jose 3.20.3 → 3.20.4

package/dist/node/cjs/runtime/generate.js

@@ -6,7 +6,7 @@ const util_1 = require("util");
 const random_js_1 = require("./random.js");
 const check_modulus_length_js_1 = require("./check_modulus_length.js");
 const errors_js_1 = require("../util/errors.js");
-const generate = (0, util_1.promisify)(crypto_1.generateKeyPair);
+const generate = util_1.promisify(crypto_1.generateKeyPair);
 async function generateSecret(alg, options) {
     let length;
     switch (alg) {
@@ -32,7 +32,7 @@ async function generateSecret(alg, options) {
         default:
             throw new errors_js_1.JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
     }
-    return (0, crypto_1.createSecretKey)((0, random_js_1.default)(new Uint8Array(length >> 3)));
+    return crypto_1.createSecretKey(random_js_1.default(new Uint8Array(length >> 3)));
 }
 exports.generateSecret = generateSecret;
 async function generateKeyPair(alg, options) {
@@ -57,8 +57,8 @@ async function generateKeyPair(alg, options) {
                 modulusLength,
                 publicExponent: 0x10001,
             });
-            (0, check_modulus_length_js_1.setModulusLength)(keypair.privateKey, modulusLength);
-            (0, check_modulus_length_js_1.setModulusLength)(keypair.publicKey, modulusLength);
+            check_modulus_length_js_1.setModulusLength(keypair.privateKey, modulusLength);
+            check_modulus_length_js_1.setModulusLength(keypair.publicKey, modulusLength);
             return keypair;
         }
         case 'ES256':

package/dist/node/cjs/runtime/get_named_curve.js

@@ -28,14 +28,14 @@ const namedCurveToJOSE = (namedCurve) => {
 const getNamedCurve = (kee, raw) => {
     var _a;
     let key;
-    if ((0, webcrypto_js_1.isCryptoKey)(kee)) {
-        key = (0, webcrypto_js_1.getKeyObject)(kee);
+    if (webcrypto_js_1.isCryptoKey(kee)) {
+        key = webcrypto_js_1.getKeyObject(kee);
     }
-    else if ((0, is_key_object_js_1.default)(kee)) {
+    else if (is_key_object_js_1.default(kee)) {
         key = kee;
     }
     else {
-        throw new TypeError((0, invalid_key_input_js_1.default)(kee, 'KeyObject', 'CryptoKey'));
+        throw new TypeError(invalid_key_input_js_1.default(kee, 'KeyObject', 'CryptoKey'));
     }
     if (key.type === 'secret') {
         throw new TypeError('only "private" or "public" type keys can be used for this operation');
@@ -53,7 +53,7 @@ const getNamedCurve = (kee, raw) => {
             }
             let namedCurve = (_a = key.asymmetricKeyDetails) === null || _a === void 0 ? void 0 : _a.namedCurve;
             if (!namedCurve && key.type === 'private') {
-                namedCurve = getNamedCurve((0, crypto_1.createPublicKey)(key), true);
+                namedCurve = getNamedCurve(crypto_1.createPublicKey(key), true);
             }
             else if (!namedCurve) {
                 const buf = key.export({ format: 'der', type: 'spki' });

package/dist/node/cjs/runtime/get_sign_verify_key.js

@@ -7,16 +7,16 @@ const invalid_key_input_js_1 = require("./invalid_key_input.js");
 function getSignVerifyKey(alg, key, usage) {
     if (key instanceof Uint8Array) {
         if (!alg.startsWith('HS')) {
-            throw new TypeError((0, invalid_key_input_js_1.default)(key, 'KeyObject', 'CryptoKey'));
+            throw new TypeError(invalid_key_input_js_1.default(key, 'KeyObject', 'CryptoKey'));
         }
-        return (0, secret_key_js_1.default)(key);
+        return secret_key_js_1.default(key);
     }
     if (key instanceof crypto.KeyObject) {
         return key;
     }
-    if ((0, webcrypto_js_1.isCryptoKey)(key)) {
-        return (0, webcrypto_js_1.getKeyObject)(key, alg, new Set([usage]));
+    if (webcrypto_js_1.isCryptoKey(key)) {
+        return webcrypto_js_1.getKeyObject(key, alg, new Set([usage]));
     }
-    throw new TypeError((0, invalid_key_input_js_1.default)(key, 'KeyObject', 'CryptoKey', 'Uint8Array'));
+    throw new TypeError(invalid_key_input_js_1.default(key, 'KeyObject', 'CryptoKey', 'Uint8Array'));
 }
 exports.default = getSignVerifyKey;

