jose 4.1.4 → 4.3.0

package/dist/node/esm/runtime/ecdhes.js

@@ -8,8 +8,9 @@ import { isCryptoKey } from './webcrypto.js';
 import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
 const generateKeyPair = promisify(generateKeyPairCb);
-export const deriveKey = async (publicKee, privateKee, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) => {
+export const deriveKey = (publicKee, privateKee, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) => {
     let publicKey;
     if (isCryptoKey(publicKee)) {
         checkEncCryptoKey(publicKee, 'ECDH-ES');
@@ -19,7 +20,7 @@ export const deriveKey = async (publicKee, privateKee, algorithm, keyLength, apu
         publicKey = publicKee;
     }
     else {
-        throw new TypeError(invalidKeyInput(publicKee, 'KeyObject', 'CryptoKey'));
+        throw new TypeError(invalidKeyInput(publicKee, ...types));
     }
     let privateKey;
     if (isCryptoKey(privateKee)) {
@@ -30,7 +31,7 @@ export const deriveKey = async (publicKee, privateKee, algorithm, keyLength, apu
         privateKey = privateKee;
     }
     else {
-        throw new TypeError(invalidKeyInput(privateKee, 'KeyObject', 'CryptoKey'));
+        throw new TypeError(invalidKeyInput(privateKee, ...types));
     }
     const value = concat(lengthAndInput(encoder.encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength));
     const sharedSecret = diffieHellman({ privateKey, publicKey });
@@ -45,7 +46,7 @@ export const generateEpk = async (kee) => {
         key = kee;
     }
     else {
-        throw new TypeError(invalidKeyInput(kee, 'KeyObject', 'CryptoKey'));
+        throw new TypeError(invalidKeyInput(kee, ...types));
     }
     switch (key.asymmetricKeyType) {
         case 'x25519':

package/dist/node/esm/runtime/encrypt.js

@@ -9,7 +9,8 @@ import isKeyObject from './is_key_object.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
 import { JOSENotSupported } from '../util/errors.js';
 import supported from './ciphers.js';
-async function cbcEncrypt(enc, plaintext, cek, iv, aad) {
+import { types } from './is_key_like.js';
+function cbcEncrypt(enc, plaintext, cek, iv, aad) {
     const keySize = parseInt(enc.substr(1, 3), 10);
     if (isKeyObject(cek)) {
         cek = cek.export();
@@ -26,7 +27,7 @@ async function cbcEncrypt(enc, plaintext, cek, iv, aad) {
     const tag = cbcTag(aad, iv, ciphertext, macSize, macKey, keySize);
     return { ciphertext, tag };
 }
-async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
+function gcmEncrypt(enc, plaintext, cek, iv, aad) {
     const keySize = parseInt(enc.substr(1, 3), 10);
     const algorithm = `aes-${keySize}-gcm`;
     if (!supported(algorithm)) {
@@ -36,11 +37,12 @@ async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
     if (aad.byteLength) {
         cipher.setAAD(aad, { plaintextLength: plaintext.length });
     }
-    const ciphertext = concat(cipher.update(plaintext), cipher.final());
+    const ciphertext = cipher.update(plaintext);
+    cipher.final();
     const tag = cipher.getAuthTag();
     return { ciphertext, tag };
 }
-const encrypt = async (enc, plaintext, cek, iv, aad) => {
+const encrypt = (enc, plaintext, cek, iv, aad) => {
     let key;
     if (isCryptoKey(cek)) {
         checkEncCryptoKey(cek, enc, 'encrypt');
@@ -50,7 +52,7 @@ const encrypt = async (enc, plaintext, cek, iv, aad) => {
         key = cek;
     }
     else {
-        throw new TypeError(invalidKeyInput(cek, 'KeyObject', 'CryptoKey', 'Uint8Array'));
+        throw new TypeError(invalidKeyInput(cek, ...types, 'Uint8Array'));
     }
     checkCekLength(enc, key);
     checkIvLength(enc, iv);

package/dist/node/esm/runtime/get_named_curve.js

@@ -4,6 +4,7 @@ import { JOSENotSupported } from '../util/errors.js';
 import { isCryptoKey } from './webcrypto.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
 const p256 = Buffer.from([42, 134, 72, 206, 61, 3, 1, 7]);
 const p384 = Buffer.from([43, 129, 4, 0, 34]);
 const p521 = Buffer.from([43, 129, 4, 0, 35]);
@@ -33,7 +34,7 @@ const getNamedCurve = (kee, raw) => {
         key = kee;
     }
     else {
-        throw new TypeError(invalidKeyInput(kee, 'KeyObject', 'CryptoKey'));
+        throw new TypeError(invalidKeyInput(kee, ...types));
     }
     if (key.type === 'secret') {
         throw new TypeError('only "private" or "public" type keys can be used for this operation');

