jose 3.20.2 → 3.20.3

package/dist/browser/jwe/flattened/decrypt.js

@@ -1,19 +1,14 @@
 import { decode as base64url } from '../../runtime/base64url.js';
 import decrypt from '../../runtime/decrypt.js';
 import { inflate } from '../../runtime/zlib.js';
-import random from '../../runtime/random.js';
 import { JOSEAlgNotAllowed, JOSENotSupported, JWEInvalid } from '../../util/errors.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import isObject from '../../lib/is_object.js';
 import decryptKeyManagement from '../../lib/decrypt_key_management.js';
 import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
-import cekFactory from '../../lib/cek.js';
+import generateCek from '../../lib/cek.js';
 import validateCrit from '../../lib/validate_crit.js';
 import validateAlgorithms from '../../lib/validate_algorithms.js';
-const generateCek = cekFactory(random);
-const checkExtensions = validateCrit.bind(undefined, JWEInvalid, new Map());
-const checkAlgOption = validateAlgorithms.bind(undefined, 'keyManagementAlgorithms');
-const checkEncOption = validateAlgorithms.bind(undefined, 'contentEncryptionAlgorithms');
 async function flattenedDecrypt(jwe, key, options) {
     var _a;
     if (!isObject(jwe)) {
@@ -64,7 +59,7 @@ async function flattenedDecrypt(jwe, key, options) {
         ...jwe.header,
         ...jwe.unprotected,
     };
-    checkExtensions(options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
+    validateCrit(JWEInvalid, new Map(), options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
     if (joseHeader.zip !== undefined) {
         if (!parsedProt || !parsedProt.zip) {
             throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
@@ -80,8 +75,9 @@ async function flattenedDecrypt(jwe, key, options) {
     if (typeof enc !== 'string' || !enc) {
         throw new JWEInvalid('missing JWE Encryption Algorithm (enc) in JWE Header');
     }
-    const keyManagementAlgorithms = options && checkAlgOption(options.keyManagementAlgorithms);
-    const contentEncryptionAlgorithms = options && checkEncOption(options.contentEncryptionAlgorithms);
+    const keyManagementAlgorithms = options && validateAlgorithms('keyManagementAlgorithms', options.keyManagementAlgorithms);
+    const contentEncryptionAlgorithms = options &&
+        validateAlgorithms('contentEncryptionAlgorithms', options.contentEncryptionAlgorithms);
     if (keyManagementAlgorithms && !keyManagementAlgorithms.has(alg)) {
         throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter not allowed');
     }

package/dist/browser/jwe/flattened/encrypt.js

@@ -1,15 +1,12 @@
 import { encode as base64url } from '../../runtime/base64url.js';
-import random from '../../runtime/random.js';
 import encrypt from '../../runtime/encrypt.js';
 import { deflate } from '../../runtime/zlib.js';
-import ivFactory from '../../lib/iv.js';
+import generateIv from '../../lib/iv.js';
 import encryptKeyManagement from '../../lib/encrypt_key_management.js';
 import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
 import validateCrit from '../../lib/validate_crit.js';
-const generateIv = ivFactory(random);
-const checkExtensions = validateCrit.bind(undefined, JWEInvalid, new Map());
 class FlattenedEncrypt {
     constructor(plaintext) {
         if (!(plaintext instanceof Uint8Array)) {
@@ -75,7 +72,7 @@ class FlattenedEncrypt {
             ...this._unprotectedHeader,
             ...this._sharedUnprotectedHeader,
         };
-        checkExtensions(options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
+        validateCrit(JWEInvalid, new Map(), options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
         if (joseHeader.zip !== undefined) {
             if (!this._protectedHeader || !this._protectedHeader.zip) {
                 throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');

package/dist/browser/jws/flattened/sign.js

@@ -5,7 +5,6 @@ import { JWSInvalid } from '../../util/errors.js';
 import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
 import checkKeyType from '../../lib/check_key_type.js';
 import validateCrit from '../../lib/validate_crit.js';
-const checkExtensions = validateCrit.bind(undefined, JWSInvalid, new Map([['b64', true]]));
 class FlattenedSign {
     constructor(payload) {
         if (!(payload instanceof Uint8Array)) {
@@ -38,7 +37,7 @@ class FlattenedSign {
             ...this._protectedHeader,
             ...this._unprotectedHeader,
         };
-        const extensions = checkExtensions(options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
+        const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
         let b64 = true;
         if (extensions.has('b64')) {
             b64 = this._protectedHeader.b64;

