deadbyte-mcp 0.8.7

package/node_modules/jose/dist/types/util/base64url.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Decodes a Base64URL encoded input.
+ *
+ * @param input Base64URL encoded input, as a string or its UTF-8 bytes.
+ * @returns The decoded bytes.
+ * @throws {!TypeError} When the input is not correctly Base64URL encoded. Standard Base64 input
+ *   (i.e. containing `+` or `/`) is rejected.
+ */
+export declare function decode(input: Uint8Array | string): Uint8Array;
+/**
+ * Encodes an input using Base64URL with no padding.
+ *
+ * @param input Input to encode, as a string or as bytes. Strings are encoded as UTF-8 first.
+ * @returns The Base64URL encoded, unpadded, representation of the input.
+ */
+export declare function encode(input: Uint8Array | string): string;

package/node_modules/jose/dist/types/util/decode_jwt.d.ts

@@ -0,0 +1,10 @@
+import type * as types from '../types.d.ts';
+/**
+ * Decodes a signed JSON Web Token payload. This does not validate the JWT Claims Set types or
+ * values. This does not validate the JWS Signature. For a proper Signed JWT Claims Set validation
+ * and JWS signature verification use `jose.jwtVerify()`. For an encrypted JWT Claims Set validation
+ * and JWE decryption use `jose.jwtDecrypt()`.
+ *
+ * @param jwt JWT token in compact JWS serialization.
+ */
+export declare function decodeJwt<PayloadType = types.JWTPayload>(jwt: string): PayloadType & types.JWTPayload & ([PayloadType] extends [object] ? unknown : unknown extends PayloadType ? unknown : never);

package/node_modules/jose/dist/types/util/decode_protected_header.d.ts

@@ -0,0 +1,9 @@
+import type * as types from '../types.d.ts';
+/** JWE and JWS Header Parameters */
+export type ProtectedHeaderParameters = types.JWSHeaderParameters & types.JWEHeaderParameters;
+/**
+ * Decodes the Protected Header of a JWE/JWS/JWT token utilizing any JOSE serialization.
+ *
+ * @param token JWE/JWS/JWT token in any JOSE serialization.
+ */
+export declare function decodeProtectedHeader(token: string | object): ProtectedHeaderParameters;

