@suveren/gateway 0.7.6 → 0.8.0

package/node_modules/jose/dist/webapi/jwe/general/decrypt.js

@@ -1,51 +1,40 @@
-import { prepareDecrypt, shareJWE, decryptRecipient, decryptResult, checkRecipient, snapshotSharedJWE, snapshotRecipientJWE, } from '../../lib/jwe_decrypt.js';
-import { JWEDecryptionFailed, JWEInvalid } from '../../util/errors.js';
-import { isObject } from '../../lib/type_checks.js';
-export async function generalDecrypt(jwe, key, options) {
-    if (!isObject(jwe)) {
-        throw new JWEInvalid('General JWE must be an object');
-    }
-    const inputRecipients = jwe.recipients;
-    if (!Array.isArray(inputRecipients)) {
-        throw new JWEInvalid('JWE Recipients missing or incorrect type');
-    }
-    const recipients = Array.from(inputRecipients);
-    if (!recipients.every(isObject)) {
-        throw new JWEInvalid('JWE Recipients missing or incorrect type');
-    }
-    if (!recipients.length) {
-        throw new JWEInvalid('JWE Recipients has no members');
-    }
-    let shared;
-    let sharedJwe;
-    let token;
-    try {
-        shared = prepareDecrypt(options);
-        sharedJwe = snapshotSharedJWE(jwe);
-        token = shareJWE(sharedJwe);
-    }
-    catch {
-        throw new JWEDecryptionFailed();
-    }
-    const recipientSnapshots = recipients.map((recipient) => snapshotRecipientJWE(recipient));
-    if (recipients.length > 1) {
-        for (const [, headerAlg] of recipientSnapshots) {
-            const alg = token[0]?.alg ?? headerAlg ?? sharedJwe.unprotected?.alg;
-            if (alg === 'dir' || alg === 'ECDH-ES') {
-                throw new JWEInvalid(`"${alg}" alg may only have a single recipient`);
-            }
-        }
-    }
-    for (const [recipient] of recipientSnapshots) {
-        if (!recipient)
-            continue;
-        try {
-            const flattened = { ...sharedJwe, ...recipient };
-            checkRecipient(flattened);
-            return decryptResult(flattened, await decryptRecipient(flattened, token, shared, key));
-        }
-        catch {
-        }
-    }
+import { prepareDecrypt, shareJWE, decryptRecipient, decryptResult, checkRecipient, snapshotSharedJWE, snapshotRecipientJWE } from "../../lib/jwe_decrypt.js";
+import { JWEDecryptionFailed, JWEInvalid } from "../../util/errors.js";
+import { isObject } from "../../lib/type_checks.js";
+import { JWE, isJWECEKTransport } from "../../lib/jwe_algorithms.js";
+async function generalDecrypt(jwe, key, options) {
+  if (!isObject(jwe))
+    throw new JWEInvalid("General JWE must be an object");
+  const inputRecipients = jwe.recipients;
+  if (!Array.isArray(inputRecipients))
+    throw new JWEInvalid("JWE Recipients missing or incorrect type");
+  const recipients = Array.from(inputRecipients);
+  if (!recipients.every(isObject))
+    throw new JWEInvalid("JWE Recipients missing or incorrect type");
+  if (!recipients.length)
+    throw new JWEInvalid("JWE Recipients has no members");
+  let shared, sharedJwe, token;
+  try {
+    shared = prepareDecrypt(options), sharedJwe = snapshotSharedJWE(jwe), token = shareJWE(sharedJwe);
+  } catch {
     throw new JWEDecryptionFailed();
+  }
+  const recipientSnapshots = recipients.map((recipient) => snapshotRecipientJWE(recipient)), recipientAlgorithms = recipientSnapshots.map(([, headerAlg]) => token[0]?.alg ?? headerAlg ?? sharedJwe.unprotected?.alg);
+  if (recipients.length > 1)
+    for (const alg of recipientAlgorithms) {
+      const algEntry = typeof alg == "string" ? JWE[alg] : void 0;
+      if (algEntry && !isJWECEKTransport(algEntry))
+        throw new JWEInvalid(`"${alg}" alg may only have a single recipient`);
+    }
+  for (const [recipient] of recipientSnapshots)
+    if (recipient)
+      try {
+        const flattened = { ...sharedJwe, ...recipient };
+        return checkRecipient(flattened), decryptResult(flattened, await decryptRecipient(flattened, token, shared, key));
+      } catch {
+      }
+  throw new JWEDecryptionFailed();
 }
+export {
+  generalDecrypt
+};

package/node_modules/jose/dist/webapi/jwe/general/encrypt.js

@@ -1,177 +1,129 @@
-import { assertNotSet } from '../../lib/helpers.js';
