jose 6.1.3 → 6.2.1

package/dist/types/jwe/general/decrypt.d.ts

@@ -16,6 +16,13 @@ export interface GeneralDecryptGetKey extends types.GetKeyFunction<types.JWEHead
  * This function is exported (as a named export) from the main `'jose'` module entry point as well
  * as from its subpath export `'jose/jwe/general/decrypt'`.
  *
+ * > [!NOTE]\
+ * > The function iterates over the `recipients` array in the General JWE and returns the decryption
+ * > result of the first recipient entry that can be successfully decrypted. The result only contains
+ * > the plaintext and headers of that successfully decrypted recipient entry. Other recipient entries
+ * > in the General JWE are not validated, and their headers are not included in the returned result.
+ * > Recipients of a General JWE should only rely on the returned (decrypted) data.
+ *
  * @param jwe General JWE.
  * @param key Private Key or Secret to decrypt the JWE with. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.

package/dist/types/jws/general/verify.d.ts

@@ -18,6 +18,14 @@ export interface GeneralVerifyGetKey extends types.GenericGetKeyFunction<types.J
  * This function is exported (as a named export) from the main `'jose'` module entry point as well
  * as from its subpath export `'jose/jws/general/verify'`.
  *
+ * > [!NOTE]\
+ * > The function iterates over the `signatures` array in the General JWS and returns the verification
+ * > result of the first signature entry that can be successfully verified. The result only contains
+ * > the payload, protected header, and unprotected header of that successfully verified signature
+ * > entry. Other signature entries in the General JWS are not validated, and their headers are not
+ * > included in the returned result. Recipients of a General JWS should only rely on the returned
+ * > (verified) data.
+ *
  * @param jws General JWS.
  * @param key Key to verify the JWS with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.

package/dist/types/types.d.ts

@@ -415,12 +415,12 @@ export interface JWEHeaderParameters extends JoseHeaderParameters {
   crit?: string[]
 
   /**
-   * JWE "zip" (Compression Algorithm) Header Parameter. This parameter is not supported anymore.
+   * JWE "zip" (Compression Algorithm) Header Parameter.
    *
-   * @deprecated Compression of data SHOULD NOT be done before encryption, because such compressed
-   *   data often reveals information about the plaintext.
+   * The only supported value is `"DEF"` (DEFLATE). Requires the `CompressionStream` /
+   * `DecompressionStream` APIs to be available in the runtime.
    *
-   * @see {@link https://www.rfc-editor.org/rfc/rfc8725#name-avoid-compression-of-encryp Avoid Compression of Encryption Inputs}
+   * @see {@link https://www.rfc-editor.org/rfc/rfc7516#section-4.1.3 JWE "zip" Header Parameter}
    */
   zip?: string
 
@@ -474,6 +474,17 @@ export interface DecryptOptions extends CritOption {
    * this value is set to 10000.
    */
   maxPBES2Count?: number
+
+  /**
+   * Maximum allowed size (in bytes) of the decompressed plaintext when the JWE `"zip"` (Compression
+   * Algorithm) Header Parameter is present. By default this value is set to 250000 (250 KB). The
+   * value must be `0`, a positive safe integer, or `Infinity`.
+   *
+   * Set to `0` to reject all compressed JWEs during decryption.
+   *
+   * Set to `Infinity` to disable the decompressed size limit.
+   */
+  maxDecompressedLength?: number
 }
 
