jose 6.1.0 → 6.1.1

package/README.md

@@ -1,6 +1,6 @@
 # jose
 
-`jose` is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. The module is designed to work across various Web-interoperable runtimes including Node.js, browsers, Cloudflare Workers, Deno, Bun, and others.
+`jose` is a JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. The module is designed to work across various Web-interoperable runtimes including Node.js, browsers, Cloudflare Workers, Deno, Bun, and others.
 
 ## Sponsor
 
@@ -110,7 +110,6 @@ The following runtimes are supported _(this is not an exhaustive list)_:
 - [Deno](https://github.com/panva/jose/issues/266)
 - [Electron](https://github.com/panva/jose/issues/264)
 - [Node.js](https://github.com/panva/jose/issues/262)
-- [Vercel's Edge Runtime](https://github.com/panva/jose/issues/301)
 
 Please note that certain algorithms may not be available depending on the runtime used. You can find a list of available algorithms for each runtime in the specific issue links provided above.
 
@@ -137,6 +136,8 @@ Please note that certain algorithms may not be available depending on the runtim
 - JSON Web Key Thumbprint URI - [RFC9278](https://www.rfc-editor.org/rfc/rfc9278)
 - JWS Unencoded Payload Option - [RFC7797](https://www.rfc-editor.org/rfc/rfc7797)
 - CFRG Elliptic Curve ECDH and Signatures - [RFC8037](https://www.rfc-editor.org/rfc/rfc8037)
+- Fully-Specified Algorithms for JOSE - [RFC9864](https://www.rfc-editor.org/rfc/rfc9864.html)
+- ML-DSA for JOSE - [draft-ietf-cose-dilithium-10](https://www.ietf.org/archive/id/draft-ietf-cose-dilithium-10.html)
 
 The algorithm implementations in `jose` have been tested using test vectors from their respective specifications as well as [RFC7520](https://www.rfc-editor.org/rfc/rfc7520).
 

package/dist/types/jwe/compact/encrypt.d.ts

@@ -46,10 +46,10 @@ export declare class CompactEncrypt {
      */
     setProtectedHeader(protectedHeader: types.CompactJWEHeaderParameters): this;
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting. Use of this is method is
-     * really only needed for ECDH based algorithms when utilizing the Agreement PartyUInfo or
-     * Agreement PartyVInfo parameters. Other parameters will always be randomly generated when needed
-     * and missing.
+     * Sets the JWE Key Management parameters to be used when encrypting.
+     *
+     * (ECDH-ES) Use of this method is needed for ECDH based algorithms to set the "apu" (Agreement
+     * PartyUInfo) or "apv" (Agreement PartyVInfo) parameters.
      *
      * @param parameters JWE Key Management parameters.
      */

package/dist/types/jwe/flattened/encrypt.d.ts

@@ -20,10 +20,10 @@ export declare class FlattenedEncrypt {
      */
     constructor(plaintext: Uint8Array);
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting. Use of this is method is
-     * really only needed for ECDH based algorithms when utilizing the "apu" (Agreement PartyUInfo) or
-     * "apv" (Agreement PartyVInfo) parameters. Other parameters will always be randomly generated
-     * when needed and missing.
+     * Sets the JWE Key Management parameters to be used when encrypting.
+     *
+     * (ECDH-ES) Use of this method is needed for ECDH based algorithms to set the "apu" (Agreement
+     * PartyUInfo) or "apv" (Agreement PartyVInfo) parameters.
      *
      * @param parameters JWE Key Management parameters.
      */

