@suveren/gateway 0.36.1 → 0.37.0

package/node_modules/fast-uri/test/reserved-path-normalization.test.js

@@ -77,13 +77,13 @@ test('serialize uses the RFC 3986 path character set without opening escapes', (
   )
   t.equal(
     fastURI.serialize({ path: './a:b/c:d' }),
-    'a%3Ab/c:d',
-    'escapes a first-segment colon exposed by dot-segment removal'
+    './a:b/c:d',
+    'a first-segment colon exposed by dot-segment removal is kept behind a "." segment'
   )
   t.equal(
     fastURI.normalize('./a:b'),
-    'a%3Ab',
-    'normalization keeps a relative path from becoming a scheme'
+    './a:b',
+    'normalization keeps a relative path from becoming a scheme without re-encoding the colon'
   )
   t.equal(
     fastURI.serialize({ path: '/Kſ' }),
@@ -107,3 +107,31 @@ test('equal distinguishes escaped reserved path data from literal syntax', (t) =
   )
   t.end()
 })
+
+// A suffix reference never emits its scheme token, so it is a scheme-less
+// (path-noscheme) reference: a bare ':' in its first path segment must be
+// escaped, or the serialized output reparses as an absolute URI with a scheme.
+// @see https://github.com/fastify/fast-uri/security/advisories/GHSA-333x-w4r6-6crp
+test('suffix reference escapes a first-segment colon instead of emitting a scheme', (t) => {
+  const dangerous = /^(?:javascript|data|vbscript):/i
+  const options = { reference: 'suffix', scheme: 'x' }
+
+  for (const input of ['javascript:alert(1)', '%6Aavascript:alert(1)', 'data:text/html,x', 'vbscript:msgbox(1)']) {
+    t.notOk(dangerous.test(fastURI.normalize(input, options)), `${input} normalizes to an inert reference`)
+  }
+
+  t.equal(
+    fastURI.normalize('javascript:alert(1)', options),
+    'javascript%3Aalert(1)',
+    'escapes the leading-segment colon to %3A'
+  )
+  t.notOk(
+    dangerous.test(fastURI.resolve('https://a.example/base/', '%6Aavascript:alert(1)', { reference: 'suffix' })),
+    'resolve in suffix mode does not emit a live scheme'
+  )
+
+  // legitimate suffix usage is unchanged
+  t.equal(fastURI.normalize('path/to/file', options), 'path/to/file', 'plain path unchanged')
+  t.equal(fastURI.normalize('a/b:c', options), 'a/b:c', 'colon in a later segment stays literal')
+  t.end()
+})

package/node_modules/fast-uri/test/scheme-validation.test.js

@@ -15,7 +15,15 @@ const malformedSchemes = [
   'foo_bar:value',
   'éxample:value',
   'Kttp://example.com/',
-  'ſcheme:value'
+  'ſcheme:value',
+  // RFC 3986 section 3.1 does not allow percent-encoding in a scheme.
+  '%4Aavascript:alert(1)',
+  '%6aavascript:alert(1)',
+  'foo%2Bbar:value',
+  '%u006Aavascript:1',
+  'ht%74ps://example.com/',
+  'ma%69lto:user@example.org',
+  '%64ata:text/html,x'
 ]
 
 test('parse validates the decoded scheme against RFC 3986', (t) => {
@@ -23,10 +31,7 @@ test('parse validates the decoded scheme against RFC 3986', (t) => {
     ['a:value', 'a'],
     ['HTTP://example.com/', 'http'],
     ['a1+.-:value', 'a1+.-'],
-    ['%4Aavascript:alert(1)', 'javascript'],
-    ['foo%2Bbar:value', 'foo+bar'],
-    ['%u006Aavascript:1', 'javascript'],
-    ['ht%74ps://example.com/', 'https']
+    ['foo+bar:value', 'foo+bar']
   ]
 
   for (const [uri, scheme] of validSchemes) {
@@ -42,17 +47,41 @@ test('parse validates the decoded scheme against RFC 3986', (t) => {
   t.end()
 })
 
