unjwt 0.8.4 → 0.8.5

package/dist/_chunks/{_import-key.mjs → algorithms.mjs}

@@ -1,10 +1,115 @@
-import { safeJsonParse, textEncoder } from "./libs/unsecure.mjs";
-import { JWTError, assertClaimValidationOptions, assertCritShape, assertCryptoKey, assertPlainObject, assertStringList, base64Parse, base64Stringify, base64UrlParse, base64UrlStringify, concatUint8Arrays, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isPlainObject, isPublicJWK, parsePayloadBytes, parsePayloadSegment, uint32be, validateJwtClaims } from "./_jwt-internal.mjs";
-import { ECDSA_CURVES, aesBitsOf, checkKeyUsage, cryptoKeyCurve, digestUrl, hashBitsOf, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, innerKeyWrapAlg, isAlgorithm, isContentEncryptionAlgorithm, isECDHESAlgorithm, isEd25519Signature, isJWSAlgorithm, isKeyManagementAlgorithm, isPBES2Algorithm, jwsHashOf, lengthOf, modulusLengthOf, namedCurveOf, pbes2HashOf, rsaOaepHashOf, shaBitsOf, unusableKey } from "./digest.mjs";
-const MAX_QUOTED_VALUE = 64;
-function quoteTokenValue(value) {
-	const text = String(value);
-	return JSON.stringify(text.length > MAX_QUOTED_VALUE ? `${text.slice(0, MAX_QUOTED_VALUE)}…` : text);
+import { safeJsonParse, sanitizeObjectCopy, textEncoder } from "./libs/unsecure.mjs";
+import { JWTError } from "../error.mjs";
+import { assertClaimValidationOptions, assertCritShape, assertCryptoKey, assertPlainObject, assertStringList, base64Parse, base64Stringify, base64UrlParse, base64UrlStringify, concatUint8Arrays, hasSymmetricSecret, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isPlainObject, isPublicJWK, quoteTokenValue, uint32be } from "./jwt.mjs";
+import { ECDSA_CURVES, aesBitsOf, checkKeyUsage, cryptoKeyCurve, digestUrl, hashBitsOf, inferJWSAllowedAlgorithms, innerKeyWrapAlg, isAlgorithm, isContentEncryptionAlgorithm, isECDHESAlgorithm, isPBES2Algorithm, isSameAlgorithm, jwkAlgServes, jwsHashOf, lengthOf, modulusLengthOf, namedCurveOf, pbes2HashOf, rsaOaepHashOf, shaBitsOf, unusableKey } from "./digest.mjs";
+function serializeProtectedHeader(header) {
+	try {
+		return JSON.stringify(header);
+	} catch (error) {
+		throw new JWTError("The protected header is not JSON-serializable.", "ERR_INVALID_OPTION", error);
+	}
+}
+function assertProducerCrit(header, family) {
+	const crit = header.crit;
+	if (crit === void 0) return;
+	assertCritShape(crit, {
+		family,
+		code: "ERR_INVALID_OPTION"
+	});
+	for (const param of crit) {
+		if (Object.hasOwn(header, param)) continue;
+		throw new JWTError(`"crit" lists "${param}", which the protected header does not carry.`, "ERR_INVALID_OPTION");
+	}
+}
+const PROTECTED_ONLY_PARAMS = {
+	JWS: ["crit", "b64"],
+	JWE: ["crit"]
+};
+function assertProtectedOnlyOption(header, options) {
+	if (!header) return;
+	const { tier, family } = options;
+	for (const param of PROTECTED_ONLY_PARAMS[family]) {
+		if (!Object.hasOwn(header, param)) continue;
+		throw new JWTError(`${family} "${param}" must be in the protected header, not the ${tier} header.`, "ERR_INVALID_OPTION");
+	}
+}
+function assertProducerKeyHeaders(header, options) {
+	if (!header) return;
+	const { tier, family } = options;
+	if (Object.hasOwn(header, "jwk") && !isPublicJWK(Reflect.get(header, "jwk"))) throw new JWTError(`${family} "jwk" in the ${tier} header must be a public JWK.`, "ERR_INVALID_OPTION");
+	if (Object.hasOwn(header, "epk")) throw new JWTError(`${family} "epk" is not a header option, use "ecdh.ephemeralKey".`, "ERR_INVALID_OPTION");
+}
+function assertProducerConfirmation(payload) {
+	if (typeof payload !== "object" || payload === null) return;
+	const cnf = Reflect.get(payload, "cnf");
+	if (typeof cnf !== "object" || cnf === null || !Object.hasOwn(cnf, "jwk")) return;
+	if (!isPublicJWK(Reflect.get(cnf, "jwk"))) throw new JWTError("Invalid JWT \"cnf\": \"jwk\" must be a public JWK.", "ERR_JWT_CLAIM_INVALID");
+}
+function assertOptionEntry(entry, options) {
+	const { label, objects } = options;
+	assertPlainObject(entry, label);
+	for (const member of objects) if (entry[member] !== void 0) assertPlainObject(entry[member], `${label}.${member}`);
+}
+function assertConsumerOptions(options) {
+	assertOptionEntry(options, {
+		label: "options",
+		objects: ["limits"]
+	});
+	const typ = options.typ;
+	if (typ !== void 0 && (typeof typ !== "string" || typ === "")) throw new JWTError("\"typ\" must be a non-empty string.", "ERR_INVALID_OPTION");
