unjwt 0.6.1 → 0.7.0

package/dist/_chunks/jwe.mjs

@@ -0,0 +1,407 @@
+import { D as JWTError, S as validateCriticalHeadersJWE, b as getPlaintextBytes, f as applyTypCtyDefaults, h as computeJwtTimeClaims, i as isCryptoKey, o as isJWK, s as isJWKSet, y as decodePayloadFromBytes } from "./utils.mjs";
+import { a as base64UrlEncode, i as base64UrlDecode, s as textEncoder, t as secureRandomBytes, u as sanitizeObjectCopy } from "./libs/unsecure.mjs";
+import { C as generateIV, S as generateCEK, _ as unwrapKey, b as decrypt$1, h as importKey, p as getJWKsFromSet, x as encrypt$1, y as encryptKey } from "./jwk.mjs";
+import { i as checkAlgAllowed, l as validateJwtClaimsIfJsonPayload, o as decodeProtectedHeader, r as buildJWKSetFilter, s as parseEphemeralKey, t as JWE_ALG_CTX } from "./_internal.mjs";
+const DIRECT_ALGS = /* @__PURE__ */ new Set(["dir", "ECDH-ES"]);
+async function encryptMulti(payload, recipients, options = {}) {
+	if (!Array.isArray(recipients) || recipients.length === 0) throw new JWTError("encryptMulti requires at least one recipient.", "ERR_JWE_INVALID");
+	const resolvedAlgs = recipients.map((r, i) => _resolveRecipientAlg(r.key, i));
+	const enc = options.enc ?? "A256GCM";
+	const userProtected = sanitizeObjectCopy(options.protectedHeader);
+	const sharedUnprotected = sanitizeObjectCopy(options.sharedUnprotectedHeader);
+	const protectedHeader = {};
+	if (userProtected) Object.assign(protectedHeader, userProtected);
+	protectedHeader.enc = enc;
+	applyTypCtyDefaults(protectedHeader, payload);
+	const plaintextBytes = getPlaintextBytes(computeJwtTimeClaims(payload, options) || payload);
+	const cek = options.cek ?? generateCEK(enc);
+	const wireRecipients = [];
+	for (let i = 0; i < recipients.length; i++) {
+		const recipient = recipients[i];
+		const alg = resolvedAlgs[i];
+		const keyMgmtParams = _buildRecipientKeyMgmtParams(recipient, alg);
+		const { encryptedKey, parameters: keyMgmtOut } = await encryptKey(alg, enc, await importKey(recipient.key, {
+			alg,
+			expect: "public"
+		}), cek, keyMgmtParams);
+		const perRecipientHeader = _buildPerRecipientHeader(recipient, alg, keyMgmtOut);
+		_assertDisjointHeaders(protectedHeader, sharedUnprotected, perRecipientHeader);
+		const wireRecipient = {};
+		if (Object.keys(perRecipientHeader).length > 0) wireRecipient.header = perRecipientHeader;
+		if (encryptedKey) wireRecipient.encrypted_key = base64UrlEncode(encryptedKey);
+		wireRecipients.push(wireRecipient);
+	}
+	const protectedHeaderEncoded = base64UrlEncode(JSON.stringify(protectedHeader));
+	let aadEncoded;
+	let aadForCipher = protectedHeaderEncoded;
+	if (options.aad !== void 0) {
+		aadEncoded = base64UrlEncode(typeof options.aad === "string" ? textEncoder.encode(options.aad) : options.aad);
+		aadForCipher = `${protectedHeaderEncoded}.${aadEncoded}`;
+	}
+	const contentAadBytes = textEncoder.encode(aadForCipher);
+	const { ciphertext: contentCiphertext, tag: contentAuthTag, iv: actualContentIV } = await encrypt$1(enc, plaintextBytes, cek, options.contentEncryptionIV ?? generateIV(enc), contentAadBytes);
+	if (!actualContentIV || !contentAuthTag) throw new JWTError("Content encryption did not return an IV / auth tag.", "ERR_JWE_INVALID");
