unjwt 0.8.0 → 0.8.2

package/dist/_chunks/index2.d.mts

@@ -1,6 +1,7 @@
 import { JWK } from "./index.mjs";
+import { DigestHash } from "./digest.mjs";
 /** Hash functions RFC 7638 §3.4 leaves open to the application. */
-export type ThumbprintHash = "SHA-256" | "SHA-384" | "SHA-512";
+export type ThumbprintHash = DigestHash;
 /**
  * The base64url JWK Thumbprint of a key (RFC 7638), over its required members only, so a
  * public key and its private counterpart share one. `hash` defaults to `"SHA-256"`

package/dist/_chunks/index3.d.mts

@@ -1,5 +1,6 @@
 import { BytesSource, DecodeOptions, DecodeReturnAs } from "./libs/unsecure.mjs";
 import { JWK, JWKSet, JWK_EC_Private, JWK_EC_Public, JWK_OKP_Private, JWK_OKP_Public, JWK_Private, JWK_Public, JWK_RSA_Private, JWK_RSA_Public, JWK_oct, JWSAlgorithm, KeyManagementAlgorithm } from "./index.mjs";
+import "./digest.mjs";
 import { ComputeJwtTimeClaimsOptions as ComputeJwtTimeClaimsOptions$1, ParsePayloadOptions, applyTypDefault, assertCritShape as assertCritShape$1, computeJwtTimeClaims as computeJwtTimeClaims$1, getPlaintextBytes as getPlaintextBytes$1, parsePayloadBytes, parsePayloadSegment, validateCriticalHeadersJWE as validateCriticalHeadersJWE$1, validateCriticalHeadersJWS as validateCriticalHeadersJWS$1 } from "./jwt.mjs";
 /**
  * Encode bytes or a UTF-8 string as base64url the way JOSE defines it
@@ -57,19 +58,19 @@ export declare function isCryptoKey(key: unknown): key is CryptoKey;
 /** Whether `key` is a `CryptoKeyPair` of two CryptoKeys. */
 export declare const isCryptoKeyPair: (key: unknown) => key is CryptoKeyPair;
 /** Whether the JWK is symmetric (`oct`); its `k` is always secret. */
-export declare function isSymmetricJWK<T>(key: T): key is Extract<T, JWK_oct>;
+export declare function isSymmetricJWK<T extends JWK>(key: T): key is Extract<T, JWK_oct>;
 export declare function isSymmetricJWK(key: unknown): key is JWK_oct;
 /** Whether the JWK is asymmetric (RSA, EC, OKP). */
-export declare function isAsymmetricJWK<T>(key: T): key is Exclude<T, JWK_oct>;
+export declare function isAsymmetricJWK<T extends JWK>(key: T): key is Exclude<T, JWK_oct>;
 export declare function isAsymmetricJWK(key: unknown): key is Exclude<JWK, JWK_oct>;
 /**
  * Whether the JWK holds asymmetric private material (`d`). It is `false` for `oct` keys,
  * so `!isPrivateJWK(key)` is not a "safe to publish" check; use `isPublicJWK`.
  */
-export declare function isPrivateJWK<T>(key: T): key is Extract<T, JWK_EC_Private | JWK_OKP_Private | JWK_RSA_Private>;
+export declare function isPrivateJWK<T extends JWK>(key: T): key is Extract<T, JWK_EC_Private | JWK_OKP_Private | JWK_RSA_Private>;
 export declare function isPrivateJWK(key: unknown): key is JWK_Private;
 /** Whether the JWK is an asymmetric public key without `d`: the "safe to publish" check. */
-export declare function isPublicJWK<T>(key: T): key is Exclude<Extract<T, JWK_EC_Public | JWK_OKP_Public | JWK_RSA_Public>, JWK_Private>;
+export declare function isPublicJWK<T extends JWK>(key: T): key is Exclude<Extract<T, JWK_EC_Public | JWK_OKP_Public | JWK_RSA_Public>, JWK_Private>;
 export declare function isPublicJWK(key: unknown): key is JWK_Public;
 /** How a JWK Set's entries are read during algorithm inference. */
 export interface InferAlgorithmsOptions {

