unjwt 0.8.3 → 0.8.5

package/dist/_chunks/jwk.mjs

@@ -1,2115 +1,10 @@
-import { safeJsonParse, sanitizeObjectCopy, secureRandomBytes, textEncoder } from "./libs/unsecure.mjs";
-import { JWTError, assertClaimValidationOptions, assertCritShape, assertCryptoKey, assertPlainObject, assertStringList, base64Parse, base64Stringify, base64UrlParse, base64UrlStringify, concatUint8Arrays, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isPlainObject, isPublicJWK, parsePayloadBytes, parsePayloadSegment, uint32be, validateJwtClaims } from "./_jwt-internal.mjs";
-import { ECDSA_CURVES, PBES2_ALGORITHMS, aesBitsOf, checkKeyUsage, cryptoKeyCurve, digestUrl, hashBitsOf, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, innerKeyWrapAlg, isAlgorithm, isContentEncryptionAlgorithm, isECDHESAlgorithm, isEd25519Signature, isJWSAlgorithm, isKeyManagementAlgorithm, isPBES2Algorithm, jwsHashOf, lengthOf, modulusLengthOf, namedCurveOf, pbes2HashOf, rsaOaepHashOf, shaBitsOf, unusableKey } from "./digest.mjs";
-const MAX_QUOTED_VALUE = 64;
-function quoteTokenValue(value) {
-	const text = String(value);
-	return JSON.stringify(text.length > MAX_QUOTED_VALUE ? `${text.slice(0, MAX_QUOTED_VALUE)}…` : text);
-}
-const HASHED_SIGNATURE_ALGORITHMS = /* @__PURE__ */ Object.freeze({
-	HS256: "HMAC",
-	HS384: "HMAC",
-	HS512: "HMAC",
-	RS256: "RSASSA-PKCS1-v1_5",
-	RS384: "RSASSA-PKCS1-v1_5",
-	RS512: "RSASSA-PKCS1-v1_5",
-	PS256: "RSA-PSS",
-	PS384: "RSA-PSS",
-	PS512: "RSA-PSS"
-});
-async function sign(alg, key, data) {
-	checkSigCryptoKey(key, alg, "sign");
-	const signature = await crypto.subtle.sign(subtleAlgorithm(alg, key.algorithm), key, data);
-	return new Uint8Array(signature);
-}
-async function verify(alg, key, signature, data) {
-	checkSigCryptoKey(key, alg, "verify");
-	try {
-		return await crypto.subtle.verify(subtleAlgorithm(alg, key.algorithm), key, signature, data);
-	} catch {
-		return false;
-	}
-}
-function checkSigCryptoKey(key, alg, usage) {
-	switch (alg) {
-		case "HS256":
-		case "HS384":
-		case "HS512":
-		case "RS256":
-		case "RS384":
-		case "RS512":
-		case "PS256":
-		case "PS384":
-		case "PS512": {
-			const name = HASHED_SIGNATURE_ALGORITHMS[alg];
-			if (!isAlgorithm(key.algorithm, name)) throw unusableKey(name);
-			const expected = shaBitsOf(jwsHashOf(alg));
-			if (hashBitsOf(key.algorithm.hash) !== expected) throw unusableKey(`SHA-${expected}`, "algorithm.hash");
-			break;
-		}
-		case "Ed25519":
-		case "EdDSA":
-			if (!isAlgorithm(key.algorithm, "Ed25519")) throw unusableKey("Ed25519");
-			break;
-		case "ES256":
-		case "ES384":
-		case "ES512": {
-			if (!isAlgorithm(key.algorithm, "ECDSA")) throw unusableKey("ECDSA");
-			const expected = ECDSA_CURVES[alg];
-			if (key.algorithm.namedCurve !== expected) throw unusableKey(expected, "algorithm.namedCurve");
-			break;
-		}
-	}
-	checkKeyUsage(key, usage);
-}
-function subtleAlgorithm(alg, algorithm) {
-	switch (alg) {
-		case "HS256":
-		case "HS384":
-		case "HS512": return {
-			hash: jwsHashOf(alg),
-			name: "HMAC"
-		};
-		case "PS256":
-		case "PS384":
-		case "PS512": {
-			const hash = jwsHashOf(alg);
-			return {
-				hash,
-				name: "RSA-PSS",
-				saltLength: shaBitsOf(hash) >> 3
-			};
-		}
-		case "RS256":
-		case "RS384":
-		case "RS512": return {
-			hash: jwsHashOf(alg),
-			name: "RSASSA-PKCS1-v1_5"
-		};
-		case "ES256":
-		case "ES384":
-		case "ES512": return {
-			hash: jwsHashOf(alg),
-			name: "ECDSA",
-			namedCurve: namedCurveOf(algorithm)
-		};
-		case "Ed25519":
-		case "EdDSA": return { name: "Ed25519" };
-		default: return unsupportedSignatureAlgorithm(alg);
-	}
-}
-function unsupportedSignatureAlgorithm(alg) {
-	throw new JWTError(`alg ${String(alg)} is not supported either by JOSE or your javascript runtime`, "ERR_JWS_ALG_NOT_ALLOWED");
-}
-const IV_BIT_LENGTHS = /* @__PURE__ */ Object.freeze({
-	"A128GCM": 96,
-	"A128GCMKW": 96,
-	"A192GCM": 96,
-	"A192GCMKW": 96,
-	"A256GCM": 96,
-	"A256GCMKW": 96,
-	"A128CBC-HS256": 128,
-	"A192CBC-HS384": 128,
-	"A256CBC-HS512": 128
-});
-const CEK_BIT_LENGTHS = /* @__PURE__ */ Object.freeze({
-	"A128GCM": 128,
-	"A192GCM": 192,
-	"A256GCM": 256,
-	"A128CBC-HS256": 256,
-	"A192CBC-HS384": 384,
-	"A256CBC-HS512": 512
-});
-function bitLengthIV(alg) {
-	return IV_BIT_LENGTHS[alg];
-}
-function generateIV(alg) {
-	return crypto.getRandomValues(new Uint8Array(bitLengthIV(alg) >> 3));
-}
-function checkIvLength(enc, iv) {
-	if (iv.length << 3 !== bitLengthIV(enc)) throw new JWTError("Invalid Initialization Vector length", "ERR_JWE_INVALID");
-}
-const TAG_BIT_LENGTHS = /* @__PURE__ */ Object.freeze({
-	"A128GCM": 128,
-	"A128GCMKW": 128,
-	"A192GCM": 128,
-	"A192GCMKW": 128,
-	"A256GCM": 128,
-	"A256GCMKW": 128,
-	"A128CBC-HS256": 128,
-	"A192CBC-HS384": 192,
-	"A256CBC-HS512": 256
-});
-function bitLengthTag(alg) {
-	return TAG_BIT_LENGTHS[alg];
-}
-function checkTagLength(enc, tag) {
-	if (tag.length << 3 !== bitLengthTag(enc)) throw new JWTError("Invalid Authentication Tag length", "ERR_JWE_INVALID");
-}
-function bitLengthCEK(enc) {
-	return CEK_BIT_LENGTHS[enc];
-}
-function generateCEK(alg) {
-	return crypto.getRandomValues(new Uint8Array(bitLengthCEK(alg) >> 3));
-}
-function checkCEKLength(cek, expected) {
-	const actual = cek.byteLength << 3;
-	if (actual !== expected) throw new JWTError(`Invalid Content Encryption Key length. Expected ${expected} bits, got ${actual} bits`, "ERR_INVALID_OPTION");
-}
-function assertOctKeyLength(bytes, alg) {
-	if (!alg) return;
-	if (alg === "HS256" || alg === "HS384" || alg === "HS512") {
-		const minBytes = shaBitsOf(jwsHashOf(alg)) >> 3;
-		if (bytes.length < minBytes) throw new JWTError(`${alg} requires a key of at least ${minBytes} bytes (got ${bytes.length})`, "ERR_JWK_INVALID");
-		return;
-	}
-	const exactBits = isKeyWrapAlgorithm(alg) ? aesBitsOf(alg) : isContentEncryption(alg) ? CEK_BIT_LENGTHS[alg] : void 0;
-	if (exactBits !== void 0 && bytes.length << 3 !== exactBits) throw new JWTError(`${alg} requires a key of exactly ${exactBits >> 3} bytes (got ${bytes.length})`, "ERR_JWK_INVALID");
-}
-function checkAESCryptoKey(key, alg, usage) {
-	const name = alg.endsWith("KW") ? "AES-KW" : "AES-GCM";
-	if (!isAlgorithm(key.algorithm, name)) throw unusableKey(name);
-	const expected = aesBitsOf(alg);
-	if (key.algorithm.length !== expected) throw unusableKey(expected, "algorithm.length");
-	checkKeyUsage(key, usage);
-}
-async function aesKwWrap(alg, key, cek) {
-	const cryptoKey = await getAESKWCryptoKey(key, alg, { usage: "wrapKey" });
-	checkAESKWKeySize(cryptoKey, alg);
-	const cryptoKeyCek = await crypto.subtle.importKey("raw", cek, {
-		hash: "SHA-256",
-		name: "HMAC"
-	}, true, ["sign"]);
-	return new Uint8Array(await crypto.subtle.wrapKey("raw", cryptoKeyCek, cryptoKey, "AES-KW"));
-}
-async function aesKwUnwrap(alg, key, encryptedKey) {
-	const cryptoKey = await getAESKWCryptoKey(key, alg, { usage: "unwrapKey" });
-	checkAESKWKeySize(cryptoKey, alg);
-	const cryptoKeyCek = await crypto.subtle.unwrapKey("raw", encryptedKey, cryptoKey, "AES-KW", {
-		hash: "SHA-256",
-		name: "HMAC"
-	}, true, ["sign"]);
-	return new Uint8Array(await crypto.subtle.exportKey("raw", cryptoKeyCek));
-}
-async function gcmkwEncrypt(alg, key, plaintext, iv) {
-	const wrapped = await encrypt(gcmOf(alg), plaintext, key, iv, /* @__PURE__ */ new Uint8Array(0));
-	return {
-		encryptedKey: wrapped.ciphertext,
-		iv: base64UrlStringify(wrapped.iv),
-		tag: base64UrlStringify(wrapped.tag)
-	};
-}
-async function gcmkwDecrypt(alg, key, ciphertext, iv, tag) {
-	return decrypt(gcmOf(alg), key, ciphertext, iv, tag, /* @__PURE__ */ new Uint8Array(0));
-}
-async function encrypt(enc, plaintext, cek, iv, aad) {
-	if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) throw new JWTError("Key must be one of type: CryptoKey or Uint8Array", "ERR_JWK_INVALID");
-	if (iv) checkIvLength(enc, iv);
-	else iv = generateIV(enc);
-	switch (enc) {
-		case "A128CBC-HS256":
-		case "A192CBC-HS384":
-		case "A256CBC-HS512":
-			if (cek instanceof Uint8Array) checkCEKLength(cek, bitLengthCEK(enc));
-			return cbcEncrypt(enc, plaintext, cek, iv, aad);
-		case "A128GCM":
-		case "A192GCM":
-		case "A256GCM":
-			if (cek instanceof Uint8Array) checkCEKLength(cek, bitLengthCEK(enc));
-			return gcmEncrypt(enc, plaintext, cek, iv, aad);
-		default: return unsupportedContentEncryption(enc);
-	}
-}
-async function decrypt(enc, cek, ciphertext, iv, tag, aad) {
-	if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) throw new JWTError("Key must be one of type: CryptoKey or Uint8Array", "ERR_JWK_INVALID");
-	if (!iv) throw new JWTError("JWE Initialization Vector missing", "ERR_JWE_INVALID");
-	if (!tag) throw new JWTError("JWE Authentication Tag missing", "ERR_JWE_INVALID");
-	checkIvLength(enc, iv);
-	checkTagLength(enc, tag);
-	switch (enc) {
-		case "A128CBC-HS256":
-		case "A192CBC-HS384":
-		case "A256CBC-HS512":
-			if (cek instanceof Uint8Array) checkCEKLength(cek, bitLengthCEK(enc));
-			return cbcDecrypt(enc, cek, ciphertext, iv, tag, aad);
-		case "A128GCM":
-		case "A192GCM":
-		case "A256GCM":
-			if (cek instanceof Uint8Array) checkCEKLength(cek, bitLengthCEK(enc));
-			return gcmDecrypt(enc, cek, ciphertext, iv, tag, aad);
-		default: return unsupportedContentEncryption(enc);
-	}
-}
-async function getAESKWCryptoKey(key, alg, options = {}) {
-	const { extractable = true, usage } = options;
-	if (key instanceof Uint8Array) return crypto.subtle.importKey("raw", key, "AES-KW", extractable, [usage ?? "wrapKey"]);
-	checkAESCryptoKey(key, alg, usage);
-	return key;
-}
-function checkAESKWKeySize(key, alg) {
-	if (lengthOf(key.algorithm) !== aesBitsOf(alg)) throw new JWTError(`Invalid key size for alg: ${alg}`, "ERR_JWK_INVALID");
-}
-async function importCBCKeys(enc, cek, usage) {
-	const keySize = aesBitsOf(enc);
-	const [encKey, macKey] = await Promise.all([crypto.subtle.importKey("raw", cek.subarray(keySize >> 3), "AES-CBC", false, [usage]), crypto.subtle.importKey("raw", cek.subarray(0, keySize >> 3), {
-		hash: `SHA-${keySize << 1}`,
-		name: "HMAC"
-	}, false, ["sign"])]);
-	return {
-		encKey,
-		macKey,
-		keySize
-	};
-}
-function cbcMacData(aad, iv, ciphertext) {
-	return concatUint8Arrays(aad, iv, ciphertext, uint64be(aad.length << 3));
-}
-async function cbcEncrypt(enc, plaintext, cek, iv, aad) {
-	if (!(cek instanceof Uint8Array)) throw new JWTError("CBC key must be of type Uint8Array", "ERR_JWK_INVALID");
-	const { encKey, macKey, keySize } = await importCBCKeys(enc, cek, "encrypt");
-	const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
-		iv,
-		name: "AES-CBC"
-	}, encKey, plaintext));
-	const macData = cbcMacData(aad, iv, ciphertext);
-	return {
-		ciphertext,
-		tag: new Uint8Array((await crypto.subtle.sign("HMAC", macKey, macData)).slice(0, keySize >> 3)),
-		iv
-	};
-}
-async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
-	let encKey;
-	if (cek instanceof Uint8Array) encKey = await crypto.subtle.importKey("raw", cek, "AES-GCM", false, ["encrypt"]);
-	else {
-		checkAESCryptoKey(cek, enc, "encrypt");
-		encKey = cek;
-	}
-	const encrypted = new Uint8Array(await crypto.subtle.encrypt({
-		additionalData: aad,
-		iv,
-		name: "AES-GCM",
-		tagLength: 128
-	}, encKey, plaintext));
-	const tag = encrypted.subarray(-16);
-	return {
-		ciphertext: encrypted.subarray(0, -16),
-		tag,
-		iv
-	};
-}
-async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
-	if (!(cek instanceof Uint8Array)) throw new JWTError("CBC key must be of type Uint8Array", "ERR_JWK_INVALID");
-	const { encKey, macKey, keySize } = await importCBCKeys(enc, cek, "decrypt");
-	const macData = cbcMacData(aad, iv, ciphertext);
-	const expectedTag = new Uint8Array((await crypto.subtle.sign("HMAC", macKey, macData)).slice(0, keySize >> 3));
-	let macCheckPassed;
-	try {
-		macCheckPassed = await timingSafeEqual(tag, expectedTag);
-	} catch {}
-	if (!macCheckPassed) throw new JWTError("JWE Decryption Failed", "ERR_JWE_DECRYPTION_FAILED");
-	let plaintext;
-	try {
-		plaintext = new Uint8Array(await crypto.subtle.decrypt({
-			iv,
-			name: "AES-CBC"
-		}, encKey, ciphertext));
-	} catch {}
-	if (!plaintext) throw new JWTError("JWE Decryption Failed", "ERR_JWE_DECRYPTION_FAILED");
-	return plaintext;
-}
-async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
-	let encKey;
-	if (cek instanceof Uint8Array) encKey = await crypto.subtle.importKey("raw", cek, "AES-GCM", false, ["decrypt"]);
-	else {
-		checkAESCryptoKey(cek, enc, "decrypt");
-		encKey = cek;
-	}
-	try {
-		return new Uint8Array(await crypto.subtle.decrypt({
-			additionalData: aad,
-			iv,
-			name: "AES-GCM",
-			tagLength: 128
-		}, encKey, concatUint8Arrays(ciphertext, tag)));
-	} catch {
-		throw new JWTError("JWE Decryption Failed", "ERR_JWE_DECRYPTION_FAILED");
-	}
-}
-let _timingSafeKey;
-function getTimingSafeKey() {
-	if (!_timingSafeKey) _timingSafeKey = crypto.subtle.generateKey({
-		name: "HMAC",
-		hash: "SHA-256"
-	}, false, ["sign"]);
