@zuplo/cli 6.73.27 → 6.73.28

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/types/util/base64url.d.ts

@@ -1,9 +1,16 @@
 /**
- * Base64URL encoding and decoding utilities
+ * Decodes a Base64URL encoded input.
  *
- * @module
+ * @param input Base64URL encoded input, as a string or its UTF-8 bytes.
+ * @returns The decoded bytes.
+ * @throws {!TypeError} When the input is not correctly Base64URL encoded. Standard Base64 input
+ *   (i.e. containing `+` or `/`) is rejected.
  */
-/** Decodes a Base64URL encoded input. */
 export declare function decode(input: Uint8Array | string): Uint8Array;
-/** Encodes an input using Base64URL with no padding. */
+/**
+ * Encodes an input using Base64URL with no padding.
+ *
+ * @param input Input to encode, as a string or as bytes. Strings are encoded as UTF-8 first.
+ * @returns The Base64URL encoded, unpadded, representation of the input.
+ */
 export declare function encode(input: Uint8Array | string): string;

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/types/util/decode_jwt.d.ts

@@ -1,8 +1,3 @@
-/**
- * JSON Web Token (JWT) Claims Set Decoding (no validation, no signature checking)
- *
- * @module
- */
 import type * as types from '../types.d.ts';
 /**
  * Decodes a signed JSON Web Token payload. This does not validate the JWT Claims Set types or
@@ -10,9 +5,6 @@ import type * as types from '../types.d.ts';
  * and JWS signature verification use `jose.jwtVerify()`. For an encrypted JWT Claims Set validation
  * and JWE decryption use `jose.jwtDecrypt()`.
  *
- * This function is exported (as a named export) from the main `'jose'` module entry point as well
- * as from its subpath export `'jose/jwt/decode'`.
- *
  * @param jwt JWT token in compact JWS serialization.
  */
-export declare function decodeJwt<PayloadType = types.JWTPayload>(jwt: string): PayloadType & types.JWTPayload;
+export declare function decodeJwt<PayloadType = types.JWTPayload>(jwt: string): PayloadType & types.JWTPayload & ([PayloadType] extends [object] ? unknown : unknown extends PayloadType ? unknown : never);

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/types/util/decode_protected_header.d.ts

@@ -1,17 +1,9 @@
-/**
- * JOSE Protected Header Decoding (JWE, JWS, all serialization syntaxes)
- *
- * @module
- */
 import type * as types from '../types.d.ts';
 /** JWE and JWS Header Parameters */
 export type ProtectedHeaderParameters = types.JWSHeaderParameters & types.JWEHeaderParameters;
 /**
  * Decodes the Protected Header of a JWE/JWS/JWT token utilizing any JOSE serialization.
  *
- * This function is exported (as a named export) from the main `'jose'` module entry point as well
- * as from its subpath export `'jose/decode/protected_header'`.
- *
  * @param token JWE/JWS/JWT token in any JOSE serialization.
  */
 export declare function decodeProtectedHeader(token: string | object): ProtectedHeaderParameters;

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/types/util/errors.d.ts

@@ -1,40 +1,50 @@
+import type * as types from '../types.d.ts';
 /**
- * JOSE module errors and error codes
- *
- * @module
+ * Every stable error code used by this module. {@link AnyJOSEError} pairs each subclass with the one
+ * it is thrown with, making that union a discriminated one.
  */
-import type * as types from '../types.d.ts';
+export type JOSEErrorCode = 'ERR_JOSE_ALG_NOT_ALLOWED' | 'ERR_JOSE_GENERIC' | 'ERR_JOSE_NOT_SUPPORTED' | 'ERR_JWE_DECRYPTION_FAILED' | 'ERR_JWE_INVALID' | 'ERR_JWK_INVALID' | 'ERR_JWKS_INVALID' | 'ERR_JWKS_MULTIPLE_MATCHING_KEYS' | 'ERR_JWKS_NO_MATCHING_KEY' | 'ERR_JWKS_TIMEOUT' | 'ERR_JWS_INVALID' | 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED' | 'ERR_JWT_CLAIM_VALIDATION_FAILED' | 'ERR_JWT_EXPIRED' | 'ERR_JWT_INVALID';
 /**
- * A generic Error that all other JOSE specific Error subclasses extend.