package/dist/browser/jws/flattened/verify.js

@@ -7,8 +7,6 @@ import isObject from '../../lib/is_object.js';
 import checkKeyType from '../../lib/check_key_type.js';
 import validateCrit from '../../lib/validate_crit.js';
 import validateAlgorithms from '../../lib/validate_algorithms.js';
-const checkExtensions = validateCrit.bind(undefined, JWSInvalid, new Map([['b64', true]]));
-const checkAlgOption = validateAlgorithms.bind(undefined, 'algorithms');
 async function flattenedVerify(jws, key, options) {
     var _a;
     if (!isObject(jws)) {
@@ -46,7 +44,7 @@ async function flattenedVerify(jws, key, options) {
         ...parsedProt,
         ...jws.header,
     };
-    const extensions = checkExtensions(options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
+    const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
     let b64 = true;
     if (extensions.has('b64')) {
         b64 = parsedProt.b64;
@@ -58,7 +56,7 @@ async function flattenedVerify(jws, key, options) {
     if (typeof alg !== 'string' || !alg) {
         throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
     }
-    const algorithms = options && checkAlgOption(options.algorithms);
+    const algorithms = options && validateAlgorithms('algorithms', options.algorithms);
     if (algorithms && !algorithms.has(alg)) {
         throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter not allowed');
     }

package/dist/browser/lib/cek.js

@@ -1,4 +1,5 @@
 import { JOSENotSupported } from '../util/errors.js';
+import random from '../runtime/random.js';
 const bitLengths = new Map([
     ['A128CBC-HS256', 256],
     ['A128GCM', 128],
@@ -7,12 +8,12 @@ const bitLengths = new Map([
     ['A256CBC-HS512', 512],
     ['A256GCM', 256],
 ]);
-const factory = (random) => (alg) => {
+const generateCek = (alg) => {
     const bitLength = bitLengths.get(alg);
     if (!bitLength) {
         throw new JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }
     return random(new Uint8Array(bitLength >> 3));
 };
-export default factory;
+export default generateCek;
 export { bitLengths };

package/dist/browser/lib/encrypt_key_management.js

@@ -1,15 +1,13 @@
-import random from '../runtime/random.js';
 import { wrap as aesKw } from '../runtime/aeskw.js';
 import * as ECDH from '../runtime/ecdhes.js';
 import { encrypt as pbes2Kw } from '../runtime/pbes2kw.js';
 import { encrypt as rsaEs } from '../runtime/rsaes.js';
 import { wrap as aesGcmKw } from '../runtime/aesgcmkw.js';
 import { encode as base64url } from '../runtime/base64url.js';
-import cekFactory, { bitLengths as cekLengths } from '../lib/cek.js';
+import generateCek, { bitLengths as cekLengths } from '../lib/cek.js';
 import { JOSENotSupported } from '../util/errors.js';
 import { exportJWK } from '../key/export.js';
 import checkKeyType from './check_key_type.js';
-const generateCek = cekFactory(random);
 async function encryptKeyManagement(alg, enc, key, providedCek, providedParameters = {}) {
     let encryptedKey;
     let parameters;

package/dist/browser/lib/iv.js

@@ -1,4 +1,5 @@
 import { JOSENotSupported } from '../util/errors.js';
+import random from '../runtime/random.js';
 const bitLengths = new Map([
     ['A128CBC-HS256', 128],
     ['A128GCM', 96],
@@ -10,12 +11,12 @@ const bitLengths = new Map([
     ['A256GCM', 96],
     ['A256GCMKW', 96],
 ]);
-const factory = (random) => (alg) => {
+const generateIv = (alg) => {
     const bitLength = bitLengths.get(alg);
     if (!bitLength) {
         throw new JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }
     return random(new Uint8Array(bitLength >> 3));
 };
-export default factory;
+export default generateIv;
 export { bitLengths };

package/dist/browser/runtime/aesgcmkw.js

@@ -1,9 +1,7 @@
 import encrypt from './encrypt.js';
 import decrypt from './decrypt.js';
-import ivFactory from '../lib/iv.js';
-import random from './random.js';
+import generateIv from '../lib/iv.js';
 import { encode as base64url } from './base64url.js';
-const generateIv = ivFactory(random);
 export const wrap = async (alg, key, cek, iv) => {
     const jweAlgorithm = alg.substr(0, 7);
     iv || (iv = generateIv(jweAlgorithm));

package/dist/browser/runtime/random.js

@@ -1,3 +1,2 @@
 import crypto from './webcrypto.js';
-const random = crypto.getRandomValues.bind(crypto);
-export default random;
+export default crypto.getRandomValues.bind(crypto);

