jose 3.20.1 → 3.20.4

package/dist/node/cjs/jwk/embedded.js

@@ -9,10 +9,10 @@ async function EmbeddedJWK(protectedHeader, token) {
         ...protectedHeader,
         ...token.header,
     };
-    if (!(0, is_object_js_1.default)(joseHeader.jwk)) {
+    if (!is_object_js_1.default(joseHeader.jwk)) {
         throw new errors_js_1.JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');
     }
-    const key = await (0, import_js_1.importJWK)({ ...joseHeader.jwk, ext: true }, joseHeader.alg, true);
+    const key = await import_js_1.importJWK({ ...joseHeader.jwk, ext: true }, joseHeader.alg, true);
     if (key instanceof Uint8Array || key.type !== 'public') {
         throw new errors_js_1.JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
     }

package/dist/node/cjs/jwk/from_key_like.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.fromKeyLike = void 0;
 const export_js_1 = require("../key/export.js");
 async function fromKeyLike(key) {
-    return (0, export_js_1.exportJWK)(key);
+    return export_js_1.exportJWK(key);
 }
 exports.fromKeyLike = fromKeyLike;
 exports.default = fromKeyLike;

package/dist/node/cjs/jwk/parse.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseJwk = void 0;
 const import_js_1 = require("../key/import.js");
 async function parseJwk(jwk, alg, octAsKeyObject) {
-    return (0, import_js_1.importJWK)(jwk, alg, octAsKeyObject);
+    return import_js_1.importJWK(jwk, alg, octAsKeyObject);
 }
 exports.parseJwk = parseJwk;
 exports.default = parseJwk;

package/dist/node/cjs/jwk/thumbprint.js

@@ -12,7 +12,7 @@ const check = (value, description) => {
     }
 };
 async function calculateThumbprint(jwk, digestAlgorithm = 'sha256') {
-    if (!(0, is_object_js_1.default)(jwk)) {
+    if (!is_object_js_1.default(jwk)) {
         throw new TypeError('JWK must be an object');
     }
     let components;
@@ -41,7 +41,7 @@ async function calculateThumbprint(jwk, digestAlgorithm = 'sha256') {
             throw new errors_js_1.JOSENotSupported('"kty" (Key Type) Parameter missing or unsupported');
     }
     const data = buffer_utils_js_1.encoder.encode(JSON.stringify(components));
-    return (0, base64url_js_1.encode)(await (0, digest_js_1.default)(digestAlgorithm, data));
+    return base64url_js_1.encode(await digest_js_1.default(digestAlgorithm, data));
 }
 exports.calculateThumbprint = calculateThumbprint;
 exports.default = calculateThumbprint;

package/dist/node/cjs/jwks/remote.js

@@ -19,7 +19,7 @@ function getKtyFromAlg(alg) {
     }
 }
 function isJWKLike(key) {
-    return (0, is_object_js_1.default)(key);
+    return is_object_js_1.default(key);
 }
 class RemoteJWKSet {
     constructor(url, options) {
@@ -93,7 +93,7 @@ class RemoteJWKSet {
         }
         const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
         if (cached[protectedHeader.alg] === undefined) {
-            const keyObject = await (0, import_js_1.importJWK)({ ...jwk, ext: true }, protectedHeader.alg);
+            const keyObject = await import_js_1.importJWK({ ...jwk, ext: true }, protectedHeader.alg);
             if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
                 throw new errors_js_1.JWKSInvalid('JSON Web Key Set members must be public keys');
             }
@@ -103,7 +103,7 @@ class RemoteJWKSet {
     }
     async reload() {
         if (!this._pendingFetch) {
-            this._pendingFetch = (0, fetch_jwks_js_1.default)(this._url, this._timeoutDuration, this._options)
+            this._pendingFetch = fetch_jwks_js_1.default(this._url, this._timeoutDuration, this._options)
                 .then((json) => {
                 if (typeof json !== 'object' ||
                     !json ||

package/dist/node/cjs/jws/compact/verify.js

@@ -15,7 +15,7 @@ async function compactVerify(jws, key, options) {
     if (length !== 3) {
         throw new errors_js_1.JWSInvalid('Invalid Compact JWS');
     }
-    const verified = await (0, verify_js_1.default)({
+    const verified = await verify_js_1.default({
         payload: (payload || undefined),
         protected: protectedHeader || undefined,
         signature: (signature || undefined),

