jose 4.2.0 → 4.3.3

package/README.md

@@ -25,6 +25,21 @@ If you or your business use `jose`, please consider becoming a [sponsor][support
 
 ## Documentation
 
+**`example`** ESM import
+```js
+import * as jose from 'jose'
+```
+
+**`example`** CJS require
+```js
+const jose = require('jose')
+```
+
+**`example`** Deno import
+```js
+import * as jose from 'https://deno.land/x/jose/index.ts'
+```
+
 - JSON Web Tokens (JWT)
   - [Signing](docs/classes/jwt_sign.SignJWT.md#readme)
   - [Verification & Claims Set Validation](docs/functions/jwt_verify.jwtVerify.md#readme)

package/dist/browser/jwe/general/encrypt.js

@@ -5,20 +5,27 @@ import isDisjoint from '../../lib/is_disjoint.js';
 import encryptKeyManagement from '../../lib/encrypt_key_management.js';
 import { encode as base64url } from '../../runtime/base64url.js';
 import validateCrit from '../../lib/validate_crit.js';
-const recipientRef = new WeakMap();
 class IndividualRecipient {
+    constructor(enc, key, options) {
+        this.parent = enc;
+        this.key = key;
+        this.options = options;
+    }
     setUnprotectedHeader(unprotectedHeader) {
-        if (this._unprotectedHeader) {
+        if (this.unprotectedHeader) {
             throw new TypeError('setUnprotectedHeader can only be called once');
         }
-        this._unprotectedHeader = unprotectedHeader;
+        this.unprotectedHeader = unprotectedHeader;
         return this;
     }
-    set _unprotectedHeader(value) {
-        recipientRef.get(this).unprotectedHeader = value;
+    addRecipient(...args) {
+        return this.parent.addRecipient(...args);
+    }
+    encrypt(...args) {
+        return this.parent.encrypt(...args);
     }
-    get _unprotectedHeader() {
-        return recipientRef.get(this).unprotectedHeader;
+    done() {
+        return this.parent;
     }
 }
 export class GeneralEncrypt {
@@ -27,8 +34,7 @@ export class GeneralEncrypt {
         this._plaintext = plaintext;
     }
     addRecipient(key, options) {
-        const recipient = new IndividualRecipient();
-        recipientRef.set(recipient, { key, options: { crit: options === null || options === void 0 ? void 0 : options.crit } });
+        const recipient = new IndividualRecipient(this, key, { crit: options === null || options === void 0 ? void 0 : options.crit });
         this._recipients.push(recipient);
         return recipient;
     }
@@ -51,19 +57,19 @@ export class GeneralEncrypt {
         return this;
     }
     async encrypt(options) {
-        var _a, _b;
+        var _a, _b, _c;
         if (!this._recipients.length) {
             throw new JWEInvalid('at least one recipient must be added');
         }
         options = { deflateRaw: options === null || options === void 0 ? void 0 : options.deflateRaw };
         if (this._recipients.length === 1) {
-            const { unprotectedHeader, options: recipientOpts, key, } = recipientRef.get(this._recipients[0]);
+            const [recipient] = this._recipients;
             const flattened = await new FlattenedEncrypt(this._plaintext)
                 .setAdditionalAuthenticatedData(this._aad)
                 .setProtectedHeader(this._protectedHeader)
                 .setSharedUnprotectedHeader(this._unprotectedHeader)
-                .setUnprotectedHeader(unprotectedHeader)
-                .encrypt(key, { ...recipientOpts, ...options });
+                .setUnprotectedHeader(recipient.unprotectedHeader)
+                .encrypt(recipient.key, { ...recipient.options, ...options });
             let jwe = {
                 ciphertext: flattened.ciphertext,
                 iv: flattened.iv,
@@ -85,14 +91,13 @@ export class GeneralEncrypt {
         let enc;
         for (let i = 0; i < this._recipients.length; i++) {
             const recipient = this._recipients[i];
