// Code generated by tools/cmd/genjwk/main.go. DO NOT EDIT.

package jwk

import (
	"bytes"
	"fmt"
	"sort"
	"sync"

	"github.com/lestrrat-go/blackmagic"
	"github.com/lestrrat-go/jwx/v3/cert"
	"github.com/lestrrat-go/jwx/v3/internal/base64"
	"github.com/lestrrat-go/jwx/v3/internal/json"
	"github.com/lestrrat-go/jwx/v3/internal/pool"
	"github.com/lestrrat-go/jwx/v3/internal/tokens"
	"github.com/lestrrat-go/jwx/v3/jwa"
	"github.com/lestrrat-go/jwx/v3/jwk/internal/registry"
)

const (
	ECDSACrvKey = "crv"
	ECDSADKey   = "d"
	ECDSAXKey   = "x"
	ECDSAYKey   = "y"
)

type ECDSAPublicKey interface {
	Key
	Crv() (jwa.EllipticCurveAlgorithm, bool)
	X() ([]byte, bool)
	Y() ([]byte, bool)
}

type ecdsaPublicKey struct {
	algorithm              *jwa.KeyAlgorithm // https://tools.ietf.org/html/rfc7517#section-4.4
	crv                    *jwa.EllipticCurveAlgorithm
	keyID                  *string           // https://tools.ietf.org/html/rfc7515#section-4.1.4
	keyOps                 *KeyOperationList // https://tools.ietf.org/html/rfc7517#section-4.3
	keyUsage               *string           // https://tools.ietf.org/html/rfc7517#section-4.2
	x                      []byte
	x509CertChain          *cert.Chain // https://tools.ietf.org/html/rfc7515#section-4.1.6
	x509CertThumbprint     *string     // https://tools.ietf.org/html/rfc7515#section-4.1.7
	x509CertThumbprintS256 *string     // https://tools.ietf.org/html/rfc7515#section-4.1.8
	x509URL                *string     // https://tools.ietf.org/html/rfc7515#section-4.1.5
	y                      []byte
	privateParams          map[string]any
	mu                     sync.RWMutex
	dc                     json.DecodeCtx
}

var _ ECDSAPublicKey = &ecdsaPublicKey{}
var _ Key = &ecdsaPublicKey{}

func newECDSAPublicKey() *ecdsaPublicKey {
	return &ecdsaPublicKey{
		privateParams: make(map[string]any),
	}
}

func (h *ecdsaPublicKey) KeyType() jwa.KeyType {
	return jwa.EC()
}

func (h *ecdsaPublicKey) rlock() {
	h.mu.RLock()
}

func (h *ecdsaPublicKey) runlock() {
	h.mu.RUnlock()
}

func (h *ecdsaPublicKey) IsPrivate() bool {
	return false
}

func (h *ecdsaPublicKey) Algorithm() (jwa.KeyAlgorithm, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.algorithm != nil {
		return *(h.algorithm), true
	}
	return nil, false
}

func (h *ecdsaPublicKey) Crv() (jwa.EllipticCurveAlgorithm, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.crv != nil {
		return *(h.crv), true
	}
	return jwa.InvalidEllipticCurve(), false
}

func (h *ecdsaPublicKey) KeyID() (string, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.keyID != nil {
		return *(h.keyID), true
	}
	return "", false
}

func (h *ecdsaPublicKey) KeyOps() (KeyOperationList, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.keyOps != nil {
		return *(h.keyOps), true
	}
	return nil, false
}

func (h *ecdsaPublicKey) KeyUsage() (string, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.keyUsage != nil {
		return *(h.keyUsage), true
	}
	return "", false
}

func (h *ecdsaPublicKey) X() ([]byte, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.x != nil {
		return h.x, true
	}
	return nil, false
}

func (h *ecdsaPublicKey) X509CertChain() (*cert.Chain, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.x509CertChain != nil {
		return h.x509CertChain, true
	}
	return nil, false
}

func (h *ecdsaPublicKey) X509CertThumbprint() (string, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.x509CertThumbprint != nil {
		return *(h.x509CertThumbprint), true
	}
	return "", false
}

func (h *ecdsaPublicKey) X509CertThumbprintS256() (string, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.x509CertThumbprintS256 != nil {
		return *(h.x509CertThumbprintS256), true
	}
	return "", false
}

func (h *ecdsaPublicKey) X509URL() (string, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.x509URL != nil {
		return *(h.x509URL), true
	}
	return "", false
}

func (h *ecdsaPublicKey) Y() ([]byte, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.y != nil {
		return h.y, true
	}
	return nil, false
}

func (h *ecdsaPublicKey) Has(name string) bool {
	h.mu.RLock()
	defer h.mu.RUnlock()
	switch name {
	case KeyTypeKey:
		return true
	case AlgorithmKey:
		return h.algorithm != nil
	case ECDSACrvKey:
		return h.crv != nil
	case KeyIDKey:
		return h.keyID != nil
	case KeyOpsKey:
		return h.keyOps != nil
	case KeyUsageKey:
		return h.keyUsage != nil
	case ECDSAXKey:
		return h.x != nil
	case X509CertChainKey:
		return h.x509CertChain != nil
	case X509CertThumbprintKey:
		return h.x509CertThumbprint != nil
	case X509CertThumbprintS256Key:
		return h.x509CertThumbprintS256 != nil
	case X509URLKey:
		return h.x509URL != nil
	case ECDSAYKey:
		return h.y != nil
	default:
		_, ok := h.privateParams[name]
		return ok
	}
}

