@suveren/gateway 0.7.4 → 0.7.6

package/node_modules/jose/dist/webapi/lib/key_management.js

@@ -5,7 +5,7 @@ import { jweAlgorithm, jweEncryption } from './jwe_algorithms.js';
 import { JOSENotSupported, JWEInvalid } from '../util/errors.js';
 import { decodeBase64url, digest } from './helpers.js';
 import { generateCek, encrypt, decrypt } from './content_encryption.js';
-import { isObject } from './type_checks.js';
+import { assertUint8Array, isObject } from './type_checks.js';
 import { checkCryptoKey, checkModulusLength, checkUsage } from './crypto_key.js';
 import { concat, encode, uint32be } from './buffer_utils.js';
 import { assertCryptoKey } from './is_key_like.js';
@@ -110,7 +110,7 @@ function assertNoEncryptedKey(encryptedKey) {
     if (encryptedKey !== undefined)
         throw new JWEInvalid('Encountered unexpected JWE Encrypted Key');
 }
-export async function decryptKeyManagement(alg, enc, key, encryptedKey, joseHeader, options) {
+export async function decryptKeyManagement(alg, enc, key, encryptedKey, joseHeader, maxPBES2Count) {
     const entry = jweAlgorithm(alg);
     if (alg === 'dir') {
         assertNoEncryptedKey(encryptedKey);
@@ -152,7 +152,7 @@ export async function decryptKeyManagement(alg, enc, key, encryptedKey, joseHead
             assertEncryptedKey(encryptedKey);
             if (typeof joseHeader.p2c !== 'number')
                 throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);
-            const p2cLimit = options?.maxPBES2Count || 10_000;
+            const p2cLimit = maxPBES2Count || 10_000;
             if (joseHeader.p2c > p2cLimit)
                 throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);
             if (typeof joseHeader.p2s !== 'string')
@@ -190,8 +190,14 @@ export async function encryptKeyManagement(alg, enc, key, providedCek, providedP
         case 'ECDH': {
             assertEcdhKey(key);
             const { apu, apv } = providedParameters;
+            if (apu !== undefined) {
+                assertUint8Array(apu, '"apu"');
+            }
+            if (apv !== undefined) {
+                assertUint8Array(apv, '"apv"');
+            }
             let ephemeralKey;
-            if (providedParameters.epk) {
+            if (providedParameters.epk !== undefined) {
                 ephemeralKey = (await prepareKey(entry, providedParameters.epk, 'decrypt'));
             }
             else {

package/node_modules/jose/dist/webapi/lib/key_options.js

@@ -0,0 +1,6 @@
+export function validateExtractableOption(extractable) {
+    if (extractable !== undefined && typeof extractable !== 'boolean') {
+        throw new TypeError('"extractable" option must be a boolean');
+    }
+    return extractable;
+}

package/node_modules/jose/dist/webapi/lib/options.js

@@ -1,4 +1,5 @@
 import { JOSENotSupported, JWEInvalid, JWSInvalid } from '../util/errors.js';
+import { isObject } from './type_checks.js';
 export const JWS_RECOGNIZED = { __proto__: null, b64: true };
 export const JWE_RECOGNIZED = { __proto__: null };
 export function validateAlgorithms(option, algorithms) {
@@ -46,3 +47,28 @@ export function validateCrit(Err, recognizedDefault, recognizedOption, protected
     }
     return protectedHeader.crit;
 }
+export function validateB64(protectedHeader, extensions) {
+    if (extensions.includes('b64')) {
+        const b64 = protectedHeader.b64;
+        if (typeof b64 !== 'boolean') {
+            throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
+        }
+        return b64;
+    }
+    return true;
+}
+export function serializeJoseHeader(Err, header) {
+    let serialized;
+    let parsed;
+    try {
+        serialized = JSON.stringify(header);
+        parsed = JSON.parse(serialized);
+    }
+    catch (cause) {
+        throw new Err('JOSE Header is not valid JSON', { cause });
+    }
+    if (!isObject(parsed)) {
+        throw new Err('JOSE Header is not a JSON object');
+    }
+    return [parsed, serialized];
+}

package/node_modules/jose/dist/webapi/lib/type_checks.js

@@ -1,3 +1,8 @@
+export function assertUint8Array(input, label) {
+    if (!(input instanceof Uint8Array)) {
+        throw new TypeError(`${label} must be an instance of Uint8Array`);
+    }
+}
 export function isObject(input) {
     if (typeof input !== 'object' ||
         input === null ||
@@ -5,14 +10,12 @@ export function isObject(input) {
         return false;
     }
     const prototype = Object.getPrototypeOf(input);
-    if (prototype === null) {
-        return true;
-    }
-    let proto = prototype;
-    while (Object.getPrototypeOf(proto) !== null) {
-        proto = Object.getPrototypeOf(proto);
-    }
-    return prototype === proto;
+    return prototype === null || Object.getPrototypeOf(prototype) === null;
+}
+export function isJwkSet(input) {
+    return (isObject(input) &&
+        Array.isArray(input.keys) &&
+        Array.from(input.keys).every(isObject));
 }
 export function isDisjoint(...headers) {
     const parameters = new Set();
@@ -28,8 +31,3 @@ export function isDisjoint(...headers) {
     }
     return true;
 }
-export const isJWK = (key) => isObject(key) && typeof key.kty === 'string';
-export const isPrivateJWK = (key) => key.kty !== 'oct' &&
-    ((key.kty === 'AKP' && typeof key.priv === 'string') || typeof key.d === 'string');
-export const isPublicJWK = (key) => key.kty !== 'oct' && key.d === undefined && key.priv === undefined;
-export const isSecretJWK = (key) => key.kty === 'oct' && typeof key.k === 'string';

package/node_modules/jose/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "6.2.8",
+  "version": "6.2.10",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "akp",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@suveren/gateway",
-  "version": "0.7.4",
+  "version": "0.7.6",
   "description": "Suveren gateway — local agent gateway built in compliance with the Human Agency Protocol (HAP). Runs the UI, control plane, and MCP server in one Node process.",
   "type": "module",
   "main": "server.js",
@@ -24,7 +24,7 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@hap/core": "npm:@humanagencyp/hap-core@^0.8.4",
+    "@hap/core": "npm:@humanagencyp/hap-core@^0.9.0",
     "@hpke/core": "^1.9.0",
     "express": "^4.18.0",
     "http-proxy-middleware": "^3.0.0",