inray 0.0.9 → 0.0.10

package/dist/jose/src/jws/general/verify.js

@@ -1,25 +1,44 @@
 /**
- * Original library: jose (v6.2.8)
+ * Original library: jose (v6.2.15)
  * - Copyright (c) 2018 Filip Skokan
  *
  * Modified and integrated in "Inray":
  * - Evgeniy Bushin
  */
 /***/
-import { prepareVerify, verifySignature, verifyResult } from '../../lib/jws_verify.js';
+import { encodeJsonUnencodedPayload, parseProtectedHeader, prepareVerify, snapshotJws, verifySignature } from '../../lib/jws_verify.js';
 import { JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';
-import { isObject } from '../../lib/type_checks.js';
+import { isObject } from '../../lib/validate.js';
+function snapshotSignature(signature, payload) {
+    try {
+        const jws = snapshotJws(signature, [payload]);
+        const protectedHeader = parseProtectedHeader(jws.protected);
+        const { b64, crit } = protectedHeader;
+        return [
+            jws,
+            protectedHeader,
+            Array.isArray(crit) && crit.includes('b64') ? (typeof b64 === 'boolean' ? (b64 ? 1 : 2) : 0) : 1
+        ];
+    }
+    catch {
+        return undefined;
+    }
+}
 export async function generalVerify(jws, key, options) {
     if (!isObject(jws)) {
         throw new JWSInvalid('General JWS must be an object');
     }
-    const { signatures, payload } = jws;
-    if (!Array.isArray(signatures) || !signatures.every(isObject)) {
+    const { signatures, payload: inputPayload } = jws;
+    if (!Array.isArray(signatures)) {
+        throw new JWSInvalid('JWS Signatures missing or incorrect type');
+    }
+    const signatureEntries = Array.from(signatures);
+    if (!signatureEntries.every(isObject)) {
         throw new JWSInvalid('JWS Signatures missing or incorrect type');
     }
     let shared;
     try {
-        if (payload === undefined)
+        if (inputPayload === undefined)
             throw new Error();
         shared = prepareVerify(options);
     }
@@ -28,24 +47,24 @@ export async function generalVerify(jws, key, options) {
         // simply not the caller's. Stay indistinguishable.
         throw new JWSSignatureVerificationFailed();
     }
-    for (const signature of signatures) {
+    const payload = inputPayload instanceof Uint8Array ? new Uint8Array(inputPayload) : inputPayload;
+    const candidates = signatureEntries
+        .map((signature) => snapshotSignature(signature, payload))
+        .filter((candidate) => candidate !== undefined);
+    // RFC 7797, Section 3: reject differing b64 values across signatures.
+    let payloadEncodings = 0;
+    for (const [, , payloadEncoding] of candidates) {
+        payloadEncodings |= payloadEncoding;
+        if (payloadEncodings === 3) {
+            throw new JWSInvalid('inconsistent use of JWS Unencoded Payload (RFC7797)');
+        }
+    }
+    // RFC 7515, Section 5.2, steps 9-10: at least one signature must validate.
+    // Returning the first valid signature is this API’s selection policy.
+    for (const candidate of candidates) {
         try {
-            const { protected: encodedProtected, header, signature: encodedSignature } = signature;
-            if (encodedProtected === undefined && header === undefined)
-                throw new Error();
-            if (encodedProtected !== undefined && typeof encodedProtected !== 'string') {
-                throw new Error();
-            }
-            if (typeof encodedSignature !== 'string')
-                throw new Error();
-            if (header !== undefined && !isObject(header))
-                throw new Error();
-            return verifyResult(signature, await verifySignature({
-                header,
-                payload,
-                protected: encodedProtected,
-                signature: encodedSignature,
-            }, shared, key));
+            const [result] = await verifySignature(candidate[0], shared, key, encodeJsonUnencodedPayload, candidate[1]);
+            return result;
         }
         catch {
             //

package/dist/jose/src/jws/general/verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../../../src/jose/src/jws/general/verify.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,KAAK;AASL,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAEtF,OAAO,EAAE,UAAU,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAA;AACjF,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAA;AA8FnD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAA0B,EAC1B,GAAyC,EACzC,OAA6B;IAE7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,UAAU,CAAC,+BAA+B,CAAC,CAAA;IACvD,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,GAAG,CAAA;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,UAAU,CAAC,0CAA0C,CAAC,CAAA;IAClE,CAAC;IAED,IAAI,MAAoB,CAAA;IACxB,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,EAAE,CAAA;QAC5C,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAA;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,6FAA6F;QAC7F,mDAAmD;QACnD,MAAM,IAAI,8BAA8B,EAAE,CAAA;IAC5C,CAAC;IAED,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,SAAS,CAAA;YACtF,IAAI,gBAAgB,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAA;YAC7E,IAAI,gBAAgB,KAAK,SAAS,IAAI,OAAO,gBAAgB,KAAK,QAAQ,EAAE,CAAC;gBAC3E,MAAM,IAAI,KAAK,EAAE,CAAA;YACnB,CAAC;YACD,IAAI,OAAO,gBAAgB,KAAK,QAAQ;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAA;YAC3D,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,EAAE,CAAA;YAEhE,OAAO,YAAY,CACjB,SAAS,EACT,MAAM,eAAe,CACnB;gBACE,MAAM;gBACN,OAAO;gBACP,SAAS,EAAE,gBAAgB;gBAC3B,SAAS,EAAE,gBAAgB;aAC5B,EACD,MAAM,EACN,GAAG,CACJ,CACF,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,EAAE;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,8BAA8B,EAAE,CAAA;AAC5C,CAAC"}
