jose 4.0.4 → 4.1.3

package/dist/browser/{runtime → lib}/aesgcmkw.js

@@ -1,14 +1,14 @@
-import encrypt from './encrypt.js';
-import decrypt from './decrypt.js';
-import generateIv from '../lib/iv.js';
-import { encode as base64url } from './base64url.js';
-export const wrap = async (alg, key, cek, iv) => {
+import encrypt from '../runtime/encrypt.js';
+import decrypt from '../runtime/decrypt.js';
+import generateIv from './iv.js';
+import { encode as base64url } from '../runtime/base64url.js';
+export async function wrap(alg, key, cek, iv) {
     const jweAlgorithm = alg.substr(0, 7);
     iv || (iv = generateIv(jweAlgorithm));
     const { ciphertext: encryptedKey, tag } = await encrypt(jweAlgorithm, cek, key, iv, new Uint8Array(0));
     return { encryptedKey, iv: base64url(iv), tag: base64url(tag) };
-};
-export const unwrap = async (alg, key, encryptedKey, iv, tag) => {
+}
+export async function unwrap(alg, key, encryptedKey, iv, tag) {
     const jweAlgorithm = alg.substr(0, 7);
     return decrypt(jweAlgorithm, key, encryptedKey, iv, tag, new Uint8Array(0));
-};
+}

package/dist/browser/lib/check_key_type.js

@@ -1,4 +1,4 @@
-import invalidKeyInput from '../runtime/invalid_key_input.js';
+import invalidKeyInput from './invalid_key_input.js';
 import isKeyLike, { types } from '../runtime/is_key_like.js';
 const symmetricTypeCheck = (key) => {
     if (key instanceof Uint8Array)

