unjwt 0.8.1 → 0.8.2

package/dist/_chunks/jwk.mjs

@@ -1,16 +1,22 @@
 import { safeJsonParse, sanitizeObjectCopy, secureRandomBytes, textEncoder } from "./libs/unsecure.mjs";
-import { JWTError, assertClaimValidationOptions, assertCritShape, assertCryptoKey, assertPlainObject, assertStringList, base64Parse, base64Stringify, base64UrlParse, base64UrlStringify, concatUint8Arrays, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isPlainObject, parsePayloadBytes, parsePayloadSegment, uint32be, validateJwtClaims } from "./_jwt-internal.mjs";
-import { ECDSA_CURVES, PBES2_ALGORITHMS, aesBitsOf, checkKeyUsage, cryptoKeyCurve, hashBitsOf, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, innerKeyWrapAlg, isAlgorithm, isContentEncryptionAlgorithm, isEd25519Signature, jwsHashOf, lengthOf, modulusLengthOf, namedCurveOf, rsaOaepHashOf, unusableKey } from "./algorithms.mjs";
+import { JWTError, assertClaimValidationOptions, assertCritShape, assertCryptoKey, assertPlainObject, assertStringList, base64Parse, base64Stringify, base64UrlParse, base64UrlStringify, concatUint8Arrays, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isPlainObject, isPublicJWK, parsePayloadBytes, parsePayloadSegment, uint32be, validateJwtClaims } from "./_jwt-internal.mjs";
+import { ECDSA_CURVES, PBES2_ALGORITHMS, aesBitsOf, checkKeyUsage, cryptoKeyCurve, digestUrl, hashBitsOf, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, innerKeyWrapAlg, isAlgorithm, isContentEncryptionAlgorithm, isECDHESAlgorithm, isEd25519Signature, isJWSAlgorithm, isKeyManagementAlgorithm, isPBES2Algorithm, jwsHashOf, lengthOf, modulusLengthOf, namedCurveOf, pbes2HashOf, rsaOaepHashOf, shaBitsOf, unusableKey } from "./digest.mjs";
 const MAX_QUOTED_VALUE = 64;
 function quoteTokenValue(value) {
 	const text = String(value);
 	return JSON.stringify(text.length > MAX_QUOTED_VALUE ? `${text.slice(0, MAX_QUOTED_VALUE)}…` : text);
 }
-const HASHED_SIGNATURE_ALGORITHMS = {
-	HS: "HMAC",
-	RS: "RSASSA-PKCS1-v1_5",
-	PS: "RSA-PSS"
-};
+const HASHED_SIGNATURE_ALGORITHMS = /* @__PURE__ */ Object.freeze({
+	HS256: "HMAC",
+	HS384: "HMAC",
+	HS512: "HMAC",
+	RS256: "RSASSA-PKCS1-v1_5",
+	RS384: "RSASSA-PKCS1-v1_5",
+	RS512: "RSASSA-PKCS1-v1_5",
+	PS256: "RSA-PSS",
+	PS384: "RSA-PSS",
+	PS512: "RSA-PSS"
+});
 async function sign(alg, key, data) {
 	checkSigCryptoKey(key, alg, "sign");
 	const signature = await crypto.subtle.sign(subtleAlgorithm(alg, key.algorithm), key, data);
@@ -35,9 +41,9 @@ function checkSigCryptoKey(key, alg, usage) {
 		case "PS256":
 		case "PS384":
 		case "PS512": {
-			const name = HASHED_SIGNATURE_ALGORITHMS[alg.slice(0, 2)];
+			const name = HASHED_SIGNATURE_ALGORITHMS[alg];
 			if (!isAlgorithm(key.algorithm, name)) throw unusableKey(name);
-			const expected = Number.parseInt(alg.slice(2), 10);
+			const expected = shaBitsOf(jwsHashOf(alg));
 			if (hashBitsOf(key.algorithm.hash) !== expected) throw unusableKey(`SHA-${expected}`, "algorithm.hash");
 			break;
 		}
@@ -53,45 +59,49 @@ function checkSigCryptoKey(key, alg, usage) {
 			if (key.algorithm.namedCurve !== expected) throw unusableKey(expected, "algorithm.namedCurve");
 			break;
 		}
-		default: throw new JWTError("CryptoKey does not support this operation", "ERR_JWK_INVALID");
 	}
 	checkKeyUsage(key, usage);
 }
 function subtleAlgorithm(alg, algorithm) {
-	const hash = jwsHashOf(alg);
 	switch (alg) {
 		case "HS256":
 		case "HS384":
 		case "HS512": return {
-			hash,
+			hash: jwsHashOf(alg),
 			name: "HMAC"
 		};
 		case "PS256":
 		case "PS384":
-		case "PS512": return {
-			hash,
-			name: "RSA-PSS",
-			saltLength: Number.parseInt(alg.slice(-3), 10) >> 3
-		};
+		case "PS512": {
+			const hash = jwsHashOf(alg);
+			return {
+				hash,
+				name: "RSA-PSS",
+				saltLength: shaBitsOf(hash) >> 3
+			};
+		}
 		case "RS256":
 		case "RS384":
 		case "RS512": return {
-			hash,
+			hash: jwsHashOf(alg),
 			name: "RSASSA-PKCS1-v1_5"
 		};
 		case "ES256":
 		case "ES384":
 		case "ES512": return {
-			hash,
+			hash: jwsHashOf(alg),
 			name: "ECDSA",
 			namedCurve: namedCurveOf(algorithm)
 		};
 		case "Ed25519":
 		case "EdDSA": return { name: "Ed25519" };
-		default: throw new JWTError(`alg ${alg} is not supported either by JOSE or your javascript runtime`, "ERR_JWS_ALG_NOT_ALLOWED");
+		default: return unsupportedSignatureAlgorithm(alg);
 	}
 }
-const IV_BIT_LENGTHS = {
+function unsupportedSignatureAlgorithm(alg) {
+	throw new JWTError(`alg ${String(alg)} is not supported either by JOSE or your javascript runtime`, "ERR_JWS_ALG_NOT_ALLOWED");
+}
+const IV_BIT_LENGTHS = /* @__PURE__ */ Object.freeze({
 	"A128GCM": 96,
 	"A128GCMKW": 96,
 	"A192GCM": 96,
@@ -101,19 +111,17 @@ const IV_BIT_LENGTHS = {
 	"A128CBC-HS256": 128,
 	"A192CBC-HS384": 128,
 	"A256CBC-HS512": 128
-};
-const CEK_BIT_LENGTHS = {
+});
+const CEK_BIT_LENGTHS = /* @__PURE__ */ Object.freeze({
 	"A128GCM": 128,
 	"A192GCM": 192,
 	"A256GCM": 256,
 	"A128CBC-HS256": 256,
 	"A192CBC-HS384": 384,
 	"A256CBC-HS512": 512
-};
+});
 function bitLengthIV(alg) {
-	const length = IV_BIT_LENGTHS[alg];