-import { JWEInvalid } from '../../util/errors.js';
-import { generateCek } from '../../lib/content_encryption.js';
-import { encryptKeyManagement } from '../../lib/key_management.js';
-import { encode as b64u } from '../../util/base64url.js';
-import { checkDisjoint, checkEncryptHeaders, createJWE, encryptJWE } from '../../lib/jwe_encrypt.js';
-import { prepareKey } from '../../lib/key.js';
-import { jweAlgorithm } from '../../lib/jwe_algorithms.js';
-import { assertUint8Array } from '../../lib/type_checks.js';
+import { assertNotSet } from "../../lib/helpers.js";
+import { JWEInvalid } from "../../util/errors.js";
+import { generateCek } from "../../lib/content_encryption.js";
+import { encode as b64u } from "../../util/base64url.js";
+import { checkDisjoint, checkEncryptHeaders, createJWE, encryptJWE, transportCek } from "../../lib/jwe_encrypt.js";
+import { JWE, isJWECEKTransport, jweAlgorithm } from "../../lib/jwe_algorithms.js";
+import { assertUint8Array } from "../../lib/type_checks.js";
 class IndividualRecipient {
-    #parent;
-    state;
-    constructor(enc, key, crit) {
-        this.#parent = enc;
-        this.state = [undefined, undefined, key, crit];
-    }
-    setUnprotectedHeader(unprotectedHeader) {
-        assertNotSet(this.state[0], 'setUnprotectedHeader');
-        this.state[0] = unprotectedHeader;
-        return this;
-    }
-    setKeyManagementParameters(parameters) {
-        assertNotSet(this.state[1], 'setKeyManagementParameters');
-        this.state[1] = parameters;
-        return this;
-    }
-    addRecipient(...args) {
-        return this.#parent.addRecipient(...args);
-    }
-    encrypt(...args) {
-        return this.#parent.encrypt(...args);
-    }
-    done() {
-        return this.#parent;
-    }
+  #parent;
+  state;
+  constructor(enc, key, crit) {
+    this.#parent = enc, this.state = [void 0, void 0, key, crit];
+  }
+  setUnprotectedHeader(unprotectedHeader) {
+    return assertNotSet(this.state[0], "setUnprotectedHeader"), this.state[0] = unprotectedHeader, this;
+  }
+  setKeyManagementParameters(parameters) {
+    return assertNotSet(this.state[1], "setKeyManagementParameters"), this.state[1] = parameters, this;
+  }
+  addRecipient(...args) {
+    return this.#parent.addRecipient(...args);
+  }
+  encrypt(...args) {
+    return this.#parent.encrypt(...args);
+  }
+  done() {
+    return this.#parent;
+  }
 }
 function copyOptionalMembers(flattened, jwe, recipient) {
-    const { aad, protected: protectedHeader, unprotected, header } = flattened;
-    if (aad)
-        jwe.aad = aad;
-    if (protectedHeader)
-        jwe.protected = protectedHeader;
-    if (unprotected)
-        jwe.unprotected = unprotected;
-    if (header)
-        recipient.header = header;
+  const { aad, protected: protectedHeader, unprotected, header } = flattened;
+  aad && (jwe.aad = aad), protectedHeader && (jwe.protected = protectedHeader), unprotected && (jwe.unprotected = unprotected), header && (recipient.header = header);
 }
-export class GeneralEncrypt {
-    #plaintext;
-    #recipients = [];
-    #protectedHeader;
-    #unprotectedHeader;
-    #aad;
-    constructor(plaintext) {
-        this.#plaintext = plaintext;
-    }
-    addRecipient(key, options) {
-        const recipient = new IndividualRecipient(this, key, options?.crit);
-        this.#recipients.push(recipient);
-        return recipient;
-    }
-    setProtectedHeader(protectedHeader) {
-        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
-        this.#protectedHeader = protectedHeader;
-        return this;
-    }
-    setSharedUnprotectedHeader(sharedUnprotectedHeader) {
-        assertNotSet(this.#unprotectedHeader, 'setSharedUnprotectedHeader');
-        this.#unprotectedHeader = sharedUnprotectedHeader;
-        return this;
+class GeneralEncrypt {
+  #plaintext;
+  #recipients = [];
+  #protectedHeader;
+  #unprotectedHeader;
+  #aad;
+  constructor(plaintext) {
+    this.#plaintext = plaintext;
+  }
+  addRecipient(key, options) {
+    const recipient = new IndividualRecipient(this, key, options?.crit);
+    return this.#recipients.push(recipient), recipient;
