@suveren/gateway 0.4.1 → 0.6.0

package/node_modules/jose/dist/webapi/lib/crypto_key.js

@@ -1,136 +1,28 @@
 const unusable = (name, prop = 'algorithm.name') => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-const isAlgorithm = (algorithm, name) => algorithm.name === name;
-function getHashLength(hash) {
-    return parseInt(hash.name.slice(4), 10);
-}
-function checkHashLength(algorithm, expected) {
-    const actual = getHashLength(algorithm.hash);
-    if (actual !== expected)
-        throw unusable(`SHA-${expected}`, 'algorithm.hash');
-}
-function getNamedCurve(alg) {
-    switch (alg) {
-        case 'ES256':
-            return 'P-256';
-        case 'ES384':
-            return 'P-384';
-        case 'ES512':
-            return 'P-521';
-        default:
-            throw new Error('unreachable');
-    }
-}
-function checkUsage(key, usage) {
+export function checkUsage(key, usage) {
     if (usage && !key.usages.includes(usage)) {
         throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
     }
 }
-export function checkSigCryptoKey(key, alg, usage) {
-    switch (alg) {
-        case 'HS256':
-        case 'HS384':
-        case 'HS512': {
-            if (!isAlgorithm(key.algorithm, 'HMAC'))
-                throw unusable('HMAC');
-            checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
-            break;
-        }
-        case 'RS256':
-        case 'RS384':
-        case 'RS512': {
-            if (!isAlgorithm(key.algorithm, 'RSASSA-PKCS1-v1_5'))
-                throw unusable('RSASSA-PKCS1-v1_5');
-            checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
-            break;
-        }
-        case 'PS256':
-        case 'PS384':
-        case 'PS512': {
-            if (!isAlgorithm(key.algorithm, 'RSA-PSS'))
-                throw unusable('RSA-PSS');
-            checkHashLength(key.algorithm, parseInt(alg.slice(2), 10));
-            break;
-        }
-        case 'Ed25519':
-        case 'EdDSA': {
-            if (!isAlgorithm(key.algorithm, 'Ed25519'))
-                throw unusable('Ed25519');
-            break;
-        }
-        case 'ML-DSA-44':
-        case 'ML-DSA-65':
-        case 'ML-DSA-87': {
-            if (!isAlgorithm(key.algorithm, alg))
-                throw unusable(alg);
-            break;
-        }
-        case 'ES256':
-        case 'ES384':
-        case 'ES512': {
-            if (!isAlgorithm(key.algorithm, 'ECDSA'))
-                throw unusable('ECDSA');
-            const expected = getNamedCurve(alg);
-            const actual = key.algorithm.namedCurve;
-            if (actual !== expected)
-                throw unusable(expected, 'algorithm.namedCurve');
-            break;
-        }
-        default:
-            throw new TypeError('CryptoKey does not support this operation');
+export function checkModulusLength(alg, key) {
+    const { modulusLength } = key.algorithm;
+    if (typeof modulusLength !== 'number' || modulusLength < 2048) {
+        throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
     }
-    checkUsage(key, usage);
 }
-export function checkEncCryptoKey(key, alg, usage) {
-    switch (alg) {
-        case 'A128GCM':
-        case 'A192GCM':
-        case 'A256GCM': {
-            if (!isAlgorithm(key.algorithm, 'AES-GCM'))
-                throw unusable('AES-GCM');
-            const expected = parseInt(alg.slice(1, 4), 10);
-            const actual = key.algorithm.length;
-            if (actual !== expected)
-                throw unusable(expected, 'algorithm.length');
-            break;
-        }
-        case 'A128KW':
-        case 'A192KW':
-        case 'A256KW': {
-            if (!isAlgorithm(key.algorithm, 'AES-KW'))
-                throw unusable('AES-KW');
-            const expected = parseInt(alg.slice(1, 4), 10);
-            const actual = key.algorithm.length;
-            if (actual !== expected)
-                throw unusable(expected, 'algorithm.length');
-            break;
-        }
-        case 'ECDH': {
-            switch (key.algorithm.name) {
-                case 'ECDH':
-                case 'X25519':
-                    break;
-                default:
-                    throw unusable('ECDH or X25519');
-            }
-            break;
-        }
-        case 'PBES2-HS256+A128KW':
-        case 'PBES2-HS384+A192KW':
-        case 'PBES2-HS512+A256KW':
-            if (!isAlgorithm(key.algorithm, 'PBKDF2'))
-                throw unusable('PBKDF2');
-            break;
-        case 'RSA-OAEP':
-        case 'RSA-OAEP-256':
-        case 'RSA-OAEP-384':
-        case 'RSA-OAEP-512': {
-            if (!isAlgorithm(key.algorithm, 'RSA-OAEP'))
-                throw unusable('RSA-OAEP');
-            checkHashLength(key.algorithm, parseInt(alg.slice(9), 10) || 1);
-            break;
-        }
-        default:
-            throw new TypeError('CryptoKey does not support this operation');
+export function checkCryptoKey(key, expected, usage) {
+    const algorithm = key.algorithm;
+    if (algorithm.name !== expected.name) {
+        throw unusable(expected.name);
+    }
+    if (expected.hash && algorithm.hash?.name !== expected.hash) {
+        throw unusable(expected.hash, 'algorithm.hash');
+    }
+    if (expected.namedCurve && algorithm.namedCurve !== expected.namedCurve) {
+        throw unusable(expected.namedCurve, 'algorithm.namedCurve');
+    }
+    if (expected.length !== undefined && algorithm.length !== expected.length) {
+        throw unusable(expected.length, 'algorithm.length');
     }
     checkUsage(key, usage);
 }

