jose 5.9.6 → 6.0.0

package/dist/browser/lib/decrypt_key_management.js

@@ -1,129 +0,0 @@
-import { unwrap as aesKw } from '../runtime/aeskw.js';
-import * as ECDH from '../runtime/ecdhes.js';
-import { decrypt as pbes2Kw } from '../runtime/pbes2kw.js';
-import { decrypt as rsaEs } from '../runtime/rsaes.js';
-import { decode as base64url } from '../runtime/base64url.js';
-import normalize from '../runtime/normalize_key.js';
-import { JOSENotSupported, JWEInvalid } from '../util/errors.js';
-import { bitLength as cekLength } from '../lib/cek.js';
-import { importJWK } from '../key/import.js';
-import checkKeyType from './check_key_type.js';
-import isObject from './is_object.js';
-import { unwrap as aesGcmKw } from './aesgcmkw.js';
-async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options) {
-    checkKeyType(alg, key, 'decrypt');
-    key = (await normalize.normalizePrivateKey?.(key, alg)) || key;
-    switch (alg) {
-        case 'dir': {
-            if (encryptedKey !== undefined)
-                throw new JWEInvalid('Encountered unexpected JWE Encrypted Key');
-            return key;
-        }
-        case 'ECDH-ES':
-            if (encryptedKey !== undefined)
-                throw new JWEInvalid('Encountered unexpected JWE Encrypted Key');
-        case 'ECDH-ES+A128KW':
-        case 'ECDH-ES+A192KW':
-        case 'ECDH-ES+A256KW': {
-            if (!isObject(joseHeader.epk))
-                throw new JWEInvalid(`JOSE Header "epk" (Ephemeral Public Key) missing or invalid`);
-            if (!ECDH.ecdhAllowed(key))
-                throw new JOSENotSupported('ECDH with the provided key is not allowed or not supported by your javascript runtime');
-            const epk = await importJWK(joseHeader.epk, alg);
-            let partyUInfo;
-            let partyVInfo;
-            if (joseHeader.apu !== undefined) {
-                if (typeof joseHeader.apu !== 'string')
-                    throw new JWEInvalid(`JOSE Header "apu" (Agreement PartyUInfo) invalid`);
-                try {
-                    partyUInfo = base64url(joseHeader.apu);
-                }
-                catch {
-                    throw new JWEInvalid('Failed to base64url decode the apu');
-                }
-            }
-            if (joseHeader.apv !== undefined) {
-                if (typeof joseHeader.apv !== 'string')
-                    throw new JWEInvalid(`JOSE Header "apv" (Agreement PartyVInfo) invalid`);
-                try {
-                    partyVInfo = base64url(joseHeader.apv);
-                }
-                catch {
-                    throw new JWEInvalid('Failed to base64url decode the apv');
-                }
-            }
-            const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, alg === 'ECDH-ES' ? cekLength(joseHeader.enc) : parseInt(alg.slice(-5, -2), 10), partyUInfo, partyVInfo);
-            if (alg === 'ECDH-ES')
-                return sharedSecret;
-            if (encryptedKey === undefined)
-                throw new JWEInvalid('JWE Encrypted Key missing');
-            return aesKw(alg.slice(-6), sharedSecret, encryptedKey);
-        }
-        case 'RSA1_5':
-        case 'RSA-OAEP':
-        case 'RSA-OAEP-256':
-        case 'RSA-OAEP-384':
-        case 'RSA-OAEP-512': {
-            if (encryptedKey === undefined)
-                throw new JWEInvalid('JWE Encrypted Key missing');
-            return rsaEs(alg, key, encryptedKey);
-        }
-        case 'PBES2-HS256+A128KW':
-        case 'PBES2-HS384+A192KW':
-        case 'PBES2-HS512+A256KW': {
-            if (encryptedKey === undefined)
-                throw new JWEInvalid('JWE Encrypted Key missing');
-            if (typeof joseHeader.p2c !== 'number')
-                throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);
-            const p2cLimit = options?.maxPBES2Count || 10000;
-            if (joseHeader.p2c > p2cLimit)
-                throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);
-            if (typeof joseHeader.p2s !== 'string')
-                throw new JWEInvalid(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);
-            let p2s;
-            try {
-                p2s = base64url(joseHeader.p2s);
-            }
-            catch {
-                throw new JWEInvalid('Failed to base64url decode the p2s');
-            }
-            return pbes2Kw(alg, key, encryptedKey, joseHeader.p2c, p2s);
-        }
-        case 'A128KW':
-        case 'A192KW':
-        case 'A256KW': {
-            if (encryptedKey === undefined)
-                throw new JWEInvalid('JWE Encrypted Key missing');
-            return aesKw(alg, key, encryptedKey);
-        }
-        case 'A128GCMKW':
-        case 'A192GCMKW':
-        case 'A256GCMKW': {
-            if (encryptedKey === undefined)
-                throw new JWEInvalid('JWE Encrypted Key missing');
-            if (typeof joseHeader.iv !== 'string')
-                throw new JWEInvalid(`JOSE Header "iv" (Initialization Vector) missing or invalid`);
-            if (typeof joseHeader.tag !== 'string')
-                throw new JWEInvalid(`JOSE Header "tag" (Authentication Tag) missing or invalid`);
-            let iv;
-            try {
-                iv = base64url(joseHeader.iv);
-            }
-            catch {
-                throw new JWEInvalid('Failed to base64url decode the iv');
-            }
-            let tag;
-            try {
-                tag = base64url(joseHeader.tag);
-            }
-            catch {
-                throw new JWEInvalid('Failed to base64url decode the tag');
-            }
-            return aesGcmKw(alg, key, encryptedKey, iv, tag);
-        }
-        default: {
-            throw new JOSENotSupported('Invalid or unsupported "alg" (JWE Algorithm) header value');
-        }
-    }
-}
-export default decryptKeyManagement;

