jose 6.0.13 → 6.1.1

package/dist/webapi/key/generate_key_pair.js

@@ -16,7 +16,7 @@ export async function generateKeyPair(alg, options) {
             algorithm = {
                 name: 'RSA-PSS',
                 hash: `SHA-${alg.slice(-3)}`,
-                publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
+                publicExponent: Uint8Array.of(0x01, 0x00, 0x01),
                 modulusLength: getModulusLengthOption(options),
             };
             keyUsages = ['sign', 'verify'];
@@ -27,7 +27,7 @@ export async function generateKeyPair(alg, options) {
             algorithm = {
                 name: 'RSASSA-PKCS1-v1_5',
                 hash: `SHA-${alg.slice(-3)}`,
-                publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
+                publicExponent: Uint8Array.of(0x01, 0x00, 0x01),
                 modulusLength: getModulusLengthOption(options),
             };
             keyUsages = ['sign', 'verify'];
@@ -39,7 +39,7 @@ export async function generateKeyPair(alg, options) {
             algorithm = {
                 name: 'RSA-OAEP',
                 hash: `SHA-${parseInt(alg.slice(-3), 10) || 1}`,
-                publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
+                publicExponent: Uint8Array.of(0x01, 0x00, 0x01),
                 modulusLength: getModulusLengthOption(options),
             };
             keyUsages = ['decrypt', 'unwrapKey', 'encrypt', 'wrapKey'];
@@ -62,6 +62,13 @@ export async function generateKeyPair(alg, options) {
             algorithm = { name: 'Ed25519' };
             break;
         }
+        case 'ML-DSA-44':
+        case 'ML-DSA-65':
+        case 'ML-DSA-87': {
+            keyUsages = ['sign', 'verify'];
+            algorithm = { name: alg };
+            break;
+        }
         case 'ECDH-ES':
         case 'ECDH-ES+A128KW':
         case 'ECDH-ES+A192KW':

package/dist/webapi/key/import.js

@@ -1,8 +1,8 @@
 import { decode as decodeBase64URL } from '../util/base64url.js';
 import { fromSPKI, fromPKCS8, fromX509 } from '../lib/asn1.js';
-import toCryptoKey from '../lib/jwk_to_key.js';
+import { jwkToKey } from '../lib/jwk_to_key.js';
 import { JOSENotSupported } from '../util/errors.js';
-import isObject from '../lib/is_object.js';
+import { isObject } from '../lib/is_object.js';
 export async function importSPKI(spki, alg, options) {
     if (typeof spki !== 'string' || spki.indexOf('-----BEGIN PUBLIC KEY-----') !== 0) {
         throw new TypeError('"spki" must be SPKI formatted string');
@@ -38,9 +38,19 @@ export async function importJWK(jwk, alg, options) {
             if ('oth' in jwk && jwk.oth !== undefined) {
                 throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
             }
+            return jwkToKey({ ...jwk, alg, ext });
+        case 'AKP': {
+            if (typeof jwk.alg !== 'string' || !jwk.alg) {
+                throw new TypeError('missing "alg" (Algorithm) Parameter value');
+            }
+            if (alg !== undefined && alg !== jwk.alg) {
+                throw new TypeError('JWK alg and alg option value mismatch');
+            }
+            return jwkToKey({ ...jwk, ext });
+        }
         case 'EC':
         case 'OKP':
-            return toCryptoKey({ ...jwk, alg, ext });
+            return jwkToKey({ ...jwk, alg, ext });
         default:
             throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
     }

package/dist/webapi/lib/aesgcmkw.js

@@ -1,9 +1,9 @@
-import encrypt from './encrypt.js';
-import decrypt from './decrypt.js';
+import { encrypt } from './encrypt.js';
+import { decrypt } from './decrypt.js';
 import { encode as b64u } from '../util/base64url.js';
 export async function wrap(alg, key, cek, iv) {
     const jweAlgorithm = alg.slice(0, 7);
-    const wrapped = await encrypt(jweAlgorithm, cek, key, iv, new Uint8Array(0));
+    const wrapped = await encrypt(jweAlgorithm, cek, key, iv, new Uint8Array());
     return {
         encryptedKey: wrapped.ciphertext,
         iv: b64u(wrapped.iv),
@@ -12,5 +12,5 @@ export async function wrap(alg, key, cek, iv) {
 }
 export async function unwrap(alg, key, encryptedKey, iv, tag) {
     const jweAlgorithm = alg.slice(0, 7);
-    return decrypt(jweAlgorithm, key, encryptedKey, iv, tag, new Uint8Array(0));
+    return decrypt(jweAlgorithm, key, encryptedKey, iv, tag, new Uint8Array());
 }