package/node_modules/jose/dist/webapi/lib/helpers.js

@@ -1,4 +1,6 @@
 import { decode } from '../util/base64url.js';
+import { encode, strictDecoder } from './buffer_utils.js';
+import { isObject } from './type_checks.js';
 export const unprotected = Symbol();
 export function assertNotSet(value, name) {
     if (value) {
@@ -13,7 +15,28 @@ export function decodeBase64url(value, label, ErrorClass) {
         throw new ErrorClass(`Failed to base64url decode the ${label}`);
     }
 }
+export function encodeBase64url(value, label, ErrorClass) {
+    try {
+        return encode(value);
+    }
+    catch {
+        throw new ErrorClass(`The ${label} is not a valid base64url string`);
+    }
+}
 export async function digest(algorithm, data) {
     const subtleDigest = `SHA-${algorithm.slice(-3)}`;
     return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));
 }
+export function parseJoseHeader(b64, ErrorClass, message) {
+    let parsed;
+    try {
+        parsed = JSON.parse(strictDecoder.decode(decode(b64)));
+    }
+    catch {
+        throw new ErrorClass(message);
+    }
+    if (!isObject(parsed)) {
+        throw new ErrorClass(message);
+    }
+    return parsed;
+}

package/node_modules/jose/dist/webapi/lib/invalid_key_input.js

@@ -1,5 +1,4 @@
 function message(msg, actual, ...types) {
-    types = types.filter(Boolean);
     if (types.length > 2) {
         const last = types.pop();
         msg += `one of type ${types.join(', ')}, or ${last}.`;

