@atproto/jwk-jose 0.1.11 → 0.2.0-next.0

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @atproto/jwk-jose
 
+## 0.2.0-next.0
+
+### Minor Changes
+
+- [#4929](https://github.com/bluesky-social/atproto/pull/4929) [`bb7491c`](https://github.com/bluesky-social/atproto/commit/bb7491c29e06181e1d2f8cf6eb454f9bb8ab961b) Thanks [@devinivy](https://github.com/devinivy)! - **BREAKING:** Drop support for Node.js 18 and 20. Node.js 22 is now the minimum supported version. Docker images now use Node.js 24.
+
+- [#4943](https://github.com/bluesky-social/atproto/pull/4943) [`07ae5d4`](https://github.com/bluesky-social/atproto/commit/07ae5d4452df51e045e0239da7a04cf0bc154028) Thanks [@devinivy](https://github.com/devinivy)! - **BREAKING:** Convert to pure ESM. All packages now ship `"type": "module"` with ES module output and Node16 module resolution.
+
+  Node.js 22's `require()` compatibility layer can still load these packages in CommonJS code.
+
+- [#4930](https://github.com/bluesky-social/atproto/pull/4930) [`042df15`](https://github.com/bluesky-social/atproto/commit/042df15087c0e62cd1e715fcbf58852fab875af9) Thanks [@devinivy](https://github.com/devinivy)! - Build with TypeScript 6.0. Emitted `.d.ts` files now use TypeScript 6's stricter `Uint8Array<ArrayBuffer>` typing in places where Web/Node APIs require buffer-backed (not shared-memory) byte arrays. Consumers compiling against these types on older TypeScript should see no runtime impact, but may need to widen or cast in spots that previously relied on `Uint8Array` defaulting to `<ArrayBufferLike>`.
+
+  Internal: tsconfig `moduleResolution: "node"` is silenced via `ignoreDeprecations: "6.0"` for now; the proper migration to `node16`/`bundler` resolution is deferred.
+
+### Patch Changes
+
+- Updated dependencies [[`bb7491c`](https://github.com/bluesky-social/atproto/commit/bb7491c29e06181e1d2f8cf6eb454f9bb8ab961b), [`07ae5d4`](https://github.com/bluesky-social/atproto/commit/07ae5d4452df51e045e0239da7a04cf0bc154028), [`042df15`](https://github.com/bluesky-social/atproto/commit/042df15087c0e62cd1e715fcbf58852fab875af9)]:
+  - @atproto/jwk@0.7.0-next.0
+
 ## 0.1.11
 
 ### Patch Changes

package/LICENSE.txt

@@ -1,6 +1,6 @@
 Dual MIT/Apache-2.0 License
 
-Copyright (c) 2022-2025 Bluesky Social PBC, and Contributors
+Copyright (c) 2022-2026 Bluesky Social PBC, and Contributors
 
 Except as otherwise noted in individual files, this software is licensed under the MIT license (<http://opensource.org/licenses/MIT>), or the Apache License, Version 2.0 (<http://www.apache.org/licenses/LICENSE-2.0>).
 

package/dist/index.js

@@ -1,18 +1,2 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __exportStar = (this && this.__exportStar) || function(m, exports) {
-    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-__exportStar(require("./jose-key.js"), exports);
+export * from './jose-key.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gDAA6B","sourcesContent":["export * from './jose-key.js'\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAA","sourcesContent":["export * from './jose-key.js'\n"]}