package/node_modules/jose/dist/types/util/errors.d.ts

@@ -0,0 +1,220 @@
+import type * as types from '../types.d.ts';
+/**
+ * Every stable error code used by this module. {@link AnyJOSEError} pairs each subclass with the one
+ * it is thrown with, making that union a discriminated one.
+ */
+export type JOSEErrorCode = 'ERR_JOSE_ALG_NOT_ALLOWED' | 'ERR_JOSE_GENERIC' | 'ERR_JOSE_NOT_SUPPORTED' | 'ERR_JWE_DECRYPTION_FAILED' | 'ERR_JWE_INVALID' | 'ERR_JWK_INVALID' | 'ERR_JWKS_INVALID' | 'ERR_JWKS_MULTIPLE_MATCHING_KEYS' | 'ERR_JWKS_NO_MATCHING_KEY' | 'ERR_JWKS_TIMEOUT' | 'ERR_JWS_INVALID' | 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED' | 'ERR_JWT_CLAIM_VALIDATION_FAILED' | 'ERR_JWT_EXPIRED' | 'ERR_JWT_INVALID';
+/**
+ * The shape shared by the two errors thrown during JWT Claims Set validation.
+ *
+ * > Note: {@link JWTExpired} does not extend {@link JWTClaimValidationFailed}, so `instanceof
+ * > JWTClaimValidationFailed` is `false` for an expired JWT. Use {@link JWTClaimValidationError} or
+ * > the {@link JOSEError.code code} discriminant to handle both.
+ */
+export interface JWTClaimValidationFailure {
+    /** The Claim for which the validation failed. */
+    claim: string;
+    /** Reason code for the validation failure. */
+    reason: JWTClaimValidationReason;
+    /** The parsed JWT Claims Set (aka payload). */
+    payload: types.JWTPayload;
+}
+/** Reason codes produced by JWT Claims Set validation. */
+export type JWTClaimValidationReason = 'check_failed' | 'invalid' | 'mismatch' | 'missing' | 'unspecified' | (string & {});
+/** A generic Error that all other JOSE specific Error subclasses extend. */
+export declare class JOSEError extends Error {
+    /** A unique error code for the particular error subclass. */
+    static code: JOSEErrorCode | (string & {});
+    /**
+     * A unique error code for {@link JOSEError}. Each subclass sets its own; see {@link AnyJOSEError}
+     * to switch over them as a discriminated union.
+     */
+    code: JOSEErrorCode | (string & {});
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
+/** An error subclass thrown when a JWT Claim Set member validation fails. */
+export declare class JWTClaimValidationFailed extends JOSEError implements JWTClaimValidationFailure {
+    static code: JOSEErrorCode | (string & {});
+    /** A unique error code for {@link JWTClaimValidationFailed}. */
+    code: JOSEErrorCode | (string & {});
+    /** The {@link JWTClaimValidationFailure} carried by every instance of this error. */
+    cause: JWTClaimValidationFailure;
+    /** The Claim for which the validation failed. */
+    claim: string;
+    /** Reason code for the validation failure. */
+    reason: JWTClaimValidationReason;
+    /**
+     * The parsed JWT Claims Set (aka payload). Other JWT claims may or may not have been verified at
+     * this point. The JSON Web Signature (JWS) or a JSON Web Encryption (JWE) structures' integrity
+     * has however been verified. Claims Set verification happens after the JWS Signature or JWE
+     * Decryption processes.
+     */
+    payload: types.JWTPayload;
+    constructor(message: string, payload: types.JWTPayload, claim?: string, reason?: JWTClaimValidationReason);
+}
+/** An error subclass thrown when a JWT is expired. */
+export declare class JWTExpired extends JOSEError implements JWTClaimValidationFailure {
+    static code: JOSEErrorCode | (string & {});
+    /** A unique error code for {@link JWTExpired}. */
+    code: JOSEErrorCode | (string & {});
+    /** The {@link JWTClaimValidationFailure} carried by every instance of this error. */
+    cause: JWTClaimValidationFailure;
+    /** The Claim for which the validation failed. */
+    claim: string;
+    /** Reason code for the validation failure. */
+    reason: JWTClaimValidationReason;
+    /**
+     * The parsed JWT Claims Set (aka payload). Other JWT claims may or may not have been verified at
+     * this point. The JSON Web Signature (JWS) or a JSON Web Encryption (JWE) structures' integrity
+     * has however been verified. Claims Set verification happens after the JWS Signature or JWE
+     * Decryption processes.
+     */
+    payload: types.JWTPayload;
+    constructor(message: string, payload: types.JWTPayload, claim?: string, reason?: JWTClaimValidationReason);
+}
+/** An error subclass thrown when a JOSE Algorithm is not allowed per developer preference. */
+export declare class JOSEAlgNotAllowed extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    /** A unique error code for {@link JOSEAlgNotAllowed}. */
+    code: JOSEErrorCode | (string & {});
+}
+/**
+ * An error subclass thrown when a particular feature or algorithm is not supported by this
+ * implementation or JOSE in general.
+ */
+export declare class JOSENotSupported extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    /** A unique error code for {@link JOSENotSupported}. */
+    code: JOSEErrorCode | (string & {});
+}
+/** An error subclass thrown when a JWE ciphertext decryption fails. */
+export declare class JWEDecryptionFailed extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    /** A unique error code for {@link JWEDecryptionFailed}. */
+    code: JOSEErrorCode | (string & {});
