agentworkshop 0.5.0 → 0.5.2

package/.output/server/node_modules/jose/dist/webapi/jwe/general/encrypt.js

@@ -0,0 +1,166 @@
+import { FlattenedEncrypt } from '../flattened/encrypt.js';
+import { assertNotSet } from '../../lib/helpers.js';
+import { JWEInvalid } from '../../util/errors.js';
+import { generateCek } from '../../lib/content_encryption.js';
+import { encryptKeyManagement } from '../../lib/key_management.js';
+import { encode as b64u } from '../../util/base64url.js';
+import { validateCritDuplicates } from '../../lib/options.js';
+import { checkEncryptHeaders, encryptJWE } from '../../lib/jwe_encrypt.js';
+import { prepareKey } from '../../lib/key.js';
+import { jweAlgorithm } from '../../lib/jwe_algorithms.js';
+class IndividualRecipient {
+    #parent;
+    state;
+    constructor(enc, key, crit) {
+        this.#parent = enc;
+        this.state = [undefined, undefined, key, crit];
+    }
+    setUnprotectedHeader(unprotectedHeader) {
+        assertNotSet(this.state[0], 'setUnprotectedHeader');
+        this.state[0] = unprotectedHeader;
+        return this;
+    }
+    setKeyManagementParameters(parameters) {
+        assertNotSet(this.state[1], 'setKeyManagementParameters');
+        this.state[1] = parameters;
+        return this;
+    }
+    addRecipient(...args) {
+        return this.#parent.addRecipient(...args);
+    }
+    encrypt(...args) {
+        return this.#parent.encrypt(...args);
+    }
+    done() {
+        return this.#parent;
+    }
+}
+function copyOptionalMembers(flattened, jwe, recipient) {
+    const { aad, protected: protectedHeader, unprotected, header } = flattened;
+    if (aad)
+        jwe.aad = aad;
+    if (protectedHeader)
+        jwe.protected = protectedHeader;
+    if (unprotected)
+        jwe.unprotected = unprotected;
+    if (header)
+        recipient.header = header;
+}
+export class GeneralEncrypt {
+    #plaintext;
+    #recipients = [];
+    #protectedHeader;
+    #unprotectedHeader;
+    #aad;
+    constructor(plaintext) {
+        this.#plaintext = plaintext;
+    }
+    addRecipient(key, options) {
+        const recipient = new IndividualRecipient(this, key, options?.crit);
+        this.#recipients.push(recipient);
+        return recipient;
+    }
+    setProtectedHeader(protectedHeader) {
+        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
+        this.#protectedHeader = protectedHeader;
+        return this;
+    }
+    setSharedUnprotectedHeader(sharedUnprotectedHeader) {
+        assertNotSet(this.#unprotectedHeader, 'setSharedUnprotectedHeader');
+        this.#unprotectedHeader = sharedUnprotectedHeader;
+        return this;
+    }
+    setAdditionalAuthenticatedData(aad) {
+        this.#aad = aad;
+        return this;
+    }
+    async encrypt() {
+        if (!this.#recipients.length) {
+            throw new JWEInvalid('at least one recipient must be added');
+        }
+        if (!(this.#plaintext instanceof Uint8Array)) {
+            throw new TypeError('plaintext must be an instance of Uint8Array');
+        }
+        if (this.#recipients.length === 1) {
+            const [recipient] = this.#recipients;
+            const [unprotectedHeader, keyManagementParameters, key, crit] = recipient.state;
+            const flattened = await new FlattenedEncrypt(this.#plaintext)
+                .setAdditionalAuthenticatedData(this.#aad)
+                .setProtectedHeader(this.#protectedHeader)
+                .setSharedUnprotectedHeader(this.#unprotectedHeader)
+                .setUnprotectedHeader(unprotectedHeader)
+                .setKeyManagementParameters(keyManagementParameters)
+                .encrypt(key, { crit });
+            const jwe = {
+                ciphertext: flattened.ciphertext,
+                iv: flattened.iv,
+                recipients: [{}],
+                tag: flattened.tag,
+            };
+            if (flattened.encrypted_key)
+                jwe.recipients[0].encrypted_key = flattened.encrypted_key;
+            copyOptionalMembers(flattened, jwe, jwe.recipients[0]);
+            return jwe;
+        }
+        validateCritDuplicates(JWEInvalid, this.#protectedHeader);
+        let enc;
+        const inputs = [];
+        const checked = [];
+        for (let i = 0; i < this.#recipients.length; i++) {
+            const recipient = this.#recipients[i];
+            const [unprotectedHeader, keyManagementParameters, , crit] = recipient.state;
+            const input = [
+                this.#plaintext,
+                this.#protectedHeader,
+                unprotectedHeader,
+                this.#unprotectedHeader,
+                this.#aad,
+                undefined,
+                undefined,
+                keyManagementParameters,
+                crit,
+                true,
+            ];
+            const headers = checkEncryptHeaders(input);
+            inputs.push(input);
+            checked.push(headers);
+            if (headers[1] === 'dir' || headers[1] === 'ECDH-ES') {
+                throw new JWEInvalid(`"${headers[1]}" alg may only have a single recipient`);
+            }
+            if (!enc) {
+                enc = headers[2];
+            }
+            else if (enc !== headers[2]) {
+                throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');
+            }
+        }
+        const cek = generateCek(checked[0][3]);
+        const jwe = {
+            ciphertext: '',
+            recipients: [],
+        };
+        for (let i = 0; i < this.#recipients.length; i++) {
+            const recipient = this.#recipients[i];
+            const [unprotectedHeader, keyManagementParameters, key] = recipient.state;
+            const target = {};
+            jwe.recipients.push(target);
+            if (i === 0) {
+                inputs[0][5] = cek;
+                const flattened = await encryptJWE(inputs[0], checked[0], key);
+                jwe.ciphertext = flattened.ciphertext;
+                jwe.iv = flattened.iv;
+                jwe.tag = flattened.tag;
+                target.encrypted_key = flattened.encrypted_key;
+                copyOptionalMembers(flattened, jwe, target);
+                continue;
+            }
+            const [, alg, , encEntry] = checked[i];
+            const k = await prepareKey(jweAlgorithm(alg), key, 'encrypt');
+            const [, encryptedKey, parameters] = await encryptKeyManagement(alg, encEntry, k, cek, keyManagementParameters);
+            target.encrypted_key = b64u(encryptedKey);
+            if (unprotectedHeader || parameters)
+                target.header = { ...unprotectedHeader, ...parameters };
+        }
+        return jwe;
+    }
+}

