@zuplo/cli 6.74.2 → 6.74.6

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/asn1.js

@@ -57,13 +57,10 @@ const parseLength = (state) => {
     return first;
 };
 const skipElement = (state, count = 1) => {
-    if (count <= 0)
-        return;
-    state.pos++;
-    const length = parseLength(state);
-    state.pos += length;
-    if (count > 1) {
-        skipElement(state, count - 1);
+    while (count-- > 0) {
+        state.pos++;
+        const length = parseLength(state);
+        state.pos += length;
     }
 };
 const expectTag = (state, expectedTag, errorMessage) => {
@@ -84,24 +81,16 @@ const parseAlgorithmOID = (state) => {
     const oidLen = parseLength(state);
     return getSubarray(state, oidLen);
 };
-function parsePKCS8Header(state) {
-    expectTag(state, 0x30, 'Invalid PKCS#8 structure');
+function parseKeyHeader(state, keyFormat) {
+    expectTag(state, 0x30, `Invalid ${keyFormat === 'spki' ? 'SPKI' : 'PKCS#8'} structure`);
     parseLength(state);
-    expectTag(state, 0x02, 'Expected version field');
-    const verLen = parseLength(state);
-    state.pos += verLen;
+    if (keyFormat === 'pkcs8') {
+        expectTag(state, 0x02, 'Expected version field');
+        const length = parseLength(state);
+        state.pos += length;
+    }
     expectTag(state, 0x30, 'Expected algorithm identifier');
-    const algIdLen = parseLength(state);
-    const algIdStart = state.pos;
-    return { algIdStart, algIdLength: algIdLen };
-}
-function parseSPKIHeader(state) {
-    expectTag(state, 0x30, 'Invalid SPKI structure');
     parseLength(state);
-    expectTag(state, 0x30, 'Expected algorithm identifier');
-    const algIdLen = parseLength(state);
-    const algIdStart = state.pos;
-    return { algIdStart, algIdLength: algIdLen };
 }
 const parseECAlgorithmIdentifier = (state) => {
     const algOid = parseAlgorithmOID(state);
@@ -114,65 +103,46 @@ const parseECAlgorithmIdentifier = (state) => {
     expectTag(state, 0x06, 'Expected curve OID');
     const curveOidLen = parseLength(state);
     const curveOid = getSubarray(state, curveOidLen);
-    for (const { name, oid } of [
-        { name: 'P-256', oid: [0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07] },
-        { name: 'P-384', oid: [0x2b, 0x81, 0x04, 0x00, 0x22] },
-        { name: 'P-521', oid: [0x2b, 0x81, 0x04, 0x00, 0x23] },
-    ]) {
-        if (bytesEqual(curveOid, oid)) {
-            return name;
-        }
-    }
+    if (bytesEqual(curveOid, [0x2a, 0x86, 0x48, 0xce, 0x3d, 0x03, 0x01, 0x07]))
+        return 'P-256';
+    if (bytesEqual(curveOid, [0x2b, 0x81, 0x04, 0x00, 0x22]))
+        return 'P-384';
+    if (bytesEqual(curveOid, [0x2b, 0x81, 0x04, 0x00, 0x23]))
+        return 'P-521';
     throw new Error('Unsupported named curve');
 };
 const genericImport = async (keyFormat, keyData, alg, options) => {
     const entry = keyAlgorithm(alg);
-    if (entry.symmetric) {
+    if (entry.secret) {
         throw new JOSENotSupported('Invalid or unsupported "alg" (Algorithm) value');
     }
     const isPublic = keyFormat === 'spki';
     let algorithm;
-    if (entry.subtleFor) {
+    if (entry.resolve) {
         try {
-            algorithm = entry.subtleFor({ crv: options.getNamedCurve(keyData) });
+            const state = createASN1State(keyData);
+            parseKeyHeader(state, keyFormat);
+            algorithm = entry.resolve({ crv: parseECAlgorithmIdentifier(state) });
         }
-        catch (cause) {
+        catch {
