jose 6.0.5 → 6.0.7

package/dist/types/jwks/remote.d.ts

@@ -94,6 +94,7 @@ import type * as types from '../types.d.ts';
  * ```
  */
 export declare const customFetch: unique symbol;
+/** See {@link customFetch}. */
 export type FetchImplementation = (url: string, options: {
     headers: Headers;
     method: 'GET';
@@ -175,10 +176,12 @@ export interface RemoteJWKSetOptions {
     /** See {@link customFetch}. */
     [customFetch]?: FetchImplementation;
 }
+/** See {@link jwksCache}. */
 export interface ExportedJWKSCache {
     jwks: types.JSONWebKeySet;
     uat: number;
 }
+/** See {@link jwksCache}. */
 export type JWKSCacheInput = ExportedJWKSCache | Record<string, never>;
 /**
  * Returns a function that resolves a JWS JOSE Header to a public key object downloaded from a

package/dist/types/key/generate_secret.d.ts

@@ -6,7 +6,12 @@
 import type * as types from '../types.d.ts';
 /** Secret generation function options. */
 export interface GenerateSecretOptions {
-    /** The value to use as {@link !SubtleCrypto.generateKey} `extractable` argument. Default is false. */
+    /**
+     * The value to use as {@link !SubtleCrypto.generateKey} `extractable` argument. Default is false.
+     *
+     * Note: Because A128CBC-HS256, A192CBC-HS384, and A256CBC-HS512 secrets cannot be represented as
+     * {@link !CryptoKey} this option has no effect for them.
+     */
     extractable?: boolean;
 }
 /**
@@ -14,6 +19,9 @@ export interface GenerateSecretOptions {
  *
  * Note: The secret key is generated with `extractable` set to `false` by default.
  *
+ * Note: Because A128CBC-HS256, A192CBC-HS384, and A256CBC-HS512 secrets cannot be represented as
+ * {@link !CryptoKey} this method yields a {@link !Uint8Array} for them instead.
+ *
  * This function is exported (as a named export) from the main `'jose'` module entry point as well
  * as from its subpath export `'jose/generate/secret'`.
  *

package/dist/types/key/import.d.ts

@@ -8,7 +8,7 @@ import type * as types from '../types.d.ts';
 export interface KeyImportOptions {
     /**
      * The value to use as {@link !SubtleCrypto.importKey} `extractable` argument. Default is false for
-     * private and secret keys, true otherwise.
+     * private keys, true otherwise.
      */
     extractable?: boolean;
 }
@@ -59,11 +59,14 @@ export declare function importX509(x509: string, alg: string, options?: KeyImpor
 export declare function importPKCS8(pkcs8: string, alg: string, options?: KeyImportOptions): Promise<types.CryptoKey>;
 /**
  * Imports a JWK to a {@link !CryptoKey}. Either the JWK "alg" (Algorithm) Parameter, or the optional
- * "alg" argument, must be present.
+ * "alg" argument, must be present for asymmetric JSON Web Key imports.
  *
  * Note: The JSON Web Key parameters "use", "key_ops", and "ext" are also used in the
  * {@link !CryptoKey} import process.
  *
+ * Note: Symmetric JSON Web Keys (i.e. `kty: "oct"`) yield back an {@link !Uint8Array} instead of a
+ * {@link !CryptoKey}.
+ *
  * This function is exported (as a named export) from the main `'jose'` module entry point as well
  * as from its subpath export `'jose/key/import'`.