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
+/** An error subclass thrown when a JWE is invalid. */
+export declare class JWEInvalid extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    /** A unique error code for {@link JWEInvalid}. */
+    code: JOSEErrorCode | (string & {});
+}
+/** An error subclass thrown when a JWS is invalid. */
+export declare class JWSInvalid extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    /** A unique error code for {@link JWSInvalid}. */
+    code: JOSEErrorCode | (string & {});
+}
+/** An error subclass thrown when a JWT is invalid. */
+export declare class JWTInvalid extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    /** A unique error code for {@link JWTInvalid}. */
+    code: JOSEErrorCode | (string & {});
+}
+/** An error subclass thrown when a JWK is invalid. */
+export declare class JWKInvalid extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    /** A unique error code for {@link JWKInvalid}. */
+    code: JOSEErrorCode | (string & {});
+}
+/** An error subclass thrown when a JWKS is invalid. */
+export declare class JWKSInvalid extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    /** A unique error code for {@link JWKSInvalid}. */
+    code: JOSEErrorCode | (string & {});
+}
+/** An error subclass thrown when no keys match from a JWKS. */
+export declare class JWKSNoMatchingKey extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    /** A unique error code for {@link JWKSNoMatchingKey}. */
+    code: JOSEErrorCode | (string & {});
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
+/** An error subclass thrown when multiple keys match from a JWKS. */
+export declare class JWKSMultipleMatchingKeys extends JOSEError {
+    /**
+     * Iterates the public keys that matched the JWS JOSE Header, so that verification can be
+     * attempted with each in turn. See the {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet}
+     * and {@link jwks/local.createLocalJWKSet createLocalJWKSet} examples. Instances thrown by this
+     * module always iterate the matched keys; an instance constructed by other code iterates
+     * nothing.
+     */
+    [Symbol.asyncIterator]: () => AsyncIterableIterator<types.CryptoKey>;
+    static code: JOSEErrorCode | (string & {});
+    /** A unique error code for {@link JWKSMultipleMatchingKeys}. */
+    code: JOSEErrorCode | (string & {});
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
+/** Timeout was reached when retrieving the JWKS response. */
+export declare class JWKSTimeout extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    /** A unique error code for {@link JWKSTimeout}. */
+    code: JOSEErrorCode | (string & {});
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
+/** An error subclass thrown when JWS signature verification fails. */
+export declare class JWSSignatureVerificationFailed extends JOSEError {
+    static code: JOSEErrorCode | (string & {});
+    /** A unique error code for {@link JWSSignatureVerificationFailed}. */
+    code: JOSEErrorCode | (string & {});
+    constructor(message?: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * Union of the errors thrown during JWT Claims Set validation. {@link JWTExpired} does not extend
+ * {@link JWTClaimValidationFailed}, so a single `instanceof` check cannot cover both. Use this type
+ * — together with the {@link JOSEError.code code} discriminant — when handling either.
+ */
+export type JWTClaimValidationError = JWTClaimValidationFailed | JWTExpired;
+/**
+ * Union of every {@link JOSEError} subclass this module throws, each paired with the single
+ * {@link JOSEErrorCode} it is thrown with. That pairing lives here rather than on the classes, so
+ * that `code` stays assignable, writable, and overridable on them exactly as before, while a value
+ * of this type can still be switched over as a discriminated union.
+ *
+ * > Note: The base {@link JOSEError} is deliberately not a member — its `code` spans every value, which
+ * > would defeat the discriminant. A small number of JSON Web Key Set HTTP failures are thrown as the
+ * > base class itself, so `instanceof JOSEError` remains the catch-all; this union is for handling a
+ * > value already known to be one of the specific errors.
+ */
+export type AnyJOSEError = (JOSEAlgNotAllowed & {
+    code: 'ERR_JOSE_ALG_NOT_ALLOWED';
+}) | (JOSENotSupported & {
+    code: 'ERR_JOSE_NOT_SUPPORTED';
+}) | (JWEDecryptionFailed & {
+    code: 'ERR_JWE_DECRYPTION_FAILED';
+}) | (JWEInvalid & {
+    code: 'ERR_JWE_INVALID';
+}) | (JWKInvalid & {
+    code: 'ERR_JWK_INVALID';
+}) | (JWKSInvalid & {
+    code: 'ERR_JWKS_INVALID';
+}) | (JWKSMultipleMatchingKeys & {
+    code: 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
+}) | (JWKSNoMatchingKey & {
+    code: 'ERR_JWKS_NO_MATCHING_KEY';
+}) | (JWKSTimeout & {
+    code: 'ERR_JWKS_TIMEOUT';
+}) | (JWSInvalid & {
+    code: 'ERR_JWS_INVALID';
+}) | (JWSSignatureVerificationFailed & {
+    code: 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
+}) | (JWTClaimValidationFailed & {
+    code: 'ERR_JWT_CLAIM_VALIDATION_FAILED';
+}) | (JWTExpired & {
+    code: 'ERR_JWT_EXPIRED';
+}) | (JWTInvalid & {
+    code: 'ERR_JWT_INVALID';
+});