             throw new JOSENotSupported('Invalid or unsupported key format');
         }
     }
     else {
         algorithm = entry.subtle;
     }
-    return crypto.subtle.importKey(keyFormat, keyData, algorithm, options?.extractable ?? (isPublic ? true : false), isPublic ? entry.usages.public : entry.usages.private);
+    return crypto.subtle.importKey(keyFormat, keyData, algorithm, options?.extractable ?? isPublic, entry.usages[isPublic ? 0 : 1]);
 };
 const processPEMData = (pem, pattern) => {
     return decodeBase64(pem.replace(pattern, ''));
 };
 export const fromPKCS8 = (pem, alg, options) => {
     const keyData = processPEMData(pem, /(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g);
-    let opts = options;
-    if (alg?.startsWith?.('ECDH-ES')) {
-        opts ||= {};
-        opts.getNamedCurve = (keyData) => {
-            const state = createASN1State(keyData);
-            parsePKCS8Header(state);
-            return parseECAlgorithmIdentifier(state);
-        };
-    }
-    return genericImport('pkcs8', keyData, alg, opts);
+    return genericImport('pkcs8', keyData, alg, options);
 };
 export const fromSPKI = (pem, alg, options) => {
     const keyData = processPEMData(pem, /(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g);
-    let opts = options;
-    if (alg?.startsWith?.('ECDH-ES')) {
-        opts ||= {};
-        opts.getNamedCurve = (keyData) => {
-            const state = createASN1State(keyData);
-            parseSPKIHeader(state);
-            return parseECAlgorithmIdentifier(state);
-        };
-    }
-    return genericImport('spki', keyData, alg, opts);
+    return genericImport('spki', keyData, alg, options);
 };
 function spkiFromX509(buf) {
     const state = createASN1State(buf);
@@ -191,17 +161,14 @@ function spkiFromX509(buf) {
     const spkiContentLen = parseLength(state);
     return buf.subarray(spkiStart, spkiStart + spkiContentLen + (state.pos - spkiStart));
 }
-function extractX509SPKI(x509) {
-    const derBytes = processPEMData(x509, /(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g);
-    return spkiFromX509(derBytes);
-}
 export const fromX509 = (pem, alg, options) => {
     let spki;
     try {
-        spki = extractX509SPKI(pem);
+        const certificate = processPEMData(pem, /(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g);
+        spki = spkiFromX509(certificate);
     }
     catch (cause) {
         throw new TypeError('Failed to parse the X.509 certificate', { cause });
     }
-    return fromSPKI(formatPEM(encodeBase64(spki), 'PUBLIC KEY'), alg, options);
+    return genericImport('spki', spki, alg, options);
 };

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/content_encryption.js

@@ -26,13 +26,13 @@ async function cbcKeySetup(enc, cek, usage) {
         hash: `SHA-${keySize << 1}`,
         name: 'HMAC',
     }, false, ['sign']);
-    return { encKey, macKey, keySize };
+    return [encKey, macKey, keySize];
 }
 async function cbcHmacTag(macKey, macData, keySize) {
     return new Uint8Array((await crypto.subtle.sign('HMAC', macKey, macData)).slice(0, keySize >> 3));
 }
 async function cbcEncrypt(enc, plaintext, cek, iv, aad) {
-    const { encKey, macKey, keySize } = await cbcKeySetup(enc, cek, 'encrypt');
+    const [encKey, macKey, keySize] = await cbcKeySetup(enc, cek, 'encrypt');
     const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
         iv: iv,
         name: 'AES-CBC',
@@ -42,25 +42,13 @@ async function cbcEncrypt(enc, plaintext, cek, iv, aad) {
