jose 6.0.4 → 6.0.6

package/dist/types/index.d.ts

@@ -45,4 +45,10 @@ export { generateSecret } from './key/generate_secret.js';
 export type { GenerateSecretOptions } from './key/generate_secret.js';
 export * as base64url from './util/base64url.js';
 export type { CompactDecryptResult, CompactJWEHeaderParameters, CompactJWSHeaderParameters, CompactVerifyResult, CritOption, CryptoKey, DecryptOptions, EncryptOptions, FlattenedDecryptResult, FlattenedJWE, FlattenedJWS, FlattenedJWSInput, FlattenedVerifyResult, GeneralDecryptResult, GeneralJWE, GeneralJWS, GeneralJWSInput, GeneralVerifyResult, GetKeyFunction, JoseHeaderParameters, JSONWebKeySet, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWK_EC_Private, JWK_EC_Public, JWK_oct, JWK_OKP_Private, JWK_OKP_Public, JWK_RSA_Private, JWK_RSA_Public, JWK, JWKParameters, JWSHeaderParameters, JWTClaimVerificationOptions, JWTDecryptResult, JWTHeaderParameters, JWTPayload, JWTVerifyResult, KeyObject, ResolvedKey, SignOptions, VerifyOptions, } from './types.d.ts';
+/**
+ * In prior releases this indicated whether a Node.js-specific build was loaded, this is now fixed
+ * to `"WebCryptoAPI"`
+ *
+ * @deprecated
+ */
 export declare const cryptoRuntime = "WebCryptoAPI";

package/dist/types/jwe/general/encrypt.d.ts

@@ -4,6 +4,7 @@
  * @module
  */
 import type * as types from '../../types.d.ts';
+/** Used to build General JWE object's individual recipients. */
 export interface Recipient {
     /**
      * Sets the JWE Per-Recipient Unprotected Header on the Recipient object.

package/dist/types/jwks/remote.d.ts

@@ -94,6 +94,7 @@ import type * as types from '../types.d.ts';
  * ```
  */
 export declare const customFetch: unique symbol;
+/** See {@link customFetch}. */
 export type FetchImplementation = (url: string, options: {
     headers: Headers;
     method: 'GET';
@@ -175,10 +176,12 @@ export interface RemoteJWKSetOptions {
     /** See {@link customFetch}. */
     [customFetch]?: FetchImplementation;
 }
+/** See {@link jwksCache}. */
 export interface ExportedJWKSCache {
     jwks: types.JSONWebKeySet;
     uat: number;
 }
+/** See {@link jwksCache}. */
 export type JWKSCacheInput = ExportedJWKSCache | Record<string, never>;
 /**
  * Returns a function that resolves a JWS JOSE Header to a public key object downloaded from a

package/dist/types/jws/general/sign.d.ts

@@ -4,6 +4,7 @@
  * @module
  */
 import type * as types from '../../types.d.ts';
+/** Used to build General JWS object's individual signatures. */
 export interface Signature {
     /**
      * Sets the JWS Protected Header on the Signature object.

package/dist/types/jwt/unsecured.d.ts

@@ -5,6 +5,7 @@
  */
 import type * as types from '../types.d.ts';
 import { ProduceJWT } from './produce.js';
+/** Result of decoding an Unsecured JWT. */
 export interface UnsecuredResult<PayloadType = types.JWTPayload> {
     payload: PayloadType & types.JWTPayload;
     header: types.JWSHeaderParameters;

package/dist/types/key/generate_key_pair.d.ts

@@ -4,12 +4,14 @@
  * @module
  */
 import type * as types from '../types.d.ts';
+/** Asymmetric key pair generation function result. */
 export interface GenerateKeyPairResult {
     /** The generated Private Key. */
     privateKey: types.CryptoKey;
     /** Public Key corresponding to the generated Private Key. */
     publicKey: types.CryptoKey;
 }
+/** Asymmetric key pair generation function options. */
 export interface GenerateKeyPairOptions {
     /**
      * The EC "crv" (Curve) or OKP "crv" (Subtype of Key Pair) value to generate. The curve must be

package/dist/types/key/generate_secret.d.ts

@@ -4,6 +4,7 @@
  * @module
  */
 import type * as types from '../types.d.ts';
+/** Secret generation function options. */
 export interface GenerateSecretOptions {
     /** The value to use as {@link !SubtleCrypto.generateKey} `extractable` argument. Default is false. */
     extractable?: boolean;

package/dist/types/key/import.d.ts

@@ -4,6 +4,7 @@
  * @module
  */
 import type * as types from '../types.d.ts';
+/** Key Import Function options. */
 export interface KeyImportOptions {
     /**
      * The value to use as {@link !SubtleCrypto.importKey} `extractable` argument. Default is false for

package/dist/types/types.d.ts

@@ -1,7 +1,7 @@
 /** Generic JSON Web Key Parameters. */
 export interface JWKParameters {
   /** JWK "kty" (Key Type) Parameter */
-  kty: string
+  kty?: string
   /**
    * JWK "alg" (Algorithm) Parameter
    *
@@ -216,8 +216,8 @@ export interface GeneralJWSInput {
 }
 
 /**
- * Flattened JWS definition. Payload is returned as an empty string when JWS Unencoded Payload
- * ({@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}) is used.