package/.output/server/node_modules/jose/dist/webapi/jwk/embedded.js

@@ -0,0 +1,19 @@
+import { jwkToKey } from '../lib/jwk_to_key.js';
+import { jwsAlgorithm } from '../lib/jws_algorithms.js';
+import { isObject } from '../lib/type_checks.js';
+import { JWSInvalid } from '../util/errors.js';
+export async function EmbeddedJWK(protectedHeader, token) {
+    const joseHeader = {
+        ...protectedHeader,
+        ...token?.header,
+    };
+    if (!isObject(joseHeader.jwk)) {
+        throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');
+    }
+    const entry = jwsAlgorithm(joseHeader.alg);
+    const key = await jwkToKey(entry, { ...joseHeader.jwk, ext: true });
+    if (key.type !== 'public') {
+        throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
+    }
+    return key;
+}

package/.output/server/node_modules/jose/dist/webapi/jwk/thumbprint.js

@@ -0,0 +1,68 @@
+import { digest } from '../lib/helpers.js';
+import { encode as b64u } from '../util/base64url.js';
+import { JOSENotSupported, JWKInvalid } from '../util/errors.js';
+import { encode } from '../lib/buffer_utils.js';
+import { isKeyLike } from '../lib/is_key_like.js';
+import { isJWK } from '../lib/type_checks.js';
+import { exportJWK } from '../key/export.js';
+import { invalidKeyInput } from '../lib/invalid_key_input.js';
+const check = (value, description) => {
+    if (typeof value !== 'string' || !value) {
+        throw new JWKInvalid(`${description} missing or invalid`);
+    }
+};
+export async function calculateJwkThumbprint(key, digestAlgorithm) {
+    let jwk;
+    if (isJWK(key)) {
+        jwk = key;
+    }
+    else if (isKeyLike(key)) {
+        jwk = await exportJWK(key);
+    }
+    else {
+        throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
+    }
+    digestAlgorithm ??= 'sha256';
+    if (digestAlgorithm !== 'sha256' &&
+        digestAlgorithm !== 'sha384' &&
+        digestAlgorithm !== 'sha512') {
+        throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');
+    }
+    let components;
+    switch (jwk.kty) {
+        case 'AKP':
+            check(jwk.alg, '"alg" (Algorithm) Parameter');
+            check(jwk.pub, '"pub" (Public key) Parameter');
+            components = { alg: jwk.alg, kty: jwk.kty, pub: jwk.pub };
+            break;
+        case 'EC':
+            check(jwk.crv, '"crv" (Curve) Parameter');
+            check(jwk.x, '"x" (X Coordinate) Parameter');
+            check(jwk.y, '"y" (Y Coordinate) Parameter');
+            components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y };
+            break;
+        case 'OKP':
+            check(jwk.crv, '"crv" (Subtype of Key Pair) Parameter');
+            check(jwk.x, '"x" (Public Key) Parameter');
+            components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x };
+            break;
+        case 'RSA':
+            check(jwk.e, '"e" (Exponent) Parameter');
+            check(jwk.n, '"n" (Modulus) Parameter');
+            components = { e: jwk.e, kty: jwk.kty, n: jwk.n };
+            break;
+        case 'oct':
+            check(jwk.k, '"k" (Key Value) Parameter');
+            components = { k: jwk.k, kty: jwk.kty };
+            break;
+        default:
+            throw new JOSENotSupported('"kty" (Key Type) Parameter missing or unsupported');
+    }
+    const data = encode(JSON.stringify(components));
+    return b64u(await digest(digestAlgorithm, data));
