inray 0.0.9 → 0.0.10

package/dist/jose/src/jwe/general/encrypt.js

@@ -1,21 +1,18 @@
 /**
- * Original library: jose (v6.2.8)
+ * Original library: jose (v6.2.15)
  * - Copyright (c) 2018 Filip Skokan
  *
  * Modified and integrated in "Inray":
  * - Evgeniy Bushin
  */
 /***/
-import { FlattenedEncrypt } from '../flattened/encrypt.js';
-import { assertNotSet } from '../../lib/helpers.js';
+import { assertNotSet, assertUint8Array } from '../../lib/validate.js';
 import { JWEInvalid } from '../../util/errors.js';
 import { generateCek } from '../../lib/content_encryption.js';
-import { encryptKeyManagement } from '../../lib/key_management.js';
 import { encode as b64u } from '../../util/base64url.js';
-import { validateCritDuplicates } from '../../lib/options.js';
-import { checkEncryptHeaders, encryptJWE } from '../../lib/jwe_encrypt.js';
-import { prepareKey } from '../../lib/key.js';
-import { jweAlgorithm } from '../../lib/jwe_algorithms.js';
+import { checkDisjoint, checkEncryptHeaders, encryptJWE } from '../../lib/jwe_encrypt.js';
+import { encryptKeyManagement } from '../../lib/key_management.js';
+import { isJWECEKTransport, jweAlgorithm } from '../../lib/jwe_algorithms.js';
 class IndividualRecipient {
     #parent;
     state;
@@ -43,19 +40,8 @@ class IndividualRecipient {
         return this.#parent;
     }
 }
-function copyOptionalMembers(flattened, jwe, recipient) {
-    const { aad, protected: protectedHeader, unprotected, header } = flattened;
-    if (aad)
-        jwe.aad = aad;
-    if (protectedHeader)
-        jwe.protected = protectedHeader;
-    if (unprotected)
-        jwe.unprotected = unprotected;
-    if (header)
-        recipient.header = header;
-}
 /**
- * The GeneralEncrypt class is used to build and encrypt General JWE objects.
+ * Produces general JWE JSON Serialization using authenticated encryption.
  *
  * This class is exported (as a named export) from the main `'jose'` module entry point as well as
  * from its subpath export `'jose/jwe/general/encrypt'`.
@@ -80,10 +66,10 @@ export class GeneralEncrypt {
     #plaintext;
     #recipients = [];
     #protectedHeader;
-    #unprotectedHeader;
+    #sharedUnprotectedHeader;
     #aad;
     /**
-     * {@link GeneralEncrypt} constructor
+     * Creates an encryptor for general JWE JSON Serialization.
      *
      * @param plaintext Binary representation of the plaintext to encrypt.
      */
@@ -91,10 +77,10 @@ export class GeneralEncrypt {
         this.#plaintext = plaintext;
     }
     /**
-     * Adds an additional recipient for the General JWE object.
+     * Adds a recipient and returns its configuration.
      *
-     * @param key Public Key or Secret to encrypt the Content Encryption Key for the recipient with.
-     *   See {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+     * @param key Public key or shared secret. See
+     *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
      * @param options JWE Encryption options.
      */
     addRecipient(key, options) {
@@ -103,7 +89,7 @@ export class GeneralEncrypt {
         return recipient;
     }
     /**
-     * Sets the JWE Protected Header on the GeneralEncrypt object.
+     * Sets the JWE Protected Header. May only be called once.
      *
      * @param protectedHeader JWE Protected Header object.
      */
@@ -113,111 +99,105 @@ export class GeneralEncrypt {
         return this;
     }
     /**
-     * Sets the JWE Shared Unprotected Header on the GeneralEncrypt object.
+     * Sets the JWE Shared Unprotected Header. May only be called once.
      *
      * @param sharedUnprotectedHeader JWE Shared Unprotected Header object.
      */
     setSharedUnprotectedHeader(sharedUnprotectedHeader) {
-        assertNotSet(this.#unprotectedHeader, 'setSharedUnprotectedHeader');
-        this.#unprotectedHeader = sharedUnprotectedHeader;
+        assertNotSet(this.#sharedUnprotectedHeader, 'setSharedUnprotectedHeader');
+        this.#sharedUnprotectedHeader = sharedUnprotectedHeader;
         return this;
     }
     /**
-     * Sets the Additional Authenticated Data on the GeneralEncrypt object.
+     * Sets the JWE AAD, which is integrity protected but not encrypted.
+     *
+     * Its base64url encoding is combined with the Encoded Protected Header to form the Additional
+     * Authenticated Data encryption parameter. See
+     * {@link https://www.ietf.org/archive/id/draft-ietf-jose-hpke-encrypt-22.html#section-7.1 draft-ietf-jose-hpke-encrypt-22, Section 7.1, step 15}.
      *
-     * @param aad Additional Authenticated Data.
+     * @param aad JWE Additional Authenticated Data (JWE AAD).
      */
     setAdditionalAuthenticatedData(aad) {
         this.#aad = aad;
         return this;
     }
-    /** Encrypts and resolves the value of the General JWE object. */
+    /** Encrypts the plaintext and returns the general JWE JSON Serialization. */
     async encrypt() {
         if (!this.#recipients.length) {
             throw new JWEInvalid('at least one recipient must be added');
         }
-        if (!(this.#plaintext instanceof Uint8Array)) {
-            throw new TypeError('plaintext must be an instance of Uint8Array');
-        }
-        if (this.#recipients.length === 1) {
-            const [recipient] = this.#recipients;
-            const [unprotectedHeader, keyManagementParameters, key, crit] = recipient.state;
-            const flattened = await new FlattenedEncrypt(this.#plaintext)
-                .setAdditionalAuthenticatedData(this.#aad)
-                .setProtectedHeader(this.#protectedHeader)
-                .setSharedUnprotectedHeader(this.#unprotectedHeader)
-                .setUnprotectedHeader(unprotectedHeader)
-                .setKeyManagementParameters(keyManagementParameters)
-                .encrypt(key, { crit });
-            const jwe = {
-                ciphertext: flattened.ciphertext,
-                iv: flattened.iv,
