1const pe=new TextEncoder,fe=new TextDecoder,ge=new TextDecoder("utf-8",{fatal:!0}),he=2**32;function I(...t){const e=t.reduce((i,{length:s})=>i+s,0),r=new Uint8Array(e);let n=0;for(const i of t)r.set(i,n),n+=i.length;return r}function Me(t,e,r){if(e<0||e>=he)throw new RangeError(`value must be >= 0 and <= ${he-1}. Received ${e}`);t.set([e>>>24,e>>>16,e>>>8,e&255],r)}function yt(t){const e=Math.floor(t/he),r=t%he,n=new Uint8Array(8);return Me(n,e,0),Me(n,r,4),n}function Le(t){const e=new Uint8Array(4);return Me(e,t),e}function W(t){const e=new Uint8Array(t.length);for(let r=0;r<t.length;r++){const n=t.charCodeAt(r);if(n>127)throw new TypeError("non-ASCII string encountered in encode()");e[r]=n}return e}const ce=(t,e="algorithm.name")=>new TypeError(`CryptoKey does not support this operation, its ${e} must be ${t}`);function wt(t,e){if(e&&!t.usages.includes(e))throw new TypeError(`CryptoKey does not support this operation, its usages must include ${e}.`)}function mt(t,e){const{modulusLength:r}=e.algorithm;if(typeof r!="number"||r<2048)throw new TypeError(`${t} requires key modulusLength to be 2048 bits or larger`)}function Z(t,e,r){const n=t.algorithm;if(n.name!==e.name)throw ce(e.name);if(e.hash&&n.hash?.name!==e.hash)throw ce(e.hash,"algorithm.hash");if(e.namedCurve&&n.namedCurve!==e.namedCurve)throw ce(e.namedCurve,"algorithm.namedCurve");if(e.length!==void 0&&n.length!==e.length)throw ce(e.length,"algorithm.length");wt(t,r)}function gt(t,e,...r){if(r.length>2){const n=r.pop();t+=`one of type ${r.join(", ")}, or ${n}.`}else r.length===2?t+=`one of type ${r[0]} or ${r[1]}.`:t+=`of type ${r[0]}.`;return e==null?t+=` Received ${e}`:typeof e=="function"&&e.name?t+=` Received function ${e.name}`:typeof e=="object"&&e!=null&&e.constructor?.name&&(t+=` Received an instance of ${e.constructor.name}`),t}const Q=(t,...e)=>gt("Key must be ",t,...e),st=(t,e,...r)=>gt(`Key for the ${t} algorithm must be `,e,...r);class P extends Error{static code="ERR_JOSE_GENERIC";code="ERR_JOSE_GENERIC";constructor(e,r){super(e,r),this.name=this.constructor.name,Error.captureStackTrace?.(this,this.constructor)}}class x extends P{static code="ERR_JWT_CLAIM_VALIDATION_FAILED";code="ERR_JWT_CLAIM_VALIDATION_FAILED";claim;reason;payload;constructor(e,r,n="unspecified",i="unspecified"){super(e,{cause:{claim:n,reason:i,payload:r}}),this.claim=n,this.reason=i,this.payload=r}}class Ne extends P{static code="ERR_JWT_EXPIRED";code="ERR_JWT_EXPIRED";claim;reason;payload;constructor(e,r,n="unspecified",i="unspecified"){super(e,{cause:{claim:n,reason:i,payload:r}}),this.claim=n,this.reason=i,this.payload=r}}class le extends P{static code="ERR_JOSE_ALG_NOT_ALLOWED";code="ERR_JOSE_ALG_NOT_ALLOWED"}class g extends P{static code="ERR_JOSE_NOT_SUPPORTED";code="ERR_JOSE_NOT_SUPPORTED"}class q extends P{static code="ERR_JWE_DECRYPTION_FAILED";code="ERR_JWE_DECRYPTION_FAILED";constructor(e="decryption operation failed",r){super(e,r)}}class d extends P{static code="ERR_JWE_INVALID";code="ERR_JWE_INVALID"}class l extends P{static code="ERR_JWS_INVALID";code="ERR_JWS_INVALID"}class J extends P{static code="ERR_JWT_INVALID";code="ERR_JWT_INVALID"}class Et extends P{static code="ERR_JWK_INVALID";code="ERR_JWK_INVALID"}class Ge extends P{static code="ERR_JWKS_INVALID";code="ERR_JWKS_INVALID"}class Ve extends P{static code="ERR_JWKS_NO_MATCHING_KEY";code="ERR_JWKS_NO_MATCHING_KEY";constructor(e="no applicable key found in the JSON Web Key Set",r){super(e,r)}}class bt extends P{[Symbol.asyncIterator]=async function*(){};static code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";code="ERR_JWKS_MULTIPLE_MATCHING_KEYS";constructor(e="multiple matching keys found in the JSON Web Key Set",r){super(e,r)}}class At extends P{static code="ERR_JWKS_TIMEOUT";code="ERR_JWKS_TIMEOUT";constructor(e="request timed out",r){super(e,r)}}class ye extends P{static code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";code="ERR_JWS_SIGNATURE_VERIFICATION_FAILED";constructor(e="signature verification failed",r){super(e,r)}}const Kn=Object.freeze(Object.defineProperty({__proto__:null,JOSEAlgNotAllowed:le,JOSEError:P,JOSENotSupported:g,JWEDecryptionFailed:q,JWEInvalid:d,JWKInvalid:Et,JWKSInvalid:Ge,JWKSMultipleMatchingKeys:bt,JWKSNoMatchingKey:Ve,JWKSTimeout:At,JWSInvalid:l,JWSSignatureVerificationFailed:ye,JWTClaimValidationFailed:x,JWTExpired:Ne,JWTInvalid:J},Symbol.toStringTag,{value:"Module"}));function Fe(t){if(!V(t))throw new Error("CryptoKey instance expected")}const V=t=>{if(t?.[Symbol.toStringTag]==="CryptoKey")return!0;try{return t instanceof CryptoKey}catch{return!1}},ze=t=>t?.[Symbol.toStringTag]==="KeyObject",St=t=>V(t)||ze(t),L=t=>crypto.getRandomValues(new Uint8Array(t.cekBits>>3));function Kt(t,e){const r=t.byteLength<<3;if(r!==e)throw new d(`Invalid Content Encryption Key length. Expected ${e} bits, got ${r} bits`)}const wr=t=>crypto.getRandomValues(new Uint8Array(t.ivBits>>3));function Pt(t,e){if(e.length<<3!==t.ivBits)throw new d("Invalid Initialization Vector length")}async function vt(t,e,r){if(!(e instanceof Uint8Array))throw new TypeError(Q(e,"Uint8Array"));const n=t.cekBits>>1,i=await crypto.subtle.importKey("raw",e.subarray(n>>3),"AES-CBC",!1,[r]),s=await crypto.subtle.importKey("raw",e.subarray(0,n>>3),{hash:`SHA-${n<<1}`,name:"HMAC"},!1,["sign"]);return[i,s,n]}async function Ct(t,e,r){return new Uint8Array((await crypto.subtle.sign("HMAC",t,e)).slice(0,r>>3))}async function mr(t,e,r,n,i){const[s,o,a]=await vt(t,r,"encrypt"),u=new Uint8Array(await crypto.subtle.encrypt({iv:n,name:"AES-CBC"},s,e)),c=I(i,n,u,yt(i.length*8)),p=await Ct(o,c,a);return{ciphertext:u,tag:p,iv:n}}async function gr(t,e){const r={name:"HMAC",hash:"SHA-256"},n=await crypto.subtle.generateKey(r,!1,["sign","verify"]),i=await crypto.subtle.sign(r,n,t);return crypto.subtle.verify(r,n,i,e)}async function Er(t,e,r,n,i,s){const[o,a,u]=await vt(t,e,"decrypt"),c=I(s,n,r,yt(s.length*8)),p=await Ct(a,c,u);let f;try{f=await gr(i,p)}catch{}if(!f)throw new q;let h;try{h=new Uint8Array(await crypto.subtle.decrypt({iv:n,name:"AES-CBC"},o,r))}catch{}if(!h)throw new q;return h}async function br(t,e,r,n,i){const s=r instanceof Uint8Array?await crypto.subtle.importKey("raw",r,"AES-GCM",!1,["encrypt"]):(Z(r,t.subtle,"encrypt"),r),o=new Uint8Array(await crypto.subtle.encrypt({additionalData:i,iv:n,name:"AES-GCM",tagLength:128},s,e)),a=o.slice(-16);return{ciphertext:o.slice(0,-16),tag:a,iv:n}}async function Ar(t,e,r,n,i,s){const o=e instanceof Uint8Array?await crypto.subtle.importKey("raw",e,"AES-GCM",!1,["decrypt"]):(Z(e,t.subtle,"decrypt"),e);try{return new Uint8Array(await crypto.subtle.decrypt({additionalData:s,iv:n,name:"AES-GCM",tagLength:128},o,I(r,i)))}catch{throw new q}}async function Jt(t,e,r,n,i){if(!V(r)&&!(r instanceof Uint8Array))throw new TypeError(Q(r,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));return n?Pt(t,n):n=wr(t),r instanceof Uint8Array&&Kt(r,t.cekBits),t.cbc?mr(t,e,r,n,i):br(t,e,r,n,i)}async function Wt(t,e,r,n,i,s){if(!V(e)&&!