jose 4.3.6 → 4.4.0

package/dist/browser/runtime/pbes2kw.js

@@ -20,9 +20,9 @@ function getCryptoKey(key, alg) {
 async function deriveKey(p2s, alg, p2c, key) {
     checkP2s(p2s);
     const salt = concatSalt(alg, p2s);
-    const keylen = parseInt(alg.substr(13, 3), 10);
+    const keylen = parseInt(alg.slice(13, 16), 10);
     const subtleAlg = {
-        hash: `SHA-${alg.substr(8, 3)}`,
+        hash: `SHA-${alg.slice(8, 11)}`,
         iterations: p2c,
         name: 'PBKDF2',
         salt,
@@ -42,10 +42,10 @@ async function deriveKey(p2s, alg, p2c, key) {
 }
 export const encrypt = async (alg, key, cek, p2c = Math.floor(Math.random() * 2049) + 2048, p2s = random(new Uint8Array(16))) => {
     const derived = await deriveKey(p2s, alg, p2c, key);
-    const encryptedKey = await wrap(alg.substr(-6), derived, cek);
+    const encryptedKey = await wrap(alg.slice(-6), derived, cek);
     return { encryptedKey, p2c, p2s: base64url(p2s) };
 };
 export const decrypt = async (alg, key, encryptedKey, p2c, p2s) => {
     const derived = await deriveKey(p2s, alg, p2c, key);
-    return unwrap(alg.substr(-6), derived, encryptedKey);
+    return unwrap(alg.slice(-6), derived, encryptedKey);
 };

package/dist/browser/runtime/sign.js

@@ -5,7 +5,7 @@ import getSignKey from './get_sign_verify_key.js';
 const sign = async (alg, key, data) => {
     const cryptoKey = await getSignKey(alg, key, 'sign');
     checkKeyLength(alg, cryptoKey);
-    const signature = await crypto.subtle.sign(subtleAlgorithm(alg, cryptoKey.algorithm.namedCurve), cryptoKey, data);
+    const signature = await crypto.subtle.sign(subtleAlgorithm(alg, cryptoKey.algorithm), cryptoKey, data);
     return new Uint8Array(signature);
 };
 export default sign;

package/dist/browser/runtime/subtle_dsa.js

@@ -1,25 +1,26 @@
 import { isCloudflareWorkers, isNodeJs } from './env.js';
 import { JOSENotSupported } from '../util/errors.js';
-export default function subtleDsa(alg, namedCurve) {
-    const length = parseInt(alg.substr(-3), 10);
+export default function subtleDsa(alg, algorithm) {
+    const hash = `SHA-${alg.slice(-3)}`;
     switch (alg) {
         case 'HS256':
         case 'HS384':
         case 'HS512':
-            return { hash: `SHA-${length}`, name: 'HMAC' };
+            return { hash, name: 'HMAC' };
         case 'PS256':
         case 'PS384':
         case 'PS512':
-            return { hash: `SHA-${length}`, name: 'RSA-PSS', saltLength: length >> 3 };
+            return { hash, name: 'RSA-PSS', saltLength: alg.slice(-3) >> 3 };
         case 'RS256':
         case 'RS384':
         case 'RS512':
-            return { hash: `SHA-${length}`, name: 'RSASSA-PKCS1-v1_5' };
+            return { hash, name: 'RSASSA-PKCS1-v1_5' };
         case 'ES256':
         case 'ES384':
         case 'ES512':
-            return { hash: `SHA-${length}`, name: 'ECDSA', namedCurve };
+            return { hash, name: 'ECDSA', namedCurve: algorithm.namedCurve };
         case (isCloudflareWorkers() || isNodeJs()) && 'EdDSA':
+            const { namedCurve } = algorithm;
             return { name: namedCurve, namedCurve };
         default:
             throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);

package/dist/browser/runtime/verify.js

@@ -5,7 +5,7 @@ import getVerifyKey from './get_sign_verify_key.js';
 const verify = async (alg, key, signature, data) => {
     const cryptoKey = await getVerifyKey(alg, key, 'verify');
     checkKeyLength(alg, cryptoKey);
-    const algorithm = subtleAlgorithm(alg, cryptoKey.algorithm.namedCurve);
+    const algorithm = subtleAlgorithm(alg, cryptoKey.algorithm);
     try {
         return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);
     }

