unjwt 0.8.3 → 0.8.5

package/dist/_chunks/algorithms.mjs

@@ -0,0 +1,1541 @@
+import { safeJsonParse, sanitizeObjectCopy, textEncoder } from "./libs/unsecure.mjs";
+import { JWTError } from "../error.mjs";
+import { assertClaimValidationOptions, assertCritShape, assertCryptoKey, assertPlainObject, assertStringList, base64Parse, base64Stringify, base64UrlParse, base64UrlStringify, concatUint8Arrays, hasSymmetricSecret, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isPlainObject, isPublicJWK, quoteTokenValue, uint32be } from "./jwt.mjs";
+import { ECDSA_CURVES, aesBitsOf, checkKeyUsage, cryptoKeyCurve, digestUrl, hashBitsOf, inferJWSAllowedAlgorithms, innerKeyWrapAlg, isAlgorithm, isContentEncryptionAlgorithm, isECDHESAlgorithm, isPBES2Algorithm, isSameAlgorithm, jwkAlgServes, jwsHashOf, lengthOf, modulusLengthOf, namedCurveOf, pbes2HashOf, rsaOaepHashOf, shaBitsOf, unusableKey } from "./digest.mjs";
+function serializeProtectedHeader(header) {
+	try {
+		return JSON.stringify(header);
+	} catch (error) {
+		throw new JWTError("The protected header is not JSON-serializable.", "ERR_INVALID_OPTION", error);
+	}
+}
+function assertProducerCrit(header, family) {
+	const crit = header.crit;
+	if (crit === void 0) return;
+	assertCritShape(crit, {
+		family,
+		code: "ERR_INVALID_OPTION"
+	});
+	for (const param of crit) {
+		if (Object.hasOwn(header, param)) continue;
+		throw new JWTError(`"crit" lists "${param}", which the protected header does not carry.`, "ERR_INVALID_OPTION");
+	}
+}
+const PROTECTED_ONLY_PARAMS = {
+	JWS: ["crit", "b64"],
+	JWE: ["crit"]
+};
+function assertProtectedOnlyOption(header, options) {
+	if (!header) return;
+	const { tier, family } = options;
+	for (const param of PROTECTED_ONLY_PARAMS[family]) {
+		if (!Object.hasOwn(header, param)) continue;
+		throw new JWTError(`${family} "${param}" must be in the protected header, not the ${tier} header.`, "ERR_INVALID_OPTION");
+	}
+}
+function assertProducerKeyHeaders(header, options) {
+	if (!header) return;
+	const { tier, family } = options;
+	if (Object.hasOwn(header, "jwk") && !isPublicJWK(Reflect.get(header, "jwk"))) throw new JWTError(`${family} "jwk" in the ${tier} header must be a public JWK.`, "ERR_INVALID_OPTION");
+	if (Object.hasOwn(header, "epk")) throw new JWTError(`${family} "epk" is not a header option, use "ecdh.ephemeralKey".`, "ERR_INVALID_OPTION");
+}
+function assertProducerConfirmation(payload) {
+	if (typeof payload !== "object" || payload === null) return;
+	const cnf = Reflect.get(payload, "cnf");
+	if (typeof cnf !== "object" || cnf === null || !Object.hasOwn(cnf, "jwk")) return;
+	if (!isPublicJWK(Reflect.get(cnf, "jwk"))) throw new JWTError("Invalid JWT \"cnf\": \"jwk\" must be a public JWK.", "ERR_JWT_CLAIM_INVALID");
+}
+function assertOptionEntry(entry, options) {
+	const { label, objects } = options;
+	assertPlainObject(entry, label);
+	for (const member of objects) if (entry[member] !== void 0) assertPlainObject(entry[member], `${label}.${member}`);
+}
+function assertConsumerOptions(options) {
+	assertOptionEntry(options, {
+		label: "options",
+		objects: ["limits"]
+	});
+	const typ = options.typ;
+	if (typ !== void 0 && (typeof typ !== "string" || typ === "")) throw new JWTError("\"typ\" must be a non-empty string.", "ERR_INVALID_OPTION");
+	assertStringList(options.algorithms, "algorithms");
+	assertStringList(options.encryptionAlgorithms, "encryptionAlgorithms");
+	assertStringList(options.recognizedHeaders, "recognizedHeaders");
+	assertClaimValidationOptions(options);
+}
+function assertCompactToken(token, family) {
+	if (typeof token !== "string") throw new JWTError(`Invalid ${family}: token must be a string.`, `ERR_${family}_INVALID`);
+}
+function assertSerializationObject(value, family) {
+	if (!isPlainObject(value)) throw new JWTError(`Invalid ${family} JSON Serialization: expected an object.`, `ERR_${family}_INVALID_SERIALIZATION`);
+}
+function checkSerializationEntry(entry, options) {
+	const { family, label, objects, strings } = options;
+	const code = `ERR_${family}_INVALID`;
+	if (!isPlainObject(entry)) return new JWTError(`Invalid ${family}: ${label} must be a JSON object.`, code);
+	for (const member of objects) if (entry[member] !== void 0 && !isPlainObject(entry[member])) return new JWTError(`Invalid ${family}: ${label} "${member}" must be a JSON object.`, code);
+	for (const member of strings) if (entry[member] !== void 0 && typeof entry[member] !== "string") return new JWTError(`Invalid ${family}: ${label} "${member}" must be a string.`, code);
+}
+function typMatches(expected, actual) {
+	if (typeof actual !== "string") return false;
+	return normalizeTyp(expected) === normalizeTyp(actual);
+}
+function checkProtectedTyp(expected, protectedHeader, options) {
+	if (expected === void 0) return void 0;
+	const actual = protectedHeader.typ;
+	if (typMatches(expected, actual)) return void 0;
+	const { family, label } = options;
+	const where = label ? ` on ${label}` : "";
+	const message = actual === void 0 ? `Invalid ${family}: the protected header${where} carries no "typ", expected "${expected}".` : `Invalid ${family}: "typ" mismatch${where}, expected "${expected}".`;
+	return new JWTError(message, `ERR_${family}_INVALID`);
+}
+function normalizeTyp(typ) {
+	const lowered = typ.toLowerCase();
+	return lowered.includes("/") ? lowered : `application/${lowered}`;
+}
+function decodeProtectedHeader(encoded, family) {
+	let parsed = {};
+	if (encoded) {
+		try {
+			parsed = safeJsonParse(base64UrlParse(encoded));
+		} catch (error) {
+			throw new JWTError(`Invalid ${family}: Protected header could not be decoded.`, `ERR_${family}_INVALID`, error);
+		}
+		if (!isPlainObject(parsed)) throw new JWTError(`Invalid ${family}: Protected header must be a JSON object.`, `ERR_${family}_INVALID`);
+	}
+	return parsed;
+}
+function decodeSegment(encoded, options) {
+	try {
+		return base64UrlParse(encoded, { returnAs: "uint8array" });
+	} catch (error) {
+		throw new JWTError(`Invalid ${options.family}: ${options.what} could not be decoded.`, `ERR_${options.family}_INVALID`, error);
+	}
+}
+const HASHED_SIGNATURE_ALGORITHMS = /* @__PURE__ */ Object.freeze({
+	HS256: "HMAC",
+	HS384: "HMAC",
+	HS512: "HMAC",
+	RS256: "RSASSA-PKCS1-v1_5",
+	RS384: "RSASSA-PKCS1-v1_5",
+	RS512: "RSASSA-PKCS1-v1_5",
+	PS256: "RSA-PSS",
+	PS384: "RSA-PSS",
+	PS512: "RSA-PSS"
+});
+async function sign(alg, key, data) {
+	checkSigCryptoKey(key, alg, "sign");
+	const signature = await crypto.subtle.sign(subtleAlgorithm(alg, key.algorithm), key, data);
+	return new Uint8Array(signature);
+}
+async function verify(alg, key, signature, data) {
+	checkSigCryptoKey(key, alg, "verify");
+	try {
+		return await crypto.subtle.verify(subtleAlgorithm(alg, key.algorithm), key, signature, data);
+	} catch {
+		return false;
+	}
+}
+function checkSigCryptoKey(key, alg, usage) {
+	switch (alg) {
+		case "HS256":
+		case "HS384":
+		case "HS512":
+		case "RS256":
+		case "RS384":
+		case "RS512":
+		case "PS256":
+		case "PS384":
+		case "PS512": {
+			const name = HASHED_SIGNATURE_ALGORITHMS[alg];
+			if (!isAlgorithm(key.algorithm, name)) throw unusableKey(name);
+			const expected = shaBitsOf(jwsHashOf(alg));
+			if (hashBitsOf(key.algorithm.hash) !== expected) throw unusableKey(`SHA-${expected}`, "algorithm.hash");
+			break;
+		}
+		case "Ed25519":
+		case "EdDSA":
+			if (!isAlgorithm(key.algorithm, "Ed25519")) throw unusableKey("Ed25519");
+			break;
+		case "ES256":
+		case "ES384":
+		case "ES512": {
