jose 6.0.13 → 6.1.1

package/README.md

@@ -1,6 +1,6 @@
 # jose
 
-`jose` is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. The module is designed to work across various Web-interoperable runtimes including Node.js, browsers, Cloudflare Workers, Deno, Bun, and others.
+`jose` is a JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. The module is designed to work across various Web-interoperable runtimes including Node.js, browsers, Cloudflare Workers, Deno, Bun, and others.
 
 ## Sponsor
 
@@ -110,7 +110,6 @@ The following runtimes are supported _(this is not an exhaustive list)_:
 - [Deno](https://github.com/panva/jose/issues/266)
 - [Electron](https://github.com/panva/jose/issues/264)
 - [Node.js](https://github.com/panva/jose/issues/262)
-- [Vercel's Edge Runtime](https://github.com/panva/jose/issues/301)
 
 Please note that certain algorithms may not be available depending on the runtime used. You can find a list of available algorithms for each runtime in the specific issue links provided above.
 
@@ -137,6 +136,8 @@ Please note that certain algorithms may not be available depending on the runtim
 - JSON Web Key Thumbprint URI - [RFC9278](https://www.rfc-editor.org/rfc/rfc9278)
 - JWS Unencoded Payload Option - [RFC7797](https://www.rfc-editor.org/rfc/rfc7797)
 - CFRG Elliptic Curve ECDH and Signatures - [RFC8037](https://www.rfc-editor.org/rfc/rfc8037)
+- Fully-Specified Algorithms for JOSE - [RFC9864](https://www.rfc-editor.org/rfc/rfc9864.html)
+- ML-DSA for JOSE - [draft-ietf-cose-dilithium-10](https://www.ietf.org/archive/id/draft-ietf-cose-dilithium-10.html)
 
 The algorithm implementations in `jose` have been tested using test vectors from their respective specifications as well as [RFC7520](https://www.rfc-editor.org/rfc/rfc7520).
 

package/dist/types/jwe/compact/encrypt.d.ts

@@ -46,10 +46,10 @@ export declare class CompactEncrypt {
      */
     setProtectedHeader(protectedHeader: types.CompactJWEHeaderParameters): this;
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting. Use of this is method is
-     * really only needed for ECDH based algorithms when utilizing the Agreement PartyUInfo or
-     * Agreement PartyVInfo parameters. Other parameters will always be randomly generated when needed
-     * and missing.
+     * Sets the JWE Key Management parameters to be used when encrypting.
+     *
+     * (ECDH-ES) Use of this method is needed for ECDH based algorithms to set the "apu" (Agreement
+     * PartyUInfo) or "apv" (Agreement PartyVInfo) parameters.
      *
      * @param parameters JWE Key Management parameters.
      */

package/dist/types/jwe/flattened/encrypt.d.ts

@@ -20,10 +20,10 @@ export declare class FlattenedEncrypt {
      */
     constructor(plaintext: Uint8Array);
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting. Use of this is method is
-     * really only needed for ECDH based algorithms when utilizing the "apu" (Agreement PartyUInfo) or
-     * "apv" (Agreement PartyVInfo) parameters. Other parameters will always be randomly generated
-     * when needed and missing.
+     * Sets the JWE Key Management parameters to be used when encrypting.
+     *
+     * (ECDH-ES) Use of this method is needed for ECDH based algorithms to set the "apu" (Agreement
+     * PartyUInfo) or "apv" (Agreement PartyVInfo) parameters.
      *
      * @param parameters JWE Key Management parameters.
      */

package/dist/types/jwe/general/encrypt.d.ts

@@ -12,6 +12,15 @@ export interface Recipient {
      * @param unprotectedHeader JWE Per-Recipient Unprotected Header.
      */
     setUnprotectedHeader(unprotectedHeader: types.JWEHeaderParameters): Recipient;
+    /**
+     * Sets the JWE Key Management parameters to be used when encrypting.
+     *
+     * (ECDH-ES) Use of this method is needed for ECDH based algorithms to set the "apu" (Agreement
+     * PartyUInfo) or "apv" (Agreement PartyVInfo) parameters.
+     *
+     * @param parameters JWE Key Management parameters.
+     */
+    setKeyManagementParameters(parameters: types.JWEKeyManagementHeaderParameters): Recipient;
     /** A shorthand for calling addRecipient() on the enclosing {@link GeneralEncrypt} instance */
     addRecipient(...args: Parameters<GeneralEncrypt['addRecipient']>): Recipient;
     /** A shorthand for calling encrypt() on the enclosing {@link GeneralEncrypt} instance */

