jose 3.17.0 → 3.20.1

package/dist/browser/runtime/asn1.js

@@ -0,0 +1,119 @@
+import globalThis, { isCloudflareWorkers, isNodeJs } from './global.js';
+import crypto, { isCryptoKey } from './webcrypto.js';
+import invalidKeyInput from './invalid_key_input.js';
+import { encodeBase64 } from './base64url.js';
+import formatPEM from '../lib/format_pem.js';
+import { JOSENotSupported } from '../util/errors.js';
+const genericExport = async (keyType, keyFormat, key) => {
+    if (!isCryptoKey(key)) {
+        throw new TypeError(invalidKeyInput(key, 'CryptoKey'));
+    }
+    if (!key.extractable) {
+        throw new TypeError('CryptoKey is not extractable');
+    }
+    if (key.type !== keyType) {
+        throw new TypeError(`key is not a ${keyType} key`);
+    }
+    return formatPEM(encodeBase64(new Uint8Array(await crypto.subtle.exportKey(keyFormat, key))), `${keyType.toUpperCase()} KEY`);
+};
+export const toSPKI = (key) => {
+    return genericExport('public', 'spki', key);
+};
+export const toPKCS8 = (key) => {
+    return genericExport('private', 'pkcs8', key);
+};
+const getNamedCurve = (keyData) => {
+    const keyDataStr = keyData.toString();
+    switch (true) {
+        case keyDataStr.includes(new Uint8Array([
+            0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce,
+            0x3d, 0x03, 0x01, 0x07,
+        ]).toString()):
+            return 'P-256';
+        case keyDataStr.includes(new Uint8Array([
+            0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x05, 0x2b, 0x81, 0x04, 0x00,
+            0x22,
+        ]).toString()):
+            return 'P-384';
+        case keyDataStr.includes(new Uint8Array([
+            0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x05, 0x2b, 0x81, 0x04, 0x00,
+            0x23,
+        ]).toString()):
+            return 'P-521';
+        case (isCloudflareWorkers() || isNodeJs()) &&
+            keyDataStr.includes(new Uint8Array([0x06, 0x03, 0x2b, 0x65, 0x70]).toString()):
+            return 'Ed25519';
+        case isNodeJs() &&
+            keyDataStr.includes(new Uint8Array([0x06, 0x03, 0x2b, 0x65, 0x71]).toString()):
+            return 'Ed448';
+        default:
+            throw new JOSENotSupported('Invalid or unsupported EC Key Curve or OKP Key Sub Type');
+    }
+};
+const genericImport = async (replace, keyFormat, pem, alg, options) => {
+    var _a;
+    let algorithm;
+    let keyUsages;
+    const keyData = new Uint8Array(globalThis
+        .atob(pem.replace(replace, ''))
+        .split('')
+        .map((c) => c.charCodeAt(0)));
+    const isPublic = keyFormat === 'spki';
+    switch (alg) {
+        case 'PS256':
+        case 'PS384':
+        case 'PS512':
+            algorithm = { name: 'RSA-PSS', hash: { name: `SHA-${alg.substr(-3)}` } };
+            keyUsages = isPublic ? ['verify'] : ['sign'];
+            break;
+        case 'RS256':
+        case 'RS384':
+        case 'RS512':
+            algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: { name: `SHA-${alg.substr(-3)}` } };
+            keyUsages = isPublic ? ['verify'] : ['sign'];
+            break;
+        case 'RSA-OAEP':
+        case 'RSA-OAEP-256':
+        case 'RSA-OAEP-384':
+        case 'RSA-OAEP-512':
+            algorithm = {
+                name: 'RSA-OAEP',
+                hash: { name: `SHA-${parseInt(alg.substr(-3), 10) || 1}` },
+            };
+            keyUsages = isPublic ? ['encrypt', 'wrapKey'] : ['decrypt', 'unwrapKey'];
+            break;
+        case 'ES256':
+            algorithm = { name: 'ECDSA', namedCurve: 'P-256' };
+            keyUsages = isPublic ? ['verify'] : ['sign'];
+            break;
+        case 'ES384':
+            algorithm = { name: 'ECDSA', namedCurve: 'P-384' };
+            keyUsages = isPublic ? ['verify'] : ['sign'];
+            break;
+        case 'ES512':
+            algorithm = { name: 'ECDSA', namedCurve: 'P-521' };
+            keyUsages = isPublic ? ['verify'] : ['sign'];
+            break;
+        case 'ECDH-ES':
+        case 'ECDH-ES+A128KW':
+        case 'ECDH-ES+A192KW':
+        case 'ECDH-ES+A256KW':
+            algorithm = { name: 'ECDH', namedCurve: getNamedCurve(keyData) };
+            keyUsages = isPublic ? [] : ['deriveBits'];
+            break;
+        case (isCloudflareWorkers() || isNodeJs()) && 'EdDSA':
+            const namedCurve = getNamedCurve(keyData).toUpperCase();
+            algorithm = { name: `NODE-${namedCurve}`, namedCurve: `NODE-${namedCurve}` };
+            keyUsages = isPublic ? ['verify'] : ['sign'];
+            break;
+        default:
+            throw new JOSENotSupported('Invalid or unsupported "alg" (Algorithm) value');
+    }
+    return crypto.subtle.importKey(keyFormat, keyData, algorithm, (_a = options === null || options === void 0 ? void 0 : options.extractable) !== null && _a !== void 0 ? _a : false, keyUsages);
+};
+export const fromPKCS8 = (pem, alg, options) => {
+    return genericImport(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, 'pkcs8', pem, alg, options);
+};
+export const fromSPKI = (pem, alg, options) => {
+    return genericImport(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g, 'spki', pem, alg, options);
+};