 /** JWE Encryption options. */

package/dist/webapi/jwe/flattened/decrypt.js

@@ -1,15 +1,17 @@
 import { decode as b64u } from '../../util/base64url.js';
-import { decrypt } from '../../lib/decrypt.js';
+import { decrypt } from '../../lib/content_encryption.js';
+import { decodeBase64url } from '../../lib/helpers.js';
 import { JOSEAlgNotAllowed, JOSENotSupported, JWEInvalid } from '../../util/errors.js';
-import { isDisjoint } from '../../lib/is_disjoint.js';
-import { isObject } from '../../lib/is_object.js';
-import { decryptKeyManagement } from '../../lib/decrypt_key_management.js';
+import { isDisjoint } from '../../lib/type_checks.js';
+import { isObject } from '../../lib/type_checks.js';
+import { decryptKeyManagement } from '../../lib/key_management.js';
 import { decoder, concat, encode } from '../../lib/buffer_utils.js';
-import { generateCek } from '../../lib/cek.js';
+import { generateCek } from '../../lib/content_encryption.js';
 import { validateCrit } from '../../lib/validate_crit.js';
 import { validateAlgorithms } from '../../lib/validate_algorithms.js';
 import { normalizeKey } from '../../lib/normalize_key.js';
 import { checkKeyType } from '../../lib/check_key_type.js';
+import { decompress } from '../../lib/deflate.js';
 export async function flattenedDecrypt(jwe, key, options) {
     if (!isObject(jwe)) {
         throw new JWEInvalid('Flattened JWE must be an object');
@@ -60,8 +62,11 @@ export async function flattenedDecrypt(jwe, key, options) {
         ...jwe.unprotected,
     };
     validateCrit(JWEInvalid, new Map(), options?.crit, parsedProt, joseHeader);
-    if (joseHeader.zip !== undefined) {
-        throw new JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');
+    if (joseHeader.zip !== undefined && joseHeader.zip !== 'DEF') {
+        throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');
+    }
+    if (joseHeader.zip !== undefined && !parsedProt?.zip) {
+        throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');
     }
     const { alg, enc } = joseHeader;
     if (typeof alg !== 'string' || !alg) {
@@ -82,12 +87,7 @@ export async function flattenedDecrypt(jwe, key, options) {
     }
     let encryptedKey;
     if (jwe.encrypted_key !== undefined) {
-        try {
-            encryptedKey = b64u(jwe.encrypted_key);
-        }
-        catch {
-            throw new JWEInvalid('Failed to base64url decode the encrypted_key');
-        }
+        encryptedKey = decodeBase64url(jwe.encrypted_key, 'encrypted_key', JWEInvalid);
     }
     let resolvedKey = false;
     if (typeof key === 'function') {
@@ -109,20 +109,10 @@ export async function flattenedDecrypt(jwe, key, options) {
     let iv;
     let tag;
     if (jwe.iv !== undefined) {
-        try {
-            iv = b64u(jwe.iv);
-        }
-        catch {
-            throw new JWEInvalid('Failed to base64url decode the iv');
-        }
+        iv = decodeBase64url(jwe.iv, 'iv', JWEInvalid);
     }
     if (jwe.tag !== undefined) {
-        try {
-            tag = b64u(jwe.tag);
-        }
-        catch {
-            throw new JWEInvalid('Failed to base64url decode the tag');
-        }
+        tag = decodeBase64url(jwe.tag, 'tag', JWEInvalid);
     }
     const protectedHeader = jwe.protected !== undefined ? encode(jwe.protected) : new Uint8Array();
     let additionalData;
@@ -132,25 +122,25 @@ export async function flattenedDecrypt(jwe, key, options) {
     else {
         additionalData = protectedHeader;
     }
-    let ciphertext;
-    try {
-        ciphertext = b64u(jwe.ciphertext);
-    }
-    catch {
-        throw new JWEInvalid('Failed to base64url decode the ciphertext');
-    }
+    const ciphertext = decodeBase64url(jwe.ciphertext, 'ciphertext', JWEInvalid);
     const plaintext = await decrypt(enc, cek, ciphertext, iv, tag, additionalData);
     const result = { plaintext };
+    if (joseHeader.zip === 'DEF') {
+        const maxDecompressedLength = options?.maxDecompressedLength ?? 250_000;
+        if (maxDecompressedLength === 0) {
+            throw new JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');
+        }
+        if (maxDecompressedLength !== Infinity &&
+            (!Number.isSafeInteger(maxDecompressedLength) || maxDecompressedLength < 1)) {
+            throw new TypeError('maxDecompressedLength must be 0, a positive safe integer, or Infinity');
+        }
+        result.plaintext = await decompress(plaintext, maxDecompressedLength);
+    }
     if (jwe.protected !== undefined) {
         result.protectedHeader = parsedProt;
     }
     if (jwe.aad !== undefined) {
-        try {
-            result.additionalAuthenticatedData = b64u(jwe.aad);
-        }
-        catch {
-            throw new JWEInvalid('Failed to base64url decode the aad');
-        }
+        result.additionalAuthenticatedData = decodeBase64url(jwe.aad, 'aad', JWEInvalid);
     }
     if (jwe.unprotected !== undefined) {
         result.sharedUnprotectedHeader = jwe.unprotected;

