@psnext/slingcli 3.1.20260904-1 → 3.3.20260911-1

package/node_modules/hono/dist/jsx/components.js

@@ -1,7 +1,7 @@
 // src/jsx/components.ts
 import { raw } from "../helper/html/index.js";
 import { HtmlEscapedCallbackPhase, resolveCallback } from "../utils/html.js";
-import { jsx, Fragment } from "./base.js";
+import { jsx, Fragment, isUntrustedObject, renderChildren, renderUntrustedObject } from "./base.js";
 import { DOM_RENDERER } from "./constants.js";
 import { captureRenderContext, useContext } from "./context.js";
 import { ErrorBoundary as ErrorBoundaryDomRenderer } from "./dom/components.js";
@@ -9,7 +9,7 @@ import { StreamingContext } from "./streaming.js";
 var errorBoundaryCounter = 0;
 var childrenToString = async (children) => {
   try {
-    return children.flat().map((c) => c == null || typeof c === "boolean" ? "" : c.toString());
+    return children.flat().map(resolveChildEarly);
   } catch (e) {
     if (e instanceof Promise) {
       const resume = captureRenderContext();
@@ -20,18 +20,16 @@ var childrenToString = async (children) => {
     }
   }
 };
-var resolveChildEarly = (c) => {
-  if (c == null || typeof c === "boolean") {
+var resolveChildEarly = (child) => {
+  if (child == null || typeof child === "boolean") {
     return "";
-  } else if (typeof c === "string") {
-    return c;
+  } else if (typeof child === "string" || Array.isArray(child)) {
+    return renderChildren([child]);
+  } else if (isUntrustedObject(child)) {
+    return renderUntrustedObject(child);
   } else {
-    const str = c.toString();
-    if (!(str instanceof Promise)) {
-      return raw(str);
-    } else {
-      return str;
-    }
+    const str = child.toString();
+    return str instanceof Promise ? str : raw(str);
   }
 };
 var ErrorBoundary = async ({ children, fallback, fallbackRender, onError }) => {
@@ -47,26 +45,27 @@ var ErrorBoundary = async ({ children, fallback, fallbackRender, onError }) => {
   let fallbackStrPromise;
   const resolveFallbackStr = () => fallbackStrPromise ||= (async () => {
     const awaitedFallback = await fallback;
-    if (typeof awaitedFallback === "string") {
-      return awaitedFallback;
-    } else {
-      const fallbackResult = await getResume()(() => awaitedFallback?.toString());
-      if (typeof fallbackResult === "string") {
-        return raw(
-          fallbackResult,
-          fallbackResult.callbacks || awaitedFallback?.callbacks
-        );
-      }
+    if (awaitedFallback === null || awaitedFallback === void 0) {
+      return;
+    }
+    if (typeof awaitedFallback === "string" || Array.isArray(awaitedFallback)) {
+      return getResume()(() => renderChildren([awaitedFallback]));
+    }
+    if (isUntrustedObject(awaitedFallback)) {
+      return getResume()(() => renderUntrustedObject(awaitedFallback));
     }
+    const fallbackResult = await getResume()(() => awaitedFallback.toString());
+    return raw(
+      fallbackResult,
+      fallbackResult.callbacks || awaitedFallback.callbacks
+    );
   })();
   const renderFallback = async (error) => {
     const fallbackStr = await resolveFallbackStr();
     return getResume()(async () => {
       onError?.(error);
       const fallbackRes = fallbackStr !== void 0 ? fallbackStr : fallbackRender && jsx(Fragment, {}, fallbackRender(error)) || "";
-      const fallbackResString = await Fragment({
-        children: fallbackRes
-      }).toString();
+      const fallbackResString = await Fragment({ children: fallbackRes }).toString();
       return raw(
         fallbackResString,
         fallbackResString.callbacks || fallbackRes.callbacks
@@ -99,7 +98,7 @@ var ErrorBoundary = async ({ children, fallback, fallbackRender, onError }) => {
       const fallbackResString = await renderFallback(error2);
       const fallbackCallbacks = fallbackResString.callbacks;
       if (buffer) {
-        buffer[0] = buffer[0].replace(replaceRe, fallbackResString);
+        buffer[0] = buffer[0].replace(replaceRe, () => fallbackResString);
         return fallbackCallbacks?.length ? raw("", fallbackCallbacks) : "";
       }
       return raw(
@@ -138,7 +137,7 @@ d.parentElement.insertBefore(c.content,d.nextSibling)
 </script>`;
           if (htmlArray.every((html2) => !html2.callbacks?.length)) {
             if (buffer) {
-              buffer[0] = buffer[0].replace(replaceRe, content);
+              buffer[0] = buffer[0].replace(replaceRe, () => content);
             }
             return html;
           }