package/dist/browser/lib/crypto_key.js

@@ -1,6 +1,12 @@
-import { isCloudflareWorkers, isNodeJs } from '../runtime/global.js';
+import { isCloudflareWorkers, isNodeJs } from '../runtime/env.js';
+function unusable(name, prop = 'algorithm.name') {
+    return new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+}
+function isAlgorithm(algorithm, name) {
+    return algorithm.name === name;
+}
 function getHashLength(hash) {
-    return parseInt(hash === null || hash === void 0 ? void 0 : hash.name.substr(4), 10);
+    return parseInt(hash.name.substr(4), 10);
 }
 function getNamedCurve(alg) {
     switch (alg) {
@@ -10,6 +16,8 @@ function getNamedCurve(alg) {
             return 'P-384';
         case 'ES512':
             return 'P-521';
+        default:
+            throw new Error('unreachable');
     }
 }
 function checkUsage(key, usages) {
@@ -33,65 +41,55 @@ export function checkSigCryptoKey(key, alg, ...usages) {
         case 'HS256':
         case 'HS384':
         case 'HS512': {
-            if (key.algorithm.name !== 'HMAC') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be HMAC.`);
-            }
+            if (!isAlgorithm(key.algorithm, 'HMAC'))
+                throw unusable('HMAC');
             const expected = parseInt(alg.substr(2), 10);
             const actual = getHashLength(key.algorithm.hash);
-            if (actual !== expected) {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.hash must be SHA-${expected}.`);
-            }
+            if (actual !== expected)
+                throw unusable(`SHA-${expected}`, 'algorithm.hash');
             break;
         }
         case 'RS256':
         case 'RS384':
         case 'RS512': {
-            if (key.algorithm.name !== 'RSASSA-PKCS1-v1_5') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be RSASSA-PKCS1-v1_5.`);
-            }
+            if (!isAlgorithm(key.algorithm, 'RSASSA-PKCS1-v1_5'))
+                throw unusable('RSASSA-PKCS1-v1_5');
             const expected = parseInt(alg.substr(2), 10);
             const actual = getHashLength(key.algorithm.hash);
-            if (actual !== expected) {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.hash must be SHA-${expected}.`);
-            }
+            if (actual !== expected)
+                throw unusable(`SHA-${expected}`, 'algorithm.hash');
             break;
         }
         case 'PS256':
         case 'PS384':
         case 'PS512': {
-            if (key.algorithm.name !== 'RSA-PSS') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be RSA-PSS.`);
-            }
+            if (!isAlgorithm(key.algorithm, 'RSA-PSS'))
+                throw unusable('RSA-PSS');
             const expected = parseInt(alg.substr(2), 10);
             const actual = getHashLength(key.algorithm.hash);
-            if (actual !== expected) {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.hash must be SHA-${expected}.`);
-            }
+            if (actual !== expected)
+                throw unusable(`SHA-${expected}`, 'algorithm.hash');
             break;
         }
         case isNodeJs() && 'EdDSA': {
-            if (key.algorithm.name !== 'NODE-ED25519' && key.algorithm.name !== 'NODE-ED448') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be NODE-ED25519 or NODE-ED448.`);
-            }
+            if (key.algorithm.name !== 'NODE-ED25519' && key.algorithm.name !== 'NODE-ED448')
+                throw unusable('NODE-ED25519 or NODE-ED448');
             break;
         }
         case isCloudflareWorkers() && 'EdDSA': {
-            if (key.algorithm.name !== 'NODE-ED25519') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be NODE-ED25519.`);
-            }
+            if (!isAlgorithm(key.algorithm, 'NODE-ED25519'))
+                throw unusable('NODE-ED25519');
             break;
         }
         case 'ES256':
         case 'ES384':
         case 'ES512': {
-            if (key.algorithm.name !== 'ECDSA') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be ECDSA.`);
-            }
+            if (!isAlgorithm(key.algorithm, 'ECDSA'))
+                throw unusable('ECDSA');
             const expected = getNamedCurve(alg);
             const actual = key.algorithm.namedCurve;
-            if (actual !== expected) {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.namedCurve must be ${expected}.`);
-            }
+            if (actual !== expected)
+                throw unusable(expected, 'algorithm.namedCurve');
             break;
         }
         default:
@@ -104,53 +102,45 @@ export function checkEncCryptoKey(key, alg, ...usages) {
         case 'A128GCM':
         case 'A192GCM':
         case 'A256GCM': {
-            if (key.algorithm.name !== 'AES-GCM') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be AES-GCM.`);
-            }
+            if (!isAlgorithm(key.algorithm, 'AES-GCM'))
+                throw unusable('AES-GCM');
             const expected = parseInt(alg.substr(1, 3), 10);
             const actual = key.algorithm.length;
-            if (actual !== expected) {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.length must be ${expected}.`);
-            }
+            if (actual !== expected)
+                throw unusable(expected, 'algorithm.length');
             break;
         }
         case 'A128KW':
         case 'A192KW':
         case 'A256KW': {
-            if (key.algorithm.name !== 'AES-KW') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be AES-KW.`);
-            }
+            if (!isAlgorithm(key.algorithm, 'AES-KW'))
+                throw unusable('AES-KW');
             const expected = parseInt(alg.substr(1, 3), 10);
             const actual = key.algorithm.length;
-            if (actual !== expected) {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.length must be ${expected}.`);
-            }
+            if (actual !== expected)
+                throw unusable(expected, 'algorithm.length');
             break;
         }
         case 'ECDH-ES':
-            if (key.algorithm.name !== 'ECDH') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be ECDH.`);
-            }
+            if (!isAlgorithm(key.algorithm, 'ECDH'))
+                throw unusable('ECDH');
             break;
         case 'PBES2-HS256+A128KW':
         case 'PBES2-HS384+A192KW':
         case 'PBES2-HS512+A256KW':
-            if (key.algorithm.name !== 'PBKDF2') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be PBKDF2.`);
-            }
+            if (!isAlgorithm(key.algorithm, 'PBKDF2'))
+                throw unusable('PBKDF2');
             break;
         case 'RSA-OAEP':
         case 'RSA-OAEP-256':
         case 'RSA-OAEP-384':
         case 'RSA-OAEP-512': {
-            if (key.algorithm.name !== 'RSA-OAEP') {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.name must be RSA-OAEP.`);
-            }
+            if (!isAlgorithm(key.algorithm, 'RSA-OAEP'))
+                throw unusable('RSA-OAEP');
             const expected = parseInt(alg.substr(9), 10) || 1;
             const actual = getHashLength(key.algorithm.hash);
-            if (actual !== expected) {
-                throw new TypeError(`CryptoKey does not support this operation, its algorithm.hash must be SHA-${expected}.`);
-            }
+            if (actual !== expected)
+                throw unusable(`SHA-${expected}`, 'algorithm.hash');
             break;
         }
         default:

package/dist/browser/lib/decrypt_key_management.js

@@ -2,13 +2,13 @@ import { unwrap as aesKw } from '../runtime/aeskw.js';
 import * as ECDH from '../runtime/ecdhes.js';
 import { decrypt as pbes2Kw } from '../runtime/pbes2kw.js';
 import { decrypt as rsaEs } from '../runtime/rsaes.js';
-import { unwrap as aesGcmKw } from '../runtime/aesgcmkw.js';
 import { decode as base64url } from '../runtime/base64url.js';
 import { JOSENotSupported, JWEInvalid } from '../util/errors.js';
 import { bitLength as cekLength } from '../lib/cek.js';
 import { importJWK } from '../key/import.js';
 import checkKeyType from './check_key_type.js';
 import isObject from './is_object.js';
+import { unwrap as aesGcmKw } from './aesgcmkw.js';
 async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
     checkKeyType(alg, key, 'decrypt');
     switch (alg) {

package/dist/browser/lib/encrypt_key_management.js

@@ -2,12 +2,12 @@ import { wrap as aesKw } from '../runtime/aeskw.js';
 import * as ECDH from '../runtime/ecdhes.js';
 import { encrypt as pbes2Kw } from '../runtime/pbes2kw.js';
 import { encrypt as rsaEs } from '../runtime/rsaes.js';
-import { wrap as aesGcmKw } from '../runtime/aesgcmkw.js';
 import { encode as base64url } from '../runtime/base64url.js';
 import generateCek, { bitLength as cekLength } from '../lib/cek.js';
 import { JOSENotSupported } from '../util/errors.js';
 import { exportJWK } from '../key/export.js';
 import checkKeyType from './check_key_type.js';
+import { wrap as aesGcmKw } from './aesgcmkw.js';
 async function encryptKeyManagement(alg, enc, key, providedCek, providedParameters = {}) {
     let encryptedKey;
     let parameters;

package/dist/browser/runtime/aeskw.js

@@ -1,7 +1,7 @@
 import bogusWebCrypto from './bogus.js';
 import crypto, { isCryptoKey } from './webcrypto.js';
 import { checkEncCryptoKey } from '../lib/crypto_key.js';
-import invalidKeyInput from './invalid_key_input.js';
+import invalidKeyInput from '../lib/invalid_key_input.js';
 function checkKeySize(key, alg) {
     if (key.algorithm.length !== parseInt(alg.substr(1, 3), 10)) {
         throw new TypeError(`Invalid key size for alg: ${alg}`);

package/dist/browser/runtime/asn1.js

@@ -1,6 +1,6 @@
-import globalThis, { isCloudflareWorkers, isNodeJs } from './global.js';
+import { isCloudflareWorkers, isNodeJs } from './env.js';
 import crypto, { isCryptoKey } from './webcrypto.js';
-import invalidKeyInput from './invalid_key_input.js';
+import invalidKeyInput from '../lib/invalid_key_input.js';
 import { encodeBase64 } from './base64url.js';
 import formatPEM from '../lib/format_pem.js';
 import { JOSENotSupported } from '../util/errors.js';
@@ -54,8 +54,7 @@ const genericImport = async (replace, keyFormat, pem, alg, options) => {
     var _a;
     let algorithm;
     let keyUsages;
-    const keyData = new Uint8Array(globalThis
-        .atob(pem.replace(replace, ''))
+    const keyData = new Uint8Array(atob(pem.replace(replace, ''))
         .split('')
         .map((c) => c.charCodeAt(0)));
     const isPublic = keyFormat === 'spki';
@@ -63,13 +62,13 @@ const genericImport = async (replace, keyFormat, pem, alg, options) => {
         case 'PS256':
         case 'PS384':
         case 'PS512':
-            algorithm = { name: 'RSA-PSS', hash: { name: `SHA-${alg.substr(-3)}` } };
+            algorithm = { name: 'RSA-PSS', hash: `SHA-${alg.substr(-3)}` };
             keyUsages = isPublic ? ['verify'] : ['sign'];
             break;
         case 'RS256':
         case 'RS384':
         case 'RS512':
-            algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: { name: `SHA-${alg.substr(-3)}` } };
+            algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${alg.substr(-3)}` };
             keyUsages = isPublic ? ['verify'] : ['sign'];
             break;
         case 'RSA-OAEP':
@@ -78,7 +77,7 @@ const genericImport = async (replace, keyFormat, pem, alg, options) => {
         case 'RSA-OAEP-512':
             algorithm = {
                 name: 'RSA-OAEP',
-                hash: { name: `SHA-${parseInt(alg.substr(-3), 10) || 1}` },
+                hash: `SHA-${parseInt(alg.substr(-3), 10) || 1}`,
             };
             keyUsages = isPublic ? ['encrypt', 'wrapKey'] : ['decrypt', 'unwrapKey'];
             break;

