jose 6.2.10 → 6.2.11

package/dist/webapi/index.js

@@ -1,32 +1,70 @@
-export { compactDecrypt } from './jwe/compact/decrypt.js';
-export { flattenedDecrypt } from './jwe/flattened/decrypt.js';
-export { generalDecrypt } from './jwe/general/decrypt.js';
-export { GeneralEncrypt } from './jwe/general/encrypt.js';
-export { compactVerify } from './jws/compact/verify.js';
-export { flattenedVerify } from './jws/flattened/verify.js';
-export { generalVerify } from './jws/general/verify.js';
-export { jwtVerify } from './jwt/verify.js';
-export { jwtDecrypt } from './jwt/decrypt.js';
-export { CompactEncrypt } from './jwe/compact/encrypt.js';
-export { FlattenedEncrypt } from './jwe/flattened/encrypt.js';
-export { CompactSign } from './jws/compact/sign.js';
-export { FlattenedSign } from './jws/flattened/sign.js';
-export { GeneralSign } from './jws/general/sign.js';
-export { SignJWT } from './jwt/sign.js';
-export { EncryptJWT } from './jwt/encrypt.js';
-export { calculateJwkThumbprint, calculateJwkThumbprintUri } from './jwk/thumbprint.js';
-export { EmbeddedJWK } from './jwk/embedded.js';
-export { createLocalJWKSet } from './jwks/local.js';
-export { createRemoteJWKSet, jwksCache, customFetch } from './jwks/remote.js';
-export { UnsecuredJWT } from './jwt/unsecured.js';
-export { exportPKCS8, exportSPKI, exportJWK } from './key/export.js';
-export { importSPKI, importPKCS8, importX509, importJWK } from './key/import.js';
-export { decodeProtectedHeader } from './util/decode_protected_header.js';
-export { decodeJwt } from './util/decode_jwt.js';
-import * as errors from './util/errors.js';
-export { errors };
-export { generateKeyPair } from './key/generate_key_pair.js';
-export { generateSecret } from './key/generate_secret.js';
-import * as base64url from './util/base64url.js';
-export { base64url };
-export const cryptoRuntime = 'WebCryptoAPI';
+import { compactDecrypt } from "./jwe/compact/decrypt.js";
+import { flattenedDecrypt } from "./jwe/flattened/decrypt.js";
+import { generalDecrypt } from "./jwe/general/decrypt.js";
+import { GeneralEncrypt } from "./jwe/general/encrypt.js";
+import { compactVerify } from "./jws/compact/verify.js";
+import { flattenedVerify } from "./jws/flattened/verify.js";
+import { generalVerify } from "./jws/general/verify.js";
+import { jwtVerify } from "./jwt/verify.js";
+import { jwtDecrypt } from "./jwt/decrypt.js";
+import { CompactEncrypt } from "./jwe/compact/encrypt.js";
+import { FlattenedEncrypt } from "./jwe/flattened/encrypt.js";
+import { CompactSign } from "./jws/compact/sign.js";
+import { FlattenedSign } from "./jws/flattened/sign.js";
+import { GeneralSign } from "./jws/general/sign.js";
+import { SignJWT } from "./jwt/sign.js";
+import { EncryptJWT } from "./jwt/encrypt.js";
+import { calculateJwkThumbprint, calculateJwkThumbprintUri } from "./jwk/thumbprint.js";
+import { EmbeddedJWK } from "./jwk/embedded.js";
+import { createLocalJWKSet } from "./jwks/local.js";
+import { createRemoteJWKSet, jwksCache, customFetch } from "./jwks/remote.js";
+import { UnsecuredJWT } from "./jwt/unsecured.js";
+import { exportPKCS8, exportSPKI, exportJWK } from "./key/export.js";
+import { importSPKI, importPKCS8, importX509, importJWK } from "./key/import.js";
+import { decodeProtectedHeader } from "./util/decode_protected_header.js";
+import { decodeJwt } from "./util/decode_jwt.js";
+import * as errors from "./util/errors.js";
+import { generateKeyPair } from "./key/generate_key_pair.js";
+import { generateSecret } from "./key/generate_secret.js";
+import * as base64url from "./util/base64url.js";
+const cryptoRuntime = "WebCryptoAPI";
+export {
+  CompactEncrypt,
+  CompactSign,
+  EmbeddedJWK,
+  EncryptJWT,
+  FlattenedEncrypt,
+  FlattenedSign,
+  GeneralEncrypt,
+  GeneralSign,
+  SignJWT,
+  UnsecuredJWT,
+  base64url,
+  calculateJwkThumbprint,
+  calculateJwkThumbprintUri,
+  compactDecrypt,
+  compactVerify,
+  createLocalJWKSet,
+  createRemoteJWKSet,
+  cryptoRuntime,
+  customFetch,
+  decodeJwt,
+  decodeProtectedHeader,
+  errors,
+  exportJWK,
+  exportPKCS8,
+  exportSPKI,
+  flattenedDecrypt,
+  flattenedVerify,
+  generalDecrypt,
+  generalVerify,
+  generateKeyPair,
+  generateSecret,
+  importJWK,
+  importPKCS8,
+  importSPKI,
+  importX509,
+  jwksCache,
+  jwtDecrypt,
+  jwtVerify
+};

