jose 4.15.4 → 5.0.1

package/dist/node/cjs/jwt/produce.js

@@ -4,8 +4,15 @@ exports.ProduceJWT = void 0;
 const epoch_js_1 = require("../lib/epoch.js");
 const is_object_js_1 = require("../lib/is_object.js");
 const secs_js_1 = require("../lib/secs.js");
+function validateInput(label, input) {
+    if (!Number.isFinite(input)) {
+        throw new TypeError(`Invalid ${label} input`);
+    }
+    return input;
+}
 class ProduceJWT {
-    constructor(payload) {
+    _payload;
+    constructor(payload = {}) {
         if (!(0, is_object_js_1.default)(payload)) {
             throw new TypeError('JWT Claims Set MUST be an object');
         }
@@ -29,7 +36,10 @@ class ProduceJWT {
     }
     setNotBefore(input) {
         if (typeof input === 'number') {
-            this._payload = { ...this._payload, nbf: input };
+            this._payload = { ...this._payload, nbf: validateInput('setNotBefore', input) };
+        }
+        else if (input instanceof Date) {
+            this._payload = { ...this._payload, nbf: validateInput('setNotBefore', (0, epoch_js_1.default)(input)) };
         }
         else {
             this._payload = { ...this._payload, nbf: (0, epoch_js_1.default)(new Date()) + (0, secs_js_1.default)(input) };
@@ -38,7 +48,10 @@ class ProduceJWT {
     }
     setExpirationTime(input) {
         if (typeof input === 'number') {
-            this._payload = { ...this._payload, exp: input };
+            this._payload = { ...this._payload, exp: validateInput('setExpirationTime', input) };
+        }
+        else if (input instanceof Date) {
+            this._payload = { ...this._payload, exp: validateInput('setExpirationTime', (0, epoch_js_1.default)(input)) };
         }
         else {
             this._payload = { ...this._payload, exp: (0, epoch_js_1.default)(new Date()) + (0, secs_js_1.default)(input) };
@@ -49,8 +62,11 @@ class ProduceJWT {
         if (typeof input === 'undefined') {
             this._payload = { ...this._payload, iat: (0, epoch_js_1.default)(new Date()) };
         }
+        else if (input instanceof Date) {
+            this._payload = { ...this._payload, iat: validateInput('setIssuedAt', (0, epoch_js_1.default)(input)) };
+        }
         else {
-            this._payload = { ...this._payload, iat: input };
+            this._payload = { ...this._payload, iat: validateInput('setIssuedAt', input) };
         }
         return this;
     }

package/dist/node/cjs/jwt/sign.js

@@ -6,15 +6,15 @@ const errors_js_1 = require("../util/errors.js");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
 const produce_js_1 = require("./produce.js");
 class SignJWT extends produce_js_1.ProduceJWT {
+    _protectedHeader;
     setProtectedHeader(protectedHeader) {
         this._protectedHeader = protectedHeader;
         return this;
     }
     async sign(key, options) {
-        var _a;
         const sig = new sign_js_1.CompactSign(buffer_utils_js_1.encoder.encode(JSON.stringify(this._payload)));
         sig.setProtectedHeader(this._protectedHeader);
-        if (Array.isArray((_a = this._protectedHeader) === null || _a === void 0 ? void 0 : _a.crit) &&
+        if (Array.isArray(this._protectedHeader?.crit) &&
             this._protectedHeader.crit.includes('b64') &&
             this._protectedHeader.b64 === false) {
             throw new errors_js_1.JWTInvalid('JWTs MUST NOT use unencoded payload');

package/dist/node/cjs/jwt/verify.js

@@ -5,9 +5,8 @@ const verify_js_1 = require("../jws/compact/verify.js");
 const jwt_claims_set_js_1 = require("../lib/jwt_claims_set.js");
 const errors_js_1 = require("../util/errors.js");
 async function jwtVerify(jwt, key, options) {
-    var _a;
     const verified = await (0, verify_js_1.compactVerify)(jwt, key, options);
-    if (((_a = verified.protectedHeader.crit) === null || _a === void 0 ? void 0 : _a.includes('b64')) && verified.protectedHeader.b64 === false) {
+    if (verified.protectedHeader.crit?.includes('b64') && verified.protectedHeader.b64 === false) {
         throw new errors_js_1.JWTInvalid('JWTs MUST NOT use unencoded payload');
     }
     const payload = (0, jwt_claims_set_js_1.default)(verified.protectedHeader, verified.payload, options);