package/dist/types/jwe/general/encrypt.d.ts

@@ -12,6 +12,15 @@ export interface Recipient {
      * @param unprotectedHeader JWE Per-Recipient Unprotected Header.
      */
     setUnprotectedHeader(unprotectedHeader: types.JWEHeaderParameters): Recipient;
+    /**
+     * Sets the JWE Key Management parameters to be used when encrypting.
+     *
+     * (ECDH-ES) Use of this method is needed for ECDH based algorithms to set the "apu" (Agreement
+     * PartyUInfo) or "apv" (Agreement PartyVInfo) parameters.
+     *
+     * @param parameters JWE Key Management parameters.
+     */
+    setKeyManagementParameters(parameters: types.JWEKeyManagementHeaderParameters): Recipient;
     /** A shorthand for calling addRecipient() on the enclosing {@link GeneralEncrypt} instance */
     addRecipient(...args: Parameters<GeneralEncrypt['addRecipient']>): Recipient;
     /** A shorthand for calling encrypt() on the enclosing {@link GeneralEncrypt} instance */

package/dist/types/jwt/encrypt.d.ts

@@ -34,10 +34,10 @@ export declare class EncryptJWT implements types.ProduceJWT {
      */
     setProtectedHeader(protectedHeader: types.CompactJWEHeaderParameters): this;
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting. Use of this is method is
-     * really only needed for ECDH based algorithms when utilizing the "apu" (Agreement PartyUInfo) or
-     * "apv" (Agreement PartyVInfo) parameters. Other parameters will always be randomly generated
-     * when needed and missing.
+     * Sets the JWE Key Management parameters to be used when encrypting.
+     *
+     * (ECDH-ES) Use of this method is needed for ECDH based algorithms to set the "apu" (Agreement
+     * PartyUInfo) or "apv" (Agreement PartyVInfo) parameters.
      *
      * @param parameters JWE Key Management parameters.
      */

package/dist/types/types.d.ts

@@ -165,7 +165,7 @@ export interface GenericGetKeyFunction<IProtectedHeader, IToken, ReturnKeyTypes>
    * Dynamic key resolution function. No token components have been verified at the time of this
    * function call.
    *
-   * If you cannot match a key suitable for the token, throw an error instead.
+   * If a suitable key for the token cannot be matched, throw an error instead.
    *
    * @param protectedHeader JWE or JWS Protected Header.
    * @param token The consumed JWE or JWS token.
@@ -304,25 +304,34 @@ export interface JWSHeaderParameters extends JoseHeaderParameters {
 
 /** Recognized JWE Key Management-related Header Parameters. */
 export interface JWEKeyManagementHeaderParameters {
+  /**
+   * ECDH-ES "apu" (Agreement PartyUInfo). This will be used as a JOSE Header Parameter and will be
+   * used in ECDH's ConcatKDF.
+   */
   apu?: Uint8Array
+
+  /**
+   * ECDH-ES "apv" (Agreement PartyVInfo). This will be used as a JOSE Header Parameter and will be
+   * used in ECDH's ConcatKDF.
+   */
   apv?: Uint8Array
   /**
-   * @deprecated You should not use this parameter. It is only really intended for test and vector
+   * @deprecated You should not use this parameter. It is only intended for testing and vector
    *   validation purposes.
    */
   p2c?: number
   /**
-   * @deprecated You should not use this parameter. It is only really intended for test and vector
+   * @deprecated You should not use this parameter. It is only intended for testing and vector
    *   validation purposes.
    */
   p2s?: Uint8Array
   /**
-   * @deprecated You should not use this parameter. It is only really intended for test and vector
+   * @deprecated You should not use this parameter. It is only intended for testing and vector
    *   validation purposes.
    */
   iv?: Uint8Array
   /**
-   * @deprecated You should not use this parameter. It is only really intended for test and vector
+   * @deprecated You should not use this parameter. It is only intended for testing and vector
    *   validation purposes.
    */
   epk?: CryptoKey | KeyObject