+ * Flattened JWS JSON Serialization Syntax token. Payload is returned as an empty string when JWS
+ * Unencoded Payload ({@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}) is used.
  */
 export interface FlattenedJWS extends Partial<FlattenedJWSInput> {
   payload: string
@@ -225,14 +225,15 @@ export interface FlattenedJWS extends Partial<FlattenedJWSInput> {
 }
 
 /**
- * General JWS definition. Payload is returned as an empty string when JWS Unencoded Payload
- * ({@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}) is used.
+ * General JWS JSON Serialization Syntax token. Payload is returned as an empty string when JWS
+ * Unencoded Payload ({@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}) is used.
  */
 export interface GeneralJWS {
   payload: string
   signatures: Omit<FlattenedJWSInput, 'payload'>[]
 }
 
+/** Header Parameters common to JWE and JWS */
 export interface JoseHeaderParameters {
   /** "kid" (Key ID) Header Parameter */
   kid?: string
@@ -307,7 +308,7 @@ export interface JWEKeyManagementHeaderParameters {
   epk?: CryptoKey | KeyObject
 }
 
-/** Flattened JWE definition. */
+/** Flattened JWE JSON Serialization Syntax token. */
 export interface FlattenedJWE {
   /**
    * The "aad" member MUST be present and contain the value BASE64URL(JWE AAD)) when the JWE AAD
@@ -361,6 +362,7 @@ export interface FlattenedJWE {
   unprotected?: JWEHeaderParameters
 }
 
+/** General JWE JSON Serialization Syntax token. */
 export interface GeneralJWE extends Omit<FlattenedJWE, 'encrypted_key' | 'header'> {
   recipients: Pick<FlattenedJWE, 'encrypted_key' | 'header'>[]
 }
@@ -583,6 +585,7 @@ export interface JWTPayload {
   [propName: string]: unknown
 }
 
+/** Flattened JWE JSON Serialization Syntax decryption result */
 export interface FlattenedDecryptResult {
   /** JWE AAD. */
   additionalAuthenticatedData?: Uint8Array
@@ -600,8 +603,10 @@ export interface FlattenedDecryptResult {
   unprotectedHeader?: JWEHeaderParameters
 }
 
+/** General JWE JSON Serialization Syntax decryption result */
 export interface GeneralDecryptResult extends FlattenedDecryptResult {}
 
+/** Compact JWE decryption result */
 export interface CompactDecryptResult {
   /** Plaintext. */
   plaintext: Uint8Array
@@ -610,6 +615,7 @@ export interface CompactDecryptResult {
   protectedHeader: CompactJWEHeaderParameters
 }
 
+/** Flattened JWS JSON Serialization Syntax verification result */
 export interface FlattenedVerifyResult {
   /** JWS Payload. */
   payload: Uint8Array
@@ -621,8 +627,10 @@ export interface FlattenedVerifyResult {
   unprotectedHeader?: JWSHeaderParameters
 }
 
+/** General JWS JSON Serialization Syntax verification result */
 export interface GeneralVerifyResult extends FlattenedVerifyResult {}
 
+/** Compact JWS verification result */
 export interface CompactVerifyResult {
   /** JWS Payload. */
   payload: Uint8Array
@@ -631,6 +639,7 @@ export interface CompactVerifyResult {
   protectedHeader: CompactJWSHeaderParameters
 }
 
+/** Signed JSON Web Token (JWT) verification result */
 export interface JWTVerifyResult<PayloadType = JWTPayload> {
   /** JWT Claims Set. */
   payload: PayloadType & JWTPayload
@@ -639,6 +648,7 @@ export interface JWTVerifyResult<PayloadType = JWTPayload> {
   protectedHeader: JWTHeaderParameters
 }
 
+/** Encrypted JSON Web Token (JWT) decryption result */
 export interface JWTDecryptResult<PayloadType = JWTPayload> {
   /** JWT Claims Set. */
   payload: PayloadType & JWTPayload
@@ -647,6 +657,7 @@ export interface JWTDecryptResult<PayloadType = JWTPayload> {
   protectedHeader: CompactJWEHeaderParameters
 }
 
+/** When key resolver functions are used this becomes part of successful resolves */
 export interface ResolvedKey {
   /** Key resolved from the key resolver function. */
   key: CryptoKey | Uint8Array

package/dist/types/util/base64url.d.ts

@@ -3,22 +3,7 @@
  *
  * @module
  */
-/**
- * Utility function to encode a string or {@link !Uint8Array} as a base64url string.