(e instanceof Uint8Array))throw new TypeError(Q(e,"CryptoKey","KeyObject","Uint8Array","JSON Web Key"));if(!n)throw new d("JWE Initialization Vector missing");if(!i)throw new d("JWE Authentication Tag missing");return Pt(t,n),e instanceof Uint8Array&&Kt(e,t.cekBits),t.cbc?Er(t,e,r,n,i,s):Ar(t,e,r,n,i,s)}function Ht(t){if(Uint8Array.prototype.toBase64)return t.toBase64();const e=32768,r=[];for(let n=0;n<t.length;n+=e)r.push(String.fromCharCode.apply(null,t.subarray(n,n+e)));return btoa(r.join(""))}function It(t){if(Uint8Array.fromBase64)return Uint8Array.fromBase64(t);const e=atob(t),r=new Uint8Array(e.length);for(let n=0;n<e.length;n++)r[n]=e.charCodeAt(n);return r}const ve="The input to be decoded is not correctly encoded.";function F(t){if(Uint8Array.fromBase64)try{return Uint8Array.fromBase64(typeof t=="string"?t:fe.decode(t),{alphabet:"base64url"})}catch(r){throw new TypeError(ve,{cause:r})}let e=t;if(e instanceof Uint8Array&&(e=fe.decode(e)),e.includes("+")||e.includes("/"))throw new TypeError(ve);e=e.replace(/-/g,"+").replace(/_/g,"/");try{return It(e)}catch{throw new TypeError(ve)}}function b(t){let e=t;return typeof e=="string"&&(e=pe.encode(e)),Uint8Array.prototype.toBase64?e.toBase64({alphabet:"base64url",omitPadding:!0}):Ht(e).replace(/=/g,"").replace(/\+/g,"-").replace(/\//g,"_")}const Pn=Object.freeze(Object.defineProperty({__proto__:null,decode:F,encode:b},Symbol.toStringTag,{value:"Module"}));function E(t){if(typeof t!="object"||t===null||Object.prototype.toString.call(t)!=="[object Object]")return!1;const e=Object.getPrototypeOf(t);if(e===null)return!0;let r=e;for(;Object.getPrototypeOf(r)!==null;)r=Object.getPrototypeOf(r);return e===r}function Ee(...t){const e=new Set;for(const r of t)if(r)for(const n of Object.keys(r)){if(e.has(n))return!1;e.add(n)}return!0}const Tt=t=>E(t)&&typeof t.kty=="string",Sr=t=>t.kty!=="oct"&&(t.kty==="AKP"&&typeof t.priv=="string"||typeof t.d=="string"),Kr=t=>t.kty!=="oct"&&t.d===void 0&&t.priv===void 0,Pr=t=>t.kty==="oct"&&typeof t.k=="string",vr=Symbol();function A(t,e){if(t)throw new TypeError(`${e} can only be called once`)}function H(t,e,r){try{return F(t)}catch{throw new r(`Failed to base64url decode the ${e}`)}}function xt(t,e,r){try{return W(t)}catch{throw new r(`The ${e} is not a valid base64url string`)}}async function Ut(t,e){const r=`SHA-${t.slice(-3)}`;return new Uint8Array(await crypto.subtle.digest(r,e))}function Xe(t,e,r){let n;try{n=JSON.parse(ge.decode(F(t)))}catch{throw new e(r)}if(!E(n))throw new e(r);return n}async function G(t,e){if(e.kty==="RSA"&&"oth"in e&&e.oth!==void 0)throw new g('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');if(!t.kty.includes(e.kty))throw new g('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');const r=t.resolve?.({kty:e.kty,crv:e.crv})??t.subtle,n=!!(e.d||e.priv),i={...e};return i.kty!=="AKP"&&delete i.alg,delete i.use,crypto.subtle.importKey("jwk",i,r,e.ext??!n,e.key_ops??t.usages[n?1:0])}const Ce=t=>t[Symbol.toStringTag],Cr=(t,e,r)=>{const{alg:n}=t;if(e.use!==void 0){const i=r==="sign"||r==="verify"?"sig":"enc";if(e.use!==i)throw new TypeError(`Invalid key for this operation, its "use" must be "${i}" when present`)}if(e.alg!==void 0&&e.alg!==n)throw new TypeError(`Invalid key for this operation, its "alg" must be "${n}" when present`);if(Array.isArray(e.key_ops)){const i=r==="encrypt"||r==="decrypt"?t.ops?.[r==="encrypt"?0:1]:r;if(i&&!e.key_ops.includes(i))throw new TypeError(`Invalid key for this operation, its "key_ops" must include "${i}" when present`)}};function Jr(t,e,r){const{alg:n,secret:i}=t,s=r==="decrypt"||r==="sign";if(i&&e instanceof Uint8Array)return[_t,e];if(Tt(e)){if(i?!Pr(e):!(s?Sr(e):Kr(e)))throw new TypeError(i?'JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present':`JSON Web Key for this operation must be a ${s?"private":"public"} JWK`);return Cr(t,e,r),[Dt,e]}if(!St(e))throw new TypeError(i?st(n,e,"CryptoKey","KeyObject","JSON Web Key","Uint8Array"):st(n,e,"CryptoKey","KeyObject","JSON Web Key"));if(i){if(e.type!=="secret")throw new TypeError(`${Ce(e)} instances for symmetric algorithms must be of type "secret"`)}else{if(e.type==="secret")throw new TypeError(`${Ce(e)} instances for asymmetric algorithms must not be of type "secret"`);const o=s?"private":"public";if((e.type==="public"||e.type==="private")&&e.type!==o){const a=r==="sign"?"signing":r==="verify"?"verifying":`${r.slice(0,-1)}tion`;throw new TypeError(`${Ce(e)} instances for asymmetric algorithm ${a} must be of type "${o}"`)}}return V(e)?[Rt,e]:[Ot,e]}const _t=0,Rt=1,Ot=2,Dt=3;let Je;const Wr={__proto__:null,prime256v1:"P-256",secp384r1:"P-384",secp521r1:"P-521"};function we(t,e,r){Je||=new WeakMap;const n=Je.get(t);return r&&(n?n[e]=r:Je.set(t,{[e]:r})),r??n?.[e]}const ot=async(t,e,r)=>we(t,r.alg)??we(t,r.alg,await G(r,{...e,alg:r.alg})),Hr=(t,e)=>{const r=we(t,e.alg);if(r)return r;const n=t.type==="public",i=e.usages[n?0:1],{asymmetricKeyType:s}=t,o=Wr[t.asymmetricKeyDetails?.namedCurve],a=e.resolve?.({crv:o,asymmetricKeyType:s})??e.subtle;return we(t,e.alg,t.toCryptoKey(a,n,i))};async function ee(t,e,r){const n=Jr(t,e,r);switch(n[0]){case _t:case Rt:return n[1];case Dt:{const i=n[1];if(i.k)return F(i.k);if(!Object.isFrozen(i)){const{key_ops:s}=i;Array.isArray(s)&&Object.freeze(s),Object.freeze(i)}return ot(i,i,t)}case Ot:{const i=n[1];return i.type==="secret"?i.export():"toCryptoKey"in i&&typeof i.toCryptoKey=="function"?Hr(i,t):ot(i,i.export({format:"jwk"}),t)}}}function Ye(t){const e={__proto__:null};for(const r in t)e[r]={...t[r],alg:r};return e}const Ir=[["encrypt","wrapKey"],["decrypt","unwrapKey"]],Tr=[[],["deriveBits"]],be=[[],[]];function de(t){return{kty:["RSA"],subtle:{name:"RSA-OAEP",hash:`SHA-${t}`},usages:Ir,ops:["wrapKey","unwrapKey"]}}function ue(){return{kty:["EC","OKP"],subtle:{name:"ECDH"},resolve:({kty:t,crv:e,asymmetricKeyType:r})=>{if(e==="X25519"||r==="x25519")return{name:"X25519"};
1if(t==="OKP")throw new g('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');return{name:"ECDH",namedCurve:e}},usages:Tr,ops:[void 0,"deriveBits"]}}function z(t,e=!1){return{kty:["oct"],secret:!0,subtle:{name:e?"AES-GCM":"AES-KW",length:t},usages:be,ops:e?["encrypt","decrypt"]:["wrapKey","unwrapKey"]}}function We(){return{kty:["oct"],secret:!0,subtle:{name:"PBKDF2"},usages:be,ops:["deriveBits","deriveBits"]}}const Mt=Ye({dir:{kty:["oct"],secret:!0,subtle:{name:"AES-GCM"},usages:be,ops:["encrypt","decrypt"]},"RSA-OAEP":de(1),"RSA-OAEP-256":de(256),"RSA-OAEP-384":de(384),"RSA-OAEP-512":de(512),"ECDH-ES":ue(),"ECDH-ES+A128KW":ue(),"ECDH-ES+A192KW":ue(),"ECDH-ES+A256KW":ue(),A128KW:z(128),A192KW:z(192),A256KW:z(256),A128GCMKW:z(128,!0),A192GCMKW:z(192,!0),A256GCMKW:z(256,!0),"PBES2-HS256+A128KW":We(),"PBES2-HS384+A192KW":We(),"PBES2-HS512+A256KW":We()}),xr=["encrypt","decrypt"];function X(t,e=!1){return{kty:["oct"],secret:!0,subtle:{name:e?"AES-CBC":"AES-GCM",length:t},usages:be,ops:xr,cekBits:t,ivBits:e?128:96,cbc:e}}const Ur=Ye({A128GCM:X(128),A192GCM:X(192),A256GCM:X(256),"A128CBC-HS256":X(256,!0),"A192CBC-HS384":X(384,!0),"A256CBC-HS512":X(512,!0)}),_r='Invalid or unsupported "alg" (JWE Algorithm) header value';function M(t){const e=Mt[t];if(!e)throw new g(_r);return e}function Rr(t){return Mt[t]}function Ae(t){const e=Ur[t];if(!e)throw new g(`Unsupported JWE Algorithm: ${t}`);return e}function at(t,e){if(t.algorithm.name!=="ECDH"&&t.algorithm.name!