unjwt 0.8.4 → 0.8.5

package/dist/{core → _chunks}/jwk.mjs

@@ -1,377 +1,10 @@
-import { UnsecureError, sanitizeObjectCopy, secureRandomBytes, textEncoder } from "../_chunks/libs/unsecure.mjs";
-import { JWTError, assertPlainObject, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWTError, isPublicJWK, isUnsecureError } from "../_chunks/_jwt-internal.mjs";
-import { ECDSA_CURVES, PBES2_ALGORITHMS, aesBitsOf, innerKeyWrapAlg, isECDHESAlgorithm, jwsHashOf, rsaOaepHashOf } from "../_chunks/digest.mjs";
-import { MAX_PARTY_INFO_BYTES, WeakMapJWKCache, aesKwUnwrap, aesKwWrap, asDecryptionError, assertDirectKeyRole, assertECDHKeyAllowed, assertJWEEncSupported, assertOctKeyLength, assertPBES2Count, assertPBES2Params, assertPBES2Salt, bitLengthCEK, bitLengthIV, bitLengthTag, buildECDHAgreementParams, clearJWKCache, configureJWKCache, decodeSegment, decryptRSAES, deriveECDHESKey, deriveKey, ecdhDerivedBits, ecdhesWrap, encryptRSAES, fromPKCS8, fromSPKI, fromX509, gcmkwDecrypt, gcmkwEncrypt, getJWKsFromSet, importKey, keyToJWK, normalizeEpk, pbes2Unwrap, pbes2Wrap, resolvePasswordKey, thumbprint, toPKCS8, toSPKI } from "../_chunks/_import-key.mjs";
-async function generateKey(alg, options = {}) {
-	const exportToJWK = options.toJWK !== void 0 && options.toJWK;
-	const defaultExtractable = exportToJWK || options.extractable !== false;
-	const kid = exportToJWK ? assertKidOption(options.kid) : void 0;
-	if (alg === "A128CBC-HS256" || alg === "A192CBC-HS384" || alg === "A256CBC-HS512") {
-		const keyLength = bitLengthCEK(alg);
-		const keyBytes = secureRandomBytes(keyLength >> 3);
-		if (exportToJWK) {
-			const jwk = await keyToJWK(keyBytes);
-			const keyOps = options.keyUsage === void 0 ? void 0 : resolveKeyUsage(options.keyUsage, {
-				allowed: CONTENT_ENCRYPTION_USAGES,
-				fallback: ["encrypt", "decrypt"],
-				alg
-			});
-			return withGeneratedKid(kid, withKeyOps({
-				...jwk,
-				alg
-			}, keyOps));
-		}
-		return keyBytes;
-	}
-	const { algorithm, keyUsages } = getGenerateKeyParams(alg, options);
-	const key = await crypto.subtle.generateKey(algorithm, defaultExtractable, keyUsages);
-	if (exportToJWK) {
-		if (isCryptoKeyPair(key)) {
-			const pairAlg = generatedPairAlgorithm(alg);
-			const [pub, priv] = await Promise.all([exportJWK(key.publicKey), exportJWK(key.privateKey)]);
-			const publicKey = await withGeneratedKid(kid, withKeyOps(withAlg(pub, pairAlg), requestedKeyOps(options, key.publicKey)));
-			const named = publicKey.kid === void 0 ? void 0 : { kid: publicKey.kid };
-			return {
-				privateKey: {
-					...withKeyOps(withAlg(priv, pairAlg), requestedKeyOps(options, key.privateKey)),
-					...named
-				},
-				publicKey
-			};
-		}
-		return withGeneratedKid(kid, withKeyOps(withAlg(await exportJWK(key), generatedSecretAlgorithm(alg)), requestedKeyOps(options, key)));
-	}
-	return key;
-}
-async function generateJWK(alg, options) {
-	const { keyUsage, modulusLength, publicExponent, namedCurve, kid, extractable: _extractable, toJWK: _toJWK, ...jwkParams } = options ?? {};
-	assertNoReservedJWKParams(jwkParams);
-	const result = await generateKey(alg, {
-		keyUsage,
-		modulusLength,
-		publicExponent,
-		namedCurve,
-		kid,
-		toJWK: true
-	});
-	if (result && typeof result === "object" && "privateKey" in result && "publicKey" in result) return {
-		privateKey: {
-			...jwkParams,
-			...result.privateKey
-		},
-		publicKey: {
-			...jwkParams,
-			...result.publicKey
-		}
-	};
-	return {
-		...jwkParams,
-		...result
-	};
-}
-async function deriveKeyFromPassword(password, options) {
-	assertPlainObject(options, "options");
-	if (typeof password !== "string" && !(password instanceof Uint8Array)) throw new JWTError("\"password\" must be a string or a Uint8Array.", "ERR_INVALID_OPTION");
-	const { alg, salt, iterations, extractable, keyUsage } = options;
-	assertPBES2Algorithm(alg);
-	const exportToJWK = options.toJWK !== void 0 && options.toJWK;
-	const saltBytes = typeof salt === "string" ? textEncoder.encode(salt) : salt;
-	assertPBES2Salt(saltBytes, "\"salt\"");
