effect 4.1.0 → 4.1.1

package/dist/jose/JoseError.d.ts

@@ -0,0 +1,285 @@
+declare const TypeId: "~effect/jose/JoseError";
+declare const ReasonTypeId: "~effect/jose/JoseError/Reason";
+declare const InvalidToken_base: new <A extends Record<string, any> = {}>(args: import("../Types.ts").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("../Cause.ts").YieldableError & {
+    readonly _tag: "InvalidToken";
+} & Readonly<A>;
+/**
+ * Reason for a malformed compact serialization, protected header, or payload,
+ * or for header parameters that are not supported, such as `crit`.
+ *
+ * @stability unstable
+ * @category errors
+ * @since 4.1.1
+ */
+export declare class InvalidToken extends InvalidToken_base<{
+    readonly description: string;
+}> {
+    /**
+     * Marks this value as a `JoseError` reason for runtime guards.
+     *
+     * @since 4.1.1
+     */
+    readonly [ReasonTypeId]: "~effect/jose/JoseError/Reason";
+    get message(): string;
+}
+declare const InvalidKey_base: new <A extends Record<string, any> = {}>(args: import("../Types.ts").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("../Cause.ts").YieldableError & {
+    readonly _tag: "InvalidKey";
+} & Readonly<A>;
+/**
+ * Reason for key material that cannot be imported, or that does not fit the
+ * selected algorithm or operation.
+ *
+ * @stability unstable
+ * @category errors
+ * @since 4.1.1
+ */
+export declare class InvalidKey extends InvalidKey_base<{
+    readonly description: string;
+    readonly cause?: unknown;
+}> {
+    /**
+     * Marks this value as a `JoseError` reason for runtime guards.
+     *
+     * @since 4.1.1
+     */
+    readonly [ReasonTypeId]: "~effect/jose/JoseError/Reason";
+    get message(): string;
+}
+declare const InvalidArgument_base: new <A extends Record<string, any> = {}>(args: import("../Types.ts").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("../Cause.ts").YieldableError & {
+    readonly _tag: "InvalidArgument";
+} & Readonly<A>;
+/**
+ * Reason for an option or configuration value that the operation rejects
+ * before doing any work, such as a non-HTTPS key-set URL.
+ *
+ * @stability unstable
+ * @category errors
+ * @since 4.1.1
+ */
+export declare class InvalidArgument extends InvalidArgument_base<{
+    readonly description: string;
+    readonly cause?: unknown;
+}> {
+    /**
+     * Marks this value as a `JoseError` reason for runtime guards.
+     *
+     * @since 4.1.1
+     */
+    readonly [ReasonTypeId]: "~effect/jose/JoseError/Reason";
+    get message(): string;
+}
+declare const AlgorithmNotAllowed_base: new <A extends Record<string, any> = {}>(args: import("../Types.ts").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("../Cause.ts").YieldableError & {
+    readonly _tag: "AlgorithmNotAllowed";
+} & Readonly<A>;
+/**
+ * Reason for a token whose protected `alg` is not the key's algorithm or is
+ * outside the allowlist.
+ *
+ * @stability unstable
+ * @category errors
+ * @since 4.1.1
+ */
+export declare class AlgorithmNotAllowed extends AlgorithmNotAllowed_base<{}> {
+    /**
+     * Marks this value as a `JoseError` reason for runtime guards.
+     *
+     * @since 4.1.1
+     */
+    readonly [ReasonTypeId]: "~effect/jose/JoseError/Reason";
+    get message(): string;
+}
+declare const SignatureVerificationFailed_base: new <A extends Record<string, any> = {}>(args: import("../Types.ts").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("../Cause.ts").YieldableError & {
+    readonly _tag: "SignatureVerificationFailed";
+} & Readonly<A>;
+/**
+ * Reason for a signature that does not authenticate the token.
+ *
+ * @stability unstable
+ * @category errors
+ * @since 4.1.1
+ */
+export declare class SignatureVerificationFailed extends SignatureVerificationFailed_base<{}> {
+    /**
+     * Marks this value as a `JoseError` reason for runtime guards.
+     *
+     * @since 4.1.1
+     */
+    readonly [ReasonTypeId]: "~effect/jose/JoseError/Reason";
+    get message(): string;
+}
+declare const DecryptionFailed_base: new <A extends Record<string, any> = {}>(args: import("../Types.ts").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("../Cause.ts").YieldableError & {
+    readonly _tag: "DecryptionFailed";
+} & Readonly<A>;
+/**
+ * Reason for ciphertext that fails authenticated decryption.
