Rename the CI job to package, restore the cached dist from the build job,
fail on cache misses, and run the bundle-family check against that
artifact.
Signed-off-by: Filip Skokan <[email protected]>
Move key-management algorithms into key_management.ts, key export
conversion into key/export.ts, and key validation and conversion into
key.ts. Freeze mutable asymmetric JWK inputs and key_ops before cached
import.
Signed-off-by: Filip Skokan <[email protected]>
Return a tagged key shape from checkKeyType and consume it in prepareKey,
combining validation and conversion into one discrimination pass.
Validate supplied ECDH-ES ephemeral keys through the same private-key
path.
Signed-off-by: Filip Skokan <[email protected]>
Add parseJoseHeader and use it to decode and validate protected headers
for JWS, JWE, and decodeProtectedHeader.
Signed-off-by: Filip Skokan <[email protected]>
Construct the algorithm registries with a shared null-prototype table
helper that assigns each record key as the entry identifier.
Signed-off-by: Filip Skokan <[email protected]>
Use algorithm registry entries to supply WebCrypto parameters and key
usages for asymmetric key generation and ASN.1 imports.
Signed-off-by: Filip Skokan <[email protected]>
Validate CryptoKey algorithms and JWK key types and operations from
registry entry metadata. Describe direct content-encryption keys and
operation-specific ECDH key_ops in their entries.
Signed-off-by: Filip Skokan <[email protected]>
Resolve the content-encryption entry with the protected header and pass
it through JWE processing. Use entry metadata for CEK and IV sizing,
cipher selection, and AES-GCM key wrapping.
Signed-off-by: Filip Skokan <[email protected]>
Resolve JWKS and embedded-JWK imports against the JWS registry and import
with jwkToKey. Use registry metadata for candidate filtering and apply
RSA oth rejection in the shared import path.
Signed-off-by: Filip Skokan <[email protected]>
Split algorithm metadata into JWS and JWE registries and pass resolved
key descriptors through JWK conversion, key normalization, and JOSE
operations. Enforce family boundaries with check:bundles.
Signed-off-by: Filip Skokan <[email protected]>
Define JWS key metadata, WebCrypto parameters, usages, and RSA limits in
a single registry. Pass resolved entries through JWS
signing and verification.
Signed-off-by: Filip Skokan <[email protected]>
Route compact, flattened, general, and JWT operations through shared JWS
and JWE cores so each token is validated, parsed, and encoded once.
Consolidate critical-header and algorithm-option validation.
Signed-off-by: Filip Skokan <[email protected]>
Report each published subpath's minified size, reachable modules, and
cross-family algorithm leakage. Include package artifact sizes, JSON
output, baseline comparisons, and a check mode.
Signed-off-by: Filip Skokan <[email protected]>
Add regression coverage for JWK interoperability, open JOSE
identifiers, resolver signatures and result inference, error
discrimination, and conditional key result helpers.
Compile a second target without DOM or Node ambient types to exercise
the structural CryptoKey fallback and ensure it cannot degrade to any.
Signed-off-by: Filip Skokan <[email protected]>
Document PayloadType on JWT results and decoders, and KeyType on
dynamic key resolvers so consumers know what each explicit argument
controls. Correct ResolvedKey type-parameter tags in generated docs.
Signed-off-by: Filip Skokan <[email protected]>
Run declaration comment cleanup during build:types instead of postbump.
Local builds and package checks now inspect the declarations shipped in
releases. Remove examples, subpath notes, and docs-only tags. Relabel
GitHub alerts for editor hovers.
Use fence-aware parsing so TypeScript examples do not leave orphaned
code in published declarations.
Signed-off-by: Filip Skokan <[email protected]>
Remove the obsolete deno.land/x artifact and its release handling now
that the registry is read-only. Check the original sources with Deno
instead; JSR and npm remain supported distribution paths.
Signed-off-by: Filip Skokan <[email protected]>
Remove repeated import-location prose from emitted declaration
comments to keep editor hovers concise. Keep it in source JSDoc because
generated API pages rely on it for actual package specifiers.
Signed-off-by: Filip Skokan <[email protected]>
Install publint and ATTW from the lockfile so package validation cannot
change between CI runs.
Resolve the local ATTW CLI directly and use `npm exec --no` for other
installed tools, preventing implicit network fetches.
Signed-off-by: Filip Skokan <[email protected]>
Build every nested declaration and type-check the emitted entry points
across supported module-resolution and library configurations.
Validate type regressions, documented subpaths, package metadata, type
resolution, and generated docs in CI. Expand dist cache inputs.
Signed-off-by: Filip Skokan <[email protected]>
Correct subpath names that otherwise lead users to unexported entries,
and fix examples, links, and missing descriptions in published JSDoc.
Use instanceof in JWKS recovery examples so strict TypeScript can
narrow caught errors.
Signed-off-by: Filip Skokan <[email protected]>
Pair each JOSE error subclass with its stable code so code switches can
narrow safely without closing subclass code values.