package/dist/webapi/jwe/flattened/decrypt.js

@@ -1,15 +1,15 @@
 import { decode as b64u } from '../../util/base64url.js';
-import decrypt from '../../lib/decrypt.js';
+import { decrypt } from '../../lib/decrypt.js';
 import { JOSEAlgNotAllowed, JOSENotSupported, JWEInvalid } from '../../util/errors.js';
-import isDisjoint from '../../lib/is_disjoint.js';
-import isObject from '../../lib/is_object.js';
-import decryptKeyManagement from '../../lib/decrypt_key_management.js';
-import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
-import generateCek from '../../lib/cek.js';
-import validateCrit from '../../lib/validate_crit.js';
-import validateAlgorithms from '../../lib/validate_algorithms.js';
-import normalizeKey from '../../lib/normalize_key.js';
-import checkKeyType from '../../lib/check_key_type.js';
+import { isDisjoint } from '../../lib/is_disjoint.js';
+import { isObject } from '../../lib/is_object.js';
+import { decryptKeyManagement } from '../../lib/decrypt_key_management.js';
+import { decoder, concat, encode } from '../../lib/buffer_utils.js';
+import { generateCek } from '../../lib/cek.js';
+import { validateCrit } from '../../lib/validate_crit.js';
+import { validateAlgorithms } from '../../lib/validate_algorithms.js';
+import { normalizeKey } from '../../lib/normalize_key.js';
+import { checkKeyType } from '../../lib/check_key_type.js';
 export async function flattenedDecrypt(jwe, key, options) {
     if (!isObject(jwe)) {
         throw new JWEInvalid('Flattened JWE must be an object');
@@ -124,10 +124,10 @@ export async function flattenedDecrypt(jwe, key, options) {
             throw new JWEInvalid('Failed to base64url decode the tag');
         }
     }
-    const protectedHeader = encoder.encode(jwe.protected ?? '');
+    const protectedHeader = jwe.protected !== undefined ? encode(jwe.protected) : new Uint8Array();
     let additionalData;
     if (jwe.aad !== undefined) {
-        additionalData = concat(protectedHeader, encoder.encode('.'), encoder.encode(jwe.aad));
+        additionalData = concat(protectedHeader, encode('.'), encode(jwe.aad));
     }
     else {
         additionalData = protectedHeader;

package/dist/webapi/jwe/flattened/encrypt.js

@@ -1,13 +1,13 @@
 import { encode as b64u } from '../../util/base64url.js';
 import { unprotected } from '../../lib/private_symbols.js';
-import encrypt from '../../lib/encrypt.js';
-import encryptKeyManagement from '../../lib/encrypt_key_management.js';
+import { encrypt } from '../../lib/encrypt.js';
+import { encryptKeyManagement } from '../../lib/encrypt_key_management.js';
 import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
-import isDisjoint from '../../lib/is_disjoint.js';
-import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
-import validateCrit from '../../lib/validate_crit.js';
-import normalizeKey from '../../lib/normalize_key.js';
-import checkKeyType from '../../lib/check_key_type.js';
+import { isDisjoint } from '../../lib/is_disjoint.js';
+import { concat, encode } from '../../lib/buffer_utils.js';
+import { validateCrit } from '../../lib/validate_crit.js';
+import { normalizeKey } from '../../lib/normalize_key.js';
+import { checkKeyType } from '../../lib/check_key_type.js';
 export class FlattenedEncrypt {
     #plaintext;
     #protectedHeader;
@@ -120,20 +120,24 @@ export class FlattenedEncrypt {
             }
         }
         let additionalData;
-        let protectedHeader;
+        let protectedHeaderS;
+        let protectedHeaderB;
         let aadMember;
         if (this.#protectedHeader) {
-            protectedHeader = encoder.encode(b64u(JSON.stringify(this.#protectedHeader)));
+            protectedHeaderS = b64u(JSON.stringify(this.#protectedHeader));
+            protectedHeaderB = encode(protectedHeaderS);
         }
         else {
-            protectedHeader = encoder.encode('');
+            protectedHeaderS = '';
+            protectedHeaderB = new Uint8Array();
         }
         if (this.#aad) {
             aadMember = b64u(this.#aad);
-            additionalData = concat(protectedHeader, encoder.encode('.'), encoder.encode(aadMember));
+            const aadMemberBytes = encode(aadMember);
+            additionalData = concat(protectedHeaderB, encode('.'), aadMemberBytes);
         }
         else {
-            additionalData = protectedHeader;
+            additionalData = protectedHeaderB;
         }
         const { ciphertext, tag, iv } = await encrypt(enc, this.#plaintext, cek, this.#iv, additionalData);
         const jwe = {
@@ -152,7 +156,7 @@ export class FlattenedEncrypt {
             jwe.aad = aadMember;
         }
         if (this.#protectedHeader) {
-            jwe.protected = decoder.decode(protectedHeader);
+            jwe.protected = protectedHeaderS;
         }
         if (this.#sharedUnprotectedHeader) {
             jwe.unprotected = this.#sharedUnprotectedHeader;

