jose 3.16.0 → 3.19.0

package/dist/node/cjs/jws/flattened/verify.js

@@ -1,13 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.flattenedVerify = void 0;
+const base64url_js_1 = require("../../runtime/base64url.js");
+const verify_js_1 = require("../../runtime/verify.js");
 const errors_js_1 = require("../../util/errors.js");
 const buffer_utils_js_1 = require("../../lib/buffer_utils.js");
 const is_disjoint_js_1 = require("../../lib/is_disjoint.js");
 const is_object_js_1 = require("../../lib/is_object.js");
 const check_key_type_js_1 = require("../../lib/check_key_type.js");
-const base64url_js_1 = require("../../runtime/base64url.js");
-const verify_js_1 = require("../../runtime/verify.js");
 const validate_crit_js_1 = require("../../lib/validate_crit.js");
 const validate_algorithms_js_1 = require("../../lib/validate_algorithms.js");
 const checkExtensions = validate_crit_js_1.default.bind(undefined, errors_js_1.JWSInvalid, new Map([['b64', true]]));
@@ -73,8 +73,10 @@ async function flattenedVerify(jws, key, options) {
     else if (typeof jws.payload !== 'string' && !(jws.payload instanceof Uint8Array)) {
         throw new errors_js_1.JWSInvalid('JWS Payload must be a string or an Uint8Array instance');
     }
+    let resolvedKey = false;
     if (typeof key === 'function') {
         key = await key(parsedProt, jws);
+        resolvedKey = true;
     }
     (0, check_key_type_js_1.default)(alg, key, 'verify');
     const data = (0, buffer_utils_js_1.concat)(buffer_utils_js_1.encoder.encode((_a = jws.protected) !== null && _a !== void 0 ? _a : ''), buffer_utils_js_1.encoder.encode('.'), typeof jws.payload === 'string' ? buffer_utils_js_1.encoder.encode(jws.payload) : jws.payload);
@@ -100,6 +102,9 @@ async function flattenedVerify(jws, key, options) {
     if (jws.header !== undefined) {
         result.unprotectedHeader = jws.header;
     }
+    if (resolvedKey) {
+        return { ...result, key };
+    }
     return result;
 }
 exports.flattenedVerify = flattenedVerify;

package/dist/node/cjs/jwt/decrypt.js

@@ -18,7 +18,11 @@ async function jwtDecrypt(jwt, key, options) {
         JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud)) {
         throw new errors_js_1.JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch', 'aud', 'mismatch');
     }
-    return { payload, protectedHeader };
+    const result = { payload, protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: decrypted.key };
+    }
+    return result;
 }
 exports.jwtDecrypt = jwtDecrypt;
 exports.default = jwtDecrypt;

package/dist/node/cjs/jwt/unsecured.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.UnsecuredJWT = void 0;
-const buffer_utils_js_1 = require("../lib/buffer_utils.js");
 const base64url = require("../runtime/base64url.js");
+const buffer_utils_js_1 = require("../lib/buffer_utils.js");
 const errors_js_1 = require("../util/errors.js");
 const jwt_claims_set_js_1 = require("../lib/jwt_claims_set.js");
 const jwt_producer_js_1 = require("../lib/jwt_producer.js");

package/dist/node/cjs/jwt/verify.js

@@ -11,7 +11,11 @@ async function jwtVerify(jwt, key, options) {
         throw new errors_js_1.JWTInvalid('JWTs MUST NOT use unencoded payload');
     }
     const payload = (0, jwt_claims_set_js_1.default)(verified.protectedHeader, verified.payload, options);
-    return { payload, protectedHeader: verified.protectedHeader };
+    const result = { payload, protectedHeader: verified.protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: verified.key };
+    }
+    return result;
 }
 exports.jwtVerify = jwtVerify;
 exports.default = jwtVerify;

package/dist/node/cjs/key/export.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exportJWK = exports.exportPKCS8 = exports.exportSPKI = void 0;
+const asn1_js_1 = require("../runtime/asn1.js");
+const asn1_js_2 = require("../runtime/asn1.js");
+const key_to_jwk_js_1 = require("../runtime/key_to_jwk.js");
+async function exportSPKI(key) {
+    return (0, asn1_js_1.toSPKI)(key);
+}
+exports.exportSPKI = exportSPKI;
+async function exportPKCS8(key) {
+    return (0, asn1_js_2.toPKCS8)(key);
+}
+exports.exportPKCS8 = exportPKCS8;
+async function exportJWK(key) {
+    return (0, key_to_jwk_js_1.default)(key);
+}
+exports.exportJWK = exportJWK;