func (h *ecdsaPublicKey) Get(name string, dst any) error {
	h.mu.RLock()
	defer h.mu.RUnlock()
	switch name {
	case KeyTypeKey:
		if err := blackmagic.AssignIfCompatible(dst, h.KeyType()); err != nil {
			return fmt.Errorf(`ecdsaPublicKey.Get: failed to assign value for field %q to destination object: %w`, name, err)
		}
	case AlgorithmKey:
		if h.algorithm == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, *(h.algorithm)); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case ECDSACrvKey:
		if h.crv == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, *(h.crv)); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case KeyIDKey:
		if h.keyID == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, *(h.keyID)); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case KeyOpsKey:
		if h.keyOps == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, *(h.keyOps)); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case KeyUsageKey:
		if h.keyUsage == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, *(h.keyUsage)); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case ECDSAXKey:
		if h.x == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, h.x); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case X509CertChainKey:
		if h.x509CertChain == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, h.x509CertChain); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case X509CertThumbprintKey:
		if h.x509CertThumbprint == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, *(h.x509CertThumbprint)); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case X509CertThumbprintS256Key:
		if h.x509CertThumbprintS256 == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, *(h.x509CertThumbprintS256)); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case X509URLKey:
		if h.x509URL == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, *(h.x509URL)); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case ECDSAYKey:
		if h.y == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, h.y); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	default:
		v, ok := h.privateParams[name]
		if !ok {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, v); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
	}
	return nil
}

func (h *ecdsaPublicKey) Set(name string, value any) error {
	h.mu.Lock()
	defer h.mu.Unlock()
	return h.setNoLock(name, value)
}

func (h *ecdsaPublicKey) setNoLock(name string, value any) error {
	switch name {
	case "kty":
		return nil
	case AlgorithmKey:
		switch v := value.(type) {
		case string, jwa.SignatureAlgorithm, jwa.KeyEncryptionAlgorithm, jwa.ContentEncryptionAlgorithm:
			tmp, err := jwa.KeyAlgorithmFrom(v)
			if err != nil {
				return fmt.Errorf(`invalid algorithm for %q key: %w`, AlgorithmKey, err)
			}
			h.algorithm = &tmp
		default:
			return fmt.Errorf(`invalid type for %q key: %T`, AlgorithmKey, value)
		}
		return nil
	case ECDSACrvKey:
		if v, ok := value.(jwa.EllipticCurveAlgorithm); ok {
			h.crv = &v
			return nil
		}
		return fmt.Errorf(`invalid value for %s key: %T`, ECDSACrvKey, value)
	case KeyIDKey:
		if v, ok := value.(string); ok {
			h.keyID = &v
			return nil
		}
		return fmt.Errorf(`invalid value for %s key: %T`, KeyIDKey, value)
	case KeyOpsKey:
		var acceptor KeyOperationList
		if err := acceptor.Accept(value); err != nil {
			return fmt.Errorf(`invalid value for %s key: %w`, KeyOpsKey, err)
		}
		h.keyOps = &acceptor
		return nil
	case KeyUsageKey:
		switch v := value.(type) {
		case KeyUsageType:
			switch v {
			case ForSignature, ForEncryption:
				tmp := v.String()
				h.keyUsage = &tmp
			default:
				return fmt.Errorf(`invalid key usage type %s`, v)
			}
		case string:
			h.keyUsage = &v
		default:
			return fmt.Errorf(`invalid key usage type %s`, v)
		}
	case ECDSAXKey:
		if v, ok := value.([]byte); ok {
			if v == nil {
				h.x = nil
			} else {
				h.x = make([]byte, len(v))
				copy(h.x, v)
			}
			return nil
		}
		return fmt.Errorf(`invalid value for %s key: %T`, ECDSAXKey, value)
	case X509CertChainKey:
		if v, ok := value.(*cert.Chain); ok {
			h.x509CertChain = v
			return nil
		}
		return fmt.Errorf(`invalid value for %s key: %T`, X509CertChainKey, value)
	case X509CertThumbprintKey:
		if v, ok := value.(string); ok {
			h.x509CertThumbprint = &v
			return nil
		}
		return fmt.Errorf(`invalid value for %s key: %T`, X509CertThumbprintKey, value)
	case X509CertThumbprintS256Key:
		if v, ok := value.(string); ok {
			h.x509CertThumbprintS256 = &v
			return nil
		}
		return fmt.Errorf(`invalid value for %s key: %T`, X509CertThumbprintS256Key, value)
	case X509URLKey:
		if v, ok := value.(string); ok {
			h.x509URL = &v
			return nil
		}
		return fmt.Errorf(`invalid value for %s key: %T`, X509URLKey, value)
	case ECDSAYKey:
		if v, ok := value.([]byte); ok {
			if v == nil {
				h.y = nil
			} else {
				h.y = make([]byte, len(v))
				copy(h.y, v)
			}
			return nil
		}
		return fmt.Errorf(`invalid value for %s key: %T`, ECDSAYKey, value)
	default:
		if h.privateParams == nil {
			h.privateParams = map[string]any{}
		}
		h.privateParams[name] = value
	}
	return nil
}

func (k *ecdsaPublicKey) Remove(key string) error {
	k.mu.Lock()
	defer k.mu.Unlock()
	switch key {
	case AlgorithmKey:
		k.algorithm = nil
	case ECDSACrvKey:
		k.crv = nil
	case KeyIDKey:
		k.keyID = nil
	case KeyOpsKey:
		k.keyOps = nil
	case KeyUsageKey:
		k.keyUsage = nil
	case ECDSAXKey:
		k.x = nil
	case X509CertChainKey:
		k.x509CertChain = nil
	case X509CertThumbprintKey:
		k.x509CertThumbprint = nil
	case X509CertThumbprintS256Key:
		k.x509CertThumbprintS256 = nil
	case X509URLKey:
		k.x509URL = nil
	case ECDSAYKey:
		k.y = nil
	default:
		delete(k.privateParams, key)
	}
	return nil
}