-	assertPBES2Count(iterations, "\"iterations\"");
-	const passwordBytes = typeof password === "string" ? textEncoder.encode(password) : password;
-	const derivedBytes = await deriveKey(saltBytes, alg, iterations, passwordBytes);
-	const wrappingAlg = innerKeyWrapAlg(alg);
-	const finalUsages = keyUsage ?? ["wrapKey", "unwrapKey"];
-	const finalExtractable = exportToJWK ? true : extractable === true;
-	const derivedKey = await crypto.subtle.importKey("raw", derivedBytes, { name: "AES-KW" }, finalExtractable, finalUsages);
-	if (exportToJWK) return withKeyOps({
-		...await keyToJWK(derivedKey),
-		alg: wrappingAlg,
-		kty: "oct"
-	}, requestedKeyOps(options, derivedKey));
-	return derivedKey;
-}
-async function deriveJWKFromPassword(password, options) {
-	assertPlainObject(options, "options");
-	const { alg, salt, iterations, keyUsage, kid: kidOption, extractable: _extractable, toJWK: _toJWK, ...jwkParams } = options;
-	assertNoReservedJWKParams(jwkParams);
-	const kid = assertKidOption(kidOption);
-	const result = await deriveKeyFromPassword(password, {
-		alg,
-		salt,
-		iterations,
-		keyUsage,
-		toJWK: true
-	});
-	return {
-		...jwkParams,
-		...await withGeneratedKid(kid, result)
-	};
-}
-async function exportJWK(key, jwkParams) {
-	if (!isCryptoKey(key)) throw new JWTError("exportJWK expects a CryptoKey.", "ERR_INVALID_OPTION");
-	if (!key.extractable) throw new JWTError("A non-extractable CryptoKey cannot be exported as a JWK.", "ERR_JWK_INVALID");
-	const exportedJwk = await keyToJWK(key);
-	if (jwkParams) {
-		const extraParams = sanitizeObjectCopy(jwkParams);
-		assertNoReservedJWKParams(extraParams);
-		return {
-			...exportedJwk,
-			...extraParams
-		};
-	}
-	return exportedJwk;
-}
-async function exportKey(key, jwkParams) {
-	return exportJWK(key, jwkParams);
-}
-function toPublicJWK(jwk) {
-	if (!isAsymmetricJWK(jwk)) throw new JWTError(isJWK(jwk) ? "An oct JWK has no public half." : "toPublicJWK expects an asymmetric JWK.", "ERR_JWK_INVALID");
-	const { d: _d, p: _p, q: _q, dp: _dp, dq: _dq, qi: _qi, oth: _oth, key_ops, ...publicMembers } = sanitizeObjectCopy({ ...jwk });
-	const publicKey = key_ops === void 0 ? publicMembers : {
-		...publicMembers,
-		key_ops: publicKeyOps(key_ops)
-	};
-	if (!isPublicJWK(publicKey)) throw new JWTError(`${jwk.kty} JWK lacks the public members of its key type.`, "ERR_JWK_INVALID");
-	return publicKey;
-}
-async function wrapKey(keyToWrap, wrappingKey, options) {
-	assertPlainObject(options, "options");
-	assertKeyBytesArg(keyToWrap, "keyToWrap");
-	const { alg } = options;
-	const cekBytes = keyToWrap instanceof Uint8Array ? keyToWrap : new Uint8Array(await crypto.subtle.exportKey("raw", keyToWrap));
-	if (alg.endsWith("KW")) assertWrappableCEK(cekBytes, alg);
-	if (alg.startsWith("PBES2")) assertPBES2Params({
-		p2s: options.p2s,
-		p2c: options.p2c
-	});
-	const importedWrappingKey = await importKey(resolvePasswordKey(alg, wrappingKey), {
-		alg,
-		expect: "public"
-	});
-	switch (alg) {
-		case "dir": return { encryptedKey: /* @__PURE__ */ new Uint8Array(0) };
-		case "A128KW":
-		case "A192KW":
-		case "A256KW": return { encryptedKey: await aesKwWrap(alg, importedWrappingKey, cekBytes) };
-		case "PBES2-HS256+A128KW":
-		case "PBES2-HS384+A192KW":
-		case "PBES2-HS512+A256KW": {
-			const { p2s, p2c } = options;
-			if (!p2s || typeof p2c !== "number") throw new JWTError("PBES2 requires 'p2s' (salt) and 'p2c' (count) options", "ERR_JWE_INVALID");
-			return pbes2Wrap(alg, importedWrappingKey, cekBytes, p2c, p2s);
-		}
-		case "A128GCMKW":
-		case "A192GCMKW":
-		case "A256GCMKW": {
-			const { encryptedKey, iv, tag } = await gcmkwEncrypt(alg, importedWrappingKey, cekBytes, options.iv);
-			return {
-				encryptedKey,
-				iv,
-				tag
-			};
-		}
-		case "RSA-OAEP":
-		case "RSA-OAEP-256":
-		case "RSA-OAEP-384":
-		case "RSA-OAEP-512":
-			assertCryptoKeyFor(alg, importedWrappingKey, "wrapping");
-			return { encryptedKey: await encryptRSAES(alg, importedWrappingKey, cekBytes) };
-		case "ECDH-ES":
-		case "ECDH-ES+A128KW":
-		case "ECDH-ES+A192KW":
