jose 5.10.0 → 6.0.0

package/dist/node/cjs/runtime/sign.js

@@ -1,19 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const crypto = require("node:crypto");
-const node_util_1 = require("node:util");
-const dsa_digest_js_1 = require("./dsa_digest.js");
-const hmac_digest_js_1 = require("./hmac_digest.js");
-const node_key_js_1 = require("./node_key.js");
-const get_sign_verify_key_js_1 = require("./get_sign_verify_key.js");
-const oneShotSign = (0, node_util_1.promisify)(crypto.sign);
-const sign = async (alg, key, data) => {
-    const k = (0, get_sign_verify_key_js_1.default)(alg, key, 'sign');
-    if (alg.startsWith('HS')) {
-        const hmac = crypto.createHmac((0, hmac_digest_js_1.default)(alg), k);
-        hmac.update(data);
-        return hmac.digest();
-    }
-    return oneShotSign((0, dsa_digest_js_1.default)(alg), data, (0, node_key_js_1.default)(alg, k));
-};
-exports.default = sign;

package/dist/node/cjs/runtime/timing_safe_equal.js

@@ -1,5 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const node_crypto_1 = require("node:crypto");
-const timingSafeEqual = node_crypto_1.timingSafeEqual;
-exports.default = timingSafeEqual;

package/dist/node/cjs/runtime/verify.js

@@ -1,31 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const crypto = require("node:crypto");
-const node_util_1 = require("node:util");
-const dsa_digest_js_1 = require("./dsa_digest.js");
-const node_key_js_1 = require("./node_key.js");
-const sign_js_1 = require("./sign.js");
-const get_sign_verify_key_js_1 = require("./get_sign_verify_key.js");
-const oneShotVerify = (0, node_util_1.promisify)(crypto.verify);
-const verify = async (alg, key, signature, data) => {
-    const k = (0, get_sign_verify_key_js_1.default)(alg, key, 'verify');
-    if (alg.startsWith('HS')) {
-        const expected = await (0, sign_js_1.default)(alg, k, data);
-        const actual = signature;
-        try {
-            return crypto.timingSafeEqual(actual, expected);
-        }
-        catch {
-            return false;
-        }
-    }
-    const algorithm = (0, dsa_digest_js_1.default)(alg);
-    const keyInput = (0, node_key_js_1.default)(alg, k);
-    try {
-        return await oneShotVerify(algorithm, data, keyInput, signature);
-    }
-    catch {
-        return false;
-    }
-};
-exports.default = verify;

package/dist/node/cjs/runtime/webcrypto.js

@@ -1,9 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.isCryptoKey = void 0;
-const crypto = require("node:crypto");
-const util = require("node:util");
-const webcrypto = crypto.webcrypto;
-exports.default = webcrypto;
-const isCryptoKey = (key) => util.types.isCryptoKey(key);
-exports.isCryptoKey = isCryptoKey;

package/dist/node/cjs/util/base64url.js

@@ -1,6 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.decode = exports.encode = void 0;
-const base64url = require("../runtime/base64url.js");
-exports.encode = base64url.encode;
-exports.decode = base64url.decode;