package/node_modules/jose/dist/webapi/index.js

@@ -0,0 +1,32 @@
+export { compactDecrypt } from './jwe/compact/decrypt.js';
+export { flattenedDecrypt } from './jwe/flattened/decrypt.js';
+export { generalDecrypt } from './jwe/general/decrypt.js';
+export { GeneralEncrypt } from './jwe/general/encrypt.js';
+export { compactVerify } from './jws/compact/verify.js';
+export { flattenedVerify } from './jws/flattened/verify.js';
+export { generalVerify } from './jws/general/verify.js';
+export { jwtVerify } from './jwt/verify.js';
+export { jwtDecrypt } from './jwt/decrypt.js';
+export { CompactEncrypt } from './jwe/compact/encrypt.js';
+export { FlattenedEncrypt } from './jwe/flattened/encrypt.js';
+export { CompactSign } from './jws/compact/sign.js';
+export { FlattenedSign } from './jws/flattened/sign.js';
+export { GeneralSign } from './jws/general/sign.js';
+export { SignJWT } from './jwt/sign.js';
+export { EncryptJWT } from './jwt/encrypt.js';
+export { calculateJwkThumbprint, calculateJwkThumbprintUri } from './jwk/thumbprint.js';
+export { EmbeddedJWK } from './jwk/embedded.js';
+export { createLocalJWKSet } from './jwks/local.js';
+export { createRemoteJWKSet, jwksCache, customFetch } from './jwks/remote.js';
+export { UnsecuredJWT } from './jwt/unsecured.js';
+export { exportPKCS8, exportSPKI, exportJWK } from './key/export.js';
+export { importSPKI, importPKCS8, importX509, importJWK } from './key/import.js';
+export { decodeProtectedHeader } from './util/decode_protected_header.js';
+export { decodeJwt } from './util/decode_jwt.js';
+import * as errors from './util/errors.js';
+export { errors };
+export { generateKeyPair } from './key/generate_key_pair.js';
+export { generateSecret } from './key/generate_secret.js';
+import * as base64url from './util/base64url.js';
+export { base64url };
+export const cryptoRuntime = 'WebCryptoAPI';

package/node_modules/jose/dist/webapi/jwe/compact/decrypt.js

@@ -0,0 +1,9 @@
+import { prepareDecrypt, decryptCompact } from '../../lib/jwe_decrypt.js';
+export async function compactDecrypt(jwe, key, options) {
+    const decrypted = await decryptCompact(jwe, prepareDecrypt(options), key);
+    const result = { plaintext: decrypted[0], protectedHeader: decrypted[1] };
+    if (typeof key === 'function') {
+        return { ...result, key: decrypted[2] };
+    }
+    return result;
+}

package/node_modules/jose/dist/webapi/jwe/compact/encrypt.js

@@ -0,0 +1,49 @@
+import { assertNotSet } from '../../lib/helpers.js';
+import { assertUint8Array } from '../../lib/type_checks.js';
+import { createJWE } from '../../lib/jwe_encrypt.js';
+export class CompactEncrypt {
+    #plaintext;
+    #protectedHeader;
+    #cek;
+    #iv;
+    #keyManagementParameters;
+    constructor(plaintext) {
+        assertUint8Array(plaintext, 'plaintext');
+        this.#plaintext = plaintext;
+    }
+    setContentEncryptionKey(cek) {
+        assertNotSet(this.#cek, 'setContentEncryptionKey');
+        this.#cek = cek;
+        return this;
+    }
+    setInitializationVector(iv) {
+        assertNotSet(this.#iv, 'setInitializationVector');
+        this.#iv = iv;
+        return this;
+    }
+    setProtectedHeader(protectedHeader) {
+        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
+        this.#protectedHeader = protectedHeader;
+        return this;
+    }
+    setKeyManagementParameters(parameters) {
+        assertNotSet(this.#keyManagementParameters, 'setKeyManagementParameters');
+        this.#keyManagementParameters = parameters;
+        return this;
+    }
+    async encrypt(key, options) {
+        const jwe = await createJWE([
+            this.#plaintext,
+            this.#protectedHeader,
+            undefined,
+            undefined,
+            undefined,
+            this.#cek,
+            this.#iv,
+            this.#keyManagementParameters,
+            undefined,
+            false,
+        ], key, options);
+        return [jwe.protected, jwe.encrypted_key, jwe.iv, jwe.ciphertext, jwe.tag].join('.');
+    }
+}

