jose 6.2.11 → 6.2.13

package/dist/webapi/jwks/local.js

@@ -1,19 +1,22 @@
-import { jwkToKey } from "../lib/jwk_to_key.js";
+import { jwkToKey, snapshotJwk } from "../lib/key.js";
 import { JWS } from "../lib/jws_algorithms.js";
 import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys } from "../util/errors.js";
-import { isJwkSet } from "../lib/type_checks.js";
-import { snapshotJwk } from "../lib/jwk_metadata.js";
+import { isJwkSet } from "../lib/validate.js";
 function isUsableJWK(jwk, entry, alg, kid) {
-  const { kty, key_ops, ext, kid: jwkKid, alg: jwkAlg, use, crv } = snapshotJwk(jwk), keyOps = Array.isArray(key_ops) ? [...key_ops] : key_ops;
+  const { kty, key_ops: keyOps, ext, kid: jwkKid, alg: jwkAlg, use, crv } = jwk;
   return (ext === void 0 || typeof ext == "boolean") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation == "string" && keyOps.indexOf(operation) === index) && keyOps.includes("verify")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid == "string" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== "AKP" : alg === jwkAlg) && (use === void 0 || use === "sig") && (!entry.crv || crv === entry.crv);
 }
 async function importWithAlgCache(cache, jwk, entry) {
   const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk), { alg } = entry;
   if (cached[alg] === void 0) {
-    const key = await jwkToKey(entry, { ...jwk, alg, ext: !0 });
-    if (key.type !== "public")
-      throw new JWKSInvalid("JSON Web Key Set members must be public keys");
-    cached[alg] = key;
+    const pending = jwkToKey(entry, jwk, !0).then((key) => {
+      if (key.type !== "public")
+        throw new JWKSInvalid("JSON Web Key Set members must be public keys");
+      return cached[alg] = key, key;
+    }).catch((error) => {
+      throw cached[alg] === pending && delete cached[alg], error;
+    });
+    cached[alg] = pending;
   }
   return cached[alg];
 }
@@ -21,16 +24,20 @@ function createLocalJWKSet(jwks) {
   let snapshot;
   try {
     snapshot = structuredClone(jwks);
-  } catch {
+  } catch (cause) {
+    throw new JWKSInvalid("JSON Web Key Set malformed", { cause });
   }
   if (!isJwkSet(snapshot))
     throw new JWKSInvalid("JSON Web Key Set malformed");
-  const cached = /* @__PURE__ */ new WeakMap();
+  const metadata = snapshot.keys.map((jwk) => {
+    const normalized = snapshotJwk(jwk);
+    return Array.isArray(normalized.key_ops) && (normalized.key_ops = [...normalized.key_ops]), normalized;
+  }), cached = /* @__PURE__ */ new WeakMap();
   return Object.defineProperty(async (protectedHeader, token) => {
     const { alg, kid } = { ...protectedHeader, ...token?.header }, entry = typeof alg == "string" ? JWS[alg] : void 0;
     if (!entry || entry.secret)
       throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
-    const candidates = snapshot.keys.filter((jwk2) => isUsableJWK(jwk2, entry, alg, kid)), { 0: jwk, length } = candidates;
+    const candidates = snapshot.keys.filter((_, index) => isUsableJWK(metadata[index], entry, alg, kid)), { 0: jwk, length } = candidates;
     if (!length)
       throw new JWKSNoMatchingKey();
     if (length !== 1) {

