unjwt 0.4.0 → 0.5.0

package/dist/index.d.mts

@@ -1,5 +1,6 @@
-export { j as jwe } from './shared/unjwt.Dr-mxtq9.mjs';
-export { j as jwk } from './shared/unjwt.A7HKFx3n.mjs';
-export { j as jws } from './shared/unjwt.BdjvpIUY.mjs';
-import './shared/unjwt.4uzJv0cA.mjs';
-import './shared/unjwt.zb2wBNCJ.mjs';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, A as JWKAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, z as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, y as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.C0bBN0AC.mjs';
+export { b as JWT, a as JWTClaims, J as JoseHeaderParameters } from './shared/unjwt.D90BbcE1.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.DYFIh1YE.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.Dz5Oe9BG.mjs';
+export { i as utils } from './shared/unjwt.CJ_ohCFC.mjs';
+export { j as jwk } from './shared/unjwt.B9uGngq-.mjs';

package/dist/index.d.ts

@@ -1,5 +1,6 @@
-export { j as jwe } from './shared/unjwt.DGsIvgyn.js';
-export { j as jwk } from './shared/unjwt.CVUxLNoy.js';
-export { j as jws } from './shared/unjwt.BmjmfFWo.js';
-import './shared/unjwt.ChP7VhqI.js';
-import './shared/unjwt.zb2wBNCJ.js';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, A as JWKAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, z as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, y as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.C0bBN0AC.js';
+export { b as JWT, a as JWTClaims, J as JoseHeaderParameters } from './shared/unjwt.DoVzOnty.js';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.ppm5Y0k7.js';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.BKG_8Y9G.js';
+export { i as utils } from './shared/unjwt.mc4AEAT7.js';
+export { j as jwk } from './shared/unjwt.BOEZHxi_.js';

package/dist/index.mjs

@@ -1,5 +1,5 @@
-export { j as jwe } from './shared/unjwt._GivNhs2.mjs';
-export { j as jwk } from './shared/unjwt.C9ELsKeK.mjs';
-export { j as jws } from './shared/unjwt.KOd0vXyx.mjs';
-import './shared/unjwt.DPTwlVpK.mjs';
-import './shared/unjwt.DD0p18Gd.mjs';
+export { i as utils } from './shared/unjwt.CjHZv3F3.mjs';
+export { j as jwe } from './shared/unjwt.B4e_rwol.mjs';
+export { j as jwk } from './shared/unjwt.DKq5VF7t.mjs';
+export { j as jws } from './shared/unjwt.Bzcov22m.mjs';
+import './shared/unjwt.sux3_Z19.mjs';

package/dist/jwe.d.mts

@@ -1,3 +1,3 @@
-export { J as JWE_DEFAULTS, s as seal, u as unseal } from './shared/unjwt.Dr-mxtq9.mjs';
-import './shared/unjwt.4uzJv0cA.mjs';
-import './shared/unjwt.zb2wBNCJ.mjs';
+import './shared/unjwt.C0bBN0AC.mjs';
+import './shared/unjwt.D90BbcE1.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.Dz5Oe9BG.mjs';

package/dist/jwe.d.ts

@@ -1,3 +1,3 @@
-export { J as JWE_DEFAULTS, s as seal, u as unseal } from './shared/unjwt.DGsIvgyn.js';
-import './shared/unjwt.ChP7VhqI.js';
-import './shared/unjwt.zb2wBNCJ.js';
+import './shared/unjwt.C0bBN0AC.js';
+import './shared/unjwt.DoVzOnty.js';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.BKG_8Y9G.js';

package/dist/jwe.mjs

@@ -1,3 +1,4 @@
-import './shared/unjwt.DPTwlVpK.mjs';
-import './shared/unjwt.DD0p18Gd.mjs';
-export { J as JWE_DEFAULTS, s as seal, u as unseal } from './shared/unjwt._GivNhs2.mjs';
+import './shared/unjwt.DKq5VF7t.mjs';
+import './shared/unjwt.CjHZv3F3.mjs';
+export { d as decrypt, e as encrypt } from './shared/unjwt.B4e_rwol.mjs';
+import './shared/unjwt.sux3_Z19.mjs';

