@polyjose/node 0.0.0-stage → 0.1.2

package/facade/api.js

@@ -0,0 +1,567 @@
+/**
+ * The polyjose JS facade (ADR 0030, ADR 0031 §1, ADR 0047), shared unchanged by
+ * `@polyjose/node` and `@polyjose/wasm`. Each package's entry binds it to its native layer:
+ *
+ * ```ts
+ * export const { version, errorCodes, jwsVerifyCompact, ... } = createApi(backend);
+ * export { PolyjoseError, ERROR_CODES } from "./api.js";
+ * ```
+ *
+ * The facade adds idiom only (ADR 0030 §1): Promises, object↔JSON, JS type checks
+ * (`TypeError`), `null` → `undefined`, the JS clock for JWT `now`, and `PolyjoseError`.
+ * Policy, defaults and every JOSE check stay in the core.
+ */
+import { ERROR_CODES } from "./error-codes.js";
+import { allowList, bare, bool, bytes, isAbsent, json, list, member, optBool, optBytes, optJson, optSeconds, optStr, optStrList, optU32, outBytes, outIndex, outList, outObject, outStr, put, record, str, u32, wipe, } from "./normalize.js";
+export { ERROR_CODES } from "./error-codes.js";
+/**
+ * A polyjose failure (ADR 0030 §5). `code` is one of {@link ERROR_CODES}, the core's stable
+ * `Error::code()` (ADR 0007): match on it, never on `message`, which may be reworded. Neither
+ * ever contains key material or input bytes.
+ */
+export class PolyjoseError extends Error {
+    name = "PolyjoseError";
+    /** The stable error code. */
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+// --- records: validated, rebuilt with only known, present members -------------------------
+// Each reads the caller's members only from `record`'s own-member copy and returns a `bare`
+// (prototype-less) record, so a polluted `Object.prototype` reaches neither (0013 F04).
+// A record with byte members takes the call's `copies` list: see `bytes` and `run`.
+function signOptions(v, at) {
+    const o = record(v, at, ["protectedHeader", "protectedB64u", "detached"]);
+    const out = bare({});
+    put(out, "protectedHeader", optJson(o["protectedHeader"], `${at}.protectedHeader`));
+    put(out, "protectedB64u", optStr(o["protectedB64u"], `${at}.protectedB64u`));
+    put(out, "detached", optBool(o["detached"], `${at}.detached`));
+    return out;
+}
+function signer(v, at) {
+    const o = record(v, at, ["key", "protectedHeader", "protectedB64u", "unprotectedHeader"]);
+    const out = bare({ key: json(o["key"], `${at}.key`) });
+    put(out, "protectedHeader", optJson(o["protectedHeader"], `${at}.protectedHeader`));
+    put(out, "protectedB64u", optStr(o["protectedB64u"], `${at}.protectedB64u`));
+    put(out, "unprotectedHeader", optJson(o["unprotectedHeader"], `${at}.unprotectedHeader`));
+    return out;
+}
+function jwsVerifyOptions(v, at, copies) {
+    const o = record(v, at, ["allowedAlgs", "detachedPayload", "maxInputLen", "maxSignatures"]);
+    const out = bare({ allowedAlgs: allowList(o["allowedAlgs"], `${at}.allowedAlgs`) });
+    put(out, "detachedPayload", optBytes(o["detachedPayload"], `${at}.detachedPayload`, copies));
+    put(out, "maxInputLen", optU32(o["maxInputLen"], `${at}.maxInputLen`));
+    put(out, "maxSignatures", optU32(o["maxSignatures"], `${at}.maxSignatures`));
+    return out;
+}
+function recipient(v, at, copies) {
+    const o = record(v, at, ["alg", "key", "header", "apu", "apv", "p2c", "p2sLen"]);
+    const out = bare({ alg: str(o["alg"], `${at}.alg`), key: json(o["key"], `${at}.key`) });
