError("CryptoKey does not support this operation");
+		default: throw new JWTError("CryptoKey does not support this operation", "ERR_JWK_INVALID");
 	}
-	checkUsage$4(key, usage);
+	checkKeyUsage(key, usage);
 }
 function subtleAlgorithm(alg, algorithm) {
-	const hash = `SHA-${alg.slice(-3)}`;
+	const hash = jwsHashOf(alg);
 	switch (alg) {
 		case "HS256":
 		case "HS384":
@@ -82,66 +84,65 @@ function subtleAlgorithm(alg, algorithm) {
 		case "ES512": return {
 			hash,
 			name: "ECDSA",
-			namedCurve: algorithm.namedCurve
+			namedCurve: namedCurveOf(algorithm)
 		};
 		case "Ed25519":
 		case "EdDSA": return { name: "Ed25519" };
-		default: throw new Error(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
-	}
-}
-function unusable$4(name, prop = "algorithm.name") {
-	return /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-}
-function isAlgorithm$3(algorithm, name) {
-	return algorithm.name === name;
-}
-function getHashLength$1(hash) {
-	return Number.parseInt(hash.name.slice(4), 10);
-}
-function getNamedCurve$1(alg) {
-	switch (alg) {
-		case "ES256": return "P-256";
-		case "ES384": return "P-384";
-		case "ES512": return "P-521";
-		default: throw new Error("unreachable");
+		default: throw new JWTError(`alg ${alg} is not supported either by JOSE or your javascript runtime`, "ERR_JWS_ALG_NOT_ALLOWED");
 	}
 }
-function checkUsage$4(key, usage) {
-	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
-}
 const IV_BIT_LENGTHS = {
-	A128GCM: 96,
-	A128GCMKW: 96,
-	A192GCM: 96,
-	A192GCMKW: 96,
-	A256GCM: 96,
-	A256GCMKW: 96,
+	"A128GCM": 96,
+	"A128GCMKW": 96,
+	"A192GCM": 96,
+	"A192GCMKW": 96,
+	"A256GCM": 96,
+	"A256GCMKW": 96,
 	"A128CBC-HS256": 128,
 	"A192CBC-HS384": 128,
 	"A256CBC-HS512": 128
 };
 const CEK_BIT_LENGTHS = {
-	A128GCM: 128,
-	A192GCM: 192,
-	A256GCM: 256,
+	"A128GCM": 128,
+	"A192GCM": 192,
+	"A256GCM": 256,
 	"A128CBC-HS256": 256,
 	"A192CBC-HS384": 384,
 	"A256CBC-HS512": 512
 };
 function bitLengthIV(alg) {
 	const length = IV_BIT_LENGTHS[alg];
-	if (length === void 0) throw new Error(`Unsupported JWE Algorithm: ${alg}`);
+	if (length === void 0) throw new JWTError(`Unsupported JWE Algorithm: ${quoteTokenValue(alg)}`, "ERR_JWE_INVALID");
 	return length;
 }
 function generateIV(alg) {
 	return crypto.getRandomValues(new Uint8Array(bitLengthIV(alg) >> 3));
 }
 function checkIvLength(enc, iv) {
-	if (iv.length << 3 !== bitLengthIV(enc)) throw new Error("Invalid Initialization Vector length");
+	if (iv.length << 3 !== bitLengthIV(enc)) throw new JWTError("Invalid Initialization Vector length", "ERR_JWE_INVALID");
+}
+const TAG_BIT_LENGTHS = {
+	"A128GCM": 128,
+	"A128GCMKW": 128,
+	"A192GCM": 128,
+	"A192GCMKW": 128,
+	"A256GCM": 128,
+	"A256GCMKW": 128,
+	"A128CBC-HS256": 128,
+	"A192CBC-HS384": 192,
+	"A256CBC-HS512": 256
+};
+function bitLengthTag(alg) {
+	const length = TAG_BIT_LENGTHS[alg];
+	if (length === void 0) throw new JWTError(`Unsupported JWE Algorithm: ${quoteTokenValue(alg)}`, "ERR_JWE_INVALID");
+	return length;
+}
+function checkTagLength(enc, tag) {
+	if (tag.length << 3 !== bitLengthTag(enc)) throw new JWTError("Invalid Authentication Tag length", "ERR_JWE_INVALID");
 }
 function bitLengthCEK(alg) {
 	const length = CEK_BIT_LENGTHS[alg];
-	if (length === void 0) throw new Error(`Unsupported JWE Algorithm: ${alg}`);
+	if (length === void 0) throw new JWTError(`Unsupported JWE Algorithm: ${quoteTokenValue(alg)}`, "ERR_JWE_INVALID");
 	return length;
 }
 function generateCEK(alg) {
@@ -149,7 +150,7 @@ function generateCEK(alg) {
 }
 function checkCEKLength(cek, expected) {
 	const actual = cek.byteLength << 3;
-	if (actual !== expected) throw new Error(`Invalid Content Encryption Key length. Expected ${expected} bits, got ${actual} bits`);
+	if (actual !== expected) throw new JWTError(`Invalid Content Encryption Key length. Expected ${expected} bits, got ${actual} bits`, "ERR_INVALID_OPTION");
 }
 function assertOctKeyLength(bytes, alg) {
 	if (!alg) return;
@@ -158,30 +159,26 @@ function assertOctKeyLength(bytes, alg) {
 		if (bytes.length < minBytes) throw new JWTError(`${alg} requires a key of at least ${minBytes} bytes (got ${bytes.length})`, "ERR_JWK_INVALID");
 		return;
 	}
-	const exactBits = /^A(128|192|256)(GCM)?KW$/.test(alg) ? Number.parseInt(alg.slice(1, 4), 10) : CEK_BIT_LENGTHS[alg];
+	const exactBits = /^A(128|192|256)(GCM)?KW$/.test(alg) ? aesBitsOf(alg) : CEK_BIT_LENGTHS[alg];
 	if (exactBits !== void 0 && bytes.length << 3 !== exactBits) throw new JWTError(`${alg} requires a key of exactly ${exactBits >> 3} bytes (got ${bytes.length})`, "ERR_JWK_INVALID");
 }
 function checkAESCryptoKey(key, alg, usage) {
 	switch (alg) {
 		case "A128GCM":
 		case "A192GCM":
-		case "A256GCM": {
-			if (!isAlgorithm$2(key.algorithm, "AES-GCM")) throw unusable$3("AES-GCM");
-			const expected = Number.parseInt(alg.slice(1, 4), 10);
-			if (key.algorithm.length !== expected) throw unusable$3(expected, "algorithm.length");
-			break;
-		}
+		case "A256GCM":
 		case "A128KW":
 		case "A192KW":
 		case "A256KW": {
-			if (!isAlgorithm$2(key.algorithm, "AES-KW")) throw unusable$3("AES-KW");
-			const expected = Number.parseInt(alg.slice(1, 4), 10);
-			if (key.algorithm.length !== expected) throw unusable$3(expected, "algorithm.length");
+			const name = alg.endsWith("KW") ? "AES-KW" : "AES-GCM";
+			if (!isAlgorithm(key.algorithm, name)) throw unusableKey(name);
+			const expected = aesBitsOf(alg);
+			if (key.algorithm.length !== expected) throw unusableKey(expected, "algorithm.length");
 			break;
 		}
-		default: throw new TypeError("CryptoKey does not support this operation");
+		default: throw new JWTError("CryptoKey does not support this operation", "ERR_JWK_INVALID");
 	}
-	checkUsage$3(key, usage);
+	checkKeyUsage(key, usage);
 }
 async function aesKwWrap(alg, key, cek) {
 	const cryptoKey = await getAESKWCryptoKey(key, alg, { usage: "wrapKey" });
@@ -202,18 +199,18 @@ async function aesKwUnwrap(alg, key, encryptedKey) {
 	return new Uint8Array(await crypto.subtle.exportKey("raw", cryptoKeyCek));
 }
 async function gcmkwEncrypt(alg, key, plaintext, iv) {
-	const wrapped = await encrypt(alg.slice(0, 7), plaintext, key, iv, new Uint8Array(0));
+	const wrapped = await encrypt(alg.slice(0, 7), plaintext, key, iv, /* @__PURE__ */ new Uint8Array(0));
 	return {
 		encryptedKey: wrapped.ciphertext,
-		iv: base64UrlEncode(wrapped.iv),
-		tag: base64UrlEncode(wrapped.tag)
+		iv: base64UrlStringify(wrapped.iv),
+		tag: base64UrlStringify(wrapped.tag)
 	};
 }
 async function gcmkwDecrypt(alg, key, ciphertext, iv, tag) {
-	return decrypt(alg.slice(0, 7), key, ciphertext, iv, tag, new Uint8Array(0));
+	return decrypt(alg.slice(0, 7), key, ciphertext, iv, tag, /* @__PURE__ */ new Uint8Array(0));
 }
 async function encrypt(enc, plaintext, cek, iv, aad) {
-	if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) throw new TypeError("Key must be one of type: CryptoKey or Uint8Array");
+	if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) throw new JWTError("Key must be one of type: CryptoKey or Uint8Array", "ERR_JWK_INVALID");
 	if (iv) checkIvLength(enc, iv);
 	else iv = generateIV(enc);
 	switch (enc) {
@@ -225,16 +222,17 @@ async function encrypt(enc, plaintext, cek, iv, aad) {
 		case "A128GCM":
 		case "A192GCM":
 		case "A256GCM":
-			if (cek instanceof Uint8Array) checkCEKLength(cek, Number.parseInt(enc.slice(1, 4), 10));
+			if (cek instanceof Uint8Array) checkCEKLength(cek, aesBitsOf(enc));
 			return gcmEncrypt(enc, plaintext, cek, iv, aad);
-		default: throw new Error("Unsupported JWE Content Encryption Algorithm");
+		default: throw new JWTError("Unsupported JWE Content Encryption Algorithm", "ERR_JWE_INVALID");
 	}
 }
 async function decrypt(enc, cek, ciphertext, iv, tag, aad) {
-	if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) throw new TypeError("Key must be one of type: CryptoKey or Uint8Array");
-	if (!iv) throw new Error("JWE Initialization Vector missing");
-	if (!tag) throw new Error("JWE Authentication Tag missing");
+	if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) throw new JWTError("Key must be one of type: CryptoKey or Uint8Array", "ERR_JWK_INVALID");
+	if (!iv) throw new JWTError("JWE Initialization Vector missing", "ERR_JWE_INVALID");
+	if (!tag) throw new JWTError("JWE Authentication Tag missing", "ERR_JWE_INVALID");
 	checkIvLength(enc, iv);
+	checkTagLength(enc, tag);
 	switch (enc) {
 		case "A128CBC-HS256":
 		case "A192CBC-HS384":
@@ -244,20 +242,11 @@ async function decrypt(enc, cek, ciphertext, iv, tag, aad) {
 		case "A128GCM":
 		case "A192GCM":
 		case "A256GCM":
-			if (cek instanceof Uint8Array) checkCEKLength(cek, Number.parseInt(enc.slice(1, 4), 10));
+			if (cek instanceof Uint8Array) checkCEKLength(cek, aesBitsOf(enc));
 			return gcmDecrypt(enc, cek, ciphertext, iv, tag, aad);
-		default: throw new Error("Unsupported JWE Content Encryption Algorithm");
+		default: throw new JWTError("Unsupported JWE Content Encryption Algorithm", "ERR_JWE_INVALID");
 	}
 }
-function unusable$3(name, prop = "algorithm.name") {
-	return /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-}
-function isAlgorithm$2(algorithm, name) {
-	return algorithm.name === name;
-}
-function checkUsage$3(key, usage) {
-	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
-}
 async function getAESKWCryptoKey(key, alg, options = {}) {
 	const { extractable = true, usage } = options;
 	if (key instanceof Uint8Array) return crypto.subtle.importKey("raw", key, "AES-KW", extractable, [usage ?? "wrapKey"]);
@@ -265,10 +254,10 @@ async function getAESKWCryptoKey(key, alg, options = {}) {
 	return key;
 }
 function checkAESKWKeySize(key, alg) {
-	if (key.algorithm.length !== Number.parseInt(alg.slice(1, 4), 10)) throw new TypeError(`Invalid key size for alg: ${alg}`);
+	if (lengthOf(key.algorithm) !== aesBitsOf(alg)) throw new JWTError(`Invalid key size for alg: ${alg}`, "ERR_JWK_INVALID");
 }
 async function importCBCKeys(enc, cek, usage) {
-	const keySize = Number.parseInt(enc.slice(1, 4), 10);
+	const keySize = aesBitsOf(enc);
 	const [encKey, macKey] = await Promise.all([crypto.subtle.importKey("raw", cek.subarray(keySize >> 3), "AES-CBC", false, [usage]), crypto.subtle.importKey("raw", cek.subarray(0, keySize >> 3), {
 		hash: `SHA-${keySize << 1}`,
 		name: "HMAC"
@@ -283,7 +272,7 @@ function cbcMacData(aad, iv, ciphertext) {
 	return concatUint8Arrays(aad, iv, ciphertext, uint64be(aad.length << 3));
 }
 async function cbcEncrypt(enc, plaintext, cek, iv, aad) {
-	if (!(cek instanceof Uint8Array)) throw new TypeError("CBC key must be of type Uint8Array");
+	if (!(cek instanceof Uint8Array)) throw new JWTError("CBC key must be of type Uint8Array", "ERR_JWK_INVALID");
 	const { encKey, macKey, keySize } = await importCBCKeys(enc, cek, "encrypt");
 	const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
 		iv,
@@ -317,7 +306,7 @@ async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
 	};
 }
 async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
-	if (!(cek instanceof Uint8Array)) throw new TypeError("CBC key must be of type Uint8Array");
+	if (!(cek instanceof Uint8Array)) throw new JWTError("CBC key must be of type Uint8Array", "ERR_JWK_INVALID");
 	const { encKey, macKey, keySize } = await importCBCKeys(enc, cek, "decrypt");
 	const macData = cbcMacData(aad, iv, ciphertext);
 	const expectedTag = new Uint8Array((await crypto.subtle.sign("HMAC", macKey, macData)).slice(0, keySize >> 3));
@@ -325,7 +314,7 @@ async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
 	try {
 		macCheckPassed = await timingSafeEqual(tag, expectedTag);
 	} catch {}
-	if (!macCheckPassed) throw new Error("JWE Decryption Failed");
+	if (!macCheckPassed) throw new JWTError("JWE Decryption Failed", "ERR_JWE_DECRYPTION_FAILED");
 	let plaintext;
 	try {
 		plaintext = new Uint8Array(await crypto.subtle.decrypt({
@@ -333,7 +322,7 @@ async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
 			name: "AES-CBC"
 		}, encKey, ciphertext));
 	} catch {}
-	if (!plaintext) throw new Error("JWE Decryption Failed");
+	if (!plaintext) throw new JWTError("JWE Decryption Failed", "ERR_JWE_DECRYPTION_FAILED");
 	return plaintext;
 }
 async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
@@ -351,7 +340,7 @@ async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
 			tagLength: 128
 		}, encKey, concatUint8Arrays(ciphertext, tag)));
 	} catch {
-		throw new Error("JWE Decryption Failed");
+		throw new JWTError("JWE Decryption Failed", "ERR_JWE_DECRYPTION_FAILED");
 	}
 }
 let _timingSafeKey;
@@ -363,8 +352,8 @@ function getTimingSafeKey() {
 	return _timingSafeKey;
 }
 async function timingSafeEqual(a, b) {
-	if (!(a instanceof Uint8Array)) throw new TypeError("First argument must be a buffer");
-	if (!(b instanceof Uint8Array)) throw new TypeError("Second argument must be a buffer");
+	if (!(a instanceof Uint8Array)) throw new JWTError("First argument must be a buffer", "ERR_INVALID_OPTION");
+	if (!(b instanceof Uint8Array)) throw new JWTError("Second argument must be a buffer", "ERR_INVALID_OPTION");
 	const algorithm = {
 		name: "HMAC",
 		hash: "SHA-256"
@@ -377,36 +366,40 @@ async function timingSafeEqual(a, b) {
 	while (++i < 32) out |= aHmac[i] ^ bHmac[i];
 	return out === 0;
 }
-function writeUInt32BE$1(buf, value, offset) {
-	if (value < 0 || value >= 2 ** 32) throw new RangeError(`value must be >= 0 and <= ${2 ** 32 - 1}. Received ${value}`);
-	buf.set([
-		value >>> 24,
-		value >>> 16,
-		value >>> 8,
-		value & 255
-	], offset);
-}
 function uint64be(value) {
-	const high = Math.floor(value / 2 ** 32);
-	const low = value % 2 ** 32;
-	const buf = new Uint8Array(8);
-	writeUInt32BE$1(buf, high, 0);
-	writeUInt32BE$1(buf, low, 4);
-	return buf;
-}
-async function jwkTokey(jwk) {
-	if (!jwk.alg) throw new TypeError("\"alg\" argument is required when \"jwk.alg\" is not present");
+	return concatUint8Arrays(uint32be(Math.floor(value / 2 ** 32)), uint32be(value % 2 ** 32));
+}
+async function jwkTokey(jwk, options = {}) {
+	if (!jwk.alg) throw new JWTError("\"alg\" argument is required when \"jwk.alg\" is not present", "ERR_JWK_INVALID");
 	const { algorithm, keyUsages } = subtleMapping(jwk);
-	return crypto.subtle.importKey("jwk", jwk, algorithm, jwk.ext ?? (jwk.d ? false : true), jwk.key_ops ?? keyUsages);
+	const isPrivate = "d" in jwk && jwk.d !== void 0;
+	const extractable = jwk.ext === false ? false : options.extractable ?? !isPrivate;
+	try {
+		return await crypto.subtle.importKey("jwk", jwk, algorithm, extractable, permittedUsages(jwk, keyUsages));
+	} catch (error) {
+		if (error instanceof JWTError) throw error;