package/dist/node/cjs/key/import.js

@@ -27,21 +27,16 @@ async function importPKCS8(pkcs8, alg, options) {
     return (0, asn1_js_1.fromPKCS8)(pkcs8, alg, options);
 }
 exports.importPKCS8 = importPKCS8;
-async function importJWK(jwk, alg, octAsKeyObject) {
-    var _a;
+async function importJWK(jwk, alg) {
     if (!(0, is_object_js_1.default)(jwk)) {
         throw new TypeError('JWK must be an object');
     }
-    alg || (alg = jwk.alg);
+    alg ||= jwk.alg;
     switch (jwk.kty) {
         case 'oct':
             if (typeof jwk.k !== 'string' || !jwk.k) {
                 throw new TypeError('missing "k" (Key Value) Parameter value');
             }
-            octAsKeyObject !== null && octAsKeyObject !== void 0 ? octAsKeyObject : (octAsKeyObject = jwk.ext !== true);
-            if (octAsKeyObject) {
-                return (0, jwk_to_key_js_1.default)({ ...jwk, alg, ext: (_a = jwk.ext) !== null && _a !== void 0 ? _a : false });
-            }
             return (0, base64url_js_1.decode)(jwk.k);
         case 'RSA':
             if (jwk.oth !== undefined) {

package/dist/node/cjs/lib/aesgcmkw.js

@@ -7,7 +7,7 @@ const iv_js_1 = require("./iv.js");
 const base64url_js_1 = require("../runtime/base64url.js");
 async function wrap(alg, key, cek, iv) {
     const jweAlgorithm = alg.slice(0, 7);
-    iv || (iv = (0, iv_js_1.default)(jweAlgorithm));
+    iv ||= (0, iv_js_1.default)(jweAlgorithm);
     const { ciphertext: encryptedKey, tag } = await (0, encrypt_js_1.default)(jweAlgorithm, cek, key, iv, new Uint8Array(0));
     return { encryptedKey, iv: (0, base64url_js_1.encode)(iv), tag: (0, base64url_js_1.encode)(tag) };
 }

package/dist/node/cjs/lib/decrypt_key_management.js

@@ -75,7 +75,7 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options)
                 throw new errors_js_1.JWEInvalid('JWE Encrypted Key missing');
             if (typeof joseHeader.p2c !== 'number')
                 throw new errors_js_1.JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);
-            const p2cLimit = (options === null || options === void 0 ? void 0 : options.maxPBES2Count) || 10000;
+            const p2cLimit = options?.maxPBES2Count || 10000;
             if (joseHeader.p2c > p2cLimit)
                 throw new errors_js_1.JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);
             if (typeof joseHeader.p2s !== 'string')

package/dist/node/cjs/lib/encrypt_key_management.js

@@ -29,7 +29,7 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
             }
             const { apu, apv } = providedParameters;
             let { epk: ephemeralKey } = providedParameters;
-            ephemeralKey || (ephemeralKey = (await ECDH.generateEpk(key)).privateKey);
+            ephemeralKey ||= (await ECDH.generateEpk(key)).privateKey;
             const { x, y, crv, kty } = await (0, export_js_1.exportJWK)(ephemeralKey);
             const sharedSecret = await ECDH.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, alg === 'ECDH-ES' ? (0, cek_js_1.bitLength)(enc) : parseInt(alg.slice(-5, -2), 10), apu, apv);
             parameters = { epk: { x, crv, kty } };