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../../../../src/jose/src/jws/general/verify.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,KAAK;AAWL,OAAO,EACL,0BAA0B,EAC1B,oBAAoB,EACpB,aAAa,EACb,WAAW,EACX,eAAe,EAChB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,8BAA8B,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AASjD,SAAS,iBAAiB,CACxB,SAAkC,EAClC,OAA2C;IAE3C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,WAAW,CAAC,SAA+C,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;QACpF,MAAM,eAAe,GAAG,oBAAoB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE5D,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,eAAe,CAAC;QACtC,OAAO;YACL,GAAG;YACH,eAAe;YACf,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACjG,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAuFD,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAA0B,EAC1B,GAAyC,EACzC,OAA6B;IAE7B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,UAAU,CAAC,+BAA+B,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,GAAG,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,UAAU,CAAC,0CAA0C,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,gBAAgB,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,UAAU,CAAC,0CAA0C,CAAC,CAAC;IACnE,CAAC;IAED,IAAI,MAAoB,CAAC;IACzB,IAAI,CAAC;QACH,IAAI,YAAY,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,EAAE,CAAC;QAClD,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,6FAA6F;QAC7F,mDAAmD;QACnD,MAAM,IAAI,8BAA8B,EAAE,CAAC;IAC7C,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IACjG,MAAM,UAAU,GAAG,gBAAgB;SAChC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;SACzD,MAAM,CAAC,CAAC,SAAS,EAAmC,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IAEnF,sEAAsE;IACtE,IAAI,gBAAgB,GAAG,CAAC,CAAC;IACzB,KAAK,MAAM,CAAC,EAAE,AAAD,EAAG,eAAe,CAAC,IAAI,UAAU,EAAE,CAAC;QAC/C,gBAAgB,IAAI,eAAe,CAAC;QACpC,IAAI,gBAAgB,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,UAAU,CAAC,qDAAqD,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,sEAAsE;IACtE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,0BAA0B,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5G,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,EAAE;QACJ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,8BAA8B,EAAE,CAAC;AAC7C,CAAC"}

package/dist/jose/src/jwt/decrypt.d.ts

@@ -1,5 +1,5 @@
 /**
- * Original library: jose (v6.2.8)
+ * Original library: jose (v6.2.15)
  * - Copyright (c) 2018 Filip Skokan
  *
  * Modified and integrated in "Inray":
@@ -12,21 +12,26 @@
  * @module
  */
 import type * as types from '../types.d.ts';
-/** Combination of JWE Decryption options and JWT Claims Set verification options. */
+/** JWE decryption and JWT Claims Set validation options. */
 export interface JWTDecryptOptions extends types.DecryptOptions, types.JWTClaimVerificationOptions {
 }
 /**
- * Interface for JWT Decryption dynamic key resolution. No token components have been verified at
- * the time of this function call.
+ * Resolves a JWT decryption key. No token components have been authenticated when this function is
+ * called.
  *
  * @typeParam KeyType Type definition of the keys the function resolves. Narrowing it is what lets
  *   {@link types.ResolvedKey.key ResolvedKey.key} be inferred at the call site.
  */
 export interface JWTDecryptGetKey<KeyType extends types.CryptoKey | Uint8Array = types.CryptoKey | Uint8Array> extends types.GetKeyFunction<types.CompactJWEHeaderParameters, types.FlattenedJWE, KeyType | types.KeyObject | types.JWK> {
 }
+/** @ignore */
+export declare function jwtDecrypt<PayloadType, KeyType extends types.KeyInput, InferredPayloadType>(jwt: string | Uint8Array, key: KeyType, options?: JWTDecryptOptions): Promise<types.InferredJWTResult<types.JWTDecryptResult<unknown>, InferredPayloadType & ([PayloadType] extends [object] ? unknown : unknown extends PayloadType ? unknown : never)>>;
+/** @ignore */
+export declare function jwtDecrypt<PayloadType, KeyType extends types.CryptoKey | Uint8Array, InferredPayloadType>(jwt: string | Uint8Array, getKey: JWTDecryptGetKey<KeyType>, options?: JWTDecryptOptions): Promise<types.InferredJWTResult<types.JWTDecryptResult<unknown>, InferredPayloadType & ([PayloadType] extends [object] ? unknown : unknown extends PayloadType ? unknown : never)> & types.ResolvedKey<KeyType>>;
+/** @ignore */
+export declare function jwtDecrypt<PayloadType, KeyType extends types.KeyInput | JWTDecryptGetKey, InferredPayloadType>(jwt: string | Uint8Array, key: KeyType, options?: JWTDecryptOptions): Promise<types.InferredJWTResult<types.JWTDecryptResult<unknown>, InferredPayloadType & ([PayloadType] extends [object] ? unknown : unknown extends PayloadType ? unknown : never)> & Partial<types.ResolvedKey>>;
 /**
- * Verifies the JWT format (to be a JWE Compact format), decrypts the ciphertext, validates the JWT
- * Claims Set.
+ * Authenticates and decrypts a JWT in JWE Compact Serialization and validates its JWT Claims Set.
  *
  * This function is exported (as a named export) from the main `'jose'` module entry point as well
  * as from its subpath export `'jose/jwt/decrypt'`.
@@ -48,29 +53,30 @@ export interface JWTDecryptGetKey<KeyType extends types.CryptoKey | Uint8Array =
  * ```
  *
  * @param jwt JSON Web Token value (encoded as JWE).
- * @param key Private Key or Secret to decrypt and verify the JWT with. See
+ * @param key Private key or shared secret to authenticate and decrypt the JWT with. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  * @param options JWT Decryption and JWT Claims Set validation options.
  */
 export declare function jwtDecrypt<PayloadType = types.JWTPayload>(jwt: string | Uint8Array, key: types.KeyInput, options?: JWTDecryptOptions): Promise<types.JWTDecryptResult<PayloadType>>;
 /**
- * Decrypts a JWT and validates its JWT Claims Set, resolving the key dynamically. The result
- * additionally carries the {@link types.ResolvedKey.key resolved key}.
+ * Decrypts a JWT and validates its claims, returning the dynamically
+ * {@link types.ResolvedKey.key resolved key}.
  *
  * @param jwt JSON Web Token value (encoded as JWE).
- * @param getKey Function resolving Private Key or Secret to decrypt and verify the JWT with. See
+ * @param getKey Function resolving a private key or shared secret to authenticate and decrypt the
+ *   JWT with. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  * @param options JWT Decryption and JWT Claims Set validation options.