package/dist/types/jwt/encrypt.d.ts

@@ -34,10 +34,10 @@ export declare class EncryptJWT implements types.ProduceJWT {
      */
     setProtectedHeader(protectedHeader: types.CompactJWEHeaderParameters): this;
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting. Use of this is method is
-     * really only needed for ECDH based algorithms when utilizing the "apu" (Agreement PartyUInfo) or
-     * "apv" (Agreement PartyVInfo) parameters. Other parameters will always be randomly generated
-     * when needed and missing.
+     * Sets the JWE Key Management parameters to be used when encrypting.
+     *
+     * (ECDH-ES) Use of this method is needed for ECDH based algorithms to set the "apu" (Agreement
+     * PartyUInfo) or "apv" (Agreement PartyVInfo) parameters.
      *
      * @param parameters JWE Key Management parameters.
      */

package/dist/types/types.d.ts

@@ -35,11 +35,25 @@ export interface JWK_OKP_Public extends JWKParameters {
 }
 
 /** Convenience interface for Private OKP JSON Web Keys */
-export interface JWK_OKP_Private extends JWK_OKP_Public, JWKParameters {
+export interface JWK_OKP_Private extends JWK_OKP_Public {
   /** OKP JWK "d" (The Private Key) Parameter */
   d: string
 }
 
+/** Convenience interface for Public AKP JSON Web Keys */
+export interface JWK_AKP_Public extends JWKParameters {
+  /** JWK "alg" (Algorithm) Parameter */
+  alg: string
+  /** AKP JWK "pub" (The Public key) Parameter */
+  pub: string
+}
+
+/** Convenience interface for Private AKP JSON Web Keys */
+export interface JWK_AKP_Private extends JWK_AKP_Public {
+  /** AKP JWK "priv" (The Private Key) Parameter */
+  priv: string
+}
+
 /** Convenience interface for Public EC JSON Web Keys */
 export interface JWK_EC_Public extends JWKParameters {
   /** EC JWK "crv" (Curve) Parameter */
@@ -51,7 +65,7 @@ export interface JWK_EC_Public extends JWKParameters {
 }
 
 /** Convenience interface for Private EC JSON Web Keys */
-export interface JWK_EC_Private extends JWK_EC_Public, JWKParameters {
+export interface JWK_EC_Private extends JWK_EC_Public {
   /** EC JWK "d" (ECC Private Key) Parameter */
   d: string
 }
@@ -65,7 +79,7 @@ export interface JWK_RSA_Public extends JWKParameters {
 }
 
 /** Convenience interface for Private RSA JSON Web Keys */
-export interface JWK_RSA_Private extends JWK_RSA_Public, JWKParameters {
+export interface JWK_RSA_Private extends JWK_RSA_Public {
   /** RSA JWK "d" (Private Exponent) Parameter */
   d: string
   /** RSA JWK "dp" (First Factor CRT Exponent) Parameter */
@@ -87,9 +101,11 @@ export interface JWK_oct extends JWKParameters {
 }
 
 /**
- * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC", "OKP", and "oct"
- * key types are supported.
+ * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC", "OKP", "AKP", and
+ * "oct" key types are supported.
  *
+ * @see {@link JWK_AKP_Public}
+ * @see {@link JWK_AKP_Private}
  * @see {@link JWK_OKP_Public}
  * @see {@link JWK_OKP_Private}
  * @see {@link JWK_EC_Public}
@@ -133,6 +149,10 @@ export interface JWK extends JWKParameters {
   x?: string
   /** EC JWK "y" (Y Coordinate) Parameter */
   y?: string
+  /** AKP JWK "pub" (Public Key) Parameter */
+  pub?: string
+  /** AKP JWK "priv" (Private key) Parameter */
+  priv?: string
 }
 