package/dist/browser/runtime/base64url.js

@@ -1,6 +1,6 @@
 import { encoder, decoder } from '../lib/buffer_utils.js';
 import globalThis from './global.js';
-export const encode = (input) => {
+export const encodeBase64 = (input) => {
     let unencoded = input;
     if (typeof unencoded === 'string') {
         unencoded = encoder.encode(unencoded);
@@ -10,8 +10,16 @@ export const encode = (input) => {
     for (let i = 0; i < unencoded.length; i += CHUNK_SIZE) {
         arr.push(String.fromCharCode.apply(null, unencoded.subarray(i, i + CHUNK_SIZE)));
     }
-    const base64string = globalThis.btoa(arr.join(''));
-    return base64string.replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+    return globalThis.btoa(arr.join(''));
+};
+export const encode = (input) => {
+    return encodeBase64(input).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+};
+export const decodeBase64 = (encoded) => {
+    return new Uint8Array(globalThis
+        .atob(encoded)
+        .split('')
+        .map((c) => c.charCodeAt(0)));
 };
 export const decode = (input) => {
     let encoded = input;
@@ -20,10 +28,7 @@ export const decode = (input) => {
     }
     encoded = encoded.replace(/-/g, '+').replace(/_/g, '/').replace(/\s/g, '');
     try {
-        return new Uint8Array(globalThis
-            .atob(encoded)
-            .split('')
-            .map((c) => c.charCodeAt(0)));
+        return decodeBase64(encoded);
     }
     catch (_a) {
         throw new TypeError('The input to be decoded is not correctly encoded.');

package/dist/browser/runtime/fetch_jwks.js

@@ -1,23 +1,36 @@
-import { JOSEError } from '../util/errors.js';
-import globalThis from './global.js';
+import { JOSEError, JWKSTimeout } from '../util/errors.js';
+import globalThis, { isCloudflareWorkers } from './global.js';
 const fetchJwks = async (url, timeout) => {
     let controller;
+    let id;
+    let timedOut = false;
     if (typeof AbortController === 'function') {
         controller = new AbortController();
-        setTimeout(() => controller.abort(), timeout);
+        id = setTimeout(() => {
+            timedOut = true;
+            controller.abort();
+        }, timeout);
     }
-    const response = await globalThis.fetch(url.href, {
+    const response = await globalThis
+        .fetch(url.href, {
         signal: controller ? controller.signal : undefined,
         redirect: 'manual',
         method: 'GET',
-        ...(globalThis.WebSocketPair === undefined
+        ...(!isCloudflareWorkers()
             ? {
                 referrerPolicy: 'no-referrer',
                 credentials: 'omit',
                 mode: 'cors',
             }
             : undefined),
+    })
+        .catch((err) => {
+        if (timedOut)
+            throw new JWKSTimeout();
+        throw err;
     });
+    if (id !== undefined)
+        clearTimeout(id);
     if (response.status !== 200) {
         throw new JOSEError('Expected 200 OK from the JSON Web Key Set HTTP response');
     }

