unjwt 0.8.1 → 0.8.3

package/dist/_chunks/index2.d.mts

@@ -1,6 +1,7 @@
 import { JWK } from "./index.mjs";
+import { DigestHash } from "./digest.mjs";
 /** Hash functions RFC 7638 §3.4 leaves open to the application. */
-export type ThumbprintHash = "SHA-256" | "SHA-384" | "SHA-512";
+export type ThumbprintHash = DigestHash;
 /**
  * The base64url JWK Thumbprint of a key (RFC 7638), over its required members only, so a
  * public key and its private counterpart share one. `hash` defaults to `"SHA-256"`

package/dist/_chunks/index3.d.mts

@@ -1,5 +1,6 @@
 import { BytesSource, DecodeOptions, DecodeReturnAs } from "./libs/unsecure.mjs";
 import { JWK, JWKSet, JWK_EC_Private, JWK_EC_Public, JWK_OKP_Private, JWK_OKP_Public, JWK_Private, JWK_Public, JWK_RSA_Private, JWK_RSA_Public, JWK_oct, JWSAlgorithm, KeyManagementAlgorithm } from "./index.mjs";
+import "./digest.mjs";
 import { ComputeJwtTimeClaimsOptions as ComputeJwtTimeClaimsOptions$1, ParsePayloadOptions, applyTypDefault, assertCritShape as assertCritShape$1, computeJwtTimeClaims as computeJwtTimeClaims$1, getPlaintextBytes as getPlaintextBytes$1, parsePayloadBytes, parsePayloadSegment, validateCriticalHeadersJWE as validateCriticalHeadersJWE$1, validateCriticalHeadersJWS as validateCriticalHeadersJWS$1 } from "./jwt.mjs";
 /**
  * Encode bytes or a UTF-8 string as base64url the way JOSE defines it

package/dist/_chunks/jwe.d.mts

@@ -1,4 +1,4 @@
-import { ContentEncryptionAlgorithm, JOSEPayload, JOSEPayloadMode, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralSerialization, JWEMultiDecryptKey, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWKLookupFunction, JWKSet, JWTClaims, KeyManagementAlgorithm, PayloadOf } from "./index.mjs";
+import { ContentEncryptionAlgorithm, JOSEPayload, JOSEPayloadMode, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralSerialization, JWEKeyLookup, JWEMultiDecryptKey, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWKSet, JWTClaims, KeyManagementAlgorithm, PayloadOf } from "./index.mjs";
 import "./_internal.mjs";
 /**
  * Encrypt a payload to multiple recipients as JWE General JSON Serialization (RFC 7516 §7.2.1).
@@ -50,12 +50,12 @@ export declare function encrypt(payload: JOSEPayload, key: CryptoKey | JWEEncryp
  * Decrypt a JWE Compact Serialization string; `key` may be a lookup function.
  * The payload type follows `options.payload` (claims `T` by default).
  */
-export declare function decrypt<T extends object = JWTClaims>(jwe: string, key: CryptoKey | JWKSet | JWEDecryptJWK | string | Uint8Array<ArrayBuffer> | JWKLookupFunction, options?: JWEDecryptOptions<"json"> & {
+export declare function decrypt<T extends object = JWTClaims>(jwe: string, key: CryptoKey | JWKSet | JWEDecryptJWK | string | Uint8Array<ArrayBuffer> | JWEKeyLookup, options?: JWEDecryptOptions<"json"> & {
   forceUint8Array?: false;
 }): Promise<JWEDecryptResult<T>>;
 /** @deprecated `forceUint8Array` is replaced by `payload: "bytes"`; removed in v0.9.0. */
-export declare function decrypt(jwe: string, key: CryptoKey | JWKSet | JWEDecryptJWK | string | Uint8Array<ArrayBuffer> | JWKLookupFunction, options: JWEDecryptOptions & {
+export declare function decrypt(jwe: string, key: CryptoKey | JWKSet | JWEDecryptJWK | string | Uint8Array<ArrayBuffer> | JWEKeyLookup, options: JWEDecryptOptions & {
   forceUint8Array: true;
 }): Promise<JWEDecryptResult<Uint8Array<ArrayBuffer>>>;
 /** Decrypts a compact JWE whose plaintext decodes under `options.payload`; see {@link PayloadOf}. */
-export declare function decrypt<Mode extends JOSEPayloadMode = JOSEPayloadMode>(jwe: string, key: CryptoKey | JWKSet | JWEDecryptJWK | string | Uint8Array<ArrayBuffer> | JWKLookupFunction, options?: JWEDecryptOptions<Mode>): Promise<JWEDecryptResult<PayloadOf<Mode>>>;
+export declare function decrypt<Mode extends JOSEPayloadMode = JOSEPayloadMode>(jwe: string, key: CryptoKey | JWKSet | JWEDecryptJWK | string | Uint8Array<ArrayBuffer> | JWEKeyLookup, options?: JWEDecryptOptions<Mode>): Promise<JWEDecryptResult<PayloadOf<Mode>>>;