package/node_modules/jose/dist/webapi/jwe/flattened/decrypt.js

@@ -0,0 +1,15 @@
+import { JWEInvalid } from '../../util/errors.js';
+import { isObject } from '../../lib/type_checks.js';
+import { prepareDecrypt, decryptJWE, decryptResult, checkRecipient, snapshotSharedJWE, snapshotRecipientJWE, } from '../../lib/jwe_decrypt.js';
+export async function flattenedDecrypt(jwe, key, options) {
+    if (!isObject(jwe)) {
+        throw new JWEInvalid('Flattened JWE must be an object');
+    }
+    const shared = snapshotSharedJWE(jwe);
+    const [recipient, , error] = snapshotRecipientJWE(jwe);
+    if (!recipient)
+        throw error;
+    const snapshot = { ...shared, ...recipient };
+    checkRecipient(snapshot);
+    return decryptResult(snapshot, await decryptJWE(snapshot, prepareDecrypt(options), key));
+}

package/node_modules/jose/dist/webapi/jwe/flattened/encrypt.js

@@ -0,0 +1,65 @@
+import { assertNotSet } from '../../lib/helpers.js';
+import { createJWE } from '../../lib/jwe_encrypt.js';
+import { assertUint8Array } from '../../lib/type_checks.js';
+export class FlattenedEncrypt {
+    #plaintext;
+    #protectedHeader;
+    #sharedUnprotectedHeader;
+    #unprotectedHeader;
+    #aad;
+    #cek;
+    #iv;
+    #keyManagementParameters;
+    constructor(plaintext) {
+        assertUint8Array(plaintext, 'plaintext');
+        this.#plaintext = plaintext;
+    }
+    setKeyManagementParameters(parameters) {
+        assertNotSet(this.#keyManagementParameters, 'setKeyManagementParameters');
+        this.#keyManagementParameters = parameters;
+        return this;
+    }
+    setProtectedHeader(protectedHeader) {
+        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
+        this.#protectedHeader = protectedHeader;
+        return this;
+    }
+    setSharedUnprotectedHeader(sharedUnprotectedHeader) {
+        assertNotSet(this.#sharedUnprotectedHeader, 'setSharedUnprotectedHeader');
+        this.#sharedUnprotectedHeader = sharedUnprotectedHeader;
+        return this;
+    }
+    setUnprotectedHeader(unprotectedHeader) {
+        assertNotSet(this.#unprotectedHeader, 'setUnprotectedHeader');
+        this.#unprotectedHeader = unprotectedHeader;
+        return this;
+    }
+    setAdditionalAuthenticatedData(aad) {
+        this.#aad = aad;
+        return this;
+    }
+    setContentEncryptionKey(cek) {
+        assertNotSet(this.#cek, 'setContentEncryptionKey');
+        this.#cek = cek;
+        return this;
+    }
+    setInitializationVector(iv) {
+        assertNotSet(this.#iv, 'setInitializationVector');
+        this.#iv = iv;
+        return this;
+    }
+    async encrypt(key, options) {
+        return createJWE([
+            this.#plaintext,
+            this.#protectedHeader,
+            this.#unprotectedHeader,
+            this.#sharedUnprotectedHeader,
+            this.#aad,
+            this.#cek,
+            this.#iv,
+            this.#keyManagementParameters,
+            undefined,
+            false,
+        ], key, options);
+    }
+}

