jose 6.0.3 → 6.0.5

package/dist/types/index.d.ts

@@ -45,4 +45,10 @@ export { generateSecret } from './key/generate_secret.js';
 export type { GenerateSecretOptions } from './key/generate_secret.js';
 export * as base64url from './util/base64url.js';
 export type { CompactDecryptResult, CompactJWEHeaderParameters, CompactJWSHeaderParameters, CompactVerifyResult, CritOption, CryptoKey, DecryptOptions, EncryptOptions, FlattenedDecryptResult, FlattenedJWE, FlattenedJWS, FlattenedJWSInput, FlattenedVerifyResult, GeneralDecryptResult, GeneralJWE, GeneralJWS, GeneralJWSInput, GeneralVerifyResult, GetKeyFunction, JoseHeaderParameters, JSONWebKeySet, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWK_EC_Private, JWK_EC_Public, JWK_oct, JWK_OKP_Private, JWK_OKP_Public, JWK_RSA_Private, JWK_RSA_Public, JWK, JWKParameters, JWSHeaderParameters, JWTClaimVerificationOptions, JWTDecryptResult, JWTHeaderParameters, JWTPayload, JWTVerifyResult, KeyObject, ResolvedKey, SignOptions, VerifyOptions, } from './types.d.ts';
+/**
+ * In prior releases this indicated whether a Node.js-specific build was loaded, this is now fixed
+ * to `"WebCryptoAPI"`
+ *
+ * @deprecated
+ */
 export declare const cryptoRuntime = "WebCryptoAPI";

package/dist/types/jwe/general/encrypt.d.ts

@@ -4,6 +4,7 @@
  * @module
  */
 import type * as types from '../../types.d.ts';
+/** Used to build General JWE object's individual recipients. */
 export interface Recipient {
     /**
      * Sets the JWE Per-Recipient Unprotected Header on the Recipient object.

package/dist/types/jws/general/sign.d.ts

@@ -4,6 +4,7 @@
  * @module
  */
 import type * as types from '../../types.d.ts';
+/** Used to build General JWS object's individual signatures. */
 export interface Signature {
     /**
      * Sets the JWS Protected Header on the Signature object.

package/dist/types/jwt/unsecured.d.ts

@@ -5,6 +5,7 @@
  */
 import type * as types from '../types.d.ts';
 import { ProduceJWT } from './produce.js';
+/** Result of decoding an Unsecured JWT. */
 export interface UnsecuredResult<PayloadType = types.JWTPayload> {
     payload: PayloadType & types.JWTPayload;
     header: types.JWSHeaderParameters;

package/dist/types/key/generate_key_pair.d.ts

@@ -4,12 +4,14 @@
  * @module
  */
 import type * as types from '../types.d.ts';
+/** Asymmetric key pair generation function result. */
 export interface GenerateKeyPairResult {
     /** The generated Private Key. */
     privateKey: types.CryptoKey;
     /** Public Key corresponding to the generated Private Key. */
     publicKey: types.CryptoKey;
 }
+/** Asymmetric key pair generation function options. */
 export interface GenerateKeyPairOptions {
     /**
      * The EC "crv" (Curve) or OKP "crv" (Subtype of Key Pair) value to generate. The curve must be

package/dist/types/key/generate_secret.d.ts

@@ -4,6 +4,7 @@
  * @module
  */
 import type * as types from '../types.d.ts';
+/** Secret generation function options. */
 export interface GenerateSecretOptions {
     /** The value to use as {@link !SubtleCrypto.generateKey} `extractable` argument. Default is false. */
     extractable?: boolean;

package/dist/types/key/import.d.ts

@@ -4,6 +4,7 @@
  * @module
  */
 import type * as types from '../types.d.ts';
+/** Key Import Function options. */
 export interface KeyImportOptions {
     /**
      * The value to use as {@link !SubtleCrypto.importKey} `extractable` argument. Default is false for

package/dist/types/types.d.ts

@@ -1,7 +1,7 @@
 /** Generic JSON Web Key Parameters. */
 export interface JWKParameters {
   /** JWK "kty" (Key Type) Parameter */
-  kty: string
+  kty?: string
   /**
    * JWK "alg" (Algorithm) Parameter
    *
@@ -216,8 +216,8 @@ export interface GeneralJWSInput {
 }
 