package/dist/node/cjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.base64url = exports.generateSecret = exports.generateKeyPair = exports.errors = exports.decodeProtectedHeader = exports.importJWK = exports.importX509 = exports.importPKCS8 = exports.importSPKI = exports.exportJWK = exports.exportSPKI = exports.exportPKCS8 = exports.UnsecuredJWT = exports.createRemoteJWKSet = exports.EmbeddedJWK = exports.calculateJwkThumbprint = exports.EncryptJWT = exports.SignJWT = exports.GeneralSign = exports.FlattenedSign = exports.CompactSign = exports.FlattenedEncrypt = exports.CompactEncrypt = exports.jwtDecrypt = exports.jwtVerify = exports.generalVerify = exports.flattenedVerify = exports.compactVerify = exports.GeneralEncrypt = exports.generalDecrypt = exports.flattenedDecrypt = exports.compactDecrypt = void 0;
+exports.base64url = exports.generateSecret = exports.generateKeyPair = exports.errors = exports.decodeProtectedHeader = exports.importJWK = exports.importX509 = exports.importPKCS8 = exports.importSPKI = exports.exportJWK = exports.exportSPKI = exports.exportPKCS8 = exports.UnsecuredJWT = exports.createRemoteJWKSet = exports.createLocalJWKSet = exports.EmbeddedJWK = exports.calculateJwkThumbprint = exports.EncryptJWT = exports.SignJWT = exports.GeneralSign = exports.FlattenedSign = exports.CompactSign = exports.FlattenedEncrypt = exports.CompactEncrypt = exports.jwtDecrypt = exports.jwtVerify = exports.generalVerify = exports.flattenedVerify = exports.compactVerify = exports.GeneralEncrypt = exports.generalDecrypt = exports.flattenedDecrypt = exports.compactDecrypt = void 0;
 var decrypt_js_1 = require("./jwe/compact/decrypt.js");
 Object.defineProperty(exports, "compactDecrypt", { enumerable: true, get: function () { return decrypt_js_1.compactDecrypt; } });
 var decrypt_js_2 = require("./jwe/flattened/decrypt.js");
@@ -37,6 +37,8 @@ var thumbprint_js_1 = require("./jwk/thumbprint.js");
 Object.defineProperty(exports, "calculateJwkThumbprint", { enumerable: true, get: function () { return thumbprint_js_1.calculateJwkThumbprint; } });
 var embedded_js_1 = require("./jwk/embedded.js");
 Object.defineProperty(exports, "EmbeddedJWK", { enumerable: true, get: function () { return embedded_js_1.EmbeddedJWK; } });
+var local_js_1 = require("./jwks/local.js");
+Object.defineProperty(exports, "createLocalJWKSet", { enumerable: true, get: function () { return local_js_1.createLocalJWKSet; } });
 var remote_js_1 = require("./jwks/remote.js");
 Object.defineProperty(exports, "createRemoteJWKSet", { enumerable: true, get: function () { return remote_js_1.createRemoteJWKSet; } });
 var unsecured_js_1 = require("./jwt/unsecured.js");