package/dist/webapi/lib/asn1.js

@@ -1,4 +1,4 @@
-import invalidKeyInput from './invalid_key_input.js';
+import { invalidKeyInput } from './invalid_key_input.js';
 import { encodeBase64, decodeBase64 } from '../lib/base64.js';
 import { JOSENotSupported } from '../util/errors.js';
 import { isCryptoKey, isKeyObject } from './is_key_like.js';
@@ -24,12 +24,8 @@ const genericExport = async (keyType, keyFormat, key) => {
     }
     return formatPEM(encodeBase64(new Uint8Array(await crypto.subtle.exportKey(keyFormat, key))), `${keyType.toUpperCase()} KEY`);
 };
-export const toSPKI = (key) => {
-    return genericExport('public', 'spki', key);
-};
-export const toPKCS8 = (key) => {
-    return genericExport('private', 'pkcs8', key);
-};
+export const toSPKI = (key) => genericExport('public', 'spki', key);
+export const toPKCS8 = (key) => genericExport('private', 'pkcs8', key);
 const bytesEqual = (a, b) => {
     if (a.byteLength !== b.length)
         return false;
@@ -174,6 +170,12 @@ const genericImport = async (keyFormat, keyData, alg, options) => {
             algorithm = { name: 'Ed25519' };
             keyUsages = getSigUsages();
             break;
+        case 'ML-DSA-44':
+        case 'ML-DSA-65':
+        case 'ML-DSA-87':
+            algorithm = { name: alg };
+            keyUsages = getSigUsages();
+            break;
         default:
             throw new JOSENotSupported('Invalid or unsupported "alg" (Algorithm) value');
     }

package/dist/webapi/lib/buffer_utils.js

@@ -30,3 +30,14 @@ export function uint32be(value) {
     writeUInt32BE(buf, value);
     return buf;
 }
+export function encode(string) {
+    const bytes = new Uint8Array(string.length);
+    for (let i = 0; i < string.length; i++) {
+        const code = string.charCodeAt(i);
+        if (code > 127) {
+            throw new TypeError('non-ASCII string encountered in encode()');
+        }
+        bytes[i] = code;
+    }
+    return bytes;
+}

package/dist/webapi/lib/cek.js

@@ -1,5 +1,5 @@
 import { JOSENotSupported } from '../util/errors.js';
-export function bitLength(alg) {
+export function cekLength(alg) {
     switch (alg) {
         case 'A128GCM':
             return 128;
@@ -16,4 +16,4 @@ export function bitLength(alg) {
             throw new JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }
 }
-export default (alg) => crypto.getRandomValues(new Uint8Array(bitLength(alg) >> 3));
+export const generateCek = (alg) => crypto.getRandomValues(new Uint8Array(cekLength(alg) >> 3));

package/dist/webapi/lib/check_cek_length.js

@@ -1,7 +1,7 @@
 import { JWEInvalid } from '../util/errors.js';
-export default (cek, expected) => {
+export function checkCekLength(cek, expected) {
     const actual = cek.byteLength << 3;
     if (actual !== expected) {
         throw new JWEInvalid(`Invalid Content Encryption Key length. Expected ${expected} bits, got ${actual} bits`);
     }
-};
+}

package/dist/webapi/lib/check_iv_length.js

@@ -1,7 +1,7 @@
 import { JWEInvalid } from '../util/errors.js';
 import { bitLength } from './iv.js';
-export default (enc, iv) => {
+export function checkIvLength(enc, iv) {
     if (iv.length << 3 !== bitLength(enc)) {
         throw new JWEInvalid('Invalid Initialization Vector length');
     }
-};
+}

package/dist/webapi/lib/check_key_length.js

@@ -1,8 +1,8 @@
-export default (alg, key) => {
+export function checkKeyLength(alg, key) {
     if (alg.startsWith('RS') || alg.startsWith('PS')) {
         const { modulusLength } = key.algorithm;
         if (typeof modulusLength !== 'number' || modulusLength < 2048) {
             throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
         }
     }
-};
+}