+		throw new JWTError(`Key is not usable for ${quoteTokenValue(jwk.alg)}.`, "ERR_JWK_INVALID", error);
+	}
 }
 async function keyToJWK(key) {
-	if (key instanceof Uint8Array) return {
+	let jwk;
+	if (key instanceof Uint8Array) jwk = {
 		kty: "oct",
-		k: base64UrlEncode(key)
+		k: base64UrlStringify(key)
 	};
-	if (!isCryptoKey(key)) throw new TypeError("Key must be one of type: CryptoKey or Uint8Array");
-	if (!key.extractable) throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");
-	return await crypto.subtle.exportKey("jwk", key);
+	else {
+		if (!isCryptoKey(key)) throw new JWTError("Key must be one of type: CryptoKey or Uint8Array", "ERR_JWK_INVALID");
+		if (!key.extractable) throw new JWTError("non-extractable CryptoKey cannot be exported as a JWK", "ERR_JWK_INVALID");
+		jwk = await crypto.subtle.exportKey("jwk", key);
+	}
+	return jwk;
+}
+function permittedUsages(jwk, keyUsages) {
+	const keyOps = jwk.key_ops;
+	if (!keyOps || keyUsages.length === 0) return keyUsages;
+	const permitted = keyUsages.filter((usage) => keyOps.includes(usage));
+	if (permitted.length === 0) throw new JWTError(`JWK "key_ops" does not permit ${keyUsages.join(", ")}.`, "ERR_JWK_INVALID");
+	return permitted;
 }
 function subtleMapping(jwk) {
 	let algorithm;
@@ -419,18 +412,18 @@ function subtleMapping(jwk) {
 				case "PS512":
 					algorithm = {
 						name: "RSA-PSS",
-						hash: `SHA-${jwk.alg.slice(-3)}`
+						hash: jwsHashOf(jwk.alg)
 					};
-					keyUsages = jwk.d ? ["sign"] : ["verify"];
+					keyUsages = hasPrivateMember(jwk) ? ["sign"] : ["verify"];
 					break;
 				case "RS256":
 				case "RS384":
 				case "RS512":
 					algorithm = {
 						name: "RSASSA-PKCS1-v1_5",
-						hash: `SHA-${jwk.alg.slice(-3)}`
+						hash: jwsHashOf(jwk.alg)
 					};
-					keyUsages = jwk.d ? ["sign"] : ["verify"];
+					keyUsages = hasPrivateMember(jwk) ? ["sign"] : ["verify"];
 					break;
 				case "RSA-OAEP":
 				case "RSA-OAEP-256":
@@ -438,35 +431,23 @@ function subtleMapping(jwk) {
 				case "RSA-OAEP-512":
 					algorithm = {
 						name: "RSA-OAEP",
-						hash: `SHA-${Number.parseInt(jwk.alg.slice(-3), 10) || 1}`
+						hash: rsaOaepHashOf(jwk.alg)
 					};
-					keyUsages = jwk.d ? ["decrypt", "unwrapKey"] : ["encrypt", "wrapKey"];
+					keyUsages = hasPrivateMember(jwk) ? ["decrypt", "unwrapKey"] : ["encrypt", "wrapKey"];
 					break;
-				default: throw new Error("Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value");
+				default: throw new JWTError(`Invalid or unsupported JWK "alg" (Algorithm) Parameter value: ${quoteTokenValue(jwk.alg)}.`, "ERR_JWK_INVALID");
 			}
 			break;
 		case "EC":
 			switch (jwk.alg) {
 				case "ES256":
-					algorithm = {
-						name: "ECDSA",
-						namedCurve: "P-256"
-					};
-					keyUsages = jwk.d ? ["sign"] : ["verify"];
-					break;
 				case "ES384":
-					algorithm = {
-						name: "ECDSA",
-						namedCurve: "P-384"
-					};
-					keyUsages = jwk.d ? ["sign"] : ["verify"];
-					break;
 				case "ES512":
 					algorithm = {
 						name: "ECDSA",
-						namedCurve: "P-521"
+						namedCurve: ECDSA_CURVES[jwk.alg]
 					};
-					keyUsages = jwk.d ? ["sign"] : ["verify"];
+					keyUsages = hasPrivateMember(jwk) ? ["sign"] : ["verify"];
 					break;
 				case "ECDH-ES":
 				case "ECDH-ES+A128KW":
@@ -474,37 +455,49 @@ function subtleMapping(jwk) {
 				case "ECDH-ES+A256KW":
 					algorithm = {
 						name: "ECDH",
-						namedCurve: jwk.crv
+						namedCurve: requireCurve(jwk, [
+							"P-256",
+							"P-384",
+							"P-521"
+						])
 					};
-					keyUsages = jwk.d ? ["deriveBits"] : [];
+					keyUsages = hasPrivateMember(jwk) ? ["deriveBits"] : [];
 					break;
-				default: throw new Error("Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value");
+				default: throw new JWTError(`Invalid or unsupported JWK "alg" (Algorithm) Parameter value: ${quoteTokenValue(jwk.alg)}.`, "ERR_JWK_INVALID");
 			}
 			break;
 		case "OKP":
 			switch (jwk.alg) {
 				case "Ed25519":
 				case "EdDSA":
-					algorithm = { name: "Ed25519" };
-					keyUsages = jwk.d ? ["sign"] : ["verify"];
+					algorithm = { name: requireCurve(jwk, ["Ed25519"]) };
+					keyUsages = hasPrivateMember(jwk) ? ["sign"] : ["verify"];
 					break;
 				case "ECDH-ES":
 				case "ECDH-ES+A128KW":
 				case "ECDH-ES+A192KW":
 				case "ECDH-ES+A256KW":
-					algorithm = { name: jwk.crv };
-					keyUsages = jwk.d ? ["deriveBits"] : [];
+					algorithm = { name: requireCurve(jwk, ["X25519"]) };
+					keyUsages = hasPrivateMember(jwk) ? ["deriveBits"] : [];
 					break;
-				default: throw new Error("Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value");
+				default: throw new JWTError(`Invalid or unsupported JWK "alg" (Algorithm) Parameter value: ${quoteTokenValue(jwk.alg)}.`, "ERR_JWK_INVALID");
 			}
 			break;
-		default: throw new Error("Invalid or unsupported JWK \"kty\" (Key Type) Parameter value");
+		default: throw new JWTError(`Invalid or unsupported JWK "kty" (Key Type) Parameter value: ${quoteTokenValue(jwk.kty)}.`, "ERR_JWK_INVALID");
 	}
 	return {
 		algorithm,
 		keyUsages
 	};
 }
+function requireCurve(jwk, allowed) {
+	const crv = "crv" in jwk ? jwk.crv : void 0;
+	if (typeof crv !== "string" || !allowed.includes(crv)) throw new JWTError(`Invalid or unsupported JWK "crv" (Curve) Parameter value: ${quoteTokenValue(crv)}. Expected one of: ${allowed.join(", ")}.`, "ERR_JWK_INVALID");
+	return crv;
+}
+function hasPrivateMember(jwk) {
+	return "d" in jwk && Boolean(jwk.d);
+}
 async function encryptRSAES(alg, key, cek) {
 	checkRSACryptoKey(key, alg, "encrypt");
 	checkRSAModulusLength(alg, key);
@@ -516,60 +509,49 @@ async function decryptRSAES(alg, key, encryptedKey) {
 	return new Uint8Array(await crypto.subtle.decrypt("RSA-OAEP", key, encryptedKey));
 }
 function checkRSACryptoKey(key, alg, usage) {
-	if (!isAlgorithm$1(key.algorithm, "RSA-OAEP")) throw unusable$2("RSA-OAEP");
+	if (!isAlgorithm(key.algorithm, "RSA-OAEP")) throw unusableKey("RSA-OAEP");
 	const expected = Number.parseInt(alg.slice(9), 10) || 1;
-	if (getHashLength(key.algorithm.hash) !== expected) throw unusable$2(`SHA-${expected}`, "algorithm.hash");
-	checkUsage$2(key, usage);
+	if (hashBitsOf(key.algorithm.hash) !== expected) throw unusableKey(`SHA-${expected}`, "algorithm.hash");
+	checkKeyUsage(key, usage);
 }
 function checkRSAModulusLength(alg, key) {
 	if (alg.startsWith("RS") || alg.startsWith("PS") || alg.startsWith("RSA")) {
-		const { modulusLength } = key.algorithm;
-		if (typeof modulusLength !== "number" || modulusLength < 2048) throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
+		const modulusLength = modulusLengthOf(key.algorithm);
+		if (typeof modulusLength !== "number" || modulusLength < 2048) throw new JWTError(`${alg} requires key modulusLength to be 2048 bits or larger`, "ERR_JWK_INVALID");
 	}
 }
-function unusable$2(name, prop = "algorithm.name") {
-	return /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-}
-function isAlgorithm$1(algorithm, name) {
-	return algorithm.name === name;
-}
-function getHashLength(hash) {
-	return Number.parseInt(hash.name.slice(4), 10);
-}
-function checkUsage$2(key, usage) {
-	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
-}
-async function deriveECDHESKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) {
+async function deriveECDHESKey(publicKey, privateKey, algorithm, keyLength, apu = /* @__PURE__ */ new Uint8Array(0), apv = /* @__PURE__ */ new Uint8Array(0)) {
 	checkECDHCryptoKey(publicKey, "ECDH");
 	checkECDHCryptoKey(privateKey, "ECDH", "deriveBits");
 	const value = concatUint8Arrays(lengthAndInput(textEncoder.encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength));
-	const length = publicKey.algorithm.name === "X25519" ? 256 : Math.ceil(Number.parseInt(publicKey.algorithm.namedCurve.slice(-3), 10) / 8) << 3;
+	const length = publicKey.algorithm.name === "X25519" ? 256 : Math.ceil(Number.parseInt((namedCurveOf(publicKey.algorithm) ?? "").slice(-3), 10) / 8) << 3;
 	return concatKdf(new Uint8Array(await crypto.subtle.deriveBits({
 		name: publicKey.algorithm.name,
 		public: publicKey
 	}, privateKey, length)), keyLength, value);
 }
-function isECDHKeyAllowed(key) {
-	switch (key.algorithm.namedCurve) {
+function ecdhDerivedBits(alg, enc) {
+	return alg === "ECDH-ES" ? bitLengthCEK(enc) : Number.parseInt(alg.slice(-5, -2), 10);
+}
+function generateEphemeralKeyPair(recipientKey) {
+	return crypto.subtle.generateKey(recipientKey.algorithm, true, ["deriveBits"]);
+}
+function assertECDHKeyAllowed(key) {
+	switch (namedCurveOf(key.algorithm) ?? key.algorithm.name) {
 		case "P-256":
 		case "P-384":
-		case "P-521": return true;
-		default: return key.algorithm.name === "X25519";
+		case "P-521":
+		case "X25519": return;
+		default: throw new JWTError("ECDH with the provided key is not allowed or not supported", "ERR_JWK_INVALID");
 	}
 }
 function checkECDHCryptoKey(key, alg, usage) {
 	switch (key.algorithm.name) {
 		case "ECDH":
 		case "X25519": break;
-		default: throw unusable$1("ECDH or X25519");
+		default: throw unusableKey("ECDH or X25519");
 	}
-	checkUsage$1(key, usage);
-}
-function unusable$1(name, prop = "algorithm.name") {
-	return /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-}
-function checkUsage$1(key, usage) {
-	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+	checkKeyUsage(key, usage);
 }
 async function concatKdf(secret, bits, value) {
 	const iterations = Math.ceil((bits >> 3) / 32);
@@ -589,39 +571,48 @@ function lengthAndInput(input) {
 async function digest(algorithm, data) {
 	return new Uint8Array(await crypto.subtle.digest(`SHA-${algorithm.slice(-3)}`, data));
 }
-function writeUInt32BE(buf, value, offset) {
-	if (value < 0 || value >= 2 ** 32) throw new RangeError(`value must be >= 0 and <= ${2 ** 32 - 1}. Received ${value}`);
-	buf.set([
-		value >>> 24,
-		value >>> 16,
-		value >>> 8,
-		value & 255
-	], offset);
-}
-function uint32be(value) {
-	const buf = new Uint8Array(4);
-	writeUInt32BE(buf, value, 0);
-	return buf;
-}
 const DEFAULT_PBES2_MIN_ITERATIONS = 1e3;
-const DEFAULT_PBES2_MAX_ITERATIONS = 1e6;
+const DEFAULT_PBES2_ITERATIONS = 6e5;
+const DEFAULT_PBES2_MAX_ITERATIONS = DEFAULT_PBES2_ITERATIONS;
+function assertPBES2Params(params) {
+	const { p2s, p2c } = params;
+	if (p2s !== void 0) assertPBES2Salt(p2s, "\"p2s\"");
+	if (p2c === void 0) return;
+	assertPBES2Count(p2c, "\"p2c\"");
+	if (p2c > 6e5) throw new JWTError(`"p2c" must be between ${DEFAULT_PBES2_MIN_ITERATIONS} and ${DEFAULT_PBES2_MAX_ITERATIONS} iterations (got ${p2c}).`, "ERR_INVALID_OPTION");
+}
+function assertPBES2Salt(salt, name) {
+	if (salt instanceof Uint8Array && salt.length >= 8) return;
+	throw new JWTError(`${name} must be 8 or more octets (RFC 7518 §4.8.1.1).`, "ERR_INVALID_OPTION");
+}
+function assertPBES2Count(count, name) {
+	if (typeof count !== "number" || !Number.isInteger(count) || count < 1) throw new JWTError(`${name} must be a positive integer.`, "ERR_INVALID_OPTION");
+	if (count < 1e3) throw new JWTError(`${name} must be at least ${DEFAULT_PBES2_MIN_ITERATIONS} iterations (got ${count}).`, "ERR_INVALID_OPTION");
+}
 async function pbes2Wrap(alg, key, cek, p2c, p2s) {
 	const derived = await deriveKey(p2s, alg, p2c, key);
 	return {
-		encryptedKey: await aesKwWrap(alg.slice(-6), derived, cek),
+		encryptedKey: await aesKwWrap(innerKeyWrapAlg(alg), derived, cek),
 		p2c,
-		p2s: base64UrlEncode(p2s)
+		p2s: base64UrlStringify(p2s)
 	};
 }
-async function pbes2Unwrap(alg, key, encryptedKey, p2c, p2s, minIterations = DEFAULT_PBES2_MIN_ITERATIONS, maxIterations = DEFAULT_PBES2_MAX_ITERATIONS) {
+function assertPBES2Iterations(p2c, bounds) {
+	const { minIterations = DEFAULT_PBES2_MIN_ITERATIONS, maxIterations = DEFAULT_PBES2_MAX_ITERATIONS } = bounds;
 	if (p2c < minIterations) throw new JWTError(`PBES2 "p2c" below the minimum of ${minIterations} iterations (got ${p2c}).`, "ERR_JWE_INVALID");
 	if (p2c > maxIterations) throw new JWTError(`PBES2 "p2c" above the maximum of ${maxIterations} iterations (got ${p2c}).`, "ERR_JWE_INVALID");
+}
+async function pbes2Unwrap(alg, key, encryptedKey, p2c, p2s, minIterations, maxIterations) {
+	assertPBES2Iterations(p2c, {
+		minIterations,
+		maxIterations
+	});
 	const derived = await deriveKey(p2s, alg, p2c, key);
-	return aesKwUnwrap(alg.slice(-6), derived, encryptedKey);
+	return aesKwUnwrap(innerKeyWrapAlg(alg), derived, encryptedKey);
 }
 async function deriveKey(p2s, alg, p2c, key) {
-	if (!(p2s instanceof Uint8Array) || p2s.length < 8) throw new Error("PBES2 Salt Input must be 8 or more octets");
-	if (p2c === void 0 || p2c < 1) throw new Error("PBES2 Iteration Count Parameter must be a positive integer");
+	assertPBES2Salt(p2s, "\"p2s\"");
+	if (p2c === void 0 || p2c < 1) throw new JWTError("PBES2 Iteration Count Parameter must be a positive integer", "ERR_INVALID_OPTION");
 	const salt = concatUint8Arrays(textEncoder.encode(alg), new Uint8Array([0]), p2s);
 	const keylen = Number.parseInt(alg.slice(13, 16), 10);
 	const subtleAlg = {
@@ -634,17 +625,8 @@ async function deriveKey(p2s, alg, p2c, key) {
 	return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
 }
 function checkPBES2CryptoKey(key, alg, usage) {
-	if (!isAlgorithm(key.algorithm, "PBKDF2")) throw unusable("PBKDF2");
-	checkUsage(key, usage);
-}
-function unusable(name, prop = "algorithm.name") {
-	return /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-}
-function isAlgorithm(algorithm, name) {
-	return algorithm.name === name;
-}
-function checkUsage(key, usage) {
-	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+	if (!isAlgorithm(key.algorithm, "PBKDF2")) throw unusableKey("PBKDF2");
+	checkKeyUsage(key, usage);
 }
 async function getPBKDF2CryptoKey(key, alg, options = {}) {
 	const { extractable = false, usage = "deriveBits" } = options;
@@ -652,20 +634,6 @@ async function getPBKDF2CryptoKey(key, alg, options = {}) {
 	checkPBES2CryptoKey(key, alg, usage);
 	return key;
 }
-const PUBLIC_EPK_FIELDS = new Set([
-	"kty",
-	"crv",
-	"x",
-	"y",
-	"kid",
-	"use",
-	"key_ops",
-	"alg",
-	"x5c",
-	"x5t",
-	"x5t#S256",
-	"x5u"
-]);
 async function encryptKey(alg, enc, key, providedCek, providedParameters = {}) {
 	let encryptedKey;
 	let parameters = {};
@@ -677,34 +645,15 @@ async function encryptKey(alg, enc, key, providedCek, providedParameters = {}) {
 		case "ECDH-ES":
 		case "ECDH-ES+A128KW":
 		case "ECDH-ES+A192KW":
-		case "ECDH-ES+A256KW": {
+		case "ECDH-ES+A256KW":
 			assertCryptoKey(key);
-			if (!isECDHKeyAllowed(key)) throw new Error("ECDH with the provided key is not allowed or not supported by your javascript runtime");
-			const { apu, apv, epk: providedEpk, epkPrivateKey } = providedParameters;