package/dist/jwk.d.mts

@@ -1,2 +1,2 @@
-import './shared/unjwt.zb2wBNCJ.mjs';
-export { e as exportKey, g as generateKey, i as importKey } from './shared/unjwt.A7HKFx3n.mjs';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, A as JWKAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, z as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, y as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.C0bBN0AC.mjs';
+export { d as deriveKeyFromPassword, e as exportKey, g as generateKey, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.B9uGngq-.mjs';

package/dist/jwk.d.ts

@@ -1,2 +1,2 @@
-import './shared/unjwt.zb2wBNCJ.js';
-export { e as exportKey, g as generateKey, i as importKey } from './shared/unjwt.CVUxLNoy.js';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, A as JWKAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, z as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, y as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.C0bBN0AC.js';
+export { d as deriveKeyFromPassword, e as exportKey, g as generateKey, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.BOEZHxi_.js';

package/dist/jwk.mjs

@@ -1,2 +1,2 @@
-import './shared/unjwt.DPTwlVpK.mjs';
-export { e as exportKey, g as generateKey, i as importKey } from './shared/unjwt.C9ELsKeK.mjs';
+import './shared/unjwt.CjHZv3F3.mjs';
+export { o as deriveKeyFromPassword, p as exportKey, n as generateKey, i as importKey, l as unwrapKey, q as wrapKey } from './shared/unjwt.DKq5VF7t.mjs';

package/dist/jws.d.mts

@@ -1,3 +1,3 @@
-import './shared/unjwt.zb2wBNCJ.mjs';
-export { J as JWS_DEFAULTS, s as sign, v as verify } from './shared/unjwt.BdjvpIUY.mjs';
-import './shared/unjwt.4uzJv0cA.mjs';
+import './shared/unjwt.C0bBN0AC.mjs';
+import './shared/unjwt.D90BbcE1.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.DYFIh1YE.mjs';

package/dist/jws.d.ts

@@ -1,3 +1,3 @@
-import './shared/unjwt.zb2wBNCJ.js';
-export { J as JWS_DEFAULTS, s as sign, v as verify } from './shared/unjwt.BmjmfFWo.js';
-import './shared/unjwt.ChP7VhqI.js';
+import './shared/unjwt.C0bBN0AC.js';
+import './shared/unjwt.DoVzOnty.js';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.ppm5Y0k7.js';

package/dist/jws.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.DPTwlVpK.mjs';
-import './shared/unjwt.DD0p18Gd.mjs';
-import './shared/unjwt.C9ELsKeK.mjs';
-export { J as JWS_DEFAULTS, s as sign, v as verify } from './shared/unjwt.KOd0vXyx.mjs';
+import './shared/unjwt.DKq5VF7t.mjs';
+import './shared/unjwt.CjHZv3F3.mjs';
+import './shared/unjwt.sux3_Z19.mjs';
+export { s as sign, v as verify } from './shared/unjwt.Bzcov22m.mjs';