package/node_modules/hono/dist/jsx/context.js

@@ -1,6 +1,6 @@
 // src/jsx/context.ts
 import { raw } from "../helper/html/index.js";
-import { JSXFragmentNode } from "./base.js";
+import { isUntrustedObject, JSXFragmentNode, renderChildren, renderUntrustedObject } from "./base.js";
 import { DOM_RENDERER } from "./constants.js";
 import { createContextProviderFunction } from "./dom/context.js";
 var globalContexts = [];
@@ -130,18 +130,18 @@ var createContext = (defaultValue) => {
   const context = ((props) => {
     const contextValues = getContextValuesIn(getCurrentStore(), context);
     contextValues.push(props.value);
-    let string;
+    let rendered;
     try {
-      string = props.children ? (Array.isArray(props.children) ? new JSXFragmentNode("", {}, props.children) : props.children).toString() : "";
+      rendered = typeof props.children === "string" ? renderChildren([props.children]) : isUntrustedObject(props.children) ? renderUntrustedObject(props.children) : props.children ? (Array.isArray(props.children) ? new JSXFragmentNode("", {}, props.children) : props.children).toString() : raw("");
     } catch (e) {
       contextValues.pop();
       throw e;
     }
-    if (string instanceof Promise) {
-      return string.finally(() => contextValues.pop()).then((resString) => raw(resString, resString.callbacks));
+    if (rendered instanceof Promise) {
+      return rendered.finally(() => contextValues.pop()).then((resString) => raw(resString, resString.callbacks));
     } else {
       contextValues.pop();
-      return raw(string);
+      return raw(rendered);
     }
   });
   context.values = values;

package/node_modules/hono/dist/jsx/dom/server.js

@@ -1,11 +1,14 @@
 // src/jsx/dom/server.ts
+import { renderChildren } from "../base.js";
 import { renderToReadableStream as renderToReadableStreamHono } from "../streaming.js";
 import version from "./index.js";
+var prepareRoot = (element) => typeof element === "string" || Array.isArray(element) ? renderChildren([element]) : element;
 var renderToString = (element, options = {}) => {
   if (Object.keys(options).length > 0) {
     console.warn("options are not supported yet");
   }
-  const res = element?.toString() ?? "";
+  element = prepareRoot(element);
+  const res = element instanceof Promise ? element : element?.toString() ?? "";
   if (typeof res !== "string") {
     throw new Error("Async component is not supported in renderToString");
   }
@@ -15,6 +18,7 @@ var renderToReadableStream = async (element, options = {}) => {
   if (Object.keys(options).some((key) => key !== "onError")) {
     console.warn("options are not supported yet, except onError");
   }
+  element = prepareRoot(element);
   if (!element || typeof element !== "object") {
     element = element?.toString() ?? "";
   }

package/node_modules/hono/dist/jsx/intrinsic-element/components.js

@@ -1,6 +1,6 @@
 // src/jsx/intrinsic-element/components.ts
 import { raw } from "../../helper/html/index.js";
-import { JSXNode, getNameSpaceContext } from "../base.js";
+import { JSXNode, getNameSpaceContext, renderChildren } from "../base.js";
 import { toArray } from "../children.js";
 import { PERMALINK } from "../constants.js";
 import { useContext } from "../context.js";
@@ -62,10 +62,10 @@ var insertIntoHead = (tagName, tag, props, precedence) => ({ buffer, context })
     insertTags.forEach((tag2) => {
       buffer[0] = buffer[0].replaceAll(tag2, "");
     });
-    buffer[0] = buffer[0].replace(/(?=<\/head>)/, insertTags.join(""));
+    buffer[0] = buffer[0].replace(/(?=<\/head>)/, () => insertTags.join(""));
   }
 };
-var returnWithoutSpecialBehavior = (tag, children, props) => raw(new JSXNode(tag, props, toArray(children ?? [])).toString());
+var returnWithoutSpecialBehavior = (tag, children, props) => renderChildren([new JSXNode(tag, props, toArray(children ?? []))]);
 var documentMetadataTag = (tag, children, props, sort) => {
   if ("itemProp" in props) {
     return returnWithoutSpecialBehavior(tag, children, props);

