jose 6.0.8 → 6.0.10

package/README.md

@@ -22,7 +22,7 @@ Support from the community to continue maintaining and improving this module is
 
 ## Documentation
 
-`jose` is distributed via [npmjs.com](https://www.npmjs.com/package/jose), [jsr.io](https://jsr.io/@panva/jose), [deno.land/x](https://deno.land/x/jose), [cdnjs.com](https://cdnjs.com/libraries/jose), [jsdelivr.com](https://www.jsdelivr.com/package/npm/jose), and [github.com](https://github.com/panva/jose).
+`jose` is distributed via [npmjs.com](https://www.npmjs.com/package/jose), [jsr.io](https://jsr.io/@panva/jose), [jsdelivr.com](https://www.jsdelivr.com/package/npm/jose), and [github.com](https://github.com/panva/jose).
 
 **`example`** ESM import[^cjs]
 

package/dist/types/index.d.ts

@@ -16,7 +16,6 @@ export { jwtVerify } from './jwt/verify.js';
 export type { JWTVerifyOptions, JWTVerifyGetKey } from './jwt/verify.js';
 export { jwtDecrypt } from './jwt/decrypt.js';
 export type { JWTDecryptOptions, JWTDecryptGetKey } from './jwt/decrypt.js';
-export type { ProduceJWT } from './jwt/produce.js';
 export { CompactEncrypt } from './jwe/compact/encrypt.js';
 export { FlattenedEncrypt } from './jwe/flattened/encrypt.js';
 export { CompactSign } from './jws/compact/sign.js';
@@ -44,7 +43,7 @@ export type { GenerateKeyPairResult, GenerateKeyPairOptions } from './key/genera
 export { generateSecret } from './key/generate_secret.js';
 export type { GenerateSecretOptions } from './key/generate_secret.js';
 export * as base64url from './util/base64url.js';
-export type { CompactDecryptResult, CompactJWEHeaderParameters, CompactJWSHeaderParameters, CompactVerifyResult, CritOption, CryptoKey, DecryptOptions, EncryptOptions, FlattenedDecryptResult, FlattenedJWE, FlattenedJWS, FlattenedJWSInput, FlattenedVerifyResult, GeneralDecryptResult, GeneralJWE, GeneralJWS, GeneralJWSInput, GeneralVerifyResult, GetKeyFunction, JoseHeaderParameters, JSONWebKeySet, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWK_EC_Private, JWK_EC_Public, JWK_oct, JWK_OKP_Private, JWK_OKP_Public, JWK_RSA_Private, JWK_RSA_Public, JWK, JWKParameters, JWSHeaderParameters, JWTClaimVerificationOptions, JWTDecryptResult, JWTHeaderParameters, JWTPayload, JWTVerifyResult, KeyObject, ResolvedKey, SignOptions, VerifyOptions, } from './types.d.ts';
+export type { CompactDecryptResult, CompactJWEHeaderParameters, CompactJWSHeaderParameters, CompactVerifyResult, CritOption, CryptoKey, DecryptOptions, EncryptOptions, FlattenedDecryptResult, FlattenedJWE, FlattenedJWS, FlattenedJWSInput, FlattenedVerifyResult, GeneralDecryptResult, GeneralJWE, GeneralJWS, GeneralJWSInput, GeneralVerifyResult, GetKeyFunction, JoseHeaderParameters, JSONWebKeySet, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWK_EC_Private, JWK_EC_Public, JWK_oct, JWK_OKP_Private, JWK_OKP_Public, JWK_RSA_Private, JWK_RSA_Public, JWK, JWKParameters, JWSHeaderParameters, JWTClaimVerificationOptions, JWTDecryptResult, JWTHeaderParameters, JWTPayload, JWTVerifyResult, KeyObject, ProduceJWT, ResolvedKey, SignOptions, VerifyOptions, } from './types.d.ts';
 /**
  * In prior releases this indicated whether a Node.js-specific build was loaded, this is now fixed
  * to `"WebCryptoAPI"`

package/dist/types/jwe/compact/encrypt.d.ts

@@ -12,8 +12,12 @@ import type * as types from '../../types.d.ts';
  *
  */
 export declare class CompactEncrypt {
-    private _flattened;
-    /** @param plaintext Binary representation of the plaintext to encrypt. */
+    #private;
+    /**
+     * {@link CompactEncrypt} constructor
+     *
+     * @param plaintext Binary representation of the plaintext to encrypt.
+     */
     constructor(plaintext: Uint8Array);
     /**
      * Sets a content encryption key to use, by default a random suitable one is generated for the JWE