-	if (length === void 0) throw new JWTError(`Unsupported JWE Algorithm: ${quoteTokenValue(alg)}`, "ERR_JWE_INVALID");
-	return length;
+	return IV_BIT_LENGTHS[alg];
 }
 function generateIV(alg) {
 	return crypto.getRandomValues(new Uint8Array(bitLengthIV(alg) >> 3));
@@ -121,7 +129,7 @@ function generateIV(alg) {
 function checkIvLength(enc, iv) {
 	if (iv.length << 3 !== bitLengthIV(enc)) throw new JWTError("Invalid Initialization Vector length", "ERR_JWE_INVALID");
 }
-const TAG_BIT_LENGTHS = {
+const TAG_BIT_LENGTHS = /* @__PURE__ */ Object.freeze({
 	"A128GCM": 128,
 	"A128GCMKW": 128,
 	"A192GCM": 128,
@@ -131,19 +139,15 @@ const TAG_BIT_LENGTHS = {
 	"A128CBC-HS256": 128,
 	"A192CBC-HS384": 192,
 	"A256CBC-HS512": 256
-};
+});
 function bitLengthTag(alg) {
-	const length = TAG_BIT_LENGTHS[alg];
-	if (length === void 0) throw new JWTError(`Unsupported JWE Algorithm: ${quoteTokenValue(alg)}`, "ERR_JWE_INVALID");
-	return length;
+	return TAG_BIT_LENGTHS[alg];
 }
 function checkTagLength(enc, tag) {
 	if (tag.length << 3 !== bitLengthTag(enc)) throw new JWTError("Invalid Authentication Tag length", "ERR_JWE_INVALID");
 }
-function bitLengthCEK(alg) {
-	const length = CEK_BIT_LENGTHS[alg];
-	if (length === void 0) throw new JWTError(`Unsupported JWE Algorithm: ${quoteTokenValue(alg)}`, "ERR_JWE_INVALID");
-	return length;
+function bitLengthCEK(enc) {
+	return CEK_BIT_LENGTHS[enc];
 }
 function generateCEK(alg) {
 	return crypto.getRandomValues(new Uint8Array(bitLengthCEK(alg) >> 3));
@@ -155,29 +159,18 @@ function checkCEKLength(cek, expected) {
 function assertOctKeyLength(bytes, alg) {
 	if (!alg) return;
 	if (alg === "HS256" || alg === "HS384" || alg === "HS512") {
-		const minBytes = Number.parseInt(alg.slice(2), 10) >> 3;
+		const minBytes = shaBitsOf(jwsHashOf(alg)) >> 3;
 		if (bytes.length < minBytes) throw new JWTError(`${alg} requires a key of at least ${minBytes} bytes (got ${bytes.length})`, "ERR_JWK_INVALID");
 		return;
 	}
-	const exactBits = /^A(128|192|256)(GCM)?KW$/.test(alg) ? aesBitsOf(alg) : CEK_BIT_LENGTHS[alg];
+	const exactBits = isKeyWrapAlgorithm(alg) ? aesBitsOf(alg) : isContentEncryption(alg) ? CEK_BIT_LENGTHS[alg] : void 0;
 	if (exactBits !== void 0 && bytes.length << 3 !== exactBits) throw new JWTError(`${alg} requires a key of exactly ${exactBits >> 3} bytes (got ${bytes.length})`, "ERR_JWK_INVALID");
 }
 function checkAESCryptoKey(key, alg, usage) {
-	switch (alg) {
-		case "A128GCM":
-		case "A192GCM":
-		case "A256GCM":
-		case "A128KW":
-		case "A192KW":
-		case "A256KW": {
-			const name = alg.endsWith("KW") ? "AES-KW" : "AES-GCM";
-			if (!isAlgorithm(key.algorithm, name)) throw unusableKey(name);
-			const expected = aesBitsOf(alg);
-			if (key.algorithm.length !== expected) throw unusableKey(expected, "algorithm.length");
-			break;
-		}
-		default: throw new JWTError("CryptoKey does not support this operation", "ERR_JWK_INVALID");
-	}
+	const name = alg.endsWith("KW") ? "AES-KW" : "AES-GCM";
+	if (!isAlgorithm(key.algorithm, name)) throw unusableKey(name);
+	const expected = aesBitsOf(alg);
+	if (key.algorithm.length !== expected) throw unusableKey(expected, "algorithm.length");
 	checkKeyUsage(key, usage);
 }
 async function aesKwWrap(alg, key, cek) {
@@ -199,7 +192,7 @@ async function aesKwUnwrap(alg, key, encryptedKey) {
 	return new Uint8Array(await crypto.subtle.exportKey("raw", cryptoKeyCek));
 }
 async function gcmkwEncrypt(alg, key, plaintext, iv) {
-	const wrapped = await encrypt(alg.slice(0, 7), plaintext, key, iv, /* @__PURE__ */ new Uint8Array(0));
+	const wrapped = await encrypt(gcmOf(alg), plaintext, key, iv, /* @__PURE__ */ new Uint8Array(0));
 	return {
 		encryptedKey: wrapped.ciphertext,
 		iv: base64UrlStringify(wrapped.iv),
@@ -207,7 +200,7 @@ async function gcmkwEncrypt(alg, key, plaintext, iv) {
 	};
 }
 async function gcmkwDecrypt(alg, key, ciphertext, iv, tag) {
-	return decrypt(alg.slice(0, 7), key, ciphertext, iv, tag, /* @__PURE__ */ new Uint8Array(0));
+	return decrypt(gcmOf(alg), key, ciphertext, iv, tag, /* @__PURE__ */ new Uint8Array(0));
 }
 async function encrypt(enc, plaintext, cek, iv, aad) {
 	if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) throw new JWTError("Key must be one of type: CryptoKey or Uint8Array", "ERR_JWK_INVALID");
@@ -217,14 +210,14 @@ async function encrypt(enc, plaintext, cek, iv, aad) {
 		case "A128CBC-HS256":
 		case "A192CBC-HS384":
 		case "A256CBC-HS512":
-			if (cek instanceof Uint8Array) checkCEKLength(cek, Number.parseInt(enc.slice(-3), 10));
+			if (cek instanceof Uint8Array) checkCEKLength(cek, bitLengthCEK(enc));
 			return cbcEncrypt(enc, plaintext, cek, iv, aad);
 		case "A128GCM":
 		case "A192GCM":
 		case "A256GCM":
-			if (cek instanceof Uint8Array) checkCEKLength(cek, aesBitsOf(enc));
+			if (cek instanceof Uint8Array) checkCEKLength(cek, bitLengthCEK(enc));
 			return gcmEncrypt(enc, plaintext, cek, iv, aad);
-		default: throw new JWTError("Unsupported JWE Content Encryption Algorithm", "ERR_JWE_INVALID");
+		default: return unsupportedContentEncryption(enc);
 	}
 }
 async function decrypt(enc, cek, ciphertext, iv, tag, aad) {