package/dist/node/cjs/key/import.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.importJWK = exports.importPKCS8 = exports.importX509 = exports.importSPKI = void 0;
+const base64url_js_1 = require("../runtime/base64url.js");
+const asn1_js_1 = require("../runtime/asn1.js");
+const asn1_js_2 = require("../runtime/asn1.js");
+const jwk_to_key_js_1 = require("../runtime/jwk_to_key.js");
+const errors_js_1 = require("../util/errors.js");
+const format_pem_js_1 = require("../lib/format_pem.js");
+const is_object_js_1 = require("../lib/is_object.js");
+function getElement(seq) {
+    let result = [];
+    let next = 0;
+    while (next < seq.length) {
+        let nextPart = parseElement(seq.subarray(next));
+        result.push(nextPart);
+        next += nextPart.byteLength;
+    }
+    return result;
+}
+function parseElement(bytes) {
+    let position = 0;
+    let tag = bytes[0] & 0x1f;
+    position++;
+    if (tag === 0x1f) {
+        tag = 0;
+        while (bytes[position] >= 0x80) {
+            tag = tag * 128 + bytes[position] - 0x80;
+            position++;
+        }
+        tag = tag * 128 + bytes[position] - 0x80;
+        position++;
+    }
+    let length = 0;
+    if (bytes[position] < 0x80) {
+        length = bytes[position];
+        position++;
+    }
+    else {
+        let numberOfDigits = bytes[position] & 0x7f;
+        position++;
+        length = 0;
+        for (let i = 0; i < numberOfDigits; i++) {
+            length = length * 256 + bytes[position];
+            position++;
+        }
+    }
+    if (length === 0x80) {
+        length = 0;
+        while (bytes[position + length] !== 0 || bytes[position + length + 1] !== 0) {
+            length++;
+        }
+        const byteLength = position + length + 2;
+        return {
+            byteLength,
+            contents: bytes.subarray(position, position + length),
+            raw: bytes.subarray(0, byteLength),
+        };
+    }
+    const byteLength = position + length;
+    return {
+        byteLength,
+        contents: bytes.subarray(position, byteLength),
+        raw: bytes.subarray(0, byteLength),
+    };
+}
+function spkiFromX509(buf) {
+    return (0, base64url_js_1.encodeBase64)(getElement(getElement(parseElement(buf).contents)[0].contents)[6].raw);
+}
+function getSPKI(x509) {
+    const pem = x509.replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g, '');
+    const raw = (0, base64url_js_1.decodeBase64)(pem);
+    return (0, format_pem_js_1.default)(spkiFromX509(raw), 'PUBLIC KEY');
+}
+async function importSPKI(spki, alg, options) {
+    if (typeof spki !== 'string' || spki.indexOf('-----BEGIN PUBLIC KEY-----') !== 0) {
+        throw new TypeError('"spki" must be SPKI formatted string');
+    }
+    return (0, asn1_js_1.fromSPKI)(spki, alg, options);
+}
+exports.importSPKI = importSPKI;
+async function importX509(x509, alg, options) {
+    if (typeof x509 !== 'string' || x509.indexOf('-----BEGIN CERTIFICATE-----') !== 0) {
+        throw new TypeError('"x509" must be X.509 formatted string');
+    }
+    const spki = getSPKI(x509);
+    return (0, asn1_js_1.fromSPKI)(spki, alg, options);
+}
+exports.importX509 = importX509;
+async function importPKCS8(pkcs8, alg, options) {
+    if (typeof pkcs8 !== 'string' || pkcs8.indexOf('-----BEGIN PRIVATE KEY-----') !== 0) {
+        throw new TypeError('"pkcs8" must be PCKS8 formatted string');
+    }
+    return (0, asn1_js_2.fromPKCS8)(pkcs8, alg, options);
+}
+exports.importPKCS8 = importPKCS8;
+async function importJWK(jwk, alg, octAsKeyObject) {
+    if (!(0, is_object_js_1.default)(jwk)) {
+        throw new TypeError('JWK must be an object');
+    }
+    alg || (alg = jwk.alg);
+    if (typeof alg !== 'string' || !alg) {
+        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
+    }
+    switch (jwk.kty) {
+        case 'oct':
+            if (typeof jwk.k !== 'string' || !jwk.k) {
+                throw new TypeError('missing "k" (Key Value) Parameter value');
+            }
+            octAsKeyObject !== null && octAsKeyObject !== void 0 ? octAsKeyObject : (octAsKeyObject = jwk.ext !== true);
+            if (octAsKeyObject) {
+                return (0, jwk_to_key_js_1.default)({ ...jwk, alg, ext: false });
+            }
+            return (0, base64url_js_1.decode)(jwk.k);
+        case 'RSA':
+            if (jwk.oth !== undefined) {
+                throw new errors_js_1.JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
+            }
+        case 'EC':
+        case 'OKP':
+            return (0, jwk_to_key_js_1.default)({ ...jwk, alg });
+        default:
+            throw new errors_js_1.JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
+    }
+}
+exports.importJWK = importJWK;