package/dist/webapi/jwe/compact/decrypt.js

@@ -1,9 +1,8 @@
-import { prepareDecrypt, decryptCompact } from '../../lib/jwe_decrypt.js';
-export async function compactDecrypt(jwe, key, options) {
-    const decrypted = await decryptCompact(jwe, prepareDecrypt(options), key);
-    const result = { plaintext: decrypted[0], protectedHeader: decrypted[1] };
-    if (typeof key === 'function') {
-        return { ...result, key: decrypted[2] };
-    }
-    return result;
+import { prepareDecrypt, decryptCompact } from "../../lib/jwe_decrypt.js";
+async function compactDecrypt(jwe, key, options) {
+  const decrypted = await decryptCompact(jwe, prepareDecrypt(options), key), result = { plaintext: decrypted[0], protectedHeader: decrypted[1] };
+  return typeof key == "function" ? { ...result, key: decrypted[2] } : result;
 }
+export {
+  compactDecrypt
+};

package/dist/webapi/jwe/compact/encrypt.js

@@ -1,49 +1,43 @@
-import { assertNotSet } from '../../lib/helpers.js';
-import { assertUint8Array } from '../../lib/type_checks.js';
-import { createJWE } from '../../lib/jwe_encrypt.js';
-export class CompactEncrypt {
-    #plaintext;
-    #protectedHeader;
-    #cek;
-    #iv;
-    #keyManagementParameters;
-    constructor(plaintext) {
-        assertUint8Array(plaintext, 'plaintext');
-        this.#plaintext = plaintext;
-    }
-    setContentEncryptionKey(cek) {
-        assertNotSet(this.#cek, 'setContentEncryptionKey');
-        this.#cek = cek;
-        return this;
-    }
-    setInitializationVector(iv) {
-        assertNotSet(this.#iv, 'setInitializationVector');
-        this.#iv = iv;
-        return this;
-    }
-    setProtectedHeader(protectedHeader) {
-        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
-        this.#protectedHeader = protectedHeader;
-        return this;
-    }
-    setKeyManagementParameters(parameters) {
-        assertNotSet(this.#keyManagementParameters, 'setKeyManagementParameters');
-        this.#keyManagementParameters = parameters;
-        return this;
-    }
-    async encrypt(key, options) {
-        const jwe = await createJWE([
-            this.#plaintext,
-            this.#protectedHeader,
-            undefined,
-            undefined,
-            undefined,
-            this.#cek,
-            this.#iv,
-            this.#keyManagementParameters,
-            undefined,
-            false,
-        ], key, options);
-        return [jwe.protected, jwe.encrypted_key, jwe.iv, jwe.ciphertext, jwe.tag].join('.');
-    }
+import { assertNotSet } from "../../lib/helpers.js";
+import { assertUint8Array } from "../../lib/type_checks.js";
+import { createJWE } from "../../lib/jwe_encrypt.js";
+class CompactEncrypt {
+  #plaintext;
+  #protectedHeader;
+  #cek;
+  #iv;
+  #keyManagementParameters;
+  constructor(plaintext) {
+    assertUint8Array(plaintext, "plaintext"), this.#plaintext = plaintext;
+  }
+  setContentEncryptionKey(cek) {
+    return assertNotSet(this.#cek, "setContentEncryptionKey"), this.#cek = cek, this;
+  }
+  setInitializationVector(iv) {
+    return assertNotSet(this.#iv, "setInitializationVector"), this.#iv = iv, this;
+  }
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
+  }
+  setKeyManagementParameters(parameters) {
+    return assertNotSet(this.#keyManagementParameters, "setKeyManagementParameters"), this.#keyManagementParameters = parameters, this;
+  }
+  async encrypt(key, options) {
+    const jwe = await createJWE([
+      this.#plaintext,
+      this.#protectedHeader,
+      void 0,
+      void 0,
+      void 0,
+      this.#cek,
+      this.#iv,
+      this.#keyManagementParameters,
+      void 0,
+      !1
+    ], key, options);
+    return [jwe.protected, jwe.encrypted_key, jwe.iv, jwe.ciphertext, jwe.tag].join(".");
+  }
 }
+export {
+  CompactEncrypt
+};