@@ -237,14 +230,14 @@ async function decrypt(enc, cek, ciphertext, iv, tag, aad) {
 		case "A128CBC-HS256":
 		case "A192CBC-HS384":
 		case "A256CBC-HS512":
-			if (cek instanceof Uint8Array) checkCEKLength(cek, Number.parseInt(enc.slice(-3), 10));
+			if (cek instanceof Uint8Array) checkCEKLength(cek, bitLengthCEK(enc));
 			return cbcDecrypt(enc, cek, ciphertext, iv, tag, aad);
 		case "A128GCM":
 		case "A192GCM":
 		case "A256GCM":
-			if (cek instanceof Uint8Array) checkCEKLength(cek, aesBitsOf(enc));
+			if (cek instanceof Uint8Array) checkCEKLength(cek, bitLengthCEK(enc));
 			return gcmDecrypt(enc, cek, ciphertext, iv, tag, aad);
-		default: throw new JWTError("Unsupported JWE Content Encryption Algorithm", "ERR_JWE_INVALID");
+		default: return unsupportedContentEncryption(enc);
 	}
 }
 async function getAESKWCryptoKey(key, alg, options = {}) {
@@ -369,16 +362,33 @@ async function timingSafeEqual(a, b) {
 function uint64be(value) {
 	return concatUint8Arrays(uint32be(Math.floor(value / 2 ** 32)), uint32be(value % 2 ** 32));
 }
+function gcmOf(alg) {
+	return alg.slice(0, 7);
+}
+function isKeyWrapAlgorithm(alg) {
+	return alg.startsWith("A") && alg.endsWith("KW");
+}
+function isContentEncryption(alg) {
+	return Object.hasOwn(CEK_BIT_LENGTHS, alg);
+}
+function unsupportedContentEncryption(enc) {
+	throw new JWTError(`Unsupported JWE Content Encryption Algorithm: ${quoteTokenValue(String(enc))}`, "ERR_JWE_INVALID");
+}
 async function jwkTokey(jwk, options = {}) {
-	if (!jwk.alg) throw new JWTError("\"alg\" argument is required when \"jwk.alg\" is not present", "ERR_JWK_INVALID");
-	const { algorithm, keyUsages } = subtleMapping(jwk);
+	const alg = jwk.alg ?? options.alg;
+	if (!alg) throw new JWTError("\"alg\" argument is required when \"jwk.alg\" is not present", "ERR_JWK_INVALID");
+	const { algorithm, keyUsages } = subtleMapping(jwk, alg);
+	const material = {
+		...jwk,
+		alg
+	};
 	const isPrivate = "d" in jwk && jwk.d !== void 0;
 	const extractable = jwk.ext === false ? false : options.extractable ?? !isPrivate;
 	try {
-		return await crypto.subtle.importKey("jwk", jwk, algorithm, extractable, permittedUsages(jwk, keyUsages));
+		return await crypto.subtle.importKey("jwk", material, algorithm, extractable, permittedUsages(jwk, keyUsages));
 	} catch (error) {
 		if (error instanceof JWTError) throw error;
-		throw new JWTError(`Key is not usable for ${quoteTokenValue(jwk.alg)}.`, "ERR_JWK_INVALID", error);
+		throw new JWTError(`Key is not usable for ${quoteTokenValue(alg)}.`, "ERR_JWK_INVALID", error);
 	}
 }
 async function keyToJWK(key) {
@@ -390,7 +400,8 @@ async function keyToJWK(key) {
 	else {
 		if (!isCryptoKey(key)) throw new JWTError("Key must be one of type: CryptoKey or Uint8Array", "ERR_JWK_INVALID");
 		if (!key.extractable) throw new JWTError("non-extractable CryptoKey cannot be exported as a JWK", "ERR_JWK_INVALID");
-		jwk = await crypto.subtle.exportKey("jwk", key);
+		const { ext: _ext, key_ops: _keyOps, ...exported } = await crypto.subtle.exportKey("jwk", key);
+		jwk = exported;
 	}
 	return jwk;
 }
@@ -401,18 +412,18 @@ function permittedUsages(jwk, keyUsages) {
 	if (permitted.length === 0) throw new JWTError(`JWK "key_ops" does not permit ${keyUsages.join(", ")}.`, "ERR_JWK_INVALID");
 	return permitted;
 }
-function subtleMapping(jwk) {
+function subtleMapping(jwk, alg) {
 	let algorithm;
 	let keyUsages;
 	switch (jwk.kty) {
 		case "RSA":
-			switch (jwk.alg) {
+			switch (alg) {
 				case "PS256":
 				case "PS384":
 				case "PS512":
 					algorithm = {
 						name: "RSA-PSS",
-						hash: jwsHashOf(jwk.alg)
+						hash: jwsHashOf(alg)
 					};
 					keyUsages = hasPrivateMember(jwk) ? ["sign"] : ["verify"];
 					break;
@@ -421,7 +432,7 @@ function subtleMapping(jwk) {
 				case "RS512":
 					algorithm = {
 						name: "RSASSA-PKCS1-v1_5",
-						hash: jwsHashOf(jwk.alg)
+						hash: jwsHashOf(alg)
 					};
 					keyUsages = hasPrivateMember(jwk) ? ["sign"] : ["verify"];
 					break;
@@ -431,21 +442,21 @@ function subtleMapping(jwk) {
 				case "RSA-OAEP-512":
 					algorithm = {
 						name: "RSA-OAEP",
-						hash: rsaOaepHashOf(jwk.alg)
+						hash: rsaOaepHashOf(alg)
 					};
 					keyUsages = hasPrivateMember(jwk) ? ["decrypt", "unwrapKey"] : ["encrypt", "wrapKey"];
 					break;
-				default: throw new JWTError(`Invalid or unsupported JWK "alg" (Algorithm) Parameter value: ${quoteTokenValue(jwk.alg)}.`, "ERR_JWK_INVALID");
+				default: throw new JWTError(`Invalid or unsupported JWK "alg" (Algorithm) Parameter value: ${quoteTokenValue(alg)}.`, "ERR_JWK_INVALID");
 			}
 			break;
 		case "EC":
-			switch (jwk.alg) {
+			switch (alg) {
 				case "ES256":
 				case "ES384":
 				case "ES512":
 					algorithm = {
 						name: "ECDSA",
-						namedCurve: ECDSA_CURVES[jwk.alg]
+						namedCurve: ECDSA_CURVES[alg]
 					};
 					keyUsages = hasPrivateMember(jwk) ? ["sign"] : ["verify"];
 					break;
@@ -463,11 +474,11 @@ function subtleMapping(jwk) {
 					};
 					keyUsages = hasPrivateMember(jwk) ? ["deriveBits"] : [];
 					break;