package/dist/node/cjs/util/decode_jwt.js

@@ -1,35 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.decodeJwt = decodeJwt;
-const base64url_js_1 = require("./base64url.js");
-const buffer_utils_js_1 = require("../lib/buffer_utils.js");
-const is_object_js_1 = require("../lib/is_object.js");
-const errors_js_1 = require("./errors.js");
-function decodeJwt(jwt) {
-    if (typeof jwt !== 'string')
-        throw new errors_js_1.JWTInvalid('JWTs must use Compact JWS serialization, JWT must be a string');
-    const { 1: payload, length } = jwt.split('.');
-    if (length === 5)
-        throw new errors_js_1.JWTInvalid('Only JWTs using Compact JWS serialization can be decoded');
-    if (length !== 3)
-        throw new errors_js_1.JWTInvalid('Invalid JWT');
-    if (!payload)
-        throw new errors_js_1.JWTInvalid('JWTs must contain a payload');
-    let decoded;
-    try {
-        decoded = (0, base64url_js_1.decode)(payload);
-    }
-    catch {
-        throw new errors_js_1.JWTInvalid('Failed to base64url decode the payload');
-    }
-    let result;
-    try {
-        result = JSON.parse(buffer_utils_js_1.decoder.decode(decoded));
-    }
-    catch {
-        throw new errors_js_1.JWTInvalid('Failed to parse the decoded payload as JSON');
-    }
-    if (!(0, is_object_js_1.default)(result))
-        throw new errors_js_1.JWTInvalid('Invalid JWT Claims Set');
-    return result;
-}

package/dist/node/cjs/util/decode_protected_header.js

@@ -1,37 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.decodeProtectedHeader = decodeProtectedHeader;
-const base64url_js_1 = require("./base64url.js");
-const buffer_utils_js_1 = require("../lib/buffer_utils.js");
-const is_object_js_1 = require("../lib/is_object.js");
-function decodeProtectedHeader(token) {
-    let protectedB64u;
-    if (typeof token === 'string') {
-        const parts = token.split('.');
-        if (parts.length === 3 || parts.length === 5) {
-            ;
-            [protectedB64u] = parts;
-        }
-    }
-    else if (typeof token === 'object' && token) {
-        if ('protected' in token) {
-            protectedB64u = token.protected;
-        }
-        else {
-            throw new TypeError('Token does not contain a Protected Header');
-        }
-    }
-    try {
-        if (typeof protectedB64u !== 'string' || !protectedB64u) {
-            throw new Error();
-        }
-        const result = JSON.parse(buffer_utils_js_1.decoder.decode((0, base64url_js_1.decode)(protectedB64u)));
-        if (!(0, is_object_js_1.default)(result)) {
-            throw new Error();
-        }
-        return result;
-    }
-    catch {
-        throw new TypeError('Invalid Token or Protected Header formatting');
-    }
-}

