jose 4.15.4 → 5.0.0

package/README.md

@@ -128,5 +128,6 @@ Please note that certain algorithms may not be available depending on the runtim
 
 | Version | Security Fixes 🔑 | Other Bug Fixes 🐞 | New Features ⭐ |
 | ------- | --------- | -------- | -------- |
-| [v4.x](https://github.com/panva/jose/tree/v4.x) | ✅ | ✅ | ✅ |
+| [v5.x](https://github.com/panva/jose/tree/v5.x) | ✅ | ✅ | ✅ |
+| [v4.x](https://github.com/panva/jose/tree/v4.x) | ✅ | ❌ | ❌ |
 | [v2.x](https://github.com/panva/jose/tree/v2.x) | ✅ | ❌ | ❌ |

package/dist/browser/index.js

@@ -23,10 +23,8 @@ export { exportPKCS8, exportSPKI, exportJWK } from './key/export.js';
 export { importSPKI, importPKCS8, importX509, importJWK } from './key/import.js';
 export { decodeProtectedHeader } from './util/decode_protected_header.js';
 export { decodeJwt } from './util/decode_jwt.js';
-import * as errors_1 from './util/errors.js';
-export { errors_1 as errors };
+export * as errors from './util/errors.js';
 export { generateKeyPair } from './key/generate_key_pair.js';
 export { generateSecret } from './key/generate_secret.js';
-import * as base64url_1 from './util/base64url.js';
-export { base64url_1 as base64url };
+export * as base64url from './util/base64url.js';
 export { default as cryptoRuntime } from './util/runtime.js';

package/dist/browser/jwe/flattened/decrypt.js

@@ -1,6 +1,5 @@
 import { decode as base64url } from '../../runtime/base64url.js';
 import decrypt from '../../runtime/decrypt.js';
-import { inflate } from '../../runtime/zlib.js';
 import { JOSEAlgNotAllowed, JOSENotSupported, JWEInvalid } from '../../util/errors.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import isObject from '../../lib/is_object.js';
@@ -10,7 +9,6 @@ import generateCek from '../../lib/cek.js';
 import validateCrit from '../../lib/validate_crit.js';
 import validateAlgorithms from '../../lib/validate_algorithms.js';
 export async function flattenedDecrypt(jwe, key, options) {
-    var _a;
     if (!isObject(jwe)) {
         throw new JWEInvalid('Flattened JWE must be an object');
     }
@@ -47,7 +45,7 @@ export async function flattenedDecrypt(jwe, key, options) {
             const protectedHeader = base64url(jwe.protected);
             parsedProt = JSON.parse(decoder.decode(protectedHeader));
         }
-        catch (_b) {
+        catch {
             throw new JWEInvalid('JWE Protected Header is invalid');
         }
     }
@@ -59,14 +57,9 @@ export async function flattenedDecrypt(jwe, key, options) {
         ...jwe.header,
         ...jwe.unprotected,
     };
-    validateCrit(JWEInvalid, new Map(), options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
+    validateCrit(JWEInvalid, new Map(), options?.crit, parsedProt, joseHeader);
     if (joseHeader.zip !== undefined) {
-        if (!parsedProt || !parsedProt.zip) {
-            throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
-        }
-        if (joseHeader.zip !== 'DEF') {
-            throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value');
-        }
+        throw new JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');
     }
     const { alg, enc } = joseHeader;
     if (typeof alg !== 'string' || !alg) {
@@ -78,18 +71,19 @@ export async function flattenedDecrypt(jwe, key, options) {
     const keyManagementAlgorithms = options && validateAlgorithms('keyManagementAlgorithms', options.keyManagementAlgorithms);
     const contentEncryptionAlgorithms = options &&
         validateAlgorithms('contentEncryptionAlgorithms', options.contentEncryptionAlgorithms);
-    if (keyManagementAlgorithms && !keyManagementAlgorithms.has(alg)) {
-        throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter not allowed');
+    if ((keyManagementAlgorithms && !keyManagementAlgorithms.has(alg)) ||
+        (!keyManagementAlgorithms && alg.startsWith('PBES2'))) {
+        throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
     }
     if (contentEncryptionAlgorithms && !contentEncryptionAlgorithms.has(enc)) {
-        throw new JOSEAlgNotAllowed('"enc" (Encryption Algorithm) Header Parameter not allowed');
+        throw new JOSEAlgNotAllowed('"enc" (Encryption Algorithm) Header Parameter value not allowed');
     }
     let encryptedKey;
     if (jwe.encrypted_key !== undefined) {
         try {
             encryptedKey = base64url(jwe.encrypted_key);
         }
-        catch (_c) {
+        catch {
             throw new JWEInvalid('Failed to base64url decode the encrypted_key');
         }
     }
@@ -113,16 +107,16 @@ export async function flattenedDecrypt(jwe, key, options) {
     try {
         iv = base64url(jwe.iv);
     }
-    catch (_d) {
+    catch {
         throw new JWEInvalid('Failed to base64url decode the iv');
     }
     try {
         tag = base64url(jwe.tag);
     }
-    catch (_e) {
+    catch {
         throw new JWEInvalid('Failed to base64url decode the tag');
     }
-    const protectedHeader = encoder.encode((_a = jwe.protected) !== null && _a !== void 0 ? _a : '');
+    const protectedHeader = encoder.encode(jwe.protected ?? '');
     let additionalData;
     if (jwe.aad !== undefined) {
         additionalData = concat(protectedHeader, encoder.encode('.'), encoder.encode(jwe.aad));
@@ -134,13 +128,10 @@ export async function flattenedDecrypt(jwe, key, options) {
     try {
         ciphertext = base64url(jwe.ciphertext);
     }
-    catch (_f) {
+    catch {
         throw new JWEInvalid('Failed to base64url decode the ciphertext');
     }
     let plaintext = await decrypt(enc, cek, ciphertext, iv, tag, additionalData);
-    if (joseHeader.zip === 'DEF') {
-        plaintext = await ((options === null || options === void 0 ? void 0 : options.inflateRaw) || inflate)(plaintext);
-    }
     const result = { plaintext };
     if (jwe.protected !== undefined) {
         result.protectedHeader = parsedProt;
@@ -149,7 +140,7 @@ export async function flattenedDecrypt(jwe, key, options) {
         try {
             result.additionalAuthenticatedData = base64url(jwe.aad);
         }
-        catch (_g) {
+        catch {
             throw new JWEInvalid('Failed to base64url decode the aad');
         }
     }