+	const output = {
+		protected: protectedHeaderEncoded,
+		recipients: wireRecipients,
+		iv: base64UrlEncode(actualContentIV),
+		ciphertext: base64UrlEncode(contentCiphertext),
+		tag: base64UrlEncode(contentAuthTag)
+	};
+	if (sharedUnprotected && Object.keys(sharedUnprotected).length > 0) output.unprotected = sharedUnprotected;
+	if (aadEncoded !== void 0) output.aad = aadEncoded;
+	return output;
+}
+async function decryptMulti(jwe, keyOrLookup, options = {}) {
+	const general = _normalizeSerialization(jwe);
+	if (typeof general.iv !== "string" || typeof general.ciphertext !== "string" || typeof general.tag !== "string" || !Array.isArray(general.recipients) || general.recipients.length === 0) throw new JWTError("Invalid JWE JSON Serialization: missing iv/ciphertext/tag/recipients.", "ERR_JWE_INVALID_SERIALIZATION");
+	const protectedHeaderEncoded = general.protected ?? "";
+	const protectedHeader = decodeProtectedHeader(protectedHeaderEncoded || void 0, "JWE");
+	const enc = protectedHeader.enc;
+	if (!enc) throw new JWTError("Invalid JWE: Protected header is missing \"enc\".", "ERR_JWE_INVALID");
+	if (options.encryptionAlgorithms && !options.encryptionAlgorithms.includes(enc)) throw new JWTError(`Content encryption algorithm not allowed: ${enc}`, "ERR_JWE_ALG_NOT_ALLOWED");
+	const sharedUnprotected = sanitizeObjectCopy(general.unprotected);
+	const ivBytes = base64UrlDecode(general.iv, { returnAs: "uint8array" });
+	const ciphertextBytes = base64UrlDecode(general.ciphertext, { returnAs: "uint8array" });
+	const tagBytes = base64UrlDecode(general.tag, { returnAs: "uint8array" });
+	const contentAadBytes = textEncoder.encode(general.aad ? `${protectedHeaderEncoded}.${general.aad}` : protectedHeaderEncoded);
+	let lastError;
+	let cryptoAttempted = false;
+	for (let i = 0; i < general.recipients.length; i++) {
+		const wireRecipient = general.recipients[i];
+		const recipientHeader = sanitizeObjectCopy(wireRecipient.header);
+		_assertDisjointHeaders(protectedHeader, sharedUnprotected, recipientHeader);
+		const effective = _mergeHeaders(protectedHeader, sharedUnprotected, recipientHeader);
+		const alg = effective.alg;
+		if (!alg) {
+			lastError = new JWTError(`Recipient[${i}] has no "alg" in the effective header.`, "ERR_JWE_INVALID");
+			continue;
+		}
+		const rawKeyMaterial = typeof keyOrLookup === "function" ? await keyOrLookup(effective, protectedHeaderEncoded) : keyOrLookup;
+		const algError = checkAlgAllowed(alg, rawKeyMaterial, options.algorithms, JWE_ALG_CTX);
+		if (algError) {
+			lastError = algError;
+			continue;
+		}
+		if (options.strictRecipientMatch && !_recipientKeyMatches(effective, rawKeyMaterial)) continue;
+		const encryptedKeyBytes = base64UrlDecode(wireRecipient.encrypted_key ?? "", { returnAs: "uint8array" });
+		const unwrapKeyOpts = _buildUnwrapKeyOptions(effective, enc, options);
+		cryptoAttempted = true;
+		try {
+			const { cek, plaintextBytes } = await _unwrapAndDecrypt(alg, enc, rawKeyMaterial, encryptedKeyBytes, unwrapKeyOpts, ciphertextBytes, ivBytes, tagBytes, contentAadBytes, effective.kid);
