jose 6.0.13 → 6.1.1

package/dist/webapi/lib/jwt_claims_set.js

@@ -1,9 +1,62 @@
 import { JWTClaimValidationFailed, JWTExpired, JWTInvalid } from '../util/errors.js';
-import { decoder } from './buffer_utils.js';
-import epoch from './epoch.js';
-import secs from './secs.js';
-import isObject from './is_object.js';
-import { encoder } from './buffer_utils.js';
+import { encoder, decoder } from './buffer_utils.js';
+import { isObject } from './is_object.js';
+const epoch = (date) => Math.floor(date.getTime() / 1000);
+const minute = 60;
+const hour = minute * 60;
+const day = hour * 24;
+const week = day * 7;
+const year = day * 365.25;
+const REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
+export function secs(str) {
+    const matched = REGEX.exec(str);
+    if (!matched || (matched[4] && matched[1])) {
+        throw new TypeError('Invalid time period format');
+    }
+    const value = parseFloat(matched[2]);
+    const unit = matched[3].toLowerCase();
+    let numericDate;
+    switch (unit) {
+        case 'sec':
+        case 'secs':
+        case 'second':
+        case 'seconds':
+        case 's':
+            numericDate = Math.round(value);
+            break;
+        case 'minute':
+        case 'minutes':
+        case 'min':
+        case 'mins':
+        case 'm':
+            numericDate = Math.round(value * minute);
+            break;
+        case 'hour':
+        case 'hours':
+        case 'hr':
+        case 'hrs':
+        case 'h':
+            numericDate = Math.round(value * hour);
+            break;
+        case 'day':
+        case 'days':
+        case 'd':
+            numericDate = Math.round(value * day);
+            break;
+        case 'week':
+        case 'weeks':
+        case 'w':
+            numericDate = Math.round(value * week);
+            break;
+        default:
+            numericDate = Math.round(value * year);
+            break;
+    }
+    if (matched[1] === '-' || matched[4] === 'ago') {
+        return -numericDate;
+    }
+    return numericDate;
+}
 function validateInput(label, input) {
     if (!Number.isFinite(input)) {
         throw new TypeError(`Invalid ${label} input`);
@@ -169,7 +222,7 @@ export class JWTClaimsBuilder {
         }
     }
     set iat(value) {
-        if (typeof value === 'undefined') {
+        if (value === undefined) {
             this.#payload.iat = epoch(new Date());
         }
         else if (value instanceof Date) {

package/dist/webapi/lib/key_to_jwk.js

@@ -1,7 +1,7 @@
-import invalidKeyInput from './invalid_key_input.js';
+import { invalidKeyInput } from './invalid_key_input.js';
 import { encode as b64u } from '../util/base64url.js';
 import { isCryptoKey, isKeyObject } from './is_key_like.js';
-export default async function keyToJWK(key) {
+export async function keyToJWK(key) {
     if (isKeyObject(key)) {
         if (key.type === 'secret') {
             key = key.export();
@@ -23,5 +23,9 @@ export default async function keyToJWK(key) {
         throw new TypeError('non-extractable CryptoKey cannot be exported as a JWK');
     }
     const { ext, key_ops, alg, use, ...jwk } = await crypto.subtle.exportKey('jwk', key);
+    if (jwk.kty === 'AKP') {
+        ;
+        jwk.alg = alg;
+    }
     return jwk;
 }

package/dist/webapi/lib/normalize_key.js

@@ -1,6 +1,6 @@
 import { isJWK } from './is_jwk.js';
 import { decode } from '../util/base64url.js';
-import importJWK from './jwk_to_key.js';
+import { jwkToKey } from './jwk_to_key.js';
 import { isCryptoKey, isKeyObject } from './is_key_like.js';
 let cache;
 const handleJWK = async (key, jwk, alg, freeze = false) => {
@@ -9,7 +9,7 @@ const handleJWK = async (key, jwk, alg, freeze = false) => {
     if (cached?.[alg]) {
         return cached[alg];
     }
-    const cryptoKey = await importJWK({ ...jwk, alg });
+    const cryptoKey = await jwkToKey({ ...jwk, alg });
     if (freeze)
         Object.freeze(key);
     if (!cached) {
@@ -49,6 +49,18 @@ const handleKeyObject = (keyObject, alg) => {
             isPublic ? 'verify' : 'sign',
         ]);
     }
+    switch (keyObject.asymmetricKeyType) {
+        case 'ml-dsa-44':
+        case 'ml-dsa-65':
+        case 'ml-dsa-87': {
+            if (alg !== keyObject.asymmetricKeyType.toUpperCase()) {
+                throw new TypeError('given KeyObject instance cannot be used for this algorithm');
+            }
+            cryptoKey = keyObject.toCryptoKey(keyObject.asymmetricKeyType, extractable, [
+                isPublic ? 'verify' : 'sign',
+            ]);
+        }
+    }
     if (keyObject.asymmetricKeyType === 'rsa') {
         let hash;
         switch (alg) {
@@ -130,7 +142,7 @@ const handleKeyObject = (keyObject, alg) => {
     }
     return cryptoKey;
 };
-export default async (key, alg) => {
+export async function normalizeKey(key, alg) {
     if (key instanceof Uint8Array) {
         return key;
     }
@@ -161,4 +173,4 @@ export default async (key, alg) => {
         return handleJWK(key, key, alg, true);
     }
     throw new Error('unreachable');
-};
+}