 /**
@@ -145,7 +165,7 @@ export interface GenericGetKeyFunction<IProtectedHeader, IToken, ReturnKeyTypes>
    * Dynamic key resolution function. No token components have been verified at the time of this
    * function call.
    *
-   * If you cannot match a key suitable for the token, throw an error instead.
+   * If a suitable key for the token cannot be matched, throw an error instead.
    *
    * @param protectedHeader JWE or JWS Protected Header.
    * @param token The consumed JWE or JWS token.
@@ -251,7 +271,7 @@ export interface JoseHeaderParameters {
   jku?: string
 
   /** "jwk" (JSON Web Key) Header Parameter */
-  jwk?: Pick<JWK, 'kty' | 'crv' | 'x' | 'y' | 'e' | 'n'>
+  jwk?: Pick<JWK, 'kty' | 'crv' | 'x' | 'y' | 'e' | 'n' | 'alg' | 'pub'>
 
   /** "typ" (Type) Header Parameter */
   typ?: string
@@ -284,25 +304,34 @@ export interface JWSHeaderParameters extends JoseHeaderParameters {
 
 /** Recognized JWE Key Management-related Header Parameters. */
 export interface JWEKeyManagementHeaderParameters {
+  /**
+   * ECDH-ES "apu" (Agreement PartyUInfo). This will be used as a JOSE Header Parameter and will be
+   * used in ECDH's ConcatKDF.
+   */
   apu?: Uint8Array
+
+  /**
+   * ECDH-ES "apv" (Agreement PartyVInfo). This will be used as a JOSE Header Parameter and will be
+   * used in ECDH's ConcatKDF.
+   */
   apv?: Uint8Array
   /**
-   * @deprecated You should not use this parameter. It is only really intended for test and vector
+   * @deprecated You should not use this parameter. It is only intended for testing and vector
    *   validation purposes.
    */
   p2c?: number
   /**
-   * @deprecated You should not use this parameter. It is only really intended for test and vector
+   * @deprecated You should not use this parameter. It is only intended for testing and vector
    *   validation purposes.
    */
   p2s?: Uint8Array
   /**
-   * @deprecated You should not use this parameter. It is only really intended for test and vector
+   * @deprecated You should not use this parameter. It is only intended for testing and vector
    *   validation purposes.
    */
   iv?: Uint8Array
   /**
-   * @deprecated You should not use this parameter. It is only really intended for test and vector
+   * @deprecated You should not use this parameter. It is only intended for testing and vector
    *   validation purposes.
    */
   epk?: CryptoKey | KeyObject

package/dist/webapi/jwe/flattened/decrypt.js

@@ -1,15 +1,15 @@
 import { decode as b64u } from '../../util/base64url.js';
-import decrypt from '../../lib/decrypt.js';
+import { decrypt } from '../../lib/decrypt.js';
 import { JOSEAlgNotAllowed, JOSENotSupported, JWEInvalid } from '../../util/errors.js';
-import isDisjoint from '../../lib/is_disjoint.js';
-import isObject from '../../lib/is_object.js';
-import decryptKeyManagement from '../../lib/decrypt_key_management.js';
-import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
-import generateCek from '../../lib/cek.js';
-import validateCrit from '../../lib/validate_crit.js';
-import validateAlgorithms from '../../lib/validate_algorithms.js';
-import normalizeKey from '../../lib/normalize_key.js';
-import checkKeyType from '../../lib/check_key_type.js';
+import { isDisjoint } from '../../lib/is_disjoint.js';
+import { isObject } from '../../lib/is_object.js';
+import { decryptKeyManagement } from '../../lib/decrypt_key_management.js';
+import { decoder, concat, encode } from '../../lib/buffer_utils.js';
+import { generateCek } from '../../lib/cek.js';
+import { validateCrit } from '../../lib/validate_crit.js';
+import { validateAlgorithms } from '../../lib/validate_algorithms.js';
+import { normalizeKey } from '../../lib/normalize_key.js';
+import { checkKeyType } from '../../lib/check_key_type.js';
 export async function flattenedDecrypt(jwe, key, options) {
     if (!isObject(jwe)) {
         throw new JWEInvalid('Flattened JWE must be an object');
@@ -124,10 +124,10 @@ export async function flattenedDecrypt(jwe, key, options) {
             throw new JWEInvalid('Failed to base64url decode the tag');
         }
     }
-    const protectedHeader = encoder.encode(jwe.protected ?? '');
+    const protectedHeader = jwe.protected !== undefined ? encode(jwe.protected) : new Uint8Array();
     let additionalData;
     if (jwe.aad !== undefined) {
-        additionalData = concat(protectedHeader, encoder.encode('.'), encoder.encode(jwe.aad));
+        additionalData = concat(protectedHeader, encode('.'), encode(jwe.aad));
     }
     else {
         additionalData = protectedHeader;