-		case "ECDH-ES+A256KW": {
-			assertCryptoKeyFor(alg, importedWrappingKey, "wrapping");
-			const enc = options.ecdh?.enc;
-			if (enc !== void 0) assertJWEEncSupported(enc);
-			if (alg === "ECDH-ES" && !enc) throw new JWTError("ECDH-ES direct key agreement requires options.ecdh.enc", "ERR_JWK_INVALID");
-			const { encryptedKey, parameters } = await ecdhesWrap(alg, {
-				enc,
-				recipientKey: importedWrappingKey,
-				cek: cekBytes,
-				parameters: buildECDHAgreementParams(options.ecdh)
-			});
-			const wrapResult = {
-				encryptedKey: encryptedKey ?? /* @__PURE__ */ new Uint8Array(0),
-				epk: parameters.epk
-			};
-			if (parameters.apu) wrapResult.apu = parameters.apu;
-			if (parameters.apv) wrapResult.apv = parameters.apv;
-			return wrapResult;
-		}
-		default: throw new JWTError(`Unsupported key wrapping algorithm: ${alg}`, "ERR_JWK_UNSUPPORTED");
-	}
-}
-async function unwrapKey(wrappedKey, unwrappingKey, options) {
-	assertPlainObject(options, "options");
-	if (!(wrappedKey instanceof Uint8Array)) throw new JWTError("\"wrappedKey\" must be a Uint8Array.", "ERR_INVALID_OPTION");
-	const { alg } = options;
-	const returnRaw = options.format === "raw";
-	const defaultExtractable = options.extractable !== false;
-	const importedUnwrappingKey = await importKey(resolvePasswordKey(alg, unwrappingKey), {
-		alg,
-		expect: "private"
-	});
-	let unwrappedCekBytes;
-	switch (alg) {
-		case "dir":
-			assertDirectKeyRole(unwrappingKey, options.enc);
-			if (importedUnwrappingKey instanceof Uint8Array) {
-				assertOctKeyLength(importedUnwrappingKey, options.enc);
-				unwrappedCekBytes = importedUnwrappingKey;
-			} else {
-				if (!returnRaw) return importedUnwrappingKey;
-				unwrappedCekBytes = new Uint8Array(await crypto.subtle.exportKey("raw", importedUnwrappingKey));
-			}
-			break;
-		case "A128KW":
-		case "A192KW":
-		case "A256KW":
-			unwrappedCekBytes = await unwrapping(aesKwUnwrap(alg, importedUnwrappingKey, wrappedKey));
-			break;
-		case "PBES2-HS256+A128KW":
-		case "PBES2-HS384+A192KW":
-		case "PBES2-HS512+A256KW": {
-			const { p2s, p2c, minIterations, maxIterations } = options;
-			if (!p2s || typeof p2c !== "number") throw new JWTError("PBES2 requires 'p2s' (salt) and 'p2c' (count) options", "ERR_JWE_INVALID");
-			const p2sBytes = segmentBytes(p2s, "p2s");
-			unwrappedCekBytes = await unwrapping(pbes2Unwrap(alg, importedUnwrappingKey, wrappedKey, p2c, p2sBytes, minIterations, maxIterations));
-			break;
-		}
-		case "A128GCMKW":
-		case "A192GCMKW":
-		case "A256GCMKW": {
-			if (!options.iv || !options.tag) throw new JWTError("AES-GCMKW requires 'iv' and 'tag' options for unwrapping", "ERR_JWE_INVALID");
-			const ivBytes = segmentBytes(options.iv, "iv");
-			const tagBytes = segmentBytes(options.tag, "tag");
-			assertKeyWrapSegmentLength("iv", ivBytes, bitLengthIV(alg) >> 3, alg);
-			assertKeyWrapSegmentLength("tag", tagBytes, bitLengthTag(alg) >> 3, alg);
-			unwrappedCekBytes = await unwrapping(gcmkwDecrypt(alg, importedUnwrappingKey, wrappedKey, ivBytes, tagBytes));
-			break;
-		}
-		case "RSA-OAEP":
-		case "RSA-OAEP-256":
-		case "RSA-OAEP-384":
-		case "RSA-OAEP-512": {
-			assertCryptoKeyFor(alg, importedUnwrappingKey, "unwrapping");
-			unwrappedCekBytes = await unwrapping(decryptRSAES(alg, importedUnwrappingKey, wrappedKey));
-			if (returnRaw) break;
-			const inferredAlgorithm = options.unwrappedKeyAlgorithm || inferAesImportAlgorithm(options.enc, unwrappedCekBytes.length);
-			if (!inferredAlgorithm) throw new JWTError("Cannot infer the RSA-OAEP unwrapped key algorithm, pass \"unwrappedKeyAlgorithm\".", "ERR_JWE_INVALID");
-			const keyUsages = options.keyUsage || ["encrypt", "decrypt"];
-			return await crypto.subtle.importKey("raw", unwrappedCekBytes, inferredAlgorithm, defaultExtractable, keyUsages);
-		}
-		case "ECDH-ES":
-		case "ECDH-ES+A128KW":
-		case "ECDH-ES+A192KW":
-		case "ECDH-ES+A256KW": {
-			if (!options.epk) throw new JWTError("ECDH-ES requires 'epk' option", "ERR_JWE_INVALID");
-			assertCryptoKeyFor(alg, importedUnwrappingKey, "unwrapping");