package/dist/webapi/jwe/flattened/encrypt.js

@@ -1,13 +1,14 @@
 import { encode as b64u } from '../../util/base64url.js';
-import { unprotected } from '../../lib/private_symbols.js';
-import { encrypt } from '../../lib/encrypt.js';
-import { encryptKeyManagement } from '../../lib/encrypt_key_management.js';
+import { unprotected, assertNotSet } from '../../lib/helpers.js';
+import { encrypt } from '../../lib/content_encryption.js';
+import { encryptKeyManagement } from '../../lib/key_management.js';
 import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
-import { isDisjoint } from '../../lib/is_disjoint.js';
+import { isDisjoint } from '../../lib/type_checks.js';
 import { concat, encode } from '../../lib/buffer_utils.js';
 import { validateCrit } from '../../lib/validate_crit.js';
 import { normalizeKey } from '../../lib/normalize_key.js';
 import { checkKeyType } from '../../lib/check_key_type.js';
+import { compress } from '../../lib/deflate.js';
 export class FlattenedEncrypt {
     #plaintext;
     #protectedHeader;
@@ -24,30 +25,22 @@ export class FlattenedEncrypt {
         this.#plaintext = plaintext;
     }
     setKeyManagementParameters(parameters) {
-        if (this.#keyManagementParameters) {
-            throw new TypeError('setKeyManagementParameters can only be called once');
-        }
+        assertNotSet(this.#keyManagementParameters, 'setKeyManagementParameters');
         this.#keyManagementParameters = parameters;
         return this;
     }
     setProtectedHeader(protectedHeader) {
-        if (this.#protectedHeader) {
-            throw new TypeError('setProtectedHeader can only be called once');
-        }
+        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
         this.#protectedHeader = protectedHeader;
         return this;
     }
     setSharedUnprotectedHeader(sharedUnprotectedHeader) {
-        if (this.#sharedUnprotectedHeader) {
-            throw new TypeError('setSharedUnprotectedHeader can only be called once');
-        }
+        assertNotSet(this.#sharedUnprotectedHeader, 'setSharedUnprotectedHeader');
         this.#sharedUnprotectedHeader = sharedUnprotectedHeader;
         return this;
     }
     setUnprotectedHeader(unprotectedHeader) {
-        if (this.#unprotectedHeader) {
-            throw new TypeError('setUnprotectedHeader can only be called once');
-        }
+        assertNotSet(this.#unprotectedHeader, 'setUnprotectedHeader');
         this.#unprotectedHeader = unprotectedHeader;
         return this;
     }
@@ -56,16 +49,12 @@ export class FlattenedEncrypt {
         return this;
     }
     setContentEncryptionKey(cek) {
-        if (this.#cek) {
-            throw new TypeError('setContentEncryptionKey can only be called once');
-        }
+        assertNotSet(this.#cek, 'setContentEncryptionKey');
         this.#cek = cek;
         return this;
     }
     setInitializationVector(iv) {
-        if (this.#iv) {
-            throw new TypeError('setInitializationVector can only be called once');
-        }
+        assertNotSet(this.#iv, 'setInitializationVector');
         this.#iv = iv;
         return this;
     }
@@ -82,8 +71,11 @@ export class FlattenedEncrypt {
             ...this.#sharedUnprotectedHeader,
         };
         validateCrit(JWEInvalid, new Map(), options?.crit, this.#protectedHeader, joseHeader);
-        if (joseHeader.zip !== undefined) {
-            throw new JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');
+        if (joseHeader.zip !== undefined && joseHeader.zip !== 'DEF') {
+            throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');
+        }
+        if (joseHeader.zip !== undefined && !this.#protectedHeader?.zip) {
+            throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');
         }
         const { alg, enc } = joseHeader;
         if (typeof alg !== 'string' || !alg) {
@@ -139,7 +131,11 @@ export class FlattenedEncrypt {
         else {
             additionalData = protectedHeaderB;
         }
-        const { ciphertext, tag, iv } = await encrypt(enc, this.#plaintext, cek, this.#iv, additionalData);
+        let plaintext = this.#plaintext;
+        if (joseHeader.zip === 'DEF') {
+            plaintext = await compress(plaintext);
+        }
+        const { ciphertext, tag, iv } = await encrypt(enc, plaintext, cek, this.#iv, additionalData);
         const jwe = {
             ciphertext: b64u(ciphertext),
         };