package/dist/webapi/jwe/general/decrypt.js

@@ -1,6 +1,6 @@
 import { flattenedDecrypt } from '../flattened/decrypt.js';
 import { JWEDecryptionFailed, JWEInvalid } from '../../util/errors.js';
-import isObject from '../../lib/is_object.js';
+import { isObject } from '../../lib/is_object.js';
 export async function generalDecrypt(jwe, key, options) {
     if (!isObject(jwe)) {
         throw new JWEInvalid('General JWE must be an object');

package/dist/webapi/jwe/general/encrypt.js

@@ -1,16 +1,17 @@
 import { FlattenedEncrypt } from '../flattened/encrypt.js';
 import { unprotected } from '../../lib/private_symbols.js';
 import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
-import generateCek from '../../lib/cek.js';
-import isDisjoint from '../../lib/is_disjoint.js';
-import encryptKeyManagement from '../../lib/encrypt_key_management.js';
+import { generateCek } from '../../lib/cek.js';
+import { isDisjoint } from '../../lib/is_disjoint.js';
+import { encryptKeyManagement } from '../../lib/encrypt_key_management.js';
 import { encode as b64u } from '../../util/base64url.js';
-import validateCrit from '../../lib/validate_crit.js';
-import normalizeKey from '../../lib/normalize_key.js';
-import checkKeyType from '../../lib/check_key_type.js';
+import { validateCrit } from '../../lib/validate_crit.js';
+import { normalizeKey } from '../../lib/normalize_key.js';
+import { checkKeyType } from '../../lib/check_key_type.js';
 class IndividualRecipient {
     #parent;
     unprotectedHeader;
+    keyManagementParameters;
     key;
     options;
     constructor(enc, key, options) {
@@ -25,6 +26,13 @@ class IndividualRecipient {
         this.unprotectedHeader = unprotectedHeader;
         return this;
     }
+    setKeyManagementParameters(parameters) {
+        if (this.keyManagementParameters) {
+            throw new TypeError('setKeyManagementParameters can only be called once');
+        }
+        this.keyManagementParameters = parameters;
+        return this;
+    }
     addRecipient(...args) {
         return this.#parent.addRecipient(...args);
     }
@@ -132,20 +140,12 @@ export class GeneralEncrypt {
         const cek = generateCek(enc);
         const jwe = {
             ciphertext: '',
-            iv: '',
             recipients: [],
-            tag: '',
         };
         for (let i = 0; i < this.#recipients.length; i++) {
             const recipient = this.#recipients[i];
             const target = {};
             jwe.recipients.push(target);
-            const joseHeader = {
-                ...this.#protectedHeader,
-                ...this.#unprotectedHeader,
-                ...recipient.unprotectedHeader,
-            };
-            const p2c = joseHeader.alg.startsWith('PBES2') ? 2048 + i : undefined;
             if (i === 0) {
                 const flattened = await new FlattenedEncrypt(this.#plaintext)
                     .setAdditionalAuthenticatedData(this.#aad)
@@ -153,7 +153,7 @@ export class GeneralEncrypt {
                     .setProtectedHeader(this.#protectedHeader)
                     .setSharedUnprotectedHeader(this.#unprotectedHeader)
                     .setUnprotectedHeader(recipient.unprotectedHeader)
-                    .setKeyManagementParameters({ p2c })
+                    .setKeyManagementParameters(recipient.keyManagementParameters)
                     .encrypt(recipient.key, {
                     ...recipient.options,
                     [unprotected]: true,
@@ -177,7 +177,7 @@ export class GeneralEncrypt {
                 this.#unprotectedHeader?.alg;
             checkKeyType(alg === 'dir' ? enc : alg, recipient.key, 'encrypt');
             const k = await normalizeKey(recipient.key, alg);
-            const { encryptedKey, parameters } = await encryptKeyManagement(alg, enc, k, cek, { p2c });
+            const { encryptedKey, parameters } = await encryptKeyManagement(alg, enc, k, cek, recipient.keyManagementParameters);
             target.encrypted_key = b64u(encryptedKey);
             if (recipient.unprotectedHeader || parameters)
                 target.header = { ...recipient.unprotectedHeader, ...parameters };