package/dist/node/cjs/jwks/local.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createLocalJWKSet = exports.LocalJWKSet = exports.isJWKSLike = void 0;
+const import_js_1 = require("../key/import.js");
+const errors_js_1 = require("../util/errors.js");
+const is_object_js_1 = require("../lib/is_object.js");
+function getKtyFromAlg(alg) {
+    switch (typeof alg === 'string' && alg.slice(0, 2)) {
+        case 'RS':
+        case 'PS':
+            return 'RSA';
+        case 'ES':
+            return 'EC';
+        case 'Ed':
+            return 'OKP';
+        default:
+            throw new errors_js_1.JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
+    }
+}
+function isJWKSLike(jwks) {
+    return (jwks &&
+        typeof jwks === 'object' &&
+        Array.isArray(jwks.keys) &&
+        jwks.keys.every(isJWKLike));
+}
+exports.isJWKSLike = isJWKSLike;
+function isJWKLike(key) {
+    return (0, is_object_js_1.default)(key);
+}
+function clone(obj) {
+    if (typeof structuredClone === 'function') {
+        return structuredClone(obj);
+    }
+    return JSON.parse(JSON.stringify(obj));
+}
+class LocalJWKSet {
+    constructor(jwks) {
+        this._cached = new WeakMap();
+        if (!isJWKSLike(jwks)) {
+            throw new errors_js_1.JWKSInvalid('JSON Web Key Set malformed');
+        }
+        this._jwks = clone(jwks);
+    }
+    async getKey(protectedHeader, token) {
+        const joseHeader = {
+            ...protectedHeader,
+            ...token.header,
+        };
+        const candidates = this._jwks.keys.filter((jwk) => {
+            let candidate = jwk.kty === getKtyFromAlg(joseHeader.alg);
+            if (candidate && typeof joseHeader.kid === 'string') {
+                candidate = joseHeader.kid === jwk.kid;
+            }
+            if (candidate && typeof jwk.alg === 'string') {
+                candidate = joseHeader.alg === jwk.alg;
+            }
+            if (candidate && typeof jwk.use === 'string') {
+                candidate = jwk.use === 'sig';
+            }
+            if (candidate && Array.isArray(jwk.key_ops)) {
+                candidate = jwk.key_ops.includes('verify');
+            }
+            if (candidate && joseHeader.alg === 'EdDSA') {
+                candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
+            }
+            if (candidate) {
+                switch (joseHeader.alg) {
+                    case 'ES256':
+                        candidate = jwk.crv === 'P-256';
+                        break;
+                    case 'ES256K':
+                        candidate = jwk.crv === 'secp256k1';
+                        break;
+                    case 'ES384':
+                        candidate = jwk.crv === 'P-384';
+                        break;
+                    case 'ES512':
+                        candidate = jwk.crv === 'P-521';
+                        break;
+                    default:
+                }
+            }
+            return candidate;
+        });
+        const { 0: jwk, length } = candidates;
+        if (length === 0) {
+            throw new errors_js_1.JWKSNoMatchingKey();
+        }
+        else if (length !== 1) {
+            throw new errors_js_1.JWKSMultipleMatchingKeys();
+        }
+        const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
+        if (cached[joseHeader.alg] === undefined) {
+            const keyObject = await (0, import_js_1.importJWK)({ ...jwk, ext: true }, joseHeader.alg);
+            if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
+                throw new errors_js_1.JWKSInvalid('JSON Web Key Set members must be public keys');
+            }
+            cached[joseHeader.alg] = keyObject;
+        }
+        return cached[joseHeader.alg];
+    }
+}
+exports.LocalJWKSet = LocalJWKSet;
+function createLocalJWKSet(jwks) {
+    return LocalJWKSet.prototype.getKey.bind(new LocalJWKSet(jwks));
+}
+exports.createLocalJWKSet = createLocalJWKSet;