package/dist/node/cjs/runtime/aeskw.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.unwrap = exports.wrap = void 0;
-const buffer_1 = require("buffer");
-const crypto_1 = require("crypto");
+const node_buffer_1 = require("node:buffer");
+const node_crypto_1 = require("node:crypto");
 const errors_js_1 = require("../util/errors.js");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
 const webcrypto_js_1 = require("./webcrypto.js");
@@ -21,11 +21,11 @@ function ensureKeyObject(key, alg, usage) {
         return key;
     }
     if (key instanceof Uint8Array) {
-        return (0, crypto_1.createSecretKey)(key);
+        return (0, node_crypto_1.createSecretKey)(key);
     }
     if ((0, webcrypto_js_1.isCryptoKey)(key)) {
         (0, crypto_key_js_1.checkEncCryptoKey)(key, alg, usage);
-        return crypto_1.KeyObject.from(key);
+        return node_crypto_1.KeyObject.from(key);
     }
     throw new TypeError((0, invalid_key_input_js_1.default)(key, ...is_key_like_js_1.types, 'Uint8Array'));
 }
@@ -37,7 +37,7 @@ const wrap = (alg, key, cek) => {
     }
     const keyObject = ensureKeyObject(key, alg, 'wrapKey');
     checkKeySize(keyObject, alg);
-    const cipher = (0, crypto_1.createCipheriv)(algorithm, keyObject, buffer_1.Buffer.alloc(8, 0xa6));
+    const cipher = (0, node_crypto_1.createCipheriv)(algorithm, keyObject, node_buffer_1.Buffer.alloc(8, 0xa6));
     return (0, buffer_utils_js_1.concat)(cipher.update(cek), cipher.final());
 };
 exports.wrap = wrap;
@@ -49,7 +49,7 @@ const unwrap = (alg, key, encryptedKey) => {
     }
     const keyObject = ensureKeyObject(key, alg, 'unwrapKey');
     checkKeySize(keyObject, alg);
-    const cipher = (0, crypto_1.createDecipheriv)(algorithm, keyObject, buffer_1.Buffer.alloc(8, 0xa6));
+    const cipher = (0, node_crypto_1.createDecipheriv)(algorithm, keyObject, node_buffer_1.Buffer.alloc(8, 0xa6));
     return (0, buffer_utils_js_1.concat)(cipher.update(encryptedKey), cipher.final());
 };
 exports.unwrap = unwrap;

package/dist/node/cjs/runtime/asn1.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.fromX509 = exports.fromSPKI = exports.fromPKCS8 = exports.toPKCS8 = exports.toSPKI = void 0;
-const crypto_1 = require("crypto");
-const buffer_1 = require("buffer");
+const node_crypto_1 = require("node:crypto");
+const node_buffer_1 = require("node:buffer");
 const webcrypto_js_1 = require("./webcrypto.js");
 const is_key_object_js_1 = require("./is_key_object.js");
 const invalid_key_input_js_1 = require("../lib/invalid_key_input.js");
@@ -13,7 +13,7 @@ const genericExport = (keyType, keyFormat, key) => {
         if (!key.extractable) {
             throw new TypeError('CryptoKey is not extractable');
         }
-        keyObject = crypto_1.KeyObject.from(key);
+        keyObject = node_crypto_1.KeyObject.from(key);
     }
     else if ((0, is_key_object_js_1.default)(key)) {
         keyObject = key;
@@ -34,19 +34,19 @@ const toPKCS8 = (key) => {
     return genericExport('private', 'pkcs8', key);
 };
 exports.toPKCS8 = toPKCS8;
-const fromPKCS8 = (pem) => (0, crypto_1.createPrivateKey)({
-    key: buffer_1.Buffer.from(pem.replace(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, ''), 'base64'),
+const fromPKCS8 = (pem) => (0, node_crypto_1.createPrivateKey)({
+    key: node_buffer_1.Buffer.from(pem.replace(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, ''), 'base64'),
     type: 'pkcs8',
     format: 'der',
 });
 exports.fromPKCS8 = fromPKCS8;
-const fromSPKI = (pem) => (0, crypto_1.createPublicKey)({
-    key: buffer_1.Buffer.from(pem.replace(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g, ''), 'base64'),
+const fromSPKI = (pem) => (0, node_crypto_1.createPublicKey)({
+    key: node_buffer_1.Buffer.from(pem.replace(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g, ''), 'base64'),
     type: 'spki',
     format: 'der',
 });
 exports.fromSPKI = fromSPKI;
-const fromX509 = (pem) => (0, crypto_1.createPublicKey)({
+const fromX509 = (pem) => (0, node_crypto_1.createPublicKey)({
     key: pem,
     type: 'spki',
     format: 'pem',