+}
+export async function calculateJwkThumbprintUri(key, digestAlgorithm) {
+    digestAlgorithm ??= 'sha256';
+    const thumbprint = await calculateJwkThumbprint(key, digestAlgorithm);
+    return `urn:ietf:params:oauth:jwk-thumbprint:sha-${digestAlgorithm.slice(-3)}:${thumbprint}`;
+}

package/.output/server/node_modules/jose/dist/webapi/jwks/local.js

@@ -0,0 +1,78 @@
+import { jwkToKey } from '../lib/jwk_to_key.js';
+import { JWS } from '../lib/jws_algorithms.js';
+import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, } from '../util/errors.js';
+import { isObject } from '../lib/type_checks.js';
+function signatureAlgorithm(alg) {
+    const entry = typeof alg === 'string' ? JWS[alg] : undefined;
+    if (!entry || entry.secret) {
+        throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
+    }
+    return entry;
+}
+function isJWKSLike(jwks) {
+    if (!jwks || typeof jwks !== 'object') {
+        return false;
+    }
+    const { keys } = jwks;
+    return Array.isArray(keys) && keys.every((isObject));
+}
+class LocalJWKSetImpl {
+    #jwks;
+    #cached = new WeakMap();
+    constructor(jwks) {
+        if (!isJWKSLike(jwks)) {
+            throw new JWKSInvalid('JSON Web Key Set malformed');
+        }
+        this.#jwks = structuredClone(jwks);
+    }
+    jwks() {
+        return this.#jwks;
+    }
+    async getKey(protectedHeader, token) {
+        const { alg, kid } = { ...protectedHeader, ...token?.header };
+        const entry = signatureAlgorithm(alg);
+        const candidates = this.#jwks.keys.filter((jwk) => entry.kty.includes(jwk.kty) &&
+            (typeof kid !== 'string' || kid === jwk.kid) &&
+            (!(typeof jwk.alg === 'string' || jwk.kty === 'AKP') || alg === jwk.alg) &&
+            (typeof jwk.use !== 'string' || jwk.use === 'sig') &&
+            (!Array.isArray(jwk.key_ops) || jwk.key_ops.includes('verify')) &&
+            (!entry.crv || jwk.crv === entry.crv));
+        const { 0: jwk, length } = candidates;
+        if (length === 0) {
+            throw new JWKSNoMatchingKey();
+        }
+        if (length !== 1) {
+            const error = new JWKSMultipleMatchingKeys();
+            const _cached = this.#cached;
+            error[Symbol.asyncIterator] = async function* () {
+                for (const jwk of candidates) {
+                    try {
+                        yield await importWithAlgCache(_cached, jwk, entry);
+                    }
+                    catch { }
+                }
+            };
+            throw error;
+        }
+        return importWithAlgCache(this.#cached, jwk, entry);
+    }
+}
+async function importWithAlgCache(cache, jwk, entry) {
+    const cached = cache.get(jwk) || cache.set(jwk, { __proto__: null }).get(jwk);
+    if (cached[entry.alg] === undefined) {
+        const key = await jwkToKey(entry, { ...jwk, alg: entry.alg, ext: true });
+        if (key.type !== 'public') {
+            throw new JWKSInvalid('JSON Web Key Set members must be public keys');
+        }
+        cached[entry.alg] = key;
+    }
+    return cached[entry.alg];
+}
+export function createLocalJWKSet(jwks) {
+    const set = new LocalJWKSetImpl(jwks);
+    const localJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
+    Object.defineProperty(localJWKSet, 'jwks', {
+        value: () => structuredClone(set.jwks()),
+    });
+    return localJWKSet;
+}

