jose 5.10.0 → 6.0.1

package/dist/types/util/errors.d.ts

@@ -1,4 +1,4 @@
-import type { JWTPayload, KeyLike } from '../types';
+import type * as types from '../types.d.ts';
 /**
  * A generic Error that all other JOSE specific Error subclasses extend.
  *
@@ -35,9 +35,9 @@ export declare class JWTClaimValidationFailed extends JOSEError {
      * has however been verified. Claims Set verification happens after the JWS Signature or JWE
      * Decryption processes.
      */
-    payload: JWTPayload;
+    payload: types.JWTPayload;
     /** @ignore */
-    constructor(message: string, payload: JWTPayload, claim?: string, reason?: string);
+    constructor(message: string, payload: types.JWTPayload, claim?: string, reason?: string);
 }
 /**
  * An error subclass thrown when a JWT is expired.
@@ -57,9 +57,9 @@ export declare class JWTExpired extends JOSEError implements JWTClaimValidationF
      * has however been verified. Claims Set verification happens after the JWS Signature or JWE
      * Decryption processes.
      */
-    payload: JWTPayload;
+    payload: types.JWTPayload;
     /** @ignore */
-    constructor(message: string, payload: JWTPayload, claim?: string, reason?: string);
+    constructor(message: string, payload: types.JWTPayload, claim?: string, reason?: string);
 }
 /**
  * An error subclass thrown when a JOSE Algorithm is not allowed per developer preference.
@@ -157,7 +157,7 @@ export declare class JWKSNoMatchingKey extends JOSEError {
  */
 export declare class JWKSMultipleMatchingKeys extends JOSEError {
     /** @ignore */
-    [Symbol.asyncIterator]: () => AsyncIterableIterator<KeyLike>;
+    [Symbol.asyncIterator]: () => AsyncIterableIterator<types.CryptoKey>;
     /** @ignore */
     static code: string;
     code: string;

package/dist/{browser → webapi}/index.js

@@ -17,7 +17,7 @@ export { EncryptJWT } from './jwt/encrypt.js';
 export { calculateJwkThumbprint, calculateJwkThumbprintUri } from './jwk/thumbprint.js';
 export { EmbeddedJWK } from './jwk/embedded.js';
 export { createLocalJWKSet } from './jwks/local.js';
-export { createRemoteJWKSet, jwksCache, experimental_jwksCache } from './jwks/remote.js';
+export { createRemoteJWKSet, jwksCache } from './jwks/remote.js';
 export { UnsecuredJWT } from './jwt/unsecured.js';
 export { exportPKCS8, exportSPKI, exportJWK } from './key/export.js';
 export { importSPKI, importPKCS8, importX509, importJWK } from './key/import.js';
@@ -27,4 +27,4 @@ export * as errors from './util/errors.js';
 export { generateKeyPair } from './key/generate_key_pair.js';
 export { generateSecret } from './key/generate_secret.js';
 export * as base64url from './util/base64url.js';
-export { default as cryptoRuntime } from './util/runtime.js';
+export const cryptoRuntime = 'WebCryptoAPI';