-				default: throw new JWTError(`Invalid or unsupported JWK "alg" (Algorithm) Parameter value: ${quoteTokenValue(jwk.alg)}.`, "ERR_JWK_INVALID");
+				default: throw new JWTError(`Invalid or unsupported JWK "alg" (Algorithm) Parameter value: ${quoteTokenValue(alg)}.`, "ERR_JWK_INVALID");
 			}
 			break;
 		case "OKP":
-			switch (jwk.alg) {
+			switch (alg) {
 				case "Ed25519":
 				case "EdDSA":
 					algorithm = { name: requireCurve(jwk, ["Ed25519"]) };
@@ -480,7 +491,7 @@ function subtleMapping(jwk) {
 					algorithm = { name: requireCurve(jwk, ["X25519"]) };
 					keyUsages = hasPrivateMember(jwk) ? ["deriveBits"] : [];
 					break;
-				default: throw new JWTError(`Invalid or unsupported JWK "alg" (Algorithm) Parameter value: ${quoteTokenValue(jwk.alg)}.`, "ERR_JWK_INVALID");
+				default: throw new JWTError(`Invalid or unsupported JWK "alg" (Algorithm) Parameter value: ${quoteTokenValue(alg)}.`, "ERR_JWK_INVALID");
 			}
 			break;
 		default: throw new JWTError(`Invalid or unsupported JWK "kty" (Key Type) Parameter value: ${quoteTokenValue(jwk.kty)}.`, "ERR_JWK_INVALID");
@@ -510,19 +521,17 @@ async function decryptRSAES(alg, key, encryptedKey) {
 }
 function checkRSACryptoKey(key, alg, usage) {
 	if (!isAlgorithm(key.algorithm, "RSA-OAEP")) throw unusableKey("RSA-OAEP");
-	const expected = Number.parseInt(alg.slice(9), 10) || 1;
+	const expected = shaBitsOf(rsaOaepHashOf(alg));
 	if (hashBitsOf(key.algorithm.hash) !== expected) throw unusableKey(`SHA-${expected}`, "algorithm.hash");
 	checkKeyUsage(key, usage);
 }
 function checkRSAModulusLength(alg, key) {
-	if (alg.startsWith("RS") || alg.startsWith("PS") || alg.startsWith("RSA")) {
-		const modulusLength = modulusLengthOf(key.algorithm);
-		if (typeof modulusLength !== "number" || modulusLength < 2048) throw new JWTError(`${alg} requires key modulusLength to be 2048 bits or larger`, "ERR_JWK_INVALID");
-	}
+	const modulusLength = modulusLengthOf(key.algorithm);
+	if (typeof modulusLength !== "number" || modulusLength < 2048) throw new JWTError(`${alg} requires key modulusLength to be 2048 bits or larger`, "ERR_JWK_INVALID");
 }
 async function deriveECDHESKey(publicKey, privateKey, algorithm, keyLength, apu = /* @__PURE__ */ new Uint8Array(0), apv = /* @__PURE__ */ new Uint8Array(0)) {
-	checkECDHCryptoKey(publicKey, "ECDH");
-	checkECDHCryptoKey(privateKey, "ECDH", "deriveBits");
+	checkECDHCryptoKey(publicKey);
+	checkECDHCryptoKey(privateKey, "deriveBits");
 	const value = concatUint8Arrays(lengthAndInput(textEncoder.encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength));
 	const length = publicKey.algorithm.name === "X25519" ? 256 : Math.ceil(Number.parseInt((namedCurveOf(publicKey.algorithm) ?? "").slice(-3), 10) / 8) << 3;
 	return concatKdf(new Uint8Array(await crypto.subtle.deriveBits({
@@ -531,7 +540,9 @@ async function deriveECDHESKey(publicKey, privateKey, algorithm, keyLength, apu
 	}, privateKey, length)), keyLength, value);
 }
 function ecdhDerivedBits(alg, enc) {
-	return alg === "ECDH-ES" ? bitLengthCEK(enc) : Number.parseInt(alg.slice(-5, -2), 10);
+	if (alg !== "ECDH-ES") return aesBitsOf(innerKeyWrapAlg(alg));
+	if (enc) return bitLengthCEK(enc);
+	throw new JWTError("ECDH-ES requires \"enc\", the content encryption algorithm the key is agreed for.", "ERR_JWE_INVALID");
 }
 function generateEphemeralKeyPair(recipientKey) {
 	return crypto.subtle.generateKey(recipientKey.algorithm, true, ["deriveBits"]);
@@ -545,7 +556,7 @@ function assertECDHKeyAllowed(key) {
 		default: throw new JWTError("ECDH with the provided key is not allowed or not supported", "ERR_JWK_INVALID");
 	}
 }
-function checkECDHCryptoKey(key, alg, usage) {
+function checkECDHCryptoKey(key, usage) {
 	switch (key.algorithm.name) {
 		case "ECDH":
 		case "X25519": break;
@@ -614,9 +625,9 @@ async function deriveKey(p2s, alg, p2c, key) {
 	assertPBES2Salt(p2s, "\"p2s\"");
 	if (p2c === void 0 || p2c < 1) throw new JWTError("PBES2 Iteration Count Parameter must be a positive integer", "ERR_INVALID_OPTION");
 	const salt = concatUint8Arrays(textEncoder.encode(alg), new Uint8Array([0]), p2s);
-	const keylen = Number.parseInt(alg.slice(13, 16), 10);
+	const keylen = aesBitsOf(innerKeyWrapAlg(alg));
 	const subtleAlg = {
-		hash: `SHA-${alg.slice(8, 11)}`,
+		hash: pbes2HashOf(alg),
 		iterations: p2c,
 		name: "PBKDF2",
 		salt
@@ -710,7 +721,7 @@ async function ecdhesWrap(alg, options) {
 		epk = await exportPublicJwkFrom(generated.publicKey);
 	}
 	const kdfAlg = alg === "ECDH-ES" ? contentAlgorithm(enc) : alg;
-	const sharedSecret = await deriveECDHESKey(recipientKey, ephemeralPrivateKey, kdfAlg, ecdhDerivedBits(alg, kdfAlg), apu, apv);
+	const sharedSecret = await deriveECDHESKey(recipientKey, ephemeralPrivateKey, kdfAlg, ecdhDerivedBits(alg, enc), apu, apv);
 	const parameters = { epk };
 	if (apu) parameters.apu = base64UrlStringify(apu);
 	if (apv) parameters.apv = base64UrlStringify(apv);
@@ -726,6 +737,7 @@ async function ecdhesWrap(alg, options) {
 	};
 }
 async function normalizeEpk(epk, options) {
+	const { alg } = options;