package/dist/node/cjs/jwks/remote.js

@@ -2,28 +2,12 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createRemoteJWKSet = void 0;
 const fetch_jwks_js_1 = require("../runtime/fetch_jwks.js");
-const import_js_1 = require("../key/import.js");
 const errors_js_1 = require("../util/errors.js");
-const is_object_js_1 = require("../lib/is_object.js");
-function getKtyFromAlg(alg) {
-    switch (typeof alg === 'string' && alg.substr(0, 2)) {
-        case 'RS':
-        case 'PS':
-            return 'RSA';
-        case 'ES':
-            return 'EC';
-        case 'Ed':
-            return 'OKP';
-        default:
-            throw new errors_js_1.JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
-    }
-}
-function isJWKLike(key) {
-    return (0, is_object_js_1.default)(key);
-}
-class RemoteJWKSet {
+const local_js_1 = require("./local.js");
+class RemoteJWKSet extends local_js_1.LocalJWKSet {
     constructor(url, options) {
-        this._cached = new WeakMap();
+        super({ keys: [] });
+        this._jwks = undefined;
         if (!(url instanceof URL)) {
             throw new TypeError('url must be an instance of URL');
         }
@@ -41,78 +25,27 @@ class RemoteJWKSet {
         return Date.now() < this._cooldownStarted + this._cooldownDuration;
     }
     async getKey(protectedHeader, token) {
-        const joseHeader = {
-            ...protectedHeader,
-            ...token.header,
-        };
         if (!this._jwks) {
             await this.reload();
         }
-        const candidates = this._jwks.keys.filter((jwk) => {
-            let candidate = jwk.kty === getKtyFromAlg(joseHeader.alg);
-            if (candidate && typeof joseHeader.kid === 'string') {
-                candidate = joseHeader.kid === jwk.kid;
-            }
-            if (candidate && typeof jwk.alg === 'string') {
-                candidate = joseHeader.alg === jwk.alg;
-            }
-            if (candidate && typeof jwk.use === 'string') {
-                candidate = jwk.use === 'sig';
-            }
-            if (candidate && Array.isArray(jwk.key_ops)) {
-                candidate = jwk.key_ops.includes('verify');
-            }
-            if (candidate && joseHeader.alg === 'EdDSA') {
-                candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
-            }
-            if (candidate) {
-                switch (joseHeader.alg) {
-                    case 'ES256':
-                        candidate = jwk.crv === 'P-256';
-                        break;
-                    case 'ES256K':
-                        candidate = jwk.crv === 'secp256k1';
-                        break;
-                    case 'ES384':
-                        candidate = jwk.crv === 'P-384';
-                        break;
-                    case 'ES512':
-                        candidate = jwk.crv === 'P-521';
-                        break;
-                    default:
-                }
-            }
-            return candidate;
-        });
-        const { 0: jwk, length } = candidates;
-        if (length === 0) {
-            if (this.coolingDown() === false) {
-                await this.reload();
-                return this.getKey(protectedHeader, token);
-            }
-            throw new errors_js_1.JWKSNoMatchingKey();
-        }
-        else if (length !== 1) {
-            throw new errors_js_1.JWKSMultipleMatchingKeys();
+        try {
+            return await super.getKey(protectedHeader, token);
         }
-        const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
-        if (cached[joseHeader.alg] === undefined) {
-            const keyObject = await (0, import_js_1.importJWK)({ ...jwk, ext: true }, joseHeader.alg);
-            if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
-                throw new errors_js_1.JWKSInvalid('JSON Web Key Set members must be public keys');
+        catch (err) {
+            if (err instanceof errors_js_1.JWKSNoMatchingKey) {
+                if (this.coolingDown() === false) {
+                    await this.reload();
+                    return super.getKey(protectedHeader, token);
+                }
             }
-            cached[joseHeader.alg] = keyObject;
+            throw err;
         }
-        return cached[joseHeader.alg];
     }
     async reload() {
         if (!this._pendingFetch) {
             this._pendingFetch = (0, fetch_jwks_js_1.default)(this._url, this._timeoutDuration, this._options)
                 .then((json) => {
-                if (typeof json !== 'object' ||
-                    !json ||
-                    !Array.isArray(json.keys) ||
-                    !json.keys.every(isJWKLike)) {
+                if (!(0, local_js_1.isJWKSLike)(json)) {
                     throw new errors_js_1.JWKSInvalid('JSON Web Key Set malformed');
                 }
                 this._jwks = { keys: json.keys };

package/dist/node/cjs/lib/aesgcmkw.js

@@ -6,14 +6,14 @@ const decrypt_js_1 = require("../runtime/decrypt.js");
 const iv_js_1 = require("./iv.js");
 const base64url_js_1 = require("../runtime/base64url.js");
 async function wrap(alg, key, cek, iv) {
-    const jweAlgorithm = alg.substr(0, 7);
+    const jweAlgorithm = alg.slice(0, 7);
     iv || (iv = (0, iv_js_1.default)(jweAlgorithm));
     const { ciphertext: encryptedKey, tag } = await (0, encrypt_js_1.default)(jweAlgorithm, cek, key, iv, new Uint8Array(0));
     return { encryptedKey, iv: (0, base64url_js_1.encode)(iv), tag: (0, base64url_js_1.encode)(tag) };
 }
 exports.wrap = wrap;
 async function unwrap(alg, key, encryptedKey, iv, tag) {
-    const jweAlgorithm = alg.substr(0, 7);
+    const jweAlgorithm = alg.slice(0, 7);
     return (0, decrypt_js_1.default)(jweAlgorithm, key, encryptedKey, iv, tag, new Uint8Array(0));
 }
 exports.unwrap = unwrap;