package/dist/webapi/jwk/embedded.js

@@ -1,5 +1,5 @@
 import { importJWK } from '../key/import.js';
-import isObject from '../lib/is_object.js';
+import { isObject } from '../lib/is_object.js';
 import { JWSInvalid } from '../util/errors.js';
 export async function EmbeddedJWK(protectedHeader, token) {
     const joseHeader = {

package/dist/webapi/jwk/thumbprint.js

@@ -1,11 +1,11 @@
-import digest from '../lib/digest.js';
+import { digest } from '../lib/digest.js';
 import { encode as b64u } from '../util/base64url.js';
 import { JOSENotSupported, JWKInvalid } from '../util/errors.js';
-import { encoder } from '../lib/buffer_utils.js';
-import isKeyLike from '../lib/is_key_like.js';
+import { encode } from '../lib/buffer_utils.js';
+import { isKeyLike } from '../lib/is_key_like.js';
 import { isJWK } from '../lib/is_jwk.js';
 import { exportJWK } from '../key/export.js';
-import invalidKeyInput from '../lib/invalid_key_input.js';
+import { invalidKeyInput } from '../lib/invalid_key_input.js';
 const check = (value, description) => {
     if (typeof value !== 'string' || !value) {
         throw new JWKInvalid(`${description} missing or invalid`);
@@ -58,7 +58,7 @@ export async function calculateJwkThumbprint(key, digestAlgorithm) {
         default:
             throw new JOSENotSupported('"kty" (Key Type) Parameter missing or unsupported');
     }
-    const data = encoder.encode(JSON.stringify(components));
+    const data = encode(JSON.stringify(components));
     return b64u(await digest(digestAlgorithm, data));
 }
 export async function calculateJwkThumbprintUri(key, digestAlgorithm) {

package/dist/webapi/jwks/local.js

@@ -1,6 +1,6 @@
 import { importJWK } from '../key/import.js';
 import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, } from '../util/errors.js';
-import isObject from '../lib/is_object.js';
+import { isObject } from '../lib/is_object.js';
 function getKtyFromAlg(alg) {
     switch (typeof alg === 'string' && alg.slice(0, 2)) {
         case 'RS':

package/dist/webapi/jwks/remote.js

@@ -1,6 +1,6 @@
 import { JOSEError, JWKSNoMatchingKey, JWKSTimeout } from '../util/errors.js';
 import { createLocalJWKSet } from './local.js';
-import isObject from '../lib/is_object.js';
+import { isObject } from '../lib/is_object.js';
 function isCloudflareWorkers() {
     return (typeof WebSocketPair !== 'undefined' ||
         (typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers') ||
@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v6.1.0';
+    const VERSION = 'v6.1.1';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const customFetch = Symbol();