  *

package/dist/types/types.d.ts

@@ -233,6 +233,7 @@ export interface GeneralJWS {
   signatures: Omit<FlattenedJWSInput, 'payload'>[]
 }
 
+/** Header Parameters common to JWE and JWS */
 export interface JoseHeaderParameters {
   /** "kid" (Key ID) Header Parameter */
   kid?: string
@@ -584,6 +585,7 @@ export interface JWTPayload {
   [propName: string]: unknown
 }
 
+/** Flattened JWE JSON Serialization Syntax decryption result */
 export interface FlattenedDecryptResult {
   /** JWE AAD. */
   additionalAuthenticatedData?: Uint8Array
@@ -601,8 +603,10 @@ export interface FlattenedDecryptResult {
   unprotectedHeader?: JWEHeaderParameters
 }
 
+/** General JWE JSON Serialization Syntax decryption result */
 export interface GeneralDecryptResult extends FlattenedDecryptResult {}
 
+/** Compact JWE decryption result */
 export interface CompactDecryptResult {
   /** Plaintext. */
   plaintext: Uint8Array
@@ -611,6 +615,7 @@ export interface CompactDecryptResult {
   protectedHeader: CompactJWEHeaderParameters
 }
 
+/** Flattened JWS JSON Serialization Syntax verification result */
 export interface FlattenedVerifyResult {
   /** JWS Payload. */
   payload: Uint8Array
@@ -622,8 +627,10 @@ export interface FlattenedVerifyResult {
   unprotectedHeader?: JWSHeaderParameters
 }
 
+/** General JWS JSON Serialization Syntax verification result */
 export interface GeneralVerifyResult extends FlattenedVerifyResult {}
 
+/** Compact JWS verification result */
 export interface CompactVerifyResult {
   /** JWS Payload. */
   payload: Uint8Array
@@ -632,6 +639,7 @@ export interface CompactVerifyResult {
   protectedHeader: CompactJWSHeaderParameters
 }
 
+/** Signed JSON Web Token (JWT) verification result */
 export interface JWTVerifyResult<PayloadType = JWTPayload> {
   /** JWT Claims Set. */
   payload: PayloadType & JWTPayload
@@ -640,6 +648,7 @@ export interface JWTVerifyResult<PayloadType = JWTPayload> {
   protectedHeader: JWTHeaderParameters
 }
 
+/** Encrypted JSON Web Token (JWT) decryption result */
 export interface JWTDecryptResult<PayloadType = JWTPayload> {
   /** JWT Claims Set. */
   payload: PayloadType & JWTPayload

package/dist/types/util/base64url.d.ts

@@ -3,22 +3,7 @@
  *
  * @module
  */
-/**
- * Utility function to encode a string or {@link !Uint8Array} as a base64url string.
- *
- * @param input Value that will be base64url-encoded.
- */
-interface Base64UrlEncode {
-    (input: Uint8Array | string): string;
-}
-/**
- * Utility function to decode a base64url encoded string.
- *
- * @param input Value that will be base64url-decoded.
- */
-interface Base64UrlDecode {
-    (input: Uint8Array | string): Uint8Array;
-}
-export declare const encode: Base64UrlEncode;
-export declare const decode: Base64UrlDecode;
-export {};
+/** Decodes a Base64URL encoded input. */
+export declare function decode(input: Uint8Array | string): Uint8Array;
+/** Encodes an input using Base64URL with no padding. */
+export declare function encode(input: Uint8Array | string): string;

package/dist/types/util/decode_protected_header.d.ts

@@ -4,6 +4,7 @@
  * @module
  */
 import type * as types from '../types.d.ts';
+/** JWE and JWS Header Parameters */
 export type ProtectedHeaderParameters = types.JWSHeaderParameters & types.JWEHeaderParameters;
 /**
  * Decodes the Protected Header of a JWE/JWS/JWT token utilizing any JOSE serialization.