+			const payload = decodePayloadFromBytes(plaintextBytes, options.forceUint8Array);
+			if (protectedHeader.crit || options.recognizedHeaders?.length) validateCriticalHeadersJWE(protectedHeader, options.recognizedHeaders);
+			validateJwtClaimsIfJsonPayload(payload, options);
+			const result = {
+				payload,
+				protectedHeader: {
+					...protectedHeader,
+					alg,
+					enc
+				},
+				recipientIndex: i
+			};
+			if (sharedUnprotected) result.sharedUnprotectedHeader = sharedUnprotected;
+			if (recipientHeader) result.recipientHeader = recipientHeader;
+			if (options.returnCek) {
+				result.cek = isCryptoKey(cek) ? new Uint8Array(await crypto.subtle.exportKey("raw", cek)) : cek;
+				result.aad = contentAadBytes;
+			}
+			return result;
+		} catch (err) {
+			if (err instanceof JWTError && err.code !== "ERR_JWE_DECRYPTION_FAILED" && err.code !== "ERR_JWK_KEY_NOT_FOUND") throw err;
+			lastError = err instanceof JWTError ? err : void 0;
+		}
+	}
+	if (options.strictRecipientMatch && !cryptoAttempted) throw new JWTError("No recipient matched the provided key under strictRecipientMatch.", "ERR_JWE_NO_MATCHING_RECIPIENT");
+	throw lastError ?? new JWTError("JWE decryption failed.", "ERR_JWE_DECRYPTION_FAILED");
+}
+function generalToFlattened(jwe) {
+	if (jwe.recipients.length !== 1) throw new JWTError(`Flattened JWE Serialization requires exactly one recipient, got ${jwe.recipients.length}.`, "ERR_JWE_INVALID_SERIALIZATION");
+	const { recipients, ...rest } = jwe;
+	const [recipient] = recipients;
+	const flattened = { ...rest };
+	if (recipient.header !== void 0) flattened.header = recipient.header;
+	if (recipient.encrypted_key !== void 0) flattened.encrypted_key = recipient.encrypted_key;
+	return flattened;
+}
+function _resolveRecipientAlg(key, index) {
+	if (!isJWK(key)) throw new JWTError(`Recipient[${index}] key is not a JWK.`, "ERR_JWE_RECIPIENT_ALG_INFERENCE");
+	const alg = key.alg;
+	if (!alg) throw new JWTError(`Cannot infer "alg" for recipient[${index}]: the JWK has no "alg" property.`, "ERR_JWE_RECIPIENT_ALG_INFERENCE");
+	if (DIRECT_ALGS.has(alg)) throw new JWTError(`Recipient[${index}] resolves to "${alg}", which requires exactly one recipient. Use encrypt() instead.`, "ERR_JWE_ALG_FORBIDDEN_IN_MULTI");
+	return alg;
+}
+function _buildRecipientKeyMgmtParams(recipient, alg) {
+	const params = {};
+	if (recipient.keyManagementIV) params.iv = recipient.keyManagementIV;
+	if (recipient.p2s) params.p2s = recipient.p2s;
+	else if (alg.startsWith("PBES2")) params.p2s = secureRandomBytes(16);
+	if (recipient.p2c) params.p2c = recipient.p2c;
+	else if (alg.startsWith("PBES2")) params.p2c = 6e5;
+	if (recipient.ecdh?.partyUInfo) params.apu = recipient.ecdh.partyUInfo;
+	if (recipient.ecdh?.partyVInfo) params.apv = recipient.ecdh.partyVInfo;
+	if (recipient.ecdh?.ephemeralKey) {
+		const { epk, epkPrivateKey } = parseEphemeralKey(recipient.ecdh.ephemeralKey);
+		params.epk = epk;
+		params.epkPrivateKey = epkPrivateKey;
+	}
+	return params;
+}
+function _buildPerRecipientHeader(recipient, alg, keyMgmtOut) {
+	const header = {};
+	if (recipient.key.kid) header.kid = recipient.key.kid;