package/node_modules/jose/dist/webapi/jwe/general/decrypt.js

@@ -0,0 +1,51 @@
+import { prepareDecrypt, shareJWE, decryptRecipient, decryptResult, checkRecipient, snapshotSharedJWE, snapshotRecipientJWE, } from '../../lib/jwe_decrypt.js';
+import { JWEDecryptionFailed, JWEInvalid } from '../../util/errors.js';
+import { isObject } from '../../lib/type_checks.js';
+export async function generalDecrypt(jwe, key, options) {
+    if (!isObject(jwe)) {
+        throw new JWEInvalid('General JWE must be an object');
+    }
+    const inputRecipients = jwe.recipients;
+    if (!Array.isArray(inputRecipients)) {
+        throw new JWEInvalid('JWE Recipients missing or incorrect type');
+    }
+    const recipients = Array.from(inputRecipients);
+    if (!recipients.every(isObject)) {
+        throw new JWEInvalid('JWE Recipients missing or incorrect type');
+    }
+    if (!recipients.length) {
+        throw new JWEInvalid('JWE Recipients has no members');
+    }
+    let shared;
+    let sharedJwe;
+    let token;
+    try {
+        shared = prepareDecrypt(options);
+        sharedJwe = snapshotSharedJWE(jwe);
+        token = shareJWE(sharedJwe);
+    }
+    catch {
+        throw new JWEDecryptionFailed();
+    }
+    const recipientSnapshots = recipients.map((recipient) => snapshotRecipientJWE(recipient));
+    if (recipients.length > 1) {
+        for (const [, headerAlg] of recipientSnapshots) {
+            const alg = token[0]?.alg ?? headerAlg ?? sharedJwe.unprotected?.alg;
+            if (alg === 'dir' || alg === 'ECDH-ES') {
+                throw new JWEInvalid(`"${alg}" alg may only have a single recipient`);
+            }
+        }
+    }
+    for (const [recipient] of recipientSnapshots) {
+        if (!recipient)
+            continue;
+        try {
+            const flattened = { ...sharedJwe, ...recipient };
+            checkRecipient(flattened);
+            return decryptResult(flattened, await decryptRecipient(flattened, token, shared, key));
+        }
+        catch {
+        }
+    }
+    throw new JWEDecryptionFailed();
+}