package/dist/node/cjs/lib/decrypt_key_management.js

@@ -1,14 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const errors_js_1 = require("../util/errors.js");
 const aeskw_js_1 = require("../runtime/aeskw.js");
 const ECDH = require("../runtime/ecdhes.js");
 const pbes2kw_js_1 = require("../runtime/pbes2kw.js");
 const rsaes_js_1 = require("../runtime/rsaes.js");
 const aesgcmkw_js_1 = require("../runtime/aesgcmkw.js");
 const base64url_js_1 = require("../runtime/base64url.js");
+const errors_js_1 = require("../util/errors.js");
 const cek_js_1 = require("../lib/cek.js");
-const parse_js_1 = require("../jwk/parse.js");
+const import_js_1 = require("../key/import.js");
 const check_key_type_js_1 = require("./check_key_type.js");
 function assertEnryptedKey(encryptedKey) {
     if (!encryptedKey) {
@@ -40,7 +40,7 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
             if (!ECDH.ecdhAllowed(key)) {
                 throw new errors_js_1.JOSENotSupported('ECDH-ES with the provided key is not allowed or not supported by your javascript runtime');
             }
-            const epk = await (0, parse_js_1.parseJwk)(joseHeader.epk, alg);
+            const epk = await (0, import_js_1.importJWK)(joseHeader.epk, alg);
             let partyUInfo;
             let partyVInfo;
             if (joseHeader.apu !== undefined)
@@ -90,7 +90,7 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
             return (0, aesgcmkw_js_1.unwrap)(alg, key, encryptedKey, iv, tag);
         }
         default: {
-            throw new errors_js_1.JOSENotSupported('unsupported or invalid "alg" (JWE Algorithm) header value');
+            throw new errors_js_1.JOSENotSupported('Invalid or unsupported "alg" (JWE Algorithm) header value');
         }
     }
 }

package/dist/node/cjs/lib/encrypt_key_management.js

@@ -1,7 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const cek_js_1 = require("../lib/cek.js");
-const errors_js_1 = require("../util/errors.js");
 const random_js_1 = require("../runtime/random.js");
 const aeskw_js_1 = require("../runtime/aeskw.js");
 const ECDH = require("../runtime/ecdhes.js");
@@ -9,6 +7,8 @@ const pbes2kw_js_1 = require("../runtime/pbes2kw.js");
 const rsaes_js_1 = require("../runtime/rsaes.js");
 const aesgcmkw_js_1 = require("../runtime/aesgcmkw.js");
 const base64url_js_1 = require("../runtime/base64url.js");
+const cek_js_1 = require("../lib/cek.js");
+const errors_js_1 = require("../util/errors.js");
 const from_key_like_js_1 = require("../jwk/from_key_like.js");
 const check_key_type_js_1 = require("./check_key_type.js");
 const generateCek = (0, cek_js_1.default)(random_js_1.default);
@@ -81,7 +81,7 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
             break;
         }
         default: {
-            throw new errors_js_1.JOSENotSupported('unsupported or invalid "alg" (JWE Algorithm) header value');
+            throw new errors_js_1.JOSENotSupported('Invalid or unsupported "alg" (JWE Algorithm) header value');
         }
     }
     return { cek, encryptedKey, parameters };