package/dist/browser/jwe/flattened/encrypt.js

@@ -1,6 +1,5 @@
 import { encode as base64url } from '../../runtime/base64url.js';
 import encrypt from '../../runtime/encrypt.js';
-import { deflate } from '../../runtime/zlib.js';
 import generateIv from '../../lib/iv.js';
 import encryptKeyManagement from '../../lib/encrypt_key_management.js';
 import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
@@ -73,14 +72,9 @@ export class FlattenedEncrypt {
             ...this._unprotectedHeader,
             ...this._sharedUnprotectedHeader,
         };
-        validateCrit(JWEInvalid, new Map(), options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
+        validateCrit(JWEInvalid, new Map(), options?.crit, this._protectedHeader, joseHeader);
         if (joseHeader.zip !== undefined) {
-            if (!this._protectedHeader || !this._protectedHeader.zip) {
-                throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
-            }
-            if (joseHeader.zip !== 'DEF') {
-                throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value');
-            }
+            throw new JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');
         }
         const { alg, enc } = joseHeader;
         if (typeof alg !== 'string' || !alg) {
@@ -140,16 +134,7 @@ export class FlattenedEncrypt {
         else {
             additionalData = protectedHeader;
         }
-        let ciphertext;
-        let tag;
-        if (joseHeader.zip === 'DEF') {
-            const deflated = await ((options === null || options === void 0 ? void 0 : options.deflateRaw) || deflate)(this._plaintext);
-            ({ ciphertext, tag } = await encrypt(enc, deflated, cek, this._iv, additionalData));
-        }
-        else {
-            ;
-            ({ ciphertext, tag } = await encrypt(enc, this._plaintext, cek, this._iv, additionalData));
-        }
+        const { ciphertext, tag } = await encrypt(enc, this._plaintext, cek, this._iv, additionalData);
         const jwe = {
             ciphertext: base64url(ciphertext),
             iv: base64url(this._iv),