+	assertStringList(options.algorithms, "algorithms");
+	assertStringList(options.encryptionAlgorithms, "encryptionAlgorithms");
+	assertStringList(options.recognizedHeaders, "recognizedHeaders");
+	assertClaimValidationOptions(options);
+}
+function assertCompactToken(token, family) {
+	if (typeof token !== "string") throw new JWTError(`Invalid ${family}: token must be a string.`, `ERR_${family}_INVALID`);
+}
+function assertSerializationObject(value, family) {
+	if (!isPlainObject(value)) throw new JWTError(`Invalid ${family} JSON Serialization: expected an object.`, `ERR_${family}_INVALID_SERIALIZATION`);
+}
+function checkSerializationEntry(entry, options) {
+	const { family, label, objects, strings } = options;
+	const code = `ERR_${family}_INVALID`;
+	if (!isPlainObject(entry)) return new JWTError(`Invalid ${family}: ${label} must be a JSON object.`, code);
+	for (const member of objects) if (entry[member] !== void 0 && !isPlainObject(entry[member])) return new JWTError(`Invalid ${family}: ${label} "${member}" must be a JSON object.`, code);
+	for (const member of strings) if (entry[member] !== void 0 && typeof entry[member] !== "string") return new JWTError(`Invalid ${family}: ${label} "${member}" must be a string.`, code);
+}
+function typMatches(expected, actual) {
+	if (typeof actual !== "string") return false;
+	return normalizeTyp(expected) === normalizeTyp(actual);
+}
+function checkProtectedTyp(expected, protectedHeader, options) {
+	if (expected === void 0) return void 0;
+	const actual = protectedHeader.typ;
+	if (typMatches(expected, actual)) return void 0;
+	const { family, label } = options;
+	const where = label ? ` on ${label}` : "";
+	const message = actual === void 0 ? `Invalid ${family}: the protected header${where} carries no "typ", expected "${expected}".` : `Invalid ${family}: "typ" mismatch${where}, expected "${expected}".`;
+	return new JWTError(message, `ERR_${family}_INVALID`);
+}
+function normalizeTyp(typ) {
+	const lowered = typ.toLowerCase();
+	return lowered.includes("/") ? lowered : `application/${lowered}`;
+}
+function decodeProtectedHeader(encoded, family) {
+	let parsed = {};
+	if (encoded) {
+		try {
+			parsed = safeJsonParse(base64UrlParse(encoded));
+		} catch (error) {
+			throw new JWTError(`Invalid ${family}: Protected header could not be decoded.`, `ERR_${family}_INVALID`, error);
+		}
+		if (!isPlainObject(parsed)) throw new JWTError(`Invalid ${family}: Protected header must be a JSON object.`, `ERR_${family}_INVALID`);
+	}
+	return parsed;
+}
+function decodeSegment(encoded, options) {
+	try {
+		return base64UrlParse(encoded, { returnAs: "uint8array" });
+	} catch (error) {
+		throw new JWTError(`Invalid ${options.family}: ${options.what} could not be decoded.`, `ERR_${options.family}_INVALID`, error);
+	}
 }
 const HASHED_SIGNATURE_ALGORITHMS = /* @__PURE__ */ Object.freeze({
 	HS256: "HMAC",
@@ -1160,91 +1265,33 @@ function assertJWKSetCandidates(candidates, options) {
 	}
 	assertCandidateLimit(candidates.length, options.limit);
 }
-function createPBES2Budget(limit) {
-	let remaining = limit;
-	return { spend(attempt) {
-		const { alg, p2c } = attempt;
-		if (!alg.startsWith("PBES2")) return;
-		if (typeof p2c !== "number" || !(p2c > 0)) return;
-		assertPBES2Iterations(p2c, attempt);
-		if (p2c > remaining) throw new JWTError(`PBES2 iteration budget of ${limit} exhausted.`, "ERR_JWE_INVALID");
-		remaining -= p2c;
-	} };
+function asKeyLookupError(error, what) {
+	return asJWTError(error, {
+		code: "ERR_JWK_KEY_NOT_FOUND",
+		message: `Key lookup failed for ${what}.`
+	});
 }
-function serializeProtectedHeader(header) {
+function asJWTError(error, options) {
+	if (error instanceof JWTError) return error;
+	return new JWTError(options.message, options.code, error);
+}
+function copyJsonObject(value, options) {
 	try {
-		return JSON.stringify(header);
+		return sanitizeObjectCopy(value);
 	} catch (error) {
-		throw new JWTError("The protected header is not JSON-serializable.", "ERR_INVALID_OPTION", error);
+		throw asJWTError(error, options);
 	}
 }
-function assertProducerCrit(header, family) {
-	const crit = header.crit;
-	if (crit === void 0) return;
-	assertCritShape(crit, {
-		family,
-		code: "ERR_INVALID_OPTION"
+function asDecryptionError(error) {
+	return asJWTError(error, {
+		code: "ERR_JWE_DECRYPTION_FAILED",
+		message: "JWE decryption failed."