+ * The shape shared by the two errors thrown during JWT Claims Set validation.
  *
+ * > Note: {@link JWTExpired} does not extend {@link JWTClaimValidationFailed}, so `instanceof
+ * > JWTClaimValidationFailed` is `false` for an expired JWT. Use {@link JWTClaimValidationError} or
+ * > the {@link JOSEError.code code} discriminant to handle both.
  */
+export interface JWTClaimValidationFailure {
+    /** The Claim for which the validation failed. */
+    claim: string;
+    /** Reason code for the validation failure. */
+    reason: JWTClaimValidationReason;
+    /** The parsed JWT Claims Set (aka payload). */
+    payload: types.JWTPayload;
+}
+/** Reason codes produced by JWT Claims Set validation. */
+export type JWTClaimValidationReason = 'check_failed' | 'invalid' | 'mismatch' | 'missing' | 'unspecified' | (string & {});
+/** A generic Error that all other JOSE specific Error subclasses extend. */
 export declare class JOSEError extends Error {
+    /** A unique error code for the particular error subclass. */
+    static code: JOSEErrorCode | (string & {});
     /**
-     * A unique error code for the particular error subclass.
-     *
-     * @ignore
+     * A unique error code for {@link JOSEError}. Each subclass sets its own; see {@link AnyJOSEError}
+     * to switch over them as a discriminated union.
      */
-    static code: string;
-    /** A unique error code for {@link JOSEError}. */
-    code: string;
-    /** @ignore */
+    code: JOSEErrorCode | (string & {});
     constructor(message?: string, options?: {
         cause?: unknown;
     });
 }
-/**
- * An error subclass thrown when a JWT Claim Set member validation fails.
- *
- */
-export declare class JWTClaimValidationFailed extends JOSEError {
-    /** @ignore */
-    static code: string;
+/** An error subclass thrown when a JWT Claim Set member validation fails. */
+export declare class JWTClaimValidationFailed extends JOSEError implements JWTClaimValidationFailure {
+    static code: JOSEErrorCode | (string & {});
     /** A unique error code for {@link JWTClaimValidationFailed}. */
-    code: string;
+    code: JOSEErrorCode | (string & {});
+    /** The {@link JWTClaimValidationFailure} carried by every instance of this error. */
+    cause: JWTClaimValidationFailure;
     /** The Claim for which the validation failed. */
     claim: string;
     /** Reason code for the validation failure. */
-    reason: string;
+    reason: JWTClaimValidationReason;
     /**
      * The parsed JWT Claims Set (aka payload). Other JWT claims may or may not have been verified at
      * this point. The JSON Web Signature (JWS) or a JSON Web Encryption (JWE) structures' integrity
@@ -42,22 +52,19 @@ export declare class JWTClaimValidationFailed extends JOSEError {
      * Decryption processes.
      */
     payload: types.JWTPayload;
-    /** @ignore */
-    constructor(message: string, payload: types.JWTPayload, claim?: string, reason?: string);
+    constructor(message: string, payload: types.JWTPayload, claim?: string, reason?: JWTClaimValidationReason);
 }
-/**
- * An error subclass thrown when a JWT is expired.