+			if (!isAlgorithm(key.algorithm, "ECDSA")) throw unusableKey("ECDSA");
+			const expected = ECDSA_CURVES[alg];
+			if (key.algorithm.namedCurve !== expected) throw unusableKey(expected, "algorithm.namedCurve");
+			break;
+		}
+	}
+	checkKeyUsage(key, usage);
+}
+function subtleAlgorithm(alg, algorithm) {
+	switch (alg) {
+		case "HS256":
+		case "HS384":
+		case "HS512": return {
+			hash: jwsHashOf(alg),
+			name: "HMAC"
+		};
+		case "PS256":
+		case "PS384":
+		case "PS512": {
+			const hash = jwsHashOf(alg);
+			return {
+				hash,
+				name: "RSA-PSS",
+				saltLength: shaBitsOf(hash) >> 3
+			};
+		}
+		case "RS256":
+		case "RS384":
+		case "RS512": return {
+			hash: jwsHashOf(alg),
+			name: "RSASSA-PKCS1-v1_5"
+		};
+		case "ES256":
+		case "ES384":
+		case "ES512": return {
+			hash: jwsHashOf(alg),
+			name: "ECDSA",
+			namedCurve: namedCurveOf(algorithm)
+		};
+		case "Ed25519":
+		case "EdDSA": return { name: "Ed25519" };
+		default: return unsupportedSignatureAlgorithm(alg);
+	}
+}
+function unsupportedSignatureAlgorithm(alg) {
+	throw new JWTError(`alg ${String(alg)} is not supported either by JOSE or your javascript runtime`, "ERR_JWS_ALG_NOT_ALLOWED");
+}
+const IV_BIT_LENGTHS = /* @__PURE__ */ Object.freeze({
+	"A128GCM": 96,
+	"A128GCMKW": 96,
+	"A192GCM": 96,
+	"A192GCMKW": 96,
+	"A256GCM": 96,
+	"A256GCMKW": 96,
+	"A128CBC-HS256": 128,
+	"A192CBC-HS384": 128,
+	"A256CBC-HS512": 128
+});
+const CEK_BIT_LENGTHS = /* @__PURE__ */ Object.freeze({
+	"A128GCM": 128,
+	"A192GCM": 192,
+	"A256GCM": 256,
+	"A128CBC-HS256": 256,
+	"A192CBC-HS384": 384,
+	"A256CBC-HS512": 512
+});
+function bitLengthIV(alg) {
+	return IV_BIT_LENGTHS[alg];
+}
+function generateIV(alg) {
+	return crypto.getRandomValues(new Uint8Array(bitLengthIV(alg) >> 3));
+}
+function checkIvLength(enc, iv) {
+	if (iv.length << 3 !== bitLengthIV(enc)) throw new JWTError("Invalid Initialization Vector length", "ERR_JWE_INVALID");
+}
+const TAG_BIT_LENGTHS = /* @__PURE__ */ Object.freeze({
+	"A128GCM": 128,
+	"A128GCMKW": 128,
+	"A192GCM": 128,
+	"A192GCMKW": 128,
+	"A256GCM": 128,
+	"A256GCMKW": 128,
+	"A128CBC-HS256": 128,
+	"A192CBC-HS384": 192,
+	"A256CBC-HS512": 256
+});
+function bitLengthTag(alg) {
+	return TAG_BIT_LENGTHS[alg];
+}
+function checkTagLength(enc, tag) {
+	if (tag.length << 3 !== bitLengthTag(enc)) throw new JWTError("Invalid Authentication Tag length", "ERR_JWE_INVALID");
+}
+function bitLengthCEK(enc) {
+	return CEK_BIT_LENGTHS[enc];
+}
+function generateCEK(alg) {
+	return crypto.getRandomValues(new Uint8Array(bitLengthCEK(alg) >> 3));
+}
+function checkCEKLength(cek, expected) {
+	const actual = cek.byteLength << 3;
+	if (actual !== expected) throw new JWTError(`Invalid Content Encryption Key length, expected ${expected} bits (got ${actual})`, "ERR_INVALID_OPTION");
+}
+function assertOctKeyLength(bytes, alg) {
+	if (!alg) return;
+	if (alg === "HS256" || alg === "HS384" || alg === "HS512") {
+		const minBytes = shaBitsOf(jwsHashOf(alg)) >> 3;
+		if (bytes.length < minBytes) throw new JWTError(`${alg} requires a key of at least ${minBytes} bytes (got ${bytes.length})`, "ERR_JWK_INVALID");
+		return;
+	}
+	const exactBits = isKeyWrapAlgorithm(alg) ? aesBitsOf(alg) : isContentEncryption(alg) ? CEK_BIT_LENGTHS[alg] : void 0;
+	if (exactBits !== void 0 && bytes.length << 3 !== exactBits) throw new JWTError(`${alg} requires a key of exactly ${exactBits >> 3} bytes (got ${bytes.length})`, "ERR_JWK_INVALID");
+}
+function checkAESCryptoKey(key, alg, usage) {
+	const name = alg.endsWith("KW") ? "AES-KW" : "AES-GCM";
+	if (!isAlgorithm(key.algorithm, name)) throw unusableKey(name);
+	const expected = aesBitsOf(alg);
+	if (key.algorithm.length !== expected) throw unusableKey(expected, "algorithm.length");
+	checkKeyUsage(key, usage);
+}
+async function aesKwWrap(alg, key, cek) {
+	const cryptoKey = await getAESKWCryptoKey(key, alg, { usage: "wrapKey" });
+	checkAESKWKeySize(cryptoKey, alg);
+	const cryptoKeyCek = await crypto.subtle.importKey("raw", cek, {
+		hash: "SHA-256",
+		name: "HMAC"
+	}, true, ["sign"]);
+	return new Uint8Array(await crypto.subtle.wrapKey("raw", cryptoKeyCek, cryptoKey, "AES-KW"));
+}
+async function aesKwUnwrap(alg, key, encryptedKey) {
+	const cryptoKey = await getAESKWCryptoKey(key, alg, { usage: "unwrapKey" });
+	checkAESKWKeySize(cryptoKey, alg);
+	const cryptoKeyCek = await crypto.subtle.unwrapKey("raw", encryptedKey, cryptoKey, "AES-KW", {
+		hash: "SHA-256",
+		name: "HMAC"
+	}, true, ["sign"]);
+	return new Uint8Array(await crypto.subtle.exportKey("raw", cryptoKeyCek));
+}
+async function gcmkwEncrypt(alg, key, plaintext, iv) {
+	const wrapped = await encrypt(gcmOf(alg), plaintext, key, iv, /* @__PURE__ */ new Uint8Array(0));
+	return {
+		encryptedKey: wrapped.ciphertext,
+		iv: base64UrlStringify(wrapped.iv),
+		tag: base64UrlStringify(wrapped.tag)
+	};
+}
+async function gcmkwDecrypt(alg, key, ciphertext, iv, tag) {
+	return decrypt(gcmOf(alg), key, ciphertext, iv, tag, /* @__PURE__ */ new Uint8Array(0));
+}
+async function encrypt(enc, plaintext, cek, iv, aad) {
+	if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) throw new JWTError("Key must be one of type: CryptoKey or Uint8Array", "ERR_JWK_INVALID");
+	if (iv) checkIvLength(enc, iv);
+	else iv = generateIV(enc);
+	switch (enc) {
+		case "A128CBC-HS256":
+		case "A192CBC-HS384":
+		case "A256CBC-HS512":
+			if (cek instanceof Uint8Array) checkCEKLength(cek, bitLengthCEK(enc));
+			return cbcEncrypt(enc, plaintext, cek, iv, aad);
+		case "A128GCM":
+		case "A192GCM":
+		case "A256GCM":
+			if (cek instanceof Uint8Array) checkCEKLength(cek, bitLengthCEK(enc));
+			return gcmEncrypt(enc, plaintext, cek, iv, aad);
+		default: return unsupportedContentEncryption(enc);
+	}
+}
+async function decrypt(enc, cek, ciphertext, iv, tag, aad) {
+	if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) throw new JWTError("Key must be one of type: CryptoKey or Uint8Array", "ERR_JWK_INVALID");
+	if (!iv) throw new JWTError("JWE Initialization Vector missing", "ERR_JWE_INVALID");
+	if (!tag) throw new JWTError("JWE Authentication Tag missing", "ERR_JWE_INVALID");
+	checkIvLength(enc, iv);
+	checkTagLength(enc, tag);
+	switch (enc) {
+		case "A128CBC-HS256":
+		case "A192CBC-HS384":
+		case "A256CBC-HS512":
+			if (cek instanceof Uint8Array) checkCEKLength(cek, bitLengthCEK(enc));
+			return cbcDecrypt(enc, cek, ciphertext, iv, tag, aad);
+		case "A128GCM":
+		case "A192GCM":
+		case "A256GCM":
+			if (cek instanceof Uint8Array) checkCEKLength(cek, bitLengthCEK(enc));
+			return gcmDecrypt(enc, cek, ciphertext, iv, tag, aad);
+		default: return unsupportedContentEncryption(enc);
+	}
+}
+async function getAESKWCryptoKey(key, alg, options = {}) {
+	const { extractable = true, usage } = options;
+	if (key instanceof Uint8Array) return crypto.subtle.importKey("raw", key, "AES-KW", extractable, [usage ?? "wrapKey"]);
+	checkAESCryptoKey(key, alg, usage);
+	return key;
+}
+function checkAESKWKeySize(key, alg) {
+	if (lengthOf(key.algorithm) !== aesBitsOf(alg)) throw new JWTError(`Invalid key size for alg: ${alg}`, "ERR_JWK_INVALID");
+}
+async function importCBCKeys(enc, cek, usage) {
+	const keySize = aesBitsOf(enc);
+	const [encKey, macKey] = await Promise.all([crypto.subtle.importKey("raw", cek.subarray(keySize >> 3), "AES-CBC", false, [usage]), crypto.subtle.importKey("raw", cek.subarray(0, keySize >> 3), {
+		hash: `SHA-${keySize << 1}`,
+		name: "HMAC"
+	}, false, ["sign"])]);
+	return {
+		encKey,
+		macKey,