package/dist/node/cjs/lib/crypto_key.js

@@ -9,7 +9,7 @@ function isAlgorithm(algorithm, name) {
     return algorithm.name === name;
 }
 function getHashLength(hash) {
-    return parseInt(hash.name.substr(4), 10);
+    return parseInt(hash.name.slice(4), 10);
 }
 function getNamedCurve(alg) {
     switch (alg) {
@@ -46,7 +46,7 @@ function checkSigCryptoKey(key, alg, ...usages) {
         case 'HS512': {
             if (!isAlgorithm(key.algorithm, 'HMAC'))
                 throw unusable('HMAC');
-            const expected = parseInt(alg.substr(2), 10);
+            const expected = parseInt(alg.slice(2), 10);
             const actual = getHashLength(key.algorithm.hash);
             if (actual !== expected)
                 throw unusable(`SHA-${expected}`, 'algorithm.hash');
@@ -57,7 +57,7 @@ function checkSigCryptoKey(key, alg, ...usages) {
         case 'RS512': {
             if (!isAlgorithm(key.algorithm, 'RSASSA-PKCS1-v1_5'))
                 throw unusable('RSASSA-PKCS1-v1_5');
-            const expected = parseInt(alg.substr(2), 10);
+            const expected = parseInt(alg.slice(2), 10);
             const actual = getHashLength(key.algorithm.hash);
             if (actual !== expected)
                 throw unusable(`SHA-${expected}`, 'algorithm.hash');
@@ -68,7 +68,7 @@ function checkSigCryptoKey(key, alg, ...usages) {
         case 'PS512': {
             if (!isAlgorithm(key.algorithm, 'RSA-PSS'))
                 throw unusable('RSA-PSS');
-            const expected = parseInt(alg.substr(2), 10);
+            const expected = parseInt(alg.slice(2), 10);
             const actual = getHashLength(key.algorithm.hash);
             if (actual !== expected)
                 throw unusable(`SHA-${expected}`, 'algorithm.hash');
@@ -108,7 +108,7 @@ function checkEncCryptoKey(key, alg, ...usages) {
         case 'A256GCM': {
             if (!isAlgorithm(key.algorithm, 'AES-GCM'))
                 throw unusable('AES-GCM');
-            const expected = parseInt(alg.substr(1, 3), 10);
+            const expected = parseInt(alg.slice(1, 4), 10);
             const actual = key.algorithm.length;
             if (actual !== expected)
                 throw unusable(expected, 'algorithm.length');
@@ -119,7 +119,7 @@ function checkEncCryptoKey(key, alg, ...usages) {
         case 'A256KW': {
             if (!isAlgorithm(key.algorithm, 'AES-KW'))
                 throw unusable('AES-KW');
-            const expected = parseInt(alg.substr(1, 3), 10);
+            const expected = parseInt(alg.slice(1, 4), 10);
             const actual = key.algorithm.length;
             if (actual !== expected)
                 throw unusable(expected, 'algorithm.length');
@@ -141,7 +141,7 @@ function checkEncCryptoKey(key, alg, ...usages) {
         case 'RSA-OAEP-512': {
             if (!isAlgorithm(key.algorithm, 'RSA-OAEP'))
                 throw unusable('RSA-OAEP');
-            const expected = parseInt(alg.substr(9), 10) || 1;
+            const expected = parseInt(alg.slice(9), 10) || 1;
             const actual = getHashLength(key.algorithm.hash);
             if (actual !== expected)
                 throw unusable(`SHA-${expected}`, 'algorithm.hash');