package/dist/webapi/lib/pbes2kw.js

@@ -1,16 +1,18 @@
 import { encode as b64u } from '../util/base64url.js';
 import * as aeskw from './aeskw.js';
 import { checkEncCryptoKey } from './crypto_key.js';
-import { concat, encoder } from './buffer_utils.js';
+import { concat, encode } from './buffer_utils.js';
 import { JWEInvalid } from '../util/errors.js';
 function getCryptoKey(key, alg) {
     if (key instanceof Uint8Array) {
-        return crypto.subtle.importKey('raw', key, 'PBKDF2', false, ['deriveBits']);
+        return crypto.subtle.importKey('raw', key, 'PBKDF2', false, [
+            'deriveBits',
+        ]);
     }
     checkEncCryptoKey(key, alg, 'deriveBits');
     return key;
 }
-const concatSalt = (alg, p2sInput) => concat(encoder.encode(alg), new Uint8Array([0]), p2sInput);
+const concatSalt = (alg, p2sInput) => concat(encode(alg), Uint8Array.of(0x00), p2sInput);
 async function deriveKey(p2s, alg, p2c, key) {
     if (!(p2s instanceof Uint8Array) || p2s.length < 8) {
         throw new JWEInvalid('PBES2 Salt Input must be 8 or more octets');

package/dist/webapi/lib/rsaes.js

@@ -1,5 +1,5 @@
 import { checkEncCryptoKey } from './crypto_key.js';
-import checkKeyLength from './check_key_length.js';
+import { checkKeyLength } from './check_key_length.js';
 import { JOSENotSupported } from '../util/errors.js';
 const subtleAlgorithm = (alg) => {
     switch (alg) {

package/dist/webapi/lib/sign.js

@@ -1,9 +1,9 @@
-import subtleAlgorithm from './subtle_dsa.js';
-import checkKeyLength from './check_key_length.js';
-import getSignKey from './get_sign_verify_key.js';
-export default async (alg, key, data) => {
-    const cryptoKey = await getSignKey(alg, key, 'sign');
+import { subtleAlgorithm } from './subtle_dsa.js';
+import { checkKeyLength } from './check_key_length.js';
+import { getSigKey } from './get_sign_verify_key.js';
+export async function sign(alg, key, data) {
+    const cryptoKey = await getSigKey(alg, key, 'sign');
     checkKeyLength(alg, cryptoKey);
     const signature = await crypto.subtle.sign(subtleAlgorithm(alg, cryptoKey.algorithm), cryptoKey, data);
     return new Uint8Array(signature);
-};
+}

package/dist/webapi/lib/subtle_dsa.js

@@ -1,5 +1,5 @@
 import { JOSENotSupported } from '../util/errors.js';
-export default (alg, algorithm) => {
+export function subtleAlgorithm(alg, algorithm) {
     const hash = `SHA-${alg.slice(-3)}`;
     switch (alg) {
         case 'HS256':
@@ -21,7 +21,11 @@ export default (alg, algorithm) => {
         case 'Ed25519':
         case 'EdDSA':
             return { name: 'Ed25519' };
+        case 'ML-DSA-44':
+        case 'ML-DSA-65':
+        case 'ML-DSA-87':
+            return { name: alg };
         default:
             throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
     }
-};
+}

package/dist/webapi/lib/validate_algorithms.js

@@ -1,4 +1,4 @@
-export default (option, algorithms) => {
+export function validateAlgorithms(option, algorithms) {
     if (algorithms !== undefined &&
         (!Array.isArray(algorithms) || algorithms.some((s) => typeof s !== 'string'))) {
         throw new TypeError(`"${option}" option must be an array of strings`);
@@ -7,4 +7,4 @@ export default (option, algorithms) => {
         return undefined;
     }
     return new Set(algorithms);
-};
+}