package/node_modules/hono/dist/jsx/streaming.js

@@ -1,7 +1,7 @@
 // src/jsx/streaming.ts
 import { raw } from "../helper/html/index.js";
 import { HtmlEscapedCallbackPhase, resolveCallback } from "../utils/html.js";
-import { JSXNode } from "./base.js";
+import { isUntrustedObject, JSXNode, renderChildren, renderUntrustedObject } from "./base.js";
 import { childrenToString } from "./components.js";
 import { DOM_RENDERER, DOM_STASH } from "./constants.js";
 import { captureRenderContext, createContext, useContext } from "./context.js";
@@ -9,6 +9,7 @@ import { Suspense as SuspenseDomRenderer } from "./dom/components.js";
 import { buildDataStack } from "./dom/render.js";
 var StreamingContext = createContext(null);
 var suspenseCounter = 0;
+var serializeBoundaryChild = (child) => typeof child === "string" || Array.isArray(child) ? renderChildren([child]) : child == null || typeof child === "boolean" ? "" : isUntrustedObject(child) ? renderUntrustedObject(child) : child.toString();
 var Suspense = async ({
   children,
   fallback
@@ -25,9 +26,7 @@ var Suspense = async ({
   try {
     stackNode[DOM_STASH][0] = 0;
     buildDataStack.push([[], stackNode]);
-    resArray = children.map(
-      (c) => c == null || typeof c === "boolean" ? "" : c.toString()
-    );
+    resArray = children.map(serializeBoundaryChild);
   } catch (e) {
     if (e instanceof Promise) {
       const resume = captureRenderContext();
@@ -48,7 +47,7 @@ var Suspense = async ({
   }
   if (resArray.some((res) => res instanceof Promise)) {
     const index = suspenseCounter++;
-    const fallbackStr = await fallback.toString();
+    const fallbackStr = await (typeof fallback === "string" || Array.isArray(fallback) ? renderChildren([fallback]) : isUntrustedObject(fallback) ? renderUntrustedObject(fallback) : fallback.toString());
     return raw(`<template id="H:${index}"></template>${fallbackStr}<!--/$-->`, [
       ...fallbackStr.callbacks || [],
       ({ phase, buffer, context }) => {
@@ -61,7 +60,7 @@ var Suspense = async ({
           if (buffer) {
             buffer[0] = buffer[0].replace(
               new RegExp(`<template id="H:${index}"></template>.*?<!--/\\$-->`),
-              content
+              () => content
             );
           }
           let html = buffer ? "" : `<template data-hono-target="H:${index}">${content}</template><script${nonce ? ` nonce="${nonce}"` : ""}>

package/node_modules/hono/dist/types/context.d.ts

@@ -347,7 +347,7 @@ export declare class Context<E extends Env = any, P extends string = any, I exte
      * ```
      */
     set: Set<IsAny<E> extends true ? {
-        Variables: ContextVariableMap & Record<string, any>;
+        Variables: ContextVariableMap & Record<PropertyKey, any>;
     } : E>;
     /**
      * `.get()` can use the value specified by the key.
@@ -363,7 +363,7 @@ export declare class Context<E extends Env = any, P extends string = any, I exte
      * ```
      */
     get: Get<IsAny<E> extends true ? {
-        Variables: ContextVariableMap & Record<string, any>;
+        Variables: ContextVariableMap & Record<PropertyKey, any>;
     } : E>;
     /**
      * `.var` can access the value of a variable.