package/dist/node/cjs/util/errors.js

@@ -1,117 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.JWSSignatureVerificationFailed = exports.JWKSTimeout = exports.JWKSMultipleMatchingKeys = exports.JWKSNoMatchingKey = exports.JWKSInvalid = exports.JWKInvalid = exports.JWTInvalid = exports.JWSInvalid = exports.JWEInvalid = exports.JWEDecryptionFailed = exports.JOSENotSupported = exports.JOSEAlgNotAllowed = exports.JWTExpired = exports.JWTClaimValidationFailed = exports.JOSEError = void 0;
-class JOSEError extends Error {
-    static code = 'ERR_JOSE_GENERIC';
-    code = 'ERR_JOSE_GENERIC';
-    constructor(message, options) {
-        super(message, options);
-        this.name = this.constructor.name;
-        Error.captureStackTrace?.(this, this.constructor);
-    }
-}
-exports.JOSEError = JOSEError;
-class JWTClaimValidationFailed extends JOSEError {
-    static code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
-    code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
-    claim;
-    reason;
-    payload;
-    constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {
-        super(message, { cause: { claim, reason, payload } });
-        this.claim = claim;
-        this.reason = reason;
-        this.payload = payload;
-    }
-}
-exports.JWTClaimValidationFailed = JWTClaimValidationFailed;
-class JWTExpired extends JOSEError {
-    static code = 'ERR_JWT_EXPIRED';
-    code = 'ERR_JWT_EXPIRED';
-    claim;
-    reason;
-    payload;
-    constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {
-        super(message, { cause: { claim, reason, payload } });
-        this.claim = claim;
-        this.reason = reason;
-        this.payload = payload;
-    }
-}
-exports.JWTExpired = JWTExpired;
-class JOSEAlgNotAllowed extends JOSEError {
-    static code = 'ERR_JOSE_ALG_NOT_ALLOWED';
-    code = 'ERR_JOSE_ALG_NOT_ALLOWED';
-}
-exports.JOSEAlgNotAllowed = JOSEAlgNotAllowed;
-class JOSENotSupported extends JOSEError {
-    static code = 'ERR_JOSE_NOT_SUPPORTED';
-    code = 'ERR_JOSE_NOT_SUPPORTED';
-}
-exports.JOSENotSupported = JOSENotSupported;
-class JWEDecryptionFailed extends JOSEError {
-    static code = 'ERR_JWE_DECRYPTION_FAILED';
-    code = 'ERR_JWE_DECRYPTION_FAILED';
-    constructor(message = 'decryption operation failed', options) {
-        super(message, options);
-    }
-}
-exports.JWEDecryptionFailed = JWEDecryptionFailed;
-class JWEInvalid extends JOSEError {
-    static code = 'ERR_JWE_INVALID';
-    code = 'ERR_JWE_INVALID';
-}
-exports.JWEInvalid = JWEInvalid;
-class JWSInvalid extends JOSEError {
-    static code = 'ERR_JWS_INVALID';
-    code = 'ERR_JWS_INVALID';
-}
-exports.JWSInvalid = JWSInvalid;
-class JWTInvalid extends JOSEError {
-    static code = 'ERR_JWT_INVALID';
-    code = 'ERR_JWT_INVALID';
-}
-exports.JWTInvalid = JWTInvalid;
-class JWKInvalid extends JOSEError {
-    static code = 'ERR_JWK_INVALID';
-    code = 'ERR_JWK_INVALID';
-}
-exports.JWKInvalid = JWKInvalid;
-class JWKSInvalid extends JOSEError {
-    static code = 'ERR_JWKS_INVALID';
-    code = 'ERR_JWKS_INVALID';
-}
-exports.JWKSInvalid = JWKSInvalid;
-class JWKSNoMatchingKey extends JOSEError {
-    static code = 'ERR_JWKS_NO_MATCHING_KEY';
-    code = 'ERR_JWKS_NO_MATCHING_KEY';
-    constructor(message = 'no applicable key found in the JSON Web Key Set', options) {
-        super(message, options);
-    }
-}
-exports.JWKSNoMatchingKey = JWKSNoMatchingKey;
-class JWKSMultipleMatchingKeys extends JOSEError {
-    [Symbol.asyncIterator];
-    static code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
-    code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
-    constructor(message = 'multiple matching keys found in the JSON Web Key Set', options) {
-        super(message, options);
-    }
-}
-exports.JWKSMultipleMatchingKeys = JWKSMultipleMatchingKeys;
-class JWKSTimeout extends JOSEError {
-    static code = 'ERR_JWKS_TIMEOUT';
-    code = 'ERR_JWKS_TIMEOUT';
-    constructor(message = 'request timed out', options) {
-        super(message, options);
-    }
-}
-exports.JWKSTimeout = JWKSTimeout;
-class JWSSignatureVerificationFailed extends JOSEError {
-    static code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
-    code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
-    constructor(message = 'signature verification failed', options) {
-        super(message, options);
-    }
-}
-exports.JWSSignatureVerificationFailed = JWSSignatureVerificationFailed;

package/dist/node/cjs/util/runtime.js

@@ -1,4 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-const runtime_js_1 = require("../runtime/runtime.js");
-exports.default = runtime_js_1.default;