package/dist/webapi/jwe/general/decrypt.js

@@ -1,6 +1,6 @@
 import { flattenedDecrypt } from '../flattened/decrypt.js';
 import { JWEDecryptionFailed, JWEInvalid } from '../../util/errors.js';
-import { isObject } from '../../lib/is_object.js';
+import { isObject } from '../../lib/type_checks.js';
 export async function generalDecrypt(jwe, key, options) {
     if (!isObject(jwe)) {
         throw new JWEInvalid('General JWE must be an object');

package/dist/webapi/jwe/general/encrypt.js

@@ -1,9 +1,9 @@
 import { FlattenedEncrypt } from '../flattened/encrypt.js';
-import { unprotected } from '../../lib/private_symbols.js';
+import { unprotected, assertNotSet } from '../../lib/helpers.js';
 import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
-import { generateCek } from '../../lib/cek.js';
-import { isDisjoint } from '../../lib/is_disjoint.js';
-import { encryptKeyManagement } from '../../lib/encrypt_key_management.js';
+import { generateCek } from '../../lib/content_encryption.js';
+import { isDisjoint } from '../../lib/type_checks.js';
+import { encryptKeyManagement } from '../../lib/key_management.js';
 import { encode as b64u } from '../../util/base64url.js';
 import { validateCrit } from '../../lib/validate_crit.js';
 import { normalizeKey } from '../../lib/normalize_key.js';
@@ -20,16 +20,12 @@ class IndividualRecipient {
         this.options = options;
     }
     setUnprotectedHeader(unprotectedHeader) {
-        if (this.unprotectedHeader) {
-            throw new TypeError('setUnprotectedHeader can only be called once');
-        }
+        assertNotSet(this.unprotectedHeader, 'setUnprotectedHeader');
         this.unprotectedHeader = unprotectedHeader;
         return this;
     }
     setKeyManagementParameters(parameters) {
-        if (this.keyManagementParameters) {
-            throw new TypeError('setKeyManagementParameters can only be called once');
-        }
+        assertNotSet(this.keyManagementParameters, 'setKeyManagementParameters');
         this.keyManagementParameters = parameters;
         return this;
     }
@@ -58,16 +54,12 @@ export class GeneralEncrypt {
         return recipient;
     }
     setProtectedHeader(protectedHeader) {
-        if (this.#protectedHeader) {
-            throw new TypeError('setProtectedHeader can only be called once');
-        }
+        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
         this.#protectedHeader = protectedHeader;
         return this;
     }
     setSharedUnprotectedHeader(sharedUnprotectedHeader) {
-        if (this.#unprotectedHeader) {
-            throw new TypeError('setSharedUnprotectedHeader can only be called once');
-        }
+        assertNotSet(this.#unprotectedHeader, 'setSharedUnprotectedHeader');
         this.#unprotectedHeader = sharedUnprotectedHeader;
         return this;
     }
@@ -133,8 +125,11 @@ export class GeneralEncrypt {
                 throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');
             }
             validateCrit(JWEInvalid, new Map(), recipient.options.crit, this.#protectedHeader, joseHeader);
-            if (joseHeader.zip !== undefined) {
-                throw new JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');
+            if (joseHeader.zip !== undefined && joseHeader.zip !== 'DEF') {
+                throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');
+            }
+            if (joseHeader.zip !== undefined && !this.#protectedHeader?.zip) {
+                throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');
             }
         }
         const cek = generateCek(enc);

package/dist/webapi/jwk/embedded.js

@@ -1,5 +1,5 @@
 import { importJWK } from '../key/import.js';
-import { isObject } from '../lib/is_object.js';
+import { isObject } from '../lib/type_checks.js';
 import { JWSInvalid } from '../util/errors.js';
 export async function EmbeddedJWK(protectedHeader, token) {
     const joseHeader = {

package/dist/webapi/jwk/thumbprint.js

@@ -1,9 +1,9 @@
-import { digest } from '../lib/digest.js';
+import { digest } from '../lib/helpers.js';
 import { encode as b64u } from '../util/base64url.js';
 import { JOSENotSupported, JWKInvalid } from '../util/errors.js';
 import { encode } from '../lib/buffer_utils.js';
 import { isKeyLike } from '../lib/is_key_like.js';
-import { isJWK } from '../lib/is_jwk.js';
+import { isJWK } from '../lib/type_checks.js';
 import { exportJWK } from '../key/export.js';
 import { invalidKeyInput } from '../lib/invalid_key_input.js';
 const check = (value, description) => {