-test('decoded schemes select their scheme handlers', (t) => {
+test('percent-encoded schemes do not select scheme handlers', (t) => {
   t.equal(
     fastURI.normalize('ht%74ps://example.com:443'),
-    'https://example.com/',
-    'HTTP normalization runs after decoding the scheme'
+    'ht%74ps://example.com:443',
+    'HTTP normalization does not run for an encoded scheme'
   )
 
   // 3.x has no mailto scheme handler (added in v4); use the ws handler to
-  // verify that a percent-encoded scheme still selects its scheme handler
-  const ws = fastURI.parse('we%62socket://example.com/')
-  t.equal(ws.scheme, 'websocket', 'ws parsing runs after decoding the scheme')
+  // verify that a percent-encoded scheme does not select its scheme handler
+  const ws = fastURI.parse('w%73://example.com/a?b')
+  t.equal(ws.resourceName, undefined, 'ws parsing does not run for an encoded scheme')
+  t.equal(ws.error, MALFORMED_SCHEME_ERROR)
+  t.end()
+})
+
+test('normalization cannot synthesize a scheme from encoded input', (t) => {
+  const inputs = [
+    '%6Aavascript:alert(1)',
+    '%4A%41%56%41%53%43%52%49%50%54:alert(1)',
+    '%u006Aavascript:alert(1)',
+    'j%61vascript:alert(1)',
+    '%64ata:text/html,<script>alert(1)</script>',
+    'vb%73cript:msgbox(1)'
+  ]
+
+  for (const uri of inputs) {
+    const parsed = fastURI.parse(uri)
+    t.equal(parsed.error, MALFORMED_SCHEME_ERROR, uri + ' is malformed')
+    t.notOk(/^(?:javascript|data|vbscript):/i.test(String(parsed.scheme) + ':'), uri + ' parsed scheme is not decoded')
+    t.equal(fastURI.normalize(uri), uri, uri + ' normalizes to itself')
+    t.equal(fastURI.equal(uri, uri), false, uri + ' is not comparable')
+    t.throws(() => fastURI.resolve('https://example.com/app/', uri), /URI scheme is malformed\./, uri + ' is rejected by resolve')
+  }
+
+  t.equal(fastURI.equal('%68ttp://a/', 'http://a/'), false, 'encoded scheme does not alias a plain scheme')
   t.end()
 })
 
@@ -95,11 +124,21 @@ test('resolve rejects malformed decoded schemes in either input', (t) => {
   t.end()
 })
 
-test('serialize validates decoded component schemes', (t) => {
+test('serialize validates component schemes without decoding them', (t) => {
   t.equal(
-    fastURI.serialize({ scheme: 'foo%2Bbar', path: 'value' }),
+    fastURI.serialize({ scheme: 'foo+bar', path: 'value' }),
     'foo+bar:value',
-    'valid decoded scheme is serialized'
+    'valid scheme is serialized'
+  )
+  t.throws(
+    () => fastURI.serialize({ scheme: 'foo%2Bbar', path: 'value' }),
+    /URI scheme is malformed\./,
+    'percent-encoded scheme is rejected'
+  )
+  t.throws(
+    () => fastURI.serialize({ scheme: '%6Aavascript', path: 'alert(1)' }),
+    /URI scheme is malformed\./,
+    'encoded scheme cannot serialize as javascript:'
   )
   t.throws(
     () => fastURI.serialize({ scheme: '//evil.example', path: '/pwn' }),

package/node_modules/jose/README.md

@@ -70,7 +70,7 @@ The `jose` module supports importing, exporting, and generating keys and secrets
 
 ### JSON Web Signature (JWS)
 
-The `jose` module supports signing and verification of JWS messages with arbitrary payloads in Compact, Flattened JSON, and General JSON serialization syntaxes.
+The `jose` module supports digital signature and MAC computation and validation over arbitrary JWS Payloads using the JWS Compact Serialization and the flattened and general JWS JSON Serialization syntaxes ([RFC 7515, Section 7](https://www.rfc-editor.org/info/rfc7515/#section-7)).
 