-	return _timingSafeKey;
-}
-async function timingSafeEqual(a, b) {
-	if (!(a instanceof Uint8Array)) throw new JWTError("First argument must be a buffer", "ERR_INVALID_OPTION");
-	if (!(b instanceof Uint8Array)) throw new JWTError("Second argument must be a buffer", "ERR_INVALID_OPTION");
-	const algorithm = {
-		name: "HMAC",
-		hash: "SHA-256"
-	};
-	const key = await getTimingSafeKey();
-	const aHmac = new Uint8Array(await crypto.subtle.sign(algorithm, key, a));
-	const bHmac = new Uint8Array(await crypto.subtle.sign(algorithm, key, b));
-	let out = 0;
-	let i = -1;
-	while (++i < 32) out |= aHmac[i] ^ bHmac[i];
-	return out === 0;
-}
-function uint64be(value) {
-	return concatUint8Arrays(uint32be(Math.floor(value / 2 ** 32)), uint32be(value % 2 ** 32));
-}
-function gcmOf(alg) {
-	return alg.slice(0, 7);
-}
-function isKeyWrapAlgorithm(alg) {
-	return alg.startsWith("A") && alg.endsWith("KW");
-}
-function isContentEncryption(alg) {
-	return Object.hasOwn(CEK_BIT_LENGTHS, alg);
-}
-function unsupportedContentEncryption(enc) {
-	throw new JWTError(`Unsupported JWE Content Encryption Algorithm: ${quoteTokenValue(String(enc))}`, "ERR_JWE_INVALID");
-}
-async function jwkTokey(jwk, options = {}) {
-	const alg = jwk.alg ?? options.alg;
-	if (!alg) throw new JWTError("\"alg\" argument is required when \"jwk.alg\" is not present", "ERR_JWK_INVALID");
-	const { algorithm, keyUsages } = subtleMapping(jwk, alg);
-	const material = {
-		...jwk,
-		alg
-	};
-	const isPrivate = "d" in jwk && jwk.d !== void 0;
-	const extractable = jwk.ext === false ? false : options.extractable ?? !isPrivate;
-	try {
-		return await crypto.subtle.importKey("jwk", material, algorithm, extractable, permittedUsages(jwk, keyUsages));
-	} catch (error) {
-		if (error instanceof JWTError) throw error;
-		throw new JWTError(`Key is not usable for ${quoteTokenValue(alg)}.`, "ERR_JWK_INVALID", error);
-	}
-}
-async function keyToJWK(key) {
-	let jwk;
-	if (key instanceof Uint8Array) jwk = {
-		kty: "oct",
-		k: base64UrlStringify(key)
-	};
-	else {
-		if (!isCryptoKey(key)) throw new JWTError("Key must be one of type: CryptoKey or Uint8Array", "ERR_JWK_INVALID");
-		if (!key.extractable) throw new JWTError("non-extractable CryptoKey cannot be exported as a JWK", "ERR_JWK_INVALID");
-		const { ext: _ext, key_ops: _keyOps, ...exported } = await crypto.subtle.exportKey("jwk", key);
-		jwk = exported;
-	}
-	return jwk;
-}
-function permittedUsages(jwk, keyUsages) {
-	const keyOps = jwk.key_ops;
-	if (!keyOps || keyUsages.length === 0) return keyUsages;
-	const permitted = keyUsages.filter((usage) => keyOps.includes(usage));
-	if (permitted.length === 0) throw new JWTError(`JWK "key_ops" does not permit ${keyUsages.join(", ")}.`, "ERR_JWK_INVALID");
-	return permitted;
-}
-function subtleMapping(jwk, alg) {
-	let algorithm;
-	let keyUsages;
-	switch (jwk.kty) {
-		case "RSA":
-			switch (alg) {
-				case "PS256":
-				case "PS384":
-				case "PS512":
-					algorithm = {
-						name: "RSA-PSS",
-						hash: jwsHashOf(alg)
-					};
-					keyUsages = hasPrivateMember(jwk) ? ["sign"] : ["verify"];
-					break;
-				case "RS256":
-				case "RS384":
-				case "RS512":
-					algorithm = {
-						name: "RSASSA-PKCS1-v1_5",
-						hash: jwsHashOf(alg)
-					};
-					keyUsages = hasPrivateMember(jwk) ? ["sign"] : ["verify"];
-					break;
-				case "RSA-OAEP":
-				case "RSA-OAEP-256":
-				case "RSA-OAEP-384":
-				case "RSA-OAEP-512":
-					algorithm = {
-						name: "RSA-OAEP",
-						hash: rsaOaepHashOf(alg)
-					};
-					keyUsages = hasPrivateMember(jwk) ? ["decrypt", "unwrapKey"] : ["encrypt", "wrapKey"];
-					break;
-				default: throw new JWTError(`Invalid or unsupported JWK "alg" (Algorithm) Parameter value: ${quoteTokenValue(alg)}.`, "ERR_JWK_INVALID");
-			}
-			break;
-		case "EC":
-			switch (alg) {
-				case "ES256":
-				case "ES384":
-				case "ES512":
-					algorithm = {
-						name: "ECDSA",
-						namedCurve: ECDSA_CURVES[alg]
-					};
-					keyUsages = hasPrivateMember(jwk) ? ["sign"] : ["verify"];
-					break;
-				case "ECDH-ES":
-				case "ECDH-ES+A128KW":
-				case "ECDH-ES+A192KW":
-				case "ECDH-ES+A256KW":
-					algorithm = {
-						name: "ECDH",
-						namedCurve: requireCurve(jwk, [
-							"P-256",
-							"P-384",
-							"P-521"
-						])
-					};
-					keyUsages = hasPrivateMember(jwk) ? ["deriveBits"] : [];
-					break;
-				default: throw new JWTError(`Invalid or unsupported JWK "alg" (Algorithm) Parameter value: ${quoteTokenValue(alg)}.`, "ERR_JWK_INVALID");
-			}
-			break;
-		case "OKP":
-			switch (alg) {
-				case "Ed25519":
-				case "EdDSA":
-					algorithm = { name: requireCurve(jwk, ["Ed25519"]) };
-					keyUsages = hasPrivateMember(jwk) ? ["sign"] : ["verify"];
-					break;
-				case "ECDH-ES":
-				case "ECDH-ES+A128KW":
-				case "ECDH-ES+A192KW":
-				case "ECDH-ES+A256KW":
-					algorithm = { name: requireCurve(jwk, ["X25519"]) };
-					keyUsages = hasPrivateMember(jwk) ? ["deriveBits"] : [];
-					break;
-				default: throw new JWTError(`Invalid or unsupported JWK "alg" (Algorithm) Parameter value: ${quoteTokenValue(alg)}.`, "ERR_JWK_INVALID");
-			}
-			break;
-		default: throw new JWTError(`Invalid or unsupported JWK "kty" (Key Type) Parameter value: ${quoteTokenValue(jwk.kty)}.`, "ERR_JWK_INVALID");
-	}
-	return {
-		algorithm,
-		keyUsages
-	};
-}
-function requireCurve(jwk, allowed) {
-	const crv = "crv" in jwk ? jwk.crv : void 0;
-	if (typeof crv !== "string" || !allowed.includes(crv)) throw new JWTError(`Invalid or unsupported JWK "crv" (Curve) Parameter value: ${quoteTokenValue(crv)}. Expected one of: ${allowed.join(", ")}.`, "ERR_JWK_INVALID");
-	return crv;
-}
-function hasPrivateMember(jwk) {
-	return "d" in jwk && Boolean(jwk.d);
-}
-async function encryptRSAES(alg, key, cek) {
-	checkRSACryptoKey(key, alg, "encrypt");
-	checkRSAModulusLength(alg, key);
-	return new Uint8Array(await crypto.subtle.encrypt("RSA-OAEP", key, cek));
-}
-async function decryptRSAES(alg, key, encryptedKey) {
-	checkRSACryptoKey(key, alg, "decrypt");
-	checkRSAModulusLength(alg, key);
-	return new Uint8Array(await crypto.subtle.decrypt("RSA-OAEP", key, encryptedKey));
-}
-function checkRSACryptoKey(key, alg, usage) {
-	if (!isAlgorithm(key.algorithm, "RSA-OAEP")) throw unusableKey("RSA-OAEP");
-	const expected = shaBitsOf(rsaOaepHashOf(alg));
-	if (hashBitsOf(key.algorithm.hash) !== expected) throw unusableKey(`SHA-${expected}`, "algorithm.hash");
-	checkKeyUsage(key, usage);
-}
-function checkRSAModulusLength(alg, key) {
-	const modulusLength = modulusLengthOf(key.algorithm);
-	if (typeof modulusLength !== "number" || modulusLength < 2048) throw new JWTError(`${alg} requires key modulusLength to be 2048 bits or larger`, "ERR_JWK_INVALID");
-}
-async function deriveECDHESKey(publicKey, privateKey, algorithm, keyLength, apu = /* @__PURE__ */ new Uint8Array(0), apv = /* @__PURE__ */ new Uint8Array(0)) {
-	checkECDHCryptoKey(publicKey);
-	checkECDHCryptoKey(privateKey, "deriveBits");
-	const value = concatUint8Arrays(lengthAndInput(textEncoder.encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength));
-	const length = publicKey.algorithm.name === "X25519" ? 256 : Math.ceil(Number.parseInt((namedCurveOf(publicKey.algorithm) ?? "").slice(-3), 10) / 8) << 3;
-	return concatKdf(new Uint8Array(await crypto.subtle.deriveBits({
-		name: publicKey.algorithm.name,
-		public: publicKey
-	}, privateKey, length)), keyLength, value);
-}
-function ecdhDerivedBits(alg, enc) {
-	if (alg !== "ECDH-ES") return aesBitsOf(innerKeyWrapAlg(alg));
-	if (enc) return bitLengthCEK(enc);
-	throw new JWTError("ECDH-ES requires \"enc\", the content encryption algorithm the key is agreed for.", "ERR_JWE_INVALID");
-}
-function generateEphemeralKeyPair(recipientKey) {
-	return crypto.subtle.generateKey(recipientKey.algorithm, true, ["deriveBits"]);
-}
-function assertECDHKeyAllowed(key) {
-	switch (namedCurveOf(key.algorithm) ?? key.algorithm.name) {
-		case "P-256":
-		case "P-384":
-		case "P-521":
-		case "X25519": return;
-		default: throw new JWTError("ECDH with the provided key is not allowed or not supported", "ERR_JWK_INVALID");
-	}
-}
-function checkECDHCryptoKey(key, usage) {
-	switch (key.algorithm.name) {
-		case "ECDH":
-		case "X25519": break;
-		default: throw unusableKey("ECDH or X25519");
-	}
-	checkKeyUsage(key, usage);
-}
-async function concatKdf(secret, bits, value) {
-	const iterations = Math.ceil((bits >> 3) / 32);
-	const res = new Uint8Array(iterations * 32);
-	for (let iter = 0; iter < iterations; iter++) {
-		const buf = new Uint8Array(4 + secret.length + value.length);
-		buf.set(uint32be(iter + 1));
-		buf.set(secret, 4);
-		buf.set(value, 4 + secret.length);
-		res.set(await digest("sha256", buf), iter * 32);
-	}
-	return res.slice(0, bits >> 3);
-}
-function lengthAndInput(input) {
-	return concatUint8Arrays(uint32be(input.length), input);
-}
-async function digest(algorithm, data) {
-	return new Uint8Array(await crypto.subtle.digest(`SHA-${algorithm.slice(-3)}`, data));
-}
-const DEFAULT_PBES2_MIN_ITERATIONS = 1e3;
-const DEFAULT_PBES2_ITERATIONS = 6e5;
-const DEFAULT_PBES2_MAX_ITERATIONS = DEFAULT_PBES2_ITERATIONS;
-function assertPBES2Params(params) {
-	const { p2s, p2c } = params;
-	if (p2s !== void 0) assertPBES2Salt(p2s, "\"p2s\"");
-	if (p2c === void 0) return;
-	assertPBES2Count(p2c, "\"p2c\"");
-	if (p2c > 6e5) throw new JWTError(`"p2c" must be between ${DEFAULT_PBES2_MIN_ITERATIONS} and ${DEFAULT_PBES2_MAX_ITERATIONS} iterations (got ${p2c}).`, "ERR_INVALID_OPTION");
-}
-function assertPBES2Salt(salt, name) {
-	if (salt instanceof Uint8Array && salt.length >= 8) return;
-	throw new JWTError(`${name} must be 8 or more octets (RFC 7518 §4.8.1.1).`, "ERR_INVALID_OPTION");
-}
-function assertPBES2Count(count, name) {
-	if (typeof count !== "number" || !Number.isInteger(count) || count < 1) throw new JWTError(`${name} must be a positive integer.`, "ERR_INVALID_OPTION");
-	if (count < 1e3) throw new JWTError(`${name} must be at least ${DEFAULT_PBES2_MIN_ITERATIONS} iterations (got ${count}).`, "ERR_INVALID_OPTION");
-}
-async function pbes2Wrap(alg, key, cek, p2c, p2s) {
-	const derived = await deriveKey(p2s, alg, p2c, key);
-	return {
-		encryptedKey: await aesKwWrap(innerKeyWrapAlg(alg), derived, cek),
-		p2c,
-		p2s: base64UrlStringify(p2s)
-	};
-}
-function assertPBES2Iterations(p2c, bounds) {
-	const { minIterations = DEFAULT_PBES2_MIN_ITERATIONS, maxIterations = DEFAULT_PBES2_MAX_ITERATIONS } = bounds;
-	if (p2c < minIterations) throw new JWTError(`PBES2 "p2c" below the minimum of ${minIterations} iterations (got ${p2c}).`, "ERR_JWE_INVALID");
-	if (p2c > maxIterations) throw new JWTError(`PBES2 "p2c" above the maximum of ${maxIterations} iterations (got ${p2c}).`, "ERR_JWE_INVALID");
-}
-async function pbes2Unwrap(alg, key, encryptedKey, p2c, p2s, minIterations, maxIterations) {
-	assertPBES2Iterations(p2c, {
-		minIterations,
-		maxIterations
-	});
-	const derived = await deriveKey(p2s, alg, p2c, key);
-	return aesKwUnwrap(innerKeyWrapAlg(alg), derived, encryptedKey);
-}
-async function deriveKey(p2s, alg, p2c, key) {
-	assertPBES2Salt(p2s, "\"p2s\"");
-	if (p2c === void 0 || p2c < 1) throw new JWTError("PBES2 Iteration Count Parameter must be a positive integer", "ERR_INVALID_OPTION");
-	const salt = concatUint8Arrays(textEncoder.encode(alg), new Uint8Array([0]), p2s);
-	const keylen = aesBitsOf(innerKeyWrapAlg(alg));
-	const subtleAlg = {
-		hash: pbes2HashOf(alg),
-		iterations: p2c,
-		name: "PBKDF2",
-		salt
-	};
-	const cryptoKey = await getPBKDF2CryptoKey(key, alg);
-	return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
-}
-function checkPBES2CryptoKey(key, alg, usage) {
-	if (!isAlgorithm(key.algorithm, "PBKDF2")) throw unusableKey("PBKDF2");
-	checkKeyUsage(key, usage);
-}
-async function getPBKDF2CryptoKey(key, alg, options = {}) {
-	const { extractable = false, usage = "deriveBits" } = options;
-	if (key instanceof Uint8Array) return crypto.subtle.importKey("raw", key, "PBKDF2", extractable, [usage]);
-	checkPBES2CryptoKey(key, alg, usage);
-	return key;
-}
-async function encryptKey(alg, enc, key, providedCek, providedParameters = {}) {
-	let encryptedKey;
-	let parameters = {};
-	let cek;
-	switch (alg) {
-		case "dir":
-			cek = key;
-			break;
-		case "ECDH-ES":
-		case "ECDH-ES+A128KW":
-		case "ECDH-ES+A192KW":
-		case "ECDH-ES+A256KW":
-			assertCryptoKey(key);
-			({cek, encryptedKey, parameters} = await ecdhesWrap(alg, {
-				enc,
-				recipientKey: key,
-				cek: providedCek,
-				parameters: providedParameters
-			}));
-			break;
-		case "RSA-OAEP":
-		case "RSA-OAEP-256":
-		case "RSA-OAEP-384":
-		case "RSA-OAEP-512":
-			cek = providedCek || generateCEK(enc);
-			assertCryptoKey(key);
-			encryptedKey = await encryptRSAES(alg, key, cek);
-			break;
-		case "PBES2-HS256+A128KW":
-		case "PBES2-HS384+A192KW":
-		case "PBES2-HS512+A256KW": {
-			cek = providedCek || generateCEK(enc);