package/.output/server/node_modules/jose/dist/webapi/jwks/remote.js

@@ -0,0 +1,170 @@
+import { JOSEError, JWKSNoMatchingKey, JWKSTimeout } from '../util/errors.js';
+import { createLocalJWKSet } from './local.js';
+import { isObject } from '../lib/type_checks.js';
+function isCloudflareWorkers() {
+    return (typeof WebSocketPair !== 'undefined' ||
+        (typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers') ||
+        (typeof EdgeRuntime !== 'undefined' && EdgeRuntime === 'vercel'));
+}
+let USER_AGENT;
+if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
+    const NAME = 'jose';
+    const VERSION = 'v6.2.8';
+    USER_AGENT = `${NAME}/${VERSION}`;
+}
+export const customFetch = Symbol();
+async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
+    const response = await fetchImpl(url, {
+        method: 'GET',
+        signal,
+        redirect: 'manual',
+        headers,
+    }).catch((err) => {
+        if (err.name === 'TimeoutError') {
+            throw new JWKSTimeout();
+        }
+        throw err;
+    });
+    if (response.status !== 200) {
+        throw new JOSEError('Expected 200 OK from the JSON Web Key Set HTTP response');
+    }
+    try {
+        return await response.json();
+    }
+    catch {
+        throw new JOSEError('Failed to parse the JSON Web Key Set HTTP response as JSON');
+    }
+}
+export const jwksCache = Symbol();
+function isFreshJwksCache(input, cacheMaxAge) {
+    if (typeof input !== 'object' || input === null) {
+        return false;
+    }
+    if (!('uat' in input) || typeof input.uat !== 'number' || Date.now() - input.uat >= cacheMaxAge) {
+        return false;
+    }
+    if (!('jwks' in input) ||
+        !isObject(input.jwks) ||
+        !Array.isArray(input.jwks.keys) ||
+        !Array.prototype.every.call(input.jwks.keys, isObject)) {
+        return false;
+    }
+    return true;
+}
+class RemoteJWKSetImpl {
+    #url;
+    #timeoutDuration;
+    #cooldownDuration;
+    #cacheMaxAge;
+    #jwksTimestamp;
+    #pendingFetch;
+    #headers;
+    #customFetch;
+    #local;
+    #cache;
+    constructor(url, options) {
+        if (!(url instanceof URL)) {
+            throw new TypeError('url must be an instance of URL');
+        }
+        this.#url = new URL(url.href);
+        const opts = options ?? {};
+        this.#timeoutDuration = typeof opts.timeoutDuration === 'number' ? opts.timeoutDuration : 5000;
+        this.#cooldownDuration =
+            typeof opts.cooldownDuration === 'number' ? opts.cooldownDuration : 30000;
+        this.#cacheMaxAge = typeof opts.cacheMaxAge === 'number' ? opts.cacheMaxAge : 600000;
+        this.#headers = new Headers(opts.headers);
+        if (USER_AGENT && !this.#headers.has('User-Agent')) {
+            this.#headers.set('User-Agent', USER_AGENT);
+        }
+        if (!this.#headers.has('accept')) {
+            this.#headers.set('accept', 'application/json');
+            this.#headers.append('accept', 'application/jwk-set+json');
+        }
+        this.#customFetch = opts[customFetch];
+        const cache = opts[jwksCache];
+        if (cache !== undefined) {
+            this.#cache = cache;
+            if (isFreshJwksCache(cache, this.#cacheMaxAge)) {
+                this.#jwksTimestamp = this.#cache.uat;
+                this.#local = createLocalJWKSet(this.#cache.jwks);
+            }
+        }
+    }
+    pendingFetch() {
+        return !!this.#pendingFetch;
+    }
+    #validFor(duration) {
+        return typeof this.#jwksTimestamp === 'number' && Date.now() < this.#jwksTimestamp + duration;
+    }
+    coolingDown() {
+        return this.#validFor(this.#cooldownDuration);
+    }
+    fresh() {
+        return this.#validFor(this.#cacheMaxAge);
+    }
+    jwks() {
+        return this.#local?.jwks();
+    }
+    async getKey(protectedHeader, token) {
+        if (!this.#local || !this.fresh()) {
+            await this.reload();
+        }
+        try {
+            return await this.#local(protectedHeader, token);
+        }
+        catch (err) {
+            if (err instanceof JWKSNoMatchingKey) {
+                if (this.coolingDown() === false) {
+                    await this.reload();
+                    return this.#local(protectedHeader, token);
+                }
+            }
+            throw err;
+        }
+    }
+    async reload() {
+        if (this.#pendingFetch && isCloudflareWorkers()) {
+            this.#pendingFetch = undefined;
+        }
+        this.#pendingFetch ||= fetchJwks(this.#url.href, this.#headers, AbortSignal.timeout(this.#timeoutDuration), this.#customFetch)
+            .then((json) => {
+            this.#local = createLocalJWKSet(json);
+            if (this.#cache) {
+                this.#cache.uat = Date.now();
+                this.#cache.jwks = json;
+            }
+            this.#jwksTimestamp = Date.now();
+        })
+            .finally(() => {
+            this.#pendingFetch = undefined;
+        });
+        await this.#pendingFetch;
+    }
+}
+export function createRemoteJWKSet(url, options) {
+    const set = new RemoteJWKSetImpl(url, options);
+    const remoteJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
+    Object.defineProperties(remoteJWKSet, {
+        coolingDown: {
+            get: () => set.coolingDown(),
+            enumerable: true,
+        },
+        fresh: {
+            get: () => set.fresh(),
+            enumerable: true,
+        },
+        reload: {
+            value: () => set.reload(),
+            enumerable: true,
+        },
+        reloading: {
+            get: () => set.pendingFetch(),
+            enumerable: true,
+        },
+        jwks: {
+            value: () => set.jwks(),
+            enumerable: true,
+        },
+    });
+    return remoteJWKSet;
+}