package/dist/node/cjs/jws/flattened/sign.js

@@ -8,7 +8,6 @@ const errors_js_1 = require("../../util/errors.js");
 const buffer_utils_js_1 = require("../../lib/buffer_utils.js");
 const check_key_type_js_1 = require("../../lib/check_key_type.js");
 const validate_crit_js_1 = require("../../lib/validate_crit.js");
-const checkExtensions = validate_crit_js_1.default.bind(undefined, errors_js_1.JWSInvalid, new Map([['b64', true]]));
 class FlattenedSign {
     constructor(payload) {
         if (!(payload instanceof Uint8Array)) {
@@ -34,14 +33,14 @@ class FlattenedSign {
         if (!this._protectedHeader && !this._unprotectedHeader) {
             throw new errors_js_1.JWSInvalid('either setProtectedHeader or setUnprotectedHeader must be called before #sign()');
         }
-        if (!(0, is_disjoint_js_1.default)(this._protectedHeader, this._unprotectedHeader)) {
+        if (!is_disjoint_js_1.default(this._protectedHeader, this._unprotectedHeader)) {
             throw new errors_js_1.JWSInvalid('JWS Protected and JWS Unprotected Header Parameter names must be disjoint');
         }
         const joseHeader = {
             ...this._protectedHeader,
             ...this._unprotectedHeader,
         };
-        const extensions = checkExtensions(options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
+        const extensions = validate_crit_js_1.default(errors_js_1.JWSInvalid, new Map([['b64', true]]), options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
         let b64 = true;
         if (extensions.has('b64')) {
             b64 = this._protectedHeader.b64;
@@ -53,22 +52,22 @@ class FlattenedSign {
         if (typeof alg !== 'string' || !alg) {
             throw new errors_js_1.JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
         }
-        (0, check_key_type_js_1.default)(alg, key, 'sign');
+        check_key_type_js_1.default(alg, key, 'sign');
         let payload = this._payload;
         if (b64) {
-            payload = buffer_utils_js_1.encoder.encode((0, base64url_js_1.encode)(payload));
+            payload = buffer_utils_js_1.encoder.encode(base64url_js_1.encode(payload));
         }
         let protectedHeader;
         if (this._protectedHeader) {
-            protectedHeader = buffer_utils_js_1.encoder.encode((0, base64url_js_1.encode)(JSON.stringify(this._protectedHeader)));
+            protectedHeader = buffer_utils_js_1.encoder.encode(base64url_js_1.encode(JSON.stringify(this._protectedHeader)));
         }
         else {
             protectedHeader = buffer_utils_js_1.encoder.encode('');
         }
-        const data = (0, buffer_utils_js_1.concat)(protectedHeader, buffer_utils_js_1.encoder.encode('.'), payload);
-        const signature = await (0, sign_js_1.default)(alg, key, data);
+        const data = buffer_utils_js_1.concat(protectedHeader, buffer_utils_js_1.encoder.encode('.'), payload);
+        const signature = await sign_js_1.default(alg, key, data);
         const jws = {
-            signature: (0, base64url_js_1.encode)(signature),
+            signature: base64url_js_1.encode(signature),
             payload: '',
         };
         if (b64) {

