jose 3.20.1 → 3.20.4

package/dist/browser/jwe/flattened/decrypt.js

@@ -1,19 +1,14 @@
 import { decode as base64url } from '../../runtime/base64url.js';
 import decrypt from '../../runtime/decrypt.js';
 import { inflate } from '../../runtime/zlib.js';
-import random from '../../runtime/random.js';
 import { JOSEAlgNotAllowed, JOSENotSupported, JWEInvalid } from '../../util/errors.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import isObject from '../../lib/is_object.js';
 import decryptKeyManagement from '../../lib/decrypt_key_management.js';
 import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
-import cekFactory from '../../lib/cek.js';
+import generateCek from '../../lib/cek.js';
 import validateCrit from '../../lib/validate_crit.js';
 import validateAlgorithms from '../../lib/validate_algorithms.js';
-const generateCek = cekFactory(random);
-const checkExtensions = validateCrit.bind(undefined, JWEInvalid, new Map());
-const checkAlgOption = validateAlgorithms.bind(undefined, 'keyManagementAlgorithms');
-const checkEncOption = validateAlgorithms.bind(undefined, 'contentEncryptionAlgorithms');
 async function flattenedDecrypt(jwe, key, options) {
     var _a;
     if (!isObject(jwe)) {
@@ -64,7 +59,7 @@ async function flattenedDecrypt(jwe, key, options) {
         ...jwe.header,
         ...jwe.unprotected,
     };
-    checkExtensions(options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
+    validateCrit(JWEInvalid, new Map(), options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
     if (joseHeader.zip !== undefined) {
         if (!parsedProt || !parsedProt.zip) {
             throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
@@ -80,8 +75,9 @@ async function flattenedDecrypt(jwe, key, options) {
     if (typeof enc !== 'string' || !enc) {
         throw new JWEInvalid('missing JWE Encryption Algorithm (enc) in JWE Header');
     }
-    const keyManagementAlgorithms = options && checkAlgOption(options.keyManagementAlgorithms);
-    const contentEncryptionAlgorithms = options && checkEncOption(options.contentEncryptionAlgorithms);
+    const keyManagementAlgorithms = options && validateAlgorithms('keyManagementAlgorithms', options.keyManagementAlgorithms);
+    const contentEncryptionAlgorithms = options &&
+        validateAlgorithms('contentEncryptionAlgorithms', options.contentEncryptionAlgorithms);
     if (keyManagementAlgorithms && !keyManagementAlgorithms.has(alg)) {
         throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter not allowed');
     }
@@ -99,10 +95,10 @@ async function flattenedDecrypt(jwe, key, options) {
     }
     let cek;
     try {
-        cek = await decryptKeyManagement(alg, key, encryptedKey, joseHeader);
+        cek = await decryptKeyManagement(alg, key, encryptedKey, joseHeader, options);
     }
     catch (err) {
-        if (err instanceof TypeError) {
+        if (err instanceof TypeError || err instanceof JWEInvalid || err instanceof JOSENotSupported) {
             throw err;
         }
         cek = generateCek(enc);

package/dist/browser/jwe/flattened/encrypt.js

@@ -1,15 +1,12 @@
 import { encode as base64url } from '../../runtime/base64url.js';
-import random from '../../runtime/random.js';
 import encrypt from '../../runtime/encrypt.js';
 import { deflate } from '../../runtime/zlib.js';
-import ivFactory from '../../lib/iv.js';
+import generateIv from '../../lib/iv.js';
 import encryptKeyManagement from '../../lib/encrypt_key_management.js';
 import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
 import validateCrit from '../../lib/validate_crit.js';
-const generateIv = ivFactory(random);
-const checkExtensions = validateCrit.bind(undefined, JWEInvalid, new Map());
 class FlattenedEncrypt {
     constructor(plaintext) {
         if (!(plaintext instanceof Uint8Array)) {
@@ -75,7 +72,7 @@ class FlattenedEncrypt {
             ...this._unprotectedHeader,
             ...this._sharedUnprotectedHeader,
         };
-        checkExtensions(options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
+        validateCrit(JWEInvalid, new Map(), options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
         if (joseHeader.zip !== undefined) {
             if (!this._protectedHeader || !this._protectedHeader.zip) {
                 throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');

