jose 4.0.3 → 4.1.2

package/dist/browser/runtime/pbes2kw.js

@@ -3,24 +3,25 @@ import { p2s as concatSalt } from '../lib/buffer_utils.js';
 import { encode as base64url } from './base64url.js';
 import { wrap, unwrap } from './aeskw.js';
 import checkP2s from '../lib/check_p2s.js';
-import crypto, { checkCryptoKey, isCryptoKey } from './webcrypto.js';
-import invalidKeyInput from './invalid_key_input.js';
+import crypto, { isCryptoKey } from './webcrypto.js';
+import { checkEncCryptoKey } from '../lib/crypto_key.js';
+import invalidKeyInput from '../lib/invalid_key_input.js';
 function getCryptoKey(key, alg) {
     if (key instanceof Uint8Array) {
         return crypto.subtle.importKey('raw', key, 'PBKDF2', false, ['deriveBits']);
     }
     if (isCryptoKey(key)) {
-        checkCryptoKey(key, alg, 'deriveBits', 'deriveKey');
+        checkEncCryptoKey(key, alg, 'deriveBits', 'deriveKey');
         return key;
     }
     throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'Uint8Array'));
 }
-export const encrypt = async (alg, key, cek, p2c = Math.floor(Math.random() * 2049) + 2048, p2s = random(new Uint8Array(16))) => {
+async function deriveKey(p2s, alg, p2c, key) {
     checkP2s(p2s);
     const salt = concatSalt(alg, p2s);
     const keylen = parseInt(alg.substr(13, 3), 10);
     const subtleAlg = {
-        hash: { name: `SHA-${alg.substr(8, 3)}` },
+        hash: `SHA-${alg.substr(8, 3)}`,
         iterations: p2c,
         name: 'PBKDF2',
         salt,
@@ -30,43 +31,20 @@ export const encrypt = async (alg, key, cek, p2c = Math.floor(Math.random() * 20
         name: 'AES-KW',
     };
     const cryptoKey = await getCryptoKey(key, alg);
-    let derived;
     if (cryptoKey.usages.includes('deriveBits')) {
-        derived = new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
-    }
-    else if (cryptoKey.usages.includes('deriveKey')) {
-        derived = await crypto.subtle.deriveKey(subtleAlg, cryptoKey, wrapAlg, false, ['wrapKey']);
+        return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
     }
-    else {
-        throw new TypeError('PBKDF2 key "usages" must include "deriveBits" or "deriveKey"');
+    if (cryptoKey.usages.includes('deriveKey')) {
+        return crypto.subtle.deriveKey(subtleAlg, cryptoKey, wrapAlg, false, ['wrapKey', 'unwrapKey']);
     }
+    throw new TypeError('PBKDF2 key "usages" must include "deriveBits" or "deriveKey"');
+}
+export const encrypt = async (alg, key, cek, p2c = Math.floor(Math.random() * 2049) + 2048, p2s = random(new Uint8Array(16))) => {
+    const derived = await deriveKey(p2s, alg, p2c, key);
     const encryptedKey = await wrap(alg.substr(-6), derived, cek);
     return { encryptedKey, p2c, p2s: base64url(p2s) };
 };
 export const decrypt = async (alg, key, encryptedKey, p2c, p2s) => {
-    checkP2s(p2s);
-    const salt = concatSalt(alg, p2s);
-    const keylen = parseInt(alg.substr(13, 3), 10);
-    const subtleAlg = {
-        hash: { name: `SHA-${alg.substr(8, 3)}` },
-        iterations: p2c,
-        name: 'PBKDF2',
-        salt,
-    };
-    const wrapAlg = {
-        length: keylen,
-        name: 'AES-KW',
-    };
-    const cryptoKey = await getCryptoKey(key, alg);
-    let derived;
-    if (cryptoKey.usages.includes('deriveBits')) {
-        derived = new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
-    }
-    else if (cryptoKey.usages.includes('deriveKey')) {
-        derived = await crypto.subtle.deriveKey(subtleAlg, cryptoKey, wrapAlg, false, ['unwrapKey']);
-    }
-    else {
-        throw new TypeError('PBKDF2 key "usages" must include "deriveBits" or "deriveKey"');
-    }
+    const derived = await deriveKey(p2s, alg, p2c, key);
     return unwrap(alg.substr(-6), derived, encryptedKey);
 };