package/dist/webapi/jwe/flattened/encrypt.js

@@ -1,13 +1,13 @@
 import { encode as b64u } from '../../util/base64url.js';
 import { unprotected } from '../../lib/private_symbols.js';
-import encrypt from '../../lib/encrypt.js';
-import encryptKeyManagement from '../../lib/encrypt_key_management.js';
+import { encrypt } from '../../lib/encrypt.js';
+import { encryptKeyManagement } from '../../lib/encrypt_key_management.js';
 import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
-import isDisjoint from '../../lib/is_disjoint.js';
-import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
-import validateCrit from '../../lib/validate_crit.js';
-import normalizeKey from '../../lib/normalize_key.js';
-import checkKeyType from '../../lib/check_key_type.js';
+import { isDisjoint } from '../../lib/is_disjoint.js';
+import { concat, encode } from '../../lib/buffer_utils.js';
+import { validateCrit } from '../../lib/validate_crit.js';
+import { normalizeKey } from '../../lib/normalize_key.js';
+import { checkKeyType } from '../../lib/check_key_type.js';
 export class FlattenedEncrypt {
     #plaintext;
     #protectedHeader;
@@ -120,20 +120,24 @@ export class FlattenedEncrypt {
             }
         }
         let additionalData;
-        let protectedHeader;
+        let protectedHeaderS;
+        let protectedHeaderB;
         let aadMember;
         if (this.#protectedHeader) {
-            protectedHeader = encoder.encode(b64u(JSON.stringify(this.#protectedHeader)));
+            protectedHeaderS = b64u(JSON.stringify(this.#protectedHeader));
+            protectedHeaderB = encode(protectedHeaderS);
         }
         else {
-            protectedHeader = encoder.encode('');
+            protectedHeaderS = '';
+            protectedHeaderB = new Uint8Array();
         }
         if (this.#aad) {
             aadMember = b64u(this.#aad);
-            additionalData = concat(protectedHeader, encoder.encode('.'), encoder.encode(aadMember));
+            const aadMemberBytes = encode(aadMember);
+            additionalData = concat(protectedHeaderB, encode('.'), aadMemberBytes);
         }
         else {
-            additionalData = protectedHeader;
+            additionalData = protectedHeaderB;
         }
         const { ciphertext, tag, iv } = await encrypt(enc, this.#plaintext, cek, this.#iv, additionalData);
         const jwe = {
@@ -152,7 +156,7 @@ export class FlattenedEncrypt {
             jwe.aad = aadMember;
         }
         if (this.#protectedHeader) {
-            jwe.protected = decoder.decode(protectedHeader);
+            jwe.protected = protectedHeaderS;
         }
         if (this.#sharedUnprotectedHeader) {
             jwe.unprotected = this.#sharedUnprotectedHeader;

package/dist/webapi/jwe/general/decrypt.js

@@ -1,6 +1,6 @@
 import { flattenedDecrypt } from '../flattened/decrypt.js';
 import { JWEDecryptionFailed, JWEInvalid } from '../../util/errors.js';
-import isObject from '../../lib/is_object.js';
+import { isObject } from '../../lib/is_object.js';
 export async function generalDecrypt(jwe, key, options) {
     if (!isObject(jwe)) {
         throw new JWEInvalid('General JWE must be an object');

