unjwt 0.8.3 → 0.8.5

package/dist/_chunks/index3.d.mts

@@ -1,109 +1,12 @@
-import { BytesSource, DecodeOptions, DecodeReturnAs } from "./libs/unsecure.mjs";
-import { JWK, JWKSet, JWK_EC_Private, JWK_EC_Public, JWK_OKP_Private, JWK_OKP_Public, JWK_Private, JWK_Public, JWK_RSA_Private, JWK_RSA_Public, JWK_oct, JWSAlgorithm, KeyManagementAlgorithm } from "./index.mjs";
-import "./digest.mjs";
-import { ComputeJwtTimeClaimsOptions as ComputeJwtTimeClaimsOptions$1, ParsePayloadOptions, applyTypDefault, assertCritShape as assertCritShape$1, computeJwtTimeClaims as computeJwtTimeClaims$1, getPlaintextBytes as getPlaintextBytes$1, parsePayloadBytes, parsePayloadSegment, validateCriticalHeadersJWE as validateCriticalHeadersJWE$1, validateCriticalHeadersJWS as validateCriticalHeadersJWS$1 } from "./jwt.mjs";
-/**
- * Encode bytes or a UTF-8 string as base64url the way JOSE defines it
- * (RFC 7515 §2): URL-safe alphabet, no `=` padding, no line breaks.
- */
-export declare function base64UrlStringify(data: string | BytesSource): string;
-/**
- * Decode JOSE base64url (RFC 7515 §2). Strict: only the canonical, unpadded
- * encoding of a byte string is accepted — `=`, whitespace, characters outside
- * the URL-safe alphabet and set bits past the final byte are rejected, and a
- * `string` result must be valid UTF-8. The return type mirrors the input unless
- * `returnAs` is given. `{ loose: true }` drops what it cannot use instead of
- * throwing: meant for application data, never for token material.
- *
- * @throws {UnsecureError} `MALFORMED` unless `loose`; `INVALID_TYPE` for input that is neither text nor bytes
- */
-export declare function base64UrlParse<T extends DecodeReturnAs>(input: string | Uint8Array, options: DecodeOptions & {
-  returnAs: T;
-}): T extends "string" ? string : Uint8Array<ArrayBuffer>;
-export declare function base64UrlParse(input: string, options?: DecodeOptions): string;
-export declare function base64UrlParse(input: Uint8Array, options?: DecodeOptions): Uint8Array<ArrayBuffer>;
-/** Encode bytes or a UTF-8 string as standard base64 (RFC 4648 §4), with `=` padding. */
-export declare function base64Stringify(data: string | BytesSource): string;
-/**
- * Decode standard base64 (RFC 4648 §4). Strict: the canonical encoding with its
- * `=` padding present. Otherwise the same contract as {@link base64UrlParse}.
- *
- * @throws {UnsecureError} `MALFORMED` unless `loose`; `INVALID_TYPE` for input that is neither text nor bytes
- */
-export declare function base64Parse<T extends DecodeReturnAs>(input: string | Uint8Array, options: DecodeOptions & {
-  returnAs: T;
-}): T extends "string" ? string : Uint8Array<ArrayBuffer>;
-export declare function base64Parse(input: string, options?: DecodeOptions): string;
-export declare function base64Parse(input: Uint8Array, options?: DecodeOptions): Uint8Array<ArrayBuffer>;
-/** @deprecated Renamed to {@link base64UrlStringify} in v0.8.0; removed in v0.9.0. */
-export declare const base64UrlEncode: typeof base64UrlStringify;
-/** @deprecated Renamed to {@link base64UrlParse} in v0.8.0; removed in v0.9.0. */
-export declare const base64UrlDecode: typeof base64UrlParse;
-/** @deprecated Renamed to {@link base64Stringify} in v0.8.0; removed in v0.9.0. */
-export declare const base64Encode: typeof base64Stringify;
-/** @deprecated Renamed to {@link base64Parse} in v0.8.0; removed in v0.9.0. */
-export declare const base64Decode: typeof base64Parse;
-/** Concatenate multiple `Uint8Array`s into a single contiguous buffer. */
-export declare function concatUint8Arrays(...arrays: Readonly<Uint8Array<ArrayBuffer>[]>): Uint8Array<ArrayBuffer>;
-/** Wrap a value in an array; returns the array unchanged if already an array. */
-export declare function maybeArray<T>(item: T | T[]): T[];
-/** Whether `key` is a JWK whose `kty` this library models (`oct`, `RSA`, `EC`, `OKP`). */
-export declare function isJWK(key: unknown): key is JWK;
-/** Whether `key` is an object with a `keys` array. */
-export declare function isJWKSet(key: unknown): key is JWKSet;
-/** Asserts that `key` is a `CryptoKey`; throws `ERR_JWK_INVALID` otherwise. */
-export declare function assertCryptoKey(key: unknown): asserts key is CryptoKey;
-/** Whether `key` is a `CryptoKey`, checked via `Symbol.toStringTag` to work across realms. */
-export declare function isCryptoKey(key: unknown): key is CryptoKey;
-/** Whether `key` is a `CryptoKeyPair` of two CryptoKeys. */
-export declare const isCryptoKeyPair: (key: unknown) => key is CryptoKeyPair;
-/** Whether the JWK is symmetric (`oct`); its `k` is always secret. */
-export declare function isSymmetricJWK<T extends JWK>(key: T): key is Extract<T, JWK_oct>;
-export declare function isSymmetricJWK(key: unknown): key is JWK_oct;
-/** Whether the JWK is asymmetric (RSA, EC, OKP). */
-export declare function isAsymmetricJWK<T extends JWK>(key: T): key is Exclude<T, JWK_oct>;
-export declare function isAsymmetricJWK(key: unknown): key is Exclude<JWK, JWK_oct>;
-/**
- * Whether the JWK holds asymmetric private material (`d`). It is `false` for `oct` keys,
- * so `!isPrivateJWK(key)` is not a "safe to publish" check; use `isPublicJWK`.