+    put(out, "header", optJson(o["header"], `${at}.header`));
+    put(out, "apu", optBytes(o["apu"], `${at}.apu`, copies));
+    put(out, "apv", optBytes(o["apv"], `${at}.apv`, copies));
+    put(out, "p2c", optU32(o["p2c"], `${at}.p2c`));
+    put(out, "p2sLen", optU32(o["p2sLen"], `${at}.p2sLen`));
+    return out;
+}
+function encryptOptions(v, at, copies) {
+    const o = record(v, at, ["enc", "recipients", "protectedHeader", "sharedUnprotectedHeader", "aad", "compress"]);
+    const out = bare({
+        enc: str(o["enc"], `${at}.enc`),
+        recipients: list(o["recipients"], `${at}.recipients`, (r, rat) => recipient(r, rat, copies)),
+    });
+    put(out, "protectedHeader", optJson(o["protectedHeader"], `${at}.protectedHeader`));
+    put(out, "sharedUnprotectedHeader", optJson(o["sharedUnprotectedHeader"], `${at}.sharedUnprotectedHeader`));
+    put(out, "aad", optBytes(o["aad"], `${at}.aad`, copies));
+    put(out, "compress", optBool(o["compress"], `${at}.compress`));
+    return out;
+}
+function decryptOptions(v, at) {
+    const o = record(v, at, [
+        "allowedAlgs",
+        "allowedEnc",
+        "maxPbes2Count",
+        "maxDecompressedLen",
+        "maxInputLen",
+        "maxRecipients",
+        "understoodCrit",
+    ]);
+    const out = bare({
+        allowedAlgs: allowList(o["allowedAlgs"], `${at}.allowedAlgs`),
+        allowedEnc: allowList(o["allowedEnc"], `${at}.allowedEnc`),
+    });
+    put(out, "maxPbes2Count", optU32(o["maxPbes2Count"], `${at}.maxPbes2Count`));
+    put(out, "maxDecompressedLen", optU32(o["maxDecompressedLen"], `${at}.maxDecompressedLen`));
+    put(out, "maxInputLen", optU32(o["maxInputLen"], `${at}.maxInputLen`));
+    put(out, "maxRecipients", optU32(o["maxRecipients"], `${at}.maxRecipients`));
+    put(out, "understoodCrit", optStrList(o["understoodCrit"], `${at}.understoodCrit`));
+    return out;
+}
+function jwtSignOptions(v, at) {
+    const o = record(v, at, ["alg", "typ", "omitTyp", "accessToken", "header"]);
+    const out = bare({ alg: str(o["alg"], `${at}.alg`) });
+    put(out, "typ", optStr(o["typ"], `${at}.typ`));
+    put(out, "omitTyp", optBool(o["omitTyp"], `${at}.omitTyp`));
+    put(out, "accessToken", optBool(o["accessToken"], `${at}.accessToken`));
+    put(out, "header", optJson(o["header"], `${at}.header`));
+    return out;
+}
+function jwtVerifyOptions(v, at) {
+    const o = record(v, at, [
+        "allowedAlgs",
+        "now",
+        "issuers",
+        "audiences",
+        "subject",
+        "leeway",
+        "maxAge",
+        "requiredClaims",
+        "allowMissingExp",
+        "ignoreAudience",
+        "typ",
+        "anyTyp",
+        "profile",
+        "maxKeyCandidates",
+        "maxInputLen",
+    ]);
+    const options = bare({ allowedAlgs: allowList(o["allowedAlgs"], `${at}.allowedAlgs`) });
+    put(options, "issuers", optStrList(o["issuers"], `${at}.issuers`));
+    put(options, "audiences", optStrList(o["audiences"], `${at}.audiences`));
+    put(options, "subject", optStr(o["subject"], `${at}.subject`));
+    put(options, "leeway", optU32(o["leeway"], `${at}.leeway`));
+    put(options, "maxAge", optU32(o["maxAge"], `${at}.maxAge`));
+    put(options, "requiredClaims", optStrList(o["requiredClaims"], `${at}.requiredClaims`));