+  }
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
+  }
+  setSharedUnprotectedHeader(sharedUnprotectedHeader) {
+    return assertNotSet(this.#unprotectedHeader, "setSharedUnprotectedHeader"), this.#unprotectedHeader = sharedUnprotectedHeader, this;
+  }
+  setAdditionalAuthenticatedData(aad) {
+    return this.#aad = aad, this;
+  }
+  async encrypt() {
+    if (!this.#recipients.length)
+      throw new JWEInvalid("at least one recipient must be added");
+    if (assertUint8Array(this.#plaintext, "plaintext"), this.#recipients.length === 1) {
+      const [unprotectedHeader, keyManagementParameters, key, crit] = this.#recipients[0].state, flattened = await createJWE([
+        this.#plaintext,
+        this.#protectedHeader,
+        unprotectedHeader,
+        this.#unprotectedHeader,
+        this.#aad,
+        void 0,
+        void 0,
+        keyManagementParameters,
+        crit,
+        !1
+      ], key), jwe2 = {
+        ciphertext: flattened.ciphertext,
+        recipients: [{}]
+      };
+      return flattened.iv && (jwe2.iv = flattened.iv), flattened.tag && (jwe2.tag = flattened.tag), flattened.encrypted_key && (jwe2.recipients[0].encrypted_key = flattened.encrypted_key), copyOptionalMembers(flattened, jwe2, jwe2.recipients[0]), jwe2;
     }
-    setAdditionalAuthenticatedData(aad) {
-        this.#aad = aad;
-        return this;
+    let enc, protectedHeader = this.#protectedHeader, sharedUnprotectedHeader = this.#unprotectedHeader;
+    const inputs = [], checked = [];
+    for (let i = 0; i < this.#recipients.length; i++) {
+      const recipient = this.#recipients[i], [unprotectedHeader, keyManagementParameters, , crit] = recipient.state, input = [
+        this.#plaintext,
+        protectedHeader,
+        unprotectedHeader,
+        sharedUnprotectedHeader,
+        this.#aad,
+        void 0,
+        void 0,
+        keyManagementParameters,
+        crit,
+        !0
+      ], headers = checkEncryptHeaders(input);
+      inputs.push(input), checked.push(headers), i === 0 && (protectedHeader = input[1], sharedUnprotectedHeader = input[3]);
+      const algEntry = JWE[headers[1]];
+      if (algEntry && !isJWECEKTransport(algEntry))
+        throw new JWEInvalid(`"${headers[1]}" alg may only have a single recipient`);
+      if (!enc)
+        enc = headers[2];
+      else if (enc !== headers[2])
+        throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');
     }
-    async encrypt() {
-        if (!this.#recipients.length) {
-            throw new JWEInvalid('at least one recipient must be added');
-        }
-        assertUint8Array(this.#plaintext, 'plaintext');
-        if (this.#recipients.length === 1) {
-            const [unprotectedHeader, keyManagementParameters, key, crit] = this.#recipients[0].state;
-            const flattened = await createJWE([
-                this.#plaintext,
-                this.#protectedHeader,
-                unprotectedHeader,
-                this.#unprotectedHeader,
-                this.#aad,
-                undefined,
-                undefined,
-                keyManagementParameters,
-                crit,
-                false,
-            ], key);
-            const jwe = {
-                ciphertext: flattened.ciphertext,
-                iv: flattened.iv,
-                recipients: [{}],
-                tag: flattened.tag,
-            };
-            if (flattened.encrypted_key)
-                jwe.recipients[0].encrypted_key = flattened.encrypted_key;
-            copyOptionalMembers(flattened, jwe, jwe.recipients[0]);
-            return jwe;
-        }
-        let enc;
-        let protectedHeader = this.#protectedHeader;
-        let sharedUnprotectedHeader = this.#unprotectedHeader;
-        const inputs = [];
-        const checked = [];
-        for (let i = 0; i < this.#recipients.length; i++) {
-            const recipient = this.#recipients[i];
-            const [unprotectedHeader, keyManagementParameters, , crit] = recipient.state;
-            const input = [
-                this.#plaintext,
-                protectedHeader,