-                recipients: [{}],
-                tag: flattened.tag,
-            };
-            if (flattened.encrypted_key)
-                jwe.recipients[0].encrypted_key = flattened.encrypted_key;
-            copyOptionalMembers(flattened, jwe, jwe.recipients[0]);
-            return jwe;
-        }
-        validateCritDuplicates(JWEInvalid, this.#protectedHeader);
+        assertUint8Array(this.#plaintext, 'plaintext');
+        const multiple = this.#recipients.length > 1;
         let enc;
-        const inputs = [];
-        const checked = [];
-        for (let i = 0; i < this.#recipients.length; i++) {
-            const recipient = this.#recipients[i];
-            const [unprotectedHeader, keyManagementParameters, , crit] = recipient.state;
+        let protectedHeader = this.#protectedHeader;
+        let sharedUnprotectedHeader = this.#sharedUnprotectedHeader;
+        const recipients = [];
+        for (const recipient of this.#recipients) {
+            const [unprotectedHeader, keyManagementParameters, key, crit] = recipient.state;
             const input = [
                 this.#plaintext,
-                this.#protectedHeader,
+                protectedHeader,
                 unprotectedHeader,
-                this.#unprotectedHeader,
+                sharedUnprotectedHeader,
                 this.#aad,
                 undefined,
                 undefined,
                 keyManagementParameters,
                 crit,
-                true,
+                multiple
             ];
-            const headers = checkEncryptHeaders(input);
-            inputs.push(input);
-            checked.push(headers);
-            if (headers[1] === 'dir' || headers[1] === 'ECDH-ES') {
-                throw new JWEInvalid(`"${headers[1]}" alg may only have a single recipient`);
+            const headers = checkEncryptHeaders(input, undefined, recipients.length > 0);
+            if (!recipients.length) {
+                protectedHeader = input[1];
+                sharedUnprotectedHeader = input[3];
+            }
+            recipients.push([input, headers, key]);
+            const [{ alg, enc: recipientEnc }, , algEntry] = headers;
+            // draft-ietf-jose-hpke-encrypt-22, Section 7.2, step 7: single-recipient modes.
+            if (multiple && algEntry && !isJWECEKTransport(algEntry)) {
+                throw new JWEInvalid(`"${alg}" alg may only have a single recipient`);
             }
             if (!enc) {
-                enc = headers[2];
+                enc = recipientEnc;
             }
-            else if (enc !== headers[2]) {
+            else if (enc !== recipientEnc) {
                 throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');
             }
         }
-        const cek = generateCek(checked[0][3]);
+        for (const [, headers] of recipients) {
+            headers[2] ??= jweAlgorithm(headers[0].alg);
+        }
+        const [firstInput, firstHeaders, firstKey] = recipients[0];
+        // draft-ietf-jose-hpke-encrypt-22, Section 7.1, steps 2 and 9: reuse one CEK.
+        const cek = multiple ? generateCek(firstHeaders[1]) : undefined;
+        firstInput[5] = cek;
+        const { encrypted_key, header, ...shared } = await encryptJWE(firstInput, firstHeaders, firstKey);
         const jwe = {
-            ciphertext: '',
-            recipients: [],
+            ...shared,
+            recipients: [{}]
         };
-        for (let i = 0; i < this.#recipients.length; i++) {
-            const recipient = this.#recipients[i];
-            const [unprotectedHeader, keyManagementParameters, key] = recipient.state;
-            const target = {};
-            jwe.recipients.push(target);
-            if (i === 0) {
-                inputs[0][5] = cek;
-                const flattened = await encryptJWE(inputs[0], checked[0], key);
-                jwe.ciphertext = flattened.ciphertext;
-                jwe.iv = flattened.iv;
-                jwe.tag = flattened.tag;
-                target.encrypted_key = flattened.encrypted_key;
-                copyOptionalMembers(flattened, jwe, target);
-                continue;
+        if (encrypted_key)
+            jwe.recipients[0].encrypted_key = encrypted_key;
+        if (header)
+            jwe.recipients[0].header = header;
+        // RFC 7516, Section 7.2.1: all recipients share the ciphertext, IV, and Authentication Tag.
+        for (let i = 1; i < recipients.length; i++) {
+            const [input, [joseHeader, encEntry, algEntry], key] = recipients[i];
+            const unprotectedHeader = input[2];
+            const [, encryptedKey, parameters] = await encryptKeyManagement(algEntry, encEntry, key, joseHeader, cek, input[7]);
+            const target = {
+                encrypted_key: b64u(encryptedKey)
+            };
+            if (unprotectedHeader || parameters) {
+                const header = { ...unprotectedHeader, ...parameters };
+                // The generated Key Management Parameters join the JWE Per-Recipient Unprotected Header
+                // only after the headers were checked, so a name they collide with in another header would
+                // otherwise reach the result.
+                if (parameters)
+                    checkDisjoint(input[1], header, input[3]);
+                target.header = header;
             }
-            const [, alg, , encEntry] = checked[i];
-            const k = await prepareKey(jweAlgorithm(alg), key, 'encrypt');
-            const [, encryptedKey, parameters] = await encryptKeyManagement(alg, encEntry, k, cek, keyManagementParameters);
-            target.encrypted_key = b64u(encryptedKey);
-            if (unprotectedHeader || parameters)
-                target.header = { ...unprotectedHeader, ...parameters };
+            jwe.recipients.push(target);
         }
         return jwe;
     }