 	const recipientCurve = cryptoKeyCurve(options.recipientKey);
 	if (isCryptoKey(epk)) {
 		if (epk.type !== "public") throw invalidEpk("must not contain private key material.");
@@ -746,12 +758,12 @@ async function normalizeEpk(epk, options) {
 		crv,
 		x,
 		y,
-		alg: options.alg
+		alg
 	} : {
 		kty: "OKP",
 		crv,
 		x,
-		alg: options.alg
+		alg
 	});
 }
 const EC_ECDH_CURVES = /* @__PURE__ */ new Set([
@@ -800,10 +812,7 @@ function toPublicEpkJwk(jwk) {
 	};
 }
 async function ensurePrivateKey(alg, value) {
-	const normalized = isCryptoKey(value) ? value : await jwkTokey(value.alg ? value : {
-		...value,
-		alg
-	});
+	const normalized = isCryptoKey(value) ? value : await jwkTokey(value, { alg });
 	if (normalized.type !== "private") throw new JWTError("ECDH-ES ephemeral private key must have type \"private\".", "ERR_JWK_INVALID");
 	return normalized;
 }
@@ -1121,8 +1130,7 @@ async function thumbprint(jwk, options = {}) {
 		if (typeof value !== "string" || value.length === 0) throw new JWTError(`JWK thumbprint requires the member "${name}" on an ${jwk.kty} key.`, "ERR_JWK_INVALID");
 		return `${JSON.stringify(name)}:${JSON.stringify(value)}`;
 	});
-	const digest = await crypto.subtle.digest(hash, textEncoder.encode(`{${canonical.join(",")}}`));
-	return base64UrlStringify(new Uint8Array(digest));
+	return digestUrl(`{${canonical.join(",")}}`, hash);
 }
 const MAX_PARTY_INFO_BYTES = 1024;
 const DEFAULT_JOSE_LIMITS = /* @__PURE__ */ Object.freeze({
@@ -1194,6 +1202,18 @@ function assertProtectedOnlyOption(header, options) {
 		throw new JWTError(`${family} "${param}" must be integrity protected; move it from the ${tier} header to the protected header.`, "ERR_INVALID_OPTION");
 	}
 }
+function assertProducerKeyHeaders(header, options) {
+	if (!header) return;
+	const { tier, family } = options;
+	if (Object.hasOwn(header, "jwk") && !isPublicJWK(Reflect.get(header, "jwk"))) throw new JWTError(`${family} "jwk" in the ${tier} header must be a public JWK; pass the pair's publicKey half.`, "ERR_INVALID_OPTION");
+	if (Object.hasOwn(header, "epk")) throw new JWTError(`${family} "epk" is written by the ECDH-ES key agreement; pass an ephemeral key through "ecdh.ephemeralKey" instead of the ${tier} header.`, "ERR_INVALID_OPTION");
+}
+function assertProducerConfirmation(payload) {
+	if (typeof payload !== "object" || payload === null) return;
+	const cnf = Reflect.get(payload, "cnf");
+	if (typeof cnf !== "object" || cnf === null || !Object.hasOwn(cnf, "jwk")) return;
+	if (!isPublicJWK(Reflect.get(cnf, "jwk"))) throw new JWTError("Invalid JWT \"cnf\" (Confirmation) Claim: \"jwk\" must be a public JWK (RFC 7800 §3.2).", "ERR_JWT_CLAIM_INVALID");
+}
 function assertOptionEntry(entry, options) {
 	const { label, objects } = options;
 	assertPlainObject(entry, label);
@@ -1300,14 +1320,14 @@ function buildECDHAgreementParams(ecdh) {
 }
 async function resolveSigningKey(alg, key, usage) {
 	if (key instanceof Uint8Array) {
-		if (!alg.startsWith("HS")) throw new JWTError(`Raw key bytes are HMAC secrets; ${alg} needs an asymmetric key. Pass a JWK or a CryptoKey.`, "ERR_JWK_INVALID");
+		if (alg !== "HS256" && alg !== "HS384" && alg !== "HS512") throw new JWTError(`Raw key bytes are HMAC secrets; ${alg} needs an asymmetric key. Pass a JWK or a CryptoKey.`, "ERR_JWK_INVALID");
 		assertOctKeyLength(key, alg);
 		return crypto.subtle.importKey("raw", key, {
 			name: "HMAC",
 			hash: jwsHashOf(alg)
 		}, false, [usage]);
 	}
-	if (alg.startsWith("RS") || alg.startsWith("PS")) {
+	if (RSA_SIGNATURE_ALGORITHMS.has(alg)) {
 		const modulusLength = modulusLengthOf(key.algorithm);
 		if (typeof modulusLength !== "number" || modulusLength < 2048) throw new JWTError(`${alg} requires a key modulusLength of at least 2048 bits`, "ERR_JWK_INVALID");
 	}
@@ -1341,7 +1361,7 @@ function assertNotStringKey(key) {
 }
 function resolvePasswordKey(alg, key) {
 	if (typeof key !== "string") return key;
-	if (!alg.startsWith("PBES2")) throw stringKeyError();
+	if (!isPBES2Algorithm(alg)) throw stringKeyError();
 	return textEncoder.encode(key);
 }
 const JWS_ALG_CTX = /* @__PURE__ */ Object.freeze({
@@ -1382,25 +1402,13 @@ function keyMatchesHeader(header, keyMaterial, options) {
 	if (isCryptoKey(keyMaterial)) return keyServesHeaderAlg(header, keyMaterial, ctx);
 	return true;
 }
-const JWS_ALGORITHM_SET = /* @__PURE__ */ new Set(Object.keys({
-	HS256: true,
-	HS384: true,
-	HS512: true,
-	RS256: true,
-	RS384: true,
-	RS512: true,
-	PS256: true,
-	PS384: true,
-	PS512: true,
-	ES256: true,
-	ES384: true,
-	ES512: true,
-	Ed25519: true,
-	EdDSA: true
-}));
+function assertJWSAlgSupported(alg) {
+	const error = checkJWSAlgSupported(alg);
+	if (error) throw error;
+}
 function checkJWSAlgSupported(alg) {
 	return checkAlgSupported(alg, {
-		supported: JWS_ALGORITHM_SET,
+		supported: isJWSAlgorithm,
 		code: "ERR_JWS_ALG_NOT_ALLOWED",
 		label: "Algorithm",
 		role: "signing algorithm"
@@ -1474,26 +1482,6 @@ function asKeyUsageError(error, alg) {
 		message: `Key is not usable for ${alg}.`
 	});
 }
-const JWE_ALGORITHM_SET = /* @__PURE__ */ new Set(Object.keys({