package/dist/node/esm/index.js

@@ -1,30 +0,0 @@
-export { compactDecrypt } from './jwe/compact/decrypt.js';
-export { flattenedDecrypt } from './jwe/flattened/decrypt.js';
-export { generalDecrypt } from './jwe/general/decrypt.js';
-export { GeneralEncrypt } from './jwe/general/encrypt.js';
-export { compactVerify } from './jws/compact/verify.js';
-export { flattenedVerify } from './jws/flattened/verify.js';
-export { generalVerify } from './jws/general/verify.js';
-export { jwtVerify } from './jwt/verify.js';
-export { jwtDecrypt } from './jwt/decrypt.js';
-export { CompactEncrypt } from './jwe/compact/encrypt.js';
-export { FlattenedEncrypt } from './jwe/flattened/encrypt.js';
-export { CompactSign } from './jws/compact/sign.js';
-export { FlattenedSign } from './jws/flattened/sign.js';
-export { GeneralSign } from './jws/general/sign.js';
-export { SignJWT } from './jwt/sign.js';
-export { EncryptJWT } from './jwt/encrypt.js';
-export { calculateJwkThumbprint, calculateJwkThumbprintUri } from './jwk/thumbprint.js';
-export { EmbeddedJWK } from './jwk/embedded.js';
-export { createLocalJWKSet } from './jwks/local.js';
-export { createRemoteJWKSet, jwksCache, experimental_jwksCache } from './jwks/remote.js';
-export { UnsecuredJWT } from './jwt/unsecured.js';
-export { exportPKCS8, exportSPKI, exportJWK } from './key/export.js';
-export { importSPKI, importPKCS8, importX509, importJWK } from './key/import.js';
-export { decodeProtectedHeader } from './util/decode_protected_header.js';
-export { decodeJwt } from './util/decode_jwt.js';
-export * as errors from './util/errors.js';
-export { generateKeyPair } from './key/generate_key_pair.js';
-export { generateSecret } from './key/generate_secret.js';
-export * as base64url from './util/base64url.js';
-export { default as cryptoRuntime } from './util/runtime.js';

package/dist/node/esm/jwe/compact/decrypt.js

@@ -1,27 +0,0 @@
-import { flattenedDecrypt } from '../flattened/decrypt.js';
-import { JWEInvalid } from '../../util/errors.js';
-import { decoder } from '../../lib/buffer_utils.js';
-export async function compactDecrypt(jwe, key, options) {
-    if (jwe instanceof Uint8Array) {
-        jwe = decoder.decode(jwe);
-    }
-    if (typeof jwe !== 'string') {
-        throw new JWEInvalid('Compact JWE must be a string or Uint8Array');
-    }
-    const { 0: protectedHeader, 1: encryptedKey, 2: iv, 3: ciphertext, 4: tag, length, } = jwe.split('.');
-    if (length !== 5) {
-        throw new JWEInvalid('Invalid Compact JWE');
-    }
-    const decrypted = await flattenedDecrypt({
-        ciphertext,
-        iv: iv || undefined,
-        protected: protectedHeader,
-        tag: tag || undefined,
-        encrypted_key: encryptedKey || undefined,
-    }, key, options);
-    const result = { plaintext: decrypted.plaintext, protectedHeader: decrypted.protectedHeader };
-    if (typeof key === 'function') {
-        return { ...result, key: decrypted.key };
-    }
-    return result;
-}

package/dist/node/esm/jwe/general/decrypt.js

@@ -1,31 +0,0 @@
-import { flattenedDecrypt } from '../flattened/decrypt.js';
-import { JWEDecryptionFailed, JWEInvalid } from '../../util/errors.js';
-import isObject from '../../lib/is_object.js';
-export async function generalDecrypt(jwe, key, options) {
-    if (!isObject(jwe)) {
-        throw new JWEInvalid('General JWE must be an object');
-    }
-    if (!Array.isArray(jwe.recipients) || !jwe.recipients.every(isObject)) {
-        throw new JWEInvalid('JWE Recipients missing or incorrect type');
-    }
-    if (!jwe.recipients.length) {
-        throw new JWEInvalid('JWE Recipients has no members');
-    }
-    for (const recipient of jwe.recipients) {
-        try {
-            return await flattenedDecrypt({
-                aad: jwe.aad,
-                ciphertext: jwe.ciphertext,
-                encrypted_key: recipient.encrypted_key,
-                header: recipient.header,
-                iv: jwe.iv,
-                protected: jwe.protected,
-                tag: jwe.tag,
-                unprotected: jwe.unprotected,
-            }, key, options);
-        }
-        catch {
-        }
-    }
-    throw new JWEDecryptionFailed();
-}