+ *
+ * @stability unstable
+ * @category errors
+ * @since 4.1.1
+ */
+export declare class DecryptionFailed extends DecryptionFailed_base<{}> {
+    /**
+     * Marks this value as a `JoseError` reason for runtime guards.
+     *
+     * @since 4.1.1
+     */
+    readonly [ReasonTypeId]: "~effect/jose/JoseError/Reason";
+    get message(): string;
+}
+declare const KeyNotFound_base: new <A extends Record<string, any> = {}>(args: import("../Types.ts").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("../Cause.ts").YieldableError & {
+    readonly _tag: "KeyNotFound";
+} & Readonly<A>;
+/**
+ * Reason for a key set with no key matching the algorithm and key id.
+ *
+ * @stability unstable
+ * @category errors
+ * @since 4.1.1
+ */
+export declare class KeyNotFound extends KeyNotFound_base<{}> {
+    /**
+     * Marks this value as a `JoseError` reason for runtime guards.
+     *
+     * @since 4.1.1
+     */
+    readonly [ReasonTypeId]: "~effect/jose/JoseError/Reason";
+    get message(): string;
+}
+declare const AmbiguousKey_base: new <A extends Record<string, any> = {}>(args: import("../Types.ts").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("../Cause.ts").YieldableError & {
+    readonly _tag: "AmbiguousKey";
+} & Readonly<A>;
+/**
+ * Reason for a key set with more than one key matching the algorithm and key
+ * id.
+ *
+ * @stability unstable
+ * @category errors
+ * @since 4.1.1
+ */
+export declare class AmbiguousKey extends AmbiguousKey_base<{}> {
+    /**
+     * Marks this value as a `JoseError` reason for runtime guards.
+     *
+     * @since 4.1.1
+     */
+    readonly [ReasonTypeId]: "~effect/jose/JoseError/Reason";
+    get message(): string;
+}
+declare const KeySetUnavailable_base: new <A extends Record<string, any> = {}>(args: import("../Types.ts").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("../Cause.ts").YieldableError & {
+    readonly _tag: "KeySetUnavailable";
+} & Readonly<A>;
+/**
+ * Reason for a remote key set that cannot be fetched or read, is cooling down
+ * after a failed refresh, or belongs to a closed layer.
+ *
+ * @stability unstable
+ * @category errors
+ * @since 4.1.1
+ */
+export declare class KeySetUnavailable extends KeySetUnavailable_base<{
+    readonly description: string;
+    readonly cause?: unknown;
+}> {
+    /**
+     * Marks this value as a `JoseError` reason for runtime guards.
+     *
+     * @since 4.1.1
+     */
+    readonly [ReasonTypeId]: "~effect/jose/JoseError/Reason";
+    get message(): string;
+}
+declare const ClaimValidationFailed_base: new <A extends Record<string, any> = {}>(args: import("../Types.ts").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("../Cause.ts").YieldableError & {
+    readonly _tag: "ClaimValidationFailed";
+} & Readonly<A>;
+/**
+ * Reason for a registered claim or `typ` header that is missing, malformed,
+ * different from the expected value, or outside its validity window.
+ *
+ * @stability unstable
+ * @category errors
+ * @since 4.1.1
+ */
+export declare class ClaimValidationFailed extends ClaimValidationFailed_base<{
+    readonly claim: "iss" | "sub" | "aud" | "exp" | "nbf" | "iat" | "jti" | "typ";
+    readonly reason: "invalid" | "missing" | "mismatch" | "expired" | "notYetValid" | "tooOld" | "future";
+}> {
+    /**
+     * Marks this value as a `JoseError` reason for runtime guards.
+     *
+     * @since 4.1.1
+     */
+    readonly [ReasonTypeId]: "~effect/jose/JoseError/Reason";
+    get message(): string;
+}
+/**
+ * Union of the reasons carried by `JoseError`.
+ *
+ * @stability unstable
+ * @category errors
+ * @since 4.1.1
+ */
+export type JoseErrorReason = InvalidToken | InvalidKey | InvalidArgument | AlgorithmNotAllowed | SignatureVerificationFailed | DecryptionFailed | KeyNotFound | AmbiguousKey | KeySetUnavailable | ClaimValidationFailed;
+declare const JoseError_base: new <A extends Record<string, any> = {}>(args: import("../Types.ts").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("../Cause.ts").YieldableError & {
+    readonly _tag: "JoseError";
+} & Readonly<A>;
+/**
+ * Error returned by the `effect/jose` modules.