+	const userHeader = sanitizeObjectCopy(recipient.header);
+	if (userHeader) Object.assign(header, userHeader);
+	if (keyMgmtOut) Object.assign(header, keyMgmtOut);
+	header.alg = alg;
+	return header;
+}
+function _assertDisjointHeaders(protectedHeader, sharedUnprotected, recipientHeader) {
+	const seen = /* @__PURE__ */ new Set();
+	const check = (obj) => {
+		if (!obj) return;
+		for (const k of Object.keys(obj)) {
+			if (seen.has(k)) throw new JWTError(`JWE header parameter "${k}" appears in multiple header tiers; protected, shared unprotected, and per-recipient headers must be disjoint (RFC 7516 §7.2.1).`, "ERR_JWE_HEADER_PARAMS_NOT_DISJOINT");
+			seen.add(k);
+		}
+	};
+	check(protectedHeader);
+	check(sharedUnprotected);
+	check(recipientHeader);
+}
+function _mergeHeaders(protectedHeader, sharedUnprotected, recipientHeader) {
+	const merged = { ...protectedHeader };
+	if (sharedUnprotected) Object.assign(merged, sharedUnprotected);
+	if (recipientHeader) Object.assign(merged, recipientHeader);
+	return merged;
+}
+function _normalizeSerialization(input) {
+	if (!input || typeof input !== "object") throw new JWTError("Invalid JWE JSON Serialization: expected an object.", "ERR_JWE_INVALID_SERIALIZATION");
+	const obj = input;
+	if (Array.isArray(obj.recipients)) return obj;
+	if ("encrypted_key" in obj || "header" in obj) {
+		const flattened = obj;
+		const general = {
+			recipients: [{
+				...flattened.header !== void 0 ? { header: flattened.header } : {},
+				...flattened.encrypted_key !== void 0 ? { encrypted_key: flattened.encrypted_key } : {}
+			}],
+			iv: flattened.iv,
+			ciphertext: flattened.ciphertext,
+			tag: flattened.tag
+		};
+		if (flattened.protected !== void 0) general.protected = flattened.protected;
+		if (flattened.unprotected !== void 0) general.unprotected = flattened.unprotected;
+		if (flattened.aad !== void 0) general.aad = flattened.aad;
+		return general;
+	}
+	throw new JWTError("Invalid JWE JSON Serialization: missing both recipients[] and flattened header/encrypted_key.", "ERR_JWE_INVALID_SERIALIZATION");
+}
+function _recipientKeyMatches(effectiveHeader, keyMaterial) {
+	const headerKid = effectiveHeader.kid;
+	if (isJWKSet(keyMaterial)) return keyMaterial.keys.some((k) => !headerKid || k.kid === headerKid);
+	if (isJWK(keyMaterial)) {
+		if (headerKid && keyMaterial.kid && headerKid !== keyMaterial.kid) return false;
+		return true;
+	}
+	return !headerKid;
+}
+function _buildUnwrapKeyOptions(effectiveHeader, enc, options) {
+	const opts = {
+		enc,
+		format: enc.includes("GCM") ? "cryptokey" : "raw",
+		keyUsage: options.keyUsage || ["decrypt"]
+	};
+	if (effectiveHeader.iv) opts.iv = effectiveHeader.iv;
+	if (effectiveHeader.tag) opts.tag = effectiveHeader.tag;
+	if (effectiveHeader.p2s) opts.p2s = effectiveHeader.p2s;
+	if (effectiveHeader.p2c) opts.p2c = effectiveHeader.p2c;
+	if (effectiveHeader.epk) opts.epk = effectiveHeader.epk;
+	if (effectiveHeader.apu) opts.apu = effectiveHeader.apu;
+	if (effectiveHeader.apv) opts.apv = effectiveHeader.apv;
+	if (options.unwrappedKeyAlgorithm) opts.unwrappedKeyAlgorithm = options.unwrappedKeyAlgorithm;