-                unprotectedHeader,
-                sharedUnprotectedHeader,
-                this.#aad,
-                undefined,
-                undefined,
-                keyManagementParameters,
-                crit,
-                true,
-            ];
-            const headers = checkEncryptHeaders(input);
-            inputs.push(input);
-            checked.push(headers);
-            if (i === 0) {
-                protectedHeader = input[1];
-                sharedUnprotectedHeader = input[3];
-            }
-            if (headers[1] === 'dir' || headers[1] === 'ECDH-ES') {
-                throw new JWEInvalid(`"${headers[1]}" alg may only have a single recipient`);
-            }
-            if (!enc) {
-                enc = headers[2];
-            }
-            else if (enc !== headers[2]) {
-                throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');
-            }
-        }
-        const cek = generateCek(checked[0][3]);
-        const jwe = {
-            ciphertext: '',
-            recipients: [],
-        };
-        for (let i = 0; i < this.#recipients.length; i++) {
-            const recipient = this.#recipients[i];
-            const [, keyManagementParameters, key] = recipient.state;
-            const target = {};
-            jwe.recipients.push(target);
-            if (i === 0) {
-                inputs[0][5] = cek;
-                const flattened = await encryptJWE(inputs[0], checked[0], key);
-                jwe.ciphertext = flattened.ciphertext;
-                jwe.iv = flattened.iv;
-                jwe.tag = flattened.tag;
-                target.encrypted_key = flattened.encrypted_key;
-                copyOptionalMembers(flattened, jwe, target);
-                continue;
-            }
-            const [, alg, , encEntry] = checked[i];
-            const unprotectedHeader = inputs[i][2];
-            const k = await prepareKey(jweAlgorithm(alg), key, 'encrypt');
-            const [, encryptedKey, parameters] = await encryptKeyManagement(alg, encEntry, k, cek, keyManagementParameters);
-            target.encrypted_key = b64u(encryptedKey);
-            if (unprotectedHeader || parameters) {
-                const header = { ...unprotectedHeader, ...parameters };
-                if (parameters)
-                    checkDisjoint(inputs[i][1], header, inputs[i][3]);
-                target.header = header;
-            }
-        }
-        return jwe;
+    const algEntries = checked.map(([, alg]) => {
+      const algEntry = jweAlgorithm(alg);
+      if (!isJWECEKTransport(algEntry))
+        throw new JWEInvalid(`"${alg}" alg may only have a single recipient`);
+      return algEntry;
+    }), cek = generateCek(checked[0][3]), jwe = {
+      ciphertext: "",
+      recipients: []
+    };
+    for (let i = 0; i < this.#recipients.length; i++) {
+      const recipient = this.#recipients[i], [, keyManagementParameters, key] = recipient.state, target = {};
+      if (jwe.recipients.push(target), i === 0) {
+        inputs[0][5] = cek;
+        const flattened = await encryptJWE(inputs[0], checked[0], key, algEntries[0]);
+        jwe.ciphertext = flattened.ciphertext, flattened.iv && (jwe.iv = flattened.iv), flattened.tag && (jwe.tag = flattened.tag), flattened.encrypted_key && (target.encrypted_key = flattened.encrypted_key), copyOptionalMembers(flattened, jwe, target);
+        continue;
+      }
+      const [joseHeader, , , encEntry] = checked[i], unprotectedHeader = inputs[i][2], [, encryptedKey, parameters] = await transportCek(algEntries[i], encEntry, key, cek, joseHeader, keyManagementParameters);
+      if (target.encrypted_key = b64u(encryptedKey), unprotectedHeader || parameters) {
+        const header = { ...unprotectedHeader, ...parameters };
+        parameters && checkDisjoint(inputs[i][1], header, inputs[i][3]), target.header = header;
+      }
     }
+    return jwe;
+  }
 }
+export {
+  GeneralEncrypt
+};

package/node_modules/jose/dist/webapi/jwk/embedded.js

@@ -1,33 +1,31 @@
-import { jwkToKey } from '../lib/jwk_to_key.js';
-import { jwsAlgorithm } from '../lib/jws_algorithms.js';