package/dist/browser/jwe/general/decrypt.js

@@ -24,7 +24,7 @@ export async function generalDecrypt(jwe, key, options) {
                 unprotected: jwe.unprotected,
             }, key, options);
         }
-        catch (_a) {
+        catch {
         }
     }
     throw new JWEDecryptionFailed();

package/dist/browser/jwe/general/encrypt.js

@@ -1,5 +1,5 @@
 import { FlattenedEncrypt, unprotected } from '../flattened/encrypt.js';
-import { JWEInvalid } from '../../util/errors.js';
+import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
 import generateCek from '../../lib/cek.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import encryptKeyManagement from '../../lib/encrypt_key_management.js';
@@ -34,7 +34,7 @@ export class GeneralEncrypt {
         this._plaintext = plaintext;
     }
     addRecipient(key, options) {
-        const recipient = new IndividualRecipient(this, key, { crit: options === null || options === void 0 ? void 0 : options.crit });
+        const recipient = new IndividualRecipient(this, key, { crit: options?.crit });
         this._recipients.push(recipient);
         return recipient;
     }
@@ -56,12 +56,10 @@ export class GeneralEncrypt {
         this._aad = aad;
         return this;
     }
-    async encrypt(options) {
-        var _a, _b, _c;
+    async encrypt() {
         if (!this._recipients.length) {
             throw new JWEInvalid('at least one recipient must be added');
         }
-        options = { deflateRaw: options === null || options === void 0 ? void 0 : options.deflateRaw };
         if (this._recipients.length === 1) {
             const [recipient] = this._recipients;
             const flattened = await new FlattenedEncrypt(this._plaintext)
@@ -69,7 +67,7 @@ export class GeneralEncrypt {
                 .setProtectedHeader(this._protectedHeader)
                 .setSharedUnprotectedHeader(this._unprotectedHeader)
                 .setUnprotectedHeader(recipient.unprotectedHeader)
-                .encrypt(recipient.key, { ...recipient.options, ...options });
+                .encrypt(recipient.key, { ...recipient.options });
             let jwe = {
                 ciphertext: flattened.ciphertext,
                 iv: flattened.iv,
@@ -117,9 +115,7 @@ export class GeneralEncrypt {
             }
             validateCrit(JWEInvalid, new Map(), recipient.options.crit, this._protectedHeader, joseHeader);
             if (joseHeader.zip !== undefined) {
-                if (!this._protectedHeader || !this._protectedHeader.zip) {
-                    throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
-                }
+                throw new JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');
             }
         }
         const cek = generateCek(enc);
@@ -149,7 +145,6 @@ export class GeneralEncrypt {
                     .setKeyManagementParameters({ p2c })
                     .encrypt(recipient.key, {
                     ...recipient.options,
-                    ...options,
                     [unprotected]: true,
                 });
                 jwe.ciphertext = flattened.ciphertext;
@@ -166,9 +161,9 @@ export class GeneralEncrypt {
                     target.header = flattened.header;
                 continue;
             }
-            const { encryptedKey, parameters } = await encryptKeyManagement(((_a = recipient.unprotectedHeader) === null || _a === void 0 ? void 0 : _a.alg) ||
-                ((_b = this._protectedHeader) === null || _b === void 0 ? void 0 : _b.alg) ||
-                ((_c = this._unprotectedHeader) === null || _c === void 0 ? void 0 : _c.alg), enc, recipient.key, cek, { p2c });
+            const { encryptedKey, parameters } = await encryptKeyManagement(recipient.unprotectedHeader?.alg ||
+                this._protectedHeader?.alg ||
+                this._unprotectedHeader?.alg, enc, recipient.key, cek, { p2c });
             target.encrypted_key = base64url(encryptedKey);
             if (recipient.unprotectedHeader || parameters)
                 target.header = { ...recipient.unprotectedHeader, ...parameters };