package/dist/webapi/jwks/remote.js

@@ -1,11 +1,11 @@
 import { JOSEError, JWKSNoMatchingKey, JWKSTimeout } from "../util/errors.js";
 import { createLocalJWKSet } from "./local.js";
-import { isJwkSet } from "../lib/type_checks.js";
+import { isJwkSet } from "../lib/validate.js";
 function isCloudflareWorkers() {
   return typeof WebSocketPair < "u" || typeof navigator < "u" && navigator.userAgent === "Cloudflare-Workers" || typeof EdgeRuntime < "u" && EdgeRuntime === "vercel";
 }
 let USER_AGENT;
-(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.11");
+(typeof navigator > "u" || !navigator.userAgent?.startsWith?.("Mozilla/5.0 ")) && (USER_AGENT = "jose/v6.2.13");
 const customFetch = /* @__PURE__ */ Symbol();
 async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
   const response = await fetchImpl(url, {
@@ -14,14 +14,14 @@ async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
     redirect: "manual",
     headers
   }).catch((err) => {
-    throw err.name === "TimeoutError" ? new JWKSTimeout() : err;
+    throw err.name === "TimeoutError" ? new JWKSTimeout(void 0, { cause: err }) : err;
   });
   if (response.status !== 200)
     throw new JOSEError("Expected 200 OK from the JSON Web Key Set HTTP response");
   try {
     return await response.json();
-  } catch {
-    throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON");
+  } catch (cause) {
+    throw new JOSEError("Failed to parse the JSON Web Key Set HTTP response as JSON", { cause });
   }
 }
 const jwksCache = /* @__PURE__ */ Symbol();

package/dist/webapi/jws/compact/sign.js

@@ -1,12 +1,10 @@
 import { createCompactSignature } from "../../lib/jws_sign.js";
-import { assertNotSet } from "../../lib/helpers.js";
+import { assertNotSet, assertUint8Array } from "../../lib/validate.js";
 class CompactSign {
   #payload;
   #protectedHeader;
   constructor(payload) {
-    if (!(payload instanceof Uint8Array))
-      throw new TypeError("payload must be an instance of Uint8Array");
-    this.#payload = payload;
+    assertUint8Array(payload, "payload"), this.#payload = payload;
   }
   setProtectedHeader(protectedHeader) {
     return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;

package/dist/webapi/jws/compact/verify.js

@@ -1,7 +1,7 @@
 import { prepareVerify, verifyCompact } from "../../lib/jws_verify.js";
 async function compactVerify(jws, key, options) {
-  const verified = await verifyCompact(jws, prepareVerify(options), key), result = { payload: verified[0], protectedHeader: verified[1] };
-  return typeof key == "function" ? { ...result, key: verified[3] } : result;
+  const [result] = await verifyCompact(jws, prepareVerify(options), key);
+  return result;
 }
 export {
   compactVerify

package/dist/webapi/jws/flattened/sign.js

@@ -1,27 +1,20 @@
 import { createSignature } from "../../lib/jws_sign.js";
-import { assertNotSet } from "../../lib/helpers.js";
+import { assertNotSet, assertUint8Array } from "../../lib/validate.js";
 class FlattenedSign {
-  #payload;
-  #protectedHeader;
-  #unprotectedHeader;
+  #input;
   constructor(payload) {
-    if (!(payload instanceof Uint8Array))
-      throw new TypeError("payload must be an instance of Uint8Array");
-    this.#payload = payload;
+    assertUint8Array(payload, "payload"), this.#input = [payload];
   }
   setProtectedHeader(protectedHeader) {
-    return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
+    return assertNotSet(this.#input[1], "setProtectedHeader"), this.#input[1] = protectedHeader, this;
   }
   setUnprotectedHeader(unprotectedHeader) {
-    return assertNotSet(this.#unprotectedHeader, "setUnprotectedHeader"), this.#unprotectedHeader = unprotectedHeader, this;
+    return assertNotSet(this.#input[2], "setUnprotectedHeader"), this.#input[2] = unprotectedHeader, this;
   }
   async sign(key, options) {
-    const [jws] = await createSignature({
-      payload: this.#payload,
-      protectedHeader: this.#protectedHeader,
-      unprotectedHeader: this.#unprotectedHeader,
-      crit: options?.crit
-    }, key);
+    const input = [...this.#input];
+    input[3] = options?.crit;
+    const [jws] = await createSignature(input, key);
     return jws;
   }
 }