-			if (providedEpk && !epkPrivateKey) throw new TypeError("ECDH-ES custom ephemeral key material must include the matching private key.");
-			let ephemeralPrivateKey;
-			let epkHeader;
-			if (epkPrivateKey) {
-				ephemeralPrivateKey = await ensurePrivateKey(alg, epkPrivateKey);
-				epkHeader = await exportPublicJwkFrom(alg, providedEpk ?? epkPrivateKey);
-			} else {
-				if (providedEpk) throw new TypeError("ECDH-ES custom ephemeral public key requires a matching private key.");
-				const generated = await crypto.subtle.generateKey(key.algorithm, true, ["deriveBits"]);
-				ephemeralPrivateKey = generated.privateKey;
-				epkHeader = await exportPublicJwkFrom(alg, generated.publicKey);
-			}
-			const sharedSecret = await deriveECDHESKey(key, ephemeralPrivateKey, alg === "ECDH-ES" ? enc : alg, alg === "ECDH-ES" ? bitLengthCEK(enc) : Number.parseInt(alg.slice(-5, -2), 10), apu, apv);
-			parameters = { epk: epkHeader };
-			if (apu) parameters.apu = base64UrlEncode(apu);
-			if (apv) parameters.apv = base64UrlEncode(apv);
-			if (alg === "ECDH-ES") {
-				cek = sharedSecret;
-				break;
-			}
-			cek = providedCek || generateCEK(enc);
-			encryptedKey = await aesKwWrap(alg.slice(-6), sharedSecret, cek);
+			({cek, encryptedKey, parameters} = await ecdhesWrap(alg, {
+				enc,
+				recipientKey: key,
+				cek: providedCek,
+				parameters: providedParameters
+			}));
 			break;
-		}
 		case "RSA-OAEP":
 		case "RSA-OAEP-256":
 		case "RSA-OAEP-384":
@@ -718,6 +667,7 @@ async function encryptKey(alg, enc, key, providedCek, providedParameters = {}) {
 		case "PBES2-HS512+A256KW": {
 			cek = providedCek || generateCEK(enc);
 			const { p2c, p2s } = providedParameters;
+			if (p2c === void 0 || p2s === void 0) throw new JWTError(`${alg} requires "p2c" and "p2s"`, "ERR_JWE_INVALID");
 			({encryptedKey, ...parameters} = await pbes2Wrap(alg, key, cek, p2c, p2s));
 			break;
 		}
@@ -735,7 +685,7 @@ async function encryptKey(alg, enc, key, providedCek, providedParameters = {}) {
 			({encryptedKey, ...parameters} = await gcmkwEncrypt(alg, key, cek, iv));
 			break;
 		}
-		default: throw new Error("Invalid or unsupported \"alg\" (JWE Algorithm) header value");
+		default: throw new JWTError(`Invalid or unsupported "alg" (JWE Algorithm) header value: ${quoteTokenValue(alg)}`, "ERR_JWE_ALG_NOT_ALLOWED");
 	}
 	return {
 		cek,
@@ -743,52 +693,127 @@ async function encryptKey(alg, enc, key, providedCek, providedParameters = {}) {
 		parameters
 	};
 }
-async function normalizeKey(key, alg) {
-	if (key instanceof Uint8Array) return key;
-	if (isCryptoKey(key)) return key;
-	if (isJWK(key)) {
-		if ("k" in key && key.k) return base64UrlDecode(key.k, { returnAs: "uint8array" });
-		return jwkTokey(key.alg ? key : {
-			...key,
-			alg
-		});
+async function ecdhesWrap(alg, options) {
+	const { enc, recipientKey } = options;
+	const { apu, apv, epk: providedEpk, epkPrivateKey } = options.parameters;
+	assertECDHKeyAllowed(recipientKey);
+	if (providedEpk && !epkPrivateKey) throw new JWTError("ECDH-ES custom ephemeral key material must include the matching private key.", "ERR_JWK_INVALID");
+	let ephemeralPrivateKey;
+	let epk;
+	if (epkPrivateKey) {
+		ephemeralPrivateKey = await ensurePrivateKey(alg, epkPrivateKey);
+		assertEphemeralCurve(ephemeralPrivateKey, recipientKey);
+		epk = await exportPublicJwkFrom(providedEpk ?? epkPrivateKey);
+	} else {
+		const generated = await generateEphemeralKeyPair(recipientKey);
+		ephemeralPrivateKey = generated.privateKey;
+		epk = await exportPublicJwkFrom(generated.publicKey);
+	}
+	const kdfAlg = alg === "ECDH-ES" ? contentAlgorithm(enc) : alg;
+	const sharedSecret = await deriveECDHESKey(recipientKey, ephemeralPrivateKey, kdfAlg, ecdhDerivedBits(alg, kdfAlg), apu, apv);
+	const parameters = { epk };
+	if (apu) parameters.apu = base64UrlStringify(apu);
+	if (apv) parameters.apv = base64UrlStringify(apv);
+	if (alg === "ECDH-ES") return {
+		cek: sharedSecret,
+		parameters
+	};
+	const cek = options.cek ?? generateCEK(contentAlgorithm(enc));
+	return {
+		cek,
+		encryptedKey: await aesKwWrap(innerKeyWrapAlg(alg), sharedSecret, cek),
+		parameters
+	};
+}
+async function normalizeEpk(epk, options) {
+	const recipientCurve = cryptoKeyCurve(options.recipientKey);
+	if (isCryptoKey(epk)) {
+		if (epk.type !== "public") throw invalidEpk("must not contain private key material.");
+		assertEpkCurve(cryptoKeyCurve(epk), recipientCurve);
+		return epk;
 	}
-	throw new Error("unreachable");
+	if (!isJWK(epk) || epk.kty !== "EC" && epk.kty !== "OKP") throw invalidEpk("must be an EC or OKP public key.");
+	if ("d" in epk && epk.d !== void 0) throw invalidEpk("must not contain private key material.");
+	const crv = epk.crv;
+	const allowed = epk.kty === "EC" ? EC_ECDH_CURVES : OKP_ECDH_CURVES;
+	if (typeof crv !== "string" || !allowed.has(crv)) throw invalidEpk(`curve ${quoteTokenValue(crv)} is not supported for ${options.alg}.`);
+	assertEpkCurve(crv, recipientCurve);
+	const x = epk.x;
+	const y = epk.kty === "EC" ? epk.y : void 0;
+	if (typeof x !== "string" || epk.kty === "EC" && typeof y !== "string") throw invalidEpk("is missing its public coordinates.");
+	return jwkTokey(epk.kty === "EC" && typeof y === "string" ? {
+		kty: "EC",
+		crv,
+		x,
+		y,
+		alg: options.alg
+	} : {
+		kty: "OKP",
+		crv,
+		x,
+		alg: options.alg
+	});
+}
+const EC_ECDH_CURVES = /* @__PURE__ */ new Set([
+	"P-256",
+	"P-384",
+	"P-521"
+]);
+const OKP_ECDH_CURVES = /* @__PURE__ */ new Set(["X25519"]);
+function contentAlgorithm(enc) {
+	if (enc) return enc;
+	throw new JWTError("ECDH-ES requires \"enc\", the content encryption algorithm the key is agreed for.", "ERR_JWE_INVALID");
+}
+function assertEphemeralCurve(ephemeralKey, recipientKey) {
+	assertECDHKeyAllowed(ephemeralKey);
+	const ephemeralCurve = cryptoKeyCurve(ephemeralKey);
+	const recipientCurve = cryptoKeyCurve(recipientKey);
+	if (ephemeralCurve === recipientCurve) return;
+	throw new JWTError(`ECDH-ES ephemeral key curve ${quoteTokenValue(ephemeralCurve)} does not match the recipient key curve ${quoteTokenValue(recipientCurve)}.`, "ERR_JWK_INVALID");
+}
+function invalidEpk(detail) {
+	return new JWTError(`Invalid JWE: "epk" ${detail}`, "ERR_JWE_INVALID");
+}
+function assertEpkCurve(epkCurve, recipientCurve) {
+	if (!recipientCurve || !epkCurve || epkCurve === recipientCurve) return;
+	throw invalidEpk(`curve "${epkCurve}" does not match the recipient key curve "${recipientCurve}".`);
 }
 function toPublicEpkJwk(jwk) {
-	const filtered = {};
-	for (const [key, value] of Object.entries(jwk)) if (value !== void 0 && PUBLIC_EPK_FIELDS.has(key)) filtered[key] = value;
-	const { kty, crv, x, y } = filtered;
-	if (typeof kty !== "string") throw new TypeError("ECDH-ES ephemeral key JWK must include the \"kty\" parameter.");
-	if (typeof crv !== "string") throw new TypeError("ECDH-ES ephemeral key JWK must include the \"crv\" parameter.");
-	if (typeof x !== "string") throw new TypeError("ECDH-ES ephemeral key JWK must include the \"x\" coordinate.");
-	if (kty === "EC" && typeof y !== "string") throw new TypeError("ECDH-ES EC ephemeral key JWK must include both \"x\" and \"y\" coordinates.");
-	const publicJwk = {
-		...filtered,
+	const { kty } = jwk;
+	const crv = "crv" in jwk ? jwk.crv : void 0;
+	const x = "x" in jwk ? jwk.x : void 0;
+	if (kty !== "EC" && kty !== "OKP") throw new JWTError("ECDH-ES ephemeral key JWK \"kty\" must be \"EC\" or \"OKP\".", "ERR_JWK_INVALID");
+	if (typeof crv !== "string") throw new JWTError("ECDH-ES ephemeral key JWK must include the \"crv\" parameter.", "ERR_JWK_INVALID");
+	if (typeof x !== "string") throw new JWTError("ECDH-ES ephemeral key JWK must include the \"x\" coordinate.", "ERR_JWK_INVALID");
+	if (kty === "OKP") return {
 		kty,
 		crv,
 		x
 	};
-	if (typeof y === "string") publicJwk.y = y;
-	else delete publicJwk.y;
-	return sanitizeObjectCopy(publicJwk);
+	const y = "y" in jwk ? jwk.y : void 0;
+	if (typeof y !== "string") throw new JWTError("ECDH-ES EC ephemeral key JWK must include both \"x\" and \"y\" coordinates.", "ERR_JWK_INVALID");
+	return {
+		kty,
+		crv,
+		x,
+		y
+	};
 }
 async function ensurePrivateKey(alg, value) {
-	const normalized = await normalizeKey(value, alg);
-	if (!(normalized instanceof CryptoKey)) throw new TypeError("ECDH-ES ephemeral private key must be a CryptoKey or convertible JWK.");
-	if (normalized.type !== "private") throw new TypeError("ECDH-ES ephemeral private key must have type \"private\".");
+	const normalized = isCryptoKey(value) ? value : await jwkTokey(value.alg ? value : {
+		...value,
+		alg
+	});
+	if (normalized.type !== "private") throw new JWTError("ECDH-ES ephemeral private key must have type \"private\".", "ERR_JWK_INVALID");
 	return normalized;
 }
-async function exportPublicJwkFrom(alg, value) {
-	if (isCryptoKey(value)) try {
+async function exportPublicJwkFrom(value) {
+	if (!isCryptoKey(value)) return toPublicEpkJwk(value);
+	try {
 		return toPublicEpkJwk(await keyToJWK(value));
 	} catch (error_) {
-		throw new TypeError("ECDH-ES ephemeral CryptoKey must be extractable to export as JWK.", { cause: error_ instanceof Error ? error_ : void 0 });
+		throw new JWTError("ECDH-ES ephemeral CryptoKey must be extractable to export as JWK.", "ERR_JWK_INVALID", error_);
 	}
-	if (isJWK(value) && isAsymmetricJWK(value) && value.kty === "EC") return toPublicEpkJwk(value);
-	const normalized = await normalizeKey(value, alg);
-	if (!(normalized instanceof CryptoKey)) throw new TypeError("ECDH-ES ephemeral public key must be a CryptoKey or convertible JWK.");
-	return exportPublicJwkFrom(alg, normalized);
 }
 const toSPKI = (key) => {
 	return genericExport("public", "spki", key);
@@ -797,42 +822,53 @@ const toPKCS8 = (key) => {
 	return genericExport("private", "pkcs8", key);
 };
 const fromPKCS8 = (pem, alg, options) => {
-	return genericImport(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, "PRIVATE KEY", "pkcs8", pem, alg, options);
+	return genericImport("PRIVATE KEY", "pkcs8", pem, alg, options);
 };
 const fromSPKI = (pem, alg, options) => {
-	return genericImport(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g, "PUBLIC KEY", "spki", pem, alg, options);
+	return genericImport("PUBLIC KEY", "spki", pem, alg, options);
 };
 const fromX509 = (pem, alg, options) => {
 	let spki;
 	try {
 		spki = getSPKI(pem);
 	} catch (error_) {
-		throw new TypeError("Failed to parse the X.509 certificate", { cause: error_ });
+		throw new JWTError("Failed to parse the X.509 certificate.", "ERR_JWK_INVALID", error_);
 	}
 	return fromSPKI(spki, alg, options);
 };
 const formatPEM = (b64, descriptor) => {
 	return `-----BEGIN ${descriptor}-----\n${(b64.match(/.{1,64}/g) || []).join("\n")}\n-----END ${descriptor}-----`;
 };
-const assertPEMLabel = (pem, descriptor) => {
+const pemBody = (pem, descriptor) => {
 	const begin = `-----BEGIN ${descriptor}-----`;
 	const end = `-----END ${descriptor}-----`;
-	if (!pem.includes(begin) || !pem.includes(end)) {
+	const start = pem.indexOf(begin);
+	if (start === -1) {
 		const found = pem.match(/-----BEGIN [^-]+-----/)?.[0];
 		throw new JWTError(found ? `PEM label mismatch: expected "${begin}", got "${found}".` : `PEM label missing: expected "${begin}".`, "ERR_JWK_INVALID");
 	}
+	const bodyStart = start + begin.length;
+	const bodyEnd = pem.indexOf(end, bodyStart);
+	if (bodyEnd === -1) throw new JWTError(`PEM label missing: expected "${end}".`, "ERR_JWK_INVALID");
+	if (pem.includes("-----BEGIN", bodyStart) || pem.slice(bodyEnd + end.length).trim() !== "") throw new JWTError(`PEM must contain exactly one ${descriptor} block, with nothing after it.`, "ERR_JWK_INVALID");
+	return pem.slice(bodyStart, bodyEnd).replaceAll(/\s/g, "");
 };
 const genericExport = async (keyType, keyFormat, key) => {
-	if (!isCryptoKey(key)) throw new TypeError(`Key must be ${key} of type CryptoKey`);
-	if (!key.extractable) throw new TypeError("CryptoKey is not extractable");
-	if (key.type !== keyType) throw new TypeError(`key is not a ${keyType} key`);
-	return formatPEM(base64Encode(new Uint8Array(await crypto.subtle.exportKey(keyFormat, key))), `${keyType.toUpperCase()} KEY`);
+	if (!isCryptoKey(key)) throw new JWTError(`Key must be of type CryptoKey, got ${typeof key}`, "ERR_INVALID_OPTION");
+	if (!key.extractable) throw new JWTError("CryptoKey is not extractable", "ERR_JWK_INVALID");
+	if (key.type !== keyType) throw new JWTError(`key is not a ${keyType} key`, "ERR_JWK_INVALID");
+	return formatPEM(base64Stringify(new Uint8Array(await crypto.subtle.exportKey(keyFormat, key))), `${keyType.toUpperCase()} KEY`);
 };
-const genericImport = async (replace, descriptor, keyFormat, pem, alg, options) => {
+const genericImport = async (descriptor, keyFormat, pem, alg, options) => {
 	let algorithm;
 	let keyUsages;
-	assertPEMLabel(pem, descriptor);
-	const keyData = base64Decode(pem.replace(replace, ""), { returnAs: "uint8array" });
+	const body = pemBody(pem, descriptor);
+	let keyData;
+	try {
+		keyData = base64Parse(body, { returnAs: "uint8array" });
+	} catch (error) {
+		throw new JWTError("Invalid PEM: body could not be decoded.", "ERR_JWK_INVALID", error);
+	}
 	const isPublic = keyFormat === "spki";
 	switch (alg) {
 		case "PS256":
@@ -840,7 +876,7 @@ const genericImport = async (replace, descriptor, keyFormat, pem, alg, options)
 		case "PS512":
 			algorithm = {
 				name: "RSA-PSS",
-				hash: `SHA-${alg.slice(-3)}`
+				hash: jwsHashOf(alg)
 			};
 			keyUsages = isPublic ? ["verify"] : ["sign"];
 			break;
@@ -849,7 +885,7 @@ const genericImport = async (replace, descriptor, keyFormat, pem, alg, options)
 		case "RS512":
 			algorithm = {
 				name: "RSASSA-PKCS1-v1_5",
-				hash: `SHA-${alg.slice(-3)}`
+				hash: jwsHashOf(alg)
 			};
 			keyUsages = isPublic ? ["verify"] : ["sign"];
 			break;
@@ -859,28 +895,16 @@ const genericImport = async (replace, descriptor, keyFormat, pem, alg, options)
 		case "RSA-OAEP-512":
 			algorithm = {
 				name: "RSA-OAEP",
-				hash: `SHA-${Number.parseInt(alg.slice(-3), 10) || 1}`
+				hash: rsaOaepHashOf(alg)
 			};
 			keyUsages = isPublic ? ["encrypt", "wrapKey"] : ["decrypt", "unwrapKey"];
 			break;
 		case "ES256":
-			algorithm = {
-				name: "ECDSA",
-				namedCurve: "P-256"
-			};
-			keyUsages = isPublic ? ["verify"] : ["sign"];
-			break;
 		case "ES384":
-			algorithm = {
-				name: "ECDSA",
-				namedCurve: "P-384"
-			};
-			keyUsages = isPublic ? ["verify"] : ["sign"];
-			break;
 		case "ES512":
 			algorithm = {
 				name: "ECDSA",
-				namedCurve: "P-521"
+				namedCurve: ECDSA_CURVES[alg]
 			};
 			keyUsages = isPublic ? ["verify"] : ["sign"];
 			break;