package/dist/webapi/jws/flattened/sign.js

@@ -1,11 +1,11 @@
 import { encode as b64u } from '../../util/base64url.js';
-import sign from '../../lib/sign.js';
-import isDisjoint from '../../lib/is_disjoint.js';
+import { sign } from '../../lib/sign.js';
+import { isDisjoint } from '../../lib/is_disjoint.js';
 import { JWSInvalid } from '../../util/errors.js';
-import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
-import checkKeyType from '../../lib/check_key_type.js';
-import validateCrit from '../../lib/validate_crit.js';
-import normalizeKey from '../../lib/normalize_key.js';
+import { concat, encode } from '../../lib/buffer_utils.js';
+import { checkKeyType } from '../../lib/check_key_type.js';
+import { validateCrit } from '../../lib/validate_crit.js';
+import { normalizeKey } from '../../lib/normalize_key.js';
 export class FlattenedSign {
     #payload;
     #protectedHeader;
@@ -54,32 +54,38 @@ export class FlattenedSign {
             throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
         }
         checkKeyType(alg, key, 'sign');
-        let payload = this.#payload;
+        let payloadS;
+        let payloadB;
         if (b64) {
-            payload = encoder.encode(b64u(payload));
+            payloadS = b64u(this.#payload);
+            payloadB = encode(payloadS);
         }
-        let protectedHeader;
+        else {
+            payloadB = this.#payload;
+            payloadS = '';
+        }
+        let protectedHeaderString;
+        let protectedHeaderBytes;
         if (this.#protectedHeader) {
-            protectedHeader = encoder.encode(b64u(JSON.stringify(this.#protectedHeader)));
+            protectedHeaderString = b64u(JSON.stringify(this.#protectedHeader));
+            protectedHeaderBytes = encode(protectedHeaderString);
         }
         else {
-            protectedHeader = encoder.encode('');
+            protectedHeaderString = '';
+            protectedHeaderBytes = new Uint8Array();
         }
-        const data = concat(protectedHeader, encoder.encode('.'), payload);
+        const data = concat(protectedHeaderBytes, encode('.'), payloadB);
         const k = await normalizeKey(key, alg);
         const signature = await sign(alg, k, data);
         const jws = {
             signature: b64u(signature),
-            payload: '',
+            payload: payloadS,
         };
-        if (b64) {
-            jws.payload = decoder.decode(payload);
-        }
         if (this.#unprotectedHeader) {
             jws.header = this.#unprotectedHeader;
         }
         if (this.#protectedHeader) {
-            jws.protected = decoder.decode(protectedHeader);
+            jws.protected = protectedHeaderString;
         }
         return jws;
     }

package/dist/webapi/jws/flattened/verify.js

@@ -1,13 +1,13 @@
 import { decode as b64u } from '../../util/base64url.js';
-import verify from '../../lib/verify.js';
+import { verify } from '../../lib/verify.js';
 import { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';
-import { concat, encoder, decoder } from '../../lib/buffer_utils.js';
-import isDisjoint from '../../lib/is_disjoint.js';
-import isObject from '../../lib/is_object.js';
-import checkKeyType from '../../lib/check_key_type.js';
-import validateCrit from '../../lib/validate_crit.js';
-import validateAlgorithms from '../../lib/validate_algorithms.js';
-import normalizeKey from '../../lib/normalize_key.js';
+import { concat, encoder, decoder, encode } from '../../lib/buffer_utils.js';
+import { isDisjoint } from '../../lib/is_disjoint.js';
+import { isObject } from '../../lib/is_object.js';
+import { checkKeyType } from '../../lib/check_key_type.js';
+import { validateCrit } from '../../lib/validate_crit.js';
+import { validateAlgorithms } from '../../lib/validate_algorithms.js';
+import { normalizeKey } from '../../lib/normalize_key.js';
 export async function flattenedVerify(jws, key, options) {
     if (!isObject(jws)) {
         throw new JWSInvalid('Flattened JWS must be an object');
@@ -74,7 +74,11 @@ export async function flattenedVerify(jws, key, options) {
         resolvedKey = true;
     }
     checkKeyType(alg, key, 'verify');
-    const data = concat(encoder.encode(jws.protected ?? ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);
+    const data = concat(jws.protected !== undefined ? encode(jws.protected) : new Uint8Array(), encode('.'), typeof jws.payload === 'string'
+        ? b64
+            ? encode(jws.payload)
+            : encoder.encode(jws.payload)
+        : jws.payload);
     let signature;
     try {
         signature = b64u(jws.signature);