package/dist/webapi/jws/flattened/verify.js

@@ -1,21 +1,11 @@
 import { JWSInvalid } from "../../util/errors.js";
-import { isObject } from "../../lib/type_checks.js";
-import { encodeJsonUnencodedPayload, prepareVerify, snapshotJws, verifySignature, verifyResult } from "../../lib/jws_verify.js";
+import { isObject } from "../../lib/validate.js";
+import { encodeJsonUnencodedPayload, prepareVerify, snapshotJws, verifySignature } from "../../lib/jws_verify.js";
 async function flattenedVerify(jws, key, options) {
   if (!isObject(jws))
     throw new JWSInvalid("Flattened JWS must be an object");
-  const snapshot = snapshotJws(jws);
-  if (snapshot.protected === void 0 && snapshot.header === void 0)
-    throw new JWSInvalid('Flattened JWS must have either of the "protected" or "header" members');
-  if (snapshot.protected !== void 0 && typeof snapshot.protected != "string")
-    throw new JWSInvalid("JWS Protected Header incorrect type");
-  if (snapshot.payload === void 0)
-    throw new JWSInvalid("JWS Payload missing");
-  if (typeof snapshot.signature != "string")
-    throw new JWSInvalid("JWS Signature missing or incorrect type");
-  if (snapshot.header !== void 0 && !isObject(snapshot.header))
-    throw new JWSInvalid("JWS Unprotected Header incorrect type");
-  return verifyResult(snapshot, await verifySignature(snapshot, prepareVerify(options), key, encodeJsonUnencodedPayload));
+  const snapshot = snapshotJws(jws), [result] = await verifySignature(snapshot, prepareVerify(options), key, encodeJsonUnencodedPayload);
+  return result;
 }
 export {
   flattenedVerify

package/dist/webapi/jws/general/sign.js

@@ -1,6 +1,6 @@
 import { createSignature } from "../../lib/jws_sign.js";
 import { JWSInvalid } from "../../util/errors.js";
-import { assertNotSet } from "../../lib/helpers.js";
+import { assertNotSet, assertUint8Array } from "../../lib/validate.js";
 class IndividualSignature {
   #parent;
   state;
@@ -36,26 +36,19 @@ class GeneralSign {
   async sign() {
     if (!this.#signatures.length)
       throw new JWSInvalid("at least one signature must be added");
-    if (!(this.#payload instanceof Uint8Array))
-      throw new TypeError("payload must be an instance of Uint8Array");
+    assertUint8Array(this.#payload, "payload");
     const jws = {
       signatures: [],
       payload: ""
-    }, encoded = [];
+    }, encodedPayloadCache = [];
     let b64;
-    for (let i = 0; i < this.#signatures.length; i++) {
-      const signature = this.#signatures[i], [protectedHeader, unprotectedHeader, key, crit] = signature.state, [{ payload, ...rest }, signatureB64] = await createSignature({
-        payload: this.#payload,
-        protectedHeader,
-        unprotectedHeader,
-        crit,
-        encoded
-      }, key);
+    for (const signature of this.#signatures) {
+      const [protectedHeader, unprotectedHeader, key, crit] = signature.state, [{ payload, ...signatureMembers }, signatureB64] = await createSignature([this.#payload, protectedHeader, unprotectedHeader, crit, encodedPayloadCache], key);
       if (b64 === void 0)
         b64 = signatureB64, jws.payload = payload;
       else if (b64 !== signatureB64)
         throw new JWSInvalid("inconsistent use of JWS Unencoded Payload (RFC7797)");
-      jws.signatures.push(rest);
+      jws.signatures.push(signatureMembers);
     }
     return jws;
   }