=="X25519")throw new TypeError("CryptoKey does not support this operation, its algorithm.name must be ECDH or X25519");wt(t,e)}async function Nt(t,e,r){const n=M(e).subtle,i=t instanceof Uint8Array?await crypto.subtle.importKey("raw",t,"AES-KW",!0,[r]):t;return Z(i,n,r),i}async function He(t,e,r){const n=await Nt(e,t,"wrapKey"),i=await crypto.subtle.importKey("raw",r,{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.wrapKey("raw",i,n,"AES-KW"))}async function Ie(t,e,r){const n=await Nt(e,t,"unwrapKey"),i=await crypto.subtle.unwrapKey("raw",r,n,"AES-KW",{hash:"SHA-256",name:"HMAC"},!0,["sign"]);return new Uint8Array(await crypto.subtle.exportKey("raw",i))}function kt(t,e,r){Z(e,M(t).subtle,r),mt(t,e)}function Or(t,e){return t instanceof Uint8Array?crypto.subtle.importKey("raw",t,"PBKDF2",!1,["deriveBits"]):(Z(t,M(e).subtle,"deriveBits"),t)}async function Bt(t,e,r,n){if(!(t instanceof Uint8Array)||t.length<8)throw new d("PBES2 Salt Input must be 8 or more octets");if(!Number.isSafeInteger(r)||Math.sign(r)!==1)throw new d("PBES2 Count Input must be a positive integer");const i=I(W(e),Uint8Array.of(0),t),s=parseInt(e.slice(13,16),10),o={hash:`SHA-${e.slice(8,11)}`,iterations:r,name:"PBKDF2",salt:i},a=await Or(n,e);return new Uint8Array(await crypto.subtle.deriveBits(o,a,s))}function Te(t){return I(Le(t.length),t)}async function Dr(t,e,r){const n=e>>3,i=32,s=Math.ceil(n/i),o=new Uint8Array(s*i);for(let a=1;a<=s;a++){const u=await Ut("sha256",I(Le(a),t,r));o.set(u,(a-1)*i)}return o.slice(0,n)}async function $t(t,e,r,n,i=new Uint8Array,s=new Uint8Array){at(t),at(e,"deriveBits");const o=I(Te(W(r)),Te(i),Te(s),Le(n)),a=new Uint8Array(await crypto.subtle.deriveBits({name:t.algorithm.name,public:t},e,t.algorithm.name==="X25519"?256:Math.ceil(parseInt(t.algorithm.namedCurve.slice(-3),10)/8)<<3));return Dr(a,n,o)}function Lt(t){Fe(t);const e=t.algorithm.namedCurve;if(e!=="P-256"&&e!=="P-384"&&e!=="P-521"&&t.algorithm.name!=="X25519")throw new g("ECDH with the provided key is not allowed or not supported by your javascript runtime")}function re(t){if(t===void 0)throw new d("JWE Encrypted Key missing")}function ct(t){if(t!==void 0)throw new d("Encountered unexpected JWE Encrypted Key")}async function Mr(t,e,r,n,i,s){const o=M(t);if(t==="dir")return ct(n),r;switch(o.subtle.name){case"ECDH":{if(t==="ECDH-ES"&&ct(n),!E(i.epk))throw new d('JOSE Header "epk" (Ephemeral Public Key) missing or invalid');Lt(r);const a=await G(o,i.epk);let u,c;if(i.apu!==void 0){if(typeof i.apu!="string")throw new d('JOSE Header "apu" (Agreement PartyUInfo) invalid');u=H(i.apu,"apu",d)}if(i.apv!==void 0){if(typeof i.apv!="string")throw new d('JOSE Header "apv" (Agreement PartyVInfo) invalid');c=H(i.apv,"apv",d)}const p=await $t(a,r,t==="ECDH-ES"?e.alg:t,t==="ECDH-ES"?e.cekBits:parseInt(t.slice(-5,-2),10),u,c);return t==="ECDH-ES"?p:(re(n),Ie(t.slice(-6),p,n))}case"RSA-OAEP":return re(n),Fe(r),kt(t,r,"decrypt"),new Uint8Array(await crypto.subtle.decrypt("RSA-OAEP",r,n));case"PBKDF2":{if(re(n),typeof i.p2c!="number")throw new d('JOSE Header "p2c" (PBES2 Count) missing or invalid');const a=s?.maxPBES2Count||1e4;if(i.p2c>a)throw new d('JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds');
1if(typeof i.p2s!="string")throw new d('JOSE Header "p2s" (PBES2 Salt) missing or invalid');const u=H(i.p2s,"p2s",d),c=await Bt(u,t,i.p2c,r);return Ie(t.slice(-6),c,n)}case"AES-KW":return re(n),Ie(t,r,n);case"AES-GCM":{if(re(n),typeof i.iv!="string")throw new d('JOSE Header "iv" (Initialization Vector) missing or invalid');if(typeof i.tag!="string")throw new d('JOSE Header "tag" (Authentication Tag) missing or invalid');let a;a=H(i.iv,"iv",d);let u;return u=H(i.tag,"tag",d),Wt(Ae(t.slice(0,-2)),r,n,a,u,new Uint8Array)}}}async function Gt(t,e,r,n,i={}){let s,o,a;const u=M(t);if(t==="dir")return[r,void 0,void 0];switch(u.subtle.name){case"ECDH":{Lt(r);const{apu:c,apv:p}=i;let f;i.epk?f=await ee(u,i.epk,"decrypt"):f=(await crypto.subtle.generateKey(r.algorithm,!0,["deriveBits"])).privateKey;const h=crypto.subtle;let S=f;if(!S.extractable){if(typeof h.getPublicKey!="function")throw new TypeError('CryptoKey for "epk" must be extractable');S=await h.getPublicKey(f,[])}const{x:K,y:w,crv:m,kty:y}=await h.exportKey("jwk",S),v=await $t(r,f,t==="ECDH-ES"?e.alg:t,t==="ECDH-ES"?e.cekBits:parseInt(t.slice(-5,-2),10),c,p);if(o={epk:{x:K,crv:m,kty:y}},y==="EC"&&(o.epk.y=w),c&&(o.apu=b(c)),p&&(o.apv=b(p)),t==="ECDH-ES"){a=v;break}a=n||L(e);const _=t.slice(-6);s=await He(_,v,a);break}case"RSA-OAEP":{a=n||L(e),Fe(r),kt(t,r,"encrypt"),s=new Uint8Array(await crypto.subtle.encrypt("RSA-OAEP",r,a));break}case"PBKDF2":{a=n||L(e);const{p2c:c=2048,p2s:p=crypto.getRandomValues(new Uint8Array(16))}=i,f=await Bt(p,t,c,r);s=await He(t.slice(-6),f,a),o={p2c:c,p2s:b(p)};break}case"AES-KW":{a=n||L(e),s=await He(t,r,a);break}case"AES-GCM":{a=n||L(e);const{iv:c}=i,p=await Jt(Ae(t.slice(0,-2)),a,r,c,new Uint8Array);s=p.ciphertext,o={iv:b(p.iv),tag:b(p.tag)};break}}return[a,s,o]}const Vt={__proto__:null,b64:!0},Ft={__proto__:null};function ke(t,e){if(e!==void 0&&(!Array.isArray(e)||e.some(r=>typeof r!="string")))throw new TypeError(`"${t}" option must be an array of strings`);if(e)return new Set(e)}function je(t,e){const{crit:r}=e??{};if(Array.isArray(r)&&new Set(r).size!==r.length)throw new t('"crit" (Critical) Header Parameter MUST NOT contain duplicate values')}function Se(t,e,r,n,i){if(i.crit!==void 0&&n?.crit===void 0)throw new t('"crit" (Critical) Header Parameter MUST be integrity protected');if(!n||n.crit===void 0)return[];if(!Array.isArray(n.crit)||n.crit.length===0||n.crit.some(o=>typeof o!="string"||o.length===0))throw new t('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');const s=r===void 0?e:{__proto__:null,...r,...e};for(const o of n.crit){if(!(o in s))throw new g(`Extension Header Parameter "${o}" is not recognized`);if(!Object.hasOwn(i,o)||i[o]===void 0)throw new t(`Extension Header Parameter "${o}" is missing`);if(s[o]&&(!Object.hasOwn(n,o)||n[o]===void 0))throw new t(`Extension Header Parameter "${o}" MUST be integrity protected`)}return n.crit}function zt(t){if(typeof globalThis[t]>"u")throw new g(`JWE "zip" (Compression Algorithm) Header Parameter requires the ${t} API.`)}async function Nr(t){zt("CompressionStream");const e=new CompressionStream("deflate-raw"),r=e.writable.getWriter();r.write(t).catch(()=>{}),r.close().catch(()=>{});const n=[],i=e.readable.getReader();for(;;){const{value:s,done:o}=await i.read();if(o)break;n.push(s)}return I(...n)}async function kr(t,e){zt("DecompressionStream");const r=new DecompressionStream("deflate-raw"),n=r.writable.getWriter();n.write(t).catch(()=>{}),n.close().catch(()=>{});const i=[];let s=0;const o=r.readable.getReader();for(;;){const{value:a,done:u}=await o.read();if(u)break;if(i.push(a),s+=a.byteLength,e!==1/0&&s>e)throw new d("Decompressed plaintext exceeded the configured limit")}return I(...i)}function Xt(t){const{ciphertext:e,protected:r,unprotected:n}=t;if(t.iv!==void 0&&typeof t.iv!="string")throw new d("JWE Initialization Vector incorrect type");if(typeof e!="string")throw new d("JWE Ciphertext missing or incorrect type");if(t.tag!==void 0&&typeof t.tag!="string")throw new d("JWE Authentication Tag incorrect type");if(r!==void 0&&typeof r!="string")throw new d("JWE Protected Header incorrect type");if(t.aad!==void 0&&typeof t.aad!="string")throw new d("JWE AAD incorrect type");if(n!==void 0&&!E(n))throw new d("JWE Shared Unprotected Header incorrect type")}function Yt(t){const{encrypted_key:e,header:r}=t;if(e!==void 0&&typeof e!="string")throw new d("JWE Encrypted Key incorrect type");if(r!==void 0&&!E(r))throw new d("JWE Per-Recipient Unprotected Header incorrect type");if(t.protected===void 0&&r===void 0&&t.unprotected===void 0)throw new d("JOSE Header missing")}function jt(t){const{protected:e,ciphertext:r,iv:n,tag:i,aad:s}=t;let o;