-			assertECDHKeyAllowed(importedUnwrappingKey);
-			const epkCandidate = await normalizeEpk(options.epk, {
-				alg,
-				recipientKey: importedUnwrappingKey
-			});
-			const apuBytes = segmentBytes(options.apu ?? /* @__PURE__ */ new Uint8Array(0), "apu");
-			const apvBytes = segmentBytes(options.apv ?? /* @__PURE__ */ new Uint8Array(0), "apv");
-			assertPartyInfoLength("apu", apuBytes);
-			assertPartyInfoLength("apv", apvBytes);
-			if (options.enc !== void 0) assertJWEEncSupported(options.enc);
-			const infoAlg = alg === "ECDH-ES" ? options.enc : alg;
-			if (!infoAlg) throw new JWTError("ECDH-ES requires 'enc' to derive the shared secret", "ERR_JWE_INVALID");
-			const keyLength = ecdhDerivedBits(alg, options.enc);
-			const sharedSecret = await unwrapping(deriveECDHESKey(epkCandidate, importedUnwrappingKey, infoAlg, keyLength, apuBytes, apvBytes));
-			if (alg === "ECDH-ES") unwrappedCekBytes = sharedSecret;
-			else {
-				const kwAlg = innerKeyWrapAlg(alg);
-				if (!(wrappedKey instanceof Uint8Array) || wrappedKey.length === 0) throw new JWTError("ECDH-ES key agreement with key wrapping requires an encrypted key", "ERR_JWE_INVALID");
-				unwrappedCekBytes = await unwrapping(aesKwUnwrap(kwAlg, sharedSecret, wrappedKey));
-			}
-			break;
-		}
-		default: throw new JWTError(`Unsupported key unwrapping algorithm: ${alg}`, "ERR_JWK_UNSUPPORTED");
-	}
-	if (returnRaw) return unwrappedCekBytes;
-	return await crypto.subtle.importKey("raw", unwrappedCekBytes, options.unwrappedKeyAlgorithm || { name: "AES-GCM" }, defaultExtractable, options.keyUsage || ["encrypt", "decrypt"]);
-}
-async function importPEM(pem, alg, options) {
-	if (typeof pem !== "string") throw new JWTError("\"pem\" must be a PEM-encoded string.", "ERR_INVALID_OPTION");
-	if (options !== void 0) assertPlainObject(options, "options");
-	const extractable = true;
-	const pemType = options?.pemType ?? inferPEMType(pem);
-	if (!pemType) throw new JWTError("Cannot infer PEM type from the input, pass \"pemType\".", "ERR_JWK_INVALID");
-	let cryptoKey;
-	switch (pemType) {
-		case "pkcs8":
-			cryptoKey = await fromPKCS8(pem, alg, { extractable });
-			break;
-		case "spki":
-			cryptoKey = await fromSPKI(pem, alg, { extractable });
-			break;
-		case "x509":
-			cryptoKey = await fromX509(pem, alg, { extractable });
-			break;
-		default: throw new JWTError(`Unsupported PEM type: ${String(pemType)}`, "ERR_JWK_UNSUPPORTED");
-	}
-	return {
-		...await exportJWK(cryptoKey, options?.jwkParams),
-		alg
-	};
-}
-async function exportPEM(jwk, options) {
-	assertPlainObject(jwk, "jwk");
-	if (options !== void 0) assertPlainObject(options, "options");
-	if (jwk.kty === "oct") throw new JWTError("An oct JWK cannot be exported to PKCS8 or SPKI PEM.", "ERR_JWK_UNSUPPORTED");
-	const effectiveAlg = jwk.alg || options?.alg;
-	if (!effectiveAlg && (jwk.kty === "RSA" || jwk.kty === "EC" || jwk.kty === "OKP")) throw new JWTError("\"alg\" is required, set it on the JWK or pass it in options.", "ERR_JWK_INVALID");
-	if (effectiveAlg !== void 0 && !PEM_ALGORITHMS.has(effectiveAlg)) throw new JWTError(`Unsupported PEM algorithm: ${effectiveAlg}`, "ERR_JWK_UNSUPPORTED");
-	const pemFormat = options?.pemFormat ?? ("d" in jwk ? "pkcs8" : "spki");
-	const cryptoKeyCandidate = await importKey({
-		...jwk,
-		ext: true
-	}, {
-		alg: effectiveAlg,
-		expect: pemFormat === "pkcs8" ? "private" : "public",
-		extractable: true
-	});
-	if (!isCryptoKey(cryptoKeyCandidate)) throw new JWTError("Failed to convert JWK to a CryptoKey instance suitable for PEM export.", "ERR_JWK_INVALID");
-	const cryptoKey = cryptoKeyCandidate;
-	switch (pemFormat) {
-		case "pkcs8":
-			if (cryptoKey.type !== "private") throw new JWTError(`Only a private CryptoKey can be exported to PKCS8 PEM (got ${cryptoKey.type}).`, "ERR_JWK_INVALID");
-			return toPKCS8(cryptoKey);
-		case "spki":
-			if (cryptoKey.type !== "public") throw new JWTError(`Only a public CryptoKey can be exported to SPKI PEM (got ${cryptoKey.type}).`, "ERR_JWK_INVALID");
-			return toSPKI(cryptoKey);