package/dist/node/cjs/lib/format_pem.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = (b64, descriptor) => {
+    const newlined = (b64.match(/.{1,64}/g) || []).join('\n');
+    return `-----BEGIN ${descriptor}-----\n${newlined}\n-----END ${descriptor}-----`;
+};

package/dist/node/cjs/runtime/aeskw.js

@@ -11,7 +11,7 @@ const invalid_key_input_js_1 = require("./invalid_key_input.js");
 const ciphers_js_1 = require("./ciphers.js");
 function checkKeySize(key, alg) {
     if (key.symmetricKeySize << 3 !== parseInt(alg.substr(1, 3), 10)) {
-        throw new TypeError(`invalid key size for alg: ${alg}`);
+        throw new TypeError(`Invalid key size for alg: ${alg}`);
     }
 }
 function ensureKeyObject(key, alg, usage) {

package/dist/node/cjs/runtime/asn1.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fromSPKI = exports.fromPKCS8 = exports.toPKCS8 = exports.toSPKI = void 0;
+const crypto_1 = require("crypto");
+const webcrypto_js_1 = require("./webcrypto.js");
+const is_key_object_js_1 = require("./is_key_object.js");
+const invalid_key_input_js_1 = require("./invalid_key_input.js");
+const genericExport = (keyType, keyFormat, key) => {
+    let keyObject;
+    if ((0, webcrypto_js_1.isCryptoKey)(key)) {
+        if (!key.extractable) {
+            throw new TypeError('CryptoKey is not extractable');
+        }
+        keyObject = (0, webcrypto_js_1.getKeyObject)(key);
+    }
+    else if ((0, is_key_object_js_1.default)(key)) {
+        keyObject = key;
+    }
+    else {
+        throw new TypeError((0, invalid_key_input_js_1.default)(key, 'KeyObject', 'CryptoKey'));
+    }
+    if (keyObject.type !== keyType) {
+        throw new TypeError(`key is not a ${keyType} key`);
+    }
+    return keyObject.export({ format: 'pem', type: keyFormat });
+};
+const toSPKI = (key) => {
+    return genericExport('public', 'spki', key);
+};
+exports.toSPKI = toSPKI;
+const toPKCS8 = (key) => {
+    return genericExport('private', 'pkcs8', key);
+};
+exports.toPKCS8 = toPKCS8;
+const fromPKCS8 = (pem) => (0, crypto_1.createPrivateKey)({
+    key: Buffer.from(pem.replace(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, ''), 'base64'),
+    type: 'pkcs8',
+    format: 'der',
+});
+exports.fromPKCS8 = fromPKCS8;
+const fromSPKI = (pem) => (0, crypto_1.createPublicKey)({
+    key: Buffer.from(pem.replace(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g, ''), 'base64'),
+    type: 'spki',
+    format: 'der',
+});
+exports.fromSPKI = fromSPKI;

package/dist/node/cjs/runtime/asn1_sequence_encoder.js

@@ -40,7 +40,7 @@ class DumbAsn1Encoder {
     oidFor(oid) {
         const bOid = oids.get(oid);
         if (!bOid) {
-            throw new errors_js_1.JOSENotSupported('unsupported or invalid OID');
+            throw new errors_js_1.JOSENotSupported('Invalid or unsupported OID');
         }
         this.elements.push(bOid);
         this.length += bOid.length;

package/dist/node/cjs/runtime/base64url.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.decode = exports.encode = void 0;
+exports.decode = exports.encode = exports.encodeBase64 = exports.decodeBase64 = void 0;
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
 let encodeImpl;
 function normalize(input) {
@@ -16,6 +16,10 @@ if (Buffer.isEncoding('base64url')) {
 else {
     encodeImpl = (input) => Buffer.from(input).toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
 }
+const decodeBase64 = (input) => Buffer.from(input, 'base64');
+exports.decodeBase64 = decodeBase64;
+const encodeBase64 = (input) => Buffer.from(input).toString('base64');
+exports.encodeBase64 = encodeBase64;
 exports.encode = encodeImpl;
 const decode = (input) => Buffer.from(normalize(input), 'base64');
 exports.decode = decode;