-			const { p2c, p2s } = providedParameters;
-			if (p2c === void 0 || p2s === void 0) throw new JWTError(`${alg} requires "p2c" and "p2s"`, "ERR_JWE_INVALID");
-			({encryptedKey, ...parameters} = await pbes2Wrap(alg, key, cek, p2c, p2s));
-			break;
-		}
-		case "A128KW":
-		case "A192KW":
-		case "A256KW":
-			cek = providedCek || generateCEK(enc);
-			encryptedKey = await aesKwWrap(alg, key, cek);
-			break;
-		case "A128GCMKW":
-		case "A192GCMKW":
-		case "A256GCMKW": {
-			cek = providedCek || generateCEK(enc);
-			const { iv } = providedParameters;
-			({encryptedKey, ...parameters} = await gcmkwEncrypt(alg, key, cek, iv));
-			break;
-		}
-		default: throw new JWTError(`Invalid or unsupported "alg" (JWE Algorithm) header value: ${quoteTokenValue(alg)}`, "ERR_JWE_ALG_NOT_ALLOWED");
-	}
-	return {
-		cek,
-		encryptedKey,
-		parameters
-	};
-}
-async function ecdhesWrap(alg, options) {
-	const { enc, recipientKey } = options;
-	const { apu, apv, epk: providedEpk, epkPrivateKey } = options.parameters;
-	assertECDHKeyAllowed(recipientKey);
-	if (providedEpk && !epkPrivateKey) throw new JWTError("ECDH-ES custom ephemeral key material must include the matching private key.", "ERR_JWK_INVALID");
-	let ephemeralPrivateKey;
-	let epk;
-	if (epkPrivateKey) {
-		ephemeralPrivateKey = await ensurePrivateKey(alg, epkPrivateKey);
-		assertEphemeralCurve(ephemeralPrivateKey, recipientKey);
-		epk = await exportPublicJwkFrom(providedEpk ?? epkPrivateKey);
-	} else {
-		const generated = await generateEphemeralKeyPair(recipientKey);
-		ephemeralPrivateKey = generated.privateKey;
-		epk = await exportPublicJwkFrom(generated.publicKey);
-	}
-	const kdfAlg = alg === "ECDH-ES" ? contentAlgorithm(enc) : alg;
-	const sharedSecret = await deriveECDHESKey(recipientKey, ephemeralPrivateKey, kdfAlg, ecdhDerivedBits(alg, enc), apu, apv);
-	const parameters = { epk };
-	if (apu) parameters.apu = base64UrlStringify(apu);
-	if (apv) parameters.apv = base64UrlStringify(apv);
-	if (alg === "ECDH-ES") return {
-		cek: sharedSecret,
-		parameters
-	};
-	const cek = options.cek ?? generateCEK(contentAlgorithm(enc));
-	return {
-		cek,
-		encryptedKey: await aesKwWrap(innerKeyWrapAlg(alg), sharedSecret, cek),
-		parameters
-	};
-}
-async function normalizeEpk(epk, options) {
-	const { alg } = options;
-	const recipientCurve = cryptoKeyCurve(options.recipientKey);
-	if (isCryptoKey(epk)) {
-		if (epk.type !== "public") throw invalidEpk("must not contain private key material.");
-		assertEpkCurve(cryptoKeyCurve(epk), recipientCurve);
-		return epk;
-	}
-	if (!isJWK(epk) || epk.kty !== "EC" && epk.kty !== "OKP") throw invalidEpk("must be an EC or OKP public key.");
-	if ("d" in epk && epk.d !== void 0) throw invalidEpk("must not contain private key material.");
-	const crv = epk.crv;
-	const allowed = epk.kty === "EC" ? EC_ECDH_CURVES : OKP_ECDH_CURVES;
-	if (typeof crv !== "string" || !allowed.has(crv)) throw invalidEpk(`curve ${quoteTokenValue(crv)} is not supported for ${options.alg}.`);
-	assertEpkCurve(crv, recipientCurve);
-	const x = epk.x;
-	const y = epk.kty === "EC" ? epk.y : void 0;
-	if (typeof x !== "string" || epk.kty === "EC" && typeof y !== "string") throw invalidEpk("is missing its public coordinates.");
-	return jwkTokey(epk.kty === "EC" && typeof y === "string" ? {
-		kty: "EC",
-		crv,
-		x,
-		y,
-		alg
-	} : {
-		kty: "OKP",
-		crv,
-		x,
-		alg
-	});
-}
-const EC_ECDH_CURVES = /* @__PURE__ */ new Set([
-	"P-256",
-	"P-384",
-	"P-521"
-]);
-const OKP_ECDH_CURVES = /* @__PURE__ */ new Set(["X25519"]);
-function contentAlgorithm(enc) {
-	if (enc) return enc;
-	throw new JWTError("ECDH-ES requires \"enc\", the content encryption algorithm the key is agreed for.", "ERR_JWE_INVALID");
-}
-function assertEphemeralCurve(ephemeralKey, recipientKey) {
-	assertECDHKeyAllowed(ephemeralKey);
-	const ephemeralCurve = cryptoKeyCurve(ephemeralKey);
-	const recipientCurve = cryptoKeyCurve(recipientKey);
-	if (ephemeralCurve === recipientCurve) return;
-	throw new JWTError(`ECDH-ES ephemeral key curve ${quoteTokenValue(ephemeralCurve)} does not match the recipient key curve ${quoteTokenValue(recipientCurve)}.`, "ERR_JWK_INVALID");
-}
-function invalidEpk(detail) {
-	return new JWTError(`Invalid JWE: "epk" ${detail}`, "ERR_JWE_INVALID");
-}
-function assertEpkCurve(epkCurve, recipientCurve) {
-	if (!recipientCurve || !epkCurve || epkCurve === recipientCurve) return;
-	throw invalidEpk(`curve "${epkCurve}" does not match the recipient key curve "${recipientCurve}".`);
-}
-function toPublicEpkJwk(jwk) {
-	const { kty } = jwk;
-	const crv = "crv" in jwk ? jwk.crv : void 0;
-	const x = "x" in jwk ? jwk.x : void 0;
-	if (kty !== "EC" && kty !== "OKP") throw new JWTError("ECDH-ES ephemeral key JWK \"kty\" must be \"EC\" or \"OKP\".", "ERR_JWK_INVALID");
-	if (typeof crv !== "string") throw new JWTError("ECDH-ES ephemeral key JWK must include the \"crv\" parameter.", "ERR_JWK_INVALID");
-	if (typeof x !== "string") throw new JWTError("ECDH-ES ephemeral key JWK must include the \"x\" coordinate.", "ERR_JWK_INVALID");
-	if (kty === "OKP") return {
-		kty,
-		crv,
-		x
-	};
-	const y = "y" in jwk ? jwk.y : void 0;
-	if (typeof y !== "string") throw new JWTError("ECDH-ES EC ephemeral key JWK must include both \"x\" and \"y\" coordinates.", "ERR_JWK_INVALID");
-	return {
-		kty,
-		crv,
-		x,
-		y
-	};
-}
-async function ensurePrivateKey(alg, value) {
-	const normalized = isCryptoKey(value) ? value : await jwkTokey(value, { alg });
-	if (normalized.type !== "private") throw new JWTError("ECDH-ES ephemeral private key must have type \"private\".", "ERR_JWK_INVALID");
-	return normalized;
-}
-async function exportPublicJwkFrom(value) {
-	if (!isCryptoKey(value)) return toPublicEpkJwk(value);
-	try {
-		return toPublicEpkJwk(await keyToJWK(value));
-	} catch (error_) {
-		throw new JWTError("ECDH-ES ephemeral CryptoKey must be extractable to export as JWK.", "ERR_JWK_INVALID", error_);
-	}
-}
-const toSPKI = (key) => {
-	return genericExport("public", "spki", key);
-};
-const toPKCS8 = (key) => {
-	return genericExport("private", "pkcs8", key);
-};
-const fromPKCS8 = (pem, alg, options) => {
-	return genericImport("PRIVATE KEY", "pkcs8", pem, alg, options);
-};
-const fromSPKI = (pem, alg, options) => {
-	return genericImport("PUBLIC KEY", "spki", pem, alg, options);
-};
-const fromX509 = (pem, alg, options) => {
-	let spki;
-	try {
-		spki = getSPKI(pem);
-	} catch (error_) {
-		throw new JWTError("Failed to parse the X.509 certificate.", "ERR_JWK_INVALID", error_);
-	}
-	return fromSPKI(spki, alg, options);
-};
-const formatPEM = (b64, descriptor) => {
-	return `-----BEGIN ${descriptor}-----\n${(b64.match(/.{1,64}/g) || []).join("\n")}\n-----END ${descriptor}-----`;
-};
-const pemBody = (pem, descriptor) => {
-	const begin = `-----BEGIN ${descriptor}-----`;
-	const end = `-----END ${descriptor}-----`;
-	const start = pem.indexOf(begin);
-	if (start === -1) {
-		const found = pem.match(/-----BEGIN [^-]+-----/)?.[0];
-		throw new JWTError(found ? `PEM label mismatch: expected "${begin}", got "${found}".` : `PEM label missing: expected "${begin}".`, "ERR_JWK_INVALID");
-	}
-	const bodyStart = start + begin.length;
-	const bodyEnd = pem.indexOf(end, bodyStart);
-	if (bodyEnd === -1) throw new JWTError(`PEM label missing: expected "${end}".`, "ERR_JWK_INVALID");
-	if (pem.includes("-----BEGIN", bodyStart) || pem.slice(bodyEnd + end.length).trim() !== "") throw new JWTError(`PEM must contain exactly one ${descriptor} block, with nothing after it.`, "ERR_JWK_INVALID");
-	return pem.slice(bodyStart, bodyEnd).replaceAll(/\s/g, "");
-};
-const genericExport = async (keyType, keyFormat, key) => {
-	if (!isCryptoKey(key)) throw new JWTError(`Key must be of type CryptoKey, got ${typeof key}`, "ERR_INVALID_OPTION");
-	if (!key.extractable) throw new JWTError("CryptoKey is not extractable", "ERR_JWK_INVALID");
-	if (key.type !== keyType) throw new JWTError(`key is not a ${keyType} key`, "ERR_JWK_INVALID");
-	return formatPEM(base64Stringify(new Uint8Array(await crypto.subtle.exportKey(keyFormat, key))), `${keyType.toUpperCase()} KEY`);
-};
-const genericImport = async (descriptor, keyFormat, pem, alg, options) => {
-	let algorithm;
-	let keyUsages;
-	const body = pemBody(pem, descriptor);
-	let keyData;
-	try {
-		keyData = base64Parse(body, { returnAs: "uint8array" });
-	} catch (error) {
-		throw new JWTError("Invalid PEM: body could not be decoded.", "ERR_JWK_INVALID", error);
-	}
-	const isPublic = keyFormat === "spki";
-	switch (alg) {
-		case "PS256":
-		case "PS384":
-		case "PS512":
-			algorithm = {
-				name: "RSA-PSS",
-				hash: jwsHashOf(alg)
-			};
-			keyUsages = isPublic ? ["verify"] : ["sign"];
-			break;
-		case "RS256":
-		case "RS384":
-		case "RS512":
-			algorithm = {
-				name: "RSASSA-PKCS1-v1_5",
-				hash: jwsHashOf(alg)
-			};
-			keyUsages = isPublic ? ["verify"] : ["sign"];
-			break;
-		case "RSA-OAEP":
-		case "RSA-OAEP-256":
-		case "RSA-OAEP-384":
-		case "RSA-OAEP-512":
-			algorithm = {
-				name: "RSA-OAEP",
-				hash: rsaOaepHashOf(alg)
-			};
-			keyUsages = isPublic ? ["encrypt", "wrapKey"] : ["decrypt", "unwrapKey"];
-			break;
-		case "ES256":
-		case "ES384":
-		case "ES512":
-			algorithm = {
-				name: "ECDSA",
-				namedCurve: ECDSA_CURVES[alg]
-			};
-			keyUsages = isPublic ? ["verify"] : ["sign"];
-			break;
-		case "ECDH-ES":
-		case "ECDH-ES+A128KW":
-		case "ECDH-ES+A192KW":
-		case "ECDH-ES+A256KW": {
-			const namedCurve = getNamedCurve(keyData);
-			if (namedCurve) algorithm = {
-				name: "ECDH",
-				namedCurve
-			};
-			else algorithm = { name: requireOKPCurve(keyData, "X25519") };
-			keyUsages = isPublic ? [] : ["deriveBits"];
-			break;
-		}
-		case "Ed25519":
-		case "EdDSA":
-			algorithm = { name: requireOKPCurve(keyData, "Ed25519") };
-			keyUsages = isPublic ? ["verify"] : ["sign"];
-			break;
-		default: throw new JWTError("Invalid or unsupported \"alg\" (Algorithm) value", "ERR_JWK_UNSUPPORTED");
-	}
-	try {
-		return await crypto.subtle.importKey(keyFormat, keyData, algorithm, options?.extractable ?? isPublic, keyUsages);
-	} catch (error) {
-		throw new JWTError(`Invalid PEM: the body could not be imported as "${alg}".`, "ERR_JWK_INVALID", error);
-	}
-};
-const findOid = (keyData, oid) => {
-	const needle = [
-		6,
-		oid.length,
-		...oid
-	];
-	const last = keyData.length - needle.length;
-	for (let i = keyData.indexOf(needle[0]); i !== -1 && i <= last; i = keyData.indexOf(needle[0], i + 1)) if (needle.every((byte, index) => keyData[i + index] === byte)) return true;
-	return false;
-};
-const OKP_CURVE_OIDS = {
-	X25519: [
-		43,
-		101,
-		110
-	],
-	Ed25519: [
-		43,
-		101,
-		112
-	]
-};
-const requireOKPCurve = (keyData, crv) => {
-	if (findOid(keyData, OKP_CURVE_OIDS[crv])) return crv;
-	throw new JWTError(`Invalid PEM: unsupported curve, expected the ${crv} OID.`, "ERR_JWK_INVALID");
-};
-const getNamedCurve = (keyData) => {
-	switch (true) {
-		case findOid(keyData, [
-			42,
-			134,
-			72,
-			206,
-			61,
-			3,
-			1,
-			7
-		]): return "P-256";
-		case findOid(keyData, [
-			43,
-			129,
-			4,
-			0,
-			34
-		]): return "P-384";
-		case findOid(keyData, [
-			43,
-			129,
-			4,
-			0,
-			35
-		]): return "P-521";
-		default: return;
-	}
-};
-const getElement = (seq) => {
-	const result = [];
-	let next = 0;
-	while (next < seq.length) {
-		const nextPart = parseElement(seq.subarray(next));
-		if (nextPart.byteLength <= 0) throw new JWTError("Invalid DER: zero-length element", "ERR_JWK_INVALID");
-		result.push(nextPart);
-		next += nextPart.byteLength;
-	}
-	return result;
-};
-const parseElement = (bytes) => {
-	let position = 0;
-	const at = (index) => {
-		const byte = bytes[index];
-		if (byte === void 0) throw new JWTError("Invalid DER: element is truncated", "ERR_JWK_INVALID");
-		return byte;
-	};
-	let tag = at(0) & 31;
-	position++;
-	if (tag === 31) {
-		tag = 0;
-		while (at(position) >= 128) {
-			tag = tag * 128 + at(position) - 128;
-			position++;
-		}
-		tag = tag * 128 + at(position) - 128;
-		position++;
-	}
-	let length = 0;
-	if (at(position) < 128) {
-		length = at(position);
-		position++;
-	} else if (at(position) === 128) {
-		length = 0;
-		while (position + length + 1 < bytes.byteLength) {
-			if (at(position + length) === 0 && at(position + length + 1) === 0) break;
-			length++;
-		}
-		if (position + length + 1 >= bytes.byteLength) throw new JWTError("Invalid DER: invalid indefinite form length", "ERR_JWK_INVALID");
-		const byteLength = position + length + 2;
-		return {
-			byteLength,
-			contents: bytes.subarray(position, position + length),
-			raw: bytes.subarray(0, byteLength)
-		};
-	} else {
-		const numberOfDigits = at(position) & 127;
-		position++;
-		length = 0;
-		for (let i = 0; i < numberOfDigits; i++) {
-			length = length * 256 + at(position);
-			position++;
-		}
-	}
-	const byteLength = position + length;