package/dist/{node/esm → webapi}/jwe/flattened/decrypt.js

@@ -1,5 +1,5 @@
-import { decode as base64url } from '../../runtime/base64url.js';
-import decrypt from '../../runtime/decrypt.js';
+import { decode as base64url } from '../../lib/base64url.js';
+import decrypt from '../../lib/decrypt.js';
 import { JOSEAlgNotAllowed, JOSENotSupported, JWEInvalid } from '../../util/errors.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import isObject from '../../lib/is_object.js';
@@ -8,6 +8,8 @@ import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
 import generateCek from '../../lib/cek.js';
 import validateCrit from '../../lib/validate_crit.js';
 import validateAlgorithms from '../../lib/validate_algorithms.js';
+import normalizeKey from '../../lib/normalize_key.js';
+import checkKeyType from '../../lib/check_key_type.js';
 export async function flattenedDecrypt(jwe, key, options) {
     if (!isObject(jwe)) {
         throw new JWEInvalid('Flattened JWE must be an object');
@@ -92,9 +94,11 @@ export async function flattenedDecrypt(jwe, key, options) {
         key = await key(parsedProt, jwe);
         resolvedKey = true;
     }
+    checkKeyType(alg === 'dir' ? enc : alg, key, 'decrypt');
+    const k = await normalizeKey(key, alg);
     let cek;
     try {
-        cek = await decryptKeyManagement(alg, key, encryptedKey, joseHeader, options);
+        cek = await decryptKeyManagement(alg, k, encryptedKey, joseHeader, options);
     }
     catch (err) {
         if (err instanceof TypeError || err instanceof JWEInvalid || err instanceof JOSENotSupported) {
@@ -155,7 +159,7 @@ export async function flattenedDecrypt(jwe, key, options) {
         result.unprotectedHeader = jwe.header;
     }
     if (resolvedKey) {
-        return { ...result, key };
+        return { ...result, key: k };
     }
     return result;
 }

package/dist/{node/esm → webapi}/jwe/flattened/encrypt.js

@@ -1,11 +1,13 @@
-import { encode as base64url } from '../../runtime/base64url.js';
+import { encode as base64url } from '../../lib/base64url.js';
 import { unprotected } from '../../lib/private_symbols.js';
-import encrypt from '../../runtime/encrypt.js';
+import encrypt from '../../lib/encrypt.js';
 import encryptKeyManagement from '../../lib/encrypt_key_management.js';
 import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
 import validateCrit from '../../lib/validate_crit.js';
+import normalizeKey from '../../lib/normalize_key.js';
+import checkKeyType from '../../lib/check_key_type.js';
 export class FlattenedEncrypt {
     _plaintext;
     _protectedHeader;
@@ -94,10 +96,12 @@ export class FlattenedEncrypt {
         if (this._cek && (alg === 'dir' || alg === 'ECDH-ES')) {
             throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${alg}`);
         }
+        checkKeyType(alg === 'dir' ? enc : alg, key, 'encrypt');
         let cek;
         {
             let parameters;
-            ({ cek, encryptedKey, parameters } = await encryptKeyManagement(alg, enc, key, this._cek, this._keyManagementParameters));
+            const k = await normalizeKey(key, alg);
+            ({ cek, encryptedKey, parameters } = await encryptKeyManagement(alg, enc, k, this._cek, this._keyManagementParameters));
             if (parameters) {
                 if (options && unprotected in options) {
                     if (!this._unprotectedHeader) {

package/dist/{node/esm → webapi}/jwe/general/encrypt.js

@@ -4,8 +4,10 @@ import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
 import generateCek from '../../lib/cek.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import encryptKeyManagement from '../../lib/encrypt_key_management.js';
-import { encode as base64url } from '../../runtime/base64url.js';
+import { encode as base64url } from '../../lib/base64url.js';
 import validateCrit from '../../lib/validate_crit.js';
+import normalizeKey from '../../lib/normalize_key.js';
+import checkKeyType from '../../lib/check_key_type.js';
 class IndividualRecipient {
     parent;
     unprotectedHeader;
@@ -170,9 +172,12 @@ export class GeneralEncrypt {
                     target.header = flattened.header;
                 continue;
             }
-            const { encryptedKey, parameters } = await encryptKeyManagement(recipient.unprotectedHeader?.alg ||
+            const alg = recipient.unprotectedHeader?.alg ||
                 this._protectedHeader?.alg ||
-                this._unprotectedHeader?.alg, enc, recipient.key, cek, { p2c });
+                this._unprotectedHeader?.alg;
+            checkKeyType(alg === 'dir' ? enc : alg, recipient.key, 'encrypt');
+            const k = await normalizeKey(recipient.key, alg);
+            const { encryptedKey, parameters } = await encryptKeyManagement(alg, enc, k, cek, { p2c });
             target.encrypted_key = base64url(encryptedKey);
             if (recipient.unprotectedHeader || parameters)
                 target.header = { ...recipient.unprotectedHeader, ...parameters };