+		keySize
+	};
+}
+function cbcMacData(aad, iv, ciphertext) {
+	return concatUint8Arrays(aad, iv, ciphertext, uint64be(aad.length << 3));
+}
+async function cbcEncrypt(enc, plaintext, cek, iv, aad) {
+	if (!(cek instanceof Uint8Array)) throw new JWTError("CBC key must be of type Uint8Array", "ERR_JWK_INVALID");
+	const { encKey, macKey, keySize } = await importCBCKeys(enc, cek, "encrypt");
+	const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
+		iv,
+		name: "AES-CBC"
+	}, encKey, plaintext));
+	const macData = cbcMacData(aad, iv, ciphertext);
+	return {
+		ciphertext,
+		tag: new Uint8Array((await crypto.subtle.sign("HMAC", macKey, macData)).slice(0, keySize >> 3)),
+		iv
+	};
+}
+async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
+	let encKey;
+	if (cek instanceof Uint8Array) encKey = await crypto.subtle.importKey("raw", cek, "AES-GCM", false, ["encrypt"]);
+	else {
+		checkAESCryptoKey(cek, enc, "encrypt");
+		encKey = cek;
+	}
+	const encrypted = new Uint8Array(await crypto.subtle.encrypt({
+		additionalData: aad,
+		iv,
+		name: "AES-GCM",
+		tagLength: 128
+	}, encKey, plaintext));
+	const tag = encrypted.subarray(-16);
+	return {
+		ciphertext: encrypted.subarray(0, -16),
+		tag,
+		iv
+	};
+}
+async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
+	if (!(cek instanceof Uint8Array)) throw new JWTError("CBC key must be of type Uint8Array", "ERR_JWK_INVALID");
+	const { encKey, macKey, keySize } = await importCBCKeys(enc, cek, "decrypt");
+	const macData = cbcMacData(aad, iv, ciphertext);
+	const expectedTag = new Uint8Array((await crypto.subtle.sign("HMAC", macKey, macData)).slice(0, keySize >> 3));
+	let macCheckPassed;
+	try {
+		macCheckPassed = await timingSafeEqual(tag, expectedTag);
+	} catch {}
+	if (!macCheckPassed) throw new JWTError("JWE Decryption Failed", "ERR_JWE_DECRYPTION_FAILED");
+	let plaintext;
+	try {
+		plaintext = new Uint8Array(await crypto.subtle.decrypt({
+			iv,
+			name: "AES-CBC"
+		}, encKey, ciphertext));
+	} catch {}
+	if (!plaintext) throw new JWTError("JWE Decryption Failed", "ERR_JWE_DECRYPTION_FAILED");
+	return plaintext;
+}
+async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
+	let encKey;
+	if (cek instanceof Uint8Array) encKey = await crypto.subtle.importKey("raw", cek, "AES-GCM", false, ["decrypt"]);
+	else {
+		checkAESCryptoKey(cek, enc, "decrypt");
+		encKey = cek;
+	}
+	try {
+		return new Uint8Array(await crypto.subtle.decrypt({
+			additionalData: aad,
+			iv,
+			name: "AES-GCM",
+			tagLength: 128
+		}, encKey, concatUint8Arrays(ciphertext, tag)));
+	} catch {
+		throw new JWTError("JWE Decryption Failed", "ERR_JWE_DECRYPTION_FAILED");
+	}
+}
+let _timingSafeKey;
+function getTimingSafeKey() {
+	if (!_timingSafeKey) _timingSafeKey = crypto.subtle.generateKey({
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	return _timingSafeKey;
+}
+async function timingSafeEqual(a, b) {
+	if (!(a instanceof Uint8Array)) throw new JWTError("First argument must be a buffer", "ERR_INVALID_OPTION");
+	if (!(b instanceof Uint8Array)) throw new JWTError("Second argument must be a buffer", "ERR_INVALID_OPTION");
+	const algorithm = {
+		name: "HMAC",
+		hash: "SHA-256"
+	};
+	const key = await getTimingSafeKey();
+	const aHmac = new Uint8Array(await crypto.subtle.sign(algorithm, key, a));
+	const bHmac = new Uint8Array(await crypto.subtle.sign(algorithm, key, b));
+	let out = 0;
+	let i = -1;
+	while (++i < 32) out |= aHmac[i] ^ bHmac[i];
+	return out === 0;
+}
+function uint64be(value) {
+	return concatUint8Arrays(uint32be(Math.floor(value / 2 ** 32)), uint32be(value % 2 ** 32));
+}
+function gcmOf(alg) {
+	return alg.slice(0, 7);
+}
+function isKeyWrapAlgorithm(alg) {
+	return alg.startsWith("A") && alg.endsWith("KW");
+}
+function isContentEncryption(alg) {
+	return Object.hasOwn(CEK_BIT_LENGTHS, alg);
+}
+function unsupportedContentEncryption(enc) {
+	throw new JWTError(`Unsupported JWE Content Encryption Algorithm: ${quoteTokenValue(String(enc))}`, "ERR_JWE_INVALID");
+}
+async function jwkTokey(jwk, options = {}) {
+	const alg = jwk.alg ?? options.alg;
+	if (!alg) throw new JWTError("\"alg\" argument is required when \"jwk.alg\" is not present", "ERR_JWK_INVALID");
+	const { algorithm, keyUsages } = subtleMapping(jwk, alg);
+	const material = {
+		...jwk,
+		alg
+	};
+	const isPrivate = "d" in jwk && jwk.d !== void 0;
+	const extractable = jwk.ext === false ? false : options.extractable ?? !isPrivate;
+	try {
+		return await crypto.subtle.importKey("jwk", material, algorithm, extractable, permittedUsages(jwk, keyUsages));
+	} catch (error) {
+		if (error instanceof JWTError) throw error;
+		throw new JWTError(`Key is not usable for ${quoteTokenValue(alg)}.`, "ERR_JWK_INVALID", error);
+	}
+}
+async function keyToJWK(key) {
+	let jwk;
+	if (key instanceof Uint8Array) jwk = {
+		kty: "oct",
+		k: base64UrlStringify(key)
+	};
+	else {
+		if (!isCryptoKey(key)) throw new JWTError("Key must be one of type: CryptoKey or Uint8Array", "ERR_JWK_INVALID");
+		if (!key.extractable) throw new JWTError("non-extractable CryptoKey cannot be exported as a JWK", "ERR_JWK_INVALID");
+		const { ext: _ext, key_ops: _keyOps, ...exported } = await crypto.subtle.exportKey("jwk", key);
+		jwk = exported;
+	}
+	return jwk;
+}
+function permittedUsages(jwk, keyUsages) {
+	const keyOps = jwk.key_ops;
+	if (!keyOps || keyUsages.length === 0) return keyUsages;
+	const permitted = keyUsages.filter((usage) => keyOps.includes(usage));
+	if (permitted.length === 0) throw new JWTError(`JWK "key_ops" does not permit ${keyUsages.join(", ")}.`, "ERR_JWK_INVALID");
+	return permitted;
+}
+function subtleMapping(jwk, alg) {
+	let algorithm;
+	let keyUsages;
+	switch (jwk.kty) {
+		case "RSA":
+			switch (alg) {
+				case "PS256":
+				case "PS384":
+				case "PS512":
+					algorithm = {
+						name: "RSA-PSS",
+						hash: jwsHashOf(alg)
+					};
+					keyUsages = hasPrivateMember(jwk) ? ["sign"] : ["verify"];
+					break;
+				case "RS256":
+				case "RS384":
+				case "RS512":
+					algorithm = {
+						name: "RSASSA-PKCS1-v1_5",
+						hash: jwsHashOf(alg)
+					};
+					keyUsages = hasPrivateMember(jwk) ? ["sign"] : ["verify"];
+					break;
+				case "RSA-OAEP":
+				case "RSA-OAEP-256":
+				case "RSA-OAEP-384":
+				case "RSA-OAEP-512":
+					algorithm = {
+						name: "RSA-OAEP",
+						hash: rsaOaepHashOf(alg)
+					};
+					keyUsages = hasPrivateMember(jwk) ? ["decrypt", "unwrapKey"] : ["encrypt", "wrapKey"];
+					break;
+				default: throw new JWTError(`Invalid JWK "alg" ${quoteTokenValue(alg)}.`, "ERR_JWK_INVALID");
+			}
+			break;
+		case "EC":
+			switch (alg) {
+				case "ES256":
+				case "ES384":
+				case "ES512":
+					algorithm = {
+						name: "ECDSA",
+						namedCurve: ECDSA_CURVES[alg]
+					};
+					keyUsages = hasPrivateMember(jwk) ? ["sign"] : ["verify"];
+					break;
+				case "ECDH-ES":
+				case "ECDH-ES+A128KW":
+				case "ECDH-ES+A192KW":
+				case "ECDH-ES+A256KW":
+					algorithm = {
+						name: "ECDH",
+						namedCurve: requireCurve(jwk, [
+							"P-256",
+							"P-384",
+							"P-521"
+						])
+					};
+					keyUsages = hasPrivateMember(jwk) ? ["deriveBits"] : [];
+					break;
+				default: throw new JWTError(`Invalid JWK "alg" ${quoteTokenValue(alg)}.`, "ERR_JWK_INVALID");
+			}
+			break;
+		case "OKP":
+			switch (alg) {
+				case "Ed25519":
+				case "EdDSA":
+					algorithm = { name: requireCurve(jwk, ["Ed25519"]) };
+					keyUsages = hasPrivateMember(jwk) ? ["sign"] : ["verify"];
+					break;
+				case "ECDH-ES":