-	if (byteLength > bytes.byteLength) throw new JWTError("Invalid DER: element length exceeds the available bytes", "ERR_JWK_INVALID");
-	return {
-		byteLength,
-		contents: bytes.subarray(position, byteLength),
-		raw: bytes.subarray(0, byteLength)
-	};
-};
-const spkiFromX509 = (buf) => {
-	const tbs = getElement(parseElement(buf).contents)[0];
-	if (!tbs) throw new JWTError("Invalid X.509 certificate: missing tbsCertificate", "ERR_JWK_INVALID");
-	const tbsCertificate = getElement(tbs.contents);
-	const first = tbsCertificate[0];
-	if (!first) throw new JWTError("Invalid X.509 certificate: empty tbsCertificate", "ERR_JWK_INVALID");
-	const spki = tbsCertificate[first.raw[0] === 160 ? 6 : 5];
-	if (!spki) throw new JWTError("Invalid X.509 certificate: missing subjectPublicKeyInfo", "ERR_JWK_INVALID");
-	return base64Stringify(spki.raw);
-};
-let createPublicKey;
-const getSPKI = (x509) => {
-	try {
-		createPublicKey ??= globalThis.process?.getBuiltinModule?.("node:crypto")?.createPublicKey;
-	} catch {
-		createPublicKey = 0;
-	}
-	const body = pemBody(x509, "CERTIFICATE");
-	if (createPublicKey) try {
-		return new createPublicKey(x509).export({
-			format: "pem",
-			type: "spki"
-		});
-	} catch {}
-	let raw;
-	try {
-		raw = base64Parse(body, { returnAs: "uint8array" });
-	} catch (error) {
-		throw new JWTError("Invalid X.509 certificate: body could not be decoded.", "ERR_JWK_INVALID", error);
-	}
-	return formatPEM(spkiFromX509(raw), "PUBLIC KEY");
-};
-const THUMBPRINT_MEMBERS = /* @__PURE__ */ Object.freeze({
-	EC: [
-		"crv",
-		"kty",
-		"x",
-		"y"
-	],
-	RSA: [
-		"e",
-		"kty",
-		"n"
-	],
-	OKP: [
-		"crv",
-		"kty",
-		"x"
-	],
-	oct: ["k", "kty"]
-});
-const THUMBPRINT_HASHES = /* @__PURE__ */ new Set([
-	"SHA-256",
-	"SHA-384",
-	"SHA-512"
-]);
-async function thumbprint(jwk, options = {}) {
-	assertPlainObject(jwk, "jwk");
-	assertPlainObject(options, "options");
-	const hash = options.hash ?? "SHA-256";
-	if (!THUMBPRINT_HASHES.has(hash)) throw new JWTError("\"hash\" must be \"SHA-256\", \"SHA-384\" or \"SHA-512\".", "ERR_INVALID_OPTION");
-	const kty = jwk.kty;
-	const members = typeof kty === "string" && Object.hasOwn(THUMBPRINT_MEMBERS, kty) ? THUMBPRINT_MEMBERS[kty] : void 0;
-	if (!members) throw new JWTError(`JWK thumbprint is not defined for kty "${String(kty)}".`, "ERR_JWK_INVALID");
-	const canonical = members.map((name) => {
-		const value = Reflect.get(jwk, name);
-		if (typeof value !== "string" || value.length === 0) throw new JWTError(`JWK thumbprint requires the member "${name}" on an ${jwk.kty} key.`, "ERR_JWK_INVALID");
-		return `${JSON.stringify(name)}:${JSON.stringify(value)}`;
-	});
-	return digestUrl(`{${canonical.join(",")}}`, hash);
-}
-const MAX_PARTY_INFO_BYTES = 1024;
-const DEFAULT_JOSE_LIMITS = /* @__PURE__ */ Object.freeze({
-	signatures: 16,
-	recipients: 16,
-	keyCandidates: 8,
-	pbes2Iterations: 4 * DEFAULT_PBES2_ITERATIONS
-});
-function resolveLimit(limits, name) {
-	const value = limits?.[name];
-	if (value === void 0) return DEFAULT_JOSE_LIMITS[name];
-	if (typeof value !== "number" || !Number.isInteger(value) || value < 1) throw new JWTError(`"limits.${name}" must be a positive integer.`, "ERR_INVALID_OPTION");
-	return value;
-}
-function assertEntryLimit(count, limit, options) {
-	if (count <= limit) return;
-	throw new JWTError(`Invalid ${options.family}: ${count} ${options.what} exceed the limit of ${limit}.`, `ERR_${options.family}_INVALID`);
-}
-function assertCandidateLimit(count, limit) {
-	if (count <= limit) return;
-	throw new JWTError(`${count} candidate keys exceed the limit of ${limit}; narrow the JWK Set with a "kid".`, "ERR_JWK_KEY_NOT_FOUND");
-}
-function assertJWKSetCandidates(candidates, options) {
-	if (candidates.length === 0) {
-		const { kid } = options;
-		throw new JWTError(`No key found in JWK Set${kid ? ` with kid ${quoteTokenValue(kid)}` : ""}.`, "ERR_JWK_KEY_NOT_FOUND");
-	}
-	assertCandidateLimit(candidates.length, options.limit);
-}
-function createPBES2Budget(limit) {
-	let remaining = limit;
-	return { spend(attempt) {
-		const { alg, p2c } = attempt;
-		if (!alg.startsWith("PBES2")) return;
-		if (typeof p2c !== "number" || !(p2c > 0)) return;
-		assertPBES2Iterations(p2c, attempt);
-		if (p2c > remaining) throw new JWTError(`PBES2 iteration budget of ${limit} exhausted.`, "ERR_JWE_INVALID");
-		remaining -= p2c;
-	} };
-}
-function serializeProtectedHeader(header) {
-	try {
-		return JSON.stringify(header);
-	} catch (error) {
-		throw new JWTError("The protected header is not JSON-serializable.", "ERR_INVALID_OPTION", error);
-	}
-}
-function assertProducerCrit(header, family) {
-	const crit = header.crit;
-	if (crit === void 0) return;
-	assertCritShape(crit, {
-		family,
-		code: "ERR_INVALID_OPTION"
-	});
-	for (const param of crit) {
-		if (Object.hasOwn(header, param)) continue;
-		throw new JWTError(`"crit" lists "${param}", which the protected header does not carry.`, "ERR_INVALID_OPTION");
-	}
-}
-const PROTECTED_ONLY_PARAMS = {
-	JWS: ["crit", "b64"],
-	JWE: ["crit"]
-};
-function assertProtectedOnlyOption(header, options) {
-	if (!header) return;
-	const { tier, family } = options;
-	for (const param of PROTECTED_ONLY_PARAMS[family]) {
-		if (!Object.hasOwn(header, param)) continue;
-		throw new JWTError(`${family} "${param}" must be integrity protected; move it from the ${tier} header to the protected header.`, "ERR_INVALID_OPTION");
-	}
-}
-function assertProducerKeyHeaders(header, options) {
-	if (!header) return;
-	const { tier, family } = options;
-	if (Object.hasOwn(header, "jwk") && !isPublicJWK(Reflect.get(header, "jwk"))) throw new JWTError(`${family} "jwk" in the ${tier} header must be a public JWK; pass the pair's publicKey half.`, "ERR_INVALID_OPTION");
-	if (Object.hasOwn(header, "epk")) throw new JWTError(`${family} "epk" is written by the ECDH-ES key agreement; pass an ephemeral key through "ecdh.ephemeralKey" instead of the ${tier} header.`, "ERR_INVALID_OPTION");
-}
-function assertProducerConfirmation(payload) {
-	if (typeof payload !== "object" || payload === null) return;
-	const cnf = Reflect.get(payload, "cnf");
-	if (typeof cnf !== "object" || cnf === null || !Object.hasOwn(cnf, "jwk")) return;
-	if (!isPublicJWK(Reflect.get(cnf, "jwk"))) throw new JWTError("Invalid JWT \"cnf\" (Confirmation) Claim: \"jwk\" must be a public JWK (RFC 7800 §3.2).", "ERR_JWT_CLAIM_INVALID");
-}
-function assertOptionEntry(entry, options) {
-	const { label, objects } = options;
-	assertPlainObject(entry, label);
-	for (const member of objects) if (entry[member] !== void 0) assertPlainObject(entry[member], `${label}.${member}`);
-}
-function assertProducerPartyInfo(name, value) {
-	if (!(value instanceof Uint8Array)) throw new JWTError(`"${name === "apu" ? "partyUInfo" : "partyVInfo"}" (${name}) must be a Uint8Array.`, "ERR_INVALID_OPTION");
-	if (value.length > 1024) throw new JWTError(`"${name === "apu" ? "partyUInfo" : "partyVInfo"}" (${name}) must not exceed ${MAX_PARTY_INFO_BYTES} bytes (got ${value.length}).`, "ERR_INVALID_OPTION");
-}
-function assertProducerCEK(cek, enc) {
-	if (cek === void 0) return;
-	const expected = bitLengthCEK(enc) >> 3;
-	if (!(cek instanceof Uint8Array) || cek.length !== expected) throw new JWTError(`"cek" must be ${expected} bytes for ${enc} (got ${cek instanceof Uint8Array ? cek.length : typeof cek}).`, "ERR_INVALID_OPTION");
-}
-function assertProducerIV(iv, enc) {
-	if (iv === void 0) return;
-	const expected = bitLengthIV(enc) >> 3;
-	if (!(iv instanceof Uint8Array) || iv.length !== expected) throw new JWTError(`"contentEncryptionIV" must be ${expected} bytes for ${enc} (got ${iv instanceof Uint8Array ? iv.length : typeof iv}).`, "ERR_INVALID_OPTION");
-}
-function assertConsumerOptions(options) {
-	assertOptionEntry(options, {
-		label: "options",
-		objects: ["limits"]
-	});
-	const typ = options.typ;
-	if (typ !== void 0 && (typeof typ !== "string" || typ === "")) throw new JWTError("\"typ\" must be a non-empty string.", "ERR_INVALID_OPTION");
-	assertStringList(options.algorithms, "algorithms");
-	assertStringList(options.encryptionAlgorithms, "encryptionAlgorithms");
-	assertStringList(options.recognizedHeaders, "recognizedHeaders");
-	assertClaimValidationOptions(options);
-}
-const JWK_SET_KEY_OPS = /* @__PURE__ */ Object.freeze({
-	sig: ["verify"],
-	enc: [
-		"unwrapKey",
-		"decrypt",
-		"deriveBits",
-		"deriveKey"
-	]
-});
-function buildJWKSetFilter(header, options) {
-	const kid = header?.kid;
-	const alg = header?.alg;
-	const { op, allowSymmetric } = options;
-	const use = op;
-	const keyOps = JWK_SET_KEY_OPS[op];
-	return (k) => {
-		if (!isJWK(k)) return false;
-		if (k.kty === "oct" && !allowSymmetric) return false;
-		if (kid && k.kid !== kid) return false;
-		if (k.alg && k.alg !== alg) return false;
-		if (k.use !== void 0 && k.use !== use) return false;
-		const ops = k.key_ops;
-		if (ops !== void 0 && !(Array.isArray(ops) && ops.some((o) => keyOps.includes(o)))) return false;
-		return true;
-	};
-}
-function parseEphemeralKey(ephemeralKey) {
-	if (isCryptoKeyPair(ephemeralKey)) return {
-		epk: ephemeralKey.publicKey,
-		epkPrivateKey: ephemeralKey.privateKey
-	};
-	if (typeof ephemeralKey === "object" && ephemeralKey !== null && "publicKey" in ephemeralKey && "privateKey" in ephemeralKey) {
-		if (!ephemeralKey.publicKey || !ephemeralKey.privateKey) throw new JWTError("ECDH-ES custom ephemeral key must include both publicKey and privateKey.", "ERR_JWK_INVALID");
-		return {
-			epk: ephemeralKey.publicKey,
-			epkPrivateKey: ephemeralKey.privateKey
-		};
-	}
-	if (isCryptoKey(ephemeralKey)) {
-		if (ephemeralKey.type !== "private") throw new JWTError("ECDH-ES custom ephemeral CryptoKey must include private key material.", "ERR_JWK_INVALID");
-		return {
-			epk: ephemeralKey,
-			epkPrivateKey: ephemeralKey
-		};
-	}
-	if (isJWK(ephemeralKey)) {
-		if (!("d" in ephemeralKey) || typeof ephemeralKey.d !== "string") throw new JWTError("ECDH-ES custom ephemeral JWK must include private parameter \"d\".", "ERR_JWK_INVALID");
-		return {
-			epk: ephemeralKey,
-			epkPrivateKey: ephemeralKey
-		};
-	}
-	throw new JWTError("Unsupported ECDH-ES ephemeral key material provided.", "ERR_JWK_INVALID");
-}
-function buildECDHAgreementParams(ecdh) {
-	const params = {};
-	if (!ecdh) return params;
-	const { partyUInfo, partyVInfo, ephemeralKey } = ecdh;
-	if (partyUInfo !== void 0) {
-		assertProducerPartyInfo("apu", partyUInfo);
-		if (partyUInfo.length > 0) params.apu = partyUInfo;
-	}
-	if (partyVInfo !== void 0) {
-		assertProducerPartyInfo("apv", partyVInfo);
-		if (partyVInfo.length > 0) params.apv = partyVInfo;
-	}
-	if (ephemeralKey) {
-		const { epk, epkPrivateKey } = parseEphemeralKey(ephemeralKey);
-		params.epk = epk;
-		params.epkPrivateKey = epkPrivateKey;
-	}
-	return params;
-}
-async function resolveSigningKey(alg, key, usage) {
-	if (key instanceof Uint8Array) {
-		if (alg !== "HS256" && alg !== "HS384" && alg !== "HS512") throw new JWTError(`Raw key bytes are HMAC secrets; ${alg} needs an asymmetric key. Pass a JWK or a CryptoKey.`, "ERR_JWK_INVALID");
-		assertOctKeyLength(key, alg);
-		return crypto.subtle.importKey("raw", key, {
-			name: "HMAC",
-			hash: jwsHashOf(alg)
-		}, false, [usage]);
-	}
-	if (RSA_SIGNATURE_ALGORITHMS.has(alg)) {
-		const modulusLength = modulusLengthOf(key.algorithm);
-		if (typeof modulusLength !== "number" || modulusLength < 2048) throw new JWTError(`${alg} requires a key modulusLength of at least 2048 bits`, "ERR_JWK_INVALID");
-	}
-	return key;
-}
-function validateClaimsIfJson(payload, mode, options) {
-	if (mode !== "json" || options.validateClaims === false) return;
-	validateJwtClaims(payload, options);
-}
-const PAYLOAD_MODES = /* @__PURE__ */ new Set([
-	"json",
-	"string",
-	"bytes"
-]);
-function resolvePayloadMode(options) {
-	const { payload, forceUint8Array, validateClaims } = options;
-	if (payload !== void 0 && !PAYLOAD_MODES.has(payload)) throw new JWTError("\"payload\" must be \"json\", \"string\" or \"bytes\".", "ERR_INVALID_OPTION");
-	let mode = payload ?? "json";
-	if (forceUint8Array !== void 0) {
-		if (payload === void 0) mode = forceUint8Array ? "bytes" : "json";
-		else if (forceUint8Array !== (payload === "bytes")) throw new JWTError("\"forceUint8Array\" contradicts \"payload\"; pass \"payload\" alone.", "ERR_INVALID_OPTION");
-	}
-	if (validateClaims === true && mode !== "json") throw new JWTError("\"validateClaims\" requires payload: \"json\".", "ERR_INVALID_OPTION");
-	return mode;
-}
-function stringKeyError() {
-	return new JWTError("String keys are not accepted: pass an oct JWK or a Uint8Array secret, or import PEM text with importPEM().", "ERR_JWK_INVALID");
-}
-function assertNotStringKey(key) {
-	if (typeof key === "string") throw stringKeyError();
-}
-function resolvePasswordKey(alg, key) {
-	if (typeof key !== "string") return key;
-	if (!isPBES2Algorithm(alg)) throw stringKeyError();
-	return textEncoder.encode(key);
-}
-const JWS_ALG_CTX = /* @__PURE__ */ Object.freeze({