package/dist/node/cjs/runtime/base64url.js

@@ -1,9 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.decode = exports.encode = exports.encodeBase64 = exports.decodeBase64 = void 0;
-const buffer_1 = require("buffer");
+const node_buffer_1 = require("node:buffer");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
-let encode;
 function normalize(input) {
     let encoded = input;
     if (encoded instanceof Uint8Array) {
@@ -11,15 +10,11 @@ function normalize(input) {
     }
     return encoded;
 }
-if (buffer_1.Buffer.isEncoding('base64url')) {
-    exports.encode = encode = (input) => buffer_1.Buffer.from(input).toString('base64url');
-}
-else {
-    exports.encode = encode = (input) => buffer_1.Buffer.from(input).toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
-}
-const decodeBase64 = (input) => buffer_1.Buffer.from(input, 'base64');
+const encode = (input) => node_buffer_1.Buffer.from(input).toString('base64url');
+exports.encode = encode;
+const decodeBase64 = (input) => new Uint8Array(node_buffer_1.Buffer.from(input, 'base64'));
 exports.decodeBase64 = decodeBase64;
-const encodeBase64 = (input) => buffer_1.Buffer.from(input).toString('base64');
+const encodeBase64 = (input) => node_buffer_1.Buffer.from(input).toString('base64');
 exports.encodeBase64 = encodeBase64;
-const decode = (input) => buffer_1.Buffer.from(normalize(input), 'base64');
+const decode = (input) => new Uint8Array(node_buffer_1.Buffer.from(normalize(input), 'base64'));
 exports.decode = decode;

package/dist/node/cjs/runtime/cbc_tag.js

@@ -1,10 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const crypto_1 = require("crypto");
+const node_crypto_1 = require("node:crypto");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
 function cbcTag(aad, iv, ciphertext, macSize, macKey, keySize) {
     const macData = (0, buffer_utils_js_1.concat)(aad, iv, ciphertext, (0, buffer_utils_js_1.uint64be)(aad.length << 3));
-    const hmac = (0, crypto_1.createHmac)(`sha${macSize}`, macKey);
+    const hmac = (0, node_crypto_1.createHmac)(`sha${macSize}`, macKey);
     hmac.update(macData);
     return hmac.digest().slice(0, keySize >> 3);
 }

package/dist/node/cjs/runtime/check_key_length.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.default = (key, alg) => {
+    const { modulusLength } = key.asymmetricKeyDetails;
+    if (typeof modulusLength !== 'number' || modulusLength < 2048) {
+        throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
+    }
+};

package/dist/node/cjs/runtime/ciphers.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const crypto_1 = require("crypto");
+const node_crypto_1 = require("node:crypto");
 let ciphers;
 exports.default = (algorithm) => {
-    ciphers || (ciphers = new Set((0, crypto_1.getCiphers)()));
+    ciphers ||= new Set((0, node_crypto_1.getCiphers)());
     return ciphers.has(algorithm);
 };

package/dist/node/cjs/runtime/decrypt.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const crypto_1 = require("crypto");
+const node_crypto_1 = require("node:crypto");
 const check_iv_length_js_1 = require("../lib/check_iv_length.js");
 const check_cek_length_js_1 = require("./check_cek_length.js");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
@@ -37,7 +37,7 @@ function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
     }
     let plaintext;
     try {
-        const decipher = (0, crypto_1.createDecipheriv)(algorithm, encKey, iv);
+        const decipher = (0, node_crypto_1.createDecipheriv)(algorithm, encKey, iv);
         plaintext = (0, buffer_utils_js_1.concat)(decipher.update(ciphertext), decipher.final());
     }
     catch {
@@ -54,7 +54,7 @@ function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
         throw new errors_js_1.JOSENotSupported(`alg ${enc} is not supported by your javascript runtime`);
     }
     try {
-        const decipher = (0, crypto_1.createDecipheriv)(algorithm, cek, iv, { authTagLength: 16 });
+        const decipher = (0, node_crypto_1.createDecipheriv)(algorithm, cek, iv, { authTagLength: 16 });
         decipher.setAuthTag(tag);
         if (aad.byteLength) {
             decipher.setAAD(aad, { plaintextLength: ciphertext.length });
@@ -71,7 +71,7 @@ const decrypt = (enc, cek, ciphertext, iv, tag, aad) => {
     let key;
     if ((0, webcrypto_js_1.isCryptoKey)(cek)) {
         (0, crypto_key_js_1.checkEncCryptoKey)(cek, enc, 'decrypt');
-        key = crypto_1.KeyObject.from(cek);
+        key = node_crypto_1.KeyObject.from(cek);
     }
     else if (cek instanceof Uint8Array || (0, is_key_object_js_1.default)(cek)) {
         key = cek;