package/dist/_chunks/jwe.d.mts

@@ -1,4 +1,4 @@
-import { ContentEncryptionAlgorithm, JOSEPayload, JOSEPayloadMode, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralSerialization, JWEMultiDecryptKey, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWKLookupFunction, JWKSet, JWTClaims, KeyManagementAlgorithm, PayloadOf } from "./index.mjs";
+import { ContentEncryptionAlgorithm, JOSEPayload, JOSEPayloadMode, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralSerialization, JWEKeyLookup, JWEMultiDecryptKey, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWKSet, JWTClaims, KeyManagementAlgorithm, PayloadOf } from "./index.mjs";
 import "./_internal.mjs";
 /**
  * Encrypt a payload to multiple recipients as JWE General JSON Serialization (RFC 7516 §7.2.1).
@@ -13,7 +13,7 @@ export declare function encryptMulti(payload: JOSEPayload, recipients: JWEMultiR
  * `ERR_JWE_NO_MATCHING_RECIPIENT` when none qualifies; a JWK Set with no `kid` candidate
  * throws `ERR_JWK_KEY_NOT_FOUND`. The payload type follows `options.payload`.
  */
-export declare function decryptMulti<T extends Record<string, unknown> = JWTClaims>(jwe: JWEGeneralSerialization | JWEFlattenedSerialization, keyOrLookup: JWEMultiDecryptKey, options?: JWEMultiDecryptOptions<"json"> & {
+export declare function decryptMulti<T extends object = JWTClaims>(jwe: JWEGeneralSerialization | JWEFlattenedSerialization, keyOrLookup: JWEMultiDecryptKey, options?: JWEMultiDecryptOptions<"json"> & {
   forceUint8Array?: false;
 }): Promise<JWEMultiDecryptResult<T>>;
 /** @deprecated `forceUint8Array` is replaced by `payload: "bytes"`; removed in v0.9.0. */
@@ -50,12 +50,12 @@ export declare function encrypt(payload: JOSEPayload, key: CryptoKey | JWEEncryp
  * Decrypt a JWE Compact Serialization string; `key` may be a lookup function.
  * The payload type follows `options.payload` (claims `T` by default).
  */
-export declare function decrypt<T extends Record<string, unknown> = JWTClaims>(jwe: string, key: CryptoKey | JWKSet | JWEDecryptJWK | string | Uint8Array<ArrayBuffer> | JWKLookupFunction, options?: JWEDecryptOptions<"json"> & {
+export declare function decrypt<T extends object = JWTClaims>(jwe: string, key: CryptoKey | JWKSet | JWEDecryptJWK | string | Uint8Array<ArrayBuffer> | JWEKeyLookup, options?: JWEDecryptOptions<"json"> & {
   forceUint8Array?: false;
 }): Promise<JWEDecryptResult<T>>;
 /** @deprecated `forceUint8Array` is replaced by `payload: "bytes"`; removed in v0.9.0. */
-export declare function decrypt(jwe: string, key: CryptoKey | JWKSet | JWEDecryptJWK | string | Uint8Array<ArrayBuffer> | JWKLookupFunction, options: JWEDecryptOptions & {
+export declare function decrypt(jwe: string, key: CryptoKey | JWKSet | JWEDecryptJWK | string | Uint8Array<ArrayBuffer> | JWEKeyLookup, options: JWEDecryptOptions & {
   forceUint8Array: true;
 }): Promise<JWEDecryptResult<Uint8Array<ArrayBuffer>>>;
 /** Decrypts a compact JWE whose plaintext decodes under `options.payload`; see {@link PayloadOf}. */
-export declare function decrypt<Mode extends JOSEPayloadMode = JOSEPayloadMode>(jwe: string, key: CryptoKey | JWKSet | JWEDecryptJWK | string | Uint8Array<ArrayBuffer> | JWKLookupFunction, options?: JWEDecryptOptions<Mode>): Promise<JWEDecryptResult<PayloadOf<Mode>>>;
+export declare function decrypt<Mode extends JOSEPayloadMode = JOSEPayloadMode>(jwe: string, key: CryptoKey | JWKSet | JWEDecryptJWK | string | Uint8Array<ArrayBuffer> | JWEKeyLookup, options?: JWEDecryptOptions<Mode>): Promise<JWEDecryptResult<PayloadOf<Mode>>>;