package/dist/browser/jws/flattened/sign.js

@@ -5,7 +5,6 @@ import { JWSInvalid } from '../../util/errors.js';
 import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
 import checkKeyType from '../../lib/check_key_type.js';
 import validateCrit from '../../lib/validate_crit.js';
-const checkExtensions = validateCrit.bind(undefined, JWSInvalid, new Map([['b64', true]]));
 class FlattenedSign {
     constructor(payload) {
         if (!(payload instanceof Uint8Array)) {
@@ -38,7 +37,7 @@ class FlattenedSign {
             ...this._protectedHeader,
             ...this._unprotectedHeader,
         };
-        const extensions = checkExtensions(options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
+        const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
         let b64 = true;
         if (extensions.has('b64')) {
             b64 = this._protectedHeader.b64;

package/dist/browser/jws/flattened/verify.js

@@ -7,8 +7,6 @@ import isObject from '../../lib/is_object.js';
 import checkKeyType from '../../lib/check_key_type.js';
 import validateCrit from '../../lib/validate_crit.js';
 import validateAlgorithms from '../../lib/validate_algorithms.js';
-const checkExtensions = validateCrit.bind(undefined, JWSInvalid, new Map([['b64', true]]));
-const checkAlgOption = validateAlgorithms.bind(undefined, 'algorithms');
 async function flattenedVerify(jws, key, options) {
     var _a;
     if (!isObject(jws)) {
@@ -46,7 +44,7 @@ async function flattenedVerify(jws, key, options) {
         ...parsedProt,
         ...jws.header,
     };
-    const extensions = checkExtensions(options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
+    const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
     let b64 = true;
     if (extensions.has('b64')) {
         b64 = parsedProt.b64;
@@ -58,7 +56,7 @@ async function flattenedVerify(jws, key, options) {
     if (typeof alg !== 'string' || !alg) {
         throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
     }
-    const algorithms = options && checkAlgOption(options.algorithms);
+    const algorithms = options && validateAlgorithms('algorithms', options.algorithms);
     if (algorithms && !algorithms.has(alg)) {
         throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter not allowed');
     }

package/dist/browser/lib/cek.js

@@ -1,4 +1,5 @@
 import { JOSENotSupported } from '../util/errors.js';
+import random from '../runtime/random.js';
 const bitLengths = new Map([
     ['A128CBC-HS256', 256],
     ['A128GCM', 128],
@@ -7,12 +8,12 @@ const bitLengths = new Map([
     ['A256CBC-HS512', 512],
     ['A256GCM', 256],
 ]);
-const factory = (random) => (alg) => {
+const generateCek = (alg) => {
     const bitLength = bitLengths.get(alg);
     if (!bitLength) {
         throw new JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }
     return random(new Uint8Array(bitLength >> 3));
 };
-export default factory;
+export default generateCek;
 export { bitLengths };

package/dist/browser/lib/decrypt_key_management.js

@@ -9,7 +9,7 @@ import { bitLengths as cekLengths } from '../lib/cek.js';
 import { importJWK } from '../key/import.js';
 import checkKeyType from './check_key_type.js';
 import isObject from './is_object.js';
-async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
+async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options) {
     checkKeyType(alg, key, 'decrypt');
     switch (alg) {
         case 'dir': {
@@ -63,6 +63,9 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
                 throw new JWEInvalid('JWE Encrypted Key missing');
             if (typeof joseHeader.p2c !== 'number')
                 throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);
+            const p2cLimit = (options === null || options === void 0 ? void 0 : options.maxPBES2Count) || 10000;
+            if (joseHeader.p2c > p2cLimit)
+                throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);
             if (typeof joseHeader.p2s !== 'string')
                 throw new JWEInvalid(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);
             return pbes2Kw(alg, key, encryptedKey, joseHeader.p2c, base64url(joseHeader.p2s));