package/dist/node/cjs/runtime/invalid_key_input.js

@@ -24,12 +24,12 @@ exports.default = (actual, ...types) => {
             msg += ` Received an instance of ${actual.constructor.name}`;
         }
         else {
-            const inspected = (0, util_1.inspect)(actual, { depth: -1 });
+            const inspected = util_1.inspect(actual, { depth: -1 });
             msg += ` Received ${inspected}`;
         }
     }
     else {
-        let inspected = (0, util_1.inspect)(actual, { colors: false });
+        let inspected = util_1.inspect(actual, { colors: false });
         if (inspected.length > 25)
             inspected = `${inspected.slice(0, 25)}...`;
         msg += ` Received type ${typeof actual} (${inspected})`;

package/dist/node/cjs/runtime/is_key_like.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.types = void 0;
 const webcrypto_js_1 = require("./webcrypto.js");
 const is_key_object_js_1 = require("./is_key_object.js");
-exports.default = (key) => (0, is_key_object_js_1.default)(key) || (0, webcrypto_js_1.isCryptoKey)(key);
+exports.default = (key) => is_key_object_js_1.default(key) || webcrypto_js_1.isCryptoKey(key);
 const types = ['KeyObject'];
 exports.types = types;
 if (parseInt(process.versions.node) >= 16) {

package/dist/node/cjs/runtime/jwk_to_key.js

@@ -14,12 +14,12 @@ const jwkImportSupported = major >= 16 || (major === 15 && minor >= 12);
 const parse = (jwk) => {
     if (jwkImportSupported && jwk.kty !== 'oct') {
         return jwk.d
-            ? (0, crypto_1.createPrivateKey)({ format: 'jwk', key: jwk })
-            : (0, crypto_1.createPublicKey)({ format: 'jwk', key: jwk });
+            ? crypto_1.createPrivateKey({ format: 'jwk', key: jwk })
+            : crypto_1.createPublicKey({ format: 'jwk', key: jwk });
     }
     switch (jwk.kty) {
         case 'oct': {
-            return (0, crypto_1.createSecretKey)((0, base64url_js_1.decode)(jwk.k));
+            return crypto_1.createSecretKey(base64url_js_1.decode(jwk.k));
         }
         case 'RSA': {
             const enc = new asn1_sequence_encoder_js_1.default();
@@ -47,8 +47,8 @@ const parse = (jwk) => {
                 format: 'der',
                 type: 'pkcs1',
             };
-            const keyObject = isPrivate ? (0, crypto_1.createPrivateKey)(createInput) : (0, crypto_1.createPublicKey)(createInput);
-            (0, check_modulus_length_js_1.setModulusLength)(keyObject, modulus.length << 3);
+            const keyObject = isPrivate ? crypto_1.createPrivateKey(createInput) : crypto_1.createPublicKey(createInput);
+            check_modulus_length_js_1.setModulusLength(keyObject, modulus.length << 3);
             return keyObject;
         }
         case 'EC': {
@@ -78,8 +78,8 @@ const parse = (jwk) => {
                 const f3 = enc$4.end(Buffer.from([0x04]));
                 enc.add(f3);
                 const der = enc.end();
-                const keyObject = (0, crypto_1.createPrivateKey)({ key: der, format: 'der', type: 'pkcs8' });
-                (0, get_named_curve_js_1.setCurve)(keyObject, jwk.crv);
+                const keyObject = crypto_1.createPrivateKey({ key: der, format: 'der', type: 'pkcs8' });
+                get_named_curve_js_1.setCurve(keyObject, jwk.crv);
                 return keyObject;
             }
             const enc$1 = new asn1_sequence_encoder_js_1.default();
@@ -88,8 +88,8 @@ const parse = (jwk) => {
             enc.add(enc$1.end());
             enc.bitStr(pub);
             const der = enc.end();
-            const keyObject = (0, crypto_1.createPublicKey)({ key: der, format: 'der', type: 'spki' });
-            (0, get_named_curve_js_1.setCurve)(keyObject, jwk.crv);
+            const keyObject = crypto_1.createPublicKey({ key: der, format: 'der', type: 'spki' });
+            get_named_curve_js_1.setCurve(keyObject, jwk.crv);
             return keyObject;
         }
         case 'OKP': {
@@ -105,14 +105,14 @@ const parse = (jwk) => {
                 const f = enc$2.end(Buffer.from([0x04]));
                 enc.add(f);
                 const der = enc.end();
-                return (0, crypto_1.createPrivateKey)({ key: der, format: 'der', type: 'pkcs8' });
+                return crypto_1.createPrivateKey({ key: der, format: 'der', type: 'pkcs8' });
             }
             const enc$1 = new asn1_sequence_encoder_js_1.default();
             enc$1.oidFor(jwk.crv);
             enc.add(enc$1.end());
             enc.bitStr(Buffer.from(jwk.x, 'base64'));
             const der = enc.end();
-            return (0, crypto_1.createPublicKey)({ key: der, format: 'der', type: 'spki' });
+            return crypto_1.createPublicKey({ key: der, format: 'der', type: 'spki' });
         }
         default:
             throw new errors_js_1.JOSENotSupported('Invalid or unsupported JWK "kty" (Key Type) Parameter value');