package/dist/node/cjs/runtime/decrypt.js

@@ -86,7 +86,7 @@ const decrypt = async (enc, cek, ciphertext, iv, tag, aad) => {
         case 'A256GCM':
             return gcmDecrypt(enc, key, ciphertext, iv, tag, aad);
         default:
-            throw new errors_js_1.JOSENotSupported('unsupported JWE Content Encryption Algorithm');
+            throw new errors_js_1.JOSENotSupported('Unsupported JWE Content Encryption Algorithm');
     }
 };
 exports.default = decrypt;

package/dist/node/cjs/runtime/ecdhes.js

@@ -11,30 +11,42 @@ const webcrypto_js_1 = require("./webcrypto.js");
 const is_key_object_js_1 = require("./is_key_object.js");
 const invalid_key_input_js_1 = require("./invalid_key_input.js");
 const generateKeyPair = (0, util_1.promisify)(crypto_1.generateKeyPair);
-const deriveKey = async (publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) => {
-    const value = (0, buffer_utils_js_1.concat)((0, buffer_utils_js_1.lengthAndInput)(buffer_utils_js_1.encoder.encode(algorithm)), (0, buffer_utils_js_1.lengthAndInput)(apu), (0, buffer_utils_js_1.lengthAndInput)(apv), (0, buffer_utils_js_1.uint32be)(keyLength));
-    if ((0, webcrypto_js_1.isCryptoKey)(publicKey)) {
-        publicKey = (0, webcrypto_js_1.getKeyObject)(publicKey, 'ECDH-ES');
+const deriveKey = async (publicKee, privateKee, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) => {
+    let publicKey;
+    if ((0, webcrypto_js_1.isCryptoKey)(publicKee)) {
+        publicKey = (0, webcrypto_js_1.getKeyObject)(publicKee, 'ECDH-ES');
+    }
+    else if ((0, is_key_object_js_1.default)(publicKee)) {
+        publicKey = publicKee;
+    }
+    else {
+        throw new TypeError((0, invalid_key_input_js_1.default)(publicKee, 'KeyObject', 'CryptoKey'));
     }
-    if (!(0, is_key_object_js_1.default)(publicKey)) {
-        throw new TypeError((0, invalid_key_input_js_1.default)(publicKey, 'KeyObject', 'CryptoKey'));
+    let privateKey;
+    if ((0, webcrypto_js_1.isCryptoKey)(privateKee)) {
+        privateKey = (0, webcrypto_js_1.getKeyObject)(privateKee, 'ECDH-ES', new Set(['deriveBits', 'deriveKey']));
     }
-    if ((0, webcrypto_js_1.isCryptoKey)(privateKey)) {
-        privateKey = (0, webcrypto_js_1.getKeyObject)(privateKey, 'ECDH-ES', new Set(['deriveBits', 'deriveKey']));
+    else if ((0, is_key_object_js_1.default)(privateKee)) {
+        privateKey = privateKee;
     }
-    if (!(0, is_key_object_js_1.default)(privateKey)) {
-        throw new TypeError((0, invalid_key_input_js_1.default)(privateKey, 'KeyObject', 'CryptoKey'));
+    else {
+        throw new TypeError((0, invalid_key_input_js_1.default)(privateKee, 'KeyObject', 'CryptoKey'));
     }
+    const value = (0, buffer_utils_js_1.concat)((0, buffer_utils_js_1.lengthAndInput)(buffer_utils_js_1.encoder.encode(algorithm)), (0, buffer_utils_js_1.lengthAndInput)(apu), (0, buffer_utils_js_1.lengthAndInput)(apv), (0, buffer_utils_js_1.uint32be)(keyLength));
     const sharedSecret = (0, crypto_1.diffieHellman)({ privateKey, publicKey });
     return (0, buffer_utils_js_1.concatKdf)(digest_js_1.default, sharedSecret, keyLength, value);
 };
 exports.deriveKey = deriveKey;
-const generateEpk = async (key) => {
-    if ((0, webcrypto_js_1.isCryptoKey)(key)) {
-        key = (0, webcrypto_js_1.getKeyObject)(key);
+const generateEpk = async (kee) => {
+    let key;
+    if ((0, webcrypto_js_1.isCryptoKey)(kee)) {
+        key = (0, webcrypto_js_1.getKeyObject)(kee);
+    }
+    else if ((0, is_key_object_js_1.default)(kee)) {
+        key = kee;
     }
-    if (!(0, is_key_object_js_1.default)(key)) {
-        throw new TypeError((0, invalid_key_input_js_1.default)(key, 'KeyObject', 'CryptoKey'));
+    else {
+        throw new TypeError((0, invalid_key_input_js_1.default)(kee, 'KeyObject', 'CryptoKey'));
     }
     switch (key.asymmetricKeyType) {
         case 'x25519':
@@ -47,7 +59,7 @@ const generateEpk = async (key) => {
             return (await generateKeyPair('ec', { namedCurve })).privateKey;
         }
         default:
-            throw new errors_js_1.JOSENotSupported('unsupported or invalid EPK');
+            throw new errors_js_1.JOSENotSupported('Invalid or unsupported EPK');
     }
 };
 exports.generateEpk = generateEpk;