package/dist/webapi/jws/general/verify.js

@@ -1,12 +1,9 @@
-import { encodeJsonUnencodedPayload, parseProtectedHeader, prepareVerify, snapshotJws, verifySignature, verifyResult } from "../../lib/jws_verify.js";
+import { encodeJsonUnencodedPayload, parseProtectedHeader, prepareVerify, snapshotJws, verifySignature } from "../../lib/jws_verify.js";
 import { JWSInvalid, JWSSignatureVerificationFailed } from "../../util/errors.js";
-import { isObject } from "../../lib/type_checks.js";
+import { isObject } from "../../lib/validate.js";
 function snapshotSignature(signature, payload) {
   try {
-    const jws = snapshotJws(signature, [payload]), { protected: encodedProtected, header, signature: encodedSignature } = jws;
-    if (encodedProtected === void 0 && header === void 0 || encodedProtected !== void 0 && typeof encodedProtected != "string" || typeof encodedSignature != "string" || header !== void 0 && !isObject(header))
-      return;
-    const protectedHeader = parseProtectedHeader(encodedProtected), { b64, crit } = protectedHeader;
+    const jws = snapshotJws(signature, [payload]), protectedHeader = parseProtectedHeader(jws.protected), { b64, crit } = protectedHeader;
     return [
       jws,
       protectedHeader,
@@ -34,13 +31,14 @@ async function generalVerify(jws, key, options) {
     throw new JWSSignatureVerificationFailed();
   }
   const payload = inputPayload instanceof Uint8Array ? new Uint8Array(inputPayload) : inputPayload, candidates = signatureEntries.map((signature) => snapshotSignature(signature, payload)).filter((candidate) => candidate !== void 0);
-  let modes = 0;
-  for (const [, , mode] of candidates)
-    if (modes |= mode, modes === 3)
+  let payloadEncodings = 0;
+  for (const [, , payloadEncoding] of candidates)
+    if (payloadEncodings |= payloadEncoding, payloadEncodings === 3)
       throw new JWSInvalid("inconsistent use of JWS Unencoded Payload (RFC7797)");
   for (const candidate of candidates)
     try {
-      return verifyResult(candidate[0], await verifySignature(candidate[0], shared, key, encodeJsonUnencodedPayload, candidate[1]));
+      const [result] = await verifySignature(candidate[0], shared, key, encodeJsonUnencodedPayload, candidate[1]);
+      return result;
     } catch {
     }
   throw new JWSSignatureVerificationFailed();

package/dist/webapi/jwt/decrypt.js

@@ -2,12 +2,11 @@ import { prepareDecrypt, decryptCompact } from "../lib/jwe_decrypt.js";
 import { validateClaimsSet } from "../lib/jwt_claims_set.js";
 import { JWTClaimValidationFailed } from "../util/errors.js";
 async function jwtDecrypt(jwt, key, options) {
-  const decrypted = await decryptCompact(jwt, prepareDecrypt(options), key), protectedHeader = decrypted[1], payload = validateClaimsSet(protectedHeader, decrypted[0], options);
+  const { plaintext, ...result } = await decryptCompact(jwt, prepareDecrypt(options), key), { protectedHeader } = result, payload = validateClaimsSet(protectedHeader, plaintext, options);
   for (const claim of ["iss", "sub", "aud"])
     if (protectedHeader[claim] !== void 0 && (claim === "aud" ? JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud) : protectedHeader[claim] !== payload[claim]))
       throw new JWTClaimValidationFailed(`replicated "${claim}" claim header parameter mismatch`, payload, claim, "mismatch");
-  const result = { payload, protectedHeader };
-  return typeof key == "function" ? { ...result, key: decrypted[2] } : result;
+  return { payload, ...result };
 }
 export {
   jwtDecrypt