package/dist/node/cjs/jws/flattened/verify.js

@@ -10,11 +10,9 @@ const is_object_js_1 = require("../../lib/is_object.js");
 const check_key_type_js_1 = require("../../lib/check_key_type.js");
 const validate_crit_js_1 = require("../../lib/validate_crit.js");
 const validate_algorithms_js_1 = require("../../lib/validate_algorithms.js");
-const checkExtensions = validate_crit_js_1.default.bind(undefined, errors_js_1.JWSInvalid, new Map([['b64', true]]));
-const checkAlgOption = validate_algorithms_js_1.default.bind(undefined, 'algorithms');
 async function flattenedVerify(jws, key, options) {
     var _a;
-    if (!(0, is_object_js_1.default)(jws)) {
+    if (!is_object_js_1.default(jws)) {
         throw new errors_js_1.JWSInvalid('Flattened JWS must be an object');
     }
     if (jws.protected === undefined && jws.header === undefined) {
@@ -29,12 +27,12 @@ async function flattenedVerify(jws, key, options) {
     if (typeof jws.signature !== 'string') {
         throw new errors_js_1.JWSInvalid('JWS Signature missing or incorrect type');
     }
-    if (jws.header !== undefined && !(0, is_object_js_1.default)(jws.header)) {
+    if (jws.header !== undefined && !is_object_js_1.default(jws.header)) {
         throw new errors_js_1.JWSInvalid('JWS Unprotected Header incorrect type');
     }
     let parsedProt = {};
     if (jws.protected) {
-        const protectedHeader = (0, base64url_js_1.decode)(jws.protected);
+        const protectedHeader = base64url_js_1.decode(jws.protected);
         try {
             parsedProt = JSON.parse(buffer_utils_js_1.decoder.decode(protectedHeader));
         }
@@ -42,14 +40,14 @@ async function flattenedVerify(jws, key, options) {
             throw new errors_js_1.JWSInvalid('JWS Protected Header is invalid');
         }
     }
-    if (!(0, is_disjoint_js_1.default)(parsedProt, jws.header)) {
+    if (!is_disjoint_js_1.default(parsedProt, jws.header)) {
         throw new errors_js_1.JWSInvalid('JWS Protected and JWS Unprotected Header Parameter names must be disjoint');
     }
     const joseHeader = {
         ...parsedProt,
         ...jws.header,
     };
-    const extensions = checkExtensions(options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
+    const extensions = validate_crit_js_1.default(errors_js_1.JWSInvalid, new Map([['b64', true]]), options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
     let b64 = true;
     if (extensions.has('b64')) {
         b64 = parsedProt.b64;
@@ -61,7 +59,7 @@ async function flattenedVerify(jws, key, options) {
     if (typeof alg !== 'string' || !alg) {
         throw new errors_js_1.JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
     }
-    const algorithms = options && checkAlgOption(options.algorithms);
+    const algorithms = options && validate_algorithms_js_1.default('algorithms', options.algorithms);
     if (algorithms && !algorithms.has(alg)) {
         throw new errors_js_1.JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter not allowed');
     }
@@ -78,16 +76,16 @@ async function flattenedVerify(jws, key, options) {
         key = await key(parsedProt, jws);
         resolvedKey = true;
     }
-    (0, check_key_type_js_1.default)(alg, key, 'verify');
-    const data = (0, buffer_utils_js_1.concat)(buffer_utils_js_1.encoder.encode((_a = jws.protected) !== null && _a !== void 0 ? _a : ''), buffer_utils_js_1.encoder.encode('.'), typeof jws.payload === 'string' ? buffer_utils_js_1.encoder.encode(jws.payload) : jws.payload);
-    const signature = (0, base64url_js_1.decode)(jws.signature);
-    const verified = await (0, verify_js_1.default)(alg, key, signature, data);
+    check_key_type_js_1.default(alg, key, 'verify');
+    const data = buffer_utils_js_1.concat(buffer_utils_js_1.encoder.encode((_a = jws.protected) !== null && _a !== void 0 ? _a : ''), buffer_utils_js_1.encoder.encode('.'), typeof jws.payload === 'string' ? buffer_utils_js_1.encoder.encode(jws.payload) : jws.payload);
+    const signature = base64url_js_1.decode(jws.signature);
+    const verified = await verify_js_1.default(alg, key, signature, data);
     if (!verified) {
         throw new errors_js_1.JWSSignatureVerificationFailed();
     }
     let payload;
     if (b64) {
-        payload = (0, base64url_js_1.decode)(jws.payload);
+        payload = base64url_js_1.decode(jws.payload);
     }
     else if (typeof jws.payload === 'string') {
         payload = buffer_utils_js_1.encoder.encode(jws.payload);

package/dist/node/cjs/jws/general/verify.js

@@ -5,7 +5,7 @@ const verify_js_1 = require("../flattened/verify.js");
 const errors_js_1 = require("../../util/errors.js");
 const is_object_js_1 = require("../../lib/is_object.js");
 async function generalVerify(jws, key, options) {
-    if (!(0, is_object_js_1.default)(jws)) {
+    if (!is_object_js_1.default(jws)) {
         throw new errors_js_1.JWSInvalid('General JWS must be an object');
     }
     if (!Array.isArray(jws.signatures) || !jws.signatures.every(is_object_js_1.default)) {
@@ -13,7 +13,7 @@ async function generalVerify(jws, key, options) {
     }
     for (const signature of jws.signatures) {
         try {
-            return await (0, verify_js_1.default)({
+            return await verify_js_1.default({
                 header: signature.header,
                 payload: jws.payload,
                 protected: signature.protected,