 	});
-	for (const param of crit) {
-		if (Object.hasOwn(header, param)) continue;
-		throw new JWTError(`"crit" lists "${param}", which the protected header does not carry.`, "ERR_INVALID_OPTION");
-	}
-}
-const PROTECTED_ONLY_PARAMS = {
-	JWS: ["crit", "b64"],
-	JWE: ["crit"]
-};
-function assertProtectedOnlyOption(header, options) {
-	if (!header) return;
-	const { tier, family } = options;
-	for (const param of PROTECTED_ONLY_PARAMS[family]) {
-		if (!Object.hasOwn(header, param)) continue;
-		throw new JWTError(`${family} "${param}" must be in the protected header, not the ${tier} header.`, "ERR_INVALID_OPTION");
-	}
-}
-function assertProducerKeyHeaders(header, options) {
-	if (!header) return;
-	const { tier, family } = options;
-	if (Object.hasOwn(header, "jwk") && !isPublicJWK(Reflect.get(header, "jwk"))) throw new JWTError(`${family} "jwk" in the ${tier} header must be a public JWK.`, "ERR_INVALID_OPTION");
-	if (Object.hasOwn(header, "epk")) throw new JWTError(`${family} "epk" is not a header option, use "ecdh.ephemeralKey".`, "ERR_INVALID_OPTION");
-}
-function assertProducerConfirmation(payload) {
-	if (typeof payload !== "object" || payload === null) return;
-	const cnf = Reflect.get(payload, "cnf");
-	if (typeof cnf !== "object" || cnf === null || !Object.hasOwn(cnf, "jwk")) return;
-	if (!isPublicJWK(Reflect.get(cnf, "jwk"))) throw new JWTError("Invalid JWT \"cnf\": \"jwk\" must be a public JWK.", "ERR_JWT_CLAIM_INVALID");
-}
-function assertOptionEntry(entry, options) {
-	const { label, objects } = options;
-	assertPlainObject(entry, label);
-	for (const member of objects) if (entry[member] !== void 0) assertPlainObject(entry[member], `${label}.${member}`);
 }
 function assertProducerPartyInfo(name, value) {
 	if (!(value instanceof Uint8Array)) throw new JWTError(`"${name === "apu" ? "partyUInfo" : "partyVInfo"}" (${name}) must be a Uint8Array.`, "ERR_INVALID_OPTION");
 	if (value.length > 1024) throw new JWTError(`"${name === "apu" ? "partyUInfo" : "partyVInfo"}" (${name}) must not exceed ${MAX_PARTY_INFO_BYTES} bytes (got ${value.length}).`, "ERR_INVALID_OPTION");
 }
-function assertProducerCEK(cek, enc) {
-	if (cek === void 0) return;
-	const expected = bitLengthCEK(enc) >> 3;
-	if (!(cek instanceof Uint8Array) || cek.length !== expected) throw new JWTError(`"cek" must be ${expected} bytes for ${enc}.`, "ERR_INVALID_OPTION");
-}
-function assertProducerIV(iv, enc) {
-	if (iv === void 0) return;
-	const expected = bitLengthIV(enc) >> 3;
-	if (!(iv instanceof Uint8Array) || iv.length !== expected) throw new JWTError(`"contentEncryptionIV" must be ${expected} bytes for ${enc}.`, "ERR_INVALID_OPTION");
-}
-function assertConsumerOptions(options) {
-	assertOptionEntry(options, {
-		label: "options",
-		objects: ["limits"]
-	});
-	const typ = options.typ;
-	if (typ !== void 0 && (typeof typ !== "string" || typ === "")) throw new JWTError("\"typ\" must be a non-empty string.", "ERR_INVALID_OPTION");
-	assertStringList(options.algorithms, "algorithms");
-	assertStringList(options.encryptionAlgorithms, "encryptionAlgorithms");
-	assertStringList(options.recognizedHeaders, "recognizedHeaders");
-	assertClaimValidationOptions(options);
-}
 const JWK_SET_KEY_OPS = /* @__PURE__ */ Object.freeze({
 	sig: ["verify"],
 	enc: [
@@ -1262,9 +1309,12 @@ function buildJWKSetFilter(header, options) {
 	const keyOps = JWK_SET_KEY_OPS[op];
 	return (k) => {
 		if (!isJWK(k)) return false;
-		if (k.kty === "oct" && !allowSymmetric) return false;
+		if (!allowSymmetric && hasSymmetricSecret(k)) return false;
 		if (kid && k.kid !== kid) return false;
-		if (k.alg && k.alg !== alg) return false;
+		if (k.alg && !(alg && jwkAlgServes({
+			kty: k.kty,
+			alg: k.alg
+		}, alg))) return false;
 		if (k.use !== void 0 && k.use !== use) return false;
 		const ops = k.key_ops;
 		if (ops !== void 0 && !(Array.isArray(ops) && ops.some((o) => keyOps.includes(o)))) return false;
@@ -1318,152 +1368,14 @@ function buildECDHAgreementParams(ecdh) {
 	}
 	return params;
 }
-async function resolveSigningKey(alg, key, usage) {
-	if (key instanceof Uint8Array) {