package/dist/webapi/jwe/flattened/decrypt.js

@@ -1,4 +1,4 @@
-import { decode as base64url } from '../../lib/base64url.js';
+import { decode as b64u } from '../../util/base64url.js';
 import decrypt from '../../lib/decrypt.js';
 import { JOSEAlgNotAllowed, JOSENotSupported, JWEInvalid } from '../../util/errors.js';
 import isDisjoint from '../../lib/is_disjoint.js';
@@ -44,7 +44,7 @@ export async function flattenedDecrypt(jwe, key, options) {
     let parsedProt;
     if (jwe.protected) {
         try {
-            const protectedHeader = base64url(jwe.protected);
+            const protectedHeader = b64u(jwe.protected);
             parsedProt = JSON.parse(decoder.decode(protectedHeader));
         }
         catch {
@@ -83,7 +83,7 @@ export async function flattenedDecrypt(jwe, key, options) {
     let encryptedKey;
     if (jwe.encrypted_key !== undefined) {
         try {
-            encryptedKey = base64url(jwe.encrypted_key);
+            encryptedKey = b64u(jwe.encrypted_key);
         }
         catch {
             throw new JWEInvalid('Failed to base64url decode the encrypted_key');
@@ -110,7 +110,7 @@ export async function flattenedDecrypt(jwe, key, options) {
     let tag;
     if (jwe.iv !== undefined) {
         try {
-            iv = base64url(jwe.iv);
+            iv = b64u(jwe.iv);
         }
         catch {
             throw new JWEInvalid('Failed to base64url decode the iv');
@@ -118,7 +118,7 @@ export async function flattenedDecrypt(jwe, key, options) {
     }
     if (jwe.tag !== undefined) {
         try {
-            tag = base64url(jwe.tag);
+            tag = b64u(jwe.tag);
         }
         catch {
             throw new JWEInvalid('Failed to base64url decode the tag');
@@ -134,7 +134,7 @@ export async function flattenedDecrypt(jwe, key, options) {
     }
     let ciphertext;
     try {
-        ciphertext = base64url(jwe.ciphertext);
+        ciphertext = b64u(jwe.ciphertext);
     }
     catch {
         throw new JWEInvalid('Failed to base64url decode the ciphertext');
@@ -146,7 +146,7 @@ export async function flattenedDecrypt(jwe, key, options) {
     }
     if (jwe.aad !== undefined) {
         try {
-            result.additionalAuthenticatedData = base64url(jwe.aad);
+            result.additionalAuthenticatedData = b64u(jwe.aad);
         }
         catch {
             throw new JWEInvalid('Failed to base64url decode the aad');

package/dist/webapi/jwe/flattened/encrypt.js

@@ -1,4 +1,4 @@
-import { encode as base64url } from '../../lib/base64url.js';
+import { encode as b64u } from '../../util/base64url.js';
 import { unprotected } from '../../lib/private_symbols.js';
 import encrypt from '../../lib/encrypt.js';
 import encryptKeyManagement from '../../lib/encrypt_key_management.js';
@@ -123,13 +123,13 @@ export class FlattenedEncrypt {
         let protectedHeader;
         let aadMember;
         if (this._protectedHeader) {
-            protectedHeader = encoder.encode(base64url(JSON.stringify(this._protectedHeader)));
+            protectedHeader = encoder.encode(b64u(JSON.stringify(this._protectedHeader)));
         }
         else {
             protectedHeader = encoder.encode('');
         }
         if (this._aad) {
-            aadMember = base64url(this._aad);
+            aadMember = b64u(this._aad);
             additionalData = concat(protectedHeader, encoder.encode('.'), encoder.encode(aadMember));
         }
         else {
@@ -137,16 +137,16 @@ export class FlattenedEncrypt {
         }
         const { ciphertext, tag, iv } = await encrypt(enc, this._plaintext, cek, this._iv, additionalData);
         const jwe = {
-            ciphertext: base64url(ciphertext),
+            ciphertext: b64u(ciphertext),
         };
         if (iv) {
-            jwe.iv = base64url(iv);
+            jwe.iv = b64u(iv);
         }
         if (tag) {
-            jwe.tag = base64url(tag);
+            jwe.tag = b64u(tag);
         }
         if (encryptedKey) {
-            jwe.encrypted_key = base64url(encryptedKey);
+            jwe.encrypted_key = b64u(encryptedKey);
         }
         if (aadMember) {
             jwe.aad = aadMember;

package/dist/webapi/jwe/general/encrypt.js