package/dist/browser/lib/encrypt_key_management.js

@@ -1,89 +0,0 @@
-import { wrap as aesKw } from '../runtime/aeskw.js';
-import * as ECDH from '../runtime/ecdhes.js';
-import { encrypt as pbes2Kw } from '../runtime/pbes2kw.js';
-import { encrypt as rsaEs } from '../runtime/rsaes.js';
-import { encode as base64url } from '../runtime/base64url.js';
-import normalize from '../runtime/normalize_key.js';
-import generateCek, { bitLength as cekLength } from '../lib/cek.js';
-import { JOSENotSupported } from '../util/errors.js';
-import { exportJWK } from '../key/export.js';
-import checkKeyType from './check_key_type.js';
-import { wrap as aesGcmKw } from './aesgcmkw.js';
-async function encryptKeyManagement(alg, enc, key, providedCek, providedParameters = {}) {
-    let encryptedKey;
-    let parameters;
-    let cek;
-    checkKeyType(alg, key, 'encrypt');
-    key = (await normalize.normalizePublicKey?.(key, alg)) || key;
-    switch (alg) {
-        case 'dir': {
-            cek = key;
-            break;
-        }
-        case 'ECDH-ES':
-        case 'ECDH-ES+A128KW':
-        case 'ECDH-ES+A192KW':
-        case 'ECDH-ES+A256KW': {
-            if (!ECDH.ecdhAllowed(key)) {
-                throw new JOSENotSupported('ECDH with the provided key is not allowed or not supported by your javascript runtime');
-            }
-            const { apu, apv } = providedParameters;
-            let { epk: ephemeralKey } = providedParameters;
-            ephemeralKey || (ephemeralKey = (await ECDH.generateEpk(key)).privateKey);
-            const { x, y, crv, kty } = await exportJWK(ephemeralKey);
-            const sharedSecret = await ECDH.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, alg === 'ECDH-ES' ? cekLength(enc) : parseInt(alg.slice(-5, -2), 10), apu, apv);
-            parameters = { epk: { x, crv, kty } };
-            if (kty === 'EC')
-                parameters.epk.y = y;
-            if (apu)
-                parameters.apu = base64url(apu);
-            if (apv)
-                parameters.apv = base64url(apv);
-            if (alg === 'ECDH-ES') {
-                cek = sharedSecret;
-                break;
-            }
-            cek = providedCek || generateCek(enc);
-            const kwAlg = alg.slice(-6);
-            encryptedKey = await aesKw(kwAlg, sharedSecret, cek);
-            break;
-        }
-        case 'RSA1_5':
-        case 'RSA-OAEP':
-        case 'RSA-OAEP-256':
-        case 'RSA-OAEP-384':
-        case 'RSA-OAEP-512': {
-            cek = providedCek || generateCek(enc);
-            encryptedKey = await rsaEs(alg, key, cek);
-            break;
-        }
-        case 'PBES2-HS256+A128KW':
-        case 'PBES2-HS384+A192KW':
-        case 'PBES2-HS512+A256KW': {
-            cek = providedCek || generateCek(enc);
-            const { p2c, p2s } = providedParameters;
-            ({ encryptedKey, ...parameters } = await pbes2Kw(alg, key, cek, p2c, p2s));
-            break;
-        }
-        case 'A128KW':
-        case 'A192KW':
-        case 'A256KW': {
-            cek = providedCek || generateCek(enc);
-            encryptedKey = await aesKw(alg, key, cek);
-            break;
-        }
-        case 'A128GCMKW':
-        case 'A192GCMKW':
-        case 'A256GCMKW': {
-            cek = providedCek || generateCek(enc);
-            const { iv } = providedParameters;
-            ({ encryptedKey, ...parameters } = await aesGcmKw(alg, key, cek, iv));
-            break;
-        }
-        default: {
-            throw new JOSENotSupported('Invalid or unsupported "alg" (JWE Algorithm) header value');
-        }
-    }
-    return { cek, encryptedKey, parameters };
-}
-export default encryptKeyManagement;