- *
- * @param input Value that will be base64url-encoded.
- */
-interface Base64UrlEncode {
-    (input: Uint8Array | string): string;
-}
-/**
- * Utility function to decode a base64url encoded string.
- *
- * @param input Value that will be base64url-decoded.
- */
-interface Base64UrlDecode {
-    (input: Uint8Array | string): Uint8Array;
-}
-export declare const encode: Base64UrlEncode;
-export declare const decode: Base64UrlDecode;
-export {};
+/** Decodes a Base64URL encoded input. */
+export declare function decode(input: Uint8Array | string): Uint8Array;
+/** Encodes an input using Base64URL with no padding. */
+export declare function encode(input: Uint8Array | string): string;

package/dist/types/util/decode_protected_header.d.ts

@@ -4,6 +4,7 @@
  * @module
  */
 import type * as types from '../types.d.ts';
+/** JWE and JWS Header Parameters */
 export type ProtectedHeaderParameters = types.JWSHeaderParameters & types.JWEHeaderParameters;
 /**
  * Decodes the Protected Header of a JWE/JWS/JWT token utilizing any JOSE serialization.

package/dist/webapi/jwe/flattened/decrypt.js

@@ -1,4 +1,4 @@
-import { decode as base64url } from '../../lib/base64url.js';
+import { decode as b64u } from '../../util/base64url.js';
 import decrypt from '../../lib/decrypt.js';
 import { JOSEAlgNotAllowed, JOSENotSupported, JWEInvalid } from '../../util/errors.js';
 import isDisjoint from '../../lib/is_disjoint.js';
@@ -44,7 +44,7 @@ export async function flattenedDecrypt(jwe, key, options) {
     let parsedProt;
     if (jwe.protected) {
         try {
-            const protectedHeader = base64url(jwe.protected);
+            const protectedHeader = b64u(jwe.protected);
             parsedProt = JSON.parse(decoder.decode(protectedHeader));
         }
         catch {
@@ -83,7 +83,7 @@ export async function flattenedDecrypt(jwe, key, options) {
     let encryptedKey;
     if (jwe.encrypted_key !== undefined) {
         try {
-            encryptedKey = base64url(jwe.encrypted_key);
+            encryptedKey = b64u(jwe.encrypted_key);
         }
         catch {
             throw new JWEInvalid('Failed to base64url decode the encrypted_key');
@@ -110,7 +110,7 @@ export async function flattenedDecrypt(jwe, key, options) {
     let tag;
     if (jwe.iv !== undefined) {
         try {
-            iv = base64url(jwe.iv);
+            iv = b64u(jwe.iv);
         }
         catch {
             throw new JWEInvalid('Failed to base64url decode the iv');
@@ -118,7 +118,7 @@ export async function flattenedDecrypt(jwe, key, options) {
     }
     if (jwe.tag !== undefined) {
         try {
-            tag = base64url(jwe.tag);
+            tag = b64u(jwe.tag);
         }
         catch {
             throw new JWEInvalid('Failed to base64url decode the tag');
@@ -134,7 +134,7 @@ export async function flattenedDecrypt(jwe, key, options) {
     }
     let ciphertext;
     try {
-        ciphertext = base64url(jwe.ciphertext);
+        ciphertext = b64u(jwe.ciphertext);
     }
     catch {
         throw new JWEInvalid('Failed to base64url decode the ciphertext');
@@ -146,7 +146,7 @@ export async function flattenedDecrypt(jwe, key, options) {
     }
     if (jwe.aad !== undefined) {
         try {
-            result.additionalAuthenticatedData = base64url(jwe.aad);
+            result.additionalAuthenticatedData = b64u(jwe.aad);
         }
         catch {
             throw new JWEInvalid('Failed to base64url decode the aad');

package/dist/webapi/jwe/flattened/encrypt.js

@@ -1,4 +1,4 @@
-import { encode as base64url } from '../../lib/base64url.js';
+import { encode as b64u } from '../../util/base64url.js';
 import { unprotected } from '../../lib/private_symbols.js';
 import encrypt from '../../lib/encrypt.js';
 import encryptKeyManagement from '../../lib/encrypt_key_management.js';
@@ -123,13 +123,13 @@ export class FlattenedEncrypt {
         let protectedHeader;