  */
 export declare function jwtDecrypt<PayloadType = types.JWTPayload, KeyType extends types.CryptoKey | Uint8Array = types.CryptoKey | Uint8Array>(jwt: string | Uint8Array, getKey: JWTDecryptGetKey<KeyType>, options?: JWTDecryptOptions): Promise<types.JWTDecryptResult<PayloadType> & types.ResolvedKey<KeyType>>;
 /**
- * Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
- * either a key or a key resolution function; `key` is present on the result only when a resolution
- * function was used.
+ * Accepts a key or key resolver. Use this overload when forwarding either form; the result includes
+ * `key` only when a resolver was used.
  *
  * @param jwt JSON Web Token value (encoded as JWE).
- * @param key Private Key or Secret, or a function resolving one, to decrypt and verify the JWT
- *   with. See {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+ * @param key Private key or shared secret, or a function resolving one, to authenticate and decrypt
+ *   the JWT with. See
+ *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  * @param options JWT Decryption and JWT Claims Set validation options.
  */
 export declare function jwtDecrypt<PayloadType = types.JWTPayload>(jwt: string | Uint8Array, key: types.KeyInput | JWTDecryptGetKey, options?: JWTDecryptOptions): Promise<types.JWTDecryptResult<PayloadType> & Partial<types.ResolvedKey>>;

package/dist/jose/src/jwt/decrypt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decrypt.d.ts","sourceRoot":"","sources":["../../../../src/jose/src/jwt/decrypt.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,KAAK;AAEL;;;;GAIG;AAEH,OAAO,KAAK,KAAK,KAAK,MAAM,eAAe,CAAA;AAM3C,qFAAqF;AACrF,MAAM,WAAW,iBACf,SAAQ,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,2BAA2B;CAAG;AAEpE;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB,CAC/B,OAAO,SAAS,KAAK,CAAC,SAAS,GAAG,UAAU,GAAG,KAAK,CAAC,SAAS,GAAG,UAAU,CAC3E,SAAQ,KAAK,CAAC,cAAc,CAC5B,KAAK,CAAC,0BAA0B,EAChC,KAAK,CAAC,YAAY,EAClB,OAAO,GAAG,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,GAAG,CACtC;CAAG;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAgB,UAAU,CAAC,WAAW,GAAG,KAAK,CAAC,UAAU,EACvD,GAAG,EAAE,MAAM,GAAG,UAAU,EACxB,GAAG,EAAE,KAAK,CAAC,QAAQ,EACnB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAA;AAC/C;;;;;;;;GAQG;AACH,wBAAgB,UAAU,CACxB,WAAW,GAAG,KAAK,CAAC,UAAU,EAC9B,OAAO,SAAS,KAAK,CAAC,SAAS,GAAG,UAAU,GAAG,KAAK,CAAC,SAAS,GAAG,UAAU,EAE3E,GAAG,EAAE,MAAM,GAAG,UAAU,EACxB,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC,EACjC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAA;AAC5E;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,WAAW,GAAG,KAAK,CAAC,UAAU,EACvD,GAAG,EAAE,MAAM,GAAG,UAAU,EACxB,GAAG,EAAE,KAAK,CAAC,QAAQ,GAAG,gBAAgB,EACtC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA"}
+{"version":3,"file":"decrypt.d.ts","sourceRoot":"","sources":["../../../../src/jose/src/jwt/decrypt.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,KAAK;AAEL;;;;GAIG;AAEH,OAAO,KAAK,KAAK,KAAK,MAAM,eAAe,CAAC;AAM5C,4DAA4D;AAC5D,MAAM,WAAW,iBAAkB,SAAQ,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,2BAA2B;CAAG;AAErG;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB,CAC/B,OAAO,SAAS,KAAK,CAAC,SAAS,GAAG,UAAU,GAAG,KAAK,CAAC,SAAS,GAAG,UAAU,CAC3E,SAAQ,KAAK,CAAC,cAAc,CAC5B,KAAK,CAAC,0BAA0B,EAChC,KAAK,CAAC,YAAY,EAClB,OAAO,GAAG,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,GAAG,CACtC;CAAG;AAIJ,cAAc;AACd,wBAAgB,UAAU,CAAC,WAAW,EAAE,OAAO,SAAS,KAAK,CAAC,QAAQ,EAAE,mBAAmB,EACzF,GAAG,EAAE,MAAM,GAAG,UAAU,EACxB,GAAG,EAAE,OAAO,EACZ,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CACR,KAAK,CAAC,iBAAiB,CACrB,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAC/B,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,OAAO,GAAG,OAAO,SAAS,WAAW,GAAG,OAAO,GAAG,KAAK,CAAC,CACjH,CACF,CAAC;AACF,cAAc;AACd,wBAAgB,UAAU,CAAC,WAAW,EAAE,OAAO,SAAS,KAAK,CAAC,SAAS,GAAG,UAAU,EAAE,mBAAmB,EACvG,GAAG,EAAE,MAAM,GAAG,UAAU,EACxB,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC,EACjC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CACR,KAAK,CAAC,iBAAiB,CACrB,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAC/B,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,OAAO,GAAG,OAAO,SAAS,WAAW,GAAG,OAAO,GAAG,KAAK,CAAC,CACjH,GACC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAC7B,CAAC;AACF,cAAc;AACd,wBAAgB,UAAU,CAAC,WAAW,EAAE,OAAO,SAAS,KAAK,CAAC,QAAQ,GAAG,gBAAgB,EAAE,mBAAmB,EAC5G,GAAG,EAAE,MAAM,GAAG,UAAU,EACxB,GAAG,EAAE,OAAO,EACZ,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CACR,KAAK,CAAC,iBAAiB,CACrB,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAC/B,mBAAmB,GAAG,CAAC,CAAC,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,OAAO,GAAG,OAAO,SAAS,WAAW,GAAG,OAAO,GAAG,KAAK,CAAC,CACjH,GACC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAC7B,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,UAAU,CAAC,WAAW,GAAG,KAAK,CAAC,UAAU,EACvD,GAAG,EAAE,MAAM,GAAG,UAAU,EACxB,GAAG,EAAE,KAAK,CAAC,QAAQ,EACnB,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC;AAChD;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CACxB,WAAW,GAAG,KAAK,CAAC,UAAU,EAC9B,OAAO,SAAS,KAAK,CAAC,SAAS,GAAG,UAAU,GAAG,KAAK,CAAC,SAAS,GAAG,UAAU,EAE3E,GAAG,EAAE,MAAM,GAAG,UAAU,EACxB,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC,EACjC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7E;;;;;;;;;GASG;AACH,wBAAgB,UAAU,CAAC,WAAW,GAAG,KAAK,CAAC,UAAU,EACvD,GAAG,EAAE,MAAM,GAAG,UAAU,EACxB,GAAG,EAAE,KAAK,CAAC,QAAQ,GAAG,gBAAgB,EACtC,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC"}

package/dist/jose/src/jwt/decrypt.js

@@ -1,5 +1,5 @@