package/dist/{node/esm → webapi}/jwk/thumbprint.js

@@ -1,16 +1,26 @@
-import digest from '../runtime/digest.js';
-import { encode as base64url } from '../runtime/base64url.js';
+import digest from '../lib/digest.js';
+import { encode as base64url } from '../lib/base64url.js';
 import { JOSENotSupported, JWKInvalid } from '../util/errors.js';
 import { encoder } from '../lib/buffer_utils.js';
-import isObject from '../lib/is_object.js';
+import isKeyLike from '../lib/is_key_like.js';
+import { isJWK } from '../lib/is_jwk.js';
+import { exportJWK } from '../key/export.js';
+import invalidKeyInput from '../lib/invalid_key_input.js';
 const check = (value, description) => {
     if (typeof value !== 'string' || !value) {
         throw new JWKInvalid(`${description} missing or invalid`);
     }
 };
-export async function calculateJwkThumbprint(jwk, digestAlgorithm) {
-    if (!isObject(jwk)) {
-        throw new TypeError('JWK must be an object');
+export async function calculateJwkThumbprint(key, digestAlgorithm) {
+    let jwk;
+    if (isJWK(key)) {
+        jwk = key;
+    }
+    else if (isKeyLike(key)) {
+        jwk = await exportJWK(key);
+    }
+    else {
+        throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
     }
     digestAlgorithm ??= 'sha256';
     if (digestAlgorithm !== 'sha256' &&
@@ -46,8 +56,8 @@ export async function calculateJwkThumbprint(jwk, digestAlgorithm) {
     const data = encoder.encode(JSON.stringify(components));
     return base64url(await digest(digestAlgorithm, data));
 }
-export async function calculateJwkThumbprintUri(jwk, digestAlgorithm) {
+export async function calculateJwkThumbprintUri(key, digestAlgorithm) {
     digestAlgorithm ??= 'sha256';
-    const thumbprint = await calculateJwkThumbprint(jwk, digestAlgorithm);
+    const thumbprint = await calculateJwkThumbprint(key, digestAlgorithm);
     return `urn:ietf:params:oauth:jwk-thumbprint:sha-${digestAlgorithm.slice(-3)}:${thumbprint}`;
 }

package/dist/{node/esm → webapi}/jwks/local.js

@@ -60,9 +60,6 @@ class LocalJWKSet {
                     case 'ES256':
                         candidate = jwk.crv === 'P-256';
                         break;
-                    case 'ES256K':
-                        candidate = jwk.crv === 'secp256k1';
-                        break;
                     case 'ES384':
                         candidate = jwk.crv === 'P-384';
                         break;
@@ -70,10 +67,8 @@ class LocalJWKSet {
                         candidate = jwk.crv === 'P-521';
                         break;
                     case 'Ed25519':
-                        candidate = jwk.crv === 'Ed25519';
-                        break;
                     case 'EdDSA':
-                        candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
+                        candidate = jwk.crv === 'Ed25519';
                         break;
                 }
             }