- */
-export declare function isPrivateJWK<T extends JWK>(key: T): key is Extract<T, JWK_EC_Private | JWK_OKP_Private | JWK_RSA_Private>;
-export declare function isPrivateJWK(key: unknown): key is JWK_Private;
-/** Whether the JWK is an asymmetric public key without `d`: the "safe to publish" check. */
-export declare function isPublicJWK<T extends JWK>(key: T): key is Exclude<Extract<T, JWK_EC_Public | JWK_OKP_Public | JWK_RSA_Public>, JWK_Private>;
-export declare function isPublicJWK(key: unknown): key is JWK_Public;
-/** How a JWK Set's entries are read during algorithm inference. */
-export interface InferAlgorithmsOptions {
-  /** Admit `oct` entries of a JWK Set. Defaults to `false`. */
-  allowSymmetric?: boolean;
-}
-/**
- * Infer the JWS algorithms a key unambiguously supports, or `undefined` when it cannot
- * (raw bytes, ambiguous JWK, lookup function) and `options.algorithms` must be passed.
- */
-export declare function inferJWSAllowedAlgorithms(key: unknown, options?: InferAlgorithmsOptions): JWSAlgorithm[] | undefined;
-/**
- * Infer the JWE key management algorithms a key unambiguously supports, or `undefined`
- * when it cannot; a password string infers the PBES2 variants, raw bytes nothing.
- */
-export declare function inferJWEAllowedAlgorithms(key: unknown, options?: InferAlgorithmsOptions): KeyManagementAlgorithm[] | undefined;
-/** @deprecated Use `ParsePayloadOptions` from `unjwt/internal`; removed in v0.9.0. */
-export type DecodePayloadOptions = ParsePayloadOptions;
-/** @deprecated Use `ComputeJwtTimeClaimsOptions` from `unjwt/internal`; removed in v0.9.0. */
-export type ComputeJwtTimeClaimsOptions = ComputeJwtTimeClaimsOptions$1;
-/** @deprecated Use `applyTypDefault` from `unjwt/internal`; removed in v0.9.0. */
-export declare const applyTypCtyDefaults: typeof applyTypDefault;
-/** @deprecated Use `parsePayloadBytes` from `unjwt/internal`; removed in v0.9.0. */
-export declare const decodePayloadFromBytes: typeof parsePayloadBytes;
-/** @deprecated Use `parsePayloadSegment` from `unjwt/internal`; removed in v0.9.0. */
-export declare const decodePayloadFromB64UrlSegment: typeof parsePayloadSegment;
-/** @deprecated Use `getPlaintextBytes` from `unjwt/internal`; removed in v0.9.0. */
-export declare const getPlaintextBytes: typeof getPlaintextBytes$1;
-/** @deprecated Use `computeJwtTimeClaims` from `unjwt/internal`; removed in v0.9.0. */
-export declare const computeJwtTimeClaims: typeof computeJwtTimeClaims$1;
-/** @deprecated Use `validateCriticalHeadersJWS` from `unjwt/internal`; removed in v0.9.0. */
-export declare const validateCriticalHeadersJWS: typeof validateCriticalHeadersJWS$1;
-/** @deprecated Use `validateCriticalHeadersJWE` from `unjwt/internal`; removed in v0.9.0. */
-export declare const validateCriticalHeadersJWE: typeof validateCriticalHeadersJWE$1;
-/** @deprecated Use `assertCritShape` from `unjwt/internal`; removed in v0.9.0. */
-export declare const assertCritShape: typeof assertCritShape$1;
+import { JWK } from "./index.mjs";
+import { DigestHash } from "./digest.mjs";
+/** Hash functions RFC 7638 §3.4 leaves open to the application. */
+export type ThumbprintHash = DigestHash;
+/**
+ * The base64url JWK Thumbprint of a key (RFC 7638), over its required members only, so a
+ * public key and its private counterpart share one. `hash` defaults to `"SHA-256"`
+ * (RFC 7638 §3.4); a missing required member or unknown `kty` throws `ERR_JWK_INVALID`.
+ */
+export declare function thumbprint(jwk: JWK, options?: {
+  hash?: ThumbprintHash;
+}): Promise<string>;

package/dist/_chunks/{jwe.d.mts → index4.d.mts}

@@ -1,5 +1,6 @@
+import "./error.mjs";
 import { ContentEncryptionAlgorithm, JOSEPayload, JOSEPayloadMode, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralSerialization, JWEKeyLookup, JWEMultiDecryptKey, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWKSet, JWTClaims, KeyManagementAlgorithm, PayloadOf } from "./index.mjs";
-import "./_internal.mjs";
+import "./limits.mjs";
 /**
  * Encrypt a payload to multiple recipients as JWE General JSON Serialization (RFC 7516 §7.2.1).
  * Each recipient's `alg` comes from `key.alg` (`ERR_JWE_RECIPIENT_ALG_INFERENCE` when absent);
@@ -49,6 +50,7 @@ export declare function encrypt(payload: JOSEPayload, key: CryptoKey | JWEEncryp
 /**
  * Decrypt a JWE Compact Serialization string; `key` may be a lookup function.
  * The payload type follows `options.payload` (claims `T` by default).
+ * A compact JWE has five sections (RFC 7516 §3).