package/dist/browser/lib/encrypt_key_management.js

@@ -1,15 +1,13 @@
-import random from '../runtime/random.js';
 import { wrap as aesKw } from '../runtime/aeskw.js';
 import * as ECDH from '../runtime/ecdhes.js';
 import { encrypt as pbes2Kw } from '../runtime/pbes2kw.js';
 import { encrypt as rsaEs } from '../runtime/rsaes.js';
 import { wrap as aesGcmKw } from '../runtime/aesgcmkw.js';
 import { encode as base64url } from '../runtime/base64url.js';
-import cekFactory, { bitLengths as cekLengths } from '../lib/cek.js';
+import generateCek, { bitLengths as cekLengths } from '../lib/cek.js';
 import { JOSENotSupported } from '../util/errors.js';
 import { exportJWK } from '../key/export.js';
 import checkKeyType from './check_key_type.js';
-const generateCek = cekFactory(random);
 async function encryptKeyManagement(alg, enc, key, providedCek, providedParameters = {}) {
     let encryptedKey;
     let parameters;

package/dist/browser/lib/iv.js

@@ -1,4 +1,5 @@
 import { JOSENotSupported } from '../util/errors.js';
+import random from '../runtime/random.js';
 const bitLengths = new Map([
     ['A128CBC-HS256', 128],
     ['A128GCM', 96],
@@ -10,12 +11,12 @@ const bitLengths = new Map([
     ['A256GCM', 96],
     ['A256GCMKW', 96],
 ]);
-const factory = (random) => (alg) => {
+const generateIv = (alg) => {
     const bitLength = bitLengths.get(alg);
     if (!bitLength) {
         throw new JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }
     return random(new Uint8Array(bitLength >> 3));
 };
-export default factory;
+export default generateIv;
 export { bitLengths };

package/dist/browser/runtime/aesgcmkw.js

@@ -1,9 +1,7 @@
 import encrypt from './encrypt.js';
 import decrypt from './decrypt.js';
-import ivFactory from '../lib/iv.js';
-import random from './random.js';
+import generateIv from '../lib/iv.js';
 import { encode as base64url } from './base64url.js';
-const generateIv = ivFactory(random);
 export const wrap = async (alg, key, cek, iv) => {
     const jweAlgorithm = alg.substr(0, 7);
     iv || (iv = generateIv(jweAlgorithm));

package/dist/browser/runtime/random.js

@@ -1,3 +1,2 @@
 import crypto from './webcrypto.js';
-const random = crypto.getRandomValues.bind(crypto);
-export default random;
+export default crypto.getRandomValues.bind(crypto);