 - Signing - [Compact](docs/jws/compact/sign/classes/CompactSign.md), [Flattened JSON](docs/jws/flattened/sign/classes/FlattenedSign.md), [General JSON](docs/jws/general/sign/classes/GeneralSign.md)
 - Verification - [Compact](docs/jws/compact/verify/functions/compactVerify.md), [Flattened JSON](docs/jws/flattened/verify/functions/flattenedVerify.md), [General JSON](docs/jws/general/verify/functions/generalVerify.md)
@@ -81,7 +81,7 @@ The `jose` module supports signing and verification of JWS messages with arbitra
 
 ### JSON Web Encryption (JWE)
 
-The `jose` module supports encryption and decryption of JWE messages with arbitrary plaintext in Compact, Flattened JSON, and General JSON serialization syntaxes.
+The `jose` module supports encryption and authenticated decryption of arbitrary plaintext using the JWE Compact Serialization and the flattened and general JWE JSON Serialization syntaxes ([RFC 7516, Section 7](https://www.rfc-editor.org/info/rfc7516/#section-7)).
 
 - Encryption - [Compact](docs/jwe/compact/encrypt/classes/CompactEncrypt.md), [Flattened JSON](docs/jwe/flattened/encrypt/classes/FlattenedEncrypt.md), [General JSON](docs/jwe/general/encrypt/classes/GeneralEncrypt.md)
 - Decryption - [Compact](docs/jwe/compact/decrypt/functions/compactDecrypt.md), [Flattened JSON](docs/jwe/flattened/decrypt/functions/flattenedDecrypt.md), [General JSON](docs/jwe/general/decrypt/functions/generalDecrypt.md)

package/node_modules/jose/dist/types/jwe/compact/decrypt.d.ts

@@ -3,21 +3,22 @@ import type * as t from '../../types.d.ts';
 export interface CompactDecryptGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.CompactJWEHeaderParameters, t.FlattenedJWE, KeyType | t.KeyObject | t.JWK> {
 }
 /**
- * Decrypts a Compact JWE.
+ * Authenticates and decrypts a JWE Compact Serialization.
  *
  * @param key Private key or shared secret. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  */
 export declare function compactDecrypt(jwe: string | Uint8Array, key: t.KeyInput, options?: t.DecryptOptions): Promise<t.CompactDecryptResult>;
 /**
- * Decrypts a Compact JWE with a dynamically resolved key, included in the result.
+ * Authenticates and decrypts a JWE Compact Serialization with a dynamically resolved key, included
+ * in the result.
  *
  * @param getKey Resolves a private key or shared secret from unverified token data.
  */
 export declare function compactDecrypt<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jwe: string | Uint8Array, getKey: CompactDecryptGetKey<KeyType>, options?: t.DecryptOptions): Promise<t.CompactDecryptResult & t.ResolvedKey<KeyType>>;
 /**
- * Decrypts a Compact JWE with a key or key resolver. The result includes `key` only when a resolver
- * is used.
+ * Authenticates and decrypts a JWE Compact Serialization with a key or key resolver. The result
+ * includes `key` only when a resolver is used.
  *
  * @param key Private key or shared secret, or a function resolving one.
  */

package/node_modules/jose/dist/types/jwe/compact/encrypt.d.ts

@@ -1,9 +1,9 @@
 import type * as t from '../../types.d.ts';
-/** Builds and encrypts Compact JWE strings. */
+/** Produces JWE Compact Serialization using authenticated encryption. */
 export declare class CompactEncrypt {
     #private;
     /**
-     * Creates a Compact JWE encryptor.
+     * Creates an encryptor for JWE Compact Serialization.
      *
      * @param plaintext Binary representation of the plaintext to encrypt.
      */
@@ -26,12 +26,12 @@ export declare class CompactEncrypt {
     setProtectedHeader(protectedHeader: t.CompactJWEHeaderParameters): this;
     /**
      * Sets key management inputs such as ECDH-ES "apu"/"apv" or PBES2 "p2c". Use this method instead
-     * of header setters; the resulting parameters are added to the JOSE header. May only be called
+     * of header setters; the resulting parameters are added to the JOSE Header. May only be called
      * once.
      */
     setKeyManagementParameters(parameters: t.JWEKeyManagementHeaderParameters): this;
     /**
-     * Encrypts the plaintext as a Compact JWE.
+     * Encrypts the plaintext and returns the JWE Compact Serialization.
      *
      * @param key Public key or shared secret. See
      *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.