package/dist/webapi/jwe/flattened/decrypt.js

@@ -1,15 +1,15 @@
-import { JWEInvalid } from '../../util/errors.js';
-import { isObject } from '../../lib/type_checks.js';
-import { prepareDecrypt, decryptJWE, decryptResult, checkRecipient, snapshotSharedJWE, snapshotRecipientJWE, } from '../../lib/jwe_decrypt.js';
-export async function flattenedDecrypt(jwe, key, options) {
-    if (!isObject(jwe)) {
-        throw new JWEInvalid('Flattened JWE must be an object');
-    }
-    const shared = snapshotSharedJWE(jwe);
-    const [recipient, , error] = snapshotRecipientJWE(jwe);
-    if (!recipient)
-        throw error;
-    const snapshot = { ...shared, ...recipient };
-    checkRecipient(snapshot);
-    return decryptResult(snapshot, await decryptJWE(snapshot, prepareDecrypt(options), key));
+import { JWEInvalid } from "../../util/errors.js";
+import { isObject } from "../../lib/type_checks.js";
+import { prepareDecrypt, decryptJWE, decryptResult, checkRecipient, snapshotSharedJWE, snapshotRecipientJWE } from "../../lib/jwe_decrypt.js";
+async function flattenedDecrypt(jwe, key, options) {
+  if (!isObject(jwe))
+    throw new JWEInvalid("Flattened JWE must be an object");
+  const shared = snapshotSharedJWE(jwe), [recipient, , error] = snapshotRecipientJWE(jwe);
+  if (!recipient)
+    throw error;
+  const snapshot = { ...shared, ...recipient };
+  return checkRecipient(snapshot), decryptResult(snapshot, await decryptJWE(snapshot, prepareDecrypt(options), key));
 }
+export {
+  flattenedDecrypt
+};