func (k *ecdsaPublicKey) Clone() (Key, error) {
	key, err := cloneKey(k)
	if err != nil {
		return nil, fmt.Errorf(`ecdsaPublicKey.Clone: %w`, err)
	}
	return key, nil
}

func (k *ecdsaPublicKey) DecodeCtx() json.DecodeCtx {
	k.mu.RLock()
	defer k.mu.RUnlock()
	return k.dc
}

func (k *ecdsaPublicKey) SetDecodeCtx(dc json.DecodeCtx) {
	k.mu.Lock()
	defer k.mu.Unlock()
	k.dc = dc
}

func (h *ecdsaPublicKey) UnmarshalJSON(buf []byte) error {
	h.mu.Lock()
	defer h.mu.Unlock()
	h.algorithm = nil
	h.crv = nil
	h.keyID = nil
	h.keyOps = nil
	h.keyUsage = nil
	h.x = nil
	h.x509CertChain = nil
	h.x509CertThumbprint = nil
	h.x509CertThumbprintS256 = nil
	h.x509URL = nil
	h.y = nil
	dec := json.NewDecoder(bytes.NewReader(buf))
LOOP:
	for {
		tok, err := dec.Token()
		if err != nil {
			return fmt.Errorf(`error reading token: %w`, err)
		}
		switch tok := tok.(type) {
		case json.Delim:
			// Assuming we're doing everything correctly, we should ONLY
			// get either tokens.OpenCurlyBracket or tokens.CloseCurlyBracket here.
			if tok == tokens.CloseCurlyBracket { // End of object
				break LOOP
			} else if tok != tokens.OpenCurlyBracket {
				return fmt.Errorf(`expected '%c' but got '%c'`, tokens.OpenCurlyBracket, tok)
			}
		case string: // Objects can only have string keys
			switch tok {
			case KeyTypeKey:
				val, err := json.ReadNextStringToken(dec, h.dc)
				if err != nil {
					return fmt.Errorf(`error reading token: %w`, err)
				}
				if val != jwa.EC().String() {
					return fmt.Errorf(`invalid kty value for RSAPublicKey (%s)`, val)
				}
			case AlgorithmKey:
				var s string
				if err := dec.Decode(&s); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, AlgorithmKey, err)
				}
				alg, err := jwa.KeyAlgorithmFrom(s)
				if err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, AlgorithmKey, err)
				}
				h.algorithm = &alg
			case ECDSACrvKey:
				var decoded jwa.EllipticCurveAlgorithm
				if err := dec.Decode(&decoded); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, ECDSACrvKey, err)
				}
				h.crv = &decoded
			case KeyIDKey:
				if err := json.AssignNextStringToken(&h.keyID, dec, h.dc); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, KeyIDKey, err)
				}
			case KeyOpsKey:
				var decoded KeyOperationList
				if err := dec.Decode(&decoded); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, KeyOpsKey, err)
				}
				h.keyOps = &decoded
			case KeyUsageKey:
				if err := json.AssignNextStringToken(&h.keyUsage, dec, h.dc); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, KeyUsageKey, err)
				}
			case ECDSAXKey:
				if err := json.AssignNextBytesToken(&h.x, dec); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, ECDSAXKey, err)
				}
			case X509CertChainKey:
				var decoded cert.Chain
				if err := dec.Decode(&decoded); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, X509CertChainKey, err)
				}
				h.x509CertChain = &decoded
			case X509CertThumbprintKey:
				if err := json.AssignNextStringToken(&h.x509CertThumbprint, dec, h.dc); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, X509CertThumbprintKey, err)
				}
			case X509CertThumbprintS256Key:
				if err := json.AssignNextStringToken(&h.x509CertThumbprintS256, dec, h.dc); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, X509CertThumbprintS256Key, err)
				}
			case X509URLKey:
				if err := json.AssignNextStringToken(&h.x509URL, dec, h.dc); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, X509URLKey, err)
				}
			case ECDSAYKey:
				if err := json.AssignNextBytesToken(&h.y, dec); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, ECDSAYKey, err)
				}
			default:
				if dc := h.dc; dc != nil {
					if localReg := dc.Registry(); localReg != nil {
						decoded, err := localReg.Decode(dec, tok)
						if err == nil {
							h.setNoLock(tok, decoded)
							continue
						}
					}
				}
				decoded, err := fieldRegistry.Decode(dec, tok)
				if err == nil {
					h.setNoLock(tok, decoded)
					continue
				}
				return fmt.Errorf(`could not decode field %s: %w`, tok, err)
			}
		default:
			return fmt.Errorf(`invalid token %T`, tok)
		}
	}
	if h.crv == nil {
		return fmt.Errorf(`required field crv is missing`)
	}
	if h.x == nil {
		return fmt.Errorf(`required field x is missing`)
	}
	if h.y == nil {
		return fmt.Errorf(`required field y is missing`)
	}
	return nil
}