package/dist/browser/util/errors.js

@@ -21,6 +21,17 @@ export class JWTClaimValidationFailed extends JOSEError {
         return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
     }
 }
+export class JWTExpired extends JOSEError {
+    constructor(message, claim = 'unspecified', reason = 'unspecified') {
+        super(message);
+        this.code = 'ERR_JWT_EXPIRED';
+        this.claim = claim;
+        this.reason = reason;
+    }
+    static get code() {
+        return 'ERR_JWT_EXPIRED';
+    }
+}
 export class JOSEAlgNotAllowed extends JOSEError {
     constructor() {
         super(...arguments);
@@ -134,12 +145,3 @@ export class JWSSignatureVerificationFailed extends JOSEError {
         return 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
     }
 }
-export class JWTExpired extends JWTClaimValidationFailed {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWT_EXPIRED';
-    }
-    static get code() {
-        return 'ERR_JWT_EXPIRED';
-    }
-}

package/dist/node/cjs/jwe/flattened/decrypt.js

@@ -4,7 +4,6 @@ exports.flattenedDecrypt = void 0;
 const base64url_js_1 = require("../../runtime/base64url.js");
 const decrypt_js_1 = require("../../runtime/decrypt.js");
 const zlib_js_1 = require("../../runtime/zlib.js");
-const random_js_1 = require("../../runtime/random.js");
 const errors_js_1 = require("../../util/errors.js");
 const is_disjoint_js_1 = require("../../lib/is_disjoint.js");
 const is_object_js_1 = require("../../lib/is_object.js");
@@ -13,10 +12,6 @@ const buffer_utils_js_1 = require("../../lib/buffer_utils.js");
 const cek_js_1 = require("../../lib/cek.js");
 const validate_crit_js_1 = require("../../lib/validate_crit.js");
 const validate_algorithms_js_1 = require("../../lib/validate_algorithms.js");
-const generateCek = (0, cek_js_1.default)(random_js_1.default);
-const checkExtensions = validate_crit_js_1.default.bind(undefined, errors_js_1.JWEInvalid, new Map());
-const checkAlgOption = validate_algorithms_js_1.default.bind(undefined, 'keyManagementAlgorithms');
-const checkEncOption = validate_algorithms_js_1.default.bind(undefined, 'contentEncryptionAlgorithms');
 async function flattenedDecrypt(jwe, key, options) {
     var _a;
     if (!(0, is_object_js_1.default)(jwe)) {
@@ -67,7 +62,7 @@ async function flattenedDecrypt(jwe, key, options) {
         ...jwe.header,
         ...jwe.unprotected,
     };
-    checkExtensions(options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
+    (0, validate_crit_js_1.default)(errors_js_1.JWEInvalid, new Map(), options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
     if (joseHeader.zip !== undefined) {
         if (!parsedProt || !parsedProt.zip) {
             throw new errors_js_1.JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
@@ -83,8 +78,9 @@ async function flattenedDecrypt(jwe, key, options) {
     if (typeof enc !== 'string' || !enc) {
         throw new errors_js_1.JWEInvalid('missing JWE Encryption Algorithm (enc) in JWE Header');
     }
-    const keyManagementAlgorithms = options && checkAlgOption(options.keyManagementAlgorithms);
-    const contentEncryptionAlgorithms = options && checkEncOption(options.contentEncryptionAlgorithms);
+    const keyManagementAlgorithms = options && (0, validate_algorithms_js_1.default)('keyManagementAlgorithms', options.keyManagementAlgorithms);
+    const contentEncryptionAlgorithms = options &&
+        (0, validate_algorithms_js_1.default)('contentEncryptionAlgorithms', options.contentEncryptionAlgorithms);
     if (keyManagementAlgorithms && !keyManagementAlgorithms.has(alg)) {
         throw new errors_js_1.JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter not allowed');
     }
@@ -108,7 +104,7 @@ async function flattenedDecrypt(jwe, key, options) {
         if (err instanceof TypeError) {
             throw err;
         }
-        cek = generateCek(enc);
+        cek = (0, cek_js_1.default)(enc);
     }
     const iv = (0, base64url_js_1.decode)(jwe.iv);
     const tag = (0, base64url_js_1.decode)(jwe.tag);