1e&&(o=Xe(e,d,"JWE Protected Header is invalid"));const a=e!==void 0?W(e):new Uint8Array;return[o,H(r,"ciphertext",d),n!==void 0?H(n,"iv",d):void 0,i!==void 0?H(i,"tag",d):void 0,s!==void 0?I(a,W("."),xt(s,"aad",d)):a]}function qt(t,e){const[r,n,i,s]=e,{protected:o,aad:a,unprotected:u,header:c}=t,p={plaintext:r};return o!==void 0&&(p.protectedHeader=n),a!==void 0&&(p.additionalAuthenticatedData=H(a,"aad",d)),u!==void 0&&(p.sharedUnprotectedHeader=u),c!==void 0&&(p.unprotectedHeader=c),s?{...p,key:i}:p}function Ke(t){return[t&&ke("keyManagementAlgorithms",t.keyManagementAlgorithms),t&&ke("contentEncryptionAlgorithms",t.contentEncryptionAlgorithms),t]}async function Zt(t,e,r,n){const[i,s,o]=r,[a,u,c,p,f]=e,{encrypted_key:h,header:S,unprotected:K}=t;let w;if(S!==void 0||K!==void 0){if(!Ee(a,S,K))throw new d("JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint");w={...a,...S,...K}}else w=a??{};if(Se(d,Ft,o?.crit,a,w),w.zip!==void 0&&w.zip!=="DEF")throw new g('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(w.zip!==void 0&&!a?.zip)throw new d('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');const{alg:m,enc:y}=w;if(typeof m!="string"||!m)throw new d("missing JWE Algorithm (alg) in JWE Header");if(typeof y!="string"||!y)throw new d("missing JWE Encryption Algorithm (enc) in JWE Header");if(i&&!i.has(m)||!i&&m.startsWith("PBES2"))throw new le('"alg" (Algorithm) Header Parameter value not allowed');if(s&&!s.has(y))throw new le('"enc" (Encryption Algorithm) Header Parameter value not allowed');const v=Ae(y);let _;h!==void 0&&(_=H(h,"encrypted_key",d));let te=!1;typeof n=="function"&&(n=await n(a,t),te=!0);const N=M(m),k=await ee(m==="dir"?v:N,n,"decrypt");let R;try{R=await Mr(m,v,k,_,w,o)}catch(C){if(C instanceof TypeError||C instanceof d||C instanceof g)throw C;R=L(v)}let B=await Wt(v,R,u,c,p,f);if(w.zip==="DEF"){const C=o?.maxDecompressedLength??25e4;if(C===0)throw new g('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');if(C!==1/0&&(!Number.isSafeInteger(C)||C<1))throw new TypeError("maxDecompressedLength must be 0, a positive safe integer, or Infinity");B=await kr(B,C).catch($=>{throw $ instanceof d?$:new d("Failed to decompress plaintext",{cause:$})})}return[B,a,k,te]}async function Qt(t,e,r){return Zt(t,jt(t),e,r)}async function er(t,e,r){if(t instanceof Uint8Array&&(t=fe.decode(t)),typeof t!="string")throw new d("Compact JWE must be a string or Uint8Array");const{0:n,1:i,2:s,3:o,4:a,length:u}=t.split(".");if(u!==5)throw new d("Invalid Compact JWE");return Qt({ciphertext:o,iv:s||void 0,protected:n,tag:a||void 0,encrypted_key:i||void 0},e,r)}async function vn(t,e,r){const n=await er(t,Ke(r),e),i={plaintext:n[0],protectedHeader:n[1]};return typeof e=="function"?{...i,key:n[2]}:i}async function Cn(t,e,r){if(!E(t))throw new d("Flattened JWE must be an object");return Xt(t),Yt(t),qt(t,await Qt(t,Ke(r),e))}async function Jn(t,e,r){if(!E(t))throw new d("General JWE must be an object");if(!Array.isArray(t.recipients)||!t.recipients.every(E))throw new d("JWE Recipients missing or incorrect type");if(!t.recipients.length)throw new d("JWE Recipients has no members");let n,i;try{Xt(t),n=Ke(r),i=jt(t)}catch{throw new q}for(const s of t.recipients)try{const o={aad:t.aad,ciphertext:t.ciphertext,encrypted_key:s.encrypted_key,header:s.header,iv:t.iv,protected:t.protected,tag:t.tag,unprotected:t.unprotected};return Yt(o),qt(o,await Zt(o,i,n,e))}catch{}throw new q}function tr(t){const[,e,r,n,,,,,i]=t;if(!Ee(e,r,n))throw new d("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");const s={...e,...r,...n};if(Se(d,Ft,i,e,s),s.zip!==void 0&&s.zip!=="DEF")throw new g('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');if(s.zip!==void 0&&!e?.zip)throw new d('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');const{alg:o,enc:a}=s;if(typeof o!="string"||!o)throw new d('JWE "alg" (Algorithm) Header Parameter missing or invalid');if(typeof a!="string"||!a)throw new d('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');return[s,o,a,Ae(a)]}async function rr(t,e,r){const[n,i,,s]=e,[o,a,u,c,p,f,h,S,,K]=t;let w=a,m=u;if(f&&(i==="dir"||i==="ECDH-ES"))throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${i}`);const y=M(i),v=await ee(i==="dir"?s:y,r,"encrypt"),[_,te,N]=await Gt(i,s,v,f,S);N&&(K?m=m?{...m,...N}:N:w=w?{...w,...N}:N);let k,R;w?(k=b(JSON.stringify(w)),R=W(k)):(k="",R=new Uint8Array);let B,C;p?.byteLength?(C=b(p),B=I(R,W("."),W(C))):B=R;
1let $=o;n.zip==="DEF"&&($=await Nr($).catch(yr=>{throw new d("Failed to compress plaintext",{cause:yr})}));const{ciphertext:lr,tag:nt,iv:it}=await Jt(s,$,_,h,B),O={ciphertext:b(lr)};return it&&(O.iv=b(it)),nt&&(O.tag=b(nt)),te&&(O.encrypted_key=b(te)),C&&(O.aad=C),w&&(O.protected=k),c&&(O.unprotected=c),m&&(O.header=m),O}async function Br(t,e){return rr(t,tr(t),e)}class nr{#e;#t;#r;#n;#s;#a;#o;#i;constructor(e){if(!(e instanceof Uint8Array))throw new TypeError("plaintext must be an instance of Uint8Array");this.#e=e}setKeyManagementParameters(e){return A(this.#i,"setKeyManagementParameters"),this.#i=e,this}setProtectedHeader(e){return A(this.#t,"setProtectedHeader"),this.#t=e,this}setSharedUnprotectedHeader(e){return A(this.#r,"setSharedUnprotectedHeader"),this.#r=e,this}setUnprotectedHeader(e){return A(this.#n,"setUnprotectedHeader"),this.#n=e,this}setAdditionalAuthenticatedData(e){return this.#s=e,this}setContentEncryptionKey(e){return A(this.#a,"setContentEncryptionKey"),this.#a=e,this}setInitializationVector(e){return A(this.#o,"setInitializationVector"),this.#o=e,this}async encrypt(e,r){if(!this.#t&&!this.#n&&!this.#r)throw new d("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");return je(d,this.#t),Br([this.#e,this.#t,this.#n,this.#r,this.#s,this.#a,this.#o,this.#i,r?.crit,r?vr in r:!1],e)}}class $r{#e;state;constructor(e,r,n){this.#e=e,this.state=[void 0,void 0,r,n]}setUnprotectedHeader(e){return A(this.state[0],"setUnprotectedHeader"),this.state[0]=e,this}setKeyManagementParameters(e){return A(this.state[1],"setKeyManagementParameters"),this.state[1]=e,this}addRecipient(...e){return this.#e.addRecipient(...e)}encrypt(...e){return this.#e.encrypt(...e)}done(){return this.#e}}function dt(t,e,r){const{aad:n,protected:i,unprotected:s,header:o}=t;n&&(e.aad=n),i&&(e.protected=i),s&&(e.unprotected=s),o&&(r.header=o)}class Wn{#e;#t=[];#r;#n;#s;constructor(e){this.#e=e}addRecipient(e,r){const n=new $r(this,e,r?.crit);return this.#t.push(n),n}setProtectedHeader(e){return A(this.#r,"setProtectedHeader"),this.#r=e,this}setSharedUnprotectedHeader(e){return A(this.#n,"setSharedUnprotectedHeader"),this.#n=e,this}setAdditionalAuthenticatedData(e){return this.#s=e,this}async encrypt(){if(!this.