package/dist/{node/esm → webapi}/jwks/remote.js

@@ -1,5 +1,4 @@
-import fetchJwks from '../runtime/fetch_jwks.js';
-import { JWKSNoMatchingKey } from '../util/errors.js';
+import { JOSEError, JWKSNoMatchingKey, JWKSTimeout } from '../util/errors.js';
 import { createLocalJWKSet } from './local.js';
 import isObject from '../lib/is_object.js';
 function isCloudflareWorkers() {
@@ -10,9 +9,32 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.10.0';
+    const VERSION = 'v6.0.1';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
+export const customFetch = Symbol();
+async function fetchJwks(url, options) {
+    const response = await (options?.[customFetch] || fetch)(url, {
+        method: 'GET',
+        signal: options.signal,
+        redirect: 'manual',
+        headers: options.headers,
+    }).catch((err) => {
+        if (err.name === 'TimeoutError') {
+            throw new JWKSTimeout();
+        }
+        throw err;
+    });
+    if (response.status !== 200) {
+        throw new JOSEError('Expected 200 OK from the JSON Web Key Set HTTP response');
+    }
+    try {
+        return await response.json();
+    }
+    catch {
+        throw new JOSEError('Failed to parse the JSON Web Key Set HTTP response as JSON');
+    }
+}
 export const jwksCache = Symbol();
 function isFreshJwksCache(input, cacheMaxAge) {
     if (typeof input !== 'object' || input === null) {
@@ -44,7 +66,7 @@ class RemoteJWKSet {
             throw new TypeError('url must be an instance of URL');
         }
         this._url = new URL(url.href);
-        this._options = { agent: options?.agent, headers: options?.headers };
+        this._options = { headers: options?.headers };
         this._timeoutDuration =
             typeof options?.timeoutDuration === 'number' ? options?.timeoutDuration : 5000;
         this._cooldownDuration =
@@ -94,7 +116,14 @@ class RemoteJWKSet {
             headers.set('User-Agent', USER_AGENT);
             this._options.headers = Object.fromEntries(headers.entries());
         }
-        this._pendingFetch ||= fetchJwks(this._url, this._timeoutDuration, this._options)
+        if (!headers.has('accept')) {
+            headers.set('accept', 'application/json');
+            headers.append('accept', 'application/jwk-set+json');
+        }
+        this._pendingFetch ||= fetchJwks(this._url.href, {
+            headers,
+            signal: AbortSignal.timeout(this._timeoutDuration),
+        })
             .then((json) => {
             this._local = createLocalJWKSet(json);
             if (this._cache) {
@@ -145,4 +174,3 @@ export function createRemoteJWKSet(url, options) {
     });
     return remoteJWKSet;
 }
-export const experimental_jwksCache = jwksCache;

package/dist/{node/esm → webapi}/jws/flattened/sign.js

@@ -1,10 +1,11 @@
-import { encode as base64url } from '../../runtime/base64url.js';
-import sign from '../../runtime/sign.js';
+import { encode as base64url } from '../../lib/base64url.js';
+import sign from '../../lib/sign.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import { JWSInvalid } from '../../util/errors.js';
 import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
-import { checkKeyTypeWithJwk } from '../../lib/check_key_type.js';
+import checkKeyType from '../../lib/check_key_type.js';
 import validateCrit from '../../lib/validate_crit.js';
+import normalizeKey from '../../lib/normalize_key.js';
 export class FlattenedSign {
     _payload;
     _protectedHeader;
@@ -52,7 +53,7 @@ export class FlattenedSign {
         if (typeof alg !== 'string' || !alg) {
             throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
         }
-        checkKeyTypeWithJwk(alg, key, 'sign');
+        checkKeyType(alg, key, 'sign');
         let payload = this._payload;
         if (b64) {
             payload = encoder.encode(base64url(payload));
@@ -65,7 +66,8 @@ export class FlattenedSign {
             protectedHeader = encoder.encode('');
         }
         const data = concat(protectedHeader, encoder.encode('.'), payload);
-        const signature = await sign(alg, key, data);
+        const k = await normalizeKey(key, alg);
+        const signature = await sign(alg, k, data);
         const jws = {
             signature: base64url(signature),
             payload: '',