-            const { unprotectedHeader, options: recipientOpts } = recipientRef.get(recipient);
-            if (!isDisjoint(this._protectedHeader, this._unprotectedHeader, unprotectedHeader)) {
+            if (!isDisjoint(this._protectedHeader, this._unprotectedHeader, recipient.unprotectedHeader)) {
                 throw new JWEInvalid('JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint');
             }
             const joseHeader = {
                 ...this._protectedHeader,
                 ...this._unprotectedHeader,
-                ...unprotectedHeader,
+                ...recipient.unprotectedHeader,
             };
             const { alg } = joseHeader;
             if (typeof alg !== 'string' || !alg) {
@@ -110,7 +115,7 @@ export class GeneralEncrypt {
             else if (enc !== joseHeader.enc) {
                 throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');
             }
-            validateCrit(JWEInvalid, new Map(), recipientOpts === null || recipientOpts === void 0 ? void 0 : recipientOpts.crit, this._protectedHeader, joseHeader);
+            validateCrit(JWEInvalid, new Map(), recipient.options.crit, this._protectedHeader, joseHeader);
             if (joseHeader.zip !== undefined) {
                 if (!this._protectedHeader || !this._protectedHeader.zip) {
                     throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
@@ -128,15 +133,18 @@ export class GeneralEncrypt {
             const recipient = this._recipients[i];
             const target = {};
             jwe.recipients.push(target);
-            const { unprotectedHeader, options: recipientOpts, key } = recipientRef.get(recipient);
             if (i === 0) {
                 const flattened = await new FlattenedEncrypt(this._plaintext)
                     .setAdditionalAuthenticatedData(this._aad)
                     .setContentEncryptionKey(cek)
                     .setProtectedHeader(this._protectedHeader)
                     .setSharedUnprotectedHeader(this._unprotectedHeader)
-                    .setUnprotectedHeader(unprotectedHeader)
-                    .encrypt(key, { ...recipientOpts, ...options, [unprotected]: true });
+                    .setUnprotectedHeader(recipient.unprotectedHeader)
+                    .encrypt(recipient.key, {
+                    ...recipient.options,
+                    ...options,
+                    [unprotected]: true,
+                });
                 jwe.ciphertext = flattened.ciphertext;
                 jwe.iv = flattened.iv;
                 jwe.tag = flattened.tag;
@@ -151,10 +159,12 @@ export class GeneralEncrypt {
                     target.header = flattened.header;
                 continue;
             }
-            const { encryptedKey, parameters } = await encryptKeyManagement((unprotectedHeader === null || unprotectedHeader === void 0 ? void 0 : unprotectedHeader.alg) || ((_a = this._protectedHeader) === null || _a === void 0 ? void 0 : _a.alg) || ((_b = this._unprotectedHeader) === null || _b === void 0 ? void 0 : _b.alg), enc, key, cek);
+            const { encryptedKey, parameters } = await encryptKeyManagement(((_a = recipient.unprotectedHeader) === null || _a === void 0 ? void 0 : _a.alg) ||
+                ((_b = this._protectedHeader) === null || _b === void 0 ? void 0 : _b.alg) ||
+                ((_c = this._unprotectedHeader) === null || _c === void 0 ? void 0 : _c.alg), enc, recipient.key, cek);
             target.encrypted_key = base64url(encryptedKey);
-            if (unprotectedHeader || parameters)
-                target.header = { ...unprotectedHeader, ...parameters };
+            if (recipient.unprotectedHeader || parameters)
+                target.header = { ...recipient.unprotectedHeader, ...parameters };
         }
         return jwe;
     }