package/dist/node/esm/jwk/embedded.js

@@ -1,17 +0,0 @@
-import { importJWK } from '../key/import.js';
-import isObject from '../lib/is_object.js';
-import { JWSInvalid } from '../util/errors.js';
-export async function EmbeddedJWK(protectedHeader, token) {
-    const joseHeader = {
-        ...protectedHeader,
-        ...token?.header,
-    };
-    if (!isObject(joseHeader.jwk)) {
-        throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');
-    }
-    const key = await importJWK({ ...joseHeader.jwk, ext: true }, joseHeader.alg);
-    if (key instanceof Uint8Array || key.type !== 'public') {
-        throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
-    }
-    return key;
-}

package/dist/node/esm/jws/compact/verify.js

@@ -1,21 +0,0 @@
-import { flattenedVerify } from '../flattened/verify.js';
-import { JWSInvalid } from '../../util/errors.js';
-import { decoder } from '../../lib/buffer_utils.js';
-export async function compactVerify(jws, key, options) {
-    if (jws instanceof Uint8Array) {
-        jws = decoder.decode(jws);
-    }
-    if (typeof jws !== 'string') {
-        throw new JWSInvalid('Compact JWS must be a string or Uint8Array');
-    }
-    const { 0: protectedHeader, 1: payload, 2: signature, length } = jws.split('.');
-    if (length !== 3) {
-        throw new JWSInvalid('Invalid Compact JWS');
-    }
-    const verified = await flattenedVerify({ payload, protected: protectedHeader, signature }, key, options);
-    const result = { payload: verified.payload, protectedHeader: verified.protectedHeader };
-    if (typeof key === 'function') {
-        return { ...result, key: verified.key };
-    }
-    return result;
-}