-	"dir": true,
-	"A128KW": true,
-	"A192KW": true,
-	"A256KW": true,
-	"A128GCMKW": true,
-	"A192GCMKW": true,
-	"A256GCMKW": true,
-	"PBES2-HS256+A128KW": true,
-	"PBES2-HS384+A192KW": true,
-	"PBES2-HS512+A256KW": true,
-	"RSA-OAEP": true,
-	"RSA-OAEP-256": true,
-	"RSA-OAEP-384": true,
-	"RSA-OAEP-512": true,
-	"ECDH-ES": true,
-	"ECDH-ES+A128KW": true,
-	"ECDH-ES+A192KW": true,
-	"ECDH-ES+A256KW": true
-}));
 const JWE_ENC_CEK_FORMAT = /* @__PURE__ */ Object.freeze({
 	"A128GCM": "cryptokey",
 	"A192GCM": "cryptokey",
@@ -1510,7 +1498,7 @@ function assertDirectKeyRole(key, enc) {
 const JWE_DIRECT_ALGS = /* @__PURE__ */ new Set(["dir", "ECDH-ES"]);
 function checkJWEAlgSupported(alg) {
 	return checkAlgSupported(alg, {
-		supported: JWE_ALGORITHM_SET,
+		supported: isKeyManagementAlgorithm,
 		code: "ERR_JWE_ALG_NOT_ALLOWED",
 		label: "Key management algorithm",
 		role: "key management algorithm"
@@ -1521,7 +1509,7 @@ function checkJWEEncSupported(enc) {
 	return new JWTError(`Invalid JWE: unsupported "enc" ${quoteTokenValue(enc)}`, "ERR_JWE_INVALID");
 }
 function isJWEAlgSupported(alg) {
-	return JWE_ALGORITHM_SET.has(alg);
+	return isKeyManagementAlgorithm(alg);
 }
 function assertJWEAlgSupported(alg) {
 	const error = checkJWEAlgSupported(alg);
@@ -1646,18 +1634,26 @@ function decodeJWEPayload(plaintext, mode) {
 function checkAlgSupported(alg, options) {
 	const { supported, code, label, role } = options;
 	if (alg === "none") return new JWTError(`"none" is not a valid ${role}`, code);
-	if (!supported.has(alg)) return new JWTError(`${label} not supported: ${quoteTokenValue(alg)}`, code);
+	if (!supported(alg)) return new JWTError(`${label} not supported: ${quoteTokenValue(alg)}`, code);
 }
 function keyServesHeaderAlg(header, key, ctx) {
 	const { alg } = header;
 	if (!alg) return false;
 	const inferred = ctx.infer(key);
 	if (inferred && !inferred.includes(alg)) return false;
-	if (!alg.startsWith("ECDH-ES")) return true;
+	if (!isECDHESAlgorithm(alg)) return true;
 	const epkCurve = header.epk?.crv;
 	const keyCurve = isCryptoKey(key) ? cryptoKeyCurve(key) : "crv" in key ? key.crv : void 0;
 	return !epkCurve || !keyCurve || epkCurve === keyCurve;
 }
+const RSA_SIGNATURE_ALGORITHMS = /* @__PURE__ */ new Set([
+	"RS256",
+	"RS384",
+	"RS512",
+	"PS256",
+	"PS384",
+	"PS512"
+]);
 async function generateKey(alg, options = {}) {
 	const exportToJWK = options.toJWK !== void 0 && options.toJWK;
 	const defaultExtractable = exportToJWK || options.extractable !== false;
@@ -1665,41 +1661,37 @@ async function generateKey(alg, options = {}) {
 	if (alg === "A128CBC-HS256" || alg === "A192CBC-HS384" || alg === "A256CBC-HS512") {
 		const keyLength = bitLengthCEK(alg);
 		const keyBytes = secureRandomBytes(keyLength >> 3);
-		if (exportToJWK) return withGeneratedKid(kid, {
-			...await keyToJWK(keyBytes),
-			alg,
-			ext: true,
-			key_ops: resolveKeyUsage(options.keyUsage, {
+		if (exportToJWK) {
+			const jwk = await keyToJWK(keyBytes);
+			const keyOps = options.keyUsage === void 0 ? void 0 : resolveKeyUsage(options.keyUsage, {
 				allowed: CONTENT_ENCRYPTION_USAGES,
 				fallback: ["encrypt", "decrypt"],
 				alg
-			})
-		});
+			});
+			return withGeneratedKid(kid, withKeyOps({
+				...jwk,
+				alg
+			}, keyOps));
+		}
 		return keyBytes;
 	}
 	const { algorithm, keyUsages } = getGenerateKeyParams(alg, options);
 	const key = await crypto.subtle.generateKey(algorithm, defaultExtractable, keyUsages);
 	if (exportToJWK) {
-		if (key instanceof CryptoKey) return withGeneratedKid(kid, {
-			...await exportKey(key),
-			alg
-		});
-		else {
-			const [pub, priv] = await Promise.all([exportKey(key.publicKey), exportKey(key.privateKey)]);
-			const publicKey = await withGeneratedKid(kid, {
-				...pub,
-				alg
-			});
+		if (isCryptoKeyPair(key)) {
+			const pairAlg = generatedPairAlgorithm(alg);
+			const [pub, priv] = await Promise.all([exportJWK(key.publicKey), exportJWK(key.privateKey)]);
+			const publicKey = await withGeneratedKid(kid, withKeyOps(withAlg(pub, pairAlg), requestedKeyOps(options, key.publicKey)));
 			const named = publicKey.kid === void 0 ? void 0 : { kid: publicKey.kid };
 			return {
 				privateKey: {
-					...priv,
-					alg,
+					...withKeyOps(withAlg(priv, pairAlg), requestedKeyOps(options, key.privateKey)),
 					...named
 				},
 				publicKey
 			};
 		}
+		return withGeneratedKid(kid, withKeyOps(withAlg(await exportJWK(key), generatedSecretAlgorithm(alg)), requestedKeyOps(options, key)));
 	}
 	return key;
 }
@@ -1743,11 +1735,11 @@ async function deriveKeyFromPassword(password, options) {
 	const finalUsages = keyUsage ?? ["wrapKey", "unwrapKey"];
 	const finalExtractable = exportToJWK ? true : extractable === true;
 	const derivedKey = await crypto.subtle.importKey("raw", derivedBytes, { name: "AES-KW" }, finalExtractable, finalUsages);
-	if (exportToJWK) return {
+	if (exportToJWK) return withKeyOps({
 		...await keyToJWK(derivedKey),
 		alg: wrappingAlg,
 		kty: "oct"
-	};
+	}, requestedKeyOps(options, derivedKey));
 	return derivedKey;
 }
 async function deriveJWKFromPassword(password, options) {
