unjwt 0.8.3 → 0.8.4

package/dist/core/jwk.mjs

@@ -1,4 +1,713 @@
-import { UnsecureError } from "../_chunks/libs/unsecure.mjs";
-import { JWTError, isJWTError, isUnsecureError } from "../_chunks/_jwt-internal.mjs";
-import { WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportJWK, exportKey, exportPEM, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, thumbprint, toPublicJWK, unwrapKey, wrapKey } from "../_chunks/jwk.mjs";
+import { UnsecureError, sanitizeObjectCopy, secureRandomBytes, textEncoder } from "../_chunks/libs/unsecure.mjs";
+import { JWTError, assertPlainObject, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWTError, isPublicJWK, isUnsecureError } from "../_chunks/_jwt-internal.mjs";
+import { ECDSA_CURVES, PBES2_ALGORITHMS, aesBitsOf, innerKeyWrapAlg, isECDHESAlgorithm, jwsHashOf, rsaOaepHashOf } from "../_chunks/digest.mjs";
+import { MAX_PARTY_INFO_BYTES, WeakMapJWKCache, aesKwUnwrap, aesKwWrap, asDecryptionError, assertDirectKeyRole, assertECDHKeyAllowed, assertJWEEncSupported, assertOctKeyLength, assertPBES2Count, assertPBES2Params, assertPBES2Salt, bitLengthCEK, bitLengthIV, bitLengthTag, buildECDHAgreementParams, clearJWKCache, configureJWKCache, decodeSegment, decryptRSAES, deriveECDHESKey, deriveKey, ecdhDerivedBits, ecdhesWrap, encryptRSAES, fromPKCS8, fromSPKI, fromX509, gcmkwDecrypt, gcmkwEncrypt, getJWKsFromSet, importKey, keyToJWK, normalizeEpk, pbes2Unwrap, pbes2Wrap, resolvePasswordKey, thumbprint, toPKCS8, toSPKI } from "../_chunks/_import-key.mjs";
+async function generateKey(alg, options = {}) {
+	const exportToJWK = options.toJWK !== void 0 && options.toJWK;
+	const defaultExtractable = exportToJWK || options.extractable !== false;
+	const kid = exportToJWK ? assertKidOption(options.kid) : void 0;
+	if (alg === "A128CBC-HS256" || alg === "A192CBC-HS384" || alg === "A256CBC-HS512") {
+		const keyLength = bitLengthCEK(alg);
+		const keyBytes = secureRandomBytes(keyLength >> 3);
+		if (exportToJWK) {
+			const jwk = await keyToJWK(keyBytes);
+			const keyOps = options.keyUsage === void 0 ? void 0 : resolveKeyUsage(options.keyUsage, {
+				allowed: CONTENT_ENCRYPTION_USAGES,
+				fallback: ["encrypt", "decrypt"],
+				alg
+			});
+			return withGeneratedKid(kid, withKeyOps({
+				...jwk,
+				alg
+			}, keyOps));
+		}
+		return keyBytes;
+	}
+	const { algorithm, keyUsages } = getGenerateKeyParams(alg, options);
+	const key = await crypto.subtle.generateKey(algorithm, defaultExtractable, keyUsages);
+	if (exportToJWK) {
+		if (isCryptoKeyPair(key)) {
+			const pairAlg = generatedPairAlgorithm(alg);
+			const [pub, priv] = await Promise.all([exportJWK(key.publicKey), exportJWK(key.privateKey)]);
+			const publicKey = await withGeneratedKid(kid, withKeyOps(withAlg(pub, pairAlg), requestedKeyOps(options, key.publicKey)));
+			const named = publicKey.kid === void 0 ? void 0 : { kid: publicKey.kid };
+			return {
+				privateKey: {
+					...withKeyOps(withAlg(priv, pairAlg), requestedKeyOps(options, key.privateKey)),
+					...named
+				},
+				publicKey
+			};
+		}
+		return withGeneratedKid(kid, withKeyOps(withAlg(await exportJWK(key), generatedSecretAlgorithm(alg)), requestedKeyOps(options, key)));
+	}
+	return key;
+}
+async function generateJWK(alg, options) {
+	const { keyUsage, modulusLength, publicExponent, namedCurve, kid, extractable: _extractable, toJWK: _toJWK, ...jwkParams } = options ?? {};
+	assertNoReservedJWKParams(jwkParams);
+	const result = await generateKey(alg, {
+		keyUsage,
+		modulusLength,
+		publicExponent,
+		namedCurve,
+		kid,
+		toJWK: true
+	});