 /**
- * Flattened JWS definition. Payload is returned as an empty string when JWS Unencoded Payload
- * ({@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}) is used.
+ * Flattened JWS JSON Serialization Syntax token. Payload is returned as an empty string when JWS
+ * Unencoded Payload ({@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}) is used.
  */
 export interface FlattenedJWS extends Partial<FlattenedJWSInput> {
   payload: string
@@ -225,8 +225,8 @@ export interface FlattenedJWS extends Partial<FlattenedJWSInput> {
 }
 
 /**
- * General JWS definition. Payload is returned as an empty string when JWS Unencoded Payload
- * ({@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}) is used.
+ * General JWS JSON Serialization Syntax token. Payload is returned as an empty string when JWS
+ * Unencoded Payload ({@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}) is used.
  */
 export interface GeneralJWS {
   payload: string
@@ -307,7 +307,7 @@ export interface JWEKeyManagementHeaderParameters {
   epk?: CryptoKey | KeyObject
 }
 
-/** Flattened JWE definition. */
+/** Flattened JWE JSON Serialization Syntax token. */
 export interface FlattenedJWE {
   /**
    * The "aad" member MUST be present and contain the value BASE64URL(JWE AAD)) when the JWE AAD
@@ -361,6 +361,7 @@ export interface FlattenedJWE {
   unprotected?: JWEHeaderParameters
 }
 
+/** General JWE JSON Serialization Syntax token. */
 export interface GeneralJWE extends Omit<FlattenedJWE, 'encrypted_key' | 'header'> {
   recipients: Pick<FlattenedJWE, 'encrypted_key' | 'header'>[]
 }
@@ -647,6 +648,7 @@ export interface JWTDecryptResult<PayloadType = JWTPayload> {
   protectedHeader: CompactJWEHeaderParameters
 }
 
+/** When key resolver functions are used this becomes part of successful resolves */
 export interface ResolvedKey {
   /** Key resolved from the key resolver function. */
   key: CryptoKey | Uint8Array

package/dist/webapi/jwks/remote.js

@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v6.0.3';
+    const VERSION = 'v6.0.5';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const customFetch = Symbol();

package/dist/webapi/lib/asn1.js

@@ -185,11 +185,17 @@ function spkiFromX509(buf) {
     const tbsCertificate = getElement(getElement(parseElement(buf).contents)[0].contents);
     return encodeBase64(tbsCertificate[tbsCertificate[0].raw[0] === 0xa0 ? 6 : 5].raw);
 }
-let X509Certificate;
+let createPublicKey;
 function getSPKI(x509) {
-    if ((X509Certificate ||= globalThis.process?.getBuiltinModule?.('node:crypto')?.X509Certificate)) {
+    try {
+        createPublicKey ??= globalThis.process?.getBuiltinModule?.('node:crypto')?.createPublicKey;
+    }
+    catch {
+        createPublicKey = 0;
+    }
+    if (createPublicKey) {
         try {
-            return new X509Certificate(x509).publicKey.export({ format: 'pem', type: 'spki' });
+            return new createPublicKey(x509).export({ format: 'pem', type: 'spki' });
         }
         catch { }
     }