@@ -889,32 +913,52 @@ const genericImport = async (replace, descriptor, keyFormat, pem, alg, options)
 		case "ECDH-ES+A192KW":
 		case "ECDH-ES+A256KW": {
 			const namedCurve = getNamedCurve(keyData);
-			algorithm = namedCurve?.startsWith("P-") ? {
+			if (namedCurve) algorithm = {
 				name: "ECDH",
 				namedCurve
-			} : { name: "X25519" };
+			};
+			else algorithm = { name: requireOKPCurve(keyData, "X25519") };
 			keyUsages = isPublic ? [] : ["deriveBits"];
 			break;
 		}
 		case "Ed25519":
 		case "EdDSA":
-			algorithm = { name: "Ed25519" };
+			algorithm = { name: requireOKPCurve(keyData, "Ed25519") };
 			keyUsages = isPublic ? ["verify"] : ["sign"];
 			break;
-		default: throw new Error("Invalid or unsupported \"alg\" (Algorithm) value");
+		default: throw new JWTError("Invalid or unsupported \"alg\" (Algorithm) value", "ERR_JWK_UNSUPPORTED");
+	}
+	try {
+		return await crypto.subtle.importKey(keyFormat, keyData, algorithm, options?.extractable ?? isPublic, keyUsages);
+	} catch (error) {
+		throw new JWTError(`Invalid PEM: the body could not be imported as "${alg}".`, "ERR_JWK_INVALID", error);
 	}
-	return crypto.subtle.importKey(keyFormat, keyData, algorithm, options?.extractable ?? (isPublic ? true : false), keyUsages);
 };
-const findOid = (keyData, oid, from = 0) => {
-	if (from === 0) {
-		oid.unshift(oid.length);
-		oid.unshift(6);
-	}
-	const i = keyData.indexOf(oid[0], from);
-	if (i === -1) return false;
-	const sub = keyData.subarray(i, i + oid.length);
-	if (sub.length !== oid.length) return false;
-	return sub.every((value, index) => value === oid[index]) || findOid(keyData, oid, i + 1);
+const findOid = (keyData, oid) => {
+	const needle = [
+		6,
+		oid.length,
+		...oid
+	];
+	const last = keyData.length - needle.length;
+	for (let i = keyData.indexOf(needle[0]); i !== -1 && i <= last; i = keyData.indexOf(needle[0], i + 1)) if (needle.every((byte, index) => keyData[i + index] === byte)) return true;
+	return false;
+};
+const OKP_CURVE_OIDS = {
+	X25519: [
+		43,
+		101,
+		110
+	],
+	Ed25519: [
+		43,
+		101,
+		112
+	]
+};
+const requireOKPCurve = (keyData, crv) => {
+	if (findOid(keyData, OKP_CURVE_OIDS[crv])) return crv;
+	throw new JWTError(`Invalid PEM: unsupported curve, expected the ${crv} OID.`, "ERR_JWK_INVALID");
 };
 const getNamedCurve = (keyData) => {
 	switch (true) {
@@ -950,6 +994,7 @@ const getElement = (seq) => {
 	let next = 0;
 	while (next < seq.length) {
 		const nextPart = parseElement(seq.subarray(next));
+		if (nextPart.byteLength <= 0) throw new JWTError("Invalid DER: zero-length element", "ERR_JWK_INVALID");
 		result.push(nextPart);
 		next += nextPart.byteLength;
 	}
@@ -957,27 +1002,33 @@ const getElement = (seq) => {
 };
 const parseElement = (bytes) => {
 	let position = 0;
-	let tag = bytes[0] & 31;
+	const at = (index) => {
+		const byte = bytes[index];
+		if (byte === void 0) throw new JWTError("Invalid DER: element is truncated", "ERR_JWK_INVALID");
+		return byte;
+	};
+	let tag = at(0) & 31;
 	position++;
 	if (tag === 31) {
 		tag = 0;
-		while (bytes[position] >= 128) {
-			tag = tag * 128 + bytes[position] - 128;
+		while (at(position) >= 128) {
+			tag = tag * 128 + at(position) - 128;
 			position++;
 		}
-		tag = tag * 128 + bytes[position] - 128;
+		tag = tag * 128 + at(position) - 128;
 		position++;
 	}
 	let length = 0;
-	if (bytes[position] < 128) {
-		length = bytes[position];
+	if (at(position) < 128) {
+		length = at(position);
 		position++;
-	} else if (length === 128) {
+	} else if (at(position) === 128) {
 		length = 0;
-		while (bytes[position + length] !== 0 || bytes[position + length + 1] !== 0) {
-			if (length > bytes.byteLength) throw new TypeError("invalid indefinite form length");
+		while (position + length + 1 < bytes.byteLength) {
+			if (at(position + length) === 0 && at(position + length + 1) === 0) break;
 			length++;
 		}
+		if (position + length + 1 >= bytes.byteLength) throw new JWTError("Invalid DER: invalid indefinite form length", "ERR_JWK_INVALID");
 		const byteLength = position + length + 2;
 		return {
 			byteLength,
@@ -985,15 +1036,16 @@ const parseElement = (bytes) => {
 			raw: bytes.subarray(0, byteLength)
 		};
 	} else {
-		const numberOfDigits = bytes[position] & 127;
+		const numberOfDigits = at(position) & 127;
 		position++;
 		length = 0;
 		for (let i = 0; i < numberOfDigits; i++) {
-			length = length * 256 + bytes[position];
+			length = length * 256 + at(position);
 			position++;
 		}
 	}
 	const byteLength = position + length;
+	if (byteLength > bytes.byteLength) throw new JWTError("Invalid DER: element length exceeds the available bytes", "ERR_JWK_INVALID");
 	return {
 		byteLength,
 		contents: bytes.subarray(position, byteLength),
@@ -1001,8 +1053,14 @@ const parseElement = (bytes) => {
 	};
 };
 const spkiFromX509 = (buf) => {
-	const tbsCertificate = getElement(getElement(parseElement(buf).contents)[0].contents);
-	return base64Encode(tbsCertificate[tbsCertificate[0].raw[0] === 160 ? 6 : 5].raw);
+	const tbs = getElement(parseElement(buf).contents)[0];
+	if (!tbs) throw new JWTError("Invalid X.509 certificate: missing tbsCertificate", "ERR_JWK_INVALID");
+	const tbsCertificate = getElement(tbs.contents);
+	const first = tbsCertificate[0];
+	if (!first) throw new JWTError("Invalid X.509 certificate: empty tbsCertificate", "ERR_JWK_INVALID");
+	const spki = tbsCertificate[first.raw[0] === 160 ? 6 : 5];
+	if (!spki) throw new JWTError("Invalid X.509 certificate: missing subjectPublicKeyInfo", "ERR_JWK_INVALID");
+	return base64Stringify(spki.raw);
 };
 let createPublicKey;
 const getSPKI = (x509) => {
@@ -1011,82 +1069,680 @@ const getSPKI = (x509) => {
 	} catch {
 		createPublicKey = 0;
 	}
+	const body = pemBody(x509, "CERTIFICATE");
 	if (createPublicKey) try {
 		return new createPublicKey(x509).export({
 			format: "pem",
 			type: "spki"
 		});
 	} catch {}
-	return formatPEM(spkiFromX509(base64Decode(x509.replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g, ""), { returnAs: "uint8array" })), "PUBLIC KEY");
+	let raw;
+	try {
+		raw = base64Parse(body, { returnAs: "uint8array" });
+	} catch (error) {
+		throw new JWTError("Invalid X.509 certificate: body could not be decoded.", "ERR_JWK_INVALID", error);
+	}
+	return formatPEM(spkiFromX509(raw), "PUBLIC KEY");
+};
+const THUMBPRINT_MEMBERS = /* @__PURE__ */ Object.freeze({
+	EC: [
+		"crv",
+		"kty",
+		"x",
+		"y"
+	],
+	RSA: [
+		"e",
+		"kty",
+		"n"
+	],
+	OKP: [
+		"crv",
+		"kty",
+		"x"
+	],
+	oct: ["k", "kty"]
+});
+const THUMBPRINT_HASHES = /* @__PURE__ */ new Set([
+	"SHA-256",
+	"SHA-384",
+	"SHA-512"
+]);
+async function thumbprint(jwk, options = {}) {
+	assertPlainObject(jwk, "jwk");
+	assertPlainObject(options, "options");
+	const hash = options.hash ?? "SHA-256";
+	if (!THUMBPRINT_HASHES.has(hash)) throw new JWTError("\"hash\" must be \"SHA-256\", \"SHA-384\" or \"SHA-512\".", "ERR_INVALID_OPTION");
+	const kty = jwk.kty;
+	const members = typeof kty === "string" && Object.hasOwn(THUMBPRINT_MEMBERS, kty) ? THUMBPRINT_MEMBERS[kty] : void 0;
+	if (!members) throw new JWTError(`JWK thumbprint is not defined for kty "${String(kty)}".`, "ERR_JWK_INVALID");
+	const canonical = members.map((name) => {
+		const value = Reflect.get(jwk, name);
+		if (typeof value !== "string" || value.length === 0) throw new JWTError(`JWK thumbprint requires the member "${name}" on an ${jwk.kty} key.`, "ERR_JWK_INVALID");
+		return `${JSON.stringify(name)}:${JSON.stringify(value)}`;
+	});
+	const digest = await crypto.subtle.digest(hash, textEncoder.encode(`{${canonical.join(",")}}`));
+	return base64UrlStringify(new Uint8Array(digest));
+}
+const MAX_PARTY_INFO_BYTES = 1024;
+const DEFAULT_JOSE_LIMITS = /* @__PURE__ */ Object.freeze({
+	signatures: 16,
+	recipients: 16,
+	keyCandidates: 8,
+	pbes2Iterations: 4 * DEFAULT_PBES2_ITERATIONS
+});
+function resolveLimit(limits, name) {
+	const value = limits?.[name];
+	if (value === void 0) return DEFAULT_JOSE_LIMITS[name];
+	if (typeof value !== "number" || !Number.isInteger(value) || value < 1) throw new JWTError(`"limits.${name}" must be a positive integer.`, "ERR_INVALID_OPTION");
+	return value;
+}
+function assertEntryLimit(count, limit, options) {
+	if (count <= limit) return;
+	throw new JWTError(`Invalid ${options.family}: ${count} ${options.what} exceed the limit of ${limit}.`, `ERR_${options.family}_INVALID`);
+}
+function assertCandidateLimit(count, limit) {
+	if (count <= limit) return;
+	throw new JWTError(`${count} candidate keys exceed the limit of ${limit}; narrow the JWK Set with a "kid".`, "ERR_JWK_KEY_NOT_FOUND");
+}
+function assertJWKSetCandidates(candidates, options) {
+	if (candidates.length === 0) {
+		const { kid } = options;
+		throw new JWTError(`No key found in JWK Set${kid ? ` with kid ${quoteTokenValue(kid)}` : ""}.`, "ERR_JWK_KEY_NOT_FOUND");
+	}
+	assertCandidateLimit(candidates.length, options.limit);
+}
+function createPBES2Budget(limit) {
+	let remaining = limit;
+	return { spend(attempt) {
+		const { alg, p2c } = attempt;
+		if (!alg.startsWith("PBES2")) return;
+		if (typeof p2c !== "number" || !(p2c > 0)) return;
+		assertPBES2Iterations(p2c, attempt);
+		if (p2c > remaining) throw new JWTError(`PBES2 iteration budget of ${limit} exhausted.`, "ERR_JWE_INVALID");
+		remaining -= p2c;
+	} };
+}
+function serializeProtectedHeader(header) {
+	try {
+		return JSON.stringify(header);
+	} catch (error) {
+		throw new JWTError("The protected header is not JSON-serializable.", "ERR_INVALID_OPTION", error);
+	}
+}
+function assertProducerCrit(header, family) {
+	const crit = header.crit;
+	if (crit === void 0) return;
+	assertCritShape(crit, {
+		family,
+		code: "ERR_INVALID_OPTION"
+	});
+	for (const param of crit) {
+		if (Object.hasOwn(header, param)) continue;
+		throw new JWTError(`"crit" lists "${param}", which the protected header does not carry.`, "ERR_INVALID_OPTION");
+	}
+}
+const PROTECTED_ONLY_PARAMS = {
+	JWS: ["crit", "b64"],
+	JWE: ["crit"]
 };
+function assertProtectedOnlyOption(header, options) {
+	if (!header) return;
+	const { tier, family } = options;
+	for (const param of PROTECTED_ONLY_PARAMS[family]) {
+		if (!Object.hasOwn(header, param)) continue;
+		throw new JWTError(`${family} "${param}" must be integrity protected; move it from the ${tier} header to the protected header.`, "ERR_INVALID_OPTION");
+	}
+}
+function assertOptionEntry(entry, options) {
+	const { label, objects } = options;
+	assertPlainObject(entry, label);
+	for (const member of objects) if (entry[member] !== void 0) assertPlainObject(entry[member], `${label}.${member}`);
+}
+function assertProducerPartyInfo(name, value) {
+	if (!(value instanceof Uint8Array)) throw new JWTError(`"${name === "apu" ? "partyUInfo" : "partyVInfo"}" (${name}) must be a Uint8Array.`, "ERR_INVALID_OPTION");
+	if (value.length > 1024) throw new JWTError(`"${name === "apu" ? "partyUInfo" : "partyVInfo"}" (${name}) must not exceed ${MAX_PARTY_INFO_BYTES} bytes (got ${value.length}).`, "ERR_INVALID_OPTION");
+}
+function assertProducerCEK(cek, enc) {
+	if (cek === void 0) return;
+	const expected = bitLengthCEK(enc) >> 3;
+	if (!(cek instanceof Uint8Array) || cek.length !== expected) throw new JWTError(`"cek" must be ${expected} bytes for ${enc} (got ${cek instanceof Uint8Array ? cek.length : typeof cek}).`, "ERR_INVALID_OPTION");
+}
+function assertProducerIV(iv, enc) {
+	if (iv === void 0) return;
+	const expected = bitLengthIV(enc) >> 3;
+	if (!(iv instanceof Uint8Array) || iv.length !== expected) throw new JWTError(`"contentEncryptionIV" must be ${expected} bytes for ${enc} (got ${iv instanceof Uint8Array ? iv.length : typeof iv}).`, "ERR_INVALID_OPTION");
+}
+function assertConsumerOptions(options) {
+	assertOptionEntry(options, {
+		label: "options",
+		objects: ["limits"]
+	});
+	const typ = options.typ;
+	if (typ !== void 0 && (typeof typ !== "string" || typ === "")) throw new JWTError("\"typ\" must be a non-empty string.", "ERR_INVALID_OPTION");
+	assertStringList(options.algorithms, "algorithms");
+	assertStringList(options.encryptionAlgorithms, "encryptionAlgorithms");
+	assertStringList(options.recognizedHeaders, "recognizedHeaders");
+	assertClaimValidationOptions(options);
+}
+const JWK_SET_KEY_OPS = /* @__PURE__ */ Object.freeze({
+	sig: ["verify"],
+	enc: [
+		"unwrapKey",
+		"decrypt",
+		"deriveBits",
+		"deriveKey"
+	]
+});
+function buildJWKSetFilter(header, options) {
+	const kid = header?.kid;
+	const alg = header?.alg;
+	const { op, allowSymmetric } = options;
+	const use = op;
+	const keyOps = JWK_SET_KEY_OPS[op];
+	return (k) => {
+		if (!isJWK(k)) return false;
+		if (k.kty === "oct" && !allowSymmetric) return false;
+		if (kid && k.kid !== kid) return false;
+		if (k.alg && k.alg !== alg) return false;
+		if (k.use !== void 0 && k.use !== use) return false;
+		const ops = k.key_ops;
+		if (ops !== void 0 && !(Array.isArray(ops) && ops.some((o) => keyOps.includes(o)))) return false;
+		return true;
+	};
+}
+function parseEphemeralKey(ephemeralKey) {
+	if (isCryptoKeyPair(ephemeralKey)) return {
+		epk: ephemeralKey.publicKey,
+		epkPrivateKey: ephemeralKey.privateKey
+	};
+	if (typeof ephemeralKey === "object" && ephemeralKey !== null && "publicKey" in ephemeralKey && "privateKey" in ephemeralKey) {
+		if (!ephemeralKey.publicKey || !ephemeralKey.privateKey) throw new JWTError("ECDH-ES custom ephemeral key must include both publicKey and privateKey.", "ERR_JWK_INVALID");
+		return {
+			epk: ephemeralKey.publicKey,
+			epkPrivateKey: ephemeralKey.privateKey
+		};
+	}
+	if (isCryptoKey(ephemeralKey)) {
+		if (ephemeralKey.type !== "private") throw new JWTError("ECDH-ES custom ephemeral CryptoKey must include private key material.", "ERR_JWK_INVALID");
+		return {
+			epk: ephemeralKey,
+			epkPrivateKey: ephemeralKey
+		};
+	}
+	if (isJWK(ephemeralKey)) {
+		if (!("d" in ephemeralKey) || typeof ephemeralKey.d !== "string") throw new JWTError("ECDH-ES custom ephemeral JWK must include private parameter \"d\".", "ERR_JWK_INVALID");
+		return {
+			epk: ephemeralKey,
+			epkPrivateKey: ephemeralKey
+		};
+	}
+	throw new JWTError("Unsupported ECDH-ES ephemeral key material provided.", "ERR_JWK_INVALID");
+}
+function buildECDHAgreementParams(ecdh) {
+	const params = {};
+	if (!ecdh) return params;
+	const { partyUInfo, partyVInfo, ephemeralKey } = ecdh;
+	if (partyUInfo !== void 0) {
+		assertProducerPartyInfo("apu", partyUInfo);
+		if (partyUInfo.length > 0) params.apu = partyUInfo;
+	}
+	if (partyVInfo !== void 0) {
+		assertProducerPartyInfo("apv", partyVInfo);
+		if (partyVInfo.length > 0) params.apv = partyVInfo;
+	}
+	if (ephemeralKey) {
+		const { epk, epkPrivateKey } = parseEphemeralKey(ephemeralKey);