package/dist/node/cjs/jwe/flattened/encrypt.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FlattenedEncrypt = void 0;
 const base64url_js_1 = require("../../runtime/base64url.js");
-const random_js_1 = require("../../runtime/random.js");
 const encrypt_js_1 = require("../../runtime/encrypt.js");
 const zlib_js_1 = require("../../runtime/zlib.js");
 const iv_js_1 = require("../../lib/iv.js");
@@ -11,8 +10,6 @@ const errors_js_1 = require("../../util/errors.js");
 const is_disjoint_js_1 = require("../../lib/is_disjoint.js");
 const buffer_utils_js_1 = require("../../lib/buffer_utils.js");
 const validate_crit_js_1 = require("../../lib/validate_crit.js");
-const generateIv = (0, iv_js_1.default)(random_js_1.default);
-const checkExtensions = validate_crit_js_1.default.bind(undefined, errors_js_1.JWEInvalid, new Map());
 class FlattenedEncrypt {
     constructor(plaintext) {
         if (!(plaintext instanceof Uint8Array)) {
@@ -78,7 +75,7 @@ class FlattenedEncrypt {
             ...this._unprotectedHeader,
             ...this._sharedUnprotectedHeader,
         };
-        checkExtensions(options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
+        (0, validate_crit_js_1.default)(errors_js_1.JWEInvalid, new Map(), options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
         if (joseHeader.zip !== undefined) {
             if (!this._protectedHeader || !this._protectedHeader.zip) {
                 throw new errors_js_1.JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
@@ -118,7 +115,7 @@ class FlattenedEncrypt {
                 }
             }
         }
-        this._iv || (this._iv = generateIv(enc));
+        this._iv || (this._iv = (0, iv_js_1.default)(enc));
         let additionalData;
         let protectedHeader;
         let aadMember;

package/dist/node/cjs/jws/flattened/sign.js

@@ -8,7 +8,6 @@ const errors_js_1 = require("../../util/errors.js");
 const buffer_utils_js_1 = require("../../lib/buffer_utils.js");
 const check_key_type_js_1 = require("../../lib/check_key_type.js");
 const validate_crit_js_1 = require("../../lib/validate_crit.js");
-const checkExtensions = validate_crit_js_1.default.bind(undefined, errors_js_1.JWSInvalid, new Map([['b64', true]]));
 class FlattenedSign {
     constructor(payload) {
         if (!(payload instanceof Uint8Array)) {
@@ -41,7 +40,7 @@ class FlattenedSign {
             ...this._protectedHeader,
             ...this._unprotectedHeader,
         };
-        const extensions = checkExtensions(options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
+        const extensions = (0, validate_crit_js_1.default)(errors_js_1.JWSInvalid, new Map([['b64', true]]), options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
         let b64 = true;
         if (extensions.has('b64')) {
             b64 = this._protectedHeader.b64;

package/dist/node/cjs/jws/flattened/verify.js

@@ -10,8 +10,6 @@ const is_object_js_1 = require("../../lib/is_object.js");
 const check_key_type_js_1 = require("../../lib/check_key_type.js");
 const validate_crit_js_1 = require("../../lib/validate_crit.js");
 const validate_algorithms_js_1 = require("../../lib/validate_algorithms.js");
-const checkExtensions = validate_crit_js_1.default.bind(undefined, errors_js_1.JWSInvalid, new Map([['b64', true]]));
-const checkAlgOption = validate_algorithms_js_1.default.bind(undefined, 'algorithms');
 async function flattenedVerify(jws, key, options) {
     var _a;
     if (!(0, is_object_js_1.default)(jws)) {
@@ -49,7 +47,7 @@ async function flattenedVerify(jws, key, options) {
         ...parsedProt,
         ...jws.header,
     };
-    const extensions = checkExtensions(options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
+    const extensions = (0, validate_crit_js_1.default)(errors_js_1.JWSInvalid, new Map([['b64', true]]), options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
     let b64 = true;
     if (extensions.has('b64')) {
         b64 = parsedProt.b64;
@@ -61,7 +59,7 @@ async function flattenedVerify(jws, key, options) {
     if (typeof alg !== 'string' || !alg) {
         throw new errors_js_1.JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
     }
-    const algorithms = options && checkAlgOption(options.algorithms);
+    const algorithms = options && (0, validate_algorithms_js_1.default)('algorithms', options.algorithms);
     if (algorithms && !algorithms.has(alg)) {
         throw new errors_js_1.JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter not allowed');
     }