package/dist/browser/runtime/rsaes.js

@@ -1,13 +1,14 @@
 import subtleAlgorithm from './subtle_rsaes.js';
 import bogusWebCrypto from './bogus.js';
-import crypto, { checkCryptoKey, isCryptoKey } from './webcrypto.js';
+import crypto, { isCryptoKey } from './webcrypto.js';
+import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import checkKeyLength from './check_key_length.js';
-import invalidKeyInput from './invalid_key_input.js';
+import invalidKeyInput from '../lib/invalid_key_input.js';
 export const encrypt = async (alg, key, cek) => {
     if (!isCryptoKey(key)) {
         throw new TypeError(invalidKeyInput(key, 'CryptoKey'));
     }
-    checkCryptoKey(key, alg, 'encrypt', 'wrapKey');
+    checkEncCryptoKey(key, alg, 'encrypt', 'wrapKey');
     checkKeyLength(alg, key);
     if (key.usages.includes('encrypt')) {
         return new Uint8Array(await crypto.subtle.encrypt(subtleAlgorithm(alg), key, cek));
@@ -22,7 +23,7 @@ export const decrypt = async (alg, key, encryptedKey) => {
     if (!isCryptoKey(key)) {
         throw new TypeError(invalidKeyInput(key, 'CryptoKey'));
     }
-    checkCryptoKey(key, alg, 'decrypt', 'unwrapKey');
+    checkEncCryptoKey(key, alg, 'decrypt', 'unwrapKey');
     checkKeyLength(alg, key);
     if (key.usages.includes('decrypt')) {
         return new Uint8Array(await crypto.subtle.decrypt(subtleAlgorithm(alg), key, encryptedKey));

package/dist/browser/runtime/subtle_dsa.js

@@ -1,45 +1,26 @@
 import { isCloudflareWorkers, isNodeJs } from './global.js';
 import { JOSENotSupported } from '../util/errors.js';
-export default function subtleDsa(alg, crv) {
+export default function subtleDsa(alg, namedCurve) {
+    const length = parseInt(alg.substr(-3), 10);
     switch (alg) {
         case 'HS256':
-            return { hash: { name: 'SHA-256' }, name: 'HMAC' };
         case 'HS384':
-            return { hash: { name: 'SHA-384' }, name: 'HMAC' };
         case 'HS512':
-            return { hash: { name: 'SHA-512' }, name: 'HMAC' };
+            return { hash: `SHA-${length}`, name: 'HMAC' };
         case 'PS256':
-            return {
-                hash: { name: 'SHA-256' },
-                name: 'RSA-PSS',
-                saltLength: 256 >> 3,
-            };
         case 'PS384':
-            return {
-                hash: { name: 'SHA-384' },
-                name: 'RSA-PSS',
-                saltLength: 384 >> 3,
-            };
         case 'PS512':
-            return {
-                hash: { name: 'SHA-512' },
-                name: 'RSA-PSS',
-                saltLength: 512 >> 3,
-            };
+            return { hash: `SHA-${length}`, name: 'RSA-PSS', saltLength: length >> 3 };
         case 'RS256':
-            return { hash: { name: 'SHA-256' }, name: 'RSASSA-PKCS1-v1_5' };
         case 'RS384':
-            return { hash: { name: 'SHA-384' }, name: 'RSASSA-PKCS1-v1_5' };
         case 'RS512':
-            return { hash: { name: 'SHA-512' }, name: 'RSASSA-PKCS1-v1_5' };
+            return { hash: `SHA-${length}`, name: 'RSASSA-PKCS1-v1_5' };
         case 'ES256':
-            return { hash: { name: 'SHA-256' }, name: 'ECDSA', namedCurve: 'P-256' };
         case 'ES384':
-            return { hash: { name: 'SHA-384' }, name: 'ECDSA', namedCurve: 'P-384' };
         case 'ES512':
-            return { hash: { name: 'SHA-512' }, name: 'ECDSA', namedCurve: 'P-521' };
+            return { hash: `SHA-${length}`, name: 'ECDSA', namedCurve };
         case (isCloudflareWorkers() || isNodeJs()) && 'EdDSA':
-            return { name: crv, namedCurve: crv };
+            return { name: namedCurve, namedCurve };
         default:
             throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
     }