package/dist/browser/lib/format_pem.js

@@ -1,4 +0,0 @@
-export default (b64, descriptor) => {
-    const newlined = (b64.match(/.{1,64}/g) || []).join('\n');
-    return `-----BEGIN ${descriptor}-----\n${newlined}\n-----END ${descriptor}-----`;
-};

package/dist/browser/lib/is_disjoint.js

@@ -1,22 +0,0 @@
-const isDisjoint = (...headers) => {
-    const sources = headers.filter(Boolean);
-    if (sources.length === 0 || sources.length === 1) {
-        return true;
-    }
-    let acc;
-    for (const header of sources) {
-        const parameters = Object.keys(header);
-        if (!acc || acc.size === 0) {
-            acc = new Set(parameters);
-            continue;
-        }
-        for (const parameter of parameters) {
-            if (acc.has(parameter)) {
-                return false;
-            }
-            acc.add(parameter);
-        }
-    }
-    return true;
-};
-export default isDisjoint;

package/dist/browser/lib/iv.js

@@ -1,20 +0,0 @@
-import { JOSENotSupported } from '../util/errors.js';
-import random from '../runtime/random.js';
-export function bitLength(alg) {
-    switch (alg) {
-        case 'A128GCM':
-        case 'A128GCMKW':
-        case 'A192GCM':
-        case 'A192GCMKW':
-        case 'A256GCM':
-        case 'A256GCMKW':
-            return 96;
-        case 'A128CBC-HS256':
-        case 'A192CBC-HS384':
-        case 'A256CBC-HS512':
-            return 128;
-        default:
-            throw new JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
-    }
-}
-export default (alg) => random(new Uint8Array(bitLength(alg) >> 3));