package/dist/browser/jwk/embedded.js

@@ -4,12 +4,12 @@ import { JWSInvalid } from '../util/errors.js';
 export async function EmbeddedJWK(protectedHeader, token) {
     const joseHeader = {
         ...protectedHeader,
-        ...token === null || token === void 0 ? void 0 : token.header,
+        ...token?.header,
     };
     if (!isObject(joseHeader.jwk)) {
         throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');
     }
-    const key = await importJWK({ ...joseHeader.jwk, ext: true }, joseHeader.alg, true);
+    const key = await importJWK({ ...joseHeader.jwk, ext: true }, joseHeader.alg);
     if (key instanceof Uint8Array || key.type !== 'public') {
         throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
     }

package/dist/browser/jwk/thumbprint.js

@@ -12,7 +12,7 @@ export async function calculateJwkThumbprint(jwk, digestAlgorithm) {
     if (!isObject(jwk)) {
         throw new TypeError('JWK must be an object');
     }
-    digestAlgorithm !== null && digestAlgorithm !== void 0 ? digestAlgorithm : (digestAlgorithm = 'sha256');
+    digestAlgorithm ?? (digestAlgorithm = 'sha256');
     if (digestAlgorithm !== 'sha256' &&
         digestAlgorithm !== 'sha384' &&
         digestAlgorithm !== 'sha512') {
@@ -47,7 +47,7 @@ export async function calculateJwkThumbprint(jwk, digestAlgorithm) {
     return base64url(await digest(digestAlgorithm, data));
 }
 export async function calculateJwkThumbprintUri(jwk, digestAlgorithm) {
-    digestAlgorithm !== null && digestAlgorithm !== void 0 ? digestAlgorithm : (digestAlgorithm = 'sha256');
+    digestAlgorithm ?? (digestAlgorithm = 'sha256');
     const thumbprint = await calculateJwkThumbprint(jwk, digestAlgorithm);
     return `urn:ietf:params:oauth:jwk-thumbprint:sha-${digestAlgorithm.slice(-3)}:${thumbprint}`;
 }

package/dist/browser/jwks/local.js

@@ -38,7 +38,7 @@ export class LocalJWKSet {
         this._jwks = clone(jwks);
     }
     async getKey(protectedHeader, token) {
-        const { alg, kid } = { ...protectedHeader, ...token === null || token === void 0 ? void 0 : token.header };
+        const { alg, kid } = { ...protectedHeader, ...token?.header };
         const kty = getKtyFromAlg(alg);
         const candidates = this._jwks.keys.filter((jwk) => {
             let candidate = kty === jwk.kty;
@@ -87,7 +87,7 @@ export class LocalJWKSet {
                     try {
                         yield await importWithAlgCache(_cached, jwk, alg);
                     }
-                    catch (_a) {
+                    catch {
                         continue;
                     }
                 }

package/dist/browser/jwks/remote.js

@@ -14,12 +14,12 @@ class RemoteJWKSet extends LocalJWKSet {
             throw new TypeError('url must be an instance of URL');
         }
         this._url = new URL(url.href);
-        this._options = { agent: options === null || options === void 0 ? void 0 : options.agent, headers: options === null || options === void 0 ? void 0 : options.headers };
+        this._options = { agent: options?.agent, headers: options?.headers };
         this._timeoutDuration =
-            typeof (options === null || options === void 0 ? void 0 : options.timeoutDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.timeoutDuration : 5000;
+            typeof options?.timeoutDuration === 'number' ? options?.timeoutDuration : 5000;
         this._cooldownDuration =
-            typeof (options === null || options === void 0 ? void 0 : options.cooldownDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.cooldownDuration : 30000;
-        this._cacheMaxAge = typeof (options === null || options === void 0 ? void 0 : options.cacheMaxAge) === 'number' ? options === null || options === void 0 ? void 0 : options.cacheMaxAge : 600000;
+            typeof options?.cooldownDuration === 'number' ? options?.cooldownDuration : 30000;
+        this._cacheMaxAge = typeof options?.cacheMaxAge === 'number' ? options?.cacheMaxAge : 600000;
     }
     coolingDown() {
         return typeof this._jwksTimestamp === 'number'

package/dist/browser/jws/flattened/sign.js

@@ -37,7 +37,7 @@ export class FlattenedSign {
             ...this._protectedHeader,
             ...this._unprotectedHeader,
         };
-        const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
+        const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options?.crit, this._protectedHeader, joseHeader);
         let b64 = true;
         if (extensions.has('b64')) {
             b64 = this._protectedHeader.b64;