package/dist/jose/src/jwe/general/encrypt.js.map

@@ -1 +1 @@
-{"version":3,"file":"encrypt.js","sourceRoot":"","sources":["../../../../../src/jose/src/jwe/general/encrypt.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,KAAK;AASL,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AACnD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAA;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAClE,OAAO,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,yBAAyB,CAAA;AACxD,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAC7D,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAE1E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAgD1D,MAAM,mBAAmB;IACvB,OAAO,CAAgB;IACvB,KAAK,CAAgB;IAErB,YAAY,GAAmB,EAAE,GAAmB,EAAE,IAA8B;QAClF,IAAI,CAAC,OAAO,GAAG,GAAG,CAAA;QAClB,IAAI,CAAC,KAAK,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IAChD,CAAC;IAED,oBAAoB,CAAC,iBAA4C;QAC/D,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAA;QACnD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAA;QACjC,OAAO,IAAI,CAAA;IACb,CAAC;IAED,0BAA0B,CAAC,UAAkD;QAC3E,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAA;QACzD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,UAAU,CAAA;QAC1B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,YAAY,CAAC,GAAG,IAAgD;QAC9D,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,CAAA;IAC3C,CAAC;IAED,OAAO,CAAC,GAAG,IAA2C;QACpD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAA;IACtC,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,CAAA;IACrB,CAAC;CACF;AAED,SAAS,mBAAmB,CAC1B,SAA6B,EAC7B,GAAqB,EACrB,SAAiD;IAEjD,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,SAAS,CAAA;IAC1E,IAAI,GAAG;QAAE,GAAG,CAAC,GAAG,GAAG,GAAG,CAAA;IACtB,IAAI,eAAe;QAAE,GAAG,CAAC,SAAS,GAAG,eAAe,CAAA;IACpD,IAAI,WAAW;QAAE,GAAG,CAAC,WAAW,GAAG,WAAW,CAAA;IAC9C,IAAI,MAAM;QAAE,SAAS,CAAC,MAAM,GAAG,MAAM,CAAA;AACvC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAO,cAAc;IACzB,UAAU,CAAY;IAEtB,WAAW,GAA0B,EAAE,CAAA;IAEvC,gBAAgB,CAA4B;IAE5C,kBAAkB,CAA4B;IAE9C,IAAI,CAAa;IAEjB;;;;OAIG;IACH,YAAY,SAAqB;QAC/B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAA;IAC7B,CAAC;IAED;;;;;;OAMG;IACH,YAAY,CAAC,GAAmB,EAAE,OAA0B;QAC1D,MAAM,SAAS,GAAG,IAAI,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;QACnE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAChC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED;;;;OAIG;IACH,kBAAkB,CAAC,eAA0C;QAC3D,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAAA;QACzD,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAA;QACvC,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;OAIG;IACH,0BAA0B,CAAC,uBAAkD;QAC3E,YAAY,CAAC,IAAI,CAAC,kBAAkB,EAAE,4BAA4B,CAAC,CAAA;QACnE,IAAI,CAAC,kBAAkB,GAAG,uBAAuB,CAAA;QACjD,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;OAIG;IACH,8BAA8B,CAAC,GAAe;QAC5C,IAAI,CAAC,IAAI,GAAG,GAAG,CAAA;QACf,OAAO,IAAI,CAAA;IACb,CAAC;IAED,iEAAiE;IACjE,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,UAAU,CAAC,sCAAsC,CAAC,CAAA;QAC9D,CAAC;QAED,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,YAAY,UAAU,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAA;QACpE,CAAC;QAED,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,MAAM,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,WAAW,CAAA;YACpC,MAAM,CAAC,iBAAiB,EAAE,uBAAuB,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,CAAA;YAE/E,MAAM,SAAS,GAAG,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,UAAU,CAAC;iBAC1D,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC;iBACzC,kBAAkB,CAAC,IAAI,CAAC,gBAAgB,CAAC;iBACzC,0BAA0B,CAAC,IAAI,CAAC,kBAAkB,CAAC;iBACnD,oBAAoB,CAAC,iBAAkB,CAAC;iBACxC,0BAA0B,CAAC,uBAAwB,CAAC;iBACpD,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,CAAA;YAEzB,MAAM,GAAG,GAAqB;gBAC5B,UAAU,EAAE,SAAS,CAAC,UAAU;gBAChC,EAAE,EAAE,SAAS,CAAC,EAAE;gBAChB,UAAU,EAAE,CAAC,EAAE,CAAC;gBAChB,GAAG,EAAE,SAAS,CAAC,GAAG;aACnB,CAAA;YAED,IAAI,SAAS,CAAC,aAAa;gBAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,aAAa,GAAG,SAAS,CAAC,aAAa,CAAA;YACtF,mBAAmB,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAA;YAEtD,OAAO,GAAG,CAAA;QACZ,CAAC;QAED,sBAAsB,CAAC,UAAU,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAEzD,IAAI,GAAY,CAAA;QAChB,MAAM,MAAM,GAAmB,EAAE,CAAA;QACjC,MAAM,OAAO,GAAqB,EAAE,CAAA;QACpC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;YACrC,MAAM,CAAC,iBAAiB,EAAE,uBAAuB,EAAE,AAAD,EAAG,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,CAAA;YAE5E,MAAM,KAAK,GAAiB;gBAC1B,IAAI,CAAC,UAAU;gBACf,IAAI,CAAC,gBAAgB;gBACrB,iBAAiB;gBACjB,IAAI,CAAC,kBAAkB;gBACvB,IAAI,CAAC,IAAI;gBACT,SAAS;gBACT,SAAS;gBACT,uBAAuB;gBACvB,IAAI;gBACJ,IAAI;aACL,CAAA;YACD,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAA;YAC1C,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClB,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAErB,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBACrD,MAAM,IAAI,UAAU,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,wCAAwC,CAAC,CAAA;YAC9E,CAAC;YAED,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;YAClB,CAAC;iBAAM,IAAI,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9B,MAAM,IAAI,UAAU,CAClB,uFAAuF,CACxF,CAAA;YACH,CAAC;QACH,CAAC;QAED,MAAM,GAAG,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAEtC,MAAM,GAAG,GAAqB;YAC5B,UAAU,EAAE,EAAE;YACd,UAAU,EAAE,EAAE;SACf,CAAA;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACjD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAA;YACrC,MAAM,CAAC,iBAAiB,EAAE,uBAAuB,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC,KAAK,CAAA;YACzE,MAAM,MAAM,GAAuD,EAAE,CAAA;YACrE,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAE3B,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBACZ,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAA;gBAClB,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