Share typed causes and reasons across JWT claim-validation errors, and
make consumer-created multiple-match errors safely iterable. Add
compile-time coverage for the public type surface.
Signed-off-by: Filip Skokan <[email protected]>
Thread resolver return types through verify and decrypt results. Add
overloads so wrappers can forward either keys or resolvers.
Infer importJWK and generateSecret results from their inputs. Keep JWT
payload generics unconstrained while rejecting known non-object shapes.
Signed-off-by: Filip Skokan <[email protected]>
Expose supported JOSE and HTTP signature identifiers to editors while
keeping arbitrary strings assignable for extension algorithms.
Add AnyJWK so callers can narrow supported JWK shapes by "kty".
Signed-off-by: Filip Skokan <[email protected]>
Render open identifier unions as `string` because their extra arms only
drive editor completion without narrowing accepted values. Fold the
equivalent inline unions as well.
Omit the redundant `JWK = object` and `JWKParameters = object` lines;
their pages list the object members immediately below.
Signed-off-by: Filip Skokan <[email protected]>
Read JWKS keys and `Symbol.toStringTag` through explicit structural
types. Replace the remaining `@ts-ignore` directives with
`@ts-expect-error` so stale suppressions fail the build.
Signed-off-by: Filip Skokan <[email protected]>
Check ASN.1 byte and subarray reads so truncated DER fails at the parse
site instead of propagating invalid offsets into Web Crypto.
Signed-off-by: Filip Skokan <[email protected]>
Match the protected header of each resolver callback to the value
supplied by its operation. Expose the members attached to local and
remote JWKS resolvers through named callable interfaces.
Allow `JWTHeaderParameters.b64` to be boolean. A false value is inert
unless "b64" is listed in "crit", so signing and verification accept it.
Signed-off-by: Filip Skokan <[email protected]>
Declare JWK shapes as aliases so they satisfy the implicit index
signatures used by host `JsonWebKey` types. Export the AKP variants,
add "oth", and exclude private members from embedded JWK headers.
Alias the host `CryptoKey` when available and use a checked fallback
otherwise, avoiding both a competing nominal type and an `any` result.
Narrow `KeyObject.type` to the values it can hold.
Signed-off-by: Filip Skokan <[email protected]>
Use NodeNext resolution so imports follow the exports map and require
the .js extensions used by the source. Enable stricter checks to catch
future regressions.
Require isolated declarations before publishing and add the explicit
internal annotations needed to keep declaration emit stable.
Signed-off-by: Filip Skokan <[email protected]>
TextDecoder defaults to fatal: false, so ill-formed sequences became U+FFFD
rather than failing RFC 7519 Section 7.2 step 10. A strict decoder is used
for structural decoding only.
Signed-off-by: Filip Skokan <[email protected]>
RFC 7515 Section 4.1.11 forbids duplicate names in the "crit" list.
Consuming stays permissive, as the same section only lets a recipient
consider them invalid.
Signed-off-by: Filip Skokan <[email protected]>
The JWS payload and the JWE "aad" member reach the ASCII-only encode()
before they are base64url decoded, so a non-ASCII value threw a bare
TypeError instead of a JOSEError.
Signed-off-by: Filip Skokan <[email protected]>
The guard tested jws.payload === undefined, which FlattenedSign never
produces, so CompactSign emitted a JWS with an empty payload segment.
Signed-off-by: Filip Skokan <[email protected]>
options.crv was only read in the ECDH-ES branch, so asking for Ed448
returned an Ed25519 key instead of an error.
Signed-off-by: Filip Skokan <[email protected]>
NaN and Infinity passed the typeof switch and made every timestamp
comparison false, turning the "nbf", "exp", and maxTokenAge checks into
no-ops.
Signed-off-by: Filip Skokan <[email protected]>
The value comparisons were gated on truthiness while the presence checks
use !== undefined, so an empty string or a maxTokenAge of 0 required the
claim to be present and then accepted any value for it.
Signed-off-by: Filip Skokan <[email protected]>
GeneralEncrypt's single-recipient path omitted setKeyManagementParameters,
dropping "apu" and "apv" for ECDH-ES and falling back to the default PBES2
"p2c".
Signed-off-by: Filip Skokan <[email protected]>
The fallback path translated "-" and "_" into "+" and "/" and handed the
result to atob, which accepts them, so "a+b/" decoded as an alias instead
of being rejected on runtimes without Uint8Array.fromBase64.
Closes: #879
Co-authored-by: Yarchik <[email protected]>
Signed-off-by: Filip Skokan <[email protected]>
Uses the CompressionStream/DecompressionStream APIs with "deflate-raw"
to support the "DEF" compression algorithm value.
Decompressed output is limited to 250 KB by default, configurable via the
maxDecompressedLength decrypt option.
Runtimes lacking CompressionStream/DecompressionStream will continue to
throw JOSENotSupported when zip is encountered.
Filip Skokan