package/dist/browser/runtime/webcrypto.js

@@ -6,148 +6,3 @@ export function isCryptoKey(key) {
     }
     return key != null && key instanceof globalThis.CryptoKey;
 }
-function getHashLength(hash) {
-    return parseInt(hash === null || hash === void 0 ? void 0 : hash.name.substr(4), 10);
-}
-function getNamedCurve(alg) {
-    switch (alg) {
-        case 'ES256':
-            return 'P-256';
-        case 'ES384':
-            return 'P-384';
-        case 'ES512':
-            return 'P-521';
-    }
-}
-export function checkCryptoKey(key, alg, ...usages) {
-    switch (alg) {
-        case undefined:
-            break;
-        case 'HS256':
-        case 'HS384':
-        case 'HS512': {
-            if (key.algorithm.name !== 'HMAC') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be HMAC.`);
-            }
-            const expected = parseInt(alg.substr(2), 10);
-            const actual = getHashLength(key.algorithm.hash);
-            if (actual !== expected) {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.hash must be SHA-${expected}.`);
-            }
-            break;
-        }
-        case 'RS256':
-        case 'RS384':
-        case 'RS512': {
-            if (key.algorithm.name !== 'RSASSA-PKCS1-v1_5') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be RSASSA-PKCS1-v1_5.`);
-            }
-            const expected = parseInt(alg.substr(2), 10);
-            const actual = getHashLength(key.algorithm.hash);
-            if (actual !== expected) {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.hash must be SHA-${expected}.`);
-            }
-            break;
-        }
-        case 'PS256':
-        case 'PS384':
-        case 'PS512': {
-            if (key.algorithm.name !== 'RSA-PSS') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be RSA-PSS.`);
-            }
-            const expected = parseInt(alg.substr(2), 10);
-            const actual = getHashLength(key.algorithm.hash);
-            if (actual !== expected) {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.hash must be SHA-${expected}.`);
-            }
-            break;
-        }
-        case 'EdDSA': {
-            if (key.algorithm.name !== 'NODE-ED25519' && key.algorithm.name !== 'NODE-ED448') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be NODE-ED25519 or NODE-ED448.`);
-            }
-            break;
-        }
-        case 'ES256':
-        case 'ES384':
-        case 'ES512': {
-            if (key.algorithm.name !== 'ECDSA') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be ECDSA.`);
-            }
-            const expected = getNamedCurve(alg);
-            const actual = key.algorithm.namedCurve;
-            if (actual !== expected) {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.namedCurve must be ${expected}.`);
-            }
-            break;
-        }
-        case 'A128GCM':
-        case 'A192GCM':
-        case 'A256GCM': {
-            if (key.algorithm.name !== 'AES-GCM') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be AES-GCM.`);
-            }
-            const expected = parseInt(alg.substr(1, 3), 10);
-            const actual = key.algorithm.length;
-            if (actual !== expected) {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.length must be ${expected}.`);
-            }
-            break;
-        }
-        case 'A128KW':
-        case 'A192KW':
-        case 'A256KW': {
-            if (key.algorithm.name !== 'AES-KW') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be AES-KW.`);
-            }
-            const expected = parseInt(alg.substr(1, 3), 10);
-            const actual = key.algorithm.length;
-            if (actual !== expected) {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.length must be ${expected}.`);
-            }
-            break;
-        }
-        case 'ECDH-ES':
-            if (key.algorithm.name !== 'ECDH') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be ECDH.`);
-            }
-            break;
-        case 'PBES2-HS256+A128KW':
-        case 'PBES2-HS384+A192KW':
-        case 'PBES2-HS512+A256KW':
-            if (key.algorithm.name !== 'PBKDF2') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be PBKDF2.`);
-            }
-            break;
-        case 'RSA-OAEP':
-        case 'RSA-OAEP-256':
-        case 'RSA-OAEP-384':
-        case 'RSA-OAEP-512': {
-            if (key.algorithm.name !== 'RSA-OAEP') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be RSA-OAEP.`);
-            }
-            const expected = parseInt(alg.substr(9), 10) || 1;
-            const actual = getHashLength(key.algorithm.hash);
-            if (actual !== expected) {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.hash must be SHA-${expected}.`);
-            }
-            break;
-        }
-        default:
-            throw new TypeError('CryptoKey does not support this operation');
-    }
-    if (usages.length && !usages.some((expected) => key.usages.includes(expected))) {
-        let msg = 'CryptoKey does not support this operation, its usages must include ';
-        if (usages.length > 2) {
-            const last = usages.pop();
-            msg += `one of ${usages.join(', ')}, or ${last}.`;
-        }
-        else if (usages.length === 2) {
-            msg += `one of ${usages[0]} or ${usages[1]}.`;
-        }
-        else {
-            msg += `${usages[0]}.`;
-        }
-        throw new TypeError(msg);
-    }
-}