-	infer: inferJWSAllowedAlgorithms,
-	octRoles: false,
-	errorCode: "ERR_JWS_ALG_NOT_ALLOWED",
-	label: "Algorithm",
-	op: "sig"
-});
-const JWE_ALG_CTX = /* @__PURE__ */ Object.freeze({
-	infer: inferJWEAllowedAlgorithms,
-	octRoles: true,
-	errorCode: "ERR_JWE_ALG_NOT_ALLOWED",
-	label: "Key management algorithm",
-	op: "enc"
-});
-function checkAlgAllowed(alg, key, options) {
-	const { ctx, algorithms, allowSymmetric } = options;
-	if (algorithms !== void 0) return algorithms.includes(alg) ? void 0 : notAllowed(alg, ctx);
-	if (isJWK(key) && typeof key.alg === "string" && (!ctx.octRoles || key.kty !== "oct")) return key.alg === alg || isEd25519Signature(key.alg) && isEd25519Signature(alg) ? void 0 : notAllowed(alg, ctx);
-	const inferred = ctx.infer(key, { allowSymmetric });
-	if (!inferred) return new JWTError(`Cannot infer allowed ${ctx.label.toLowerCase()}s from this key; pass "options.algorithms" explicitly.`, ctx.errorCode);
-	return inferred.includes(alg) ? void 0 : notAllowed(alg, ctx);
-}
-function notAllowed(alg, ctx) {
-	return new JWTError(`${ctx.label} not allowed: ${alg}`, ctx.errorCode);
-}
-function keyMatchesHeader(header, keyMaterial, options) {
-	const { ctx, allowSymmetric } = options;
-	if (isJWKSet(keyMaterial)) {
-		const candidates = keyMaterial.keys.filter(buildJWKSetFilter(header, {
-			op: ctx.op,
-			allowSymmetric
-		}));
-		return candidates.length === 0 || candidates.some((k) => keyServesHeaderAlg(header, k, ctx));
-	}
-	if (isJWK(keyMaterial)) return keyServesHeaderAlg(header, keyMaterial, ctx);
-	if (isCryptoKey(keyMaterial)) return keyServesHeaderAlg(header, keyMaterial, ctx);
-	return true;
-}
-function assertJWSAlgSupported(alg) {
-	const error = checkJWSAlgSupported(alg);
-	if (error) throw error;
-}
-function checkJWSAlgSupported(alg) {
-	return checkAlgSupported(alg, {
-		supported: isJWSAlgorithm,
-		code: "ERR_JWS_ALG_NOT_ALLOWED",
-		label: "Algorithm",
-		role: "signing algorithm"
-	});
-}
-function checkJWSB64(header) {
-	if (Object.hasOwn(header, "b64") && typeof header.b64 !== "boolean") return new JWTError("Invalid JWS: \"b64\" must be a boolean (RFC 7797 §3).", "ERR_JWS_INVALID");
-	if (header.b64 !== false) return void 0;
-	if (Array.isArray(header.crit) && header.crit.includes("b64")) return void 0;
-	return new JWTError("Invalid JWS: \"b64\" must be listed in \"crit\" (RFC 7797 §6).", "ERR_JWS_INVALID");
-}
-function assertB64Option(header) {
-	if (!header || !Object.hasOwn(header, "b64") || typeof header.b64 === "boolean") return;
-	throw new JWTError("\"b64\" must be a boolean (RFC 7797 §3).", "ERR_INVALID_OPTION");
-}
-function applyB64Header(header) {
-	assertB64Option(header);
-	if (header.b64 === true) {
-		if (!(Array.isArray(header.crit) && header.crit.includes("b64"))) delete header.b64;
-		return;
-	}
-	if (header.b64 !== false) return;
-	const crit = header.crit;
-	if (crit === void 0) header.crit = ["b64"];
-	else if (Array.isArray(crit) && !crit.includes("b64")) header.crit = [...crit, "b64"];
-}
-function assertCompactToken(token, family) {
-	if (typeof token !== "string") throw new JWTError(`Invalid ${family}: token must be a string.`, `ERR_${family}_INVALID`);
-}
-function assertSerializationObject(value, family) {
-	if (!isPlainObject(value)) throw new JWTError(`Invalid ${family} JSON Serialization: expected an object.`, `ERR_${family}_INVALID_SERIALIZATION`);
-}
-function checkSerializationEntry(entry, options) {
-	const { family, label, objects, strings } = options;
-	const code = `ERR_${family}_INVALID`;
-	if (!isPlainObject(entry)) return new JWTError(`Invalid ${family}: ${label} must be a JSON object.`, code);
-	for (const member of objects) if (entry[member] !== void 0 && !isPlainObject(entry[member])) return new JWTError(`Invalid ${family}: ${label} "${member}" must be a JSON object.`, code);
-	for (const member of strings) if (entry[member] !== void 0 && typeof entry[member] !== "string") return new JWTError(`Invalid ${family}: ${label} "${member}" must be a string.`, code);
-}
-function asKeyLookupError(error, what) {
-	return asJWTError(error, {
-		code: "ERR_JWK_KEY_NOT_FOUND",
-		message: `Key lookup failed for ${what}.`
-	});
-}
-function asJWTError(error, options) {
-	if (error instanceof JWTError) return error;
-	return new JWTError(options.message, options.code, error);
-}
-function asDecryptionError(error) {
-	return asJWTError(error, {
-		code: "ERR_JWE_DECRYPTION_FAILED",
-		message: "JWE decryption failed."
-	});
-}
-async function resolveKeyInput(key, options) {
-	if (typeof key !== "function") return key;
-	const { header, token, what } = options;
-	let resolved;
-	try {
-		resolved = await key(header, token);
-	} catch (error) {
-		throw asKeyLookupError(error, what);
-	}
-	if (resolved === void 0 || resolved === null) throw new JWTError(`Key lookup returned no key for ${what}.`, "ERR_JWK_KEY_NOT_FOUND");
-	return resolved;
-}
-function asKeyUsageError(error, alg) {
-	return asJWTError(error, {
-		code: "ERR_JWK_INVALID",
-		message: `Key is not usable for ${alg}.`
-	});
-}
-const JWE_ENC_CEK_FORMAT = /* @__PURE__ */ Object.freeze({
-	"A128GCM": "cryptokey",
-	"A192GCM": "cryptokey",
-	"A256GCM": "cryptokey",
-	"A128CBC-HS256": "raw",
-	"A192CBC-HS384": "raw",
-	"A256CBC-HS512": "raw"
-});
-function assertDirectKeyRole(key, enc) {
-	if (!isJWK(key) || typeof key.alg !== "string" || key.alg === "dir") return;
-	if (enc !== void 0 && key.alg === enc) return;
-	throw new JWTError(`JWK "alg" is "${key.alg}" but "dir" requires a key declared as "dir" or as the token's "enc" (${enc ?? "unknown"}).`, "ERR_JWK_INVALID");
-}
-const JWE_DIRECT_ALGS = /* @__PURE__ */ new Set(["dir", "ECDH-ES"]);
-function checkJWEAlgSupported(alg) {
-	return checkAlgSupported(alg, {
-		supported: isKeyManagementAlgorithm,
-		code: "ERR_JWE_ALG_NOT_ALLOWED",
-		label: "Key management algorithm",
-		role: "key management algorithm"
-	});
-}
-function checkJWEEncSupported(enc) {
-	if (typeof enc === "string" && isContentEncryptionAlgorithm(enc)) return void 0;
-	return new JWTError(`Invalid JWE: unsupported "enc" ${quoteTokenValue(enc)}`, "ERR_JWE_INVALID");
-}
-function isJWEAlgSupported(alg) {
-	return isKeyManagementAlgorithm(alg);
-}
-function assertJWEAlgSupported(alg) {
-	const error = checkJWEAlgSupported(alg);
-	if (error) throw error;
-}
-function assertJWEEncSupported(enc) {
-	const error = checkJWEEncSupported(enc);
-	if (error) throw error;
-}
-function checkJWEEncAllowed(enc, encryptionAlgorithms) {
-	if (encryptionAlgorithms === void 0 || encryptionAlgorithms.includes(enc)) return void 0;
-	return new JWTError(`Content encryption algorithm not allowed: ${enc}`, "ERR_JWE_ALG_NOT_ALLOWED");
-}
-async function exportReturnedCek(cek) {
-	if (!isCryptoKey(cek)) return cek;
-	if (!cek.extractable) throw new JWTError("\"returnCek\" requires an extractable content encryption key.", "ERR_INVALID_OPTION");
-	return new Uint8Array(await crypto.subtle.exportKey("raw", cek));
-}
-function cekFormatForEnc(enc) {
-	return JWE_ENC_CEK_FORMAT[enc];
-}
-function buildUnwrapKeyOptions(header, algorithms, options) {
-	const { alg, enc } = algorithms;
-	const opts = {
-		alg,
-		enc,
-		format: cekFormatForEnc(enc),
-		keyUsage: options?.keyUsage || ["decrypt"]
-	};
-	if (header.iv) opts.iv = header.iv;
-	if (header.tag) opts.tag = header.tag;
-	if (header.p2s) opts.p2s = header.p2s;
-	if (header.p2c) opts.p2c = header.p2c;
-	if (header.epk) opts.epk = header.epk;
-	if (header.apu) opts.apu = header.apu;
-	if (header.apv) opts.apv = header.apv;
-	if (options?.unwrappedKeyAlgorithm) opts.unwrappedKeyAlgorithm = options.unwrappedKeyAlgorithm;
-	if (options?.extractable !== void 0) opts.extractable = options.extractable;
-	if (options?.minIterations !== void 0) opts.minIterations = options.minIterations;
-	if (options?.maxIterations !== void 0) opts.maxIterations = options.maxIterations;
-	return opts;
-}
-function checkJWEDirectEncryptedKey(alg, encryptedKey) {
-	if (!JWE_DIRECT_ALGS.has(alg) || !encryptedKey) return void 0;
-	return new JWTError(`Invalid JWE: Encrypted key must be empty for ${alg}.`, "ERR_JWE_INVALID");
-}
-function checkJWEContentSegments(enc, iv, tag) {
-	const ivBytes = bitLengthIV(enc) >> 3;
-	if (iv.length !== ivBytes) return new JWTError(`Invalid JWE: Initialization vector must be ${ivBytes} bytes for ${enc} (got ${iv.length}).`, "ERR_JWE_INVALID");
-	const tagBytes = bitLengthTag(enc) >> 3;
-	if (tag.length !== tagBytes) return new JWTError(`Invalid JWE: Authentication tag must be ${tagBytes} bytes for ${enc} (got ${tag.length}).`, "ERR_JWE_INVALID");
-}
-function checkJWEZip(header) {
-	if (!header || !Object.hasOwn(header, "zip")) return void 0;
-	return new JWTError("Invalid JWE: compression is not supported.", "ERR_JWE_INVALID");
-}
-function assertNoZipOption(header, tier) {
-	if (!header || !Object.hasOwn(header, "zip")) return;
-	throw new JWTError(`JWE compression ("zip") is not supported; remove it from the ${tier} header.`, "ERR_INVALID_OPTION");
-}
-function checkJWEUnprotectedCrit(header) {
-	if (!header || !Object.hasOwn(header, "crit")) return void 0;
-	return new JWTError("Invalid JWE: \"crit\" must be integrity protected (RFC 7516 §4.1.13).", "ERR_JWE_INVALID");
-}
-function typMatches(expected, actual) {
-	if (typeof actual !== "string") return false;
-	return normalizeTyp(expected) === normalizeTyp(actual);
-}
-function checkProtectedTyp(expected, protectedHeader, options) {
-	if (expected === void 0) return void 0;
-	const actual = protectedHeader.typ;
-	if (typMatches(expected, actual)) return void 0;
-	const { family, label } = options;
-	const where = label ? ` on ${label}` : "";
-	const message = actual === void 0 ? `Invalid ${family}: the protected header${where} carries no "typ"; expected "${expected}".` : `Invalid ${family}: "typ" (Type) Header Parameter mismatch${where}. Expected "${expected}", got ${JSON.stringify(actual)}.`;
-	return new JWTError(message, `ERR_${family}_INVALID`);
-}
-function normalizeTyp(typ) {
-	const lowered = typ.toLowerCase();
-	return lowered.includes("/") ? lowered : `application/${lowered}`;
-}
-function decodeProtectedHeader(encoded, family) {
-	let parsed = {};
-	if (encoded) {
-		try {
-			parsed = safeJsonParse(base64UrlParse(encoded));
-		} catch (error) {
-			throw new JWTError(`Invalid ${family}: Protected header could not be decoded.`, `ERR_${family}_INVALID`, error);
-		}
-		if (!isPlainObject(parsed)) throw new JWTError(`Invalid ${family}: Protected header must be a JSON object.`, `ERR_${family}_INVALID`);
-	}
-	return parsed;
-}
-function decodeSegment(encoded, options) {
-	try {
-		return base64UrlParse(encoded, { returnAs: "uint8array" });
-	} catch (error) {
-		throw new JWTError(`Invalid ${options.family}: ${options.what} could not be decoded.`, `ERR_${options.family}_INVALID`, error);
-	}
-}
-function decodeJWSPayload(payloadSegment, useB64, mode) {
-	if (!useB64) return mode === "string" ? payloadSegment : parsePayloadBytes(textEncoder.encode(payloadSegment), {
-		payload: mode,
-		family: "JWS"
-	});
-	try {
-		return parsePayloadSegment(payloadSegment, {
-			payload: mode,
-			family: "JWS"
-		});
-	} catch (error) {
-		if (error instanceof JWTError) throw error;
-		throw new JWTError("Invalid JWS: Payload could not be decoded.", "ERR_JWS_INVALID", error);
-	}
-}
-function decodeJWEPayload(plaintext, mode) {
-	return parsePayloadBytes(plaintext, {
-		payload: mode,
-		family: "JWE"
-	});
-}
-function checkAlgSupported(alg, options) {
-	const { supported, code, label, role } = options;
-	if (alg === "none") return new JWTError(`"none" is not a valid ${role}`, code);
-	if (!supported(alg)) return new JWTError(`${label} not supported: ${quoteTokenValue(alg)}`, code);
-}
-function keyServesHeaderAlg(header, key, ctx) {
-	const { alg } = header;
-	if (!alg) return false;
-	const inferred = ctx.infer(key);
-	if (inferred && !inferred.includes(alg)) return false;
-	if (!isECDHESAlgorithm(alg)) return true;
-	const epkCurve = header.epk?.crv;
-	const keyCurve = isCryptoKey(key) ? cryptoKeyCurve(key) : "crv" in key ? key.crv : void 0;
-	return !epkCurve || !keyCurve || epkCurve === keyCurve;
-}
-const RSA_SIGNATURE_ALGORITHMS = /* @__PURE__ */ new Set([
-	"RS256",
-	"RS384",
-	"RS512",
-	"PS256",
-	"PS384",
-	"PS512"
-]);
-async function generateKey(alg, options = {}) {
-	const exportToJWK = options.toJWK !== void 0 && options.toJWK;
-	const defaultExtractable = exportToJWK || options.extractable !== false;
-	const kid = exportToJWK ? assertKidOption(options.kid) : void 0;
-	if (alg === "A128CBC-HS256" || alg === "A192CBC-HS384" || alg === "A256CBC-HS512") {
-		const keyLength = bitLengthCEK(alg);
-		const keyBytes = secureRandomBytes(keyLength >> 3);
-		if (exportToJWK) {
-			const jwk = await keyToJWK(keyBytes);
-			const keyOps = options.keyUsage === void 0 ? void 0 : resolveKeyUsage(options.keyUsage, {
-				allowed: CONTENT_ENCRYPTION_USAGES,
-				fallback: ["encrypt", "decrypt"],