package/dist/browser/jws/flattened/verify.js

@@ -8,7 +8,6 @@ import checkKeyType from '../../lib/check_key_type.js';
 import validateCrit from '../../lib/validate_crit.js';
 import validateAlgorithms from '../../lib/validate_algorithms.js';
 export async function flattenedVerify(jws, key, options) {
-    var _a;
     if (!isObject(jws)) {
         throw new JWSInvalid('Flattened JWS must be an object');
     }
@@ -33,7 +32,7 @@ export async function flattenedVerify(jws, key, options) {
             const protectedHeader = base64url(jws.protected);
             parsedProt = JSON.parse(decoder.decode(protectedHeader));
         }
-        catch (_b) {
+        catch {
             throw new JWSInvalid('JWS Protected Header is invalid');
         }
     }
@@ -44,7 +43,7 @@ export async function flattenedVerify(jws, key, options) {
         ...parsedProt,
         ...jws.header,
     };
-    const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
+    const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options?.crit, parsedProt, joseHeader);
     let b64 = true;
     if (extensions.has('b64')) {
         b64 = parsedProt.b64;
@@ -58,7 +57,7 @@ export async function flattenedVerify(jws, key, options) {
     }
     const algorithms = options && validateAlgorithms('algorithms', options.algorithms);
     if (algorithms && !algorithms.has(alg)) {
-        throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter not allowed');
+        throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
     }
     if (b64) {
         if (typeof jws.payload !== 'string') {
@@ -74,12 +73,12 @@ export async function flattenedVerify(jws, key, options) {
         resolvedKey = true;
     }
     checkKeyType(alg, key, 'verify');
-    const data = concat(encoder.encode((_a = jws.protected) !== null && _a !== void 0 ? _a : ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);
+    const data = concat(encoder.encode(jws.protected ?? ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);
     let signature;
     try {
         signature = base64url(jws.signature);
     }
-    catch (_c) {
+    catch {
         throw new JWSInvalid('Failed to base64url decode the signature');
     }
     const verified = await verify(alg, key, signature, data);
@@ -91,7 +90,7 @@ export async function flattenedVerify(jws, key, options) {
         try {
             payload = base64url(jws.payload);
         }
-        catch (_d) {
+        catch {
             throw new JWSInvalid('Failed to base64url decode the payload');
         }
     }

package/dist/browser/jws/general/verify.js

@@ -17,7 +17,7 @@ export async function generalVerify(jws, key, options) {
                 signature: signature.signature,
             }, key, options);
         }
-        catch (_a) {
+        catch {
         }
     }
     throw new JWSSignatureVerificationFailed();

package/dist/browser/jwt/produce.js

@@ -1,8 +1,14 @@
 import epoch from '../lib/epoch.js';
 import isObject from '../lib/is_object.js';
 import secs from '../lib/secs.js';
+function validateInput(label, input) {
+    if (!Number.isFinite(input)) {
+        throw new TypeError(`Invalid ${label} input`);
+    }
+    return input;
+}
 export class ProduceJWT {
-    constructor(payload) {
+    constructor(payload = {}) {
         if (!isObject(payload)) {
             throw new TypeError('JWT Claims Set MUST be an object');
         }
@@ -26,7 +32,10 @@ export class ProduceJWT {
     }
     setNotBefore(input) {
         if (typeof input === 'number') {
-            this._payload = { ...this._payload, nbf: input };
+            this._payload = { ...this._payload, nbf: validateInput('setNotBefore', input) };
+        }
+        else if (input instanceof Date) {
+            this._payload = { ...this._payload, nbf: validateInput('setNotBefore', epoch(input)) };
         }
         else {
             this._payload = { ...this._payload, nbf: epoch(new Date()) + secs(input) };
@@ -35,7 +44,10 @@ export class ProduceJWT {
     }
     setExpirationTime(input) {
         if (typeof input === 'number') {
-            this._payload = { ...this._payload, exp: input };
+            this._payload = { ...this._payload, exp: validateInput('setExpirationTime', input) };
+        }
+        else if (input instanceof Date) {
+            this._payload = { ...this._payload, exp: validateInput('setExpirationTime', epoch(input)) };
         }
         else {
             this._payload = { ...this._payload, exp: epoch(new Date()) + secs(input) };
@@ -46,8 +58,11 @@ export class ProduceJWT {
         if (typeof input === 'undefined') {
             this._payload = { ...this._payload, iat: epoch(new Date()) };
         }
+        else if (input instanceof Date) {
+            this._payload = { ...this._payload, iat: validateInput('setIssuedAt', epoch(input)) };
+        }
         else {
-            this._payload = { ...this._payload, iat: input };
+            this._payload = { ...this._payload, iat: validateInput('setIssuedAt', input) };
         }
         return this;
     }