-import { isObject } from '../lib/type_checks.js';
-import { JWSInvalid } from '../util/errors.js';
-import { normalizeJwk } from '../lib/jwk_metadata.js';
-export async function EmbeddedJWK(protectedHeader, token) {
-    const joseHeader = {
-        ...protectedHeader,
-        ...token?.header,
-    };
-    if (!isObject(joseHeader.jwk)) {
-        throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');
-    }
-    let jwk;
-    try {
-        jwk = normalizeJwk(joseHeader.jwk);
-    }
-    catch (cause) {
-        throw new JWSInvalid('Invalid Embedded JWK', { cause });
-    }
-    const entry = jwsAlgorithm(joseHeader.alg);
-    if (jwk.use !== undefined && jwk.use !== 'sig') {
-        throw new JWSInvalid('Invalid Embedded JWK, its "use" must be "sig" when present');
-    }
-    if (jwk.alg !== undefined && jwk.alg !== entry.alg) {
-        throw new JWSInvalid(`Invalid Embedded JWK, its "alg" must be "${entry.alg}" when present`);
-    }
-    const key = await jwkToKey(entry, { ...jwk, ext: true });
-    if (key.type !== 'public') {
-        throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
-    }
-    return key;
+import { jwkToKey } from "../lib/jwk_to_key.js";
+import { jwsAlgorithm } from "../lib/jws_algorithms.js";
+import { isObject } from "../lib/type_checks.js";
+import { JWSInvalid } from "../util/errors.js";
+import { normalizeJwk } from "../lib/jwk_metadata.js";
+async function EmbeddedJWK(protectedHeader, token) {
+  const joseHeader = {
+    ...protectedHeader,
+    ...token?.header
+  };
+  if (!isObject(joseHeader.jwk))
+    throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');
+  let jwk;
+  try {
+    jwk = normalizeJwk(joseHeader.jwk);
+  } catch (cause) {
+    throw new JWSInvalid("Invalid Embedded JWK", { cause });
+  }
+  const entry = jwsAlgorithm(joseHeader.alg);
+  if (jwk.use !== void 0 && jwk.use !== "sig")
+    throw new JWSInvalid('Invalid Embedded JWK, its "use" must be "sig" when present');
+  if (jwk.alg !== void 0 && jwk.alg !== entry.alg)
+    throw new JWSInvalid(`Invalid Embedded JWK, its "alg" must be "${entry.alg}" when present`);
+  const key = await jwkToKey(entry, { ...jwk, ext: !0 });
+  if (key.type !== "public")
+    throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
+  return key;
 }
+export {
+  EmbeddedJWK
+};

package/node_modules/jose/dist/webapi/jwk/thumbprint.js

@@ -1,74 +1,58 @@
-import { digest } from '../lib/helpers.js';
-import { encode as b64u } from '../util/base64url.js';
-import { JOSENotSupported, JWKInvalid } from '../util/errors.js';
-import { encode } from '../lib/buffer_utils.js';
-import { isKeyLike } from '../lib/is_key_like.js';
-import { isObject } from '../lib/type_checks.js';
-import { exportJWK } from '../key/export.js';
-import { invalidKeyInput } from '../lib/invalid_key_input.js';
-import { snapshotJwk } from '../lib/jwk_metadata.js';
+import { digest } from "../lib/helpers.js";
+import { encode as b64u } from "../util/base64url.js";
+import { JOSENotSupported, JWKInvalid } from "../util/errors.js";
+import { encode } from "../lib/buffer_utils.js";
+import { isKeyLike } from "../lib/is_key_like.js";
+import { isObject } from "../lib/type_checks.js";
+import { exportJWK } from "../key/export.js";
+import { invalidKeyInput } from "../lib/invalid_key_input.js";
+import { snapshotJwk } from "../lib/jwk_metadata.js";
 const check = (value, description) => {
-    if (typeof value !== 'string' || !value) {
-        throw new JWKInvalid(`${description} missing or invalid`);
-    }
+  if (typeof value != "string" || !value)
+    throw new JWKInvalid(`${description} missing or invalid`);
 };
-export async function calculateJwkThumbprint(key, digestAlgorithm) {
-    let jwk;
-    if (isObject(key)) {
-        jwk = snapshotJwk(key);
-        if (typeof jwk.kty !== 'string') {
-            throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
-        }
-    }
-    else if (isKeyLike(key)) {
-        jwk = snapshotJwk(await exportJWK(key));
-    }
-    else {
-        throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
-    }
-    digestAlgorithm ??= 'sha256';