package/dist/node/cjs/jwt/decrypt.js

@@ -5,8 +5,8 @@ const decrypt_js_1 = require("../jwe/compact/decrypt.js");
 const jwt_claims_set_js_1 = require("../lib/jwt_claims_set.js");
 const errors_js_1 = require("../util/errors.js");
 async function jwtDecrypt(jwt, key, options) {
-    const decrypted = await (0, decrypt_js_1.default)(jwt, key, options);
-    const payload = (0, jwt_claims_set_js_1.default)(decrypted.protectedHeader, decrypted.plaintext, options);
+    const decrypted = await decrypt_js_1.default(jwt, key, options);
+    const payload = jwt_claims_set_js_1.default(decrypted.protectedHeader, decrypted.plaintext, options);
     const { protectedHeader } = decrypted;
     if (protectedHeader.iss !== undefined && protectedHeader.iss !== payload.iss) {
         throw new errors_js_1.JWTClaimValidationFailed('replicated "iss" claim header parameter mismatch', 'iss', 'mismatch');

package/dist/node/cjs/jwt/produce.js

@@ -6,7 +6,7 @@ const is_object_js_1 = require("../lib/is_object.js");
 const secs_js_1 = require("../lib/secs.js");
 class ProduceJWT {
     constructor(payload) {
-        if (!(0, is_object_js_1.default)(payload)) {
+        if (!is_object_js_1.default(payload)) {
             throw new TypeError('JWT Claims Set MUST be an object');
         }
         this._payload = payload;
@@ -32,7 +32,7 @@ class ProduceJWT {
             this._payload = { ...this._payload, nbf: input };
         }
         else {
-            this._payload = { ...this._payload, nbf: (0, epoch_js_1.default)(new Date()) + (0, secs_js_1.default)(input) };
+            this._payload = { ...this._payload, nbf: epoch_js_1.default(new Date()) + secs_js_1.default(input) };
         }
         return this;
     }
@@ -41,13 +41,13 @@ class ProduceJWT {
             this._payload = { ...this._payload, exp: input };
         }
         else {
-            this._payload = { ...this._payload, exp: (0, epoch_js_1.default)(new Date()) + (0, secs_js_1.default)(input) };
+            this._payload = { ...this._payload, exp: epoch_js_1.default(new Date()) + secs_js_1.default(input) };
         }
         return this;
     }
     setIssuedAt(input) {
         if (typeof input === 'undefined') {
-            this._payload = { ...this._payload, iat: (0, epoch_js_1.default)(new Date()) };
+            this._payload = { ...this._payload, iat: epoch_js_1.default(new Date()) };
         }
         else {
             this._payload = { ...this._payload, iat: input };

package/dist/node/cjs/jwt/unsecured.js

@@ -29,7 +29,7 @@ class UnsecuredJWT extends produce_js_1.ProduceJWT {
         catch {
             throw new errors_js_1.JWTInvalid('Invalid Unsecured JWT');
         }
-        const payload = (0, jwt_claims_set_js_1.default)(header, base64url.decode(encodedPayload), options);
+        const payload = jwt_claims_set_js_1.default(header, base64url.decode(encodedPayload), options);
         return { payload, header };
     }
 }

package/dist/node/cjs/jwt/verify.js

@@ -6,11 +6,11 @@ const jwt_claims_set_js_1 = require("../lib/jwt_claims_set.js");
 const errors_js_1 = require("../util/errors.js");
 async function jwtVerify(jwt, key, options) {
     var _a;
-    const verified = await (0, verify_js_1.default)(jwt, key, options);
+    const verified = await verify_js_1.default(jwt, key, options);
     if (((_a = verified.protectedHeader.crit) === null || _a === void 0 ? void 0 : _a.includes('b64')) && verified.protectedHeader.b64 === false) {
         throw new errors_js_1.JWTInvalid('JWTs MUST NOT use unencoded payload');
     }
-    const payload = (0, jwt_claims_set_js_1.default)(verified.protectedHeader, verified.payload, options);
+    const payload = jwt_claims_set_js_1.default(verified.protectedHeader, verified.payload, options);
     const result = { payload, protectedHeader: verified.protectedHeader };
     if (typeof key === 'function') {
         return { ...result, key: verified.key };