;gBAE9D,GAAG,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAA;gBACrC,GAAG,CAAC,EAAE,GAAG,SAAS,CAAC,EAAE,CAAA;gBACrB,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,CAAA;gBAEvB,MAAM,CAAC,aAAa,GAAG,SAAS,CAAC,aAAc,CAAA;gBAC/C,mBAAmB,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;gBAE3C,SAAQ;YACV,CAAC;YAED,MAAM,CAAC,EAAE,GAAG,EAAE,AAAD,EAAG,QAAQ,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;YAEtC,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,SAAS,CAAC,CAAA;YAC7D,MAAM,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,GAAG,MAAM,oBAAoB,CAC7D,GAAG,EACH,QAAQ,EACR,CAAC,EACD,GAAG,EACH,uBAAuB,CACxB,CAAA;YACD,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC,YAAa,CAAC,CAAA;YAC1C,IAAI,iBAAiB,IAAI,UAAU;gBAAE,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,iBAAiB,EAAE,GAAG,UAAU,EAAE,CAAA;QAC9F,CAAC;QAED,OAAO,GAAuB,CAAA;IAChC,CAAC;CACF"}
+{"version":3,"file":"encrypt.js","sourceRoot":"","sources":["../../../../../src/jose/src/jwe/general/encrypt.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,KAAK;AAWL,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,iCAAiC,CAAC;AAC9D,OAAO,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAC1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AA+C9E,MAAM,mBAAmB;IACvB,OAAO,CAAiB;IACxB,KAAK,CAAiB;IAEtB,YAAY,GAAmB,EAAE,GAAmB,EAAE,IAA8B;QAClF,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC;QACnB,IAAI,CAAC,KAAK,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAED,oBAAoB,CAAC,iBAA4C;QAC/D,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC;QACpD,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,0BAA0B,CAAC,UAAkD;QAC3E,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,YAAY,CAAC,GAAG,IAAgD;QAC9D,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,CAAC,GAAG,IAA2C;QACpD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC;IACvC,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAO,cAAc;IACzB,UAAU,CAAa;IAEvB,WAAW,GAA0B,EAAE,CAAC;IAExC,gBAAgB,CAA6B;IAE7C,wBAAwB,CAA6B;IAErD,IAAI,CAAc;IAElB;;;;OAIG;IACH,YAAY,SAAqB;QAC/B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;IAC9B,CAAC;IAED;;;;;;OAMG;IACH,YAAY,CAAC,GAAmB,EAAE,OAA0B;QAC1D,MAAM,SAAS,GAAG,IAAI,mBAAmB,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACpE,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,kBAAkB,CAAC,eAA0C;QAC3D,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAAC;QAC1D,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,0BAA0B,CAAC,uBAAkD;QAC3E,YAAY,CAAC,IAAI,CAAC,wBAAwB,EAAE,4BAA4B,CAAC,CAAC;QAC1E,IAAI,CAAC,wBAAwB,GAAG,uBAAuB,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACH,8BAA8B,CAAC,GAAe;QAC5C,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6EAA6E;IAC7E,KAAK,CAAC,OAAO;QACX,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YAC7B,MAAM,IAAI,UAAU,CAAC,sCAAsC,CAAC,CAAC;QAC/D,CAAC;QAED,gBAAgB,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC;QAE/C,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC;QAC7C,IAAI,GAAuB,CAAC;QAC5B,IAAI,eAAe,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAC5C,IAAI,uBAAuB,GAAG,IAAI,CAAC,wBAAwB,CAAC;QAC5D,MAAM,UAAU,GAA0E,EAAE,CAAC;QAC7F,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACzC,MAAM,CAAC,iBAAiB,EAAE,uBAAuB,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC;YAEhF,MAAM,KAAK,GAAiB;gBAC1B,IAAI,CAAC,UAAU;gBACf,eAAe;gBACf,iBAAiB;gBACjB,uBAAuB;gBACvB,IAAI,CAAC,IAAI;gBACT,SAAS;gBACT,SAAS;gBACT,uBAAuB;gBACvB,IAAI;gBACJ,QAAQ;aACT,CAAC;YACF,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAC7E,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;gBACvB,eAAe,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;gBAC5B,uBAAuB,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;YACtC,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YAEvC,MAAM,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,AAAD,EAAG,QAAQ,CAAC,GAAG,OAAO,CAAC;YACzD,gFAAgF;YAChF,IAAI,QAAQ,IAAI,QAAQ,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzD,MAAM,IAAI,UAAU,CAAC,IAAI,GAAG,wCAAwC,CAAC,CAAC;YACxE,CAAC;YAED,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,GAAG,GAAG,YAAY,CAAC;YACrB,CAAC;iBAAM,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;gBAChC,MAAM,IAAI,UAAU,CAAC,uFAAuF,CAAC,CAAC;YAChH,CAAC;QACH,CAAC;QAED,KAAK,MAAM,CAAC,EAAE,OAAO,CAAC,IAAI,UAAU,EAAE,CAAC;YACrC,OAAO,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC;QACD,MAAM,CAAC,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;QAC3D,8EAA8E;QAC9E,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,UAAU,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;QACpB,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,UAAU,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC;QAElG,MAAM,GAAG,GAAqB;YAC5B,GAAG,MAAM;YACT,UAAU,EAAE,CAAC,EAAE,CAAC;SACjB,CAAC;QACF,IAAI,aAAa;YAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,aAAa,GAAG,aAAa,CAAC;QACnE,IAAI,MAAM;YAAE,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC;QAE9C,4FAA4F;QAC5F,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3C,MAAM,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;YACrE,MAAM,iBAAiB,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YAEnC,MAAM,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,GAAG,MAAM,oBAAoB,CAC7D,QAAoC,EACpC,QAAS,EACT,GAAG,EACH,UAAU,EACV,GAAG,EACH,KAAK,CAAC,CAAC,CAAC,CACT,CAAC;YACF,MAAM,MAAM,GAA2C;gBACrD,aAAa,EAAE,IAAI,CAAC,YAAa,CAAC;aACnC,CAAC;YACF,IAAI,iBAAiB,IAAI,UAAU,EAAE,CAAC;gBACpC,MAAM,MAAM,GAA8B,EAAE,GAAG,iBAAiB,EAAE,GAAG,UAAU,EAAE,CAAC;gBAClF,wFAAwF;gBACxF,2FAA2F;gBAC3F,8BAA8B;gBAC9B,IAAI,UAAU;oBAAE,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC1D,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;YACzB,CAAC;YACD,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}