package/dist/node/cjs/lib/cek.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.bitLengths = void 0;
 const errors_js_1 = require("../util/errors.js");
+const random_js_1 = require("../runtime/random.js");
 const bitLengths = new Map([
     ['A128CBC-HS256', 256],
     ['A128GCM', 128],
@@ -11,11 +12,11 @@ const bitLengths = new Map([
     ['A256GCM', 256],
 ]);
 exports.bitLengths = bitLengths;
-const factory = (random) => (alg) => {
+const generateCek = (alg) => {
     const bitLength = bitLengths.get(alg);
     if (!bitLength) {
         throw new errors_js_1.JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }
-    return random(new Uint8Array(bitLength >> 3));
+    return (0, random_js_1.default)(new Uint8Array(bitLength >> 3));
 };
-exports.default = factory;
+exports.default = generateCek;

package/dist/node/cjs/lib/encrypt_key_management.js

@@ -1,6 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const random_js_1 = require("../runtime/random.js");
 const aeskw_js_1 = require("../runtime/aeskw.js");
 const ECDH = require("../runtime/ecdhes.js");
 const pbes2kw_js_1 = require("../runtime/pbes2kw.js");
@@ -11,7 +10,6 @@ const cek_js_1 = require("../lib/cek.js");
 const errors_js_1 = require("../util/errors.js");
 const export_js_1 = require("../key/export.js");
 const check_key_type_js_1 = require("./check_key_type.js");
-const generateCek = (0, cek_js_1.default)(random_js_1.default);
 async function encryptKeyManagement(alg, enc, key, providedCek, providedParameters = {}) {
     let encryptedKey;
     let parameters;
@@ -43,7 +41,7 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
                 cek = sharedSecret;
                 break;
             }
-            cek = providedCek || generateCek(enc);
+            cek = providedCek || (0, cek_js_1.default)(enc);
             const kwAlg = alg.substr(-6);
             encryptedKey = await (0, aeskw_js_1.wrap)(kwAlg, sharedSecret, cek);
             break;
@@ -53,14 +51,14 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
         case 'RSA-OAEP-256':
         case 'RSA-OAEP-384':
         case 'RSA-OAEP-512': {
-            cek = providedCek || generateCek(enc);
+            cek = providedCek || (0, cek_js_1.default)(enc);
             encryptedKey = await (0, rsaes_js_1.encrypt)(alg, key, cek);
             break;
         }
         case 'PBES2-HS256+A128KW':
         case 'PBES2-HS384+A192KW':
         case 'PBES2-HS512+A256KW': {
-            cek = providedCek || generateCek(enc);
+            cek = providedCek || (0, cek_js_1.default)(enc);
             const { p2c, p2s } = providedParameters;
             ({ encryptedKey, ...parameters } = await (0, pbes2kw_js_1.encrypt)(alg, key, cek, p2c, p2s));
             break;
@@ -68,14 +66,14 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
         case 'A128KW':
         case 'A192KW':
         case 'A256KW': {
-            cek = providedCek || generateCek(enc);
+            cek = providedCek || (0, cek_js_1.default)(enc);
             encryptedKey = await (0, aeskw_js_1.wrap)(alg, key, cek);
             break;
         }
         case 'A128GCMKW':
         case 'A192GCMKW':
         case 'A256GCMKW': {
-            cek = providedCek || generateCek(enc);
+            cek = providedCek || (0, cek_js_1.default)(enc);
             const { iv } = providedParameters;
             ({ encryptedKey, ...parameters } = await (0, aesgcmkw_js_1.wrap)(alg, key, cek, iv));
             break;

package/dist/node/cjs/lib/iv.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.bitLengths = void 0;
 const errors_js_1 = require("../util/errors.js");
+const random_js_1 = require("../runtime/random.js");
 const bitLengths = new Map([
     ['A128CBC-HS256', 128],
     ['A128GCM', 96],
@@ -14,11 +15,11 @@ const bitLengths = new Map([
     ['A256GCMKW', 96],
 ]);
 exports.bitLengths = bitLengths;
-const factory = (random) => (alg) => {
+const generateIv = (alg) => {
     const bitLength = bitLengths.get(alg);
     if (!bitLength) {
         throw new errors_js_1.JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }
-    return random(new Uint8Array(bitLength >> 3));
+    return (0, random_js_1.default)(new Uint8Array(bitLength >> 3));
 };
-exports.default = factory;
+exports.default = generateIv;

package/dist/node/cjs/runtime/aesgcmkw.js

@@ -4,12 +4,10 @@ exports.unwrap = exports.wrap = void 0;
 const encrypt_js_1 = require("./encrypt.js");
 const decrypt_js_1 = require("./decrypt.js");
 const iv_js_1 = require("../lib/iv.js");
-const random_js_1 = require("./random.js");
 const base64url_js_1 = require("./base64url.js");
-const generateIv = (0, iv_js_1.default)(random_js_1.default);
 const wrap = async (alg, key, cek, iv) => {
     const jweAlgorithm = alg.substr(0, 7);
-    iv || (iv = generateIv(jweAlgorithm));
+    iv || (iv = (0, iv_js_1.default)(jweAlgorithm));
     const { ciphertext: encryptedKey, tag } = await (0, encrypt_js_1.default)(jweAlgorithm, cek, key, iv, new Uint8Array(0));
     return { encryptedKey, iv: (0, base64url_js_1.encode)(iv), tag: (0, base64url_js_1.encode)(tag) };
 };