+				case "ECDH-ES+A128KW":
+				case "ECDH-ES+A192KW":
+				case "ECDH-ES+A256KW":
+					algorithm = { name: requireCurve(jwk, ["X25519"]) };
+					keyUsages = hasPrivateMember(jwk) ? ["deriveBits"] : [];
+					break;
+				default: throw new JWTError(`Invalid JWK "alg" ${quoteTokenValue(alg)}.`, "ERR_JWK_INVALID");
+			}
+			break;
+		default: throw new JWTError(`Invalid JWK "kty" ${quoteTokenValue(jwk.kty)}.`, "ERR_JWK_INVALID");
+	}
+	return {
+		algorithm,
+		keyUsages
+	};
+}
+function requireCurve(jwk, allowed) {
+	const crv = "crv" in jwk ? jwk.crv : void 0;
+	if (typeof crv !== "string" || !allowed.includes(crv)) throw new JWTError(`Invalid JWK "crv" ${quoteTokenValue(crv)}, expected ${allowed.join(", ")}.`, "ERR_JWK_INVALID");
+	return crv;
+}
+function hasPrivateMember(jwk) {
+	return "d" in jwk && Boolean(jwk.d);
+}
+async function encryptRSAES(alg, key, cek) {
+	checkRSACryptoKey(key, alg, "encrypt");
+	checkRSAModulusLength(alg, key);
+	return new Uint8Array(await crypto.subtle.encrypt("RSA-OAEP", key, cek));
+}
+async function decryptRSAES(alg, key, encryptedKey) {
+	checkRSACryptoKey(key, alg, "decrypt");
+	checkRSAModulusLength(alg, key);
+	return new Uint8Array(await crypto.subtle.decrypt("RSA-OAEP", key, encryptedKey));
+}
+function checkRSACryptoKey(key, alg, usage) {
+	if (!isAlgorithm(key.algorithm, "RSA-OAEP")) throw unusableKey("RSA-OAEP");
+	const expected = shaBitsOf(rsaOaepHashOf(alg));
+	if (hashBitsOf(key.algorithm.hash) !== expected) throw unusableKey(`SHA-${expected}`, "algorithm.hash");
+	checkKeyUsage(key, usage);
+}
+function checkRSAModulusLength(alg, key) {
+	const modulusLength = modulusLengthOf(key.algorithm);
+	if (typeof modulusLength !== "number" || modulusLength < 2048) throw new JWTError(`${alg} requires key modulusLength to be 2048 bits or larger`, "ERR_JWK_INVALID");
+}
+async function deriveECDHESKey(publicKey, privateKey, algorithm, keyLength, apu = /* @__PURE__ */ new Uint8Array(0), apv = /* @__PURE__ */ new Uint8Array(0)) {
+	checkECDHCryptoKey(publicKey);
+	checkECDHCryptoKey(privateKey, "deriveBits");
+	const value = concatUint8Arrays(lengthAndInput(textEncoder.encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength));
+	const length = publicKey.algorithm.name === "X25519" ? 256 : Math.ceil(Number.parseInt((namedCurveOf(publicKey.algorithm) ?? "").slice(-3), 10) / 8) << 3;
+	return concatKdf(new Uint8Array(await crypto.subtle.deriveBits({
+		name: publicKey.algorithm.name,
+		public: publicKey
+	}, privateKey, length)), keyLength, value);
+}
+function ecdhDerivedBits(alg, enc) {
+	if (alg !== "ECDH-ES") return aesBitsOf(innerKeyWrapAlg(alg));
+	if (enc) return bitLengthCEK(enc);
+	throw new JWTError("ECDH-ES requires \"enc\" to derive the key.", "ERR_JWE_INVALID");
+}
+function generateEphemeralKeyPair(recipientKey) {
+	return crypto.subtle.generateKey(recipientKey.algorithm, true, ["deriveBits"]);
+}
+function assertECDHKeyAllowed(key) {
+	switch (namedCurveOf(key.algorithm) ?? key.algorithm.name) {
+		case "P-256":
+		case "P-384":
+		case "P-521":
+		case "X25519": return;
+		default: throw new JWTError("ECDH with the provided key is not allowed or not supported", "ERR_JWK_INVALID");
+	}
+}
+function checkECDHCryptoKey(key, usage) {
+	switch (key.algorithm.name) {
+		case "ECDH":
+		case "X25519": break;
+		default: throw unusableKey("ECDH or X25519");
+	}
+	checkKeyUsage(key, usage);
+}
+async function concatKdf(secret, bits, value) {
+	const iterations = Math.ceil((bits >> 3) / 32);
+	const res = new Uint8Array(iterations * 32);
+	for (let iter = 0; iter < iterations; iter++) {
+		const buf = new Uint8Array(4 + secret.length + value.length);
+		buf.set(uint32be(iter + 1));
+		buf.set(secret, 4);
+		buf.set(value, 4 + secret.length);
+		res.set(await digest("sha256", buf), iter * 32);
+	}
+	return res.slice(0, bits >> 3);
+}
+function lengthAndInput(input) {
+	return concatUint8Arrays(uint32be(input.length), input);
+}
+async function digest(algorithm, data) {
+	return new Uint8Array(await crypto.subtle.digest(`SHA-${algorithm.slice(-3)}`, data));
+}
+const DEFAULT_PBES2_MIN_ITERATIONS = 1e3;
+const DEFAULT_PBES2_ITERATIONS = 6e5;
+const DEFAULT_PBES2_MAX_ITERATIONS = DEFAULT_PBES2_ITERATIONS;
+function assertPBES2Params(params) {
+	const { p2s, p2c } = params;
+	if (p2s !== void 0) assertPBES2Salt(p2s, "\"p2s\"");
+	if (p2c === void 0) return;
+	assertPBES2Count(p2c, "\"p2c\"");
+	if (p2c > 6e5) throw new JWTError(`"p2c" must be between ${DEFAULT_PBES2_MIN_ITERATIONS} and ${DEFAULT_PBES2_MAX_ITERATIONS} iterations (got ${p2c}).`, "ERR_INVALID_OPTION");
+}
+function assertPBES2Salt(salt, name) {
+	if (salt instanceof Uint8Array && salt.length >= 8) return;
+	throw new JWTError(`${name} must be 8 or more octets.`, "ERR_INVALID_OPTION");
+}
+function assertPBES2Count(count, name) {
+	if (typeof count !== "number" || !Number.isInteger(count) || count < 1) throw new JWTError(`${name} must be a positive integer.`, "ERR_INVALID_OPTION");
+	if (count < 1e3) throw new JWTError(`${name} must be at least ${DEFAULT_PBES2_MIN_ITERATIONS} iterations (got ${count}).`, "ERR_INVALID_OPTION");
+}
+async function pbes2Wrap(alg, key, cek, p2c, p2s) {
+	const derived = await deriveKey(p2s, alg, p2c, key);
+	return {
+		encryptedKey: await aesKwWrap(innerKeyWrapAlg(alg), derived, cek),
+		p2c,
+		p2s: base64UrlStringify(p2s)
+	};
+}
+function assertPBES2Iterations(p2c, bounds) {
+	const { minIterations = DEFAULT_PBES2_MIN_ITERATIONS, maxIterations = DEFAULT_PBES2_MAX_ITERATIONS } = bounds;
+	if (p2c < minIterations) throw new JWTError(`PBES2 "p2c" below the minimum of ${minIterations} iterations (got ${p2c}).`, "ERR_JWE_INVALID");
+	if (p2c > maxIterations) throw new JWTError(`PBES2 "p2c" above the maximum of ${maxIterations} iterations (got ${p2c}).`, "ERR_JWE_INVALID");
+}
+async function pbes2Unwrap(alg, key, encryptedKey, p2c, p2s, minIterations, maxIterations) {
+	assertPBES2Iterations(p2c, {
+		minIterations,
+		maxIterations
+	});
+	const derived = await deriveKey(p2s, alg, p2c, key);
+	return aesKwUnwrap(innerKeyWrapAlg(alg), derived, encryptedKey);
+}
+async function deriveKey(p2s, alg, p2c, key) {
+	assertPBES2Salt(p2s, "\"p2s\"");
+	if (p2c === void 0 || p2c < 1) throw new JWTError("PBES2 Iteration Count Parameter must be a positive integer", "ERR_INVALID_OPTION");
+	const salt = concatUint8Arrays(textEncoder.encode(alg), new Uint8Array([0]), p2s);
+	const keylen = aesBitsOf(innerKeyWrapAlg(alg));
+	const subtleAlg = {
+		hash: pbes2HashOf(alg),
+		iterations: p2c,
+		name: "PBKDF2",
+		salt
+	};
+	const cryptoKey = await getPBKDF2CryptoKey(key, alg);
+	return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
+}
+function checkPBES2CryptoKey(key, alg, usage) {
+	if (!isAlgorithm(key.algorithm, "PBKDF2")) throw unusableKey("PBKDF2");
+	checkKeyUsage(key, usage);
+}
+async function getPBKDF2CryptoKey(key, alg, options = {}) {
+	const { extractable = false, usage = "deriveBits" } = options;
+	if (key instanceof Uint8Array) return crypto.subtle.importKey("raw", key, "PBKDF2", extractable, [usage]);
+	checkPBES2CryptoKey(key, alg, usage);
+	return key;
+}
+async function encryptKey(alg, enc, key, providedCek, providedParameters = {}) {
+	let encryptedKey;
+	let parameters = {};
+	let cek;
+	switch (alg) {
+		case "dir":
+			cek = key;
+			break;
+		case "ECDH-ES":
+		case "ECDH-ES+A128KW":
+		case "ECDH-ES+A192KW":
+		case "ECDH-ES+A256KW":
+			assertCryptoKey(key);
+			({cek, encryptedKey, parameters} = await ecdhesWrap(alg, {
+				enc,