-				alg
-			});
-			return withGeneratedKid(kid, withKeyOps({
-				...jwk,
-				alg
-			}, keyOps));
-		}
-		return keyBytes;
-	}
-	const { algorithm, keyUsages } = getGenerateKeyParams(alg, options);
-	const key = await crypto.subtle.generateKey(algorithm, defaultExtractable, keyUsages);
-	if (exportToJWK) {
-		if (isCryptoKeyPair(key)) {
-			const pairAlg = generatedPairAlgorithm(alg);
-			const [pub, priv] = await Promise.all([exportJWK(key.publicKey), exportJWK(key.privateKey)]);
-			const publicKey = await withGeneratedKid(kid, withKeyOps(withAlg(pub, pairAlg), requestedKeyOps(options, key.publicKey)));
-			const named = publicKey.kid === void 0 ? void 0 : { kid: publicKey.kid };
-			return {
-				privateKey: {
-					...withKeyOps(withAlg(priv, pairAlg), requestedKeyOps(options, key.privateKey)),
-					...named
-				},
-				publicKey
-			};
-		}
-		return withGeneratedKid(kid, withKeyOps(withAlg(await exportJWK(key), generatedSecretAlgorithm(alg)), requestedKeyOps(options, key)));
-	}
-	return key;
-}
-async function generateJWK(alg, options) {
-	const { keyUsage, modulusLength, publicExponent, namedCurve, kid, extractable: _extractable, toJWK: _toJWK, ...jwkParams } = options ?? {};
-	assertNoReservedJWKParams(jwkParams);
-	const result = await generateKey(alg, {
-		keyUsage,
-		modulusLength,
-		publicExponent,
-		namedCurve,
-		kid,
-		toJWK: true
-	});
-	if (result && typeof result === "object" && "privateKey" in result && "publicKey" in result) return {
-		privateKey: {
-			...jwkParams,
-			...result.privateKey
-		},
-		publicKey: {
-			...jwkParams,
-			...result.publicKey
-		}
-	};
-	return {
-		...jwkParams,
-		...result
-	};
-}
-async function deriveKeyFromPassword(password, options) {
-	assertPlainObject(options, "options");
-	if (typeof password !== "string" && !(password instanceof Uint8Array)) throw new JWTError("\"password\" must be a string or a Uint8Array.", "ERR_INVALID_OPTION");
-	const { alg, salt, iterations, extractable, keyUsage } = options;
-	assertPBES2Algorithm(alg);
-	const exportToJWK = options.toJWK !== void 0 && options.toJWK;
-	const saltBytes = typeof salt === "string" ? textEncoder.encode(salt) : salt;
-	assertPBES2Salt(saltBytes, "\"salt\"");
-	assertPBES2Count(iterations, "\"iterations\"");
-	const derivedBytes = await deriveKey(saltBytes, alg, iterations, typeof password === "string" ? textEncoder.encode(password) : password);
-	const wrappingAlg = innerKeyWrapAlg(alg);
-	const finalUsages = keyUsage ?? ["wrapKey", "unwrapKey"];
-	const finalExtractable = exportToJWK ? true : extractable === true;
-	const derivedKey = await crypto.subtle.importKey("raw", derivedBytes, { name: "AES-KW" }, finalExtractable, finalUsages);
-	if (exportToJWK) return withKeyOps({
-		...await keyToJWK(derivedKey),
-		alg: wrappingAlg,
-		kty: "oct"
-	}, requestedKeyOps(options, derivedKey));
-	return derivedKey;
-}
-async function deriveJWKFromPassword(password, options) {
-	assertPlainObject(options, "options");
-	const { alg, salt, iterations, keyUsage, kid: kidOption, extractable: _extractable, toJWK: _toJWK, ...jwkParams } = options;
-	assertNoReservedJWKParams(jwkParams);
-	const kid = assertKidOption(kidOption);
-	const result = await deriveKeyFromPassword(password, {
-		alg,
-		salt,
-		iterations,
-		keyUsage,
-		toJWK: true
-	});
-	return {
-		...jwkParams,
-		...await withGeneratedKid(kid, result)
-	};
-}
-var WeakMapJWKCache = class {
-	_map = /* @__PURE__ */ new WeakMap();
-	get(jwk, alg) {
-		return this._map.get(jwk)?.[alg];
-	}
-	set(jwk, alg, key) {
-		let entry = this._map.get(jwk);
-		if (!entry) this._map.set(jwk, { [alg]: key });
-		else entry[alg] = key;
-	}
-};
-let _activeCache = new WeakMapJWKCache();
-function configureJWKCache(cache) {
-	_activeCache = cache;
-}
-function clearJWKCache() {
-	_activeCache = new WeakMapJWKCache();
-}
-async function importKey(key, algOrOptions) {
-	const alg = typeof algOrOptions === "string" ? algOrOptions : algOrOptions?.alg ?? void 0;
-	const expect = typeof algOrOptions === "object" ? algOrOptions.expect ?? void 0 : void 0;
-	const extractable = typeof algOrOptions === "object" && !algOrOptions.asCryptoKey ? algOrOptions.extractable : void 0;
-	if (typeof key === "string") throw stringKeyError();
-	if (key instanceof Uint8Array) return key;
-	if (isCryptoKey(key)) {
-		assertIntentOnCryptoKey(key, expect);
-		return key;
-	}
-	if (isJWK(key)) {
-		assertJWKAlgAuthority(key, alg);
-		if ("k" in key && typeof key.k === "string") {
-			const rawBytes = decodeSegment(key.k, {
-				family: "JWK",
-				what: "\"k\""
-			});
-			assertOctKeyLength(rawBytes, alg ?? key.alg);
-			if (typeof algOrOptions === "object" && algOrOptions.asCryptoKey) {
-				const { algorithm, usage, extractable: rawExtractable = false } = algOrOptions;
-				if (!algorithm || !usage) throw new JWTError("asCryptoKey option requires `algorithm` and `usage` to be provided.", "ERR_JWK_INVALID");
-				if (typeof algorithm === "object" && algorithm.name === "HMAC") {
-					const hash = "hash" in algorithm ? algorithm.hash : void 0;
-					const hashName = typeof hash === "string" ? hash : typeof hash === "object" && hash !== null && "name" in hash && typeof hash.name === "string" ? hash.name : void 0;
-					const minBytes = Number.parseInt(hashName?.slice(-3) ?? "", 10) / 8;
-					if (minBytes && rawBytes.length < minBytes) throw new JWTError(`HMAC with ${hashName} requires a key of at least ${minBytes} bytes (got ${rawBytes.length})`, "ERR_JWK_INVALID");
-				}
-				return crypto.subtle.importKey("raw", rawBytes, algorithm, rawExtractable, usage);
-			}
-			return rawBytes;
-		} else {
-			const effectiveAlg = key.alg || alg;
-			if (!effectiveAlg) throw new JWTError("Algorithm must be provided when importing non-oct JWK", "ERR_JWK_INVALID");
-			assertIntentOnJWK(key, expect);
-			const cache = extractable === void 0 ? _activeCache : false;
-			if (cache) {
-				const cached = await cache.get(key, effectiveAlg);
-				if (cached) return cached;
-			}
-			const cryptoKey = await jwkTokey(key, {
-				extractable,
-				alg
-			});
-			if (cache) await cache.set(key, effectiveAlg, cryptoKey);
-			return cryptoKey;
-		}
-	}
-	throw new JWTError("Invalid key type provided to importKey", "ERR_JWK_INVALID");
-}
-function assertJWKAlgAuthority(jwk, alg) {
-	if (!alg || !jwk.alg || jwk.alg === alg) return;
-	if (jwk.kty === "oct" && alg === "dir" && isContentEncryptionAlgorithm(jwk.alg)) return;
-	if (isEd25519Signature(jwk.alg) && isEd25519Signature(alg)) return;
-	throw new JWTError(`JWK "alg" is "${jwk.alg}" but the operation requires "${alg}".`, "ERR_JWK_INVALID");
-}
-function assertIntentOnJWK(jwk, expect) {
-	if (expect === void 0 || jwk.kty === "oct") return;
-	const hasPrivateScalar = "d" in jwk && typeof jwk.d === "string";
-	if (expect === "public" && hasPrivateScalar) throw new JWTError("Private JWK passed where a public key is expected.", "ERR_JWK_INVALID");
-	if (expect === "private" && !hasPrivateScalar) throw new JWTError("Public JWK passed where a private key is expected.", "ERR_JWK_INVALID");
-}
-function assertIntentOnCryptoKey(key, expect) {
-	if (expect === void 0 || key.type === "secret") return;
-	if (expect === "public" && key.type === "private") throw new JWTError("Private CryptoKey passed where a public key is expected.", "ERR_JWK_INVALID");
-	if (expect === "private" && key.type === "public") throw new JWTError("Public CryptoKey passed where a private key is expected.", "ERR_JWK_INVALID");
-}
-async function exportJWK(key, jwkParams) {
-	if (!isCryptoKey(key)) throw new JWTError(`exportJWK expects a CryptoKey, got ${key === null ? "null" : typeof key}.`, "ERR_INVALID_OPTION");
-	if (!key.extractable) throw new JWTError("A non-extractable CryptoKey cannot be exported as a JWK.", "ERR_JWK_INVALID");
-	const exportedJwk = await keyToJWK(key);
-	if (jwkParams) {
-		const extraParams = sanitizeObjectCopy(jwkParams);
-		assertNoReservedJWKParams(extraParams);
-		return {
-			...exportedJwk,
-			...extraParams
-		};
-	}
-	return exportedJwk;
-}
-async function exportKey(key, jwkParams) {
-	return exportJWK(key, jwkParams);
-}
-function toPublicJWK(jwk) {
-	if (!isAsymmetricJWK(jwk)) throw new JWTError(isJWK(jwk) ? "An oct JWK has no public half." : "toPublicJWK expects an asymmetric JWK.", "ERR_JWK_INVALID");
-	const { d: _d, p: _p, q: _q, dp: _dp, dq: _dq, qi: _qi, oth: _oth, key_ops, ...publicMembers } = sanitizeObjectCopy({ ...jwk });
-	const publicKey = key_ops === void 0 ? publicMembers : {
-		...publicMembers,
-		key_ops: publicKeyOps(key_ops)
-	};
-	if (!isPublicJWK(publicKey)) throw new JWTError(`${jwk.kty} JWK lacks the public members of its key type.`, "ERR_JWK_INVALID");
-	return publicKey;
-}
-async function wrapKey(keyToWrap, wrappingKey, options) {
-	assertPlainObject(options, "options");
-	assertKeyBytesArg(keyToWrap, "keyToWrap");
-	const { alg } = options;
-	const cekBytes = keyToWrap instanceof Uint8Array ? keyToWrap : new Uint8Array(await crypto.subtle.exportKey("raw", keyToWrap));
-	if (alg.endsWith("KW")) assertWrappableCEK(cekBytes, alg);
-	if (alg.startsWith("PBES2")) assertPBES2Params({
-		p2s: options.p2s,
-		p2c: options.p2c
-	});
-	const importedWrappingKey = await importKey(resolvePasswordKey(alg, wrappingKey), {
-		alg,
-		expect: "public"
-	});
-	switch (alg) {
-		case "dir": return { encryptedKey: /* @__PURE__ */ new Uint8Array(0) };
-		case "A128KW":
-		case "A192KW":
-		case "A256KW": return { encryptedKey: await aesKwWrap(alg, importedWrappingKey, cekBytes) };
-		case "PBES2-HS256+A128KW":
-		case "PBES2-HS384+A192KW":
-		case "PBES2-HS512+A256KW": {
-			const { p2s, p2c } = options;
-			if (!p2s || typeof p2c !== "number") throw new JWTError("PBES2 requires 'p2s' (salt) and 'p2c' (count) options", "ERR_JWE_INVALID");
-			return pbes2Wrap(alg, importedWrappingKey, cekBytes, p2c, p2s);
-		}
-		case "A128GCMKW":
-		case "A192GCMKW":
-		case "A256GCMKW": {
-			const { encryptedKey, iv, tag } = await gcmkwEncrypt(alg, importedWrappingKey, cekBytes, options.iv);
-			return {
-				encryptedKey,
-				iv,
-				tag
-			};
-		}
-		case "RSA-OAEP":
-		case "RSA-OAEP-256":
-		case "RSA-OAEP-384":
-		case "RSA-OAEP-512":
-			assertCryptoKeyFor(alg, importedWrappingKey, "wrapping");
-			return { encryptedKey: await encryptRSAES(alg, importedWrappingKey, cekBytes) };
-		case "ECDH-ES":
-		case "ECDH-ES+A128KW":
-		case "ECDH-ES+A192KW":
-		case "ECDH-ES+A256KW": {
-			assertCryptoKeyFor(alg, importedWrappingKey, "wrapping");
-			const enc = options.ecdh?.enc;
-			if (enc !== void 0) assertJWEEncSupported(enc);
-			if (alg === "ECDH-ES" && !enc) throw new JWTError("ECDH-ES direct key agreement requires options.ecdh.enc (the target content encryption algorithm)", "ERR_JWK_INVALID");
-			const { encryptedKey, parameters } = await ecdhesWrap(alg, {
-				enc,
-				recipientKey: importedWrappingKey,
-				cek: cekBytes,
-				parameters: buildECDHAgreementParams(options.ecdh)
-			});
-			const wrapResult = {
-				encryptedKey: encryptedKey ?? /* @__PURE__ */ new Uint8Array(0),
-				epk: parameters.epk
-			};
-			if (parameters.apu) wrapResult.apu = parameters.apu;
-			if (parameters.apv) wrapResult.apv = parameters.apv;
-			return wrapResult;
-		}
-		default: throw new JWTError(`Unsupported key wrapping algorithm: ${alg}`, "ERR_JWK_UNSUPPORTED");
-	}
-}
-async function unwrapKey(wrappedKey, unwrappingKey, options) {
-	assertPlainObject(options, "options");
-	if (!(wrappedKey instanceof Uint8Array)) throw new JWTError("\"wrappedKey\" must be a Uint8Array.", "ERR_INVALID_OPTION");
-	const { alg } = options;
-	const returnRaw = options.format === "raw";
-	const defaultExtractable = options.extractable !== false;
-	const importedUnwrappingKey = await importKey(resolvePasswordKey(alg, unwrappingKey), {
-		alg,
-		expect: "private"
-	});
-	let unwrappedCekBytes;
-	switch (alg) {
-		case "dir":
-			assertDirectKeyRole(unwrappingKey, options.enc);
-			if (importedUnwrappingKey instanceof Uint8Array) {
-				assertOctKeyLength(importedUnwrappingKey, options.enc);
-				unwrappedCekBytes = importedUnwrappingKey;
-			} else {
-				if (!returnRaw) return importedUnwrappingKey;
-				unwrappedCekBytes = new Uint8Array(await crypto.subtle.exportKey("raw", importedUnwrappingKey));
-			}
-			break;
-		case "A128KW":
-		case "A192KW":
-		case "A256KW":
-			unwrappedCekBytes = await unwrapping(aesKwUnwrap(alg, importedUnwrappingKey, wrappedKey));
-			break;
-		case "PBES2-HS256+A128KW":
-		case "PBES2-HS384+A192KW":
-		case "PBES2-HS512+A256KW": {
-			const { p2s, p2c, minIterations, maxIterations } = options;
-			if (!p2s || typeof p2c !== "number") throw new JWTError("PBES2 requires 'p2s' (salt) and 'p2c' (count) options", "ERR_JWE_INVALID");
-			unwrappedCekBytes = await unwrapping(pbes2Unwrap(alg, importedUnwrappingKey, wrappedKey, p2c, segmentBytes(p2s, "p2s"), minIterations, maxIterations));
-			break;
-		}
-		case "A128GCMKW":
-		case "A192GCMKW":
-		case "A256GCMKW": {