package/dist/browser/runtime/base64url.js

@@ -1,5 +1,4 @@
 import { encoder, decoder } from '../lib/buffer_utils.js';
-import globalThis from './global.js';
 export const encodeBase64 = (input) => {
     let unencoded = input;
     if (typeof unencoded === 'string') {
@@ -10,14 +9,13 @@ export const encodeBase64 = (input) => {
     for (let i = 0; i < unencoded.length; i += CHUNK_SIZE) {
         arr.push(String.fromCharCode.apply(null, unencoded.subarray(i, i + CHUNK_SIZE)));
     }
-    return globalThis.btoa(arr.join(''));
+    return btoa(arr.join(''));
 };
 export const encode = (input) => {
     return encodeBase64(input).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
 };
 export const decodeBase64 = (encoded) => {
-    return new Uint8Array(globalThis
-        .atob(encoded)
+    return new Uint8Array(atob(encoded)
         .split('')
         .map((c) => c.charCodeAt(0)));
 };

package/dist/browser/runtime/bogus.js

@@ -1,5 +1,5 @@
 const bogusWebCrypto = [
-    { hash: { name: 'SHA-256' }, name: 'HMAC' },
+    { hash: 'SHA-256', name: 'HMAC' },
     true,
     ['sign'],
 ];

package/dist/browser/runtime/decrypt.js

@@ -5,7 +5,7 @@ import timingSafeEqual from './timing_safe_equal.js';
 import { JOSENotSupported, JWEDecryptionFailed } from '../util/errors.js';
 import crypto, { isCryptoKey } from './webcrypto.js';
 import { checkEncCryptoKey } from '../lib/crypto_key.js';
-import invalidKeyInput from './invalid_key_input.js';
+import invalidKeyInput from '../lib/invalid_key_input.js';
 async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
     if (!(cek instanceof Uint8Array)) {
         throw new TypeError(invalidKeyInput(cek, 'Uint8Array'));
@@ -13,7 +13,7 @@ async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
     const keySize = parseInt(enc.substr(1, 3), 10);
     const encKey = await crypto.subtle.importKey('raw', cek.subarray(keySize >> 3), 'AES-CBC', false, ['decrypt']);
     const macKey = await crypto.subtle.importKey('raw', cek.subarray(0, keySize >> 3), {
-        hash: { name: `SHA-${keySize << 1}` },
+        hash: `SHA-${keySize << 1}`,
         name: 'HMAC',
     }, false, ['sign']);
     const macData = concat(aad, iv, ciphertext, uint64be(aad.length << 3));

package/dist/browser/runtime/ecdhes.js

@@ -2,7 +2,7 @@ import { encoder, concat, uint32be, lengthAndInput, concatKdf } from '../lib/buf
 import crypto, { isCryptoKey } from './webcrypto.js';
 import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import digest from './digest.js';
-import invalidKeyInput from './invalid_key_input.js';
+import invalidKeyInput from '../lib/invalid_key_input.js';
 export const deriveKey = async (publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) => {
     if (!isCryptoKey(publicKey)) {
         throw new TypeError(invalidKeyInput(publicKey, 'CryptoKey'));