#t.length)throw new d("at least one recipient must be added");if(!(this.#e instanceof Uint8Array))throw new TypeError("plaintext must be an instance of Uint8Array");if(this.#t.length===1){const[o]=this.#t,[a,u,c,p]=o.state,f=await new nr(this.#e).setAdditionalAuthenticatedData(this.#s).setProtectedHeader(this.#r).setSharedUnprotectedHeader(this.#n).setUnprotectedHeader(a).setKeyManagementParameters(u).encrypt(c,{crit:p}),h={ciphertext:f.ciphertext,iv:f.iv,recipients:[{}],tag:f.tag};return f.encrypted_key&&(h.recipients[0].encrypted_key=f.encrypted_key),dt(f,h,h.recipients[0]),h}je(d,this.#r);let e;const r=[],n=[];for(let o=0;o<this.#t.length;o++){const a=this.#t[o],[u,c,,p]=a.state,f=[this.#e,this.#r,u,this.#n,this.#s,void 0,void 0,c,p,!0],h=tr(f);if(r.push(f),n.push(h),h[1]==="dir"||h[1]==="ECDH-ES")throw new d('"dir" and "ECDH-ES" alg may only be used with a single recipient');if(!e)e=h[2];else if(e!==h[2])throw new d('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients')}const i=L(n[0][3]),s={ciphertext:"",recipients:[]};for(let o=0;o<this.#t.length;o++){const a=this.#t[o],[u,c,p]=a.state,f={};if(s.recipients.push(f),o===0){r[0][5]=i;const y=await rr(r[0],n[0],p);s.ciphertext=y.ciphertext,s.iv=y.iv,s.tag=y.tag,f.encrypted_key=y.encrypted_key,dt(y,s,f);continue}const[,h,,S]=n[o],K=await ee(M(h),p,"encrypt"),[,w,m]=await Gt(h,S,K,i,c);f.encrypted_key=b(w),(u||m)&&(f.header={...u,...m})}return s}}async function ir(t,e,r){return e instanceof Uint8Array?crypto.subtle.importKey("raw",e,t.subtle,!1,[r]):(Z(e,t.subtle,r),t.minRsaBits&&mt(t.alg,e),e)}async function Lr(t,e,r){const n=await ir(t,e,"sign"),i=await crypto.subtle.sign(t.signing,n,r);return new Uint8Array(i)}async function Gr(t,e,r,n){const i=await ir(t,e,"verify");try{return await crypto.subtle.verify(t.signing,i,r,n)}catch{return!1}}const ae=[["verify"],["sign"]];function xe(t){const e={name:"HMAC",hash:`SHA-${t}`};return{kty:["oct"],secret:!0,subtle:e,signing:e,usages:ae}}function Y(t,e){const n={name:e?"RSA-PSS":"RSASSA-PKCS1-v1_5",hash:`SHA-${t}`};return{kty:["RSA"],subtle:n,signing:e?{...n,saltLength:e}:n,usages:ae,minRsaBits:2048}}function Ue(t,e){return{kty:["EC"],crv:t,subtle:{name:"ECDSA",namedCurve:t},signing:{name:"ECDSA",hash:`SHA-${e}`},usages:ae}}function ut(){const t={name:"Ed25519"};return{kty:["OKP"],crv:"Ed25519",subtle:t,signing:t,usages:ae}}function _e(t){const r={name:`ML-DSA-${t}`};return{kty:["AKP"],subtle:r,signing:r,usages:ae}}const sr=Ye({HS256:xe(256),HS384:xe(384),HS512:xe(512),RS256:Y(256),RS384:Y(384),RS512:Y(512),PS256:Y(256,32),PS384:Y(384,48),PS512:Y(512,64),ES256:Ue("P-256",256),ES384:Ue("P-384",384),ES512:Ue("P-521",512),EdDSA:ut(),Ed25519:ut(),"ML-DSA-44":_e(44),"ML-DSA-65":_e(65),"ML-DSA-87":_e(87)});function qe(t){const e=sr[t];if(!e)throw new g(`alg ${t} is not supported either by JOSE or your javascript runtime`);return e}function or(t){return sr[t]}function ar(t,e){const[r,n,,i,s]=e,o={payload:r};return t.protected!==void 0&&(o.protectedHeader=n),t.header!==void 0&&(o.unprotectedHeader=t.header),s?{...o,key:i}:o}function Pe(t){return[t&&ke("algorithms",t.algorithms),t?.crit]}async function Ze(t,e,r){const{protected:n,header:i,payload:s}=t;let o={};
1n&&(o=Xe(n,l,"JWS Protected Header is invalid"));let a;if(i!==void 0){if(!Ee(o,i))throw new l("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");a={...o,...i}}else a=o;const u=Se(l,Vt,e[1],o,a);let c=!0;if(u.includes("b64")&&(c=o.b64,typeof c!="boolean"))throw new l('The "b64" (base64url-encode payload) Header Parameter must be a boolean');const{alg:p}=a;if(typeof p!="string"||!p)throw new l('JWS "alg" (Algorithm) Header Parameter missing or invalid');if(e[0]&&!e[0].has(p))throw new le('"alg" (Algorithm) Header Parameter value not allowed');if(c){if(typeof s!="string")throw new l("JWS Payload must be a string")}else if(typeof s!="string"&&!(s instanceof Uint8Array))throw new l("JWS Payload must be a string or an Uint8Array instance");let f=!1;typeof r=="function"&&(r=await r(o,t),f=!0);const h=qe(p),S=I(n!==void 0?W(n):new Uint8Array,W("."),typeof s=="string"?c?e[2]??=xt(s,"payload",l):pe.encode(s):s),K=H(t.signature,"signature",l),w=await ee(h,r,"verify");if(!await Gr(h,w,K,S))throw new ye;let y;return c?y=H(s,"payload",l):typeof s=="string"?y=pe.encode(s):y=s,[y,o,c,w,f]}async function cr(t,e,r){if(t instanceof Uint8Array&&(t=fe.decode(t)),typeof t!="string")throw new l("Compact JWS must be a string or Uint8Array");const{0:n,1:i,2:s,length:o}=t.split(".");if(o!==3)throw new l("Invalid Compact JWS");return Ze({payload:i,protected:n,signature:s},e,r)}async function Hn(t,e,r){const n=await cr(t,Pe(r),e),i={payload:n[0],protectedHeader:n[1]};return typeof e=="function"?{...i,key:n[3]}:i}async function In(t,e,r){if(!E(t))throw new l("Flattened JWS must be an object");if(t.protected===void 0&&t.header===void 0)throw new l('Flattened JWS must have either of the "protected" or "header" members');if(t.protected!==void 0&&typeof t.protected!="string")throw new l("JWS Protected Header incorrect type");if(t.payload===void 0)throw new l("JWS Payload missing");if(typeof t.signature!="string")throw new l("JWS Signature missing or incorrect type");if(t.header!==void 0&&!E(t.header))throw new l("JWS Unprotected Header incorrect type");return ar(t,await Ze(t,Pe(r),e))}async function Tn(t,e,r){if(!E(t))throw new l("General JWS must be an object");const{signatures:n,payload:i}=t;if(!Array.isArray(n)||!n.every(E))throw new l("JWS Signatures missing or incorrect type");let s;try{if(i===void 0)throw new Error;s=Pe(r)}catch{throw new ye}for(const o of n)try{const{protected:a,header:u,signature:c}=o;if(a===void 0&&u===void 0)throw new Error;if(a!==void 0&&typeof a!="string")throw new Error;if(typeof c!="string")throw new Error;if(u!==void 0&&!E(u))throw new Error;return ar(o,await Ze({header:u,payload:i,protected:a,signature:c},s,e))}catch{}throw new ye}const se=t=>Math.floor(t.getTime()/1e3),Vr={s:1,m:60,h:3600,d:86400,w:604800,y:31557600},Fr=/^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i,j="check_failed";function me(t){const e=Fr.exec(t);if(!e||e[4]&&e[1])throw new TypeError("Invalid time period format");const r=parseFloat(e[2]),n=Math.round(r*Vr[e[3][0].toLowerCase()]);return e[1]==="-"||e[4]==="ago"?-n:n}function oe(t,e){if(!Number.isFinite(e))throw new TypeError(`Invalid ${t} input`);return e}function Re(t,e){return typeof t=="number"?oe(e,t):t instanceof Date?oe(e,se(t)):se(new Date)+me(t)}const pt=t=>t.includes("/")?t.toLowerCase():`application/${t.toLowerCase()}`,zr=(t,e)=>typeof t=="string"?e.includes(t):Array.isArray(t)?e.some(r=>t.includes(r)):!1;function Oe(t,e,r=!1){const n=t[e];if(!(n===void 0&&!r)){if(typeof n!="number")throw new x(`"${e}" claim must be a number`,t,e,"invalid");return n}}function De(t,e){throw new x(`unexpected "${e}" claim value`,t,e,j)}function Qe(t,e,r={}){let n;try{n=JSON.parse(ge.decode(e))}catch{}if(!E(n))throw new J("JWT Claims Set must be a top-level JSON object");const{typ:i}=r;if(i&&(typeof t.typ!="string"||pt(t.typ)!==pt(i)))throw new x('unexpected "typ" JWT header value',n,"typ",j);const{requiredClaims:s=[],issuer:o,subject:a,audience:u,maxTokenAge:c}=r,p=[...s];c!==void 0&&p.push("iat"),u!==void 0&&p.push("aud"),a!==void 0&&p.push("sub"),o!==void 0&&p.push("iss");for(const v of new Set(p.reverse()))if(!Object.hasOwn(n,v))throw new x(`missing required "${v}" claim`,n,v,"missing");o!==void 0&&!(Array.isArray(o)?o:[o]).includes(n.iss)&&De(n,"iss"),a!==void 0&&n.sub!==a&&De(n,"sub"),u!==void 0&&!zr(n.aud,typeof u=="string"?[u]:u)&&De(n,"aud");const{clockTolerance:f}=r;let h=0;if(typeof f=="string")h=me(f);else if(f!==void 0){if(typeof f!="number")throw new TypeError("Invalid clockTolerance option type");h=f}oe("clockTolerance option",h);const{currentDate:S}