package/dist/webapi/jwt/encrypt.js

@@ -1,26 +1,23 @@
-import { createJWE } from "../lib/jwe_encrypt.js";
-import { JWTClaimsBuilder, jwtClaim, jwtData } from "../lib/jwt_claims_set.js";
-import { assertNotSet } from "../lib/helpers.js";
+import { compactJWE, createJWE } from "../lib/jwe_encrypt.js";
+import { JWTClaimsBuilder, jwtClaim, jwtClaimsSetBytes } from "../lib/jwt_claims_set.js";
+import { assertNotSet } from "../lib/validate.js";
 const EncryptJWT_base = JWTClaimsBuilder;
 class EncryptJWT extends EncryptJWT_base {
-  #cek;
-  #iv;
-  #keyManagementParameters;
-  #protectedHeader;
+  #input = [void 0];
   #replicateIssuerAsHeader;
   #replicateSubjectAsHeader;
   #replicateAudienceAsHeader;
   setProtectedHeader(protectedHeader) {
-    return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
+    return assertNotSet(this.#input[1], "setProtectedHeader"), this.#input[1] = protectedHeader, this;
   }
   setKeyManagementParameters(parameters) {
-    return assertNotSet(this.#keyManagementParameters, "setKeyManagementParameters"), this.#keyManagementParameters = parameters, this;
+    return assertNotSet(this.#input[7], "setKeyManagementParameters"), this.#input[7] = parameters, this;
   }
   setContentEncryptionKey(cek) {
-    return assertNotSet(this.#cek, "setContentEncryptionKey"), this.#cek = cek, this;
+    return assertNotSet(this.#input[5], "setContentEncryptionKey"), this.#input[5] = cek, this;
   }
   setInitializationVector(iv) {
-    return assertNotSet(this.#iv, "setInitializationVector"), this.#iv = iv, this;
+    return assertNotSet(this.#input[6], "setInitializationVector"), this.#input[6] = iv, this;
   }
   replicateIssuerAsHeader() {
     return this.#replicateIssuerAsHeader = !0, this;
@@ -32,26 +29,15 @@ class EncryptJWT extends EncryptJWT_base {
     return this.#replicateAudienceAsHeader = !0, this;
   }
   async encrypt(key, options) {
-    const plaintext = jwtData(this);
-    this.#protectedHeader && (this.#replicateIssuerAsHeader || this.#replicateSubjectAsHeader || this.#replicateAudienceAsHeader) && (this.#protectedHeader = {
-      ...this.#protectedHeader,
+    const plaintext = jwtClaimsSetBytes(this);
+    this.#input[1] && (this.#replicateIssuerAsHeader || this.#replicateSubjectAsHeader || this.#replicateAudienceAsHeader) && (this.#input[1] = {
+      ...this.#input[1],
       iss: this.#replicateIssuerAsHeader ? jwtClaim(this, "iss") : void 0,
       sub: this.#replicateSubjectAsHeader ? jwtClaim(this, "sub") : void 0,
       aud: this.#replicateAudienceAsHeader ? jwtClaim(this, "aud") : void 0
     });
-    const jwe = await createJWE([
-      plaintext,
-      this.#protectedHeader,
-      void 0,
-      void 0,
-      void 0,
-      this.#cek,
-      this.#iv,
-      this.#keyManagementParameters,
-      void 0,
-      !1
-    ], key, options);
-    return [jwe.protected, jwe.encrypted_key, jwe.iv, jwe.ciphertext, jwe.tag].join(".");
+    const input = [...this.#input];
+    return input[0] = plaintext, compactJWE(await createJWE(input, key, options));
   }
 }
 export {

package/dist/webapi/jwt/sign.js

@@ -1,7 +1,7 @@
 import { createCompactSignature } from "../lib/jws_sign.js";
 import { JWTInvalid } from "../util/errors.js";
-import { JWTClaimsBuilder, jwtData } from "../lib/jwt_claims_set.js";
-import { assertNotSet } from "../lib/helpers.js";
+import { JWTClaimsBuilder, jwtClaimsSetBytes } from "../lib/jwt_claims_set.js";
+import { assertNotSet } from "../lib/validate.js";
 const SignJWT_base = JWTClaimsBuilder;
 class SignJWT extends SignJWT_base {
   #protectedHeader;
@@ -9,7 +9,7 @@ class SignJWT extends SignJWT_base {
     return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
   }
   async sign(key, options) {
-    return createCompactSignature(jwtData(this), this.#protectedHeader, options?.crit, key, () => {
+    return createCompactSignature(jwtClaimsSetBytes(this), this.#protectedHeader, options?.crit, key, () => {
       throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
     });
   }