-		default: throw new JWTError(`Unsupported PEM format: ${String(pemFormat)}`, "ERR_JWK_UNSUPPORTED");
-	}
-}
-function inferPEMType(pem) {
-	if (pem.includes("-----BEGIN PRIVATE KEY-----")) return "pkcs8";
-	if (pem.includes("-----BEGIN PUBLIC KEY-----")) return "spki";
-	if (pem.includes("-----BEGIN CERTIFICATE-----")) return "x509";
-}
-async function deriveSharedSecret(publicKey, privateKey, options) {
-	assertPlainObject(options, "options");
-	const { enc: alg, keyLength: requestedKeyLength, partyUInfo, partyVInfo } = options;
-	if (!isECDHESAlgorithm(alg)) assertJWEEncSupported(alg);
-	if (requestedKeyLength !== void 0) assertDerivedKeyLength(requestedKeyLength);
-	const importAlg = isECDHESAlgorithm(alg) ? alg : "ECDH-ES";
-	const pubCryptoKey = isCryptoKey(publicKey) ? publicKey : await importKey(publicKey, {
-		alg: importAlg,
-		expect: "public"
-	});
-	const privCryptoKey = isCryptoKey(privateKey) ? privateKey : await importKey(privateKey, {
-		alg: importAlg,
-		expect: "private"
-	});
-	let keyLength;
-	if (requestedKeyLength !== void 0) keyLength = requestedKeyLength;
-	else if (alg === "ECDH-ES") throw new JWTError("deriveSharedSecret with enc \"ECDH-ES\" requires an explicit keyLength in options", "ERR_JWK_INVALID");
-	else if (isECDHESAlgorithm(alg)) keyLength = aesBitsOf(innerKeyWrapAlg(alg));
-	else keyLength = bitLengthCEK(alg);
-	return deriveECDHESKey(pubCryptoKey, privCryptoKey, alg, keyLength, partyUInfo ?? /* @__PURE__ */ new Uint8Array(0), partyVInfo ?? /* @__PURE__ */ new Uint8Array(0));
-}
+import { secureRandomBytes, textEncoder } from "./libs/unsecure.mjs";
+import { JWTError } from "../error.mjs";
+import { assertPlainObject, isCryptoKey, isCryptoKeyPair } from "./jwt.mjs";
+import { assertJWEEncSupported, assertPBES2Count, assertPBES2Salt, bitLengthCEK, deriveECDHESKey, deriveKey, fromPKCS8, fromSPKI, fromX509, importKey, keyToJWK, toPKCS8, toSPKI } from "./algorithms.mjs";
+import { ECDSA_CURVES, PBES2_ALGORITHMS, aesBitsOf, innerKeyWrapAlg, isECDHESAlgorithm, jwsHashOf, rsaOaepHashOf } from "./digest.mjs";
+import "./wrap.mjs";
+import { assertKidOption, assertNoReservedJWKParams, exportJWK, requestedKeyOps, withGeneratedKid, withKeyOps } from "./export.mjs";
 function getGenerateKeyParams(alg, options) {
 	let algorithm;
 	let keyUsages;
@@ -508,43 +141,6 @@ function getGenerateKeyParams(alg, options) {
 		keyUsages
 	};
 }
-function inferAesImportAlgorithm(enc, cekLengthBytes) {
-	const bitLength = cekLengthBytes << 3;
-	if (enc) {
-		if (enc.includes("GCM")) return {
-			name: "AES-GCM",
-			length: aesBitsOf(enc)
-		};
-		if (enc.includes("CBC-HS")) return;
-	}
-	if (bitLength === 128 || bitLength === 192 || bitLength === 256) return {
-		name: "AES-GCM",
-		length: bitLength
-	};
-}
-const RESERVED_JWK_PARAMS = /* @__PURE__ */ new Set([
-	"kty",
-	"alg",
-	"key_ops",
-	"ext",
-	"k",
-	"d",
-	"n",
-	"e",
-	"p",
-	"q",
-	"dp",
-	"dq",
-	"qi",
-	"oth",
-	"x",
-	"y",
-	"crv"
-]);
-function assertNoReservedJWKParams(jwkParams) {
-	const reserved = Object.keys(jwkParams).filter((name) => RESERVED_JWK_PARAMS.has(name));
-	if (reserved.length > 0) throw new JWTError(`jwkParams must not set reserved JWK members: ${reserved.join(", ")}`, "ERR_INVALID_OPTION");
-}
 function assertNamedCurve(requested, expected, alg) {
 	if (requested === void 0 || requested === expected) return;
 	throw new JWTError(`"namedCurve" ${requested} contradicts ${alg}, which is defined over ${expected}.`, "ERR_INVALID_OPTION");
@@ -597,17 +193,193 @@ function assertPairUsages(usages, options) {
 	}
 	return usages;
 }
-function assertKidOption(kid) {
-	if (kid === void 0 || kid === false || typeof kid === "string") return kid;
-	throw new JWTError("\"kid\" must be a string or false.", "ERR_INVALID_OPTION");
+function assertModulusLength(modulusLength) {
+	const length = modulusLength ?? 2048;
+	if (!Number.isInteger(length) || length < 2048) throw new JWTError("modulusLength must be at least 2048 bits", "ERR_INVALID_OPTION");
+	return length;
 }
-async function withGeneratedKid(kid, jwk) {