package/dist/webapi/lib/check_key_type.js

@@ -1,5 +1,5 @@
 import { withAlg as invalidKeyInput } from './invalid_key_input.js';
-import isKeyLike from './is_key_like.js';
+import { isKeyLike } from './is_key_like.js';
 import * as jwk from './is_jwk.js';
 const tag = (key) => key?.[Symbol.toStringTag];
 const jwkMatchesOp = (alg, key, usage) => {
@@ -96,8 +96,6 @@ const asymmetricTypeCheck = (alg, key, usage) => {
                 throw new TypeError(`${tag(key)} instances for asymmetric algorithm signing must be of type "private"`);
             case 'decrypt':
                 throw new TypeError(`${tag(key)} instances for asymmetric algorithm decryption must be of type "private"`);
-            default:
-                break;
         }
     }
     if (key.type === 'private') {
@@ -106,21 +104,19 @@ const asymmetricTypeCheck = (alg, key, usage) => {
                 throw new TypeError(`${tag(key)} instances for asymmetric algorithm verifying must be of type "public"`);
             case 'encrypt':
                 throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type "public"`);
-            default:
-                break;
         }
     }
 };
-export default (alg, key, usage) => {
-    const symmetric = alg.startsWith('HS') ||
-        alg === 'dir' ||
-        alg.startsWith('PBES2') ||
-        /^A(?:128|192|256)(?:GCM)?(?:KW)?$/.test(alg) ||
-        /^A(?:128|192|256)CBC-HS(?:256|384|512)$/.test(alg);
-    if (symmetric) {
-        symmetricTypeCheck(alg, key, usage);
+export function checkKeyType(alg, key, usage) {
+    switch (alg.substring(0, 2)) {
+        case 'A1':
+        case 'A2':
+        case 'di':
+        case 'HS':
+        case 'PB':
+            symmetricTypeCheck(alg, key, usage);
+            break;
+        default:
+            asymmetricTypeCheck(alg, key, usage);
     }
-    else {
-        asymmetricTypeCheck(alg, key, usage);
-    }
-};
+}

package/dist/webapi/lib/crypto_key.js

@@ -1,9 +1,5 @@
-function unusable(name, prop = 'algorithm.name') {
-    return new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-}
-function isAlgorithm(algorithm, name) {
-    return algorithm.name === name;
-}
+const unusable = (name, prop = 'algorithm.name') => new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+const isAlgorithm = (algorithm, name) => algorithm.name === name;
 function getHashLength(hash) {
     return parseInt(hash.name.slice(4), 10);
 }
@@ -65,6 +61,13 @@ export function checkSigCryptoKey(key, alg, usage) {
                 throw unusable('Ed25519');
             break;
         }
+        case 'ML-DSA-44':
+        case 'ML-DSA-65':
+        case 'ML-DSA-87': {
+            if (!isAlgorithm(key.algorithm, alg))
+                throw unusable(alg);
+            break;
+        }
         case 'ES256':
         case 'ES384':
         case 'ES512': {

package/dist/webapi/lib/decrypt.js

@@ -1,9 +1,9 @@
 import { concat, uint64be } from './buffer_utils.js';
-import checkIvLength from './check_iv_length.js';
-import checkCekLength from './check_cek_length.js';
+import { checkIvLength } from './check_iv_length.js';
+import { checkCekLength } from './check_cek_length.js';
 import { JOSENotSupported, JWEDecryptionFailed, JWEInvalid } from '../util/errors.js';
 import { checkEncCryptoKey } from './crypto_key.js';
-import invalidKeyInput from './invalid_key_input.js';
+import { invalidKeyInput } from './invalid_key_input.js';
 import { isCryptoKey } from './is_key_like.js';
 async function timingSafeEqual(a, b) {
     if (!(a instanceof Uint8Array)) {
@@ -46,7 +46,7 @@ async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
     }
     let plaintext;
     try {
-        plaintext = new Uint8Array(await crypto.subtle.decrypt({ iv, name: 'AES-CBC' }, encKey, ciphertext));
+        plaintext = new Uint8Array(await crypto.subtle.decrypt({ iv: iv, name: 'AES-CBC' }, encKey, ciphertext));
     }
     catch {
     }
@@ -67,7 +67,7 @@ async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
     try {
         return new Uint8Array(await crypto.subtle.decrypt({
             additionalData: aad,
-            iv,
+            iv: iv,
             name: 'AES-GCM',
             tagLength: 128,
         }, encKey, concat(ciphertext, tag)));
@@ -76,7 +76,7 @@ async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
         throw new JWEDecryptionFailed();
     }
 }
-export default async (enc, cek, ciphertext, iv, tag, aad) => {
+export async function decrypt(enc, cek, ciphertext, iv, tag, aad) {
     if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) {
         throw new TypeError(invalidKeyInput(cek, 'CryptoKey', 'KeyObject', 'Uint8Array', 'JSON Web Key'));
     }
@@ -103,4 +103,4 @@ export default async (enc, cek, ciphertext, iv, tag, aad) => {
         default:
             throw new JOSENotSupported('Unsupported JWE Content Encryption Algorithm');
     }
-};
+}