+    put(options, "allowMissingExp", optBool(o["allowMissingExp"], `${at}.allowMissingExp`));
+    put(options, "ignoreAudience", optBool(o["ignoreAudience"], `${at}.ignoreAudience`));
+    put(options, "typ", optStr(o["typ"], `${at}.typ`));
+    put(options, "anyTyp", optBool(o["anyTyp"], `${at}.anyTyp`));
+    put(options, "profile", optStr(o["profile"], `${at}.profile`));
+    put(options, "maxKeyCandidates", optU32(o["maxKeyCandidates"], `${at}.maxKeyCandidates`));
+    put(options, "maxInputLen", optU32(o["maxInputLen"], `${at}.maxInputLen`));
+    return { options, now: optSeconds(o["now"], `${at}.now`) };
+}
+/**
+ * The JWT clock (ADR 0028 §4, ADR 0030 §4): the caller's `now` wins; otherwise the JS wall
+ * clock, floored to whole seconds, read at the call (in `run`'s synchronous preparation, so a
+ * pending `ready()` can't delay the reading). A clock reading, not a policy default:
+ * `@polyjose/node` and `@polyjose/wasm` behave identically and no Rust code reads time.
+ */
+function withNow(prepared) {
+    return bare({ ...prepared.options, now: prepared.now ?? Math.floor(Date.now() / 1000) });
+}
+function selector(v, at) {
+    const o = record(v, at, ["kid", "alg", "keyUse"]);
+    const out = bare({});
+    put(out, "kid", optStr(o["kid"], `${at}.kid`));
+    put(out, "alg", optStr(o["alg"], `${at}.alg`));
+    put(out, "keyUse", optStr(o["keyUse"], `${at}.keyUse`));
+    return out;
+}
+/** A positional `detached` flag: absent is `false`, the ADR 0030 `detached: bool = false`. */
+function detachedFlag(v, at) {
+    return isAbsent(v) ? false : bool(v, at);
+}
+// --- results ------------------------------------------------------------------------------
+/** An optional JSON-object member of a backend result; absent (`null`/`undefined`) is left out. */
+function optObject(v, name, at) {
+    const raw = member(v, name, at);
+    return isAbsent(raw) ? undefined : outObject(raw, `${at}.${name}`);
+}
+function jwsVerified(v, at) {
+    const out = {
+        alg: outStr(member(v, "alg", at), `${at}.alg`),
+        payload: outBytes(member(v, "payload", at), `${at}.payload`),
+        signatureIndex: outIndex(member(v, "signatureIndex", at), `${at}.signatureIndex`),
+    };
+    put(out, "protectedHeader", optObject(v, "protectedHeader", at));
+    put(out, "unprotectedHeader", optObject(v, "unprotectedHeader", at));
+    return out;
+}
+function jweDecrypted(v, at) {
+    const out = {
+        plaintext: outBytes(member(v, "plaintext", at), `${at}.plaintext`),
+        header: outObject(member(v, "header", at), `${at}.header`),
+        recipientIndex: outIndex(member(v, "recipientIndex", at), `${at}.recipientIndex`),
+    };
+    put(out, "protectedHeader", optObject(v, "protectedHeader", at));
+    put(out, "sharedUnprotectedHeader", optObject(v, "sharedUnprotectedHeader", at));
+    put(out, "recipientHeader", optObject(v, "recipientHeader", at));
+    const aad = member(v, "aad", at);
+    put(out, "aad", isAbsent(aad) ? undefined : outBytes(aad, `${at}.aad`));
+    return out;
+}
+function jwtVerified(v, at) {
+    const out = {
+        claims: outObject(member(v, "claims", at), `${at}.claims`),
+        header: outObject(member(v, "header", at), `${at}.header`),
+        alg: outStr(member(v, "alg", at), `${at}.alg`),
+    };
+    // `keyIndex` 0 is a real index (ADR 0029 §4): only null/undefined mean absent.