package/node_modules/jose/dist/webapi/lib/jwe_algorithms.js

@@ -0,0 +1,116 @@
+import { JOSENotSupported } from '../util/errors.js';
+import { table } from './key_descriptor.js';
+const wrap = [
+    ['encrypt', 'wrapKey'],
+    ['decrypt', 'unwrapKey'],
+];
+const derive = [[], ['deriveBits']];
+const none = [[], []];
+function rsaes(bits) {
+    return {
+        kty: ['RSA'],
+        subtle: { name: 'RSA-OAEP', hash: `SHA-${bits}` },
+        usages: wrap,
+        ops: ['wrapKey', 'unwrapKey'],
+    };
+}
+function ecdh() {
+    return {
+        kty: ['EC', 'OKP'],
+        subtle: { name: 'ECDH' },
+        resolve: ({ kty, crv, asymmetricKeyType }) => {
+            if (crv === 'X25519' || asymmetricKeyType === 'x25519') {
+                return { name: 'X25519' };
+            }
+            if (kty === 'OKP') {
+                throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+            }
+            return { name: 'ECDH', namedCurve: crv };
+        },
+        usages: derive,
+        ops: [undefined, 'deriveBits'],
+    };
+}
+function aeskw(bits, gcm = false) {
+    return {
+        kty: ['oct'],
+        secret: true,
+        subtle: { name: gcm ? 'AES-GCM' : 'AES-KW', length: bits },
+        usages: none,
+        ops: gcm ? ['encrypt', 'decrypt'] : ['wrapKey', 'unwrapKey'],
+    };
+}
+function pbes2() {
+    return {
+        kty: ['oct'],
+        secret: true,
+        subtle: { name: 'PBKDF2' },
+        usages: none,
+        ops: ['deriveBits', 'deriveBits'],
+    };
+}
+const JWE = table({
+    dir: {
+        kty: ['oct'],
+        secret: true,
+        subtle: { name: 'AES-GCM' },
+        usages: none,
+        ops: ['encrypt', 'decrypt'],
+    },
+    'RSA-OAEP': rsaes(1),
+    'RSA-OAEP-256': rsaes(256),
+    'RSA-OAEP-384': rsaes(384),
+    'RSA-OAEP-512': rsaes(512),
+    'ECDH-ES': ecdh(),
+    'ECDH-ES+A128KW': ecdh(),
+    'ECDH-ES+A192KW': ecdh(),
+    'ECDH-ES+A256KW': ecdh(),
+    A128KW: aeskw(128),
+    A192KW: aeskw(192),
+    A256KW: aeskw(256),
+    A128GCMKW: aeskw(128, true),
+    A192GCMKW: aeskw(192, true),
+    A256GCMKW: aeskw(256, true),
+    'PBES2-HS256+A128KW': pbes2(),
+    'PBES2-HS384+A192KW': pbes2(),
+    'PBES2-HS512+A256KW': pbes2(),
+});
+const contentOps = ['encrypt', 'decrypt'];
+function contentEncryption(bits, cbc = false) {
+    return {
+        kty: ['oct'],
+        secret: true,
+        subtle: { name: cbc ? 'AES-CBC' : 'AES-GCM', length: bits },
+        usages: none,
+        ops: contentOps,
+        cekBits: bits,
+        ivBits: cbc ? 128 : 96,
+        cbc,
+    };
+}
+const ENC = table({
+    A128GCM: contentEncryption(128),
+    A192GCM: contentEncryption(192),
+    A256GCM: contentEncryption(256),
+    'A128CBC-HS256': contentEncryption(256, true),
+    'A192CBC-HS384': contentEncryption(384, true),
+    'A256CBC-HS512': contentEncryption(512, true),
+});
+const unsupportedAlg = 'Invalid or unsupported "alg" (JWE Algorithm) header value';
+export function jweAlgorithm(alg) {
+    const entry = JWE[alg];
+    if (!entry) {
+        throw new JOSENotSupported(unsupportedAlg);
+    }
+    return entry;
+}
+export function maybeJWEAlgorithm(alg) {
+    return JWE[alg];
+}
+export function jweEncryption(enc) {
+    const entry = ENC[enc];
+    if (!entry) {
+        throw new JOSENotSupported(`Unsupported JWE Algorithm: ${enc}`);
+    }
+    return entry;
+}