package/dist/browser/jwt/sign.js

@@ -8,10 +8,9 @@ export class SignJWT extends ProduceJWT {
         return this;
     }
     async sign(key, options) {
-        var _a;
         const sig = new CompactSign(encoder.encode(JSON.stringify(this._payload)));
         sig.setProtectedHeader(this._protectedHeader);
-        if (Array.isArray((_a = this._protectedHeader) === null || _a === void 0 ? void 0 : _a.crit) &&
+        if (Array.isArray(this._protectedHeader?.crit) &&
             this._protectedHeader.crit.includes('b64') &&
             this._protectedHeader.b64 === false) {
             throw new JWTInvalid('JWTs MUST NOT use unencoded payload');

package/dist/browser/jwt/unsecured.js

@@ -23,7 +23,7 @@ export class UnsecuredJWT extends ProduceJWT {
             if (header.alg !== 'none')
                 throw new Error();
         }
-        catch (_a) {
+        catch {
             throw new JWTInvalid('Invalid Unsecured JWT');
         }
         const payload = jwtPayload(header, base64url.decode(encodedPayload), options);

package/dist/browser/jwt/verify.js

@@ -2,9 +2,8 @@ import { compactVerify } from '../jws/compact/verify.js';
 import jwtPayload from '../lib/jwt_claims_set.js';
 import { JWTInvalid } from '../util/errors.js';
 export async function jwtVerify(jwt, key, options) {
-    var _a;
     const verified = await compactVerify(jwt, key, options);
-    if (((_a = verified.protectedHeader.crit) === null || _a === void 0 ? void 0 : _a.includes('b64')) && verified.protectedHeader.b64 === false) {
+    if (verified.protectedHeader.crit?.includes('b64') && verified.protectedHeader.b64 === false) {
         throw new JWTInvalid('JWTs MUST NOT use unencoded payload');
     }
     const payload = jwtPayload(verified.protectedHeader, verified.payload, options);

package/dist/browser/key/import.js

@@ -21,8 +21,7 @@ export async function importPKCS8(pkcs8, alg, options) {
     }
     return fromPKCS8(pkcs8, alg, options);
 }
-export async function importJWK(jwk, alg, octAsKeyObject) {
-    var _a;
+export async function importJWK(jwk, alg) {
     if (!isObject(jwk)) {
         throw new TypeError('JWK must be an object');
     }
@@ -32,10 +31,6 @@ export async function importJWK(jwk, alg, octAsKeyObject) {
             if (typeof jwk.k !== 'string' || !jwk.k) {
                 throw new TypeError('missing "k" (Key Value) Parameter value');
             }
-            octAsKeyObject !== null && octAsKeyObject !== void 0 ? octAsKeyObject : (octAsKeyObject = jwk.ext !== true);
-            if (octAsKeyObject) {
-                return asKeyObject({ ...jwk, alg, ext: (_a = jwk.ext) !== null && _a !== void 0 ? _a : false });
-            }
             return decodeBase64URL(jwk.k);
         case 'RSA':
             if (jwk.oth !== undefined) {