package/dist/node/cjs/{runtime → lib}/aesgcmkw.js

@@ -1,19 +1,19 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.unwrap = exports.wrap = void 0;
-const encrypt_js_1 = require("./encrypt.js");
-const decrypt_js_1 = require("./decrypt.js");
-const iv_js_1 = require("../lib/iv.js");
-const base64url_js_1 = require("./base64url.js");
-const wrap = async (alg, key, cek, iv) => {
+const encrypt_js_1 = require("../runtime/encrypt.js");
+const decrypt_js_1 = require("../runtime/decrypt.js");
+const iv_js_1 = require("./iv.js");
+const base64url_js_1 = require("../runtime/base64url.js");
+async function wrap(alg, key, cek, iv) {
     const jweAlgorithm = alg.substr(0, 7);
     iv || (iv = (0, iv_js_1.default)(jweAlgorithm));
     const { ciphertext: encryptedKey, tag } = await (0, encrypt_js_1.default)(jweAlgorithm, cek, key, iv, new Uint8Array(0));
     return { encryptedKey, iv: (0, base64url_js_1.encode)(iv), tag: (0, base64url_js_1.encode)(tag) };
-};
+}
 exports.wrap = wrap;
-const unwrap = async (alg, key, encryptedKey, iv, tag) => {
+async function unwrap(alg, key, encryptedKey, iv, tag) {
     const jweAlgorithm = alg.substr(0, 7);
     return (0, decrypt_js_1.default)(jweAlgorithm, key, encryptedKey, iv, tag, new Uint8Array(0));
-};
+}
 exports.unwrap = unwrap;