func (h *ecdsaPublicKey) makePairs() ([]fieldPair, error) {
	pairs := getFieldPairList()
	h.mu.RLock()
	defer h.mu.RUnlock()
	{
		v, err := json.Marshal(jwa.EC())
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, KeyTypeKey, err)
		}
		pairs = append(pairs, fieldPair{Name: KeyTypeKey, Value: v})
	}
	if h.algorithm != nil {
		v, err := json.Marshal(*(h.algorithm))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, AlgorithmKey, err)
		}
		pairs = append(pairs, fieldPair{Name: AlgorithmKey, Value: v})
	}
	if h.crv != nil {
		v, err := json.Marshal(*(h.crv))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, ECDSACrvKey, err)
		}
		pairs = append(pairs, fieldPair{Name: ECDSACrvKey, Value: v})
	}
	if h.keyID != nil {
		v, err := json.Marshal(*(h.keyID))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, KeyIDKey, err)
		}
		pairs = append(pairs, fieldPair{Name: KeyIDKey, Value: v})
	}
	if h.keyOps != nil {
		v, err := json.Marshal(*(h.keyOps))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, KeyOpsKey, err)
		}
		pairs = append(pairs, fieldPair{Name: KeyOpsKey, Value: v})
	}
	if h.keyUsage != nil {
		v, err := json.Marshal(*(h.keyUsage))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, KeyUsageKey, err)
		}
		pairs = append(pairs, fieldPair{Name: KeyUsageKey, Value: v})
	}
	if h.x != nil {
		v, err := json.Marshal(base64.EncodeToString(h.x))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, ECDSAXKey, err)
		}
		pairs = append(pairs, fieldPair{Name: ECDSAXKey, Value: v})
	}
	if h.x509CertChain != nil {
		v, err := json.Marshal(h.x509CertChain)
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, X509CertChainKey, err)
		}
		pairs = append(pairs, fieldPair{Name: X509CertChainKey, Value: v})
	}
	if h.x509CertThumbprint != nil {
		v, err := json.Marshal(*(h.x509CertThumbprint))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, X509CertThumbprintKey, err)
		}
		pairs = append(pairs, fieldPair{Name: X509CertThumbprintKey, Value: v})
	}
	if h.x509CertThumbprintS256 != nil {
		v, err := json.Marshal(*(h.x509CertThumbprintS256))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, X509CertThumbprintS256Key, err)
		}
		pairs = append(pairs, fieldPair{Name: X509CertThumbprintS256Key, Value: v})
	}
	if h.x509URL != nil {
		v, err := json.Marshal(*(h.x509URL))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, X509URLKey, err)
		}
		pairs = append(pairs, fieldPair{Name: X509URLKey, Value: v})
	}
	if h.y != nil {
		v, err := json.Marshal(base64.EncodeToString(h.y))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, ECDSAYKey, err)
		}
		pairs = append(pairs, fieldPair{Name: ECDSAYKey, Value: v})
	}
	for k, v := range h.privateParams {
		var encoded []byte
		switch v := v.(type) {
		case []byte:
			var err error
			encoded, err = json.Marshal(base64.EncodeToString(v))
			if err != nil {
				return nil, fmt.Errorf(`failed to marshal field %q: %w`, k, err)
			}
		default:
			var err error
			encoded, err = json.Marshal(v)
			if err != nil {
				return nil, fmt.Errorf(`failed to marshal field %q: %w`, k, err)
			}
		}
		pairs = append(pairs, fieldPair{Name: k, Value: encoded})
	}

	sort.Slice(pairs, func(i, j int) bool {
		return pairs[i].Name < pairs[j].Name
	})

	return pairs, nil
}

func (h *ecdsaPublicKey) MarshalJSON() ([]byte, error) {
	buf := pool.BytesBuffer().Get()
	defer pool.BytesBuffer().Put(buf)
	pairs, err := h.makePairs()
	if err != nil {
		return nil, fmt.Errorf(`failed to make pairs: %w`, err)
	}
	buf.WriteByte(tokens.OpenCurlyBracket)

	for i, pair := range pairs {
		if i > 0 {
			buf.WriteByte(tokens.Comma)
		}
		buf.WriteByte('"')
		buf.WriteString(pair.Name)
		buf.WriteString(`": `)
		buf.Write(pair.Value.([]byte))
	}
	buf.WriteByte(tokens.CloseCurlyBracket)
	ret := make([]byte, buf.Len())
	copy(ret, buf.Bytes())
	putFieldPairList(pairs)
	return ret, nil
}

func (h *ecdsaPublicKey) Keys() []string {
	h.mu.RLock()
	defer h.mu.RUnlock()
	keys := make([]string, 0, 11+len(h.privateParams))
	keys = append(keys, KeyTypeKey)
	if h.algorithm != nil {
		keys = append(keys, AlgorithmKey)
	}
	if h.crv != nil {
		keys = append(keys, ECDSACrvKey)
	}
	if h.keyID != nil {
		keys = append(keys, KeyIDKey)
	}
	if h.keyOps != nil {
		keys = append(keys, KeyOpsKey)
	}
	if h.keyUsage != nil {
		keys = append(keys, KeyUsageKey)
	}
	if h.x != nil {
		keys = append(keys, ECDSAXKey)
	}
	if h.x509CertChain != nil {
		keys = append(keys, X509CertChainKey)
	}
	if h.x509CertThumbprint != nil {
		keys = append(keys, X509CertThumbprintKey)
	}
	if h.x509CertThumbprintS256 != nil {
		keys = append(keys, X509CertThumbprintS256Key)
	}
	if h.x509URL != nil {
		keys = append(keys, X509URLKey)
	}
	if h.y != nil {
		keys = append(keys, ECDSAYKey)
	}
	for k := range h.privateParams {
		keys = append(keys, k)
	}
	return keys
}

type ECDSAPrivateKey interface {
	Key
	Crv() (jwa.EllipticCurveAlgorithm, bool)
	D() ([]byte, bool)
	X() ([]byte, bool)
	Y() ([]byte, bool)
}

type ecdsaPrivateKey struct {
	algorithm              *jwa.KeyAlgorithm // https://tools.ietf.org/html/rfc7517#section-4.4
	crv                    *jwa.EllipticCurveAlgorithm
	d                      []byte
	keyID                  *string           // https://tools.ietf.org/html/rfc7515#section-4.1.4
	keyOps                 *KeyOperationList // https://tools.ietf.org/html/rfc7517#section-4.3
	keyUsage               *string           // https://tools.ietf.org/html/rfc7517#section-4.2
	x                      []byte
	x509CertChain          *cert.Chain // https://tools.ietf.org/html/rfc7515#section-4.1.6
	x509CertThumbprint     *string     // https://tools.ietf.org/html/rfc7515#section-4.1.7
	x509CertThumbprintS256 *string     // https://tools.ietf.org/html/rfc7515#section-4.1.8
	x509URL                *string     // https://tools.ietf.org/html/rfc7515#section-4.1.5
	y                      []byte
	privateParams          map[string]any
	mu                     sync.RWMutex
	dc                     json.DecodeCtx
}