+				recipientKey: key,
+				cek: providedCek,
+				parameters: providedParameters
+			}));
+			break;
+		case "RSA-OAEP":
+		case "RSA-OAEP-256":
+		case "RSA-OAEP-384":
+		case "RSA-OAEP-512":
+			cek = providedCek || generateCEK(enc);
+			assertCryptoKey(key);
+			encryptedKey = await encryptRSAES(alg, key, cek);
+			break;
+		case "PBES2-HS256+A128KW":
+		case "PBES2-HS384+A192KW":
+		case "PBES2-HS512+A256KW": {
+			cek = providedCek || generateCEK(enc);
+			const { p2c, p2s } = providedParameters;
+			if (p2c === void 0 || p2s === void 0) throw new JWTError(`${alg} requires "p2c" and "p2s"`, "ERR_JWE_INVALID");
+			({encryptedKey, ...parameters} = await pbes2Wrap(alg, key, cek, p2c, p2s));
+			break;
+		}
+		case "A128KW":
+		case "A192KW":
+		case "A256KW":
+			cek = providedCek || generateCEK(enc);
+			encryptedKey = await aesKwWrap(alg, key, cek);
+			break;
+		case "A128GCMKW":
+		case "A192GCMKW":
+		case "A256GCMKW": {
+			cek = providedCek || generateCEK(enc);
+			const { iv } = providedParameters;
+			({encryptedKey, ...parameters} = await gcmkwEncrypt(alg, key, cek, iv));
+			break;
+		}
+		default: throw new JWTError(`Unsupported JWE "alg" ${quoteTokenValue(alg)}`, "ERR_JWE_ALG_NOT_ALLOWED");
+	}
+	return {
+		cek,
+		encryptedKey,
+		parameters
+	};
+}
+async function ecdhesWrap(alg, options) {
+	const { enc, recipientKey } = options;
+	const { apu, apv, epk: providedEpk, epkPrivateKey } = options.parameters;
+	assertECDHKeyAllowed(recipientKey);
+	if (providedEpk && !epkPrivateKey) throw new JWTError("ECDH-ES custom ephemeral key material must include the matching private key.", "ERR_JWK_INVALID");
+	let ephemeralPrivateKey;
+	let epk;
+	if (epkPrivateKey) {
+		ephemeralPrivateKey = await ensurePrivateKey(alg, epkPrivateKey);
+		assertEphemeralCurve(ephemeralPrivateKey, recipientKey);
+		epk = await exportPublicJwkFrom(providedEpk ?? epkPrivateKey);
+	} else {
+		const generated = await generateEphemeralKeyPair(recipientKey);
+		ephemeralPrivateKey = generated.privateKey;
+		epk = await exportPublicJwkFrom(generated.publicKey);
+	}
+	const kdfAlg = alg === "ECDH-ES" ? contentAlgorithm(enc) : alg;
+	const sharedSecret = await deriveECDHESKey(recipientKey, ephemeralPrivateKey, kdfAlg, ecdhDerivedBits(alg, enc), apu, apv);
+	const parameters = { epk };
+	if (apu) parameters.apu = base64UrlStringify(apu);
+	if (apv) parameters.apv = base64UrlStringify(apv);
+	if (alg === "ECDH-ES") return {
+		cek: sharedSecret,
+		parameters
+	};
+	const cek = options.cek ?? generateCEK(contentAlgorithm(enc));
+	return {
+		cek,
+		encryptedKey: await aesKwWrap(innerKeyWrapAlg(alg), sharedSecret, cek),
+		parameters
+	};
+}
+async function normalizeEpk(epk, options) {
+	const { alg } = options;
+	const recipientCurve = cryptoKeyCurve(options.recipientKey);
+	if (isCryptoKey(epk)) {
+		if (epk.type !== "public") throw invalidEpk("must not contain private key material.");
+		assertEpkCurve(cryptoKeyCurve(epk), recipientCurve);
+		return epk;
+	}
+	if (!isJWK(epk) || epk.kty !== "EC" && epk.kty !== "OKP") throw invalidEpk("must be an EC or OKP public key.");
+	if ("d" in epk && epk.d !== void 0) throw invalidEpk("must not contain private key material.");
+	const crv = epk.crv;
+	const allowed = epk.kty === "EC" ? EC_ECDH_CURVES : OKP_ECDH_CURVES;
+	if (typeof crv !== "string" || !allowed.has(crv)) throw invalidEpk(`curve ${quoteTokenValue(crv)} is not supported for ${options.alg}.`);
+	assertEpkCurve(crv, recipientCurve);
+	const x = epk.x;
+	const y = epk.kty === "EC" ? epk.y : void 0;
+	if (typeof x !== "string" || epk.kty === "EC" && typeof y !== "string") throw invalidEpk("is missing its public coordinates.");
+	return jwkTokey(epk.kty === "EC" && typeof y === "string" ? {
+		kty: "EC",
+		crv,
+		x,
+		y,
+		alg
+	} : {
+		kty: "OKP",
+		crv,
+		x,
+		alg
+	});
+}
+const EC_ECDH_CURVES = /* @__PURE__ */ new Set([
+	"P-256",
+	"P-384",
+	"P-521"
+]);
+const OKP_ECDH_CURVES = /* @__PURE__ */ new Set(["X25519"]);
+function contentAlgorithm(enc) {
+	if (enc) return enc;
+	throw new JWTError("ECDH-ES requires \"enc\" to derive the key.", "ERR_JWE_INVALID");
+}
+function assertEphemeralCurve(ephemeralKey, recipientKey) {
+	assertECDHKeyAllowed(ephemeralKey);
+	const ephemeralCurve = cryptoKeyCurve(ephemeralKey);
+	const recipientCurve = cryptoKeyCurve(recipientKey);
+	if (ephemeralCurve === recipientCurve) return;
+	throw new JWTError(`ECDH-ES ephemeral key curve ${quoteTokenValue(ephemeralCurve)} does not match recipient curve ${quoteTokenValue(recipientCurve)}.`, "ERR_JWK_INVALID");
+}
+function invalidEpk(detail) {
+	return new JWTError(`Invalid JWE: "epk" ${detail}`, "ERR_JWE_INVALID");
+}
+function assertEpkCurve(epkCurve, recipientCurve) {
+	if (!recipientCurve || !epkCurve || epkCurve === recipientCurve) return;
+	throw invalidEpk(`curve "${epkCurve}" does not match recipient curve "${recipientCurve}".`);
+}
+function toPublicEpkJwk(jwk) {
+	const { kty } = jwk;
+	const crv = "crv" in jwk ? jwk.crv : void 0;
+	const x = "x" in jwk ? jwk.x : void 0;
+	if (kty !== "EC" && kty !== "OKP") throw new JWTError("ECDH-ES ephemeral key JWK \"kty\" must be \"EC\" or \"OKP\".", "ERR_JWK_INVALID");
+	if (typeof crv !== "string") throw new JWTError("ECDH-ES ephemeral key JWK must include the \"crv\" parameter.", "ERR_JWK_INVALID");
+	if (typeof x !== "string") throw new JWTError("ECDH-ES ephemeral key JWK must include the \"x\" coordinate.", "ERR_JWK_INVALID");
+	if (kty === "OKP") return {
+		kty,
+		crv,
+		x
+	};
+	const y = "y" in jwk ? jwk.y : void 0;
+	if (typeof y !== "string") throw new JWTError("ECDH-ES EC ephemeral key JWK must include both \"x\" and \"y\" coordinates.", "ERR_JWK_INVALID");
+	return {
+		kty,
+		crv,
+		x,
+		y
+	};
+}
+async function ensurePrivateKey(alg, value) {
+	const normalized = isCryptoKey(value) ? value : await jwkTokey(value, { alg });
+	if (normalized.type !== "private") throw new JWTError("ECDH-ES ephemeral private key must have type \"private\".", "ERR_JWK_INVALID");
+	return normalized;
+}
+async function exportPublicJwkFrom(value) {
+	if (!isCryptoKey(value)) return toPublicEpkJwk(value);
+	try {
+		return toPublicEpkJwk(await keyToJWK(value));
+	} catch (error_) {
+		throw new JWTError("ECDH-ES ephemeral CryptoKey must be extractable to export as JWK.", "ERR_JWK_INVALID", error_);
+	}
+}
+const toSPKI = (key) => {
+	return genericExport("public", "spki", key);
+};
+const toPKCS8 = (key) => {
+	return genericExport("private", "pkcs8", key);
+};
+const fromPKCS8 = (pem, alg, options) => {
+	return genericImport("PRIVATE KEY", "pkcs8", pem, alg, options);
+};
+const fromSPKI = (pem, alg, options) => {
+	return genericImport("PUBLIC KEY", "spki", pem, alg, options);
+};
+const fromX509 = (pem, alg, options) => {
+	let spki;
+	try {
+		spki = getSPKI(pem);
+	} catch (error_) {
+		throw new JWTError("Failed to parse the X.509 certificate.", "ERR_JWK_INVALID", error_);
+	}
+	return fromSPKI(spki, alg, options);
+};
+const formatPEM = (b64, descriptor) => {
+	return `-----BEGIN ${descriptor}-----\n${(b64.match(/.{1,64}/g) || []).join("\n")}\n-----END ${descriptor}-----`;
+};
+const pemBody = (pem, descriptor) => {
+	const begin = `-----BEGIN ${descriptor}-----`;
+	const end = `-----END ${descriptor}-----`;
+	const start = pem.indexOf(begin);
+	if (start === -1) {
+		const found = pem.match(/-----BEGIN [^-]+-----/)?.[0];
+		throw new JWTError(found ? `PEM label mismatch: expected "${begin}", got "${found}".` : `PEM label missing: expected "${begin}".`, "ERR_JWK_INVALID");