package/dist/node/cjs/key/export.js

@@ -5,14 +5,14 @@ const asn1_js_1 = require("../runtime/asn1.js");
 const asn1_js_2 = require("../runtime/asn1.js");
 const key_to_jwk_js_1 = require("../runtime/key_to_jwk.js");
 async function exportSPKI(key) {
-    return (0, asn1_js_1.toSPKI)(key);
+    return asn1_js_1.toSPKI(key);
 }
 exports.exportSPKI = exportSPKI;
 async function exportPKCS8(key) {
-    return (0, asn1_js_2.toPKCS8)(key);
+    return asn1_js_2.toPKCS8(key);
 }
 exports.exportPKCS8 = exportPKCS8;
 async function exportJWK(key) {
-    return (0, key_to_jwk_js_1.default)(key);
+    return key_to_jwk_js_1.default(key);
 }
 exports.exportJWK = exportJWK;

package/dist/node/cjs/key/import.js

@@ -65,18 +65,18 @@ function parseElement(bytes) {
     };
 }
 function spkiFromX509(buf) {
-    return (0, base64url_js_1.encodeBase64)(getElement(getElement(parseElement(buf).contents)[0].contents)[6].raw);
+    return base64url_js_1.encodeBase64(getElement(getElement(parseElement(buf).contents)[0].contents)[6].raw);
 }
 function getSPKI(x509) {
     const pem = x509.replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g, '');
-    const raw = (0, base64url_js_1.decodeBase64)(pem);
-    return (0, format_pem_js_1.default)(spkiFromX509(raw), 'PUBLIC KEY');
+    const raw = base64url_js_1.decodeBase64(pem);
+    return format_pem_js_1.default(spkiFromX509(raw), 'PUBLIC KEY');
 }
 async function importSPKI(spki, alg, options) {
     if (typeof spki !== 'string' || spki.indexOf('-----BEGIN PUBLIC KEY-----') !== 0) {
         throw new TypeError('"spki" must be SPKI formatted string');
     }
-    return (0, asn1_js_1.fromSPKI)(spki, alg, options);
+    return asn1_js_1.fromSPKI(spki, alg, options);
 }
 exports.importSPKI = importSPKI;
 async function importX509(x509, alg, options) {
@@ -84,18 +84,18 @@ async function importX509(x509, alg, options) {
         throw new TypeError('"x509" must be X.509 formatted string');
     }
     const spki = getSPKI(x509);
-    return (0, asn1_js_1.fromSPKI)(spki, alg, options);
+    return asn1_js_1.fromSPKI(spki, alg, options);
 }
 exports.importX509 = importX509;
 async function importPKCS8(pkcs8, alg, options) {
     if (typeof pkcs8 !== 'string' || pkcs8.indexOf('-----BEGIN PRIVATE KEY-----') !== 0) {
         throw new TypeError('"pkcs8" must be PCKS8 formatted string');
     }
-    return (0, asn1_js_2.fromPKCS8)(pkcs8, alg, options);
+    return asn1_js_2.fromPKCS8(pkcs8, alg, options);
 }
 exports.importPKCS8 = importPKCS8;
 async function importJWK(jwk, alg, octAsKeyObject) {
-    if (!(0, is_object_js_1.default)(jwk)) {
+    if (!is_object_js_1.default(jwk)) {
         throw new TypeError('JWK must be an object');
     }
     alg || (alg = jwk.alg);
@@ -109,16 +109,16 @@ async function importJWK(jwk, alg, octAsKeyObject) {
             }
             octAsKeyObject !== null && octAsKeyObject !== void 0 ? octAsKeyObject : (octAsKeyObject = jwk.ext !== true);
             if (octAsKeyObject) {
-                return (0, jwk_to_key_js_1.default)({ ...jwk, alg, ext: false });
+                return jwk_to_key_js_1.default({ ...jwk, alg, ext: false });
             }
-            return (0, base64url_js_1.decode)(jwk.k);
+            return base64url_js_1.decode(jwk.k);
         case 'RSA':
             if (jwk.oth !== undefined) {
                 throw new errors_js_1.JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
             }
         case 'EC':
         case 'OKP':
-            return (0, jwk_to_key_js_1.default)({ ...jwk, alg });
+            return jwk_to_key_js_1.default({ ...jwk, alg });
         default:
             throw new errors_js_1.JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
     }