-	if (kid === false) return jwk;
+function withAlg(jwk, alg) {
 	return {
 		...jwk,
-		kid: kid ?? await thumbprint(jwk)
+		alg
+	};
+}
+function generatedPairAlgorithm(alg) {
+	return alg;
+}
+function generatedSecretAlgorithm(alg) {
+	return alg;
+}
+async function generateKey(alg, options = {}) {
+	const exportToJWK = options.toJWK !== void 0 && options.toJWK;
+	const defaultExtractable = exportToJWK || options.extractable !== false;
+	const kid = exportToJWK ? assertKidOption(options.kid) : void 0;
+	if (alg === "A128CBC-HS256" || alg === "A192CBC-HS384" || alg === "A256CBC-HS512") {
+		const keyLength = bitLengthCEK(alg);
+		const keyBytes = secureRandomBytes(keyLength >> 3);
+		if (exportToJWK) {
+			const jwk = await keyToJWK(keyBytes);
+			const keyOps = options.keyUsage === void 0 ? void 0 : resolveKeyUsage(options.keyUsage, {
+				allowed: CONTENT_ENCRYPTION_USAGES,
+				fallback: ["encrypt", "decrypt"],
+				alg
+			});
+			return withGeneratedKid(kid, withKeyOps({
+				...jwk,
+				alg
+			}, keyOps));
+		}
+		return keyBytes;
+	}
+	const { algorithm, keyUsages } = getGenerateKeyParams(alg, options);
+	const key = await crypto.subtle.generateKey(algorithm, defaultExtractable, keyUsages);
+	if (exportToJWK) {
+		if (isCryptoKeyPair(key)) {
+			const pairAlg = generatedPairAlgorithm(alg);
+			const [pub, priv] = await Promise.all([exportJWK(key.publicKey), exportJWK(key.privateKey)]);
+			const publicKey = await withGeneratedKid(kid, withKeyOps(withAlg(pub, pairAlg), requestedKeyOps(options, key.publicKey)));
+			const named = publicKey.kid === void 0 ? void 0 : { kid: publicKey.kid };
+			return {
+				privateKey: {
+					...withKeyOps(withAlg(priv, pairAlg), requestedKeyOps(options, key.privateKey)),
+					...named
+				},
+				publicKey
+			};
+		}
+		return withGeneratedKid(kid, withKeyOps(withAlg(await exportJWK(key), generatedSecretAlgorithm(alg)), requestedKeyOps(options, key)));
+	}
+	return key;
+}
+async function generateJWK(alg, options) {
+	const { keyUsage, modulusLength, publicExponent, namedCurve, kid, extractable: _extractable, toJWK: _toJWK, ...jwkParams } = options ?? {};
+	assertNoReservedJWKParams(jwkParams);
+	const result = await generateKey(alg, {
+		keyUsage,
+		modulusLength,
+		publicExponent,
+		namedCurve,
+		kid,
+		toJWK: true
+	});
+	if (result && typeof result === "object" && "privateKey" in result && "publicKey" in result) return {
+		privateKey: {
+			...jwkParams,
+			...result.privateKey
+		},
+		publicKey: {
+			...jwkParams,
+			...result.publicKey
+		}
+	};
+	return {
+		...jwkParams,
+		...result
+	};
+}
+async function deriveKeyFromPassword(password, options) {
+	assertPlainObject(options, "options");
+	if (typeof password !== "string" && !(password instanceof Uint8Array)) throw new JWTError("\"password\" must be a string or a Uint8Array.", "ERR_INVALID_OPTION");
+	const { alg, salt, iterations, extractable, keyUsage } = options;
+	assertPBES2Algorithm(alg);
+	const exportToJWK = options.toJWK !== void 0 && options.toJWK;
+	const saltBytes = typeof salt === "string" ? textEncoder.encode(salt) : salt;
+	assertPBES2Salt(saltBytes, "\"salt\"");
+	assertPBES2Count(iterations, "\"iterations\"");
+	const passwordBytes = typeof password === "string" ? textEncoder.encode(password) : password;
+	const derivedBytes = await deriveKey(saltBytes, alg, iterations, passwordBytes);
+	const wrappingAlg = innerKeyWrapAlg(alg);
+	const finalUsages = keyUsage ?? ["wrapKey", "unwrapKey"];
+	const finalExtractable = exportToJWK ? true : extractable === true;
+	const derivedKey = await crypto.subtle.importKey("raw", derivedBytes, { name: "AES-KW" }, finalExtractable, finalUsages);
+	if (exportToJWK) {
+		const jwk = await keyToJWK(derivedKey);
+		return withKeyOps({
+			...jwk,
+			alg: wrappingAlg,
+			kty: "oct"
+		}, requestedKeyOps(options, derivedKey));
+	}
+	return derivedKey;
+}
+async function deriveJWKFromPassword(password, options) {
+	assertPlainObject(options, "options");
+	const { alg, salt, iterations, keyUsage, kid: kidOption, extractable: _extractable, toJWK: _toJWK, ...jwkParams } = options;