+	}
+	const bodyStart = start + begin.length;
+	const bodyEnd = pem.indexOf(end, bodyStart);
+	if (bodyEnd === -1) throw new JWTError(`PEM label missing: expected "${end}".`, "ERR_JWK_INVALID");
+	if (pem.includes("-----BEGIN", bodyStart) || pem.slice(bodyEnd + end.length).trim() !== "") throw new JWTError(`PEM must contain exactly one ${descriptor} block, with nothing after it.`, "ERR_JWK_INVALID");
+	return pem.slice(bodyStart, bodyEnd).replaceAll(/\s/g, "");
+};
+const genericExport = async (keyType, keyFormat, key) => {
+	if (!isCryptoKey(key)) throw new JWTError("Key must be of type CryptoKey", "ERR_INVALID_OPTION");
+	if (!key.extractable) throw new JWTError("CryptoKey is not extractable", "ERR_JWK_INVALID");
+	if (key.type !== keyType) throw new JWTError(`key is not a ${keyType} key`, "ERR_JWK_INVALID");
+	return formatPEM(base64Stringify(new Uint8Array(await crypto.subtle.exportKey(keyFormat, key))), `${keyType.toUpperCase()} KEY`);
+};
+const genericImport = async (descriptor, keyFormat, pem, alg, options) => {
+	let algorithm;
+	let keyUsages;
+	const body = pemBody(pem, descriptor);
+	let keyData;
+	try {
+		keyData = base64Parse(body, { returnAs: "uint8array" });
+	} catch (error) {
+		throw new JWTError("Invalid PEM: body could not be decoded.", "ERR_JWK_INVALID", error);
+	}
+	const isPublic = keyFormat === "spki";
+	switch (alg) {
+		case "PS256":
+		case "PS384":
+		case "PS512":
+			algorithm = {
+				name: "RSA-PSS",
+				hash: jwsHashOf(alg)
+			};
+			keyUsages = isPublic ? ["verify"] : ["sign"];
+			break;
+		case "RS256":
+		case "RS384":
+		case "RS512":
+			algorithm = {
+				name: "RSASSA-PKCS1-v1_5",
+				hash: jwsHashOf(alg)
+			};
+			keyUsages = isPublic ? ["verify"] : ["sign"];
+			break;
+		case "RSA-OAEP":
+		case "RSA-OAEP-256":
+		case "RSA-OAEP-384":
+		case "RSA-OAEP-512":
+			algorithm = {
+				name: "RSA-OAEP",
+				hash: rsaOaepHashOf(alg)
+			};
+			keyUsages = isPublic ? ["encrypt", "wrapKey"] : ["decrypt", "unwrapKey"];
+			break;
+		case "ES256":
+		case "ES384":
+		case "ES512":
+			algorithm = {
+				name: "ECDSA",
+				namedCurve: ECDSA_CURVES[alg]
+			};
+			keyUsages = isPublic ? ["verify"] : ["sign"];
+			break;
+		case "ECDH-ES":
+		case "ECDH-ES+A128KW":
+		case "ECDH-ES+A192KW":
+		case "ECDH-ES+A256KW": {
+			const namedCurve = getNamedCurve(keyData);
+			if (namedCurve) algorithm = {
+				name: "ECDH",
+				namedCurve
+			};
+			else algorithm = { name: requireOKPCurve(keyData, "X25519") };
+			keyUsages = isPublic ? [] : ["deriveBits"];
+			break;
+		}
+		case "Ed25519":
+		case "EdDSA":
+			algorithm = { name: requireOKPCurve(keyData, "Ed25519") };
+			keyUsages = isPublic ? ["verify"] : ["sign"];
+			break;
+		default: throw new JWTError("Invalid or unsupported \"alg\" value", "ERR_JWK_UNSUPPORTED");
+	}
+	try {
+		return await crypto.subtle.importKey(keyFormat, keyData, algorithm, options?.extractable ?? isPublic, keyUsages);
+	} catch (error) {
+		throw new JWTError(`Invalid PEM: the body could not be imported as "${alg}".`, "ERR_JWK_INVALID", error);
+	}
+};
+const findOid = (keyData, oid) => {
+	const needle = [
+		6,
+		oid.length,
+		...oid
+	];
+	const last = keyData.length - needle.length;
+	for (let i = keyData.indexOf(needle[0]); i !== -1 && i <= last; i = keyData.indexOf(needle[0], i + 1)) if (needle.every((byte, index) => keyData[i + index] === byte)) return true;
+	return false;
+};
+const OKP_CURVE_OIDS = {
+	X25519: [
+		43,
+		101,
+		110
+	],
+	Ed25519: [
+		43,
+		101,
+		112
+	]
+};
+const requireOKPCurve = (keyData, crv) => {
+	if (findOid(keyData, OKP_CURVE_OIDS[crv])) return crv;
+	throw new JWTError(`Invalid PEM: unsupported curve, expected the ${crv} OID.`, "ERR_JWK_INVALID");
+};
+const getNamedCurve = (keyData) => {
+	switch (true) {
+		case findOid(keyData, [
+			42,
+			134,
+			72,
+			206,
+			61,
+			3,
+			1,
+			7
+		]): return "P-256";
+		case findOid(keyData, [
+			43,
+			129,
+			4,
+			0,
+			34
+		]): return "P-384";
+		case findOid(keyData, [
+			43,
+			129,
+			4,
+			0,
+			35
+		]): return "P-521";
+		default: return;
+	}
+};
+const getElement = (seq) => {
+	const result = [];
+	let next = 0;
+	while (next < seq.length) {
+		const nextPart = parseElement(seq.subarray(next));
+		if (nextPart.byteLength <= 0) throw new JWTError("Invalid DER: zero-length element", "ERR_JWK_INVALID");
+		result.push(nextPart);
+		next += nextPart.byteLength;
+	}
+	return result;
+};
+const parseElement = (bytes) => {
+	let position = 0;
+	const at = (index) => {
+		const byte = bytes[index];
+		if (byte === void 0) throw new JWTError("Invalid DER: element is truncated", "ERR_JWK_INVALID");
+		return byte;
+	};
+	let tag = at(0) & 31;
+	position++;
+	if (tag === 31) {
+		tag = 0;
+		while (at(position) >= 128) {
+			tag = tag * 128 + at(position) - 128;
+			position++;
+		}
+		tag = tag * 128 + at(position) - 128;
+		position++;
+	}
+	let length = 0;
+	if (at(position) < 128) {
+		length = at(position);
+		position++;
+	} else if (at(position) === 128) {
+		length = 0;
+		while (position + length + 1 < bytes.byteLength) {
+			if (at(position + length) === 0 && at(position + length + 1) === 0) break;
+			length++;
+		}
+		if (position + length + 1 >= bytes.byteLength) throw new JWTError("Invalid DER: invalid indefinite form length", "ERR_JWK_INVALID");
+		const byteLength = position + length + 2;
+		return {
+			byteLength,
+			contents: bytes.subarray(position, position + length),
+			raw: bytes.subarray(0, byteLength)
+		};
+	} else {
+		const numberOfDigits = at(position) & 127;
+		position++;
+		length = 0;
+		for (let i = 0; i < numberOfDigits; i++) {
+			length = length * 256 + at(position);
+			position++;
+		}
+	}
+	const byteLength = position + length;
+	if (byteLength > bytes.byteLength) throw new JWTError("Invalid DER: element length exceeds the available bytes", "ERR_JWK_INVALID");
+	return {
+		byteLength,
+		contents: bytes.subarray(position, byteLength),
+		raw: bytes.subarray(0, byteLength)
+	};
+};
+const spkiFromX509 = (buf) => {
+	const tbs = getElement(parseElement(buf).contents)[0];
+	if (!tbs) throw new JWTError("Invalid X.509 certificate: missing tbsCertificate", "ERR_JWK_INVALID");
+	const tbsCertificate = getElement(tbs.contents);
+	const first = tbsCertificate[0];
+	if (!first) throw new JWTError("Invalid X.509 certificate: empty tbsCertificate", "ERR_JWK_INVALID");
+	const spki = tbsCertificate[first.raw[0] === 160 ? 6 : 5];
+	if (!spki) throw new JWTError("Invalid X.509 certificate: missing subjectPublicKeyInfo", "ERR_JWK_INVALID");
+	return base64Stringify(spki.raw);
+};
+let createPublicKey;
+const getSPKI = (x509) => {
+	try {
+		createPublicKey ??= globalThis.process?.getBuiltinModule?.("node:crypto")?.createPublicKey;
+	} catch {
+		createPublicKey = 0;
+	}
+	const body = pemBody(x509, "CERTIFICATE");
+	if (createPublicKey) try {
+		return new createPublicKey(x509).export({
+			format: "pem",
+			type: "spki"
+		});
+	} catch {}
+	let raw;
+	try {
+		raw = base64Parse(body, { returnAs: "uint8array" });
+	} catch (error) {
+		throw new JWTError("Invalid X.509 certificate: body could not be decoded.", "ERR_JWK_INVALID", error);
+	}
+	return formatPEM(spkiFromX509(raw), "PUBLIC KEY");
+};
+const THUMBPRINT_MEMBERS = /* @__PURE__ */ Object.freeze({
+	EC: [
+		"crv",
+		"kty",
+		"x",
+		"y"
+	],
+	RSA: [
+		"e",
+		"kty",
+		"n"
+	],
+	OKP: [
+		"crv",
+		"kty",
+		"x"
+	],
+	oct: ["k", "kty"]
+});
+const THUMBPRINT_HASHES = /* @__PURE__ */ new Set([
+	"SHA-256",
+	"SHA-384",