package/dist/{browser → webapi}/jws/flattened/verify.js

@@ -1,14 +1,13 @@
-import { decode as base64url } from '../../runtime/base64url.js';
-import verify from '../../runtime/verify.js';
+import { decode as base64url } from '../../lib/base64url.js';
+import verify from '../../lib/verify.js';
 import { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';
 import { concat, encoder, decoder } from '../../lib/buffer_utils.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import isObject from '../../lib/is_object.js';
-import { checkKeyTypeWithJwk } from '../../lib/check_key_type.js';
+import checkKeyType from '../../lib/check_key_type.js';
 import validateCrit from '../../lib/validate_crit.js';
 import validateAlgorithms from '../../lib/validate_algorithms.js';
-import { isJWK } from '../../lib/is_jwk.js';
-import { importJWK } from '../../key/import.js';
+import normalizeKey from '../../lib/normalize_key.js';
 export async function flattenedVerify(jws, key, options) {
     if (!isObject(jws)) {
         throw new JWSInvalid('Flattened JWS must be an object');
@@ -73,14 +72,8 @@ export async function flattenedVerify(jws, key, options) {
     if (typeof key === 'function') {
         key = await key(parsedProt, jws);
         resolvedKey = true;
-        checkKeyTypeWithJwk(alg, key, 'verify');
-        if (isJWK(key)) {
-            key = await importJWK(key, alg);
-        }
-    }
-    else {
-        checkKeyTypeWithJwk(alg, key, 'verify');
     }
+    checkKeyType(alg, key, 'verify');
     const data = concat(encoder.encode(jws.protected ?? ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);
     let signature;
     try {
@@ -89,7 +82,8 @@ export async function flattenedVerify(jws, key, options) {
     catch {
         throw new JWSInvalid('Failed to base64url decode the signature');
     }
-    const verified = await verify(alg, key, signature, data);
+    const k = await normalizeKey(key, alg);
+    const verified = await verify(alg, k, signature, data);
     if (!verified) {
         throw new JWSSignatureVerificationFailed();
     }
@@ -116,7 +110,7 @@ export async function flattenedVerify(jws, key, options) {
         result.unprotectedHeader = jws.header;
     }
     if (resolvedKey) {
-        return { ...result, key };
+        return { ...result, key: k };
     }
     return result;
 }

package/dist/{browser → webapi}/jwt/unsecured.js

@@ -1,4 +1,4 @@
-import * as base64url from '../runtime/base64url.js';
+import * as base64url from '../lib/base64url.js';
 import { decoder } from '../lib/buffer_utils.js';
 import { JWTInvalid } from '../util/errors.js';
 import jwtPayload from '../lib/jwt_claims_set.js';

package/dist/{node/esm → webapi}/key/export.js

@@ -1,6 +1,5 @@
-import { toSPKI as exportPublic } from '../runtime/asn1.js';
-import { toPKCS8 as exportPrivate } from '../runtime/asn1.js';
-import keyToJWK from '../runtime/key_to_jwk.js';
+import { toSPKI as exportPublic, toPKCS8 as exportPrivate } from '../lib/asn1.js';
+import keyToJWK from '../lib/key_to_jwk.js';
 export async function exportSPKI(key) {
     return exportPublic(key);
 }