+	if (result && typeof result === "object" && "privateKey" in result && "publicKey" in result) return {
+		privateKey: {
+			...jwkParams,
+			...result.privateKey
+		},
+		publicKey: {
+			...jwkParams,
+			...result.publicKey
+		}
+	};
+	return {
+		...jwkParams,
+		...result
+	};
+}
+async function deriveKeyFromPassword(password, options) {
+	assertPlainObject(options, "options");
+	if (typeof password !== "string" && !(password instanceof Uint8Array)) throw new JWTError("\"password\" must be a string or a Uint8Array.", "ERR_INVALID_OPTION");
+	const { alg, salt, iterations, extractable, keyUsage } = options;
+	assertPBES2Algorithm(alg);
+	const exportToJWK = options.toJWK !== void 0 && options.toJWK;
+	const saltBytes = typeof salt === "string" ? textEncoder.encode(salt) : salt;
+	assertPBES2Salt(saltBytes, "\"salt\"");
+	assertPBES2Count(iterations, "\"iterations\"");
+	const passwordBytes = typeof password === "string" ? textEncoder.encode(password) : password;
+	const derivedBytes = await deriveKey(saltBytes, alg, iterations, passwordBytes);
+	const wrappingAlg = innerKeyWrapAlg(alg);
+	const finalUsages = keyUsage ?? ["wrapKey", "unwrapKey"];
+	const finalExtractable = exportToJWK ? true : extractable === true;
+	const derivedKey = await crypto.subtle.importKey("raw", derivedBytes, { name: "AES-KW" }, finalExtractable, finalUsages);
+	if (exportToJWK) return withKeyOps({
+		...await keyToJWK(derivedKey),
+		alg: wrappingAlg,
+		kty: "oct"
+	}, requestedKeyOps(options, derivedKey));
+	return derivedKey;
+}
+async function deriveJWKFromPassword(password, options) {
+	assertPlainObject(options, "options");
+	const { alg, salt, iterations, keyUsage, kid: kidOption, extractable: _extractable, toJWK: _toJWK, ...jwkParams } = options;
+	assertNoReservedJWKParams(jwkParams);
+	const kid = assertKidOption(kidOption);
+	const result = await deriveKeyFromPassword(password, {
+		alg,
+		salt,
+		iterations,
+		keyUsage,
+		toJWK: true
+	});
+	return {
+		...jwkParams,
+		...await withGeneratedKid(kid, result)
+	};
+}
+async function exportJWK(key, jwkParams) {
+	if (!isCryptoKey(key)) throw new JWTError("exportJWK expects a CryptoKey.", "ERR_INVALID_OPTION");
+	if (!key.extractable) throw new JWTError("A non-extractable CryptoKey cannot be exported as a JWK.", "ERR_JWK_INVALID");
+	const exportedJwk = await keyToJWK(key);
+	if (jwkParams) {
+		const extraParams = sanitizeObjectCopy(jwkParams);
+		assertNoReservedJWKParams(extraParams);
+		return {
+			...exportedJwk,
+			...extraParams
+		};
+	}
+	return exportedJwk;
+}
+async function exportKey(key, jwkParams) {
+	return exportJWK(key, jwkParams);
+}
+function toPublicJWK(jwk) {
+	if (!isAsymmetricJWK(jwk)) throw new JWTError(isJWK(jwk) ? "An oct JWK has no public half." : "toPublicJWK expects an asymmetric JWK.", "ERR_JWK_INVALID");
+	const { d: _d, p: _p, q: _q, dp: _dp, dq: _dq, qi: _qi, oth: _oth, key_ops, ...publicMembers } = sanitizeObjectCopy({ ...jwk });
+	const publicKey = key_ops === void 0 ? publicMembers : {
+		...publicMembers,
+		key_ops: publicKeyOps(key_ops)
+	};
+	if (!isPublicJWK(publicKey)) throw new JWTError(`${jwk.kty} JWK lacks the public members of its key type.`, "ERR_JWK_INVALID");
+	return publicKey;
+}
+async function wrapKey(keyToWrap, wrappingKey, options) {
+	assertPlainObject(options, "options");
+	assertKeyBytesArg(keyToWrap, "keyToWrap");
+	const { alg } = options;
+	const cekBytes = keyToWrap instanceof Uint8Array ? keyToWrap : new Uint8Array(await crypto.subtle.exportKey("raw", keyToWrap));
+	if (alg.endsWith("KW")) assertWrappableCEK(cekBytes, alg);
+	if (alg.startsWith("PBES2")) assertPBES2Params({