package/dist/browser/jwks/remote.js

@@ -37,17 +37,21 @@ class RemoteJWKSet {
         }
         return Date.now() < this._cooldownStarted + this._cooldownDuration;
     }
-    async getKey(protectedHeader) {
+    async getKey(protectedHeader, token) {
+        const joseHeader = {
+            ...protectedHeader,
+            ...token.header,
+        };
         if (!this._jwks) {
             await this.reload();
         }
         const candidates = this._jwks.keys.filter((jwk) => {
-            let candidate = jwk.kty === getKtyFromAlg(protectedHeader.alg);
-            if (candidate && typeof protectedHeader.kid === 'string') {
-                candidate = protectedHeader.kid === jwk.kid;
+            let candidate = jwk.kty === getKtyFromAlg(joseHeader.alg);
+            if (candidate && typeof joseHeader.kid === 'string') {
+                candidate = joseHeader.kid === jwk.kid;
             }
             if (candidate && typeof jwk.alg === 'string') {
-                candidate = protectedHeader.alg === jwk.alg;
+                candidate = joseHeader.alg === jwk.alg;
             }
             if (candidate && typeof jwk.use === 'string') {
                 candidate = jwk.use === 'sig';
@@ -55,11 +59,11 @@ class RemoteJWKSet {
             if (candidate && Array.isArray(jwk.key_ops)) {
                 candidate = jwk.key_ops.includes('verify');
             }
-            if (candidate && protectedHeader.alg === 'EdDSA') {
+            if (candidate && joseHeader.alg === 'EdDSA') {
                 candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
             }
             if (candidate) {
-                switch (protectedHeader.alg) {
+                switch (joseHeader.alg) {
                     case 'ES256':
                         candidate = jwk.crv === 'P-256';
                         break;
@@ -81,7 +85,7 @@ class RemoteJWKSet {
         if (length === 0) {
             if (this.coolingDown() === false) {
                 await this.reload();
-                return this.getKey(protectedHeader);
+                return this.getKey(protectedHeader, token);
             }
             throw new JWKSNoMatchingKey();
         }
@@ -89,14 +93,14 @@ class RemoteJWKSet {
             throw new JWKSMultipleMatchingKeys();
         }
         const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
-        if (cached[protectedHeader.alg] === undefined) {
-            const keyObject = await importJWK({ ...jwk, ext: true }, protectedHeader.alg);
+        if (cached[joseHeader.alg] === undefined) {
+            const keyObject = await importJWK({ ...jwk, ext: true }, joseHeader.alg);
             if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
                 throw new JWKSInvalid('JSON Web Key Set members must be public keys');
             }
-            cached[protectedHeader.alg] = keyObject;
+            cached[joseHeader.alg] = keyObject;
         }
-        return cached[protectedHeader.alg];
+        return cached[joseHeader.alg];
     }
     async reload() {
         if (!this._pendingFetch) {

package/dist/browser/jws/general/sign.js

@@ -1,32 +1,33 @@
 import { FlattenedSign } from '../flattened/sign.js';
 import { JWSInvalid } from '../../util/errors.js';
-const signatureRef = new WeakMap();
 class IndividualSignature {
+    constructor(sig, key, options) {
+        this.parent = sig;
+        this.key = key;
+        this.options = options;
+    }
     setProtectedHeader(protectedHeader) {
-        if (this._protectedHeader) {
+        if (this.protectedHeader) {
             throw new TypeError('setProtectedHeader can only be called once');
         }
-        this._protectedHeader = protectedHeader;
+        this.protectedHeader = protectedHeader;
         return this;
     }
     setUnprotectedHeader(unprotectedHeader) {
-        if (this._unprotectedHeader) {
+        if (this.unprotectedHeader) {
             throw new TypeError('setUnprotectedHeader can only be called once');
         }
-        this._unprotectedHeader = unprotectedHeader;
+        this.unprotectedHeader = unprotectedHeader;
         return this;
     }
-    set _protectedHeader(value) {
-        signatureRef.get(this).protectedHeader = value;
-    }
-    get _protectedHeader() {
-        return signatureRef.get(this).protectedHeader;
+    addSignature(...args) {
+        return this.parent.addSignature(...args);
     }
-    set _unprotectedHeader(value) {
-        signatureRef.get(this).unprotectedHeader = value;
+    sign(...args) {
+        return this.parent.sign(...args);
     }
-    get _unprotectedHeader() {
-        return signatureRef.get(this).unprotectedHeader;
+    done() {
+        return this.parent;
     }
 }
 export class GeneralSign {
@@ -35,8 +36,7 @@ export class GeneralSign {
         this._payload = payload;
     }
     addSignature(key, options) {
-        const signature = new IndividualSignature();
-        signatureRef.set(signature, { key, options });
+        const signature = new IndividualSignature(this, key, options);
         this._signatures.push(signature);
         return signature;
     }
@@ -48,23 +48,19 @@ export class GeneralSign {
             signatures: [],
             payload: '',
         };
-        let payloads = new Set();
-        await Promise.all(this._signatures.map(async (sig) => {
-            const { protectedHeader, unprotectedHeader, options, key } = signatureRef.get(sig);
+        for (let i = 0; i < this._signatures.length; i++) {
+            const signature = this._signatures[i];
             const flattened = new FlattenedSign(this._payload);
-            if (protectedHeader) {
-                flattened.setProtectedHeader(protectedHeader);
+            flattened.setProtectedHeader(signature.protectedHeader);
+            flattened.setUnprotectedHeader(signature.unprotectedHeader);
+            const { payload, ...rest } = await flattened.sign(signature.key, signature.options);
+            if (i === 0) {
+                jws.payload = payload;
             }
-            if (unprotectedHeader) {
-                flattened.setUnprotectedHeader(unprotectedHeader);
+            else if (jws.payload !== payload) {
+                throw new JWSInvalid('inconsistent use of JWS Unencoded Payload Option (RFC7797)');
             }
-            const { payload, ...rest } = await flattened.sign(key, options);
-            payloads.add(payload);
-            jws.payload = payload;
             jws.signatures.push(rest);
-        }));
-        if (payloads.size !== 1) {
-            throw new JWSInvalid('inconsistent use of JWS Unencoded Payload Option (RFC7797)');
         }
         return jws;
     }