package/dist/browser/runtime/encrypt.js

@@ -3,7 +3,7 @@ import checkIvLength from '../lib/check_iv_length.js';
 import checkCekLength from './check_cek_length.js';
 import crypto, { isCryptoKey } from './webcrypto.js';
 import { checkEncCryptoKey } from '../lib/crypto_key.js';
-import invalidKeyInput from './invalid_key_input.js';
+import invalidKeyInput from '../lib/invalid_key_input.js';
 import { JOSENotSupported } from '../util/errors.js';
 async function cbcEncrypt(enc, plaintext, cek, iv, aad) {
     if (!(cek instanceof Uint8Array)) {
@@ -12,7 +12,7 @@ async function cbcEncrypt(enc, plaintext, cek, iv, aad) {
     const keySize = parseInt(enc.substr(1, 3), 10);
     const encKey = await crypto.subtle.importKey('raw', cek.subarray(keySize >> 3), 'AES-CBC', false, ['encrypt']);
     const macKey = await crypto.subtle.importKey('raw', cek.subarray(0, keySize >> 3), {
-        hash: { name: `SHA-${keySize << 1}` },
+        hash: `SHA-${keySize << 1}`,
         name: 'HMAC',
     }, false, ['sign']);
     const ciphertext = new Uint8Array(await crypto.subtle.encrypt({

package/dist/browser/runtime/env.js

@@ -0,0 +1,11 @@
+export function isCloudflareWorkers() {
+    return typeof WebSocketPair === 'function';
+}
+export function isNodeJs() {
+    try {
+        return process.versions.node !== undefined;
+    }
+    catch (_a) {
+        return false;
+    }
+}

package/dist/browser/runtime/fetch_jwks.js

@@ -1,5 +1,5 @@
 import { JOSEError, JWKSTimeout } from '../util/errors.js';
-import globalThis, { isCloudflareWorkers } from './global.js';
+import { isCloudflareWorkers } from './env.js';
 const fetchJwks = async (url, timeout) => {
     let controller;
     let id;
@@ -11,8 +11,7 @@ const fetchJwks = async (url, timeout) => {
             controller.abort();
         }, timeout);
     }
-    const response = await globalThis
-        .fetch(url.href, {
+    const response = await fetch(url.href, {
         signal: controller ? controller.signal : undefined,
         redirect: 'manual',
         method: 'GET',
@@ -23,8 +22,7 @@ const fetchJwks = async (url, timeout) => {
                 mode: 'cors',
             }
             : undefined),
-    })
-        .catch((err) => {
+    }).catch((err) => {
         if (timedOut)
             throw new JWKSTimeout();
         throw err;

package/dist/browser/runtime/generate.js

@@ -1,4 +1,4 @@
-import { isCloudflareWorkers, isNodeJs } from './global.js';
+import { isCloudflareWorkers, isNodeJs } from './env.js';
 import crypto from './webcrypto.js';
 import { JOSENotSupported } from '../util/errors.js';
 import random from './random.js';
@@ -12,7 +12,7 @@ export async function generateSecret(alg, options) {
         case 'HS384':
         case 'HS512':
             length = parseInt(alg.substr(-3), 10);
-            algorithm = { name: 'HMAC', hash: { name: `SHA-${length}` }, length };
+            algorithm = { name: 'HMAC', hash: `SHA-${length}`, length };
             keyUsages = ['sign', 'verify'];
             break;
         case 'A128CBC-HS256':
@@ -60,7 +60,7 @@ export async function generateKeyPair(alg, options) {
         case 'PS512':
             algorithm = {
                 name: 'RSA-PSS',
-                hash: { name: `SHA-${alg.substr(-3)}` },
+                hash: `SHA-${alg.substr(-3)}`,
                 publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
                 modulusLength: getModulusLengthOption(options),
             };
@@ -71,7 +71,7 @@ export async function generateKeyPair(alg, options) {
         case 'RS512':
             algorithm = {
                 name: 'RSASSA-PKCS1-v1_5',
-                hash: { name: `SHA-${alg.substr(-3)}` },
+                hash: `SHA-${alg.substr(-3)}`,
                 publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
                 modulusLength: getModulusLengthOption(options),
             };
@@ -83,7 +83,7 @@ export async function generateKeyPair(alg, options) {
         case 'RSA-OAEP-512':
             algorithm = {
                 name: 'RSA-OAEP',
-                hash: { name: `SHA-${parseInt(alg.substr(-3), 10) || 1}` },
+                hash: `SHA-${parseInt(alg.substr(-3), 10) || 1}`,
                 publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
                 modulusLength: getModulusLengthOption(options),
             };