- *
- */
-export declare class JWTExpired extends JOSEError implements JWTClaimValidationFailed {
-    /** @ignore */
-    static code: string;
+/** An error subclass thrown when a JWT is expired. */
+export declare class JWTExpired extends JOSEError implements JWTClaimValidationFailure {
+    static code: JOSEErrorCode | (string & {});
     /** A unique error code for {@link JWTExpired}. */
-    code: string;
+    code: JOSEErrorCode | (string & {});
+    /** The {@link JWTClaimValidationFailure} carried by every instance of this error. */
+    cause: JWTClaimValidationFailure;
     /** The Claim for which the validation failed. */
     claim: string;
     /** Reason code for the validation failure. */
-    reason: string;
+    reason: JWTClaimValidationReason;
     /**
      * The parsed JWT Claims Set (aka payload). Other JWT claims may or may not have been verified at
      * this point. The JSON Web Signature (JWS) or a JSON Web Encryption (JWE) structures' integrity
@@ -65,149 +72,149 @@ export declare class JWTExpired extends JOSEError implements JWTClaimValidationF
      * Decryption processes.
      */
     payload: types.JWTPayload;
-    /** @ignore */
-    constructor(message: string, payload: types.JWTPayload, claim?: string, reason?: string);
+    constructor(message: string, payload: types.JWTPayload, claim?: string, reason?: JWTClaimValidationReason);
 }
-/**
- * An error subclass thrown when a JOSE Algorithm is not allowed per developer preference.
- *
- */
+/** An error subclass thrown when a JOSE Algorithm is not allowed per developer preference. */
 export declare class JOSEAlgNotAllowed extends JOSEError {
-    /** @ignore */
-    static code: string;
+    static code: JOSEErrorCode | (string & {});
     /** A unique error code for {@link JOSEAlgNotAllowed}. */
-    code: string;
+    code: JOSEErrorCode | (string & {});
 }
 /**
  * An error subclass thrown when a particular feature or algorithm is not supported by this
  * implementation or JOSE in general.
- *
  */
 export declare class JOSENotSupported extends JOSEError {
-    /** @ignore */
-    static code: string;
+    static code: JOSEErrorCode | (string & {});
     /** A unique error code for {@link JOSENotSupported}. */
-    code: string;
+    code: JOSEErrorCode | (string & {});
 }
-/**
- * An error subclass thrown when a JWE ciphertext decryption fails.
- *
- */
+/** An error subclass thrown when a JWE ciphertext decryption fails. */
 export declare class JWEDecryptionFailed extends JOSEError {
-    /** @ignore */
-    static code: string;
+    static code: JOSEErrorCode | (string & {});
     /** A unique error code for {@link JWEDecryptionFailed}. */
-    code: string;
-    /** @ignore */
+    code: JOSEErrorCode | (string & {});
     constructor(message?: string, options?: {
         cause?: unknown;
     });
 }
-/**
- * An error subclass thrown when a JWE is invalid.
- *
- */
+/** An error subclass thrown when a JWE is invalid. */
 export declare class JWEInvalid extends JOSEError {
-    /** @ignore */
-    static code: string;
+    static code: JOSEErrorCode | (string & {});
     /** A unique error code for {@link JWEInvalid}. */
-    code: string;
+    code: JOSEErrorCode | (string & {});
 }
-/**
- * An error subclass thrown when a JWS is invalid.
- *
- */
+/** An error subclass thrown when a JWS is invalid. */
 export declare class JWSInvalid extends JOSEError {
-    /** @ignore */
-    static code: string;
+    static code: JOSEErrorCode | (string & {});
     /** A unique error code for {@link JWSInvalid}. */
-    code: string;
+    code: JOSEErrorCode | (string & {});
 }
-/**
- * An error subclass thrown when a JWT is invalid.
- *
- */
+/** An error subclass thrown when a JWT is invalid. */
 export declare class JWTInvalid extends JOSEError {
-    /** @ignore */
-    static code: string;
+    static code: JOSEErrorCode | (string & {});
     /** A unique error code for {@link JWTInvalid}. */
-    code: string;
+    code: JOSEErrorCode | (string & {});
 }
-/**
- * An error subclass thrown when a JWK is invalid.