package/dist/node/cjs/runtime/key_to_jwk.js

@@ -15,23 +15,23 @@ const [major, minor] = process.version
 const jwkExportSupported = major >= 16 || (major === 15 && minor >= 9);
 const keyToJWK = (key) => {
     let keyObject;
-    if ((0, webcrypto_js_1.isCryptoKey)(key)) {
+    if (webcrypto_js_1.isCryptoKey(key)) {
         if (!key.extractable) {
             throw new TypeError('CryptoKey is not extractable');
         }
-        keyObject = (0, webcrypto_js_1.getKeyObject)(key);
+        keyObject = webcrypto_js_1.getKeyObject(key);
     }
-    else if ((0, is_key_object_js_1.default)(key)) {
+    else if (is_key_object_js_1.default(key)) {
         keyObject = key;
     }
     else if (key instanceof Uint8Array) {
         return {
             kty: 'oct',
-            k: (0, base64url_js_1.encode)(key),
+            k: base64url_js_1.encode(key),
         };
     }
     else {
-        throw new TypeError((0, invalid_key_input_js_1.default)(key, 'KeyObject', 'CryptoKey', 'Uint8Array'));
+        throw new TypeError(invalid_key_input_js_1.default(key, 'KeyObject', 'CryptoKey', 'Uint8Array'));
     }
     if (jwkExportSupported) {
         return keyObject.export({ format: 'jwk' });
@@ -40,7 +40,7 @@ const keyToJWK = (key) => {
         case 'secret':
             return {
                 kty: 'oct',
-                k: (0, base64url_js_1.encode)(keyObject.export()),
+                k: base64url_js_1.encode(keyObject.export()),
             };
         case 'private':
         case 'public': {
@@ -51,24 +51,24 @@ const keyToJWK = (key) => {
                     if (keyObject.type === 'private') {
                         dec.unsignedInteger();
                     }
-                    const n = (0, base64url_js_1.encode)(dec.unsignedInteger());
-                    const e = (0, base64url_js_1.encode)(dec.unsignedInteger());
+                    const n = base64url_js_1.encode(dec.unsignedInteger());
+                    const e = base64url_js_1.encode(dec.unsignedInteger());
                     let jwk;
                     if (keyObject.type === 'private') {
                         jwk = {
-                            d: (0, base64url_js_1.encode)(dec.unsignedInteger()),
-                            p: (0, base64url_js_1.encode)(dec.unsignedInteger()),
-                            q: (0, base64url_js_1.encode)(dec.unsignedInteger()),
-                            dp: (0, base64url_js_1.encode)(dec.unsignedInteger()),
-                            dq: (0, base64url_js_1.encode)(dec.unsignedInteger()),
-                            qi: (0, base64url_js_1.encode)(dec.unsignedInteger()),
+                            d: base64url_js_1.encode(dec.unsignedInteger()),
+                            p: base64url_js_1.encode(dec.unsignedInteger()),
+                            q: base64url_js_1.encode(dec.unsignedInteger()),
+                            dp: base64url_js_1.encode(dec.unsignedInteger()),
+                            dq: base64url_js_1.encode(dec.unsignedInteger()),
+                            qi: base64url_js_1.encode(dec.unsignedInteger()),
                         };
                     }
                     dec.end();
                     return { kty: 'RSA', n, e, ...jwk };
                 }
                 case 'ec': {
-                    const crv = (0, get_named_curve_js_1.default)(keyObject);
+                    const crv = get_named_curve_js_1.default(keyObject);
                     let len;
                     let offset;
                     let correction;