 /**
- * Original library: jose (v6.2.8)
+ * Original library: jose (v6.2.15)
  * - Copyright (c) 2018 Filip Skokan
  *
  * Modified and integrated in "Inray":
@@ -10,23 +10,20 @@ import { prepareDecrypt, decryptCompact } from '../lib/jwe_decrypt.js';
 import { validateClaimsSet } from '../lib/jwt_claims_set.js';
 import { JWTClaimValidationFailed } from '../util/errors.js';
 export async function jwtDecrypt(jwt, key, options) {
-    const decrypted = await decryptCompact(jwt, prepareDecrypt(options), key);
-    const protectedHeader = decrypted[1];
-    const payload = validateClaimsSet(protectedHeader, decrypted[0], options);
-    if (protectedHeader.iss !== undefined && protectedHeader.iss !== payload.iss) {
-        throw new JWTClaimValidationFailed('replicated "iss" claim header parameter mismatch', payload, 'iss', 'mismatch');
+    const { plaintext, ...result } = await decryptCompact(jwt, prepareDecrypt(options), key);
+    const { protectedHeader } = result;
+    // RFC 7519, Section 7.2, step 10: parse and validate the JWT Claims Set.
+    const payload = validateClaimsSet(protectedHeader, plaintext, options);
+    // RFC 7519, Section 5.3: compare replicated claims with the encrypted Claims Set.
+    // The audience-array comparison below requires the same element order.
+    for (const claim of ['iss', 'sub', 'aud']) {
+        if (protectedHeader[claim] !== undefined &&
+            (claim === 'aud'
+                ? JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud)
+                : protectedHeader[claim] !== payload[claim])) {
+            throw new JWTClaimValidationFailed(`replicated "${claim}" claim header parameter mismatch`, payload, claim, 'mismatch');
+        }
     }
-    if (protectedHeader.sub !== undefined && protectedHeader.sub !== payload.sub) {
-        throw new JWTClaimValidationFailed('replicated "sub" claim header parameter mismatch', payload, 'sub', 'mismatch');
-    }
-    if (protectedHeader.aud !== undefined &&
-        JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud)) {
-        throw new JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch', payload, 'aud', 'mismatch');
-    }
-    const result = { payload, protectedHeader };
-    if (typeof key === 'function') {
-        return { ...result, key: decrypted[2] };
-    }
-    return result;
+    return { payload, ...result };
 }
 //# sourceMappingURL=decrypt.js.map

package/dist/jose/src/jwt/decrypt.js.map

@@ -1 +1 @@
-{"version":3,"file":"decrypt.js","sourceRoot":"","sources":["../../../../src/jose/src/jwt/decrypt.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,KAAK;AASL,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAEtE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAA;AAsF5D,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAwB,EACxB,GAAsC,EACtC,OAA2B;IAE3B,MAAM,SAAS,GAAG,MAAM,cAAc,CACpC,GAAG,EACH,cAAc,CAAC,OAAO,CAAC,EACvB,GAAqC,CACtC,CAAA;IACD,MAAM,eAAe,GAAG,SAAS,CAAC,CAAC,CAA8B,CAAA;IACjE,MAAM,OAAO,GAAG,iBAAiB,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IAEzE,IAAI,eAAe,CAAC,GAAG,KAAK,SAAS,IAAI,eAAe,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;QAC7E,MAAM,IAAI,wBAAwB,CAChC,kDAAkD,EAClD,OAAO,EACP,KAAK,EACL,UAAU,CACX,CAAA;IACH,CAAC;IAED,IAAI,eAAe,CAAC,GAAG,KAAK,SAAS,IAAI,eAAe,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;QAC7E,MAAM,IAAI,wBAAwB,CAChC,kDAAkD,EAClD,OAAO,EACP,KAAK,EACL,UAAU,CACX,CAAA;IACH,CAAC;IAED,IACE,eAAe,CAAC,GAAG,KAAK,SAAS;QACjC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EACnE,CAAC;QACD,MAAM,IAAI,wBAAwB,CAChC,kDAAkD,EAClD,OAAO,EACP,KAAK,EACL,UAAU,CACX,CAAA;IACH,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,eAAe,EAAE,CAAA;IAE3C,IAAI,OAAO,GAAG,KAAK,UAAU,EAAE,CAAC;QAC9B,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,CAAA;IACzC,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}
+{"version":3,"file":"decrypt.js","sourceRoot":"","sources":["../../../../src/jose/src/jwt/decrypt.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,KAAK;AASL,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAEvE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AA2H7D,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAwB,EACxB,GAAsC,EACtC,OAA2B;IAE3B,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,cAAc,CACnD,GAAG,EACH,cAAc,CAAC,OAAO,CAAC,EACvB,GAAqC,CACtC,CAAC;IACF,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,CAAC;IACnC,yEAAyE;IACzE,MAAM,OAAO,GAAG,iBAAiB,CAAC,eAAe,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAEvE,kFAAkF;IAClF,uEAAuE;IACvE,KAAK,MAAM,KAAK,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAU,EAAE,CAAC;QACnD,IACE,eAAe,CAAC,KAAK,CAAC,KAAK,SAAS;YACpC,CAAC,KAAK,KAAK,KAAK;gBACd,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC;gBACrE,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,CAAC,EAC9C,CAAC;YACD,MAAM,IAAI,wBAAwB,CAChC,eAAe,KAAK,mCAAmC,EACvD,OAAO,EACP,KAAK,EACL,UAAU,CACX,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC;AAChC,CAAC"}

package/dist/jose/src/jwt/encrypt.d.ts

@@ -1,5 +1,5 @@
 /**
- * Original library: jose (v6.2.8)
+ * Original library: jose (v6.2.15)
  * - Copyright (c) 2018 Filip Skokan
  *
  * Modified and integrated in "Inray":
@@ -12,8 +12,10 @@
  * @module
  */
 import type * as types from '../types.d.ts';
+/** @param payload Initial JWT Claims Set. Defaults to an empty object. */
+declare const EncryptJWT_base: new (payload?: types.JWTPayload) => types.ProduceJWT;
 /**
- * The EncryptJWT class is used to build and encrypt Compact JWE formatted JSON Web Tokens.