package/dist/webapi/lib/decrypt_key_management.js

@@ -4,12 +4,12 @@ import * as pbes2kw from './pbes2kw.js';
 import * as rsaes from './rsaes.js';
 import { decode as b64u } from '../util/base64url.js';
 import { JOSENotSupported, JWEInvalid } from '../util/errors.js';
-import { bitLength as cekLength } from '../lib/cek.js';
+import { cekLength } from '../lib/cek.js';
 import { importJWK } from '../key/import.js';
-import isObject from './is_object.js';
+import { isObject } from './is_object.js';
 import { unwrap as aesGcmKw } from './aesgcmkw.js';
 import { assertCryptoKey } from './is_key_like.js';
-export default async (alg, key, encryptedKey, joseHeader, options) => {
+export async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options) {
     switch (alg) {
         case 'dir': {
             if (encryptedKey !== undefined)
@@ -124,4 +124,4 @@ export default async (alg, key, encryptedKey, joseHeader, options) => {
             throw new JOSENotSupported('Invalid or unsupported "alg" (JWE Algorithm) header value');
         }
     }
-};
+}

package/dist/webapi/lib/digest.js

@@ -1,4 +1,4 @@
-export default async (algorithm, data) => {
+export async function digest(algorithm, data) {
     const subtleDigest = `SHA-${algorithm.slice(-3)}`;
     return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));
-};
+}

package/dist/webapi/lib/ecdhes.js

@@ -1,6 +1,6 @@
-import { encoder, concat, uint32be } from './buffer_utils.js';
+import { encode, concat, uint32be } from './buffer_utils.js';
 import { checkEncCryptoKey } from './crypto_key.js';
-import digest from './digest.js';
+import { digest } from './digest.js';
 function lengthAndInput(input) {
     return concat(uint32be(input.length), input);
 }
@@ -19,14 +19,14 @@ async function concatKdf(Z, L, OtherInfo) {
     }
     return dk.slice(0, dkLen);
 }
-export async function deriveKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) {
+export async function deriveKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(), apv = new Uint8Array()) {
     checkEncCryptoKey(publicKey, 'ECDH');
     checkEncCryptoKey(privateKey, 'ECDH', 'deriveBits');
-    const algorithmID = lengthAndInput(encoder.encode(algorithm));
+    const algorithmID = lengthAndInput(encode(algorithm));
     const partyUInfo = lengthAndInput(apu);
     const partyVInfo = lengthAndInput(apv);
     const suppPubInfo = uint32be(keyLength);
-    const suppPrivInfo = new Uint8Array(0);
+    const suppPrivInfo = new Uint8Array();
     const otherInfo = concat(algorithmID, partyUInfo, partyVInfo, suppPubInfo, suppPrivInfo);
     const Z = new Uint8Array(await crypto.subtle.deriveBits({
         name: publicKey.algorithm.name,