package/dist/browser/lib/validate_crit.js

@@ -1,34 +0,0 @@
-import { JOSENotSupported } from '../util/errors.js';
-function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
-    if (joseHeader.crit !== undefined && protectedHeader?.crit === undefined) {
-        throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
-    }
-    if (!protectedHeader || protectedHeader.crit === undefined) {
-        return new Set();
-    }
-    if (!Array.isArray(protectedHeader.crit) ||
-        protectedHeader.crit.length === 0 ||
-        protectedHeader.crit.some((input) => typeof input !== 'string' || input.length === 0)) {
-        throw new Err('"crit" (Critical) Header Parameter MUST be an array of non-empty strings when present');
-    }
-    let recognized;
-    if (recognizedOption !== undefined) {
-        recognized = new Map([...Object.entries(recognizedOption), ...recognizedDefault.entries()]);
-    }
-    else {
-        recognized = recognizedDefault;
-    }
-    for (const parameter of protectedHeader.crit) {
-        if (!recognized.has(parameter)) {
-            throw new JOSENotSupported(`Extension Header Parameter "${parameter}" is not recognized`);
-        }
-        if (joseHeader[parameter] === undefined) {
-            throw new Err(`Extension Header Parameter "${parameter}" is missing`);
-        }
-        if (recognized.get(parameter) && protectedHeader[parameter] === undefined) {
-            throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
-        }
-    }
-    return new Set(protectedHeader.crit);
-}
-export default validateCrit;

package/dist/browser/package.json

@@ -1 +0,0 @@
-{"type":"module","sideEffects":false}

package/dist/browser/runtime/bogus.js

@@ -1,6 +0,0 @@
-const bogusWebCrypto = [
-    { hash: 'SHA-256', name: 'HMAC' },
-    true,
-    ['sign'],
-];
-export default bogusWebCrypto;

package/dist/browser/runtime/ecdhes.js

@@ -1,47 +0,0 @@
-import { encoder, concat, uint32be, lengthAndInput, concatKdf } from '../lib/buffer_utils.js';
-import crypto, { isCryptoKey } from './webcrypto.js';
-import { checkEncCryptoKey } from '../lib/crypto_key.js';
-import invalidKeyInput from '../lib/invalid_key_input.js';
-import { types } from './is_key_like.js';
-export async function deriveKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) {
-    if (!isCryptoKey(publicKey)) {
-        throw new TypeError(invalidKeyInput(publicKey, ...types));
-    }
-    checkEncCryptoKey(publicKey, 'ECDH');
-    if (!isCryptoKey(privateKey)) {
-        throw new TypeError(invalidKeyInput(privateKey, ...types));
-    }
-    checkEncCryptoKey(privateKey, 'ECDH', 'deriveBits');
-    const value = concat(lengthAndInput(encoder.encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength));
-    let length;
-    if (publicKey.algorithm.name === 'X25519') {
-        length = 256;
-    }
-    else if (publicKey.algorithm.name === 'X448') {
-        length = 448;
-    }
-    else {
-        length =
-            Math.ceil(parseInt(publicKey.algorithm.namedCurve.substr(-3), 10) / 8) <<
-                3;
-    }
-    const sharedSecret = new Uint8Array(await crypto.subtle.deriveBits({
-        name: publicKey.algorithm.name,
-        public: publicKey,
-    }, privateKey, length));
-    return concatKdf(sharedSecret, keyLength, value);
-}
-export async function generateEpk(key) {
-    if (!isCryptoKey(key)) {
-        throw new TypeError(invalidKeyInput(key, ...types));
-    }
-    return crypto.subtle.generateKey(key.algorithm, true, ['deriveBits']);
-}
-export function ecdhAllowed(key) {
-    if (!isCryptoKey(key)) {
-        throw new TypeError(invalidKeyInput(key, ...types));
-    }
-    return (['P-256', 'P-384', 'P-521'].includes(key.algorithm.namedCurve) ||
-        key.algorithm.name === 'X25519' ||
-        key.algorithm.name === 'X448');
-}