-		if (alg !== "HS256" && alg !== "HS384" && alg !== "HS512") throw new JWTError(`${alg} needs an asymmetric key, not raw bytes.`, "ERR_JWK_INVALID");
-		assertOctKeyLength(key, alg);
-		return crypto.subtle.importKey("raw", key, {
-			name: "HMAC",
-			hash: jwsHashOf(alg)
-		}, false, [usage]);
-	}
-	if (RSA_SIGNATURE_ALGORITHMS.has(alg)) {
-		const modulusLength = modulusLengthOf(key.algorithm);
-		if (typeof modulusLength !== "number" || modulusLength < 2048) throw new JWTError(`${alg} requires a key modulusLength of at least 2048 bits`, "ERR_JWK_INVALID");
-	}
-	return key;
-}
-function validateClaimsIfJson(payload, mode, options) {
-	if (mode !== "json" || options.validateClaims === false) return;
-	validateJwtClaims(payload, options);
-}
-const PAYLOAD_MODES = /* @__PURE__ */ new Set([
-	"json",
-	"string",
-	"bytes"
-]);
-function resolvePayloadMode(options) {
-	const { payload, forceUint8Array, validateClaims } = options;
-	if (payload !== void 0 && !PAYLOAD_MODES.has(payload)) throw new JWTError("\"payload\" must be \"json\", \"string\" or \"bytes\".", "ERR_INVALID_OPTION");
-	let mode = payload ?? "json";
-	if (forceUint8Array !== void 0) {
-		if (payload === void 0) mode = forceUint8Array ? "bytes" : "json";
-		else if (forceUint8Array !== (payload === "bytes")) throw new JWTError("\"forceUint8Array\" contradicts \"payload\", pass \"payload\" alone.", "ERR_INVALID_OPTION");
-	}
-	if (validateClaims === true && mode !== "json") throw new JWTError("\"validateClaims\" requires payload: \"json\".", "ERR_INVALID_OPTION");
-	return mode;
-}
 function stringKeyError() {
 	return new JWTError("Key must be a JWK, CryptoKey or Uint8Array, not a string.", "ERR_JWK_INVALID");
 }
-function assertNotStringKey(key) {
-	if (typeof key === "string") throw stringKeyError();
-}
 function resolvePasswordKey(alg, key) {
 	if (typeof key !== "string") return key;
 	if (!isPBES2Algorithm(alg)) throw stringKeyError();
 	return textEncoder.encode(key);
 }
-const JWS_ALG_CTX = /* @__PURE__ */ Object.freeze({
-	infer: inferJWSAllowedAlgorithms,
-	octRoles: false,
-	errorCode: "ERR_JWS_ALG_NOT_ALLOWED",
-	label: "Algorithm",
-	op: "sig"
-});
-const JWE_ALG_CTX = /* @__PURE__ */ Object.freeze({
-	infer: inferJWEAllowedAlgorithms,
-	octRoles: true,
-	errorCode: "ERR_JWE_ALG_NOT_ALLOWED",
-	label: "Key management algorithm",
-	op: "enc"
-});
-function checkAlgAllowed(alg, key, options) {
-	const { ctx, algorithms, allowSymmetric } = options;
-	if (algorithms !== void 0) return algorithms.includes(alg) ? void 0 : notAllowed(alg, ctx);
-	if (isJWK(key) && typeof key.alg === "string" && (!ctx.octRoles || key.kty !== "oct")) return key.alg === alg || isEd25519Signature(key.alg) && isEd25519Signature(alg) ? void 0 : notAllowed(alg, ctx);
-	const inferred = ctx.infer(key, { allowSymmetric });
-	if (!inferred) return new JWTError("Cannot infer allowed algorithms from this key, pass \"algorithms\".", ctx.errorCode);
-	return inferred.includes(alg) ? void 0 : notAllowed(alg, ctx);
-}
-function notAllowed(alg, ctx) {
-	return new JWTError(`${ctx.label} not allowed: ${alg}`, ctx.errorCode);
-}
-function keyMatchesHeader(header, keyMaterial, options) {
-	const { ctx, allowSymmetric } = options;
-	if (isJWKSet(keyMaterial)) {
-		const candidates = keyMaterial.keys.filter(buildJWKSetFilter(header, {
-			op: ctx.op,
-			allowSymmetric
-		}));
-		return candidates.length === 0 || candidates.some((k) => keyServesHeaderAlg(header, k, ctx));
-	}
-	if (isJWK(keyMaterial)) return keyServesHeaderAlg(header, keyMaterial, ctx);
-	if (isCryptoKey(keyMaterial)) return keyServesHeaderAlg(header, keyMaterial, ctx);
-	return true;
-}
-function assertJWSAlgSupported(alg) {
-	const error = checkJWSAlgSupported(alg);
-	if (error) throw error;
-}
-function checkJWSAlgSupported(alg) {
-	return checkAlgSupported(alg, {
-		supported: isJWSAlgorithm,
-		code: "ERR_JWS_ALG_NOT_ALLOWED",
-		label: "Algorithm",
-		role: "signing algorithm"
-	});
-}
-function checkJWSB64(header) {
-	if (Object.hasOwn(header, "b64") && typeof header.b64 !== "boolean") return new JWTError("Invalid JWS: \"b64\" must be a boolean.", "ERR_JWS_INVALID");
-	if (header.b64 !== false) return void 0;
-	if (Array.isArray(header.crit) && header.crit.includes("b64")) return void 0;