package/.output/server/node_modules/jose/dist/webapi/jws/compact/sign.js

@@ -0,0 +1,21 @@
+import { FlattenedSign } from '../flattened/sign.js';
+import { unencodedPayload } from '../../lib/jws_sign.js';
+export class CompactSign {
+    #flattened;
+    #protectedHeader;
+    constructor(payload) {
+        this.#flattened = new FlattenedSign(payload);
+    }
+    setProtectedHeader(protectedHeader) {
+        this.#flattened.setProtectedHeader(protectedHeader);
+        this.#protectedHeader = protectedHeader;
+        return this;
+    }
+    async sign(key, options) {
+        if (unencodedPayload(this.#protectedHeader)) {
+            throw new TypeError('use the flattened module for creating JWS with b64: false');
+        }
+        const jws = await this.#flattened.sign(key, options);
+        return `${jws.protected}.${jws.payload}.${jws.signature}`;
+    }
+}

package/.output/server/node_modules/jose/dist/webapi/jws/compact/verify.js

@@ -0,0 +1,9 @@
+import { prepareVerify, verifyCompact } from '../../lib/jws_verify.js';
+export async function compactVerify(jws, key, options) {
+    const verified = await verifyCompact(jws, prepareVerify(options), key);
+    const result = { payload: verified[0], protectedHeader: verified[1] };
+    if (typeof key === 'function') {
+        return { ...result, key: verified[3] };
+    }
+    return result;
+}