+		p2s: options.p2s,
+		p2c: options.p2c
+	});
+	const importedWrappingKey = await importKey(resolvePasswordKey(alg, wrappingKey), {
+		alg,
+		expect: "public"
+	});
+	switch (alg) {
+		case "dir": return { encryptedKey: /* @__PURE__ */ new Uint8Array(0) };
+		case "A128KW":
+		case "A192KW":
+		case "A256KW": return { encryptedKey: await aesKwWrap(alg, importedWrappingKey, cekBytes) };
+		case "PBES2-HS256+A128KW":
+		case "PBES2-HS384+A192KW":
+		case "PBES2-HS512+A256KW": {
+			const { p2s, p2c } = options;
+			if (!p2s || typeof p2c !== "number") throw new JWTError("PBES2 requires 'p2s' (salt) and 'p2c' (count) options", "ERR_JWE_INVALID");
+			return pbes2Wrap(alg, importedWrappingKey, cekBytes, p2c, p2s);
+		}
+		case "A128GCMKW":
+		case "A192GCMKW":
+		case "A256GCMKW": {
+			const { encryptedKey, iv, tag } = await gcmkwEncrypt(alg, importedWrappingKey, cekBytes, options.iv);
+			return {
+				encryptedKey,
+				iv,
+				tag
+			};
+		}
+		case "RSA-OAEP":
+		case "RSA-OAEP-256":
+		case "RSA-OAEP-384":
+		case "RSA-OAEP-512":
+			assertCryptoKeyFor(alg, importedWrappingKey, "wrapping");
+			return { encryptedKey: await encryptRSAES(alg, importedWrappingKey, cekBytes) };
+		case "ECDH-ES":
+		case "ECDH-ES+A128KW":
+		case "ECDH-ES+A192KW":
+		case "ECDH-ES+A256KW": {
+			assertCryptoKeyFor(alg, importedWrappingKey, "wrapping");
+			const enc = options.ecdh?.enc;
+			if (enc !== void 0) assertJWEEncSupported(enc);
+			if (alg === "ECDH-ES" && !enc) throw new JWTError("ECDH-ES direct key agreement requires options.ecdh.enc", "ERR_JWK_INVALID");
+			const { encryptedKey, parameters } = await ecdhesWrap(alg, {
+				enc,
+				recipientKey: importedWrappingKey,
+				cek: cekBytes,
+				parameters: buildECDHAgreementParams(options.ecdh)
+			});
+			const wrapResult = {
+				encryptedKey: encryptedKey ?? /* @__PURE__ */ new Uint8Array(0),
+				epk: parameters.epk
+			};
+			if (parameters.apu) wrapResult.apu = parameters.apu;
+			if (parameters.apv) wrapResult.apv = parameters.apv;
+			return wrapResult;
+		}
+		default: throw new JWTError(`Unsupported key wrapping algorithm: ${alg}`, "ERR_JWK_UNSUPPORTED");
+	}
+}
+async function unwrapKey(wrappedKey, unwrappingKey, options) {
+	assertPlainObject(options, "options");
+	if (!(wrappedKey instanceof Uint8Array)) throw new JWTError("\"wrappedKey\" must be a Uint8Array.", "ERR_INVALID_OPTION");
+	const { alg } = options;
+	const returnRaw = options.format === "raw";
+	const defaultExtractable = options.extractable !== false;
+	const importedUnwrappingKey = await importKey(resolvePasswordKey(alg, unwrappingKey), {
+		alg,
+		expect: "private"
+	});
+	let unwrappedCekBytes;
+	switch (alg) {
+		case "dir":
+			assertDirectKeyRole(unwrappingKey, options.enc);
+			if (importedUnwrappingKey instanceof Uint8Array) {
+				assertOctKeyLength(importedUnwrappingKey, options.enc);
+				unwrappedCekBytes = importedUnwrappingKey;
+			} else {
+				if (!returnRaw) return importedUnwrappingKey;
+				unwrappedCekBytes = new Uint8Array(await crypto.subtle.exportKey("raw", importedUnwrappingKey));
+			}
+			break;
+		case "A128KW":
+		case "A192KW":
+		case "A256KW":
+			unwrappedCekBytes = await unwrapping(aesKwUnwrap(alg, importedUnwrappingKey, wrappedKey));
+			break;
+		case "PBES2-HS256+A128KW":
+		case "PBES2-HS384+A192KW":
+		case "PBES2-HS512+A256KW": {
+			const { p2s, p2c, minIterations, maxIterations } = options;
+			if (!p2s || typeof p2c !== "number") throw new JWTError("PBES2 requires 'p2s' (salt) and 'p2c' (count) options", "ERR_JWE_INVALID");
+			const p2sBytes = segmentBytes(p2s, "p2s");