package/dist/webapi/lib/validate_crit.js

@@ -1,5 +1,5 @@
 import { JOSENotSupported, JWEInvalid, JWSInvalid } from '../util/errors.js';
-export default (Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) => {
+export function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader, joseHeader) {
     if (joseHeader.crit !== undefined && protectedHeader?.crit === undefined) {
         throw new Err('"crit" (Critical) Header Parameter MUST be integrity protected');
     }
@@ -30,4 +30,4 @@ export default (Err, recognizedDefault, recognizedOption, protectedHeader, joseH
         }
     }
     return new Set(protectedHeader.crit);
-};
+}

package/dist/webapi/lib/verify.js

@@ -1,8 +1,8 @@
-import subtleAlgorithm from './subtle_dsa.js';
-import checkKeyLength from './check_key_length.js';
-import getVerifyKey from './get_sign_verify_key.js';
-export default async (alg, key, signature, data) => {
-    const cryptoKey = await getVerifyKey(alg, key, 'verify');
+import { subtleAlgorithm } from './subtle_dsa.js';
+import { checkKeyLength } from './check_key_length.js';
+import { getSigKey } from './get_sign_verify_key.js';
+export async function verify(alg, key, signature, data) {
+    const cryptoKey = await getSigKey(alg, key, 'verify');
     checkKeyLength(alg, cryptoKey);
     const algorithm = subtleAlgorithm(alg, cryptoKey.algorithm);
     try {
@@ -11,4 +11,4 @@ export default async (alg, key, signature, data) => {
     catch {
         return false;
     }
-};
+}

package/dist/webapi/util/base64url.js

@@ -10,7 +10,7 @@ export function decode(input) {
     if (encoded instanceof Uint8Array) {
         encoded = decoder.decode(encoded);
     }
-    encoded = encoded.replace(/-/g, '+').replace(/_/g, '/').replace(/\s/g, '');
+    encoded = encoded.replace(/-/g, '+').replace(/_/g, '/');
     try {
         return decodeBase64(encoded);
     }

package/dist/webapi/util/decode_jwt.js

@@ -1,6 +1,6 @@
 import { decode as b64u } from './base64url.js';
 import { decoder } from '../lib/buffer_utils.js';
-import isObject from '../lib/is_object.js';
+import { isObject } from '../lib/is_object.js';
 import { JWTInvalid } from './errors.js';
 export function decodeJwt(jwt) {
     if (typeof jwt !== 'string')

package/dist/webapi/util/decode_protected_header.js

@@ -1,6 +1,6 @@
 import { decode as b64u } from './base64url.js';
 import { decoder } from '../lib/buffer_utils.js';
-import isObject from '../lib/is_object.js';
+import { isObject } from '../lib/is_object.js';
 export function decodeProtectedHeader(token) {
     let protectedB64u;
     if (typeof token === 'string') {

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "jose",
-  "version": "6.0.13",
+  "version": "6.1.1",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
+    "akp",
     "browser",
     "bun",
     "cloudflare",
@@ -29,8 +30,9 @@
     "jwk",
     "jwks",
     "jws",
-    "jwt",
     "jwt-decode",
+    "jwt",
+    "ml-dsa",
     "netlify",
     "next",
     "nextjs",

package/dist/webapi/lib/epoch.js

@@ -1 +0,0 @@
-export default (date) => Math.floor(date.getTime() / 1000);

package/dist/webapi/lib/secs.js

@@ -1,55 +0,0 @@
-const minute = 60;
-const hour = minute * 60;
-const day = hour * 24;
-const week = day * 7;
-const year = day * 365.25;
-const REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
-export default (str) => {
-    const matched = REGEX.exec(str);
-    if (!matched || (matched[4] && matched[1])) {
-        throw new TypeError('Invalid time period format');
-    }
-    const value = parseFloat(matched[2]);
-    const unit = matched[3].toLowerCase();
-    let numericDate;
-    switch (unit) {
-        case 'sec':
-        case 'secs':
-        case 'second':
-        case 'seconds':
-        case 's':
-            numericDate = Math.round(value);
-            break;
-        case 'minute':
-        case 'minutes':
-        case 'min':
-        case 'mins':
-        case 'm':
-            numericDate = Math.round(value * minute);
-            break;
-        case 'hour':
-        case 'hours':
-        case 'hr':
-        case 'hrs':
-        case 'h':
-            numericDate = Math.round(value * hour);
-            break;
-        case 'day':
-        case 'days':
-        case 'd':
-            numericDate = Math.round(value * day);
-            break;
-        case 'week':
-        case 'weeks':
-        case 'w':
-            numericDate = Math.round(value * week);
-            break;
-        default:
-            numericDate = Math.round(value * year);
-            break;
-    }
-    if (matched[1] === '-' || matched[4] === 'ago') {
-        return -numericDate;
-    }
-    return numericDate;
-};