-	return new JWTError("Invalid JWS: \"b64\" must be listed in \"crit\".", "ERR_JWS_INVALID");
-}
-function assertB64Option(header) {
-	if (!header || !Object.hasOwn(header, "b64") || typeof header.b64 === "boolean") return;
-	throw new JWTError("\"b64\" must be a boolean.", "ERR_INVALID_OPTION");
-}
-function applyB64Header(header) {
-	assertB64Option(header);
-	if (header.b64 === true) {
-		if (!(Array.isArray(header.crit) && header.crit.includes("b64"))) delete header.b64;
-		return;
-	}
-	if (header.b64 !== false) return;
-	const crit = header.crit;
-	if (crit === void 0) header.crit = ["b64"];
-	else if (Array.isArray(crit) && !crit.includes("b64")) header.crit = [...crit, "b64"];
-}
-function assertCompactToken(token, family) {
-	if (typeof token !== "string") throw new JWTError(`Invalid ${family}: token must be a string.`, `ERR_${family}_INVALID`);
-}
-function assertSerializationObject(value, family) {
-	if (!isPlainObject(value)) throw new JWTError(`Invalid ${family} JSON Serialization: expected an object.`, `ERR_${family}_INVALID_SERIALIZATION`);
-}
-function checkSerializationEntry(entry, options) {
-	const { family, label, objects, strings } = options;
-	const code = `ERR_${family}_INVALID`;
-	if (!isPlainObject(entry)) return new JWTError(`Invalid ${family}: ${label} must be a JSON object.`, code);
-	for (const member of objects) if (entry[member] !== void 0 && !isPlainObject(entry[member])) return new JWTError(`Invalid ${family}: ${label} "${member}" must be a JSON object.`, code);
-	for (const member of strings) if (entry[member] !== void 0 && typeof entry[member] !== "string") return new JWTError(`Invalid ${family}: ${label} "${member}" must be a string.`, code);
-}
-function asKeyLookupError(error, what) {
-	return asJWTError(error, {
-		code: "ERR_JWK_KEY_NOT_FOUND",
-		message: `Key lookup failed for ${what}.`
-	});
-}
-function asJWTError(error, options) {
-	if (error instanceof JWTError) return error;
-	return new JWTError(options.message, options.code, error);
-}
-function asDecryptionError(error) {
-	return asJWTError(error, {
-		code: "ERR_JWE_DECRYPTION_FAILED",
-		message: "JWE decryption failed."
-	});
-}
 async function resolveKeyInput(key, options) {
 	if (typeof key !== "function") return key;
 	const { header, token, what } = options;
@@ -1476,184 +1388,11 @@ async function resolveKeyInput(key, options) {
 	if (resolved === void 0 || resolved === null) throw new JWTError(`Key lookup returned no key for ${what}.`, "ERR_JWK_KEY_NOT_FOUND");
 	return resolved;
 }
-function asKeyUsageError(error, alg) {
-	return asJWTError(error, {
-		code: "ERR_JWK_INVALID",
-		message: `Key is not usable for ${alg}.`
-	});
-}
-const JWE_ENC_CEK_FORMAT = /* @__PURE__ */ Object.freeze({
-	"A128GCM": "cryptokey",
-	"A192GCM": "cryptokey",
-	"A256GCM": "cryptokey",
-	"A128CBC-HS256": "raw",
-	"A192CBC-HS384": "raw",
-	"A256CBC-HS512": "raw"
-});
 function assertDirectKeyRole(key, enc) {
 	if (!isJWK(key) || typeof key.alg !== "string" || key.alg === "dir") return;
 	if (enc !== void 0 && key.alg === enc) return;
 	throw new JWTError(`JWK "alg" is "${key.alg}" but "dir" requires "dir" or the token's "enc".`, "ERR_JWK_INVALID");
 }
-const JWE_DIRECT_ALGS = /* @__PURE__ */ new Set(["dir", "ECDH-ES"]);
-function checkJWEAlgSupported(alg) {
-	return checkAlgSupported(alg, {
-		supported: isKeyManagementAlgorithm,
-		code: "ERR_JWE_ALG_NOT_ALLOWED",
-		label: "Key management algorithm",
-		role: "key management algorithm"
-	});
-}
-function checkJWEEncSupported(enc) {
-	if (typeof enc === "string" && isContentEncryptionAlgorithm(enc)) return void 0;
-	return new JWTError(`Invalid JWE: unsupported "enc" ${quoteTokenValue(enc)}`, "ERR_JWE_INVALID");
-}
-function isJWEAlgSupported(alg) {
-	return isKeyManagementAlgorithm(alg);
-}
-function assertJWEAlgSupported(alg) {
-	const error = checkJWEAlgSupported(alg);
-	if (error) throw error;
-}
-function assertJWEEncSupported(enc) {
-	const error = checkJWEEncSupported(enc);
-	if (error) throw error;
-}
-function checkJWEEncAllowed(enc, encryptionAlgorithms) {
-	if (encryptionAlgorithms === void 0 || encryptionAlgorithms.includes(enc)) return void 0;