+			unwrappedCekBytes = await unwrapping(pbes2Unwrap(alg, importedUnwrappingKey, wrappedKey, p2c, p2sBytes, minIterations, maxIterations));
+			break;
+		}
+		case "A128GCMKW":
+		case "A192GCMKW":
+		case "A256GCMKW": {
+			if (!options.iv || !options.tag) throw new JWTError("AES-GCMKW requires 'iv' and 'tag' options for unwrapping", "ERR_JWE_INVALID");
+			const ivBytes = segmentBytes(options.iv, "iv");
+			const tagBytes = segmentBytes(options.tag, "tag");
+			assertKeyWrapSegmentLength("iv", ivBytes, bitLengthIV(alg) >> 3, alg);
+			assertKeyWrapSegmentLength("tag", tagBytes, bitLengthTag(alg) >> 3, alg);
+			unwrappedCekBytes = await unwrapping(gcmkwDecrypt(alg, importedUnwrappingKey, wrappedKey, ivBytes, tagBytes));
+			break;
+		}
+		case "RSA-OAEP":
+		case "RSA-OAEP-256":
+		case "RSA-OAEP-384":
+		case "RSA-OAEP-512": {
+			assertCryptoKeyFor(alg, importedUnwrappingKey, "unwrapping");
+			unwrappedCekBytes = await unwrapping(decryptRSAES(alg, importedUnwrappingKey, wrappedKey));
+			if (returnRaw) break;
+			const inferredAlgorithm = options.unwrappedKeyAlgorithm || inferAesImportAlgorithm(options.enc, unwrappedCekBytes.length);
+			if (!inferredAlgorithm) throw new JWTError("Cannot infer the RSA-OAEP unwrapped key algorithm, pass \"unwrappedKeyAlgorithm\".", "ERR_JWE_INVALID");
+			const keyUsages = options.keyUsage || ["encrypt", "decrypt"];
+			return await crypto.subtle.importKey("raw", unwrappedCekBytes, inferredAlgorithm, defaultExtractable, keyUsages);
+		}
+		case "ECDH-ES":
+		case "ECDH-ES+A128KW":
+		case "ECDH-ES+A192KW":
+		case "ECDH-ES+A256KW": {
+			if (!options.epk) throw new JWTError("ECDH-ES requires 'epk' option", "ERR_JWE_INVALID");
+			assertCryptoKeyFor(alg, importedUnwrappingKey, "unwrapping");
+			assertECDHKeyAllowed(importedUnwrappingKey);
+			const epkCandidate = await normalizeEpk(options.epk, {
+				alg,
+				recipientKey: importedUnwrappingKey
+			});
+			const apuBytes = segmentBytes(options.apu ?? /* @__PURE__ */ new Uint8Array(0), "apu");
+			const apvBytes = segmentBytes(options.apv ?? /* @__PURE__ */ new Uint8Array(0), "apv");
+			assertPartyInfoLength("apu", apuBytes);
+			assertPartyInfoLength("apv", apvBytes);
+			if (options.enc !== void 0) assertJWEEncSupported(options.enc);
+			const infoAlg = alg === "ECDH-ES" ? options.enc : alg;
+			if (!infoAlg) throw new JWTError("ECDH-ES requires 'enc' to derive the shared secret", "ERR_JWE_INVALID");
+			const keyLength = ecdhDerivedBits(alg, options.enc);
+			const sharedSecret = await unwrapping(deriveECDHESKey(epkCandidate, importedUnwrappingKey, infoAlg, keyLength, apuBytes, apvBytes));
+			if (alg === "ECDH-ES") unwrappedCekBytes = sharedSecret;
+			else {
+				const kwAlg = innerKeyWrapAlg(alg);
+				if (!(wrappedKey instanceof Uint8Array) || wrappedKey.length === 0) throw new JWTError("ECDH-ES key agreement with key wrapping requires an encrypted key", "ERR_JWE_INVALID");
+				unwrappedCekBytes = await unwrapping(aesKwUnwrap(kwAlg, sharedSecret, wrappedKey));
+			}
+			break;
+		}
+		default: throw new JWTError(`Unsupported key unwrapping algorithm: ${alg}`, "ERR_JWK_UNSUPPORTED");
+	}
+	if (returnRaw) return unwrappedCekBytes;
+	return await crypto.subtle.importKey("raw", unwrappedCekBytes, options.unwrappedKeyAlgorithm || { name: "AES-GCM" }, defaultExtractable, options.keyUsage || ["encrypt", "decrypt"]);
+}
+async function importPEM(pem, alg, options) {
+	if (typeof pem !== "string") throw new JWTError("\"pem\" must be a PEM-encoded string.", "ERR_INVALID_OPTION");
+	if (options !== void 0) assertPlainObject(options, "options");
+	const extractable = true;