         let aadMember;
         if (this._protectedHeader) {
-            protectedHeader = encoder.encode(base64url(JSON.stringify(this._protectedHeader)));
+            protectedHeader = encoder.encode(b64u(JSON.stringify(this._protectedHeader)));
         }
         else {
             protectedHeader = encoder.encode('');
         }
         if (this._aad) {
-            aadMember = base64url(this._aad);
+            aadMember = b64u(this._aad);
             additionalData = concat(protectedHeader, encoder.encode('.'), encoder.encode(aadMember));
         }
         else {
@@ -137,16 +137,16 @@ export class FlattenedEncrypt {
         }
         const { ciphertext, tag, iv } = await encrypt(enc, this._plaintext, cek, this._iv, additionalData);
         const jwe = {
-            ciphertext: base64url(ciphertext),
+            ciphertext: b64u(ciphertext),
         };
         if (iv) {
-            jwe.iv = base64url(iv);
+            jwe.iv = b64u(iv);
         }
         if (tag) {
-            jwe.tag = base64url(tag);
+            jwe.tag = b64u(tag);
         }
         if (encryptedKey) {
-            jwe.encrypted_key = base64url(encryptedKey);
+            jwe.encrypted_key = b64u(encryptedKey);
         }
         if (aadMember) {
             jwe.aad = aadMember;

package/dist/webapi/jwe/general/encrypt.js

@@ -4,7 +4,7 @@ import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
 import generateCek from '../../lib/cek.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import encryptKeyManagement from '../../lib/encrypt_key_management.js';
-import { encode as base64url } from '../../lib/base64url.js';
+import { encode as b64u } from '../../util/base64url.js';
 import validateCrit from '../../lib/validate_crit.js';
 import normalizeKey from '../../lib/normalize_key.js';
 import checkKeyType from '../../lib/check_key_type.js';
@@ -178,7 +178,7 @@ export class GeneralEncrypt {
             checkKeyType(alg === 'dir' ? enc : alg, recipient.key, 'encrypt');
             const k = await normalizeKey(recipient.key, alg);
             const { encryptedKey, parameters } = await encryptKeyManagement(alg, enc, k, cek, { p2c });
-            target.encrypted_key = base64url(encryptedKey);
+            target.encrypted_key = b64u(encryptedKey);
             if (recipient.unprotectedHeader || parameters)
                 target.header = { ...recipient.unprotectedHeader, ...parameters };
         }

package/dist/webapi/jwk/thumbprint.js

@@ -1,5 +1,5 @@
 import digest from '../lib/digest.js';
-import { encode as base64url } from '../lib/base64url.js';
+import { encode as b64u } from '../util/base64url.js';
 import { JOSENotSupported, JWKInvalid } from '../util/errors.js';
 import { encoder } from '../lib/buffer_utils.js';
 import isKeyLike from '../lib/is_key_like.js';
@@ -54,7 +54,7 @@ export async function calculateJwkThumbprint(key, digestAlgorithm) {
             throw new JOSENotSupported('"kty" (Key Type) Parameter missing or unsupported');
     }
     const data = encoder.encode(JSON.stringify(components));
-    return base64url(await digest(digestAlgorithm, data));
+    return b64u(await digest(digestAlgorithm, data));
 }
 export async function calculateJwkThumbprintUri(key, digestAlgorithm) {
     digestAlgorithm ??= 'sha256';

package/dist/webapi/jwks/remote.js

@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v6.0.4';
+    const VERSION = 'v6.0.6';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const customFetch = Symbol();

package/dist/webapi/jws/flattened/sign.js

@@ -1,4 +1,4 @@
-import { encode as base64url } from '../../lib/base64url.js';
+import { encode as b64u } from '../../util/base64url.js';
 import sign from '../../lib/sign.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import { JWSInvalid } from '../../util/errors.js';
@@ -56,11 +56,11 @@ export class FlattenedSign {
         checkKeyType(alg, key, 'sign');