  */
 export declare function decrypt<T extends object = JWTClaims>(jwe: string, key: CryptoKey | JWKSet | JWEDecryptJWK | string | Uint8Array<ArrayBuffer> | JWEKeyLookup, options?: JWEDecryptOptions<"json"> & {
   forceUint8Array?: false;

package/dist/_chunks/{jws.d.mts → index5.d.mts}

@@ -1,5 +1,6 @@
+import "./error.mjs";
 import { JOSEPayload, JOSEPayloadMode, JWKSet, JWSAlgorithm, JWSFlattenedSerialization, JWSGeneralSerialization, JWSKeyLookup, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWTClaims, PayloadOf } from "./index.mjs";
-import "./_internal.mjs";
+import "./limits.mjs";
 /**
  * Signs a payload with multiple signers as a JWS General JSON Serialization (RFC 7515 §7.2.1).
  * Each signer's `alg` is inferred from its key when omitted (`ERR_JWS_SIGNER_ALG_INFERENCE`);
@@ -37,7 +38,10 @@ export declare function verifyMultiAll(jws: JWSGeneralSerialization | JWSFlatten
 export declare function verifyMultiAll<Mode extends JOSEPayloadMode = JOSEPayloadMode>(jws: JWSGeneralSerialization | JWSFlattenedSerialization, keyResolver: JWSKeyLookup, options?: JWSMultiVerifyAllOptions<Mode>): Promise<JWSMultiVerifyOutcome<PayloadOf<Mode>>[]>;
 /** Converts a single-signature General JWS to Flattened form (RFC 7515 §7.2.2); otherwise `ERR_JWS_INVALID_SERIALIZATION`. */
 export declare function generalToFlattenedJWS(jws: JWSGeneralSerialization): JWSFlattenedSerialization;
-/** Creates a JWS Compact Serialization; an object payload is JSON-serialized, `alg` is required unless the JWK carries one. */
+/**
+ * Creates a JWS Compact Serialization; an object payload is JSON-serialized, `alg` is required unless the JWK carries one.
+ * An unencoded (`b64: false`) compact payload cannot contain "." (RFC 7797 §5.2).
+ */
 export declare function sign(payload: JOSEPayload, key: JWSSignJWK, options?: JWSSignOptions): Promise<string>;
 export declare function sign(payload: JOSEPayload, key: CryptoKey | Uint8Array<ArrayBuffer>, options: JWSSignOptions & {
   alg: JWSAlgorithm;

package/dist/_chunks/index6.d.mts

@@ -0,0 +1,113 @@
+import "./libs/unsecure.mjs";
+import "./error.mjs";
+import { JWK, JWKSet, JWK_EC_Private, JWK_EC_Public, JWK_OKP_Private, JWK_OKP_Public, JWK_Private, JWK_Public, JWK_RSA_Private, JWK_RSA_Public, JWK_oct, JWSAlgorithm, KeyManagementAlgorithm } from "./index.mjs";
+import "./digest.mjs";
+import { ComputeJwtTimeClaimsOptions as ComputeJwtTimeClaimsOptions$1, ParsePayloadOptions, applyTypDefault, assertCritShape as assertCritShape$1, computeJwtTimeClaims as computeJwtTimeClaims$1, getPlaintextBytes as getPlaintextBytes$1, parsePayloadBytes, parsePayloadSegment, validateCriticalHeadersJWE as validateCriticalHeadersJWE$1, validateCriticalHeadersJWS as validateCriticalHeadersJWS$1 } from "./jwt.mjs";
+/** Decoder output shape. `"bytes"` aliases `"uint8array"`. */
+export type DecodeReturnAs = "string" | "uint8array" | "bytes";
+export interface Base64ParseOptions {
+  /**
+   * Output shape: UTF-8 text, or the bytes themselves.
+   * @default "string"
+   */
+  returnAs?: DecodeReturnAs;
+}
+/** Encode bytes, or the UTF-8 bytes of a string, as unpadded base64url (RFC 7515 §2). */
+export declare function base64UrlStringify(data: string | Uint8Array): string;
+/** Encode bytes, or the UTF-8 bytes of a string, as padded standard base64 (RFC 4648 §4). */
+export declare function base64Stringify(data: string | Uint8Array): string;
+/**
+ * Decode unpadded base64url (RFC 7515 §2). Strict: only the canonical encoding of a byte string
+ * is accepted, so `=`, whitespace, characters outside the URL-safe alphabet and set bits past
+ * the final byte are rejected; a `string` result must be valid UTF-8.
+ *
+ * @throws {UnsecureError} `MALFORMED` for text that is not such an encoding; `INVALID_TYPE` for input that is not a string
+ */
+export declare function base64UrlParse<T extends DecodeReturnAs>(text: string, options: Base64ParseOptions & {
+  returnAs: T;
+}): T extends "string" ? string : Uint8Array<ArrayBuffer>;
+export declare function base64UrlParse(text: string, options?: Base64ParseOptions): string;
+/**
+ * Decode padded standard base64 (RFC 4648 §4). Strict: the canonical encoding with its `=` run
+ * present, no whitespace, no set bits past the final byte; a `string` result must be valid UTF-8.