package/dist/browser/runtime/is_key_like.js

@@ -0,0 +1,5 @@
+import { isCryptoKey } from './webcrypto.js';
+export default (key) => {
+    return isCryptoKey(key);
+};
+export const types = ['CryptoKey'];

package/dist/browser/util/errors.js

@@ -1,11 +1,10 @@
 export class JOSEError extends Error {
     constructor(message) {
+        var _a;
         super(message);
         this.code = JOSEError.code;
         this.name = this.constructor.name;
-        if (Error.captureStackTrace) {
-            Error.captureStackTrace(this, this.constructor);
-        }
+        (_a = Error.captureStackTrace) === null || _a === void 0 ? void 0 : _a.call(Error, this, this.constructor);
     }
 }
 JOSEError.code = 'ERR_JOSE_GENERIC';
@@ -91,6 +90,14 @@ export class JWKSMultipleMatchingKeys extends JOSEError {
     }
 }
 JWKSMultipleMatchingKeys.code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
+export class JWKSTimeout extends JOSEError {
+    constructor() {
+        super(...arguments);
+        this.code = JWKSTimeout.code;
+        this.message = 'request timed out';
+    }
+}
+JWKSTimeout.code = 'ERR_JWKS_TIMEOUT';
 export class JWSSignatureVerificationFailed extends JOSEError {
     constructor() {
         super(...arguments);

package/dist/node/cjs/jwe/compact/decrypt.js

@@ -22,7 +22,11 @@ async function compactDecrypt(jwe, key, options) {
         tag: (tag || undefined),
         encrypted_key: encryptedKey || undefined,
     }, key, options);
-    return { plaintext: decrypted.plaintext, protectedHeader: decrypted.protectedHeader };
+    const result = { plaintext: decrypted.plaintext, protectedHeader: decrypted.protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: decrypted.key };
+    }
+    return result;
 }
 exports.compactDecrypt = compactDecrypt;
 exports.default = compactDecrypt;

package/dist/node/cjs/jwe/flattened/decrypt.js

@@ -95,8 +95,10 @@ async function flattenedDecrypt(jwe, key, options) {
     if (jwe.encrypted_key !== undefined) {
         encryptedKey = (0, base64url_js_1.decode)(jwe.encrypted_key);
     }
+    let resolvedKey = false;
     if (typeof key === 'function') {
         key = await key(parsedProt, jwe);
+        resolvedKey = true;
     }
     let cek;
     try {
@@ -135,6 +137,9 @@ async function flattenedDecrypt(jwe, key, options) {
     if (jwe.header !== undefined) {
         result.unprotectedHeader = jwe.header;
     }
+    if (resolvedKey) {
+        return { ...result, key };
+    }
     return result;
 }
 exports.flattenedDecrypt = flattenedDecrypt;

package/dist/node/cjs/jwk/embedded.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EmbeddedJWK = void 0;
-const parse_js_1 = require("./parse.js");
+const import_js_1 = require("../key/import.js");
 const is_object_js_1 = require("../lib/is_object.js");
 const errors_js_1 = require("../util/errors.js");
 async function EmbeddedJWK(protectedHeader, token) {
@@ -12,8 +12,8 @@ async function EmbeddedJWK(protectedHeader, token) {
     if (!(0, is_object_js_1.default)(joseHeader.jwk)) {
         throw new errors_js_1.JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');
     }
-    const key = await (0, parse_js_1.default)(joseHeader.jwk, joseHeader.alg, true);
-    if (key.type !== 'public') {
+    const key = await (0, import_js_1.importJWK)({ ...joseHeader.jwk, ext: true }, joseHeader.alg, true);
+    if (key instanceof Uint8Array || key.type !== 'public') {
         throw new errors_js_1.JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
     }
     return key;