package/dist/node/cjs/util/errors.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.JWTExpired = exports.JWSSignatureVerificationFailed = exports.JWKSTimeout = exports.JWKSMultipleMatchingKeys = exports.JWKSNoMatchingKey = exports.JWKSInvalid = exports.JWKInvalid = exports.JWTInvalid = exports.JWSInvalid = exports.JWEInvalid = exports.JWEDecryptionFailed = exports.JOSENotSupported = exports.JOSEAlgNotAllowed = exports.JWTClaimValidationFailed = exports.JOSEError = void 0;
+exports.JWSSignatureVerificationFailed = exports.JWKSTimeout = exports.JWKSMultipleMatchingKeys = exports.JWKSNoMatchingKey = exports.JWKSInvalid = exports.JWKInvalid = exports.JWTInvalid = exports.JWSInvalid = exports.JWEInvalid = exports.JWEDecryptionFailed = exports.JOSENotSupported = exports.JOSEAlgNotAllowed = exports.JWTExpired = exports.JWTClaimValidationFailed = exports.JOSEError = void 0;
 class JOSEError extends Error {
     constructor(message) {
         var _a;
@@ -26,6 +26,18 @@ class JWTClaimValidationFailed extends JOSEError {
     }
 }
 exports.JWTClaimValidationFailed = JWTClaimValidationFailed;
+class JWTExpired extends JOSEError {
+    constructor(message, claim = 'unspecified', reason = 'unspecified') {
+        super(message);
+        this.code = 'ERR_JWT_EXPIRED';
+        this.claim = claim;
+        this.reason = reason;
+    }
+    static get code() {
+        return 'ERR_JWT_EXPIRED';
+    }
+}
+exports.JWTExpired = JWTExpired;
 class JOSEAlgNotAllowed extends JOSEError {
     constructor() {
         super(...arguments);
@@ -151,13 +163,3 @@ class JWSSignatureVerificationFailed extends JOSEError {
     }
 }
 exports.JWSSignatureVerificationFailed = JWSSignatureVerificationFailed;
-class JWTExpired extends JWTClaimValidationFailed {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWT_EXPIRED';
-    }
-    static get code() {
-        return 'ERR_JWT_EXPIRED';
-    }
-}
-exports.JWTExpired = JWTExpired;

package/dist/node/esm/jwe/flattened/decrypt.js

@@ -1,19 +1,14 @@
 import { decode as base64url } from '../../runtime/base64url.js';
 import decrypt from '../../runtime/decrypt.js';
 import { inflate } from '../../runtime/zlib.js';
-import random from '../../runtime/random.js';
 import { JOSEAlgNotAllowed, JOSENotSupported, JWEInvalid } from '../../util/errors.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import isObject from '../../lib/is_object.js';
 import decryptKeyManagement from '../../lib/decrypt_key_management.js';
 import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
-import cekFactory from '../../lib/cek.js';
+import generateCek from '../../lib/cek.js';
 import validateCrit from '../../lib/validate_crit.js';
 import validateAlgorithms from '../../lib/validate_algorithms.js';
-const generateCek = cekFactory(random);
-const checkExtensions = validateCrit.bind(undefined, JWEInvalid, new Map());
-const checkAlgOption = validateAlgorithms.bind(undefined, 'keyManagementAlgorithms');
-const checkEncOption = validateAlgorithms.bind(undefined, 'contentEncryptionAlgorithms');
 async function flattenedDecrypt(jwe, key, options) {
     var _a;
     if (!isObject(jwe)) {
@@ -64,7 +59,7 @@ async function flattenedDecrypt(jwe, key, options) {
         ...jwe.header,
         ...jwe.unprotected,
     };
-    checkExtensions(options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
+    validateCrit(JWEInvalid, new Map(), options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
     if (joseHeader.zip !== undefined) {
         if (!parsedProt || !parsedProt.zip) {
             throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
@@ -80,8 +75,9 @@ async function flattenedDecrypt(jwe, key, options) {
     if (typeof enc !== 'string' || !enc) {
         throw new JWEInvalid('missing JWE Encryption Algorithm (enc) in JWE Header');
     }
-    const keyManagementAlgorithms = options && checkAlgOption(options.keyManagementAlgorithms);
-    const contentEncryptionAlgorithms = options && checkEncOption(options.contentEncryptionAlgorithms);
+    const keyManagementAlgorithms = options && validateAlgorithms('keyManagementAlgorithms', options.keyManagementAlgorithms);
+    const contentEncryptionAlgorithms = options &&
+        validateAlgorithms('contentEncryptionAlgorithms', options.contentEncryptionAlgorithms);
     if (keyManagementAlgorithms && !keyManagementAlgorithms.has(alg)) {
         throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter not allowed');
     }