-	return new JWTError(`Content encryption algorithm not allowed: ${enc}`, "ERR_JWE_ALG_NOT_ALLOWED");
-}
-async function exportReturnedCek(cek) {
-	if (!isCryptoKey(cek)) return cek;
-	if (!cek.extractable) throw new JWTError("\"returnCek\" requires an extractable content encryption key.", "ERR_INVALID_OPTION");
-	return new Uint8Array(await crypto.subtle.exportKey("raw", cek));
-}
-function cekFormatForEnc(enc) {
-	return JWE_ENC_CEK_FORMAT[enc];
-}
-function buildUnwrapKeyOptions(header, algorithms, options) {
-	const { alg, enc } = algorithms;
-	const opts = {
-		alg,
-		enc,
-		format: cekFormatForEnc(enc),
-		keyUsage: options?.keyUsage || ["decrypt"]
-	};
-	if (header.iv) opts.iv = header.iv;
-	if (header.tag) opts.tag = header.tag;
-	if (header.p2s) opts.p2s = header.p2s;
-	if (header.p2c) opts.p2c = header.p2c;
-	if (header.epk) opts.epk = header.epk;
-	if (header.apu) opts.apu = header.apu;
-	if (header.apv) opts.apv = header.apv;
-	if (options?.unwrappedKeyAlgorithm) opts.unwrappedKeyAlgorithm = options.unwrappedKeyAlgorithm;
-	if (options?.extractable !== void 0) opts.extractable = options.extractable;
-	if (options?.minIterations !== void 0) opts.minIterations = options.minIterations;
-	if (options?.maxIterations !== void 0) opts.maxIterations = options.maxIterations;
-	return opts;
-}
-function checkJWEDirectEncryptedKey(alg, encryptedKey) {
-	if (!JWE_DIRECT_ALGS.has(alg) || !encryptedKey) return void 0;
-	return new JWTError(`Invalid JWE: Encrypted key must be empty for ${alg}.`, "ERR_JWE_INVALID");
-}
-function checkJWEContentSegments(enc, iv, tag) {
-	const ivBytes = bitLengthIV(enc) >> 3;
-	if (iv.length !== ivBytes) return new JWTError(`Invalid JWE: Initialization vector must be ${ivBytes} bytes for ${enc} (got ${iv.length}).`, "ERR_JWE_INVALID");
-	const tagBytes = bitLengthTag(enc) >> 3;
-	if (tag.length !== tagBytes) return new JWTError(`Invalid JWE: Authentication tag must be ${tagBytes} bytes for ${enc} (got ${tag.length}).`, "ERR_JWE_INVALID");
-}
-function checkJWEZip(header) {
-	if (!header || !Object.hasOwn(header, "zip")) return void 0;
-	return new JWTError("Invalid JWE: compression is not supported.", "ERR_JWE_INVALID");
-}
-function assertNoZipOption(header, tier) {
-	if (!header || !Object.hasOwn(header, "zip")) return;
-	throw new JWTError(`JWE compression ("zip") in the ${tier} header is not supported.`, "ERR_INVALID_OPTION");
-}
-function checkJWEUnprotectedCrit(header) {
-	if (!header || !Object.hasOwn(header, "crit")) return void 0;
-	return new JWTError("Invalid JWE: \"crit\" must be integrity protected.", "ERR_JWE_INVALID");
-}
-function typMatches(expected, actual) {
-	if (typeof actual !== "string") return false;
-	return normalizeTyp(expected) === normalizeTyp(actual);
-}
-function checkProtectedTyp(expected, protectedHeader, options) {
-	if (expected === void 0) return void 0;
-	const actual = protectedHeader.typ;
-	if (typMatches(expected, actual)) return void 0;
-	const { family, label } = options;
-	const where = label ? ` on ${label}` : "";
-	const message = actual === void 0 ? `Invalid ${family}: the protected header${where} carries no "typ", expected "${expected}".` : `Invalid ${family}: "typ" mismatch${where}, expected "${expected}".`;
-	return new JWTError(message, `ERR_${family}_INVALID`);
-}
-function normalizeTyp(typ) {
-	const lowered = typ.toLowerCase();
-	return lowered.includes("/") ? lowered : `application/${lowered}`;
-}
-function decodeProtectedHeader(encoded, family) {
-	let parsed = {};
-	if (encoded) {
-		try {
-			parsed = safeJsonParse(base64UrlParse(encoded));
-		} catch (error) {
-			throw new JWTError(`Invalid ${family}: Protected header could not be decoded.`, `ERR_${family}_INVALID`, error);
-		}
-		if (!isPlainObject(parsed)) throw new JWTError(`Invalid ${family}: Protected header must be a JSON object.`, `ERR_${family}_INVALID`);
-	}
-	return parsed;
-}
-function decodeSegment(encoded, options) {
-	try {
-		return base64UrlParse(encoded, { returnAs: "uint8array" });
-	} catch (error) {
-		throw new JWTError(`Invalid ${options.family}: ${options.what} could not be decoded.`, `ERR_${options.family}_INVALID`, error);
-	}
-}
-function decodeJWSPayload(payloadSegment, useB64, mode) {
