jose 6.2.10 → 6.2.12

package/dist/webapi/lib/jwe_encrypt.js

@@ -1,142 +1,75 @@
-import { encode as b64u } from '../util/base64url.js';
-import { encrypt } from './content_encryption.js';
-import { encryptKeyManagement } from './key_management.js';
-import { JWEInvalid } from '../util/errors.js';
-import { assertUint8Array, isDisjoint, isObject } from './type_checks.js';
-import { concat, encode } from './buffer_utils.js';
-import { serializeJoseHeader, validateCrit, validateCritDuplicates, JWE_RECOGNIZED, } from './options.js';
-import { prepareKey } from './key.js';
-import { jweAlgorithm, jweEncryption } from './jwe_algorithms.js';
-import { compress, validateZip } from './deflate.js';
-import { unprotected } from './helpers.js';
-export function checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader) {
-    if (!isDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader)) {
-        throw new JWEInvalid('JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint');
-    }
+import { encode as b64u } from "../util/base64url.js";
+import { encrypt } from "./content_encryption.js";
+import { encryptKeyManagement } from "./key_management.js";
+import { JWEInvalid } from "../util/errors.js";
+import { assertUint8Array, isDisjoint, isObject, serializeJoseHeader, validateCrit, validateCritDuplicates, JWE_RECOGNIZED } from "./validate.js";
+import { encode } from "./buffer_utils.js";
+import { prepareKey } from "./key.js";
+import { JWE, jweAlgorithm, jweEncryption } from "./jwe_algorithms.js";
+import { compress, validateZip } from "./deflate.js";
+function checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader) {
+  if (!isDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader))
+    throw new JWEInvalid("JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint");
 }
-export function checkEncryptHeaders(input) {
-    let [, protectedHeader, unprotectedHeader, sharedUnprotectedHeader, aad, cek, iv, keyManagementParameters, crit,] = input;
-    if (aad !== undefined) {
-        assertUint8Array(aad, 'JWE Additional Authenticated Data');
-    }
-    if (cek !== undefined) {
-        assertUint8Array(cek, 'JWE Content Encryption Key');
-    }
-    if (iv !== undefined) {
-        assertUint8Array(iv, 'JWE Initialization Vector');
-    }
-    if (protectedHeader !== undefined) {
-        protectedHeader = serializeJoseHeader(JWEInvalid, protectedHeader)[0];
-        input[1] = protectedHeader;
-    }
-    if (unprotectedHeader !== undefined) {
-        unprotectedHeader = serializeJoseHeader(JWEInvalid, unprotectedHeader)[0];
-        input[2] = unprotectedHeader;
-    }
-    if (sharedUnprotectedHeader !== undefined) {
-        sharedUnprotectedHeader = serializeJoseHeader(JWEInvalid, sharedUnprotectedHeader)[0];
-        input[3] = sharedUnprotectedHeader;
-    }
-    if (keyManagementParameters !== undefined && !isObject(keyManagementParameters)) {
-        throw new TypeError('JWE Key Management Parameters must be an object');
-    }
-    checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader);
-    const joseHeader = {
-        ...protectedHeader,
-        ...unprotectedHeader,
-        ...sharedUnprotectedHeader,
-    };
-    validateCritDuplicates(JWEInvalid, protectedHeader);
-    validateCrit(JWEInvalid, JWE_RECOGNIZED, crit, protectedHeader, joseHeader);
-    validateZip(joseHeader, protectedHeader);
-    const { alg, enc } = joseHeader;
-    if (typeof alg !== 'string' || !alg) {
-        throw new JWEInvalid('JWE "alg" (Algorithm) Header Parameter missing or invalid');
-    }
-    if (typeof enc !== 'string' || !enc) {
-        throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');