     return { ciphertext, tag, iv };
 }
 async function timingSafeEqual(a, b) {
-    if (!(a instanceof Uint8Array)) {
-        throw new TypeError('First argument must be a buffer');
-    }
-    if (!(b instanceof Uint8Array)) {
-        throw new TypeError('Second argument must be a buffer');
-    }
     const algorithm = { name: 'HMAC', hash: 'SHA-256' };
-    const key = (await crypto.subtle.generateKey(algorithm, false, ['sign']));
-    const aHmac = new Uint8Array(await crypto.subtle.sign(algorithm, key, a));
-    const bHmac = new Uint8Array(await crypto.subtle.sign(algorithm, key, b));
-    let out = 0;
-    let i = -1;
-    while (++i < 32) {
-        out |= aHmac[i] ^ bHmac[i];
-    }
-    return out === 0;
+    const key = (await crypto.subtle.generateKey(algorithm, false, ['sign', 'verify']));
+    const aHmac = await crypto.subtle.sign(algorithm, key, a);
+    return crypto.subtle.verify(algorithm, key, aHmac, b);
 }
 async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
-    const { encKey, macKey, keySize } = await cbcKeySetup(enc, cek, 'decrypt');
+    const [encKey, macKey, keySize] = await cbcKeySetup(enc, cek, 'decrypt');
     const macData = concat(aad, iv, ciphertext, uint64be(aad.length * 8));
     const expectedTag = await cbcHmacTag(macKey, macData, keySize);
     let macCheckPassed;
@@ -84,14 +72,11 @@ async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
     return plaintext;
 }
 async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
-    let encKey;
-    if (cek instanceof Uint8Array) {
-        encKey = await crypto.subtle.importKey('raw', cek, 'AES-GCM', false, ['encrypt']);
-    }
-    else {
-        checkCryptoKey(cek, enc.subtle, 'encrypt');
-        encKey = cek;
-    }
+    const encKey = cek instanceof Uint8Array
+        ? await crypto.subtle.importKey('raw', cek, 'AES-GCM', false, [
+            'encrypt',
+        ])
+        : (checkCryptoKey(cek, enc.subtle, 'encrypt'), cek);
     const encrypted = new Uint8Array(await crypto.subtle.encrypt({
         additionalData: aad,
         iv: iv,
@@ -103,14 +88,11 @@ async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
     return { ciphertext, tag, iv };
 }
 async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
-    let encKey;
-    if (cek instanceof Uint8Array) {
-        encKey = await crypto.subtle.importKey('raw', cek, 'AES-GCM', false, ['decrypt']);
-    }
-    else {
-        checkCryptoKey(cek, enc.subtle, 'decrypt');
-        encKey = cek;
-    }
+    const encKey = cek instanceof Uint8Array
+        ? await crypto.subtle.importKey('raw', cek, 'AES-GCM', false, [
+            'decrypt',
+        ])
+        : (checkCryptoKey(cek, enc.subtle, 'decrypt'), cek);
     try {
         return new Uint8Array(await crypto.subtle.decrypt({
             additionalData: aad,

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/crypto_key.js

@@ -4,6 +4,12 @@ export function checkUsage(key, usage) {
         throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
     }
 }
+export function checkModulusLength(alg, key) {
+    const { modulusLength } = key.algorithm;
+    if (typeof modulusLength !== 'number' || modulusLength < 2048) {
+        throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
+    }
+}
 export function checkCryptoKey(key, expected, usage) {
     const algorithm = key.algorithm;
     if (algorithm.name !== expected.name) {

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/invalid_key_input.js