@@ -4,7 +4,7 @@ import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
 import generateCek from '../../lib/cek.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import encryptKeyManagement from '../../lib/encrypt_key_management.js';
-import { encode as base64url } from '../../lib/base64url.js';
+import { encode as b64u } from '../../util/base64url.js';
 import validateCrit from '../../lib/validate_crit.js';
 import normalizeKey from '../../lib/normalize_key.js';
 import checkKeyType from '../../lib/check_key_type.js';
@@ -178,7 +178,7 @@ export class GeneralEncrypt {
             checkKeyType(alg === 'dir' ? enc : alg, recipient.key, 'encrypt');
             const k = await normalizeKey(recipient.key, alg);
             const { encryptedKey, parameters } = await encryptKeyManagement(alg, enc, k, cek, { p2c });
-            target.encrypted_key = base64url(encryptedKey);
+            target.encrypted_key = b64u(encryptedKey);
             if (recipient.unprotectedHeader || parameters)
                 target.header = { ...recipient.unprotectedHeader, ...parameters };
         }

package/dist/webapi/jwk/thumbprint.js

@@ -1,5 +1,5 @@
 import digest from '../lib/digest.js';
-import { encode as base64url } from '../lib/base64url.js';
+import { encode as b64u } from '../util/base64url.js';
 import { JOSENotSupported, JWKInvalid } from '../util/errors.js';
 import { encoder } from '../lib/buffer_utils.js';
 import isKeyLike from '../lib/is_key_like.js';
@@ -54,7 +54,7 @@ export async function calculateJwkThumbprint(key, digestAlgorithm) {
             throw new JOSENotSupported('"kty" (Key Type) Parameter missing or unsupported');
     }
     const data = encoder.encode(JSON.stringify(components));
-    return base64url(await digest(digestAlgorithm, data));
+    return b64u(await digest(digestAlgorithm, data));
 }
 export async function calculateJwkThumbprintUri(key, digestAlgorithm) {
     digestAlgorithm ??= 'sha256';

package/dist/webapi/jwks/remote.js

@@ -9,16 +9,16 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v6.0.5';
+    const VERSION = 'v6.0.7';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const customFetch = Symbol();
-async function fetchJwks(url, options) {
-    const response = await (options?.[customFetch] || fetch)(url, {
+async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
+    const response = await fetchImpl(url, {
         method: 'GET',
-        signal: options.signal,
+        signal,
         redirect: 'manual',
-        headers: options.headers,
+        headers,
     }).catch((err) => {
         if (err.name === 'TimeoutError') {
             throw new JWKSTimeout();
@@ -58,7 +58,8 @@ class RemoteJWKSet {
     _cacheMaxAge;
     _jwksTimestamp;
     _pendingFetch;
-    _options;
+    _headers;
+    [customFetch];
     _local;
     _cache;
     constructor(url, options) {
@@ -66,12 +67,20 @@ class RemoteJWKSet {
             throw new TypeError('url must be an instance of URL');
         }
         this._url = new URL(url.href);
-        this._options = { headers: options?.headers };
         this._timeoutDuration =
             typeof options?.timeoutDuration === 'number' ? options?.timeoutDuration : 5000;
         this._cooldownDuration =
             typeof options?.cooldownDuration === 'number' ? options?.cooldownDuration : 30000;
         this._cacheMaxAge = typeof options?.cacheMaxAge === 'number' ? options?.cacheMaxAge : 600000;
+        this._headers = new Headers(options?.headers);
+        if (USER_AGENT && !this._headers.has('User-Agent')) {
+            this._headers.set('User-Agent', USER_AGENT);
+        }
+        if (!this._headers.has('accept')) {
+            this._headers.set('accept', 'application/json');
+            this._headers.append('accept', 'application/jwk-set+json');
+        }
+        this[customFetch] = options?.[customFetch];
         if (options?.[jwksCache] !== undefined) {
             this._cache = options?.[jwksCache];
             if (isFreshJwksCache(options?.[jwksCache], this._cacheMaxAge)) {
@@ -111,19 +120,7 @@ class RemoteJWKSet {
         if (this._pendingFetch && isCloudflareWorkers()) {
             this._pendingFetch = undefined;
         }
-        const headers = new Headers(this._options.headers);