package/dist/node/cjs/lib/cek.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.bitLengths = void 0;
 const errors_js_1 = require("../util/errors.js");
+const random_js_1 = require("../runtime/random.js");
 const bitLengths = new Map([
     ['A128CBC-HS256', 256],
     ['A128GCM', 128],
@@ -11,11 +12,11 @@ const bitLengths = new Map([
     ['A256GCM', 256],
 ]);
 exports.bitLengths = bitLengths;
-const factory = (random) => (alg) => {
+const generateCek = (alg) => {
     const bitLength = bitLengths.get(alg);
     if (!bitLength) {
         throw new errors_js_1.JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }
-    return random(new Uint8Array(bitLength >> 3));
+    return random_js_1.default(new Uint8Array(bitLength >> 3));
 };
-exports.default = factory;
+exports.default = generateCek;

package/dist/node/cjs/lib/check_key_type.js

@@ -5,16 +5,16 @@ const is_key_like_js_1 = require("../runtime/is_key_like.js");
 const symmetricTypeCheck = (key) => {
     if (key instanceof Uint8Array)
         return;
-    if (!(0, is_key_like_js_1.default)(key)) {
-        throw new TypeError((0, invalid_key_input_js_1.default)(key, ...is_key_like_js_1.types, 'Uint8Array'));
+    if (!is_key_like_js_1.default(key)) {
+        throw new TypeError(invalid_key_input_js_1.default(key, ...is_key_like_js_1.types, 'Uint8Array'));
     }
     if (key.type !== 'secret') {
         throw new TypeError(`${is_key_like_js_1.types.join(' or ')} instances for symmetric algorithms must be of type "secret"`);
     }
 };
 const asymmetricTypeCheck = (key, usage) => {
-    if (!(0, is_key_like_js_1.default)(key)) {
-        throw new TypeError((0, invalid_key_input_js_1.default)(key, ...is_key_like_js_1.types));
+    if (!is_key_like_js_1.default(key)) {
+        throw new TypeError(invalid_key_input_js_1.default(key, ...is_key_like_js_1.types));
     }
     if (key.type === 'secret') {
         throw new TypeError(`${is_key_like_js_1.types.join(' or ')} instances for asymmetric algorithms must not be of type "secret"`);