package/dist/shared/unjwt.B4e_rwol.mjs

@@ -0,0 +1,453 @@
+import { a as checkEncCryptoKey, u as uint32be, g as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, b as bitLengthCEK, d as jwkTokey, i as importKey, f as generateIV, h as encrypt$1, l as unwrapKey, m as decrypt$1 } from './unjwt.DKq5VF7t.mjs';
+import { e as concatUint8Arrays, t as textEncoder, f as assertCryptoKey, b as base64UrlEncode, g as isCryptoKey, a as isJWK, d as base64UrlDecode, r as randomBytes, c as textDecoder } from './unjwt.CjHZv3F3.mjs';
+import { c as checkKeyLength } from './unjwt.sux3_Z19.mjs';
+
+function lengthAndInput(input) {
+  return concatUint8Arrays(uint32be(input.length), input);
+}
+async function concatKdf(secret, bits, value) {
+  const iterations = Math.ceil((bits >> 3) / 32);
+  const res = new Uint8Array(iterations * 32);
+  for (let iter = 0; iter < iterations; iter++) {
+    const buf = new Uint8Array(4 + secret.length + value.length);
+    buf.set(uint32be(iter + 1));
+    buf.set(secret, 4);
+    buf.set(value, 4 + secret.length);
+    res.set(await digest("sha256", buf), iter * 32);
+  }
+  return res.slice(0, bits >> 3);
+}
+async function deriveECDHESKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) {
+  checkEncCryptoKey(publicKey, "ECDH");
+  checkEncCryptoKey(privateKey, "ECDH", "deriveBits");
+  const value = concatUint8Arrays(
+    lengthAndInput(textEncoder.encode(algorithm)),
+    lengthAndInput(apu),
+    lengthAndInput(apv),
+    uint32be(keyLength)
+  );
+  const length = publicKey.algorithm.name === "X25519" ? 256 : Math.ceil(
+    Number.parseInt(
+      publicKey.algorithm.namedCurve.slice(-3),
+      10
+    ) / 8
+  ) << 3;
+  const sharedSecret = new Uint8Array(
+    await crypto.subtle.deriveBits(
+      {
+        name: publicKey.algorithm.name,
+        public: publicKey
+      },
+      privateKey,
+      length
+    )
+  );
+  return concatKdf(sharedSecret, keyLength, value);
+}
+function allowed(key) {
+  switch (key.algorithm.namedCurve) {
+    case "P-256":
+    case "P-384":
+    case "P-521": {
+      return true;
+    }
+    default: {
+      return key.algorithm.name === "X25519";
+    }
+  }
+}
+async function digest(algorithm, data) {
+  const subtleDigest = `SHA-${algorithm.slice(-3)}`;
+  return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));
+}
+
+const subtleAlgorithm = (alg) => {
+  switch (alg) {
+    case "RSA-OAEP":
+    case "RSA-OAEP-256":
+    case "RSA-OAEP-384":
+    case "RSA-OAEP-512": {
+      return "RSA-OAEP";
+    }
+    default: {
+      throw new Error(
+        `alg ${alg} is not supported either by JOSE or your javascript runtime`
+      );
+    }
+  }
+};
+async function encryptRSAES(alg, key, cek) {
+  checkEncCryptoKey(key, alg, "encrypt");
+  checkKeyLength(alg, key);
+  return new Uint8Array(
+    await crypto.subtle.encrypt(subtleAlgorithm(alg), key, cek)
+  );
+}
+
+/**
+ * This is a fork of Jose library's utility functions.
+ * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/encrypt_key_management.ts
+ * @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
+ */
+async function encryptKey(alg, enc, key, providedCek, providedParameters = {}) {
+  let encryptedKey;
+  let parameters = {};
+  let cek;
+  switch (alg) {
+    case "dir": {
+      cek = key;
+      break;
+    }
+    case "ECDH-ES":
+    case "ECDH-ES+A128KW":
+    case "ECDH-ES+A192KW":
+    case "ECDH-ES+A256KW": {
+      assertCryptoKey(key);
+      if (!allowed(key)) {
+        throw new Error(
+          "ECDH with the provided key is not allowed or not supported by your javascript runtime"
+        );
+      }