package/dist/node/esm/runtime/get_sign_verify_key.js

@@ -3,10 +3,11 @@ import { isCryptoKey } from './webcrypto.js';
 import { checkSigCryptoKey } from '../lib/crypto_key.js';
 import getSecretKey from './secret_key.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
 export default function getSignVerifyKey(alg, key, usage) {
     if (key instanceof Uint8Array) {
         if (!alg.startsWith('HS')) {
-            throw new TypeError(invalidKeyInput(key, 'KeyObject', 'CryptoKey'));
+            throw new TypeError(invalidKeyInput(key, ...types));
         }
         return getSecretKey(key);
     }
@@ -17,5 +18,5 @@ export default function getSignVerifyKey(alg, key, usage) {
         checkSigCryptoKey(key, alg, usage);
         return KeyObject.from(key);
     }
-    throw new TypeError(invalidKeyInput(key, 'KeyObject', 'CryptoKey', 'Uint8Array'));
+    throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
 }

package/dist/node/esm/runtime/key_to_jwk.js

@@ -6,6 +6,7 @@ import getNamedCurve from './get_named_curve.js';
 import { isCryptoKey } from './webcrypto.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
 const [major, minor] = process.version
     .substr(1)
     .split('.')
@@ -29,7 +30,7 @@ const keyToJWK = (key) => {
         };
     }
     else {
-        throw new TypeError(invalidKeyInput(key, 'KeyObject', 'CryptoKey', 'Uint8Array'));
+        throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
     }
     if (jwkExportSupported) {
         return keyObject.export({ format: 'jwk' });

package/dist/node/esm/runtime/pbes2kw.js

@@ -9,6 +9,7 @@ import { isCryptoKey } from './webcrypto.js';
 import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
 const pbkdf2 = promisify(pbkdf2cb);
 function getPassword(key, alg) {
     if (isKeyObject(key)) {
@@ -21,7 +22,7 @@ function getPassword(key, alg) {
         checkEncCryptoKey(key, alg, 'deriveBits', 'deriveKey');
         return KeyObject.from(key).export();
     }
-    throw new TypeError(invalidKeyInput(key, 'KeyObject', 'CryptoKey', 'Uint8Array'));
+    throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
 }
 export const encrypt = async (alg, key, cek, p2c = Math.floor(Math.random() * 2049) + 2048, p2s = random(new Uint8Array(16))) => {
     checkP2s(p2s);

package/dist/node/esm/runtime/rsaes.js

@@ -4,6 +4,7 @@ import { isCryptoKey } from './webcrypto.js';
 import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
 const checkKey = (key, alg) => {
     if (key.asymmetricKeyType !== 'rsa') {
         throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa');
@@ -45,16 +46,16 @@ function ensureKeyObject(key, alg, ...usages) {
         checkEncCryptoKey(key, alg, ...usages);
         return KeyObject.from(key);
     }
-    throw new TypeError(invalidKeyInput(key, 'KeyObject', 'CryptoKey'));
+    throw new TypeError(invalidKeyInput(key, ...types));
 }
-export const encrypt = async (alg, key, cek) => {
+export const encrypt = (alg, key, cek) => {
     const padding = resolvePadding(alg);
     const oaepHash = resolveOaepHash(alg);
     const keyObject = ensureKeyObject(key, alg, 'wrapKey', 'encrypt');
     checkKey(keyObject, alg);
     return publicEncrypt({ key: keyObject, oaepHash, padding }, cek);
 };
-export const decrypt = async (alg, key, encryptedKey) => {
+export const decrypt = (alg, key, encryptedKey) => {
     const padding = resolvePadding(alg);
     const oaepHash = resolveOaepHash(alg);
     const keyObject = ensureKeyObject(key, alg, 'unwrapKey', 'decrypt');