package/dist/browser/util/errors.js

@@ -2,114 +2,146 @@ export class JOSEError extends Error {
     constructor(message) {
         var _a;
         super(message);
-        this.code = JOSEError.code;
+        this.code = 'ERR_JOSE_GENERIC';
         this.name = this.constructor.name;
         (_a = Error.captureStackTrace) === null || _a === void 0 ? void 0 : _a.call(Error, this, this.constructor);
     }
+    static get code() {
+        return 'ERR_JOSE_GENERIC';
+    }
 }
-JOSEError.code = 'ERR_JOSE_GENERIC';
 export class JWTClaimValidationFailed extends JOSEError {
     constructor(message, claim = 'unspecified', reason = 'unspecified') {
         super(message);
-        this.code = JWTClaimValidationFailed.code;
+        this.code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
+        this.claim = claim;
+        this.reason = reason;
+    }
+    static get code() {
+        return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
+    }
+}
+export class JWTExpired extends JOSEError {
+    constructor(message, claim = 'unspecified', reason = 'unspecified') {
+        super(message);
+        this.code = 'ERR_JWT_EXPIRED';
         this.claim = claim;
         this.reason = reason;
     }
+    static get code() {
+        return 'ERR_JWT_EXPIRED';
+    }
 }
-JWTClaimValidationFailed.code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
 export class JOSEAlgNotAllowed extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JOSEAlgNotAllowed.code;
+        this.code = 'ERR_JOSE_ALG_NOT_ALLOWED';
+    }
+    static get code() {
+        return 'ERR_JOSE_ALG_NOT_ALLOWED';
     }
 }
-JOSEAlgNotAllowed.code = 'ERR_JOSE_ALG_NOT_ALLOWED';
 export class JOSENotSupported extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JOSENotSupported.code;
+        this.code = 'ERR_JOSE_NOT_SUPPORTED';
+    }
+    static get code() {
+        return 'ERR_JOSE_NOT_SUPPORTED';
     }
 }
-JOSENotSupported.code = 'ERR_JOSE_NOT_SUPPORTED';
 export class JWEDecryptionFailed extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWEDecryptionFailed.code;
+        this.code = 'ERR_JWE_DECRYPTION_FAILED';
         this.message = 'decryption operation failed';
     }
+    static get code() {
+        return 'ERR_JWE_DECRYPTION_FAILED';
+    }
 }
-JWEDecryptionFailed.code = 'ERR_JWE_DECRYPTION_FAILED';
 export class JWEInvalid extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWEInvalid.code;
+        this.code = 'ERR_JWE_INVALID';
+    }
+    static get code() {
+        return 'ERR_JWE_INVALID';
     }
 }
-JWEInvalid.code = 'ERR_JWE_INVALID';
 export class JWSInvalid extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWSInvalid.code;
+        this.code = 'ERR_JWS_INVALID';
+    }
+    static get code() {
+        return 'ERR_JWS_INVALID';
     }
 }
-JWSInvalid.code = 'ERR_JWS_INVALID';
 export class JWTInvalid extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWTInvalid.code;
+        this.code = 'ERR_JWT_INVALID';
+    }
+    static get code() {
+        return 'ERR_JWT_INVALID';
     }
 }
-JWTInvalid.code = 'ERR_JWT_INVALID';
 export class JWKInvalid extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWKInvalid.code;
+        this.code = 'ERR_JWK_INVALID';
+    }
+    static get code() {
+        return 'ERR_JWK_INVALID';
     }
 }
-JWKInvalid.code = 'ERR_JWK_INVALID';
 export class JWKSInvalid extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWKSInvalid.code;
+        this.code = 'ERR_JWKS_INVALID';
+    }
+    static get code() {
+        return 'ERR_JWKS_INVALID';
     }
 }
-JWKSInvalid.code = 'ERR_JWKS_INVALID';
 export class JWKSNoMatchingKey extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWKSNoMatchingKey.code;
+        this.code = 'ERR_JWKS_NO_MATCHING_KEY';
         this.message = 'no applicable key found in the JSON Web Key Set';
     }
+    static get code() {
+        return 'ERR_JWKS_NO_MATCHING_KEY';
+    }
 }
-JWKSNoMatchingKey.code = 'ERR_JWKS_NO_MATCHING_KEY';
 export class JWKSMultipleMatchingKeys extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWKSMultipleMatchingKeys.code;
+        this.code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
         this.message = 'multiple matching keys found in the JSON Web Key Set';
     }
+    static get code() {
+        return 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
+    }
 }
-JWKSMultipleMatchingKeys.code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
 export class JWKSTimeout extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWKSTimeout.code;
+        this.code = 'ERR_JWKS_TIMEOUT';
         this.message = 'request timed out';
     }
+    static get code() {
+        return 'ERR_JWKS_TIMEOUT';
+    }
 }
-JWKSTimeout.code = 'ERR_JWKS_TIMEOUT';
 export class JWSSignatureVerificationFailed extends JOSEError {
     constructor() {
         super(...arguments);
-        this.code = JWSSignatureVerificationFailed.code;
+        this.code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
         this.message = 'signature verification failed';
     }
-}
-JWSSignatureVerificationFailed.code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
-export class JWTExpired extends JWTClaimValidationFailed {
-    constructor() {
-        super(...arguments);
-        this.code = JWTExpired.code;
+    static get code() {
+        return 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
     }
 }
-JWTExpired.code = 'ERR_JWT_EXPIRED';