package/dist/webapi/lib/encrypt.js

@@ -1,9 +1,9 @@
 import { concat, uint64be } from './buffer_utils.js';
-import checkIvLength from './check_iv_length.js';
-import checkCekLength from './check_cek_length.js';
+import { checkIvLength } from './check_iv_length.js';
+import { checkCekLength } from './check_cek_length.js';
 import { checkEncCryptoKey } from './crypto_key.js';
-import invalidKeyInput from './invalid_key_input.js';
-import generateIv from './iv.js';
+import { invalidKeyInput } from './invalid_key_input.js';
+import { generateIv } from './iv.js';
 import { JOSENotSupported } from '../util/errors.js';
 import { isCryptoKey } from './is_key_like.js';
 async function cbcEncrypt(enc, plaintext, cek, iv, aad) {
@@ -17,7 +17,7 @@ async function cbcEncrypt(enc, plaintext, cek, iv, aad) {
         name: 'HMAC',
     }, false, ['sign']);
     const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
-        iv,
+        iv: iv,
         name: 'AES-CBC',
     }, encKey, plaintext));
     const macData = concat(aad, iv, ciphertext, uint64be(aad.length << 3));
@@ -35,7 +35,7 @@ async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
     }
     const encrypted = new Uint8Array(await crypto.subtle.encrypt({
         additionalData: aad,
-        iv,
+        iv: iv,
         name: 'AES-GCM',
         tagLength: 128,
     }, encKey, plaintext));
@@ -43,7 +43,7 @@ async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
     const ciphertext = encrypted.slice(0, -16);
     return { ciphertext, tag, iv };
 }
-export default async (enc, plaintext, cek, iv, aad) => {
+export async function encrypt(enc, plaintext, cek, iv, aad) {
     if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) {
         throw new TypeError(invalidKeyInput(cek, 'CryptoKey', 'KeyObject', 'Uint8Array', 'JSON Web Key'));
     }
@@ -71,4 +71,4 @@ export default async (enc, plaintext, cek, iv, aad) => {
         default:
             throw new JOSENotSupported('Unsupported JWE Content Encryption Algorithm');
     }
-};
+}

package/dist/webapi/lib/encrypt_key_management.js

@@ -3,13 +3,13 @@ import * as ecdhes from './ecdhes.js';
 import * as pbes2kw from './pbes2kw.js';
 import * as rsaes from './rsaes.js';
 import { encode as b64u } from '../util/base64url.js';
-import normalizeKey from './normalize_key.js';
-import generateCek, { bitLength as cekLength } from '../lib/cek.js';
+import { normalizeKey } from './normalize_key.js';
+import { generateCek, cekLength } from '../lib/cek.js';
 import { JOSENotSupported } from '../util/errors.js';
 import { exportJWK } from '../key/export.js';
 import { wrap as aesGcmKw } from './aesgcmkw.js';
 import { assertCryptoKey } from './is_key_like.js';
-export default async (alg, enc, key, providedCek, providedParameters = {}) => {
+export async function encryptKeyManagement(alg, enc, key, providedCek, providedParameters = {}) {
     let encryptedKey;
     let parameters;
     let cek;
@@ -89,4 +89,4 @@ export default async (alg, enc, key, providedCek, providedParameters = {}) => {
         }
     }
     return { cek, encryptedKey, parameters };
-};
+}

package/dist/webapi/lib/get_sign_verify_key.js

@@ -1,6 +1,6 @@
 import { checkSigCryptoKey } from './crypto_key.js';
-import invalidKeyInput from './invalid_key_input.js';
-export default async (alg, key, usage) => {
+import { invalidKeyInput } from './invalid_key_input.js';
+export async function getSigKey(alg, key, usage) {
     if (key instanceof Uint8Array) {
         if (!alg.startsWith('HS')) {
             throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
@@ -9,4 +9,4 @@ export default async (alg, key, usage) => {
     }
     checkSigCryptoKey(key, alg, usage);
     return key;
-};
+}

package/dist/webapi/lib/invalid_key_input.js

@@ -23,9 +23,5 @@ function message(msg, actual, ...types) {
     }
     return msg;
 }
-export default (actual, ...types) => {
-    return message('Key must be ', actual, ...types);
-};
-export function withAlg(alg, actual, ...types) {
-    return message(`Key for the ${alg} algorithm must be `, actual, ...types);
-}
+export const invalidKeyInput = (actual, ...types) => message('Key must be ', actual, ...types);
+export const withAlg = (alg, actual, ...types) => message(`Key for the ${alg} algorithm must be `, actual, ...types);

package/dist/webapi/lib/is_disjoint.js

@@ -1,4 +1,4 @@
-export default (...headers) => {
+export function isDisjoint(...headers) {
     const sources = headers.filter(Boolean);
     if (sources.length === 0 || sources.length === 1) {
         return true;
@@ -18,4 +18,4 @@ export default (...headers) => {
         }
     }
     return true;
-};
+}