         let payload = this._payload;
         if (b64) {
-            payload = encoder.encode(base64url(payload));
+            payload = encoder.encode(b64u(payload));
         }
         let protectedHeader;
         if (this._protectedHeader) {
-            protectedHeader = encoder.encode(base64url(JSON.stringify(this._protectedHeader)));
+            protectedHeader = encoder.encode(b64u(JSON.stringify(this._protectedHeader)));
         }
         else {
             protectedHeader = encoder.encode('');
@@ -69,7 +69,7 @@ export class FlattenedSign {
         const k = await normalizeKey(key, alg);
         const signature = await sign(alg, k, data);
         const jws = {
-            signature: base64url(signature),
+            signature: b64u(signature),
             payload: '',
         };
         if (b64) {

package/dist/webapi/jws/flattened/verify.js

@@ -1,4 +1,4 @@
-import { decode as base64url } from '../../lib/base64url.js';
+import { decode as b64u } from '../../util/base64url.js';
 import verify from '../../lib/verify.js';
 import { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';
 import { concat, encoder, decoder } from '../../lib/buffer_utils.js';
@@ -30,7 +30,7 @@ export async function flattenedVerify(jws, key, options) {
     let parsedProt = {};
     if (jws.protected) {
         try {
-            const protectedHeader = base64url(jws.protected);
+            const protectedHeader = b64u(jws.protected);
             parsedProt = JSON.parse(decoder.decode(protectedHeader));
         }
         catch {
@@ -77,7 +77,7 @@ export async function flattenedVerify(jws, key, options) {
     const data = concat(encoder.encode(jws.protected ?? ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);
     let signature;
     try {
-        signature = base64url(jws.signature);
+        signature = b64u(jws.signature);
     }
     catch {
         throw new JWSInvalid('Failed to base64url decode the signature');
@@ -90,7 +90,7 @@ export async function flattenedVerify(jws, key, options) {
     let payload;
     if (b64) {
         try {
-            payload = base64url(jws.payload);
+            payload = b64u(jws.payload);
         }
         catch {
             throw new JWSInvalid('Failed to base64url decode the payload');

package/dist/webapi/jwt/unsecured.js

@@ -1,12 +1,12 @@
-import * as base64url from '../lib/base64url.js';
+import * as b64u from '../util/base64url.js';
 import { decoder } from '../lib/buffer_utils.js';
 import { JWTInvalid } from '../util/errors.js';
 import jwtPayload from '../lib/jwt_claims_set.js';
 import { ProduceJWT } from './produce.js';
 export class UnsecuredJWT extends ProduceJWT {
     encode() {
-        const header = base64url.encode(JSON.stringify({ alg: 'none' }));
-        const payload = base64url.encode(JSON.stringify(this._payload));
+        const header = b64u.encode(JSON.stringify({ alg: 'none' }));
+        const payload = b64u.encode(JSON.stringify(this._payload));
         return `${header}.${payload}.`;
     }
     static decode(jwt, options) {
@@ -19,14 +19,14 @@ export class UnsecuredJWT extends ProduceJWT {
         }
         let header;
         try {
-            header = JSON.parse(decoder.decode(base64url.decode(encodedHeader)));
+            header = JSON.parse(decoder.decode(b64u.decode(encodedHeader)));
             if (header.alg !== 'none')
                 throw new Error();
         }
         catch {
             throw new JWTInvalid('Invalid Unsecured JWT');
         }
-        const payload = jwtPayload(header, base64url.decode(encodedPayload), options);
+        const payload = jwtPayload(header, b64u.decode(encodedPayload), options);
         return { payload, header };
     }
 }

package/dist/webapi/key/import.js

@@ -1,4 +1,4 @@
-import { decode as decodeBase64URL } from '../lib/base64url.js';
+import { decode as decodeBase64URL } from '../util/base64url.js';