-    }
-    return [joseHeader, alg, enc, jweEncryption(enc)];
+function checkEncryptHeaders(input, options, sharedHeadersNormalized = !1) {
+  if (!input[1] && !input[2] && !input[3])
+    throw new JWEInvalid("either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()");
+  options !== void 0 && (input[8] = options?.crit);
+  let [, protectedHeader, unprotectedHeader, sharedUnprotectedHeader, aad, cek, iv, keyManagementParameters, crit] = input;
+  if (aad !== void 0 && assertUint8Array(aad, "JWE Additional Authenticated Data"), cek !== void 0 && assertUint8Array(cek, "JWE Content Encryption Key"), iv !== void 0 && assertUint8Array(iv, "JWE Initialization Vector"), !sharedHeadersNormalized && protectedHeader !== void 0 && (protectedHeader = serializeJoseHeader(JWEInvalid, protectedHeader)[0], input[1] = protectedHeader), unprotectedHeader !== void 0 && (unprotectedHeader = serializeJoseHeader(JWEInvalid, unprotectedHeader)[0], input[2] = unprotectedHeader), !sharedHeadersNormalized && sharedUnprotectedHeader !== void 0 && (sharedUnprotectedHeader = serializeJoseHeader(JWEInvalid, sharedUnprotectedHeader)[0], input[3] = sharedUnprotectedHeader), keyManagementParameters !== void 0 && !isObject(keyManagementParameters))
+    throw new TypeError("JWE Key Management Parameters must be an object");
+  checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader);
+  const joseHeader = {
+    ...protectedHeader,
+    ...unprotectedHeader,
+    ...sharedUnprotectedHeader
+  };
+  validateCritDuplicates(JWEInvalid, protectedHeader), validateCrit(JWEInvalid, JWE_RECOGNIZED, crit, protectedHeader, joseHeader), validateZip(joseHeader, protectedHeader);
+  const { alg, enc } = joseHeader;
+  if (typeof alg != "string" || !alg)
+    throw new JWEInvalid('JWE "alg" (Algorithm) Header Parameter missing or invalid');
+  const algEntry = JWE[alg];
+  if (algEntry?.mode === "integrated-encryption") {
+    if (enc !== void 0)
+      throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must not be present for integrated encryption');
+    if (cek !== void 0)
+      throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${alg}`);
+    if (iv !== void 0)
+      throw new TypeError(`setInitializationVector cannot be called with JWE "alg" (Algorithm) Header ${alg}`);
+    return [joseHeader, void 0, algEntry];
+  }
+  if (typeof enc != "string" || !enc)
+    throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');
+  return [joseHeader, jweEncryption(enc), algEntry];
 }
-export async function encryptJWE(input, checked, key) {
-    const [joseHeader, alg, , encEntry] = checked;
-    const [inputPlaintext, inputProtectedHeader, inputUnprotectedHeader, sharedUnprotectedHeader, aad, providedCek, inputIv, keyManagementParameters, , unprotectedParameters,] = input;
-    let protectedHeader = inputProtectedHeader;
-    let unprotectedHeader = inputUnprotectedHeader;
-    if (providedCek && (alg === 'dir' || alg === 'ECDH-ES')) {
-        throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${alg}`);
-    }
-    const algEntry = jweAlgorithm(alg);
-    const k = await prepareKey(alg === 'dir' ? encEntry : algEntry, key, 'encrypt');
-    const [cek, encryptedKey, parameters] = await encryptKeyManagement(alg, encEntry, k, providedCek, keyManagementParameters);
-    if (parameters) {
-        if (unprotectedParameters) {
-            unprotectedHeader = unprotectedHeader ? { ...unprotectedHeader, ...parameters } : parameters;
-        }
-        else {
-            protectedHeader = protectedHeader ? { ...protectedHeader, ...parameters } : parameters;
-        }