package/dist/node/cjs/lib/decrypt_key_management.js

@@ -42,12 +42,12 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
                     throw new errors_js_1.JWEInvalid(`JOSE Header "apv" (Agreement PartyVInfo) invalid`);
                 partyVInfo = (0, base64url_js_1.decode)(joseHeader.apv);
             }
-            const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, alg === 'ECDH-ES' ? (0, cek_js_1.bitLength)(joseHeader.enc) : parseInt(alg.substr(-5, 3), 10), partyUInfo, partyVInfo);
+            const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, alg === 'ECDH-ES' ? (0, cek_js_1.bitLength)(joseHeader.enc) : parseInt(alg.slice(-5, -2), 10), partyUInfo, partyVInfo);
             if (alg === 'ECDH-ES')
                 return sharedSecret;
             if (encryptedKey === undefined)
                 throw new errors_js_1.JWEInvalid('JWE Encrypted Key missing');
-            return (0, aeskw_js_1.unwrap)(alg.substr(-6), sharedSecret, encryptedKey);
+            return (0, aeskw_js_1.unwrap)(alg.slice(-6), sharedSecret, encryptedKey);
         }
         case 'RSA1_5':
         case 'RSA-OAEP':

package/dist/node/cjs/lib/encrypt_key_management.js

@@ -29,10 +29,12 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
             }
             const { apu, apv } = providedParameters;
             let { epk: ephemeralKey } = providedParameters;
-            ephemeralKey || (ephemeralKey = await ECDH.generateEpk(key));
+            ephemeralKey || (ephemeralKey = (await ECDH.generateEpk(key)).privateKey);
             const { x, y, crv, kty } = await (0, export_js_1.exportJWK)(ephemeralKey);
-            const sharedSecret = await ECDH.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, alg === 'ECDH-ES' ? (0, cek_js_1.bitLength)(enc) : parseInt(alg.substr(-5, 3), 10), apu, apv);
-            parameters = { epk: { x, y, crv, kty } };
+            const sharedSecret = await ECDH.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, alg === 'ECDH-ES' ? (0, cek_js_1.bitLength)(enc) : parseInt(alg.slice(-5, -2), 10), apu, apv);
+            parameters = { epk: { x, crv, kty } };
+            if (kty === 'EC')
+                parameters.epk.y = y;
             if (apu)
                 parameters.apu = (0, base64url_js_1.encode)(apu);
             if (apv)
@@ -42,7 +44,7 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
                 break;
             }
             cek = providedCek || (0, cek_js_1.default)(enc);
-            const kwAlg = alg.substr(-6);
+            const kwAlg = alg.slice(-6);
             encryptedKey = await (0, aeskw_js_1.wrap)(kwAlg, sharedSecret, cek);
             break;
         }

package/dist/node/cjs/runtime/aeskw.js

@@ -5,7 +5,6 @@ const buffer_1 = require("buffer");
 const crypto_1 = require("crypto");
 const errors_js_1 = require("../util/errors.js");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
-const secret_key_js_1 = require("./secret_key.js");
 const webcrypto_js_1 = require("./webcrypto.js");
 const crypto_key_js_1 = require("../lib/crypto_key.js");
 const is_key_object_js_1 = require("./is_key_object.js");
@@ -13,7 +12,7 @@ const invalid_key_input_js_1 = require("../lib/invalid_key_input.js");
 const ciphers_js_1 = require("./ciphers.js");
 const is_key_like_js_1 = require("./is_key_like.js");
 function checkKeySize(key, alg) {
-    if (key.symmetricKeySize << 3 !== parseInt(alg.substr(1, 3), 10)) {
+    if (key.symmetricKeySize << 3 !== parseInt(alg.slice(1, 4), 10)) {
         throw new TypeError(`Invalid key size for alg: ${alg}`);
     }
 }
@@ -22,7 +21,7 @@ function ensureKeyObject(key, alg, usage) {
         return key;
     }
     if (key instanceof Uint8Array) {
-        return (0, secret_key_js_1.default)(key);
+        return (0, crypto_1.createSecretKey)(key);
     }
     if ((0, webcrypto_js_1.isCryptoKey)(key)) {
         (0, crypto_key_js_1.checkEncCryptoKey)(key, alg, usage);
@@ -31,7 +30,7 @@ function ensureKeyObject(key, alg, usage) {
     throw new TypeError((0, invalid_key_input_js_1.default)(key, ...is_key_like_js_1.types, 'Uint8Array'));
 }
 const wrap = (alg, key, cek) => {
-    const size = parseInt(alg.substr(1, 3), 10);
+    const size = parseInt(alg.slice(1, 4), 10);
     const algorithm = `aes${size}-wrap`;
     if (!(0, ciphers_js_1.default)(algorithm)) {
         throw new errors_js_1.JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
@@ -43,7 +42,7 @@ const wrap = (alg, key, cek) => {
 };
 exports.wrap = wrap;
 const unwrap = (alg, key, encryptedKey) => {
-    const size = parseInt(alg.substr(1, 3), 10);
+    const size = parseInt(alg.slice(1, 4), 10);
     const algorithm = `aes${size}-wrap`;
     if (!(0, ciphers_js_1.default)(algorithm)) {
         throw new errors_js_1.JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);