+	const pemType = options?.pemType ?? inferPEMType(pem);
+	if (!pemType) throw new JWTError("Cannot infer PEM type from the input, pass \"pemType\".", "ERR_JWK_INVALID");
+	let cryptoKey;
+	switch (pemType) {
+		case "pkcs8":
+			cryptoKey = await fromPKCS8(pem, alg, { extractable });
+			break;
+		case "spki":
+			cryptoKey = await fromSPKI(pem, alg, { extractable });
+			break;
+		case "x509":
+			cryptoKey = await fromX509(pem, alg, { extractable });
+			break;
+		default: throw new JWTError(`Unsupported PEM type: ${String(pemType)}`, "ERR_JWK_UNSUPPORTED");
+	}
+	return {
+		...await exportJWK(cryptoKey, options?.jwkParams),
+		alg
+	};
+}
+async function exportPEM(jwk, options) {
+	assertPlainObject(jwk, "jwk");
+	if (options !== void 0) assertPlainObject(options, "options");
+	if (jwk.kty === "oct") throw new JWTError("An oct JWK cannot be exported to PKCS8 or SPKI PEM.", "ERR_JWK_UNSUPPORTED");
+	const effectiveAlg = jwk.alg || options?.alg;
+	if (!effectiveAlg && (jwk.kty === "RSA" || jwk.kty === "EC" || jwk.kty === "OKP")) throw new JWTError("\"alg\" is required, set it on the JWK or pass it in options.", "ERR_JWK_INVALID");
+	if (effectiveAlg !== void 0 && !PEM_ALGORITHMS.has(effectiveAlg)) throw new JWTError(`Unsupported PEM algorithm: ${effectiveAlg}`, "ERR_JWK_UNSUPPORTED");
+	const pemFormat = options?.pemFormat ?? ("d" in jwk ? "pkcs8" : "spki");
+	const cryptoKeyCandidate = await importKey({
+		...jwk,
+		ext: true
+	}, {
+		alg: effectiveAlg,
+		expect: pemFormat === "pkcs8" ? "private" : "public",
+		extractable: true
+	});
+	if (!isCryptoKey(cryptoKeyCandidate)) throw new JWTError("Failed to convert JWK to a CryptoKey instance suitable for PEM export.", "ERR_JWK_INVALID");
+	const cryptoKey = cryptoKeyCandidate;
+	switch (pemFormat) {
+		case "pkcs8":
+			if (cryptoKey.type !== "private") throw new JWTError(`Only a private CryptoKey can be exported to PKCS8 PEM (got ${cryptoKey.type}).`, "ERR_JWK_INVALID");
+			return toPKCS8(cryptoKey);
+		case "spki":
+			if (cryptoKey.type !== "public") throw new JWTError(`Only a public CryptoKey can be exported to SPKI PEM (got ${cryptoKey.type}).`, "ERR_JWK_INVALID");
+			return toSPKI(cryptoKey);
+		default: throw new JWTError(`Unsupported PEM format: ${String(pemFormat)}`, "ERR_JWK_UNSUPPORTED");
+	}
+}
+function inferPEMType(pem) {
+	if (pem.includes("-----BEGIN PRIVATE KEY-----")) return "pkcs8";
+	if (pem.includes("-----BEGIN PUBLIC KEY-----")) return "spki";
+	if (pem.includes("-----BEGIN CERTIFICATE-----")) return "x509";
+}
+async function deriveSharedSecret(publicKey, privateKey, options) {
+	assertPlainObject(options, "options");
+	const { enc: alg, keyLength: requestedKeyLength, partyUInfo, partyVInfo } = options;
+	if (!isECDHESAlgorithm(alg)) assertJWEEncSupported(alg);
+	if (requestedKeyLength !== void 0) assertDerivedKeyLength(requestedKeyLength);
+	const importAlg = isECDHESAlgorithm(alg) ? alg : "ECDH-ES";
+	const pubCryptoKey = isCryptoKey(publicKey) ? publicKey : await importKey(publicKey, {
+		alg: importAlg,
+		expect: "public"
+	});
+	const privCryptoKey = isCryptoKey(privateKey) ? privateKey : await importKey(privateKey, {
+		alg: importAlg,
+		expect: "private"
+	});
+	let keyLength;
+	if (requestedKeyLength !== void 0) keyLength = requestedKeyLength;
+	else if (alg === "ECDH-ES") throw new JWTError("deriveSharedSecret with enc \"ECDH-ES\" requires an explicit keyLength in options", "ERR_JWK_INVALID");
+	else if (isECDHESAlgorithm(alg)) keyLength = aesBitsOf(innerKeyWrapAlg(alg));
+	else keyLength = bitLengthCEK(alg);