+ *
+ * **Example** (Rejecting a token with a bad signature)
+ *
+ * ```ts import.meta.vitest
+ * import { Effect } from "effect"
+ * import { JoseError } from "effect/jose"
+ *
+ * const verify = Effect.fail(
+ *   new JoseError.JoseError({ reason: new JoseError.SignatureVerificationFailed() })
+ * )
+ *
+ * const program = verify.pipe(
+ *   Effect.catchReason("JoseError", "SignatureVerificationFailed", () => Effect.succeed("rejected"))
+ * )
+ *
+ * await Effect.runPromise(program) // => "rejected"
+ * ```
+ *
+ * @see {@link isJoseError} for narrowing unknown values
+ *
+ * @stability unstable
+ * @category errors
+ * @since 4.1.1
+ */
+export declare class JoseError extends JoseError_base<{
+    readonly reason: JoseErrorReason;
+}> {
+    /**
+     * Marks this value as a `JoseError` for runtime guards.
+     *
+     * @since 4.1.1
+     */
+    readonly [TypeId]: "~effect/jose/JoseError";
+    /**
+     * The reason's cause, when it has one.
+     *
+     * @since 4.1.1
+     */
+    readonly cause: unknown;
+    get message(): string;
+}
+/**
+ * Checks whether a value is a `JoseError`.
+ *
+ * @stability unstable
+ * @category guards
+ * @since 4.1.1
+ */
+export declare const isJoseError: (u: unknown) => u is JoseError;
+/**
+ * Checks whether a value is one of the reasons carried by `JoseError`.
+ *
+ * @stability unstable
+ * @category guards
+ * @since 4.1.1
+ */
+export declare const isJoseErrorReason: (u: unknown) => u is JoseErrorReason;
+export {};
+//# sourceMappingURL=JoseError.d.ts.map

package/dist/jose/JoseError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"JoseError.d.ts","sourceRoot":"","sources":["../../src/jose/JoseError.ts"],"names":[],"mappings":"AAqBA,QAAA,MAAM,MAAM,EAAG,wBAAiC,CAAA;AAChD,QAAA,MAAM,YAAY,EAAG,+BAAwC,CAAA;;;;AAE7D;;;;;;;GAOG;AACH,qBAAa,YAAa,SAAQ,kBAAiC;IACjE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B,CAAC;IACA;;;;OAIG;IACH,QAAQ,CAAC,CAAC,YAAY,CAAC,kCAAe;IAEtC,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED;;;;;;;GAOG;AACH,qBAAa,UAAW,SAAQ,gBAA+B;IAC7D,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;IACA;;;;OAIG;IACH,QAAQ,CAAC,CAAC,YAAY,CAAC,kCAAe;IAEtC,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED;;;;;;;GAOG;AACH,qBAAa,eAAgB,SAAQ,qBAAoC;IACvE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;IACA;;;;OAIG;IACH,QAAQ,CAAC,CAAC,YAAY,CAAC,kCAAe;IAEtC,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED;;;;;;;GAOG;AACH,qBAAa,mBAAoB,SAAQ,yBAAwC,EAAE,CAAC;IAClF;;;;OAIG;IACH,QAAQ,CAAC,CAAC,YAAY,CAAC,kCAAe;IAEtC,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED;;;;;;GAMG;AACH,qBAAa,2BAA4B,SAAQ,iCAAgD,EAAE,CAAC;IAClG;;;;OAIG;IACH,QAAQ,CAAC,CAAC,YAAY,CAAC,kCAAe;IAEtC,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED;;;;;;GAMG;AACH,qBAAa,gBAAiB,SAAQ,sBAAqC,EAAE,CAAC;IAC5E;;;;OAIG;IACH,QAAQ,CAAC,CAAC,YAAY,CAAC,kCAAe;IAEtC,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED;;;;;;GAMG;AACH,qBAAa,WAAY,SAAQ,iBAAgC,EAAE,CAAC;IAClE;;;;OAIG;IACH,QAAQ,CAAC,CAAC,YAAY,CAAC,kCAAe;IAEtC,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED;;;;;;;GAOG;AACH,qBAAa,YAAa,SAAQ,kBAAiC,EAAE,CAAC;IACpE;;;;OAIG;IACH,QAAQ,CAAC,CAAC,YAAY,CAAC,kCAAe;IAEtC,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED;;;;;;;GAOG;AACH,qBAAa,iBAAkB,SAAQ,uBAAsC;IAC3E,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CACzB,CAAC;IACA;;;;OAIG;IACH,QAAQ,CAAC,CAAC,YAAY,CAAC,kCAAe;IAEtC,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED;;;;;;;GAOG;AACH,qBAAa,qBAAsB,SAAQ,2BAA0C;IACnF,QAAQ,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAA;IAC7E,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,GAAG,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAA;CACtG,CAAC;IACA;;;;OAIG;IACH,QAAQ,CAAC,CAAC,YAAY,CAAC,kCAAe;IAEtC,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;AAED;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GACvB,YAAY,GACZ,UAAU,GACV,eAAe,GACf,mBAAmB,GACnB,2BAA2B,GAC3B,gBAAgB,GAChB,WAAW,GACX,YAAY,GACZ,iBAAiB,GACjB,qBAAqB,CAAA;;;;AAEzB;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,qBAAa,SAAU,SAAQ,eAA8B;IAC3D,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;CACjC,CAAC;IACA;;;;OAIG;IACH,QAAQ,CAAC,CAAC,MAAM,CAAC,2BAAS;IAE1B;;;;OAIG;IACH,SAAkB,KAAK,EAAE,OAAO,CAAyD;IAEzF,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;AAED;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,MAAO,OAAO,KAAG,CAAC,IAAI,SAA6C,CAAA;AAE3F;;;;;;GAMG;AACH,eAAO,MAAM,iBAAiB,MAAO,OAAO,KAAG,CAAC,IAAI,eAAyD,CAAA"}

package/dist/jose/JoseError.js

@@ -0,0 +1,269 @@
+/**
+ * The `JoseError` returned by the `effect/jose` modules, and the reasons it
+ * carries.
+ *
+ * Every failure is one `JoseError` whose `reason` says what went wrong. Reasons
+ * for configuration, transport, and key-import problems carry a `description`
+ * and, when there is one, a `cause`. Reasons for failed authentication carry
+ * nothing: they never describe tokens, claims, plaintext, or key material.
+ *
+ * **Gotchas**
+ *
+ * Map the error before it reaches a client, for example
+ * `SignatureVerificationFailed` to a 401. Sending verification detail to
+ * clients is how oracles leak.
+ *
+ * @stability unstable
+ * @since 4.1.1
+ */
+import * as Data from "../Data.js";
+import * as Predicate from "../Predicate.js";
+const TypeId = "~effect/jose/JoseError";
+const ReasonTypeId = "~effect/jose/JoseError/Reason";
+/**
+ * Reason for a malformed compact serialization, protected header, or payload,
+ * or for header parameters that are not supported, such as `crit`.
+ *
+ * @stability unstable
+ * @category errors
+ * @since 4.1.1
+ */
+export class InvalidToken extends /*#__PURE__*/Data.TaggedError("InvalidToken") {
+  /**
+   * Marks this value as a `JoseError` reason for runtime guards.
+   *
+   * @since 4.1.1
+   */
+  [ReasonTypeId] = ReasonTypeId;
+  get message() {
+    return this.description;
+  }
+}
+/**
+ * Reason for key material that cannot be imported, or that does not fit the
+ * selected algorithm or operation.
+ *
+ * @stability unstable
+ * @category errors
+ * @since 4.1.1
+ */
+export class InvalidKey extends /*#__PURE__*/Data.TaggedError("InvalidKey") {
+  /**
+   * Marks this value as a `JoseError` reason for runtime guards.
+   *
+   * @since 4.1.1
+   */
+  [ReasonTypeId] = ReasonTypeId;
+  get message() {
+    return this.description;
+  }
+}
+/**
+ * Reason for an option or configuration value that the operation rejects
+ * before doing any work, such as a non-HTTPS key-set URL.
+ *
+ * @stability unstable
+ * @category errors
+ * @since 4.1.1
+ */
+export class InvalidArgument extends /*#__PURE__*/Data.TaggedError("InvalidArgument") {
+  /**
+   * Marks this value as a `JoseError` reason for runtime guards.