+ *
+ * @throws {UnsecureError} `MALFORMED` for text that is not such an encoding; `INVALID_TYPE` for input that is not a string
+ */
+export declare function base64Parse<T extends DecodeReturnAs>(text: string, options: Base64ParseOptions & {
+  returnAs: T;
+}): T extends "string" ? string : Uint8Array<ArrayBuffer>;
+export declare function base64Parse(text: string, options?: Base64ParseOptions): string;
+/** @deprecated Renamed to {@link Base64ParseOptions}; removed in v0.9.0. */
+export type DecodeOptions = Base64ParseOptions;
+/** @deprecated Renamed to {@link base64UrlStringify} in v0.8.0; removed in v0.9.0. */
+export declare const base64UrlEncode: typeof base64UrlStringify;
+/** @deprecated Renamed to {@link base64UrlParse} in v0.8.0; removed in v0.9.0. */
+export declare const base64UrlDecode: typeof base64UrlParse;
+/** @deprecated Renamed to {@link base64Stringify} in v0.8.0; removed in v0.9.0. */
+export declare const base64Encode: typeof base64Stringify;
+/** @deprecated Renamed to {@link base64Parse} in v0.8.0; removed in v0.9.0. */
+export declare const base64Decode: typeof base64Parse;
+/** Concatenate multiple `Uint8Array`s into a single contiguous buffer. */
+export declare function concatUint8Arrays(...arrays: Readonly<Uint8Array<ArrayBuffer>[]>): Uint8Array<ArrayBuffer>;
+/** Wrap a value in an array; returns the array unchanged if already an array. */
+export declare function maybeArray<T>(item: T | T[]): T[];
+/** Whether `key` is a JWK whose `kty` this library models (`oct`, `RSA`, `EC`, `OKP`). */
+export declare function isJWK(key: unknown): key is JWK;
+/** Whether `key` is an object with a `keys` array. */
+export declare function isJWKSet(key: unknown): key is JWKSet;
+/** Asserts that `key` is a `CryptoKey`; throws `ERR_JWK_INVALID` otherwise. */
+export declare function assertCryptoKey(key: unknown): asserts key is CryptoKey;
+/** Whether `key` is a `CryptoKey`, checked via `Symbol.toStringTag` to work across realms. */
+export declare function isCryptoKey(key: unknown): key is CryptoKey;
+/** Whether `key` is a `CryptoKeyPair` of two CryptoKeys. */
+export declare const isCryptoKeyPair: (key: unknown) => key is CryptoKeyPair;
+/** Whether the JWK is symmetric (`oct`); its `k` is always secret. */
+export declare function isSymmetricJWK<T extends JWK>(key: T): key is Extract<T, JWK_oct>;
+export declare function isSymmetricJWK(key: unknown): key is JWK_oct;
+/** Whether the JWK is asymmetric (RSA, EC, OKP). */
+export declare function isAsymmetricJWK<T extends JWK>(key: T): key is Exclude<T, JWK_oct>;
+export declare function isAsymmetricJWK(key: unknown): key is Exclude<JWK, JWK_oct>;
+/**
+ * Whether the JWK holds asymmetric private material (`d`). It is `false` for `oct` keys,
+ * so `!isPrivateJWK(key)` is not a "safe to publish" check; use `isPublicJWK`.
+ */
+export declare function isPrivateJWK<T extends JWK>(key: T): key is Extract<T, JWK_EC_Private | JWK_OKP_Private | JWK_RSA_Private>;
+export declare function isPrivateJWK(key: unknown): key is JWK_Private;
+/** Whether the JWK is an asymmetric public key without `d`: the "safe to publish" check. */
+export declare function isPublicJWK<T extends JWK>(key: T): key is Exclude<Extract<T, JWK_EC_Public | JWK_OKP_Public | JWK_RSA_Public>, JWK_Private>;
+export declare function isPublicJWK(key: unknown): key is JWK_Public;
+/** How a JWK Set's entries are read during algorithm inference. */
+export interface InferAlgorithmsOptions {
+  /** Admit `oct` entries of a JWK Set. Defaults to `false`. */
+  allowSymmetric?: boolean;
+}
+/**
+ * Infer the JWS algorithms a key unambiguously supports, or `undefined` when it cannot
+ * (raw bytes, ambiguous JWK, lookup function) and `options.algorithms` must be passed.
+ */
+export declare function inferJWSAllowedAlgorithms(key: unknown, options?: InferAlgorithmsOptions): JWSAlgorithm[] | undefined;
+/**
+ * Infer the JWE key management algorithms a key unambiguously supports, or `undefined`
+ * when it cannot; a password string infers the PBES2 variants, raw bytes nothing.
+ */
+export declare function inferJWEAllowedAlgorithms(key: unknown, options?: InferAlgorithmsOptions): KeyManagementAlgorithm[] | undefined;
+/** @deprecated Use `ParsePayloadOptions` from `unjwt/internal`; removed in v0.9.0. */
+export type DecodePayloadOptions = ParsePayloadOptions;
+/** @deprecated Use `ComputeJwtTimeClaimsOptions` from `unjwt/internal`; removed in v0.9.0. */
+export type ComputeJwtTimeClaimsOptions = ComputeJwtTimeClaimsOptions$1;
+/** @deprecated Use `applyTypDefault` from `unjwt/internal`; removed in v0.9.0. */
+export declare const applyTypCtyDefaults: typeof applyTypDefault;
+/** @deprecated Use `parsePayloadBytes` from `unjwt/internal`; removed in v0.9.0. */
+export declare const decodePayloadFromBytes: typeof parsePayloadBytes;
+/** @deprecated Use `parsePayloadSegment` from `unjwt/internal`; removed in v0.9.0. */