+		params.epk = epk;
+		params.epkPrivateKey = epkPrivateKey;
+	}
+	return params;
+}
+async function resolveSigningKey(alg, key, usage) {
+	if (key instanceof Uint8Array) {
+		if (!alg.startsWith("HS")) throw new JWTError(`Raw key bytes are HMAC secrets; ${alg} needs an asymmetric key. Pass a JWK or a CryptoKey.`, "ERR_JWK_INVALID");
+		assertOctKeyLength(key, alg);
+		return crypto.subtle.importKey("raw", key, {
+			name: "HMAC",
+			hash: jwsHashOf(alg)
+		}, false, [usage]);
+	}
+	if (alg.startsWith("RS") || alg.startsWith("PS")) {
+		const modulusLength = modulusLengthOf(key.algorithm);
+		if (typeof modulusLength !== "number" || modulusLength < 2048) throw new JWTError(`${alg} requires a key modulusLength of at least 2048 bits`, "ERR_JWK_INVALID");
+	}
+	return key;
+}
+function validateClaimsIfJson(payload, mode, options) {
+	if (mode !== "json" || options.validateClaims === false) return;
+	validateJwtClaims(payload, options);
+}
+const PAYLOAD_MODES = /* @__PURE__ */ new Set([
+	"json",
+	"string",
+	"bytes"
+]);
+function resolvePayloadMode(options) {
+	const { payload, forceUint8Array, validateClaims } = options;
+	if (payload !== void 0 && !PAYLOAD_MODES.has(payload)) throw new JWTError("\"payload\" must be \"json\", \"string\" or \"bytes\".", "ERR_INVALID_OPTION");
+	let mode = payload ?? "json";
+	if (forceUint8Array !== void 0) {
+		if (payload === void 0) mode = forceUint8Array ? "bytes" : "json";
+		else if (forceUint8Array !== (payload === "bytes")) throw new JWTError("\"forceUint8Array\" contradicts \"payload\"; pass \"payload\" alone.", "ERR_INVALID_OPTION");
+	}
+	if (validateClaims === true && mode !== "json") throw new JWTError("\"validateClaims\" requires payload: \"json\".", "ERR_INVALID_OPTION");
+	return mode;
+}
+function stringKeyError() {
+	return new JWTError("String keys are not accepted: pass an oct JWK or a Uint8Array secret, or import PEM text with importPEM().", "ERR_JWK_INVALID");
+}
+function assertNotStringKey(key) {
+	if (typeof key === "string") throw stringKeyError();
+}
+function resolvePasswordKey(alg, key) {
+	if (typeof key !== "string") return key;
+	if (!alg.startsWith("PBES2")) throw stringKeyError();
+	return textEncoder.encode(key);
+}
+const JWS_ALG_CTX = /* @__PURE__ */ Object.freeze({
+	infer: inferJWSAllowedAlgorithms,
+	octRoles: false,
+	errorCode: "ERR_JWS_ALG_NOT_ALLOWED",
+	label: "Algorithm",
+	op: "sig"
+});
+const JWE_ALG_CTX = /* @__PURE__ */ Object.freeze({
+	infer: inferJWEAllowedAlgorithms,
+	octRoles: true,
+	errorCode: "ERR_JWE_ALG_NOT_ALLOWED",
+	label: "Key management algorithm",
+	op: "enc"
+});
+function checkAlgAllowed(alg, key, options) {
+	const { ctx, algorithms, allowSymmetric } = options;
+	if (algorithms !== void 0) return algorithms.includes(alg) ? void 0 : notAllowed(alg, ctx);
+	if (isJWK(key) && typeof key.alg === "string" && (!ctx.octRoles || key.kty !== "oct")) return key.alg === alg || isEd25519Signature(key.alg) && isEd25519Signature(alg) ? void 0 : notAllowed(alg, ctx);
+	const inferred = ctx.infer(key, { allowSymmetric });
+	if (!inferred) return new JWTError(`Cannot infer allowed ${ctx.label.toLowerCase()}s from this key; pass "options.algorithms" explicitly.`, ctx.errorCode);
+	return inferred.includes(alg) ? void 0 : notAllowed(alg, ctx);
+}
+function notAllowed(alg, ctx) {
+	return new JWTError(`${ctx.label} not allowed: ${alg}`, ctx.errorCode);
+}
+function keyMatchesHeader(header, keyMaterial, options) {
+	const { ctx, allowSymmetric } = options;
+	if (isJWKSet(keyMaterial)) {
+		const candidates = keyMaterial.keys.filter(buildJWKSetFilter(header, {
+			op: ctx.op,
+			allowSymmetric
+		}));
+		return candidates.length === 0 || candidates.some((k) => keyServesHeaderAlg(header, k, ctx));
+	}
+	if (isJWK(keyMaterial)) {
+		if (header.kid && keyMaterial.kid && header.kid !== keyMaterial.kid) return false;
+		return keyServesHeaderAlg(header, keyMaterial, ctx);
+	}
+	if (isCryptoKey(keyMaterial)) return keyServesHeaderAlg(header, keyMaterial, ctx);
+	return true;
+}
+const JWS_ALGORITHM_SET = /* @__PURE__ */ new Set(Object.keys({
+	HS256: true,
+	HS384: true,
+	HS512: true,
+	RS256: true,
+	RS384: true,
+	RS512: true,
+	PS256: true,
+	PS384: true,
+	PS512: true,
+	ES256: true,
+	ES384: true,
+	ES512: true,
+	Ed25519: true,
+	EdDSA: true
+}));
+function checkJWSAlgSupported(alg) {
+	return checkAlgSupported(alg, {
+		supported: JWS_ALGORITHM_SET,
+		code: "ERR_JWS_ALG_NOT_ALLOWED",
+		label: "Algorithm",
+		role: "signing algorithm"
+	});
+}
+function checkJWSB64(header) {
+	if (Object.hasOwn(header, "b64") && typeof header.b64 !== "boolean") return new JWTError("Invalid JWS: \"b64\" must be a boolean (RFC 7797 §3).", "ERR_JWS_INVALID");
+	if (header.b64 !== false) return void 0;
+	if (Array.isArray(header.crit) && header.crit.includes("b64")) return void 0;
+	return new JWTError("Invalid JWS: \"b64\" must be listed in \"crit\" (RFC 7797 §6).", "ERR_JWS_INVALID");
+}
+function assertB64Option(header) {
+	if (!header || !Object.hasOwn(header, "b64") || typeof header.b64 === "boolean") return;
+	throw new JWTError("\"b64\" must be a boolean (RFC 7797 §3).", "ERR_INVALID_OPTION");
+}
+function applyB64Header(header) {
+	assertB64Option(header);
+	if (header.b64 === true) {
+		if (!(Array.isArray(header.crit) && header.crit.includes("b64"))) delete header.b64;
+		return;
+	}
+	if (header.b64 !== false) return;
+	const crit = header.crit;
+	if (crit === void 0) header.crit = ["b64"];
+	else if (Array.isArray(crit) && !crit.includes("b64")) header.crit = [...crit, "b64"];
+}
+function assertCompactToken(token, family) {
+	if (typeof token !== "string") throw new JWTError(`Invalid ${family}: token must be a string.`, `ERR_${family}_INVALID`);
+}
+function assertSerializationObject(value, family) {
+	if (!isPlainObject(value)) throw new JWTError(`Invalid ${family} JSON Serialization: expected an object.`, `ERR_${family}_INVALID_SERIALIZATION`);
+}
+function checkSerializationEntry(entry, options) {
+	const { family, label, objects, strings } = options;
+	const code = `ERR_${family}_INVALID`;
+	if (!isPlainObject(entry)) return new JWTError(`Invalid ${family}: ${label} must be a JSON object.`, code);
+	for (const member of objects) if (entry[member] !== void 0 && !isPlainObject(entry[member])) return new JWTError(`Invalid ${family}: ${label} "${member}" must be a JSON object.`, code);
+	for (const member of strings) if (entry[member] !== void 0 && typeof entry[member] !== "string") return new JWTError(`Invalid ${family}: ${label} "${member}" must be a string.`, code);
+}
+function asKeyLookupError(error, what) {
+	return asJWTError(error, {
+		code: "ERR_JWK_KEY_NOT_FOUND",
+		message: `Key lookup failed for ${what}.`
+	});
+}
+function asJWTError(error, options) {
+	if (error instanceof JWTError) return error;
+	return new JWTError(options.message, options.code, error);
+}
+function asDecryptionError(error) {
+	return asJWTError(error, {
+		code: "ERR_JWE_DECRYPTION_FAILED",
+		message: "JWE decryption failed."
+	});
+}
+async function resolveKeyInput(key, options) {
+	if (typeof key !== "function") return key;
+	const { header, token, what } = options;
+	let resolved;
+	try {
+		resolved = await key(header, token);
+	} catch (error) {
+		throw asKeyLookupError(error, what);
+	}
+	if (resolved === void 0 || resolved === null) throw new JWTError(`Key lookup returned no key for ${what}.`, "ERR_JWK_KEY_NOT_FOUND");
+	return resolved;
+}
+function asKeyUsageError(error, alg) {
+	return asJWTError(error, {
+		code: "ERR_JWK_INVALID",
+		message: `Key is not usable for ${alg}.`
+	});
+}
+const JWE_ALGORITHM_SET = /* @__PURE__ */ new Set(Object.keys({
+	"dir": true,
+	"A128KW": true,
+	"A192KW": true,
+	"A256KW": true,
+	"A128GCMKW": true,
+	"A192GCMKW": true,
+	"A256GCMKW": true,
+	"PBES2-HS256+A128KW": true,
+	"PBES2-HS384+A192KW": true,
+	"PBES2-HS512+A256KW": true,
+	"RSA-OAEP": true,
+	"RSA-OAEP-256": true,
+	"RSA-OAEP-384": true,
+	"RSA-OAEP-512": true,
+	"ECDH-ES": true,
+	"ECDH-ES+A128KW": true,
+	"ECDH-ES+A192KW": true,
+	"ECDH-ES+A256KW": true
+}));
+const JWE_ENC_CEK_FORMAT = /* @__PURE__ */ Object.freeze({
+	"A128GCM": "cryptokey",
+	"A192GCM": "cryptokey",
+	"A256GCM": "cryptokey",
+	"A128CBC-HS256": "raw",
+	"A192CBC-HS384": "raw",
+	"A256CBC-HS512": "raw"
+});
+function assertDirectKeyRole(key, enc) {
+	if (!isJWK(key) || typeof key.alg !== "string" || key.alg === "dir") return;
+	if (enc !== void 0 && key.alg === enc) return;
+	throw new JWTError(`JWK "alg" is "${key.alg}" but "dir" requires a key declared as "dir" or as the token's "enc" (${enc ?? "unknown"}).`, "ERR_JWK_INVALID");
+}
+const JWE_DIRECT_ALGS = /* @__PURE__ */ new Set(["dir", "ECDH-ES"]);
+function checkJWEAlgSupported(alg) {
+	return checkAlgSupported(alg, {
+		supported: JWE_ALGORITHM_SET,
+		code: "ERR_JWE_ALG_NOT_ALLOWED",
+		label: "Key management algorithm",
+		role: "key management algorithm"
+	});
+}
+function checkJWEEncSupported(enc) {
+	if (typeof enc === "string" && isContentEncryptionAlgorithm(enc)) return void 0;
+	return new JWTError(`Invalid JWE: unsupported "enc" ${quoteTokenValue(enc)}`, "ERR_JWE_INVALID");
+}
+function isJWEAlgSupported(alg) {
+	return JWE_ALGORITHM_SET.has(alg);
+}
+function assertJWEAlgSupported(alg) {
+	const error = checkJWEAlgSupported(alg);
+	if (error) throw error;
+}
+function assertJWEEncSupported(enc) {
+	const error = checkJWEEncSupported(enc);
+	if (error) throw error;
+}
+function checkJWEEncAllowed(enc, encryptionAlgorithms) {
+	if (encryptionAlgorithms === void 0 || encryptionAlgorithms.includes(enc)) return void 0;
+	return new JWTError(`Content encryption algorithm not allowed: ${enc}`, "ERR_JWE_ALG_NOT_ALLOWED");
+}
+async function exportReturnedCek(cek) {
+	if (!isCryptoKey(cek)) return cek;
+	if (!cek.extractable) throw new JWTError("\"returnCek\" requires an extractable content encryption key.", "ERR_INVALID_OPTION");
+	return new Uint8Array(await crypto.subtle.exportKey("raw", cek));
+}
+function cekFormatForEnc(enc) {
+	return JWE_ENC_CEK_FORMAT[enc];
+}
+function buildUnwrapKeyOptions(header, algorithms, options) {
+	const { alg, enc } = algorithms;
+	const opts = {
+		alg,
+		enc,
+		format: cekFormatForEnc(enc),
+		keyUsage: options?.keyUsage || ["decrypt"]
+	};
+	if (header.iv) opts.iv = header.iv;
+	if (header.tag) opts.tag = header.tag;
+	if (header.p2s) opts.p2s = header.p2s;
+	if (header.p2c) opts.p2c = header.p2c;
+	if (header.epk) opts.epk = header.epk;
+	if (header.apu) opts.apu = header.apu;
+	if (header.apv) opts.apv = header.apv;
+	if (options?.unwrappedKeyAlgorithm) opts.unwrappedKeyAlgorithm = options.unwrappedKeyAlgorithm;
+	if (options?.extractable !== void 0) opts.extractable = options.extractable;
+	if (options?.minIterations !== void 0) opts.minIterations = options.minIterations;
+	if (options?.maxIterations !== void 0) opts.maxIterations = options.maxIterations;
+	return opts;
+}
+function checkJWEDirectEncryptedKey(alg, encryptedKey) {
+	if (!JWE_DIRECT_ALGS.has(alg) || !encryptedKey) return void 0;
+	return new JWTError(`Invalid JWE: Encrypted key must be empty for ${alg}.`, "ERR_JWE_INVALID");
+}
+function checkJWEContentSegments(enc, iv, tag) {
+	const ivBytes = bitLengthIV(enc) >> 3;
+	if (iv.length !== ivBytes) return new JWTError(`Invalid JWE: Initialization vector must be ${ivBytes} bytes for ${enc} (got ${iv.length}).`, "ERR_JWE_INVALID");
+	const tagBytes = bitLengthTag(enc) >> 3;
+	if (tag.length !== tagBytes) return new JWTError(`Invalid JWE: Authentication tag must be ${tagBytes} bytes for ${enc} (got ${tag.length}).`, "ERR_JWE_INVALID");
+}
+function checkJWEZip(header) {
+	if (!header || !Object.hasOwn(header, "zip")) return void 0;
+	return new JWTError("Invalid JWE: compression is not supported.", "ERR_JWE_INVALID");
+}
+function assertNoZipOption(header, tier) {
+	if (!header || !Object.hasOwn(header, "zip")) return;
+	throw new JWTError(`JWE compression ("zip") is not supported; remove it from the ${tier} header.`, "ERR_INVALID_OPTION");
+}
+function checkJWEUnprotectedCrit(header) {
+	if (!header || !Object.hasOwn(header, "crit")) return void 0;
+	return new JWTError("Invalid JWE: \"crit\" must be integrity protected (RFC 7516 §4.1.13).", "ERR_JWE_INVALID");
+}
+function typMatches(expected, actual) {
+	if (typeof actual !== "string") return false;
+	return normalizeTyp(expected) === normalizeTyp(actual);
+}
+function checkProtectedTyp(expected, protectedHeader, options) {
+	if (expected === void 0) return void 0;
+	const actual = protectedHeader.typ;
+	if (typMatches(expected, actual)) return void 0;
+	const { family, label } = options;
+	const where = label ? ` on ${label}` : "";
+	const message = actual === void 0 ? `Invalid ${family}: the protected header${where} carries no "typ"; expected "${expected}".` : `Invalid ${family}: "typ" (Type) Header Parameter mismatch${where}. Expected "${expected}", got ${JSON.stringify(actual)}.`;
+	return new JWTError(message, `ERR_${family}_INVALID`);
+}
+function normalizeTyp(typ) {
+	const lowered = typ.toLowerCase();
+	return lowered.includes("/") ? lowered : `application/${lowered}`;
+}
+function decodeProtectedHeader(encoded, family) {
+	let parsed = {};
+	if (encoded) {
+		try {
+			parsed = safeJsonParse(base64UrlParse(encoded));
+		} catch (error) {
+			throw new JWTError(`Invalid ${family}: Protected header could not be decoded.`, `ERR_${family}_INVALID`, error);
+		}
+		if (!isPlainObject(parsed)) throw new JWTError(`Invalid ${family}: Protected header must be a JSON object.`, `ERR_${family}_INVALID`);
+	}
+	return parsed;
+}
+function decodeSegment(encoded, options) {
+	try {
+		return base64UrlParse(encoded, { returnAs: "uint8array" });
+	} catch (error) {
+		throw new JWTError(`Invalid ${options.family}: ${options.what} could not be decoded.`, `ERR_${options.family}_INVALID`, error);
+	}
+}
+function decodeJWSPayload(payloadSegment, useB64, mode) {
+	if (!useB64) return mode === "string" ? payloadSegment : parsePayloadBytes(textEncoder.encode(payloadSegment), {
+		payload: mode,
+		family: "JWS"
+	});
+	try {
+		return parsePayloadSegment(payloadSegment, {
+			payload: mode,
+			family: "JWS"
+		});
+	} catch (error) {
+		if (error instanceof JWTError) throw error;
+		throw new JWTError("Invalid JWS: Payload could not be decoded.", "ERR_JWS_INVALID", error);
+	}
+}
+function decodeJWEPayload(plaintext, mode) {
+	return parsePayloadBytes(plaintext, {
+		payload: mode,
+		family: "JWE"
+	});
+}
+function checkAlgSupported(alg, options) {
+	const { supported, code, label, role } = options;
+	if (alg === "none") return new JWTError(`"none" is not a valid ${role}`, code);