+   *
+   * @since 4.1.1
+   */
+  [ReasonTypeId] = ReasonTypeId;
+  get message() {
+    return this.description;
+  }
+}
+/**
+ * Reason for a token whose protected `alg` is not the key's algorithm or is
+ * outside the allowlist.
+ *
+ * @stability unstable
+ * @category errors
+ * @since 4.1.1
+ */
+export class AlgorithmNotAllowed extends /*#__PURE__*/Data.TaggedError("AlgorithmNotAllowed") {
+  /**
+   * Marks this value as a `JoseError` reason for runtime guards.
+   *
+   * @since 4.1.1
+   */
+  [ReasonTypeId] = ReasonTypeId;
+  get message() {
+    return "The token algorithm is not allowed";
+  }
+}
+/**
+ * Reason for a signature that does not authenticate the token.
+ *
+ * @stability unstable
+ * @category errors
+ * @since 4.1.1
+ */
+export class SignatureVerificationFailed extends /*#__PURE__*/Data.TaggedError("SignatureVerificationFailed") {
+  /**
+   * Marks this value as a `JoseError` reason for runtime guards.
+   *
+   * @since 4.1.1
+   */
+  [ReasonTypeId] = ReasonTypeId;
+  get message() {
+    return "Could not verify the signature";
+  }
+}
+/**
+ * Reason for ciphertext that fails authenticated decryption.
+ *
+ * @stability unstable
+ * @category errors
+ * @since 4.1.1
+ */
+export class DecryptionFailed extends /*#__PURE__*/Data.TaggedError("DecryptionFailed") {
+  /**
+   * Marks this value as a `JoseError` reason for runtime guards.
+   *
+   * @since 4.1.1
+   */
+  [ReasonTypeId] = ReasonTypeId;
+  get message() {
+    return "Could not decrypt the token";
+  }
+}
+/**
+ * Reason for a key set with no key matching the algorithm and key id.
+ *
+ * @stability unstable
+ * @category errors
+ * @since 4.1.1
+ */
+export class KeyNotFound extends /*#__PURE__*/Data.TaggedError("KeyNotFound") {
+  /**
+   * Marks this value as a `JoseError` reason for runtime guards.
+   *
+   * @since 4.1.1
+   */
+  [ReasonTypeId] = ReasonTypeId;
+  get message() {
+    return "No key matches the algorithm and key id";
+  }
+}
+/**
+ * Reason for a key set with more than one key matching the algorithm and key
+ * id.
+ *
+ * @stability unstable
+ * @category errors
+ * @since 4.1.1
+ */
+export class AmbiguousKey extends /*#__PURE__*/Data.TaggedError("AmbiguousKey") {
+  /**
+   * Marks this value as a `JoseError` reason for runtime guards.
+   *
+   * @since 4.1.1
+   */
+  [ReasonTypeId] = ReasonTypeId;
+  get message() {
+    return "More than one key matches the algorithm and key id";
+  }
+}
+/**
+ * Reason for a remote key set that cannot be fetched or read, is cooling down
+ * after a failed refresh, or belongs to a closed layer.
+ *
+ * @stability unstable
+ * @category errors
+ * @since 4.1.1
+ */
+export class KeySetUnavailable extends /*#__PURE__*/Data.TaggedError("KeySetUnavailable") {
+  /**
+   * Marks this value as a `JoseError` reason for runtime guards.
+   *
+   * @since 4.1.1
+   */
+  [ReasonTypeId] = ReasonTypeId;
+  get message() {
+    return this.description;
+  }
+}
+/**
+ * Reason for a registered claim or `typ` header that is missing, malformed,
+ * different from the expected value, or outside its validity window.
+ *
+ * @stability unstable
+ * @category errors
+ * @since 4.1.1
+ */
+export class ClaimValidationFailed extends /*#__PURE__*/Data.TaggedError("ClaimValidationFailed") {
+  /**
+   * Marks this value as a `JoseError` reason for runtime guards.
+   *
+   * @since 4.1.1
+   */
+  [ReasonTypeId] = ReasonTypeId;
+  get message() {
+    return `The ${this.claim} claim failed validation: ${this.reason}`;
+  }
+}
+/**
+ * Error returned by the `effect/jose` modules.