+	if (options.extractable) opts.extractable = options.extractable;
+	if (options.minIterations !== void 0) opts.minIterations = options.minIterations;
+	if (options.maxIterations !== void 0) opts.maxIterations = options.maxIterations;
+	return opts;
+}
+async function _unwrapAndDecrypt(alg, enc, rawKeyMaterial, encryptedKeyBytes, unwrapKeyOpts, ciphertextBytes, ivBytes, tagBytes, contentAadBytes, headerKid) {
+	if (isJWKSet(rawKeyMaterial)) {
+		const candidates = getJWKsFromSet(rawKeyMaterial, buildJWKSetFilter({
+			kid: headerKid,
+			alg
+		}));
+		if (candidates.length === 0) throw new JWTError("No key found in JWK Set.", "ERR_JWK_KEY_NOT_FOUND");
+		let lastErr;
+		for (const candidate of candidates) {
+			const unwrappingKey = await importKey(candidate, {
+				alg,
+				expect: "private"
+			});
+			try {
+				const cek = await unwrapKey(alg, encryptedKeyBytes, unwrappingKey, unwrapKeyOpts);
+				return {
+					cek,
+					plaintextBytes: await decrypt$1(enc, cek, ciphertextBytes, ivBytes, tagBytes, contentAadBytes)
+				};
+			} catch (err) {
+				if (err instanceof JWTError && err.code !== "ERR_JWE_DECRYPTION_FAILED") throw err;
+				lastErr = err;
+			}
+		}
+		throw lastErr ?? new JWTError("JWE decryption failed.", "ERR_JWE_DECRYPTION_FAILED");
+	}
+	const unwrappingKey = await importKey(rawKeyMaterial, {
+		alg,
+		expect: "private"
+	});
+	try {
+		const cek = await unwrapKey(alg, encryptedKeyBytes, unwrappingKey, unwrapKeyOpts);
+		return {
+			cek,
+			plaintextBytes: await decrypt$1(enc, cek, ciphertextBytes, ivBytes, tagBytes, contentAadBytes)
+		};
+	} catch (err) {
+		if (err instanceof JWTError) throw err;
+		throw new JWTError("JWE decryption failed.", "ERR_JWE_DECRYPTION_FAILED", err);
+	}
+}
+async function encrypt(payload, key, options = {}) {
+	const { protectedHeader: userHeader, cek: providedCek, contentEncryptionIV: providedContentIV, keyManagementIV, p2s, p2c, ecdh } = options;
+	let { alg, enc } = options;
+	if (!alg) {
+		if (typeof key === "string" || key instanceof Uint8Array) alg = "PBES2-HS256+A128KW";
+		else if (isJWK(key)) alg = key.alg;
+	}
+	if (!alg) throw new JWTError("JWE \"alg\" (Key Management Algorithm) must be provided in options or inferable from the key", "ERR_JWE_ALG_MISSING");
+	if (!enc) if (alg === "dir") {
+		enc = isJWK(key) && "enc" in key ? key.enc : void 0;
+		if (!enc) throw new JWTError("JWE \"enc\" must be provided when alg is \"dir\"", "ERR_JWE_ENC_MISSING");
+	} else enc = isJWK(key) && "enc" in key ? key.enc : "A128GCM";
+	const jweKeyManagementParams = {};
+	if (keyManagementIV) jweKeyManagementParams.iv = keyManagementIV;
+	if (p2s) jweKeyManagementParams.p2s = p2s;
+	else if (alg?.startsWith("PBES2")) jweKeyManagementParams.p2s = secureRandomBytes(16);
+	if (p2c) jweKeyManagementParams.p2c = p2c;
+	else if (alg?.startsWith("PBES2")) jweKeyManagementParams.p2c = 6e5;
+	if (ecdh?.partyUInfo) jweKeyManagementParams.apu = ecdh.partyUInfo;
+	if (ecdh?.partyVInfo) jweKeyManagementParams.apv = ecdh.partyVInfo;
+	if (ecdh?.ephemeralKey) {
+		const parsed = parseEphemeralKey(ecdh.ephemeralKey);
+		jweKeyManagementParams.epk = parsed.epk;