+	if (!supported.has(alg)) return new JWTError(`${label} not supported: ${quoteTokenValue(alg)}`, code);
+}
+function keyServesHeaderAlg(header, key, ctx) {
+	const { alg } = header;
+	if (!alg) return false;
+	const inferred = ctx.infer(key);
+	if (inferred && !inferred.includes(alg)) return false;
+	if (!alg.startsWith("ECDH-ES")) return true;
+	const epkCurve = header.epk?.crv;
+	const keyCurve = isCryptoKey(key) ? cryptoKeyCurve(key) : "crv" in key ? key.crv : void 0;
+	return !epkCurve || !keyCurve || epkCurve === keyCurve;
+}
 async function generateKey(alg, options = {}) {
-	const exportToJWK = options.toJWK !== void 0 && options.toJWK !== false;
+	const exportToJWK = options.toJWK !== void 0 && options.toJWK;
 	const defaultExtractable = exportToJWK || options.extractable !== false;
+	const kid = exportToJWK ? assertKidOption(options.kid) : void 0;
 	if (alg === "A128CBC-HS256" || alg === "A192CBC-HS384" || alg === "A256CBC-HS512") {
-		const keyBytes = secureRandomBytes(bitLengthCEK(alg) >> 3);
-		if (exportToJWK) return keyToJWK(keyBytes);
+		const keyLength = bitLengthCEK(alg);
+		const keyBytes = secureRandomBytes(keyLength >> 3);
+		if (exportToJWK) return withGeneratedKid(kid, {
+			...await keyToJWK(keyBytes),
+			alg,
+			ext: true,
+			key_ops: resolveKeyUsage(options.keyUsage, {
+				allowed: CONTENT_ENCRYPTION_USAGES,
+				fallback: ["encrypt", "decrypt"],
+				alg
+			})
+		});
 		return keyBytes;
 	}
 	const { algorithm, keyUsages } = getGenerateKeyParams(alg, options);
 	const key = await crypto.subtle.generateKey(algorithm, defaultExtractable, keyUsages);
-	if (exportToJWK) if (key instanceof CryptoKey) return {
-		...await exportKey(key),
-		alg
-	};
-	else {
-		const [pub, priv] = await Promise.all([exportKey(key.publicKey), exportKey(key.privateKey)]);
-		return {
-			privateKey: {
-				...priv,
-				alg
-			},
-			publicKey: {
+	if (exportToJWK) {
+		if (key instanceof CryptoKey) return withGeneratedKid(kid, {
+			...await exportKey(key),
+			alg
+		});
+		else {
+			const [pub, priv] = await Promise.all([exportKey(key.publicKey), exportKey(key.privateKey)]);
+			const publicKey = await withGeneratedKid(kid, {
 				...pub,
 				alg
-			}
-		};
+			});
+			const named = publicKey.kid === void 0 ? void 0 : { kid: publicKey.kid };
+			return {
+				privateKey: {
+					...priv,
+					alg,
+					...named
+				},
+				publicKey
+			};
+		}
 	}
 	return key;
 }
 async function generateJWK(alg, options) {
-	const { keyUsage, modulusLength, publicExponent, namedCurve, ...jwkParams } = options ?? {};
-	const kid = typeof jwkParams.kid === "string" ? jwkParams.kid : crypto.randomUUID();
-	const extraParams = {
-		...jwkParams,
-		kid
-	};
+	const { keyUsage, modulusLength, publicExponent, namedCurve, kid, extractable: _extractable, toJWK: _toJWK, ...jwkParams } = options ?? {};
+	assertNoReservedJWKParams(jwkParams);
 	const result = await generateKey(alg, {
 		keyUsage,
 		modulusLength,
 		publicExponent,
 		namedCurve,
+		kid,
 		toJWK: true
 	});
-	if (result && typeof result === "object" && "privateKey" in result && "publicKey" in result) {
-		const pair = result;
-		return {
-			privateKey: {
-				...extraParams,
-				...pair.privateKey
-			},
-			publicKey: {
-				...extraParams,
-				...pair.publicKey
-			}
-		};
-	}
+	if (result && typeof result === "object" && "privateKey" in result && "publicKey" in result) return {
+		privateKey: {
+			...jwkParams,
+			...result.privateKey
+		},
+		publicKey: {
+			...jwkParams,
+			...result.publicKey
+		}
+	};
 	return {
-		...extraParams,
+		...jwkParams,
 		...result
 	};
 }
-async function deriveKeyFromPassword(password, alg, options) {
-	const { salt, iterations, extractable, keyUsage } = options;
-	const exportToJWK = options.toJWK !== void 0 && options.toJWK !== false;
-	if (!(salt instanceof Uint8Array) || salt.length < 8) throw new JWTError("PBES2 Salt Input (salt) must be 8 or more octets", "ERR_JWE_INVALID");
-	if (typeof iterations !== "number" || iterations < 1) throw new JWTError("PBES2 Iteration Count (iterations) must be a positive integer", "ERR_JWE_INVALID");
-	const derivedBytes = await deriveKey(salt, alg, iterations, typeof password === "string" ? textEncoder.encode(password) : password);
-	const wrappingAlg = alg.slice(-6);
+async function deriveKeyFromPassword(password, options) {
+	assertPlainObject(options, "options");
+	if (typeof password !== "string" && !(password instanceof Uint8Array)) throw new JWTError("\"password\" must be a string or a Uint8Array.", "ERR_INVALID_OPTION");
+	const { alg, salt, iterations, extractable, keyUsage } = options;
+	assertPBES2Algorithm(alg);
+	const exportToJWK = options.toJWK !== void 0 && options.toJWK;
+	const saltBytes = typeof salt === "string" ? textEncoder.encode(salt) : salt;
+	assertPBES2Salt(saltBytes, "\"salt\"");
+	assertPBES2Count(iterations, "\"iterations\"");
+	const derivedBytes = await deriveKey(saltBytes, alg, iterations, typeof password === "string" ? textEncoder.encode(password) : password);
+	const wrappingAlg = innerKeyWrapAlg(alg);
 	const finalUsages = keyUsage ?? ["wrapKey", "unwrapKey"];
 	const finalExtractable = exportToJWK ? true : extractable === true;
 	const derivedKey = await crypto.subtle.importKey("raw", derivedBytes, { name: "AES-KW" }, finalExtractable, finalUsages);
@@ -1097,18 +1753,22 @@ async function deriveKeyFromPassword(password, alg, options) {
 	};
 	return derivedKey;
 }
-async function deriveJWKFromPassword(password, alg, options) {
-	const { salt, iterations, keyUsage, ...jwkParams } = options;
-	const result = await deriveKeyFromPassword(password, alg, {
+async function deriveJWKFromPassword(password, options) {
+	assertPlainObject(options, "options");
+	const { alg, salt, iterations, keyUsage, kid: kidOption, extractable: _extractable, toJWK: _toJWK, ...jwkParams } = options;
+	assertNoReservedJWKParams(jwkParams);
+	const kid = assertKidOption(kidOption);
+	const result = await deriveKeyFromPassword(password, {
+		alg,
 		salt,
 		iterations,
 		keyUsage,
 		toJWK: true
 	});
-	return Object.keys(jwkParams).length > 0 ? {
+	return {
 		...jwkParams,
-		...result
-	} : result;
+		...await withGeneratedKid(kid, result)
+	};
 }
 var WeakMapJWKCache = class {
 	_map = /* @__PURE__ */ new WeakMap();
@@ -1131,44 +1791,58 @@ function clearJWKCache() {
 async function importKey(key, algOrOptions) {
 	const alg = typeof algOrOptions === "string" ? algOrOptions : algOrOptions?.alg ?? void 0;
 	const expect = typeof algOrOptions === "object" ? algOrOptions.expect ?? void 0 : void 0;
-	if (typeof key === "string") key = textEncoder.encode(key);
+	const extractable = typeof algOrOptions === "object" && !algOrOptions.asCryptoKey ? algOrOptions.extractable : void 0;
+	if (typeof key === "string") throw stringKeyError();
 	if (key instanceof Uint8Array) return key;
 	if (isCryptoKey(key)) {
 		assertIntentOnCryptoKey(key, expect);
 		return key;
 	}
-	if (isJWK(key)) if ("k" in key && typeof key.k === "string") {
-		const rawBytes = base64UrlDecode(key.k, { returnAs: "uint8array" });
-		assertOctKeyLength(rawBytes, key.alg || alg);
-		if (typeof algOrOptions === "object" && algOrOptions.asCryptoKey) {
-			const { algorithm, usage, extractable = false } = algOrOptions;
-			if (!algorithm || !usage) throw new JWTError("asCryptoKey option requires `algorithm` and `usage` to be provided.", "ERR_JWK_INVALID");
-			if (typeof algorithm === "object" && algorithm.name === "HMAC") {
-				const hash = algorithm.hash;
-				const hashName = typeof hash === "string" ? hash : hash?.name;
-				const minBytes = Number.parseInt(hashName?.slice(-3) ?? "", 10) / 8;
-				if (minBytes && rawBytes.length < minBytes) throw new JWTError(`HMAC with ${hashName} requires a key of at least ${minBytes} bytes (got ${rawBytes.length})`, "ERR_JWK_INVALID");
+	if (isJWK(key)) {
+		assertJWKAlgAuthority(key, alg);
+		if ("k" in key && typeof key.k === "string") {
+			const rawBytes = decodeSegment(key.k, {
+				family: "JWK",
+				what: "\"k\""
+			});
+			assertOctKeyLength(rawBytes, alg ?? key.alg);
+			if (typeof algOrOptions === "object" && algOrOptions.asCryptoKey) {
+				const { algorithm, usage, extractable: rawExtractable = false } = algOrOptions;
+				if (!algorithm || !usage) throw new JWTError("asCryptoKey option requires `algorithm` and `usage` to be provided.", "ERR_JWK_INVALID");
+				if (typeof algorithm === "object" && algorithm.name === "HMAC") {
+					const hash = "hash" in algorithm ? algorithm.hash : void 0;
+					const hashName = typeof hash === "string" ? hash : typeof hash === "object" && hash !== null && "name" in hash && typeof hash.name === "string" ? hash.name : void 0;
+					const minBytes = Number.parseInt(hashName?.slice(-3) ?? "", 10) / 8;
+					if (minBytes && rawBytes.length < minBytes) throw new JWTError(`HMAC with ${hashName} requires a key of at least ${minBytes} bytes (got ${rawBytes.length})`, "ERR_JWK_INVALID");
+				}
+				return crypto.subtle.importKey("raw", rawBytes, algorithm, rawExtractable, usage);
 			}
-			return crypto.subtle.importKey("raw", rawBytes, algorithm, extractable, usage);
-		}
-		return rawBytes;
-	} else {
-		if (!key.alg && !alg) throw new JWTError("Algorithm must be provided when importing non-oct JWK", "ERR_JWK_INVALID");
-		assertIntentOnJWK(key, expect);
-		const effectiveAlg = key.alg || alg;
-		if (_activeCache) {
-			const cached = _activeCache.get(key, effectiveAlg);
-			if (cached) return cached;
+			return rawBytes;
+		} else {
+			const effectiveAlg = key.alg || alg;
+			if (!effectiveAlg) throw new JWTError("Algorithm must be provided when importing non-oct JWK", "ERR_JWK_INVALID");
+			assertIntentOnJWK(key, expect);
+			const cache = extractable === void 0 ? _activeCache : false;
+			if (cache) {
+				const cached = await cache.get(key, effectiveAlg);
+				if (cached) return cached;
+			}
+			const cryptoKey = await jwkTokey(key.alg ? key : {
+				...key,
+				alg
+			}, { extractable });
+			if (cache) await cache.set(key, effectiveAlg, cryptoKey);
+			return cryptoKey;
 		}
-		const cryptoKey = await jwkTokey(key.alg ? key : {
-			...key,
-			alg
-		});
-		if (_activeCache) _activeCache.set(key, effectiveAlg, cryptoKey);
-		return cryptoKey;
 	}
 	throw new JWTError("Invalid key type provided to importKey", "ERR_JWK_INVALID");
 }
+function assertJWKAlgAuthority(jwk, alg) {
+	if (!alg || !jwk.alg || jwk.alg === alg) return;
+	if (jwk.kty === "oct" && alg === "dir" && isContentEncryptionAlgorithm(jwk.alg)) return;
+	if (isEd25519Signature(jwk.alg) && isEd25519Signature(alg)) return;
+	throw new JWTError(`JWK "alg" is "${jwk.alg}" but the operation requires "${alg}".`, "ERR_JWK_INVALID");
+}
 function assertIntentOnJWK(jwk, expect) {
 	if (expect === void 0 || jwk.kty === "oct") return;
 	const hasPrivateScalar = "d" in jwk && typeof jwk.d === "string";
@@ -1181,27 +1855,35 @@ function assertIntentOnCryptoKey(key, expect) {
 	if (expect === "private" && key.type === "public") throw new JWTError("Public CryptoKey passed where a private key is expected.", "ERR_JWK_INVALID");
 }
 async function exportKey(key, jwkParams) {
+	if (!isCryptoKey(key)) throw new JWTError(`exportKey expects a CryptoKey, got ${key === null ? "null" : typeof key}.`, "ERR_INVALID_OPTION");
+	if (!key.extractable) throw new JWTError("A non-extractable CryptoKey cannot be exported as a JWK.", "ERR_JWK_INVALID");
 	const exportedJwk = await keyToJWK(key);
-	if (jwkParams) return {
-		...exportedJwk,
-		...sanitizeObjectCopy(jwkParams)
-	};
+	if (jwkParams) {
+		const extraParams = sanitizeObjectCopy(jwkParams);
+		assertNoReservedJWKParams(extraParams);
+		return {
+			...exportedJwk,
+			...extraParams
+		};
+	}
 	return exportedJwk;
 }
-async function resolveWrappingKey(alg, key, expect) {
-	if (alg.startsWith("PBES2") && (typeof key === "string" || key instanceof Uint8Array)) return typeof key === "string" ? textEncoder.encode(key) : key;
-	if (typeof key === "string") throw new TypeError(`Key must be CryptoKey, JWK, or Uint8Array for ${alg}`);
-	if (expect !== void 0) return importKey(key, {
+async function wrapKey(keyToWrap, wrappingKey, options) {
+	assertPlainObject(options, "options");
+	assertKeyBytesArg(keyToWrap, "keyToWrap");
+	const { alg } = options;
+	const cekBytes = keyToWrap instanceof Uint8Array ? keyToWrap : new Uint8Array(await crypto.subtle.exportKey("raw", keyToWrap));
+	if (alg.endsWith("KW")) assertWrappableCEK(cekBytes, alg);
+	if (alg.startsWith("PBES2")) assertPBES2Params({
+		p2s: options.p2s,
+		p2c: options.p2c
+	});
+	const importedWrappingKey = await importKey(resolvePasswordKey(alg, wrappingKey), {
 		alg,
-		expect
+		expect: "public"
 	});
-	return importKey(key, alg);
-}
-async function wrapKey(alg, keyToWrap, wrappingKey, options = {}) {
-	const cekBytes = keyToWrap instanceof Uint8Array ? keyToWrap : new Uint8Array(await crypto.subtle.exportKey("raw", keyToWrap));
-	const importedWrappingKey = await resolveWrappingKey(alg, wrappingKey, "public");
 	switch (alg) {
-		case "dir": return { encryptedKey: new Uint8Array(0) };
+		case "dir": return { encryptedKey: /* @__PURE__ */ new Uint8Array(0) };
 		case "A128KW":
 		case "A192KW":
 		case "A256KW": return { encryptedKey: await aesKwWrap(alg, importedWrappingKey, cekBytes) };
@@ -1225,43 +1907,51 @@ async function wrapKey(alg, keyToWrap, wrappingKey, options = {}) {
 		case "RSA-OAEP":
 		case "RSA-OAEP-256":
 		case "RSA-OAEP-384":
-		case "RSA-OAEP-512": return { encryptedKey: await encryptRSAES(alg, importedWrappingKey, cekBytes) };
+		case "RSA-OAEP-512":
+			assertCryptoKeyFor(alg, importedWrappingKey, "wrapping");
+			return { encryptedKey: await encryptRSAES(alg, importedWrappingKey, cekBytes) };
 		case "ECDH-ES":
 		case "ECDH-ES+A128KW":
 		case "ECDH-ES+A192KW":
 		case "ECDH-ES+A256KW": {
-			if (!(importedWrappingKey instanceof CryptoKey)) throw new TypeError("ECDH-ES requires the wrapping key to be a CryptoKey (recipient's public key)");
-			if (!isECDHKeyAllowed(importedWrappingKey)) throw new JWTError("ECDH with the provided key is not allowed or not supported", "ERR_JWK_INVALID");
-			const apu = options.ecdh?.partyUInfo ?? new Uint8Array(0);
-			const apv = options.ecdh?.partyVInfo ?? new Uint8Array(0);
-			const { ephemeralPrivateKey, epkJwk } = await resolveECDHEphemeralPair(importedWrappingKey, options.ecdh?.ephemeralKey);
-			const infoAlg = alg === "ECDH-ES" ? (() => {
-				if (!options.ecdh?.enc) throw new JWTError("ECDH-ES direct key agreement requires options.ecdh.enc (the target content encryption algorithm)", "ERR_JWK_INVALID");
-				return options.ecdh.enc;
-			})() : alg;
-			const sharedSecret = await deriveECDHESKey(importedWrappingKey, ephemeralPrivateKey, infoAlg, alg === "ECDH-ES" ? bitLengthCEK(infoAlg) : Number.parseInt(alg.slice(-5, -2), 10), apu, apv);