+	"SHA-512"
+]);
+async function thumbprint(jwk, options = {}) {
+	assertPlainObject(jwk, "jwk");
+	assertPlainObject(options, "options");
+	const hash = options.hash ?? "SHA-256";
+	if (!THUMBPRINT_HASHES.has(hash)) throw new JWTError("\"hash\" must be \"SHA-256\", \"SHA-384\" or \"SHA-512\".", "ERR_INVALID_OPTION");
+	const kty = jwk.kty;
+	const members = typeof kty === "string" && Object.hasOwn(THUMBPRINT_MEMBERS, kty) ? THUMBPRINT_MEMBERS[kty] : void 0;
+	if (!members) throw new JWTError(`JWK thumbprint is not defined for kty "${String(kty)}".`, "ERR_JWK_INVALID");
+	const canonical = members.map((name) => {
+		const value = Reflect.get(jwk, name);
+		if (typeof value !== "string" || value.length === 0) throw new JWTError(`JWK thumbprint requires the member "${name}" on an ${jwk.kty} key.`, "ERR_JWK_INVALID");
+		return `${JSON.stringify(name)}:${JSON.stringify(value)}`;
+	});
+	return digestUrl(`{${canonical.join(",")}}`, hash);
+}
+const MAX_PARTY_INFO_BYTES = 1024;
+const DEFAULT_JOSE_LIMITS = /* @__PURE__ */ Object.freeze({
+	signatures: 16,
+	recipients: 16,
+	keyCandidates: 8,
+	pbes2Iterations: 4 * DEFAULT_PBES2_ITERATIONS
+});
+function resolveLimit(limits, name) {
+	const value = limits?.[name];
+	if (value === void 0) return DEFAULT_JOSE_LIMITS[name];
+	if (typeof value !== "number" || !Number.isInteger(value) || value < 1) throw new JWTError(`"limits.${name}" must be a positive integer.`, "ERR_INVALID_OPTION");
+	return value;
+}
+function assertEntryLimit(count, limit, options) {
+	if (count <= limit) return;
+	throw new JWTError(`Invalid ${options.family}: ${count} ${options.what} exceed the limit of ${limit}.`, `ERR_${options.family}_INVALID`);
+}
+function assertCandidateLimit(count, limit) {
+	if (count <= limit) return;
+	throw new JWTError(`${count} candidate keys exceed the limit of ${limit}, narrow them with a "kid".`, "ERR_JWK_KEY_NOT_FOUND");
+}
+function assertJWKSetCandidates(candidates, options) {
+	if (candidates.length === 0) {
+		const { kid } = options;
+		throw new JWTError(`No key found in JWK Set${kid ? ` with kid ${quoteTokenValue(kid)}` : ""}.`, "ERR_JWK_KEY_NOT_FOUND");
+	}
+	assertCandidateLimit(candidates.length, options.limit);
+}
+function asKeyLookupError(error, what) {
+	return asJWTError(error, {
+		code: "ERR_JWK_KEY_NOT_FOUND",
+		message: `Key lookup failed for ${what}.`
+	});
+}
+function asJWTError(error, options) {
+	if (error instanceof JWTError) return error;
+	return new JWTError(options.message, options.code, error);
+}
+function copyJsonObject(value, options) {
+	try {
+		return sanitizeObjectCopy(value);
+	} catch (error) {
+		throw asJWTError(error, options);
+	}
+}
+function asDecryptionError(error) {
+	return asJWTError(error, {
+		code: "ERR_JWE_DECRYPTION_FAILED",
+		message: "JWE decryption failed."
+	});
+}
+function assertProducerPartyInfo(name, value) {
+	if (!(value instanceof Uint8Array)) throw new JWTError(`"${name === "apu" ? "partyUInfo" : "partyVInfo"}" (${name}) must be a Uint8Array.`, "ERR_INVALID_OPTION");
+	if (value.length > 1024) throw new JWTError(`"${name === "apu" ? "partyUInfo" : "partyVInfo"}" (${name}) must not exceed ${MAX_PARTY_INFO_BYTES} bytes (got ${value.length}).`, "ERR_INVALID_OPTION");
+}
+const JWK_SET_KEY_OPS = /* @__PURE__ */ Object.freeze({
+	sig: ["verify"],
+	enc: [
+		"unwrapKey",
+		"decrypt",
+		"deriveBits",
+		"deriveKey"
+	]
+});
+function buildJWKSetFilter(header, options) {
+	const kid = header?.kid;
+	const alg = header?.alg;
+	const { op, allowSymmetric } = options;
+	const use = op;
+	const keyOps = JWK_SET_KEY_OPS[op];
+	return (k) => {
+		if (!isJWK(k)) return false;
+		if (!allowSymmetric && hasSymmetricSecret(k)) return false;
+		if (kid && k.kid !== kid) return false;
+		if (k.alg && !(alg && jwkAlgServes({
+			kty: k.kty,
+			alg: k.alg
+		}, alg))) return false;
+		if (k.use !== void 0 && k.use !== use) return false;
+		const ops = k.key_ops;
+		if (ops !== void 0 && !(Array.isArray(ops) && ops.some((o) => keyOps.includes(o)))) return false;
+		return true;
+	};
+}
+function parseEphemeralKey(ephemeralKey) {
+	if (isCryptoKeyPair(ephemeralKey)) return {
+		epk: ephemeralKey.publicKey,
+		epkPrivateKey: ephemeralKey.privateKey
+	};
+	if (typeof ephemeralKey === "object" && ephemeralKey !== null && "publicKey" in ephemeralKey && "privateKey" in ephemeralKey) {
+		if (!ephemeralKey.publicKey || !ephemeralKey.privateKey) throw new JWTError("ECDH-ES custom ephemeral key must include both publicKey and privateKey.", "ERR_JWK_INVALID");
+		return {
+			epk: ephemeralKey.publicKey,
+			epkPrivateKey: ephemeralKey.privateKey
+		};
+	}
+	if (isCryptoKey(ephemeralKey)) {
+		if (ephemeralKey.type !== "private") throw new JWTError("ECDH-ES custom ephemeral CryptoKey must include private key material.", "ERR_JWK_INVALID");
+		return {
+			epk: ephemeralKey,
+			epkPrivateKey: ephemeralKey
+		};
+	}
+	if (isJWK(ephemeralKey)) {
+		if (!("d" in ephemeralKey) || typeof ephemeralKey.d !== "string") throw new JWTError("ECDH-ES custom ephemeral JWK must include private parameter \"d\".", "ERR_JWK_INVALID");
+		return {
+			epk: ephemeralKey,
+			epkPrivateKey: ephemeralKey
+		};
+	}
+	throw new JWTError("Unsupported ECDH-ES ephemeral key material provided.", "ERR_JWK_INVALID");
+}
+function buildECDHAgreementParams(ecdh) {
+	const params = {};
+	if (!ecdh) return params;
+	const { partyUInfo, partyVInfo, ephemeralKey } = ecdh;
+	if (partyUInfo !== void 0) {
+		assertProducerPartyInfo("apu", partyUInfo);
+		if (partyUInfo.length > 0) params.apu = partyUInfo;
+	}
+	if (partyVInfo !== void 0) {
+		assertProducerPartyInfo("apv", partyVInfo);
+		if (partyVInfo.length > 0) params.apv = partyVInfo;
+	}
+	if (ephemeralKey) {
+		const { epk, epkPrivateKey } = parseEphemeralKey(ephemeralKey);
+		params.epk = epk;
+		params.epkPrivateKey = epkPrivateKey;
+	}
+	return params;
+}
+function stringKeyError() {
+	return new JWTError("Key must be a JWK, CryptoKey or Uint8Array, not a string.", "ERR_JWK_INVALID");
+}
+function resolvePasswordKey(alg, key) {
+	if (typeof key !== "string") return key;
+	if (!isPBES2Algorithm(alg)) throw stringKeyError();
+	return textEncoder.encode(key);
+}
+async function resolveKeyInput(key, options) {
+	if (typeof key !== "function") return key;
+	const { header, token, what } = options;
+	let resolved;
+	try {
+		resolved = await key(header, token);
+	} catch (error) {
+		throw asKeyLookupError(error, what);
+	}
+	if (resolved === void 0 || resolved === null) throw new JWTError(`Key lookup returned no key for ${what}.`, "ERR_JWK_KEY_NOT_FOUND");
+	return resolved;
+}
+function assertDirectKeyRole(key, enc) {
+	if (!isJWK(key) || typeof key.alg !== "string" || key.alg === "dir") return;
+	if (enc !== void 0 && key.alg === enc) return;
+	throw new JWTError(`JWK "alg" is "${key.alg}" but "dir" requires "dir" or the token's "enc".`, "ERR_JWK_INVALID");
+}
+var WeakMapJWKCache = class {
+	_map = /* @__PURE__ */ new WeakMap();
+	get(jwk, alg) {
+		return this._map.get(jwk)?.[alg];
+	}
+	set(jwk, alg, key) {
+		let entry = this._map.get(jwk);
+		if (!entry) this._map.set(jwk, { [alg]: key });
+		else entry[alg] = key;
+	}
+};
+let _activeCache = new WeakMapJWKCache();
+function configureJWKCache(cache) {
+	_activeCache = cache;
+}
+function clearJWKCache() {
+	_activeCache = new WeakMapJWKCache();
+}
+async function importKey(key, algOrOptions) {
+	const alg = typeof algOrOptions === "string" ? algOrOptions : algOrOptions?.alg ?? void 0;