package/dist/node/cjs/runtime/digest.js

@@ -1,5 +1,5 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const crypto_1 = require("crypto");
-const digest = (algorithm, data) => (0, crypto_1.createHash)(algorithm).update(data).digest();
+const node_crypto_1 = require("node:crypto");
+const digest = (algorithm, data) => (0, node_crypto_1.createHash)(algorithm).update(data).digest();
 exports.default = digest;

package/dist/node/cjs/runtime/ecdhes.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ecdhAllowed = exports.generateEpk = exports.deriveKey = void 0;
-const crypto_1 = require("crypto");
-const util_1 = require("util");
+const node_crypto_1 = require("node:crypto");
+const node_util_1 = require("node:util");
 const get_named_curve_js_1 = require("./get_named_curve.js");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
 const errors_js_1 = require("../util/errors.js");
@@ -11,12 +11,12 @@ const crypto_key_js_1 = require("../lib/crypto_key.js");
 const is_key_object_js_1 = require("./is_key_object.js");
 const invalid_key_input_js_1 = require("../lib/invalid_key_input.js");
 const is_key_like_js_1 = require("./is_key_like.js");
-const generateKeyPair = (0, util_1.promisify)(crypto_1.generateKeyPair);
+const generateKeyPair = (0, node_util_1.promisify)(node_crypto_1.generateKeyPair);
 async function deriveKey(publicKee, privateKee, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) {
     let publicKey;
     if ((0, webcrypto_js_1.isCryptoKey)(publicKee)) {
         (0, crypto_key_js_1.checkEncCryptoKey)(publicKee, 'ECDH');
-        publicKey = crypto_1.KeyObject.from(publicKee);
+        publicKey = node_crypto_1.KeyObject.from(publicKee);
     }
     else if ((0, is_key_object_js_1.default)(publicKee)) {
         publicKey = publicKee;
@@ -27,7 +27,7 @@ async function deriveKey(publicKee, privateKee, algorithm, keyLength, apu = new
     let privateKey;
     if ((0, webcrypto_js_1.isCryptoKey)(privateKee)) {
         (0, crypto_key_js_1.checkEncCryptoKey)(privateKee, 'ECDH', 'deriveBits');
-        privateKey = crypto_1.KeyObject.from(privateKee);
+        privateKey = node_crypto_1.KeyObject.from(privateKee);
     }
     else if ((0, is_key_object_js_1.default)(privateKee)) {
         privateKey = privateKee;
@@ -36,14 +36,14 @@ async function deriveKey(publicKee, privateKee, algorithm, keyLength, apu = new
         throw new TypeError((0, invalid_key_input_js_1.default)(privateKee, ...is_key_like_js_1.types));
     }
     const value = (0, buffer_utils_js_1.concat)((0, buffer_utils_js_1.lengthAndInput)(buffer_utils_js_1.encoder.encode(algorithm)), (0, buffer_utils_js_1.lengthAndInput)(apu), (0, buffer_utils_js_1.lengthAndInput)(apv), (0, buffer_utils_js_1.uint32be)(keyLength));
-    const sharedSecret = (0, crypto_1.diffieHellman)({ privateKey, publicKey });
+    const sharedSecret = (0, node_crypto_1.diffieHellman)({ privateKey, publicKey });
     return (0, buffer_utils_js_1.concatKdf)(sharedSecret, keyLength, value);
 }
 exports.deriveKey = deriveKey;
 async function generateEpk(kee) {
     let key;
     if ((0, webcrypto_js_1.isCryptoKey)(kee)) {
-        key = crypto_1.KeyObject.from(kee);
+        key = node_crypto_1.KeyObject.from(kee);
     }
     else if ((0, is_key_object_js_1.default)(kee)) {
         key = kee;