package/dist/node/cjs/lib/cek.js

@@ -1,22 +1,25 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.bitLengths = void 0;
+exports.bitLength = void 0;
 const errors_js_1 = require("../util/errors.js");
 const random_js_1 = require("../runtime/random.js");
-const bitLengths = new Map([
-    ['A128CBC-HS256', 256],
-    ['A128GCM', 128],
-    ['A192CBC-HS384', 384],
-    ['A192GCM', 192],
-    ['A256CBC-HS512', 512],
-    ['A256GCM', 256],
-]);
-exports.bitLengths = bitLengths;
-const generateCek = (alg) => {
-    const bitLength = bitLengths.get(alg);
-    if (!bitLength) {
-        throw new errors_js_1.JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
+function bitLength(alg) {
+    switch (alg) {
+        case 'A128CBC-HS256':
+            return 256;
+        case 'A192CBC-HS384':
+            return 384;
+        case 'A256CBC-HS512':
+            return 512;
+        case 'A128GCM':
+            return 128;
+        case 'A192GCM':
+            return 192;
+        case 'A256GCM':
+            return 256;
+        default:
+            throw new errors_js_1.JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }
-    return (0, random_js_1.default)(new Uint8Array(bitLength >> 3));
-};
-exports.default = generateCek;
+}
+exports.bitLength = bitLength;
+exports.default = (alg) => (0, random_js_1.default)(new Uint8Array(bitLength(alg) >> 3));

package/dist/node/cjs/lib/check_iv_length.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const errors_js_1 = require("../util/errors.js");
 const iv_js_1 = require("./iv.js");
 const checkIvLength = (enc, iv) => {
-    if (iv.length << 3 !== iv_js_1.bitLengths.get(enc)) {
+    if (iv.length << 3 !== (0, iv_js_1.bitLength)(enc)) {
         throw new errors_js_1.JWEInvalid('Invalid Initialization Vector length');
     }
 };

package/dist/node/cjs/lib/check_key_type.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const invalid_key_input_js_1 = require("../runtime/invalid_key_input.js");
+const invalid_key_input_js_1 = require("./invalid_key_input.js");
 const is_key_like_js_1 = require("../runtime/is_key_like.js");
 const symmetricTypeCheck = (key) => {
     if (key instanceof Uint8Array)