package/node_modules/jose/dist/webapi/lib/jwe_decrypt.js

@@ -0,0 +1,186 @@
+import { decrypt, generateCek } from './content_encryption.js';
+import { decodeBase64url, encodeBase64url, parseJoseHeader } from './helpers.js';
+import { JOSEAlgNotAllowed, JOSENotSupported, JWEInvalid } from '../util/errors.js';
+import { isDisjoint, isObject } from './type_checks.js';
+import { decryptKeyManagement } from './key_management.js';
+import { concat, decoder, encode } from './buffer_utils.js';
+import { validateCrit, validateAlgorithms, JWE_RECOGNIZED } from './options.js';
+import { prepareKey } from './key.js';
+import { jweAlgorithm, jweEncryption } from './jwe_algorithms.js';
+import { decompress } from './deflate.js';
+export function checkShared(jwe) {
+    const { ciphertext, protected: encodedProtected, unprotected } = jwe;
+    if (jwe.iv !== undefined && typeof jwe.iv !== 'string') {
+        throw new JWEInvalid('JWE Initialization Vector incorrect type');
+    }
+    if (typeof ciphertext !== 'string') {
+        throw new JWEInvalid('JWE Ciphertext missing or incorrect type');
+    }
+    if (jwe.tag !== undefined && typeof jwe.tag !== 'string') {
+        throw new JWEInvalid('JWE Authentication Tag incorrect type');
+    }
+    if (encodedProtected !== undefined && typeof encodedProtected !== 'string') {
+        throw new JWEInvalid('JWE Protected Header incorrect type');
+    }
+    if (jwe.aad !== undefined && typeof jwe.aad !== 'string') {
+        throw new JWEInvalid('JWE AAD incorrect type');
+    }
+    if (unprotected !== undefined && !isObject(unprotected)) {
+        throw new JWEInvalid('JWE Shared Unprotected Header incorrect type');
+    }
+}
+export function checkRecipient(jwe) {
+    const { encrypted_key: encryptedKey, header } = jwe;
+    if (encryptedKey !== undefined && typeof encryptedKey !== 'string') {
+        throw new JWEInvalid('JWE Encrypted Key incorrect type');
+    }
+    if (header !== undefined && !isObject(header)) {
+        throw new JWEInvalid('JWE Per-Recipient Unprotected Header incorrect type');
+    }
+    if (jwe.protected === undefined && header === undefined && jwe.unprotected === undefined) {
+        throw new JWEInvalid('JOSE Header missing');
+    }
+}
+export function shareJWE(jwe) {
+    const { protected: encodedProtected, ciphertext, iv, tag, aad } = jwe;
+    let parsedProt;
+    if (encodedProtected) {
+        parsedProt = parseJoseHeader(encodedProtected, JWEInvalid, 'JWE Protected Header is invalid');
+    }
+    const protectedHeader = encodedProtected !== undefined ? encode(encodedProtected) : new Uint8Array();
+    return [
+        parsedProt,
+        decodeBase64url(ciphertext, 'ciphertext', JWEInvalid),
+        iv !== undefined ? decodeBase64url(iv, 'iv', JWEInvalid) : undefined,
+        tag !== undefined ? decodeBase64url(tag, 'tag', JWEInvalid) : undefined,
+        aad !== undefined
+            ? concat(protectedHeader, encode('.'), encodeBase64url(aad, 'aad', JWEInvalid))
+            : protectedHeader,
+    ];
+}
+export function decryptResult(jwe, decrypted) {
+    const [plaintext, parsedProt, key, resolvedKey] = decrypted;
+    const { protected: encodedProtected, aad, unprotected, header } = jwe;
+    const result = { plaintext };
+    if (encodedProtected !== undefined) {
+        result.protectedHeader = parsedProt;
+    }
+    if (aad !== undefined) {
+        result.additionalAuthenticatedData = decodeBase64url(aad, 'aad', JWEInvalid);
+    }
+    if (unprotected !== undefined) {
+        result.sharedUnprotectedHeader = unprotected;
+    }
+    if (header !== undefined) {
+        result.unprotectedHeader = header;
+    }
+    if (resolvedKey) {
+        return { ...result, key };
+    }
+    return result;
+}
+export function prepareDecrypt(options) {
+    return [
+        options && validateAlgorithms('keyManagementAlgorithms', options.keyManagementAlgorithms),
+        options &&
+            validateAlgorithms('contentEncryptionAlgorithms', options.contentEncryptionAlgorithms),
+        options,
+    ];
+}
+export async function decryptRecipient(jwe, token, shared, key) {