package/node_modules/hono/dist/types/jsx/base.d.ts

@@ -26,6 +26,9 @@ export declare namespace JSX {
 export declare const getNameSpaceContext: () => Context<string> | undefined;
 export declare const booleanAttributes: string[];
 export type Child = string | Promise<string> | number | JSXNode | null | undefined | boolean | Child[];
+export declare const renderChildren: (children: Child[]) => HtmlEscapedString | Promise<HtmlEscapedString>;
+export declare const isUntrustedObject: (value: unknown) => boolean;
+export declare const renderUntrustedObject: (value: unknown) => HtmlEscapedString | Promise<HtmlEscapedString>;
 export declare class JSXNode implements HtmlEscaped {
     tag: string | Function;
     props: Props;

package/node_modules/hono/package.json

@@ -1,6 +1,6 @@
 {
   "name": "hono",
-  "version": "4.13.5",
+  "version": "4.13.7",
   "description": "Web framework built on Web Standards",
   "main": "dist/cjs/index.js",
   "type": "module",
@@ -682,7 +682,7 @@
     "@typescript/native-preview": "7.0.0-dev.20260210.1",
     "@vitest/coverage-v8": "^4.1.7",
     "bun-types": "^1.2.20",
-    "editorconfig-checker": "6.1.1",
+    "editorconfig-checker": "6.2.0",
     "esbuild": "^0.27.1",
     "eslint": "^9.39.3",
     "jsdom": "22.1.0",

package/node_modules/jose/dist/types/index.d.ts

@@ -48,8 +48,7 @@ import * as base64url from './util/base64url.js';
 export { base64url };
 export type { AnyJWK, CompactDecryptResult, CompactJWEHeaderParameters, CompactJWSHeaderParameters, CompactVerifyResult, CritOption, CryptoKey, DecryptOptions, EncryptOptions, FlattenedDecryptResult, FlattenedJWE, FlattenedJWS, FlattenedJWSInput, FlattenedVerifyResult, GeneralDecryptResult, GeneralJWE, GeneralJWS, GeneralJWSInput, GeneralVerifyResult, GetKeyFunction, JoseHeaderParameters, JSONWebKeySet, JWEContentEncryptionAlgorithm, JWEHeaderParameters, JWEKeyManagementAlgorithm, JWEKeyManagementHeaderParameters, JWK_AKP_Private, JWK_AKP_Public, JWK_EC_Private, JWK_EC_Public, JWK_oct, JWK_OKP_Private, JWK_OKP_Public, JWK_RSA_Private, JWK_RSA_Public, JWK, JWKKeyType, JWKParameters, JWSAlgorithm, JWSHeaderParameters, JWTClaimVerificationOptions, JWTDecryptResult, JWTHeaderParameters, JWTPayload, JWTVerifyResult, KeyInput, KeyObject, ProduceJWT, ResolvedKey, SignOptions, VerifyOptions, } from './types.d.ts';
 /**
- * In prior releases this indicated whether a Node.js-specific build was loaded, this is now fixed
- * to `"WebCryptoAPI"`
+ * Identified the loaded runtime-specific build in prior releases; now always `"WebCryptoAPI"`.
  *
  * @deprecated Remove any runtime branching on this value; it is always `"WebCryptoAPI"`.
  */