package/dist/types/jwe/flattened/encrypt.d.ts

@@ -12,15 +12,12 @@ import type * as types from '../../types.d.ts';
  *
  */
 export declare class FlattenedEncrypt {
-    private _plaintext;
-    private _protectedHeader;
-    private _sharedUnprotectedHeader;
-    private _unprotectedHeader;
-    private _aad;
-    private _cek;
-    private _iv;
-    private _keyManagementParameters;
-    /** @param plaintext Binary representation of the plaintext to encrypt. */
+    #private;
+    /**
+     * {@link FlattenedEncrypt} constructor
+     *
+     * @param plaintext Binary representation of the plaintext to encrypt.
+     */
     constructor(plaintext: Uint8Array);
     /**
      * Sets the JWE Key Management parameters to be used when encrypting. Use of this is method is

package/dist/types/jwe/general/encrypt.d.ts

@@ -12,11 +12,11 @@ export interface Recipient {
      * @param unprotectedHeader JWE Per-Recipient Unprotected Header.
      */
     setUnprotectedHeader(unprotectedHeader: types.JWEHeaderParameters): Recipient;
-    /** A shorthand for calling addRecipient() on the enclosing GeneralEncrypt instance */
+    /** A shorthand for calling addRecipient() on the enclosing {@link GeneralEncrypt} instance */
     addRecipient(...args: Parameters<GeneralEncrypt['addRecipient']>): Recipient;
-    /** A shorthand for calling encrypt() on the enclosing GeneralEncrypt instance */
+    /** A shorthand for calling encrypt() on the enclosing {@link GeneralEncrypt} instance */
     encrypt(...args: Parameters<GeneralEncrypt['encrypt']>): Promise<types.GeneralJWE>;
-    /** Returns the enclosing GeneralEncrypt */
+    /** Returns the enclosing {@link GeneralEncrypt} instance */
     done(): GeneralEncrypt;
 }
 /**
@@ -27,12 +27,12 @@ export interface Recipient {
  *
  */
 export declare class GeneralEncrypt {
-    private _plaintext;
-    private _recipients;
-    private _protectedHeader;
-    private _unprotectedHeader;
-    private _aad;
-    /** @param plaintext Binary representation of the plaintext to encrypt. */
+    #private;
+    /**
+     * {@link GeneralEncrypt} constructor
+     *
+     * @param plaintext Binary representation of the plaintext to encrypt.
+     */
     constructor(plaintext: Uint8Array);
     /**
      * Adds an additional recipient for the General JWE object.

package/dist/types/jwks/remote.d.ts

@@ -95,9 +95,16 @@ import type * as types from '../types.d.ts';
  */
 export declare const customFetch: unique symbol;
 /** See {@link customFetch}. */
-export type FetchImplementation = (url: string, options: {
+export type FetchImplementation = (
+/** URL the request is being made sent to {@link !fetch} as the `resource` argument */
+url: string, 
+/** Options otherwise sent to {@link !fetch} as the `options` argument */
+options: {
+    /** HTTP Headers */
     headers: Headers;
+    /** The {@link https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods request method} */
     method: 'GET';
+    /** See {@link !Request.redirect} */
     redirect: 'manual';
     signal: AbortSignal;
 }) => Promise<Response>;
@@ -178,7 +185,9 @@ export interface RemoteJWKSetOptions {
 }
 /** See {@link jwksCache}. */
 export interface ExportedJWKSCache {
+    /** Current cached JSON Web Key Set */
     jwks: types.JSONWebKeySet;
+    /** Last updated at timestamp (seconds since epoch) */
     uat: number;
 }
 /** See {@link jwksCache}. */

package/dist/types/jws/compact/sign.d.ts

@@ -12,8 +12,12 @@ import type * as types from '../../types.d.ts';
  *
  */
 export declare class CompactSign {
-    private _flattened;
-    /** @param payload Binary representation of the payload to sign. */
+    #private;
+    /**
+     * {@link CompactSign} constructor
+     *
+     * @param payload Binary representation of the payload to sign.
+     */
     constructor(payload: Uint8Array);
     /**
      * Sets the JWS Protected Header on the CompactSign object.