+    const [keyManagementAlgorithms, contentEncryptionAlgorithms, options] = shared;
+    const [parsedProt, ciphertext, iv, tag, additionalData] = token;
+    const { encrypted_key: encodedKey, header, unprotected } = jwe;
+    let joseHeader;
+    if (header !== undefined || unprotected !== undefined) {
+        if (!isDisjoint(parsedProt, header, unprotected)) {
+            throw new JWEInvalid('JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint');
+        }
+        joseHeader = { ...parsedProt, ...header, ...unprotected };
+    }
+    else {
+        joseHeader = parsedProt ?? {};
+    }
+    validateCrit(JWEInvalid, JWE_RECOGNIZED, options?.crit, parsedProt, joseHeader);
+    if (joseHeader.zip !== undefined && joseHeader.zip !== 'DEF') {
+        throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');
+    }
+    if (joseHeader.zip !== undefined && !parsedProt?.zip) {
+        throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');
+    }
+    const { alg, enc } = joseHeader;
+    if (typeof alg !== 'string' || !alg) {
+        throw new JWEInvalid('missing JWE Algorithm (alg) in JWE Header');
+    }
+    if (typeof enc !== 'string' || !enc) {
+        throw new JWEInvalid('missing JWE Encryption Algorithm (enc) in JWE Header');
+    }
+    if ((keyManagementAlgorithms && !keyManagementAlgorithms.has(alg)) ||
+        (!keyManagementAlgorithms && alg.startsWith('PBES2'))) {
+        throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
+    }
+    if (contentEncryptionAlgorithms && !contentEncryptionAlgorithms.has(enc)) {
+        throw new JOSEAlgNotAllowed('"enc" (Encryption Algorithm) Header Parameter value not allowed');
+    }
+    const encEntry = jweEncryption(enc);
+    let encryptedKey;
+    if (encodedKey !== undefined) {
+        encryptedKey = decodeBase64url(encodedKey, 'encrypted_key', JWEInvalid);
+    }
+    let resolvedKey = false;
+    if (typeof key === 'function') {
+        key = await key(parsedProt, jwe);
+        resolvedKey = true;
+    }
+    const algEntry = jweAlgorithm(alg);
+    const k = await prepareKey(alg === 'dir' ? encEntry : algEntry, key, 'decrypt');
+    let cek;
+    try {
+        cek = await decryptKeyManagement(alg, encEntry, k, encryptedKey, joseHeader, options);
+    }
+    catch (err) {
+        if (err instanceof TypeError || err instanceof JWEInvalid || err instanceof JOSENotSupported) {
+            throw err;
+        }
+        cek = generateCek(encEntry);
+    }
+    let plaintext = await decrypt(encEntry, cek, ciphertext, iv, tag, additionalData);
+    if (joseHeader.zip === 'DEF') {
+        const maxDecompressedLength = options?.maxDecompressedLength ?? 250_000;
+        if (maxDecompressedLength === 0) {
+            throw new JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');
+        }
+        if (maxDecompressedLength !== Infinity &&
+            (!Number.isSafeInteger(maxDecompressedLength) || maxDecompressedLength < 1)) {
+            throw new TypeError('maxDecompressedLength must be 0, a positive safe integer, or Infinity');
+        }
+        plaintext = await decompress(plaintext, maxDecompressedLength).catch((cause) => {
+            if (cause instanceof JWEInvalid)
+                throw cause;
+            throw new JWEInvalid('Failed to decompress plaintext', { cause });
+        });
+    }
+    return [plaintext, parsedProt, k, resolvedKey];
+}
+export async function decryptJWE(jwe, shared, key) {
+    return decryptRecipient(jwe, shareJWE(jwe), shared, key);
+}
+export async function decryptCompact(jwe, shared, key) {
+    if (jwe instanceof Uint8Array) {
+        jwe = decoder.decode(jwe);
+    }
+    if (typeof jwe !== 'string') {
+        throw new JWEInvalid('Compact JWE must be a string or Uint8Array');
+    }
+    const { 0: protectedHeader, 1: encryptedKey, 2: iv, 3: ciphertext, 4: tag, length, } = jwe.split('.');
+    if (length !== 5) {
+        throw new JWEInvalid('Invalid Compact JWE');
+    }
+    return decryptJWE({
+        ciphertext,
+        iv: iv || undefined,
+        protected: protectedHeader,
+        tag: tag || undefined,
+        encrypted_key: encryptedKey || undefined,
+    }, shared, key);
+}