- *
- */
+/** An error subclass thrown when a JWK is invalid. */
 export declare class JWKInvalid extends JOSEError {
-    /** @ignore */
-    static code: string;
+    static code: JOSEErrorCode | (string & {});
     /** A unique error code for {@link JWKInvalid}. */
-    code: string;
+    code: JOSEErrorCode | (string & {});
 }
-/**
- * An error subclass thrown when a JWKS is invalid.
- *
- */
+/** An error subclass thrown when a JWKS is invalid. */
 export declare class JWKSInvalid extends JOSEError {
-    /** @ignore */
-    static code: string;
+    static code: JOSEErrorCode | (string & {});
     /** A unique error code for {@link JWKSInvalid}. */
-    code: string;
+    code: JOSEErrorCode | (string & {});
 }
-/**
- * An error subclass thrown when no keys match from a JWKS.
- *
- */
+/** An error subclass thrown when no keys match from a JWKS. */
 export declare class JWKSNoMatchingKey extends JOSEError {
-    /** @ignore */
-    static code: string;
+    static code: JOSEErrorCode | (string & {});
     /** A unique error code for {@link JWKSNoMatchingKey}. */
-    code: string;
-    /** @ignore */
+    code: JOSEErrorCode | (string & {});
     constructor(message?: string, options?: {
         cause?: unknown;
     });
 }
-/**
- * An error subclass thrown when multiple keys match from a JWKS.
- *
- */
+/** An error subclass thrown when multiple keys match from a JWKS. */
 export declare class JWKSMultipleMatchingKeys extends JOSEError {
-    /** @ignore */
+    /**
+     * Iterates the public keys that matched the JWS JOSE Header, so that verification can be
+     * attempted with each in turn. See the {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet}
+     * and {@link jwks/local.createLocalJWKSet createLocalJWKSet} examples. Instances thrown by this
+     * module always iterate the matched keys; an instance constructed by other code iterates
+     * nothing.
+     */
     [Symbol.asyncIterator]: () => AsyncIterableIterator<types.CryptoKey>;
-    /** @ignore */
-    static code: string;
+    static code: JOSEErrorCode | (string & {});
     /** A unique error code for {@link JWKSMultipleMatchingKeys}. */
-    code: string;
-    /** @ignore */
+    code: JOSEErrorCode | (string & {});
     constructor(message?: string, options?: {
         cause?: unknown;
     });
 }
-/**
- * Timeout was reached when retrieving the JWKS response.
- *
- */
+/** Timeout was reached when retrieving the JWKS response. */
 export declare class JWKSTimeout extends JOSEError {
-    /** @ignore */
-    static code: string;
+    static code: JOSEErrorCode | (string & {});
     /** A unique error code for {@link JWKSTimeout}. */
-    code: string;
-    /** @ignore */
+    code: JOSEErrorCode | (string & {});
     constructor(message?: string, options?: {
         cause?: unknown;
     });
 }
-/**
- * An error subclass thrown when JWS signature verification fails.
- *
- */
+/** An error subclass thrown when JWS signature verification fails. */
 export declare class JWSSignatureVerificationFailed extends JOSEError {
-    /** @ignore */
-    static code: string;
+    static code: JOSEErrorCode | (string & {});
     /** A unique error code for {@link JWSSignatureVerificationFailed}. */
-    code: string;
-    /** @ignore */
+    code: JOSEErrorCode | (string & {});
     constructor(message?: string, options?: {
         cause?: unknown;
     });
 }
+/**
+ * Union of the errors thrown during JWT Claims Set validation. {@link JWTExpired} does not extend
+ * {@link JWTClaimValidationFailed}, so a single `instanceof` check cannot cover both. Use this type
+ * — together with the {@link JOSEError.code code} discriminant — when handling either.