package/dist/node/cjs/jwe/compact/decrypt.js

@@ -15,7 +15,7 @@ async function compactDecrypt(jwe, key, options) {
     if (length !== 5) {
         throw new errors_js_1.JWEInvalid('Invalid Compact JWE');
     }
-    const decrypted = await (0, decrypt_js_1.default)({
+    const decrypted = await decrypt_js_1.default({
         ciphertext: (ciphertext || undefined),
         iv: (iv || undefined),
         protected: protectedHeader || undefined,

package/dist/node/cjs/jwe/flattened/decrypt.js

@@ -4,7 +4,6 @@ exports.flattenedDecrypt = void 0;
 const base64url_js_1 = require("../../runtime/base64url.js");
 const decrypt_js_1 = require("../../runtime/decrypt.js");
 const zlib_js_1 = require("../../runtime/zlib.js");
-const random_js_1 = require("../../runtime/random.js");
 const errors_js_1 = require("../../util/errors.js");
 const is_disjoint_js_1 = require("../../lib/is_disjoint.js");
 const is_object_js_1 = require("../../lib/is_object.js");
@@ -13,13 +12,9 @@ const buffer_utils_js_1 = require("../../lib/buffer_utils.js");
 const cek_js_1 = require("../../lib/cek.js");
 const validate_crit_js_1 = require("../../lib/validate_crit.js");
 const validate_algorithms_js_1 = require("../../lib/validate_algorithms.js");
-const generateCek = (0, cek_js_1.default)(random_js_1.default);
-const checkExtensions = validate_crit_js_1.default.bind(undefined, errors_js_1.JWEInvalid, new Map());
-const checkAlgOption = validate_algorithms_js_1.default.bind(undefined, 'keyManagementAlgorithms');
-const checkEncOption = validate_algorithms_js_1.default.bind(undefined, 'contentEncryptionAlgorithms');
 async function flattenedDecrypt(jwe, key, options) {
     var _a;
-    if (!(0, is_object_js_1.default)(jwe)) {
+    if (!is_object_js_1.default(jwe)) {
         throw new errors_js_1.JWEInvalid('Flattened JWE must be an object');
     }
     if (jwe.protected === undefined && jwe.header === undefined && jwe.unprotected === undefined) {
@@ -43,15 +38,15 @@ async function flattenedDecrypt(jwe, key, options) {
     if (jwe.aad !== undefined && typeof jwe.aad !== 'string') {
         throw new errors_js_1.JWEInvalid('JWE AAD incorrect type');
     }
-    if (jwe.header !== undefined && !(0, is_object_js_1.default)(jwe.header)) {
+    if (jwe.header !== undefined && !is_object_js_1.default(jwe.header)) {
         throw new errors_js_1.JWEInvalid('JWE Shared Unprotected Header incorrect type');
     }
-    if (jwe.unprotected !== undefined && !(0, is_object_js_1.default)(jwe.unprotected)) {
+    if (jwe.unprotected !== undefined && !is_object_js_1.default(jwe.unprotected)) {
         throw new errors_js_1.JWEInvalid('JWE Per-Recipient Unprotected Header incorrect type');
     }
     let parsedProt;
     if (jwe.protected) {
-        const protectedHeader = (0, base64url_js_1.decode)(jwe.protected);
+        const protectedHeader = base64url_js_1.decode(jwe.protected);
         try {
             parsedProt = JSON.parse(buffer_utils_js_1.decoder.decode(protectedHeader));
         }
@@ -59,7 +54,7 @@ async function flattenedDecrypt(jwe, key, options) {
             throw new errors_js_1.JWEInvalid('JWE Protected Header is invalid');
         }
     }
-    if (!(0, is_disjoint_js_1.default)(parsedProt, jwe.header, jwe.unprotected)) {
+    if (!is_disjoint_js_1.default(parsedProt, jwe.header, jwe.unprotected)) {
         throw new errors_js_1.JWEInvalid('JWE Protected, JWE Unprotected Header, and JWE Per-Recipient Unprotected Header Parameter names must be disjoint');
     }
     const joseHeader = {
@@ -67,7 +62,7 @@ async function flattenedDecrypt(jwe, key, options) {
         ...jwe.header,
         ...jwe.unprotected,
     };
-    checkExtensions(options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