 import { fromSPKI, fromPKCS8, fromX509 } from '../lib/asn1.js';
 import toCryptoKey from '../lib/jwk_to_key.js';
 import { JOSENotSupported } from '../util/errors.js';

package/dist/webapi/lib/aesgcmkw.js

@@ -1,13 +1,13 @@
 import encrypt from './encrypt.js';
 import decrypt from './decrypt.js';
-import { encode as base64url } from '../lib/base64url.js';
+import { encode as b64u } from '../util/base64url.js';
 export async function wrap(alg, key, cek, iv) {
     const jweAlgorithm = alg.slice(0, 7);
     const wrapped = await encrypt(jweAlgorithm, cek, key, iv, new Uint8Array(0));
     return {
         encryptedKey: wrapped.ciphertext,
-        iv: base64url(wrapped.iv),
-        tag: base64url(wrapped.tag),
+        iv: b64u(wrapped.iv),
+        tag: b64u(wrapped.tag),
     };
 }
 export async function unwrap(alg, key, encryptedKey, iv, tag) {

package/dist/webapi/lib/asn1.js

@@ -1,5 +1,5 @@
 import invalidKeyInput from './invalid_key_input.js';
-import { encodeBase64, decodeBase64 } from './base64url.js';
+import { encodeBase64, decodeBase64 } from '../lib/base64.js';
 import { JOSENotSupported } from '../util/errors.js';
 import { isCryptoKey, isKeyObject } from './is_key_like.js';
 const formatPEM = (b64, descriptor) => {

package/dist/webapi/lib/base64.js

@@ -0,0 +1,22 @@
+export function encodeBase64(input) {
+    if (Uint8Array.prototype.toBase64) {
+        return input.toBase64();
+    }
+    const CHUNK_SIZE = 0x8000;
+    const arr = [];
+    for (let i = 0; i < input.length; i += CHUNK_SIZE) {
+        arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+    }
+    return btoa(arr.join(''));
+}
+export function decodeBase64(encoded) {
+    if (Uint8Array.fromBase64) {
+        return Uint8Array.fromBase64(encoded);
+    }
+    const binary = atob(encoded);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}

package/dist/webapi/lib/decrypt_key_management.js

@@ -2,7 +2,7 @@ import * as aeskw from './aeskw.js';
 import * as ecdhes from './ecdhes.js';
 import * as pbes2kw from './pbes2kw.js';
 import * as rsaes from './rsaes.js';
-import * as base64url from '../lib/base64url.js';
+import { decode as b64u } from '../util/base64url.js';
 import { JOSENotSupported, JWEInvalid } from '../util/errors.js';
 import { bitLength as cekLength } from '../lib/cek.js';
 import { importJWK } from '../key/import.js';
@@ -35,7 +35,7 @@ export default async (alg, key, encryptedKey, joseHeader, options) => {
                 if (typeof joseHeader.apu !== 'string')
                     throw new JWEInvalid(`JOSE Header "apu" (Agreement PartyUInfo) invalid`);
                 try {
-                    partyUInfo = base64url.decode(joseHeader.apu);
+                    partyUInfo = b64u(joseHeader.apu);
                 }
                 catch {
                     throw new JWEInvalid('Failed to base64url decode the apu');
@@ -45,7 +45,7 @@ export default async (alg, key, encryptedKey, joseHeader, options) => {
                 if (typeof joseHeader.apv !== 'string')
                     throw new JWEInvalid(`JOSE Header "apv" (Agreement PartyVInfo) invalid`);
                 try {
-                    partyVInfo = base64url.decode(joseHeader.apv);
+                    partyVInfo = b64u(joseHeader.apv);
                 }
                 catch {
                     throw new JWEInvalid('Failed to base64url decode the apv');
@@ -81,7 +81,7 @@ export default async (alg, key, encryptedKey, joseHeader, options) => {
                 throw new JWEInvalid(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);
             let p2s;
             try {
-                p2s = base64url.decode(joseHeader.p2s);
+                p2s = b64u(joseHeader.p2s);
             }
             catch {
                 throw new JWEInvalid('Failed to base64url decode the p2s');
@@ -106,14 +106,14 @@ export default async (alg, key, encryptedKey, joseHeader, options) => {