+ */
+export type JWTClaimValidationError = JWTClaimValidationFailed | JWTExpired;
+/**
+ * Union of every {@link JOSEError} subclass this module throws, each paired with the single
+ * {@link JOSEErrorCode} it is thrown with. That pairing lives here rather than on the classes, so
+ * that `code` stays assignable, writable, and overridable on them exactly as before, while a value
+ * of this type can still be switched over as a discriminated union.
+ *
+ * > Note: The base {@link JOSEError} is deliberately not a member — its `code` spans every value, which
+ * > would defeat the discriminant. A small number of JSON Web Key Set HTTP failures are thrown as the
+ * > base class itself, so `instanceof JOSEError` remains the catch-all; this union is for handling a
+ * > value already known to be one of the specific errors.
+ */
+export type AnyJOSEError = (JOSEAlgNotAllowed & {
+    code: 'ERR_JOSE_ALG_NOT_ALLOWED';
+}) | (JOSENotSupported & {
+    code: 'ERR_JOSE_NOT_SUPPORTED';
+}) | (JWEDecryptionFailed & {
+    code: 'ERR_JWE_DECRYPTION_FAILED';
+}) | (JWEInvalid & {
+    code: 'ERR_JWE_INVALID';
+}) | (JWKInvalid & {
+    code: 'ERR_JWK_INVALID';
+}) | (JWKSInvalid & {
+    code: 'ERR_JWKS_INVALID';
+}) | (JWKSMultipleMatchingKeys & {
+    code: 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
+}) | (JWKSNoMatchingKey & {
+    code: 'ERR_JWKS_NO_MATCHING_KEY';
+}) | (JWKSTimeout & {
+    code: 'ERR_JWKS_TIMEOUT';
+}) | (JWSInvalid & {
+    code: 'ERR_JWS_INVALID';
+}) | (JWSSignatureVerificationFailed & {
+    code: 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
+}) | (JWTClaimValidationFailed & {
+    code: 'ERR_JWT_CLAIM_VALIDATION_FAILED';
+}) | (JWTExpired & {
+    code: 'ERR_JWT_EXPIRED';
+}) | (JWTInvalid & {
+    code: 'ERR_JWT_INVALID';
+});

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwe/compact/decrypt.js

@@ -1,25 +1,7 @@
-import { flattenedDecrypt } from '../flattened/decrypt.js';
-import { JWEInvalid } from '../../util/errors.js';
-import { decoder } from '../../lib/buffer_utils.js';
+import { prepareDecrypt, decryptCompact } from '../../lib/jwe_decrypt.js';
 export async function compactDecrypt(jwe, key, options) {
-    if (jwe instanceof Uint8Array) {
-        jwe = decoder.decode(jwe);
-    }
-    if (typeof jwe !== 'string') {
-        throw new JWEInvalid('Compact JWE must be a string or Uint8Array');
-    }
-    const { 0: protectedHeader, 1: encryptedKey, 2: iv, 3: ciphertext, 4: tag, length, } = jwe.split('.');
-    if (length !== 5) {
-        throw new JWEInvalid('Invalid Compact JWE');
-    }
-    const decrypted = await flattenedDecrypt({
-        ciphertext,
-        iv: iv || undefined,
-        protected: protectedHeader,
-        tag: tag || undefined,
-        encrypted_key: encryptedKey || undefined,
-    }, key, options);
-    const result = { plaintext: decrypted.plaintext, protectedHeader: decrypted.protectedHeader };
+    const decrypted = await decryptCompact(jwe, prepareDecrypt(options), key);
+    const result = { plaintext: decrypted.plaintext, protectedHeader: decrypted.parsedProt };
     if (typeof key === 'function') {
         return { ...result, key: decrypted.key };
     }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwe/flattened/decrypt.js

@@ -1,159 +1,11 @@
-import { decode as b64u } from '../../util/base64url.js';
-import { decrypt } from '../../lib/content_encryption.js';
-import { decodeBase64url } from '../../lib/helpers.js';
-import { JOSEAlgNotAllowed, JOSENotSupported, JWEInvalid } from '../../util/errors.js';