package/dist/browser/lib/cek.js

@@ -2,18 +2,17 @@ import { JOSENotSupported } from '../util/errors.js';
 import random from '../runtime/random.js';
 export function bitLength(alg) {
     switch (alg) {
-        case 'A128CBC-HS256':
-            return 256;
-        case 'A192CBC-HS384':
-            return 384;
-        case 'A256CBC-HS512':
-            return 512;
         case 'A128GCM':
             return 128;
         case 'A192GCM':
             return 192;
         case 'A256GCM':
+        case 'A128CBC-HS256':
             return 256;
+        case 'A192CBC-HS384':
+            return 384;
+        case 'A256CBC-HS512':
+            return 512;
         default:
             throw new JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }

package/dist/browser/lib/decrypt_key_management.js

@@ -40,7 +40,7 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
                     throw new JWEInvalid(`JOSE Header "apv" (Agreement PartyVInfo) invalid`);
                 partyVInfo = base64url(joseHeader.apv);
             }
-            const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, parseInt(alg.substr(-5, 3), 10) || cekLength(joseHeader.enc), partyUInfo, partyVInfo);
+            const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, alg === 'ECDH-ES' ? cekLength(joseHeader.enc) : parseInt(alg.substr(-5, 3), 10), partyUInfo, partyVInfo);
             if (alg === 'ECDH-ES')
                 return sharedSecret;
             if (encryptedKey === undefined)

package/dist/browser/lib/encrypt_key_management.js

@@ -29,7 +29,7 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
             let { epk: ephemeralKey } = providedParameters;
             ephemeralKey || (ephemeralKey = await ECDH.generateEpk(key));
             const { x, y, crv, kty } = await exportJWK(ephemeralKey);
-            const sharedSecret = await ECDH.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, parseInt(alg.substr(-5, 3), 10) || cekLength(enc), apu, apv);
+            const sharedSecret = await ECDH.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, alg === 'ECDH-ES' ? cekLength(enc) : parseInt(alg.substr(-5, 3), 10), apu, apv);
             parameters = { epk: { x, y, crv, kty } };
             if (apu)
                 parameters.apu = base64url(apu);

package/dist/browser/lib/iv.js

@@ -2,24 +2,17 @@ import { JOSENotSupported } from '../util/errors.js';
 import random from '../runtime/random.js';
 export function bitLength(alg) {
     switch (alg) {
-        case 'A128CBC-HS256':
-            return 128;
         case 'A128GCM':
-            return 96;
         case 'A128GCMKW':
-            return 96;
-        case 'A192CBC-HS384':
-            return 128;
         case 'A192GCM':
-            return 96;
         case 'A192GCMKW':
-            return 96;
-        case 'A256CBC-HS512':
-            return 128;
         case 'A256GCM':
-            return 96;
         case 'A256GCMKW':
             return 96;
+        case 'A128CBC-HS256':
+        case 'A192CBC-HS384':
+        case 'A256CBC-HS512':
+            return 128;
         default:
             throw new JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }

package/dist/browser/runtime/aeskw.js

@@ -2,6 +2,7 @@ import bogusWebCrypto from './bogus.js';
 import crypto, { isCryptoKey } from './webcrypto.js';
 import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
 function checkKeySize(key, alg) {
     if (key.algorithm.length !== parseInt(alg.substr(1, 3), 10)) {
         throw new TypeError(`Invalid key size for alg: ${alg}`);
@@ -15,7 +16,7 @@ function getCryptoKey(key, alg, usage) {
     if (key instanceof Uint8Array) {
         return crypto.subtle.importKey('raw', key, 'AES-KW', true, [usage]);
     }
-    throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'Uint8Array'));
+    throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
 }
 export const wrap = async (alg, key, cek) => {
     const cryptoKey = await getCryptoKey(key, alg, 'wrapKey');

package/dist/browser/runtime/asn1.js

@@ -4,9 +4,10 @@ import invalidKeyInput from '../lib/invalid_key_input.js';
 import { encodeBase64 } from './base64url.js';
 import formatPEM from '../lib/format_pem.js';
 import { JOSENotSupported } from '../util/errors.js';
+import { types } from './is_key_like.js';
 const genericExport = async (keyType, keyFormat, key) => {
     if (!isCryptoKey(key)) {
-        throw new TypeError(invalidKeyInput(key, 'CryptoKey'));
+        throw new TypeError(invalidKeyInput(key, ...types));
     }
     if (!key.extractable) {
         throw new TypeError('CryptoKey is not extractable');

package/dist/browser/runtime/decrypt.js

@@ -6,6 +6,7 @@ import { JOSENotSupported, JWEDecryptionFailed } from '../util/errors.js';
 import crypto, { isCryptoKey } from './webcrypto.js';
 import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
 async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
     if (!(cek instanceof Uint8Array)) {
         throw new TypeError(invalidKeyInput(cek, 'Uint8Array'));
@@ -61,7 +62,7 @@ async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
 }
 const decrypt = async (enc, cek, ciphertext, iv, tag, aad) => {
     if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) {
-        throw new TypeError(invalidKeyInput(cek, 'CryptoKey', 'Uint8Array'));
+        throw new TypeError(invalidKeyInput(cek, ...types, 'Uint8Array'));
     }
     checkIvLength(enc, iv);
     switch (enc) {

package/dist/browser/runtime/ecdhes.js

@@ -3,13 +3,14 @@ import crypto, { isCryptoKey } from './webcrypto.js';
 import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import digest from './digest.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
 export const deriveKey = async (publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) => {
     if (!isCryptoKey(publicKey)) {
-        throw new TypeError(invalidKeyInput(publicKey, 'CryptoKey'));
+        throw new TypeError(invalidKeyInput(publicKey, ...types));
     }
     checkEncCryptoKey(publicKey, 'ECDH-ES');
     if (!isCryptoKey(privateKey)) {
-        throw new TypeError(invalidKeyInput(privateKey, 'CryptoKey'));
+        throw new TypeError(invalidKeyInput(privateKey, ...types));
     }
     checkEncCryptoKey(privateKey, 'ECDH-ES', 'deriveBits', 'deriveKey');
     const value = concat(lengthAndInput(encoder.encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength));
@@ -25,13 +26,13 @@ export const deriveKey = async (publicKey, privateKey, algorithm, keyLength, apu
 };
 export const generateEpk = async (key) => {
     if (!isCryptoKey(key)) {
-        throw new TypeError(invalidKeyInput(key, 'CryptoKey'));
+        throw new TypeError(invalidKeyInput(key, ...types));
     }
     return (await crypto.subtle.generateKey({ name: 'ECDH', namedCurve: key.algorithm.namedCurve }, true, ['deriveBits'])).privateKey;
 };
 export const ecdhAllowed = (key) => {
     if (!isCryptoKey(key)) {
-        throw new TypeError(invalidKeyInput(key, 'CryptoKey'));
+        throw new TypeError(invalidKeyInput(key, ...types));
     }
     return ['P-256', 'P-384', 'P-521'].includes(key.algorithm.namedCurve);
 };