+ *
+ * **Example** (Rejecting a token with a bad signature)
+ *
+ * ```ts import.meta.vitest
+ * import { Effect } from "effect"
+ * import { JoseError } from "effect/jose"
+ *
+ * const verify = Effect.fail(
+ *   new JoseError.JoseError({ reason: new JoseError.SignatureVerificationFailed() })
+ * )
+ *
+ * const program = verify.pipe(
+ *   Effect.catchReason("JoseError", "SignatureVerificationFailed", () => Effect.succeed("rejected"))
+ * )
+ *
+ * await Effect.runPromise(program) // => "rejected"
+ * ```
+ *
+ * @see {@link isJoseError} for narrowing unknown values
+ *
+ * @stability unstable
+ * @category errors
+ * @since 4.1.1
+ */
+export class JoseError extends /*#__PURE__*/Data.TaggedError("JoseError") {
+  /**
+   * Marks this value as a `JoseError` for runtime guards.
+   *
+   * @since 4.1.1
+   */
+  [TypeId] = TypeId;
+  /**
+   * The reason's cause, when it has one.
+   *
+   * @since 4.1.1
+   */
+  cause = "cause" in this.reason ? this.reason.cause : undefined;
+  get message() {
+    return this.reason.message;
+  }
+}
+/**
+ * Checks whether a value is a `JoseError`.
+ *
+ * @stability unstable
+ * @category guards
+ * @since 4.1.1
+ */
+export const isJoseError = u => Predicate.hasProperty(u, TypeId);
+/**
+ * Checks whether a value is one of the reasons carried by `JoseError`.
+ *
+ * @stability unstable
+ * @category guards
+ * @since 4.1.1
+ */
+export const isJoseErrorReason = u => Predicate.hasProperty(u, ReasonTypeId);
+//# sourceMappingURL=JoseError.js.map

package/dist/jose/JoseError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"JoseError.js","names":[],"sources":["../../src/jose/JoseError.ts"],"sourcesContent":[null],"mappings":"AAAA;;;;;;;;;;;;;;;;;;AAkBA,OAAO,KAAK,IAAI,MAAM,YAAY;AAClC,OAAO,KAAK,SAAS,MAAM,iBAAiB;AAE5C,MAAM,MAAM,GAAG,wBAAiC;AAChD,MAAM,YAAY,GAAG,+BAAwC;AAE7D;;;;;;;;AAQA,OAAM,MAAO,YAAa,sBAAQ,IAAI,CAAC,WAAW,CAAC,cAAc,CAE/D;EACA;;;;;EAKS,CAAC,YAAY,IAAI,YAAY;EAEtC,IAAa,OAAO;IAClB,OAAO,IAAI,CAAC,WAAW;EACzB;;AAGF;;;;;;;;AAQA,OAAM,MAAO,UAAW,sBAAQ,IAAI,CAAC,WAAW,CAAC,YAAY,CAG3D;EACA;;;;;EAKS,CAAC,YAAY,IAAI,YAAY;EAEtC,IAAa,OAAO;IAClB,OAAO,IAAI,CAAC,WAAW;EACzB;;AAGF;;;;;;;;AAQA,OAAM,MAAO,eAAgB,sBAAQ,IAAI,CAAC,WAAW,CAAC,iBAAiB,CAGrE;EACA;;;;;EAKS,CAAC,YAAY,IAAI,YAAY;EAEtC,IAAa,OAAO;IAClB,OAAO,IAAI,CAAC,WAAW;EACzB;;AAGF;;;;;;;;AAQA,OAAM,MAAO,mBAAoB,sBAAQ,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAK;EAClF;;;;;EAKS,CAAC,YAAY,IAAI,YAAY;EAEtC,IAAa,OAAO;IAClB,OAAO,oCAAoC;EAC7C;;AAGF;;;;;;;AAOA,OAAM,MAAO,2BAA4B,sBAAQ,IAAI,CAAC,WAAW,CAAC,6BAA6B,CAAK;EAClG;;;;;EAKS,CAAC,YAAY,IAAI,YAAY;EAEtC,IAAa,OAAO;IAClB,OAAO,gCAAgC;EACzC;;AAGF;;;;;;;AAOA,OAAM,MAAO,gBAAiB,sBAAQ,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAK;EAC5E;;;;;EAKS,CAAC,YAAY,IAAI,YAAY;EAEtC,IAAa,OAAO;IAClB,OAAO,6BAA6B;EACtC;;AAGF;;;;;;;AAOA,OAAM,MAAO,WAAY,sBAAQ,IAAI,CAAC,WAAW,CAAC,aAAa,CAAK;EAClE;;;;;EAKS,CAAC,YAAY,IAAI,YAAY;EAEtC,IAAa,OAAO;IAClB,OAAO,yCAAyC;EAClD;;AAGF;;;;;;;;AAQA,OAAM,MAAO,YAAa,sBAAQ,IAAI,CAAC,WAAW,CAAC,cAAc,CAAK;EACpE;;;;;EAKS,CAAC,YAAY,IAAI,YAAY;EAEtC,IAAa,OAAO;IAClB,OAAO,oDAAoD;EAC7D;;AAGF;;;;;;;;AAQA,OAAM,MAAO,iBAAkB,sBAAQ,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAGzE;EACA;;;;;EAKS,CAAC,YAAY,IAAI,YAAY;EAEtC,IAAa,OAAO;IAClB,OAAO,IAAI,CAAC,WAAW;EACzB;;AAGF;;;;;;;;AAQA,OAAM,MAAO,qBAAsB,sBAAQ,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAGjF;EACA;;;;;EAKS,CAAC,YAAY,IAAI,YAAY;EAEtC,IAAa,OAAO;IAClB,OAAO,OAAO,IAAI,CAAC,KAAK,6BAA6B,IAAI,CAAC,MAAM,EAAE;EACpE;;AAsBF;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,OAAM,MAAO,SAAU,sBAAQ,IAAI,CAAC,WAAW,CAAC,WAAW,CAEzD;EACA;;;;;EAKS,CAAC,MAAM,IAAI,MAAM;EAE1B;;;;;EAKkB,KAAK,GAAY,OAAO,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,GAAG,SAAS;EAEzF,IAAa,OAAO;IAClB,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO;EAC5B;;AAGF;;;;;;;AAOA,OAAO,MAAM,WAAW,GAAI,CAAU,IAAqB,SAAS,CAAC,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC;AAE3F;;;;;;;AAOA,OAAO,MAAM,iBAAiB,GAAI,CAAU,IAA2B,SAAS,CAAC,WAAW,CAAC,CAAC,EAAE,YAAY,CAAC","ignoreList":[]}

package/dist/jose/Jwe.d.ts

@@ -0,0 +1,128 @@
+/**
+ * Compact JSON Web Encryption with a shared key: `dir` key management and
+ * A256GCM content encryption.
+ *
+ * The protected header is authenticated as additional data, so changing it
+ * fails decryption. Headers with `crit` or `zip` are rejected.
+ *
+ * Bound untrusted token length before decryption; this module does not impose
+ * a token-size limit.
+ *
+ * @stability unstable
+ * @since 4.1.1
+ */
+import * as Aead from "../crypto/Aead.ts";
+import * as SecureRandom from "../crypto/SecureRandom.ts";
+import * as Effect from "../Effect.ts";
+import * as Redacted from "../Redacted.ts";
+import * as Schema from "../Schema.ts";
+import * as JoseError from "./JoseError.ts";
+import type { SecretKey } from "./Jwk.ts";
+/**
+ * Schema for a JWE protected header, including additional JSON-valued
+ * parameters.
+ *
+ * @stability unstable
+ * @category schemas
+ * @since 4.1.1
+ */
+export declare const ProtectedHeader: Schema.StructWithRest<Schema.Struct<{
+    readonly alg: Schema.Literal<"dir">;
+    readonly enc: Schema.Literal<"A256GCM">;
+    readonly kid: Schema.optionalKey<Schema.String>;
+    readonly typ: Schema.optionalKey<Schema.String>;
+    readonly cty: Schema.optionalKey<Schema.String>;
+}>, readonly [Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>]>;
+/**
+ * A JWE protected header. It is authenticated only after decryption succeeds.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.1.1
+ */
+export type ProtectedHeader = typeof ProtectedHeader.Type;
+/**
+ * Standard header parameters to protect. Encryption also accepts additional
+ * JSON-valued parameters. `alg` and `enc` are fixed and `kid` defaults to the
+ * key's.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.1.1
+ */
+export interface Header {
+    readonly alg?: never;
+    readonly enc?: never;
+    readonly crit?: never;
+    readonly zip?: never;
+    readonly kid?: string | undefined;
+    readonly typ?: string | undefined;
+    readonly cty?: string | undefined;
+}
+/**
+ * The protected header, plaintext, and key used to decrypt a JWE.