-        checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader);
-    }
-    let protectedHeaderS;
-    let protectedHeaderB;
-    if (protectedHeader) {
-        protectedHeaderS = b64u(JSON.stringify(protectedHeader));
-        protectedHeaderB = encode(protectedHeaderS);
-    }
-    else {
-        protectedHeaderS = '';
-        protectedHeaderB = new Uint8Array();
-    }
-    let additionalData;
-    let aadMember;
-    if (aad?.byteLength) {
-        aadMember = b64u(aad);
-        additionalData = concat(protectedHeaderB, encode('.'), encode(aadMember));
-    }
-    else {
-        additionalData = protectedHeaderB;
-    }
-    let plaintext = inputPlaintext;
-    if (joseHeader.zip === 'DEF') {
-        plaintext = await compress(plaintext).catch((cause) => {
-            throw new JWEInvalid('Failed to compress plaintext', { cause });
-        });
-    }
-    const { ciphertext, tag, iv } = await encrypt(encEntry, plaintext, cek, inputIv, additionalData);
-    const jwe = {
-        ciphertext: b64u(ciphertext),
-    };
-    if (iv) {
-        jwe.iv = b64u(iv);
-    }
-    if (tag) {
-        jwe.tag = b64u(tag);
-    }
-    if (encryptedKey) {
-        jwe.encrypted_key = b64u(encryptedKey);
-    }
-    if (aadMember) {
-        jwe.aad = aadMember;
-    }
-    if (protectedHeader) {
-        jwe.protected = protectedHeaderS;
-    }
-    if (sharedUnprotectedHeader) {
-        jwe.unprotected = sharedUnprotectedHeader;
-    }
-    if (unprotectedHeader) {
-        jwe.header = unprotectedHeader;
-    }
-    return jwe;
+async function encryptJWE(input, checked, key) {
+  const [joseHeader, encEntry, selected] = checked, [inputPlaintext, inputProtectedHeader, inputUnprotectedHeader, sharedUnprotectedHeader, aad, providedCek, inputIv, keyManagementParameters, , unprotectedParameters] = input;
+  let protectedHeader = inputProtectedHeader, unprotectedHeader = inputUnprotectedHeader;
+  const algEntry = selected ?? jweAlgorithm(joseHeader.alg);
+  let encryptedKey, parameters, cek;
+  algEntry.mode === "integrated-encryption" ? cek = await prepareKey(algEntry, key, "encrypt") : [cek, encryptedKey, parameters] = await encryptKeyManagement(algEntry, encEntry, key, joseHeader, providedCek, keyManagementParameters), parameters && (unprotectedParameters ? unprotectedHeader = unprotectedHeader ? { ...unprotectedHeader, ...parameters } : parameters : protectedHeader = protectedHeader ? { ...protectedHeader, ...parameters } : parameters, checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader));
+  const protectedHeaderS = protectedHeader ? b64u(JSON.stringify(protectedHeader)) : "", aadMember = aad?.byteLength ? b64u(aad) : void 0, additionalData = encode(aadMember ? `${protectedHeaderS}.${aadMember}` : protectedHeaderS);
+  let plaintext = inputPlaintext;
+  joseHeader.zip === "DEF" && (plaintext = await compress(plaintext).catch((cause) => {
+    throw new JWEInvalid("Failed to compress plaintext", { cause });
+  }));
+  let ciphertext, tag, iv;
+  algEntry.mode === "integrated-encryption" ? [encryptedKey, ciphertext] = await algEntry.encrypt(cek, plaintext, additionalData, protectedHeader, joseHeader, keyManagementParameters) : { ciphertext, tag, iv } = await encrypt(encEntry, plaintext, cek, inputIv, additionalData);
+  const jwe = {
+    ciphertext: b64u(ciphertext)
+  };
+  return iv && (jwe.iv = b64u(iv)), tag && (jwe.tag = b64u(tag)), encryptedKey?.byteLength && (jwe.encrypted_key = b64u(encryptedKey)), aadMember && (jwe.aad = aadMember), protectedHeader && (jwe.protected = protectedHeaderS), sharedUnprotectedHeader && (jwe.unprotected = sharedUnprotectedHeader), unprotectedHeader && (jwe.header = unprotectedHeader), jwe;