var _ ECDSAPrivateKey = &ecdsaPrivateKey{}
var _ Key = &ecdsaPrivateKey{}

func newECDSAPrivateKey() *ecdsaPrivateKey {
	return &ecdsaPrivateKey{
		privateParams: make(map[string]any),
	}
}

func (h *ecdsaPrivateKey) KeyType() jwa.KeyType {
	return jwa.EC()
}

func (h *ecdsaPrivateKey) rlock() {
	h.mu.RLock()
}

func (h *ecdsaPrivateKey) runlock() {
	h.mu.RUnlock()
}

func (h *ecdsaPrivateKey) IsPrivate() bool {
	return true
}

func (h *ecdsaPrivateKey) Algorithm() (jwa.KeyAlgorithm, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.algorithm != nil {
		return *(h.algorithm), true
	}
	return nil, false
}

func (h *ecdsaPrivateKey) Crv() (jwa.EllipticCurveAlgorithm, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.crv != nil {
		return *(h.crv), true
	}
	return jwa.InvalidEllipticCurve(), false
}

func (h *ecdsaPrivateKey) D() ([]byte, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.d != nil {
		return h.d, true
	}
	return nil, false
}

func (h *ecdsaPrivateKey) KeyID() (string, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.keyID != nil {
		return *(h.keyID), true
	}
	return "", false
}

func (h *ecdsaPrivateKey) KeyOps() (KeyOperationList, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.keyOps != nil {
		return *(h.keyOps), true
	}
	return nil, false
}

func (h *ecdsaPrivateKey) KeyUsage() (string, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.keyUsage != nil {
		return *(h.keyUsage), true
	}
	return "", false
}

func (h *ecdsaPrivateKey) X() ([]byte, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.x != nil {
		return h.x, true
	}
	return nil, false
}

func (h *ecdsaPrivateKey) X509CertChain() (*cert.Chain, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.x509CertChain != nil {
		return h.x509CertChain, true
	}
	return nil, false
}

func (h *ecdsaPrivateKey) X509CertThumbprint() (string, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.x509CertThumbprint != nil {
		return *(h.x509CertThumbprint), true
	}
	return "", false
}

func (h *ecdsaPrivateKey) X509CertThumbprintS256() (string, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.x509CertThumbprintS256 != nil {
		return *(h.x509CertThumbprintS256), true
	}
	return "", false
}

func (h *ecdsaPrivateKey) X509URL() (string, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.x509URL != nil {
		return *(h.x509URL), true
	}
	return "", false
}

func (h *ecdsaPrivateKey) Y() ([]byte, bool) {
	h.mu.RLock()
	defer h.mu.RUnlock()
	if h.y != nil {
		return h.y, true
	}
	return nil, false
}

func (h *ecdsaPrivateKey) Has(name string) bool {
	h.mu.RLock()
	defer h.mu.RUnlock()
	switch name {
	case KeyTypeKey:
		return true
	case AlgorithmKey:
		return h.algorithm != nil
	case ECDSACrvKey:
		return h.crv != nil
	case ECDSADKey:
		return h.d != nil
	case KeyIDKey:
		return h.keyID != nil
	case KeyOpsKey:
		return h.keyOps != nil
	case KeyUsageKey:
		return h.keyUsage != nil
	case ECDSAXKey:
		return h.x != nil
	case X509CertChainKey:
		return h.x509CertChain != nil
	case X509CertThumbprintKey:
		return h.x509CertThumbprint != nil
	case X509CertThumbprintS256Key:
		return h.x509CertThumbprintS256 != nil
	case X509URLKey:
		return h.x509URL != nil
	case ECDSAYKey:
		return h.y != nil
	default:
		_, ok := h.privateParams[name]
		return ok
	}
}

func (h *ecdsaPrivateKey) Get(name string, dst any) error {
	h.mu.RLock()
	defer h.mu.RUnlock()
	switch name {
	case KeyTypeKey:
		if err := blackmagic.AssignIfCompatible(dst, h.KeyType()); err != nil {
			return fmt.Errorf(`ecdsaPrivateKey.Get: failed to assign value for field %q to destination object: %w`, name, err)
		}
	case AlgorithmKey:
		if h.algorithm == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, *(h.algorithm)); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case ECDSACrvKey:
		if h.crv == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, *(h.crv)); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case ECDSADKey:
		if h.d == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, h.d); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case KeyIDKey:
		if h.keyID == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, *(h.keyID)); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case KeyOpsKey:
		if h.keyOps == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, *(h.keyOps)); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case KeyUsageKey:
		if h.keyUsage == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, *(h.keyUsage)); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case ECDSAXKey:
		if h.x == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, h.x); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case X509CertChainKey:
		if h.x509CertChain == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, h.x509CertChain); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case X509CertThumbprintKey:
		if h.x509CertThumbprint == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, *(h.x509CertThumbprint)); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case X509CertThumbprintS256Key:
		if h.x509CertThumbprintS256 == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, *(h.x509CertThumbprintS256)); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case X509URLKey:
		if h.x509URL == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, *(h.x509URL)); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	case ECDSAYKey:
		if h.y == nil {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, h.y); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
		return nil
	default:
		v, ok := h.privateParams[name]
		if !ok {
			return fmt.Errorf(`field %q not found`, name)
		}
		if err := blackmagic.AssignIfCompatible(dst, v); err != nil {
			return fmt.Errorf(`failed to assign value for field %q: %w`, name, err)
		}
	}
	return nil
}