                 throw new JWEInvalid(`JOSE Header "tag" (Authentication Tag) missing or invalid`);
             let iv;
             try {
-                iv = base64url.decode(joseHeader.iv);
+                iv = b64u(joseHeader.iv);
             }
             catch {
                 throw new JWEInvalid('Failed to base64url decode the iv');
             }
             let tag;
             try {
-                tag = base64url.decode(joseHeader.tag);
+                tag = b64u(joseHeader.tag);
             }
             catch {
                 throw new JWEInvalid('Failed to base64url decode the tag');

package/dist/webapi/lib/encrypt_key_management.js

@@ -2,7 +2,7 @@ import * as aeskw from './aeskw.js';
 import * as ecdhes from './ecdhes.js';
 import * as pbes2kw from './pbes2kw.js';
 import * as rsaes from './rsaes.js';
-import * as base64url from '../lib/base64url.js';
+import { encode as b64u } from '../util/base64url.js';
 import normalizeKey from './normalize_key.js';
 import generateCek, { bitLength as cekLength } from '../lib/cek.js';
 import { JOSENotSupported } from '../util/errors.js';
@@ -40,9 +40,9 @@ export default async (alg, enc, key, providedCek, providedParameters = {}) => {
             if (kty === 'EC')
                 parameters.epk.y = y;
             if (apu)
-                parameters.apu = base64url.encode(apu);
+                parameters.apu = b64u(apu);
             if (apv)
-                parameters.apv = base64url.encode(apv);
+                parameters.apv = b64u(apv);
             if (alg === 'ECDH-ES') {
                 cek = sharedSecret;
                 break;

package/dist/webapi/lib/key_to_jwk.js

@@ -1,5 +1,5 @@
 import invalidKeyInput from './invalid_key_input.js';
-import { encode as base64url } from './base64url.js';
+import { encode as b64u } from '../util/base64url.js';
 import { isCryptoKey, isKeyObject } from './is_key_like.js';
 export default async function keyToJWK(key) {
     if (isKeyObject(key)) {
@@ -13,7 +13,7 @@ export default async function keyToJWK(key) {
     if (key instanceof Uint8Array) {
         return {
             kty: 'oct',
-            k: base64url(key),
+            k: b64u(key),
         };
     }
     if (!isCryptoKey(key)) {

package/dist/webapi/lib/normalize_key.js

@@ -1,5 +1,5 @@
 import { isJWK } from './is_jwk.js';
-import { decode } from './base64url.js';
+import { decode } from '../util/base64url.js';
 import importJWK from './jwk_to_key.js';
 import { isCryptoKey, isKeyObject } from './is_key_like.js';
 let cache;

package/dist/webapi/lib/pbes2kw.js

@@ -1,4 +1,4 @@
-import { encode as base64url } from './base64url.js';
+import { encode as b64u } from '../util/base64url.js';
 import * as aeskw from './aeskw.js';
 import { checkEncCryptoKey } from './crypto_key.js';
 import { concat, encoder } from './buffer_utils.js';
@@ -29,7 +29,7 @@ async function deriveKey(p2s, alg, p2c, key) {
 export async function wrap(alg, key, cek, p2c = 2048, p2s = crypto.getRandomValues(new Uint8Array(16))) {
     const derived = await deriveKey(p2s, alg, p2c, key);
     const encryptedKey = await aeskw.wrap(alg.slice(-6), derived, cek);
-    return { encryptedKey, p2c, p2s: base64url(p2s) };
+    return { encryptedKey, p2c, p2s: b64u(p2s) };
 }
 export async function unwrap(alg, key, encryptedKey, p2c, p2s) {
     const derived = await deriveKey(p2s, alg, p2c, key);

package/dist/webapi/util/base64url.js

@@ -1,3 +1,30 @@
-import * as base64url from '../lib/base64url.js';
-export const encode = base64url.encode;
-export const decode = base64url.decode;
+import { encoder, decoder } from '../lib/buffer_utils.js';
+import { encodeBase64, decodeBase64 } from '../lib/base64.js';
+export function decode(input) {
+    if (Uint8Array.fromBase64) {
+        return Uint8Array.fromBase64(typeof input === 'string' ? input : decoder.decode(input), {
+            alphabet: 'base64url',
+        });
+    }
+    let encoded = input;