+      const { apu, apv } = providedParameters;
+      const ephemeralKey = providedParameters.epk ? await normalizeKey(providedParameters.epk, alg) : (await crypto.subtle.generateKey(
+        key.algorithm,
+        true,
+        ["deriveBits"]
+      )).privateKey;
+      const { x, y, crv, kty } = await keyToJWK(ephemeralKey);
+      const sharedSecret = await deriveECDHESKey(
+        key,
+        ephemeralKey,
+        alg === "ECDH-ES" ? enc : alg,
+        alg === "ECDH-ES" ? bitLengthCEK(enc) : Number.parseInt(alg.slice(-5, -2), 10),
+        apu,
+        apv
+      );
+      parameters = { epk: { x, y, crv, kty } };
+      if (apu) parameters.apu = base64UrlEncode(apu);
+      if (apv) parameters.apv = base64UrlEncode(apv);
+      if (alg === "ECDH-ES") {
+        cek = sharedSecret;
+        break;
+      }
+      cek = providedCek || generateCEK(enc);
+      const kwAlg = alg.slice(-6);
+      encryptedKey = (await wrap(kwAlg, sharedSecret, cek)).encryptedKey;
+      break;
+    }
+    case "RSA-OAEP":
+    case "RSA-OAEP-256":
+    case "RSA-OAEP-384":
+    case "RSA-OAEP-512": {
+      cek = providedCek || generateCEK(enc);
+      assertCryptoKey(key);
+      encryptedKey = await encryptRSAES(alg, key, cek);
+      break;
+    }
+    case "PBES2-HS256+A128KW":
+    case "PBES2-HS384+A192KW":
+    case "PBES2-HS512+A256KW": {
+      cek = providedCek || generateCEK(enc);
+      const { p2c, p2s } = providedParameters;
+      ({ encryptedKey, ...parameters } = await wrap(alg, key, cek, p2c, p2s));
+      break;
+    }
+    case "A128KW":
+    case "A192KW":
+    case "A256KW": {
+      cek = providedCek || generateCEK(enc);
+      encryptedKey = (await wrap(alg, key, cek)).encryptedKey;
+      break;
+    }
+    case "A128GCMKW":
+    case "A192GCMKW":
+    case "A256GCMKW": {
+      cek = providedCek || generateCEK(enc);
+      const { iv } = providedParameters;
+      ({ encryptedKey, ...parameters } = await encryptIV(alg, key, cek, iv));
+      break;
+    }
+    default: {
+      throw new Error(
+        'Invalid or unsupported "alg" (JWE Algorithm) header value'
+      );
+    }
+  }
+  return { cek, encryptedKey, parameters };
+}
+async function normalizeKey(key, alg) {
+  if (key instanceof Uint8Array) {
+    return key;
+  }
+  if (isCryptoKey(key)) {
+    return key;
+  }
+  if (isJWK(key)) {
+    if ("k" in key && key.k) {
+      return base64UrlDecode(key.k, false);
+    }
+    return jwkTokey({ ...key, alg });
+  }
+  throw new Error("unreachable");
+}
+
+async function encrypt(payload, key, options = {}) {
+  const {
+    protectedHeader: additionalProtectedHeader,
+    cek: providedCek,
+    contentEncryptionIV: providedContentIV,
+    keyManagementIV,
+    p2s = randomBytes(16),
+    p2c = 2048,
+    ecdhPartyUInfo,
+    ecdhPartyVInfo
+  } = options;
+  let { alg, enc } = options;
+  if (!alg) {
+    if (typeof key === "string" || key instanceof Uint8Array) {
+      alg = "PBES2-HS256+A128KW";
+    } else if (isJWK(key)) {
+      alg = key.alg;
+    }
+  }
+  if (!alg) {
+    throw new TypeError(
+      'JWE "alg" (Key Management Algorithm) must be provided in options or inferable from the key'
+    );
+  }
+  if (!enc) {
+    enc = isJWK(key) && "enc" in key ? key.enc : "A128GCM";
+  }
+  const plaintextBytes = getPlaintextBytes(payload);
+  const jweKeyManagementParams = {};
+  if (keyManagementIV) jweKeyManagementParams.iv = keyManagementIV;
+  if (p2s) jweKeyManagementParams.p2s = p2s;
+  if (p2c) jweKeyManagementParams.p2c = p2c;
+  if (ecdhPartyUInfo) jweKeyManagementParams.apu = ecdhPartyUInfo;
+  if (ecdhPartyVInfo) jweKeyManagementParams.apv = ecdhPartyVInfo;