+ * Produces encrypted JWTs in JWE Compact Serialization.
  *
  * This class is exported (as a named export) from the main `'jose'` module entry point as well as
  * from its subpath export `'jose/jwt/encrypt'`.
@@ -33,70 +35,58 @@ import type * as types from '../types.d.ts';
  * console.log(jwt)
  * ```
  */
-export declare class EncryptJWT implements types.ProduceJWT {
+export declare class EncryptJWT extends EncryptJWT_base {
     #private;
     /**
-     * {@link EncryptJWT} constructor
-     *
-     * @param payload The JWT Claims Set object. Defaults to an empty object.
-     */
-    constructor(payload?: types.JWTPayload);
-    setIssuer(issuer: string): this;
-    setSubject(subject: string): this;
-    setAudience(audience: string | string[]): this;
-    setJti(jwtId: string): this;
-    setNotBefore(input: number | string | Date): this;
-    setExpirationTime(input: number | string | Date): this;
-    setIssuedAt(input?: number | string | Date): this;
-    /**
-     * Sets the JWE Protected Header on the EncryptJWT object.
+     * Sets the JWE Protected Header. May only be called once.
      *
      * @param protectedHeader JWE Protected Header. Must contain an "alg" (JWE Algorithm) and "enc"
      *   (JWE Encryption Algorithm) properties.
      */
     setProtectedHeader(protectedHeader: types.CompactJWEHeaderParameters): this;
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting. For ECDH based algorithms,
-     * use this method to set the "apu" (Agreement PartyUInfo) or "apv" (Agreement PartyVInfo)
-     * parameters.
+     * Sets JWE Key Management parameters, such as ECDH-ES "apu" and "apv" or PBES2 "p2c", and adds
+     * them to the appropriate JOSE Header. Use this instead of the header setters for algorithm
+     * inputs. May only be called once.
      *
      * @param parameters JWE Key Management parameters.
      */
     setKeyManagementParameters(parameters: types.JWEKeyManagementHeaderParameters): this;
     /**
-     * Sets a content encryption key to use, by default a random suitable one is generated for the JWE
-     * "enc" (Encryption Algorithm) Header Parameter.
+     * Sets the content encryption key. By default, a suitable random key is generated for the JWE
+     * "enc" (Encryption Algorithm). May only be called once.
      *
-     * @deprecated You should not use this method. It is only really intended for test and vector
-     *   validation purposes.
+     * @deprecated For testing and vector validation only; allow random generation in production.
      *
      * @param cek JWE Content Encryption Key.
      */
     setContentEncryptionKey(cek: Uint8Array): this;
     /**
-     * Sets the JWE Initialization Vector to use for content encryption, by default a random suitable
-     * one is generated for the JWE "enc" (Encryption Algorithm) Header Parameter.
+     * Sets the Initialization Vector for content encryption. By default, a suitable random IV is
+     * generated for the JWE "enc" (Encryption Algorithm). May only be called once.
      *
-     * @deprecated You should not use this method. It is only really intended for test and vector
-     *   validation purposes.
+     * @deprecated For testing and vector validation only; allow random generation in production.
      *
      * @param iv JWE Initialization Vector.
      */
     setInitializationVector(iv: Uint8Array): this;
     /**
-     * Replicates the "iss" (Issuer) Claim as a JWE Protected Header Parameter.
+     * Replicates the "iss" (Issuer) Claim in the JWE Protected Header, exposing it without
+     * decryption.
      *
      * @see {@link https://www.rfc-editor.org/info/rfc7519/#section-5.3 RFC7519#section-5.3}
      */
     replicateIssuerAsHeader(): this;
     /**
-     * Replicates the "sub" (Subject) Claim as a JWE Protected Header Parameter.
+     * Replicates the "sub" (Subject) Claim in the JWE Protected Header, exposing it without
+     * decryption.
      *
      * @see {@link https://www.rfc-editor.org/info/rfc7519/#section-5.3 RFC7519#section-5.3}
      */
     replicateSubjectAsHeader(): this;
     /**
-     * Replicates the "aud" (Audience) Claim as a JWE Protected Header Parameter.
+     * Replicates the "aud" (Audience) Claim in the JWE Protected Header, exposing it without
+     * decryption.
      *
      * @see {@link https://www.rfc-editor.org/info/rfc7519/#section-5.3 RFC7519#section-5.3}
      */
@@ -104,10 +94,11 @@ export declare class EncryptJWT implements types.ProduceJWT {
     /**
      * Encrypts and returns the JWT.
      *
-     * @param key Public Key or Secret to encrypt the JWT with. See
+     * @param key Public key or shared secret to encrypt the JWT with. See
      *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
      * @param options JWE Encryption options.