@@ -1,5 +1,4 @@
 function message(msg, actual, ...types) {
-    types = types.filter(Boolean);
     if (types.length > 2) {
         const last = types.pop();
         msg += `one of type ${types.join(', ')}, or ${last}.`;

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/jwe_algorithms.js

@@ -1,25 +1,24 @@
 import { JOSENotSupported } from '../util/errors.js';
 import { table } from './key_descriptor.js';
-const wrap = {
-    public: ['encrypt', 'wrapKey'],
-    private: ['decrypt', 'unwrapKey'],
-};
-const derive = { public: [], private: ['deriveBits'] };
-const none = { public: [], private: [] };
+const wrap = [
+    ['encrypt', 'wrapKey'],
+    ['decrypt', 'unwrapKey'],
+];
+const derive = [[], ['deriveBits']];
+const none = [[], []];
 function rsaes(bits) {
     return {
         kty: ['RSA'],
         subtle: { name: 'RSA-OAEP', hash: `SHA-${bits}` },
         usages: wrap,
-        minModulusLength: 2048,
-        keyOps: { encrypt: 'wrapKey', decrypt: 'unwrapKey' },
+        ops: ['wrapKey', 'unwrapKey'],
     };
 }
-function ecdh(kwBits) {
+function ecdh() {
     return {
         kty: ['EC', 'OKP'],
         subtle: { name: 'ECDH' },
-        subtleFor: ({ kty, crv, asymmetricKeyType }) => {
+        resolve: ({ kty, crv, asymmetricKeyType }) => {
             if (crv === 'X25519' || asymmetricKeyType === 'x25519') {
                 return { name: 'X25519' };
             }
@@ -29,105 +28,79 @@ function ecdh(kwBits) {
             return { name: 'ECDH', namedCurve: crv };
         },
         usages: derive,
-        kwBits,
-        keyOps: { decrypt: 'deriveBits' },
+        ops: [undefined, 'deriveBits'],
     };
 }
-function aeskw(bits) {
+function aeskw(bits, gcm = false) {
     return {
         kty: ['oct'],
-        symmetric: true,
-        subtle: { name: 'AES-KW', length: bits },
+        secret: true,
+        subtle: { name: gcm ? 'AES-GCM' : 'AES-KW', length: bits },
         usages: none,
-        keyOps: { encrypt: 'wrapKey', decrypt: 'unwrapKey' },
+        ops: gcm ? ['encrypt', 'decrypt'] : ['wrapKey', 'unwrapKey'],
     };
 }
-function aesgcmkw(bits) {
+function pbes2() {
     return {
         kty: ['oct'],
-        symmetric: true,
-        subtle: { name: 'AES-GCM', length: bits },
-        usages: none,
-        gcmkw: `A${bits}GCM`,
-        keyOps: { encrypt: 'encrypt', decrypt: 'decrypt' },
-    };
-}
-function pbes2(bits, kwBits) {
-    return {
-        kty: ['oct'],
-        symmetric: true,
+        secret: true,
         subtle: { name: 'PBKDF2' },
         usages: none,
-        pbes2Hash: `SHA-${bits}`,
-        kwBits,
-        keyOps: { encrypt: 'deriveBits', decrypt: 'deriveBits' },
+        ops: ['deriveBits', 'deriveBits'],
     };
 }
 const JWE = table({
     dir: {
         kty: ['oct'],
-        symmetric: true,
+        secret: true,
         subtle: { name: 'AES-GCM' },
         usages: none,
-        keyOps: { encrypt: 'encrypt', decrypt: 'decrypt' },
+        ops: ['encrypt', 'decrypt'],
     },
     'RSA-OAEP': rsaes(1),
     'RSA-OAEP-256': rsaes(256),
     'RSA-OAEP-384': rsaes(384),
     'RSA-OAEP-512': rsaes(512),
     'ECDH-ES': ecdh(),
-    'ECDH-ES+A128KW': ecdh(128),
-    'ECDH-ES+A192KW': ecdh(192),
-    'ECDH-ES+A256KW': ecdh(256),
+    'ECDH-ES+A128KW': ecdh(),
+    'ECDH-ES+A192KW': ecdh(),
+    'ECDH-ES+A256KW': ecdh(),
     A128KW: aeskw(128),
     A192KW: aeskw(192),
     A256KW: aeskw(256),
-    A128GCMKW: aesgcmkw(128),