-        if (USER_AGENT && !headers.has('User-Agent')) {
-            headers.set('User-Agent', USER_AGENT);
-            this._options.headers = Object.fromEntries(headers.entries());
-        }
-        if (!headers.has('accept')) {
-            headers.set('accept', 'application/json');
-            headers.append('accept', 'application/jwk-set+json');
-        }
-        this._pendingFetch ||= fetchJwks(this._url.href, {
-            headers,
-            signal: AbortSignal.timeout(this._timeoutDuration),
-        })
+        this._pendingFetch ||= fetchJwks(this._url.href, this._headers, AbortSignal.timeout(this._timeoutDuration), this[customFetch])
             .then((json) => {
             this._local = createLocalJWKSet(json);
             if (this._cache) {

package/dist/webapi/jws/flattened/sign.js

@@ -1,4 +1,4 @@
-import { encode as base64url } from '../../lib/base64url.js';
+import { encode as b64u } from '../../util/base64url.js';
 import sign from '../../lib/sign.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import { JWSInvalid } from '../../util/errors.js';
@@ -56,11 +56,11 @@ export class FlattenedSign {
         checkKeyType(alg, key, 'sign');
         let payload = this._payload;
         if (b64) {
-            payload = encoder.encode(base64url(payload));
+            payload = encoder.encode(b64u(payload));
         }
         let protectedHeader;
         if (this._protectedHeader) {
-            protectedHeader = encoder.encode(base64url(JSON.stringify(this._protectedHeader)));
+            protectedHeader = encoder.encode(b64u(JSON.stringify(this._protectedHeader)));
         }
         else {
             protectedHeader = encoder.encode('');
@@ -69,7 +69,7 @@ export class FlattenedSign {
         const k = await normalizeKey(key, alg);
         const signature = await sign(alg, k, data);
         const jws = {
-            signature: base64url(signature),
+            signature: b64u(signature),
             payload: '',
         };
         if (b64) {

package/dist/webapi/jws/flattened/verify.js

@@ -1,4 +1,4 @@
-import { decode as base64url } from '../../lib/base64url.js';
+import { decode as b64u } from '../../util/base64url.js';
 import verify from '../../lib/verify.js';
 import { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';
 import { concat, encoder, decoder } from '../../lib/buffer_utils.js';
@@ -30,7 +30,7 @@ export async function flattenedVerify(jws, key, options) {
     let parsedProt = {};
     if (jws.protected) {
         try {
-            const protectedHeader = base64url(jws.protected);
+            const protectedHeader = b64u(jws.protected);
             parsedProt = JSON.parse(decoder.decode(protectedHeader));
         }
         catch {
@@ -77,7 +77,7 @@ export async function flattenedVerify(jws, key, options) {
     const data = concat(encoder.encode(jws.protected ?? ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);
     let signature;
     try {
-        signature = base64url(jws.signature);
+        signature = b64u(jws.signature);
     }
     catch {
         throw new JWSInvalid('Failed to base64url decode the signature');
@@ -90,7 +90,7 @@ export async function flattenedVerify(jws, key, options) {
     let payload;
     if (b64) {
         try {
-            payload = base64url(jws.payload);
+            payload = b64u(jws.payload);
         }
         catch {
             throw new JWSInvalid('Failed to base64url decode the payload');

package/dist/webapi/jwt/unsecured.js

@@ -1,12 +1,12 @@
-import * as base64url from '../lib/base64url.js';
+import * as b64u from '../util/base64url.js';
 import { decoder } from '../lib/buffer_utils.js';
 import { JWTInvalid } from '../util/errors.js';
 import jwtPayload from '../lib/jwt_claims_set.js';
 import { ProduceJWT } from './produce.js';
 export class UnsecuredJWT extends ProduceJWT {
     encode() {
-        const header = base64url.encode(JSON.stringify({ alg: 'none' }));
-        const payload = base64url.encode(JSON.stringify(this._payload));
+        const header = b64u.encode(JSON.stringify({ alg: 'none' }));
+        const payload = b64u.encode(JSON.stringify(this._payload));
         return `${header}.${payload}.`;
     }