package/dist/node/esm/jwe/flattened/encrypt.js

@@ -1,15 +1,12 @@
 import { encode as base64url } from '../../runtime/base64url.js';
-import random from '../../runtime/random.js';
 import encrypt from '../../runtime/encrypt.js';
 import { deflate } from '../../runtime/zlib.js';
-import ivFactory from '../../lib/iv.js';
+import generateIv from '../../lib/iv.js';
 import encryptKeyManagement from '../../lib/encrypt_key_management.js';
 import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
 import validateCrit from '../../lib/validate_crit.js';
-const generateIv = ivFactory(random);
-const checkExtensions = validateCrit.bind(undefined, JWEInvalid, new Map());
 class FlattenedEncrypt {
     constructor(plaintext) {
         if (!(plaintext instanceof Uint8Array)) {
@@ -75,7 +72,7 @@ class FlattenedEncrypt {
             ...this._unprotectedHeader,
             ...this._sharedUnprotectedHeader,
         };
-        checkExtensions(options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
+        validateCrit(JWEInvalid, new Map(), options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
         if (joseHeader.zip !== undefined) {
             if (!this._protectedHeader || !this._protectedHeader.zip) {
                 throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');

package/dist/node/esm/jws/flattened/sign.js

@@ -5,7 +5,6 @@ import { JWSInvalid } from '../../util/errors.js';
 import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
 import checkKeyType from '../../lib/check_key_type.js';
 import validateCrit from '../../lib/validate_crit.js';
-const checkExtensions = validateCrit.bind(undefined, JWSInvalid, new Map([['b64', true]]));
 class FlattenedSign {
     constructor(payload) {
         if (!(payload instanceof Uint8Array)) {
@@ -38,7 +37,7 @@ class FlattenedSign {
             ...this._protectedHeader,
             ...this._unprotectedHeader,
         };
-        const extensions = checkExtensions(options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
+        const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
         let b64 = true;
         if (extensions.has('b64')) {
             b64 = this._protectedHeader.b64;

package/dist/node/esm/jws/flattened/verify.js

@@ -7,8 +7,6 @@ import isObject from '../../lib/is_object.js';
 import checkKeyType from '../../lib/check_key_type.js';
 import validateCrit from '../../lib/validate_crit.js';
 import validateAlgorithms from '../../lib/validate_algorithms.js';
-const checkExtensions = validateCrit.bind(undefined, JWSInvalid, new Map([['b64', true]]));
-const checkAlgOption = validateAlgorithms.bind(undefined, 'algorithms');
 async function flattenedVerify(jws, key, options) {
     var _a;
     if (!isObject(jws)) {
@@ -46,7 +44,7 @@ async function flattenedVerify(jws, key, options) {
         ...parsedProt,
         ...jws.header,
     };
-    const extensions = checkExtensions(options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
+    const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
     let b64 = true;
     if (extensions.has('b64')) {
         b64 = parsedProt.b64;
@@ -58,7 +56,7 @@ async function flattenedVerify(jws, key, options) {
     if (typeof alg !== 'string' || !alg) {
         throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
     }
-    const algorithms = options && checkAlgOption(options.algorithms);
+    const algorithms = options && validateAlgorithms('algorithms', options.algorithms);
     if (algorithms && !algorithms.has(alg)) {
         throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter not allowed');
     }

package/dist/node/esm/lib/cek.js

@@ -1,4 +1,5 @@
 import { JOSENotSupported } from '../util/errors.js';
+import random from '../runtime/random.js';
 const bitLengths = new Map([
     ['A128CBC-HS256', 256],
     ['A128GCM', 128],
@@ -7,12 +8,12 @@ const bitLengths = new Map([
     ['A256CBC-HS512', 512],
     ['A256GCM', 256],
 ]);
-const factory = (random) => (alg) => {
+const generateCek = (alg) => {
     const bitLength = bitLengths.get(alg);
     if (!bitLength) {
         throw new JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }
     return random(new Uint8Array(bitLength >> 3));
 };
-export default factory;
+export default generateCek;
 export { bitLengths };