package/dist/node/cjs/runtime/encrypt.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const crypto_1 = require("crypto");
+const node_crypto_1 = require("node:crypto");
 const check_iv_length_js_1 = require("../lib/check_iv_length.js");
 const check_cek_length_js_1 = require("./check_cek_length.js");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
@@ -23,7 +23,7 @@ function cbcEncrypt(enc, plaintext, cek, iv, aad) {
     if (!(0, ciphers_js_1.default)(algorithm)) {
         throw new errors_js_1.JOSENotSupported(`alg ${enc} is not supported by your javascript runtime`);
     }
-    const cipher = (0, crypto_1.createCipheriv)(algorithm, encKey, iv);
+    const cipher = (0, node_crypto_1.createCipheriv)(algorithm, encKey, iv);
     const ciphertext = (0, buffer_utils_js_1.concat)(cipher.update(plaintext), cipher.final());
     const macSize = parseInt(enc.slice(-3), 10);
     const tag = (0, cbc_tag_js_1.default)(aad, iv, ciphertext, macSize, macKey, keySize);
@@ -35,7 +35,7 @@ function gcmEncrypt(enc, plaintext, cek, iv, aad) {
     if (!(0, ciphers_js_1.default)(algorithm)) {
         throw new errors_js_1.JOSENotSupported(`alg ${enc} is not supported by your javascript runtime`);
     }
-    const cipher = (0, crypto_1.createCipheriv)(algorithm, cek, iv, { authTagLength: 16 });
+    const cipher = (0, node_crypto_1.createCipheriv)(algorithm, cek, iv, { authTagLength: 16 });
     if (aad.byteLength) {
         cipher.setAAD(aad, { plaintextLength: plaintext.length });
     }
@@ -48,7 +48,7 @@ const encrypt = (enc, plaintext, cek, iv, aad) => {
     let key;
     if ((0, webcrypto_js_1.isCryptoKey)(cek)) {
         (0, crypto_key_js_1.checkEncCryptoKey)(cek, enc, 'encrypt');
-        key = crypto_1.KeyObject.from(cek);
+        key = node_crypto_1.KeyObject.from(cek);
     }
     else if (cek instanceof Uint8Array || (0, is_key_object_js_1.default)(cek)) {
         key = cek;

package/dist/node/cjs/runtime/fetch_jwks.js

@@ -1,8 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const http = require("http");
-const https = require("https");
-const events_1 = require("events");
+const http = require("node:http");
+const https = require("node:https");
+const node_events_1 = require("node:events");
 const errors_js_1 = require("../util/errors.js");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
 const fetchJwks = async (url, timeout, options) => {
@@ -23,7 +23,7 @@ const fetchJwks = async (url, timeout, options) => {
         timeout,
         headers,
     });
-    const [response] = (await Promise.race([(0, events_1.once)(req, 'response'), (0, events_1.once)(req, 'timeout')]));
+    const [response] = (await Promise.race([(0, node_events_1.once)(req, 'response'), (0, node_events_1.once)(req, 'timeout')]));
     if (!response) {
         req.destroy();
         throw new errors_js_1.JWKSTimeout();