+	assertNoReservedJWKParams(jwkParams);
+	const kid = assertKidOption(kidOption);
+	const result = await deriveKeyFromPassword(password, {
+		alg,
+		salt,
+		iterations,
+		keyUsage,
+		toJWK: true
+	});
+	return {
+		...jwkParams,
+		...await withGeneratedKid(kid, result)
+	};
+}
+function assertPBES2Algorithm(alg) {
+	if (typeof alg === "string" && PBES2_ALGORITHMS.includes(alg)) return;
+	throw new JWTError(`Password derivation is defined for ${PBES2_ALGORITHMS.join(", ")}, not ${String(alg)}.`, "ERR_JWK_UNSUPPORTED");
+}
+async function importPEM(pem, alg, options) {
+	if (typeof pem !== "string") throw new JWTError("\"pem\" must be a PEM-encoded string.", "ERR_INVALID_OPTION");
+	if (options !== void 0) assertPlainObject(options, "options");
+	const extractable = true;
+	const pemType = options?.pemType ?? inferPEMType(pem);
+	if (!pemType) throw new JWTError("Cannot infer PEM type from the input, pass \"pemType\".", "ERR_JWK_INVALID");
+	let cryptoKey;
+	switch (pemType) {
+		case "pkcs8":
+			cryptoKey = await fromPKCS8(pem, alg, { extractable });
+			break;
+		case "spki":
+			cryptoKey = await fromSPKI(pem, alg, { extractable });
+			break;
+		case "x509":
+			cryptoKey = await fromX509(pem, alg, { extractable });
+			break;
+		default: throw new JWTError(`Unsupported PEM type: ${String(pemType)}`, "ERR_JWK_UNSUPPORTED");
+	}
+	return {
+		...await exportJWK(cryptoKey, options?.jwkParams),
+		alg
 	};
 }
+async function exportPEM(jwk, options) {
+	assertPlainObject(jwk, "jwk");
+	if (options !== void 0) assertPlainObject(options, "options");
+	if (jwk.kty === "oct") throw new JWTError("An oct JWK cannot be exported to PKCS8 or SPKI PEM.", "ERR_JWK_UNSUPPORTED");
+	const effectiveAlg = jwk.alg || options?.alg;
+	if (!effectiveAlg && (jwk.kty === "RSA" || jwk.kty === "EC" || jwk.kty === "OKP")) throw new JWTError("\"alg\" is required, set it on the JWK or pass it in options.", "ERR_JWK_INVALID");
+	if (effectiveAlg !== void 0 && !PEM_ALGORITHMS.has(effectiveAlg)) throw new JWTError(`Unsupported PEM algorithm: ${effectiveAlg}`, "ERR_JWK_UNSUPPORTED");
+	const pemFormat = options?.pemFormat ?? ("d" in jwk ? "pkcs8" : "spki");
+	const cryptoKeyCandidate = await importKey({
+		...jwk,
+		ext: true
+	}, {
+		alg: effectiveAlg,
+		expect: pemFormat === "pkcs8" ? "private" : "public",
+		extractable: true
+	});
+	if (!isCryptoKey(cryptoKeyCandidate)) throw new JWTError("Failed to convert JWK to a CryptoKey instance suitable for PEM export.", "ERR_JWK_INVALID");
+	const cryptoKey = cryptoKeyCandidate;
+	switch (pemFormat) {
+		case "pkcs8":
+			if (cryptoKey.type !== "private") throw new JWTError(`Only a private CryptoKey can be exported to PKCS8 PEM (got ${cryptoKey.type}).`, "ERR_JWK_INVALID");
+			return toPKCS8(cryptoKey);
+		case "spki":
+			if (cryptoKey.type !== "public") throw new JWTError(`Only a public CryptoKey can be exported to SPKI PEM (got ${cryptoKey.type}).`, "ERR_JWK_INVALID");
+			return toSPKI(cryptoKey);
+		default: throw new JWTError(`Unsupported PEM format: ${String(pemFormat)}`, "ERR_JWK_UNSUPPORTED");
+	}
+}
+function inferPEMType(pem) {
+	if (pem.includes("-----BEGIN PRIVATE KEY-----")) return "pkcs8";
+	if (pem.includes("-----BEGIN PUBLIC KEY-----")) return "spki";
+	if (pem.includes("-----BEGIN CERTIFICATE-----")) return "x509";
+}
 const PEM_ALGORITHMS = /* @__PURE__ */ new Set(Object.keys({
 	"PS256": true,
 	"PS384": true,
@@ -629,85 +401,28 @@ const PEM_ALGORITHMS = /* @__PURE__ */ new Set(Object.keys({
 	"Ed25519": true,
 	"EdDSA": true
 }));
-function assertWrappableCEK(cek, alg) {
-	if (cek.length >= 16 && cek.length % 8 === 0) return;
-	throw new JWTError(`${alg} wraps a key of 16 or more bytes in whole 8-byte blocks (got ${cek.length}).`, "ERR_INVALID_OPTION");
-}
-async function unwrapping(operation) {
-	try {
-		return await operation;
-	} catch (error) {
-		throw asDecryptionError(error);
-	}
-}
-function assertPBES2Algorithm(alg) {
-	if (typeof alg === "string" && PBES2_ALGORITHMS.includes(alg)) return;