package/dist/node/esm/jws/flattened/verify.js

@@ -1,122 +0,0 @@
-import { decode as base64url } from '../../runtime/base64url.js';
-import verify from '../../runtime/verify.js';
-import { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';
-import { concat, encoder, decoder } from '../../lib/buffer_utils.js';
-import isDisjoint from '../../lib/is_disjoint.js';
-import isObject from '../../lib/is_object.js';
-import { checkKeyTypeWithJwk } from '../../lib/check_key_type.js';
-import validateCrit from '../../lib/validate_crit.js';
-import validateAlgorithms from '../../lib/validate_algorithms.js';
-import { isJWK } from '../../lib/is_jwk.js';
-import { importJWK } from '../../key/import.js';
-export async function flattenedVerify(jws, key, options) {
-    if (!isObject(jws)) {
-        throw new JWSInvalid('Flattened JWS must be an object');
-    }
-    if (jws.protected === undefined && jws.header === undefined) {
-        throw new JWSInvalid('Flattened JWS must have either of the "protected" or "header" members');
-    }
-    if (jws.protected !== undefined && typeof jws.protected !== 'string') {
-        throw new JWSInvalid('JWS Protected Header incorrect type');
-    }
-    if (jws.payload === undefined) {
-        throw new JWSInvalid('JWS Payload missing');
-    }
-    if (typeof jws.signature !== 'string') {
-        throw new JWSInvalid('JWS Signature missing or incorrect type');
-    }
-    if (jws.header !== undefined && !isObject(jws.header)) {
-        throw new JWSInvalid('JWS Unprotected Header incorrect type');
-    }
-    let parsedProt = {};
-    if (jws.protected) {
-        try {
-            const protectedHeader = base64url(jws.protected);
-            parsedProt = JSON.parse(decoder.decode(protectedHeader));
-        }
-        catch {
-            throw new JWSInvalid('JWS Protected Header is invalid');
-        }
-    }
-    if (!isDisjoint(parsedProt, jws.header)) {
-        throw new JWSInvalid('JWS Protected and JWS Unprotected Header Parameter names must be disjoint');
-    }
-    const joseHeader = {
-        ...parsedProt,
-        ...jws.header,
-    };
-    const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options?.crit, parsedProt, joseHeader);
-    let b64 = true;
-    if (extensions.has('b64')) {
-        b64 = parsedProt.b64;
-        if (typeof b64 !== 'boolean') {
-            throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
-        }
-    }
-    const { alg } = joseHeader;
-    if (typeof alg !== 'string' || !alg) {
-        throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-    }
-    const algorithms = options && validateAlgorithms('algorithms', options.algorithms);
-    if (algorithms && !algorithms.has(alg)) {
-        throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
-    }
-    if (b64) {
-        if (typeof jws.payload !== 'string') {
-            throw new JWSInvalid('JWS Payload must be a string');
-        }
-    }
-    else if (typeof jws.payload !== 'string' && !(jws.payload instanceof Uint8Array)) {
-        throw new JWSInvalid('JWS Payload must be a string or an Uint8Array instance');
-    }
-    let resolvedKey = false;
-    if (typeof key === 'function') {
-        key = await key(parsedProt, jws);
-        resolvedKey = true;
-        checkKeyTypeWithJwk(alg, key, 'verify');
-        if (isJWK(key)) {
-            key = await importJWK(key, alg);
-        }
-    }
-    else {
-        checkKeyTypeWithJwk(alg, key, 'verify');
-    }
-    const data = concat(encoder.encode(jws.protected ?? ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);
-    let signature;
-    try {
-        signature = base64url(jws.signature);
-    }
-    catch {
-        throw new JWSInvalid('Failed to base64url decode the signature');
-    }
-    const verified = await verify(alg, key, signature, data);
-    if (!verified) {
-        throw new JWSSignatureVerificationFailed();
-    }
-    let payload;
-    if (b64) {
-        try {
-            payload = base64url(jws.payload);
-        }
-        catch {
-            throw new JWSInvalid('Failed to base64url decode the payload');
-        }
-    }
-    else if (typeof jws.payload === 'string') {
-        payload = encoder.encode(jws.payload);
-    }
-    else {
-        payload = jws.payload;
-    }
-    const result = { payload };
-    if (jws.protected !== undefined) {
-        result.protectedHeader = parsedProt;
-    }
-    if (jws.header !== undefined) {
-        result.unprotectedHeader = jws.header;
-    }
-    if (resolvedKey) {
-        return { ...result, key };
-    }
-    return result;
-}

package/dist/node/esm/jws/general/verify.js

@@ -1,24 +0,0 @@
-import { flattenedVerify } from '../flattened/verify.js';
-import { JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';
-import isObject from '../../lib/is_object.js';
-export async function generalVerify(jws, key, options) {
-    if (!isObject(jws)) {
-        throw new JWSInvalid('General JWS must be an object');
-    }
-    if (!Array.isArray(jws.signatures) || !jws.signatures.every(isObject)) {
-        throw new JWSInvalid('JWS Signatures missing or incorrect type');
-    }
-    for (const signature of jws.signatures) {
-        try {
-            return await flattenedVerify({
-                header: signature.header,
-                payload: jws.payload,
-                protected: signature.protected,
-                signature: signature.signature,
-            }, key, options);
-        }
-        catch {
-        }
-    }
-    throw new JWSSignatureVerificationFailed();
-}