+    const keyIndex = member(v, "keyIndex", at);
+    put(out, "keyIndex", isAbsent(keyIndex) ? undefined : outIndex(keyIndex, `${at}.keyIndex`));
+    const kid = member(v, "kid", at);
+    put(out, "kid", isAbsent(kid) ? undefined : outStr(kid, `${at}.kid`));
+    return out;
+}
+function jwtNestedVerified(v, at) {
+    return {
+        inner: jwtVerified(member(v, "inner", at), `${at}.inner`),
+        outerHeader: outObject(member(v, "outerHeader", at), `${at}.outerHeader`),
+        recipientIndex: outIndex(member(v, "recipientIndex", at), `${at}.recipientIndex`),
+    };
+}
+const jwk = (v, at) => outObject(v, at);
+// --- errors -------------------------------------------------------------------------------
+/**
+ * `e`'s own data member `name`, or `undefined` (0013 F09, F12): never read through a prototype,
+ * so a polluted `Object.prototype.code` or `Error.prototype.message` can't stand in for one the
+ * backend didn't set, and never through a getter, so reading runs no backend or caller code.
+ * napi-rs (`napi_create_error`) and wasm-bindgen (`Reflect::set`) set `code` and `message` as
+ * own data properties.
+ */
+function ownData(e, name) {
+    if ((typeof e !== "object" || e === null) && typeof e !== "function")
+        return undefined;
+    try {
+        const d = Object.getOwnPropertyDescriptor(e, name);
+        return d !== undefined && "value" in d ? d.value : undefined;
+    }
+    catch {
+        return undefined; // a Proxy whose trap throws has no readable member
+    }
+}
+/** `e instanceof C`, false if a hostile `Proxy` or `Symbol.hasInstance` throws. */
+function isInstance(e, C) {
+    try {
+        return e instanceof C;
+    }
+    catch {
+        return false;
+    }
+}
+/** One of the generated {@link ERROR_CODES}, the core's `Error::CODES` this facade was built from. */
+function isErrorCode(code) {
+    return ERROR_CODES.includes(code);
+}
+/**
+ * napi-rs's argument-conversion `Status` names: the `code` napi-rs puts on the JS error when a
+ * caller's value can't be converted to the Rust parameter type (napi 3.16, `Status` and its
+ * `AsRef<str>`; Node-API `napi_status`). Other statuses (`GenericFailure`, `PendingException`,
+ * `Cancelled`, ...) don't say the caller misused the API, so they pass through unchanged.
+ */
+const NAPI_ARGUMENT_STATUSES = new Set([
+    "InvalidArg",
+    "ObjectExpected",
+    "StringExpected",
+    "NameExpected",
+    "FunctionExpected",
+    "NumberExpected",
+    "BooleanExpected",
+    "ArrayExpected",
+    "BigintExpected",
+    "DateExpected",
+    "ArrayBufferExpected",
+    "DetachableArraybufferExpected",
+]);
+/** `e`'s own string `message`, or `fallback`: never a prototype's (0013 F12). */
+function ownMessage(e, fallback) {
+    const m = ownData(e, "message");
+    return typeof m === "string" ? m : fallback;
+}
+/**
+ * A backend failure as the facade reports it (ADR 0030 §5, ADR 0031 §1, BACKEND.md "Errors";
+ * 0013 F04, F12). `code` and `message` are read as own data members only.
+ *
+ * 1. An own `code` that is in the generated {@link ERROR_CODES} and in the backend's
+ *    `errorCodes()` gives a `PolyjoseError` with the backend's own message, so
+ *    `PolyjoseError.code` is always an {@link ErrorCode} even if the backend and the facade
+ *    versions drift (F04, review N2). `codes` throws if the backend can't list its codes; that
+ *    error is reported instead. It is asked only for a code in `ERROR_CODES`, the only codes
+ *    that could become a `PolyjoseError`.