package/node_modules/jose/dist/types/jwe/flattened/decrypt.d.ts

@@ -3,21 +3,22 @@ import type * as t from '../../types.d.ts';
 export interface FlattenedDecryptGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.JWEHeaderParameters | undefined, t.FlattenedJWE, KeyType | t.KeyObject | t.JWK> {
 }
 /**
- * Decrypts a Flattened JWE.
+ * Authenticates and decrypts a flattened JWE JSON Serialization.
  *
  * @param key Private key or shared secret. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  */
 export declare function flattenedDecrypt(jwe: t.FlattenedJWE, key: t.KeyInput, options?: t.DecryptOptions): Promise<t.FlattenedDecryptResult>;
 /**
- * Decrypts a Flattened JWE with a dynamically resolved key, included in the result.
+ * Authenticates and decrypts a flattened JWE JSON Serialization with a dynamically resolved key,
+ * included in the result.
  *
  * @param getKey Resolves a private key or shared secret from unverified token data.
  */
 export declare function flattenedDecrypt<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jwe: t.FlattenedJWE, getKey: FlattenedDecryptGetKey<KeyType>, options?: t.DecryptOptions): Promise<t.FlattenedDecryptResult & t.ResolvedKey<KeyType>>;
 /**
- * Decrypts a Flattened JWE with a key or key resolver. The result includes `key` only when a
- * resolver is used.
+ * Authenticates and decrypts a flattened JWE JSON Serialization with a key or key resolver. The
+ * result includes `key` only when a resolver is used.
  *
  * @param key Private key or shared secret, or a function resolving one.
  */

package/node_modules/jose/dist/types/jwe/flattened/encrypt.d.ts

@@ -1,16 +1,16 @@
 import type * as t from '../../types.d.ts';
-/** Builds and encrypts Flattened JWE objects. */
+/** Produces flattened JWE JSON Serialization using authenticated encryption. */
 export declare class FlattenedEncrypt {
     #private;
     /**
-     * Creates a Flattened JWE encryptor.
+     * Creates an encryptor for flattened JWE JSON Serialization.
      *
      * @param plaintext Binary representation of the plaintext to encrypt.
      */
     constructor(plaintext: Uint8Array);
     /**
      * Sets key management inputs such as ECDH-ES "apu"/"apv" or PBES2 "p2c". Use this method instead
-     * of header setters; the resulting parameters are added to the JOSE header. May only be called
+     * of header setters; the resulting parameters are added to the JOSE Header. May only be called
      * once.
      */
     setKeyManagementParameters(parameters: t.JWEKeyManagementHeaderParameters): this;
@@ -20,7 +20,7 @@ export declare class FlattenedEncrypt {
     setSharedUnprotectedHeader(sharedUnprotectedHeader: t.JWEHeaderParameters): this;
     /** Sets the JWE Per-Recipient Unprotected Header. May only be called once. */
     setUnprotectedHeader(unprotectedHeader: t.JWEHeaderParameters): this;
-    /** Sets additional data to authenticate without encrypting it. */
+    /** Sets the JWE AAD, which is integrity protected but not encrypted. */
     setAdditionalAuthenticatedData(aad: Uint8Array): this;
     /**
      * Sets a content encryption key instead of generating a random one for the JWE "enc" algorithm.
@@ -37,7 +37,7 @@ export declare class FlattenedEncrypt {
      */
     setInitializationVector(iv: Uint8Array): this;
     /**
-     * Encrypts the plaintext as a Flattened JWE.
+     * Encrypts the plaintext and returns the flattened JWE JSON Serialization.
      *
      * @param key Public key or shared secret. See
      *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.