package/dist/webapi/jwks/local.js

@@ -1,6 +1,6 @@
 import { importJWK } from '../key/import.js';
 import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, } from '../util/errors.js';
-import { isObject } from '../lib/is_object.js';
+import { isObject } from '../lib/type_checks.js';
 function getKtyFromAlg(alg) {
     switch (typeof alg === 'string' && alg.slice(0, 2)) {
         case 'RS':

package/dist/webapi/jwks/remote.js

@@ -1,6 +1,6 @@
 import { JOSEError, JWKSNoMatchingKey, JWKSTimeout } from '../util/errors.js';
 import { createLocalJWKSet } from './local.js';
-import { isObject } from '../lib/is_object.js';
+import { isObject } from '../lib/type_checks.js';
 function isCloudflareWorkers() {
     return (typeof WebSocketPair !== 'undefined' ||
         (typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers') ||
@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v6.1.3';
+    const VERSION = 'v6.2.1';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const customFetch = Symbol();

package/dist/webapi/jws/flattened/sign.js

@@ -1,11 +1,12 @@
 import { encode as b64u } from '../../util/base64url.js';
-import { sign } from '../../lib/sign.js';
-import { isDisjoint } from '../../lib/is_disjoint.js';
+import { sign } from '../../lib/signing.js';
+import { isDisjoint } from '../../lib/type_checks.js';
 import { JWSInvalid } from '../../util/errors.js';
 import { concat, encode } from '../../lib/buffer_utils.js';
 import { checkKeyType } from '../../lib/check_key_type.js';
 import { validateCrit } from '../../lib/validate_crit.js';
 import { normalizeKey } from '../../lib/normalize_key.js';
+import { assertNotSet } from '../../lib/helpers.js';
 export class FlattenedSign {
     #payload;
     #protectedHeader;
@@ -17,16 +18,12 @@ export class FlattenedSign {
         this.#payload = payload;
     }
     setProtectedHeader(protectedHeader) {
-        if (this.#protectedHeader) {
-            throw new TypeError('setProtectedHeader can only be called once');
-        }
+        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
         this.#protectedHeader = protectedHeader;
         return this;
     }
     setUnprotectedHeader(unprotectedHeader) {
-        if (this.#unprotectedHeader) {
-            throw new TypeError('setUnprotectedHeader can only be called once');
-        }
+        assertNotSet(this.#unprotectedHeader, 'setUnprotectedHeader');
         this.#unprotectedHeader = unprotectedHeader;
         return this;
     }

package/dist/webapi/jws/flattened/verify.js

@@ -1,9 +1,10 @@
 import { decode as b64u } from '../../util/base64url.js';
-import { verify } from '../../lib/verify.js';
+import { verify } from '../../lib/signing.js';
 import { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';
 import { concat, encoder, decoder, encode } from '../../lib/buffer_utils.js';
-import { isDisjoint } from '../../lib/is_disjoint.js';
-import { isObject } from '../../lib/is_object.js';
+import { decodeBase64url } from '../../lib/helpers.js';
+import { isDisjoint } from '../../lib/type_checks.js';
+import { isObject } from '../../lib/type_checks.js';
 import { checkKeyType } from '../../lib/check_key_type.js';
 import { validateCrit } from '../../lib/validate_crit.js';
 import { validateAlgorithms } from '../../lib/validate_algorithms.js';
@@ -79,13 +80,7 @@ export async function flattenedVerify(jws, key, options) {
             ? encode(jws.payload)
             : encoder.encode(jws.payload)
         : jws.payload);
-    let signature;
-    try {
-        signature = b64u(jws.signature);
-    }
-    catch {
-        throw new JWSInvalid('Failed to base64url decode the signature');
-    }
+    const signature = decodeBase64url(jws.signature, 'signature', JWSInvalid);
     const k = await normalizeKey(key, alg);
     const verified = await verify(alg, k, signature, data);
     if (!verified) {
@@ -93,12 +88,7 @@ export async function flattenedVerify(jws, key, options) {
     }
     let payload;
     if (b64) {
-        try {
-            payload = b64u(jws.payload);
-        }
-        catch {
-            throw new JWSInvalid('Failed to base64url decode the payload');
-        }
+        payload = decodeBase64url(jws.payload, 'payload', JWSInvalid);
     }
     else if (typeof jws.payload === 'string') {
         payload = encoder.encode(jws.payload);