+			assertCryptoKeyFor(alg, importedWrappingKey, "wrapping");
+			const enc = options.ecdh?.enc;
+			if (alg === "ECDH-ES" && !enc) throw new JWTError("ECDH-ES direct key agreement requires options.ecdh.enc (the target content encryption algorithm)", "ERR_JWK_INVALID");
+			const { encryptedKey, parameters } = await ecdhesWrap(alg, {
+				enc,
+				recipientKey: importedWrappingKey,
+				cek: cekBytes,
+				parameters: buildECDHAgreementParams(options.ecdh)
+			});
 			const wrapResult = {
-				encryptedKey: new Uint8Array(0),
-				epk: epkJwk
+				encryptedKey: encryptedKey ?? /* @__PURE__ */ new Uint8Array(0),
+				epk: parameters.epk
 			};
-			if (apu.length > 0) wrapResult.apu = base64UrlEncode(apu);
-			if (apv.length > 0) wrapResult.apv = base64UrlEncode(apv);
-			if (alg === "ECDH-ES") return wrapResult;
-			wrapResult.encryptedKey = await aesKwWrap(alg.slice(-6), sharedSecret, cekBytes);
+			if (parameters.apu) wrapResult.apu = parameters.apu;
+			if (parameters.apv) wrapResult.apv = parameters.apv;
 			return wrapResult;
 		}
 		default: throw new JWTError(`Unsupported key wrapping algorithm: ${alg}`, "ERR_JWK_UNSUPPORTED");
 	}
 }
-async function unwrapKey(alg, wrappedKey, unwrappingKey, options = {}) {
+async function unwrapKey(wrappedKey, unwrappingKey, options) {
+	assertPlainObject(options, "options");
+	if (!(wrappedKey instanceof Uint8Array)) throw new JWTError("\"wrappedKey\" must be a Uint8Array.", "ERR_INVALID_OPTION");
+	const { alg } = options;
 	const returnRaw = options.format === "raw";
 	const defaultExtractable = options.extractable !== false;
-	const importedUnwrappingKey = await resolveWrappingKey(alg, unwrappingKey, "private");
+	const importedUnwrappingKey = await importKey(resolvePasswordKey(alg, unwrappingKey), {
+		alg,
+		expect: "private"
+	});
 	let unwrappedCekBytes;
 	switch (alg) {
 		case "dir":
-			if (importedUnwrappingKey instanceof Uint8Array) unwrappedCekBytes = importedUnwrappingKey;
-			else {
+			assertDirectKeyRole(unwrappingKey, options.enc);
+			if (importedUnwrappingKey instanceof Uint8Array) {
+				assertOctKeyLength(importedUnwrappingKey, options.enc);
+				unwrappedCekBytes = importedUnwrappingKey;
+			} else {
 				if (!returnRaw) return importedUnwrappingKey;
 				unwrappedCekBytes = new Uint8Array(await crypto.subtle.exportKey("raw", importedUnwrappingKey));
 			}
@@ -1269,28 +1959,33 @@ async function unwrapKey(alg, wrappedKey, unwrappingKey, options = {}) {
 		case "A128KW":
 		case "A192KW":
 		case "A256KW":
-			unwrappedCekBytes = await aesKwUnwrap(alg, importedUnwrappingKey, wrappedKey);
+			unwrappedCekBytes = await unwrapping(aesKwUnwrap(alg, importedUnwrappingKey, wrappedKey));
 			break;
 		case "PBES2-HS256+A128KW":
 		case "PBES2-HS384+A192KW":
 		case "PBES2-HS512+A256KW": {
 			const { p2s, p2c, minIterations, maxIterations } = options;
 			if (!p2s || typeof p2c !== "number") throw new JWTError("PBES2 requires 'p2s' (salt) and 'p2c' (count) options", "ERR_JWE_INVALID");
-			unwrappedCekBytes = await pbes2Unwrap(alg, importedUnwrappingKey, wrappedKey, p2c, typeof p2s === "string" ? base64UrlDecode(p2s, { returnAs: "uint8array" }) : p2s, minIterations, maxIterations);
+			unwrappedCekBytes = await unwrapping(pbes2Unwrap(alg, importedUnwrappingKey, wrappedKey, p2c, segmentBytes(p2s, "p2s"), minIterations, maxIterations));
 			break;
 		}
 		case "A128GCMKW":
 		case "A192GCMKW":
-		case "A256GCMKW":
+		case "A256GCMKW": {
 			if (!options.iv || !options.tag) throw new JWTError("AES-GCMKW requires 'iv' and 'tag' options for unwrapping", "ERR_JWE_INVALID");
-			unwrappedCekBytes = await gcmkwDecrypt(alg, importedUnwrappingKey, wrappedKey, typeof options.iv === "string" ? base64UrlDecode(options.iv, { returnAs: "uint8array" }) : options.iv, typeof options.tag === "string" ? base64UrlDecode(options.tag, { returnAs: "uint8array" }) : options.tag);
+			const ivBytes = segmentBytes(options.iv, "iv");
+			const tagBytes = segmentBytes(options.tag, "tag");
+			assertKeyWrapSegmentLength("iv", ivBytes, bitLengthIV(alg) >> 3, alg);
+			assertKeyWrapSegmentLength("tag", tagBytes, bitLengthTag(alg) >> 3, alg);
+			unwrappedCekBytes = await unwrapping(gcmkwDecrypt(alg, importedUnwrappingKey, wrappedKey, ivBytes, tagBytes));
 			break;
+		}
 		case "RSA-OAEP":
 		case "RSA-OAEP-256":
 		case "RSA-OAEP-384":
 		case "RSA-OAEP-512": {
-			if (!(importedUnwrappingKey instanceof CryptoKey)) throw new TypeError("RSA-OAEP requires the unwrapping key to be provided as a CryptoKey");
-			unwrappedCekBytes = await decryptRSAES(alg, importedUnwrappingKey, wrappedKey);
+			assertCryptoKeyFor(alg, importedUnwrappingKey, "unwrapping");
+			unwrappedCekBytes = await unwrapping(decryptRSAES(alg, importedUnwrappingKey, wrappedKey));
 			if (returnRaw) break;
 			const inferredAlgorithm = options.unwrappedKeyAlgorithm || inferAesImportAlgorithm(options.enc, unwrappedCekBytes.length);
 			if (!inferredAlgorithm) throw new JWTError("Unable to infer algorithm for RSA-OAEP unwrapped key. Provide \"unwrappedKeyAlgorithm\" in options.", "ERR_JWE_INVALID");
@@ -1302,20 +1997,24 @@ async function unwrapKey(alg, wrappedKey, unwrappingKey, options = {}) {
 		case "ECDH-ES+A192KW":
 		case "ECDH-ES+A256KW": {
 			if (!options.epk) throw new JWTError("ECDH-ES requires 'epk' (Ephemeral Public Key) option", "ERR_JWE_INVALID");
-			if (!(importedUnwrappingKey instanceof CryptoKey)) throw new TypeError("ECDH-ES requires the unwrapping key to be a CryptoKey");
-			if (!isECDHKeyAllowed(importedUnwrappingKey)) throw new JWTError("ECDH with the provided key is not allowed or not supported", "ERR_JWK_INVALID");
-			const epkCandidate = options.epk instanceof CryptoKey ? options.epk : await normalizeKey(options.epk, alg);
-			if (!(epkCandidate instanceof CryptoKey)) throw new JWTError("Failed to normalize ECDH ephemeral public key", "ERR_JWK_INVALID");
-			const apuBytes = typeof options.apu === "string" ? base64UrlDecode(options.apu, { returnAs: "uint8array" }) : options.apu ?? new Uint8Array(0);
-			const apvBytes = typeof options.apv === "string" ? base64UrlDecode(options.apv, { returnAs: "uint8array" }) : options.apv ?? new Uint8Array(0);
+			assertCryptoKeyFor(alg, importedUnwrappingKey, "unwrapping");
+			assertECDHKeyAllowed(importedUnwrappingKey);
+			const epkCandidate = await normalizeEpk(options.epk, {
+				alg,
+				recipientKey: importedUnwrappingKey
+			});
+			const apuBytes = segmentBytes(options.apu ?? /* @__PURE__ */ new Uint8Array(0), "apu");
+			const apvBytes = segmentBytes(options.apv ?? /* @__PURE__ */ new Uint8Array(0), "apv");
+			assertPartyInfoLength("apu", apuBytes);
+			assertPartyInfoLength("apv", apvBytes);
 			const infoAlg = alg === "ECDH-ES" ? options.enc : alg;
 			if (!infoAlg) throw new JWTError("ECDH-ES requires content encryption algorithm ('enc') to derive the shared secret", "ERR_JWE_INVALID");
-			const sharedSecret = await deriveECDHESKey(epkCandidate, importedUnwrappingKey, infoAlg, alg === "ECDH-ES" ? bitLengthCEK(infoAlg) : Number.parseInt(alg.slice(-5, -2), 10), apuBytes, apvBytes);
+			const sharedSecret = await unwrapping(deriveECDHESKey(epkCandidate, importedUnwrappingKey, infoAlg, ecdhDerivedBits(alg, infoAlg), apuBytes, apvBytes));
 			if (alg === "ECDH-ES") unwrappedCekBytes = sharedSecret;
 			else {
-				const kwAlg = alg.slice(-6);
+				const kwAlg = innerKeyWrapAlg(alg);
 				if (!(wrappedKey instanceof Uint8Array) || wrappedKey.length === 0) throw new JWTError("ECDH-ES key agreement with key wrapping requires an encrypted key", "ERR_JWE_INVALID");
-				unwrappedCekBytes = await aesKwUnwrap(kwAlg, sharedSecret, wrappedKey);
+				unwrappedCekBytes = await unwrapping(aesKwUnwrap(kwAlg, sharedSecret, wrappedKey));
 			}
 			break;
 		}
@@ -1325,6 +2024,8 @@ async function unwrapKey(alg, wrappedKey, unwrappingKey, options = {}) {
 	return await crypto.subtle.importKey("raw", unwrappedCekBytes, options.unwrappedKeyAlgorithm || { name: "AES-GCM" }, defaultExtractable, options.keyUsage || ["encrypt", "decrypt"]);
 }
 async function importPEM(pem, alg, options) {
+	if (typeof pem !== "string") throw new JWTError(`"pem" must be a PEM-encoded string, got ${pem === null ? "null" : typeof pem}.`, "ERR_INVALID_OPTION");
+	if (options !== void 0) assertPlainObject(options, "options");
 	const extractable = true;
 	const pemType = options?.pemType ?? inferPEMType(pem);
 	if (!pemType) throw new JWTError("Cannot infer PEM type from the input; pass \"options.pemType\" explicitly.", "ERR_JWK_INVALID");
@@ -1339,30 +2040,28 @@ async function importPEM(pem, alg, options) {
 		case "x509":
 			cryptoKey = await fromX509(pem, alg, { extractable });
 			break;
-		default: throw new JWTError(`Unsupported PEM type: ${pemType}`, "ERR_JWK_UNSUPPORTED");
+		default: throw new JWTError(`Unsupported PEM type: ${String(pemType)}`, "ERR_JWK_UNSUPPORTED");
 	}
 	return {
 		...await exportKey(cryptoKey, options?.jwkParams),
 		alg
 	};
 }
-async function importFromPEM(pem, pemType, alg, options) {
-	return importPEM(pem, alg, {
-		pemType,
-		...options
-	});
-}
 async function exportPEM(jwk, options) {
+	assertPlainObject(jwk, "jwk");
+	if (options !== void 0) assertPlainObject(options, "options");
 	if (jwk.kty === "oct") throw new JWTError("Octet (symmetric) JWKs (kty: 'oct') cannot be exported to PKCS8 or SPKI PEM formats.", "ERR_JWK_UNSUPPORTED");
 	const effectiveAlg = jwk.alg || options?.alg;
 	if (!effectiveAlg && (jwk.kty === "RSA" || jwk.kty === "EC" || jwk.kty === "OKP")) throw new JWTError("Algorithm (alg) must be provided in the JWK or via options for converting this JWK type to a CryptoKey.", "ERR_JWK_INVALID");
+	if (effectiveAlg !== void 0 && !PEM_ALGORITHMS.has(effectiveAlg)) throw new JWTError(`Unsupported PEM algorithm: ${effectiveAlg}`, "ERR_JWK_UNSUPPORTED");
 	const pemFormat = options?.pemFormat ?? ("d" in jwk ? "pkcs8" : "spki");
 	const cryptoKeyCandidate = await importKey({
 		...jwk,
 		ext: true
 	}, {
 		alg: effectiveAlg,
-		expect: pemFormat === "pkcs8" ? "private" : "public"
+		expect: pemFormat === "pkcs8" ? "private" : "public",
+		extractable: true
 	});
 	if (!isCryptoKey(cryptoKeyCandidate)) throw new JWTError("Failed to convert JWK to a CryptoKey instance suitable for PEM export.", "ERR_JWK_INVALID");
 	const cryptoKey = cryptoKeyCandidate;
@@ -1373,111 +2072,83 @@ async function exportPEM(jwk, options) {
 		case "spki":
 			if (cryptoKey.type !== "public") throw new JWTError(`Only 'public' type CryptoKeys can be exported to SPKI PEM format. Key type is '${cryptoKey.type}'.`, "ERR_JWK_INVALID");
 			return toSPKI(cryptoKey);
-		default: throw new JWTError(`Unsupported PEM format: ${pemFormat}`, "ERR_JWK_UNSUPPORTED");
+		default: throw new JWTError(`Unsupported PEM format: ${String(pemFormat)}`, "ERR_JWK_UNSUPPORTED");
 	}
 }
-async function exportToPEM(jwk, pemFormat, algForCryptoKeyImport) {
-	return exportPEM(jwk, {
-		pemFormat,
-		alg: algForCryptoKeyImport
-	});
-}
 function inferPEMType(pem) {
 	if (pem.includes("-----BEGIN PRIVATE KEY-----")) return "pkcs8";
 	if (pem.includes("-----BEGIN PUBLIC KEY-----")) return "spki";
 	if (pem.includes("-----BEGIN CERTIFICATE-----")) return "x509";
 }
-async function deriveSharedSecret(publicKey, privateKey, alg, options) {
+async function deriveSharedSecret(publicKey, privateKey, options) {
+	assertPlainObject(options, "options");
+	const { enc: alg, keyLength: requestedKeyLength, partyUInfo, partyVInfo } = options;
+	if (requestedKeyLength !== void 0) assertDerivedKeyLength(requestedKeyLength);
+	const importAlg = alg.startsWith("ECDH-ES") ? alg : "ECDH-ES";
 	const pubCryptoKey = isCryptoKey(publicKey) ? publicKey : await importKey(publicKey, {
-		alg: "ECDH-ES",
+		alg: importAlg,
 		expect: "public"
 	});
 	const privCryptoKey = isCryptoKey(privateKey) ? privateKey : await importKey(privateKey, {
-		alg: "ECDH-ES",
+		alg: importAlg,
 		expect: "private"
 	});
 	let keyLength;
-	if (options?.keyLength !== void 0) keyLength = options.keyLength;
-	else if (alg === "ECDH-ES") throw new JWTError("deriveSharedSecret with alg \"ECDH-ES\" requires an explicit keyLength in options", "ERR_JWK_INVALID");
+	if (requestedKeyLength !== void 0) keyLength = requestedKeyLength;
+	else if (alg === "ECDH-ES") throw new JWTError("deriveSharedSecret with enc \"ECDH-ES\" requires an explicit keyLength in options", "ERR_JWK_INVALID");
 	else if (alg.startsWith("ECDH-ES+")) keyLength = Number.parseInt(alg.slice(-5, -2), 10);
 	else keyLength = bitLengthCEK(alg);
-	return deriveECDHESKey(pubCryptoKey, privCryptoKey, alg, keyLength, options?.partyUInfo ?? new Uint8Array(0), options?.partyVInfo ?? new Uint8Array(0));
-}
-function getJWKFromSet(jwkSet, kidOrProtectedHeader) {
-	if (!jwkSet || !isJWKSet(jwkSet)) throw new JWTError("Invalid JWK Set provided", "ERR_JWK_INVALID");
-	if (typeof kidOrProtectedHeader === "string") {
-		const kid = kidOrProtectedHeader;
-		const selectedKey = jwkSet.keys.find((k) => k.kid === kid);
-		if (!selectedKey) throw new JWTError(`No key found in JWK Set with kid "${kid}".`, "ERR_JWK_KEY_NOT_FOUND");
-		return selectedKey;
-	} else if (typeof kidOrProtectedHeader === "object") {
-		const { kid, alg, kty } = kidOrProtectedHeader;
-		if (!kid) {
-			if (jwkSet.keys.length === 1) return jwkSet.keys[0];
-			throw new JWTError("JWS Protected Header is missing 'kid' (Key ID) and the JWK Set contains multiple keys. Add a 'kid' parameter to the token header and to the matching JWK to enable automatic selection.", "ERR_JWK_KEY_NOT_FOUND");
-		}
-		const selectedKey = jwkSet.keys.find((k) => {
-			return k.kid === kid && (!alg || k.alg === alg) && (!kty || k.kty === kty);
-		});
-		if (!selectedKey) {
-			let errorMessage = `No key found in JWK Set with kid "${kid}"`;
-			if (alg) errorMessage += ` and alg "${alg}"`;
-			if (kty) errorMessage += ` and kty "${kty}"`;
-			errorMessage += ".";
-			throw new JWTError(errorMessage, "ERR_JWK_KEY_NOT_FOUND");
-		}
-		return selectedKey;
-	}
-	throw new TypeError("`kidOrProtectedHeader` must be a string (kid) or an object (JOSE Protected Header).");
+	return deriveECDHESKey(pubCryptoKey, privCryptoKey, alg, keyLength, partyUInfo ?? /* @__PURE__ */ new Uint8Array(0), partyVInfo ?? /* @__PURE__ */ new Uint8Array(0));
 }
 function getJWKsFromSet(jwkSet, filter) {
 	if (!jwkSet || !isJWKSet(jwkSet)) throw new JWTError("Invalid JWK Set provided", "ERR_JWK_INVALID");
-	if (!filter) return [...jwkSet.keys];
-	return jwkSet.keys.filter(filter);
+	const keys = jwkSet.keys.filter((key) => isJWK(key));
+	return filter ? keys.filter(filter) : keys;
 }
 function getGenerateKeyParams(alg, options) {