1=r,K=oe("currentDate option",se(S||new Date)),w=Oe(n,"iat",c!==void 0),m=Oe(n,"nbf");if(m!==void 0&&m>K+h)throw new x('"nbf" claim timestamp check failed',n,"nbf",j);const y=Oe(n,"exp");if(y!==void 0&&y<=K-h)throw new Ne('"exp" claim timestamp check failed',n,"exp",j);if(c!==void 0){const v=K-w,_=typeof c=="number"?c:me(c);if(v-h>_)throw new Ne('"iat" claim timestamp check failed (too far in the past)',n,"iat",j);if(v<0-h)throw new x('"iat" claim timestamp check failed (it should be in the past)',n,"iat",j)}return n}class et{#e;constructor(e){if(!E(e))throw new TypeError("JWT Claims Set MUST be an object");this.#e=structuredClone(e)}data(){return pe.encode(JSON.stringify(this.#e))}get iss(){return this.#e.iss}set iss(e){this.#e.iss=e}get sub(){return this.#e.sub}set sub(e){this.#e.sub=e}get aud(){return this.#e.aud}set aud(e){this.#e.aud=e}set jti(e){this.#e.jti=e}set nbf(e){this.#e.nbf=Re(e,"setNotBefore")}set exp(e){this.#e.exp=Re(e,"setExpirationTime")}set iat(e){e===void 0?this.#e.iat=se(new Date):typeof e=="string"?this.#e.iat=oe("setIssuedAt",se(new Date)+me(e)):this.#e.iat=Re(e,"setIssuedAt")}}async function xn(t,e,r){const n=await cr(t,Pe(r),e);if(!n[2])throw new J("JWTs MUST NOT use unencoded payload");const s={payload:Qe(n[1],n[0],r),protectedHeader:n[1]};return typeof e=="function"?{...s,key:n[3]}:s}async function Un(t,e,r){const n=await er(t,Ke(r),e),i=n[1],s=Qe(i,n[0],r);if(i.iss!==void 0&&i.iss!==s.iss)throw new x('replicated "iss" claim header parameter mismatch',s,"iss","mismatch");if(i.sub!==void 0&&i.sub!==s.sub)throw new x('replicated "sub" claim header parameter mismatch',s,"sub","mismatch");if(i.aud!==void 0&&JSON.stringify(i.aud)!==JSON.stringify(s.aud))throw new x('replicated "aud" claim header parameter mismatch',s,"aud","mismatch");const o={payload:s,protectedHeader:i};return typeof e=="function"?{...o,key:n[2]}:o}class Xr{#e;constructor(e){this.#e=new nr(e)}setContentEncryptionKey(e){return this.#e.setContentEncryptionKey(e),this}setInitializationVector(e){return this.#e.setInitializationVector(e),this}setProtectedHeader(e){return this.#e.setProtectedHeader(e),this}setKeyManagementParameters(e){return this.#e.setKeyManagementParameters(e),this}async encrypt(e,r){const n=await this.#e.encrypt(e,r);return[n.protected,n.encrypted_key,n.iv,n.ciphertext,n.tag].join(".")}}function dr(t){return t?.b64===!1&&Array.isArray(t.crit)&&t.crit.includes("b64")}async function ur(t,e){const{protectedHeader:r,unprotectedHeader:n}=t;if(!r&&!n)throw new l("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");if(!Ee(r,n))throw new l("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");const i={...r,...n};je(l,r);const s=Se(l,Vt,t.crit,r,i);let o=!0;if(s.includes("b64")&&(o=r.b64,typeof o!="boolean"))throw new l('The "b64" (base64url-encode payload) Header Parameter must be a boolean');const{alg:a}=i;if(typeof a!="string"||!a)throw new l('JWS "alg" (Algorithm) Header Parameter missing or invalid');const u=qe(a);let c,p;if(o){const y=t.encoded??=[];y[0]??=b(t.payload),y[1]??=W(y[0]),c=y[0],p=y[1]}else p=t.payload,c="";let f,h;r?(f=b(JSON.stringify(r)),h=W(f)):(f="",h=new Uint8Array);const S=I(h,W("."),p),K=await ee(u,e,"sign"),w=await Lr(u,K,S),m={signature:b(w),payload:c};return r&&(m.protected=f),n&&(m.header=n),m}class Yr{#e;#t;#r;constructor(e){if(!(e instanceof Uint8Array))throw new TypeError("payload must be an instance of Uint8Array");this.#e=e}setProtectedHeader(e){return A(this.#t,"setProtectedHeader"),this.#t=e,this}setUnprotectedHeader(e){return A(this.#r,"setUnprotectedHeader"),this.#r=e,this}async sign(e,r){return ur({payload:this.#e,protectedHeader:this.#t,unprotectedHeader:this.#r,crit:r?.crit},e)}}class jr{#e;#t;constructor(e){this.#e=new Yr(e)}setProtectedHeader(e){return this.#e.setProtectedHeader(e),this.#t=e,this}async sign(e,r){if(dr(this.#t))throw new TypeError("use the flattened module for creating JWS with b64: false");const n=await this.#e.sign(e,r);return`${n.protected}.${n.payload}.${n.signature}`}}class qr{#e;state;constructor(e,r,n){this.#e=e,this.state=[void 0,void 0,r,n?.crit]}setProtectedHeader(e){return A(this.state[0],"setProtectedHeader"),this.state[0]=e,this}setUnprotectedHeader(e){return A(this.state[1],"setUnprotectedHeader"),this.state[1]=e,this}addSignature(...e){return this.#e.addSignature(...e)}sign(...e){return this.#e.sign(...e)}done(){return this.#e}}class _n{#e;#t=[];constructor(e){this.#e=e}addSignature(e,r){const n=new qr(this,e,r);return this.#t.push(n),n}async sign(){if(!this.#t.length)throw new l("at least one signature must be added");if(!(this.#e instanceof Uint8Array))throw new TypeError("payload must be an instance of Uint8Array");const e={signatures:[],payload:""},r=[];for(let n=0;n<this.#t.length;n++){const i=this.#t[n],[s,o,a,u]=i.state,{payload:c,...p}=await ur({payload:this.#e,protectedHeader:s,unprotectedHeader:o,crit:u,encoded:r},a);if(n===0)e.payload=c;else if(e.payload!==c)throw new l("inconsistent use of JWS Unencoded Payload (RFC7797)");e.signatures.push(p)}return e}}class Rn{#e;#t;constructor(e={}){this.#t=new et(e)}setIssuer(e){return this.#t.iss=e,this}setSubject(e){return this.#t.sub=e,this}setAudience(e){return this.#t.aud=e,this}setJti(e){return this.#t.jti=e,this}setNotBefore(e){return this.#t.nbf=e,this}setExpirationTime(e){return this.#t.exp=e,this}
1setIssuedAt(e){return this.#t.iat=e,this}setProtectedHeader(e){return this.#e=e,this}async sign(e,r){const n=new jr(this.#t.data());if(n.setProtectedHeader(this.#e),dr(this.#e))throw new J("JWTs MUST NOT use unencoded payload");return n.sign(e,r)}}class On{#e;#t;#r;#n;#s;#a;#o;#i;constructor(e={}){this.#i=new et(e)}setIssuer(e){return this.#i.iss=e,this}setSubject(e){return this.#i.sub=e,this}setAudience(e){return this.#i.aud=e,this}setJti(e){return this.#i.jti=e,this}setNotBefore(e){return this.#i.nbf=e,this}setExpirationTime(e){return this.#i.exp=e,this}setIssuedAt(e){return this.#i.iat=e,this}setProtectedHeader(e){return A(this.#n,"setProtectedHeader"),this.#n=e,this}setKeyManagementParameters(e){return A(this.#r,"setKeyManagementParameters"),this.#r=e,this}setContentEncryptionKey(e){return A(this.#e,"setContentEncryptionKey"),this.#e=e,this}setInitializationVector(e){return A(this.#t,"setInitializationVector"),this.#t=e,this}replicateIssuerAsHeader(){return this.#s=!0,this}replicateSubjectAsHeader(){return this.#a=!0,this}replicateAudienceAsHeader(){return this.#o=!0,this}async encrypt(e,r){const n=new Xr(this.#i.data());return this.#n&&(this.#s||this.#a||this.#o)&&(this.#n={...this.#n,iss:this.#s?this.#i.iss:void 0,sub:this.#a?this.#i.sub:void 0,aud:this.#o?this.#i.aud:void 0}),n.setProtectedHeader(this.#n),this.