package/dist/node/cjs/lib/decrypt_key_management.js

@@ -11,8 +11,8 @@ const cek_js_1 = require("../lib/cek.js");
 const import_js_1 = require("../key/import.js");
 const check_key_type_js_1 = require("./check_key_type.js");
 const is_object_js_1 = require("./is_object.js");
-async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
-    (0, check_key_type_js_1.default)(alg, key, 'decrypt');
+async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options) {
+    check_key_type_js_1.default(alg, key, 'decrypt');
     switch (alg) {
         case 'dir': {
             if (encryptedKey !== undefined)
@@ -25,29 +25,29 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
         case 'ECDH-ES+A128KW':
         case 'ECDH-ES+A192KW':
         case 'ECDH-ES+A256KW': {
-            if (!(0, is_object_js_1.default)(joseHeader.epk))
+            if (!is_object_js_1.default(joseHeader.epk))
                 throw new errors_js_1.JWEInvalid(`JOSE Header "epk" (Ephemeral Public Key) missing or invalid`);
             if (!ECDH.ecdhAllowed(key))
                 throw new errors_js_1.JOSENotSupported('ECDH-ES with the provided key is not allowed or not supported by your javascript runtime');
-            const epk = await (0, import_js_1.importJWK)(joseHeader.epk, alg);
+            const epk = await import_js_1.importJWK(joseHeader.epk, alg);
             let partyUInfo;
             let partyVInfo;
             if (joseHeader.apu !== undefined) {
                 if (typeof joseHeader.apu !== 'string')
                     throw new errors_js_1.JWEInvalid(`JOSE Header "apu" (Agreement PartyUInfo) invalid`);
-                partyUInfo = (0, base64url_js_1.decode)(joseHeader.apu);
+                partyUInfo = base64url_js_1.decode(joseHeader.apu);
             }
             if (joseHeader.apv !== undefined) {
                 if (typeof joseHeader.apv !== 'string')
                     throw new errors_js_1.JWEInvalid(`JOSE Header "apv" (Agreement PartyVInfo) invalid`);
-                partyVInfo = (0, base64url_js_1.decode)(joseHeader.apv);
+                partyVInfo = base64url_js_1.decode(joseHeader.apv);
             }
             const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, parseInt(alg.substr(-5, 3), 10) || cek_js_1.bitLengths.get(joseHeader.enc), partyUInfo, partyVInfo);
             if (alg === 'ECDH-ES')
                 return sharedSecret;
             if (encryptedKey === undefined)
                 throw new errors_js_1.JWEInvalid('JWE Encrypted Key missing');
-            return (0, aeskw_js_1.unwrap)(alg.substr(-6), sharedSecret, encryptedKey);
+            return aeskw_js_1.unwrap(alg.substr(-6), sharedSecret, encryptedKey);
         }
         case 'RSA1_5':
         case 'RSA-OAEP':
@@ -56,7 +56,7 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
         case 'RSA-OAEP-512': {
             if (encryptedKey === undefined)
                 throw new errors_js_1.JWEInvalid('JWE Encrypted Key missing');
-            return (0, rsaes_js_1.decrypt)(alg, key, encryptedKey);
+            return rsaes_js_1.decrypt(alg, key, encryptedKey);
         }
         case 'PBES2-HS256+A128KW':
         case 'PBES2-HS384+A192KW':
@@ -65,16 +65,19 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
                 throw new errors_js_1.JWEInvalid('JWE Encrypted Key missing');
             if (typeof joseHeader.p2c !== 'number')
                 throw new errors_js_1.JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);
+            const p2cLimit = (options === null || options === void 0 ? void 0 : options.maxPBES2Count) || 10000;
+            if (joseHeader.p2c > p2cLimit)
+                throw new errors_js_1.JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);
             if (typeof joseHeader.p2s !== 'string')
                 throw new errors_js_1.JWEInvalid(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);
-            return (0, pbes2kw_js_1.decrypt)(alg, key, encryptedKey, joseHeader.p2c, (0, base64url_js_1.decode)(joseHeader.p2s));
+            return pbes2kw_js_1.decrypt(alg, key, encryptedKey, joseHeader.p2c, base64url_js_1.decode(joseHeader.p2s));
         }
         case 'A128KW':
         case 'A192KW':
         case 'A256KW': {
             if (encryptedKey === undefined)
                 throw new errors_js_1.JWEInvalid('JWE Encrypted Key missing');
-            return (0, aeskw_js_1.unwrap)(alg, key, encryptedKey);
+            return aeskw_js_1.unwrap(alg, key, encryptedKey);
         }
         case 'A128GCMKW':
         case 'A192GCMKW':
@@ -85,9 +88,9 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
                 throw new errors_js_1.JWEInvalid(`JOSE Header "iv" (Initialization Vector) missing or invalid`);
             if (typeof joseHeader.tag !== 'string')
                 throw new errors_js_1.JWEInvalid(`JOSE Header "tag" (Authentication Tag) missing or invalid`);
-            const iv = (0, base64url_js_1.decode)(joseHeader.iv);
-            const tag = (0, base64url_js_1.decode)(joseHeader.tag);
-            return (0, aesgcmkw_js_1.unwrap)(alg, key, encryptedKey, iv, tag);
+            const iv = base64url_js_1.decode(joseHeader.iv);
+            const tag = base64url_js_1.decode(joseHeader.tag);
+            return aesgcmkw_js_1.unwrap(alg, key, encryptedKey, iv, tag);
         }
         default: {
             throw new errors_js_1.JOSENotSupported('Invalid or unsupported "alg" (JWE Algorithm) header value');