func (h *ecdsaPrivateKey) Set(name string, value any) error {
	h.mu.Lock()
	defer h.mu.Unlock()
	return h.setNoLock(name, value)
}

func (h *ecdsaPrivateKey) setNoLock(name string, value any) error {
	switch name {
	case "kty":
		return nil
	case AlgorithmKey:
		switch v := value.(type) {
		case string, jwa.SignatureAlgorithm, jwa.KeyEncryptionAlgorithm, jwa.ContentEncryptionAlgorithm:
			tmp, err := jwa.KeyAlgorithmFrom(v)
			if err != nil {
				return fmt.Errorf(`invalid algorithm for %q key: %w`, AlgorithmKey, err)
			}
			h.algorithm = &tmp
		default:
			return fmt.Errorf(`invalid type for %q key: %T`, AlgorithmKey, value)
		}
		return nil
	case ECDSACrvKey:
		if v, ok := value.(jwa.EllipticCurveAlgorithm); ok {
			h.crv = &v
			return nil
		}
		return fmt.Errorf(`invalid value for %s key: %T`, ECDSACrvKey, value)
	case ECDSADKey:
		if v, ok := value.([]byte); ok {
			if v == nil {
				h.d = nil
			} else {
				h.d = make([]byte, len(v))
				copy(h.d, v)
			}
			return nil
		}
		return fmt.Errorf(`invalid value for %s key: %T`, ECDSADKey, value)
	case KeyIDKey:
		if v, ok := value.(string); ok {
			h.keyID = &v
			return nil
		}
		return fmt.Errorf(`invalid value for %s key: %T`, KeyIDKey, value)
	case KeyOpsKey:
		var acceptor KeyOperationList
		if err := acceptor.Accept(value); err != nil {
			return fmt.Errorf(`invalid value for %s key: %w`, KeyOpsKey, err)
		}
		h.keyOps = &acceptor
		return nil
	case KeyUsageKey:
		switch v := value.(type) {
		case KeyUsageType:
			switch v {
			case ForSignature, ForEncryption:
				tmp := v.String()
				h.keyUsage = &tmp
			default:
				return fmt.Errorf(`invalid key usage type %s`, v)
			}
		case string:
			h.keyUsage = &v
		default:
			return fmt.Errorf(`invalid key usage type %s`, v)
		}
	case ECDSAXKey:
		if v, ok := value.([]byte); ok {
			if v == nil {
				h.x = nil
			} else {
				h.x = make([]byte, len(v))
				copy(h.x, v)
			}
			return nil
		}
		return fmt.Errorf(`invalid value for %s key: %T`, ECDSAXKey, value)
	case X509CertChainKey:
		if v, ok := value.(*cert.Chain); ok {
			h.x509CertChain = v
			return nil
		}
		return fmt.Errorf(`invalid value for %s key: %T`, X509CertChainKey, value)
	case X509CertThumbprintKey:
		if v, ok := value.(string); ok {
			h.x509CertThumbprint = &v
			return nil
		}
		return fmt.Errorf(`invalid value for %s key: %T`, X509CertThumbprintKey, value)
	case X509CertThumbprintS256Key:
		if v, ok := value.(string); ok {
			h.x509CertThumbprintS256 = &v
			return nil
		}
		return fmt.Errorf(`invalid value for %s key: %T`, X509CertThumbprintS256Key, value)
	case X509URLKey:
		if v, ok := value.(string); ok {
			h.x509URL = &v
			return nil
		}
		return fmt.Errorf(`invalid value for %s key: %T`, X509URLKey, value)
	case ECDSAYKey:
		if v, ok := value.([]byte); ok {
			if v == nil {
				h.y = nil
			} else {
				h.y = make([]byte, len(v))
				copy(h.y, v)
			}
			return nil
		}
		return fmt.Errorf(`invalid value for %s key: %T`, ECDSAYKey, value)
	default:
		if h.privateParams == nil {
			h.privateParams = map[string]any{}
		}
		h.privateParams[name] = value
	}
	return nil
}

func (k *ecdsaPrivateKey) Remove(key string) error {
	k.mu.Lock()
	defer k.mu.Unlock()
	switch key {
	case AlgorithmKey:
		k.algorithm = nil
	case ECDSACrvKey:
		k.crv = nil
	case ECDSADKey:
		k.d = nil
	case KeyIDKey:
		k.keyID = nil
	case KeyOpsKey:
		k.keyOps = nil
	case KeyUsageKey:
		k.keyUsage = nil
	case ECDSAXKey:
		k.x = nil
	case X509CertChainKey:
		k.x509CertChain = nil
	case X509CertThumbprintKey:
		k.x509CertThumbprint = nil
	case X509CertThumbprintS256Key:
		k.x509CertThumbprintS256 = nil
	case X509URLKey:
		k.x509URL = nil
	case ECDSAYKey:
		k.y = nil
	default:
		delete(k.privateParams, key)
	}
	return nil
}

func (k *ecdsaPrivateKey) Clone() (Key, error) {
	key, err := cloneKey(k)
	if err != nil {
		return nil, fmt.Errorf(`ecdsaPrivateKey.Clone: %w`, err)
	}
	return key, nil
}

func (k *ecdsaPrivateKey) DecodeCtx() json.DecodeCtx {
	k.mu.RLock()
	defer k.mu.RUnlock()
	return k.dc
}

func (k *ecdsaPrivateKey) SetDecodeCtx(dc json.DecodeCtx) {
	k.mu.Lock()
	defer k.mu.Unlock()
	k.dc = dc
}