+		jweKeyManagementParams.epkPrivateKey = parsed.epkPrivateKey;
+	}
+	const wrappingKeyMaterial = await importKey(key, {
+		alg,
+		expect: "public"
+	});
+	const { cek: finalCek, encryptedKey: jweEncryptedKey, parameters: keyManagementHeaderParams } = await encryptKey(alg, enc, wrappingKeyMaterial, providedCek, jweKeyManagementParams);
+	const protectedHeader = _buildJWEHeader(alg, enc, key, userHeader, keyManagementHeaderParams, payload);
+	const plaintextBytes = getPlaintextBytes(computeJwtTimeClaims(payload, options) || payload);
+	const protectedHeaderEncoded = base64UrlEncode(JSON.stringify(protectedHeader));
+	const aadBytes = textEncoder.encode(protectedHeaderEncoded);
+	const contentIVBytes = providedContentIV ?? generateIV(enc);
+	const { ciphertext: contentCiphertext, tag: contentAuthTag, iv: actualContentIV } = await encrypt$1(enc, plaintextBytes, finalCek, contentIVBytes, aadBytes);
+	if (!actualContentIV) throw new JWTError("Content encryption IV was not generated or returned.", "ERR_JWE_INVALID");
+	if (!contentAuthTag) throw new JWTError("Content encryption auth tag was not generated or returned.", "ERR_JWE_INVALID");
+	return [
+		protectedHeaderEncoded,
+		jweEncryptedKey ? base64UrlEncode(jweEncryptedKey) : "",
+		base64UrlEncode(actualContentIV),
+		base64UrlEncode(contentCiphertext),
+		base64UrlEncode(contentAuthTag)
+	].join(".");
+}
+async function decrypt(jwe, key, options = {}) {
+	const parts = jwe.split(".");
+	if (parts.length !== 5) throw new JWTError("Invalid JWE: Must contain five sections (RFC7516, section-3).", "ERR_JWE_INVALID");
+	const [protectedHeaderEncoded, encryptedKeyEncoded, ivEncoded, ciphertextEncoded, authTagEncoded] = parts;
+	const protectedHeader = decodeProtectedHeader(protectedHeaderEncoded, "JWE");
+	if (!protectedHeader.alg || !protectedHeader.enc) throw new JWTError("Invalid JWE: Protected header must be an object with \"alg\" and \"enc\" properties.", "ERR_JWE_INVALID");
+	const alg = protectedHeader.alg;
+	const enc = protectedHeader.enc;
+	if (options?.encryptionAlgorithms && !options.encryptionAlgorithms.includes(enc)) throw new JWTError(`Content encryption algorithm not allowed: ${enc}`, "ERR_JWE_ALG_NOT_ALLOWED");
+	const rawKeyMaterial = typeof key === "function" ? await key(protectedHeader, jwe) : key;
+	const algError = checkAlgAllowed(alg, rawKeyMaterial, options?.algorithms, JWE_ALG_CTX);
+	if (algError) throw algError;
+	const encryptedKeyBytes = base64UrlDecode(encryptedKeyEncoded, { returnAs: "uint8array" });
+	const contentIVBytes = base64UrlDecode(ivEncoded, { returnAs: "uint8array" });
+	const contentAuthTagBytes = base64UrlDecode(authTagEncoded, { returnAs: "uint8array" });
+	const ciphertextBytes = base64UrlDecode(ciphertextEncoded, { returnAs: "uint8array" });
+	const unwrapKeyOpts = {
+		enc,
+		format: enc.includes("GCM") ? "cryptokey" : "raw",
+		keyUsage: options?.keyUsage || ["decrypt"]
+	};
+	if (protectedHeader.iv) unwrapKeyOpts.iv = protectedHeader.iv;
+	if (protectedHeader.tag) unwrapKeyOpts.tag = protectedHeader.tag;
+	if (protectedHeader.p2s) unwrapKeyOpts.p2s = protectedHeader.p2s;
+	if (protectedHeader.p2c) unwrapKeyOpts.p2c = protectedHeader.p2c;