package/dist/node/cjs/runtime/check_cek_length.js

@@ -8,12 +8,12 @@ const checkCekLength = (enc, cek) => {
         case 'A128CBC-HS256':
         case 'A192CBC-HS384':
         case 'A256CBC-HS512':
-            expected = parseInt(enc.substr(-3), 10);
+            expected = parseInt(enc.slice(-3), 10);
             break;
         case 'A128GCM':
         case 'A192GCM':
         case 'A256GCM':
-            expected = parseInt(enc.substr(1, 3), 10);
+            expected = parseInt(enc.slice(1, 4), 10);
             break;
         default:
             throw new errors_js_1.JOSENotSupported(`Content Encryption Algorithm ${enc} is not supported either by JOSE or your javascript runtime`);

package/dist/node/cjs/runtime/decrypt.js

@@ -14,13 +14,13 @@ const invalid_key_input_js_1 = require("../lib/invalid_key_input.js");
 const ciphers_js_1 = require("./ciphers.js");
 const is_key_like_js_1 = require("./is_key_like.js");
 function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
-    const keySize = parseInt(enc.substr(1, 3), 10);
+    const keySize = parseInt(enc.slice(1, 4), 10);
     if ((0, is_key_object_js_1.default)(cek)) {
         cek = cek.export();
     }
     const encKey = cek.subarray(keySize >> 3);
     const macKey = cek.subarray(0, keySize >> 3);
-    const macSize = parseInt(enc.substr(-3), 10);
+    const macSize = parseInt(enc.slice(-3), 10);
     const algorithm = `aes-${keySize}-cbc`;
     if (!(0, ciphers_js_1.default)(algorithm)) {
         throw new errors_js_1.JOSENotSupported(`alg ${enc} is not supported by your javascript runtime`);
@@ -48,7 +48,7 @@ function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
     return plaintext;
 }
 function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
-    const keySize = parseInt(enc.substr(1, 3), 10);
+    const keySize = parseInt(enc.slice(1, 4), 10);
     const algorithm = `aes-${keySize}-gcm`;
     if (!(0, ciphers_js_1.default)(algorithm)) {
         throw new errors_js_1.JOSENotSupported(`alg ${enc} is not supported by your javascript runtime`);

package/dist/node/cjs/runtime/ecdhes.js

@@ -13,7 +13,7 @@ const is_key_object_js_1 = require("./is_key_object.js");
 const invalid_key_input_js_1 = require("../lib/invalid_key_input.js");
 const is_key_like_js_1 = require("./is_key_like.js");
 const generateKeyPair = (0, util_1.promisify)(crypto_1.generateKeyPair);
-const deriveKey = (publicKee, privateKee, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) => {
+async function deriveKey(publicKee, privateKee, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) {
     let publicKey;
     if ((0, webcrypto_js_1.isCryptoKey)(publicKee)) {
         (0, crypto_key_js_1.checkEncCryptoKey)(publicKee, 'ECDH-ES');
@@ -39,9 +39,9 @@ const deriveKey = (publicKee, privateKee, algorithm, keyLength, apu = new Uint8A
     const value = (0, buffer_utils_js_1.concat)((0, buffer_utils_js_1.lengthAndInput)(buffer_utils_js_1.encoder.encode(algorithm)), (0, buffer_utils_js_1.lengthAndInput)(apu), (0, buffer_utils_js_1.lengthAndInput)(apv), (0, buffer_utils_js_1.uint32be)(keyLength));
     const sharedSecret = (0, crypto_1.diffieHellman)({ privateKey, publicKey });
     return (0, buffer_utils_js_1.concatKdf)(digest_js_1.default, sharedSecret, keyLength, value);
-};
+}
 exports.deriveKey = deriveKey;
-const generateEpk = async (kee) => {
+async function generateEpk(kee) {
     let key;
     if ((0, webcrypto_js_1.isCryptoKey)(kee)) {
         key = crypto_1.KeyObject.from(kee);
@@ -54,18 +54,18 @@ const generateEpk = async (kee) => {
     }
     switch (key.asymmetricKeyType) {
         case 'x25519':
-            return (await generateKeyPair('x25519')).privateKey;
+            return generateKeyPair('x25519');
         case 'x448': {
-            return (await generateKeyPair('x448')).privateKey;
+            return generateKeyPair('x448');
         }
         case 'ec': {
             const namedCurve = (0, get_named_curve_js_1.default)(key);
-            return (await generateKeyPair('ec', { namedCurve })).privateKey;
+            return generateKeyPair('ec', { namedCurve });
         }
         default:
             throw new errors_js_1.JOSENotSupported('Invalid or unsupported EPK');
     }
-};
+}
 exports.generateEpk = generateEpk;
 const ecdhAllowed = (key) => ['P-256', 'P-384', 'P-521', 'X25519', 'X448'].includes((0, get_named_curve_js_1.default)(key));
 exports.ecdhAllowed = ecdhAllowed;