-    A192GCMKW: aesgcmkw(192),
-    A256GCMKW: aesgcmkw(256),
-    'PBES2-HS256+A128KW': pbes2(256, 128),
-    'PBES2-HS384+A192KW': pbes2(384, 192),
-    'PBES2-HS512+A256KW': pbes2(512, 256),
+    A128GCMKW: aeskw(128, true),
+    A192GCMKW: aeskw(192, true),
+    A256GCMKW: aeskw(256, true),
+    'PBES2-HS256+A128KW': pbes2(),
+    'PBES2-HS384+A192KW': pbes2(),
+    'PBES2-HS512+A256KW': pbes2(),
 });
-const content = { public: [], private: [] };
-const contentOps = { encrypt: 'encrypt', decrypt: 'decrypt' };
-function gcm(bits) {
+const contentOps = ['encrypt', 'decrypt'];
+function contentEncryption(bits, cbc = false) {
     return {
         kty: ['oct'],
-        symmetric: true,
-        subtle: { name: 'AES-GCM', length: bits },
-        usages: content,
-        keyOps: contentOps,
-        cekBits: bits,
-        ivBits: 96,
-        cbc: false,
-    };
-}
-function cbc(bits) {
-    return {
-        kty: ['oct'],
-        symmetric: true,
-        subtle: { name: 'AES-CBC', length: bits },
-        usages: content,
-        keyOps: contentOps,
+        secret: true,
+        subtle: { name: cbc ? 'AES-CBC' : 'AES-GCM', length: bits },
+        usages: none,
+        ops: contentOps,
         cekBits: bits,
-        ivBits: 128,
-        cbc: true,
+        ivBits: cbc ? 128 : 96,
+        cbc,
     };
 }
 const ENC = table({
-    A128GCM: gcm(128),
-    A192GCM: gcm(192),
-    A256GCM: gcm(256),
-    'A128CBC-HS256': cbc(256),
-    'A192CBC-HS384': cbc(384),
-    'A256CBC-HS512': cbc(512),
+    A128GCM: contentEncryption(128),
+    A192GCM: contentEncryption(192),
+    A256GCM: contentEncryption(256),
+    'A128CBC-HS256': contentEncryption(256, true),
+    'A192CBC-HS384': contentEncryption(384, true),
+    'A256CBC-HS512': contentEncryption(512, true),
 });
-const unsupportedAlgHeader = 'Invalid or unsupported "alg" (JWE Algorithm) header value';
+const unsupportedAlg = 'Invalid or unsupported "alg" (JWE Algorithm) header value';
 export function jweAlgorithm(alg) {
     const entry = JWE[alg];
     if (!entry) {
-        throw new JOSENotSupported(unsupportedAlgHeader);
+        throw new JOSENotSupported(unsupportedAlg);
     }
     return entry;
 }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/lib/jwe_decrypt.js

@@ -9,88 +9,94 @@ import { prepareKey } from './key.js';
 import { jweAlgorithm, jweEncryption } from './jwe_algorithms.js';
 import { decompress } from './deflate.js';
 export function checkShared(jwe) {
+    const { ciphertext, protected: encodedProtected, unprotected } = jwe;
     if (jwe.iv !== undefined && typeof jwe.iv !== 'string') {
         throw new JWEInvalid('JWE Initialization Vector incorrect type');
     }
-    if (typeof jwe.ciphertext !== 'string') {
+    if (typeof ciphertext !== 'string') {
         throw new JWEInvalid('JWE Ciphertext missing or incorrect type');
     }
     if (jwe.tag !== undefined && typeof jwe.tag !== 'string') {
         throw new JWEInvalid('JWE Authentication Tag incorrect type');
     }
-    if (jwe.protected !== undefined && typeof jwe.protected !== 'string') {
+    if (encodedProtected !== undefined && typeof encodedProtected !== 'string') {
         throw new JWEInvalid('JWE Protected Header incorrect type');
     }
     if (jwe.aad !== undefined && typeof jwe.aad !== 'string') {
         throw new JWEInvalid('JWE AAD incorrect type');
     }
-    if (jwe.unprotected !== undefined && !isObject(jwe.unprotected)) {
+    if (unprotected !== undefined && !isObject(unprotected)) {