#t&&n.setInitializationVector(this.#t),this.#e&&n.setContentEncryptionKey(this.#e),this.#r&&n.setKeyManagementParameters(this.#r),n.encrypt(e,r)}}function ie(t){const e=typeof t=="string"?or(t)??Rr(t):void 0;if(!e)throw new g('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');return e}const Zr=(t,e)=>{const r=(t.match(/.{1,64}/g)||[]).join(` 2`);return`-----BEGIN ${e}----- 3${r} 4-----END ${e}-----`},pr=async(t,e,r)=>{if(ze(r)){if(r.type!==t)throw new TypeError(`key is not a ${t} key`);return r.export({format:"pem",type:e})}if(!V(r))throw new TypeError(Q(r,"CryptoKey","KeyObject"));if(!r.extractable)throw new TypeError("CryptoKey is not extractable");if(r.type!==t)throw new TypeError(`key is not a ${t} key`);return Zr(Ht(new Uint8Array(await crypto.subtle.exportKey(e,r))),`${t.toUpperCase()} KEY`)},Qr=t=>pr("public","spki",t),en=t=>pr("private","pkcs8",t),ne=(t,e)=>{if(t.byteLength!==e.length)return!1;for(let r=0;r<t.byteLength;r++)if(t[r]!==e[r])return!1;return!0},fr=t=>({data:t,pos:0}),Be=t=>{const e=t.data[t.pos++];if(e===void 0)throw new Error("Unexpected end of ASN.1 input");return e},U=t=>{const e=Be(t);if(e&128){const r=e&127;let n=0;for(let i=0;i<r;i++)n=n<<8|Be(t);return n}return e},ft=(t,e=1)=>{for(;e-- >0;){t.pos++;const r=U(t);t.pos+=r}},D=(t,e,r)=>{if(Be(t)!==e)throw new Error(r)},hr=(t,e)=>{if(e<0||t.pos+e>t.data.length)throw new Error("Unexpected end of ASN.1 input");const r=t.data.subarray(t.pos,t.pos+e);return t.pos+=e,r},tn=t=>{D(t,6,"Expected algorithm OID");const e=U(t);return hr(t,e)};function rn(t,e){if(D(t,48,`Invalid ${e==="spki"?"SPKI":"PKCS#8"} structure`),U(t),e==="pkcs8"){D(t,2,"Expected version field");const r=U(t);t.pos+=r}D(t,48,"Expected algorithm identifier"),U(t)}const nn=t=>{const e=tn(t);if(ne(e,[43,101,110]))return"X25519";if(!ne(e,[42,134,72,206,61,2,1]))throw new Error("Unsupported key algorithm");D(t,6,"Expected curve OID");const r=U(t),n=hr(t,r);if(ne(n,[42,134,72,206,61,3,1,7]))return"P-256";if(ne(n,[43,129,4,0,34]))return"P-384";if(ne(n,[43,129,4,0,35]))return"P-521";throw new Error("Unsupported named curve")},tt=async(t,e,r,n)=>{const i=ie(r);if(i.secret)throw new g('Invalid or unsupported "alg" (Algorithm) value');const s=t==="spki";let o;if(i.resolve)try{const a=fr(e);rn(a,t),o=i.resolve({crv:nn(a)})}catch{throw new g("Invalid or unsupported key format")}else o=i.subtle;return crypto.subtle.importKey(t,e,o,n?.extractable??s,i.usages[s?0:1])},rt=(t,e)=>It(t.replace(e,"")),sn=(t,e,r)=>{const n=rt(t,/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g);return tt("pkcs8",n,e,r)},on=(t,e,r)=>{const n=rt(t,/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g);return tt("spki",n,e,r)};function an(t){const e=fr(t);D(e,48,"Invalid certificate structure"),U(e),D(e,48,"Invalid tbsCertificate structure"),U(e),t[e.pos]===160?ft(e,6):ft(e,5);const r=e.pos;D(e,48,"Invalid SPKI structure");const n=U(e);return t.subarray(r,r+n+(e.pos-r))}const cn=(t,e,r)=>{let n;
4try{const i=rt(t,/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g);n=an(i)}catch(i){throw new TypeError("Failed to parse the X.509 certificate",{cause:i})}return tt("spki",n,e,r)};function dn(t){return Object.fromEntries(Object.entries(t).filter(([,e])=>e!==void 0))}async function un(t){if(ze(t))if(t.type==="secret")t=t.export();else return t.export({format:"jwk"});if(t instanceof Uint8Array)return{kty:"oct",k:b(t)};if(!V(t))throw new TypeError(Q(t,"CryptoKey","KeyObject","Uint8Array"));if(!t.extractable)throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");const{ext:e,key_ops:r,alg:n,use:i,...s}=dn(await crypto.subtle.exportKey("jwk",t));return s.kty==="AKP"&&(s.alg=n),s}function Dn(t){return Qr(t)}function Mn(t){return en(t)}function pn(t){return un(t)}const T=(t,e)=>{if(typeof t!="string"||!t)throw new Et(`${e} missing or invalid`)};async function fn(t,e){let r;if(Tt(t))r=t;else if(St(t))r=await pn(t);else throw new TypeError(Q(t,"CryptoKey","KeyObject","JSON Web Key"));if(e??="sha256",e!=="sha256"&&e!=="sha384"&&e!=="sha512")throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');let n;switch(r.kty){case"AKP":T(r.alg,'"alg" (Algorithm) Parameter'),T(r.pub,'"pub" (Public key) Parameter'),n={alg:r.alg,kty:r.kty,pub:r.pub};break;case"EC":T(r.crv,'"crv" (Curve) Parameter'),T(r.x,'"x" (X Coordinate) Parameter'),T(r.y,'"y" (Y Coordinate) Parameter'),n={crv:r.crv,kty:r.kty,x:r.x,y:r.y};break;case"OKP":T(r.crv,'"crv" (Subtype of Key Pair) Parameter'),T(r.x,'"x" (Public Key) Parameter'),n={crv:r.crv,kty:r.kty,x:r.x};break;case"RSA":T(r.e,'"e" (Exponent) Parameter'),T(r.n,'"n" (Modulus) Parameter'),n={e:r.e,kty:r.kty,n:r.n};break;case"oct":T(r.k,'"k" (Key Value) Parameter'),n={k:r.k,kty:r.kty};break;default:throw new g('"kty" (Key Type) Parameter missing or unsupported')}const i=W(JSON.stringify(n));return b(await Ut(e,i))}async function Nn(t,e){e??="sha256";const r=await fn(t,e);return`urn:ietf:params:oauth:jwk-thumbprint:sha-${e.slice(-3)}:${r}`}async function kn(t,e){const r={...t,...e?.header};if(!E(r.jwk))throw new l('"jwk" (JSON Web Key) Header Parameter must be a JSON object');const n=qe(r.alg),i=await G(n,{...r.jwk,ext:!0});if(i.type!=="public")throw new l('"jwk" (JSON Web Key) Header Parameter must be a public key');return i}function hn(t){const e=typeof t=="string"?or(t):void 0;if(!e||e.secret)throw new g('Unsupported "alg" value for a JSON Web Key Set');return e}function ln(t){if(!t||typeof t!="object")return!1;const{keys:e}=t;return Array.isArray(e)&&e.every(E)}class yn{#e;#t=new WeakMap;constructor(e){if(!ln(e))throw new Ge("JSON Web Key Set malformed");this.#e=structuredClone(e)}jwks(){return this.#e}async getKey(e,r){const{alg:n,kid:i}={...e,...r?.header},s=hn(n),o=this.#e.keys.filter(c=>s.kty.includes(c.kty)&&(typeof i!="string"||i===c.kid)&&(!(typeof c.alg=="string"||c.kty==="AKP")||n===c.alg)&&(typeof c.use!="string"||c.use==="sig")&&(!Array.isArray(c.key_ops)||c.key_ops.includes("verify"))&&(!s.crv||c.crv===s.crv)),{0:a,length:u}=o;if(u===0)throw new Ve;if(u!==1){const c=new bt,p=this.#t;throw c[Symbol.asyncIterator]=async function*(){for(const f of o)try{yield await ht(p,f,s)}catch{}},c}return ht(this.#t,a,s)}}async function ht(t,e,r){const n=t.get(e)||t.set(e,{}).get(e);if(n[r.alg]===void 0){const i=await G(r,{...e,alg:r.alg,ext:!0});if(i.type!=="public")throw new Ge("JSON Web Key Set members must be public keys");n[r.alg]=i}return n[r.alg]}function lt(t){const e=new yn(t),r=async(n,i)=>e.getKey(n,i);return Object.defineProperty(r,"jwks",{value:()=>structuredClone(e.jwks())}),r}function wn(){return typeof WebSocketPair<"u"||typeof navigator<"u"&&navigator.userAgent==="Cloudflare-Workers"||typeof EdgeRuntime<"u"&&EdgeRuntime==="vercel"}let $e;(typeof navigator>"u"||!navigator.userAgent?.startsWith?.("Mozilla/5.0 "))&&($e="jose/v6.2.7");const mn=Symbol();async function gn(t,e,r,n=fetch){const i=await n(t,{method:"GET",signal:r,redirect:"manual",headers:e}).catch(s=>{throw s.name==="TimeoutError"?new At:s});if(i.status!==200)throw new P("Expected 200 OK from the JSON Web Key Set HTTP response");try{return await i.json()}catch{throw new P("Failed to parse the JSON Web Key Set HTTP response as JSON")}}const En=Symbol();function bn(t,e){return!(typeof t!="object"||t===null||!("uat"in t)||typeof t.uat!="number"||Date.now()-t.uat>