+	if (protectedHeader.epk) unwrapKeyOpts.epk = protectedHeader.epk;
+	if (protectedHeader.apu) unwrapKeyOpts.apu = protectedHeader.apu;
+	if (protectedHeader.apv) unwrapKeyOpts.apv = protectedHeader.apv;
+	if (options?.unwrappedKeyAlgorithm) unwrapKeyOpts.unwrappedKeyAlgorithm = options.unwrappedKeyAlgorithm;
+	if (options?.extractable) unwrapKeyOpts.extractable = options.extractable;
+	if (options?.minIterations !== void 0) unwrapKeyOpts.minIterations = options.minIterations;
+	if (options?.maxIterations !== void 0) unwrapKeyOpts.maxIterations = options.maxIterations;
+	const aadBytes = textEncoder.encode(protectedHeaderEncoded);
+	let cek;
+	let plaintextBytes;
+	if (isJWKSet(rawKeyMaterial)) {
+		const candidates = getJWKsFromSet(rawKeyMaterial, buildJWKSetFilter(protectedHeader));
+		if (candidates.length === 0) throw new JWTError(`No key found in JWK Set${protectedHeader.kid ? ` with kid "${protectedHeader.kid}"` : ""}.`, "ERR_JWK_KEY_NOT_FOUND");
+		let decrypted = false;
+		for (const candidate of candidates) {
+			const unwrappingKey = await importKey(candidate, {
+				alg,
+				expect: "private"
+			});
+			try {
+				const candidateCek = await unwrapKey(alg, encryptedKeyBytes, unwrappingKey, unwrapKeyOpts);
+				plaintextBytes = await decrypt$1(enc, candidateCek, ciphertextBytes, contentIVBytes, contentAuthTagBytes, aadBytes);
+				cek = candidateCek;
+				decrypted = true;
+				break;
+			} catch (err) {
+				if (err instanceof JWTError && err.code !== "ERR_JWE_DECRYPTION_FAILED") throw err;
+			}
+		}
+		if (!decrypted) throw new JWTError("JWE decryption failed.", "ERR_JWE_DECRYPTION_FAILED");
+	} else {
+		const unwrappingKey = await importKey(rawKeyMaterial, {
+			alg,
+			expect: "private"
+		});
+		try {
+			cek = await unwrapKey(alg, encryptedKeyBytes, unwrappingKey, unwrapKeyOpts);
+			plaintextBytes = await decrypt$1(enc, cek, ciphertextBytes, contentIVBytes, contentAuthTagBytes, aadBytes);
+		} catch (error_) {
+			if (error_ instanceof JWTError) throw error_;
+			throw new JWTError("JWE decryption failed.", "ERR_JWE_DECRYPTION_FAILED", error_);
+		}
+	}
+	const payload = decodePayloadFromBytes(plaintextBytes, options?.forceUint8Array);
+	if (protectedHeader.crit || options?.recognizedHeaders?.length) validateCriticalHeadersJWE(protectedHeader, options?.recognizedHeaders);
+	validateJwtClaimsIfJsonPayload(payload, options);
+	const result = {
+		payload,
+		protectedHeader
+	};
+	if (options.returnCek) {
+		result.cek = isCryptoKey(cek) ? new Uint8Array(await crypto.subtle.exportKey("raw", cek)) : cek;
+		result.aad = aadBytes;
+	}
+	return result;
+}
+function _buildJWEHeader(alg, enc, key, userHeader, keyManagementParams, payload) {
+	const safeHeader = sanitizeObjectCopy(userHeader);
+	const header = {};
+	if (isJWK(key) && key.kid) header.kid = key.kid;
+	if (safeHeader) Object.assign(header, safeHeader);
+	if (keyManagementParams) Object.assign(header, keyManagementParams);
+	header.alg = alg;
+	header.enc = enc;
+	return applyTypCtyDefaults(header, payload);
+}
+export { generalToFlattened as a, encryptMulti as i, encrypt as n, decryptMulti as r, decrypt as t };