+export declare const decodePayloadFromB64UrlSegment: typeof parsePayloadSegment;
+/** @deprecated Use `getPlaintextBytes` from `unjwt/internal`; removed in v0.9.0. */
+export declare const getPlaintextBytes: typeof getPlaintextBytes$1;
+/** @deprecated Use `computeJwtTimeClaims` from `unjwt/internal`; removed in v0.9.0. */
+export declare const computeJwtTimeClaims: typeof computeJwtTimeClaims$1;
+/** @deprecated Use `validateCriticalHeadersJWS` from `unjwt/internal`; removed in v0.9.0. */
+export declare const validateCriticalHeadersJWS: typeof validateCriticalHeadersJWS$1;
+/** @deprecated Use `validateCriticalHeadersJWE` from `unjwt/internal`; removed in v0.9.0. */
+export declare const validateCriticalHeadersJWE: typeof validateCriticalHeadersJWE$1;
+/** @deprecated Use `assertCritShape` from `unjwt/internal`; removed in v0.9.0. */
+export declare const assertCritShape: typeof assertCritShape$1;

package/dist/_chunks/jwe.mjs

@@ -1,7 +1,117 @@
-import { sanitizeObjectCopy, secureRandomBytes, textEncoder } from "./libs/unsecure.mjs";
-import { JWTError, applyTypDefault, base64UrlStringify, computeJwtTimeClaims, getPlaintextBytes, isJWK, isJWKSet, validateCriticalHeadersJWE } from "./_jwt-internal.mjs";
-import { isContentEncryptionAlgorithm, isPBES2Algorithm } from "./digest.mjs";
-import { DEFAULT_PBES2_ITERATIONS, JWE_ALG_CTX, JWE_DIRECT_ALGS, asDecryptionError, asKeyLookupError, assertCompactToken, assertConsumerOptions, assertDirectKeyRole, assertEntryLimit, assertJWEAlgSupported, assertJWEEncSupported, assertJWKSetCandidates, assertNoZipOption, assertOptionEntry, assertPBES2Params, assertProducerCEK, assertProducerConfirmation, assertProducerCrit, assertProducerIV, assertProducerKeyHeaders, assertProtectedOnlyOption, assertSerializationObject, buildECDHAgreementParams, buildJWKSetFilter, buildUnwrapKeyOptions, checkAlgAllowed, checkJWEAlgSupported, checkJWEContentSegments, checkJWEDirectEncryptedKey, checkJWEEncAllowed, checkJWEEncSupported, checkJWEUnprotectedCrit, checkJWEZip, checkProtectedTyp, checkSerializationEntry, createPBES2Budget, decodeJWEPayload, decodeProtectedHeader, decodeSegment, decrypt as decrypt$1, encrypt as encrypt$1, encryptKey, exportReturnedCek, generateCEK, generateIV, getJWKsFromSet, importKey, isJWEAlgSupported, keyMatchesHeader, resolveKeyInput, resolveLimit, resolvePasswordKey, resolvePayloadMode, serializeProtectedHeader, unwrapKey, validateClaimsIfJson } from "./jwk.mjs";
+import { secureRandomBytes, textEncoder } from "./libs/unsecure.mjs";
+import { JWTError } from "../error.mjs";
+import { applyTypDefault, base64UrlStringify, computeJwtTimeClaims, getPlaintextBytes, isCryptoKey, isJWK, isJWKSet, parsePayloadBytes, validateCriticalHeadersJWE } from "./jwt.mjs";
+import { DEFAULT_PBES2_ITERATIONS, asDecryptionError, asKeyLookupError, assertCompactToken, assertConsumerOptions, assertDirectKeyRole, assertEntryLimit, assertJWEEncSupported, assertJWKSetCandidates, assertOptionEntry, assertPBES2Iterations, assertPBES2Params, assertProducerConfirmation, assertProducerCrit, assertProducerKeyHeaders, assertProtectedOnlyOption, assertSerializationObject, bitLengthCEK, bitLengthIV, bitLengthTag, buildECDHAgreementParams, buildJWKSetFilter, checkAlgAllowed, checkAlgSupported, checkJWEEncSupported, checkProtectedTyp, checkSerializationEntry, copyJsonObject, decodeProtectedHeader, decodeSegment, decrypt as decrypt$1, encrypt as encrypt$1, encryptKey, generateCEK, generateIV, getJWKsFromSet, importKey, keyMatchesHeader, resolveKeyInput, resolveLimit, resolvePasswordKey, serializeProtectedHeader } from "./algorithms.mjs";
+import { inferJWEAllowedAlgorithms, isContentEncryptionAlgorithm, isKeyManagementAlgorithm, isPBES2Algorithm } from "./digest.mjs";
+import { resolvePayloadMode, validateClaimsIfJson } from "./payload.mjs";
+import { unwrapKey } from "./wrap.mjs";
+const JWE_ALG_CTX = /* @__PURE__ */ Object.freeze({
+	infer: inferJWEAllowedAlgorithms,
+	octRoles: true,
+	errorCode: "ERR_JWE_ALG_NOT_ALLOWED",
+	label: "Key management algorithm",
+	op: "enc"
+});
+const JWE_DIRECT_ALGS = /* @__PURE__ */ new Set(["dir", "ECDH-ES"]);
+function checkJWEAlgSupported(alg) {
+	return checkAlgSupported(alg, {
+		supported: isKeyManagementAlgorithm,
+		code: "ERR_JWE_ALG_NOT_ALLOWED",
+		label: "Key management algorithm",
+		role: "key management algorithm"
+	});
+}
+function isJWEAlgSupported(alg) {
+	return isKeyManagementAlgorithm(alg);
+}
+function assertJWEAlgSupported(alg) {
+	const error = checkJWEAlgSupported(alg);
+	if (error) throw error;
+}
+function checkJWEEncAllowed(enc, encryptionAlgorithms) {
+	if (encryptionAlgorithms === void 0 || encryptionAlgorithms.includes(enc)) return void 0;
+	return new JWTError(`Content encryption algorithm not allowed: ${enc}`, "ERR_JWE_ALG_NOT_ALLOWED");
+}
+function assertProducerCEK(cek, enc) {
+	if (cek === void 0) return;
+	const expected = bitLengthCEK(enc) >> 3;