+    if (encoded instanceof Uint8Array) {
+        encoded = decoder.decode(encoded);
+    }
+    encoded = encoded.replace(/-/g, '+').replace(/_/g, '/').replace(/\s/g, '');
+    try {
+        return decodeBase64(encoded);
+    }
+    catch {
+        throw new TypeError('The input to be decoded is not correctly encoded.');
+    }
+}
+export function encode(input) {
+    let unencoded = input;
+    if (typeof unencoded === 'string') {
+        unencoded = encoder.encode(unencoded);
+    }
+    if (Uint8Array.prototype.toBase64) {
+        return unencoded.toBase64({ alphabet: 'base64url', omitPadding: true });
+    }
+    return encodeBase64(unencoded).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+}

package/dist/webapi/util/decode_jwt.js

@@ -1,4 +1,4 @@
-import { decode as base64url } from './base64url.js';
+import { decode as b64u } from './base64url.js';
 import { decoder } from '../lib/buffer_utils.js';
 import isObject from '../lib/is_object.js';
 import { JWTInvalid } from './errors.js';
@@ -14,7 +14,7 @@ export function decodeJwt(jwt) {
         throw new JWTInvalid('JWTs must contain a payload');
     let decoded;
     try {
-        decoded = base64url(payload);
+        decoded = b64u(payload);
     }
     catch {
         throw new JWTInvalid('Failed to base64url decode the payload');

package/dist/webapi/util/decode_protected_header.js

@@ -1,4 +1,4 @@
-import { decode as base64url } from './base64url.js';
+import { decode as b64u } from './base64url.js';
 import { decoder } from '../lib/buffer_utils.js';
 import isObject from '../lib/is_object.js';
 export function decodeProtectedHeader(token) {
@@ -22,7 +22,7 @@ export function decodeProtectedHeader(token) {
         if (typeof protectedB64u !== 'string' || !protectedB64u) {
             throw new Error();
         }
-        const result = JSON.parse(decoder.decode(base64url(protectedB64u)));
+        const result = JSON.parse(decoder.decode(b64u(protectedB64u)));
         if (!isObject(result)) {
             throw new Error();
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "6.0.4",
+  "version": "6.0.6",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "browser",

package/dist/webapi/lib/base64url.js

@@ -1,51 +0,0 @@
-import { encoder, decoder } from '../lib/buffer_utils.js';
-export function encodeBase64(input) {
-    if (Uint8Array.prototype.toBase64) {
-        return input.toBase64();
-    }
-    const CHUNK_SIZE = 0x8000;
-    const arr = [];
-    for (let i = 0; i < input.length; i += CHUNK_SIZE) {
-        arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
-    }
-    return btoa(arr.join(''));
-}
-export function encode(input) {
-    let unencoded = input;
-    if (typeof unencoded === 'string') {
-        unencoded = encoder.encode(unencoded);
-    }
-    if (Uint8Array.prototype.toBase64) {
-        return unencoded.toBase64({ alphabet: 'base64url', omitPadding: true });
-    }
-    return encodeBase64(unencoded).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
-}
-export function decodeBase64(encoded) {
-    if (Uint8Array.fromBase64) {
-        return Uint8Array.fromBase64(encoded);
-    }
-    const binary = atob(encoded);
-    const bytes = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i++) {
-        bytes[i] = binary.charCodeAt(i);
-    }
-    return bytes;
-}
-export function decode(input) {
-    if (Uint8Array.fromBase64) {
-        return Uint8Array.fromBase64(typeof input === 'string' ? input : decoder.decode(input), {
-            alphabet: 'base64url',
-        });
-    }
-    let encoded = input;
-    if (encoded instanceof Uint8Array) {
-        encoded = decoder.decode(encoded);
-    }
-    encoded = encoded.replace(/-/g, '+').replace(/_/g, '/').replace(/\s/g, '');
-    try {
-        return decodeBase64(encoded);
-    }
-    catch {
-        throw new TypeError('The input to be decoded is not correctly encoded.');
-    }
-}