package/dist/node/cjs/jwk/from_key_like.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.fromKeyLike = void 0;
-const key_to_jwk_js_1 = require("../runtime/key_to_jwk.js");
+const export_js_1 = require("../key/export.js");
 async function fromKeyLike(key) {
-    return (0, key_to_jwk_js_1.default)(key);
+    return (0, export_js_1.exportJWK)(key);
 }
 exports.fromKeyLike = fromKeyLike;
 exports.default = fromKeyLike;

package/dist/node/cjs/jwk/parse.js

@@ -1,38 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseJwk = void 0;
-const base64url_js_1 = require("../runtime/base64url.js");
-const jwk_to_key_js_1 = require("../runtime/jwk_to_key.js");
-const errors_js_1 = require("../util/errors.js");
-const is_object_js_1 = require("../lib/is_object.js");
+const import_js_1 = require("../key/import.js");
 async function parseJwk(jwk, alg, octAsKeyObject) {
-    if (!(0, is_object_js_1.default)(jwk)) {
-        throw new TypeError('JWK must be an object');
-    }
-    alg || (alg = jwk.alg);
-    if (typeof alg !== 'string' || !alg) {
-        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
-    }
-    switch (jwk.kty) {
-        case 'oct':
-            if (typeof jwk.k !== 'string' || !jwk.k) {
-                throw new TypeError('missing "k" (Key Value) Parameter value');
-            }
-            octAsKeyObject !== null && octAsKeyObject !== void 0 ? octAsKeyObject : (octAsKeyObject = jwk.ext !== true);
-            if (octAsKeyObject) {
-                return (0, jwk_to_key_js_1.default)({ ...jwk, alg, ext: false });
-            }
-            return (0, base64url_js_1.decode)(jwk.k);
-        case 'RSA':
-            if (jwk.oth !== undefined) {
-                throw new errors_js_1.JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
-            }
-        case 'EC':
-        case 'OKP':
-            return (0, jwk_to_key_js_1.default)({ ...jwk, alg });
-        default:
-            throw new errors_js_1.JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
-    }
+    return (0, import_js_1.importJWK)(jwk, alg, octAsKeyObject);
 }
 exports.parseJwk = parseJwk;
 exports.default = parseJwk;

package/dist/node/cjs/jwks/remote.js

@@ -2,11 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createRemoteJWKSet = void 0;
 const fetch_jwks_js_1 = require("../runtime/fetch_jwks.js");
-const parse_js_1 = require("../jwk/parse.js");
+const import_js_1 = require("../key/import.js");
 const errors_js_1 = require("../util/errors.js");
 const is_object_js_1 = require("../lib/is_object.js");
 function getKtyFromAlg(alg) {
-    switch (alg.substr(0, 2)) {
+    switch (typeof alg === 'string' && alg.substr(0, 2)) {
         case 'RS':
         case 'PS':
             return 'RSA';
@@ -35,7 +35,7 @@ class RemoteJWKSet {
             typeof (options === null || options === void 0 ? void 0 : options.cooldownDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.cooldownDuration : 30000;
     }
     coolingDown() {
-        if (typeof this._cooldownStarted === 'undefined') {
+        if (!this._cooldownStarted) {
             return false;
         }
         return Date.now() < this._cooldownStarted + this._cooldownDuration;
@@ -59,7 +59,7 @@ class RemoteJWKSet {
                 candidate = jwk.key_ops.includes('verify');
             }
             if (candidate && protectedHeader.alg === 'EdDSA') {
-                candidate = ['Ed25519', 'Ed448'].includes(jwk.crv);
+                candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
             }
             if (candidate) {
                 switch (protectedHeader.alg) {
@@ -91,13 +91,10 @@ class RemoteJWKSet {
         else if (length !== 1) {
             throw new errors_js_1.JWKSMultipleMatchingKeys();
         }
-        if (!this._cached.has(jwk)) {
-            this._cached.set(jwk, {});
-        }
-        const cached = this._cached.get(jwk);
+        const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
         if (cached[protectedHeader.alg] === undefined) {
-            const keyObject = await (0, parse_js_1.default)({ ...jwk, alg: protectedHeader.alg });
-            if (keyObject.type !== 'public') {
+            const keyObject = await (0, import_js_1.importJWK)({ ...jwk, ext: true }, protectedHeader.alg);
+            if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
                 throw new errors_js_1.JWKSInvalid('JSON Web Key Set members must be public keys');
             }
             cached[protectedHeader.alg] = keyObject;