package/node_modules/jose/dist/types/jwe/compact/decrypt.d.ts

@@ -1,28 +1,24 @@
 import type * as t from '../../types.d.ts';
-/** Dynamic key resolver for Compact JWE decryption. */
+/** Resolves a key for Compact JWE decryption from unverified headers and token data. */
 export interface CompactDecryptGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.CompactJWEHeaderParameters, t.FlattenedJWE, KeyType | t.KeyObject | t.JWK> {
 }
 /**
  * Decrypts a Compact JWE.
  *
- * @param key Private Key or Secret to decrypt the JWE with. See
+ * @param key Private key or shared secret. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  */
 export declare function compactDecrypt(jwe: string | Uint8Array, key: t.KeyInput, options?: t.DecryptOptions): Promise<t.CompactDecryptResult>;
 /**
- * Decrypts a Compact JWE, resolving the key dynamically. The result additionally carries the
- * {@link t.ResolvedKey.key resolved key}.
+ * Decrypts a Compact JWE with a dynamically resolved key, included in the result.
  *
- * @param getKey Function resolving Private Key or Secret to decrypt the JWE with. See
- *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+ * @param getKey Resolves a private key or shared secret from unverified token data.
  */
 export declare function compactDecrypt<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jwe: string | Uint8Array, getKey: CompactDecryptGetKey<KeyType>, options?: t.DecryptOptions): Promise<t.CompactDecryptResult & t.ResolvedKey<KeyType>>;
 /**
- * Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
- * either a key or a key resolution function; `key` is present on the result only when a resolution
- * function was used.
+ * Decrypts a Compact JWE with a key or key resolver. The result includes `key` only when a resolver
+ * is used.
  *
- * @param key Private Key or Secret, or a function resolving one, to decrypt the JWE with. See
- *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+ * @param key Private key or shared secret, or a function resolving one.
  */
 export declare function compactDecrypt(jwe: string | Uint8Array, key: t.KeyInput | CompactDecryptGetKey, options?: t.DecryptOptions): Promise<t.CompactDecryptResult & Partial<t.ResolvedKey>>;

package/node_modules/jose/dist/types/jwe/compact/encrypt.d.ts

@@ -3,40 +3,37 @@ import type * as t from '../../types.d.ts';
 export declare class CompactEncrypt {
     #private;
     /**
-     * {@link CompactEncrypt} constructor
+     * Creates a Compact JWE encryptor.
      *
      * @param plaintext Binary representation of the plaintext to encrypt.
      */
     constructor(plaintext: Uint8Array);
     /**
-     * Sets a content encryption key to use, by default a random suitable one is generated for the JWE
-     * "enc" (Encryption Algorithm) Header Parameter.
+     * Sets a content encryption key instead of generating a random one for the JWE "enc" algorithm.
+     * May only be called once.
      *
-     * @deprecated You should not use this method. It is only really intended for test and vector
-     *   validation purposes.
+     * @deprecated Use only for testing and vector validation.
      */
     setContentEncryptionKey(cek: Uint8Array): this;
     /**
-     * Sets the JWE Initialization Vector to use for content encryption, by default a random suitable
-     * one is generated for the JWE "enc" (Encryption Algorithm) Header Parameter.
+     * Sets the content encryption IV instead of generating a random one for the JWE "enc" algorithm.
+     * May only be called once.
      *
-     * @deprecated You should not use this method. It is only really intended for test and vector
-     *   validation purposes.
+     * @deprecated Use only for testing and vector validation.
      */
     setInitializationVector(iv: Uint8Array): this;
-    /** Sets the JWE Protected Header on the CompactEncrypt object. */
+    /** Sets the JWE Protected Header. May only be called once. */
     setProtectedHeader(protectedHeader: t.CompactJWEHeaderParameters): this;
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting. Use this method instead of
-     * the header setters to configure algorithm inputs such as ECDH-ES "apu" (Agreement PartyUInfo)
-     * and "apv" (Agreement PartyVInfo), or PBES2 "p2c" (PBES2 Count). The parameters are added to the
-     * appropriate JOSE Header.
+     * Sets key management inputs such as ECDH-ES "apu"/"apv" or PBES2 "p2c". Use this method instead
+     * of header setters; the resulting parameters are added to the JOSE header. May only be called
+     * once.
      */
     setKeyManagementParameters(parameters: t.JWEKeyManagementHeaderParameters): this;
     /**
-     * Encrypts and resolves the value of the Compact JWE string.
+     * Encrypts the plaintext as a Compact JWE.
      *
-     * @param key Public Key or Secret to encrypt the JWE with. See
+     * @param key Public key or shared secret. See
      *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
      */
     encrypt(key: t.KeyInput, options?: t.EncryptOptions): Promise<string>;