package/dist/webapi/jwt/unsecured.js

@@ -1,13 +1,12 @@
 import * as b64u from "../util/base64url.js";
-import { decodeBase64url, parseJoseHeader } from "../lib/helpers.js";
+import { decodeBase64url, parseJoseHeader, JWS_RECOGNIZED, validateB64, validateCrit } from "../lib/validate.js";
 import { JWSInvalid, JWTInvalid } from "../util/errors.js";
-import { validateClaimsSet, JWTClaimsBuilder, jwtData } from "../lib/jwt_claims_set.js";
-import { JWS_RECOGNIZED, validateB64, validateCrit } from "../lib/options.js";
+import { validateClaimsSet, JWTClaimsBuilder, jwtClaimsSetBytes } from "../lib/jwt_claims_set.js";
 const UnsecuredJWT_base = JWTClaimsBuilder;
 class UnsecuredJWT extends UnsecuredJWT_base {
   encode() {
-    const header = b64u.encode(JSON.stringify({ alg: "none" })), payload = b64u.encode(jwtData(this));
-    return `${header}.${payload}.`;
+    const encodedProtectedHeader = b64u.encode(JSON.stringify({ alg: "none" })), encodedPayload = b64u.encode(jwtClaimsSetBytes(this));
+    return `${encodedProtectedHeader}.${encodedPayload}.`;
   }
   static decode(jwt, options) {
     if (typeof jwt != "string")

package/dist/webapi/jwt/verify.js

@@ -2,11 +2,11 @@ import { prepareVerify, verifyCompact } from "../lib/jws_verify.js";
 import { validateClaimsSet } from "../lib/jwt_claims_set.js";
 import { JWTInvalid } from "../util/errors.js";
 async function jwtVerify(jwt, key, options) {
-  const verified = await verifyCompact(jwt, prepareVerify(options), key);
-  if (!verified[2])
+  const [verified, b64] = await verifyCompact(jwt, prepareVerify(options), key);
+  if (!b64)
     throw new JWTInvalid("JWTs MUST NOT use unencoded payload");
-  const result = { payload: validateClaimsSet(verified[1], verified[0], options), protectedHeader: verified[1] };
-  return typeof key == "function" ? { ...result, key: verified[3] } : result;
+  const payload = validateClaimsSet(verified.protectedHeader, verified.payload, options);
+  return { ...verified, payload };
 }
 export {
   jwtVerify

package/dist/webapi/key/export.js

@@ -1,11 +1,13 @@
 import { toSPKI as exportPublic, toPKCS8 as exportPrivate } from "../lib/asn1.js";
-import { invalidKeyInput } from "../lib/invalid_key_input.js";
+import { invalidKeyInput, isCryptoKey, isKeyObject } from "../lib/key.js";
 import { encode as b64u } from "../util/base64url.js";
-import { isCryptoKey, isKeyObject } from "../lib/is_key_like.js";
-function omitUndefinedProperties(jwk) {
-  return Object.fromEntries(Object.entries(jwk).filter(([, value]) => value !== void 0));
+function exportSPKI(key) {
+  return exportPublic(key);
+}
+function exportPKCS8(key) {
+  return exportPrivate(key);
 }
-async function keyToJWK(key) {
+async function exportJWK(key) {
   if (isKeyObject(key))
     if (key.type === "secret")
       key = key.export();
@@ -20,17 +22,11 @@ async function keyToJWK(key) {
     throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "Uint8Array"));
   if (!key.extractable)
     throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");
-  const { ext, key_ops, alg, use, ...jwk } = omitUndefinedProperties(await crypto.subtle.exportKey("jwk", key));
-  return jwk.kty === "AKP" && (jwk.alg = alg), jwk;
-}
-function exportSPKI(key) {
-  return exportPublic(key);
-}
-function exportPKCS8(key) {
-  return exportPrivate(key);
-}
-function exportJWK(key) {
-  return keyToJWK(key);
+  const jwk = await crypto.subtle.exportKey("jwk", key);
+  delete jwk.ext, delete jwk.key_ops, delete jwk.use, jwk.kty !== "AKP" && delete jwk.alg;
+  for (const parameter of Object.keys(jwk))
+    jwk[parameter] === void 0 && delete jwk[parameter];
+  return jwk;
 }
 export {
   exportJWK,