package/dist/jose-key.js

@@ -1,11 +1,8 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.JoseKey = void 0;
-const jose_1 = require("jose");
-const jwk_1 = require("@atproto/jwk");
-const util_js_1 = require("./util.js");
-const { JOSEError } = jose_1.errors;
-class JoseKey extends jwk_1.Key {
+import { SignJWT, errors, exportJWK, generateKeyPair, importJWK, importPKCS8, jwtVerify, } from 'jose';
+import { JwkError, JwtCreateError, JwtVerifyError, Key, isPrivateJwk, jwkSchema, jwtHeaderSchema, jwtPayloadSchema, } from '@atproto/jwk';
+import { either } from './util.js';
+const { JOSEError } = errors;
+export class JoseKey extends Key {
     /**
      * Some runtimes (e.g. Bun) require an `alg` second argument to be set when
      * invoking `importJWK`. In order to be compatible with these runtimes, we
@@ -14,27 +11,27 @@ class JoseKey extends jwk_1.Key {
      */
     async getKeyObj(alg) {
         if (!this.algorithms.includes(alg)) {
-            throw new jwk_1.JwkError(`Key cannot be used with algorithm "${alg}"`);
+            throw new JwkError(`Key cannot be used with algorithm "${alg}"`);
         }
         try {
-            return await (0, jose_1.importJWK)(this.jwk, alg);
+            return await importJWK(this.jwk, alg);
         }
         catch (cause) {
-            throw new jwk_1.JwkError('Failed to import JWK', undefined, { cause });
+            throw new JwkError('Failed to import JWK', undefined, { cause });
         }
     }
     async createJwt(header, payload) {
         try {
             const { kid } = header;
             if (kid && kid !== this.kid) {
-                throw new jwk_1.JwtCreateError(`Invalid "kid" (${kid}) used to sign with key "${this.kid}"`);
+                throw new JwtCreateError(`Invalid "kid" (${kid}) used to sign with key "${this.kid}"`);
             }
             const { alg } = header;
             if (!alg) {
-                throw new jwk_1.JwtCreateError('Missing "alg" in JWT header');
+                throw new JwtCreateError('Missing "alg" in JWT header');
             }
             const keyObj = await this.getKeyObj(alg);
-            const jwtBuilder = new jose_1.SignJWT(payload).setProtectedHeader({
+            const jwtBuilder = new SignJWT(payload).setProtectedHeader({
                 ...header,
                 alg,
                 kid: this.kid,
@@ -44,30 +41,30 @@ class JoseKey extends jwk_1.Key {
         }
         catch (cause) {
             if (cause instanceof JOSEError) {
-                throw new jwk_1.JwtCreateError(cause.message, cause.code, { cause });
+                throw new JwtCreateError(cause.message, cause.code, { cause });
             }
             else {
-                throw jwk_1.JwtCreateError.from(cause);
+                throw JwtCreateError.from(cause);
             }
         }
     }
     async verifyJwt(token, options) {
         try {
-            const result = await (0, jose_1.jwtVerify)(token, async ({ alg }) => this.getKeyObj(alg), { ...options, algorithms: this.algorithms });
+            const result = await jwtVerify(token, async ({ alg }) => this.getKeyObj(alg), { ...options, algorithms: this.algorithms });
             // @NOTE if all tokens are signed exclusively through createJwt(), then
             // there should be no need to parse the payload and headers here. But
             // since the JWT could have been signed with the same key from somewhere
             // else, let's parse it to ensure the integrity (and type safety) of the
             // data.
-            const headerParsed = jwk_1.jwtHeaderSchema.safeParse(result.protectedHeader);
+            const headerParsed = jwtHeaderSchema.safeParse(result.protectedHeader);
             if (!headerParsed.success) {
-                throw new jwk_1.JwtVerifyError('Invalid JWT header', undefined, {
+                throw new JwtVerifyError('Invalid JWT header', undefined, {
                     cause: headerParsed.error,
                 });
             }
-            const payloadParsed = jwk_1.jwtPayloadSchema.safeParse(result.payload);
+            const payloadParsed = jwtPayloadSchema.safeParse(result.payload);