     static decode(jwt, options) {
@@ -19,14 +19,14 @@ export class UnsecuredJWT extends ProduceJWT {
         }
         let header;
         try {
-            header = JSON.parse(decoder.decode(base64url.decode(encodedHeader)));
+            header = JSON.parse(decoder.decode(b64u.decode(encodedHeader)));
             if (header.alg !== 'none')
                 throw new Error();
         }
         catch {
             throw new JWTInvalid('Invalid Unsecured JWT');
         }
-        const payload = jwtPayload(header, base64url.decode(encodedPayload), options);
+        const payload = jwtPayload(header, b64u.decode(encodedPayload), options);
         return { payload, header };
     }
 }

package/dist/webapi/key/import.js

@@ -1,4 +1,4 @@
-import { decode as decodeBase64URL } from '../lib/base64url.js';
+import { decode as decodeBase64URL } from '../util/base64url.js';
 import { fromSPKI, fromPKCS8, fromX509 } from '../lib/asn1.js';
 import toCryptoKey from '../lib/jwk_to_key.js';
 import { JOSENotSupported } from '../util/errors.js';

package/dist/webapi/lib/aesgcmkw.js

@@ -1,13 +1,13 @@
 import encrypt from './encrypt.js';
 import decrypt from './decrypt.js';
-import { encode as base64url } from '../lib/base64url.js';
+import { encode as b64u } from '../util/base64url.js';
 export async function wrap(alg, key, cek, iv) {
     const jweAlgorithm = alg.slice(0, 7);
     const wrapped = await encrypt(jweAlgorithm, cek, key, iv, new Uint8Array(0));
     return {
         encryptedKey: wrapped.ciphertext,
-        iv: base64url(wrapped.iv),
-        tag: base64url(wrapped.tag),
+        iv: b64u(wrapped.iv),
+        tag: b64u(wrapped.tag),
     };
 }
 export async function unwrap(alg, key, encryptedKey, iv, tag) {

package/dist/webapi/lib/asn1.js

@@ -1,5 +1,5 @@
 import invalidKeyInput from './invalid_key_input.js';
-import { encodeBase64, decodeBase64 } from './base64url.js';
+import { encodeBase64, decodeBase64 } from '../lib/base64.js';
 import { JOSENotSupported } from '../util/errors.js';
 import { isCryptoKey, isKeyObject } from './is_key_like.js';
 const formatPEM = (b64, descriptor) => {

package/dist/webapi/lib/base64.js

@@ -0,0 +1,22 @@
+export function encodeBase64(input) {
+    if (Uint8Array.prototype.toBase64) {
+        return input.toBase64();
+    }
+    const CHUNK_SIZE = 0x8000;
+    const arr = [];
+    for (let i = 0; i < input.length; i += CHUNK_SIZE) {
+        arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
+    }
+    return btoa(arr.join(''));
+}
+export function decodeBase64(encoded) {
+    if (Uint8Array.fromBase64) {
+        return Uint8Array.fromBase64(encoded);
+    }
+    const binary = atob(encoded);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}

package/dist/webapi/lib/decrypt_key_management.js

@@ -2,7 +2,7 @@ import * as aeskw from './aeskw.js';
 import * as ecdhes from './ecdhes.js';
 import * as pbes2kw from './pbes2kw.js';
 import * as rsaes from './rsaes.js';
-import * as base64url from '../lib/base64url.js';
+import { decode as b64u } from '../util/base64url.js';
 import { JOSENotSupported, JWEInvalid } from '../util/errors.js';
 import { bitLength as cekLength } from '../lib/cek.js';
 import { importJWK } from '../key/import.js';
@@ -35,7 +35,7 @@ export default async (alg, key, encryptedKey, joseHeader, options) => {
                 if (typeof joseHeader.apu !== 'string')
                     throw new JWEInvalid(`JOSE Header "apu" (Agreement PartyUInfo) invalid`);
                 try {
-                    partyUInfo = base64url.decode(joseHeader.apu);
+                    partyUInfo = b64u(joseHeader.apu);
                 }
                 catch {
                     throw new JWEInvalid('Failed to base64url decode the apu');
@@ -45,7 +45,7 @@ export default async (alg, key, encryptedKey, joseHeader, options) => {
                 if (typeof joseHeader.apv !== 'string')
                     throw new JWEInvalid(`JOSE Header "apv" (Agreement PartyVInfo) invalid`);
                 try {
-                    partyVInfo = base64url.decode(joseHeader.apv);
+                    partyVInfo = b64u(joseHeader.apv);
                 }
                 catch {
                     throw new JWEInvalid('Failed to base64url decode the apv');