+	if (!(cek instanceof Uint8Array) || cek.length !== expected) throw new JWTError(`"cek" must be ${expected} bytes for ${enc}.`, "ERR_INVALID_OPTION");
+}
+function assertProducerIV(iv, enc) {
+	if (iv === void 0) return;
+	const expected = bitLengthIV(enc) >> 3;
+	if (!(iv instanceof Uint8Array) || iv.length !== expected) throw new JWTError(`"contentEncryptionIV" must be ${expected} bytes for ${enc}.`, "ERR_INVALID_OPTION");
+}
+function checkJWEDirectEncryptedKey(alg, encryptedKey) {
+	if (!JWE_DIRECT_ALGS.has(alg) || !encryptedKey) return void 0;
+	return new JWTError(`Invalid JWE: Encrypted key must be empty for ${alg}.`, "ERR_JWE_INVALID");
+}
+function checkJWEContentSegments(enc, iv, tag) {
+	const ivBytes = bitLengthIV(enc) >> 3;
+	if (iv.length !== ivBytes) return new JWTError(`Invalid JWE: Initialization vector must be ${ivBytes} bytes for ${enc} (got ${iv.length}).`, "ERR_JWE_INVALID");
+	const tagBytes = bitLengthTag(enc) >> 3;
+	if (tag.length !== tagBytes) return new JWTError(`Invalid JWE: Authentication tag must be ${tagBytes} bytes for ${enc} (got ${tag.length}).`, "ERR_JWE_INVALID");
+}
+function checkJWEZip(header) {
+	if (!header || !Object.hasOwn(header, "zip")) return void 0;
+	return new JWTError("Invalid JWE: compression is not supported.", "ERR_JWE_INVALID");
+}
+function assertNoZipOption(header, tier) {
+	if (!header || !Object.hasOwn(header, "zip")) return;
+	throw new JWTError(`JWE compression ("zip") in the ${tier} header is not supported.`, "ERR_INVALID_OPTION");
+}
+function checkJWEUnprotectedCrit(header) {
+	if (!header || !Object.hasOwn(header, "crit")) return void 0;
+	return new JWTError("Invalid JWE: \"crit\" must be integrity protected.", "ERR_JWE_INVALID");
+}
+function createPBES2Budget(limit) {
+	let remaining = limit;
+	return { spend(attempt) {
+		const { alg, p2c } = attempt;
+		if (!alg.startsWith("PBES2")) return;
+		if (typeof p2c !== "number" || !(p2c > 0)) return;
+		assertPBES2Iterations(p2c, attempt);
+		if (p2c > remaining) throw new JWTError(`PBES2 iteration budget of ${limit} exhausted.`, "ERR_JWE_INVALID");
+		remaining -= p2c;
+	} };
+}
+const JWE_ENC_CEK_FORMAT = /* @__PURE__ */ Object.freeze({
+	"A128GCM": "cryptokey",
+	"A192GCM": "cryptokey",
+	"A256GCM": "cryptokey",
+	"A128CBC-HS256": "raw",
+	"A192CBC-HS384": "raw",
+	"A256CBC-HS512": "raw"
+});
+async function exportReturnedCek(cek) {
+	if (!isCryptoKey(cek)) return cek;
+	if (!cek.extractable) throw new JWTError("\"returnCek\" requires an extractable content encryption key.", "ERR_INVALID_OPTION");
+	return new Uint8Array(await crypto.subtle.exportKey("raw", cek));
+}
+function cekFormatForEnc(enc) {
+	return JWE_ENC_CEK_FORMAT[enc];
+}
+function buildUnwrapKeyOptions(header, algorithms, options) {
+	const { alg, enc } = algorithms;
+	const opts = {
+		alg,
+		enc,
+		format: cekFormatForEnc(enc),
+		keyUsage: options?.keyUsage || ["decrypt"]
+	};
+	if (header.iv) opts.iv = header.iv;
+	if (header.tag) opts.tag = header.tag;
+	if (header.p2s) opts.p2s = header.p2s;
+	if (header.p2c) opts.p2c = header.p2c;
+	if (header.epk) opts.epk = header.epk;
+	if (header.apu) opts.apu = header.apu;
+	if (header.apv) opts.apv = header.apv;
+	if (options?.unwrappedKeyAlgorithm) opts.unwrappedKeyAlgorithm = options.unwrappedKeyAlgorithm;
+	if (options?.extractable !== void 0) opts.extractable = options.extractable;
+	if (options?.minIterations !== void 0) opts.minIterations = options.minIterations;
+	if (options?.maxIterations !== void 0) opts.maxIterations = options.maxIterations;
+	return opts;
+}
 function buildKeyManagementParams(alg, source) {
 	const { keyManagementIV, p2s, p2c, ecdh } = source;
 	const isPBES2 = alg.startsWith("PBES2");
@@ -61,6 +171,77 @@ async function unwrapAndDecrypt(alg, rawKeyMaterial, options) {
 		throw asDecryptionError(err);
 	}
 }
+function decodeJWEPayload(plaintext, mode) {
+	return parsePayloadBytes(plaintext, {
+		payload: mode,
+		family: "JWE"
+	});
+}
+function _resolveRecipientAlg(key, index) {
+	if (!isJWK(key)) throw new JWTError(`Recipient[${index}] key is not a JWK.`, "ERR_JWE_RECIPIENT_ALG_INFERENCE");
+	const declared = key.alg;
+	if (!declared) throw new JWTError(`Cannot infer "alg" for recipient[${index}]: the JWK has no "alg" property.`, "ERR_JWE_RECIPIENT_ALG_INFERENCE");
+	const alg = key.kty === "oct" && isContentEncryptionAlgorithm(declared) ? "dir" : declared;
+	if (JWE_DIRECT_ALGS.has(alg)) throw new JWTError(`Recipient[${index}] "${alg}" allows a single recipient, use encrypt().`, "ERR_JWE_ALG_FORBIDDEN_IN_MULTI");
+	assertJWEAlgSupported(alg);
+	return alg;
+}
+function _buildPerRecipientHeader(recipient, alg, keyMgmtOut) {
+	const header = {};
+	if (recipient.key.kid) header.kid = recipient.key.kid;
+	const userHeader = copyJsonObject(recipient.header, {
+		code: "ERR_INVALID_OPTION",
+		message: "A recipient \"header\" must hold only JSON values."