+	const expect = typeof algOrOptions === "object" ? algOrOptions.expect ?? void 0 : void 0;
+	const extractable = typeof algOrOptions === "object" && !algOrOptions.asCryptoKey ? algOrOptions.extractable : void 0;
+	if (typeof key === "string") throw stringKeyError();
+	if (key instanceof Uint8Array) return key;
+	if (isCryptoKey(key)) {
+		assertIntentOnCryptoKey(key, expect);
+		return key;
+	}
+	if (isJWK(key)) {
+		if (key.kty !== "oct" && Object.hasOwn(key, "k")) throw new JWTError(`JWK "k" is defined only for "oct" keys, not "${key.kty}".`, "ERR_JWK_INVALID");
+		assertJWKAlgAuthority(key, alg);
+		if (key.kty === "oct" && typeof key.k === "string") {
+			const rawBytes = decodeSegment(key.k, {
+				family: "JWK",
+				what: "\"k\""
+			});
+			assertOctKeyLength(rawBytes, alg ?? key.alg);
+			if (typeof algOrOptions === "object" && algOrOptions.asCryptoKey) {
+				const { algorithm, usage, extractable: rawExtractable = false } = algOrOptions;
+				if (!algorithm || !usage) throw new JWTError("asCryptoKey option requires `algorithm` and `usage` to be provided.", "ERR_JWK_INVALID");
+				if (typeof algorithm === "object" && algorithm.name === "HMAC") {
+					const hash = "hash" in algorithm ? algorithm.hash : void 0;
+					const hashName = typeof hash === "string" ? hash : typeof hash === "object" && hash !== null && "name" in hash && typeof hash.name === "string" ? hash.name : void 0;
+					const minBytes = Number.parseInt(hashName?.slice(-3) ?? "", 10) / 8;
+					if (minBytes && rawBytes.length < minBytes) throw new JWTError(`HMAC with ${hashName} requires a key of at least ${minBytes} bytes (got ${rawBytes.length})`, "ERR_JWK_INVALID");
+				}
+				return crypto.subtle.importKey("raw", rawBytes, algorithm, rawExtractable, usage);
+			}
+			return rawBytes;
+		} else {
+			const effectiveAlg = key.alg || alg;
+			if (!effectiveAlg) throw new JWTError("Algorithm must be provided when importing non-oct JWK", "ERR_JWK_INVALID");
+			assertIntentOnJWK(key, expect);
+			const cache = extractable === void 0 ? _activeCache : false;
+			if (cache) {
+				const cached = await cache.get(key, effectiveAlg);
+				if (cached) return cached;
+			}
+			const cryptoKey = await jwkTokey(key, {
+				extractable,
+				alg
+			});
+			if (cache) await cache.set(key, effectiveAlg, cryptoKey);
+			return cryptoKey;
+		}
+	}
+	throw new JWTError("Invalid key type provided to importKey", "ERR_JWK_INVALID");
+}
+function assertJWKAlgAuthority(jwk, alg) {
+	if (!alg || !jwk.alg || jwkAlgServes({
+		kty: jwk.kty,
+		alg: jwk.alg
+	}, alg)) return;
+	throw new JWTError(`JWK "alg" is "${jwk.alg}" but the operation requires "${alg}".`, "ERR_JWK_INVALID");
+}
+function assertIntentOnJWK(jwk, expect) {
+	if (expect === void 0 || jwk.kty === "oct") return;
+	const hasPrivateScalar = "d" in jwk && typeof jwk.d === "string";
+	if (expect === "public" && hasPrivateScalar) throw new JWTError("Private JWK passed where a public key is expected.", "ERR_JWK_INVALID");
+	if (expect === "private" && !hasPrivateScalar) throw new JWTError("Public JWK passed where a private key is expected.", "ERR_JWK_INVALID");
+}
+function assertIntentOnCryptoKey(key, expect) {
+	if (expect === void 0 || key.type === "secret") return;
+	if (expect === "public" && key.type === "private") throw new JWTError("Private CryptoKey passed where a public key is expected.", "ERR_JWK_INVALID");
+	if (expect === "private" && key.type === "public") throw new JWTError("Public CryptoKey passed where a private key is expected.", "ERR_JWK_INVALID");
+}
+function getJWKsFromSet(jwkSet, filter) {
+	if (!jwkSet || !isJWKSet(jwkSet)) throw new JWTError("Invalid JWK Set provided", "ERR_JWK_INVALID");
+	const keys = jwkSet.keys.filter((key) => isJWK(key));
+	return filter ? keys.filter(filter) : keys;
+}
+const JWS_ALG_CTX = /* @__PURE__ */ Object.freeze({
+	infer: inferJWSAllowedAlgorithms,
+	octRoles: false,
+	errorCode: "ERR_JWS_ALG_NOT_ALLOWED",
+	label: "Algorithm",
+	op: "sig"
+});
+function checkAlgAllowed(alg, key, options) {
+	const { ctx, algorithms, allowSymmetric } = options;
+	if (algorithms !== void 0) return algorithms.includes(alg) ? void 0 : notAllowed(alg, ctx);
+	if (isJWK(key) && typeof key.alg === "string" && (!ctx.octRoles || key.kty !== "oct")) return isSameAlgorithm(key.alg, alg) ? void 0 : notAllowed(alg, ctx);
+	const inferred = ctx.infer(key, { allowSymmetric });
+	if (!inferred) return new JWTError("Cannot infer allowed algorithms from this key, pass \"algorithms\".", ctx.errorCode);
+	return inferred.includes(alg) ? void 0 : notAllowed(alg, ctx);
+}
+function notAllowed(alg, ctx) {
+	return new JWTError(`${ctx.label} not allowed: ${alg}`, ctx.errorCode);
+}
+function keyMatchesHeader(header, keyMaterial, options) {
+	const { ctx, allowSymmetric } = options;
+	if (isJWKSet(keyMaterial)) {
+		const candidates = keyMaterial.keys.filter(buildJWKSetFilter(header, {
+			op: ctx.op,
+			allowSymmetric
+		}));
+		return candidates.length === 0 || candidates.some((k) => keyServesHeaderAlg(header, k, ctx));
+	}
+	if (isJWK(keyMaterial)) return keyServesHeaderAlg(header, keyMaterial, ctx);
+	if (isCryptoKey(keyMaterial)) return keyServesHeaderAlg(header, keyMaterial, ctx);
+	return true;
+}
+function checkJWEEncSupported(enc) {
+	if (typeof enc === "string" && isContentEncryptionAlgorithm(enc)) return void 0;
+	return new JWTError(`Invalid JWE: unsupported "enc" ${quoteTokenValue(enc)}`, "ERR_JWE_INVALID");
+}
+function assertJWEEncSupported(enc) {
+	const error = checkJWEEncSupported(enc);
+	if (error) throw error;
+}
+function checkAlgSupported(alg, options) {
+	const { supported, code, label, role } = options;
+	if (alg === "none") return new JWTError(`"none" is not a valid ${role}`, code);
+	if (!supported(alg)) return new JWTError(`${label} not supported: ${quoteTokenValue(alg)}`, code);
+}
+function keyServesHeaderAlg(header, key, ctx) {
+	const { alg } = header;
+	if (!alg) return false;
+	const inferred = ctx.infer(key);
+	if (inferred && !inferred.includes(alg)) return false;
+	if (!isECDHESAlgorithm(alg)) return true;
+	const epkCurve = header.epk?.crv;
+	const keyCurve = isCryptoKey(key) ? cryptoKeyCurve(key) : "crv" in key ? key.crv : void 0;
+	return !epkCurve || !keyCurve || epkCurve === keyCurve;
+}
+export { DEFAULT_JOSE_LIMITS, DEFAULT_PBES2_ITERATIONS, JWS_ALG_CTX, MAX_PARTY_INFO_BYTES, WeakMapJWKCache, aesKwUnwrap, aesKwWrap, asDecryptionError, asJWTError, asKeyLookupError, assertCompactToken, assertConsumerOptions, assertDirectKeyRole, assertECDHKeyAllowed, assertEntryLimit, assertJWEEncSupported, assertJWKSetCandidates, assertOctKeyLength, assertOptionEntry, assertPBES2Count, assertPBES2Iterations, assertPBES2Params, assertPBES2Salt, assertProducerConfirmation, assertProducerCrit, assertProducerKeyHeaders, assertProtectedOnlyOption, assertSerializationObject, bitLengthCEK, bitLengthIV, bitLengthTag, buildECDHAgreementParams, buildJWKSetFilter, checkAlgAllowed, checkAlgSupported, checkJWEEncSupported, checkProtectedTyp, checkSerializationEntry, clearJWKCache, configureJWKCache, copyJsonObject, decodeProtectedHeader, decodeSegment, decrypt, decryptRSAES, deriveECDHESKey, deriveKey, ecdhDerivedBits, ecdhesWrap, encrypt, encryptKey, encryptRSAES, fromPKCS8, fromSPKI, fromX509, gcmkwDecrypt, gcmkwEncrypt, generateCEK, generateIV, getJWKsFromSet, importKey, jwkTokey, keyMatchesHeader, keyToJWK, normalizeEpk, pbes2Unwrap, pbes2Wrap, resolveKeyInput, resolveLimit, resolvePasswordKey, serializeProtectedHeader, sign, stringKeyError, thumbprint, toPKCS8, toSPKI, verify };