package/dist/node/cjs/lib/crypto_key.js

@@ -0,0 +1,155 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkEncCryptoKey = exports.checkSigCryptoKey = void 0;
+const global_js_1 = require("../runtime/global.js");
+function unusable(name, prop = 'algorithm.name') {
+    return new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+}
+function isAlgorithm(algorithm, name) {
+    return algorithm.name === name;
+}
+function getHashLength(hash) {
+    return parseInt(hash.name.substr(4), 10);
+}
+function getNamedCurve(alg) {
+    switch (alg) {
+        case 'ES256':
+            return 'P-256';
+        case 'ES384':
+            return 'P-384';
+        case 'ES512':
+            return 'P-521';
+        default:
+            throw new Error('unreachable');
+    }
+}
+function checkUsage(key, usages) {
+    if (usages.length && !usages.some((expected) => key.usages.includes(expected))) {
+        let msg = 'CryptoKey does not support this operation, its usages must include ';
+        if (usages.length > 2) {
+            const last = usages.pop();
+            msg += `one of ${usages.join(', ')}, or ${last}.`;
+        }
+        else if (usages.length === 2) {
+            msg += `one of ${usages[0]} or ${usages[1]}.`;
+        }
+        else {
+            msg += `${usages[0]}.`;
+        }
+        throw new TypeError(msg);
+    }
+}
+function checkSigCryptoKey(key, alg, ...usages) {
+    switch (alg) {
+        case 'HS256':
+        case 'HS384':
+        case 'HS512': {
+            if (!isAlgorithm(key.algorithm, 'HMAC'))
+                throw unusable('HMAC');
+            const expected = parseInt(alg.substr(2), 10);
+            const actual = getHashLength(key.algorithm.hash);
+            if (actual !== expected)
+                throw unusable(`SHA-${expected}`, 'algorithm.hash');
+            break;
+        }
+        case 'RS256':
+        case 'RS384':
+        case 'RS512': {
+            if (!isAlgorithm(key.algorithm, 'RSASSA-PKCS1-v1_5'))
+                throw unusable('RSASSA-PKCS1-v1_5');
+            const expected = parseInt(alg.substr(2), 10);
+            const actual = getHashLength(key.algorithm.hash);
+            if (actual !== expected)
+                throw unusable(`SHA-${expected}`, 'algorithm.hash');
+            break;
+        }
+        case 'PS256':
+        case 'PS384':
+        case 'PS512': {
+            if (!isAlgorithm(key.algorithm, 'RSA-PSS'))
+                throw unusable('RSA-PSS');
+            const expected = parseInt(alg.substr(2), 10);
+            const actual = getHashLength(key.algorithm.hash);
+            if (actual !== expected)
+                throw unusable(`SHA-${expected}`, 'algorithm.hash');
+            break;
+        }
+        case (0, global_js_1.isNodeJs)() && 'EdDSA': {
+            if (key.algorithm.name !== 'NODE-ED25519' && key.algorithm.name !== 'NODE-ED448')
+                throw unusable('NODE-ED25519 or NODE-ED448');
+            break;
+        }
+        case (0, global_js_1.isCloudflareWorkers)() && 'EdDSA': {
+            if (!isAlgorithm(key.algorithm, 'NODE-ED25519'))
+                throw unusable('NODE-ED25519');
+            break;
+        }
+        case 'ES256':
+        case 'ES384':
+        case 'ES512': {
+            if (!isAlgorithm(key.algorithm, 'ECDSA'))
+                throw unusable('ECDSA');
+            const expected = getNamedCurve(alg);
+            const actual = key.algorithm.namedCurve;
+            if (actual !== expected)
+                throw unusable(expected, 'algorithm.namedCurve');
+            break;
+        }
+        default:
+            throw new TypeError('CryptoKey does not support this operation');
+    }
+    checkUsage(key, usages);
+}
+exports.checkSigCryptoKey = checkSigCryptoKey;
+function checkEncCryptoKey(key, alg, ...usages) {
+    switch (alg) {
+        case 'A128GCM':
+        case 'A192GCM':
+        case 'A256GCM': {
+            if (!isAlgorithm(key.algorithm, 'AES-GCM'))
+                throw unusable('AES-GCM');
+            const expected = parseInt(alg.substr(1, 3), 10);
+            const actual = key.algorithm.length;
+            if (actual !== expected)
+                throw unusable(expected, 'algorithm.length');
+            break;
+        }
+        case 'A128KW':
+        case 'A192KW':
+        case 'A256KW': {
+            if (!isAlgorithm(key.algorithm, 'AES-KW'))
+                throw unusable('AES-KW');
+            const expected = parseInt(alg.substr(1, 3), 10);
+            const actual = key.algorithm.length;
+            if (actual !== expected)
+                throw unusable(expected, 'algorithm.length');
+            break;
+        }
+        case 'ECDH-ES':
+            if (!isAlgorithm(key.algorithm, 'ECDH'))
+                throw unusable('ECDH');
+            break;
+        case 'PBES2-HS256+A128KW':
+        case 'PBES2-HS384+A192KW':
+        case 'PBES2-HS512+A256KW':
+            if (!isAlgorithm(key.algorithm, 'PBKDF2'))
+                throw unusable('PBKDF2');
+            break;
+        case 'RSA-OAEP':
+        case 'RSA-OAEP-256':
+        case 'RSA-OAEP-384':
+        case 'RSA-OAEP-512': {
+            if (!isAlgorithm(key.algorithm, 'RSA-OAEP'))
+                throw unusable('RSA-OAEP');
+            const expected = parseInt(alg.substr(9), 10) || 1;
+            const actual = getHashLength(key.algorithm.hash);
+            if (actual !== expected)
+                throw unusable(`SHA-${expected}`, 'algorithm.hash');
+            break;
+        }
+        default:
+            throw new TypeError('CryptoKey does not support this operation');
+    }
+    checkUsage(key, usages);
+}
+exports.checkEncCryptoKey = checkEncCryptoKey;