4=e||!("jwks"in t)||!E(t.jwks)||!Array.isArray(t.jwks.keys)||!Array.prototype.every.call(t.jwks.keys,E))}class An{#e;#t;#r;#n;#s;#a;#o;#i;#c;#d;constructor(e,r){if(!(e instanceof URL))throw new TypeError("url must be an instance of URL");this.#e=new URL(e.href);const n=r??{};this.#t=typeof n.timeoutDuration=="number"?n.timeoutDuration:5e3,this.#r=typeof n.cooldownDuration=="number"?n.cooldownDuration:3e4,this.#n=typeof n.cacheMaxAge=="number"?n.cacheMaxAge:6e5,this.#o=new Headers(n.headers),$e&&!this.#o.has("User-Agent")&&this.#o.set("User-Agent",$e),this.#o.has("accept")||(this.#o.set("accept","application/json"),this.#o.append("accept","application/jwk-set+json")),this.#i=n[mn];const i=n[En];i!==void 0&&(this.#d=i,bn(i,this.#n)&&(this.#s=this.#d.uat,this.#c=lt(this.#d.jwks)))}pendingFetch(){return!!this.#a}#u(e){return typeof this.#s=="number"&&Date.now()<this.#s+e}coolingDown(){return this.#u(this.#r)}fresh(){return this.#u(this.#n)}jwks(){return this.#c?.jwks()}async getKey(e,r){(!this.#c||!this.fresh())&&await this.reload();try{return await this.#c(e,r)}catch(n){if(n instanceof Ve&&this.coolingDown()===!1)return await this.reload(),this.#c(e,r);throw n}}async reload(){this.#a&&wn()&&(this.#a=void 0),this.#a||=gn(this.#e.href,this.#o,AbortSignal.timeout(this.#t),this.#i).then(e=>{this.#c=lt(e),this.#d&&(this.#d.uat=Date.now(),this.#d.jwks=e),this.#s=Date.now()}).finally(()=>{this.#a=void 0}),await this.#a}}function Bn(t,e){const r=new An(t,e),n=async(i,s)=>r.getKey(i,s);return Object.defineProperties(n,{coolingDown:{get:()=>r.coolingDown(),enumerable:!0},fresh:{get:()=>r.fresh(),enumerable:!0},reload:{value:()=>r.reload(),enumerable:!0},reloading:{get:()=>r.pendingFetch(),enumerable:!0},jwks:{value:()=>r.jwks(),enumerable:!0}}),n}class $n{#e;constructor(e={}){this.#e=new et(e)}encode(){const e=b(JSON.stringify({alg:"none"})),r=b(this.#e.data());return`${e}.${r}.`}setIssuer(e){return this.#e.iss=e,this}setSubject(e){return this.#e.sub=e,this}setAudience(e){return this.#e.aud=e,this}setJti(e){return this.#e.jti=e,this}setNotBefore(e){return this.#e.nbf=e,this}setExpirationTime(e){return this.#e.exp=e,this}setIssuedAt(e){return this.#e.iat=e,this}static decode(e,r){if(typeof e!="string")throw new J("Unsecured JWT must be a string");const{0:n,1:i,2:s,length:o}=e.split(".");if(o!==3||s!=="")throw new J("Invalid Unsecured JWT");let a;try{if(a=JSON.parse(ge.decode(F(n))),a.alg!=="none")throw new Error}catch{throw new J("Invalid Unsecured JWT")}return{payload:Qe(a,H(i,"payload",J),r),header:a}}}async function Ln(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN PUBLIC KEY-----")!==0)throw new TypeError('"spki" must be SPKI formatted string');return on(t,e,r)}async function Gn(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN CERTIFICATE-----")!==0)throw new TypeError('"x509" must be X.509 formatted string');return cn(t,e,r)}async function Vn(t,e,r){if(typeof t!="string"||t.indexOf("-----BEGIN PRIVATE KEY-----")!==0)throw new TypeError('"pkcs8" must be PKCS#8 formatted string');return sn(t,e,r)}async function Fn(t,e,r){if(!E(t))throw new TypeError("JWK must be an object");e??=t.alg;const n=r?.extractable??t.ext;if(t.kty!=="oct"&&!e)throw new TypeError('"alg" argument is required when "jwk.alg" is not present');switch(t.kty){case"oct":if(typeof t.k!="string"||!t.k)throw new TypeError('missing "k" (Key Value) Parameter value');return F(t.k);case"RSA":return G(ie(e),{...t,alg:e,ext:n});case"AKP":{if(typeof t.alg!="string"||!t.alg)throw new TypeError('missing "alg" (Algorithm) Parameter value');if(e!==void 0&&e!==t.alg)throw new TypeError("JWK alg and alg option value mismatch");return G(ie(t.alg),{...t,ext:n})}case"EC":case"OKP":return G(ie(e),{...t,alg:e,ext:n});default:throw new g('Unsupported "kty" (Key Type) Parameter value')}}function zn(t){let e;if(typeof t=="string"){const n=t.split(".");(n.length===3||n.length===5)&&([e]=n)}else if(typeof t=="object"&&t)if("protected"in t)e=t.protected;else throw new TypeError("Token does not contain a Protected Header");const r="Invalid Token or Protected Header formatting";if(typeof e!="string"||!e)throw new TypeError(r);return Xe(e,TypeError,r)}function Xn(t){if(typeof t!="string")throw new J("JWTs must use Compact JWS serialization, JWT must be a string");const{1:e,length:r}=t.split(".");if(r===5)throw new J("Only JWTs using Compact JWS serialization can be decoded");
4if(r!==3)throw new J("Invalid JWT");if(!e)throw new J("JWTs must contain a payload");let n;try{n=F(e)}catch{throw new J("Failed to base64url decode the payload")}let i;try{i=JSON.parse(ge.decode(n))}catch{throw new J("Failed to parse the decoded payload as JSON")}if(!E(i))throw new J("Invalid JWT Claims Set");return i}function Sn(t){const e=t?.modulusLength??2048;if(typeof e!="number"||e<2048)throw new g("Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used");return e}async function Yn(t,e){const r=ie(t);if(r.secret)throw new g('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');let n;if(r.resolve){const i=e?.crv??"P-256";switch(i){case"P-256":case"P-384":case"P-521":n={name:"ECDH",namedCurve:i};break;case"X25519":n={name:"X25519"};break;default:throw new g("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519")}}else{if(r.crv!==void 0&&e?.crv!==void 0&&e.crv!==r.crv)throw new g(`Invalid or unsupported crv option provided, the only supported value for ${t} is ${r.crv}`);n=r.kty[0]==="RSA"?{...r.subtle,publicExponent:Uint8Array.of(1,0,1),modulusLength:Sn(e)}:r.subtle}return crypto.subtle.generateKey(n,e?.extractable??!1,[...r.usages[1],...r.usages[0]])}async function jn(t,e){let r,n,i;switch(t){case"HS256":case"HS384":case"HS512":r=parseInt(t.slice(-3),10),n={name:"HMAC",hash:`SHA-${r}`,length:r},i=["sign","verify"];break;case"A128CBC-HS256":case"A192CBC-HS384":case"A256CBC-HS512":return r=parseInt(t.slice(-3),10),crypto.getRandomValues(new Uint8Array(r>>3));case"A128KW":case"A192KW":case"A256KW":r=parseInt(t.slice(1,4),10),n={name:"AES-KW",length:r},i=["wrapKey","unwrapKey"];break;case"A128GCMKW":case"A192GCMKW":case"A256GCMKW":case"A128GCM":case"A192GCM":case"A256GCM":r=parseInt(t.slice(1,4),10),n={name:"AES-GCM",length:r},i=["encrypt","decrypt"];break;default:throw new g('Invalid or unsupported JWK "alg" (Algorithm) Parameter value')}return crypto.subtle.generateKey(n,e?.extractable??!1,i)}const qn="WebCryptoAPI";export{Xr as CompactEncrypt,jr as CompactSign,kn as EmbeddedJWK,On as EncryptJWT,nr as FlattenedEncrypt,Yr as FlattenedSign,Wn as GeneralEncrypt,_n as GeneralSign,Rn as SignJWT,$n as UnsecuredJWT,Pn as base64url,fn as calculateJwkThumbprint,Nn as calculateJwkThumbprintUri,vn as compactDecrypt,Hn as compactVerify,lt as createLocalJWKSet,Bn as createRemoteJWKSet,qn as cryptoRuntime,mn as customFetch,Xn as decodeJwt,zn as decodeProtectedHeader,Kn as errors,pn as exportJWK,Mn as exportPKCS8,Dn as exportSPKI,Cn as flattenedDecrypt,In as flattenedVerify,Jn as generalDecrypt,Tn as generalVerify,Yn as generateKeyPair,jn as generateSecret,Fn as importJWK,Vn as importPKCS8,Ln as importSPKI,Gn as importX509,En as jwksCache,Un as jwtDecrypt,xn as jwtVerify};
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.