package/node_modules/jose/dist/types/jwe/flattened/decrypt.d.ts

@@ -1,28 +1,24 @@
 import type * as t from '../../types.d.ts';
-/** Dynamic key resolver for Flattened JWE decryption. */
+/** Resolves a key for Flattened JWE decryption from unverified headers and token data. */
 export interface FlattenedDecryptGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.JWEHeaderParameters | undefined, t.FlattenedJWE, KeyType | t.KeyObject | t.JWK> {
 }
 /**
  * Decrypts a Flattened JWE.
  *
- * @param key Private Key or Secret to decrypt the JWE with. See
+ * @param key Private key or shared secret. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  */
 export declare function flattenedDecrypt(jwe: t.FlattenedJWE, key: t.KeyInput, options?: t.DecryptOptions): Promise<t.FlattenedDecryptResult>;
 /**
- * Decrypts a Flattened JWE, resolving the key dynamically. The result additionally carries the
- * {@link t.ResolvedKey.key resolved key}.
+ * Decrypts a Flattened JWE with a dynamically resolved key, included in the result.
  *
- * @param getKey Function resolving Private Key or Secret to decrypt the JWE with. See
- *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+ * @param getKey Resolves a private key or shared secret from unverified token data.
  */
 export declare function flattenedDecrypt<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jwe: t.FlattenedJWE, getKey: FlattenedDecryptGetKey<KeyType>, options?: t.DecryptOptions): Promise<t.FlattenedDecryptResult & t.ResolvedKey<KeyType>>;
 /**
- * Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
- * either a key or a key resolution function; `key` is present on the result only when a resolution
- * function was used.
+ * Decrypts a Flattened JWE with a key or key resolver. The result includes `key` only when a
+ * resolver is used.
  *
- * @param key Private Key or Secret, or a function resolving one, to decrypt the JWE with. See
- *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+ * @param key Private key or shared secret, or a function resolving one.
  */
 export declare function flattenedDecrypt(jwe: t.FlattenedJWE, key: t.KeyInput | FlattenedDecryptGetKey, options?: t.DecryptOptions): Promise<t.FlattenedDecryptResult & Partial<t.ResolvedKey>>;

package/node_modules/jose/dist/types/jwe/flattened/encrypt.d.ts

@@ -3,46 +3,43 @@ import type * as t from '../../types.d.ts';
 export declare class FlattenedEncrypt {
     #private;
     /**
-     * {@link FlattenedEncrypt} constructor
+     * Creates a Flattened JWE encryptor.
      *
      * @param plaintext Binary representation of the plaintext to encrypt.
      */
     constructor(plaintext: Uint8Array);
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting. Use this method instead of
-     * the header setters to configure algorithm inputs such as ECDH-ES "apu" (Agreement PartyUInfo)
-     * and "apv" (Agreement PartyVInfo), or PBES2 "p2c" (PBES2 Count). The parameters are added to the
-     * appropriate JOSE Header.
+     * Sets key management inputs such as ECDH-ES "apu"/"apv" or PBES2 "p2c". Use this method instead
+     * of header setters; the resulting parameters are added to the JOSE header. May only be called
+     * once.
      */
     setKeyManagementParameters(parameters: t.JWEKeyManagementHeaderParameters): this;
-    /** Sets the JWE Protected Header on the FlattenedEncrypt object. */
+    /** Sets the JWE Protected Header. May only be called once. */
     setProtectedHeader(protectedHeader: t.JWEHeaderParameters): this;
-    /** Sets the JWE Shared Unprotected Header on the FlattenedEncrypt object. */
+    /** Sets the JWE Shared Unprotected Header. May only be called once. */
     setSharedUnprotectedHeader(sharedUnprotectedHeader: t.JWEHeaderParameters): this;
-    /** Sets the JWE Per-Recipient Unprotected Header on the FlattenedEncrypt object. */
+    /** Sets the JWE Per-Recipient Unprotected Header. May only be called once. */
     setUnprotectedHeader(unprotectedHeader: t.JWEHeaderParameters): this;
-    /** Sets the Additional Authenticated Data on the FlattenedEncrypt object. */
+    /** Sets additional data to authenticate without encrypting it. */
     setAdditionalAuthenticatedData(aad: Uint8Array): this;
     /**
-     * Sets a content encryption key to use, by default a random suitable one is generated for the JWE
-     * "enc" (Encryption Algorithm) Header Parameter.
+     * Sets a content encryption key instead of generating a random one for the JWE "enc" algorithm.
+     * May only be called once.
      *
-     * @deprecated You should not use this method. It is only really intended for test and vector
-     *   validation purposes.
+     * @deprecated Use only for testing and vector validation.
      */
     setContentEncryptionKey(cek: Uint8Array): this;
     /**
-     * Sets the JWE Initialization Vector to use for content encryption, by default a random suitable
-     * one is generated for the JWE "enc" (Encryption Algorithm) Header Parameter.
+     * Sets the content encryption IV instead of generating a random one for the JWE "enc" algorithm.
+     * May only be called once.
      *
-     * @deprecated You should not use this method. It is only really intended for test and vector
-     *   validation purposes.
+     * @deprecated Use only for testing and vector validation.
      */
     setInitializationVector(iv: Uint8Array): this;
     /**
-     * Encrypts and resolves the value of the Flattened JWE object.
+     * Encrypts the plaintext as a Flattened JWE.
      *
-     * @param key Public Key or Secret to encrypt the JWE with. See
+     * @param key Public key or shared secret. See
      *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
      */
     encrypt(key: t.KeyInput, options?: t.EncryptOptions): Promise<t.FlattenedJWE>;