package/node_modules/jose/dist/webapi/jwe/general/encrypt.js

@@ -0,0 +1,177 @@
+import { assertNotSet } from '../../lib/helpers.js';
+import { JWEInvalid } from '../../util/errors.js';
+import { generateCek } from '../../lib/content_encryption.js';
+import { encryptKeyManagement } from '../../lib/key_management.js';
+import { encode as b64u } from '../../util/base64url.js';
+import { checkDisjoint, checkEncryptHeaders, createJWE, encryptJWE } from '../../lib/jwe_encrypt.js';
+import { prepareKey } from '../../lib/key.js';
+import { jweAlgorithm } from '../../lib/jwe_algorithms.js';
+import { assertUint8Array } from '../../lib/type_checks.js';
+class IndividualRecipient {
+    #parent;
+    state;
+    constructor(enc, key, crit) {
+        this.#parent = enc;
+        this.state = [undefined, undefined, key, crit];
+    }
+    setUnprotectedHeader(unprotectedHeader) {
+        assertNotSet(this.state[0], 'setUnprotectedHeader');
+        this.state[0] = unprotectedHeader;
+        return this;
+    }
+    setKeyManagementParameters(parameters) {
+        assertNotSet(this.state[1], 'setKeyManagementParameters');
+        this.state[1] = parameters;
+        return this;
+    }
+    addRecipient(...args) {
+        return this.#parent.addRecipient(...args);
+    }
+    encrypt(...args) {
+        return this.#parent.encrypt(...args);
+    }
+    done() {
+        return this.#parent;
+    }
+}
+function copyOptionalMembers(flattened, jwe, recipient) {
+    const { aad, protected: protectedHeader, unprotected, header } = flattened;
+    if (aad)
+        jwe.aad = aad;
+    if (protectedHeader)
+        jwe.protected = protectedHeader;
+    if (unprotected)
+        jwe.unprotected = unprotected;
+    if (header)
+        recipient.header = header;
+}
+export class GeneralEncrypt {
+    #plaintext;
+    #recipients = [];
+    #protectedHeader;
+    #unprotectedHeader;
+    #aad;
+    constructor(plaintext) {
+        this.#plaintext = plaintext;
+    }
+    addRecipient(key, options) {
+        const recipient = new IndividualRecipient(this, key, options?.crit);
+        this.#recipients.push(recipient);
+        return recipient;
+    }
+    setProtectedHeader(protectedHeader) {
+        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
+        this.#protectedHeader = protectedHeader;
+        return this;
+    }
+    setSharedUnprotectedHeader(sharedUnprotectedHeader) {
+        assertNotSet(this.#unprotectedHeader, 'setSharedUnprotectedHeader');
+        this.#unprotectedHeader = sharedUnprotectedHeader;
+        return this;
+    }
+    setAdditionalAuthenticatedData(aad) {
+        this.#aad = aad;
+        return this;
+    }
+    async encrypt() {
+        if (!this.#recipients.length) {
+            throw new JWEInvalid('at least one recipient must be added');
+        }
+        assertUint8Array(this.#plaintext, 'plaintext');
+        if (this.#recipients.length === 1) {
+            const [unprotectedHeader, keyManagementParameters, key, crit] = this.#recipients[0].state;
+            const flattened = await createJWE([
+                this.#plaintext,
+                this.#protectedHeader,
+                unprotectedHeader,
+                this.#unprotectedHeader,
+                this.#aad,
+                undefined,
+                undefined,
+                keyManagementParameters,
+                crit,
+                false,
+            ], key);
+            const jwe = {
+                ciphertext: flattened.ciphertext,
+                iv: flattened.iv,
+                recipients: [{}],
+                tag: flattened.tag,
+            };
+            if (flattened.encrypted_key)
+                jwe.recipients[0].encrypted_key = flattened.encrypted_key;
+            copyOptionalMembers(flattened, jwe, jwe.recipients[0]);
+            return jwe;
+        }
+        let enc;
+        let protectedHeader = this.#protectedHeader;
+        let sharedUnprotectedHeader = this.#unprotectedHeader;
+        const inputs = [];
+        const checked = [];
+        for (let i = 0; i < this.#recipients.length; i++) {
+            const recipient = this.#recipients[i];
+            const [unprotectedHeader, keyManagementParameters, , crit] = recipient.state;
+            const input = [
+                this.#plaintext,
+                protectedHeader,
+                unprotectedHeader,
+                sharedUnprotectedHeader,
+                this.#aad,
+                undefined,
+                undefined,
+                keyManagementParameters,
+                crit,
+                true,
+            ];
+            const headers = checkEncryptHeaders(input);
+            inputs.push(input);
+            checked.push(headers);
+            if (i === 0) {
+                protectedHeader = input[1];
+                sharedUnprotectedHeader = input[3];
+            }
+            if (headers[1] === 'dir' || headers[1] === 'ECDH-ES') {
+                throw new JWEInvalid(`"${headers[1]}" alg may only have a single recipient`);
+            }
+            if (!enc) {
+                enc = headers[2];
+            }
+            else if (enc !== headers[2]) {
+                throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');
+            }
+        }
+        const cek = generateCek(checked[0][3]);
+        const jwe = {
+            ciphertext: '',
+            recipients: [],
+        };
+        for (let i = 0; i < this.#recipients.length; i++) {
+            const recipient = this.#recipients[i];
+            const [, keyManagementParameters, key] = recipient.state;
+            const target = {};
+            jwe.recipients.push(target);
+            if (i === 0) {
+                inputs[0][5] = cek;
+                const flattened = await encryptJWE(inputs[0], checked[0], key);
+                jwe.ciphertext = flattened.ciphertext;
+                jwe.iv = flattened.iv;
+                jwe.tag = flattened.tag;
+                target.encrypted_key = flattened.encrypted_key;
+                copyOptionalMembers(flattened, jwe, target);
+                continue;
+            }
+            const [, alg, , encEntry] = checked[i];
+            const unprotectedHeader = inputs[i][2];
+            const k = await prepareKey(jweAlgorithm(alg), key, 'encrypt');
+            const [, encryptedKey, parameters] = await encryptKeyManagement(alg, encEntry, k, cek, keyManagementParameters);
+            target.encrypted_key = b64u(encryptedKey);
+            if (unprotectedHeader || parameters) {
+                const header = { ...unprotectedHeader, ...parameters };
+                if (parameters)
+                    checkDisjoint(inputs[i][1], header, inputs[i][3]);
+                target.header = header;
+            }
+        }
+        return jwe;
+    }
+}