+	});
+	if (userHeader) Object.assign(header, userHeader);
+	if (keyMgmtOut) Object.assign(header, keyMgmtOut);
+	header.alg = alg;
+	return header;
+}
+function _assertDisjointHeaders(protectedHeader, sharedUnprotected, recipientHeader) {
+	const seen = /* @__PURE__ */ new Set();
+	const check = (obj) => {
+		if (!obj) return;
+		for (const k of Object.keys(obj)) {
+			if (seen.has(k)) throw new JWTError(`Invalid JWE: header parameter "${k}" is set in more than one header.`, "ERR_JWE_HEADER_PARAMS_NOT_DISJOINT");
+			seen.add(k);
+		}
+	};
+	check(protectedHeader);
+	check(sharedUnprotected);
+	check(recipientHeader);
+}
+function _mergeHeaders(protectedHeader, sharedUnprotected, recipientHeader) {
+	const merged = { ...protectedHeader };
+	if (sharedUnprotected) Object.assign(merged, sharedUnprotected);
+	if (recipientHeader) Object.assign(merged, recipientHeader);
+	return merged;
+}
+function _normalizeSerialization(input) {
+	assertSerializationObject(input, "JWE");
+	if ("recipients" in input) {
+		if ("encrypted_key" in input || "header" in input) throw new JWTError("Invalid JWE JSON Serialization: \"recipients\" excludes top-level \"header\" and \"encrypted_key\".", "ERR_JWE_INVALID_SERIALIZATION");
+		return input;
+	}
+	const flattened = input;
+	const recipient = {};
+	if (flattened.header !== void 0) recipient.header = flattened.header;
+	if (flattened.encrypted_key !== void 0) recipient.encrypted_key = flattened.encrypted_key;
+	const general = {
+		recipients: [recipient],
+		iv: flattened.iv,
+		ciphertext: flattened.ciphertext,
+		tag: flattened.tag
+	};
+	if (flattened.protected !== void 0) general.protected = flattened.protected;
+	if (flattened.unprotected !== void 0) general.unprotected = flattened.unprotected;
+	if (flattened.aad !== void 0) general.aad = flattened.aad;
+	return general;
+}
+function _assertAADOption(aad) {
+	if (aad === void 0 || typeof aad === "string" || aad instanceof Uint8Array) return;
+	throw new JWTError("\"aad\" must be a string or a Uint8Array.", "ERR_INVALID_OPTION");
+}
 async function encryptMulti(payload, recipients, options = {}) {
 	if (!Array.isArray(recipients) || recipients.length === 0) throw new JWTError("encryptMulti requires at least one recipient.", "ERR_JWE_INVALID");
 	assertOptionEntry(options, {
@@ -108,8 +289,14 @@ async function encryptMulti(payload, recipients, options = {}) {
 		p2s: recipient.p2s,
 		p2c: recipient.p2c
 	});
-	const userProtected = sanitizeObjectCopy(options.protectedHeader);
-	const sharedUnprotected = sanitizeObjectCopy(options.sharedUnprotectedHeader);
+	const userProtected = copyJsonObject(options.protectedHeader, {
+		code: "ERR_INVALID_OPTION",
+		message: "\"protectedHeader\" must hold only JSON values."
+	});
+	const sharedUnprotected = copyJsonObject(options.sharedUnprotectedHeader, {
+		code: "ERR_INVALID_OPTION",
+		message: "\"sharedUnprotectedHeader\" must hold only JSON values."
+	});
 	const protectedHeader = {};
 	if (userProtected) Object.assign(protectedHeader, userProtected);
 	protectedHeader.enc = enc;
@@ -178,7 +365,10 @@ async function decryptMulti(jwe, keyOrLookup, options = {}) {
 	if (envelopeError) throw envelopeError;
 	const protectedHeaderEncoded = general.protected ?? "";
 	const protectedHeader = decodeProtectedHeader(protectedHeaderEncoded || void 0, "JWE");
-	const sharedUnprotected = sanitizeObjectCopy(general.unprotected);
+	const sharedUnprotected = copyJsonObject(general.unprotected, {
+		code: "ERR_JWE_INVALID",
+		message: "Invalid JWE JSON Serialization: \"unprotected\" must hold only JSON values."
+	});
 	const sharedError = checkJWEZip(protectedHeader) ?? checkJWEUnprotectedCrit(sharedUnprotected) ?? checkJWEZip(sharedUnprotected);
 	if (sharedError) throw sharedError;
 	_assertDisjointHeaders(protectedHeader, sharedUnprotected, void 0);
@@ -219,7 +409,10 @@ async function decryptMulti(jwe, keyOrLookup, options = {}) {
 			continue;
 		}
 		const wireRecipient = general.recipients[i];
-		const recipientHeader = sanitizeObjectCopy(wireRecipient.header);
+		const recipientHeader = copyJsonObject(wireRecipient.header, {
+			code: "ERR_JWE_INVALID",
+			message: "Invalid JWE JSON Serialization: a recipient \"header\" must hold only JSON values."