@@ -101,8 +101,8 @@ const keyToJWK = (key) => {
                         return {
                             kty: 'EC',
                             crv,
-                            x: (0, base64url_js_1.encode)(der.subarray(-len, -len / 2)),
-                            y: (0, base64url_js_1.encode)(der.subarray(-len / 2)),
+                            x: base64url_js_1.encode(der.subarray(-len, -len / 2)),
+                            y: base64url_js_1.encode(der.subarray(-len / 2)),
                         };
                     }
                     const der = keyObject.export({ type: 'pkcs8', format: 'der' });
@@ -110,42 +110,42 @@ const keyToJWK = (key) => {
                         offset += correction;
                     }
                     return {
-                        ...keyToJWK((0, crypto_1.createPublicKey)(keyObject)),
-                        d: (0, base64url_js_1.encode)(der.subarray(offset, offset + len / 2)),
+                        ...keyToJWK(crypto_1.createPublicKey(keyObject)),
+                        d: base64url_js_1.encode(der.subarray(offset, offset + len / 2)),
                     };
                 }
                 case 'ed25519':
                 case 'x25519': {
-                    const crv = (0, get_named_curve_js_1.default)(keyObject);
+                    const crv = get_named_curve_js_1.default(keyObject);
                     if (keyObject.type === 'public') {
                         const der = keyObject.export({ type: 'spki', format: 'der' });
                         return {
                             kty: 'OKP',
                             crv,
-                            x: (0, base64url_js_1.encode)(der.subarray(-32)),
+                            x: base64url_js_1.encode(der.subarray(-32)),
                         };
                     }
                     const der = keyObject.export({ type: 'pkcs8', format: 'der' });
                     return {
-                        ...keyToJWK((0, crypto_1.createPublicKey)(keyObject)),
-                        d: (0, base64url_js_1.encode)(der.subarray(-32)),
+                        ...keyToJWK(crypto_1.createPublicKey(keyObject)),
+                        d: base64url_js_1.encode(der.subarray(-32)),
                     };
                 }
                 case 'ed448':
                 case 'x448': {
-                    const crv = (0, get_named_curve_js_1.default)(keyObject);
+                    const crv = get_named_curve_js_1.default(keyObject);
                     if (keyObject.type === 'public') {
                         const der = keyObject.export({ type: 'spki', format: 'der' });
                         return {
                             kty: 'OKP',
                             crv,
-                            x: (0, base64url_js_1.encode)(der.subarray(crv === 'Ed448' ? -57 : -56)),
+                            x: base64url_js_1.encode(der.subarray(crv === 'Ed448' ? -57 : -56)),
                         };
                     }
                     const der = keyObject.export({ type: 'pkcs8', format: 'der' });
                     return {
-                        ...keyToJWK((0, crypto_1.createPublicKey)(keyObject)),
-                        d: (0, base64url_js_1.encode)(der.subarray(crv === 'Ed448' ? -57 : -56)),
+                        ...keyToJWK(crypto_1.createPublicKey(keyObject)),
+                        d: base64url_js_1.encode(der.subarray(crv === 'Ed448' ? -57 : -56)),
                     };
                 }
                 default:

package/dist/node/cjs/runtime/node_key.js

@@ -28,7 +28,7 @@ function keyForCrypto(alg, key) {
             if (key.asymmetricKeyType !== 'rsa') {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa');
             }
-            (0, check_modulus_length_js_1.default)(key, alg);
+            check_modulus_length_js_1.default(key, alg);
             return key;
         case rsaPssParams && 'PS256':
         case rsaPssParams && 'PS384':
@@ -47,7 +47,7 @@ function keyForCrypto(alg, key) {
             else if (key.asymmetricKeyType !== 'rsa') {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa or rsa-pss');
             }
-            (0, check_modulus_length_js_1.default)(key, alg);
+            check_modulus_length_js_1.default(key, alg);
             return {
                 key,
                 padding: crypto_1.constants.RSA_PKCS1_PSS_PADDING,
@@ -59,7 +59,7 @@ function keyForCrypto(alg, key) {
             if (key.asymmetricKeyType !== 'rsa') {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa');
             }
-            (0, check_modulus_length_js_1.default)(key, alg);
+            check_modulus_length_js_1.default(key, alg);
             return {
                 key,
                 padding: crypto_1.constants.RSA_PKCS1_PSS_PADDING,
@@ -72,7 +72,7 @@ function keyForCrypto(alg, key) {
             if (key.asymmetricKeyType !== 'ec') {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be ec');
             }
-            const actual = (0, get_named_curve_js_1.default)(key);
+            const actual = get_named_curve_js_1.default(key);
             const expected = ecCurveAlgMap.get(alg);
             if (actual !== expected) {
                 throw new TypeError(`Invalid key curve for the algorithm, its curve must be ${expected}, got ${actual}`);