package/dist/types/index.d.ts

@@ -4,6 +4,8 @@ export { flattenedDecrypt } from './jwe/flattened/decrypt';
 export type { FlattenedDecryptGetKey } from './jwe/flattened/decrypt';
 export { generalDecrypt } from './jwe/general/decrypt';
 export type { GeneralDecryptGetKey } from './jwe/general/decrypt';
+export { GeneralEncrypt } from './jwe/general/encrypt';
+export type { Recipient } from './jwe/general/encrypt';
 export { compactVerify } from './jws/compact/verify';
 export type { CompactVerifyGetKey } from './jws/compact/verify';
 export { flattenedVerify } from './jws/flattened/verify';
@@ -40,4 +42,4 @@ export type { GenerateKeyPairResult, GenerateKeyPairOptions } from './key/genera
 export { generateSecret } from './key/generate_secret';
 export type { GenerateSecretOptions } from './key/generate_secret';
 export * as base64url from './util/base64url';
-export type { KeyLike, JWK, FlattenedJWSInput, GeneralJWSInput, FlattenedJWS, GeneralJWS, JoseHeaderParameters, JWSHeaderParameters, JWEKeyManagementHeaderParameters, FlattenedJWE, GeneralJWE, JWEHeaderParameters, CritOption, DecryptOptions, EncryptOptions, JWTClaimVerificationOptions, VerifyOptions, SignOptions, JWTPayload, DeflateFunction, InflateFunction, FlattenedDecryptResult, GeneralDecryptResult, CompactDecryptResult, FlattenedVerifyResult, GeneralVerifyResult, CompactVerifyResult, JWTVerifyResult, JWTDecryptResult, ResolvedKey, } from './types';
+export type { KeyLike, JWK, FlattenedJWSInput, GeneralJWSInput, FlattenedJWS, GeneralJWS, JoseHeaderParameters, JWSHeaderParameters, JWEKeyManagementHeaderParameters, FlattenedJWE, GeneralJWE, JWEHeaderParameters, CritOption, DeflateOption, DecryptOptions, EncryptOptions, JWTClaimVerificationOptions, VerifyOptions, SignOptions, JWTPayload, DeflateFunction, InflateFunction, FlattenedDecryptResult, GeneralDecryptResult, CompactDecryptResult, FlattenedVerifyResult, GeneralVerifyResult, CompactVerifyResult, JWTVerifyResult, JWTDecryptResult, ResolvedKey, } from './types';

package/dist/types/jwe/flattened/encrypt.d.ts

@@ -1,4 +1,5 @@
 import type { KeyLike, FlattenedJWE, JWEHeaderParameters, JWEKeyManagementHeaderParameters, EncryptOptions } from '../../types';
+export declare const unprotected: unique symbol;
 export declare class FlattenedEncrypt {
     private _plaintext;
     private _protectedHeader;

package/dist/types/jwe/general/encrypt.d.ts

@@ -0,0 +1,20 @@
+import type { KeyLike, GeneralJWE, JWEHeaderParameters, CritOption, DeflateOption } from '../../types';
+export interface Recipient {
+    setUnprotectedHeader(unprotectedHeader: JWEHeaderParameters): Recipient;
+    addRecipient(...args: Parameters<GeneralEncrypt['addRecipient']>): Recipient;
+    encrypt(...args: Parameters<GeneralEncrypt['encrypt']>): Promise<GeneralJWE>;
+    done(): GeneralEncrypt;
+}
+export declare class GeneralEncrypt {
+    private _plaintext;
+    private _recipients;
+    private _protectedHeader;
+    private _unprotectedHeader;
+    private _aad;
+    constructor(plaintext: Uint8Array);
+    addRecipient(key: KeyLike | Uint8Array, options?: CritOption): Recipient;
+    setProtectedHeader(protectedHeader: JWEHeaderParameters): this;
+    setSharedUnprotectedHeader(sharedUnprotectedHeader: JWEHeaderParameters): this;
+    setAdditionalAuthenticatedData(aad: Uint8Array): this;
+    encrypt(options?: DeflateOption): Promise<GeneralJWE>;
+}

package/dist/types/jws/general/sign.d.ts

@@ -2,6 +2,9 @@ import type { KeyLike, GeneralJWS, JWSHeaderParameters, SignOptions } from '../.
 export interface Signature {
     setProtectedHeader(protectedHeader: JWSHeaderParameters): Signature;
     setUnprotectedHeader(unprotectedHeader: JWSHeaderParameters): Signature;
+    addSignature(...args: Parameters<GeneralSign['addSignature']>): Signature;
+    sign(...args: Parameters<GeneralSign['sign']>): Promise<GeneralJWS>;
+    done(): GeneralSign;
 }
 export declare class GeneralSign {
     private _payload;