+    validate_crit_js_1.default(errors_js_1.JWEInvalid, new Map(), options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
     if (joseHeader.zip !== undefined) {
         if (!parsedProt || !parsedProt.zip) {
             throw new errors_js_1.JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
@@ -83,8 +78,9 @@ async function flattenedDecrypt(jwe, key, options) {
     if (typeof enc !== 'string' || !enc) {
         throw new errors_js_1.JWEInvalid('missing JWE Encryption Algorithm (enc) in JWE Header');
     }
-    const keyManagementAlgorithms = options && checkAlgOption(options.keyManagementAlgorithms);
-    const contentEncryptionAlgorithms = options && checkEncOption(options.contentEncryptionAlgorithms);
+    const keyManagementAlgorithms = options && validate_algorithms_js_1.default('keyManagementAlgorithms', options.keyManagementAlgorithms);
+    const contentEncryptionAlgorithms = options &&
+        validate_algorithms_js_1.default('contentEncryptionAlgorithms', options.contentEncryptionAlgorithms);
     if (keyManagementAlgorithms && !keyManagementAlgorithms.has(alg)) {
         throw new errors_js_1.JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter not allowed');
     }
@@ -93,7 +89,7 @@ async function flattenedDecrypt(jwe, key, options) {
     }
     let encryptedKey;
     if (jwe.encrypted_key !== undefined) {
-        encryptedKey = (0, base64url_js_1.decode)(jwe.encrypted_key);
+        encryptedKey = base64url_js_1.decode(jwe.encrypted_key);
     }
     let resolvedKey = false;
     if (typeof key === 'function') {
@@ -102,25 +98,25 @@ async function flattenedDecrypt(jwe, key, options) {
     }
     let cek;
     try {
-        cek = await (0, decrypt_key_management_js_1.default)(alg, key, encryptedKey, joseHeader);
+        cek = await decrypt_key_management_js_1.default(alg, key, encryptedKey, joseHeader, options);
     }
     catch (err) {
-        if (err instanceof TypeError) {
+        if (err instanceof TypeError || err instanceof errors_js_1.JWEInvalid || err instanceof errors_js_1.JOSENotSupported) {
             throw err;
         }
-        cek = generateCek(enc);
+        cek = cek_js_1.default(enc);
     }
-    const iv = (0, base64url_js_1.decode)(jwe.iv);
-    const tag = (0, base64url_js_1.decode)(jwe.tag);
+    const iv = base64url_js_1.decode(jwe.iv);
+    const tag = base64url_js_1.decode(jwe.tag);
     const protectedHeader = buffer_utils_js_1.encoder.encode((_a = jwe.protected) !== null && _a !== void 0 ? _a : '');
     let additionalData;
     if (jwe.aad !== undefined) {
-        additionalData = (0, buffer_utils_js_1.concat)(protectedHeader, buffer_utils_js_1.encoder.encode('.'), buffer_utils_js_1.encoder.encode(jwe.aad));
+        additionalData = buffer_utils_js_1.concat(protectedHeader, buffer_utils_js_1.encoder.encode('.'), buffer_utils_js_1.encoder.encode(jwe.aad));
     }
     else {
         additionalData = protectedHeader;
     }
-    let plaintext = await (0, decrypt_js_1.default)(enc, cek, (0, base64url_js_1.decode)(jwe.ciphertext), iv, tag, additionalData);
+    let plaintext = await decrypt_js_1.default(enc, cek, base64url_js_1.decode(jwe.ciphertext), iv, tag, additionalData);
     if (joseHeader.zip === 'DEF') {
         plaintext = await ((options === null || options === void 0 ? void 0 : options.inflateRaw) || zlib_js_1.inflate)(plaintext);
     }
@@ -129,7 +125,7 @@ async function flattenedDecrypt(jwe, key, options) {
         result.protectedHeader = parsedProt;
     }
     if (jwe.aad !== undefined) {
-        result.additionalAuthenticatedData = (0, base64url_js_1.decode)(jwe.aad);
+        result.additionalAuthenticatedData = base64url_js_1.decode(jwe.aad);
     }
     if (jwe.unprotected !== undefined) {
         result.sharedUnprotectedHeader = jwe.unprotected;