package/dist/node/cjs/lib/decrypt_key_management.js

@@ -4,13 +4,13 @@ const aeskw_js_1 = require("../runtime/aeskw.js");
 const ECDH = require("../runtime/ecdhes.js");
 const pbes2kw_js_1 = require("../runtime/pbes2kw.js");
 const rsaes_js_1 = require("../runtime/rsaes.js");
-const aesgcmkw_js_1 = require("../runtime/aesgcmkw.js");
 const base64url_js_1 = require("../runtime/base64url.js");
 const errors_js_1 = require("../util/errors.js");
 const cek_js_1 = require("../lib/cek.js");
 const import_js_1 = require("../key/import.js");
 const check_key_type_js_1 = require("./check_key_type.js");
 const is_object_js_1 = require("./is_object.js");
+const aesgcmkw_js_1 = require("./aesgcmkw.js");
 async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
     (0, check_key_type_js_1.default)(alg, key, 'decrypt');
     switch (alg) {
@@ -42,7 +42,7 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
                     throw new errors_js_1.JWEInvalid(`JOSE Header "apv" (Agreement PartyVInfo) invalid`);
                 partyVInfo = (0, base64url_js_1.decode)(joseHeader.apv);
             }
-            const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, parseInt(alg.substr(-5, 3), 10) || cek_js_1.bitLengths.get(joseHeader.enc), partyUInfo, partyVInfo);
+            const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, parseInt(alg.substr(-5, 3), 10) || (0, cek_js_1.bitLength)(joseHeader.enc), partyUInfo, partyVInfo);
             if (alg === 'ECDH-ES')
                 return sharedSecret;
             if (encryptedKey === undefined)

package/dist/node/cjs/lib/encrypt_key_management.js

@@ -4,12 +4,12 @@ const aeskw_js_1 = require("../runtime/aeskw.js");
 const ECDH = require("../runtime/ecdhes.js");
 const pbes2kw_js_1 = require("../runtime/pbes2kw.js");
 const rsaes_js_1 = require("../runtime/rsaes.js");
-const aesgcmkw_js_1 = require("../runtime/aesgcmkw.js");
 const base64url_js_1 = require("../runtime/base64url.js");
 const cek_js_1 = require("../lib/cek.js");
 const errors_js_1 = require("../util/errors.js");
 const export_js_1 = require("../key/export.js");
 const check_key_type_js_1 = require("./check_key_type.js");
+const aesgcmkw_js_1 = require("./aesgcmkw.js");
 async function encryptKeyManagement(alg, enc, key, providedCek, providedParameters = {}) {
     let encryptedKey;
     let parameters;
@@ -31,7 +31,7 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
             let { epk: ephemeralKey } = providedParameters;
             ephemeralKey || (ephemeralKey = await ECDH.generateEpk(key));
             const { x, y, crv, kty } = await (0, export_js_1.exportJWK)(ephemeralKey);
-            const sharedSecret = await ECDH.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, parseInt(alg.substr(-5, 3), 10) || cek_js_1.bitLengths.get(enc), apu, apv);
+            const sharedSecret = await ECDH.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, parseInt(alg.substr(-5, 3), 10) || (0, cek_js_1.bitLength)(enc), apu, apv);
             parameters = { epk: { x, y, crv, kty } };
             if (apu)
                 parameters.apu = (0, base64url_js_1.encode)(apu);

package/dist/node/cjs/{runtime → lib}/invalid_key_input.js

@@ -1,6 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const util_1 = require("util");
 exports.default = (actual, ...types) => {
     let msg = 'Key must be ';
     if (types.length > 2) {
@@ -23,16 +22,6 @@ exports.default = (actual, ...types) => {
         if (actual.constructor && actual.constructor.name) {
             msg += ` Received an instance of ${actual.constructor.name}`;
         }
-        else {
-            const inspected = (0, util_1.inspect)(actual, { depth: -1 });
-            msg += ` Received ${inspected}`;
-        }
-    }
-    else {
-        let inspected = (0, util_1.inspect)(actual, { colors: false });
-        if (inspected.length > 25)
-            inspected = `${inspected.slice(0, 25)}...`;
-        msg += ` Received type ${typeof actual} (${inspected})`;
     }
     return msg;
 };