package/dist/webapi/jws/general/verify.js

@@ -1,6 +1,6 @@
 import { flattenedVerify } from '../flattened/verify.js';
 import { JWSInvalid, JWSSignatureVerificationFailed } from '../../util/errors.js';
-import isObject from '../../lib/is_object.js';
+import { isObject } from '../../lib/is_object.js';
 export async function generalVerify(jws, key, options) {
     if (!isObject(jws)) {
         throw new JWSInvalid('General JWS must be an object');

package/dist/webapi/key/export.js

@@ -1,5 +1,5 @@
 import { toSPKI as exportPublic, toPKCS8 as exportPrivate } from '../lib/asn1.js';
-import keyToJWK from '../lib/key_to_jwk.js';
+import { keyToJWK } from '../lib/key_to_jwk.js';
 export async function exportSPKI(key) {
     return exportPublic(key);
 }

package/dist/webapi/key/generate_key_pair.js

@@ -16,7 +16,7 @@ export async function generateKeyPair(alg, options) {
             algorithm = {
                 name: 'RSA-PSS',
                 hash: `SHA-${alg.slice(-3)}`,
-                publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
+                publicExponent: Uint8Array.of(0x01, 0x00, 0x01),
                 modulusLength: getModulusLengthOption(options),
             };
             keyUsages = ['sign', 'verify'];
@@ -27,7 +27,7 @@ export async function generateKeyPair(alg, options) {
             algorithm = {
                 name: 'RSASSA-PKCS1-v1_5',
                 hash: `SHA-${alg.slice(-3)}`,
-                publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
+                publicExponent: Uint8Array.of(0x01, 0x00, 0x01),
                 modulusLength: getModulusLengthOption(options),
             };
             keyUsages = ['sign', 'verify'];
@@ -39,7 +39,7 @@ export async function generateKeyPair(alg, options) {
             algorithm = {
                 name: 'RSA-OAEP',
                 hash: `SHA-${parseInt(alg.slice(-3), 10) || 1}`,
-                publicExponent: new Uint8Array([0x01, 0x00, 0x01]),
+                publicExponent: Uint8Array.of(0x01, 0x00, 0x01),
                 modulusLength: getModulusLengthOption(options),
             };
             keyUsages = ['decrypt', 'unwrapKey', 'encrypt', 'wrapKey'];