package/dist/browser/runtime/fetch_jwks.js

@@ -1,34 +0,0 @@
-import { JOSEError, JWKSTimeout } from '../util/errors.js';
-const fetchJwks = async (url, timeout, options) => {
-    let controller;
-    let id;
-    let timedOut = false;
-    if (typeof AbortController === 'function') {
-        controller = new AbortController();
-        id = setTimeout(() => {
-            timedOut = true;
-            controller.abort();
-        }, timeout);
-    }
-    const response = await fetch(url.href, {
-        signal: controller ? controller.signal : undefined,
-        redirect: 'manual',
-        headers: options.headers,
-    }).catch((err) => {
-        if (timedOut)
-            throw new JWKSTimeout();
-        throw err;
-    });
-    if (id !== undefined)
-        clearTimeout(id);
-    if (response.status !== 200) {
-        throw new JOSEError('Expected 200 OK from the JSON Web Key Set HTTP response');
-    }
-    try {
-        return await response.json();
-    }
-    catch {
-        throw new JOSEError('Failed to parse the JSON Web Key Set HTTP response as JSON');
-    }
-};
-export default fetchJwks;

package/dist/browser/runtime/get_sign_verify_key.js

@@ -1,24 +0,0 @@
-import crypto, { isCryptoKey } from './webcrypto.js';
-import { checkSigCryptoKey } from '../lib/crypto_key.js';
-import invalidKeyInput from '../lib/invalid_key_input.js';
-import { types } from './is_key_like.js';
-import normalize from './normalize_key.js';
-export default async function getCryptoKey(alg, key, usage) {
-    if (usage === 'sign') {
-        key = await normalize.normalizePrivateKey(key, alg);
-    }
-    if (usage === 'verify') {
-        key = await normalize.normalizePublicKey(key, alg);
-    }
-    if (isCryptoKey(key)) {
-        checkSigCryptoKey(key, alg, usage);
-        return key;
-    }
-    if (key instanceof Uint8Array) {
-        if (!alg.startsWith('HS')) {
-            throw new TypeError(invalidKeyInput(key, ...types));
-        }
-        return crypto.subtle.importKey('raw', key, { hash: `SHA-${alg.slice(-3)}`, name: 'HMAC' }, false, [usage]);
-    }
-    throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array', 'JSON Web Key'));
-}

package/dist/browser/runtime/is_key_like.js

@@ -1,8 +0,0 @@
-import { isCryptoKey } from './webcrypto.js';
-export default (key) => {
-    if (isCryptoKey(key)) {
-        return true;
-    }
-    return key?.[Symbol.toStringTag] === 'KeyObject';
-};
-export const types = ['CryptoKey'];

package/dist/browser/runtime/key_to_jwk.js

@@ -1,21 +0,0 @@
-import crypto, { isCryptoKey } from './webcrypto.js';
-import invalidKeyInput from '../lib/invalid_key_input.js';
-import { encode as base64url } from './base64url.js';
-import { types } from './is_key_like.js';
-const keyToJWK = async (key) => {
-    if (key instanceof Uint8Array) {
-        return {
-            kty: 'oct',
-            k: base64url(key),
-        };
-    }
-    if (!isCryptoKey(key)) {
-        throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
-    }
-    if (!key.extractable) {
-        throw new TypeError('non-extractable CryptoKey cannot be exported as a JWK');
-    }
-    const { ext, key_ops, alg, use, ...jwk } = await crypto.subtle.exportKey('jwk', key);
-    return jwk;
-};
-export default keyToJWK;