package/dist/node/cjs/jws/compact/verify.js

@@ -20,7 +20,11 @@ async function compactVerify(jws, key, options) {
         protected: protectedHeader || undefined,
         signature: (signature || undefined),
     }, key, options);
-    return { payload: verified.payload, protectedHeader: verified.protectedHeader };
+    const result = { payload: verified.payload, protectedHeader: verified.protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: verified.key };
+    }
+    return result;
 }
 exports.compactVerify = compactVerify;
 exports.default = compactVerify;

package/dist/node/cjs/jws/flattened/verify.js

@@ -73,8 +73,10 @@ async function flattenedVerify(jws, key, options) {
     else if (typeof jws.payload !== 'string' && !(jws.payload instanceof Uint8Array)) {
         throw new errors_js_1.JWSInvalid('JWS Payload must be a string or an Uint8Array instance');
     }
+    let resolvedKey = false;
     if (typeof key === 'function') {
         key = await key(parsedProt, jws);
+        resolvedKey = true;
     }
     (0, check_key_type_js_1.default)(alg, key, 'verify');
     const data = (0, buffer_utils_js_1.concat)(buffer_utils_js_1.encoder.encode((_a = jws.protected) !== null && _a !== void 0 ? _a : ''), buffer_utils_js_1.encoder.encode('.'), typeof jws.payload === 'string' ? buffer_utils_js_1.encoder.encode(jws.payload) : jws.payload);
@@ -100,6 +102,9 @@ async function flattenedVerify(jws, key, options) {
     if (jws.header !== undefined) {
         result.unprotectedHeader = jws.header;
     }
+    if (resolvedKey) {
+        return { ...result, key };
+    }
     return result;
 }
 exports.flattenedVerify = flattenedVerify;

package/dist/node/cjs/jwt/decrypt.js

@@ -18,7 +18,11 @@ async function jwtDecrypt(jwt, key, options) {
         JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud)) {
         throw new errors_js_1.JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch', 'aud', 'mismatch');
     }
-    return { payload, protectedHeader };
+    const result = { payload, protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: decrypted.key };
+    }
+    return result;
 }
 exports.jwtDecrypt = jwtDecrypt;
 exports.default = jwtDecrypt;

package/dist/node/cjs/jwt/encrypt.js

@@ -3,8 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.EncryptJWT = void 0;
 const encrypt_js_1 = require("../jwe/compact/encrypt.js");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
-const jwt_producer_js_1 = require("../lib/jwt_producer.js");
-class EncryptJWT extends jwt_producer_js_1.default {
+const produce_js_1 = require("./produce.js");
+class EncryptJWT extends produce_js_1.ProduceJWT {
     setProtectedHeader(protectedHeader) {
         if (this._protectedHeader) {
             throw new TypeError('setProtectedHeader can only be called once');

package/dist/node/cjs/{lib/jwt_producer.js → jwt/produce.js}

@@ -1,8 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const epoch_js_1 = require("./epoch.js");
-const is_object_js_1 = require("./is_object.js");
-const secs_js_1 = require("./secs.js");
+exports.ProduceJWT = void 0;
+const epoch_js_1 = require("../lib/epoch.js");
+const is_object_js_1 = require("../lib/is_object.js");
+const secs_js_1 = require("../lib/secs.js");
 class ProduceJWT {
     constructor(payload) {
         if (!(0, is_object_js_1.default)(payload)) {
@@ -54,4 +55,4 @@ class ProduceJWT {
         return this;
     }
 }
-exports.default = ProduceJWT;
+exports.ProduceJWT = ProduceJWT;