-			if (!options.iv || !options.tag) throw new JWTError("AES-GCMKW requires 'iv' and 'tag' options for unwrapping", "ERR_JWE_INVALID");
-			const ivBytes = segmentBytes(options.iv, "iv");
-			const tagBytes = segmentBytes(options.tag, "tag");
-			assertKeyWrapSegmentLength("iv", ivBytes, bitLengthIV(alg) >> 3, alg);
-			assertKeyWrapSegmentLength("tag", tagBytes, bitLengthTag(alg) >> 3, alg);
-			unwrappedCekBytes = await unwrapping(gcmkwDecrypt(alg, importedUnwrappingKey, wrappedKey, ivBytes, tagBytes));
-			break;
-		}
-		case "RSA-OAEP":
-		case "RSA-OAEP-256":
-		case "RSA-OAEP-384":
-		case "RSA-OAEP-512": {
-			assertCryptoKeyFor(alg, importedUnwrappingKey, "unwrapping");
-			unwrappedCekBytes = await unwrapping(decryptRSAES(alg, importedUnwrappingKey, wrappedKey));
-			if (returnRaw) break;
-			const inferredAlgorithm = options.unwrappedKeyAlgorithm || inferAesImportAlgorithm(options.enc, unwrappedCekBytes.length);
-			if (!inferredAlgorithm) throw new JWTError("Unable to infer algorithm for RSA-OAEP unwrapped key. Provide \"unwrappedKeyAlgorithm\" in options.", "ERR_JWE_INVALID");
-			const keyUsages = options.keyUsage || ["encrypt", "decrypt"];
-			return await crypto.subtle.importKey("raw", unwrappedCekBytes, inferredAlgorithm, defaultExtractable, keyUsages);
-		}
-		case "ECDH-ES":
-		case "ECDH-ES+A128KW":
-		case "ECDH-ES+A192KW":
-		case "ECDH-ES+A256KW": {
-			if (!options.epk) throw new JWTError("ECDH-ES requires 'epk' (Ephemeral Public Key) option", "ERR_JWE_INVALID");
-			assertCryptoKeyFor(alg, importedUnwrappingKey, "unwrapping");
-			assertECDHKeyAllowed(importedUnwrappingKey);
-			const epkCandidate = await normalizeEpk(options.epk, {
-				alg,
-				recipientKey: importedUnwrappingKey
-			});
-			const apuBytes = segmentBytes(options.apu ?? /* @__PURE__ */ new Uint8Array(0), "apu");
-			const apvBytes = segmentBytes(options.apv ?? /* @__PURE__ */ new Uint8Array(0), "apv");
-			assertPartyInfoLength("apu", apuBytes);
-			assertPartyInfoLength("apv", apvBytes);
-			if (options.enc !== void 0) assertJWEEncSupported(options.enc);
-			const infoAlg = alg === "ECDH-ES" ? options.enc : alg;
-			if (!infoAlg) throw new JWTError("ECDH-ES requires content encryption algorithm ('enc') to derive the shared secret", "ERR_JWE_INVALID");
-			const sharedSecret = await unwrapping(deriveECDHESKey(epkCandidate, importedUnwrappingKey, infoAlg, ecdhDerivedBits(alg, options.enc), apuBytes, apvBytes));
-			if (alg === "ECDH-ES") unwrappedCekBytes = sharedSecret;
-			else {
-				const kwAlg = innerKeyWrapAlg(alg);
-				if (!(wrappedKey instanceof Uint8Array) || wrappedKey.length === 0) throw new JWTError("ECDH-ES key agreement with key wrapping requires an encrypted key", "ERR_JWE_INVALID");
-				unwrappedCekBytes = await unwrapping(aesKwUnwrap(kwAlg, sharedSecret, wrappedKey));
-			}
-			break;
-		}
-		default: throw new JWTError(`Unsupported key unwrapping algorithm: ${alg}`, "ERR_JWK_UNSUPPORTED");
-	}
-	if (returnRaw) return unwrappedCekBytes;
-	return await crypto.subtle.importKey("raw", unwrappedCekBytes, options.unwrappedKeyAlgorithm || { name: "AES-GCM" }, defaultExtractable, options.keyUsage || ["encrypt", "decrypt"]);
-}
-async function importPEM(pem, alg, options) {
-	if (typeof pem !== "string") throw new JWTError(`"pem" must be a PEM-encoded string, got ${pem === null ? "null" : typeof pem}.`, "ERR_INVALID_OPTION");
-	if (options !== void 0) assertPlainObject(options, "options");
-	const extractable = true;
-	const pemType = options?.pemType ?? inferPEMType(pem);
-	if (!pemType) throw new JWTError("Cannot infer PEM type from the input; pass \"options.pemType\" explicitly.", "ERR_JWK_INVALID");
-	let cryptoKey;
-	switch (pemType) {
-		case "pkcs8":
-			cryptoKey = await fromPKCS8(pem, alg, { extractable });
-			break;
-		case "spki":
-			cryptoKey = await fromSPKI(pem, alg, { extractable });
-			break;
-		case "x509":
-			cryptoKey = await fromX509(pem, alg, { extractable });
-			break;
-		default: throw new JWTError(`Unsupported PEM type: ${String(pemType)}`, "ERR_JWK_UNSUPPORTED");
-	}
-	return {
-		...await exportJWK(cryptoKey, options?.jwkParams),
-		alg
-	};
-}
-async function exportPEM(jwk, options) {
-	assertPlainObject(jwk, "jwk");
-	if (options !== void 0) assertPlainObject(options, "options");
-	if (jwk.kty === "oct") throw new JWTError("Octet (symmetric) JWKs (kty: 'oct') cannot be exported to PKCS8 or SPKI PEM formats.", "ERR_JWK_UNSUPPORTED");
-	const effectiveAlg = jwk.alg || options?.alg;
-	if (!effectiveAlg && (jwk.kty === "RSA" || jwk.kty === "EC" || jwk.kty === "OKP")) throw new JWTError("Algorithm (alg) must be provided in the JWK or via options for converting this JWK type to a CryptoKey.", "ERR_JWK_INVALID");
-	if (effectiveAlg !== void 0 && !PEM_ALGORITHMS.has(effectiveAlg)) throw new JWTError(`Unsupported PEM algorithm: ${effectiveAlg}`, "ERR_JWK_UNSUPPORTED");
-	const pemFormat = options?.pemFormat ?? ("d" in jwk ? "pkcs8" : "spki");
-	const cryptoKeyCandidate = await importKey({
-		...jwk,
-		ext: true
-	}, {
-		alg: effectiveAlg,
-		expect: pemFormat === "pkcs8" ? "private" : "public",
-		extractable: true
-	});
-	if (!isCryptoKey(cryptoKeyCandidate)) throw new JWTError("Failed to convert JWK to a CryptoKey instance suitable for PEM export.", "ERR_JWK_INVALID");
-	const cryptoKey = cryptoKeyCandidate;
-	switch (pemFormat) {
-		case "pkcs8":
-			if (cryptoKey.type !== "private") throw new JWTError(`Only 'private' type CryptoKeys can be exported to PKCS8 PEM format. Key type is '${cryptoKey.type}'.`, "ERR_JWK_INVALID");
-			return toPKCS8(cryptoKey);
-		case "spki":
-			if (cryptoKey.type !== "public") throw new JWTError(`Only 'public' type CryptoKeys can be exported to SPKI PEM format. Key type is '${cryptoKey.type}'.`, "ERR_JWK_INVALID");
-			return toSPKI(cryptoKey);
-		default: throw new JWTError(`Unsupported PEM format: ${String(pemFormat)}`, "ERR_JWK_UNSUPPORTED");
-	}
-}
-function inferPEMType(pem) {
-	if (pem.includes("-----BEGIN PRIVATE KEY-----")) return "pkcs8";
-	if (pem.includes("-----BEGIN PUBLIC KEY-----")) return "spki";
-	if (pem.includes("-----BEGIN CERTIFICATE-----")) return "x509";
-}
-async function deriveSharedSecret(publicKey, privateKey, options) {
-	assertPlainObject(options, "options");
-	const { enc: alg, keyLength: requestedKeyLength, partyUInfo, partyVInfo } = options;
-	if (!isECDHESAlgorithm(alg)) assertJWEEncSupported(alg);
-	if (requestedKeyLength !== void 0) assertDerivedKeyLength(requestedKeyLength);
-	const importAlg = isECDHESAlgorithm(alg) ? alg : "ECDH-ES";
-	const pubCryptoKey = isCryptoKey(publicKey) ? publicKey : await importKey(publicKey, {
-		alg: importAlg,
-		expect: "public"
-	});
-	const privCryptoKey = isCryptoKey(privateKey) ? privateKey : await importKey(privateKey, {
-		alg: importAlg,
-		expect: "private"
-	});
-	let keyLength;
-	if (requestedKeyLength !== void 0) keyLength = requestedKeyLength;
-	else if (alg === "ECDH-ES") throw new JWTError("deriveSharedSecret with enc \"ECDH-ES\" requires an explicit keyLength in options", "ERR_JWK_INVALID");
-	else if (isECDHESAlgorithm(alg)) keyLength = aesBitsOf(innerKeyWrapAlg(alg));
-	else keyLength = bitLengthCEK(alg);
-	return deriveECDHESKey(pubCryptoKey, privCryptoKey, alg, keyLength, partyUInfo ?? /* @__PURE__ */ new Uint8Array(0), partyVInfo ?? /* @__PURE__ */ new Uint8Array(0));
-}
-function getJWKsFromSet(jwkSet, filter) {
-	if (!jwkSet || !isJWKSet(jwkSet)) throw new JWTError("Invalid JWK Set provided", "ERR_JWK_INVALID");
-	const keys = jwkSet.keys.filter((key) => isJWK(key));
-	return filter ? keys.filter(filter) : keys;
-}
+import { secureRandomBytes, textEncoder } from "./libs/unsecure.mjs";
+import { JWTError } from "../error.mjs";
+import { assertPlainObject, isCryptoKey, isCryptoKeyPair } from "./jwt.mjs";
+import { assertJWEEncSupported, assertPBES2Count, assertPBES2Salt, bitLengthCEK, deriveECDHESKey, deriveKey, fromPKCS8, fromSPKI, fromX509, importKey, keyToJWK, toPKCS8, toSPKI } from "./algorithms.mjs";
+import { ECDSA_CURVES, PBES2_ALGORITHMS, aesBitsOf, innerKeyWrapAlg, isECDHESAlgorithm, jwsHashOf, rsaOaepHashOf } from "./digest.mjs";
+import "./wrap.mjs";
+import { assertKidOption, assertNoReservedJWKParams, exportJWK, requestedKeyOps, withGeneratedKid, withKeyOps } from "./export.mjs";
 function getGenerateKeyParams(alg, options) {
 	let algorithm;
 	let keyUsages;
@@ -2213,7 +108,7 @@ function getGenerateKeyParams(alg, options) {
 		case "EdDSA": {
 			keyUsages = pairUsage(SIGNATURE_USAGES, ["sign", "verify"]);
 			const namedCurve = options?.namedCurve ?? "Ed25519";
-			if (namedCurve !== "Ed25519") throw new JWTError("Unsupported namedCurve provided. Supported values are: Ed25519", "ERR_JWK_UNSUPPORTED");
+			if (namedCurve !== "Ed25519") throw new JWTError("Unsupported namedCurve, expected Ed25519", "ERR_JWK_UNSUPPORTED");
 			algorithm = { name: namedCurve };
 			break;
 		}
@@ -2235,7 +130,7 @@ function getGenerateKeyParams(alg, options) {
 				case "X25519":
 					algorithm = { name: "X25519" };
 					break;
-				default: throw new JWTError("Unsupported namedCurve provided. Supported values are: P-256, P-384, P-521 and X25519", "ERR_JWK_UNSUPPORTED");
+				default: throw new JWTError("Unsupported namedCurve, expected P-256, P-384, P-521 or X25519", "ERR_JWK_UNSUPPORTED");
 			}
 			break;
 		}
@@ -2246,43 +141,6 @@ function getGenerateKeyParams(alg, options) {
 		keyUsages
 	};
 }
-function inferAesImportAlgorithm(enc, cekLengthBytes) {
-	const bitLength = cekLengthBytes << 3;
-	if (enc) {
-		if (enc.includes("GCM")) return {
-			name: "AES-GCM",
-			length: aesBitsOf(enc)
-		};
-		if (enc.includes("CBC-HS")) return;
-	}
-	if (bitLength === 128 || bitLength === 192 || bitLength === 256) return {
-		name: "AES-GCM",
-		length: bitLength
-	};
-}
-const RESERVED_JWK_PARAMS = /* @__PURE__ */ new Set([
-	"kty",
-	"alg",
-	"key_ops",
-	"ext",
-	"k",
-	"d",
-	"n",
-	"e",
-	"p",
-	"q",
-	"dp",
-	"dq",
-	"qi",
-	"oth",
-	"x",
-	"y",
-	"crv"
-]);
-function assertNoReservedJWKParams(jwkParams) {
-	const reserved = Object.keys(jwkParams).filter((name) => RESERVED_JWK_PARAMS.has(name));
-	if (reserved.length > 0) throw new JWTError(`jwkParams must not set reserved JWK members: ${reserved.join(", ")}`, "ERR_INVALID_OPTION");
-}
 function assertNamedCurve(requested, expected, alg) {
 	if (requested === void 0 || requested === expected) return;
 	throw new JWTError(`"namedCurve" ${requested} contradicts ${alg}, which is defined over ${expected}.`, "ERR_INVALID_OPTION");
@@ -2311,7 +169,7 @@ function resolveKeyUsage(requested, options) {
 	if (requested === void 0) return fallback;
 	if (!Array.isArray(requested) || requested.length === 0) throw new JWTError("\"keyUsage\" must be a non-empty array.", "ERR_INVALID_OPTION");
 	const rejected = requested.filter((entry) => !allowed.includes(entry));
-	if (rejected.length > 0) throw new JWTError(`"keyUsage" ${rejected.join(", ")} cannot be served by ${alg}; it admits ${allowed.join(", ")}.`, "ERR_INVALID_OPTION");
+	if (rejected.length > 0) throw new JWTError(`"keyUsage" ${rejected.join(", ")} cannot be served by ${alg}, use ${allowed.join(", ")}.`, "ERR_INVALID_OPTION");
 	return requested;
 }
 const PRIVATE_KEY_USAGES = [
@@ -2331,21 +189,197 @@ function assertPairUsages(usages, options) {
 	for (const [half, side] of [[PRIVATE_KEY_USAGES, "private"], [PUBLIC_KEY_USAGES, "public"]]) {
 		const wanted = fallback.filter((entry) => half.includes(entry));
 		if (wanted.length === 0 || usages.some((entry) => half.includes(entry))) continue;
-		throw new JWTError(`"keyUsage" leaves the ${side} half of a ${alg} key pair with no usage; include one of ${wanted.join(", ")}.`, "ERR_INVALID_OPTION");
+		throw new JWTError(`"keyUsage" leaves the ${side} half of a ${alg} key pair unusable, add ${wanted.join(" or ")}.`, "ERR_INVALID_OPTION");
 	}
 	return usages;
 }
-function assertKidOption(kid) {
-	if (kid === void 0 || kid === false || typeof kid === "string") return kid;
-	throw new JWTError("\"kid\" must be a string or false.", "ERR_INVALID_OPTION");
+function assertModulusLength(modulusLength) {
+	const length = modulusLength ?? 2048;
+	if (!Number.isInteger(length) || length < 2048) throw new JWTError("modulusLength must be at least 2048 bits", "ERR_INVALID_OPTION");
+	return length;
 }
-async function withGeneratedKid(kid, jwk) {
-	if (kid === false) return jwk;
+function withAlg(jwk, alg) {
 	return {
 		...jwk,
-		kid: kid ?? await thumbprint(jwk)
+		alg
+	};
+}
+function generatedPairAlgorithm(alg) {
+	return alg;
+}
+function generatedSecretAlgorithm(alg) {
+	return alg;
+}
+async function generateKey(alg, options = {}) {
+	const exportToJWK = options.toJWK !== void 0 && options.toJWK;
+	const defaultExtractable = exportToJWK || options.extractable !== false;
+	const kid = exportToJWK ? assertKidOption(options.kid) : void 0;
+	if (alg === "A128CBC-HS256" || alg === "A192CBC-HS384" || alg === "A256CBC-HS512") {
+		const keyLength = bitLengthCEK(alg);