package/dist/node/cjs/runtime/pbes2kw.js

@@ -11,35 +11,35 @@ const check_p2s_js_1 = require("../lib/check_p2s.js");
 const webcrypto_js_1 = require("./webcrypto.js");
 const is_key_object_js_1 = require("./is_key_object.js");
 const invalid_key_input_js_1 = require("./invalid_key_input.js");
-const pbkdf2 = (0, util_1.promisify)(crypto_1.pbkdf2);
+const pbkdf2 = util_1.promisify(crypto_1.pbkdf2);
 function getPassword(key, alg) {
-    if ((0, is_key_object_js_1.default)(key)) {
+    if (is_key_object_js_1.default(key)) {
         return key.export();
     }
     if (key instanceof Uint8Array) {
         return key;
     }
-    if ((0, webcrypto_js_1.isCryptoKey)(key)) {
-        return (0, webcrypto_js_1.getKeyObject)(key, alg, new Set(['deriveBits', 'deriveKey'])).export();
+    if (webcrypto_js_1.isCryptoKey(key)) {
+        return webcrypto_js_1.getKeyObject(key, alg, new Set(['deriveBits', 'deriveKey'])).export();
     }
-    throw new TypeError((0, invalid_key_input_js_1.default)(key, 'KeyObject', 'CryptoKey', 'Uint8Array'));
+    throw new TypeError(invalid_key_input_js_1.default(key, 'KeyObject', 'CryptoKey', 'Uint8Array'));
 }
-const encrypt = async (alg, key, cek, p2c = Math.floor(Math.random() * 2049) + 2048, p2s = (0, random_js_1.default)(new Uint8Array(16))) => {
-    (0, check_p2s_js_1.default)(p2s);
-    const salt = (0, buffer_utils_js_1.p2s)(alg, p2s);
+const encrypt = async (alg, key, cek, p2c = Math.floor(Math.random() * 2049) + 2048, p2s = random_js_1.default(new Uint8Array(16))) => {
+    check_p2s_js_1.default(p2s);
+    const salt = buffer_utils_js_1.p2s(alg, p2s);
     const keylen = parseInt(alg.substr(13, 3), 10) >> 3;
     const password = getPassword(key, alg);
     const derivedKey = await pbkdf2(password, salt, p2c, keylen, `sha${alg.substr(8, 3)}`);
-    const encryptedKey = await (0, aeskw_js_1.wrap)(alg.substr(-6), derivedKey, cek);
-    return { encryptedKey, p2c, p2s: (0, base64url_js_1.encode)(p2s) };
+    const encryptedKey = await aeskw_js_1.wrap(alg.substr(-6), derivedKey, cek);
+    return { encryptedKey, p2c, p2s: base64url_js_1.encode(p2s) };
 };
 exports.encrypt = encrypt;
 const decrypt = async (alg, key, encryptedKey, p2c, p2s) => {
-    (0, check_p2s_js_1.default)(p2s);
-    const salt = (0, buffer_utils_js_1.p2s)(alg, p2s);
+    check_p2s_js_1.default(p2s);
+    const salt = buffer_utils_js_1.p2s(alg, p2s);
     const keylen = parseInt(alg.substr(13, 3), 10) >> 3;
     const password = getPassword(key, alg);
     const derivedKey = await pbkdf2(password, salt, p2c, keylen, `sha${alg.substr(8, 3)}`);
-    return (0, aeskw_js_1.unwrap)(alg.substr(-6), derivedKey, encryptedKey);
+    return aeskw_js_1.unwrap(alg.substr(-6), derivedKey, encryptedKey);
 };
 exports.decrypt = decrypt;

package/dist/node/cjs/runtime/rsaes.js

@@ -10,7 +10,7 @@ const checkKey = (key, alg) => {
     if (key.asymmetricKeyType !== 'rsa') {
         throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa');
     }
-    (0, check_modulus_length_js_1.default)(key, alg);
+    check_modulus_length_js_1.default(key, alg);
 };
 const resolvePadding = (alg) => {
     switch (alg) {
@@ -40,20 +40,20 @@ const resolveOaepHash = (alg) => {
     }
 };
 function ensureKeyObject(key, alg, ...usages) {
-    if ((0, is_key_object_js_1.default)(key)) {
+    if (is_key_object_js_1.default(key)) {
         return key;
     }
-    if ((0, webcrypto_js_1.isCryptoKey)(key)) {
-        return (0, webcrypto_js_1.getKeyObject)(key, alg, new Set(usages));
+    if (webcrypto_js_1.isCryptoKey(key)) {
+        return webcrypto_js_1.getKeyObject(key, alg, new Set(usages));
     }
-    throw new TypeError((0, invalid_key_input_js_1.default)(key, 'KeyObject', 'CryptoKey'));
+    throw new TypeError(invalid_key_input_js_1.default(key, 'KeyObject', 'CryptoKey'));
 }
 const encrypt = async (alg, key, cek) => {
     const padding = resolvePadding(alg);
     const oaepHash = resolveOaepHash(alg);
     const keyObject = ensureKeyObject(key, alg, 'wrapKey', 'encrypt');
     checkKey(keyObject, alg);
-    return (0, crypto_1.publicEncrypt)({ key: keyObject, oaepHash, padding }, cek);
+    return crypto_1.publicEncrypt({ key: keyObject, oaepHash, padding }, cek);
 };
 exports.encrypt = encrypt;
 const decrypt = async (alg, key, encryptedKey) => {
@@ -61,6 +61,6 @@ const decrypt = async (alg, key, encryptedKey) => {
     const oaepHash = resolveOaepHash(alg);
     const keyObject = ensureKeyObject(key, alg, 'unwrapKey', 'decrypt');
     checkKey(keyObject, alg);
-    return (0, crypto_1.privateDecrypt)({ key: keyObject, oaepHash, padding }, encryptedKey);
+    return crypto_1.privateDecrypt({ key: keyObject, oaepHash, padding }, encryptedKey);
 };
 exports.decrypt = decrypt;