package/dist/webapi/jwe/flattened/encrypt.js

@@ -1,65 +1,54 @@
-import { assertNotSet } from '../../lib/helpers.js';
-import { createJWE } from '../../lib/jwe_encrypt.js';
-import { assertUint8Array } from '../../lib/type_checks.js';
-export class FlattenedEncrypt {
-    #plaintext;
-    #protectedHeader;
-    #sharedUnprotectedHeader;
-    #unprotectedHeader;
-    #aad;
-    #cek;
-    #iv;
-    #keyManagementParameters;
-    constructor(plaintext) {
-        assertUint8Array(plaintext, 'plaintext');
-        this.#plaintext = plaintext;
-    }
-    setKeyManagementParameters(parameters) {
-        assertNotSet(this.#keyManagementParameters, 'setKeyManagementParameters');
-        this.#keyManagementParameters = parameters;
-        return this;
-    }
-    setProtectedHeader(protectedHeader) {
-        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
-        this.#protectedHeader = protectedHeader;
-        return this;
-    }
-    setSharedUnprotectedHeader(sharedUnprotectedHeader) {
-        assertNotSet(this.#sharedUnprotectedHeader, 'setSharedUnprotectedHeader');
-        this.#sharedUnprotectedHeader = sharedUnprotectedHeader;
-        return this;
-    }
-    setUnprotectedHeader(unprotectedHeader) {
-        assertNotSet(this.#unprotectedHeader, 'setUnprotectedHeader');
-        this.#unprotectedHeader = unprotectedHeader;
-        return this;
-    }
-    setAdditionalAuthenticatedData(aad) {
-        this.#aad = aad;
-        return this;
-    }
-    setContentEncryptionKey(cek) {
-        assertNotSet(this.#cek, 'setContentEncryptionKey');
-        this.#cek = cek;
-        return this;
-    }
-    setInitializationVector(iv) {
-        assertNotSet(this.#iv, 'setInitializationVector');
-        this.#iv = iv;
-        return this;
-    }
-    async encrypt(key, options) {
-        return createJWE([
-            this.#plaintext,
-            this.#protectedHeader,
-            this.#unprotectedHeader,
-            this.#sharedUnprotectedHeader,
-            this.#aad,
-            this.#cek,
-            this.#iv,
-            this.#keyManagementParameters,
-            undefined,
-            false,
-        ], key, options);
-    }
+import { assertNotSet } from "../../lib/helpers.js";
+import { createJWE } from "../../lib/jwe_encrypt.js";
+import { assertUint8Array } from "../../lib/type_checks.js";
+class FlattenedEncrypt {
+  #plaintext;
+  #protectedHeader;
+  #sharedUnprotectedHeader;
+  #unprotectedHeader;
+  #aad;
+  #cek;
+  #iv;
+  #keyManagementParameters;
+  constructor(plaintext) {
+    assertUint8Array(plaintext, "plaintext"), this.#plaintext = plaintext;
+  }
+  setKeyManagementParameters(parameters) {
+    return assertNotSet(this.#keyManagementParameters, "setKeyManagementParameters"), this.#keyManagementParameters = parameters, this;
+  }
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
+  }
+  setSharedUnprotectedHeader(sharedUnprotectedHeader) {
+    return assertNotSet(this.#sharedUnprotectedHeader, "setSharedUnprotectedHeader"), this.#sharedUnprotectedHeader = sharedUnprotectedHeader, this;
+  }
+  setUnprotectedHeader(unprotectedHeader) {
+    return assertNotSet(this.#unprotectedHeader, "setUnprotectedHeader"), this.#unprotectedHeader = unprotectedHeader, this;
+  }
+  setAdditionalAuthenticatedData(aad) {
+    return this.#aad = aad, this;
+  }
+  setContentEncryptionKey(cek) {
+    return assertNotSet(this.#cek, "setContentEncryptionKey"), this.#cek = cek, this;
+  }
+  setInitializationVector(iv) {
+    return assertNotSet(this.#iv, "setInitializationVector"), this.#iv = iv, this;
+  }
+  async encrypt(key, options) {
+    return createJWE([
+      this.#plaintext,
+      this.#protectedHeader,
+      this.#unprotectedHeader,
+      this.#sharedUnprotectedHeader,
+      this.#aad,
+      this.#cek,
+      this.#iv,
+      this.#keyManagementParameters,
+      void 0,
+      !1
+    ], key, options);
+  }
 }
+export {
+  FlattenedEncrypt
+};