@@ -1824,10 +1816,10 @@ async function importKey(key, algOrOptions) {
 				const cached = await cache.get(key, effectiveAlg);
 				if (cached) return cached;
 			}
-			const cryptoKey = await jwkTokey(key.alg ? key : {
-				...key,
+			const cryptoKey = await jwkTokey(key, {
+				extractable,
 				alg
-			}, { extractable });
+			});
 			if (cache) await cache.set(key, effectiveAlg, cryptoKey);
 			return cryptoKey;
 		}
@@ -1843,7 +1835,7 @@ function assertJWKAlgAuthority(jwk, alg) {
 function assertIntentOnJWK(jwk, expect) {
 	if (expect === void 0 || jwk.kty === "oct") return;
 	const hasPrivateScalar = "d" in jwk && typeof jwk.d === "string";
-	if (expect === "public" && hasPrivateScalar) throw new JWTError("Private JWK passed where a public key is expected. Strip `d` (and CRT fields on RSA) before import.", "ERR_JWK_INVALID");
+	if (expect === "public" && hasPrivateScalar) throw new JWTError("Private JWK passed where a public key is expected.", "ERR_JWK_INVALID");
 	if (expect === "private" && !hasPrivateScalar) throw new JWTError("Public JWK passed where a private key is expected.", "ERR_JWK_INVALID");
 }
 function assertIntentOnCryptoKey(key, expect) {
@@ -1851,8 +1843,8 @@ function assertIntentOnCryptoKey(key, expect) {
 	if (expect === "public" && key.type === "private") throw new JWTError("Private CryptoKey passed where a public key is expected.", "ERR_JWK_INVALID");
 	if (expect === "private" && key.type === "public") throw new JWTError("Public CryptoKey passed where a private key is expected.", "ERR_JWK_INVALID");
 }
-async function exportKey(key, jwkParams) {
-	if (!isCryptoKey(key)) throw new JWTError(`exportKey expects a CryptoKey, got ${key === null ? "null" : typeof key}.`, "ERR_INVALID_OPTION");
+async function exportJWK(key, jwkParams) {
+	if (!isCryptoKey(key)) throw new JWTError(`exportJWK expects a CryptoKey, got ${key === null ? "null" : typeof key}.`, "ERR_INVALID_OPTION");
 	if (!key.extractable) throw new JWTError("A non-extractable CryptoKey cannot be exported as a JWK.", "ERR_JWK_INVALID");
 	const exportedJwk = await keyToJWK(key);
 	if (jwkParams) {
@@ -1865,6 +1857,19 @@ async function exportKey(key, jwkParams) {
 	}
 	return exportedJwk;
 }
+async function exportKey(key, jwkParams) {
+	return exportJWK(key, jwkParams);
+}
+function toPublicJWK(jwk) {
+	if (!isAsymmetricJWK(jwk)) throw new JWTError(isJWK(jwk) ? "An oct JWK has no public half." : "toPublicJWK expects an asymmetric JWK.", "ERR_JWK_INVALID");
+	const { d: _d, p: _p, q: _q, dp: _dp, dq: _dq, qi: _qi, oth: _oth, key_ops, ...publicMembers } = sanitizeObjectCopy({ ...jwk });
+	const publicKey = key_ops === void 0 ? publicMembers : {
+		...publicMembers,
+		key_ops: publicKeyOps(key_ops)
+	};
+	if (!isPublicJWK(publicKey)) throw new JWTError(`${jwk.kty} JWK lacks the public members of its key type.`, "ERR_JWK_INVALID");
+	return publicKey;
+}
 async function wrapKey(keyToWrap, wrappingKey, options) {
 	assertPlainObject(options, "options");
 	assertKeyBytesArg(keyToWrap, "keyToWrap");
@@ -1913,6 +1918,7 @@ async function wrapKey(keyToWrap, wrappingKey, options) {
 		case "ECDH-ES+A256KW": {
 			assertCryptoKeyFor(alg, importedWrappingKey, "wrapping");
 			const enc = options.ecdh?.enc;
+			if (enc !== void 0) assertJWEEncSupported(enc);
 			if (alg === "ECDH-ES" && !enc) throw new JWTError("ECDH-ES direct key agreement requires options.ecdh.enc (the target content encryption algorithm)", "ERR_JWK_INVALID");
 			const { encryptedKey, parameters } = await ecdhesWrap(alg, {
 				enc,
@@ -2004,9 +2010,10 @@ async function unwrapKey(wrappedKey, unwrappingKey, options) {
 			const apvBytes = segmentBytes(options.apv ?? /* @__PURE__ */ new Uint8Array(0), "apv");
 			assertPartyInfoLength("apu", apuBytes);
 			assertPartyInfoLength("apv", apvBytes);
+			if (options.enc !== void 0) assertJWEEncSupported(options.enc);
 			const infoAlg = alg === "ECDH-ES" ? options.enc : alg;
 			if (!infoAlg) throw new JWTError("ECDH-ES requires content encryption algorithm ('enc') to derive the shared secret", "ERR_JWE_INVALID");
-			const sharedSecret = await unwrapping(deriveECDHESKey(epkCandidate, importedUnwrappingKey, infoAlg, ecdhDerivedBits(alg, infoAlg), apuBytes, apvBytes));
+			const sharedSecret = await unwrapping(deriveECDHESKey(epkCandidate, importedUnwrappingKey, infoAlg, ecdhDerivedBits(alg, options.enc), apuBytes, apvBytes));
 			if (alg === "ECDH-ES") unwrappedCekBytes = sharedSecret;
 			else {
 				const kwAlg = innerKeyWrapAlg(alg);
@@ -2040,7 +2047,7 @@ async function importPEM(pem, alg, options) {
 		default: throw new JWTError(`Unsupported PEM type: ${String(pemType)}`, "ERR_JWK_UNSUPPORTED");
 	}
 	return {
-		...await exportKey(cryptoKey, options?.jwkParams),
+		...await exportJWK(cryptoKey, options?.jwkParams),
 		alg
 	};
 }
@@ -2080,8 +2087,9 @@ function inferPEMType(pem) {
 async function deriveSharedSecret(publicKey, privateKey, options) {
 	assertPlainObject(options, "options");
 	const { enc: alg, keyLength: requestedKeyLength, partyUInfo, partyVInfo } = options;