package/dist/node/cjs/jwt/sign.js

@@ -4,8 +4,8 @@ exports.SignJWT = void 0;
 const sign_js_1 = require("../jws/compact/sign.js");
 const errors_js_1 = require("../util/errors.js");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
-const jwt_producer_js_1 = require("../lib/jwt_producer.js");
-class SignJWT extends jwt_producer_js_1.default {
+const produce_js_1 = require("./produce.js");
+class SignJWT extends produce_js_1.ProduceJWT {
     setProtectedHeader(protectedHeader) {
         this._protectedHeader = protectedHeader;
         return this;

package/dist/node/cjs/jwt/unsecured.js

@@ -5,8 +5,8 @@ const base64url = require("../runtime/base64url.js");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
 const errors_js_1 = require("../util/errors.js");
 const jwt_claims_set_js_1 = require("../lib/jwt_claims_set.js");
-const jwt_producer_js_1 = require("../lib/jwt_producer.js");
-class UnsecuredJWT extends jwt_producer_js_1.default {
+const produce_js_1 = require("./produce.js");
+class UnsecuredJWT extends produce_js_1.ProduceJWT {
     encode() {
         const header = base64url.encode(JSON.stringify({ alg: 'none' }));
         const payload = base64url.encode(JSON.stringify(this._payload));

package/dist/node/cjs/jwt/verify.js

@@ -11,7 +11,11 @@ async function jwtVerify(jwt, key, options) {
         throw new errors_js_1.JWTInvalid('JWTs MUST NOT use unencoded payload');
     }
     const payload = (0, jwt_claims_set_js_1.default)(verified.protectedHeader, verified.payload, options);
-    return { payload, protectedHeader: verified.protectedHeader };
+    const result = { payload, protectedHeader: verified.protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: verified.key };
+    }
+    return result;
 }
 exports.jwtVerify = jwtVerify;
 exports.default = jwtVerify;

package/dist/node/cjs/key/export.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exportJWK = exports.exportPKCS8 = exports.exportSPKI = void 0;
+const asn1_js_1 = require("../runtime/asn1.js");
+const asn1_js_2 = require("../runtime/asn1.js");
+const key_to_jwk_js_1 = require("../runtime/key_to_jwk.js");
+async function exportSPKI(key) {
+    return (0, asn1_js_1.toSPKI)(key);
+}
+exports.exportSPKI = exportSPKI;
+async function exportPKCS8(key) {
+    return (0, asn1_js_2.toPKCS8)(key);
+}
+exports.exportPKCS8 = exportPKCS8;
+async function exportJWK(key) {
+    return (0, key_to_jwk_js_1.default)(key);
+}
+exports.exportJWK = exportJWK;