package/dist/jose/src/jwk/embedded.d.ts

@@ -1,5 +1,5 @@
 /**
- * Original library: jose (v6.2.8)
+ * Original library: jose (v6.2.15)
  * - Copyright (c) 2018 Filip Skokan
  *
  * Modified and integrated in "Inray":
@@ -13,11 +13,9 @@
  */
 import type * as types from '../types.d.ts';
 /**
- * EmbeddedJWK is an implementation of a {@link types.GetKeyFunction GetKeyFunction} intended to be
- * used with the JWS/JWT verify operations whenever you need to opt-in to verify signatures with a
- * public key embedded in the token's "jwk" (JSON Web Key) Header Parameter. It is recommended to
- * combine this with the verify function's `algorithms` option to define accepted JWS "alg"
- * (Algorithm) Header Parameter values.
+ * Resolves a verification key from an embedded "jwk" (JSON Web Key) Header Parameter. This key
+ * resolver opts JWS and JWT verification into trusting a public key supplied by the token. Use the
+ * verification function's `algorithms` option to restrict accepted algorithms.
  *
  * This function is exported (as a named export) from the main `'jose'` module entry point as well
  * as from its subpath export `'jose/jwk/embedded'`.

package/dist/jose/src/jwk/embedded.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"embedded.d.ts","sourceRoot":"","sources":["../../../../src/jose/src/jwk/embedded.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,KAAK;AAEL;;;;GAIG;AAEH,OAAO,KAAK,KAAK,KAAK,MAAM,eAAe,CAAA;AAM3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,WAAW,CAC/B,eAAe,CAAC,EAAE,KAAK,CAAC,mBAAmB,EAC3C,KAAK,CAAC,EAAE,KAAK,CAAC,iBAAiB,GAC9B,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAiB1B"}
+{"version":3,"file":"embedded.d.ts","sourceRoot":"","sources":["../../../../src/jose/src/jwk/embedded.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,KAAK;AAEL;;;;GAIG;AAEH,OAAO,KAAK,KAAK,KAAK,MAAM,eAAe,CAAC;AAM5C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,WAAW,CAC/B,eAAe,CAAC,EAAE,KAAK,CAAC,mBAAmB,EAC3C,KAAK,CAAC,EAAE,KAAK,CAAC,iBAAiB,GAC9B,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAgC1B"}

package/dist/jose/src/jwk/embedded.js

@@ -1,21 +1,19 @@
 /**
- * Original library: jose (v6.2.8)
+ * Original library: jose (v6.2.15)
  * - Copyright (c) 2018 Filip Skokan
  *
  * Modified and integrated in "Inray":
  * - Evgeniy Bushin
  */
 /***/
-import { jwkToKey } from '../lib/jwk_to_key.js';
+import { jwkToKey, normalizeJwk } from '../lib/key.js';
 import { jwsAlgorithm } from '../lib/jws_algorithms.js';
-import { isObject } from '../lib/type_checks.js';
+import { isObject } from '../lib/validate.js';
 import { JWSInvalid } from '../util/errors.js';
 /**
- * EmbeddedJWK is an implementation of a {@link types.GetKeyFunction GetKeyFunction} intended to be
- * used with the JWS/JWT verify operations whenever you need to opt-in to verify signatures with a
- * public key embedded in the token's "jwk" (JSON Web Key) Header Parameter. It is recommended to
- * combine this with the verify function's `algorithms` option to define accepted JWS "alg"
- * (Algorithm) Header Parameter values.
+ * Resolves a verification key from an embedded "jwk" (JSON Web Key) Header Parameter. This key
+ * resolver opts JWS and JWT verification into trusting a public key supplied by the token. Use the
+ * verification function's `algorithms` option to restrict accepted algorithms.
  *
  * This function is exported (as a named export) from the main `'jose'` module entry point as well
  * as from its subpath export `'jose/jwk/embedded'`.
@@ -43,13 +41,28 @@ import { JWSInvalid } from '../util/errors.js';
 export async function EmbeddedJWK(protectedHeader, token) {
     const joseHeader = {
         ...protectedHeader,
-        ...token?.header,
+        ...token?.header
     };
     if (!isObject(joseHeader.jwk)) {
         throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');
     }
+    let jwk;
+    try {
+        jwk = normalizeJwk(joseHeader.jwk);
+    }
+    catch (cause) {
+        throw new JWSInvalid('Invalid Embedded JWK', { cause });
+    }
     const entry = jwsAlgorithm(joseHeader.alg);
-    const key = await jwkToKey(entry, { ...joseHeader.jwk, ext: true });
+    // RFC 7517, Sections 4.2 and 4.4: respect declared key use and algorithm.
+    if (jwk.use !== undefined && jwk.use !== 'sig') {
+        throw new JWSInvalid('Invalid Embedded JWK, its "use" must be "sig" when present');
+    }
+    if (jwk.alg !== undefined && jwk.alg !== entry.alg) {
+        throw new JWSInvalid(`Invalid Embedded JWK, its "alg" must be "${entry.alg}" when present`);
+    }
+    const key = await jwkToKey(entry, jwk, true);
+    // RFC 7515, Section 4.1.3: the jwk Header Parameter represents a public key.
     if (key.type !== 'public') {
         throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
     }