package/dist/node/esm/lib/encrypt_key_management.js

@@ -1,15 +1,13 @@
-import random from '../runtime/random.js';
 import { wrap as aesKw } from '../runtime/aeskw.js';
 import * as ECDH from '../runtime/ecdhes.js';
 import { encrypt as pbes2Kw } from '../runtime/pbes2kw.js';
 import { encrypt as rsaEs } from '../runtime/rsaes.js';
 import { wrap as aesGcmKw } from '../runtime/aesgcmkw.js';
 import { encode as base64url } from '../runtime/base64url.js';
-import cekFactory, { bitLengths as cekLengths } from '../lib/cek.js';
+import generateCek, { bitLengths as cekLengths } from '../lib/cek.js';
 import { JOSENotSupported } from '../util/errors.js';
 import { exportJWK } from '../key/export.js';
 import checkKeyType from './check_key_type.js';
-const generateCek = cekFactory(random);
 async function encryptKeyManagement(alg, enc, key, providedCek, providedParameters = {}) {
     let encryptedKey;
     let parameters;

package/dist/node/esm/lib/iv.js

@@ -1,4 +1,5 @@
 import { JOSENotSupported } from '../util/errors.js';
+import random from '../runtime/random.js';
 const bitLengths = new Map([
     ['A128CBC-HS256', 128],
     ['A128GCM', 96],
@@ -10,12 +11,12 @@ const bitLengths = new Map([
     ['A256GCM', 96],
     ['A256GCMKW', 96],
 ]);
-const factory = (random) => (alg) => {
+const generateIv = (alg) => {
     const bitLength = bitLengths.get(alg);
     if (!bitLength) {
         throw new JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }
     return random(new Uint8Array(bitLength >> 3));
 };
-export default factory;
+export default generateIv;
 export { bitLengths };

package/dist/node/esm/runtime/aesgcmkw.js

@@ -1,9 +1,7 @@
 import encrypt from './encrypt.js';
 import decrypt from './decrypt.js';
-import ivFactory from '../lib/iv.js';
-import random from './random.js';
+import generateIv from '../lib/iv.js';
 import { encode as base64url } from './base64url.js';
-const generateIv = ivFactory(random);
 export const wrap = async (alg, key, cek, iv) => {
     const jweAlgorithm = alg.substr(0, 7);
     iv || (iv = generateIv(jweAlgorithm));

package/dist/node/esm/util/errors.js

@@ -21,6 +21,17 @@ export class JWTClaimValidationFailed extends JOSEError {
         return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
     }
 }
+export class JWTExpired extends JOSEError {
+    constructor(message, claim = 'unspecified', reason = 'unspecified') {
+        super(message);
+        this.code = 'ERR_JWT_EXPIRED';
+        this.claim = claim;
+        this.reason = reason;
+    }
+    static get code() {
+        return 'ERR_JWT_EXPIRED';
+    }
+}
 export class JOSEAlgNotAllowed extends JOSEError {
     constructor() {
         super(...arguments);
@@ -134,12 +145,3 @@ export class JWSSignatureVerificationFailed extends JOSEError {
         return 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
     }
 }
-export class JWTExpired extends JWTClaimValidationFailed {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWT_EXPIRED';
-    }
-    static get code() {
-        return 'ERR_JWT_EXPIRED';
-    }
-}

package/dist/types/util/errors.d.ts

@@ -10,6 +10,13 @@ export declare class JWTClaimValidationFailed extends JOSEError {
     reason: string;
     constructor(message: string, claim?: string, reason?: string);
 }
+export declare class JWTExpired extends JOSEError implements JWTClaimValidationFailed {
+    static get code(): 'ERR_JWT_EXPIRED';
+    code: string;
+    claim: string;
+    reason: string;
+    constructor(message: string, claim?: string, reason?: string);
+}
 export declare class JOSEAlgNotAllowed extends JOSEError {
     static get code(): 'ERR_JOSE_ALG_NOT_ALLOWED';
     code: string;
@@ -63,7 +70,3 @@ export declare class JWSSignatureVerificationFailed extends JOSEError {
     code: string;
     message: string;
 }
-export declare class JWTExpired extends JWTClaimValidationFailed {
-    static get code(): 'ERR_JWT_EXPIRED';
-    code: string;
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "3.20.2",
+  "version": "3.20.3",
   "description": "Universal 'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK with no dependencies",
   "keywords": [
     "browser",