+ *
+ * @stability unstable
+ * @category models
+ * @since 4.1.1
+ */
+export interface Decrypted {
+    readonly protectedHeader: ProtectedHeader;
+    readonly plaintext: Uint8Array;
+    readonly key: SecretKey<"dir">;
+}
+/**
+ * Encrypts plaintext as a compact JWE with a random 96-bit IV.
+ *
+ * **Example** (Encrypting and decrypting a message)
+ *
+ * ```ts import.meta.vitest
+ * import { Effect, Layer, Redacted } from "effect"
+ * import { Aead, SecureRandom } from "effect/crypto"
+ * import { Jwe, Jwk } from "effect/jose"
+ *
+ * const layer = Aead.layerWebCrypto.pipe(Layer.provideMerge(SecureRandom.layerWebCrypto))
+ *
+ * const plaintext = await Effect.runPromise(Effect.gen(function*() {
+ *   // Fixed public example material; generate application secrets securely.
+ *   const key = yield* Jwk.importSecret(
+ *     Redacted.make({ kty: "oct", k: "BwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwcHBwc" } as const),
+ *     "dir"
+ *   )
+ *   const token = yield* Jwe.encrypt(new TextEncoder().encode("private message"), key)
+ *   const decrypted = yield* Jwe.decrypt(token, key)
+ *   return new TextDecoder().decode(decrypted.plaintext)
+ * }).pipe(Effect.provide(layer)))
+ * plaintext // => "private message"
+ * ```
+ *
+ * @see {@link decrypt}
+ *
+ * @stability unstable
+ * @category cryptography
+ * @since 4.1.1
+ */
+export declare const encrypt: <H extends object & { readonly [P in keyof H]: Schema.Json | undefined; } = Header>(plaintext: Uint8Array<ArrayBufferLike>, key: SecretKey<"dir">, header?: (Header & H) | undefined) => Effect.Effect<Redacted.Redacted<string>, JoseError.JoseError, Aead.Aead | SecureRandom.SecureRandom>;
+/**
+ * Decrypts a compact `dir`/A256GCM JWE and authenticates its protected
+ * header.
+ *
+ * **Details**
+ *
+ * Accepts a key or an effectful resolver for key rotation. The token's
+ * structure and supported header parameters are checked before the resolver
+ * runs. Resolver failures and service requirements are preserved.
+ *
+ * **Gotchas**
+ *
+ * The resolver receives an unauthenticated header and must use it only for
+ * key selection.
+ *
+ * @see {@link encrypt}
+ *
+ * @stability unstable
+ * @category cryptography
+ * @since 4.1.1
+ */
+export declare const decrypt: <E = never, R = never>(token: string | Redacted.Redacted<string>, key: SecretKey<"dir"> | ((header: ProtectedHeader) => Effect.Effect<SecretKey<"dir">, E, R>)) => Effect.Effect<Decrypted, E | JoseError.JoseError, R | Aead.Aead>;
+//# sourceMappingURL=Jwe.d.ts.map

package/dist/jose/Jwe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Jwe.d.ts","sourceRoot":"","sources":["../../src/jose/Jwe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,IAAI,MAAM,mBAAmB,CAAA;AACzC,OAAO,KAAK,YAAY,MAAM,2BAA2B,CAAA;AACzD,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AAEtC,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAA;AAC1C,OAAO,KAAK,MAAM,MAAM,cAAc,CAAA;AAUtC,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAA;AAC3C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,UAAU,CAAA;AAEzC;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe;;;;;;mGAS3B,CAAA;AAED;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,eAAe,CAAC,IAAI,CAAA;AAEzD;;;;;;;;GAQG;AACH,MAAM,WAAW,MAAM;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,CAAA;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,CAAA;IACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAA;IACrB,QAAQ,CAAC,GAAG,CAAC,EAAE,KAAK,CAAA;IACpB,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACjC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAClC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,eAAe,EAAE,eAAe,CAAA;IACzC,QAAQ,CAAC,SAAS,EAAE,UAAU,CAAA;IAC9B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,CAAA;CAC/B;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,OAAO,GAClB,CAAC,SAAS,MAAM,GAAG,EAAE,QAAQ,EAAE,CAAC,IAAI,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,SAAS,GAAE,oNAgBvE,CAAA;AAEF;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,OAAO,GAA+B,CAAC,UAAU,CAAC,uFAE3B,eAAe,KAAK,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,sEA2B3F,CAAA"}