package/dist/types/jws/flattened/sign.d.ts

@@ -12,10 +12,12 @@ import type * as types from '../../types.d.ts';
  *
  */
 export declare class FlattenedSign {
-    private _payload;
-    private _protectedHeader;
-    private _unprotectedHeader;
-    /** @param payload Binary representation of the payload to sign. */
+    #private;
+    /**
+     * {@link FlattenedSign} constructor
+     *
+     * @param payload Binary representation of the payload to sign.
+     */
     constructor(payload: Uint8Array);
     /**
      * Sets the JWS Protected Header on the FlattenedSign object.

package/dist/types/jws/general/sign.d.ts

@@ -18,11 +18,11 @@ export interface Signature {
      * @param unprotectedHeader JWS Unprotected Header.
      */
     setUnprotectedHeader(unprotectedHeader: types.JWSHeaderParameters): Signature;
-    /** A shorthand for calling addSignature() on the enclosing GeneralSign instance */
+    /** A shorthand for calling addSignature() on the enclosing {@link GeneralSign} instance */
     addSignature(...args: Parameters<GeneralSign['addSignature']>): Signature;
-    /** A shorthand for calling encrypt() on the enclosing GeneralSign instance */
+    /** A shorthand for calling encrypt() on the enclosing {@link GeneralSign} instance */
     sign(...args: Parameters<GeneralSign['sign']>): Promise<types.GeneralJWS>;
-    /** Returns the enclosing GeneralSign */
+    /** Returns the enclosing {@link GeneralSign} instance */
     done(): GeneralSign;
 }
 /**
@@ -33,9 +33,12 @@ export interface Signature {
  *
  */
 export declare class GeneralSign {
-    private _payload;
-    private _signatures;
-    /** @param payload Binary representation of the payload to sign. */
+    #private;
+    /**
+     * {@link GeneralSign} constructor
+     *
+     * @param payload Binary representation of the payload to sign.
+     */
     constructor(payload: Uint8Array);
     /**
      * Adds an additional signature for the General JWS object.

package/dist/types/jwt/encrypt.d.ts

@@ -4,7 +4,6 @@
  * @module
  */
 import type * as types from '../types.d.ts';
-import { ProduceJWT } from './produce.js';
 /**
  * The EncryptJWT class is used to build and encrypt Compact JWE formatted JSON Web Tokens.
  *
@@ -12,14 +11,21 @@ import { ProduceJWT } from './produce.js';
  * from its subpath export `'jose/jwt/encrypt'`.
  *
  */
-export declare class EncryptJWT extends ProduceJWT {
-    private _cek;
-    private _iv;
-    private _keyManagementParameters;
-    private _protectedHeader;
-    private _replicateIssuerAsHeader;
-    private _replicateSubjectAsHeader;
-    private _replicateAudienceAsHeader;
+export declare class EncryptJWT implements types.ProduceJWT {
+    #private;
+    /**
+     * {@link EncryptJWT} constructor
+     *
+     * @param payload The JWT Claims Set object. Defaults to an empty object.
+     */
+    constructor(payload?: types.JWTPayload);
+    setIssuer(issuer: string): this;
+    setSubject(subject: string): this;
+    setAudience(audience: string | string[]): this;
+    setJti(jwtId: string): this;
+    setNotBefore(input: number | string | Date): this;
+    setExpirationTime(input: number | string | Date): this;
+    setIssuedAt(input?: number | string | Date): this;
     /**
      * Sets the JWE Protected Header on the EncryptJWT object.
      *

package/dist/types/jwt/sign.d.ts

@@ -4,7 +4,6 @@
  * @module
  */
 import type * as types from '../types.d.ts';
-import { ProduceJWT } from './produce.js';
 /**
  * The SignJWT class is used to build and sign Compact JWS formatted JSON Web Tokens.
  *
@@ -12,8 +11,21 @@ import { ProduceJWT } from './produce.js';
  * from its subpath export `'jose/jwt/sign'`.
  *
  */
-export declare class SignJWT extends ProduceJWT {
-    private _protectedHeader;
+export declare class SignJWT implements types.ProduceJWT {
+    #private;
+    /**
+     * {@link SignJWT} constructor
+     *
+     * @param payload The JWT Claims Set object. Defaults to an empty object.
+     */
+    constructor(payload?: types.JWTPayload);
+    setIssuer(issuer: string): this;
+    setSubject(subject: string): this;
+    setAudience(audience: string | string[]): this;
+    setJti(jwtId: string): this;
+    setNotBefore(input: number | string | Date): this;
+    setExpirationTime(input: number | string | Date): this;
+    setIssuedAt(input?: number | string | Date): this;
     /**
      * Sets the JWS Protected Header on the SignJWT object.
      *