package/dist/node/cjs/runtime/generate.js

@@ -1,12 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.generateKeyPair = exports.generateSecret = void 0;
-const crypto_1 = require("crypto");
-const util_1 = require("util");
+const node_crypto_1 = require("node:crypto");
+const node_util_1 = require("node:util");
 const random_js_1 = require("./random.js");
-const check_modulus_length_js_1 = require("./check_modulus_length.js");
 const errors_js_1 = require("../util/errors.js");
-const generate = (0, util_1.promisify)(crypto_1.generateKeyPair);
+const generate = (0, node_util_1.promisify)(node_crypto_1.generateKeyPair);
 async function generateSecret(alg, options) {
     let length;
     switch (alg) {
@@ -32,11 +31,10 @@ async function generateSecret(alg, options) {
         default:
             throw new errors_js_1.JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
     }
-    return (0, crypto_1.createSecretKey)((0, random_js_1.default)(new Uint8Array(length >> 3)));
+    return (0, node_crypto_1.createSecretKey)((0, random_js_1.default)(new Uint8Array(length >> 3)));
 }
 exports.generateSecret = generateSecret;
 async function generateKeyPair(alg, options) {
-    var _a, _b;
     switch (alg) {
         case 'RS256':
         case 'RS384':
@@ -49,7 +47,7 @@ async function generateKeyPair(alg, options) {
         case 'RSA-OAEP-384':
         case 'RSA-OAEP-512':
         case 'RSA1_5': {
-            const modulusLength = (_a = options === null || options === void 0 ? void 0 : options.modulusLength) !== null && _a !== void 0 ? _a : 2048;
+            const modulusLength = options?.modulusLength ?? 2048;
             if (typeof modulusLength !== 'number' || modulusLength < 2048) {
                 throw new errors_js_1.JOSENotSupported('Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used');
             }
@@ -57,8 +55,6 @@ async function generateKeyPair(alg, options) {
                 modulusLength,
                 publicExponent: 0x10001,
             });
-            (0, check_modulus_length_js_1.setModulusLength)(keypair.privateKey, modulusLength);
-            (0, check_modulus_length_js_1.setModulusLength)(keypair.publicKey, modulusLength);
             return keypair;
         }
         case 'ES256':
@@ -70,7 +66,7 @@ async function generateKeyPair(alg, options) {
         case 'ES512':
             return generate('ec', { namedCurve: 'P-521' });
         case 'EdDSA': {
-            switch (options === null || options === void 0 ? void 0 : options.crv) {
+            switch (options?.crv) {
                 case undefined:
                 case 'Ed25519':
                     return generate('ed25519');
@@ -84,7 +80,7 @@ async function generateKeyPair(alg, options) {
         case 'ECDH-ES+A128KW':
         case 'ECDH-ES+A192KW':
         case 'ECDH-ES+A256KW':
-            const crv = (_b = options === null || options === void 0 ? void 0 : options.crv) !== null && _b !== void 0 ? _b : 'P-256';
+            const crv = options?.crv ?? 'P-256';
             switch (crv) {
                 case undefined:
                 case 'P-256':

package/dist/node/cjs/runtime/get_named_curve.js

@@ -1,17 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.setCurve = exports.weakMap = void 0;
-const buffer_1 = require("buffer");
-const crypto_1 = require("crypto");
+exports.weakMap = void 0;
+const node_crypto_1 = require("node:crypto");
 const errors_js_1 = require("../util/errors.js");
 const webcrypto_js_1 = require("./webcrypto.js");
 const is_key_object_js_1 = require("./is_key_object.js");
 const invalid_key_input_js_1 = require("../lib/invalid_key_input.js");
 const is_key_like_js_1 = require("./is_key_like.js");
-const p256 = buffer_1.Buffer.from([42, 134, 72, 206, 61, 3, 1, 7]);
-const p384 = buffer_1.Buffer.from([43, 129, 4, 0, 34]);
-const p521 = buffer_1.Buffer.from([43, 129, 4, 0, 35]);
-const secp256k1 = buffer_1.Buffer.from([43, 129, 4, 0, 10]);
 exports.weakMap = new WeakMap();
 const namedCurveToJOSE = (namedCurve) => {
     switch (namedCurve) {
@@ -28,10 +23,9 @@ const namedCurveToJOSE = (namedCurve) => {
     }
 };
 const getNamedCurve = (kee, raw) => {
-    var _a;
     let key;
     if ((0, webcrypto_js_1.isCryptoKey)(kee)) {
-        key = crypto_1.KeyObject.from(kee);
+        key = node_crypto_1.KeyObject.from(kee);
     }
     else if ((0, is_key_object_js_1.default)(kee)) {
         key = kee;
@@ -50,46 +44,14 @@ const getNamedCurve = (kee, raw) => {
         case 'x448':
             return `X${key.asymmetricKeyType.slice(1)}`;
         case 'ec': {
-            if (exports.weakMap.has(key)) {
-                return exports.weakMap.get(key);
-            }
-            let namedCurve = (_a = key.asymmetricKeyDetails) === null || _a === void 0 ? void 0 : _a.namedCurve;
-            if (!namedCurve && key.type === 'private') {
-                namedCurve = getNamedCurve((0, crypto_1.createPublicKey)(key), true);
-            }
-            else if (!namedCurve) {
-                const buf = key.export({ format: 'der', type: 'spki' });
-                const i = buf[1] < 128 ? 14 : 15;
-                const len = buf[i];
-                const curveOid = buf.slice(i + 1, i + 1 + len);
-                if (curveOid.equals(p256)) {
-                    namedCurve = 'prime256v1';
-                }
-                else if (curveOid.equals(p384)) {
-                    namedCurve = 'secp384r1';
-                }
-                else if (curveOid.equals(p521)) {
-                    namedCurve = 'secp521r1';
-                }
-                else if (curveOid.equals(secp256k1)) {
-                    namedCurve = 'secp256k1';
-                }
-                else {
-                    throw new errors_js_1.JOSENotSupported('Unsupported key curve for this operation');
-                }
-            }
-            if (raw)
+            let namedCurve = key.asymmetricKeyDetails.namedCurve;
+            if (raw) {
                 return namedCurve;
-            const curve = namedCurveToJOSE(namedCurve);
-            exports.weakMap.set(key, curve);
-            return curve;
+            }
+            return namedCurveToJOSE(namedCurve);
         }
         default:
             throw new TypeError('Invalid asymmetric key type for this operation');
     }
 };
-function setCurve(keyObject, curve) {
-    exports.weakMap.set(keyObject, curve);
-}
-exports.setCurve = setCurve;
 exports.default = getNamedCurve;