-	throw new JWTError(`Password derivation is defined for ${PBES2_ALGORITHMS.join(", ")}, not ${String(alg)}.`, "ERR_JWK_UNSUPPORTED");
-}
-function assertKeyBytesArg(value, name) {
-	if (value instanceof Uint8Array || isCryptoKey(value)) return;
-	throw new JWTError(`"${name}" must be a Uint8Array or a CryptoKey.`, "ERR_INVALID_OPTION");
-}
-function assertModulusLength(modulusLength) {
-	const length = modulusLength ?? 2048;
-	if (!Number.isInteger(length) || length < 2048) throw new JWTError("modulusLength must be at least 2048 bits", "ERR_INVALID_OPTION");
-	return length;
-}
-function assertPartyInfoLength(name, bytes) {
-	if (bytes.length > 1024) throw new JWTError(`Invalid JWE: "${name}" must not exceed ${MAX_PARTY_INFO_BYTES} bytes (got ${bytes.length}).`, "ERR_JWE_INVALID");
-}
-function assertKeyWrapSegmentLength(name, bytes, expected, alg) {
-	if (bytes.length !== expected) throw new JWTError(`Invalid JWE: "${name}" must be ${expected} bytes for ${alg} (got ${bytes.length}).`, "ERR_JWE_INVALID");
+async function deriveSharedSecret(publicKey, privateKey, options) {
+	assertPlainObject(options, "options");
+	const { enc: alg, keyLength: requestedKeyLength, partyUInfo, partyVInfo } = options;
+	if (!isECDHESAlgorithm(alg)) assertJWEEncSupported(alg);
+	if (requestedKeyLength !== void 0) assertDerivedKeyLength(requestedKeyLength);
+	const importAlg = isECDHESAlgorithm(alg) ? alg : "ECDH-ES";
+	const pubCryptoKey = isCryptoKey(publicKey) ? publicKey : await importKey(publicKey, {
+		alg: importAlg,
+		expect: "public"
+	});
+	const privCryptoKey = isCryptoKey(privateKey) ? privateKey : await importKey(privateKey, {
+		alg: importAlg,
+		expect: "private"
+	});
+	let keyLength;
+	if (requestedKeyLength !== void 0) keyLength = requestedKeyLength;
+	else if (alg === "ECDH-ES") throw new JWTError("deriveSharedSecret with enc \"ECDH-ES\" requires an explicit keyLength in options", "ERR_JWK_INVALID");
+	else if (isECDHESAlgorithm(alg)) keyLength = aesBitsOf(innerKeyWrapAlg(alg));
+	else keyLength = bitLengthCEK(alg);
+	return deriveECDHESKey(pubCryptoKey, privCryptoKey, alg, keyLength, partyUInfo ?? /* @__PURE__ */ new Uint8Array(0), partyVInfo ?? /* @__PURE__ */ new Uint8Array(0));
 }
 function assertDerivedKeyLength(keyLength) {
 	if (!Number.isInteger(keyLength) || keyLength <= 0 || keyLength % 8 !== 0 || keyLength > 8192) throw new JWTError(`keyLength must be a positive multiple of 8 no greater than 8192 bits, got ${keyLength}`, "ERR_INVALID_OPTION");
 }
-function assertCryptoKeyFor(alg, key, role) {
-	if (isCryptoKey(key)) return;
-	throw new JWTError(`${alg} requires the ${role} key to be a CryptoKey`, "ERR_JWK_INVALID");
-}
-function segmentBytes(value, name) {
-	return typeof value === "string" ? decodeSegment(value, {
-		family: "JWE",
-		what: `"${name}"`
-	}) : value;
-}
-function withAlg(jwk, alg) {
-	return {
-		...jwk,
-		alg
-	};
-}
-function generatedPairAlgorithm(alg) {
-	return alg;
-}
-function generatedSecretAlgorithm(alg) {
-	return alg;
-}
-const PUBLIC_KEY_OPS = /* @__PURE__ */ new Map([
-	["sign", "verify"],
-	["verify", "verify"],
-	["decrypt", "encrypt"],
-	["encrypt", "encrypt"],
-	["unwrapKey", "wrapKey"],
-	["wrapKey", "wrapKey"]
-]);
-function publicKeyOps(keyOps) {
-	if (!Array.isArray(keyOps)) return [];
-	const ops = [];
-	for (const op of keyOps) {
-		const publicOp = typeof op === "string" ? PUBLIC_KEY_OPS.get(op) : void 0;
-		if (publicOp !== void 0 && !ops.includes(publicOp)) ops.push(publicOp);
-	}
-	return ops;
-}
-function requestedKeyOps(options, key) {
-	return options.keyUsage === void 0 ? void 0 : [...key.usages];
-}
-function withKeyOps(jwk, keyOps) {
-	return keyOps === void 0 ? jwk : {
-		...jwk,
-		key_ops: keyOps
-	};
-}
-export { JWTError, UnsecureError, WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportJWK, exportKey, exportPEM, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, isJWTError, isUnsecureError, thumbprint, toPublicJWK, unwrapKey, wrapKey };
+export { deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportPEM, generateJWK, generateKey, importPEM };