package/node_modules/jose/dist/types/jwe/general/decrypt.d.ts

@@ -3,7 +3,7 @@ import type * as t from '../../types.d.ts';
 export interface GeneralDecryptGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.JWEHeaderParameters | undefined, t.FlattenedJWE, KeyType | t.KeyObject | t.JWK> {
 }
 /**
- * Decrypts a General JWE.
+ * Authenticates and decrypts a general JWE JSON Serialization.
  *
  * > Note: Returns plaintext and headers from the first recipient that decrypts successfully. Other
  * > recipients may be inspected to enforce serialization rules, but their headers are not included in
@@ -14,14 +14,15 @@ export interface GeneralDecryptGetKey<KeyType extends t.CryptoKey | Uint8Array =
  */
 export declare function generalDecrypt(jwe: t.GeneralJWE, key: t.KeyInput, options?: t.DecryptOptions): Promise<t.GeneralDecryptResult>;
 /**
- * Decrypts a General JWE with a dynamically resolved key, included in the result.
+ * Authenticates and decrypts a general JWE JSON Serialization with a dynamically resolved key,
+ * included in the result.
  *
  * @param getKey Resolves a private key or shared secret from unverified token data.
  */
 export declare function generalDecrypt<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jwe: t.GeneralJWE, getKey: GeneralDecryptGetKey<KeyType>, options?: t.DecryptOptions): Promise<t.GeneralDecryptResult & t.ResolvedKey<KeyType>>;
 /**
- * Decrypts a General JWE with a key or key resolver. The result includes `key` only when a resolver
- * is used.
+ * Authenticates and decrypts a general JWE JSON Serialization with a key or key resolver. The
+ * result includes `key` only when a resolver is used.
  *
  * @param key Private key or shared secret, or a function resolving one.
  */

package/node_modules/jose/dist/types/jwe/general/encrypt.d.ts

@@ -5,7 +5,7 @@ export interface Recipient {
     setUnprotectedHeader(unprotectedHeader: t.JWEHeaderParameters): Recipient;
     /**
      * Sets key management inputs such as ECDH-ES "apu"/"apv" or PBES2 "p2c". Use this method instead
-     * of header setters; the resulting parameters are added to the JOSE header. May only be called
+     * of header setters; the resulting parameters are added to the JOSE Header. May only be called
      * once.
      */
     setKeyManagementParameters(parameters: t.JWEKeyManagementHeaderParameters): Recipient;
@@ -24,11 +24,11 @@ export interface Recipient {
     /** Returns the enclosing {@link GeneralEncrypt} instance. */
     done(): GeneralEncrypt;
 }
-/** Builds and encrypts General JWE objects. */
+/** Produces general JWE JSON Serialization using authenticated encryption. */
 export declare class GeneralEncrypt {
     #private;
     /**
-     * Creates a General JWE encryptor.
+     * Creates an encryptor for general JWE JSON Serialization.
      *
      * @param plaintext Binary representation of the plaintext to encrypt.
      */
@@ -44,8 +44,8 @@ export declare class GeneralEncrypt {
     setProtectedHeader(protectedHeader: t.JWEHeaderParameters): this;
     /** Sets the JWE Shared Unprotected Header. May only be called once. */
     setSharedUnprotectedHeader(sharedUnprotectedHeader: t.JWEHeaderParameters): this;
-    /** Sets additional data to authenticate without encrypting it. */
+    /** Sets the JWE AAD, which is integrity protected but not encrypted. */
     setAdditionalAuthenticatedData(aad: Uint8Array): this;
-    /** Encrypts the plaintext as a General JWE. */
+    /** Encrypts the plaintext and returns the general JWE JSON Serialization. */
     encrypt(): Promise<t.GeneralJWE>;
 }

package/node_modules/jose/dist/types/jws/compact/sign.d.ts

@@ -1,17 +1,18 @@
 import type * as t from '../../types.d.ts';
-/** Builds and signs Compact JWS strings. */
+/** Produces JWS Compact Serialization using a digital signature or MAC. */
 export declare class CompactSign {
     #private;
     /**
-     * Creates a Compact JWS signer.
+     * Creates a signer for JWS Compact Serialization.
      *
-     * @param payload Binary representation of the payload to sign.
+     * @param payload JWS Payload bytes to sign or MAC.
      */
     constructor(payload: Uint8Array);
     /** Sets the JWS Protected Header. May only be called once. */
     setProtectedHeader(protectedHeader: t.CompactJWSHeaderParameters): this;
     /**
-     * Signs the payload as a Compact JWS.
+     * Computes the JWS Signature (digital signature or MAC) and returns the JWS Compact
+     * Serialization.
      *
      * @param key Private key or shared secret. See
      *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.