+ * 2. A host argument error is a `TypeError` with the original message: a `TypeError` (a wasm
+ *    reader's), returned as is, or an `Error` whose own `code` is one of
+ *    {@link NAPI_ARGUMENT_STATUSES}, re-made as a `TypeError`.
+ * 3. Anything else is returned unchanged, the same value: a `WebAssembly.RuntimeError` trap, a
+ *    backend's own "unusable, reload it" refusal, another napi status, a code only one side
+ *    knows. It isn't the caller's misuse, so it isn't reported as a `TypeError` (F12).
+ */
+function mapError(e, codes) {
+    const code = ownData(e, "code");
+    if (typeof code === "string" && isErrorCode(code) && codes().has(code))
+        return new PolyjoseError(code, ownMessage(e, code));
+    if (isInstance(e, TypeError))
+        return e;
+    if (typeof code === "string" && NAPI_ARGUMENT_STATUSES.has(code) && isInstance(e, Error)) {
+        return new TypeError(ownMessage(e, `polyjose: the backend could not convert an argument (${code})`));
+    }
+    return e;
+}
+function describe(e) {
+    if ((typeof e === "object" && e !== null) || typeof e === "function")
+        return "the backend threw a value with no message";
+    try {
+        return String(e);
+    }
+    catch {
+        return "polyjose: the backend failed";
+    }
+}
+/** Binds the facade to one native layer (BACKEND.md). */
+export function createApi(backend) {
+    let initialised = backend.ready === undefined;
+    let pending;
+    let codeSet;
+    /**
+     * Awaits `backend.ready()` once, lazily, on first use (ADR 0031 §3: WASM initialises without
+     * top-level await). A failure is reported unchanged and the next call tries again.
+     */
+    function ready() {
+        if (initialised)
+            return undefined;
+        const init = backend.ready;
+        if (init === undefined)
+            return undefined;
+        pending ??= Promise.resolve()
+            .then(() => init.call(backend))
+            .then(() => {
+            initialised = true;
+        }, (e) => {
+            pending = undefined;
+            throw e;
+        });
+        return pending;
+    }
+    /**
+     * The backend's `errorCodes()`, read once, on the first failure to map (0013 F04, review N2).
+     * If the backend can't list them (it throws, or returns no array), the facade can't tell a core
+     * failure from a host one, so it throws an `Error` naming the cause rather than reporting every
+     * core failure as a `TypeError`; nothing is cached, and the next failure asks again.
+     */
+    const codes = () => {
+        if (codeSet !== undefined)
+            return codeSet;
+        let listed;
+        try {
+            listed = backend.errorCodes();
+        }
+        catch (e) {
+            throw new Error(`polyjose: the backend's errorCodes() failed (${ownMessage(e, describe(e))}), so a backend error can't be mapped`, {
+                cause: e,
+            });
+        }
+        if (!Array.isArray(listed))
+            throw new Error("polyjose: the backend's errorCodes() did not return an array, so a backend error can't be mapped");
+        // Own elements only: `filter` would read a hole through a polluted `Array.prototype` and map
+        // a code the backend never listed (0013 F09).
+        const own = new Set();
+        for (let i = 0; i < listed.length; i++) {
+            const c = Object.hasOwn(listed, i) ? listed[i] : undefined;
+            if (typeof c === "string")
+                own.add(c);
+        }
+        codeSet = own;
+        return codeSet;
+    };
+    /** Initialises, calls the backend, and maps its sync throws and rejections. */
+    async function invoke(call) {
+        const waiting = ready();
+        if (waiting !== undefined)
+            await waiting;
+        try {
+            return await call();
+        }
+        catch (e) {
+            throw mapError(e, codes);
+        }
+    }
+    /**
+     * One operation with arguments (ADR 0030 §2, §7; ADR 0031 §1, §3; 0013 B06).