package/dist/node/cjs/runtime/encrypt.js

@@ -64,7 +64,7 @@ const encrypt = async (enc, plaintext, cek, iv, aad) => {
         case 'A256GCM':
             return gcmEncrypt(enc, plaintext, key, iv, aad);
         default:
-            throw new errors_js_1.JOSENotSupported('unsupported JWE Content Encryption Algorithm');
+            throw new errors_js_1.JOSENotSupported('Unsupported JWE Content Encryption Algorithm');
     }
 };
 exports.default = encrypt;

package/dist/node/cjs/runtime/generate.js

@@ -30,7 +30,7 @@ async function generateSecret(alg, options) {
             length = parseInt(alg.substring(1, 4), 10);
             break;
         default:
-            throw new errors_js_1.JOSENotSupported('unsupported or invalid JWK "alg" (Algorithm) Parameter value');
+            throw new errors_js_1.JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
     }
     return (0, crypto_1.createSecretKey)((0, random_js_1.default)(new Uint8Array(length >> 3)));
 }
@@ -98,7 +98,7 @@ async function generateKeyPair(alg, options) {
                     throw new errors_js_1.JOSENotSupported('Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, X25519, and X448');
             }
         default:
-            throw new errors_js_1.JOSENotSupported('unsupported or invalid JWK "alg" (Algorithm) Parameter value');
+            throw new errors_js_1.JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
     }
 }
 exports.generateKeyPair = generateKeyPair;

package/dist/node/cjs/runtime/get_named_curve.js

@@ -20,18 +20,22 @@ const namedCurveToJOSE = (namedCurve) => {
         case 'secp521r1':
             return 'P-521';
         case 'secp256k1':
-            return namedCurve;
+            return 'secp256k1';
         default:
-            throw new errors_js_1.JOSENotSupported('unsupported key curve for this operation');
+            throw new errors_js_1.JOSENotSupported('Unsupported key curve for this operation');
     }
 };
-const getNamedCurve = (key, raw) => {
+const getNamedCurve = (kee, raw) => {
     var _a;
-    if ((0, webcrypto_js_1.isCryptoKey)(key)) {
-        key = (0, webcrypto_js_1.getKeyObject)(key);
+    let key;
+    if ((0, webcrypto_js_1.isCryptoKey)(kee)) {
+        key = (0, webcrypto_js_1.getKeyObject)(kee);
     }
-    if (!(0, is_key_object_js_1.default)(key)) {
-        throw new TypeError((0, invalid_key_input_js_1.default)(key, 'KeyObject', 'CryptoKey'));
+    else if ((0, is_key_object_js_1.default)(kee)) {
+        key = kee;
+    }
+    else {
+        throw new TypeError((0, invalid_key_input_js_1.default)(kee, 'KeyObject', 'CryptoKey'));
     }
     if (key.type === 'secret') {
         throw new TypeError('only "private" or "public" type keys can be used for this operation');
@@ -69,7 +73,7 @@ const getNamedCurve = (key, raw) => {
                     namedCurve = 'secp256k1';
                 }
                 else {
-                    throw new errors_js_1.JOSENotSupported('unsupported key curve for this operation');
+                    throw new errors_js_1.JOSENotSupported('Unsupported key curve for this operation');
                 }
             }
             if (raw)