package/dist/jose/src/jwk/embedded.js.map

@@ -1 +1 @@
-{"version":3,"file":"embedded.js","sourceRoot":"","sources":["../../../../src/jose/src/jwk/embedded.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,KAAK;AASL,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAA;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAChD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAE9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,eAA2C,EAC3C,KAA+B;IAE/B,MAAM,UAAU,GAAG;QACjB,GAAG,eAAe;QAClB,GAAG,KAAK,EAAE,MAAM;KACjB,CAAA;IACD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,UAAU,CAAC,6DAA6D,CAAC,CAAA;IACrF,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;IAC1C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAA;IAEnE,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,UAAU,CAAC,4DAA4D,CAAC,CAAA;IACpF,CAAC;IAED,OAAO,GAAG,CAAA;AACZ,CAAC"}
+{"version":3,"file":"embedded.js","sourceRoot":"","sources":["../../../../src/jose/src/jwk/embedded.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,KAAK;AASL,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,eAA2C,EAC3C,KAA+B;IAE/B,MAAM,UAAU,GAAG;QACjB,GAAG,eAAe;QAClB,GAAG,KAAK,EAAE,MAAM;KACjB,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,UAAU,CAAC,6DAA6D,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,GAAc,CAAC;IACnB,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,UAAU,CAAC,sBAAsB,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC3C,0EAA0E;IAC1E,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QAC/C,MAAM,IAAI,UAAU,CAAC,4DAA4D,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC;QACnD,MAAM,IAAI,UAAU,CAAC,4CAA4C,KAAK,CAAC,GAAG,gBAAgB,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAE7C,6EAA6E;IAC7E,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,UAAU,CAAC,4DAA4D,CAAC,CAAC;IACrF,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/jose/src/jwk/thumbprint.d.ts

@@ -1,5 +1,5 @@
 /**
- * Original library: jose (v6.2.8)
+ * Original library: jose (v6.2.15)
  * - Copyright (c) 2018 Filip Skokan
  *
  * Modified and integrated in "Inray":
@@ -8,7 +8,7 @@
 /***/
 import type * as types from '../types.d.ts';
 /**
- * Calculates a base64url-encoded JSON Web Key (JWK) Thumbprint
+ * Calculates a base64url-encoded JWK Thumbprint. CryptoKey inputs must be extractable.
  *
  * This function is exported (as a named export) from the main `'jose'` module entry point as well
  * as from its subpath export `'jose/jwk/thumbprint'`.
@@ -28,14 +28,13 @@ import type * as types from '../types.d.ts';
  * ```
  *
  * @param key Key to calculate the thumbprint for.
- * @param digestAlgorithm Digest Algorithm to use for calculating the thumbprint. Default is
- *   "sha256".
+ * @param digestAlgorithm Digest algorithm. Defaults to "sha256".
  *
- * @see {@link https://www.rfc-editor.org/info/rfc7638/ RFC7638}
+ * @see {@link https://www.rfc-editor.org/info/rfc7638/#section-3 RFC 7638, Section 3}
  */
 export declare function calculateJwkThumbprint(key: types.JWK | types.CryptoKey | types.KeyObject, digestAlgorithm?: 'sha256' | 'sha384' | 'sha512'): Promise<string>;
 /**
- * Calculates a JSON Web Key (JWK) Thumbprint URI
+ * Calculates a JWK Thumbprint URI. CryptoKey inputs must be extractable.
  *
  * This function is exported (as a named export) from the main `'jose'` module entry point as well
  * as from its subpath export `'jose/jwk/thumbprint'`.
@@ -55,10 +54,9 @@ export declare function calculateJwkThumbprint(key: types.JWK | types.CryptoKey
  * ```
  *
  * @param key Key to calculate the thumbprint for.
- * @param digestAlgorithm Digest Algorithm to use for calculating the thumbprint. Default is
- *   "sha256".
+ * @param digestAlgorithm Digest algorithm. Defaults to "sha256".
  *
- * @see {@link https://www.rfc-editor.org/info/rfc9278/ RFC9278}
+ * @see {@link https://www.rfc-editor.org/info/rfc9278/#section-3 RFC 9278, Section 3}
  */
 export declare function calculateJwkThumbprintUri(key: types.CryptoKey | types.KeyObject | types.JWK, digestAlgorithm?: 'sha256' | 'sha384' | 'sha512'): Promise<string>;
 //# sourceMappingURL=thumbprint.d.ts.map

package/dist/jose/src/jwk/thumbprint.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"thumbprint.d.ts","sourceRoot":"","sources":["../../../../src/jose/src/jwk/thumbprint.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,KAAK;AAaL,OAAO,KAAK,KAAK,KAAK,MAAM,eAAe,CAAA;AAY3C;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,EAClD,eAAe,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAC/C,OAAO,CAAC,MAAM,CAAC,CAqDjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,GAAG,EAClD,eAAe,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAC/C,OAAO,CAAC,MAAM,CAAC,CAIjB"}
+{"version":3,"file":"thumbprint.d.ts","sourceRoot":"","sources":["../../../../src/jose/src/jwk/thumbprint.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,KAAK;AAeL,OAAO,KAAK,KAAK,KAAK,MAAM,eAAe,CAAC;AAQ5C;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,KAAK,CAAC,GAAG,GAAG,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,EAClD,eAAe,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAC/C,OAAO,CAAC,MAAM,CAAC,CA0DjB;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,yBAAyB,CAC7C,GAAG,EAAE,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,GAAG,EAClD,eAAe,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAC/C,OAAO,CAAC,MAAM,CAAC,CAKjB"}