 }
-export async function createJWE(input, key, options) {
-    if (!input[1] && !input[2] && !input[3]) {
-        throw new JWEInvalid('either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()');
-    }
-    if (options !== undefined) {
-        input[8] = options?.crit;
-        input[9] = options ? unprotected in options : false;
-    }
-    return encryptJWE(input, checkEncryptHeaders(input), key);
+async function createJWE(input, key, options) {
+  return encryptJWE(input, checkEncryptHeaders(input, options), key);
 }
+function compactJWE(jwe) {
+  return [jwe.protected, jwe.encrypted_key, jwe.iv, jwe.ciphertext, jwe.tag].join(".");
+}
+export {
+  checkDisjoint,
+  checkEncryptHeaders,
+  compactJWE,
+  createJWE,
+  encryptJWE
+};

package/dist/webapi/lib/jws_algorithms.js

@@ -1,73 +1,74 @@
-import { JOSENotSupported } from '../util/errors.js';
-import { table } from './key_descriptor.js';
-const sig = [['verify'], ['sign']];
+import { JOSENotSupported } from "../util/errors.js";
+import { table } from "./key_descriptor.js";
+const sig = [["verify"], ["sign"]];
 function hmac(bits) {
-    const subtle = { name: 'HMAC', hash: `SHA-${bits}` };
-    return { kty: ['oct'], secret: true, subtle, signing: subtle, usages: sig };
+  const subtle = { name: "HMAC", hash: `SHA-${bits}` };
+  return { kty: ["oct"], secret: !0, subtle, signing: subtle, usages: sig };
 }
 function rsa(bits, saltLength) {
-    const name = saltLength ? 'RSA-PSS' : 'RSASSA-PKCS1-v1_5';
-    const subtle = { name, hash: `SHA-${bits}` };
-    return {
-        kty: ['RSA'],
-        subtle,
-        signing: saltLength ? { ...subtle, saltLength } : subtle,
-        usages: sig,
-        minRsaBits: 2048,
-    };
+  const subtle = { name: saltLength ? "RSA-PSS" : "RSASSA-PKCS1-v1_5", hash: `SHA-${bits}` };
+  return {
+    kty: ["RSA"],
+    subtle,
+    signing: saltLength ? { ...subtle, saltLength } : subtle,
+    usages: sig,
+    minRsaBits: 2048
+  };
 }
 function ecdsa(crv, bits) {
-    return {
-        kty: ['EC'],
-        crv,
-        subtle: { name: 'ECDSA', namedCurve: crv },
-        signing: { name: 'ECDSA', hash: `SHA-${bits}` },
-        usages: sig,
-    };
+  return {
+    kty: ["EC"],
+    crv,
+    subtle: { name: "ECDSA", namedCurve: crv },
+    signing: { name: "ECDSA", hash: `SHA-${bits}` },
+    usages: sig
+  };
 }
 function eddsa() {
-    const subtle = { name: 'Ed25519' };
-    return {
-        kty: ['OKP'],
-        crv: 'Ed25519',
-        subtle,
-        signing: subtle,
-        usages: sig,
-    };
+  const subtle = { name: "Ed25519" };
+  return {
+    kty: ["OKP"],
+    crv: "Ed25519",
+    subtle,
+    signing: subtle,
+    usages: sig
+  };
 }
 function mldsa(bits) {
-    const name = `ML-DSA-${bits}`;
-    const subtle = { name };
-    return {
-        kty: ['AKP'],
-        subtle,
-        signing: subtle,
-        usages: sig,
-    };
+  const subtle = { name: `ML-DSA-${bits}` };
+  return {
+    kty: ["AKP"],
+    subtle,
+    signing: subtle,
+    usages: sig
+  };
 }
-export const JWS = table({
-    HS256: hmac(256),
-    HS384: hmac(384),
-    HS512: hmac(512),
-    RS256: rsa(256),
-    RS384: rsa(384),
-    RS512: rsa(512),
-    PS256: rsa(256, 32),
-    PS384: rsa(384, 48),
-    PS512: rsa(512, 64),
-    ES256: ecdsa('P-256', 256),
-    ES384: ecdsa('P-384', 384),
-    ES512: ecdsa('P-521', 512),
-    EdDSA: eddsa(),
-    Ed25519: eddsa(),
-    'ML-DSA-44': mldsa(44),
-    'ML-DSA-65': mldsa(65),
-    'ML-DSA-87': mldsa(87),
+const JWS = table({
+  HS256: hmac(256),
+  HS384: hmac(384),
+  HS512: hmac(512),
+  RS256: rsa(256),