package/dist/webapi/lib/is_jwk.js

@@ -1,13 +1,6 @@
-import isObject from './is_object.js';
-export function isJWK(key) {
-    return isObject(key) && typeof key.kty === 'string';
-}
-export function isPrivateJWK(key) {
-    return key.kty !== 'oct' && typeof key.d === 'string';
-}
-export function isPublicJWK(key) {
-    return key.kty !== 'oct' && typeof key.d === 'undefined';
-}
-export function isSecretJWK(key) {
-    return key.kty === 'oct' && typeof key.k === 'string';
-}
+import { isObject } from './is_object.js';
+export const isJWK = (key) => isObject(key) && typeof key.kty === 'string';
+export const isPrivateJWK = (key) => key.kty !== 'oct' &&
+    ((key.kty === 'AKP' && typeof key.priv === 'string') || typeof key.d === 'string');
+export const isPublicJWK = (key) => key.kty !== 'oct' && key.d === undefined && key.priv === undefined;
+export const isSecretJWK = (key) => key.kty === 'oct' && typeof key.k === 'string';

package/dist/webapi/lib/is_key_like.js

@@ -3,12 +3,6 @@ export function assertCryptoKey(key) {
         throw new Error('CryptoKey instance expected');
     }
 }
-export function isCryptoKey(key) {
-    return key?.[Symbol.toStringTag] === 'CryptoKey';
-}
-export function isKeyObject(key) {
-    return key?.[Symbol.toStringTag] === 'KeyObject';
-}
-export default (key) => {
-    return isCryptoKey(key) || isKeyObject(key);
-};
+export const isCryptoKey = (key) => key?.[Symbol.toStringTag] === 'CryptoKey';
+export const isKeyObject = (key) => key?.[Symbol.toStringTag] === 'KeyObject';
+export const isKeyLike = (key) => isCryptoKey(key) || isKeyObject(key);

package/dist/webapi/lib/is_object.js

@@ -1,7 +1,5 @@
-function isObjectLike(value) {
-    return typeof value === 'object' && value !== null;
-}
-export default (input) => {
+const isObjectLike = (value) => typeof value === 'object' && value !== null;
+export function isObject(input) {
     if (!isObjectLike(input) || Object.prototype.toString.call(input) !== '[object Object]') {
         return false;
     }
@@ -13,4 +11,4 @@ export default (input) => {
         proto = Object.getPrototypeOf(proto);
     }
     return Object.getPrototypeOf(input) === proto;
-};
+}

package/dist/webapi/lib/iv.js

@@ -16,4 +16,4 @@ export function bitLength(alg) {
             throw new JOSENotSupported(`Unsupported JWE Algorithm: ${alg}`);
     }
 }
-export default (alg) => crypto.getRandomValues(new Uint8Array(bitLength(alg) >> 3));
+export const generateIv = (alg) => crypto.getRandomValues(new Uint8Array(bitLength(alg) >> 3));

package/dist/webapi/lib/jwk_to_key.js

@@ -3,6 +3,19 @@ function subtleMapping(jwk) {
     let algorithm;
     let keyUsages;
     switch (jwk.kty) {
+        case 'AKP': {
+            switch (jwk.alg) {
+                case 'ML-DSA-44':
+                case 'ML-DSA-65':
+                case 'ML-DSA-87':
+                    algorithm = { name: jwk.alg };
+                    keyUsages = jwk.priv ? ['sign'] : ['verify'];
+                    break;
+                default:
+                    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+            }
+            break;
+        }
         case 'RSA': {
             switch (jwk.alg) {
                 case 'PS256':
@@ -82,13 +95,15 @@ function subtleMapping(jwk) {
     }
     return { algorithm, keyUsages };
 }
-export default async (jwk) => {
+export async function jwkToKey(jwk) {
     if (!jwk.alg) {
         throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
     }
     const { algorithm, keyUsages } = subtleMapping(jwk);
     const keyData = { ...jwk };
-    delete keyData.alg;
+    if (keyData.kty !== 'AKP') {
+        delete keyData.alg;
+    }
     delete keyData.use;
-    return crypto.subtle.importKey('jwk', keyData, algorithm, jwk.ext ?? (jwk.d ? false : true), jwk.key_ops ?? keyUsages);
-};
+    return crypto.subtle.importKey('jwk', keyData, algorithm, jwk.ext ?? (jwk.d || jwk.priv ? false : true), jwk.key_ops ?? keyUsages);
+}