+	return deriveECDHESKey(pubCryptoKey, privCryptoKey, alg, keyLength, partyUInfo ?? /* @__PURE__ */ new Uint8Array(0), partyVInfo ?? /* @__PURE__ */ new Uint8Array(0));
+}
+function getGenerateKeyParams(alg, options) {
+	let algorithm;
+	let keyUsages;
+	const requested = options?.keyUsage;
+	const usage = (allowed, fallback) => resolveKeyUsage(requested, {
+		allowed,
+		fallback,
+		alg
+	});
+	const pairUsage = (allowed, fallback) => assertPairUsages(usage(allowed, fallback), {
+		fallback,
+		alg
+	});
+	switch (alg) {
+		case "HS256":
+		case "HS384":
+		case "HS512":
+			algorithm = {
+				name: "HMAC",
+				hash: jwsHashOf(alg)
+			};
+			keyUsages = usage(SIGNATURE_USAGES, ["sign", "verify"]);
+			break;
+		case "RS256":
+		case "RS384":
+		case "RS512":
+			algorithm = {
+				name: "RSASSA-PKCS1-v1_5",
+				modulusLength: assertModulusLength(options?.modulusLength),
+				publicExponent: assertPublicExponent(options?.publicExponent),
+				hash: jwsHashOf(alg)
+			};
+			keyUsages = pairUsage(SIGNATURE_USAGES, ["sign", "verify"]);
+			break;
+		case "PS256":
+		case "PS384":
+		case "PS512":
+			algorithm = {
+				name: "RSA-PSS",
+				modulusLength: assertModulusLength(options?.modulusLength),
+				publicExponent: assertPublicExponent(options?.publicExponent),
+				hash: jwsHashOf(alg)
+			};
+			keyUsages = pairUsage(SIGNATURE_USAGES, ["sign", "verify"]);
+			break;
+		case "RSA-OAEP":
+		case "RSA-OAEP-256":
+		case "RSA-OAEP-384":
+		case "RSA-OAEP-512":
+			algorithm = {
+				name: "RSA-OAEP",
+				modulusLength: assertModulusLength(options?.modulusLength),
+				publicExponent: assertPublicExponent(options?.publicExponent),
+				hash: rsaOaepHashOf(alg)
+			};
+			keyUsages = pairUsage(KEY_ENCRYPTION_USAGES, [
+				"encrypt",
+				"decrypt",
+				"wrapKey",
+				"unwrapKey"
+			]);
+			break;
+		case "A128KW":
+		case "A192KW":
+		case "A256KW":
+			algorithm = {
+				name: "AES-KW",
+				length: aesBitsOf(alg)
+			};
+			keyUsages = usage(KEY_WRAPPING_USAGES, ["wrapKey", "unwrapKey"]);
+			break;
+		case "A128GCM":
+		case "A192GCM":
+		case "A256GCM":
+		case "A128GCMKW":
+		case "A192GCMKW":
+		case "A256GCMKW":
+			algorithm = {
+				name: "AES-GCM",
+				length: aesBitsOf(alg)
+			};
+			keyUsages = usage(KEY_ENCRYPTION_USAGES, ["encrypt", "decrypt"]);
+			break;
+		case "ES256":
+		case "ES384":
+		case "ES512": {
+			const namedCurve = ECDSA_CURVES[alg];
+			assertNamedCurve(options?.namedCurve, namedCurve, alg);
+			algorithm = {
+				name: "ECDSA",
+				namedCurve
+			};
+			keyUsages = pairUsage(SIGNATURE_USAGES, ["sign", "verify"]);
+			break;
+		}
+		case "Ed25519":
+			assertNamedCurve(options?.namedCurve, "Ed25519", alg);
+			keyUsages = pairUsage(SIGNATURE_USAGES, ["sign", "verify"]);
+			algorithm = { name: "Ed25519" };
+			break;
+		case "EdDSA": {
+			keyUsages = pairUsage(SIGNATURE_USAGES, ["sign", "verify"]);
+			const namedCurve = options?.namedCurve ?? "Ed25519";
+			if (namedCurve !== "Ed25519") throw new JWTError("Unsupported namedCurve, expected Ed25519", "ERR_JWK_UNSUPPORTED");
+			algorithm = { name: namedCurve };
+			break;
+		}
+		case "ECDH-ES":
+		case "ECDH-ES+A128KW":
+		case "ECDH-ES+A192KW":
+		case "ECDH-ES+A256KW": {
+			keyUsages = pairUsage(DERIVATION_USAGES, ["deriveBits"]);
+			const namedCurve = options?.namedCurve ?? "P-256";
+			switch (namedCurve) {
+				case "P-256":
+				case "P-384":
+				case "P-521":
+					algorithm = {
+						name: "ECDH",
+						namedCurve
+					};
+					break;
+				case "X25519":
+					algorithm = { name: "X25519" };
+					break;
+				default: throw new JWTError("Unsupported namedCurve, expected P-256, P-384, P-521 or X25519", "ERR_JWK_UNSUPPORTED");