package/dist/webapi/key/import.js

@@ -1,8 +1,8 @@
 import { decode as decodeBase64URL } from '../util/base64url.js';
 import { fromSPKI, fromPKCS8, fromX509 } from '../lib/asn1.js';
-import toCryptoKey from '../lib/jwk_to_key.js';
+import { jwkToKey } from '../lib/jwk_to_key.js';
 import { JOSENotSupported } from '../util/errors.js';
-import isObject from '../lib/is_object.js';
+import { isObject } from '../lib/is_object.js';
 export async function importSPKI(spki, alg, options) {
     if (typeof spki !== 'string' || spki.indexOf('-----BEGIN PUBLIC KEY-----') !== 0) {
         throw new TypeError('"spki" must be SPKI formatted string');
@@ -38,7 +38,7 @@ export async function importJWK(jwk, alg, options) {
             if ('oth' in jwk && jwk.oth !== undefined) {
                 throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
             }
-            return toCryptoKey({ ...jwk, alg, ext });
+            return jwkToKey({ ...jwk, alg, ext });
         case 'AKP': {
             if (typeof jwk.alg !== 'string' || !jwk.alg) {
                 throw new TypeError('missing "alg" (Algorithm) Parameter value');
@@ -46,11 +46,11 @@ export async function importJWK(jwk, alg, options) {
             if (alg !== undefined && alg !== jwk.alg) {
                 throw new TypeError('JWK alg and alg option value mismatch');
             }
-            return toCryptoKey({ ...jwk, ext });
+            return jwkToKey({ ...jwk, ext });
         }
         case 'EC':
         case 'OKP':
-            return toCryptoKey({ ...jwk, alg, ext });
+            return jwkToKey({ ...jwk, alg, ext });
         default:
             throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
     }

package/dist/webapi/lib/aesgcmkw.js

@@ -1,9 +1,9 @@
-import encrypt from './encrypt.js';
-import decrypt from './decrypt.js';
+import { encrypt } from './encrypt.js';
+import { decrypt } from './decrypt.js';
 import { encode as b64u } from '../util/base64url.js';
 export async function wrap(alg, key, cek, iv) {
     const jweAlgorithm = alg.slice(0, 7);
-    const wrapped = await encrypt(jweAlgorithm, cek, key, iv, new Uint8Array(0));
+    const wrapped = await encrypt(jweAlgorithm, cek, key, iv, new Uint8Array());
     return {
         encryptedKey: wrapped.ciphertext,
         iv: b64u(wrapped.iv),
@@ -12,5 +12,5 @@ export async function wrap(alg, key, cek, iv) {
 }
 export async function unwrap(alg, key, encryptedKey, iv, tag) {
     const jweAlgorithm = alg.slice(0, 7);
-    return decrypt(jweAlgorithm, key, encryptedKey, iv, tag, new Uint8Array(0));
+    return decrypt(jweAlgorithm, key, encryptedKey, iv, tag, new Uint8Array());
 }

package/dist/webapi/lib/asn1.js

@@ -1,4 +1,4 @@
-import invalidKeyInput from './invalid_key_input.js';
+import { invalidKeyInput } from './invalid_key_input.js';
 import { encodeBase64, decodeBase64 } from '../lib/base64.js';
 import { JOSENotSupported } from '../util/errors.js';
 import { isCryptoKey, isKeyObject } from './is_key_like.js';
@@ -24,12 +24,8 @@ const genericExport = async (keyType, keyFormat, key) => {
     }
     return formatPEM(encodeBase64(new Uint8Array(await crypto.subtle.exportKey(keyFormat, key))), `${keyType.toUpperCase()} KEY`);
 };
-export const toSPKI = (key) => {
-    return genericExport('public', 'spki', key);
-};
-export const toPKCS8 = (key) => {
-    return genericExport('private', 'pkcs8', key);
-};
+export const toSPKI = (key) => genericExport('public', 'spki', key);
+export const toPKCS8 = (key) => genericExport('private', 'pkcs8', key);
 const bytesEqual = (a, b) => {
     if (a.byteLength !== b.length)
         return false;

package/dist/webapi/lib/buffer_utils.js

@@ -30,3 +30,14 @@ export function uint32be(value) {
     writeUInt32BE(buf, value);
     return buf;
 }
+export function encode(string) {
+    const bytes = new Uint8Array(string.length);
+    for (let i = 0; i < string.length; i++) {
+        const code = string.charCodeAt(i);
+        if (code > 127) {
+            throw new TypeError('non-ASCII string encountered in encode()');
+        }
+        bytes[i] = code;
+    }
+    return bytes;
+}