package/dist/types/jwt/unsecured.d.ts

@@ -4,7 +4,6 @@
  * @module
  */
 import type * as types from '../types.d.ts';
-import { ProduceJWT } from './produce.js';
 /** Result of decoding an Unsecured JWT. */
 export interface UnsecuredResult<PayloadType = types.JWTPayload> {
     payload: PayloadType & types.JWTPayload;
@@ -17,9 +16,23 @@ export interface UnsecuredResult<PayloadType = types.JWTPayload> {
  * from its subpath export `'jose/jwt/unsecured'`.
  *
  */
-export declare class UnsecuredJWT extends ProduceJWT {
+export declare class UnsecuredJWT implements types.ProduceJWT {
+    #private;
+    /**
+     * {@link UnsecuredJWT} constructor
+     *
+     * @param payload The JWT Claims Set object. Defaults to an empty object.
+     */
+    constructor(payload?: types.JWTPayload);
     /** Encodes the Unsecured JWT. */
     encode(): string;
+    setIssuer(issuer: string): this;
+    setSubject(subject: string): this;
+    setAudience(audience: string | string[]): this;
+    setJti(jwtId: string): this;
+    setNotBefore(input: number | string | Date): this;
+    setExpirationTime(input: number | string | Date): this;
+    setIssuedAt(input?: number | string | Date): this;
     /**
      * Decodes an unsecured JWT.
      *

package/dist/types/types.d.ts

@@ -703,3 +703,110 @@ export type CryptoKey = Extract<
   Awaited<ReturnType<typeof crypto.subtle.generateKey>>,
   { type: string }
 >
+
+/** Generic interface for JWT producing classes. */
+export interface ProduceJWT {
+  /**
+   * Set the "iss" (Issuer) Claim.
+   *
+   * @param issuer "Issuer" Claim value to set on the JWT Claims Set.
+   */
+  setIssuer(issuer: string): this
+
+  /**
+   * Set the "sub" (Subject) Claim.
+   *
+   * @param subject "sub" (Subject) Claim value to set on the JWT Claims Set.
+   */
+  setSubject(subject: string): this
+
+  /**
+   * Set the "aud" (Audience) Claim.
+   *
+   * @param audience "aud" (Audience) Claim value to set on the JWT Claims Set.
+   */
+  setAudience(audience: string | string[]): this
+
+  /**
+   * Set the "jti" (JWT ID) Claim.
+   *
+   * @param jwtId "jti" (JWT ID) Claim value to set on the JWT Claims Set.
+   */
+  setJti(jwtId: string): this
+
+  /**
+   * Set the "nbf" (Not Before) Claim.
+   *
+   * - If a `number` is passed as an argument it is used as the claim directly.
+   * - If a `Date` instance is passed as an argument it is converted to unix timestamp and used as the
+   *   claim.
+   * - If a `string` is passed as an argument it is resolved to a time span, and then added to the
+   *   current unix timestamp and used as the claim.
+   *
+   * Format used for time span should be a number followed by a unit, such as "5 minutes" or "1
+   * day".
+   *
+   * Valid units are: "sec", "secs", "second", "seconds", "s", "minute", "minutes", "min", "mins",
+   * "m", "hour", "hours", "hr", "hrs", "h", "day", "days", "d", "week", "weeks", "w", "year",
+   * "years", "yr", "yrs", and "y". It is not possible to specify months. 365.25 days is used as an