package/dist/node/cjs/jwe/flattened/encrypt.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FlattenedEncrypt = void 0;
 const base64url_js_1 = require("../../runtime/base64url.js");
-const random_js_1 = require("../../runtime/random.js");
 const encrypt_js_1 = require("../../runtime/encrypt.js");
 const zlib_js_1 = require("../../runtime/zlib.js");
 const iv_js_1 = require("../../lib/iv.js");
@@ -11,8 +10,6 @@ const errors_js_1 = require("../../util/errors.js");
 const is_disjoint_js_1 = require("../../lib/is_disjoint.js");
 const buffer_utils_js_1 = require("../../lib/buffer_utils.js");
 const validate_crit_js_1 = require("../../lib/validate_crit.js");
-const generateIv = (0, iv_js_1.default)(random_js_1.default);
-const checkExtensions = validate_crit_js_1.default.bind(undefined, errors_js_1.JWEInvalid, new Map());
 class FlattenedEncrypt {
     constructor(plaintext) {
         if (!(plaintext instanceof Uint8Array)) {
@@ -70,7 +67,7 @@ class FlattenedEncrypt {
         if (!this._protectedHeader && !this._unprotectedHeader && !this._sharedUnprotectedHeader) {
             throw new errors_js_1.JWEInvalid('either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()');
         }
-        if (!(0, is_disjoint_js_1.default)(this._protectedHeader, this._unprotectedHeader, this._sharedUnprotectedHeader)) {
+        if (!is_disjoint_js_1.default(this._protectedHeader, this._unprotectedHeader, this._sharedUnprotectedHeader)) {
             throw new errors_js_1.JWEInvalid('JWE Shared Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint');
         }
         const joseHeader = {
@@ -78,7 +75,7 @@ class FlattenedEncrypt {
             ...this._unprotectedHeader,
             ...this._sharedUnprotectedHeader,
         };
-        checkExtensions(options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
+        validate_crit_js_1.default(errors_js_1.JWEInvalid, new Map(), options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
         if (joseHeader.zip !== undefined) {
             if (!this._protectedHeader || !this._protectedHeader.zip) {
                 throw new errors_js_1.JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
@@ -108,7 +105,7 @@ class FlattenedEncrypt {
         let cek;
         {
             let parameters;
-            ({ cek, encryptedKey, parameters } = await (0, encrypt_key_management_js_1.default)(alg, enc, key, this._cek, this._keyManagementParameters));
+            ({ cek, encryptedKey, parameters } = await encrypt_key_management_js_1.default(alg, enc, key, this._cek, this._keyManagementParameters));
             if (parameters) {
                 if (!this._protectedHeader) {
                     this.setProtectedHeader(parameters);
@@ -118,19 +115,19 @@ class FlattenedEncrypt {
                 }
             }
         }
-        this._iv || (this._iv = generateIv(enc));
+        this._iv || (this._iv = iv_js_1.default(enc));
         let additionalData;
         let protectedHeader;
         let aadMember;
         if (this._protectedHeader) {
-            protectedHeader = buffer_utils_js_1.encoder.encode((0, base64url_js_1.encode)(JSON.stringify(this._protectedHeader)));