func (h *ecdsaPrivateKey) UnmarshalJSON(buf []byte) (retErr error) {
	h.mu.Lock()
	defer h.mu.Unlock()
	h.algorithm = nil
	h.crv = nil
	h.d = nil
	h.keyID = nil
	h.keyOps = nil
	h.keyUsage = nil
	h.x = nil
	h.x509CertChain = nil
	h.x509CertThumbprint = nil
	h.x509CertThumbprintS256 = nil
	h.x509URL = nil
	h.y = nil
	defer func() {
		if retErr != nil {
			clear(h.d)
			h.d = nil
			clear(h.x)
			h.x = nil
			clear(h.y)
			h.y = nil
		}
	}()
	dec := json.NewDecoder(bytes.NewReader(buf))
LOOP:
	for {
		tok, err := dec.Token()
		if err != nil {
			return fmt.Errorf(`error reading token: %w`, err)
		}
		switch tok := tok.(type) {
		case json.Delim:
			// Assuming we're doing everything correctly, we should ONLY
			// get either tokens.OpenCurlyBracket or tokens.CloseCurlyBracket here.
			if tok == tokens.CloseCurlyBracket { // End of object
				break LOOP
			} else if tok != tokens.OpenCurlyBracket {
				return fmt.Errorf(`expected '%c' but got '%c'`, tokens.OpenCurlyBracket, tok)
			}
		case string: // Objects can only have string keys
			switch tok {
			case KeyTypeKey:
				val, err := json.ReadNextStringToken(dec, h.dc)
				if err != nil {
					return fmt.Errorf(`error reading token: %w`, err)
				}
				if val != jwa.EC().String() {
					return fmt.Errorf(`invalid kty value for RSAPublicKey (%s)`, val)
				}
			case AlgorithmKey:
				var s string
				if err := dec.Decode(&s); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, AlgorithmKey, err)
				}
				alg, err := jwa.KeyAlgorithmFrom(s)
				if err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, AlgorithmKey, err)
				}
				h.algorithm = &alg
			case ECDSACrvKey:
				var decoded jwa.EllipticCurveAlgorithm
				if err := dec.Decode(&decoded); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, ECDSACrvKey, err)
				}
				h.crv = &decoded
			case ECDSADKey:
				if err := json.AssignNextBytesToken(&h.d, dec); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, ECDSADKey, err)
				}
			case KeyIDKey:
				if err := json.AssignNextStringToken(&h.keyID, dec, h.dc); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, KeyIDKey, err)
				}
			case KeyOpsKey:
				var decoded KeyOperationList
				if err := dec.Decode(&decoded); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, KeyOpsKey, err)
				}
				h.keyOps = &decoded
			case KeyUsageKey:
				if err := json.AssignNextStringToken(&h.keyUsage, dec, h.dc); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, KeyUsageKey, err)
				}
			case ECDSAXKey:
				if err := json.AssignNextBytesToken(&h.x, dec); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, ECDSAXKey, err)
				}
			case X509CertChainKey:
				var decoded cert.Chain
				if err := dec.Decode(&decoded); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, X509CertChainKey, err)
				}
				h.x509CertChain = &decoded
			case X509CertThumbprintKey:
				if err := json.AssignNextStringToken(&h.x509CertThumbprint, dec, h.dc); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, X509CertThumbprintKey, err)
				}
			case X509CertThumbprintS256Key:
				if err := json.AssignNextStringToken(&h.x509CertThumbprintS256, dec, h.dc); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, X509CertThumbprintS256Key, err)
				}
			case X509URLKey:
				if err := json.AssignNextStringToken(&h.x509URL, dec, h.dc); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, X509URLKey, err)
				}
			case ECDSAYKey:
				if err := json.AssignNextBytesToken(&h.y, dec); err != nil {
					return fmt.Errorf(`failed to decode value for key %s: %w`, ECDSAYKey, err)
				}
			default:
				if dc := h.dc; dc != nil {
					if localReg := dc.Registry(); localReg != nil {
						decoded, err := localReg.Decode(dec, tok)
						if err == nil {
							h.setNoLock(tok, decoded)
							continue
						}
					}
				}
				decoded, err := fieldRegistry.Decode(dec, tok)
				if err == nil {
					h.setNoLock(tok, decoded)
					continue
				}
				return fmt.Errorf(`could not decode field %s: %w`, tok, err)
			}
		default:
			return fmt.Errorf(`invalid token %T`, tok)
		}
	}
	if h.crv == nil {
		return fmt.Errorf(`required field crv is missing`)
	}
	if h.d == nil {
		return fmt.Errorf(`required field d is missing`)
	}
	if h.x == nil {
		return fmt.Errorf(`required field x is missing`)
	}
	if h.y == nil {
		return fmt.Errorf(`required field y is missing`)
	}
	return nil
}