-import { isDisjoint } from '../../lib/type_checks.js';
+import { JWEInvalid } from '../../util/errors.js';
 import { isObject } from '../../lib/type_checks.js';
-import { decryptKeyManagement } from '../../lib/key_management.js';
-import { decoder, concat, encode } from '../../lib/buffer_utils.js';
-import { generateCek } from '../../lib/content_encryption.js';
-import { validateCrit } from '../../lib/validate_crit.js';
-import { validateAlgorithms } from '../../lib/validate_algorithms.js';
-import { normalizeKey } from '../../lib/normalize_key.js';
-import { checkKeyType } from '../../lib/check_key_type.js';
-import { decompress } from '../../lib/deflate.js';
+import { prepareDecrypt, decryptJWE, decryptResult, checkShared, checkRecipient, } from '../../lib/jwe_decrypt.js';
 export async function flattenedDecrypt(jwe, key, options) {
     if (!isObject(jwe)) {
         throw new JWEInvalid('Flattened JWE must be an object');
     }
-    if (jwe.protected === undefined && jwe.header === undefined && jwe.unprotected === undefined) {
-        throw new JWEInvalid('JOSE Header missing');
-    }
-    if (jwe.iv !== undefined && typeof jwe.iv !== 'string') {
-        throw new JWEInvalid('JWE Initialization Vector incorrect type');
-    }
-    if (typeof jwe.ciphertext !== 'string') {
-        throw new JWEInvalid('JWE Ciphertext missing or incorrect type');
-    }
-    if (jwe.tag !== undefined && typeof jwe.tag !== 'string') {
-        throw new JWEInvalid('JWE Authentication Tag incorrect type');
-    }
-    if (jwe.protected !== undefined && typeof jwe.protected !== 'string') {
-        throw new JWEInvalid('JWE Protected Header incorrect type');
-    }
-    if (jwe.encrypted_key !== undefined && typeof jwe.encrypted_key !== 'string') {
-        throw new JWEInvalid('JWE Encrypted Key incorrect type');
-    }
-    if (jwe.aad !== undefined && typeof jwe.aad !== 'string') {
-        throw new JWEInvalid('JWE AAD incorrect type');
-    }
-    if (jwe.header !== undefined && !isObject(jwe.header)) {
-        throw new JWEInvalid('JWE Shared Unprotected Header incorrect type');
-    }
-    if (jwe.unprotected !== undefined && !isObject(jwe.unprotected)) {
-        throw new JWEInvalid('JWE Per-Recipient Unprotected Header incorrect type');
-    }
-    let parsedProt;
-    if (jwe.protected) {
-        try {
-            const protectedHeader = b64u(jwe.protected);
-            parsedProt = JSON.parse(decoder.decode(protectedHeader));
-        }
-        catch {
-            throw new JWEInvalid('JWE Protected Header is invalid');
-        }
-    }
-    if (!isDisjoint(parsedProt, jwe.header, jwe.unprotected)) {
-        throw new JWEInvalid('JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint');
-    }
-    const joseHeader = {
-        ...parsedProt,
-        ...jwe.header,
-        ...jwe.unprotected,
-    };
-    validateCrit(JWEInvalid, new Map(), options?.crit, parsedProt, joseHeader);
-    if (joseHeader.zip !== undefined && joseHeader.zip !== 'DEF') {
-        throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');
-    }
-    if (joseHeader.zip !== undefined && !parsedProt?.zip) {
-        throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');
-    }
-    const { alg, enc } = joseHeader;
-    if (typeof alg !== 'string' || !alg) {
-        throw new JWEInvalid('missing JWE Algorithm (alg) in JWE Header');
-    }
-    if (typeof enc !== 'string' || !enc) {
-        throw new JWEInvalid('missing JWE Encryption Algorithm (enc) in JWE Header');
-    }