-	if (!useB64) return mode === "string" ? payloadSegment : parsePayloadBytes(textEncoder.encode(payloadSegment), {
-		payload: mode,
-		family: "JWS"
-	});
-	try {
-		return parsePayloadSegment(payloadSegment, {
-			payload: mode,
-			family: "JWS"
-		});
-	} catch (error) {
-		if (error instanceof JWTError) throw error;
-		throw new JWTError("Invalid JWS: Payload could not be decoded.", "ERR_JWS_INVALID", error);
-	}
-}
-function decodeJWEPayload(plaintext, mode) {
-	return parsePayloadBytes(plaintext, {
-		payload: mode,
-		family: "JWE"
-	});
-}
-function checkAlgSupported(alg, options) {
-	const { supported, code, label, role } = options;
-	if (alg === "none") return new JWTError(`"none" is not a valid ${role}`, code);
-	if (!supported(alg)) return new JWTError(`${label} not supported: ${quoteTokenValue(alg)}`, code);
-}
-function keyServesHeaderAlg(header, key, ctx) {
-	const { alg } = header;
-	if (!alg) return false;
-	const inferred = ctx.infer(key);
-	if (inferred && !inferred.includes(alg)) return false;
-	if (!isECDHESAlgorithm(alg)) return true;
-	const epkCurve = header.epk?.crv;
-	const keyCurve = isCryptoKey(key) ? cryptoKeyCurve(key) : "crv" in key ? key.crv : void 0;
-	return !epkCurve || !keyCurve || epkCurve === keyCurve;
-}
-const RSA_SIGNATURE_ALGORITHMS = /* @__PURE__ */ new Set([
-	"RS256",
-	"RS384",
-	"RS512",
-	"PS256",
-	"PS384",
-	"PS512"
-]);
 var WeakMapJWKCache = class {
 	_map = /* @__PURE__ */ new WeakMap();
 	get(jwk, alg) {
@@ -1683,8 +1422,9 @@ async function importKey(key, algOrOptions) {
 		return key;
 	}
 	if (isJWK(key)) {
+		if (key.kty !== "oct" && Object.hasOwn(key, "k")) throw new JWTError(`JWK "k" is defined only for "oct" keys, not "${key.kty}".`, "ERR_JWK_INVALID");
 		assertJWKAlgAuthority(key, alg);
-		if ("k" in key && typeof key.k === "string") {
+		if (key.kty === "oct" && typeof key.k === "string") {
 			const rawBytes = decodeSegment(key.k, {
 				family: "JWK",
 				what: "\"k\""
@@ -1722,9 +1462,10 @@ async function importKey(key, algOrOptions) {
 	throw new JWTError("Invalid key type provided to importKey", "ERR_JWK_INVALID");
 }
 function assertJWKAlgAuthority(jwk, alg) {
-	if (!alg || !jwk.alg || jwk.alg === alg) return;
-	if (jwk.kty === "oct" && alg === "dir" && isContentEncryptionAlgorithm(jwk.alg)) return;
-	if (isEd25519Signature(jwk.alg) && isEd25519Signature(alg)) return;
+	if (!alg || !jwk.alg || jwkAlgServes({
+		kty: jwk.kty,
+		alg: jwk.alg
+	}, alg)) return;
 	throw new JWTError(`JWK "alg" is "${jwk.alg}" but the operation requires "${alg}".`, "ERR_JWK_INVALID");
 }
 function assertIntentOnJWK(jwk, expect) {
@@ -1743,4 +1484,58 @@ function getJWKsFromSet(jwkSet, filter) {
 	const keys = jwkSet.keys.filter((key) => isJWK(key));
 	return filter ? keys.filter(filter) : keys;
 }
-export { DEFAULT_JOSE_LIMITS, DEFAULT_PBES2_ITERATIONS, JWE_ALG_CTX, JWE_DIRECT_ALGS, JWS_ALG_CTX, MAX_PARTY_INFO_BYTES, WeakMapJWKCache, aesKwUnwrap, aesKwWrap, applyB64Header, asDecryptionError, asJWTError, asKeyLookupError, asKeyUsageError, assertB64Option, assertCompactToken, assertConsumerOptions, assertDirectKeyRole, assertECDHKeyAllowed, assertEntryLimit, assertJWEAlgSupported, assertJWEEncSupported, assertJWKSetCandidates, assertJWSAlgSupported, assertNoZipOption, assertNotStringKey, assertOctKeyLength, assertOptionEntry, assertPBES2Count, assertPBES2Params, assertPBES2Salt, assertProducerCEK, assertProducerConfirmation, assertProducerCrit, assertProducerIV, assertProducerKeyHeaders, assertProtectedOnlyOption, assertSerializationObject, bitLengthCEK, bitLengthIV, bitLengthTag, buildECDHAgreementParams, buildJWKSetFilter, buildUnwrapKeyOptions, checkAlgAllowed, checkJWEAlgSupported, checkJWEContentSegments, checkJWEDirectEncryptedKey, checkJWEEncAllowed, checkJWEEncSupported, checkJWEUnprotectedCrit, checkJWEZip, checkJWSAlgSupported, checkJWSB64, checkProtectedTyp, checkSerializationEntry, clearJWKCache, configureJWKCache, createPBES2Budget, decodeJWEPayload, decodeJWSPayload, decodeProtectedHeader, decodeSegment, decrypt, decryptRSAES, deriveECDHESKey, deriveKey, ecdhDerivedBits, ecdhesWrap, encrypt, encryptKey, encryptRSAES, exportReturnedCek, fromPKCS8, fromSPKI, fromX509, gcmkwDecrypt, gcmkwEncrypt, generateCEK, generateIV, getJWKsFromSet, importKey, isJWEAlgSupported, keyMatchesHeader, keyToJWK, normalizeEpk, pbes2Unwrap, pbes2Wrap, quoteTokenValue, resolveKeyInput, resolveLimit, resolvePasswordKey, resolvePayloadMode, resolveSigningKey, serializeProtectedHeader, sign, stringKeyError, thumbprint, toPKCS8, toSPKI, validateClaimsIfJson, verify };