+  if (additionalProtectedHeader?.epk instanceof CryptoKey) {
+    jweKeyManagementParams.epk = additionalProtectedHeader.epk;
+  }
+  const wrappingKeyMaterial = await importKey(key, alg);
+  const {
+    cek: finalCek,
+    // This is the CEK (CryptoKey | Uint8Array) to be used for content encryption
+    encryptedKey: jweEncryptedKey,
+    // This is the JWE Encrypted Key (Uint8Array | undefined)
+    parameters: keyManagementHeaderParams
+    // JWE header params from key encryption (e.g., epk, p2s, iv, tag)
+  } = await encryptKey(
+    alg,
+    enc,
+    wrappingKeyMaterial,
+    providedCek,
+    jweKeyManagementParams
+  );
+  const baseProtectedHeader = { ...additionalProtectedHeader };
+  delete baseProtectedHeader.alg;
+  delete baseProtectedHeader.enc;
+  const jweProtectedHeader = {
+    ...baseProtectedHeader,
+    ...keyManagementHeaderParams,
+    alg,
+    enc
+  };
+  if (jweProtectedHeader.typ === void 0 && typeof payload === "object" && !(payload instanceof Uint8Array)) {
+    jweProtectedHeader.typ = "JWT";
+  }
+  if (jweProtectedHeader.typ === "JWT" && typeof payload === "object" && !(payload instanceof Uint8Array)) {
+    jweProtectedHeader.cty ||= "json";
+  }
+  const protectedHeaderSerialized = JSON.stringify(jweProtectedHeader);
+  const protectedHeaderEncoded = base64UrlEncode(protectedHeaderSerialized);
+  const aadBytes = textEncoder.encode(protectedHeaderEncoded);
+  const contentIVBytes = providedContentIV ?? generateIV(enc);
+  const {
+    ciphertext: contentCiphertext,
+    tag: contentAuthTag,
+    iv: actualContentIV
+  } = await encrypt$1(
+    enc,
+    plaintextBytes,
+    finalCek,
+    contentIVBytes,
+    aadBytes
+  );
+  if (!actualContentIV) {
+    throw new Error("Content encryption IV was not generated or returned.");
+  }
+  if (!contentAuthTag) {
+    throw new Error(
+      "Content encryption auth tag was not generated or returned."
+    );
+  }
+  const encryptedKeyEncoded = jweEncryptedKey ? base64UrlEncode(jweEncryptedKey) : "";
+  const jweParts = [
+    protectedHeaderEncoded,
+    encryptedKeyEncoded,
+    base64UrlEncode(actualContentIV),
+    base64UrlEncode(contentCiphertext),
+    base64UrlEncode(contentAuthTag)
+  ];
+  return jweParts.join(".");
+}
+async function decrypt(jwe, key, options) {
+  const parts = jwe.split(".");
+  if (parts.length !== 5) {
+    throw new Error(
+      "Invalid JWE: Must contain five sections (RFC7516, section-3)."
+    );
+  }
+  const [
+    protectedHeaderEncoded,
+    encryptedKeyEncoded,
+    ivEncoded,
+    ciphertextEncoded,
+    authTagEncoded
+  ] = parts;
+  let protectedHeader;
+  try {
+    const protectedHeaderJson = base64UrlDecode(protectedHeaderEncoded);
+    protectedHeader = JSON.parse(protectedHeaderJson);
+  } catch (error_) {
+    throw new Error(
+      `Invalid JWE: Protected header is not valid Base64URL or JSON (${error_ instanceof Error ? error_.message : error_})`
+    );
+  }
+  if (!protectedHeader || typeof protectedHeader !== "object" || !protectedHeader.alg || !protectedHeader.enc) {
+    throw new Error(
+      'Invalid JWE: Protected header must be an object with "alg" and "enc" properties.'
+    );
+  }
+  const alg = protectedHeader.alg;
+  const enc = protectedHeader.enc;
+  if (options?.algorithms && !options.algorithms.includes(alg)) {
+    throw new Error(`Key management algorithm not allowed: ${alg}`);
+  }
+  if (options?.encryptionAlgorithms && !options.encryptionAlgorithms.includes(enc)) {
+    throw new Error(`Content encryption algorithm not allowed: ${enc}`);
+  }
+  const resolvedKeyMaterial = typeof key === "function" ? await key(protectedHeader) : key;