         throw new JWEInvalid('JWE Shared Unprotected Header incorrect type');
     }
 }
 export function checkRecipient(jwe) {
-    if (jwe.encrypted_key !== undefined && typeof jwe.encrypted_key !== 'string') {
+    const { encrypted_key: encryptedKey, header } = jwe;
+    if (encryptedKey !== undefined && typeof encryptedKey !== 'string') {
         throw new JWEInvalid('JWE Encrypted Key incorrect type');
     }
-    if (jwe.header !== undefined && !isObject(jwe.header)) {
+    if (header !== undefined && !isObject(header)) {
         throw new JWEInvalid('JWE Per-Recipient Unprotected Header incorrect type');
     }
-    if (jwe.protected === undefined && jwe.header === undefined && jwe.unprotected === undefined) {
+    if (jwe.protected === undefined && header === undefined && jwe.unprotected === undefined) {
         throw new JWEInvalid('JOSE Header missing');
     }
 }
 export function shareJWE(jwe) {
+    const { protected: encodedProtected, ciphertext, iv, tag, aad } = jwe;
     let parsedProt;
-    if (jwe.protected) {
-        parsedProt = parseJoseHeader(jwe.protected, JWEInvalid, 'JWE Protected Header is invalid');
+    if (encodedProtected) {
+        parsedProt = parseJoseHeader(encodedProtected, JWEInvalid, 'JWE Protected Header is invalid');
     }
-    const protectedHeader = jwe.protected !== undefined ? encode(jwe.protected) : new Uint8Array();
-    return {
+    const protectedHeader = encodedProtected !== undefined ? encode(encodedProtected) : new Uint8Array();
+    return [
         parsedProt,
-        ciphertext: decodeBase64url(jwe.ciphertext, 'ciphertext', JWEInvalid),
-        iv: jwe.iv !== undefined ? decodeBase64url(jwe.iv, 'iv', JWEInvalid) : undefined,
-        tag: jwe.tag !== undefined ? decodeBase64url(jwe.tag, 'tag', JWEInvalid) : undefined,
-        additionalData: jwe.aad !== undefined
-            ? concat(protectedHeader, encode('.'), encodeBase64url(jwe.aad, 'aad', JWEInvalid))
+        decodeBase64url(ciphertext, 'ciphertext', JWEInvalid),
+        iv !== undefined ? decodeBase64url(iv, 'iv', JWEInvalid) : undefined,
+        tag !== undefined ? decodeBase64url(tag, 'tag', JWEInvalid) : undefined,
+        aad !== undefined
+            ? concat(protectedHeader, encode('.'), encodeBase64url(aad, 'aad', JWEInvalid))
             : protectedHeader,
-    };
+    ];
 }
 export function decryptResult(jwe, decrypted) {
-    const result = { plaintext: decrypted.plaintext };
-    if (jwe.protected !== undefined) {
-        result.protectedHeader = decrypted.parsedProt;
+    const [plaintext, parsedProt, key, resolvedKey] = decrypted;
+    const { protected: encodedProtected, aad, unprotected, header } = jwe;
+    const result = { plaintext };
+    if (encodedProtected !== undefined) {
+        result.protectedHeader = parsedProt;
     }
-    if (jwe.aad !== undefined) {
-        result.additionalAuthenticatedData = decodeBase64url(jwe.aad, 'aad', JWEInvalid);
+    if (aad !== undefined) {
+        result.additionalAuthenticatedData = decodeBase64url(aad, 'aad', JWEInvalid);
     }
-    if (jwe.unprotected !== undefined) {
-        result.sharedUnprotectedHeader = jwe.unprotected;
+    if (unprotected !== undefined) {
+        result.sharedUnprotectedHeader = unprotected;
     }
-    if (jwe.header !== undefined) {
-        result.unprotectedHeader = jwe.header;
+    if (header !== undefined) {
+        result.unprotectedHeader = header;
     }
-    if (decrypted.resolvedKey) {