-    if (digestAlgorithm !== 'sha256' &&
-        digestAlgorithm !== 'sha384' &&
-        digestAlgorithm !== 'sha512') {
-        throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');
-    }
-    let components;
-    switch (jwk.kty) {
-        case 'AKP':
-            check(jwk.alg, '"alg" (Algorithm) Parameter');
-            check(jwk.pub, '"pub" (Public key) Parameter');
-            components = { alg: jwk.alg, kty: jwk.kty, pub: jwk.pub };
-            break;
-        case 'EC':
-            check(jwk.crv, '"crv" (Curve) Parameter');
-            check(jwk.x, '"x" (X Coordinate) Parameter');
-            check(jwk.y, '"y" (Y Coordinate) Parameter');
-            components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y };
-            break;
-        case 'OKP':
-            check(jwk.crv, '"crv" (Subtype of Key Pair) Parameter');
-            check(jwk.x, '"x" (Public Key) Parameter');
-            components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x };
-            break;
-        case 'RSA':
-            check(jwk.e, '"e" (Exponent) Parameter');
-            check(jwk.n, '"n" (Modulus) Parameter');
-            components = { e: jwk.e, kty: jwk.kty, n: jwk.n };
-            break;
-        case 'oct':
-            if (typeof jwk.k !== 'string') {
-                throw new JWKInvalid('"k" (Key Value) Parameter missing or invalid');
-            }
-            components = { k: jwk.k, kty: jwk.kty };
-            break;
-        default:
-            throw new JOSENotSupported('"kty" (Key Type) Parameter missing or unsupported');
-    }
-    const data = encode(JSON.stringify(components));
-    return b64u(await digest(digestAlgorithm, data));
+async function calculateJwkThumbprint(key, digestAlgorithm) {
+  let jwk;
+  if (isObject(key)) {
+    if (jwk = snapshotJwk(key), typeof jwk.kty != "string")
+      throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
+  } else if (isKeyLike(key))
+    jwk = snapshotJwk(await exportJWK(key));
+  else
+    throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
+  if (digestAlgorithm ??= "sha256", digestAlgorithm !== "sha256" && digestAlgorithm !== "sha384" && digestAlgorithm !== "sha512")
+    throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');
+  let components;
+  switch (jwk.kty) {
+    case "AKP":
+      check(jwk.alg, '"alg" (Algorithm) Parameter'), check(jwk.pub, '"pub" (Public key) Parameter'), components = { alg: jwk.alg, kty: jwk.kty, pub: jwk.pub };
+      break;
+    case "EC":
+      check(jwk.crv, '"crv" (Curve) Parameter'), check(jwk.x, '"x" (X Coordinate) Parameter'), check(jwk.y, '"y" (Y Coordinate) Parameter'), components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y };
+      break;
+    case "OKP":
+      check(jwk.crv, '"crv" (Subtype of Key Pair) Parameter'), check(jwk.x, '"x" (Public Key) Parameter'), components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x };
+      break;
+    case "RSA":
+      check(jwk.e, '"e" (Exponent) Parameter'), check(jwk.n, '"n" (Modulus) Parameter'), components = { e: jwk.e, kty: jwk.kty, n: jwk.n };
+      break;
+    case "oct":
+      if (typeof jwk.k != "string")
+        throw new JWKInvalid('"k" (Key Value) Parameter missing or invalid');
+      components = { k: jwk.k, kty: jwk.kty };
+      break;
+    default:
+      throw new JOSENotSupported('"kty" (Key Type) Parameter missing or unsupported');
+  }
+  const data = encode(JSON.stringify(components));
+  return b64u(await digest(digestAlgorithm, data));
 }
-export async function calculateJwkThumbprintUri(key, digestAlgorithm) {
-    digestAlgorithm ??= 'sha256';
-    const thumbprint = await calculateJwkThumbprint(key, digestAlgorithm);
-    return `urn:ietf:params:oauth:jwk-thumbprint:sha-${digestAlgorithm.slice(-3)}:${thumbprint}`;
+async function calculateJwkThumbprintUri(key, digestAlgorithm) {
+  digestAlgorithm ??= "sha256";
+  const thumbprint = await calculateJwkThumbprint(key, digestAlgorithm);
+  return `urn:ietf:params:oauth:jwk-thumbprint:sha-${digestAlgorithm.slice(-3)}:${thumbprint}`;
 }
+export {
+  calculateJwkThumbprint,
+  calculateJwkThumbprintUri
+};