package/dist/_chunks/jwe.mjs

@@ -1,7 +1,7 @@
 import { sanitizeObjectCopy, secureRandomBytes, textEncoder } from "./libs/unsecure.mjs";
 import { JWTError, applyTypDefault, base64UrlStringify, computeJwtTimeClaims, getPlaintextBytes, isJWK, isJWKSet, validateCriticalHeadersJWE } from "./_jwt-internal.mjs";
-import { isContentEncryptionAlgorithm } from "./algorithms.mjs";
-import { DEFAULT_PBES2_ITERATIONS, JWE_ALG_CTX, JWE_DIRECT_ALGS, asDecryptionError, asKeyLookupError, assertCompactToken, assertConsumerOptions, assertDirectKeyRole, assertEntryLimit, assertJWEAlgSupported, assertJWEEncSupported, assertJWKSetCandidates, assertNoZipOption, assertOptionEntry, assertPBES2Params, assertProducerCEK, assertProducerCrit, assertProducerIV, assertProtectedOnlyOption, assertSerializationObject, buildECDHAgreementParams, buildJWKSetFilter, buildUnwrapKeyOptions, checkAlgAllowed, checkJWEAlgSupported, checkJWEContentSegments, checkJWEDirectEncryptedKey, checkJWEEncAllowed, checkJWEEncSupported, checkJWEUnprotectedCrit, checkJWEZip, checkProtectedTyp, checkSerializationEntry, createPBES2Budget, decodeJWEPayload, decodeProtectedHeader, decodeSegment, decrypt as decrypt$1, encrypt as encrypt$1, encryptKey, exportReturnedCek, generateCEK, generateIV, getJWKsFromSet, importKey, isJWEAlgSupported, keyMatchesHeader, resolveKeyInput, resolveLimit, resolvePasswordKey, resolvePayloadMode, serializeProtectedHeader, unwrapKey, validateClaimsIfJson } from "./jwk.mjs";
+import { isContentEncryptionAlgorithm, isPBES2Algorithm } from "./digest.mjs";
+import { DEFAULT_PBES2_ITERATIONS, JWE_ALG_CTX, JWE_DIRECT_ALGS, asDecryptionError, asKeyLookupError, assertCompactToken, assertConsumerOptions, assertDirectKeyRole, assertEntryLimit, assertJWEAlgSupported, assertJWEEncSupported, assertJWKSetCandidates, assertNoZipOption, assertOptionEntry, assertPBES2Params, assertProducerCEK, assertProducerConfirmation, assertProducerCrit, assertProducerIV, assertProducerKeyHeaders, assertProtectedOnlyOption, assertSerializationObject, buildECDHAgreementParams, buildJWKSetFilter, buildUnwrapKeyOptions, checkAlgAllowed, checkJWEAlgSupported, checkJWEContentSegments, checkJWEDirectEncryptedKey, checkJWEEncAllowed, checkJWEEncSupported, checkJWEUnprotectedCrit, checkJWEZip, checkProtectedTyp, checkSerializationEntry, createPBES2Budget, decodeJWEPayload, decodeProtectedHeader, decodeSegment, decrypt as decrypt$1, encrypt as encrypt$1, encryptKey, exportReturnedCek, generateCEK, generateIV, getJWKsFromSet, importKey, isJWEAlgSupported, keyMatchesHeader, resolveKeyInput, resolveLimit, resolvePasswordKey, resolvePayloadMode, serializeProtectedHeader, unwrapKey, validateClaimsIfJson } from "./jwk.mjs";
 function buildKeyManagementParams(alg, source) {
 	const { keyManagementIV, p2s, p2c, ecdh } = source;
 	const isPBES2 = alg.startsWith("PBES2");
@@ -74,6 +74,15 @@ async function encryptMulti(payload, recipients, options = {}) {
 		tier: "shared unprotected",
 		family: "JWE"
 	});
+	assertProducerKeyHeaders(options.protectedHeader, {
+		tier: "protected",
+		family: "JWE"
+	});
+	assertProducerKeyHeaders(options.sharedUnprotectedHeader, {
+		tier: "shared unprotected",
+		family: "JWE"
+	});
+	assertProducerConfirmation(payload);
 	for (const [index, recipient] of recipients.entries()) {
 		assertOptionEntry(recipient, {
 			label: `recipients[${index}]`,
@@ -84,6 +93,10 @@ async function encryptMulti(payload, recipients, options = {}) {
 			tier: "per-recipient",
 			family: "JWE"
 		});
+		assertProducerKeyHeaders(recipient.header, {
+			tier: "per-recipient",
+			family: "JWE"
+		});
 	}
 	const resolvedAlgs = recipients.map((r, i) => _resolveRecipientAlg(r.key, i));
 	const enc = options.enc ?? "A256GCM";
@@ -388,6 +401,11 @@ async function encrypt(payload, key, options = {}) {
 		label: "options",
 		objects: ["protectedHeader"]
 	});
+	assertProducerKeyHeaders(options.protectedHeader, {
+		tier: "protected",
+		family: "JWE"
+	});
+	assertProducerConfirmation(payload);
 	const { protectedHeader: userHeader, cek: providedCek, contentEncryptionIV: providedContentIV, keyManagementIV, p2s, p2c, ecdh } = options;
 	let alg = options.alg;
 	let enc = options.enc;
@@ -409,7 +427,7 @@ async function encrypt(payload, key, options = {}) {
 	assertJWEEncSupported(enc);
 	assertProducerCEK(providedCek, enc);
 	assertProducerIV(providedContentIV, enc);
-	if (alg.startsWith("PBES2")) assertPBES2Params({
+	if (isPBES2Algorithm(alg)) assertPBES2Params({
 		p2s,
 		p2c
 	});