package/dist/webapi/key/generate_key_pair.js

@@ -1,5 +1,5 @@
 import { JOSENotSupported } from "../util/errors.js";
-import { validateExtractableOption } from "../lib/key_options.js";
+import { validateExtractableOption } from "../lib/key.js";
 import { keyAlgorithm, unsupportedAlg, algArgument } from "../lib/key_algorithm.js";
 function getModulusLengthOption(options) {
   const modulusLength = options?.modulusLength ?? 2048;
@@ -13,18 +13,9 @@ async function generateKeyPair(alg, options) {
   let algorithm;
   if (entry.resolve) {
     const crv = options?.crv ?? "P-256";
-    switch (crv) {
-      case "P-256":
-      case "P-384":
-      case "P-521":
-        algorithm = { name: "ECDH", namedCurve: crv };
-        break;
-      case "X25519":
-        algorithm = { name: "X25519" };
-        break;
-      default:
-        throw new JOSENotSupported("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519");
-    }
+    if (!["P-256", "P-384", "P-521", "X25519"].includes(crv))
+      throw new JOSENotSupported("Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, and X25519");
+    algorithm = entry.resolve({ crv });
   } else {
     if (entry.crv !== void 0 && options?.crv !== void 0 && options.crv !== entry.crv)
       throw new JOSENotSupported(`Invalid or unsupported crv option provided, the only supported value for ${alg} is ${entry.crv}`);

package/dist/webapi/key/generate_secret.js

@@ -1,13 +1,13 @@
 import { unsupportedAlg, algArgument } from "../lib/key_algorithm.js";
-import { validateExtractableOption } from "../lib/key_options.js";
+import { validateExtractableOption } from "../lib/key.js";
 async function generateSecret(alg, options) {
   const extractable = validateExtractableOption(options?.extractable);
-  let length, algorithm, keyUsages;
+  let keyLengthBits, algorithm, keyUsages;
   switch (alg) {
     case "HS256":
     case "HS384":
     case "HS512":
-      length = +alg.slice(-3), algorithm = { name: "HMAC", hash: `SHA-${length}`, length }, keyUsages = ["sign", "verify"];
+      keyLengthBits = +alg.slice(-3), algorithm = { name: "HMAC", hash: `SHA-${keyLengthBits}`, length: keyLengthBits }, keyUsages = ["sign", "verify"];
       break;
     case "A128CBC-HS256":
     case "A192CBC-HS384":
@@ -16,7 +16,7 @@ async function generateSecret(alg, options) {
     case "A128KW":
     case "A192KW":
     case "A256KW":
-      length = +alg.slice(1, 4), algorithm = { name: "AES-KW", length }, keyUsages = ["wrapKey", "unwrapKey"];
+      keyLengthBits = +alg.slice(1, 4), algorithm = { name: "AES-KW", length: keyLengthBits }, keyUsages = ["wrapKey", "unwrapKey"];
       break;
     case "A128GCMKW":
     case "A192GCMKW":
@@ -24,7 +24,7 @@ async function generateSecret(alg, options) {
     case "A128GCM":
     case "A192GCM":
     case "A256GCM":
-      length = +alg.slice(1, 4), algorithm = { name: "AES-GCM", length }, keyUsages = ["encrypt", "decrypt"];
+      keyLengthBits = +alg.slice(1, 4), algorithm = { name: "AES-GCM", length: keyLengthBits }, keyUsages = ["encrypt", "decrypt"];
       break;
     default:
       unsupportedAlg(algArgument);