package/node_modules/jose/dist/webapi/lib/jwe_encrypt.js

@@ -0,0 +1,110 @@
+import { encode as b64u } from '../util/base64url.js';
+import { encrypt } from './content_encryption.js';
+import { encryptKeyManagement } from './key_management.js';
+import { JOSENotSupported, JWEInvalid } from '../util/errors.js';
+import { isDisjoint } from './type_checks.js';
+import { concat, encode } from './buffer_utils.js';
+import { validateCrit, JWE_RECOGNIZED } from './options.js';
+import { prepareKey } from './key.js';
+import { jweAlgorithm, jweEncryption } from './jwe_algorithms.js';
+import { compress } from './deflate.js';
+export function checkEncryptHeaders(input) {
+    const [, protectedHeader, unprotectedHeader, sharedUnprotectedHeader, , , , , crit] = input;
+    if (!isDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader)) {
+        throw new JWEInvalid('JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint');
+    }
+    const joseHeader = {
+        ...protectedHeader,
+        ...unprotectedHeader,
+        ...sharedUnprotectedHeader,
+    };
+    validateCrit(JWEInvalid, JWE_RECOGNIZED, crit, protectedHeader, joseHeader);
+    if (joseHeader.zip !== undefined && joseHeader.zip !== 'DEF') {
+        throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');
+    }
+    if (joseHeader.zip !== undefined && !protectedHeader?.zip) {
+        throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');
+    }
+    const { alg, enc } = joseHeader;
+    if (typeof alg !== 'string' || !alg) {
+        throw new JWEInvalid('JWE "alg" (Algorithm) Header Parameter missing or invalid');
+    }
+    if (typeof enc !== 'string' || !enc) {
+        throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');
+    }
+    return [joseHeader, alg, enc, jweEncryption(enc)];
+}
+export async function encryptJWE(input, checked, key) {
+    const [joseHeader, alg, , encEntry] = checked;
+    const [inputPlaintext, inputProtectedHeader, inputUnprotectedHeader, sharedUnprotectedHeader, aad, providedCek, inputIv, keyManagementParameters, , unprotectedParameters,] = input;
+    let protectedHeader = inputProtectedHeader;
+    let unprotectedHeader = inputUnprotectedHeader;
+    if (providedCek && (alg === 'dir' || alg === 'ECDH-ES')) {
+        throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${alg}`);
+    }
+    const algEntry = jweAlgorithm(alg);
+    const k = await prepareKey(alg === 'dir' ? encEntry : algEntry, key, 'encrypt');
+    const [cek, encryptedKey, parameters] = await encryptKeyManagement(alg, encEntry, k, providedCek, keyManagementParameters);
+    if (parameters) {
+        if (unprotectedParameters) {
+            unprotectedHeader = unprotectedHeader ? { ...unprotectedHeader, ...parameters } : parameters;
+        }
+        else {
+            protectedHeader = protectedHeader ? { ...protectedHeader, ...parameters } : parameters;
+        }
+    }
+    let protectedHeaderS;
+    let protectedHeaderB;
+    if (protectedHeader) {
+        protectedHeaderS = b64u(JSON.stringify(protectedHeader));
+        protectedHeaderB = encode(protectedHeaderS);
+    }
+    else {
+        protectedHeaderS = '';
+        protectedHeaderB = new Uint8Array();
+    }
+    let additionalData;
+    let aadMember;
+    if (aad?.byteLength) {
+        aadMember = b64u(aad);
+        additionalData = concat(protectedHeaderB, encode('.'), encode(aadMember));
+    }
+    else {
+        additionalData = protectedHeaderB;
+    }
+    let plaintext = inputPlaintext;
+    if (joseHeader.zip === 'DEF') {
+        plaintext = await compress(plaintext).catch((cause) => {
+            throw new JWEInvalid('Failed to compress plaintext', { cause });
+        });
+    }
+    const { ciphertext, tag, iv } = await encrypt(encEntry, plaintext, cek, inputIv, additionalData);
+    const jwe = {
+        ciphertext: b64u(ciphertext),
+    };
+    if (iv) {
+        jwe.iv = b64u(iv);
+    }
+    if (tag) {
+        jwe.tag = b64u(tag);
+    }
+    if (encryptedKey) {
+        jwe.encrypted_key = b64u(encryptedKey);
+    }
+    if (aadMember) {
+        jwe.aad = aadMember;
+    }
+    if (protectedHeader) {
+        jwe.protected = protectedHeaderS;
+    }
+    if (sharedUnprotectedHeader) {
+        jwe.unprotected = sharedUnprotectedHeader;
+    }
+    if (unprotectedHeader) {
+        jwe.header = unprotectedHeader;
+    }
+    return jwe;
+}
+export async function createJWE(input, key) {
+    return encryptJWE(input, checkEncryptHeaders(input), key);
+}