package/dist/browser/runtime/get_sign_verify_key.js

@@ -1,6 +1,6 @@
 import crypto, { isCryptoKey } from './webcrypto.js';
 import { checkSigCryptoKey } from '../lib/crypto_key.js';
-import invalidKeyInput from './invalid_key_input.js';
+import invalidKeyInput from '../lib/invalid_key_input.js';
 export default function getCryptoKey(alg, key, usage) {
     if (isCryptoKey(key)) {
         checkSigCryptoKey(key, alg, usage);
@@ -10,7 +10,7 @@ export default function getCryptoKey(alg, key, usage) {
         if (!alg.startsWith('HS')) {
             throw new TypeError(invalidKeyInput(key, 'CryptoKey'));
         }
-        return crypto.subtle.importKey('raw', key, { hash: { name: `SHA-${alg.substr(-3)}` }, name: 'HMAC' }, false, [usage]);
+        return crypto.subtle.importKey('raw', key, { hash: `SHA-${alg.substr(-3)}`, name: 'HMAC' }, false, [usage]);
     }
     throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'Uint8Array'));
 }

package/dist/browser/runtime/jwk_to_key.js

@@ -1,4 +1,4 @@
-import { isCloudflareWorkers, isNodeJs } from './global.js';
+import { isCloudflareWorkers, isNodeJs } from './env.js';
 import crypto from './webcrypto.js';
 import { JOSENotSupported } from '../util/errors.js';
 import { decode as base64url } from './base64url.js';
@@ -11,7 +11,7 @@ function subtleMapping(jwk) {
                 case 'HS256':
                 case 'HS384':
                 case 'HS512':
-                    algorithm = { name: 'HMAC', hash: { name: `SHA-${jwk.alg.substr(-3)}` } };
+                    algorithm = { name: 'HMAC', hash: `SHA-${jwk.alg.substr(-3)}` };
                     keyUsages = ['sign', 'verify'];
                     break;
                 case 'A128CBC-HS256':
@@ -49,13 +49,13 @@ function subtleMapping(jwk) {
                 case 'PS256':
                 case 'PS384':
                 case 'PS512':
-                    algorithm = { name: 'RSA-PSS', hash: { name: `SHA-${jwk.alg.substr(-3)}` } };
+                    algorithm = { name: 'RSA-PSS', hash: `SHA-${jwk.alg.substr(-3)}` };
                     keyUsages = jwk.d ? ['sign'] : ['verify'];
                     break;
                 case 'RS256':
                 case 'RS384':
                 case 'RS512':
-                    algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: { name: `SHA-${jwk.alg.substr(-3)}` } };
+                    algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: `SHA-${jwk.alg.substr(-3)}` };
                     keyUsages = jwk.d ? ['sign'] : ['verify'];
                     break;
                 case 'RSA-OAEP':
@@ -64,7 +64,7 @@ function subtleMapping(jwk) {
                 case 'RSA-OAEP-512':
                     algorithm = {
                         name: 'RSA-OAEP',
-                        hash: { name: `SHA-${parseInt(jwk.alg.substr(-3), 10) || 1}` },
+                        hash: `SHA-${parseInt(jwk.alg.substr(-3), 10) || 1}`,
                     };
                     keyUsages = jwk.d ? ['decrypt', 'unwrapKey'] : ['encrypt', 'wrapKey'];
                     break;

package/dist/browser/runtime/key_to_jwk.js

@@ -1,5 +1,5 @@
 import crypto, { isCryptoKey } from './webcrypto.js';
-import invalidKeyInput from './invalid_key_input.js';
+import invalidKeyInput from '../lib/invalid_key_input.js';
 import { encode as base64url } from './base64url.js';
 const keyToJWK = async (key) => {
     if (key instanceof Uint8Array) {