package/node_modules/jose/dist/types/jws/compact/verify.d.ts

@@ -3,22 +3,22 @@ import type * as t from '../../types.d.ts';
 export interface CompactVerifyGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.CompactJWSHeaderParameters, t.FlattenedJWSInput, KeyType | t.KeyObject | t.JWK> {
 }
 /**
- * Verifies a Compact JWS signature and decodes its payload.
+ * Validates a JWS Compact Serialization (digital signature or MAC) and decodes its JWS Payload.
  *
  * @param key Public key or shared secret. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  */
 export declare function compactVerify(jws: string | Uint8Array, key: t.KeyInput, options?: t.VerifyOptions): Promise<t.CompactVerifyResult>;
 /**
- * Verifies a Compact JWS signature and decodes its payload with a dynamically resolved key,
- * included in the result.
+ * Validates a JWS Compact Serialization (digital signature or MAC) and decodes its JWS Payload with
+ * a dynamically resolved key, included in the result.
  *
  * @param getKey Resolves a public key or shared secret from unverified token data.
  */
 export declare function compactVerify<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jws: string | Uint8Array, getKey: CompactVerifyGetKey<KeyType>, options?: t.VerifyOptions): Promise<t.CompactVerifyResult & t.ResolvedKey<KeyType>>;
 /**
- * Verifies a Compact JWS and decodes its payload using a key or key resolver. The result includes
- * `key` only when a resolver is used.
+ * Validates a JWS Compact Serialization (digital signature or MAC) and decodes its JWS Payload
+ * using a key or key resolver. The result includes `key` only when a resolver is used.
  *
  * @param key Public key or shared secret, or a function resolving one.
  */

package/node_modules/jose/dist/types/jws/flattened/sign.d.ts

@@ -1,11 +1,11 @@
 import type * as t from '../../types.d.ts';
-/** Builds and signs Flattened JWS objects. */
+/** Produces flattened JWS JSON Serialization using a digital signature or MAC. */
 export declare class FlattenedSign {
     #private;
     /**
-     * Creates a Flattened JWS signer.
+     * Creates a signer for flattened JWS JSON Serialization.
      *
-     * @param payload Binary representation of the payload to sign.
+     * @param payload JWS Payload bytes to sign or MAC.
      */
     constructor(payload: Uint8Array);
     /** Sets the JWS Protected Header. May only be called once. */
@@ -13,7 +13,8 @@ export declare class FlattenedSign {
     /** Sets the JWS Unprotected Header. May only be called once. */
     setUnprotectedHeader(unprotectedHeader: t.JWSHeaderParameters): this;
     /**
-     * Signs the payload as a Flattened JWS.
+     * Computes the JWS Signature (digital signature or MAC) and returns the flattened JWS JSON
+     * Serialization.
      *
      * @param key Private key or shared secret. See
      *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.

package/node_modules/jose/dist/types/jws/flattened/verify.d.ts

@@ -3,22 +3,23 @@ import type * as t from '../../types.d.ts';
 export interface FlattenedVerifyGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.JWSHeaderParameters, t.FlattenedJWSInput, KeyType | t.KeyObject | t.JWK> {
 }
 /**
- * Verifies a Flattened JWS signature and decodes its payload.
+ * Validates a flattened JWS JSON Serialization (digital signature or MAC) and decodes its JWS
+ * Payload.
  *
  * @param key Public key or shared secret. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  */
 export declare function flattenedVerify(jws: t.FlattenedJWSInput, key: t.KeyInput, options?: t.VerifyOptions): Promise<t.FlattenedVerifyResult>;
 /**
- * Verifies a Flattened JWS signature and decodes its payload with a dynamically resolved key,
- * included in the result.
+ * Validates a flattened JWS JSON Serialization (digital signature or MAC) and decodes its JWS
+ * Payload with a dynamically resolved key, included in the result.
  *
  * @param getKey Resolves a public key or shared secret from unverified token data.
  */
 export declare function flattenedVerify<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jws: t.FlattenedJWSInput, getKey: FlattenedVerifyGetKey<KeyType>, options?: t.VerifyOptions): Promise<t.FlattenedVerifyResult & t.ResolvedKey<KeyType>>;
 /**
- * Verifies a Flattened JWS and decodes its payload using a key or key resolver. The result includes
- * `key` only when a resolver is used.
+ * Validates a flattened JWS JSON Serialization (digital signature or MAC) and decodes its JWS
+ * Payload using a key or key resolver. The result includes `key` only when a resolver is used.
  *
  * @param key Public key or shared secret, or a function resolving one.
  */