package/node_modules/jose/dist/types/jwe/general/decrypt.d.ts

@@ -1,34 +1,28 @@
 import type * as t from '../../types.d.ts';
-/** Dynamic key resolver for General JWE decryption. */
+/** Resolves a key for General JWE decryption from unverified headers and token data. */
 export interface GeneralDecryptGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.JWEHeaderParameters | undefined, t.FlattenedJWE, KeyType | t.KeyObject | t.JWK> {
 }
 /**
  * Decrypts a General JWE.
  *
- * > Note: The function iterates over the `recipients` array in the General JWE and returns the decryption
- * > result of the first recipient entry that can be successfully decrypted. The result only contains
- * > the plaintext and headers of that successfully decrypted recipient entry. Other recipient entries
- * > in the General JWE are not validated, and their headers are not included in the returned result.
- * > Recipients of a General JWE should only rely on the returned (decrypted) data.
+ * > Note: Returns plaintext and headers from the first recipient that decrypts successfully. Other
+ * > recipients may be inspected to enforce serialization rules, but their headers are not included in
+ * > the result. Rely only on the returned data.
  *
- * @param key Private Key or Secret to decrypt the JWE with. See
+ * @param key Private key or shared secret. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  */
 export declare function generalDecrypt(jwe: t.GeneralJWE, key: t.KeyInput, options?: t.DecryptOptions): Promise<t.GeneralDecryptResult>;
 /**
- * Decrypts a General JWE, resolving the key dynamically. The result additionally carries the
- * {@link t.ResolvedKey.key resolved key}.
+ * Decrypts a General JWE with a dynamically resolved key, included in the result.
  *
- * @param getKey Function resolving Private Key or Secret to decrypt the JWE with. See
- *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+ * @param getKey Resolves a private key or shared secret from unverified token data.
  */
 export declare function generalDecrypt<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jwe: t.GeneralJWE, getKey: GeneralDecryptGetKey<KeyType>, options?: t.DecryptOptions): Promise<t.GeneralDecryptResult & t.ResolvedKey<KeyType>>;
 /**
- * Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
- * either a key or a key resolution function; `key` is present on the result only when a resolution
- * function was used.
+ * Decrypts a General JWE with a key or key resolver. The result includes `key` only when a resolver
+ * is used.
  *
- * @param key Private Key or Secret, or a function resolving one, to decrypt the JWE with. See
- *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+ * @param key Private key or shared secret, or a function resolving one.
  */
 export declare function generalDecrypt(jwe: t.GeneralJWE, key: t.KeyInput | GeneralDecryptGetKey, options?: t.DecryptOptions): Promise<t.GeneralDecryptResult & Partial<t.ResolvedKey>>;