package/dist/webapi/key/import.js

@@ -1,11 +1,9 @@
 import { decode as decodeBase64URL } from "../util/base64url.js";
 import { fromSPKI, fromPKCS8, fromX509 } from "../lib/asn1.js";
-import { jwkToKey } from "../lib/jwk_to_key.js";
+import { jwkToKey, validateExtractableOption, normalizeJwk } from "../lib/key.js";
 import { keyAlgorithm } from "../lib/key_algorithm.js";
 import { JOSENotSupported } from "../util/errors.js";
-import { isObject } from "../lib/type_checks.js";
-import { validateExtractableOption } from "../lib/key_options.js";
-import { normalizeJwk } from "../lib/jwk_metadata.js";
+import { isObject } from "../lib/validate.js";
 async function importSPKI(spki, alg, options) {
   if (typeof spki != "string" || spki.indexOf("-----BEGIN PUBLIC KEY-----") !== 0)
     throw new TypeError('"spki" must be SPKI formatted string');
@@ -25,9 +23,7 @@ async function importJWK(jwk, alg, options) {
   if (!isObject(jwk))
     throw new TypeError("JWK must be an object");
   const normalized = normalizeJwk(jwk), extractable = validateExtractableOption(options?.extractable), { alg: jwkAlg } = normalized;
-  alg ??= jwkAlg;
-  const ext = extractable ?? normalized.ext;
-  if (normalized.kty !== "oct" && !alg)
+  if (alg ??= jwkAlg, normalized.kty !== "oct" && !alg)
     throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
   switch (normalized.kty) {
     case "oct":
@@ -39,12 +35,12 @@ async function importJWK(jwk, alg, options) {
         throw new TypeError('missing "alg" (Algorithm) Parameter value');
       if (alg !== jwkAlg)
         throw new TypeError("JWK alg and alg option value mismatch");
-      return jwkToKey(keyAlgorithm(alg), { ...normalized, ext });
+      return jwkToKey(keyAlgorithm(alg), normalized, extractable);
     }
     case "RSA":
     case "EC":
     case "OKP":
-      return jwkToKey(keyAlgorithm(alg), { ...normalized, alg, ext });
+      return jwkToKey(keyAlgorithm(alg), normalized, extractable);
     default:
       throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
   }

package/dist/webapi/lib/asn1.js

@@ -1,9 +1,7 @@
-import { invalidKeyInput } from "./invalid_key_input.js";
-import { encodeBase64, decodeBase64 } from "../lib/base64.js";
+import { invalidKeyInput, isCryptoKey, isKeyObject, validateExtractableOption } from "./key.js";
+import { encodeBase64, decodeBase64 } from "./buffer_utils.js";
 import { JOSENotSupported } from "../util/errors.js";
 import { keyAlgorithm, unsupportedAlg, algArgument } from "./key_algorithm.js";
-import { isCryptoKey, isKeyObject } from "./is_key_like.js";
-import { validateExtractableOption } from "./key_options.js";
 const formatPEM = (b64, descriptor) => {
   const newlined = (b64.match(/.{1,64}/g) || []).join(`
 `);
@@ -96,8 +94,8 @@ const parseECAlgorithmIdentifier = (state) => {
     try {
       const state = createASN1State(keyData);
       parseKeyHeader(state, keyFormat), algorithm = entry.resolve({ crv: parseECAlgorithmIdentifier(state) });
-    } catch {
-      throw new JOSENotSupported("Invalid or unsupported key format");
+    } catch (cause) {
+      throw new JOSENotSupported("Invalid or unsupported key format", { cause });
     }
   else
     algorithm = entry.subtle;