+     *
+     * `prepare` runs synchronously, when the operation is called and before anything is awaited:
+     * it validates and normalises every argument (a `TypeError` rejects the call before
+     * `ready()` or the backend is reached), copies each byte input into a fresh `Uint8Array`
+     * recorded in `copies`, serialises JSON objects, reads the JWT clock, and returns the backend
+     * call. Only that call waits for `ready()`, so nothing the caller does to its arrays or objects
+     * after starting the call changes what is processed. Once the backend call settles, success or
+     * failure, the copies are wiped with `fill(0)`; they are never handed back to the caller.
+     */
+    async function run(prepare, output) {
+        const copies = [];
+        try {
+            const call = prepare(copies);
+            return output(await invoke(call));
+        }
+        finally {
+            wipe(copies);
+        }
+    }
+    const b = backend;
+    return {
+        version: async () => outStr(await invoke(() => b.version()), "version"),
+        // Own elements only (0013 F09): a hole is reported, never read through `Array.prototype`.
+        errorCodes: async () => outList(await invoke(() => b.errorCodes()), "errorCodes", outStr),
+        base64urlEncode: (input) => run((copies) => {
+            const data = bytes(input, "base64urlEncode: bytes", copies);
+            return () => b.base64urlEncode(data);
+        }, (r) => outStr(r, "base64urlEncode")),
+        base64urlDecode: (input) => run(() => {
+            const text = str(input, "base64urlDecode: text");
+            return () => b.base64urlDecode(text);
+        }, (r) => outBytes(r, "base64urlDecode")),
+        jwkParse: (key) => run(() => {
+            const k = json(key, "jwkParse: jwk");
+            return () => b.jwkParse(k);
+        }, (r) => jwk(r, "jwkParse")),
+        jwkToPublic: (key) => run(() => {
+            const k = json(key, "jwkToPublic: jwk");
+            return () => b.jwkToPublic(k);
+        }, (r) => jwk(r, "jwkToPublic")),
+        // `hash` is optional (ADR 0054 §9): null and undefined reach the backend as undefined, so
+        // the core's default applies; a name is passed as given, for the core to parse (§8.2).
+        jwkThumbprint: (key, hash) => run(() => {
+            const k = json(key, "jwkThumbprint: jwk");
+            const h = optStr(hash, "jwkThumbprint: hash");
+            return () => b.jwkThumbprint(k, h);
+        }, (r) => outStr(r, "jwkThumbprint")),
+        jwkThumbprintUri: (key, hash) => run(() => {
+            const k = json(key, "jwkThumbprintUri: jwk");
+            const h = optStr(hash, "jwkThumbprintUri: hash");
+            return () => b.jwkThumbprintUri(k, h);
+        }, (r) => outStr(r, "jwkThumbprintUri")),
+        jwksSelect: (jwks, criteria) => run(() => {
+            const set = json(jwks, "jwksSelect: jwks");
+            const sel = selector(criteria, "jwksSelect: selector");
+            return () => b.jwksSelect(set, sel);
+        }, (r) => jwk(r, "jwksSelect")),
+        jwkGenerateOct: (lenBytes) => run(() => {
+            const n = u32(lenBytes, "jwkGenerateOct: lenBytes");
+            return () => b.jwkGenerateOct(n);
+        }, (r) => jwk(r, "jwkGenerateOct")),
+        jwkGenerateEc: (crv) => run(() => {
+            const c = str(crv, "jwkGenerateEc: crv");
+            return () => b.jwkGenerateEc(c);
+        }, (r) => jwk(r, "jwkGenerateEc")),
+        jwkGenerateOkp: (crv) => run(() => {
+            const c = str(crv, "jwkGenerateOkp: crv");
+            return () => b.jwkGenerateOkp(c);