package/dist/{browser/runtime/generate.js → webapi/key/generate_key_pair.js}

@@ -1,45 +1,4 @@
-import crypto from './webcrypto.js';
 import { JOSENotSupported } from '../util/errors.js';
-import random from './random.js';
-export async function generateSecret(alg, options) {
-    let length;
-    let algorithm;
-    let keyUsages;
-    switch (alg) {
-        case 'HS256':
-        case 'HS384':
-        case 'HS512':
-            length = parseInt(alg.slice(-3), 10);
-            algorithm = { name: 'HMAC', hash: `SHA-${length}`, length };
-            keyUsages = ['sign', 'verify'];
-            break;
-        case 'A128CBC-HS256':
-        case 'A192CBC-HS384':
-        case 'A256CBC-HS512':
-            length = parseInt(alg.slice(-3), 10);
-            return random(new Uint8Array(length >> 3));
-        case 'A128KW':
-        case 'A192KW':
-        case 'A256KW':
-            length = parseInt(alg.slice(1, 4), 10);
-            algorithm = { name: 'AES-KW', length };
-            keyUsages = ['wrapKey', 'unwrapKey'];
-            break;
-        case 'A128GCMKW':
-        case 'A192GCMKW':
-        case 'A256GCMKW':
-        case 'A128GCM':
-        case 'A192GCM':
-        case 'A256GCM':
-            length = parseInt(alg.slice(1, 4), 10);
-            algorithm = { name: 'AES-GCM', length };
-            keyUsages = ['encrypt', 'decrypt'];
-            break;
-        default:
-            throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
-    }
-    return crypto.subtle.generateKey(algorithm, options?.extractable ?? false, keyUsages);
-}
 function getModulusLengthOption(options) {
     const modulusLength = options?.modulusLength ?? 2048;
     if (typeof modulusLength !== 'number' || modulusLength < 2048) {
@@ -98,27 +57,16 @@ export async function generateKeyPair(alg, options) {
             keyUsages = ['sign', 'verify'];
             break;
         case 'Ed25519':
-            algorithm = { name: 'Ed25519' };
-            keyUsages = ['sign', 'verify'];
-            break;
         case 'EdDSA': {
             keyUsages = ['sign', 'verify'];
-            const crv = options?.crv ?? 'Ed25519';
-            switch (crv) {
-                case 'Ed25519':
-                case 'Ed448':
-                    algorithm = { name: crv };
-                    break;
-                default:
-                    throw new JOSENotSupported('Invalid or unsupported crv option provided');
-            }
+            algorithm = { name: 'Ed25519' };
             break;
         }
         case 'ECDH-ES':
         case 'ECDH-ES+A128KW':
         case 'ECDH-ES+A192KW':
         case 'ECDH-ES+A256KW': {
-            keyUsages = ['deriveKey', 'deriveBits'];
+            keyUsages = ['deriveBits'];
             const crv = options?.crv ?? 'P-256';
             switch (crv) {
                 case 'P-256':
@@ -128,11 +76,10 @@ export async function generateKeyPair(alg, options) {
                     break;
                 }
                 case 'X25519':
-                case 'X448':
-                    algorithm = { name: crv };
+                    algorithm = { name: 'X25519' };
                     break;
                 default:
-                    throw new JOSENotSupported('Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, X25519, and X448');
+                    throw new JOSENotSupported('Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519');
             }
             break;
         }

package/dist/webapi/key/generate_secret.js

@@ -0,0 +1,40 @@
+import { JOSENotSupported } from '../util/errors.js';
+export async function generateSecret(alg, options) {
+    let length;
+    let algorithm;
+    let keyUsages;
+    switch (alg) {
+        case 'HS256':
+        case 'HS384':
+        case 'HS512':
+            length = parseInt(alg.slice(-3), 10);
+            algorithm = { name: 'HMAC', hash: `SHA-${length}`, length };
+            keyUsages = ['sign', 'verify'];
+            break;
+        case 'A128CBC-HS256':
+        case 'A192CBC-HS384':
+        case 'A256CBC-HS512':
+            length = parseInt(alg.slice(-3), 10);
+            return crypto.getRandomValues(new Uint8Array(length >> 3));
+        case 'A128KW':
+        case 'A192KW':
+        case 'A256KW':
+            length = parseInt(alg.slice(1, 4), 10);
+            algorithm = { name: 'AES-KW', length };
+            keyUsages = ['wrapKey', 'unwrapKey'];
+            break;
+        case 'A128GCMKW':
+        case 'A192GCMKW':
+        case 'A256GCMKW':
+        case 'A128GCM':
+        case 'A192GCM':
+        case 'A256GCM':
+            length = parseInt(alg.slice(1, 4), 10);
+            algorithm = { name: 'AES-GCM', length };
+            keyUsages = ['encrypt', 'decrypt'];
+            break;
+        default:
+            throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+    }
+    return crypto.subtle.generateKey(algorithm, options?.extractable ?? false, keyUsages);
+}