+  RS384: rsa(384),
+  RS512: rsa(512),
+  PS256: rsa(256, 32),
+  PS384: rsa(384, 48),
+  PS512: rsa(512, 64),
+  ES256: ecdsa("P-256", 256),
+  ES384: ecdsa("P-384", 384),
+  ES512: ecdsa("P-521", 512),
+  EdDSA: eddsa(),
+  Ed25519: eddsa(),
+  "ML-DSA-44": mldsa(44),
+  "ML-DSA-65": mldsa(65),
+  "ML-DSA-87": mldsa(87)
 });
-export function jwsAlgorithm(alg) {
-    const entry = typeof alg === 'string' ? JWS[alg] : undefined;
-    if (!entry) {
-        throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
-    }
-    return entry;
+function jwsAlgorithm(alg) {
+  const entry = typeof alg == "string" ? JWS[alg] : void 0;
+  if (!entry)
+    throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
+  return entry;
 }
+export {
+  JWS,
+  jwsAlgorithm
+};

package/dist/webapi/lib/jws_sign.js

@@ -1,85 +1,46 @@
-import { encode as b64u } from '../util/base64url.js';
-import { sign } from './signing.js';
-import { jwsAlgorithm } from './jws_algorithms.js';
-import { isDisjoint } from './type_checks.js';
-import { JWSInvalid } from '../util/errors.js';
-import { concat, encode } from './buffer_utils.js';
-import { serializeJoseHeader, validateB64, validateCrit, validateCritDuplicates, JWS_RECOGNIZED, } from './options.js';
-import { prepareKey } from './key.js';
-function serializeProtectedHeader(protectedHeader) {
-    if (protectedHeader === undefined)
-        return [undefined, ''];
+import { encode as b64u } from "../util/base64url.js";
+import { jwsAlgorithm } from "./jws_algorithms.js";
+import { isDisjoint, serializeJoseHeader, validateB64, validateCrit, validateCritDuplicates, JWS_RECOGNIZED } from "./validate.js";
+import { JWSInvalid } from "../util/errors.js";
+import { concat, encode, encoder } from "./buffer_utils.js";
+import { prepareKey, rawKey, checkModulusLength } from "./key.js";
+async function createSignature(input, key, rejectUnencoded) {
+  let [payload, protectedHeader, unprotectedHeader, crit] = input, protectedHeaderString = "";
+  if (protectedHeader !== void 0) {
     const normalized = serializeJoseHeader(JWSInvalid, protectedHeader);
-    return [normalized[0], b64u(normalized[1])];
+    protectedHeader = normalized[0], protectedHeaderString = b64u(normalized[1]);
+  }
+  if (unprotectedHeader !== void 0 && (unprotectedHeader = serializeJoseHeader(JWSInvalid, unprotectedHeader)[0]), !protectedHeader && !unprotectedHeader)
+    throw new JWSInvalid("either setProtectedHeader or setUnprotectedHeader must be called before #sign()");
+  if (!isDisjoint(protectedHeader, unprotectedHeader))
+    throw new JWSInvalid("JWS Protected and JWS Unprotected Header Parameter names must be disjoint");
+  const joseHeader = { ...protectedHeader, ...unprotectedHeader };
+  validateCritDuplicates(JWSInvalid, protectedHeader);
+  const b64 = validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, crit, protectedHeader, joseHeader));
+  b64 || rejectUnencoded?.();
+  const { alg } = joseHeader;
+  if (typeof alg != "string" || !alg)
+    throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+  const entry = jwsAlgorithm(alg);
+  let payloadS = "", payloadB = payload, data;
+  if (b64) {
+    const encoded = input[4];
+    encoded ? (payloadS = encoded[0] ??= b64u(payload), payloadB = encoded[1] ??= encode(payloadS)) : (payloadS = b64u(payload), data = encoder.encode(`${protectedHeaderString}.${payloadS}`));
+  }
+  data ??= concat(encode(protectedHeaderString), encode("."), payloadB);
+  const k = await rawKey(await prepareKey(entry, key, "sign"), entry.subtle, "sign");
+  entry.minRsaBits && checkModulusLength(entry.alg, k);
+  const jws = {