package/dist/node/cjs/runtime/is_key_object.js

@@ -2,15 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 const crypto_1 = require("crypto");
 const util = require("util");
-let impl;
-if (util.types.isKeyObject) {
-    impl = function isKeyObject(obj) {
-        return util.types.isKeyObject(obj);
-    };
-}
-else {
-    impl = function isKeyObject(obj) {
-        return obj != null && obj instanceof crypto_1.KeyObject;
-    };
-}
-exports.default = impl;
+exports.default = util.types.isKeyObject
+    ? (obj) => util.types.isKeyObject(obj)
+    : (obj) => obj != null && obj instanceof crypto_1.KeyObject;

package/dist/node/cjs/runtime/jwk_to_key.js

@@ -115,7 +115,7 @@ const parse = (jwk) => {
             return (0, crypto_1.createPublicKey)({ key: der, format: 'der', type: 'spki' });
         }
         default:
-            throw new errors_js_1.JOSENotSupported('unsupported or invalid JWK "kty" (Key Type) Parameter value');
+            throw new errors_js_1.JOSENotSupported('Invalid or unsupported JWK "kty" (Key Type) Parameter value');
     }
 };
 exports.default = parse;

package/dist/node/cjs/runtime/key_to_jwk.js

@@ -94,7 +94,7 @@ const keyToJWK = (key) => {
                             correction = -3;
                             break;
                         default:
-                            throw new errors_js_1.JOSENotSupported('unsupported curve');
+                            throw new errors_js_1.JOSENotSupported('Unsupported curve');
                     }
                     if (keyObject.type === 'public') {
                         const der = keyObject.export({ type: 'spki', format: 'der' });
@@ -149,11 +149,11 @@ const keyToJWK = (key) => {
                     };
                 }
                 default:
-                    throw new errors_js_1.JOSENotSupported('unsupported key asymmetricKeyType');
+                    throw new errors_js_1.JOSENotSupported('Unsupported key asymmetricKeyType');
             }
         }
         default:
-            throw new errors_js_1.JOSENotSupported('unsupported key type');
+            throw new errors_js_1.JOSENotSupported('Unsupported key type');
     }
 };
 exports.default = keyToJWK;

package/dist/node/cjs/runtime/webcrypto.js

@@ -5,21 +5,10 @@ const crypto = require("crypto");
 const util = require("util");
 const webcrypto = crypto.webcrypto;
 exports.default = webcrypto;
-let impl;
-exports.isCryptoKey = impl;
-if (util.types.isCryptoKey) {
-    exports.isCryptoKey = impl = function isCryptoKey(obj) {
-        return util.types.isCryptoKey(obj);
-    };
-}
-else if (webcrypto) {
-    exports.isCryptoKey = impl = function isCryptoKey(obj) {
-        return obj != null && obj instanceof webcrypto.CryptoKey;
-    };
-}
-else {
-    exports.isCryptoKey = impl = (obj) => false;
-}
+exports.isCryptoKey = util.types.isCryptoKey
+    ? (obj) => util.types.isCryptoKey(obj)
+    :
+        (obj) => false;
 function getHashLength(hash) {
     return parseInt(hash === null || hash === void 0 ? void 0 : hash.name.substr(4), 10);
 }
@@ -34,10 +23,9 @@ function getNamedCurve(alg) {
     }
 }
 function getKeyObject(key, alg, usage) {
-    if (!alg) {
-        return crypto.KeyObject.from(key);
-    }
     switch (alg) {
+        case undefined:
+            break;
         case 'HS256':
         case 'HS384':
         case 'HS512': {
@@ -77,6 +65,12 @@ function getKeyObject(key, alg, usage) {
             }
             break;
         }
+        case 'EdDSA': {
+            if (key.algorithm.name !== 'NODE-ED25519' && key.algorithm.name !== 'NODE-ED448') {
+                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be NODE-ED25519 or NODE-ED448.`);
+            }
+            break;
+        }
         case 'ES256':
         case 'ES384':
         case 'ES512': {

package/dist/node/esm/jwe/compact/decrypt.js

@@ -19,7 +19,11 @@ async function compactDecrypt(jwe, key, options) {
         tag: (tag || undefined),
         encrypted_key: encryptedKey || undefined,
     }, key, options);
-    return { plaintext: decrypted.plaintext, protectedHeader: decrypted.protectedHeader };
+    const result = { plaintext: decrypted.plaintext, protectedHeader: decrypted.protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: decrypted.key };
+    }
+    return result;
 }
 export { compactDecrypt };
 export default compactDecrypt;