package/node_modules/jose/dist/types/jws/general/sign.d.ts

@@ -1,5 +1,5 @@
 import type * as t from '../../types.d.ts';
-/** Configures an individual signature in a General JWS. */
+/** Configures an individual JWS Signature (digital signature or MAC) in a General JWS. */
 export interface Signature {
     /** Sets the JWS Protected Header. May only be called once. */
     setProtectedHeader(protectedHeader: t.JWSHeaderParameters): Signature;
@@ -12,18 +12,18 @@ export interface Signature {
      *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
      */
     addSignature(key: t.KeyInput, options?: t.SignOptions): Signature;
-    /** Creates all signatures on the enclosing {@link GeneralSign}, using their configured keys. */
+    /** Computes all JWS Signatures on the enclosing {@link GeneralSign}, using their configured keys. */
     sign(): Promise<t.GeneralJWS>;
     /** Returns the enclosing {@link GeneralSign} instance. */
     done(): GeneralSign;
 }
-/** Builds and signs General JWS objects. */
+/** Produces general JWS JSON Serialization using digital signatures or MACs. */
 export declare class GeneralSign {
     #private;
     /**
-     * Creates a General JWS signer.
+     * Creates a signer for general JWS JSON Serialization.
      *
-     * @param payload Binary representation of the payload to sign.
+     * @param payload JWS Payload bytes to sign or MAC.
      */
     constructor(payload: Uint8Array);
     /**
@@ -33,6 +33,9 @@ export declare class GeneralSign {
      *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
      */
     addSignature(key: t.KeyInput, options?: t.SignOptions): Signature;
-    /** Signs the payload as a General JWS. */
+    /**
+     * Computes each JWS Signature (digital signature or MAC) and returns the general JWS JSON
+     * Serialization.
+     */
     sign(): Promise<t.GeneralJWS>;
 }

package/node_modules/jose/dist/types/jws/general/verify.d.ts

@@ -3,7 +3,8 @@ import type * as t from '../../types.d.ts';
 export interface GeneralVerifyGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.JWSHeaderParameters, t.FlattenedJWSInput, KeyType | t.KeyObject | t.JWK> {
 }
 /**
- * Verifies a General JWS signature and decodes its payload.
+ * Validates a JWS Signature (digital signature or MAC) from a general JWS JSON Serialization and
+ * decodes its JWS Payload.
  *
  * > Note: Returns payload and headers from the first signature that verifies successfully. Other entries'
  * > headers may be inspected to reject inconsistent use of the JWS Unencoded Payload Option, but are
@@ -14,15 +15,16 @@ export interface GeneralVerifyGetKey<KeyType extends t.CryptoKey | Uint8Array =
  */
 export declare function generalVerify(jws: t.GeneralJWSInput, key: t.KeyInput, options?: t.VerifyOptions): Promise<t.GeneralVerifyResult>;
 /**
- * Verifies a General JWS signature and decodes its payload with a dynamically resolved key,
- * included in the result.
+ * Validates a JWS Signature (digital signature or MAC) from a general JWS JSON Serialization and
+ * decodes its JWS Payload with a dynamically resolved key, included in the result.
  *
  * @param getKey Resolves a public key or shared secret from unverified token data.
  */
 export declare function generalVerify<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jws: t.GeneralJWSInput, getKey: GeneralVerifyGetKey<KeyType>, options?: t.VerifyOptions): Promise<t.GeneralVerifyResult & t.ResolvedKey<KeyType>>;
 /**
- * Verifies a General JWS and decodes its payload using a key or key resolver. The result includes
- * `key` only when a resolver is used.
+ * Validates a JWS Signature (digital signature or MAC) from a general JWS JSON Serialization and
+ * decodes its JWS Payload using a key or key resolver. The result includes `key` only when a
+ * resolver is used.
  *
  * @param key Public key or shared secret, or a function resolving one.
  */