package/dist/webapi/jwe/general/encrypt.js

@@ -1,16 +1,17 @@
 import { FlattenedEncrypt } from '../flattened/encrypt.js';
 import { unprotected } from '../../lib/private_symbols.js';
 import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
-import generateCek from '../../lib/cek.js';
-import isDisjoint from '../../lib/is_disjoint.js';
-import encryptKeyManagement from '../../lib/encrypt_key_management.js';
+import { generateCek } from '../../lib/cek.js';
+import { isDisjoint } from '../../lib/is_disjoint.js';
+import { encryptKeyManagement } from '../../lib/encrypt_key_management.js';
 import { encode as b64u } from '../../util/base64url.js';
-import validateCrit from '../../lib/validate_crit.js';
-import normalizeKey from '../../lib/normalize_key.js';
-import checkKeyType from '../../lib/check_key_type.js';
+import { validateCrit } from '../../lib/validate_crit.js';
+import { normalizeKey } from '../../lib/normalize_key.js';
+import { checkKeyType } from '../../lib/check_key_type.js';
 class IndividualRecipient {
     #parent;
     unprotectedHeader;
+    keyManagementParameters;
     key;
     options;
     constructor(enc, key, options) {
@@ -25,6 +26,13 @@ class IndividualRecipient {
         this.unprotectedHeader = unprotectedHeader;
         return this;
     }
+    setKeyManagementParameters(parameters) {
+        if (this.keyManagementParameters) {
+            throw new TypeError('setKeyManagementParameters can only be called once');
+        }
+        this.keyManagementParameters = parameters;
+        return this;
+    }
     addRecipient(...args) {
         return this.#parent.addRecipient(...args);
     }
@@ -132,20 +140,12 @@ export class GeneralEncrypt {
         const cek = generateCek(enc);
         const jwe = {
             ciphertext: '',
-            iv: '',
             recipients: [],
-            tag: '',
         };
         for (let i = 0; i < this.#recipients.length; i++) {
             const recipient = this.#recipients[i];
             const target = {};
             jwe.recipients.push(target);
-            const joseHeader = {
-                ...this.#protectedHeader,
-                ...this.#unprotectedHeader,
-                ...recipient.unprotectedHeader,
-            };
-            const p2c = joseHeader.alg.startsWith('PBES2') ? 2048 + i : undefined;
             if (i === 0) {
                 const flattened = await new FlattenedEncrypt(this.#plaintext)
                     .setAdditionalAuthenticatedData(this.#aad)
@@ -153,7 +153,7 @@ export class GeneralEncrypt {
                     .setProtectedHeader(this.#protectedHeader)
                     .setSharedUnprotectedHeader(this.#unprotectedHeader)
                     .setUnprotectedHeader(recipient.unprotectedHeader)
-                    .setKeyManagementParameters({ p2c })
+                    .setKeyManagementParameters(recipient.keyManagementParameters)
                     .encrypt(recipient.key, {
                     ...recipient.options,
                     [unprotected]: true,
@@ -177,7 +177,7 @@ export class GeneralEncrypt {
                 this.#unprotectedHeader?.alg;
             checkKeyType(alg === 'dir' ? enc : alg, recipient.key, 'encrypt');
             const k = await normalizeKey(recipient.key, alg);
-            const { encryptedKey, parameters } = await encryptKeyManagement(alg, enc, k, cek, { p2c });
+            const { encryptedKey, parameters } = await encryptKeyManagement(alg, enc, k, cek, recipient.keyManagementParameters);
             target.encrypted_key = b64u(encryptedKey);
             if (recipient.unprotectedHeader || parameters)
                 target.header = { ...recipient.unprotectedHeader, ...parameters };

package/dist/webapi/jwk/embedded.js

@@ -1,5 +1,5 @@
 import { importJWK } from '../key/import.js';
-import isObject from '../lib/is_object.js';
+import { isObject } from '../lib/is_object.js';
 import { JWSInvalid } from '../util/errors.js';
 export async function EmbeddedJWK(protectedHeader, token) {
     const joseHeader = {