package/dist/browser/runtime/normalize_key.js

@@ -1,68 +0,0 @@
-import { isJWK } from '../lib/is_jwk.js';
-import { decode } from './base64url.js';
-import importJWK from './jwk_to_key.js';
-const exportKeyValue = (k) => decode(k);
-let privCache;
-let pubCache;
-const isKeyObject = (key) => {
-    return key?.[Symbol.toStringTag] === 'KeyObject';
-};
-const importAndCache = async (cache, key, jwk, alg, freeze = false) => {
-    let cached = cache.get(key);
-    if (cached?.[alg]) {
-        return cached[alg];
-    }
-    const cryptoKey = await importJWK({ ...jwk, alg });
-    if (freeze)
-        Object.freeze(key);
-    if (!cached) {
-        cache.set(key, { [alg]: cryptoKey });
-    }
-    else {
-        cached[alg] = cryptoKey;
-    }
-    return cryptoKey;
-};
-const normalizePublicKey = (key, alg) => {
-    if (isKeyObject(key)) {
-        let jwk = key.export({ format: 'jwk' });
-        delete jwk.d;
-        delete jwk.dp;
-        delete jwk.dq;
-        delete jwk.p;
-        delete jwk.q;
-        delete jwk.qi;
-        if (jwk.k) {
-            return exportKeyValue(jwk.k);
-        }
-        pubCache || (pubCache = new WeakMap());
-        return importAndCache(pubCache, key, jwk, alg);
-    }
-    if (isJWK(key)) {
-        if (key.k)
-            return decode(key.k);
-        pubCache || (pubCache = new WeakMap());
-        const cryptoKey = importAndCache(pubCache, key, key, alg, true);
-        return cryptoKey;
-    }
-    return key;
-};
-const normalizePrivateKey = (key, alg) => {
-    if (isKeyObject(key)) {
-        let jwk = key.export({ format: 'jwk' });
-        if (jwk.k) {
-            return exportKeyValue(jwk.k);
-        }
-        privCache || (privCache = new WeakMap());
-        return importAndCache(privCache, key, jwk, alg);
-    }
-    if (isJWK(key)) {
-        if (key.k)
-            return decode(key.k);
-        privCache || (privCache = new WeakMap());
-        const cryptoKey = importAndCache(privCache, key, key, alg, true);
-        return cryptoKey;
-    }
-    return key;
-};
-export default { normalizePublicKey, normalizePrivateKey };

package/dist/browser/runtime/pbes2kw.js

@@ -1,51 +0,0 @@
-import random from './random.js';
-import { p2s as concatSalt } from '../lib/buffer_utils.js';
-import { encode as base64url } from './base64url.js';
-import { wrap, unwrap } from './aeskw.js';
-import checkP2s from '../lib/check_p2s.js';
-import crypto, { isCryptoKey } from './webcrypto.js';
-import { checkEncCryptoKey } from '../lib/crypto_key.js';
-import invalidKeyInput from '../lib/invalid_key_input.js';
-import { types } from './is_key_like.js';
-function getCryptoKey(key, alg) {
-    if (key instanceof Uint8Array) {
-        return crypto.subtle.importKey('raw', key, 'PBKDF2', false, ['deriveBits']);
-    }
-    if (isCryptoKey(key)) {
-        checkEncCryptoKey(key, alg, 'deriveBits', 'deriveKey');
-        return key;
-    }
-    throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
-}
-async function deriveKey(p2s, alg, p2c, key) {
-    checkP2s(p2s);
-    const salt = concatSalt(alg, p2s);
-    const keylen = parseInt(alg.slice(13, 16), 10);
-    const subtleAlg = {
-        hash: `SHA-${alg.slice(8, 11)}`,
-        iterations: p2c,
-        name: 'PBKDF2',
-        salt,
-    };
-    const wrapAlg = {
-        length: keylen,
-        name: 'AES-KW',
-    };
-    const cryptoKey = await getCryptoKey(key, alg);
-    if (cryptoKey.usages.includes('deriveBits')) {
-        return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
-    }
-    if (cryptoKey.usages.includes('deriveKey')) {
-        return crypto.subtle.deriveKey(subtleAlg, cryptoKey, wrapAlg, false, ['wrapKey', 'unwrapKey']);
-    }
-    throw new TypeError('PBKDF2 key "usages" must include "deriveBits" or "deriveKey"');
-}
-export const encrypt = async (alg, key, cek, p2c = 2048, p2s = random(new Uint8Array(16))) => {
-    const derived = await deriveKey(p2s, alg, p2c, key);
-    const encryptedKey = await wrap(alg.slice(-6), derived, cek);
-    return { encryptedKey, p2c, p2s: base64url(p2s) };
-};
-export const decrypt = async (alg, key, encryptedKey, p2c, p2s) => {
-    const derived = await deriveKey(p2s, alg, p2c, key);
-    return unwrap(alg.slice(-6), derived, encryptedKey);
-};

package/dist/browser/runtime/random.js

@@ -1,2 +0,0 @@
-import crypto from './webcrypto.js';
-export default crypto.getRandomValues.bind(crypto);