             if (!payloadParsed.success) {
-                throw new jwk_1.JwtVerifyError('Invalid JWT payload', undefined, {
+                throw new JwtVerifyError('Invalid JWT payload', undefined, {
                     cause: payloadParsed.error,
                 });
             }
@@ -79,27 +76,27 @@ class JoseKey extends jwk_1.Key {
         }
         catch (cause) {
             if (cause instanceof JOSEError) {
-                throw new jwk_1.JwtVerifyError(cause.message, cause.code, { cause });
+                throw new JwtVerifyError(cause.message, cause.code, { cause });
             }
             else {
-                throw jwk_1.JwtVerifyError.from(cause);
+                throw JwtVerifyError.from(cause);
             }
         }
     }
     static async generateKeyPair(allowedAlgos = ['ES256'], options) {
         if (!allowedAlgos.length) {
-            throw new jwk_1.JwkError('No algorithms provided for key generation');
+            throw new JwkError('No algorithms provided for key generation');
         }
         const errors = [];
         for (const alg of allowedAlgos) {
             try {
-                return await (0, jose_1.generateKeyPair)(alg, options);
+                return await generateKeyPair(alg, options);
             }
             catch (err) {
                 errors.push(err);
             }
         }
-        throw new jwk_1.JwkError('Failed to generate key pair', undefined, {
+        throw new JwkError('Failed to generate key pair', undefined, {
             cause: new AggregateError(errors, 'None of the algorithms worked'),
         });
     }
@@ -121,7 +118,7 @@ class JoseKey extends jwk_1.Key {
             if (input.startsWith('{')) {
                 return this.fromJWK(input, kid);
             }
-            throw new jwk_1.JwkError('Invalid input');
+            throw new JwkError('Invalid input');
         }
         if (typeof input === 'object') {
             // Jwk
@@ -131,18 +128,18 @@ class JoseKey extends jwk_1.Key {
             // KeyLike
             return this.fromKeyLike(input, kid);
         }
-        throw new jwk_1.JwkError('Invalid input');
+        throw new JwkError('Invalid input');
     }
     /**
      * @see {@link exportJWK}
      */
     static async fromKeyLike(keyLike, kid, alg) {
-        const jwk = await (0, jose_1.exportJWK)(keyLike);
+        const jwk = await exportJWK(keyLike);
         if (alg) {
             if (!jwk.alg)
                 jwk.alg = alg;
             else if (jwk.alg !== alg)
-                throw new jwk_1.JwkError('Invalid "alg" in JWK');
+                throw new JwkError('Invalid "alg" in JWK');
         }
         return this.fromJWK(jwk, kid);
     }
@@ -150,22 +147,21 @@ class JoseKey extends jwk_1.Key {
      * @see {@link importPKCS8}
      */
     static async fromPKCS8(pem, alg, kid) {
-        const keyLike = await (0, jose_1.importPKCS8)(pem, alg, { extractable: true });
+        const keyLike = await importPKCS8(pem, alg, { extractable: true });
         return this.fromKeyLike(keyLike, kid);
     }
     static async fromJWK(input, inputKid) {
         const jwk = typeof input === 'string' ? JSON.parse(input) : input;
         if (!jwk || typeof jwk !== 'object')
-            throw new jwk_1.JwkError('Invalid JWK');
-        const kid = (0, util_js_1.either)(jwk.kid, inputKid);
+            throw new JwkError('Invalid JWK');
+        const kid = either(jwk.kid, inputKid);
         // Backwards compatibility with old behavior
-        if (jwk.use != null && (0, jwk_1.isPrivateJwk)(jwk)) {
+        if (jwk.use != null && isPrivateJwk(jwk)) {
             console.warn('Deprecation warning: Private JWK with a "use" property will be rejected in the future. Please remove replace "use" with (valid) "key_ops".');
             jwk.key_ops ??= jwk.use === 'sig' ? ['sign'] : ['encrypt'];
             delete jwk.use;
         }
-        return new JoseKey(jwk_1.jwkSchema.parse({ ...jwk, kid }));
+        return new JoseKey(jwkSchema.parse({ ...jwk, kid }));
     }
 }
-exports.JoseKey = JoseKey;
 //# sourceMappingURL=jose-key.js.map