@@ -81,7 +81,7 @@ export default async (alg, key, encryptedKey, joseHeader, options) => {
                 throw new JWEInvalid(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);
             let p2s;
             try {
-                p2s = base64url.decode(joseHeader.p2s);
+                p2s = b64u(joseHeader.p2s);
             }
             catch {
                 throw new JWEInvalid('Failed to base64url decode the p2s');
@@ -106,14 +106,14 @@ export default async (alg, key, encryptedKey, joseHeader, options) => {
                 throw new JWEInvalid(`JOSE Header "tag" (Authentication Tag) missing or invalid`);
             let iv;
             try {
-                iv = base64url.decode(joseHeader.iv);
+                iv = b64u(joseHeader.iv);
             }
             catch {
                 throw new JWEInvalid('Failed to base64url decode the iv');
             }
             let tag;
             try {
-                tag = base64url.decode(joseHeader.tag);
+                tag = b64u(joseHeader.tag);
             }
             catch {
                 throw new JWEInvalid('Failed to base64url decode the tag');

package/dist/webapi/lib/encrypt_key_management.js

@@ -2,7 +2,7 @@ import * as aeskw from './aeskw.js';
 import * as ecdhes from './ecdhes.js';
 import * as pbes2kw from './pbes2kw.js';
 import * as rsaes from './rsaes.js';
-import * as base64url from '../lib/base64url.js';
+import { encode as b64u } from '../util/base64url.js';
 import normalizeKey from './normalize_key.js';
 import generateCek, { bitLength as cekLength } from '../lib/cek.js';
 import { JOSENotSupported } from '../util/errors.js';
@@ -40,9 +40,9 @@ export default async (alg, enc, key, providedCek, providedParameters = {}) => {
             if (kty === 'EC')
                 parameters.epk.y = y;
             if (apu)
-                parameters.apu = base64url.encode(apu);
+                parameters.apu = b64u(apu);
             if (apv)
-                parameters.apv = base64url.encode(apv);
+                parameters.apv = b64u(apv);
             if (alg === 'ECDH-ES') {
                 cek = sharedSecret;
                 break;

package/dist/webapi/lib/key_to_jwk.js

@@ -1,5 +1,5 @@
 import invalidKeyInput from './invalid_key_input.js';
-import { encode as base64url } from './base64url.js';
+import { encode as b64u } from '../util/base64url.js';
 import { isCryptoKey, isKeyObject } from './is_key_like.js';
 export default async function keyToJWK(key) {
     if (isKeyObject(key)) {
@@ -13,7 +13,7 @@ export default async function keyToJWK(key) {
     if (key instanceof Uint8Array) {
         return {
             kty: 'oct',
-            k: base64url(key),
+            k: b64u(key),
         };
     }
     if (!isCryptoKey(key)) {

package/dist/webapi/lib/normalize_key.js

@@ -1,5 +1,5 @@
 import { isJWK } from './is_jwk.js';
-import { decode } from './base64url.js';
+import { decode } from '../util/base64url.js';
 import importJWK from './jwk_to_key.js';
 import { isCryptoKey, isKeyObject } from './is_key_like.js';
 let cache;

package/dist/webapi/lib/pbes2kw.js

@@ -1,4 +1,4 @@
-import { encode as base64url } from './base64url.js';
+import { encode as b64u } from '../util/base64url.js';
 import * as aeskw from './aeskw.js';
 import { checkEncCryptoKey } from './crypto_key.js';
 import { concat, encoder } from './buffer_utils.js';
@@ -29,7 +29,7 @@ async function deriveKey(p2s, alg, p2c, key) {
 export async function wrap(alg, key, cek, p2c = 2048, p2s = crypto.getRandomValues(new Uint8Array(16))) {
     const derived = await deriveKey(p2s, alg, p2c, key);
     const encryptedKey = await aeskw.wrap(alg.slice(-6), derived, cek);
-    return { encryptedKey, p2c, p2s: base64url(p2s) };
+    return { encryptedKey, p2c, p2s: b64u(p2s) };
 }
 export async function unwrap(alg, key, encryptedKey, p2c, p2s) {
     const derived = await deriveKey(p2s, alg, p2c, key);

package/dist/webapi/util/base64url.js

@@ -1,3 +1,30 @@
-import * as base64url from '../lib/base64url.js';
-export const encode = base64url.encode;
-export const decode = base64url.decode;
+import { encoder, decoder } from '../lib/buffer_utils.js';