package/.output/server/node_modules/jose/dist/webapi/jws/flattened/sign.js

@@ -0,0 +1,31 @@
+import { createSignature } from '../../lib/jws_sign.js';
+import { assertNotSet } from '../../lib/helpers.js';
+export class FlattenedSign {
+    #payload;
+    #protectedHeader;
+    #unprotectedHeader;
+    constructor(payload) {
+        if (!(payload instanceof Uint8Array)) {
+            throw new TypeError('payload must be an instance of Uint8Array');
+        }
+        this.#payload = payload;
+    }
+    setProtectedHeader(protectedHeader) {
+        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
+        this.#protectedHeader = protectedHeader;
+        return this;
+    }
+    setUnprotectedHeader(unprotectedHeader) {
+        assertNotSet(this.#unprotectedHeader, 'setUnprotectedHeader');
+        this.#unprotectedHeader = unprotectedHeader;
+        return this;
+    }
+    async sign(key, options) {
+        return createSignature({
+            payload: this.#payload,
+            protectedHeader: this.#protectedHeader,
+            unprotectedHeader: this.#unprotectedHeader,
+            crit: options?.crit,
+        }, key);
+    }
+}

package/.output/server/node_modules/jose/dist/webapi/jws/flattened/verify.js

@@ -0,0 +1,24 @@
+import { JWSInvalid } from '../../util/errors.js';
+import { isObject } from '../../lib/type_checks.js';
+import { prepareVerify, verifySignature, verifyResult } from '../../lib/jws_verify.js';
+export async function flattenedVerify(jws, key, options) {
+    if (!isObject(jws)) {
+        throw new JWSInvalid('Flattened JWS must be an object');
+    }
+    if (jws.protected === undefined && jws.header === undefined) {
+        throw new JWSInvalid('Flattened JWS must have either of the "protected" or "header" members');
+    }
+    if (jws.protected !== undefined && typeof jws.protected !== 'string') {
+        throw new JWSInvalid('JWS Protected Header incorrect type');
+    }
+    if (jws.payload === undefined) {
+        throw new JWSInvalid('JWS Payload missing');
+    }
+    if (typeof jws.signature !== 'string') {
+        throw new JWSInvalid('JWS Signature missing or incorrect type');
+    }
+    if (jws.header !== undefined && !isObject(jws.header)) {
+        throw new JWSInvalid('JWS Unprotected Header incorrect type');
+    }
+    return verifyResult(jws, await verifySignature(jws, prepareVerify(options), key));
+}

package/.output/server/node_modules/jose/dist/webapi/jws/general/sign.js

@@ -0,0 +1,74 @@
+import { createSignature } from '../../lib/jws_sign.js';
+import { JWSInvalid } from '../../util/errors.js';
+import { assertNotSet } from '../../lib/helpers.js';
+class IndividualSignature {
+    #parent;
+    state;
+    constructor(sig, key, options) {
+        this.#parent = sig;
+        this.state = [undefined, undefined, key, options?.crit];
+    }
+    setProtectedHeader(protectedHeader) {
+        assertNotSet(this.state[0], 'setProtectedHeader');
+        this.state[0] = protectedHeader;
+        return this;
+    }
+    setUnprotectedHeader(unprotectedHeader) {
+        assertNotSet(this.state[1], 'setUnprotectedHeader');
+        this.state[1] = unprotectedHeader;
+        return this;
+    }
+    addSignature(...args) {
+        return this.#parent.addSignature(...args);
+    }
+    sign(...args) {
+        return this.#parent.sign(...args);
+    }
+    done() {
+        return this.#parent;
+    }
+}
+export class GeneralSign {
+    #payload;
+    #signatures = [];
+    constructor(payload) {
+        this.#payload = payload;
+    }
+    addSignature(key, options) {
+        const signature = new IndividualSignature(this, key, options);
+        this.#signatures.push(signature);
+        return signature;
+    }
+    async sign() {
+        if (!this.#signatures.length) {
+            throw new JWSInvalid('at least one signature must be added');
+        }
+        if (!(this.#payload instanceof Uint8Array)) {
+            throw new TypeError('payload must be an instance of Uint8Array');
+        }
+        const jws = {
+            signatures: [],
+            payload: '',
+        };
+        const encoded = [];
+        for (let i = 0; i < this.#signatures.length; i++) {
+            const signature = this.#signatures[i];
+            const [protectedHeader, unprotectedHeader, key, crit] = signature.state;
+            const { payload, ...rest } = await createSignature({
+                payload: this.#payload,
+                protectedHeader,
+                unprotectedHeader,
+                crit,
+                encoded,
+            }, key);
+            if (i === 0) {
+                jws.payload = payload;
+            }
+            else if (jws.payload !== payload) {
+                throw new JWSInvalid('inconsistent use of JWS Unencoded Payload (RFC7797)');
+            }
+            jws.signatures.push(rest);
+        }
+        return jws;
+    }
+}