package/dist/webapi/jwk/thumbprint.js

@@ -1,11 +1,11 @@
-import digest from '../lib/digest.js';
+import { digest } from '../lib/digest.js';
 import { encode as b64u } from '../util/base64url.js';
 import { JOSENotSupported, JWKInvalid } from '../util/errors.js';
-import { encoder } from '../lib/buffer_utils.js';
-import isKeyLike from '../lib/is_key_like.js';
+import { encode } from '../lib/buffer_utils.js';
+import { isKeyLike } from '../lib/is_key_like.js';
 import { isJWK } from '../lib/is_jwk.js';
 import { exportJWK } from '../key/export.js';
-import invalidKeyInput from '../lib/invalid_key_input.js';
+import { invalidKeyInput } from '../lib/invalid_key_input.js';
 const check = (value, description) => {
     if (typeof value !== 'string' || !value) {
         throw new JWKInvalid(`${description} missing or invalid`);
@@ -30,6 +30,11 @@ export async function calculateJwkThumbprint(key, digestAlgorithm) {
     }
     let components;
     switch (jwk.kty) {
+        case 'AKP':
+            check(jwk.alg, '"alg" (Algorithm) Parameter');
+            check(jwk.pub, '"pub" (Public key) Parameter');
+            components = { alg: jwk.alg, kty: jwk.kty, pub: jwk.pub };
+            break;
         case 'EC':
             check(jwk.crv, '"crv" (Curve) Parameter');
             check(jwk.x, '"x" (X Coordinate) Parameter');
@@ -53,7 +58,7 @@ export async function calculateJwkThumbprint(key, digestAlgorithm) {
         default:
             throw new JOSENotSupported('"kty" (Key Type) Parameter missing or unsupported');
     }
-    const data = encoder.encode(JSON.stringify(components));
+    const data = encode(JSON.stringify(components));
     return b64u(await digest(digestAlgorithm, data));
 }
 export async function calculateJwkThumbprintUri(key, digestAlgorithm) {

package/dist/webapi/jwks/local.js

@@ -1,6 +1,6 @@
 import { importJWK } from '../key/import.js';
 import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, } from '../util/errors.js';
-import isObject from '../lib/is_object.js';
+import { isObject } from '../lib/is_object.js';
 function getKtyFromAlg(alg) {
     switch (typeof alg === 'string' && alg.slice(0, 2)) {
         case 'RS':
@@ -10,6 +10,8 @@ function getKtyFromAlg(alg) {
             return 'EC';
         case 'Ed':
             return 'OKP';
+        case 'ML':
+            return 'AKP';
         default:
             throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
     }
@@ -43,7 +45,7 @@ class LocalJWKSet {
             if (candidate && typeof kid === 'string') {
                 candidate = kid === jwk.kid;
             }
-            if (candidate && typeof jwk.alg === 'string') {
+            if (candidate && (typeof jwk.alg === 'string' || kty === 'AKP')) {
                 candidate = alg === jwk.alg;
             }
             if (candidate && typeof jwk.use === 'string') {

package/dist/webapi/jwks/remote.js

@@ -1,6 +1,6 @@
 import { JOSEError, JWKSNoMatchingKey, JWKSTimeout } from '../util/errors.js';
 import { createLocalJWKSet } from './local.js';
-import isObject from '../lib/is_object.js';
+import { isObject } from '../lib/is_object.js';
 function isCloudflareWorkers() {
     return (typeof WebSocketPair !== 'undefined' ||
         (typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers') ||
@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v6.0.13';
+    const VERSION = 'v6.1.1';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const customFetch = Symbol();