+			}
+			break;
+		}
+		default: throw new JWTError(`Unsupported or invalid algorithm for key generation: ${alg}`, "ERR_JWK_UNSUPPORTED");
+	}
+	return {
+		algorithm,
+		keyUsages
+	};
+}
+function inferAesImportAlgorithm(enc, cekLengthBytes) {
+	const bitLength = cekLengthBytes << 3;
+	if (enc) {
+		if (enc.includes("GCM")) return {
+			name: "AES-GCM",
+			length: aesBitsOf(enc)
+		};
+		if (enc.includes("CBC-HS")) return;
+	}
+	if (bitLength === 128 || bitLength === 192 || bitLength === 256) return {
+		name: "AES-GCM",
+		length: bitLength
+	};
+}
+const RESERVED_JWK_PARAMS = /* @__PURE__ */ new Set([
+	"kty",
+	"alg",
+	"key_ops",
+	"ext",
+	"k",
+	"d",
+	"n",
+	"e",
+	"p",
+	"q",
+	"dp",
+	"dq",
+	"qi",
+	"oth",
+	"x",
+	"y",
+	"crv"
+]);
+function assertNoReservedJWKParams(jwkParams) {
+	const reserved = Object.keys(jwkParams).filter((name) => RESERVED_JWK_PARAMS.has(name));
+	if (reserved.length > 0) throw new JWTError(`jwkParams must not set reserved JWK members: ${reserved.join(", ")}`, "ERR_INVALID_OPTION");
+}
+function assertNamedCurve(requested, expected, alg) {
+	if (requested === void 0 || requested === expected) return;
+	throw new JWTError(`"namedCurve" ${requested} contradicts ${alg}, which is defined over ${expected}.`, "ERR_INVALID_OPTION");
+}
+function assertPublicExponent(publicExponent) {
+	if (publicExponent === void 0) return new Uint8Array([
+		1,
+		0,
+		1
+	]);
+	if (!(publicExponent instanceof Uint8Array) || publicExponent.length === 0) throw new JWTError("\"publicExponent\" must be the exponent's big-endian bytes as a Uint8Array.", "ERR_INVALID_OPTION");
+	return publicExponent;
+}
+const SIGNATURE_USAGES = ["sign", "verify"];
+const KEY_WRAPPING_USAGES = ["wrapKey", "unwrapKey"];
+const KEY_ENCRYPTION_USAGES = [
+	"encrypt",
+	"decrypt",
+	"wrapKey",
+	"unwrapKey"
+];
+const DERIVATION_USAGES = ["deriveBits", "deriveKey"];
+const CONTENT_ENCRYPTION_USAGES = ["encrypt", "decrypt"];
+function resolveKeyUsage(requested, options) {
+	const { allowed, fallback, alg } = options;
+	if (requested === void 0) return fallback;
+	if (!Array.isArray(requested) || requested.length === 0) throw new JWTError("\"keyUsage\" must be a non-empty array.", "ERR_INVALID_OPTION");
+	const rejected = requested.filter((entry) => !allowed.includes(entry));
+	if (rejected.length > 0) throw new JWTError(`"keyUsage" ${rejected.join(", ")} cannot be served by ${alg}, use ${allowed.join(", ")}.`, "ERR_INVALID_OPTION");
+	return requested;
+}
+const PRIVATE_KEY_USAGES = [
+	"sign",
+	"decrypt",
+	"unwrapKey",
+	"deriveBits",
+	"deriveKey"
+];
+const PUBLIC_KEY_USAGES = [
+	"verify",
+	"encrypt",
+	"wrapKey"
+];
+function assertPairUsages(usages, options) {
+	const { fallback, alg } = options;
+	for (const [half, side] of [[PRIVATE_KEY_USAGES, "private"], [PUBLIC_KEY_USAGES, "public"]]) {
+		const wanted = fallback.filter((entry) => half.includes(entry));
+		if (wanted.length === 0 || usages.some((entry) => half.includes(entry))) continue;
+		throw new JWTError(`"keyUsage" leaves the ${side} half of a ${alg} key pair unusable, add ${wanted.join(" or ")}.`, "ERR_INVALID_OPTION");
+	}
+	return usages;
+}
+function assertKidOption(kid) {
+	if (kid === void 0 || kid === false || typeof kid === "string") return kid;
+	throw new JWTError("\"kid\" must be a string or false.", "ERR_INVALID_OPTION");
+}
+async function withGeneratedKid(kid, jwk) {
+	if (kid === false) return jwk;
+	return {
+		...jwk,
+		kid: kid ?? await thumbprint(jwk)
+	};
+}
+const PEM_ALGORITHMS = /* @__PURE__ */ new Set(Object.keys({
+	"PS256": true,
+	"PS384": true,