package/dist/jose/src/jwk/thumbprint.js

@@ -1,5 +1,5 @@
 /**
- * Original library: jose (v6.2.8)
+ * Original library: jose (v6.2.15)
  * - Copyright (c) 2018 Filip Skokan
  *
  * Modified and integrated in "Inray":
@@ -11,21 +11,19 @@
  *
  * @module
  */
-import { digest } from '../lib/helpers.js';
+import { digest, encode } from '../lib/buffer_utils.js';
 import { encode as b64u } from '../util/base64url.js';
 import { JOSENotSupported, JWKInvalid } from '../util/errors.js';
-import { encode } from '../lib/buffer_utils.js';
-import { isKeyLike } from '../lib/is_key_like.js';
-import { isJWK } from '../lib/type_checks.js';
+import { isKeyLike, invalidKeyInput, snapshotJwk } from '../lib/key.js';
+import { isObject } from '../lib/validate.js';
 import { exportJWK } from '../key/export.js';
-import { invalidKeyInput } from '../lib/invalid_key_input.js';
 const check = (value, description) => {
     if (typeof value !== 'string' || !value) {
         throw new JWKInvalid(`${description} missing or invalid`);
     }
 };
 /**
- * Calculates a base64url-encoded JSON Web Key (JWK) Thumbprint
+ * Calculates a base64url-encoded JWK Thumbprint. CryptoKey inputs must be extractable.
  *
  * This function is exported (as a named export) from the main `'jose'` module entry point as well
  * as from its subpath export `'jose/jwk/thumbprint'`.
@@ -45,63 +43,69 @@ const check = (value, description) => {
  * ```
  *
  * @param key Key to calculate the thumbprint for.
- * @param digestAlgorithm Digest Algorithm to use for calculating the thumbprint. Default is
- *   "sha256".
+ * @param digestAlgorithm Digest algorithm. Defaults to "sha256".
  *
- * @see {@link https://www.rfc-editor.org/info/rfc7638/ RFC7638}
+ * @see {@link https://www.rfc-editor.org/info/rfc7638/#section-3 RFC 7638, Section 3}
  */
 export async function calculateJwkThumbprint(key, digestAlgorithm) {
     let jwk;
-    if (isJWK(key)) {
-        jwk = key;
+    if (isObject(key)) {
+        jwk = snapshotJwk(key);
+        if (typeof jwk.kty !== 'string') {
+            throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
+        }
     }
     else if (isKeyLike(key)) {
-        jwk = await exportJWK(key);
+        jwk = snapshotJwk(await exportJWK(key));
     }
     else {
         throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
     }
     digestAlgorithm ??= 'sha256';
-    if (digestAlgorithm !== 'sha256' &&
-        digestAlgorithm !== 'sha384' &&
-        digestAlgorithm !== 'sha512') {
+    if (digestAlgorithm !== 'sha256' && digestAlgorithm !== 'sha384' && digestAlgorithm !== 'sha512') {
         throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');
     }
-    let components;
+    // RFC 7638, Section 3, step 1 and Section 3.2: required members in lexicographic order.
+    let requiredMembers;
     switch (jwk.kty) {
+        // RFC 9964, Section 6: AKP thumbprints include alg, kty and pub.
         case 'AKP':
             check(jwk.alg, '"alg" (Algorithm) Parameter');
             check(jwk.pub, '"pub" (Public key) Parameter');
-            components = { alg: jwk.alg, kty: jwk.kty, pub: jwk.pub };
+            requiredMembers = { alg: jwk.alg, kty: jwk.kty, pub: jwk.pub };
             break;
         case 'EC':
             check(jwk.crv, '"crv" (Curve) Parameter');
             check(jwk.x, '"x" (X Coordinate) Parameter');
             check(jwk.y, '"y" (Y Coordinate) Parameter');
-            components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y };
+            requiredMembers = { crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y };
             break;
+        // RFC 8037, Section 2: OKP thumbprints include crv, kty and x.
         case 'OKP':
             check(jwk.crv, '"crv" (Subtype of Key Pair) Parameter');
             check(jwk.x, '"x" (Public Key) Parameter');
-            components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x };
+            requiredMembers = { crv: jwk.crv, kty: jwk.kty, x: jwk.x };
             break;
         case 'RSA':
             check(jwk.e, '"e" (Exponent) Parameter');
             check(jwk.n, '"n" (Modulus) Parameter');
-            components = { e: jwk.e, kty: jwk.kty, n: jwk.n };
+            requiredMembers = { e: jwk.e, kty: jwk.kty, n: jwk.n };
             break;
         case 'oct':
-            check(jwk.k, '"k" (Key Value) Parameter');
-            components = { k: jwk.k, kty: jwk.kty };
+            if (typeof jwk.k !== 'string') {
+                throw new JWKInvalid('"k" (Key Value) Parameter missing or invalid');
+            }
+            requiredMembers = { k: jwk.k, kty: jwk.kty };
             break;
         default:
             throw new JOSENotSupported('"kty" (Key Type) Parameter missing or unsupported');
     }
-    const data = encode(JSON.stringify(components));
-    return b64u(await digest(digestAlgorithm, data));
+    // RFC 7638, Section 3, step 2: hash the UTF-8 representation (ASCII for these members).
+    const thumbprintInput = encode(JSON.stringify(requiredMembers));
+    return b64u(await digest(digestAlgorithm, thumbprintInput));
 }
 /**
- * Calculates a JSON Web Key (JWK) Thumbprint URI
+ * Calculates a JWK Thumbprint URI. CryptoKey inputs must be extractable.
  *
  * This function is exported (as a named export) from the main `'jose'` module entry point as well
  * as from its subpath export `'jose/jwk/thumbprint'`.
@@ -121,14 +125,14 @@ export async function calculateJwkThumbprint(key, digestAlgorithm) {
  * ```
  *
  * @param key Key to calculate the thumbprint for.
- * @param digestAlgorithm Digest Algorithm to use for calculating the thumbprint. Default is
- *   "sha256".
+ * @param digestAlgorithm Digest algorithm. Defaults to "sha256".
  *
- * @see {@link https://www.rfc-editor.org/info/rfc9278/ RFC9278}
+ * @see {@link https://www.rfc-editor.org/info/rfc9278/#section-3 RFC 9278, Section 3}
  */
 export async function calculateJwkThumbprintUri(key, digestAlgorithm) {
     digestAlgorithm ??= 'sha256';
     const thumbprint = await calculateJwkThumbprint(key, digestAlgorithm);
+    // RFC 9278, Sections 3-4: URI namespace, registered hash name, and encoded thumbprint.
     return `urn:ietf:params:oauth:jwk-thumbprint:sha-${digestAlgorithm.slice(-3)}:${thumbprint}`;
 }
 //# sourceMappingURL=thumbprint.js.map