+   * alias for a year.
+   *
+   * If the string is suffixed with "ago", or prefixed with a "-", the resulting time span gets
+   * subtracted from the current unix timestamp. A "from now" suffix can also be used for
+   * readability when adding to the current unix timestamp.
+   *
+   * @param input "nbf" (Not Before) Claim value to set on the JWT Claims Set.
+   */
+  setNotBefore(input: number | string | Date): this
+
+  /**
+   * Set the "exp" (Expiration Time) Claim.
+   *
+   * - If a `number` is passed as an argument it is used as the claim directly.
+   * - If a `Date` instance is passed as an argument it is converted to unix timestamp and used as the
+   *   claim.
+   * - If a `string` is passed as an argument it is resolved to a time span, and then added to the
+   *   current unix timestamp and used as the claim.
+   *
+   * Format used for time span should be a number followed by a unit, such as "5 minutes" or "1
+   * day".
+   *
+   * Valid units are: "sec", "secs", "second", "seconds", "s", "minute", "minutes", "min", "mins",
+   * "m", "hour", "hours", "hr", "hrs", "h", "day", "days", "d", "week", "weeks", "w", "year",
+   * "years", "yr", "yrs", and "y". It is not possible to specify months. 365.25 days is used as an
+   * alias for a year.
+   *
+   * If the string is suffixed with "ago", or prefixed with a "-", the resulting time span gets
+   * subtracted from the current unix timestamp. A "from now" suffix can also be used for
+   * readability when adding to the current unix timestamp.
+   *
+   * @param input "exp" (Expiration Time) Claim value to set on the JWT Claims Set.
+   */
+  setExpirationTime(input: number | string | Date): this
+
+  /**
+   * Set the "iat" (Issued At) Claim.
+   *
+   * - If no argument is used the current unix timestamp is used as the claim.
+   * - If a `number` is passed as an argument it is used as the claim directly.
+   * - If a `Date` instance is passed as an argument it is converted to unix timestamp and used as the
+   *   claim.
+   * - If a `string` is passed as an argument it is resolved to a time span, and then added to the
+   *   current unix timestamp and used as the claim.
+   *
+   * Format used for time span should be a number followed by a unit, such as "5 minutes" or "1
+   * day".
+   *
+   * Valid units are: "sec", "secs", "second", "seconds", "s", "minute", "minutes", "min", "mins",
+   * "m", "hour", "hours", "hr", "hrs", "h", "day", "days", "d", "week", "weeks", "w", "year",
+   * "years", "yr", "yrs", and "y". It is not possible to specify months. 365.25 days is used as an
+   * alias for a year.
+   *
+   * If the string is suffixed with "ago", or prefixed with a "-", the resulting time span gets
+   * subtracted from the current unix timestamp. A "from now" suffix can also be used for
+   * readability when adding to the current unix timestamp.
+   *
+   * @param input "iat" (Expiration Time) Claim value to set on the JWT Claims Set.
+   */
+  setIssuedAt(input?: number | string | Date): this
+}