+import { encodeBase64, decodeBase64 } from '../lib/base64.js';
+export function decode(input) {
+    if (Uint8Array.fromBase64) {
+        return Uint8Array.fromBase64(typeof input === 'string' ? input : decoder.decode(input), {
+            alphabet: 'base64url',
+        });
+    }
+    let encoded = input;
+    if (encoded instanceof Uint8Array) {
+        encoded = decoder.decode(encoded);
+    }
+    encoded = encoded.replace(/-/g, '+').replace(/_/g, '/').replace(/\s/g, '');
+    try {
+        return decodeBase64(encoded);
+    }
+    catch {
+        throw new TypeError('The input to be decoded is not correctly encoded.');
+    }
+}
+export function encode(input) {
+    let unencoded = input;
+    if (typeof unencoded === 'string') {
+        unencoded = encoder.encode(unencoded);
+    }
+    if (Uint8Array.prototype.toBase64) {
+        return unencoded.toBase64({ alphabet: 'base64url', omitPadding: true });
+    }
+    return encodeBase64(unencoded).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+}

package/dist/webapi/util/decode_jwt.js

@@ -1,4 +1,4 @@
-import { decode as base64url } from './base64url.js';
+import { decode as b64u } from './base64url.js';
 import { decoder } from '../lib/buffer_utils.js';
 import isObject from '../lib/is_object.js';
 import { JWTInvalid } from './errors.js';
@@ -14,7 +14,7 @@ export function decodeJwt(jwt) {
         throw new JWTInvalid('JWTs must contain a payload');
     let decoded;
     try {
-        decoded = base64url(payload);
+        decoded = b64u(payload);
     }
     catch {
         throw new JWTInvalid('Failed to base64url decode the payload');

package/dist/webapi/util/decode_protected_header.js

@@ -1,4 +1,4 @@
-import { decode as base64url } from './base64url.js';
+import { decode as b64u } from './base64url.js';
 import { decoder } from '../lib/buffer_utils.js';
 import isObject from '../lib/is_object.js';
 export function decodeProtectedHeader(token) {
@@ -22,7 +22,7 @@ export function decodeProtectedHeader(token) {
         if (typeof protectedB64u !== 'string' || !protectedB64u) {
             throw new Error();
         }
-        const result = JSON.parse(decoder.decode(base64url(protectedB64u)));
+        const result = JSON.parse(decoder.decode(b64u(protectedB64u)));
         if (!isObject(result)) {
             throw new Error();
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "6.0.5",
+  "version": "6.0.7",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "browser",

package/dist/webapi/lib/base64url.js

@@ -1,51 +0,0 @@
-import { encoder, decoder } from '../lib/buffer_utils.js';
-export function encodeBase64(input) {
-    if (Uint8Array.prototype.toBase64) {
-        return input.toBase64();
-    }
-    const CHUNK_SIZE = 0x8000;
-    const arr = [];
-    for (let i = 0; i < input.length; i += CHUNK_SIZE) {
-        arr.push(String.fromCharCode.apply(null, input.subarray(i, i + CHUNK_SIZE)));
-    }
-    return btoa(arr.join(''));
-}
-export function encode(input) {
-    let unencoded = input;
-    if (typeof unencoded === 'string') {
-        unencoded = encoder.encode(unencoded);
-    }
-    if (Uint8Array.prototype.toBase64) {
-        return unencoded.toBase64({ alphabet: 'base64url', omitPadding: true });
-    }
-    return encodeBase64(unencoded).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
-}
-export function decodeBase64(encoded) {
-    if (Uint8Array.fromBase64) {
-        return Uint8Array.fromBase64(encoded);
-    }
-    const binary = atob(encoded);
-    const bytes = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i++) {
-        bytes[i] = binary.charCodeAt(i);
-    }
-    return bytes;
-}
-export function decode(input) {
-    if (Uint8Array.fromBase64) {
-        return Uint8Array.fromBase64(typeof input === 'string' ? input : decoder.decode(input), {
-            alphabet: 'base64url',
-        });
-    }
-    let encoded = input;
-    if (encoded instanceof Uint8Array) {
-        encoded = decoder.decode(encoded);
-    }
-    encoded = encoded.replace(/-/g, '+').replace(/_/g, '/').replace(/\s/g, '');
-    try {
-        return decodeBase64(encoded);
-    }
-    catch {
-        throw new TypeError('The input to be decoded is not correctly encoded.');
-    }
-}