+  const unwrappingKey = await importKey(resolvedKeyMaterial, alg);
+  const encryptedKeyBytes = base64UrlDecode(encryptedKeyEncoded, false);
+  const contentIVBytes = base64UrlDecode(ivEncoded, false);
+  const contentAuthTagBytes = base64UrlDecode(authTagEncoded, false);
+  const ciphertextBytes = base64UrlDecode(ciphertextEncoded, false);
+  const unwrapKeyOpts = {
+    iv: protectedHeader.iv,
+    tag: protectedHeader.tag,
+    p2s: protectedHeader.p2s,
+    p2c: protectedHeader.p2c,
+    epk: protectedHeader.epk,
+    apu: protectedHeader.apu,
+    apv: protectedHeader.apv,
+    unwrappedKeyAlgorithm: options?.unwrappedKeyAlgorithm,
+    keyUsage: options?.keyUsage,
+    extractable: options?.extractable,
+    returnAs: false
+    // Returning CEK as Uint8Array
+  };
+  const cekBytes = await unwrapKey(
+    alg,
+    encryptedKeyBytes,
+    unwrappingKey,
+    unwrapKeyOpts
+  );
+  const aadBytes = textEncoder.encode(protectedHeaderEncoded);
+  const plaintextBytes = await decrypt$1(
+    enc,
+    cekBytes,
+    ciphertextBytes,
+    contentIVBytes,
+    contentAuthTagBytes,
+    aadBytes
+  );
+  let payload;
+  if (options?.forceUint8Array) {
+    payload = plaintextBytes;
+  } else {
+    const decodedString = textDecoder.decode(plaintextBytes);
+    const cty = protectedHeader.cty?.toLowerCase();
+    const isJsonOutput = protectedHeader.typ === "JWT" || cty === "json" || cty === "application/json" || cty && cty.endsWith("+json");
+    if (isJsonOutput) {
+      if (decodedString.startsWith("{") && decodedString.endsWith("}") || decodedString.startsWith("[") && decodedString.endsWith("]")) {
+        try {
+          payload = JSON.parse(decodedString);
+        } catch {
+          payload = decodedString;
+        }
+      } else {
+        payload = decodedString;
+      }
+    } else {
+      payload = decodedString;
+    }
+  }
+  if (options?.critical && protectedHeader.crit) {
+    const understoodParams = /* @__PURE__ */ new Set([
+      ...options.critical || [],
+      // JWE specific standard headers:
+      "alg",
+      "enc",
+      "typ",
+      "cty",
+      "kid",
+      "jwk",
+      "jku",
+      "x5c",
+      "x5t",
+      "x5u",
+      "iv",
+      "tag",
+      "p2s",
+      "p2c",
+      "epk",
+      "apu",
+      "apv"
+    ]);
+    for (const critParam of protectedHeader.crit) {
+      if (!Object.prototype.hasOwnProperty.call(protectedHeader, critParam)) {
+        throw new Error(
+          `Critical header parameter "${critParam}" listed in "crit" but not present in the protected header.`
+        );
+      }
+      if (!understoodParams.has(critParam)) {
+        throw new Error(
+          `Critical header parameter not understood: ${critParam}`
+        );
+      }
+    }
+  } else if (!options?.critical && protectedHeader.crit) {
+    throw new Error(
+      `Unprocessed critical header parameters: ${protectedHeader.crit.join(", ")}`
+    );
+  }
+  return {
+    payload,
+    protectedHeader,
+    cek: cekBytes,
+    aad: aadBytes
+  };
+}
+function getPlaintextBytes(payload) {
+  if (payload instanceof Uint8Array) {
+    return payload;
+  }
+  if (typeof payload === "string") {
+    return textEncoder.encode(payload);
+  }
+  if (typeof payload === "object" && payload !== null) {
+    return textEncoder.encode(JSON.stringify(payload));
+  }
+  throw new TypeError(
+    "Plaintext must be a string, Uint8Array, or a JSON-serializable object."
+  );
+}
+
+const jwe = {
+  __proto__: null,
+  decrypt: decrypt,
+  encrypt: encrypt
+};
+
+export { decrypt as d, encrypt as e, jwe as j };