package/node_modules/jose/dist/types/jwe/general/encrypt.d.ts

@@ -1,54 +1,51 @@
 import type * as t from '../../types.d.ts';
 /** Configures an individual recipient in a General JWE. */
 export interface Recipient {
-    /** Sets the JWE Per-Recipient Unprotected Header on the Recipient object. */
+    /** Sets the JWE Per-Recipient Unprotected Header. May only be called once. */
     setUnprotectedHeader(unprotectedHeader: t.JWEHeaderParameters): Recipient;
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting. Use this method instead of
-     * the header setters to configure algorithm inputs such as ECDH-ES "apu" (Agreement PartyUInfo)
-     * and "apv" (Agreement PartyVInfo), or PBES2 "p2c" (PBES2 Count). The parameters are added to the
-     * appropriate JOSE Header.
+     * Sets key management inputs such as ECDH-ES "apu"/"apv" or PBES2 "p2c". Use this method instead
+     * of header setters; the resulting parameters are added to the JOSE header. May only be called
+     * once.
      */
     setKeyManagementParameters(parameters: t.JWEKeyManagementHeaderParameters): Recipient;
     /**
-     * A shorthand for calling {@link GeneralEncrypt.addRecipient addRecipient()} on the enclosing
-     * {@link GeneralEncrypt} instance.
+     * Adds another recipient to the enclosing {@link GeneralEncrypt} and returns its configuration.
      *
-     * @param key Public Key or Secret to encrypt the Content Encryption Key for the recipient with.
-     *   See {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+     * @param key Public key or shared secret. See
+     *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
      */
     addRecipient(key: t.KeyInput, options?: t.CritOption): Recipient;
     /**
-     * A shorthand for calling {@link GeneralEncrypt.encrypt encrypt()} on the enclosing
-     * {@link GeneralEncrypt} instance. Takes no arguments — each recipient's key is supplied to
-     * {@link addRecipient}.
+     * Encrypts for all recipients on the enclosing {@link GeneralEncrypt}, using their configured
+     * keys.
      */
     encrypt(): Promise<t.GeneralJWE>;
-    /** Returns the enclosing {@link GeneralEncrypt} instance */
+    /** Returns the enclosing {@link GeneralEncrypt} instance. */
     done(): GeneralEncrypt;
 }
 /** Builds and encrypts General JWE objects. */
 export declare class GeneralEncrypt {
     #private;
     /**
-     * {@link GeneralEncrypt} constructor
+     * Creates a General JWE encryptor.
      *
      * @param plaintext Binary representation of the plaintext to encrypt.
      */
     constructor(plaintext: Uint8Array);
     /**
-     * Adds an additional recipient for the General JWE object.
+     * Adds a recipient and returns its configuration.
      *
-     * @param key Public Key or Secret to encrypt the Content Encryption Key for the recipient with.
-     *   See {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+     * @param key Public key or shared secret. See
+     *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
      */
     addRecipient(key: t.KeyInput, options?: t.CritOption): Recipient;
-    /** Sets the JWE Protected Header on the GeneralEncrypt object. */
+    /** Sets the JWE Protected Header. May only be called once. */
     setProtectedHeader(protectedHeader: t.JWEHeaderParameters): this;
-    /** Sets the JWE Shared Unprotected Header on the GeneralEncrypt object. */
+    /** Sets the JWE Shared Unprotected Header. May only be called once. */
     setSharedUnprotectedHeader(sharedUnprotectedHeader: t.JWEHeaderParameters): this;
-    /** Sets the Additional Authenticated Data on the GeneralEncrypt object. */
+    /** Sets additional data to authenticate without encrypting it. */
     setAdditionalAuthenticatedData(aad: Uint8Array): this;
-    /** Encrypts and resolves the value of the General JWE object. */
+    /** Encrypts the plaintext as a General JWE. */
     encrypt(): Promise<t.GeneralJWE>;
 }

package/node_modules/jose/dist/types/jwk/embedded.d.ts

@@ -1,6 +1,8 @@
 import type * as t from '../types.d.ts';
 /**
- * Resolves a verification key from an embedded "jwk" (JSON Web Key) Header Parameter.
+ * Resolves a verification key from an embedded "jwk" (JSON Web Key) Header Parameter. This key
+ * resolver opts JWS and JWT verification into trusting a public key supplied by the token. Use the
+ * verification function's `algorithms` option to restrict accepted algorithms.
  *
  * @param token The consumed JWS token.
  * @returns The public key from the JWS "jwk" (JSON Web Key) Header Parameter.