package/dist/browser/runtime/encrypt.js

@@ -5,6 +5,7 @@ import crypto, { isCryptoKey } from './webcrypto.js';
 import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
 import { JOSENotSupported } from '../util/errors.js';
+import { types } from './is_key_like.js';
 async function cbcEncrypt(enc, plaintext, cek, iv, aad) {
     if (!(cek instanceof Uint8Array)) {
         throw new TypeError(invalidKeyInput(cek, 'Uint8Array'));
@@ -44,7 +45,7 @@ async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
 }
 const encrypt = async (enc, plaintext, cek, iv, aad) => {
     if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) {
-        throw new TypeError(invalidKeyInput(cek, 'CryptoKey', 'Uint8Array'));
+        throw new TypeError(invalidKeyInput(cek, ...types, 'Uint8Array'));
     }
     checkIvLength(enc, iv);
     switch (enc) {

package/dist/browser/runtime/get_sign_verify_key.js

@@ -1,6 +1,7 @@
 import crypto, { isCryptoKey } from './webcrypto.js';
 import { checkSigCryptoKey } from '../lib/crypto_key.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
 export default function getCryptoKey(alg, key, usage) {
     if (isCryptoKey(key)) {
         checkSigCryptoKey(key, alg, usage);
@@ -8,9 +9,9 @@ export default function getCryptoKey(alg, key, usage) {
     }
     if (key instanceof Uint8Array) {
         if (!alg.startsWith('HS')) {
-            throw new TypeError(invalidKeyInput(key, 'CryptoKey'));
+            throw new TypeError(invalidKeyInput(key, ...types));
         }
         return crypto.subtle.importKey('raw', key, { hash: `SHA-${alg.substr(-3)}`, name: 'HMAC' }, false, [usage]);
     }
-    throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'Uint8Array'));
+    throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
 }

package/dist/browser/runtime/key_to_jwk.js

@@ -1,6 +1,7 @@
 import crypto, { isCryptoKey } from './webcrypto.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
 import { encode as base64url } from './base64url.js';
+import { types } from './is_key_like.js';
 const keyToJWK = async (key) => {
     if (key instanceof Uint8Array) {
         return {
@@ -9,7 +10,7 @@ const keyToJWK = async (key) => {
         };
     }
     if (!isCryptoKey(key)) {
-        throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'Uint8Array'));
+        throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
     }
     if (!key.extractable) {
         throw new TypeError('non-extractable CryptoKey cannot be exported as a JWK');

package/dist/browser/runtime/pbes2kw.js

@@ -6,6 +6,7 @@ import checkP2s from '../lib/check_p2s.js';
 import crypto, { isCryptoKey } from './webcrypto.js';
 import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
 function getCryptoKey(key, alg) {
     if (key instanceof Uint8Array) {
         return crypto.subtle.importKey('raw', key, 'PBKDF2', false, ['deriveBits']);
@@ -14,7 +15,7 @@ function getCryptoKey(key, alg) {
         checkEncCryptoKey(key, alg, 'deriveBits', 'deriveKey');
         return key;
     }
-    throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'Uint8Array'));
+    throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
 }
 async function deriveKey(p2s, alg, p2c, key) {
     checkP2s(p2s);

package/dist/browser/runtime/rsaes.js

@@ -4,9 +4,10 @@ import crypto, { isCryptoKey } from './webcrypto.js';
 import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import checkKeyLength from './check_key_length.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
+import { types } from './is_key_like.js';
 export const encrypt = async (alg, key, cek) => {
     if (!isCryptoKey(key)) {
-        throw new TypeError(invalidKeyInput(key, 'CryptoKey'));
+        throw new TypeError(invalidKeyInput(key, ...types));
     }
     checkEncCryptoKey(key, alg, 'encrypt', 'wrapKey');
     checkKeyLength(alg, key);
@@ -21,7 +22,7 @@ export const encrypt = async (alg, key, cek) => {
 };
 export const decrypt = async (alg, key, encryptedKey) => {
     if (!isCryptoKey(key)) {
-        throw new TypeError(invalidKeyInput(key, 'CryptoKey'));
+        throw new TypeError(invalidKeyInput(key, ...types));
     }
     checkEncCryptoKey(key, alg, 'decrypt', 'unwrapKey');
     checkKeyLength(alg, key);