package/dist/node/cjs/runtime/encrypt.js

@@ -13,7 +13,7 @@ const errors_js_1 = require("../util/errors.js");
 const ciphers_js_1 = require("./ciphers.js");
 const is_key_like_js_1 = require("./is_key_like.js");
 function cbcEncrypt(enc, plaintext, cek, iv, aad) {
-    const keySize = parseInt(enc.substr(1, 3), 10);
+    const keySize = parseInt(enc.slice(1, 4), 10);
     if ((0, is_key_object_js_1.default)(cek)) {
         cek = cek.export();
     }
@@ -25,12 +25,12 @@ function cbcEncrypt(enc, plaintext, cek, iv, aad) {
     }
     const cipher = (0, crypto_1.createCipheriv)(algorithm, encKey, iv);
     const ciphertext = (0, buffer_utils_js_1.concat)(cipher.update(plaintext), cipher.final());
-    const macSize = parseInt(enc.substr(-3), 10);
+    const macSize = parseInt(enc.slice(-3), 10);
     const tag = (0, cbc_tag_js_1.default)(aad, iv, ciphertext, macSize, macKey, keySize);
     return { ciphertext, tag };
 }
 function gcmEncrypt(enc, plaintext, cek, iv, aad) {
-    const keySize = parseInt(enc.substr(1, 3), 10);
+    const keySize = parseInt(enc.slice(1, 4), 10);
     const algorithm = `aes-${keySize}-gcm`;
     if (!(0, ciphers_js_1.default)(algorithm)) {
         throw new errors_js_1.JOSENotSupported(`alg ${enc} is not supported by your javascript runtime`);

package/dist/node/cjs/runtime/generate.js

@@ -16,7 +16,7 @@ async function generateSecret(alg, options) {
         case 'A128CBC-HS256':
         case 'A192CBC-HS384':
         case 'A256CBC-HS512':
-            length = parseInt(alg.substr(-3), 10);
+            length = parseInt(alg.slice(-3), 10);
             break;
         case 'A128KW':
         case 'A192KW':
@@ -27,7 +27,7 @@ async function generateSecret(alg, options) {
         case 'A128GCM':
         case 'A192GCM':
         case 'A256GCM':
-            length = parseInt(alg.substring(1, 4), 10);
+            length = parseInt(alg.slice(1, 4), 10);
             break;
         default:
             throw new errors_js_1.JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');

package/dist/node/cjs/runtime/get_named_curve.js

@@ -45,10 +45,10 @@ const getNamedCurve = (kee, raw) => {
     switch (key.asymmetricKeyType) {
         case 'ed25519':
         case 'ed448':
-            return `Ed${key.asymmetricKeyType.substr(2)}`;
+            return `Ed${key.asymmetricKeyType.slice(2)}`;
         case 'x25519':
         case 'x448':
-            return `X${key.asymmetricKeyType.substr(1)}`;
+            return `X${key.asymmetricKeyType.slice(1)}`;
         case 'ec': {
             if (exports.weakMap.has(key)) {
                 return exports.weakMap.get(key);