package/dist/node/cjs/runtime/secret_key.js

@@ -4,7 +4,7 @@ const crypto_1 = require("crypto");
 function getSecretKey(key) {
     let keyObject;
     if (key instanceof Uint8Array) {
-        keyObject = (0, crypto_1.createSecretKey)(key);
+        keyObject = crypto_1.createSecretKey(key);
     }
     else {
         keyObject = key;

package/dist/node/cjs/runtime/sign.js

@@ -8,22 +8,22 @@ const node_key_js_1 = require("./node_key.js");
 const get_sign_verify_key_js_1 = require("./get_sign_verify_key.js");
 let oneShotSign;
 if (crypto.sign.length > 3) {
-    oneShotSign = (0, util_1.promisify)(crypto.sign);
+    oneShotSign = util_1.promisify(crypto.sign);
 }
 else {
     oneShotSign = crypto.sign;
 }
 const sign = async (alg, key, data) => {
-    const keyObject = (0, get_sign_verify_key_js_1.default)(alg, key, 'sign');
+    const keyObject = get_sign_verify_key_js_1.default(alg, key, 'sign');
     if (alg.startsWith('HS')) {
         const bitlen = parseInt(alg.substr(-3), 10);
         if (!keyObject.symmetricKeySize || keyObject.symmetricKeySize << 3 < bitlen) {
             throw new TypeError(`${alg} requires symmetric keys to be ${bitlen} bits or larger`);
         }
-        const hmac = crypto.createHmac((0, hmac_digest_js_1.default)(alg), keyObject);
+        const hmac = crypto.createHmac(hmac_digest_js_1.default(alg), keyObject);
         hmac.update(data);
         return hmac.digest();
     }
-    return oneShotSign((0, dsa_digest_js_1.default)(alg), data, (0, node_key_js_1.default)(alg, keyObject));
+    return oneShotSign(dsa_digest_js_1.default(alg), data, node_key_js_1.default(alg, keyObject));
 };
 exports.default = sign;

package/dist/node/cjs/runtime/verify.js

@@ -13,15 +13,15 @@ const [major, minor] = process.version
 const oneShotCallbackSupported = major >= 16 || (major === 15 && minor >= 13);
 let oneShotVerify;
 if (crypto.verify.length > 4 && oneShotCallbackSupported) {
-    oneShotVerify = (0, util_1.promisify)(crypto.verify);
+    oneShotVerify = util_1.promisify(crypto.verify);
 }
 else {
     oneShotVerify = crypto.verify;
 }
 const verify = async (alg, key, signature, data) => {
-    const keyObject = (0, get_sign_verify_key_js_1.default)(alg, key, 'verify');
+    const keyObject = get_sign_verify_key_js_1.default(alg, key, 'verify');
     if (alg.startsWith('HS')) {
-        const expected = await (0, sign_js_1.default)(alg, keyObject, data);
+        const expected = await sign_js_1.default(alg, keyObject, data);
         const actual = signature;
         try {
             return crypto.timingSafeEqual(actual, expected);
@@ -30,8 +30,8 @@ const verify = async (alg, key, signature, data) => {
             return false;
         }
     }
-    const algorithm = (0, dsa_digest_js_1.default)(alg);
-    const keyInput = (0, node_key_js_1.default)(alg, keyObject);
+    const algorithm = dsa_digest_js_1.default(alg);
+    const keyInput = node_key_js_1.default(alg, keyObject);
     try {
         return await oneShotVerify(algorithm, data, keyInput, signature);
     }