package/dist/browser/lib/decrypt_key_management.js

@@ -36,7 +36,7 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options)
                 try {
                     partyUInfo = base64url(joseHeader.apu);
                 }
-                catch (_a) {
+                catch {
                     throw new JWEInvalid('Failed to base64url decode the apu');
                 }
             }
@@ -46,7 +46,7 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options)
                 try {
                     partyVInfo = base64url(joseHeader.apv);
                 }
-                catch (_b) {
+                catch {
                     throw new JWEInvalid('Failed to base64url decode the apv');
                 }
             }
@@ -73,7 +73,7 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options)
                 throw new JWEInvalid('JWE Encrypted Key missing');
             if (typeof joseHeader.p2c !== 'number')
                 throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);
-            const p2cLimit = (options === null || options === void 0 ? void 0 : options.maxPBES2Count) || 10000;
+            const p2cLimit = options?.maxPBES2Count || 10000;
             if (joseHeader.p2c > p2cLimit)
                 throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);
             if (typeof joseHeader.p2s !== 'string')
@@ -82,7 +82,7 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options)
             try {
                 p2s = base64url(joseHeader.p2s);
             }
-            catch (_c) {
+            catch {
                 throw new JWEInvalid('Failed to base64url decode the p2s');
             }
             return pbes2Kw(alg, key, encryptedKey, joseHeader.p2c, p2s);
@@ -107,14 +107,14 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options)
             try {
                 iv = base64url(joseHeader.iv);
             }
-            catch (_d) {
+            catch {
                 throw new JWEInvalid('Failed to base64url decode the iv');
             }
             let tag;
             try {
                 tag = base64url(joseHeader.tag);
             }
-            catch (_e) {
+            catch {
                 throw new JWEInvalid('Failed to base64url decode the tag');
             }
             return aesGcmKw(alg, key, encryptedKey, iv, tag);

package/dist/browser/lib/jwt_claims_set.js

@@ -24,7 +24,7 @@ export default (protectedHeader, encodedPayload, options = {}) => {
     try {
         payload = JSON.parse(decoder.decode(encodedPayload));
     }
-    catch (_a) {
+    catch {
     }
     if (!isObject(payload)) {
         throw new JWTInvalid('JWT Claims Set must be a top-level JSON object');

package/dist/browser/runtime/asn1.js

@@ -56,7 +56,6 @@ const getNamedCurve = (keyData) => {
     }
 };
 const genericImport = async (replace, keyFormat, pem, alg, options) => {
-    var _a;
     let algorithm;
     let keyUsages;
     const keyData = new Uint8Array(atob(pem.replace(replace, ''))
@@ -114,7 +113,7 @@ const genericImport = async (replace, keyFormat, pem, alg, options) => {
         default:
             throw new JOSENotSupported('Invalid or unsupported "alg" (Algorithm) value');
     }
-    return crypto.subtle.importKey(keyFormat, keyData, algorithm, (_a = options === null || options === void 0 ? void 0 : options.extractable) !== null && _a !== void 0 ? _a : false, keyUsages);
+    return crypto.subtle.importKey(keyFormat, keyData, algorithm, options?.extractable ?? false, keyUsages);
 };
 export const fromPKCS8 = (pem, alg, options) => {
     return genericImport(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, 'pkcs8', pem, alg, options);

package/dist/browser/runtime/base64url.js

@@ -31,7 +31,7 @@ export const decode = (input) => {
     try {
         return decodeBase64(encoded);
     }
-    catch (_a) {
+    catch {
         throw new TypeError('The input to be decoded is not correctly encoded.');
     }
 };

package/dist/browser/runtime/decrypt.js

@@ -23,7 +23,7 @@ async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
     try {
         macCheckPassed = timingSafeEqual(tag, expectedTag);
     }
-    catch (_a) {
+    catch {
     }
     if (!macCheckPassed) {
         throw new JWEDecryptionFailed();
@@ -32,7 +32,7 @@ async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
     try {
         plaintext = new Uint8Array(await crypto.subtle.decrypt({ iv, name: 'AES-CBC' }, encKey, ciphertext));
     }
-    catch (_b) {
+    catch {
     }
     if (!plaintext) {
         throw new JWEDecryptionFailed();
@@ -56,7 +56,7 @@ async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
             tagLength: 128,
         }, encKey, concat(ciphertext, tag)));
     }
-    catch (_a) {
+    catch {
         throw new JWEDecryptionFailed();
     }
 }

package/dist/browser/runtime/fetch_jwks.js

@@ -27,7 +27,7 @@ const fetchJwks = async (url, timeout, options) => {
     try {
         return await response.json();
     }
-    catch (_a) {
+    catch {
         throw new JOSEError('Failed to parse the JSON Web Key Set HTTP response as JSON');
     }
 };