+		const keyBytes = secureRandomBytes(keyLength >> 3);
+		if (exportToJWK) {
+			const jwk = await keyToJWK(keyBytes);
+			const keyOps = options.keyUsage === void 0 ? void 0 : resolveKeyUsage(options.keyUsage, {
+				allowed: CONTENT_ENCRYPTION_USAGES,
+				fallback: ["encrypt", "decrypt"],
+				alg
+			});
+			return withGeneratedKid(kid, withKeyOps({
+				...jwk,
+				alg
+			}, keyOps));
+		}
+		return keyBytes;
+	}
+	const { algorithm, keyUsages } = getGenerateKeyParams(alg, options);
+	const key = await crypto.subtle.generateKey(algorithm, defaultExtractable, keyUsages);
+	if (exportToJWK) {
+		if (isCryptoKeyPair(key)) {
+			const pairAlg = generatedPairAlgorithm(alg);
+			const [pub, priv] = await Promise.all([exportJWK(key.publicKey), exportJWK(key.privateKey)]);
+			const publicKey = await withGeneratedKid(kid, withKeyOps(withAlg(pub, pairAlg), requestedKeyOps(options, key.publicKey)));
+			const named = publicKey.kid === void 0 ? void 0 : { kid: publicKey.kid };
+			return {
+				privateKey: {
+					...withKeyOps(withAlg(priv, pairAlg), requestedKeyOps(options, key.privateKey)),
+					...named
+				},
+				publicKey
+			};
+		}
+		return withGeneratedKid(kid, withKeyOps(withAlg(await exportJWK(key), generatedSecretAlgorithm(alg)), requestedKeyOps(options, key)));
+	}
+	return key;
+}
+async function generateJWK(alg, options) {
+	const { keyUsage, modulusLength, publicExponent, namedCurve, kid, extractable: _extractable, toJWK: _toJWK, ...jwkParams } = options ?? {};
+	assertNoReservedJWKParams(jwkParams);
+	const result = await generateKey(alg, {
+		keyUsage,
+		modulusLength,
+		publicExponent,
+		namedCurve,
+		kid,
+		toJWK: true
+	});
+	if (result && typeof result === "object" && "privateKey" in result && "publicKey" in result) return {
+		privateKey: {
+			...jwkParams,
+			...result.privateKey
+		},
+		publicKey: {
+			...jwkParams,
+			...result.publicKey
+		}
+	};
+	return {
+		...jwkParams,
+		...result
+	};
+}
+async function deriveKeyFromPassword(password, options) {
+	assertPlainObject(options, "options");
+	if (typeof password !== "string" && !(password instanceof Uint8Array)) throw new JWTError("\"password\" must be a string or a Uint8Array.", "ERR_INVALID_OPTION");
+	const { alg, salt, iterations, extractable, keyUsage } = options;
+	assertPBES2Algorithm(alg);
+	const exportToJWK = options.toJWK !== void 0 && options.toJWK;
+	const saltBytes = typeof salt === "string" ? textEncoder.encode(salt) : salt;
+	assertPBES2Salt(saltBytes, "\"salt\"");
+	assertPBES2Count(iterations, "\"iterations\"");
+	const passwordBytes = typeof password === "string" ? textEncoder.encode(password) : password;
+	const derivedBytes = await deriveKey(saltBytes, alg, iterations, passwordBytes);
+	const wrappingAlg = innerKeyWrapAlg(alg);
+	const finalUsages = keyUsage ?? ["wrapKey", "unwrapKey"];
+	const finalExtractable = exportToJWK ? true : extractable === true;
+	const derivedKey = await crypto.subtle.importKey("raw", derivedBytes, { name: "AES-KW" }, finalExtractable, finalUsages);
+	if (exportToJWK) {
+		const jwk = await keyToJWK(derivedKey);
+		return withKeyOps({
+			...jwk,
+			alg: wrappingAlg,
+			kty: "oct"
+		}, requestedKeyOps(options, derivedKey));
+	}
+	return derivedKey;
+}
+async function deriveJWKFromPassword(password, options) {
+	assertPlainObject(options, "options");
+	const { alg, salt, iterations, keyUsage, kid: kidOption, extractable: _extractable, toJWK: _toJWK, ...jwkParams } = options;
+	assertNoReservedJWKParams(jwkParams);
+	const kid = assertKidOption(kidOption);
+	const result = await deriveKeyFromPassword(password, {
+		alg,
+		salt,
+		iterations,
+		keyUsage,
+		toJWK: true
+	});
+	return {
+		...jwkParams,
+		...await withGeneratedKid(kid, result)
+	};
+}
+function assertPBES2Algorithm(alg) {
+	if (typeof alg === "string" && PBES2_ALGORITHMS.includes(alg)) return;
+	throw new JWTError(`Password derivation is defined for ${PBES2_ALGORITHMS.join(", ")}, not ${String(alg)}.`, "ERR_JWK_UNSUPPORTED");
+}
+async function importPEM(pem, alg, options) {
+	if (typeof pem !== "string") throw new JWTError("\"pem\" must be a PEM-encoded string.", "ERR_INVALID_OPTION");
+	if (options !== void 0) assertPlainObject(options, "options");
+	const extractable = true;
+	const pemType = options?.pemType ?? inferPEMType(pem);
+	if (!pemType) throw new JWTError("Cannot infer PEM type from the input, pass \"pemType\".", "ERR_JWK_INVALID");
+	let cryptoKey;
+	switch (pemType) {
+		case "pkcs8":
+			cryptoKey = await fromPKCS8(pem, alg, { extractable });
+			break;
+		case "spki":
+			cryptoKey = await fromSPKI(pem, alg, { extractable });
+			break;
+		case "x509":
+			cryptoKey = await fromX509(pem, alg, { extractable });
+			break;
+		default: throw new JWTError(`Unsupported PEM type: ${String(pemType)}`, "ERR_JWK_UNSUPPORTED");
+	}
+	return {
+		...await exportJWK(cryptoKey, options?.jwkParams),
+		alg
 	};
 }
+async function exportPEM(jwk, options) {
+	assertPlainObject(jwk, "jwk");
+	if (options !== void 0) assertPlainObject(options, "options");
+	if (jwk.kty === "oct") throw new JWTError("An oct JWK cannot be exported to PKCS8 or SPKI PEM.", "ERR_JWK_UNSUPPORTED");
+	const effectiveAlg = jwk.alg || options?.alg;
+	if (!effectiveAlg && (jwk.kty === "RSA" || jwk.kty === "EC" || jwk.kty === "OKP")) throw new JWTError("\"alg\" is required, set it on the JWK or pass it in options.", "ERR_JWK_INVALID");
+	if (effectiveAlg !== void 0 && !PEM_ALGORITHMS.has(effectiveAlg)) throw new JWTError(`Unsupported PEM algorithm: ${effectiveAlg}`, "ERR_JWK_UNSUPPORTED");
+	const pemFormat = options?.pemFormat ?? ("d" in jwk ? "pkcs8" : "spki");
+	const cryptoKeyCandidate = await importKey({
+		...jwk,
+		ext: true
+	}, {
+		alg: effectiveAlg,
+		expect: pemFormat === "pkcs8" ? "private" : "public",
+		extractable: true
+	});
+	if (!isCryptoKey(cryptoKeyCandidate)) throw new JWTError("Failed to convert JWK to a CryptoKey instance suitable for PEM export.", "ERR_JWK_INVALID");
+	const cryptoKey = cryptoKeyCandidate;
+	switch (pemFormat) {
+		case "pkcs8":
+			if (cryptoKey.type !== "private") throw new JWTError(`Only a private CryptoKey can be exported to PKCS8 PEM (got ${cryptoKey.type}).`, "ERR_JWK_INVALID");
+			return toPKCS8(cryptoKey);
+		case "spki":
+			if (cryptoKey.type !== "public") throw new JWTError(`Only a public CryptoKey can be exported to SPKI PEM (got ${cryptoKey.type}).`, "ERR_JWK_INVALID");
+			return toSPKI(cryptoKey);
+		default: throw new JWTError(`Unsupported PEM format: ${String(pemFormat)}`, "ERR_JWK_UNSUPPORTED");
+	}
+}
+function inferPEMType(pem) {
+	if (pem.includes("-----BEGIN PRIVATE KEY-----")) return "pkcs8";
+	if (pem.includes("-----BEGIN PUBLIC KEY-----")) return "spki";
+	if (pem.includes("-----BEGIN CERTIFICATE-----")) return "x509";
+}
 const PEM_ALGORITHMS = /* @__PURE__ */ new Set(Object.keys({
 	"PS256": true,
 	"PS384": true,
@@ -2367,85 +401,28 @@ const PEM_ALGORITHMS = /* @__PURE__ */ new Set(Object.keys({
 	"Ed25519": true,
 	"EdDSA": true
 }));
-function assertWrappableCEK(cek, alg) {
-	if (cek.length >= 16 && cek.length % 8 === 0) return;
-	throw new JWTError(`${alg} wraps a key of 16 or more bytes in whole 8-byte blocks (got ${cek.length}).`, "ERR_INVALID_OPTION");
-}
-async function unwrapping(operation) {
-	try {
-		return await operation;
-	} catch (error) {
-		throw asDecryptionError(error);
-	}
-}
-function assertPBES2Algorithm(alg) {
-	if (typeof alg === "string" && PBES2_ALGORITHMS.includes(alg)) return;
-	throw new JWTError(`Password derivation is defined for ${PBES2_ALGORITHMS.join(", ")}, not ${String(alg)}.`, "ERR_JWK_UNSUPPORTED");
-}
-function assertKeyBytesArg(value, name) {
-	if (value instanceof Uint8Array || isCryptoKey(value)) return;
-	throw new JWTError(`"${name}" must be a Uint8Array or a CryptoKey, got ${value === null ? "null" : typeof value}.`, "ERR_INVALID_OPTION");
-}
-function assertModulusLength(modulusLength) {
-	const length = modulusLength ?? 2048;
-	if (!Number.isInteger(length) || length < 2048) throw new JWTError("modulusLength must be at least 2048 bits (RFC 7518 §3.3)", "ERR_INVALID_OPTION");
-	return length;
-}
-function assertPartyInfoLength(name, bytes) {
-	if (bytes.length > 1024) throw new JWTError(`Invalid JWE: "${name}" must not exceed ${MAX_PARTY_INFO_BYTES} bytes (got ${bytes.length}).`, "ERR_JWE_INVALID");
-}
-function assertKeyWrapSegmentLength(name, bytes, expected, alg) {
-	if (bytes.length !== expected) throw new JWTError(`Invalid JWE: "${name}" must be ${expected} bytes for ${alg} (got ${bytes.length}).`, "ERR_JWE_INVALID");
+async function deriveSharedSecret(publicKey, privateKey, options) {
+	assertPlainObject(options, "options");
+	const { enc: alg, keyLength: requestedKeyLength, partyUInfo, partyVInfo } = options;
+	if (!isECDHESAlgorithm(alg)) assertJWEEncSupported(alg);
+	if (requestedKeyLength !== void 0) assertDerivedKeyLength(requestedKeyLength);
+	const importAlg = isECDHESAlgorithm(alg) ? alg : "ECDH-ES";
+	const pubCryptoKey = isCryptoKey(publicKey) ? publicKey : await importKey(publicKey, {
+		alg: importAlg,
+		expect: "public"
+	});
+	const privCryptoKey = isCryptoKey(privateKey) ? privateKey : await importKey(privateKey, {
+		alg: importAlg,
+		expect: "private"
+	});
+	let keyLength;
+	if (requestedKeyLength !== void 0) keyLength = requestedKeyLength;
+	else if (alg === "ECDH-ES") throw new JWTError("deriveSharedSecret with enc \"ECDH-ES\" requires an explicit keyLength in options", "ERR_JWK_INVALID");
+	else if (isECDHESAlgorithm(alg)) keyLength = aesBitsOf(innerKeyWrapAlg(alg));
+	else keyLength = bitLengthCEK(alg);
+	return deriveECDHESKey(pubCryptoKey, privCryptoKey, alg, keyLength, partyUInfo ?? /* @__PURE__ */ new Uint8Array(0), partyVInfo ?? /* @__PURE__ */ new Uint8Array(0));
 }
 function assertDerivedKeyLength(keyLength) {
 	if (!Number.isInteger(keyLength) || keyLength <= 0 || keyLength % 8 !== 0 || keyLength > 8192) throw new JWTError(`keyLength must be a positive multiple of 8 no greater than 8192 bits, got ${keyLength}`, "ERR_INVALID_OPTION");
 }
-function assertCryptoKeyFor(alg, key, role) {
-	if (isCryptoKey(key)) return;
-	throw new JWTError(`${alg.startsWith("RSA") ? "RSA-OAEP" : "ECDH-ES"} requires the ${role} key to be a CryptoKey`, "ERR_JWK_INVALID");
-}
-function segmentBytes(value, name) {
-	return typeof value === "string" ? decodeSegment(value, {
-		family: "JWE",
-		what: `"${name}"`
-	}) : value;
-}
-function withAlg(jwk, alg) {
-	return {
-		...jwk,
-		alg
-	};
-}
-function generatedPairAlgorithm(alg) {
-	return alg;
-}
-function generatedSecretAlgorithm(alg) {
-	return alg;
-}
-const PUBLIC_KEY_OPS = /* @__PURE__ */ new Map([
-	["sign", "verify"],
-	["verify", "verify"],
-	["decrypt", "encrypt"],
-	["encrypt", "encrypt"],
-	["unwrapKey", "wrapKey"],
-	["wrapKey", "wrapKey"]
-]);
-function publicKeyOps(keyOps) {
-	if (!Array.isArray(keyOps)) return [];
-	const ops = [];
-	for (const op of keyOps) {
-		const publicOp = typeof op === "string" ? PUBLIC_KEY_OPS.get(op) : void 0;
-		if (publicOp !== void 0 && !ops.includes(publicOp)) ops.push(publicOp);
-	}
-	return ops;
-}
-function requestedKeyOps(options, key) {
-	return options.keyUsage === void 0 ? void 0 : [...key.usages];
-}
-function withKeyOps(jwk, keyOps) {
-	return keyOps === void 0 ? jwk : {
-		...jwk,
-		key_ops: keyOps
-	};
-}
-export { DEFAULT_JOSE_LIMITS, DEFAULT_PBES2_ITERATIONS, JWE_ALG_CTX, JWE_DIRECT_ALGS, JWS_ALG_CTX, WeakMapJWKCache, applyB64Header, asDecryptionError, asJWTError, asKeyLookupError, asKeyUsageError, assertB64Option, assertCompactToken, assertConsumerOptions, assertDirectKeyRole, assertEntryLimit, assertJWEAlgSupported, assertJWEEncSupported, assertJWKSetCandidates, assertJWSAlgSupported, assertNoZipOption, assertNotStringKey, assertOptionEntry, assertPBES2Params, assertProducerCEK, assertProducerConfirmation, assertProducerCrit, assertProducerIV, assertProducerKeyHeaders, assertProtectedOnlyOption, assertSerializationObject, buildECDHAgreementParams, buildJWKSetFilter, buildUnwrapKeyOptions, checkAlgAllowed, checkJWEAlgSupported, checkJWEContentSegments, checkJWEDirectEncryptedKey, checkJWEEncAllowed, checkJWEEncSupported, checkJWEUnprotectedCrit, checkJWEZip, checkJWSAlgSupported, checkJWSB64, checkProtectedTyp, checkSerializationEntry, clearJWKCache, configureJWKCache, createPBES2Budget, decodeJWEPayload, decodeJWSPayload, decodeProtectedHeader, decodeSegment, decrypt, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, encrypt, encryptKey, exportJWK, exportKey, exportPEM, exportReturnedCek, generateCEK, generateIV, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, isJWEAlgSupported, keyMatchesHeader, quoteTokenValue, resolveKeyInput, resolveLimit, resolvePasswordKey, resolvePayloadMode, resolveSigningKey, serializeProtectedHeader, sign, stringKeyError, thumbprint, toPublicJWK, unwrapKey, validateClaimsIfJson, verify, wrapKey };
+export { deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportPEM, generateJWK, generateKey, importPEM };