+            protectedHeader = buffer_utils_js_1.encoder.encode(base64url_js_1.encode(JSON.stringify(this._protectedHeader)));
         }
         else {
             protectedHeader = buffer_utils_js_1.encoder.encode('');
         }
         if (this._aad) {
-            aadMember = (0, base64url_js_1.encode)(this._aad);
-            additionalData = (0, buffer_utils_js_1.concat)(protectedHeader, buffer_utils_js_1.encoder.encode('.'), buffer_utils_js_1.encoder.encode(aadMember));
+            aadMember = base64url_js_1.encode(this._aad);
+            additionalData = buffer_utils_js_1.concat(protectedHeader, buffer_utils_js_1.encoder.encode('.'), buffer_utils_js_1.encoder.encode(aadMember));
         }
         else {
             additionalData = protectedHeader;
@@ -139,19 +136,19 @@ class FlattenedEncrypt {
         let tag;
         if (joseHeader.zip === 'DEF') {
             const deflated = await ((options === null || options === void 0 ? void 0 : options.deflateRaw) || zlib_js_1.deflate)(this._plaintext);
-            ({ ciphertext, tag } = await (0, encrypt_js_1.default)(enc, deflated, cek, this._iv, additionalData));
+            ({ ciphertext, tag } = await encrypt_js_1.default(enc, deflated, cek, this._iv, additionalData));
         }
         else {
             ;
-            ({ ciphertext, tag } = await (0, encrypt_js_1.default)(enc, this._plaintext, cek, this._iv, additionalData));
+            ({ ciphertext, tag } = await encrypt_js_1.default(enc, this._plaintext, cek, this._iv, additionalData));
         }
         const jwe = {
-            ciphertext: (0, base64url_js_1.encode)(ciphertext),
-            iv: (0, base64url_js_1.encode)(this._iv),
-            tag: (0, base64url_js_1.encode)(tag),
+            ciphertext: base64url_js_1.encode(ciphertext),
+            iv: base64url_js_1.encode(this._iv),
+            tag: base64url_js_1.encode(tag),
         };
         if (encryptedKey) {
-            jwe.encrypted_key = (0, base64url_js_1.encode)(encryptedKey);
+            jwe.encrypted_key = base64url_js_1.encode(encryptedKey);
         }
         if (aadMember) {
             jwe.aad = aadMember;

package/dist/node/cjs/jwe/general/decrypt.js

@@ -5,7 +5,7 @@ const decrypt_js_1 = require("../flattened/decrypt.js");
 const errors_js_1 = require("../../util/errors.js");
 const is_object_js_1 = require("../../lib/is_object.js");
 async function generalDecrypt(jwe, key, options) {
-    if (!(0, is_object_js_1.default)(jwe)) {
+    if (!is_object_js_1.default(jwe)) {
         throw new errors_js_1.JWEInvalid('General JWE must be an object');
     }
     if (!Array.isArray(jwe.recipients) || !jwe.recipients.every(is_object_js_1.default)) {
@@ -13,7 +13,7 @@ async function generalDecrypt(jwe, key, options) {
     }
     for (const recipient of jwe.recipients) {
         try {
-            return await (0, decrypt_js_1.default)({
+            return await decrypt_js_1.default({
                 aad: jwe.aad,
                 ciphertext: jwe.ciphertext,
                 encrypted_key: recipient.encrypted_key,