+		});
 		const recipientError = checkJWEUnprotectedCrit(recipientHeader) ?? checkJWEZip(recipientHeader);
 		if (recipientError) {
 			lastError = recipientError;
@@ -334,68 +527,6 @@ function generalToFlattened(jwe) {
 	if (recipient.encrypted_key !== void 0) flattened.encrypted_key = recipient.encrypted_key;
 	return flattened;
 }
-function _resolveRecipientAlg(key, index) {
-	if (!isJWK(key)) throw new JWTError(`Recipient[${index}] key is not a JWK.`, "ERR_JWE_RECIPIENT_ALG_INFERENCE");
-	const declared = key.alg;
-	if (!declared) throw new JWTError(`Cannot infer "alg" for recipient[${index}]: the JWK has no "alg" property.`, "ERR_JWE_RECIPIENT_ALG_INFERENCE");
-	const alg = key.kty === "oct" && isContentEncryptionAlgorithm(declared) ? "dir" : declared;
-	if (JWE_DIRECT_ALGS.has(alg)) throw new JWTError(`Recipient[${index}] resolves to "${alg}", which requires exactly one recipient. Use encrypt() instead.`, "ERR_JWE_ALG_FORBIDDEN_IN_MULTI");
-	assertJWEAlgSupported(alg);
-	return alg;
-}
-function _buildPerRecipientHeader(recipient, alg, keyMgmtOut) {
-	const header = {};
-	if (recipient.key.kid) header.kid = recipient.key.kid;
-	const userHeader = sanitizeObjectCopy(recipient.header);
-	if (userHeader) Object.assign(header, userHeader);
-	if (keyMgmtOut) Object.assign(header, keyMgmtOut);
-	header.alg = alg;
-	return header;
-}
-function _assertDisjointHeaders(protectedHeader, sharedUnprotected, recipientHeader) {
-	const seen = /* @__PURE__ */ new Set();
-	const check = (obj) => {
-		if (!obj) return;
-		for (const k of Object.keys(obj)) {
-			if (seen.has(k)) throw new JWTError(`JWE header parameter "${k}" appears in multiple header tiers; protected, shared unprotected, and per-recipient headers must be disjoint (RFC 7516 §7.2.1).`, "ERR_JWE_HEADER_PARAMS_NOT_DISJOINT");
-			seen.add(k);
-		}
-	};
-	check(protectedHeader);
-	check(sharedUnprotected);
-	check(recipientHeader);
-}
-function _mergeHeaders(protectedHeader, sharedUnprotected, recipientHeader) {
-	const merged = { ...protectedHeader };
-	if (sharedUnprotected) Object.assign(merged, sharedUnprotected);
-	if (recipientHeader) Object.assign(merged, recipientHeader);
-	return merged;
-}
-function _normalizeSerialization(input) {
-	assertSerializationObject(input, "JWE");
-	if ("recipients" in input) {
-		if ("encrypted_key" in input || "header" in input) throw new JWTError("Invalid JWE JSON Serialization: \"recipients\" must not be combined with a top-level \"header\" or \"encrypted_key\".", "ERR_JWE_INVALID_SERIALIZATION");
-		return input;
-	}
-	const flattened = input;
-	const recipient = {};
-	if (flattened.header !== void 0) recipient.header = flattened.header;
-	if (flattened.encrypted_key !== void 0) recipient.encrypted_key = flattened.encrypted_key;
-	const general = {
-		recipients: [recipient],
-		iv: flattened.iv,
-		ciphertext: flattened.ciphertext,
-		tag: flattened.tag
-	};
-	if (flattened.protected !== void 0) general.protected = flattened.protected;
-	if (flattened.unprotected !== void 0) general.unprotected = flattened.unprotected;
-	if (flattened.aad !== void 0) general.aad = flattened.aad;
-	return general;
-}
-function _assertAADOption(aad) {
-	if (aad === void 0 || typeof aad === "string" || aad instanceof Uint8Array) return;
-	throw new JWTError("\"aad\" must be a string or a Uint8Array.", "ERR_INVALID_OPTION");
-}
 async function encrypt(payload, key, options = {}) {
 	assertOptionEntry(options, {
 		label: "options",
@@ -416,7 +547,7 @@ async function encrypt(payload, key, options = {}) {
 		else if (cekRole) alg = "dir";
 		else if (isJWK(key)) alg = key.alg;
 	}
-	if (!alg) throw new JWTError("JWE \"alg\" (Key Management Algorithm) must be provided in options or inferable from the key", "ERR_JWE_ALG_MISSING");
+	if (!alg) throw new JWTError("JWE \"alg\" must be provided in options or inferable from the key", "ERR_JWE_ALG_MISSING");
 	if (!enc) {
 		if (alg === "dir") {
 			enc = cekRole ?? (isJWK(key) ? key.enc : void 0);
@@ -466,7 +597,7 @@ async function decrypt(jwe, key, options = {}) {
 	const keyCandidateLimit = resolveLimit(options.limits, "keyCandidates");
 	const pbes2Budget = createPBES2Budget(resolveLimit(options.limits, "pbes2Iterations"));
 	const parts = jwe.split(".");
-	if (parts.length !== 5) throw new JWTError("Invalid JWE: Must contain five sections (RFC7516, section-3).", "ERR_JWE_INVALID");
+	if (parts.length !== 5) throw new JWTError("Invalid JWE: Must contain five sections.", "ERR_JWE_INVALID");
 	const [protectedHeaderEncoded, encryptedKeyEncoded, ivEncoded, ciphertextEncoded, authTagEncoded] = parts;
 	const protectedHeader = decodeProtectedHeader(protectedHeaderEncoded, "JWE");
 	assertHeaderAlgorithms(protectedHeader);
@@ -538,7 +669,10 @@ async function decrypt(jwe, key, options = {}) {
 	return result;
 }
 function _buildJWEHeader(alg, enc, key, userHeader, keyManagementParams, payload) {
-	const safeHeader = sanitizeObjectCopy(userHeader);
+	const safeHeader = copyJsonObject(userHeader, {
+		code: "ERR_INVALID_OPTION",
+		message: "\"protectedHeader\" must hold only JSON values."
+	});
 	const header = {};
 	if (isJWK(key) && key.kid) header.kid = key.kid;
 	if (safeHeader) Object.assign(header, safeHeader);
@@ -550,7 +684,7 @@ function _buildJWEHeader(alg, enc, key, userHeader, keyManagementParams, payload
 	return header;
 }
 function assertHeaderAlgorithms(header) {
-	if (!header.alg || !header.enc) throw new JWTError("Invalid JWE: Protected header must be an object with \"alg\" and \"enc\" properties.", "ERR_JWE_INVALID");
+	if (!header.alg || !header.enc) throw new JWTError("Invalid JWE: Protected header must carry \"alg\" and \"enc\".", "ERR_JWE_INVALID");
 	assertJWEAlgSupported(header.alg);
 	assertJWEEncSupported(header.enc);
 }