+const JWS_ALG_CTX = /* @__PURE__ */ Object.freeze({
+	infer: inferJWSAllowedAlgorithms,
+	octRoles: false,
+	errorCode: "ERR_JWS_ALG_NOT_ALLOWED",
+	label: "Algorithm",
+	op: "sig"
+});
+function checkAlgAllowed(alg, key, options) {
+	const { ctx, algorithms, allowSymmetric } = options;
+	if (algorithms !== void 0) return algorithms.includes(alg) ? void 0 : notAllowed(alg, ctx);
+	if (isJWK(key) && typeof key.alg === "string" && (!ctx.octRoles || key.kty !== "oct")) return isSameAlgorithm(key.alg, alg) ? void 0 : notAllowed(alg, ctx);
+	const inferred = ctx.infer(key, { allowSymmetric });
+	if (!inferred) return new JWTError("Cannot infer allowed algorithms from this key, pass \"algorithms\".", ctx.errorCode);
+	return inferred.includes(alg) ? void 0 : notAllowed(alg, ctx);
+}
+function notAllowed(alg, ctx) {
+	return new JWTError(`${ctx.label} not allowed: ${alg}`, ctx.errorCode);
+}
+function keyMatchesHeader(header, keyMaterial, options) {
+	const { ctx, allowSymmetric } = options;
+	if (isJWKSet(keyMaterial)) {
+		const candidates = keyMaterial.keys.filter(buildJWKSetFilter(header, {
+			op: ctx.op,
+			allowSymmetric
+		}));
+		return candidates.length === 0 || candidates.some((k) => keyServesHeaderAlg(header, k, ctx));
+	}
+	if (isJWK(keyMaterial)) return keyServesHeaderAlg(header, keyMaterial, ctx);
+	if (isCryptoKey(keyMaterial)) return keyServesHeaderAlg(header, keyMaterial, ctx);
+	return true;
+}
+function checkJWEEncSupported(enc) {
+	if (typeof enc === "string" && isContentEncryptionAlgorithm(enc)) return void 0;
+	return new JWTError(`Invalid JWE: unsupported "enc" ${quoteTokenValue(enc)}`, "ERR_JWE_INVALID");
+}
+function assertJWEEncSupported(enc) {
+	const error = checkJWEEncSupported(enc);
+	if (error) throw error;
+}
+function checkAlgSupported(alg, options) {
+	const { supported, code, label, role } = options;
+	if (alg === "none") return new JWTError(`"none" is not a valid ${role}`, code);
+	if (!supported(alg)) return new JWTError(`${label} not supported: ${quoteTokenValue(alg)}`, code);
+}
+function keyServesHeaderAlg(header, key, ctx) {
+	const { alg } = header;
+	if (!alg) return false;
+	const inferred = ctx.infer(key);
+	if (inferred && !inferred.includes(alg)) return false;
+	if (!isECDHESAlgorithm(alg)) return true;
+	const epkCurve = header.epk?.crv;
+	const keyCurve = isCryptoKey(key) ? cryptoKeyCurve(key) : "crv" in key ? key.crv : void 0;
+	return !epkCurve || !keyCurve || epkCurve === keyCurve;
+}
+export { DEFAULT_JOSE_LIMITS, DEFAULT_PBES2_ITERATIONS, JWS_ALG_CTX, MAX_PARTY_INFO_BYTES, WeakMapJWKCache, aesKwUnwrap, aesKwWrap, asDecryptionError, asJWTError, asKeyLookupError, assertCompactToken, assertConsumerOptions, assertDirectKeyRole, assertECDHKeyAllowed, assertEntryLimit, assertJWEEncSupported, assertJWKSetCandidates, assertOctKeyLength, assertOptionEntry, assertPBES2Count, assertPBES2Iterations, assertPBES2Params, assertPBES2Salt, assertProducerConfirmation, assertProducerCrit, assertProducerKeyHeaders, assertProtectedOnlyOption, assertSerializationObject, bitLengthCEK, bitLengthIV, bitLengthTag, buildECDHAgreementParams, buildJWKSetFilter, checkAlgAllowed, checkAlgSupported, checkJWEEncSupported, checkProtectedTyp, checkSerializationEntry, clearJWKCache, configureJWKCache, copyJsonObject, decodeProtectedHeader, decodeSegment, decrypt, decryptRSAES, deriveECDHESKey, deriveKey, ecdhDerivedBits, ecdhesWrap, encrypt, encryptKey, encryptRSAES, fromPKCS8, fromSPKI, fromX509, gcmkwDecrypt, gcmkwEncrypt, generateCEK, generateIV, getJWKsFromSet, importKey, jwkTokey, keyMatchesHeader, keyToJWK, normalizeEpk, pbes2Unwrap, pbes2Wrap, resolveKeyInput, resolveLimit, resolvePasswordKey, serializeProtectedHeader, sign, stringKeyError, thumbprint, toPKCS8, toSPKI, verify };