package/node_modules/jose/dist/types/jwt/decrypt.d.ts

@@ -9,9 +9,9 @@ export interface JWTDecryptOptions extends t.DecryptOptions, t.JWTClaimVerificat
 export interface JWTDecryptGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.CompactJWEHeaderParameters, t.FlattenedJWE, KeyType | t.KeyObject | t.JWK> {
 }
 /**
- * Decrypts a Compact JWE-formatted JWT and validates its Claims Set.
+ * Authenticates and decrypts a JWT in JWE Compact Serialization and validates its JWT Claims Set.
  *
- * @param key Private key or shared secret to decrypt and verify the JWT with. See
+ * @param key Private key or shared secret to authenticate and decrypt the JWT with. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  */
 export declare function jwtDecrypt<PayloadType = t.JWTPayload>(jwt: string | Uint8Array, key: t.KeyInput, options?: JWTDecryptOptions): Promise<t.JWTDecryptResult<PayloadType>>;
@@ -19,16 +19,17 @@ export declare function jwtDecrypt<PayloadType = t.JWTPayload>(jwt: string | Uin
  * Decrypts a JWT and validates its claims, returning the dynamically
  * {@link t.ResolvedKey.key resolved key}.
  *
- * @param getKey Function resolving a private key or shared secret to decrypt and verify the JWT
- *   with. See {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+ * @param getKey Function resolving a private key or shared secret to authenticate and decrypt the
+ *   JWT with. See
+ *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  */
 export declare function jwtDecrypt<PayloadType = t.JWTPayload, KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jwt: string | Uint8Array, getKey: JWTDecryptGetKey<KeyType>, options?: JWTDecryptOptions): Promise<t.JWTDecryptResult<PayloadType> & t.ResolvedKey<KeyType>>;
 /**
  * Accepts a key or key resolver. Use this overload when forwarding either form; the result includes
  * `key` only when a resolver was used.
  *
- * @param key Private key or shared secret, or a function resolving one, to decrypt and verify the
- *   JWT with. See
+ * @param key Private key or shared secret, or a function resolving one, to authenticate and decrypt
+ *   the JWT with. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  */
 export declare function jwtDecrypt<PayloadType = t.JWTPayload>(jwt: string | Uint8Array, key: t.KeyInput | JWTDecryptGetKey, options?: JWTDecryptOptions): Promise<t.JWTDecryptResult<PayloadType> & Partial<t.ResolvedKey>>;

package/node_modules/jose/dist/types/jwt/encrypt.d.ts

@@ -1,7 +1,7 @@
 import type * as t from '../types.d.ts';
 /** @param payload Initial JWT Claims Set. Defaults to an empty object. */
 declare const EncryptJWT_base: new (payload?: t.JWTPayload) => t.ProduceJWT;
-/** Builds and encrypts Compact JWE-formatted JSON Web Tokens. */
+/** Produces encrypted JWTs in JWE Compact Serialization. */
 export declare class EncryptJWT extends EncryptJWT_base {
     #private;
     /**

package/node_modules/jose/dist/types/jwt/sign.d.ts

@@ -1,7 +1,7 @@
 import type * as t from '../types.d.ts';
 /** @param payload Initial JWT Claims Set. Defaults to an empty object. */
 declare const SignJWT_base: new (payload?: t.JWTPayload) => t.ProduceJWT;
-/** Builds and signs Compact JWS-formatted JSON Web Tokens. */
+/** Produces JWTs in JWS Compact Serialization using a digital signature or MAC. */
 export declare class SignJWT extends SignJWT_base {
     #private;
     /**

package/node_modules/jose/dist/types/jwt/unsecured.d.ts

@@ -3,7 +3,7 @@ import type * as t from '../types.d.ts';
 export interface UnsecuredResult<PayloadType = t.JWTPayload> {
     /** JWT Claims Set. */
     payload: PayloadType & t.JWTPayload & ([PayloadType] extends [object] ? unknown : unknown extends PayloadType ? unknown : never);
-    /** The decoded JOSE Header; always `{ "alg": "none" }` for an Unsecured JWT. */
+    /** The decoded JOSE Header; its "alg" (Algorithm) Header Parameter is "none". */
     header: t.JWSHeaderParameters;
 }
 /** @param payload Initial JWT Claims Set. Defaults to an empty object. */