package/dist/_chunks/jwe.mjs

@@ -1,7 +1,7 @@
 import { sanitizeObjectCopy, secureRandomBytes, textEncoder } from "./libs/unsecure.mjs";
 import { JWTError, applyTypDefault, base64UrlStringify, computeJwtTimeClaims, getPlaintextBytes, isJWK, isJWKSet, validateCriticalHeadersJWE } from "./_jwt-internal.mjs";
-import { isContentEncryptionAlgorithm } from "./algorithms.mjs";
-import { DEFAULT_PBES2_ITERATIONS, JWE_ALG_CTX, JWE_DIRECT_ALGS, asDecryptionError, asKeyLookupError, assertCompactToken, assertConsumerOptions, assertDirectKeyRole, assertEntryLimit, assertJWEAlgSupported, assertJWEEncSupported, assertJWKSetCandidates, assertNoZipOption, assertOptionEntry, assertPBES2Params, assertProducerCEK, assertProducerCrit, assertProducerIV, assertProtectedOnlyOption, assertSerializationObject, buildECDHAgreementParams, buildJWKSetFilter, buildUnwrapKeyOptions, checkAlgAllowed, checkJWEAlgSupported, checkJWEContentSegments, checkJWEDirectEncryptedKey, checkJWEEncAllowed, checkJWEEncSupported, checkJWEUnprotectedCrit, checkJWEZip, checkProtectedTyp, checkSerializationEntry, createPBES2Budget, decodeJWEPayload, decodeProtectedHeader, decodeSegment, decrypt as decrypt$1, encrypt as encrypt$1, encryptKey, exportReturnedCek, generateCEK, generateIV, getJWKsFromSet, importKey, isJWEAlgSupported, keyMatchesHeader, resolveKeyInput, resolveLimit, resolvePasswordKey, resolvePayloadMode, serializeProtectedHeader, unwrapKey, validateClaimsIfJson } from "./jwk.mjs";
+import { isContentEncryptionAlgorithm, isPBES2Algorithm } from "./digest.mjs";
+import { DEFAULT_PBES2_ITERATIONS, JWE_ALG_CTX, JWE_DIRECT_ALGS, asDecryptionError, asKeyLookupError, assertCompactToken, assertConsumerOptions, assertDirectKeyRole, assertEntryLimit, assertJWEAlgSupported, assertJWEEncSupported, assertJWKSetCandidates, assertNoZipOption, assertOptionEntry, assertPBES2Params, assertProducerCEK, assertProducerConfirmation, assertProducerCrit, assertProducerIV, assertProducerKeyHeaders, assertProtectedOnlyOption, assertSerializationObject, buildECDHAgreementParams, buildJWKSetFilter, buildUnwrapKeyOptions, checkAlgAllowed, checkJWEAlgSupported, checkJWEContentSegments, checkJWEDirectEncryptedKey, checkJWEEncAllowed, checkJWEEncSupported, checkJWEUnprotectedCrit, checkJWEZip, checkProtectedTyp, checkSerializationEntry, createPBES2Budget, decodeJWEPayload, decodeProtectedHeader, decodeSegment, decrypt as decrypt$1, encrypt as encrypt$1, encryptKey, exportReturnedCek, generateCEK, generateIV, getJWKsFromSet, importKey, isJWEAlgSupported, keyMatchesHeader, resolveKeyInput, resolveLimit, resolvePasswordKey, resolvePayloadMode, serializeProtectedHeader, unwrapKey, validateClaimsIfJson } from "./jwk.mjs";
 function buildKeyManagementParams(alg, source) {
 	const { keyManagementIV, p2s, p2c, ecdh } = source;
 	const isPBES2 = alg.startsWith("PBES2");
@@ -74,6 +74,15 @@ async function encryptMulti(payload, recipients, options = {}) {
 		tier: "shared unprotected",
 		family: "JWE"
 	});
+	assertProducerKeyHeaders(options.protectedHeader, {
+		tier: "protected",
+		family: "JWE"
+	});
+	assertProducerKeyHeaders(options.sharedUnprotectedHeader, {
+		tier: "shared unprotected",
+		family: "JWE"
+	});
+	assertProducerConfirmation(payload);
 	for (const [index, recipient] of recipients.entries()) {
 		assertOptionEntry(recipient, {
 			label: `recipients[${index}]`,
@@ -84,6 +93,10 @@ async function encryptMulti(payload, recipients, options = {}) {
 			tier: "per-recipient",
 			family: "JWE"
 		});
+		assertProducerKeyHeaders(recipient.header, {
+			tier: "per-recipient",
+			family: "JWE"
+		});
 	}
 	const resolvedAlgs = recipients.map((r, i) => _resolveRecipientAlg(r.key, i));
 	const enc = options.enc ?? "A256GCM";
@@ -388,6 +401,11 @@ async function encrypt(payload, key, options = {}) {
 		label: "options",
 		objects: ["protectedHeader"]
 	});
+	assertProducerKeyHeaders(options.protectedHeader, {
+		tier: "protected",
+		family: "JWE"
+	});
+	assertProducerConfirmation(payload);
 	const { protectedHeader: userHeader, cek: providedCek, contentEncryptionIV: providedContentIV, keyManagementIV, p2s, p2c, ecdh } = options;
 	let alg = options.alg;
 	let enc = options.enc;
@@ -409,7 +427,7 @@ async function encrypt(payload, key, options = {}) {
 	assertJWEEncSupported(enc);
 	assertProducerCEK(providedCek, enc);
 	assertProducerIV(providedContentIV, enc);
-	if (alg.startsWith("PBES2")) assertPBES2Params({
+	if (isPBES2Algorithm(alg)) assertPBES2Params({
 		p2s,
 		p2c
 	});