package/dist/node/esm/jwt/decrypt.js

@@ -1,23 +0,0 @@
-import { compactDecrypt } from '../jwe/compact/decrypt.js';
-import jwtPayload from '../lib/jwt_claims_set.js';
-import { JWTClaimValidationFailed } from '../util/errors.js';
-export async function jwtDecrypt(jwt, key, options) {
-    const decrypted = await compactDecrypt(jwt, key, options);
-    const payload = jwtPayload(decrypted.protectedHeader, decrypted.plaintext, options);
-    const { protectedHeader } = decrypted;
-    if (protectedHeader.iss !== undefined && protectedHeader.iss !== payload.iss) {
-        throw new JWTClaimValidationFailed('replicated "iss" claim header parameter mismatch', payload, 'iss', 'mismatch');
-    }
-    if (protectedHeader.sub !== undefined && protectedHeader.sub !== payload.sub) {
-        throw new JWTClaimValidationFailed('replicated "sub" claim header parameter mismatch', payload, 'sub', 'mismatch');
-    }
-    if (protectedHeader.aud !== undefined &&
-        JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud)) {
-        throw new JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch', payload, 'aud', 'mismatch');
-    }
-    const result = { payload, protectedHeader };
-    if (typeof key === 'function') {
-        return { ...result, key: decrypted.key };
-    }
-    return result;
-}

package/dist/node/esm/jwt/unsecured.js

@@ -1,32 +0,0 @@
-import * as base64url from '../runtime/base64url.js';
-import { decoder } from '../lib/buffer_utils.js';
-import { JWTInvalid } from '../util/errors.js';
-import jwtPayload from '../lib/jwt_claims_set.js';
-import { ProduceJWT } from './produce.js';
-export class UnsecuredJWT extends ProduceJWT {
-    encode() {
-        const header = base64url.encode(JSON.stringify({ alg: 'none' }));
-        const payload = base64url.encode(JSON.stringify(this._payload));
-        return `${header}.${payload}.`;
-    }
-    static decode(jwt, options) {
-        if (typeof jwt !== 'string') {
-            throw new JWTInvalid('Unsecured JWT must be a string');
-        }
-        const { 0: encodedHeader, 1: encodedPayload, 2: signature, length } = jwt.split('.');
-        if (length !== 3 || signature !== '') {
-            throw new JWTInvalid('Invalid Unsecured JWT');
-        }
-        let header;
-        try {
-            header = JSON.parse(decoder.decode(base64url.decode(encodedHeader)));
-            if (header.alg !== 'none')
-                throw new Error();
-        }
-        catch {
-            throw new JWTInvalid('Invalid Unsecured JWT');
-        }
-        const payload = jwtPayload(header, base64url.decode(encodedPayload), options);
-        return { payload, header };
-    }
-}

package/dist/node/esm/jwt/verify.js

@@ -1,15 +0,0 @@
-import { compactVerify } from '../jws/compact/verify.js';
-import jwtPayload from '../lib/jwt_claims_set.js';
-import { JWTInvalid } from '../util/errors.js';
-export async function jwtVerify(jwt, key, options) {
-    const verified = await compactVerify(jwt, key, options);
-    if (verified.protectedHeader.crit?.includes('b64') && verified.protectedHeader.b64 === false) {
-        throw new JWTInvalid('JWTs MUST NOT use unencoded payload');
-    }
-    const payload = jwtPayload(verified.protectedHeader, verified.payload, options);
-    const result = { payload, protectedHeader: verified.protectedHeader };
-    if (typeof key === 'function') {
-        return { ...result, key: verified.key };
-    }
-    return result;
-}

package/dist/node/esm/key/generate_key_pair.js

@@ -1,4 +0,0 @@
-import { generateKeyPair as generate } from '../runtime/generate.js';
-export async function generateKeyPair(alg, options) {
-    return generate(alg, options);
-}

package/dist/node/esm/key/generate_secret.js

@@ -1,4 +0,0 @@
-import { generateSecret as generate } from '../runtime/generate.js';
-export async function generateSecret(alg, options) {
-    return generate(alg, options);
-}