-        return { ...result, key: decrypted.key };
+    if (resolvedKey) {
+        return { ...result, key };
     }
     return result;
 }
 export function prepareDecrypt(options) {
-    return {
-        keyManagementAlgorithms: options && validateAlgorithms('keyManagementAlgorithms', options.keyManagementAlgorithms),
-        contentEncryptionAlgorithms: options &&
+    return [
+        options && validateAlgorithms('keyManagementAlgorithms', options.keyManagementAlgorithms),
+        options &&
             validateAlgorithms('contentEncryptionAlgorithms', options.contentEncryptionAlgorithms),
         options,
-    };
+    ];
 }
 export async function decryptRecipient(jwe, token, shared, key) {
-    const { options } = shared;
-    const { parsedProt } = token;
+    const [keyManagementAlgorithms, contentEncryptionAlgorithms, options] = shared;
+    const [parsedProt, ciphertext, iv, tag, additionalData] = token;
+    const { encrypted_key: encodedKey, header, unprotected } = jwe;
     let joseHeader;
-    if (jwe.header !== undefined || jwe.unprotected !== undefined) {
-        if (!isDisjoint(parsedProt, jwe.header, jwe.unprotected)) {
+    if (header !== undefined || unprotected !== undefined) {
+        if (!isDisjoint(parsedProt, header, unprotected)) {
             throw new JWEInvalid('JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint');
         }
-        joseHeader = { ...parsedProt, ...jwe.header, ...jwe.unprotected };
+        joseHeader = { ...parsedProt, ...header, ...unprotected };
     }
     else {
         joseHeader = parsedProt ?? {};
@@ -109,7 +115,6 @@ export async function decryptRecipient(jwe, token, shared, key) {
     if (typeof enc !== 'string' || !enc) {
         throw new JWEInvalid('missing JWE Encryption Algorithm (enc) in JWE Header');
     }
-    const { keyManagementAlgorithms, contentEncryptionAlgorithms } = shared;
     if ((keyManagementAlgorithms && !keyManagementAlgorithms.has(alg)) ||
         (!keyManagementAlgorithms && alg.startsWith('PBES2'))) {
         throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
@@ -119,8 +124,8 @@ export async function decryptRecipient(jwe, token, shared, key) {
     }
     const encEntry = jweEncryption(enc);
     let encryptedKey;
-    if (jwe.encrypted_key !== undefined) {
-        encryptedKey = decodeBase64url(jwe.encrypted_key, 'encrypted_key', JWEInvalid);
+    if (encodedKey !== undefined) {
+        encryptedKey = decodeBase64url(encodedKey, 'encrypted_key', JWEInvalid);
     }
     let resolvedKey = false;
     if (typeof key === 'function') {
@@ -139,7 +144,7 @@ export async function decryptRecipient(jwe, token, shared, key) {
         }
         cek = generateCek(encEntry);
     }
-    let plaintext = await decrypt(encEntry, cek, token.ciphertext, token.iv, token.tag, token.additionalData);
+    let plaintext = await decrypt(encEntry, cek, ciphertext, iv, tag, additionalData);
     if (joseHeader.zip === 'DEF') {
         const maxDecompressedLength = options?.maxDecompressedLength ?? 250_000;
         if (maxDecompressedLength === 0) {
@@ -155,7 +160,7 @@ export async function decryptRecipient(jwe, token, shared, key) {
             throw new JWEInvalid('Failed to decompress plaintext', { cause });
         });
     }
-    return { plaintext, parsedProt, key: k, resolvedKey };
+    return [plaintext, parsedProt, k, resolvedKey];
 }
 export async function decryptJWE(jwe, shared, key) {
     return decryptRecipient(jwe, shareJWE(jwe), shared, key);