package/dist/webapi/lib/base64url.js

@@ -1,26 +1,29 @@
-import { encoder, decoder, Buffer } from '../lib/buffer_utils.js';
+import { encoder, decoder } from '../lib/buffer_utils.js';
 export function encodeBase64(input) {
-    if (Buffer)
-        return Buffer.from(input).toString('base64');
-    let unencoded = input;
-    if (typeof unencoded === 'string') {
-        unencoded = encoder.encode(unencoded);
+    if (Uint8Array.prototype.toBase64) {
+        return input.toBase64();
     }
     const CHUNK_SIZE = 0x8000;
     const arr = [];
-    for (let i = 0; i < unencoded.length; i += CHUNK_SIZE) {
-        arr.push(String.fromCharCode.apply(null, unencoded.subarray(i, i + CHUNK_SIZE)));
+    for (let i = 0; i < input.length; i += CHUNK_SIZE) {
+        arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
     }
     return btoa(arr.join(''));
 }
 export function encode(input) {
-    if (Buffer)
-        return Buffer.from(input).toString('base64url');
-    return encodeBase64(input).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+    let unencoded = input;
+    if (typeof unencoded === 'string') {
+        unencoded = encoder.encode(unencoded);
+    }
+    if (Uint8Array.prototype.toBase64) {
+        return unencoded.toBase64({ alphabet: 'base64url', omitPadding: true });
+    }
+    return encodeBase64(unencoded).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
 }
 export function decodeBase64(encoded) {
-    if (Buffer)
-        return Buffer.from(encoded, 'base64');
+    if (Uint8Array.fromBase64) {
+        return Uint8Array.fromBase64(encoded);
+    }
     const binary = atob(encoded);
     const bytes = new Uint8Array(binary.length);
     for (let i = 0; i < binary.length; i++) {
@@ -29,12 +32,15 @@ export function decodeBase64(encoded) {
     return bytes;
 }
 export function decode(input) {
+    if (Uint8Array.fromBase64) {
+        return Uint8Array.fromBase64(typeof input === 'string' ? input : decoder.decode(input), {
+            alphabet: 'base64url',
+        });
+    }
     let encoded = input;
     if (encoded instanceof Uint8Array) {
         encoded = decoder.decode(encoded);
     }
-    if (Buffer)
-        return Buffer.from(encoded, 'base64url');
     encoded = encoded.replace(/-/g, '+').replace(/_/g, '/').replace(/\s/g, '');
     try {
         return decodeBase64(encoded);

package/dist/webapi/lib/buffer_utils.js

@@ -1,11 +1,7 @@
 export const encoder = new TextEncoder();
 export const decoder = new TextDecoder();
 const MAX_INT32 = 2 ** 32;
-const Buffer = globalThis.process?.getBuiltinModule?.('node:buffer')?.Buffer;
-export { Buffer };
 export function concat(...buffers) {
-    if (Buffer)
-        return Buffer.concat(buffers);
     const size = buffers.reduce((acc, { length }) => acc + length, 0);
     const buf = new Uint8Array(size);
     let i = 0;

package/dist/webapi/lib/decrypt.js

@@ -5,25 +5,24 @@ import { JOSENotSupported, JWEDecryptionFailed, JWEInvalid } from '../util/error
 import { checkEncCryptoKey } from './crypto_key.js';
 import invalidKeyInput from './invalid_key_input.js';
 import { isCryptoKey } from './is_key_like.js';
-let timingSafeEqual = globalThis.process?.getBuiltinModule?.('node:crypto')?.timingSafeEqual;
-timingSafeEqual ||= (a, b) => {
+async function timingSafeEqual(a, b) {
     if (!(a instanceof Uint8Array)) {
         throw new TypeError('First argument must be a buffer');
     }
     if (!(b instanceof Uint8Array)) {
         throw new TypeError('Second argument must be a buffer');
     }
-    if (a.length !== b.length) {
-        throw new TypeError('Input buffers must have the same length');
-    }
-    const len = a.length;
+    const algorithm = { name: 'HMAC', hash: 'SHA-256' };
+    const key = (await crypto.subtle.generateKey(algorithm, false, ['sign']));
+    const aHmac = new Uint8Array(await crypto.subtle.sign(algorithm, key, a));
+    const bHmac = new Uint8Array(await crypto.subtle.sign(algorithm, key, b));
     let out = 0;
     let i = -1;
-    while (++i < len) {
-        out |= a[i] ^ b[i];
+    while (++i < 32) {
+        out |= aHmac[i] ^ bHmac[i];
     }
     return out === 0;
-};
+}
 async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
     if (!(cek instanceof Uint8Array)) {
         throw new TypeError(invalidKeyInput(cek, 'Uint8Array'));
@@ -38,7 +37,7 @@ async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
     const expectedTag = new Uint8Array((await crypto.subtle.sign('HMAC', macKey, macData)).slice(0, keySize >> 3));
     let macCheckPassed;
     try {
-        macCheckPassed = timingSafeEqual(tag, expectedTag);
+        macCheckPassed = await timingSafeEqual(tag, expectedTag);
     }
     catch {
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "6.0.3",
+  "version": "6.0.5",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "browser",