+	"PS512": true,
+	"RS256": true,
+	"RS384": true,
+	"RS512": true,
+	"RSA-OAEP": true,
+	"RSA-OAEP-256": true,
+	"RSA-OAEP-384": true,
+	"RSA-OAEP-512": true,
+	"ES256": true,
+	"ES384": true,
+	"ES512": true,
+	"ECDH-ES": true,
+	"ECDH-ES+A128KW": true,
+	"ECDH-ES+A192KW": true,
+	"ECDH-ES+A256KW": true,
+	"Ed25519": true,
+	"EdDSA": true
+}));
+function assertWrappableCEK(cek, alg) {
+	if (cek.length >= 16 && cek.length % 8 === 0) return;
+	throw new JWTError(`${alg} wraps a key of 16 or more bytes in whole 8-byte blocks (got ${cek.length}).`, "ERR_INVALID_OPTION");
+}
+async function unwrapping(operation) {
+	try {
+		return await operation;
+	} catch (error) {
+		throw asDecryptionError(error);
+	}
+}
+function assertPBES2Algorithm(alg) {
+	if (typeof alg === "string" && PBES2_ALGORITHMS.includes(alg)) return;
+	throw new JWTError(`Password derivation is defined for ${PBES2_ALGORITHMS.join(", ")}, not ${String(alg)}.`, "ERR_JWK_UNSUPPORTED");
+}
+function assertKeyBytesArg(value, name) {
+	if (value instanceof Uint8Array || isCryptoKey(value)) return;
+	throw new JWTError(`"${name}" must be a Uint8Array or a CryptoKey.`, "ERR_INVALID_OPTION");
+}
+function assertModulusLength(modulusLength) {
+	const length = modulusLength ?? 2048;
+	if (!Number.isInteger(length) || length < 2048) throw new JWTError("modulusLength must be at least 2048 bits", "ERR_INVALID_OPTION");
+	return length;
+}
+function assertPartyInfoLength(name, bytes) {
+	if (bytes.length > 1024) throw new JWTError(`Invalid JWE: "${name}" must not exceed ${MAX_PARTY_INFO_BYTES} bytes (got ${bytes.length}).`, "ERR_JWE_INVALID");
+}
+function assertKeyWrapSegmentLength(name, bytes, expected, alg) {
+	if (bytes.length !== expected) throw new JWTError(`Invalid JWE: "${name}" must be ${expected} bytes for ${alg} (got ${bytes.length}).`, "ERR_JWE_INVALID");
+}
+function assertDerivedKeyLength(keyLength) {
+	if (!Number.isInteger(keyLength) || keyLength <= 0 || keyLength % 8 !== 0 || keyLength > 8192) throw new JWTError(`keyLength must be a positive multiple of 8 no greater than 8192 bits, got ${keyLength}`, "ERR_INVALID_OPTION");
+}
+function assertCryptoKeyFor(alg, key, role) {
+	if (isCryptoKey(key)) return;
+	throw new JWTError(`${alg} requires the ${role} key to be a CryptoKey`, "ERR_JWK_INVALID");
+}
+function segmentBytes(value, name) {
+	return typeof value === "string" ? decodeSegment(value, {
+		family: "JWE",
+		what: `"${name}"`
+	}) : value;
+}
+function withAlg(jwk, alg) {
+	return {
+		...jwk,
+		alg
+	};
+}
+function generatedPairAlgorithm(alg) {
+	return alg;
+}
+function generatedSecretAlgorithm(alg) {
+	return alg;
+}
+const PUBLIC_KEY_OPS = /* @__PURE__ */ new Map([
+	["sign", "verify"],
+	["verify", "verify"],
+	["decrypt", "encrypt"],
+	["encrypt", "encrypt"],
+	["unwrapKey", "wrapKey"],
+	["wrapKey", "wrapKey"]
+]);
+function publicKeyOps(keyOps) {
+	if (!Array.isArray(keyOps)) return [];
+	const ops = [];
+	for (const op of keyOps) {
+		const publicOp = typeof op === "string" ? PUBLIC_KEY_OPS.get(op) : void 0;
+		if (publicOp !== void 0 && !ops.includes(publicOp)) ops.push(publicOp);
+	}
+	return ops;
+}
+function requestedKeyOps(options, key) {
+	return options.keyUsage === void 0 ? void 0 : [...key.usages];
+}
+function withKeyOps(jwk, keyOps) {
+	return keyOps === void 0 ? jwk : {
+		...jwk,
+		key_ops: keyOps
+	};
+}
 export { JWTError, UnsecureError, WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportJWK, exportKey, exportPEM, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, isJWTError, isUnsecureError, thumbprint, toPublicJWK, unwrapKey, wrapKey };