package/dist/browser/runtime/pbes2kw.js

@@ -5,7 +5,7 @@ import { wrap, unwrap } from './aeskw.js';
 import checkP2s from '../lib/check_p2s.js';
 import crypto, { isCryptoKey } from './webcrypto.js';
 import { checkEncCryptoKey } from '../lib/crypto_key.js';
-import invalidKeyInput from './invalid_key_input.js';
+import invalidKeyInput from '../lib/invalid_key_input.js';
 function getCryptoKey(key, alg) {
     if (key instanceof Uint8Array) {
         return crypto.subtle.importKey('raw', key, 'PBKDF2', false, ['deriveBits']);
@@ -16,12 +16,12 @@ function getCryptoKey(key, alg) {
     }
     throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'Uint8Array'));
 }
-export const encrypt = async (alg, key, cek, p2c = Math.floor(Math.random() * 2049) + 2048, p2s = random(new Uint8Array(16))) => {
+async function deriveKey(p2s, alg, p2c, key) {
     checkP2s(p2s);
     const salt = concatSalt(alg, p2s);
     const keylen = parseInt(alg.substr(13, 3), 10);
     const subtleAlg = {
-        hash: { name: `SHA-${alg.substr(8, 3)}` },
+        hash: `SHA-${alg.substr(8, 3)}`,
         iterations: p2c,
         name: 'PBKDF2',
         salt,
@@ -31,43 +31,20 @@ export const encrypt = async (alg, key, cek, p2c = Math.floor(Math.random() * 20
         name: 'AES-KW',
     };
     const cryptoKey = await getCryptoKey(key, alg);
-    let derived;
     if (cryptoKey.usages.includes('deriveBits')) {
-        derived = new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
-    }
-    else if (cryptoKey.usages.includes('deriveKey')) {
-        derived = await crypto.subtle.deriveKey(subtleAlg, cryptoKey, wrapAlg, false, ['wrapKey']);
+        return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
     }
-    else {
-        throw new TypeError('PBKDF2 key "usages" must include "deriveBits" or "deriveKey"');
+    if (cryptoKey.usages.includes('deriveKey')) {
+        return crypto.subtle.deriveKey(subtleAlg, cryptoKey, wrapAlg, false, ['wrapKey', 'unwrapKey']);
     }
+    throw new TypeError('PBKDF2 key "usages" must include "deriveBits" or "deriveKey"');
+}
+export const encrypt = async (alg, key, cek, p2c = Math.floor(Math.random() * 2049) + 2048, p2s = random(new Uint8Array(16))) => {
+    const derived = await deriveKey(p2s, alg, p2c, key);
     const encryptedKey = await wrap(alg.substr(-6), derived, cek);
     return { encryptedKey, p2c, p2s: base64url(p2s) };
 };
 export const decrypt = async (alg, key, encryptedKey, p2c, p2s) => {
-    checkP2s(p2s);
-    const salt = concatSalt(alg, p2s);
-    const keylen = parseInt(alg.substr(13, 3), 10);
-    const subtleAlg = {
-        hash: { name: `SHA-${alg.substr(8, 3)}` },
-        iterations: p2c,
-        name: 'PBKDF2',
-        salt,
-    };
-    const wrapAlg = {
-        length: keylen,
-        name: 'AES-KW',
-    };
-    const cryptoKey = await getCryptoKey(key, alg);
-    let derived;
-    if (cryptoKey.usages.includes('deriveBits')) {
-        derived = new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
-    }
-    else if (cryptoKey.usages.includes('deriveKey')) {
-        derived = await crypto.subtle.deriveKey(subtleAlg, cryptoKey, wrapAlg, false, ['unwrapKey']);
-    }
-    else {
-        throw new TypeError('PBKDF2 key "usages" must include "deriveBits" or "deriveKey"');
-    }
+    const derived = await deriveKey(p2s, alg, p2c, key);
     return unwrap(alg.substr(-6), derived, encryptedKey);
 };

package/dist/browser/runtime/rsaes.js

@@ -3,7 +3,7 @@ import bogusWebCrypto from './bogus.js';
 import crypto, { isCryptoKey } from './webcrypto.js';
 import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import checkKeyLength from './check_key_length.js';
-import invalidKeyInput from './invalid_key_input.js';
+import invalidKeyInput from '../lib/invalid_key_input.js';
 export const encrypt = async (alg, key, cek) => {
     if (!isCryptoKey(key)) {
         throw new TypeError(invalidKeyInput(key, 'CryptoKey'));