package/dist/webapi/jwe/general/decrypt.js

@@ -1,51 +1,40 @@
-import { prepareDecrypt, shareJWE, decryptRecipient, decryptResult, checkRecipient, snapshotSharedJWE, snapshotRecipientJWE, } from '../../lib/jwe_decrypt.js';
-import { JWEDecryptionFailed, JWEInvalid } from '../../util/errors.js';
-import { isObject } from '../../lib/type_checks.js';
-export async function generalDecrypt(jwe, key, options) {
-    if (!isObject(jwe)) {
-        throw new JWEInvalid('General JWE must be an object');
-    }
-    const inputRecipients = jwe.recipients;
-    if (!Array.isArray(inputRecipients)) {
-        throw new JWEInvalid('JWE Recipients missing or incorrect type');
-    }
-    const recipients = Array.from(inputRecipients);
-    if (!recipients.every(isObject)) {
-        throw new JWEInvalid('JWE Recipients missing or incorrect type');
-    }
-    if (!recipients.length) {
-        throw new JWEInvalid('JWE Recipients has no members');
-    }
-    let shared;
-    let sharedJwe;
-    let token;
-    try {
-        shared = prepareDecrypt(options);
-        sharedJwe = snapshotSharedJWE(jwe);
-        token = shareJWE(sharedJwe);
-    }
-    catch {
-        throw new JWEDecryptionFailed();
-    }
-    const recipientSnapshots = recipients.map((recipient) => snapshotRecipientJWE(recipient));
-    if (recipients.length > 1) {
-        for (const [, headerAlg] of recipientSnapshots) {
-            const alg = token[0]?.alg ?? headerAlg ?? sharedJwe.unprotected?.alg;
-            if (alg === 'dir' || alg === 'ECDH-ES') {
-                throw new JWEInvalid(`"${alg}" alg may only have a single recipient`);
-            }
-        }
-    }
-    for (const [recipient] of recipientSnapshots) {
-        if (!recipient)
-            continue;
-        try {
-            const flattened = { ...sharedJwe, ...recipient };
-            checkRecipient(flattened);
-            return decryptResult(flattened, await decryptRecipient(flattened, token, shared, key));
-        }
-        catch {
-        }
-    }
+import { prepareDecrypt, shareJWE, decryptRecipient, decryptResult, checkRecipient, snapshotSharedJWE, snapshotRecipientJWE } from "../../lib/jwe_decrypt.js";
+import { JWEDecryptionFailed, JWEInvalid } from "../../util/errors.js";
+import { isObject } from "../../lib/type_checks.js";
+import { JWE, isJWECEKTransport } from "../../lib/jwe_algorithms.js";
+async function generalDecrypt(jwe, key, options) {
+  if (!isObject(jwe))
+    throw new JWEInvalid("General JWE must be an object");
+  const inputRecipients = jwe.recipients;
+  if (!Array.isArray(inputRecipients))
+    throw new JWEInvalid("JWE Recipients missing or incorrect type");
+  const recipients = Array.from(inputRecipients);
+  if (!recipients.every(isObject))
+    throw new JWEInvalid("JWE Recipients missing or incorrect type");
+  if (!recipients.length)
+    throw new JWEInvalid("JWE Recipients has no members");
+  let shared, sharedJwe, token;
+  try {
+    shared = prepareDecrypt(options), sharedJwe = snapshotSharedJWE(jwe), token = shareJWE(sharedJwe);
+  } catch {
     throw new JWEDecryptionFailed();
+  }
+  const recipientSnapshots = recipients.map((recipient) => snapshotRecipientJWE(recipient)), recipientAlgorithms = recipientSnapshots.map(([, headerAlg]) => token[0]?.alg ?? headerAlg ?? sharedJwe.unprotected?.alg);
+  if (recipients.length > 1)
+    for (const alg of recipientAlgorithms) {
+      const algEntry = typeof alg == "string" ? JWE[alg] : void 0;
+      if (algEntry && !isJWECEKTransport(algEntry))
+        throw new JWEInvalid(`"${alg}" alg may only have a single recipient`);
+    }
+  for (const [recipient] of recipientSnapshots)
+    if (recipient)
+      try {
+        const flattened = { ...sharedJwe, ...recipient };
+        return checkRecipient(flattened), decryptResult(flattened, await decryptRecipient(flattened, token, shared, key));
+      } catch {
+      }
+  throw new JWEDecryptionFailed();
 }
+export {
+  generalDecrypt
+};