+    signature: b64u(new Uint8Array(await crypto.subtle.sign(entry.signing, k, data))),
+    payload: payloadS
+  };
+  return protectedHeader && (jws.protected = protectedHeaderString), unprotectedHeader && (jws.header = unprotectedHeader), [jws, b64];
 }
-function validateSignatureHeader(protectedHeader, joseHeader, crit) {
-    validateCritDuplicates(JWSInvalid, protectedHeader);
-    return validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, crit, protectedHeader, joseHeader));
-}
-function signatureAlgorithm(joseHeader) {
-    const alg = joseHeader.alg;
-    if (typeof alg !== 'string' || !alg) {
-        throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-    }
-    return jwsAlgorithm(alg);
-}
-async function signSignature(protectedHeader, payload, entry, key) {
-    const data = concat(encode(protectedHeader), encode('.'), payload);
-    const k = await prepareKey(entry, key, 'sign');
-    return b64u(await sign(entry, k, data));
-}
-export async function createSignature(input, key, assertB64) {
-    let { protectedHeader, unprotectedHeader } = input;
-    let protectedHeaderString;
-    [protectedHeader, protectedHeaderString] = serializeProtectedHeader(protectedHeader);
-    if (unprotectedHeader !== undefined) {
-        unprotectedHeader = serializeJoseHeader(JWSInvalid, unprotectedHeader)[0];
-    }
-    if (!protectedHeader && !unprotectedHeader) {
-        throw new JWSInvalid('either setProtectedHeader or setUnprotectedHeader must be called before #sign()');
-    }
-    if (!isDisjoint(protectedHeader, unprotectedHeader)) {
-        throw new JWSInvalid('JWS Protected and JWS Unprotected Header Parameter names must be disjoint');
-    }
-    const joseHeader = { ...protectedHeader, ...unprotectedHeader };
-    const b64 = validateSignatureHeader(protectedHeader, joseHeader, input.crit);
-    assertB64?.(b64);
-    const entry = signatureAlgorithm(joseHeader);
-    let payloadS;
-    let payloadB;
-    if (b64) {
-        const encoded = (input.encoded ??= []);
-        encoded[0] ??= b64u(input.payload);
-        encoded[1] ??= encode(encoded[0]);
-        payloadS = encoded[0];
-        payloadB = encoded[1];
-    }
-    else {
-        payloadB = input.payload;
-        payloadS = '';
-    }
-    const jws = {
-        signature: await signSignature(protectedHeaderString, payloadB, entry, key),
-        payload: payloadS,
-    };
-    if (protectedHeader) {
-        jws.protected = protectedHeaderString;
-    }
-    if (unprotectedHeader) {
-        jws.header = unprotectedHeader;
-    }
-    return [jws, b64];
-}
-export async function createCompactSignature(payload, inputProtectedHeader, inputCrit, key, rejectUnencoded) {
-    const [protectedHeader, protectedHeaderString] = serializeProtectedHeader(inputProtectedHeader);
-    if (!protectedHeader) {
-        throw new JWSInvalid('either setProtectedHeader or setUnprotectedHeader must be called before #sign()');
-    }
-    const b64 = validateSignatureHeader(protectedHeader, protectedHeader, inputCrit);
-    if (!b64)
-        rejectUnencoded();
-    const entry = signatureAlgorithm(protectedHeader);
-    const encodedPayload = b64u(payload);
-    const signature = await signSignature(protectedHeaderString, encode(encodedPayload), entry, key);
-    return `${protectedHeaderString}.${encodedPayload}.${signature}`;
+async function createCompactSignature(payload, protectedHeader, crit, key, rejectUnencoded) {
+  const [jws] = await createSignature([payload, protectedHeader, void 0, crit], key, rejectUnencoded);
+  return `${jws.protected}.${jws.payload}.${jws.signature}`;
 }
+export {
+  createCompactSignature,
+  createSignature
+};