package/dist/{browser → webapi}/key/import.js

@@ -1,6 +1,6 @@
-import { decode as decodeBase64URL } from '../runtime/base64url.js';
-import { fromSPKI, fromPKCS8, fromX509 } from '../runtime/asn1.js';
-import asKeyObject from '../runtime/jwk_to_key.js';
+import { decode as decodeBase64URL } from '../lib/base64url.js';
+import { fromSPKI, fromPKCS8, fromX509 } from '../lib/asn1.js';
+import toCryptoKey from '../lib/jwk_to_key.js';
 import { JOSENotSupported } from '../util/errors.js';
 import isObject from '../lib/is_object.js';
 export async function importSPKI(spki, alg, options) {
@@ -21,11 +21,13 @@ export async function importPKCS8(pkcs8, alg, options) {
     }
     return fromPKCS8(pkcs8, alg, options);
 }
-export async function importJWK(jwk, alg) {
+export async function importJWK(jwk, alg, options) {
     if (!isObject(jwk)) {
         throw new TypeError('JWK must be an object');
     }
-    alg || (alg = jwk.alg);
+    let ext;
+    alg ??= jwk.alg;
+    ext ??= options?.extractable ?? jwk.ext;
     switch (jwk.kty) {
         case 'oct':
             if (typeof jwk.k !== 'string' || !jwk.k) {
@@ -38,7 +40,7 @@ export async function importJWK(jwk, alg) {
             }
         case 'EC':
         case 'OKP':
-            return asKeyObject({ ...jwk, alg });
+            return toCryptoKey({ ...jwk, alg, ext });
         default:
             throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
     }

package/dist/{node/esm → webapi}/lib/aesgcmkw.js

@@ -1,6 +1,6 @@
-import encrypt from '../runtime/encrypt.js';
-import decrypt from '../runtime/decrypt.js';
-import { encode as base64url } from '../runtime/base64url.js';
+import encrypt from './encrypt.js';
+import decrypt from './decrypt.js';
+import { encode as base64url } from '../lib/base64url.js';
 export async function wrap(alg, key, cek, iv) {
     const jweAlgorithm = alg.slice(0, 7);
     const wrapped = await encrypt(jweAlgorithm, cek, key, iv, new Uint8Array(0));

package/dist/{browser/runtime → webapi/lib}/aeskw.js

@@ -1,32 +1,25 @@
-import bogusWebCrypto from './bogus.js';
-import crypto, { isCryptoKey } from './webcrypto.js';
-import { checkEncCryptoKey } from '../lib/crypto_key.js';
-import invalidKeyInput from '../lib/invalid_key_input.js';
-import { types } from './is_key_like.js';
+import { checkEncCryptoKey } from './crypto_key.js';
 function checkKeySize(key, alg) {
     if (key.algorithm.length !== parseInt(alg.slice(1, 4), 10)) {
         throw new TypeError(`Invalid key size for alg: ${alg}`);
     }
 }
 function getCryptoKey(key, alg, usage) {
-    if (isCryptoKey(key)) {
-        checkEncCryptoKey(key, alg, usage);
-        return key;
-    }
     if (key instanceof Uint8Array) {
         return crypto.subtle.importKey('raw', key, 'AES-KW', true, [usage]);
     }
-    throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
+    checkEncCryptoKey(key, alg, usage);
+    return key;
 }
-export const wrap = async (alg, key, cek) => {
+export async function wrap(alg, key, cek) {
     const cryptoKey = await getCryptoKey(key, alg, 'wrapKey');
     checkKeySize(cryptoKey, alg);
-    const cryptoKeyCek = await crypto.subtle.importKey('raw', cek, ...bogusWebCrypto);
+    const cryptoKeyCek = await crypto.subtle.importKey('raw', cek, { hash: 'SHA-256', name: 'HMAC' }, true, ['sign']);
     return new Uint8Array(await crypto.subtle.wrapKey('raw', cryptoKeyCek, cryptoKey, 'AES-KW'));
-};
-export const unwrap = async (alg, key, encryptedKey) => {
+}
+export async function unwrap(alg, key, encryptedKey) {
     const cryptoKey = await getCryptoKey(key, alg, 'unwrapKey');
     checkKeySize(cryptoKey, alg);
-    const cryptoKeyCek = await crypto.subtle.unwrapKey('raw', encryptedKey, cryptoKey, 'AES-KW', ...bogusWebCrypto);
+    const cryptoKeyCek = await crypto.subtle.unwrapKey('raw', encryptedKey, cryptoKey, 'AES-KW', { hash: 'SHA-256', name: 'HMAC' }, true, ['sign']);
     return new Uint8Array(await crypto.subtle.exportKey('raw', cryptoKeyCek));
-};
+}