package/dist/webapi/jws/flattened/sign.js

@@ -1,11 +1,11 @@
 import { encode as b64u } from '../../util/base64url.js';
-import sign from '../../lib/sign.js';
-import isDisjoint from '../../lib/is_disjoint.js';
+import { sign } from '../../lib/sign.js';
+import { isDisjoint } from '../../lib/is_disjoint.js';
 import { JWSInvalid } from '../../util/errors.js';
-import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
-import checkKeyType from '../../lib/check_key_type.js';
-import validateCrit from '../../lib/validate_crit.js';
-import normalizeKey from '../../lib/normalize_key.js';
+import { concat, encode } from '../../lib/buffer_utils.js';
+import { checkKeyType } from '../../lib/check_key_type.js';
+import { validateCrit } from '../../lib/validate_crit.js';
+import { normalizeKey } from '../../lib/normalize_key.js';
 export class FlattenedSign {
     #payload;
     #protectedHeader;
@@ -54,32 +54,38 @@ export class FlattenedSign {
             throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
         }
         checkKeyType(alg, key, 'sign');
-        let payload = this.#payload;
+        let payloadS;
+        let payloadB;
         if (b64) {
-            payload = encoder.encode(b64u(payload));
+            payloadS = b64u(this.#payload);
+            payloadB = encode(payloadS);
         }
-        let protectedHeader;
+        else {
+            payloadB = this.#payload;
+            payloadS = '';
+        }
+        let protectedHeaderString;
+        let protectedHeaderBytes;
         if (this.#protectedHeader) {
-            protectedHeader = encoder.encode(b64u(JSON.stringify(this.#protectedHeader)));
+            protectedHeaderString = b64u(JSON.stringify(this.#protectedHeader));
+            protectedHeaderBytes = encode(protectedHeaderString);
         }
         else {
-            protectedHeader = encoder.encode('');
+            protectedHeaderString = '';
+            protectedHeaderBytes = new Uint8Array();
         }
-        const data = concat(protectedHeader, encoder.encode('.'), payload);
+        const data = concat(protectedHeaderBytes, encode('.'), payloadB);
         const k = await normalizeKey(key, alg);
         const signature = await sign(alg, k, data);
         const jws = {
             signature: b64u(signature),
-            payload: '',
+            payload: payloadS,
         };
-        if (b64) {
-            jws.payload = decoder.decode(payload);
-        }
         if (this.#unprotectedHeader) {
             jws.header = this.#unprotectedHeader;
         }
         if (this.#protectedHeader) {
-            jws.protected = decoder.decode(protectedHeader);
+            jws.protected = protectedHeaderString;
         }
         return jws;
     }

package/dist/webapi/jws/flattened/verify.js

@@ -1,13 +1,13 @@
 import { decode as b64u } from '../../util/base64url.js';
-import verify from '../../lib/verify.js';
+import { verify } from '../../lib/verify.js';
 import { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';
-import { concat, encoder, decoder } from '../../lib/buffer_utils.js';
-import isDisjoint from '../../lib/is_disjoint.js';
-import isObject from '../../lib/is_object.js';
-import checkKeyType from '../../lib/check_key_type.js';
-import validateCrit from '../../lib/validate_crit.js';
-import validateAlgorithms from '../../lib/validate_algorithms.js';
-import normalizeKey from '../../lib/normalize_key.js';
+import { concat, encoder, decoder, encode } from '../../lib/buffer_utils.js';
+import { isDisjoint } from '../../lib/is_disjoint.js';
+import { isObject } from '../../lib/is_object.js';
+import { checkKeyType } from '../../lib/check_key_type.js';
+import { validateCrit } from '../../lib/validate_crit.js';
+import { validateAlgorithms } from '../../lib/validate_algorithms.js';
+import { normalizeKey } from '../../lib/normalize_key.js';
 export async function flattenedVerify(jws, key, options) {
     if (!isObject(jws)) {
         throw new JWSInvalid('Flattened JWS must be an object');
@@ -74,7 +74,11 @@ export async function flattenedVerify(jws, key, options) {
         resolvedKey = true;
     }
     checkKeyType(alg, key, 'verify');
-    const data = concat(encoder.encode(jws.protected ?? ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);
+    const data = concat(jws.protected !== undefined ? encode(jws.protected) : new Uint8Array(), encode('.'), typeof jws.payload === 'string'
+        ? b64
+            ? encode(jws.payload)
+            : encoder.encode(jws.payload)
+        : jws.payload);
     let signature;
     try {
         signature = b64u(jws.signature);

package/dist/webapi/jws/general/verify.js

@@ -1,6 +1,6 @@
 import { flattenedVerify } from '../flattened/verify.js';
 import { JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';
-import isObject from '../../lib/is_object.js';
+import { isObject } from '../../lib/is_object.js';
 export async function generalVerify(jws, key, options) {
     if (!isObject(jws)) {
         throw new JWSInvalid('General JWS must be an object');

package/dist/webapi/key/export.js

@@ -1,5 +1,5 @@
 import { toSPKI as exportPublic, toPKCS8 as exportPrivate } from '../lib/asn1.js';
-import keyToJWK from '../lib/key_to_jwk.js';
+import { keyToJWK } from '../lib/key_to_jwk.js';
 export async function exportSPKI(key) {
     return exportPublic(key);
 }