package/dist/browser/runtime/rsaes.js

@@ -1,37 +0,0 @@
-import subtleAlgorithm from './subtle_rsaes.js';
-import bogusWebCrypto from './bogus.js';
-import crypto, { isCryptoKey } from './webcrypto.js';
-import { checkEncCryptoKey } from '../lib/crypto_key.js';
-import checkKeyLength from './check_key_length.js';
-import invalidKeyInput from '../lib/invalid_key_input.js';
-import { types } from './is_key_like.js';
-export const encrypt = async (alg, key, cek) => {
-    if (!isCryptoKey(key)) {
-        throw new TypeError(invalidKeyInput(key, ...types));
-    }
-    checkEncCryptoKey(key, alg, 'encrypt', 'wrapKey');
-    checkKeyLength(alg, key);
-    if (key.usages.includes('encrypt')) {
-        return new Uint8Array(await crypto.subtle.encrypt(subtleAlgorithm(alg), key, cek));
-    }
-    if (key.usages.includes('wrapKey')) {
-        const cryptoKeyCek = await crypto.subtle.importKey('raw', cek, ...bogusWebCrypto);
-        return new Uint8Array(await crypto.subtle.wrapKey('raw', cryptoKeyCek, key, subtleAlgorithm(alg)));
-    }
-    throw new TypeError('RSA-OAEP key "usages" must include "encrypt" or "wrapKey" for this operation');
-};
-export const decrypt = async (alg, key, encryptedKey) => {
-    if (!isCryptoKey(key)) {
-        throw new TypeError(invalidKeyInput(key, ...types));
-    }
-    checkEncCryptoKey(key, alg, 'decrypt', 'unwrapKey');
-    checkKeyLength(alg, key);
-    if (key.usages.includes('decrypt')) {
-        return new Uint8Array(await crypto.subtle.decrypt(subtleAlgorithm(alg), key, encryptedKey));
-    }
-    if (key.usages.includes('unwrapKey')) {
-        const cryptoKeyCek = await crypto.subtle.unwrapKey('raw', encryptedKey, key, subtleAlgorithm(alg), ...bogusWebCrypto);
-        return new Uint8Array(await crypto.subtle.exportKey('raw', cryptoKeyCek));
-    }
-    throw new TypeError('RSA-OAEP key "usages" must include "decrypt" or "unwrapKey" for this operation');
-};

package/dist/browser/runtime/runtime.js

@@ -1 +0,0 @@
-export default 'WebCryptoAPI';

package/dist/browser/runtime/subtle_rsaes.js

@@ -1,12 +0,0 @@
-import { JOSENotSupported } from '../util/errors.js';
-export default function subtleRsaEs(alg) {
-    switch (alg) {
-        case 'RSA-OAEP':
-        case 'RSA-OAEP-256':
-        case 'RSA-OAEP-384':
-        case 'RSA-OAEP-512':
-            return 'RSA-OAEP';
-        default:
-            throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
-    }
-}

package/dist/browser/runtime/timing_safe_equal.js

@@ -1,19 +0,0 @@
-const timingSafeEqual = (a, b) => {
-    if (!(a instanceof Uint8Array)) {
-        throw new TypeError('First argument must be a buffer');
-    }
-    if (!(b instanceof Uint8Array)) {
-        throw new TypeError('Second argument must be a buffer');
-    }
-    if (a.length !== b.length) {
-        throw new TypeError('Input buffers must have the same length');
-    }
-    const len = a.length;
-    let out = 0;
-    let i = -1;
-    while (++i < len) {
-        out |= a[i] ^ b[i];
-    }
-    return out === 0;
-};
-export default timingSafeEqual;

package/dist/browser/runtime/webcrypto.js

@@ -1,2 +0,0 @@
-export default crypto;
-export const isCryptoKey = (key) => key instanceof CryptoKey;

package/dist/browser/util/base64url.js

@@ -1,3 +0,0 @@
-import * as base64url from '../runtime/base64url.js';
-export const encode = base64url.encode;
-export const decode = base64url.decode;