package/dist/jose/src/jwk/thumbprint.js.map

@@ -1 +1 @@
-{"version":3,"file":"thumbprint.js","sourceRoot":"","sources":["../../../../src/jose/src/jwk/thumbprint.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,KAAK;AAEL;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAC1C,OAAO,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,sBAAsB,CAAA;AAErD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAA;AAE/C,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAA;AACjD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAA;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAA;AAE7D,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,WAAmB,EAAE,EAAE;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,IAAI,UAAU,CAAC,GAAG,WAAW,qBAAqB,CAAC,CAAA;IAC3D,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAkD,EAClD,eAAgD;IAEhD,IAAI,GAAc,CAAA;IAClB,IAAI,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACf,GAAG,GAAG,GAAG,CAAA;IACX,CAAC;SAAM,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAA;IAC5B,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,SAAS,CAAC,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,CAAA;IACrF,CAAC;IAED,eAAe,KAAK,QAAQ,CAAA;IAE5B,IACE,eAAe,KAAK,QAAQ;QAC5B,eAAe,KAAK,QAAQ;QAC5B,eAAe,KAAK,QAAQ,EAC5B,CAAC;QACD,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAA;IACpF,CAAC;IAED,IAAI,UAAqB,CAAA;IACzB,QAAQ,GAAG,CAAC,GAAG,EAAE,CAAC;QAChB,KAAK,KAAK;YACR,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAA;YAC7C,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAA;YAC9C,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAA;YACzD,MAAK;QACP,KAAK,IAAI;YACP,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAA;YACzC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,8BAA8B,CAAC,CAAA;YAC5C,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,8BAA8B,CAAC,CAAA;YAC5C,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAA;YAC/D,MAAK;QACP,KAAK,KAAK;YACR,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAA;YACvD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAA;YAC1C,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAA;YACrD,MAAK;QACP,KAAK,KAAK;YACR,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAA;YACxC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAA;YACvC,UAAU,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAA;YACjD,MAAK;QACP,KAAK,KAAK;YACR,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAA;YACzC,UAAU,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAA;YACvC,MAAK;QACP;YACE,MAAM,IAAI,gBAAgB,CAAC,mDAAmD,CAAC,CAAA;IACnF,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAA;IAC/C,OAAO,IAAI,CAAC,MAAM,MAAM,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,CAAA;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAkD,EAClD,eAAgD;IAEhD,eAAe,KAAK,QAAQ,CAAA;IAC5B,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAA;IACrE,OAAO,4CAA4C,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,CAAA;AAC9F,CAAC"}
+{"version":3,"file":"thumbprint.js","sourceRoot":"","sources":["../../../../src/jose/src/jwk/thumbprint.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,KAAK;AAEL;;;;GAIG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,MAAM,IAAI,IAAI,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACjE,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACxE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAI7C,MAAM,KAAK,GAAG,CAAC,KAAc,EAAE,WAAmB,EAAE,EAAE;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;QACxC,MAAM,IAAI,UAAU,CAAC,GAAG,WAAW,qBAAqB,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAkD,EAClD,eAAgD;IAEhD,IAAI,GAAc,CAAC;IACnB,IAAI,QAAQ,CAAY,GAAG,CAAC,EAAE,CAAC;QAC7B,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACvB,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,IAAI,SAAS,CAAC,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;QACtF,CAAC;IACH,CAAC;SAAM,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,GAAG,GAAG,WAAW,CAAC,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1C,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,SAAS,CAAC,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;IACtF,CAAC;IAED,eAAe,KAAK,QAAQ,CAAC;IAE7B,IAAI,eAAe,KAAK,QAAQ,IAAI,eAAe,KAAK,QAAQ,IAAI,eAAe,KAAK,QAAQ,EAAE,CAAC;QACjG,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;IACrF,CAAC;IAED,wFAAwF;IACxF,IAAI,eAA0B,CAAC;IAC/B,QAAQ,GAAG,CAAC,GAAG,EAAE,CAAC;QAChB,iEAAiE;QACjE,KAAK,KAAK;YACR,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;YAC9C,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;YAC/C,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;YAC/D,MAAM;QACR,KAAK,IAAI;YACP,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;YAC1C,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,8BAA8B,CAAC,CAAC;YAC7C,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,8BAA8B,CAAC,CAAC;YAC7C,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YACrE,MAAM;QACR,+DAA+D;QAC/D,KAAK,KAAK;YACR,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,uCAAuC,CAAC,CAAC;YACxD,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC;YAC3C,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YAC3D,MAAM;QACR,KAAK,KAAK;YACR,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC,CAAC;YACzC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC;YACxC,eAAe,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC;YACvD,MAAM;QACR,KAAK,KAAK;YACR,IAAI,OAAO,GAAG,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC9B,MAAM,IAAI,UAAU,CAAC,8CAA8C,CAAC,CAAC;YACvE,CAAC;YACD,eAAe,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;YAC7C,MAAM;QACR;YACE,MAAM,IAAI,gBAAgB,CAAC,mDAAmD,CAAC,CAAC;IACpF,CAAC;IAED,wFAAwF;IACxF,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC;IAChE,OAAO,IAAI,CAAC,MAAM,MAAM,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,GAAkD,EAClD,eAAgD;IAEhD,eAAe,KAAK,QAAQ,CAAC;IAC7B,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACtE,uFAAuF;IACvF,OAAO,4CAA4C,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,UAAU,EAAE,CAAC;AAC/F,CAAC"}