      */
     encrypt(key: types.KeyInput, options?: types.EncryptOptions): Promise<string>;
 }
+export {};
 //# sourceMappingURL=encrypt.d.ts.map

package/dist/jose/src/jwt/encrypt.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"encrypt.d.ts","sourceRoot":"","sources":["../../../../src/jose/src/jwt/encrypt.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,KAAK;AAEL;;;;GAIG;AAEH,OAAO,KAAK,KAAK,KAAK,MAAM,eAAe,CAAA;AAK3C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,UAAW,YAAW,KAAK,CAAC,UAAU;;IAiBjD;;;;OAIG;gBACS,OAAO,GAAE,KAAK,CAAC,UAAe;IAI1C,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAK/B,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI;IAKjC,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,IAAI;IAK9C,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAK3B,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,IAAI;IAKjD,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,IAAI;IAKtD,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,IAAI;IAKjD;;;;;OAKG;IACH,kBAAkB,CAAC,eAAe,EAAE,KAAK,CAAC,0BAA0B,GAAG,IAAI;IAM3E;;;;;;OAMG;IACH,0BAA0B,CAAC,UAAU,EAAE,KAAK,CAAC,gCAAgC,GAAG,IAAI;IAMpF;;;;;;;;OAQG;IACH,uBAAuB,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI;IAM9C;;;;;;;;OAQG;IACH,uBAAuB,CAAC,EAAE,EAAE,UAAU,GAAG,IAAI;IAM7C;;;;OAIG;IACH,uBAAuB,IAAI,IAAI;IAK/B;;;;OAIG;IACH,wBAAwB,IAAI,IAAI;IAKhC;;;;OAIG;IACH,yBAAyB,IAAI,IAAI;IAKjC;;;;;;OAMG;IACG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;CA2BpF"}
+{"version":3,"file":"encrypt.d.ts","sourceRoot":"","sources":["../../../../src/jose/src/jwt/encrypt.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,KAAK;AAEL;;;;GAIG;AAEH,OAAO,KAAK,KAAK,KAAK,MAAM,eAAe,CAAC;AAM5C,0EAA0E;AAC1E,QAAA,MAAM,eAAe,EAAE,KAAK,OAAO,CAAC,EAAE,KAAK,CAAC,UAAU,KAAK,KAAK,CAAC,UAA6B,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,qBAAa,UAAW,SAAQ,eAAe;;IAS7C;;;;;OAKG;IACH,kBAAkB,CAAC,eAAe,EAAE,KAAK,CAAC,0BAA0B,GAAG,IAAI;IAM3E;;;;;;OAMG;IACH,0BAA0B,CAAC,UAAU,EAAE,KAAK,CAAC,gCAAgC,GAAG,IAAI;IAMpF;;;;;;;OAOG;IACH,uBAAuB,CAAC,GAAG,EAAE,UAAU,GAAG,IAAI;IAM9C;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,EAAE,UAAU,GAAG,IAAI;IAM7C;;;;;OAKG;IACH,uBAAuB,IAAI,IAAI;IAK/B;;;;;OAKG;IACH,wBAAwB,IAAI,IAAI;IAKhC;;;;;OAKG;IACH,yBAAyB,IAAI,IAAI;IAKjC;;;;;;OAMG;IACG,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;CAkBpF"}

package/dist/jose/src/jwt/encrypt.js

@@ -1,16 +1,18 @@
 /**
- * Original library: jose (v6.2.8)
+ * Original library: jose (v6.2.15)
  * - Copyright (c) 2018 Filip Skokan
  *
  * Modified and integrated in "Inray":
  * - Evgeniy Bushin
  */
 /***/
-import { CompactEncrypt } from '../jwe/compact/encrypt.js';
-import { JWTClaimsBuilder } from '../lib/jwt_claims_set.js';
-import { assertNotSet } from '../lib/helpers.js';
+import { compactJWE, createJWE } from '../lib/jwe_encrypt.js';
+import { JWTClaimsBuilder, jwtClaim, jwtClaimsSetBytes } from '../lib/jwt_claims_set.js';
+import { assertNotSet } from '../lib/validate.js';
+/** @param payload Initial JWT Claims Set. Defaults to an empty object. */
+const EncryptJWT_base = JWTClaimsBuilder;
 /**
- * The EncryptJWT class is used to build and encrypt Compact JWE formatted JSON Web Tokens.
+ * Produces encrypted JWTs in JWE Compact Serialization.
  *
  * This class is exported (as a named export) from the main `'jose'` module entry point as well as
  * from its subpath export `'jose/jwt/encrypt'`.
@@ -30,104 +32,63 @@ import { assertNotSet } from '../lib/helpers.js';
  * console.log(jwt)
  * ```
  */
-export class EncryptJWT {
-    #cek;
-    #iv;
-    #keyManagementParameters;
-    #protectedHeader;
+export class EncryptJWT extends EncryptJWT_base {
+    #input = [undefined];
     #replicateIssuerAsHeader;
     #replicateSubjectAsHeader;
     #replicateAudienceAsHeader;
-    #jwt;
     /**
-     * {@link EncryptJWT} constructor
-     *
-     * @param payload The JWT Claims Set object. Defaults to an empty object.
-     */
-    constructor(payload = {}) {
-        this.#jwt = new JWTClaimsBuilder(payload);
-    }
-    setIssuer(issuer) {
-        this.#jwt.iss = issuer;
-        return this;
-    }
-    setSubject(subject) {
-        this.#jwt.sub = subject;
-        return this;
-    }
-    setAudience(audience) {
-        this.#jwt.aud = audience;
-        return this;
-    }
-    setJti(jwtId) {
-        this.#jwt.jti = jwtId;
-        return this;
-    }
-    setNotBefore(input) {
-        this.#jwt.nbf = input;
-        return this;
-    }
-    setExpirationTime(input) {
-        this.#jwt.exp = input;
-        return this;
-    }
-    setIssuedAt(input) {
-        this.#jwt.iat = input;
-        return this;
-    }
-    /**
-     * Sets the JWE Protected Header on the EncryptJWT object.