func (h *ecdsaPrivateKey) makePairs() ([]fieldPair, error) {
	pairs := getFieldPairList()
	h.mu.RLock()
	defer h.mu.RUnlock()
	{
		v, err := json.Marshal(jwa.EC())
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, KeyTypeKey, err)
		}
		pairs = append(pairs, fieldPair{Name: KeyTypeKey, Value: v})
	}
	if h.algorithm != nil {
		v, err := json.Marshal(*(h.algorithm))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, AlgorithmKey, err)
		}
		pairs = append(pairs, fieldPair{Name: AlgorithmKey, Value: v})
	}
	if h.crv != nil {
		v, err := json.Marshal(*(h.crv))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, ECDSACrvKey, err)
		}
		pairs = append(pairs, fieldPair{Name: ECDSACrvKey, Value: v})
	}
	if h.d != nil {
		v, err := json.Marshal(base64.EncodeToString(h.d))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, ECDSADKey, err)
		}
		pairs = append(pairs, fieldPair{Name: ECDSADKey, Value: v})
	}
	if h.keyID != nil {
		v, err := json.Marshal(*(h.keyID))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, KeyIDKey, err)
		}
		pairs = append(pairs, fieldPair{Name: KeyIDKey, Value: v})
	}
	if h.keyOps != nil {
		v, err := json.Marshal(*(h.keyOps))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, KeyOpsKey, err)
		}
		pairs = append(pairs, fieldPair{Name: KeyOpsKey, Value: v})
	}
	if h.keyUsage != nil {
		v, err := json.Marshal(*(h.keyUsage))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, KeyUsageKey, err)
		}
		pairs = append(pairs, fieldPair{Name: KeyUsageKey, Value: v})
	}
	if h.x != nil {
		v, err := json.Marshal(base64.EncodeToString(h.x))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, ECDSAXKey, err)
		}
		pairs = append(pairs, fieldPair{Name: ECDSAXKey, Value: v})
	}
	if h.x509CertChain != nil {
		v, err := json.Marshal(h.x509CertChain)
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, X509CertChainKey, err)
		}
		pairs = append(pairs, fieldPair{Name: X509CertChainKey, Value: v})
	}
	if h.x509CertThumbprint != nil {
		v, err := json.Marshal(*(h.x509CertThumbprint))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, X509CertThumbprintKey, err)
		}
		pairs = append(pairs, fieldPair{Name: X509CertThumbprintKey, Value: v})
	}
	if h.x509CertThumbprintS256 != nil {
		v, err := json.Marshal(*(h.x509CertThumbprintS256))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, X509CertThumbprintS256Key, err)
		}
		pairs = append(pairs, fieldPair{Name: X509CertThumbprintS256Key, Value: v})
	}
	if h.x509URL != nil {
		v, err := json.Marshal(*(h.x509URL))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, X509URLKey, err)
		}
		pairs = append(pairs, fieldPair{Name: X509URLKey, Value: v})
	}
	if h.y != nil {
		v, err := json.Marshal(base64.EncodeToString(h.y))
		if err != nil {
			return nil, fmt.Errorf(`failed to marshal field %q: %w`, ECDSAYKey, err)
		}
		pairs = append(pairs, fieldPair{Name: ECDSAYKey, Value: v})
	}
	for k, v := range h.privateParams {
		var encoded []byte
		switch v := v.(type) {
		case []byte:
			var err error
			encoded, err = json.Marshal(base64.EncodeToString(v))
			if err != nil {
				return nil, fmt.Errorf(`failed to marshal field %q: %w`, k, err)
			}
		default:
			var err error
			encoded, err = json.Marshal(v)
			if err != nil {
				return nil, fmt.Errorf(`failed to marshal field %q: %w`, k, err)
			}
		}
		pairs = append(pairs, fieldPair{Name: k, Value: encoded})
	}

	sort.Slice(pairs, func(i, j int) bool {
		return pairs[i].Name < pairs[j].Name
	})

	return pairs, nil
}

func (h *ecdsaPrivateKey) MarshalJSON() ([]byte, error) {
	buf := pool.BytesBuffer().Get()
	defer pool.BytesBuffer().Put(buf)
	pairs, err := h.makePairs()
	if err != nil {
		return nil, fmt.Errorf(`failed to make pairs: %w`, err)
	}
	buf.WriteByte(tokens.OpenCurlyBracket)

	for i, pair := range pairs {
		if i > 0 {
			buf.WriteByte(tokens.Comma)
		}
		buf.WriteByte('"')
		buf.WriteString(pair.Name)
		buf.WriteString(`": `)
		buf.Write(pair.Value.([]byte))
	}
	buf.WriteByte(tokens.CloseCurlyBracket)
	ret := make([]byte, buf.Len())
	copy(ret, buf.Bytes())
	putFieldPairList(pairs)
	return ret, nil
}

func (h *ecdsaPrivateKey) Keys() []string {
	h.mu.RLock()
	defer h.mu.RUnlock()
	keys := make([]string, 0, 12+len(h.privateParams))
	keys = append(keys, KeyTypeKey)
	if h.algorithm != nil {
		keys = append(keys, AlgorithmKey)
	}
	if h.crv != nil {
		keys = append(keys, ECDSACrvKey)
	}
	if h.d != nil {
		keys = append(keys, ECDSADKey)
	}
	if h.keyID != nil {
		keys = append(keys, KeyIDKey)
	}
	if h.keyOps != nil {
		keys = append(keys, KeyOpsKey)
	}
	if h.keyUsage != nil {
		keys = append(keys, KeyUsageKey)
	}
	if h.x != nil {
		keys = append(keys, ECDSAXKey)
	}
	if h.x509CertChain != nil {
		keys = append(keys, X509CertChainKey)
	}
	if h.x509CertThumbprint != nil {
		keys = append(keys, X509CertThumbprintKey)
	}
	if h.x509CertThumbprintS256 != nil {
		keys = append(keys, X509CertThumbprintS256Key)
	}
	if h.x509URL != nil {
		keys = append(keys, X509URLKey)
	}
	if h.y != nil {
		keys = append(keys, ECDSAYKey)
	}
	for k := range h.privateParams {
		keys = append(keys, k)
	}
	return keys
}

var ecdsaStandardFields KeyFilter

func init() {
	ecdsaStandardFields = NewFieldNameFilter(KeyTypeKey, KeyUsageKey, KeyOpsKey, AlgorithmKey, KeyIDKey, X509URLKey, X509CertChainKey, X509CertThumbprintKey, X509CertThumbprintS256Key, ECDSACrvKey, ECDSAXKey, ECDSAYKey, ECDSADKey)
}

// ECDSAStandardFieldsFilter returns a KeyFilter that filters out standard ECDSA fields.
func ECDSAStandardFieldsFilter() KeyFilter {
	return ecdsaStandardFields
}

func init() {
	registry.Register(jwa.EC().String(), registry.Constructor{
		Public:  func() any { return newECDSAPublicKey() },
		Private: func() any { return newECDSAPrivateKey() },
	})
}