package/dist/types/util/errors.d.ts

@@ -15,7 +15,7 @@ export declare class JOSEError extends Error {
      * @ignore
      */
     static code: string;
-    /** A unique error code for this particular error subclass. */
+    /** A unique error code for {@link JOSEError}. */
     code: string;
     /** @ignore */
     constructor(message?: string, options?: {
@@ -29,6 +29,7 @@ export declare class JOSEError extends Error {
 export declare class JWTClaimValidationFailed extends JOSEError {
     /** @ignore */
     static code: string;
+    /** A unique error code for {@link JWTClaimValidationFailed}. */
     code: string;
     /** The Claim for which the validation failed. */
     claim: string;
@@ -51,6 +52,7 @@ export declare class JWTClaimValidationFailed extends JOSEError {
 export declare class JWTExpired extends JOSEError implements JWTClaimValidationFailed {
     /** @ignore */
     static code: string;
+    /** A unique error code for {@link JWTExpired}. */
     code: string;
     /** The Claim for which the validation failed. */
     claim: string;
@@ -73,6 +75,7 @@ export declare class JWTExpired extends JOSEError implements JWTClaimValidationF
 export declare class JOSEAlgNotAllowed extends JOSEError {
     /** @ignore */
     static code: string;
+    /** A unique error code for {@link JOSEAlgNotAllowed}. */
     code: string;
 }
 /**
@@ -83,6 +86,7 @@ export declare class JOSEAlgNotAllowed extends JOSEError {
 export declare class JOSENotSupported extends JOSEError {
     /** @ignore */
     static code: string;
+    /** A unique error code for {@link JOSENotSupported}. */
     code: string;
 }
 /**
@@ -92,6 +96,7 @@ export declare class JOSENotSupported extends JOSEError {
 export declare class JWEDecryptionFailed extends JOSEError {
     /** @ignore */
     static code: string;
+    /** A unique error code for {@link JWEDecryptionFailed}. */
     code: string;
     /** @ignore */
     constructor(message?: string, options?: {
@@ -105,6 +110,7 @@ export declare class JWEDecryptionFailed extends JOSEError {
 export declare class JWEInvalid extends JOSEError {
     /** @ignore */
     static code: string;
+    /** A unique error code for {@link JWEInvalid}. */
     code: string;
 }
 /**
@@ -114,6 +120,7 @@ export declare class JWEInvalid extends JOSEError {
 export declare class JWSInvalid extends JOSEError {
     /** @ignore */
     static code: string;
+    /** A unique error code for {@link JWSInvalid}. */
     code: string;
 }
 /**
@@ -123,6 +130,7 @@ export declare class JWSInvalid extends JOSEError {
 export declare class JWTInvalid extends JOSEError {
     /** @ignore */
     static code: string;
+    /** A unique error code for {@link JWTInvalid}. */
     code: string;
 }
 /**
@@ -132,6 +140,7 @@ export declare class JWTInvalid extends JOSEError {
 export declare class JWKInvalid extends JOSEError {
     /** @ignore */
     static code: string;
+    /** A unique error code for {@link JWKInvalid}. */
     code: string;
 }
 /**
@@ -141,6 +150,7 @@ export declare class JWKInvalid extends JOSEError {
 export declare class JWKSInvalid extends JOSEError {
     /** @ignore */
     static code: string;
+    /** A unique error code for {@link JWKSInvalid}. */
     code: string;
 }
 /**
@@ -150,6 +160,7 @@ export declare class JWKSInvalid extends JOSEError {
 export declare class JWKSNoMatchingKey extends JOSEError {
     /** @ignore */
     static code: string;
+    /** A unique error code for {@link JWKSNoMatchingKey}. */
     code: string;
     /** @ignore */
     constructor(message?: string, options?: {
@@ -165,6 +176,7 @@ export declare class JWKSMultipleMatchingKeys extends JOSEError {
     [Symbol.asyncIterator]: () => AsyncIterableIterator<types.CryptoKey>;
     /** @ignore */
     static code: string;
+    /** A unique error code for {@link JWKSMultipleMatchingKeys}. */
     code: string;
     /** @ignore */
     constructor(message?: string, options?: {
@@ -178,6 +190,7 @@ export declare class JWKSMultipleMatchingKeys extends JOSEError {
 export declare class JWKSTimeout extends JOSEError {
     /** @ignore */
     static code: string;
+    /** A unique error code for {@link JWKSTimeout}. */
     code: string;
     /** @ignore */
     constructor(message?: string, options?: {
@@ -191,6 +204,7 @@ export declare class JWKSTimeout extends JOSEError {
 export declare class JWSSignatureVerificationFailed extends JOSEError {
     /** @ignore */
     static code: string;
+    /** A unique error code for {@link JWSSignatureVerificationFailed}. */
     code: string;
     /** @ignore */
     constructor(message?: string, options?: {

package/dist/webapi/jwe/compact/encrypt.js

@@ -1,27 +1,27 @@
 import { FlattenedEncrypt } from '../flattened/encrypt.js';
 export class CompactEncrypt {
-    _flattened;
+    #flattened;
     constructor(plaintext) {
-        this._flattened = new FlattenedEncrypt(plaintext);
+        this.#flattened = new FlattenedEncrypt(plaintext);
     }
     setContentEncryptionKey(cek) {
-        this._flattened.setContentEncryptionKey(cek);
+        this.#flattened.setContentEncryptionKey(cek);
         return this;
     }
     setInitializationVector(iv) {
-        this._flattened.setInitializationVector(iv);
+        this.#flattened.setInitializationVector(iv);
         return this;
     }
     setProtectedHeader(protectedHeader) {
-        this._flattened.setProtectedHeader(protectedHeader);
+        this.#flattened.setProtectedHeader(protectedHeader);
         return this;
     }
     setKeyManagementParameters(parameters) {
-        this._flattened.setKeyManagementParameters(parameters);
+        this.#flattened.setKeyManagementParameters(parameters);
         return this;
     }
     async encrypt(key, options) {
-        const jwe = await this._flattened.encrypt(key, options);
+        const jwe = await this.#flattened.encrypt(key, options);
         return [jwe.protected, jwe.encrypted_key, jwe.iv, jwe.ciphertext, jwe.tag].join('.');
     }
 }