+     * Sets the JWE Protected Header. May only be called once.
      *
      * @param protectedHeader JWE Protected Header. Must contain an "alg" (JWE Algorithm) and "enc"
      *   (JWE Encryption Algorithm) properties.
      */
     setProtectedHeader(protectedHeader) {
-        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
-        this.#protectedHeader = protectedHeader;
+        assertNotSet(this.#input[1], 'setProtectedHeader');
+        this.#input[1] = protectedHeader;
         return this;
     }
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting. For ECDH based algorithms,
-     * use this method to set the "apu" (Agreement PartyUInfo) or "apv" (Agreement PartyVInfo)
-     * parameters.
+     * Sets JWE Key Management parameters, such as ECDH-ES "apu" and "apv" or PBES2 "p2c", and adds
+     * them to the appropriate JOSE Header. Use this instead of the header setters for algorithm
+     * inputs. May only be called once.
      *
      * @param parameters JWE Key Management parameters.
      */
     setKeyManagementParameters(parameters) {
-        assertNotSet(this.#keyManagementParameters, 'setKeyManagementParameters');
-        this.#keyManagementParameters = parameters;
+        assertNotSet(this.#input[7], 'setKeyManagementParameters');
+        this.#input[7] = parameters;
         return this;
     }
     /**
-     * Sets a content encryption key to use, by default a random suitable one is generated for the JWE
-     * "enc" (Encryption Algorithm) Header Parameter.
+     * Sets the content encryption key. By default, a suitable random key is generated for the JWE
+     * "enc" (Encryption Algorithm). May only be called once.
      *
-     * @deprecated You should not use this method. It is only really intended for test and vector
-     *   validation purposes.
+     * @deprecated For testing and vector validation only; allow random generation in production.
      *
      * @param cek JWE Content Encryption Key.
      */
     setContentEncryptionKey(cek) {
-        assertNotSet(this.#cek, 'setContentEncryptionKey');
-        this.#cek = cek;
+        assertNotSet(this.#input[5], 'setContentEncryptionKey');
+        this.#input[5] = cek;
         return this;
     }
     /**
-     * Sets the JWE Initialization Vector to use for content encryption, by default a random suitable
-     * one is generated for the JWE "enc" (Encryption Algorithm) Header Parameter.
+     * Sets the Initialization Vector for content encryption. By default, a suitable random IV is
+     * generated for the JWE "enc" (Encryption Algorithm). May only be called once.
      *
-     * @deprecated You should not use this method. It is only really intended for test and vector
-     *   validation purposes.
+     * @deprecated For testing and vector validation only; allow random generation in production.
      *
      * @param iv JWE Initialization Vector.
      */
     setInitializationVector(iv) {
-        assertNotSet(this.#iv, 'setInitializationVector');
-        this.#iv = iv;
+        assertNotSet(this.#input[6], 'setInitializationVector');
+        this.#input[6] = iv;
         return this;
     }
     /**
-     * Replicates the "iss" (Issuer) Claim as a JWE Protected Header Parameter.
+     * Replicates the "iss" (Issuer) Claim in the JWE Protected Header, exposing it without
+     * decryption.
      *
      * @see {@link https://www.rfc-editor.org/info/rfc7519/#section-5.3 RFC7519#section-5.3}
      */
@@ -136,7 +97,8 @@ export class EncryptJWT {
         return this;
     }
     /**
-     * Replicates the "sub" (Subject) Claim as a JWE Protected Header Parameter.
+     * Replicates the "sub" (Subject) Claim in the JWE Protected Header, exposing it without
+     * decryption.
      *
      * @see {@link https://www.rfc-editor.org/info/rfc7519/#section-5.3 RFC7519#section-5.3}
      */
@@ -145,7 +107,8 @@ export class EncryptJWT {
         return this;
     }
     /**
-     * Replicates the "aud" (Audience) Claim as a JWE Protected Header Parameter.
+     * Replicates the "aud" (Audience) Claim in the JWE Protected Header, exposing it without
+     * decryption.
      *
      * @see {@link https://www.rfc-editor.org/info/rfc7519/#section-5.3 RFC7519#section-5.3}
      */
@@ -156,34 +119,24 @@ export class EncryptJWT {
     /**
      * Encrypts and returns the JWT.
      *
-     * @param key Public Key or Secret to encrypt the JWT with. See
+     * @param key Public key or shared secret to encrypt the JWT with. See
      *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
      * @param options JWE Encryption options.