package/dist/node/cjs/key/import.js

@@ -0,0 +1,126 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.importJWK = exports.importPKCS8 = exports.importX509 = exports.importSPKI = void 0;
+const base64url_js_1 = require("../runtime/base64url.js");
+const asn1_js_1 = require("../runtime/asn1.js");
+const asn1_js_2 = require("../runtime/asn1.js");
+const jwk_to_key_js_1 = require("../runtime/jwk_to_key.js");
+const errors_js_1 = require("../util/errors.js");
+const format_pem_js_1 = require("../lib/format_pem.js");
+const is_object_js_1 = require("../lib/is_object.js");
+function getElement(seq) {
+    let result = [];
+    let next = 0;
+    while (next < seq.length) {
+        let nextPart = parseElement(seq.subarray(next));
+        result.push(nextPart);
+        next += nextPart.byteLength;
+    }
+    return result;
+}
+function parseElement(bytes) {
+    let position = 0;
+    let tag = bytes[0] & 0x1f;
+    position++;
+    if (tag === 0x1f) {
+        tag = 0;
+        while (bytes[position] >= 0x80) {
+            tag = tag * 128 + bytes[position] - 0x80;
+            position++;
+        }
+        tag = tag * 128 + bytes[position] - 0x80;
+        position++;
+    }
+    let length = 0;
+    if (bytes[position] < 0x80) {
+        length = bytes[position];
+        position++;
+    }
+    else {
+        let numberOfDigits = bytes[position] & 0x7f;
+        position++;
+        length = 0;
+        for (let i = 0; i < numberOfDigits; i++) {
+            length = length * 256 + bytes[position];
+            position++;
+        }
+    }
+    if (length === 0x80) {
+        length = 0;
+        while (bytes[position + length] !== 0 || bytes[position + length + 1] !== 0) {
+            length++;
+        }
+        const byteLength = position + length + 2;
+        return {
+            byteLength,
+            contents: bytes.subarray(position, position + length),
+            raw: bytes.subarray(0, byteLength),
+        };
+    }
+    const byteLength = position + length;
+    return {
+        byteLength,
+        contents: bytes.subarray(position, byteLength),
+        raw: bytes.subarray(0, byteLength),
+    };
+}
+function spkiFromX509(buf) {
+    return (0, base64url_js_1.encodeBase64)(getElement(getElement(parseElement(buf).contents)[0].contents)[6].raw);
+}
+function getSPKI(x509) {
+    const pem = x509.replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g, '');
+    const raw = (0, base64url_js_1.decodeBase64)(pem);
+    return (0, format_pem_js_1.default)(spkiFromX509(raw), 'PUBLIC KEY');
+}
+async function importSPKI(spki, alg, options) {
+    if (typeof spki !== 'string' || spki.indexOf('-----BEGIN PUBLIC KEY-----') !== 0) {
+        throw new TypeError('"spki" must be SPKI formatted string');
+    }
+    return (0, asn1_js_1.fromSPKI)(spki, alg, options);
+}
+exports.importSPKI = importSPKI;
+async function importX509(x509, alg, options) {
+    if (typeof x509 !== 'string' || x509.indexOf('-----BEGIN CERTIFICATE-----') !== 0) {
+        throw new TypeError('"x509" must be X.509 formatted string');
+    }
+    const spki = getSPKI(x509);
+    return (0, asn1_js_1.fromSPKI)(spki, alg, options);
+}
+exports.importX509 = importX509;
+async function importPKCS8(pkcs8, alg, options) {
+    if (typeof pkcs8 !== 'string' || pkcs8.indexOf('-----BEGIN PRIVATE KEY-----') !== 0) {
+        throw new TypeError('"pkcs8" must be PCKS8 formatted string');
+    }
+    return (0, asn1_js_2.fromPKCS8)(pkcs8, alg, options);
+}
+exports.importPKCS8 = importPKCS8;
+async function importJWK(jwk, alg, octAsKeyObject) {
+    if (!(0, is_object_js_1.default)(jwk)) {
+        throw new TypeError('JWK must be an object');
+    }
+    alg || (alg = jwk.alg);
+    if (typeof alg !== 'string' || !alg) {
+        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
+    }
+    switch (jwk.kty) {
+        case 'oct':
+            if (typeof jwk.k !== 'string' || !jwk.k) {
+                throw new TypeError('missing "k" (Key Value) Parameter value');
+            }
+            octAsKeyObject !== null && octAsKeyObject !== void 0 ? octAsKeyObject : (octAsKeyObject = jwk.ext !== true);
+            if (octAsKeyObject) {
+                return (0, jwk_to_key_js_1.default)({ ...jwk, alg, ext: false });
+            }
+            return (0, base64url_js_1.decode)(jwk.k);
+        case 'RSA':
+            if (jwk.oth !== undefined) {
+                throw new errors_js_1.JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
+            }
+        case 'EC':
+        case 'OKP':
+            return (0, jwk_to_key_js_1.default)({ ...jwk, alg });
+        default:
+            throw new errors_js_1.JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
+    }
+}
+exports.importJWK = importJWK;