package/dist/node/cjs/runtime/get_sign_verify_key.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const crypto_1 = require("crypto");
+const node_crypto_1 = require("node:crypto");
 const webcrypto_js_1 = require("./webcrypto.js");
 const crypto_key_js_1 = require("../lib/crypto_key.js");
 const invalid_key_input_js_1 = require("../lib/invalid_key_input.js");
@@ -10,14 +10,14 @@ function getSignVerifyKey(alg, key, usage) {
         if (!alg.startsWith('HS')) {
             throw new TypeError((0, invalid_key_input_js_1.default)(key, ...is_key_like_js_1.types));
         }
-        return (0, crypto_1.createSecretKey)(key);
+        return (0, node_crypto_1.createSecretKey)(key);
     }
-    if (key instanceof crypto_1.KeyObject) {
+    if (key instanceof node_crypto_1.KeyObject) {
         return key;
     }
     if ((0, webcrypto_js_1.isCryptoKey)(key)) {
         (0, crypto_key_js_1.checkSigCryptoKey)(key, alg, usage);
-        return crypto_1.KeyObject.from(key);
+        return node_crypto_1.KeyObject.from(key);
     }
     throw new TypeError((0, invalid_key_input_js_1.default)(key, ...is_key_like_js_1.types, 'Uint8Array'));
 }

package/dist/node/cjs/runtime/is_key_like.js

@@ -6,6 +6,6 @@ const is_key_object_js_1 = require("./is_key_object.js");
 exports.default = (key) => (0, is_key_object_js_1.default)(key) || (0, webcrypto_js_1.isCryptoKey)(key);
 const types = ['KeyObject'];
 exports.types = types;
-if (globalThis.CryptoKey || (webcrypto_js_1.default === null || webcrypto_js_1.default === void 0 ? void 0 : webcrypto_js_1.default.CryptoKey)) {
+if (globalThis.CryptoKey || webcrypto_js_1.default?.CryptoKey) {
     types.push('CryptoKey');
 }

package/dist/node/cjs/runtime/is_key_object.js

@@ -1,7 +1,4 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-const crypto_1 = require("crypto");
-const util = require("util");
-exports.default = util.types.isKeyObject
-    ? (obj) => util.types.isKeyObject(obj)
-    : (obj) => obj != null && obj instanceof crypto_1.KeyObject;
+const util = require("node:util");
+exports.default = (obj) => util.types.isKeyObject(obj);