package/dist/webapi/jws/general/sign.js

@@ -1,5 +1,6 @@
 import { FlattenedSign } from '../flattened/sign.js';
 import { JWSInvalid } from '../../util/errors.js';
+import { assertNotSet } from '../../lib/helpers.js';
 class IndividualSignature {
     #parent;
     protectedHeader;
@@ -12,16 +13,12 @@ class IndividualSignature {
         this.options = options;
     }
     setProtectedHeader(protectedHeader) {
-        if (this.protectedHeader) {
-            throw new TypeError('setProtectedHeader can only be called once');
-        }
+        assertNotSet(this.protectedHeader, 'setProtectedHeader');
         this.protectedHeader = protectedHeader;
         return this;
     }
     setUnprotectedHeader(unprotectedHeader) {
-        if (this.unprotectedHeader) {
-            throw new TypeError('setUnprotectedHeader can only be called once');
-        }
+        assertNotSet(this.unprotectedHeader, 'setUnprotectedHeader');
         this.unprotectedHeader = unprotectedHeader;
         return this;
     }

package/dist/webapi/jws/general/verify.js

@@ -1,6 +1,6 @@
 import { flattenedVerify } from '../flattened/verify.js';
 import { JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';
-import { isObject } from '../../lib/is_object.js';
+import { isObject } from '../../lib/type_checks.js';
 export async function generalVerify(jws, key, options) {
     if (!isObject(jws)) {
         throw new JWSInvalid('General JWS must be an object');

package/dist/webapi/jwt/encrypt.js

@@ -1,5 +1,6 @@
 import { CompactEncrypt } from '../jwe/compact/encrypt.js';
 import { JWTClaimsBuilder } from '../lib/jwt_claims_set.js';
+import { assertNotSet } from '../lib/helpers.js';
 export class EncryptJWT {
     #cek;
     #iv;
@@ -41,30 +42,22 @@ export class EncryptJWT {
         return this;
     }
     setProtectedHeader(protectedHeader) {
-        if (this.#protectedHeader) {
-            throw new TypeError('setProtectedHeader can only be called once');
-        }
+        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
         this.#protectedHeader = protectedHeader;
         return this;
     }
     setKeyManagementParameters(parameters) {
-        if (this.#keyManagementParameters) {
-            throw new TypeError('setKeyManagementParameters can only be called once');
-        }
+        assertNotSet(this.#keyManagementParameters, 'setKeyManagementParameters');
         this.#keyManagementParameters = parameters;
         return this;
     }
     setContentEncryptionKey(cek) {
-        if (this.#cek) {
-            throw new TypeError('setContentEncryptionKey can only be called once');
-        }
+        assertNotSet(this.#cek, 'setContentEncryptionKey');
         this.#cek = cek;
         return this;
     }
     setInitializationVector(iv) {
-        if (this.#iv) {
-            throw new TypeError('setInitializationVector can only be called once');
-        }
+        assertNotSet(this.#iv, 'setInitializationVector');
         this.#iv = iv;
         return this;
     }

package/dist/webapi/key/import.js

@@ -2,7 +2,7 @@ import { decode as decodeBase64URL } from '../util/base64url.js';
 import { fromSPKI, fromPKCS8, fromX509 } from '../lib/asn1.js';
 import { jwkToKey } from '../lib/jwk_to_key.js';
 import { JOSENotSupported } from '../util/errors.js';
-import { isObject } from '../lib/is_object.js';
+import { isObject } from '../lib/type_checks.js';
 export async function importSPKI(spki, alg, options) {
     if (typeof spki !== 'string' || spki.indexOf('-----BEGIN PUBLIC KEY-----') !== 0) {
         throw new TypeError('"spki" must be SPKI formatted string');

package/dist/webapi/lib/aesgcmkw.js

@@ -1,5 +1,4 @@
-import { encrypt } from './encrypt.js';
-import { decrypt } from './decrypt.js';
+import { encrypt, decrypt } from './content_encryption.js';
 import { encode as b64u } from '../util/base64url.js';
 export async function wrap(alg, key, cek, iv) {
     const jweAlgorithm = alg.slice(0, 7);

package/dist/webapi/lib/check_key_type.js

@@ -1,6 +1,6 @@
 import { withAlg as invalidKeyInput } from './invalid_key_input.js';
 import { isKeyLike } from './is_key_like.js';
-import * as jwk from './is_jwk.js';
+import * as jwk from './type_checks.js';
 const tag = (key) => key?.[Symbol.toStringTag];
 const jwkMatchesOp = (alg, key, usage) => {
     if (key.use !== undefined) {