+        }, (r) => jwk(r, "jwkGenerateOkp")),
+        jwkGenerateForAlg: (alg) => run(() => {
+            const a = str(alg, "jwkGenerateForAlg: alg");
+            return () => b.jwkGenerateForAlg(a);
+        }, (r) => jwk(r, "jwkGenerateForAlg")),
+        jwkFromPem: (pem) => run(() => {
+            const p = str(pem, "jwkFromPem: pem");
+            return () => b.jwkFromPem(p);
+        }, (r) => jwk(r, "jwkFromPem")),
+        jwkFromDer: (der, format) => run((copies) => {
+            const d = bytes(der, "jwkFromDer: der", copies);
+            const f = str(format, "jwkFromDer: format");
+            return () => b.jwkFromDer(d, f);
+        }, (r) => jwk(r, "jwkFromDer")),
+        jwkToPem: (key, format) => run(() => {
+            const k = json(key, "jwkToPem: jwk");
+            const f = str(format, "jwkToPem: format");
+            return () => b.jwkToPem(k, f);
+        }, (r) => outStr(r, "jwkToPem")),
+        jwkToDer: (key, format) => run(() => {
+            const k = json(key, "jwkToDer: jwk");
+            const f = str(format, "jwkToDer: format");
+            return () => b.jwkToDer(k, f);
+        }, (r) => outBytes(r, "jwkToDer")),
+        jwsSignCompact: (payload, key, options) => run((copies) => {
+            const p = bytes(payload, "jwsSignCompact: payload", copies);
+            const k = json(key, "jwsSignCompact: key");
+            const o = signOptions(options, "jwsSignCompact: options");
+            return () => b.jwsSignCompact(p, k, o);
+        }, (r) => outStr(r, "jwsSignCompact")),
+        jwsSignFlattened: (payload, one, detached) => run((copies) => {
+            const p = bytes(payload, "jwsSignFlattened: payload", copies);
+            const s = signer(one, "jwsSignFlattened: signer");
+            const d = detachedFlag(detached, "jwsSignFlattened: detached");
+            return () => b.jwsSignFlattened(p, s, d);
+        }, (r) => outStr(r, "jwsSignFlattened")),
+        jwsSignGeneral: (payload, signers, detached) => run((copies) => {
+            const p = bytes(payload, "jwsSignGeneral: payload", copies);
+            const s = list(signers, "jwsSignGeneral: signers", signer);
+            const d = detachedFlag(detached, "jwsSignGeneral: detached");
+            return () => b.jwsSignGeneral(p, s, d);
+        }, (r) => outStr(r, "jwsSignGeneral")),
+        jwsVerifyCompact: (token, key, options) => run((copies) => {
+            const t = str(token, "jwsVerifyCompact: token");
+            const k = json(key, "jwsVerifyCompact: key");
+            const o = jwsVerifyOptions(options, "jwsVerifyCompact: options", copies);
+            return () => b.jwsVerifyCompact(t, k, o);
+        }, (r) => jwsVerified(r, "jwsVerifyCompact")),
+        jwsVerifyJson: (jws, key, options) => run((copies) => {
+            const t = json(jws, "jwsVerifyJson: jws");
+            const k = json(key, "jwsVerifyJson: key");
+            const o = jwsVerifyOptions(options, "jwsVerifyJson: options", copies);
+            return () => b.jwsVerifyJson(t, k, o);
+        }, (r) => jwsVerified(r, "jwsVerifyJson")),
+        jweEncryptCompact: (plaintext, options) => run((copies) => {
+            const p = bytes(plaintext, "jweEncryptCompact: plaintext", copies);
+            const o = encryptOptions(options, "jweEncryptCompact: options", copies);
+            return () => b.jweEncryptCompact(p, o);
+        }, (r) => outStr(r, "jweEncryptCompact")),
+        jweEncryptJson: (plaintext, options, form) => run((copies) => {
+            const p = bytes(plaintext, "jweEncryptJson: plaintext", copies);