+	if (!isECDHESAlgorithm(alg)) assertJWEEncSupported(alg);
 	if (requestedKeyLength !== void 0) assertDerivedKeyLength(requestedKeyLength);
-	const importAlg = alg.startsWith("ECDH-ES") ? alg : "ECDH-ES";
+	const importAlg = isECDHESAlgorithm(alg) ? alg : "ECDH-ES";
 	const pubCryptoKey = isCryptoKey(publicKey) ? publicKey : await importKey(publicKey, {
 		alg: importAlg,
 		expect: "public"
@@ -2093,7 +2101,7 @@ async function deriveSharedSecret(publicKey, privateKey, options) {
 	let keyLength;
 	if (requestedKeyLength !== void 0) keyLength = requestedKeyLength;
 	else if (alg === "ECDH-ES") throw new JWTError("deriveSharedSecret with enc \"ECDH-ES\" requires an explicit keyLength in options", "ERR_JWK_INVALID");
-	else if (alg.startsWith("ECDH-ES+")) keyLength = Number.parseInt(alg.slice(-5, -2), 10);
+	else if (isECDHESAlgorithm(alg)) keyLength = aesBitsOf(innerKeyWrapAlg(alg));
 	else keyLength = bitLengthCEK(alg);
 	return deriveECDHESKey(pubCryptoKey, privCryptoKey, alg, keyLength, partyUInfo ?? /* @__PURE__ */ new Uint8Array(0), partyVInfo ?? /* @__PURE__ */ new Uint8Array(0));
 }
@@ -2402,4 +2410,42 @@ function segmentBytes(value, name) {
 		what: `"${name}"`
 	}) : value;
 }
-export { DEFAULT_JOSE_LIMITS, DEFAULT_PBES2_ITERATIONS, JWE_ALG_CTX, JWE_DIRECT_ALGS, JWS_ALG_CTX, WeakMapJWKCache, applyB64Header, asDecryptionError, asJWTError, asKeyLookupError, asKeyUsageError, assertB64Option, assertCompactToken, assertConsumerOptions, assertDirectKeyRole, assertEntryLimit, assertJWEAlgSupported, assertJWEEncSupported, assertJWKSetCandidates, assertNoZipOption, assertNotStringKey, assertOptionEntry, assertPBES2Params, assertProducerCEK, assertProducerCrit, assertProducerIV, assertProtectedOnlyOption, assertSerializationObject, buildECDHAgreementParams, buildJWKSetFilter, buildUnwrapKeyOptions, checkAlgAllowed, checkJWEAlgSupported, checkJWEContentSegments, checkJWEDirectEncryptedKey, checkJWEEncAllowed, checkJWEEncSupported, checkJWEUnprotectedCrit, checkJWEZip, checkJWSAlgSupported, checkJWSB64, checkProtectedTyp, checkSerializationEntry, clearJWKCache, configureJWKCache, createPBES2Budget, decodeJWEPayload, decodeJWSPayload, decodeProtectedHeader, decodeSegment, decrypt, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, encrypt, encryptKey, exportKey, exportPEM, exportReturnedCek, generateCEK, generateIV, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, isJWEAlgSupported, keyMatchesHeader, quoteTokenValue, resolveKeyInput, resolveLimit, resolvePasswordKey, resolvePayloadMode, resolveSigningKey, serializeProtectedHeader, sign, stringKeyError, thumbprint, unwrapKey, validateClaimsIfJson, verify, wrapKey };
+function withAlg(jwk, alg) {
+	return {
+		...jwk,
+		alg
+	};
+}
+function generatedPairAlgorithm(alg) {
+	return alg;
+}
+function generatedSecretAlgorithm(alg) {
+	return alg;
+}
+const PUBLIC_KEY_OPS = /* @__PURE__ */ new Map([
+	["sign", "verify"],
+	["verify", "verify"],
+	["decrypt", "encrypt"],
+	["encrypt", "encrypt"],
+	["unwrapKey", "wrapKey"],
+	["wrapKey", "wrapKey"]
+]);
+function publicKeyOps(keyOps) {
+	if (!Array.isArray(keyOps)) return [];
+	const ops = [];
+	for (const op of keyOps) {
+		const publicOp = typeof op === "string" ? PUBLIC_KEY_OPS.get(op) : void 0;
+		if (publicOp !== void 0 && !ops.includes(publicOp)) ops.push(publicOp);
+	}
+	return ops;
+}
+function requestedKeyOps(options, key) {
+	return options.keyUsage === void 0 ? void 0 : [...key.usages];
+}
+function withKeyOps(jwk, keyOps) {
+	return keyOps === void 0 ? jwk : {
+		...jwk,
+		key_ops: keyOps
+	};
+}
+export { DEFAULT_JOSE_LIMITS, DEFAULT_PBES2_ITERATIONS, JWE_ALG_CTX, JWE_DIRECT_ALGS, JWS_ALG_CTX, WeakMapJWKCache, applyB64Header, asDecryptionError, asJWTError, asKeyLookupError, asKeyUsageError, assertB64Option, assertCompactToken, assertConsumerOptions, assertDirectKeyRole, assertEntryLimit, assertJWEAlgSupported, assertJWEEncSupported, assertJWKSetCandidates, assertJWSAlgSupported, assertNoZipOption, assertNotStringKey, assertOptionEntry, assertPBES2Params, assertProducerCEK, assertProducerConfirmation, assertProducerCrit, assertProducerIV, assertProducerKeyHeaders, assertProtectedOnlyOption, assertSerializationObject, buildECDHAgreementParams, buildJWKSetFilter, buildUnwrapKeyOptions, checkAlgAllowed, checkJWEAlgSupported, checkJWEContentSegments, checkJWEDirectEncryptedKey, checkJWEEncAllowed, checkJWEEncSupported, checkJWEUnprotectedCrit, checkJWEZip, checkJWSAlgSupported, checkJWSB64, checkProtectedTyp, checkSerializationEntry, clearJWKCache, configureJWKCache, createPBES2Budget, decodeJWEPayload, decodeJWSPayload, decodeProtectedHeader, decodeSegment, decrypt, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, encrypt, encryptKey, exportJWK, exportKey, exportPEM, exportReturnedCek, generateCEK, generateIV, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, isJWEAlgSupported, keyMatchesHeader, quoteTokenValue, resolveKeyInput, resolveLimit, resolvePasswordKey, resolvePayloadMode, resolveSigningKey, serializeProtectedHeader, sign, stringKeyError, thumbprint, toPublicJWK, unwrapKey, validateClaimsIfJson, verify, wrapKey };