      */
     async encrypt(key, options) {
-        const enc = new CompactEncrypt(this.#jwt.data());
-        if (this.#protectedHeader &&
-            (this.#replicateIssuerAsHeader ||
-                this.#replicateSubjectAsHeader ||
-                this.#replicateAudienceAsHeader)) {
-            this.#protectedHeader = {
-                ...this.#protectedHeader,
-                iss: this.#replicateIssuerAsHeader ? this.#jwt.iss : undefined,
-                sub: this.#replicateSubjectAsHeader ? this.#jwt.sub : undefined,
-                aud: this.#replicateAudienceAsHeader ? this.#jwt.aud : undefined,
+        const plaintext = jwtClaimsSetBytes(this);
+        if (this.#input[1] &&
+            (this.#replicateIssuerAsHeader || this.#replicateSubjectAsHeader || this.#replicateAudienceAsHeader)) {
+            this.#input[1] = {
+                ...this.#input[1],
+                iss: this.#replicateIssuerAsHeader ? jwtClaim(this, 'iss') : undefined,
+                sub: this.#replicateSubjectAsHeader ? jwtClaim(this, 'sub') : undefined,
+                aud: this.#replicateAudienceAsHeader ? jwtClaim(this, 'aud') : undefined
             };
         }
-        enc.setProtectedHeader(this.#protectedHeader);
-        if (this.#iv) {
-            enc.setInitializationVector(this.#iv);
-        }
-        if (this.#cek) {
-            enc.setContentEncryptionKey(this.#cek);
-        }
-        if (this.#keyManagementParameters) {
-            enc.setKeyManagementParameters(this.#keyManagementParameters);
-        }
-        return enc.encrypt(key, options);
+        const input = [...this.#input];
+        input[0] = plaintext;
+        return compactJWE(await createJWE(input, key, options));
     }
 }
 //# sourceMappingURL=encrypt.js.map

package/dist/jose/src/jwt/encrypt.js.map

@@ -1 +1 @@
-{"version":3,"file":"encrypt.js","sourceRoot":"","sources":["../../../../src/jose/src/jwt/encrypt.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,KAAK;AASL,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAA;AAEhD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,UAAU;IACrB,IAAI,CAAa;IAEjB,GAAG,CAAa;IAEhB,wBAAwB,CAAyC;IAEjE,gBAAgB,CAAmC;IAEnD,wBAAwB,CAAU;IAElC,yBAAyB,CAAU;IAEnC,0BAA0B,CAAU;IAEpC,IAAI,CAAkB;IAEtB;;;;OAIG;IACH,YAAY,UAA4B,EAAE;QACxC,IAAI,CAAC,IAAI,GAAG,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAA;IAC3C,CAAC;IAED,SAAS,CAAC,MAAc;QACtB,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,MAAM,CAAA;QACtB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAA;QACvB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,WAAW,CAAC,QAA2B;QACrC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,QAAQ,CAAA;QACxB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,CAAA;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,YAAY,CAAC,KAA6B;QACxC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,CAAA;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,iBAAiB,CAAC,KAA6B;QAC7C,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,CAAA;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,WAAW,CAAC,KAA8B;QACxC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,KAAK,CAAA;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;OAKG;IACH,kBAAkB,CAAC,eAAiD;QAClE,YAAY,CAAC,IAAI,CAAC,gBAAgB,EAAE,oBAAoB,CAAC,CAAA;QACzD,IAAI,CAAC,gBAAgB,GAAG,eAAe,CAAA;QACvC,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;OAMG;IACH,0BAA0B,CAAC,UAAkD;QAC3E,YAAY,CAAC,IAAI,CAAC,wBAAwB,EAAE,4BAA4B,CAAC,CAAA;QACzE,IAAI,CAAC,wBAAwB,GAAG,UAAU,CAAA;QAC1C,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;;;OAQG;IACH,uBAAuB,CAAC,GAAe;QACrC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAA;QAClD,IAAI,CAAC,IAAI,GAAG,GAAG,CAAA;QACf,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;;;OAQG;IACH,uBAAuB,CAAC,EAAc;QACpC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAA;QACjD,IAAI,CAAC,GAAG,GAAG,EAAE,CAAA;QACb,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;OAIG;IACH,uBAAuB;QACrB,IAAI,CAAC,wBAAwB,GAAG,IAAI,CAAA;QACpC,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;OAIG;IACH,wBAAwB;QACtB,IAAI,CAAC,yBAAyB,GAAG,IAAI,CAAA;QACrC,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;OAIG;IACH,yBAAyB;QACvB,IAAI,CAAC,0BAA0B,GAAG,IAAI,CAAA;QACtC,OAAO,IAAI,CAAA;IACb,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,GAAmB,EAAE,OAA8B;QAC/D,MAAM,GAAG,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QAChD,IACE,IAAI,CAAC,gBAAgB;YACrB,CAAC,IAAI,CAAC,wBAAwB;gBAC5B,IAAI,CAAC,yBAAyB;gBAC9B,IAAI,CAAC,0BAA0B,CAAC,EAClC,CAAC;YACD,IAAI,CAAC,gBAAgB,GAAG;gBACtB,GAAG,IAAI,CAAC,gBAAgB;gBACxB,GAAG,EAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;gBAC9D,GAAG,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;gBAC/D,GAAG,EAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;aACjE,CAAA;QACH,CAAC;QACD,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAA;QAC7C,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACvC,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,GAAG,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACxC,CAAC;QACD,IAAI,IAAI,CAAC,wBAAwB,EAAE,CAAC;YAClC,GAAG,CAAC,0BAA0B,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;QAC/D,CAAC;QACD,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;IAClC,CAAC;CACF"}
+{"version":3,"file":"encrypt.js","sourceRoot":"","sources":["../../../../src/jose/src/jwt/encrypt.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,KAAK;AASL,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAE9D,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AACzF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,0EAA0E;AAC1E,MAAM,eAAe,GAAyD,gBAAgB,CAAC;AAE/F;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,OAAO,UAAW,SAAQ,eAAe;IAC7C,MAAM,GAAiB,CAAC,SAAU,CAAC,CAAC;IAEpC,wBAAwB,CAAW;IAEnC,yBAAyB,CAAW;IAEpC,0BAA0B,CAAW;IAErC;;;;;OAKG;IACH,kBAAkB,CAAC,eAAiD;QAClE,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,eAAe,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACH,0BAA0B,CAAC,UAAkD;QAC3E,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC;QAC5B,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,uBAAuB,CAAC,GAAe;QACrC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;QACrB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAc;QACpC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,yBAAyB,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,uBAAuB;QACrB,IAAI,CAAC,wBAAwB,GAAG,IAAI,CAAC;QACrC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,wBAAwB;QACtB,IAAI,CAAC,yBAAyB,GAAG,IAAI,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,yBAAyB;QACvB,IAAI,CAAC,0BAA0B,GAAG,IAAI,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,GAAmB,EAAE,OAA8B;QAC/D,MAAM,SAAS,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC1C,IACE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YACd,CAAC,IAAI,CAAC,wBAAwB,IAAI,IAAI,CAAC,yBAAyB,IAAI,IAAI,CAAC,0BAA0B,CAAC,EACpG,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG;gBACf,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;gBACjB,GAAG,EAAE,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;gBACtE,GAAG,EAAE,IAAI,CAAC,yBAAyB,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;gBACvE,GAAG,EAAE,IAAI,CAAC,0BAA0B,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS;aACzE,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAiB,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7C,KAAK,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC;QACrB,OAAO,UAAU,CAAC,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1D,CAAC;CACF"}