package/dist/node/cjs/runtime/zlib.js

@@ -3,8 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.deflate = exports.inflate = void 0;
 const util_1 = require("util");
 const zlib_1 = require("zlib");
-const inflateRaw = (0, util_1.promisify)(zlib_1.inflateRaw);
-const deflateRaw = (0, util_1.promisify)(zlib_1.deflateRaw);
+const inflateRaw = util_1.promisify(zlib_1.inflateRaw);
+const deflateRaw = util_1.promisify(zlib_1.deflateRaw);
 const inflate = (input) => inflateRaw(input);
 exports.inflate = inflate;
 const deflate = (input) => deflateRaw(input);

package/dist/node/cjs/util/decode_protected_header.js

@@ -25,8 +25,8 @@ function decodeProtectedHeader(token) {
         if (typeof protectedB64u !== 'string' || !protectedB64u) {
             throw new Error();
         }
-        const result = JSON.parse(buffer_utils_js_1.decoder.decode((0, base64url_js_1.decode)(protectedB64u)));
-        if (!(0, is_object_js_1.default)(result)) {
+        const result = JSON.parse(buffer_utils_js_1.decoder.decode(base64url_js_1.decode(protectedB64u)));
+        if (!is_object_js_1.default(result)) {
             throw new Error();
         }
         return result;

package/dist/node/cjs/util/generate_key_pair.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.generateKeyPair = void 0;
 const generate_js_1 = require("../runtime/generate.js");
 async function generateKeyPair(alg, options) {
-    return (0, generate_js_1.generateKeyPair)(alg, options);
+    return generate_js_1.generateKeyPair(alg, options);
 }
 exports.generateKeyPair = generateKeyPair;
 exports.default = generateKeyPair;

package/dist/node/cjs/util/generate_secret.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.generateSecret = void 0;
 const generate_js_1 = require("../runtime/generate.js");
 async function generateSecret(alg, options) {
-    return (0, generate_js_1.generateSecret)(alg, options);
+    return generate_js_1.generateSecret(alg, options);
 }
 exports.generateSecret = generateSecret;
 exports.default = generateSecret;

package/dist/node/esm/jwe/flattened/decrypt.js

@@ -95,10 +95,10 @@ async function flattenedDecrypt(jwe, key, options) {
     }
     let cek;
     try {
-        cek = await decryptKeyManagement(alg, key, encryptedKey, joseHeader);
+        cek = await decryptKeyManagement(alg, key, encryptedKey, joseHeader, options);
     }
     catch (err) {
-        if (err instanceof TypeError) {
+        if (err instanceof TypeError || err instanceof JWEInvalid || err instanceof JOSENotSupported) {
             throw err;
         }
         cek = generateCek(enc);

package/dist/node/esm/lib/decrypt_key_management.js

@@ -9,7 +9,7 @@ import { bitLengths as cekLengths } from '../lib/cek.js';
 import { importJWK } from '../key/import.js';
 import checkKeyType from './check_key_type.js';
 import isObject from './is_object.js';
-async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
+async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options) {
     checkKeyType(alg, key, 'decrypt');
     switch (alg) {
         case 'dir': {
@@ -63,6 +63,9 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
                 throw new JWEInvalid('JWE Encrypted Key missing');
             if (typeof joseHeader.p2c !== 'number')
                 throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);
+            const p2cLimit = (options === null || options === void 0 ? void 0 : options.maxPBES2Count) || 10000;
+            if (joseHeader.p2c > p2cLimit)
+                throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);
             if (typeof joseHeader.p2s !== 'string')
                 throw new JWEInvalid(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);
             return pbes2Kw(alg, key, encryptedKey, joseHeader.p2c, base64url(joseHeader.p2s));

package/dist/types/types.d.ts

@@ -199,6 +199,7 @@ export interface DecryptOptions extends CritOption {
   keyManagementAlgorithms?: string[]
   contentEncryptionAlgorithms?: string[]
   inflateRaw?: InflateFunction
+  maxPBES2Count?: number
 }
 export interface EncryptOptions extends CritOption {
   deflateRaw?: DeflateFunction

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "3.20.3",
+  "version": "3.20.4",
   "description": "Universal 'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK with no dependencies",
   "keywords": [
     "browser",