package/dist/types/types.d.ts

@@ -35,20 +35,16 @@
  *
  * @example Import a PEM-encoded SPKI Public Key
  * ```js
- * import { importSPKI } from 'jose'
- *
  * const algorithm = 'ES256'
  * const spki = `-----BEGIN PUBLIC KEY-----
  * MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEFlHHWfLk0gLBbsLTcuCrbCqoHqmM
  * YJepMC+Q+Dd6RBmBiA41evUsNMwLeN+PNFqib+xwi9JkJ8qhZkq8Y/IzGg==
  * -----END PUBLIC KEY-----`
- * const ecPublicKey = await importSPKI(spki, algorithm)
+ * const ecPublicKey = await jose.importSPKI(spki, algorithm)
  * ```
  *
  * @example Import a X.509 Certificate
  * ```js
- * import { importX509 } from 'jose'
- *
  * const algorithm = 'ES256'
  * const x509 = `-----BEGIN CERTIFICATE-----
  * MIIBXjCCAQSgAwIBAgIGAXvykuMKMAoGCCqGSM49BAMCMDYxNDAyBgNVBAMMK3Np
@@ -60,34 +56,30 @@
  * 1yyMTRe66MhEXID9+uVub7woMkNYd0LhSHwKSPMUUTkCIFQGsfm1ecXOpeGOufAh
  * v+A1QWZMuTWqYt+uh/YSRNDn
  * -----END CERTIFICATE-----`
- * const ecPublicKey = await importX509(x509, algorithm)
+ * const ecPublicKey = await jose.importX509(x509, algorithm)
  * ```
  *
  * @example Import a PEM-encoded PKCS8 Private Key
  * ```js
- * import { importPKCS8 } from 'jose'
- *
  * const algorithm = 'ES256'
  * const pkcs8 = `-----BEGIN PRIVATE KEY-----
  * MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgiyvo0X+VQ0yIrOaN
  * nlrnUclopnvuuMfoc8HHly3505OhRANCAAQWUcdZ8uTSAsFuwtNy4KtsKqgeqYxg
  * l6kwL5D4N3pEGYGIDjV69Sw0zAt43480WqJv7HCL0mQnyqFmSrxj8jMa
  * -----END PRIVATE KEY-----`
- * const ecPrivateKey = await importPKCS8(pkcs8, algorithm)
+ * const ecPrivateKey = await jose.importPKCS8(pkcs8, algorithm)
  * ```
  *
  * @example Import a JSON Web Key (JWK)
  * ```js
- * import { importJWK } from 'jose'
- *
- * const ecPublicKey = await importJWK({
+ * const ecPublicKey = await jose.importJWK({
  *   crv: 'P-256',
  *   kty: 'EC',
  *   x: 'ySK38C1jBdLwDsNWKzzBHqKYEE5Cgv-qjWvorUXk9fw',
  *   y: '_LeQBw07cf5t57Iavn4j-BqJsAD1dpoz8gokd3sBsOo'
  * }, 'ES256')
  *
- * const rsaPublicKey = await importJWK({
+ * const rsaPublicKey = await jose.importJWK({
  *   kty: 'RSA',
  *   e: 'AQAB',
  *   n: '12oBZRhCiZFJLcPg59LkZZ9mdhSMTKAQZYq32k_ti5SBB6jerkh-WzOMAO664r_qyLkqHUSp3u5SbXtseZEpN3XPWGKSxjsy-1JyEFTdLSYe6f9gfrmxkUF_7DTpq0gn6rntP05g2-wFW50YO7mosfdslfrTJYWHFhJALabAeYirYD7-9kqq9ebfFMF4sRRELbv9oi36As6Q9B3Qb5_C1rAzqfao_PCsf9EPsTZsVVVkA5qoIAr47lo1ipfiBPxUCCNSdvkmDTYgvvRm6ZoMjFbvOtgyts55fXKdMWv7I9HMD5HwE9uW839PWA514qhbcIsXEYSFMPMV6fnlsiZvQQ'
@@ -200,9 +192,10 @@ export interface DecryptOptions extends CritOption {
   contentEncryptionAlgorithms?: string[]
   inflateRaw?: InflateFunction
 }
-export interface EncryptOptions extends CritOption {
+export interface DeflateOption {
   deflateRaw?: DeflateFunction
 }
+export interface EncryptOptions extends CritOption, DeflateOption {}
 export interface JWTClaimVerificationOptions {
   audience?: string | string[]
   clockTolerance?: string | number

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "4.1.4",
+  "version": "4.3.0",
   "description": "'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto",
   "keywords": [
     "browser",