-    const keyManagementAlgorithms = options && validateAlgorithms('keyManagementAlgorithms', options.keyManagementAlgorithms);
-    const contentEncryptionAlgorithms = options &&
-        validateAlgorithms('contentEncryptionAlgorithms', options.contentEncryptionAlgorithms);
-    if ((keyManagementAlgorithms && !keyManagementAlgorithms.has(alg)) ||
-        (!keyManagementAlgorithms && alg.startsWith('PBES2'))) {
-        throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
-    }
-    if (contentEncryptionAlgorithms && !contentEncryptionAlgorithms.has(enc)) {
-        throw new JOSEAlgNotAllowed('"enc" (Encryption Algorithm) Header Parameter value not allowed');
-    }
-    let encryptedKey;
-    if (jwe.encrypted_key !== undefined) {
-        encryptedKey = decodeBase64url(jwe.encrypted_key, 'encrypted_key', JWEInvalid);
-    }
-    let resolvedKey = false;
-    if (typeof key === 'function') {
-        key = await key(parsedProt, jwe);
-        resolvedKey = true;
-    }
-    checkKeyType(alg === 'dir' ? enc : alg, key, 'decrypt');
-    const k = await normalizeKey(key, alg);
-    let cek;
-    try {
-        cek = await decryptKeyManagement(alg, k, encryptedKey, joseHeader, options);
-    }
-    catch (err) {
-        if (err instanceof TypeError || err instanceof JWEInvalid || err instanceof JOSENotSupported) {
-            throw err;
-        }
-        cek = generateCek(enc);
-    }
-    let iv;
-    let tag;
-    if (jwe.iv !== undefined) {
-        iv = decodeBase64url(jwe.iv, 'iv', JWEInvalid);
-    }
-    if (jwe.tag !== undefined) {
-        tag = decodeBase64url(jwe.tag, 'tag', JWEInvalid);
-    }
-    const protectedHeader = jwe.protected !== undefined ? encode(jwe.protected) : new Uint8Array();
-    let additionalData;
-    if (jwe.aad !== undefined) {
-        additionalData = concat(protectedHeader, encode('.'), encode(jwe.aad));
-    }
-    else {
-        additionalData = protectedHeader;
-    }
-    const ciphertext = decodeBase64url(jwe.ciphertext, 'ciphertext', JWEInvalid);
-    const plaintext = await decrypt(enc, cek, ciphertext, iv, tag, additionalData);
-    const result = { plaintext };
-    if (joseHeader.zip === 'DEF') {
-        const maxDecompressedLength = options?.maxDecompressedLength ?? 250_000;
-        if (maxDecompressedLength === 0) {
-            throw new JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');
-        }
-        if (maxDecompressedLength !== Infinity &&
-            (!Number.isSafeInteger(maxDecompressedLength) || maxDecompressedLength < 1)) {
-            throw new TypeError('maxDecompressedLength must be 0, a positive safe integer, or Infinity');
-        }
-        result.plaintext = await decompress(plaintext, maxDecompressedLength).catch((cause) => {
-            if (cause instanceof JWEInvalid)
-                throw cause;
-            throw new JWEInvalid('Failed to decompress plaintext', { cause });
-        });
-    }
-    if (jwe.protected !== undefined) {
-        result.protectedHeader = parsedProt;
-    }
-    if (jwe.aad !== undefined) {
-        result.additionalAuthenticatedData = decodeBase64url(jwe.aad, 'aad', JWEInvalid);
-    }
-    if (jwe.unprotected !== undefined) {
-        result.sharedUnprotectedHeader = jwe.unprotected;
-    }
-    if (jwe.header !== undefined) {
-        result.unprotectedHeader = jwe.header;
-    }
-    if (resolvedKey) {
-        return { ...result, key: k };
-    }
-    return result;
+    checkShared(jwe);
+    checkRecipient(jwe);
+    return decryptResult(jwe, await decryptJWE(jwe, prepareDecrypt(options), key));
 }