 	let algorithm;
 	let keyUsages;
-	const defaultKeyUsage = options?.keyUsage;
+	const requested = options?.keyUsage;
+	const usage = (allowed, fallback) => resolveKeyUsage(requested, {
+		allowed,
+		fallback,
+		alg
+	});
+	const pairUsage = (allowed, fallback) => assertPairUsages(usage(allowed, fallback), {
+		fallback,
+		alg
+	});
 	switch (alg) {
 		case "HS256":
 		case "HS384":
 		case "HS512":
 			algorithm = {
 				name: "HMAC",
-				hash: `SHA-${alg.slice(2)}`
+				hash: jwsHashOf(alg)
 			};
-			keyUsages = defaultKeyUsage ?? ["sign", "verify"];
+			keyUsages = usage(SIGNATURE_USAGES, ["sign", "verify"]);
 			break;
 		case "RS256":
 		case "RS384":
 		case "RS512":
 			algorithm = {
 				name: "RSASSA-PKCS1-v1_5",
-				modulusLength: options?.modulusLength ?? 2048,
-				publicExponent: options?.publicExponent ?? new Uint8Array([
-					1,
-					0,
-					1
-				]),
-				hash: `SHA-${alg.slice(2)}`
+				modulusLength: assertModulusLength(options?.modulusLength),
+				publicExponent: assertPublicExponent(options?.publicExponent),
+				hash: jwsHashOf(alg)
 			};
-			keyUsages = defaultKeyUsage ?? ["sign", "verify"];
+			keyUsages = pairUsage(SIGNATURE_USAGES, ["sign", "verify"]);
 			break;
 		case "PS256":
 		case "PS384":
 		case "PS512":
 			algorithm = {
 				name: "RSA-PSS",
-				modulusLength: options?.modulusLength ?? 2048,
-				publicExponent: options?.publicExponent ?? new Uint8Array([
-					1,
-					0,
-					1
-				]),
-				hash: `SHA-${alg.slice(2)}`
+				modulusLength: assertModulusLength(options?.modulusLength),
+				publicExponent: assertPublicExponent(options?.publicExponent),
+				hash: jwsHashOf(alg)
 			};
-			keyUsages = defaultKeyUsage ?? ["sign", "verify"];
+			keyUsages = pairUsage(SIGNATURE_USAGES, ["sign", "verify"]);
 			break;
 		case "RSA-OAEP":
 		case "RSA-OAEP-256":
@@ -1485,74 +2156,67 @@ function getGenerateKeyParams(alg, options) {
 		case "RSA-OAEP-512":
 			algorithm = {
 				name: "RSA-OAEP",
-				modulusLength: options?.modulusLength ?? 2048,
-				publicExponent: options?.publicExponent ?? new Uint8Array([
-					1,
-					0,
-					1
-				]),
-				hash: `SHA-${Number.parseInt(alg.slice(9), 10) || 1}`
+				modulusLength: assertModulusLength(options?.modulusLength),
+				publicExponent: assertPublicExponent(options?.publicExponent),
+				hash: rsaOaepHashOf(alg)
 			};
-			keyUsages = defaultKeyUsage ?? [
+			keyUsages = pairUsage(KEY_ENCRYPTION_USAGES, [
 				"encrypt",
 				"decrypt",
 				"wrapKey",
 				"unwrapKey"
-			];
+			]);
 			break;
 		case "A128KW":
 		case "A192KW":
 		case "A256KW":
 			algorithm = {
 				name: "AES-KW",
-				length: Number.parseInt(alg.slice(1, 4), 10)
+				length: aesBitsOf(alg)
 			};
-			keyUsages = defaultKeyUsage ?? ["wrapKey", "unwrapKey"];
+			keyUsages = usage(KEY_WRAPPING_USAGES, ["wrapKey", "unwrapKey"]);
 			break;
 		case "A128GCM":
 		case "A192GCM":
 		case "A256GCM":
 		case "A128GCMKW":
 		case "A192GCMKW":
-		case "A256GCMKW": {
-			const baseAlg = alg.replace("KW", "");
+		case "A256GCMKW":
 			algorithm = {
 				name: "AES-GCM",
-				length: Number.parseInt(baseAlg.slice(1, 4), 10)
+				length: aesBitsOf(alg)
 			};
-			keyUsages = defaultKeyUsage ?? (alg.endsWith("KW") ? ["wrapKey", "unwrapKey"] : ["encrypt", "decrypt"]);
+			keyUsages = usage(KEY_ENCRYPTION_USAGES, ["encrypt", "decrypt"]);
 			break;
-		}
 		case "ES256":
 		case "ES384":
-		case "ES512":
+		case "ES512": {
+			const namedCurve = ECDSA_CURVES[alg];
+			assertNamedCurve(options?.namedCurve, namedCurve, alg);
 			algorithm = {
 				name: "ECDSA",
-				namedCurve: `P-${alg.slice(2)}`
+				namedCurve
 			};
-			keyUsages = defaultKeyUsage ?? ["sign", "verify"];
+			keyUsages = pairUsage(SIGNATURE_USAGES, ["sign", "verify"]);
 			break;
+		}
 		case "Ed25519":
-			keyUsages = defaultKeyUsage ?? ["sign", "verify"];
+			assertNamedCurve(options?.namedCurve, "Ed25519", alg);
+			keyUsages = pairUsage(SIGNATURE_USAGES, ["sign", "verify"]);
 			algorithm = { name: "Ed25519" };
 			break;
 		case "EdDSA": {
-			keyUsages = defaultKeyUsage ?? ["sign", "verify"];
+			keyUsages = pairUsage(SIGNATURE_USAGES, ["sign", "verify"]);
 			const namedCurve = options?.namedCurve ?? "Ed25519";
-			switch (namedCurve) {
-				case "Ed25519":
-				case "Ed448":
-					algorithm = { name: namedCurve };
-					break;
-				default: throw new JWTError("Unsupported namedCurve provided. Supported values are: Ed25519 and Ed448", "ERR_JWK_UNSUPPORTED");
-			}
+			if (namedCurve !== "Ed25519") throw new JWTError("Unsupported namedCurve provided. Supported values are: Ed25519", "ERR_JWK_UNSUPPORTED");
+			algorithm = { name: namedCurve };
 			break;
 		}
 		case "ECDH-ES":
 		case "ECDH-ES+A128KW":
 		case "ECDH-ES+A192KW":
 		case "ECDH-ES+A256KW": {
-			keyUsages = ["deriveBits"];
+			keyUsages = pairUsage(DERIVATION_USAGES, ["deriveBits"]);
 			const namedCurve = options?.namedCurve ?? "P-256";
 			switch (namedCurve) {
 				case "P-256":
@@ -1577,58 +2241,12 @@ function getGenerateKeyParams(alg, options) {
 		keyUsages
 	};
 }
-async function resolveECDHEphemeralPair(recipientPublicKey, ephemeralKeyInput) {
-	if (!ephemeralKeyInput) {
-		const generated = await crypto.subtle.generateKey(recipientPublicKey.algorithm, true, ["deriveBits"]);
-		const rawJwk = await keyToJWK(generated.publicKey);
-		return {
-			ephemeralPrivateKey: generated.privateKey,
-			epkJwk: stripPrivateJwkFields(rawJwk)
-		};
-	}
-	if (isCryptoKeyPair(ephemeralKeyInput)) {
-		const rawJwk = await keyToJWK(ephemeralKeyInput.publicKey);
-		return {
-			ephemeralPrivateKey: ephemeralKeyInput.privateKey,
-			epkJwk: stripPrivateJwkFields(rawJwk)
-		};
-	}
-	if (typeof ephemeralKeyInput === "object" && "publicKey" in ephemeralKeyInput && "privateKey" in ephemeralKeyInput) {
-		const { publicKey, privateKey } = ephemeralKeyInput;
-		return {
-			ephemeralPrivateKey: isCryptoKey(privateKey) ? privateKey : await importKey(privateKey, {
-				alg: "ECDH-ES",
-				expect: "private"
-			}),
-			epkJwk: isCryptoKey(publicKey) ? stripPrivateJwkFields(await keyToJWK(publicKey)) : stripPrivateJwkFields(publicKey)
-		};
-	}
-	if (isCryptoKey(ephemeralKeyInput)) {
-		if (ephemeralKeyInput.type !== "private") throw new JWTError("ECDH-ES ephemeral CryptoKey must be a private key", "ERR_JWK_INVALID");
-		return {
-			ephemeralPrivateKey: ephemeralKeyInput,
-			epkJwk: stripPrivateJwkFields(await keyToJWK(ephemeralKeyInput))
-		};
-	}
-	if (isJWK(ephemeralKeyInput) && "d" in ephemeralKeyInput) return {
-		ephemeralPrivateKey: await importKey(ephemeralKeyInput, {
-			alg: "ECDH-ES",
-			expect: "private"
-		}),
-		epkJwk: stripPrivateJwkFields(ephemeralKeyInput)
-	};
-	throw new JWTError("Unsupported ECDH-ES ephemeral key material", "ERR_JWK_INVALID");
-}
-function stripPrivateJwkFields(jwk) {
-	const { d: _d, ...pub } = jwk;
-	return pub;
-}
 function inferAesImportAlgorithm(enc, cekLengthBytes) {
 	const bitLength = cekLengthBytes << 3;
 	if (enc) {
 		if (enc.includes("GCM")) return {
 			name: "AES-GCM",
-			length: Number.parseInt(enc.slice(1, 4), 10)
+			length: aesBitsOf(enc)
 		};
 		if (enc.includes("CBC-HS")) return;
 	}
@@ -1637,4 +2255,154 @@ function inferAesImportAlgorithm(enc, cekLengthBytes) {
 		length: bitLength
 	};
 }
-export { WeakMapJWKCache, assertOctKeyLength, clearJWKCache, configureJWKCache, decrypt, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, encrypt, encryptKey, exportKey, exportPEM, exportToPEM, generateCEK, generateIV, generateJWK, generateKey, getJWKFromSet, getJWKsFromSet, importFromPEM, importKey, importPEM, sign, unwrapKey, verify, wrapKey };
+const RESERVED_JWK_PARAMS = /* @__PURE__ */ new Set([
+	"kty",
+	"alg",
+	"key_ops",
+	"ext",
+	"k",
+	"d",
+	"n",
+	"e",
+	"p",
+	"q",
+	"dp",
+	"dq",
+	"qi",
+	"oth",
+	"x",
+	"y",
+	"crv"
+]);
+function assertNoReservedJWKParams(jwkParams) {
+	const reserved = Object.keys(jwkParams).filter((name) => RESERVED_JWK_PARAMS.has(name));
+	if (reserved.length > 0) throw new JWTError(`jwkParams must not set reserved JWK members: ${reserved.join(", ")}`, "ERR_INVALID_OPTION");
+}
+function assertNamedCurve(requested, expected, alg) {
+	if (requested === void 0 || requested === expected) return;
+	throw new JWTError(`"namedCurve" ${requested} contradicts ${alg}, which is defined over ${expected}.`, "ERR_INVALID_OPTION");
+}
+function assertPublicExponent(publicExponent) {
+	if (publicExponent === void 0) return new Uint8Array([
+		1,
+		0,
+		1
+	]);
+	if (!(publicExponent instanceof Uint8Array) || publicExponent.length === 0) throw new JWTError("\"publicExponent\" must be the exponent's big-endian bytes as a Uint8Array.", "ERR_INVALID_OPTION");
+	return publicExponent;
+}
+const SIGNATURE_USAGES = ["sign", "verify"];
+const KEY_WRAPPING_USAGES = ["wrapKey", "unwrapKey"];
+const KEY_ENCRYPTION_USAGES = [
+	"encrypt",
+	"decrypt",
+	"wrapKey",
+	"unwrapKey"
+];
+const DERIVATION_USAGES = ["deriveBits", "deriveKey"];
+const CONTENT_ENCRYPTION_USAGES = ["encrypt", "decrypt"];
+function resolveKeyUsage(requested, options) {
+	const { allowed, fallback, alg } = options;
+	if (requested === void 0) return fallback;
+	if (!Array.isArray(requested) || requested.length === 0) throw new JWTError("\"keyUsage\" must be a non-empty array.", "ERR_INVALID_OPTION");
+	const rejected = requested.filter((entry) => !allowed.includes(entry));
+	if (rejected.length > 0) throw new JWTError(`"keyUsage" ${rejected.join(", ")} cannot be served by ${alg}; it admits ${allowed.join(", ")}.`, "ERR_INVALID_OPTION");
+	return requested;
+}
+const PRIVATE_KEY_USAGES = [
+	"sign",
+	"decrypt",
+	"unwrapKey",
+	"deriveBits",
+	"deriveKey"
+];
+const PUBLIC_KEY_USAGES = [
+	"verify",
+	"encrypt",
+	"wrapKey"
+];
+function assertPairUsages(usages, options) {
+	const { fallback, alg } = options;
+	for (const [half, side] of [[PRIVATE_KEY_USAGES, "private"], [PUBLIC_KEY_USAGES, "public"]]) {
+		const wanted = fallback.filter((entry) => half.includes(entry));
+		if (wanted.length === 0 || usages.some((entry) => half.includes(entry))) continue;
+		throw new JWTError(`"keyUsage" leaves the ${side} half of a ${alg} key pair with no usage; include one of ${wanted.join(", ")}.`, "ERR_INVALID_OPTION");
+	}
+	return usages;
+}
+function assertKidOption(kid) {
+	if (kid === void 0 || kid === false || typeof kid === "string") return kid;
+	throw new JWTError("\"kid\" must be a string or false.", "ERR_INVALID_OPTION");
+}
+async function withGeneratedKid(kid, jwk) {
+	if (kid === false) return jwk;
+	return {
+		...jwk,
+		kid: kid ?? await thumbprint(jwk)
+	};
+}
+const PEM_ALGORITHMS = /* @__PURE__ */ new Set(Object.keys({
+	"PS256": true,
+	"PS384": true,
+	"PS512": true,
+	"RS256": true,
+	"RS384": true,
+	"RS512": true,
+	"RSA-OAEP": true,
+	"RSA-OAEP-256": true,
+	"RSA-OAEP-384": true,
+	"RSA-OAEP-512": true,
+	"ES256": true,
+	"ES384": true,
+	"ES512": true,
+	"ECDH-ES": true,
+	"ECDH-ES+A128KW": true,
+	"ECDH-ES+A192KW": true,
+	"ECDH-ES+A256KW": true,
+	"Ed25519": true,
+	"EdDSA": true
+}));
+function assertWrappableCEK(cek, alg) {
+	if (cek.length >= 16 && cek.length % 8 === 0) return;
+	throw new JWTError(`${alg} wraps a key of 16 or more bytes in whole 8-byte blocks (got ${cek.length}).`, "ERR_INVALID_OPTION");
+}
+async function unwrapping(operation) {
+	try {
+		return await operation;
+	} catch (error) {
+		throw asDecryptionError(error);
+	}
+}
+function assertPBES2Algorithm(alg) {
+	if (typeof alg === "string" && PBES2_ALGORITHMS.includes(alg)) return;
+	throw new JWTError(`Password derivation is defined for ${PBES2_ALGORITHMS.join(", ")}, not ${String(alg)}.`, "ERR_JWK_UNSUPPORTED");
+}
+function assertKeyBytesArg(value, name) {
+	if (value instanceof Uint8Array || isCryptoKey(value)) return;
+	throw new JWTError(`"${name}" must be a Uint8Array or a CryptoKey, got ${value === null ? "null" : typeof value}.`, "ERR_INVALID_OPTION");
+}
+function assertModulusLength(modulusLength) {
+	const length = modulusLength ?? 2048;
+	if (!Number.isInteger(length) || length < 2048) throw new JWTError("modulusLength must be at least 2048 bits (RFC 7518 §3.3)", "ERR_INVALID_OPTION");
+	return length;
+}
+function assertPartyInfoLength(name, bytes) {
+	if (bytes.length > 1024) throw new JWTError(`Invalid JWE: "${name}" must not exceed ${MAX_PARTY_INFO_BYTES} bytes (got ${bytes.length}).`, "ERR_JWE_INVALID");
+}
+function assertKeyWrapSegmentLength(name, bytes, expected, alg) {
+	if (bytes.length !== expected) throw new JWTError(`Invalid JWE: "${name}" must be ${expected} bytes for ${alg} (got ${bytes.length}).`, "ERR_JWE_INVALID");
+}
+function assertDerivedKeyLength(keyLength) {
+	if (!Number.isInteger(keyLength) || keyLength <= 0 || keyLength % 8 !== 0 || keyLength > 8192) throw new JWTError(`keyLength must be a positive multiple of 8 no greater than 8192 bits, got ${keyLength}`, "ERR_INVALID_OPTION");
+}
+function assertCryptoKeyFor(alg, key, role) {
+	if (isCryptoKey(key)) return;
+	throw new JWTError(`${alg.startsWith("RSA") ? "RSA-OAEP" : "ECDH-ES"} requires the ${role} key to be a CryptoKey`, "ERR_JWK_INVALID");
+}
+function segmentBytes(value, name) {
+	return typeof value === "string" ? decodeSegment(value, {
+		family: "JWE",
+		what: `"${name}"`
+	}) : value;
+}
+export { DEFAULT_JOSE_LIMITS, DEFAULT_PBES2_ITERATIONS, JWE_ALG_CTX, JWE_DIRECT_ALGS, JWS_ALG_CTX, WeakMapJWKCache, applyB64Header, asDecryptionError, asJWTError, asKeyLookupError, asKeyUsageError, assertB64Option, assertCompactToken, assertConsumerOptions, assertDirectKeyRole, assertEntryLimit, assertJWEAlgSupported, assertJWEEncSupported, assertJWKSetCandidates, assertNoZipOption, assertNotStringKey, assertOptionEntry, assertPBES2Params, assertProducerCEK, assertProducerCrit, assertProducerIV, assertProtectedOnlyOption, assertSerializationObject, buildECDHAgreementParams, buildJWKSetFilter, buildUnwrapKeyOptions, checkAlgAllowed, checkJWEAlgSupported, checkJWEContentSegments, checkJWEDirectEncryptedKey, checkJWEEncAllowed, checkJWEEncSupported, checkJWEUnprotectedCrit, checkJWEZip, checkJWSAlgSupported, checkJWSB64, checkProtectedTyp, checkSerializationEntry, clearJWKCache, configureJWKCache, createPBES2Budget, decodeJWEPayload, decodeJWSPayload, decodeProtectedHeader, decodeSegment, decrypt, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, encrypt, encryptKey, exportKey, exportPEM, exportReturnedCek, generateCEK, generateIV, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, isJWEAlgSupported, keyMatchesHeader, quoteTokenValue, resolveKeyInput, resolveLimit, resolvePasswordKey, resolvePayloadMode, resolveSigningKey, serializeProtectedHeader, sign, stringKeyError, thumbprint, unwrapKey, validateClaimsIfJson, verify, wrapKey };