+            const o = encryptOptions(options, "jweEncryptJson: options", copies);
+            const f = str(form, "jweEncryptJson: form");
+            return () => b.jweEncryptJson(p, o, f);
+        }, (r) => outStr(r, "jweEncryptJson")),
+        jweDecryptCompact: (token, key, options) => run(() => {
+            const t = str(token, "jweDecryptCompact: token");
+            const k = json(key, "jweDecryptCompact: key");
+            const o = decryptOptions(options, "jweDecryptCompact: options");
+            return () => b.jweDecryptCompact(t, k, o);
+        }, (r) => jweDecrypted(r, "jweDecryptCompact")),
+        jweDecryptJson: (jwe, key, options) => run(() => {
+            const t = json(jwe, "jweDecryptJson: jwe");
+            const k = json(key, "jweDecryptJson: key");
+            const o = decryptOptions(options, "jweDecryptJson: options");
+            return () => b.jweDecryptJson(t, k, o);
+        }, (r) => jweDecrypted(r, "jweDecryptJson")),
+        jwtSign: (claims, key, options) => run(() => {
+            const c = json(claims, "jwtSign: claims");
+            const k = json(key, "jwtSign: key");
+            const o = jwtSignOptions(options, "jwtSign: options");
+            return () => b.jwtSign(c, k, o);
+        }, (r) => outStr(r, "jwtSign")),
+        jwtVerify: (token, key, options) => run(() => {
+            const t = str(token, "jwtVerify: token");
+            const k = json(key, "jwtVerify: key");
+            const o = withNow(jwtVerifyOptions(options, "jwtVerify: options"));
+            return () => b.jwtVerify(t, k, o);
+        }, (r) => jwtVerified(r, "jwtVerify")),
+        jwtVerifyWithJwks: (token, jwks, options) => run(() => {
+            const t = str(token, "jwtVerifyWithJwks: token");
+            const s = json(jwks, "jwtVerifyWithJwks: jwks");
+            const o = withNow(jwtVerifyOptions(options, "jwtVerifyWithJwks: options"));
+            return () => b.jwtVerifyWithJwks(t, s, o);
+        }, (r) => jwtVerified(r, "jwtVerifyWithJwks")),
+        jwtEncryptNested: (signedJwt, options) => run((copies) => {
+            const t = str(signedJwt, "jwtEncryptNested: signedJwt");
+            const o = encryptOptions(options, "jwtEncryptNested: options", copies);
+            return () => b.jwtEncryptNested(t, o);
+        }, (r) => outStr(r, "jwtEncryptNested")),
+        jwtDecryptNested: (token, decryptKey, decrypt, key, verify) => run(() => {
+            const t = str(token, "jwtDecryptNested: token");
+            const dk = json(decryptKey, "jwtDecryptNested: decryptKey");
+            const d = decryptOptions(decrypt, "jwtDecryptNested: decryptOptions");
+            const k = json(key, "jwtDecryptNested: key");
+            const v = withNow(jwtVerifyOptions(verify, "jwtDecryptNested: verifyOptions"));
+            return () => b.jwtDecryptNested(t, dk, d, k, v);
+        }, (r) => jwtNestedVerified(r, "jwtDecryptNested")),
+        jwtDecryptNestedWithJwks: (token, decryptKey, decrypt, jwks, verify) => run(() => {
+            const t = str(token, "jwtDecryptNestedWithJwks: token");
+            const dk = json(decryptKey, "jwtDecryptNestedWithJwks: decryptKey");
+            const d = decryptOptions(decrypt, "jwtDecryptNestedWithJwks: decryptOptions");
+            const s = json(jwks, "jwtDecryptNestedWithJwks: jwks");
+            const v = withNow(jwtVerifyOptions(verify, "jwtDecryptNestedWithJwks: verifyOptions"));
+            return () => b.jwtDecryptNestedWithJwks(t, dk, d, s, v);
+        }, (r) => jwtNestedVerified(r, "jwtDecryptNestedWithJwks")),
+        PolyjoseError,
+    };
+}