package/dist/node/cjs/lib/encrypt_key_management.js

@@ -1,6 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const random_js_1 = require("../runtime/random.js");
 const aeskw_js_1 = require("../runtime/aeskw.js");
 const ECDH = require("../runtime/ecdhes.js");
 const pbes2kw_js_1 = require("../runtime/pbes2kw.js");
@@ -11,12 +10,11 @@ const cek_js_1 = require("../lib/cek.js");
 const errors_js_1 = require("../util/errors.js");
 const export_js_1 = require("../key/export.js");
 const check_key_type_js_1 = require("./check_key_type.js");
-const generateCek = (0, cek_js_1.default)(random_js_1.default);
 async function encryptKeyManagement(alg, enc, key, providedCek, providedParameters = {}) {
     let encryptedKey;
     let parameters;
     let cek;
-    (0, check_key_type_js_1.default)(alg, key, 'encrypt');
+    check_key_type_js_1.default(alg, key, 'encrypt');
     switch (alg) {
         case 'dir': {
             cek = key;
@@ -32,20 +30,20 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
             const { apu, apv } = providedParameters;
             let { epk: ephemeralKey } = providedParameters;
             ephemeralKey || (ephemeralKey = await ECDH.generateEpk(key));
-            const { x, y, crv, kty } = await (0, export_js_1.exportJWK)(ephemeralKey);
+            const { x, y, crv, kty } = await export_js_1.exportJWK(ephemeralKey);
             const sharedSecret = await ECDH.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, parseInt(alg.substr(-5, 3), 10) || cek_js_1.bitLengths.get(enc), apu, apv);
             parameters = { epk: { x, y, crv, kty } };
             if (apu)
-                parameters.apu = (0, base64url_js_1.encode)(apu);
+                parameters.apu = base64url_js_1.encode(apu);
             if (apv)
-                parameters.apv = (0, base64url_js_1.encode)(apv);
+                parameters.apv = base64url_js_1.encode(apv);
             if (alg === 'ECDH-ES') {
                 cek = sharedSecret;
                 break;
             }
-            cek = providedCek || generateCek(enc);
+            cek = providedCek || cek_js_1.default(enc);
             const kwAlg = alg.substr(-6);
-            encryptedKey = await (0, aeskw_js_1.wrap)(kwAlg, sharedSecret, cek);
+            encryptedKey = await aeskw_js_1.wrap(kwAlg, sharedSecret, cek);
             break;
         }
         case 'RSA1_5':
@@ -53,31 +51,31 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
         case 'RSA-OAEP-256':
         case 'RSA-OAEP-384':
         case 'RSA-OAEP-512': {
-            cek = providedCek || generateCek(enc);
-            encryptedKey = await (0, rsaes_js_1.encrypt)(alg, key, cek);
+            cek = providedCek || cek_js_1.default(enc);
+            encryptedKey = await rsaes_js_1.encrypt(alg, key, cek);
             break;
         }
         case 'PBES2-HS256+A128KW':
         case 'PBES2-HS384+A192KW':
         case 'PBES2-HS512+A256KW': {
-            cek = providedCek || generateCek(enc);
+            cek = providedCek || cek_js_1.default(enc);
             const { p2c, p2s } = providedParameters;
-            ({ encryptedKey, ...parameters } = await (0, pbes2kw_js_1.encrypt)(alg, key, cek, p2c, p2s));
+            ({ encryptedKey, ...parameters } = await pbes2kw_js_1.encrypt(alg, key, cek, p2c, p2s));
             break;
         }
         case 'A128KW':
         case 'A192KW':
         case 'A256KW': {
-            cek = providedCek || generateCek(enc);
-            encryptedKey = await (0, aeskw_js_1.wrap)(alg, key, cek);
+            cek = providedCek || cek_js_1.default(enc);
+            encryptedKey = await aeskw_js_1.wrap(alg, key, cek);
             break;
         }
         case 'A128GCMKW':
         case 'A192GCMKW':
         case 'A256GCMKW': {
-            cek = providedCek || generateCek(enc);
+            cek = providedCek || cek_js_1.default(enc);
             const { iv } = providedParameters;
-            ({ encryptedKey, ...parameters } = await (0, aesgcmkw_js_1.wrap)(alg, key, cek, iv));
+            ({ encryptedKey, ...parameters } = await aesgcmkw_js_1.wrap(alg, key, cek, iv));
             break;
         }
         default: {

package/dist/node/cjs/lib/iv.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.bitLengths = void 0;
 const errors_js_1 = require("../util/errors.js");
+const random_js_1 = require("../runtime/random.js");
 const bitLengths = new Map([
     ['A128CBC-HS256', 128],
     ['A128GCM', 96],
@@ -14,11 +15,11 @@ const bitLengths = new Map([
     ['A256GCMKW', 96],
 ]);
 exports.bitLengths = bitLengths;
-const factory = (random) => (alg) => {
+const generateIv = (alg) => {
     const bitLength = bitLengths.get(alg);
     if (!bitLength) {
         throw new errors_js_1.JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }
-    return random(new Uint8Array(bitLength >> 3));
+    return random_js_1.default(new Uint8Array(bitLength >> 3));
 };
-exports.default = factory;
+exports.default = generateIv;