package/dist/jose-key.js.map

@@ -1 +1 @@
-{"version":3,"file":"jose-key.js","sourceRoot":"","sources":["../src/jose-key.ts"],"names":[],"mappings":";;;AAAA,+BAaa;AACb,sCAeqB;AACrB,uCAA+C;AAE/C,MAAM,EAAE,SAAS,EAAE,GAAG,aAAM,CAAA;AAa5B,MAAa,OAA6B,SAAQ,SAAM;IACtD;;;;;OAKG;IACO,KAAK,CAAC,SAAS,CAAC,GAAW;QACnC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,cAAQ,CAAC,sCAAsC,GAAG,GAAG,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,IAAA,gBAAS,EAAC,IAAI,CAAC,GAAU,EAAE,GAAG,CAAC,CAAA;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,cAAQ,CAAC,sBAAsB,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QAClE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAiB,EAAE,OAAmB;QACpD,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;YACtB,IAAI,GAAG,IAAI,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,oBAAc,CACtB,kBAAkB,GAAG,4BAA4B,IAAI,CAAC,GAAG,GAAG,CAC7D,CAAA;YACH,CAAC;YAED,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;YACtB,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,oBAAc,CAAC,6BAA6B,CAAC,CAAA;YACzD,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;YACxC,MAAM,UAAU,GAAG,IAAI,cAAO,CAAC,OAAO,CAAC,CAAC,kBAAkB,CAAC;gBACzD,GAAG,MAAM;gBACT,GAAG;gBACH,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAA;YAEF,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAE/C,OAAO,SAAsB,CAAA;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;gBAC/B,MAAM,IAAI,oBAAc,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;YAChE,CAAC;iBAAM,CAAC;gBACN,MAAM,oBAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CACb,KAAgB,EAChB,OAA0B;QAE1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAA,gBAAS,EAC5B,KAAK,EACL,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EACtC,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAsB,CAChE,CAAA;YAED,uEAAuE;YACvE,qEAAqE;YACrE,wEAAwE;YACxE,wEAAwE;YACxE,QAAQ;YACR,MAAM,YAAY,GAAG,qBAAe,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;YACtE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;gBAC1B,MAAM,IAAI,oBAAc,CAAC,oBAAoB,EAAE,SAAS,EAAE;oBACxD,KAAK,EAAE,YAAY,CAAC,KAAK;iBAC1B,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,aAAa,GAAG,sBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YAChE,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;gBAC3B,MAAM,IAAI,oBAAc,CAAC,qBAAqB,EAAE,SAAS,EAAE;oBACzD,KAAK,EAAE,aAAa,CAAC,KAAK;iBAC3B,CAAC,CAAA;YACJ,CAAC;YAED,OAAO;gBACL,eAAe,EAAE,YAAY,CAAC,IAAI;gBAClC,2CAA2C;gBAC3C,OAAO,EAAE,aAAa,CAAC,IAAkC;aAC1D,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;gBAC/B,MAAM,IAAI,oBAAc,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;YAChE,CAAC;iBAAM,CAAC;gBACN,MAAM,oBAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,eAAe,CAC1B,eAAkC,CAAC,OAAO,CAAC,EAC3C,OAAgC;QAEhC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;YACzB,MAAM,IAAI,cAAQ,CAAC,2CAA2C,CAAC,CAAA;QACjE,CAAC;QAED,MAAM,MAAM,GAAc,EAAE,CAAA;QAC5B,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,OAAO,MAAM,IAAA,sBAAe,EAAC,GAAG,EAAE,OAAO,CAAC,CAAA;YAC5C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;QAED,MAAM,IAAI,cAAQ,CAAC,6BAA6B,EAAE,SAAS,EAAE;YAC3D,KAAK,EAAE,IAAI,cAAc,CAAC,MAAM,EAAE,+BAA+B,CAAC;SACnE,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,QAAQ,CACnB,eAAyB,CAAC,OAAO,CAAC,EAClC,GAAY,EACZ,OAAqD;QAErD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE;YAClD,GAAG,OAAO;YACV,WAAW,EAAE,IAAI;SAClB,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;IAC7C,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,cAAc,CACzB,KAA6B,EAC7B,GAAY;QAEZ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,QAAQ;YACR,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,8DAA8D;gBAC9D,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;YACvC,CAAC;YAED,eAAe;YACf,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YACjC,CAAC;YAED,MAAM,IAAI,cAAQ,CAAC,eAAe,CAAC,CAAA;QACrC,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM;YACN,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YACjC,CAAC;YAED,UAAU;YACV,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACrC,CAAC;QAED,MAAM,IAAI,cAAQ,CAAC,eAAe,CAAC,CAAA;IACrC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,WAAW,CACtB,OAA6B,EAC7B,GAAY,EACZ,GAAY;QAEZ,MAAM,GAAG,GAAG,MAAM,IAAA,gBAAS,EAAC,OAAO,CAAC,CAAA;QACpC,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC,GAAG,CAAC,GAAG;gBAAE,GAAG,CAAC,GAAG,GAAG,GAAG,CAAA;iBACtB,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG;gBAAE,MAAM,IAAI,cAAQ,CAAC,sBAAsB,CAAC,CAAA;QACtE,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAC/B,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,SAAS,CACpB,GAAW,EACX,GAAW,EACX,GAAY;QAEZ,MAAM,OAAO,GAAG,MAAM,IAAA,kBAAW,EAAC,GAAG,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;QAClE,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACvC,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,OAAO,CAClB,KAAuC,EACvC,QAAiB;QAEjB,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACjE,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,MAAM,IAAI,cAAQ,CAAC,aAAa,CAAC,CAAA;QAEtE,MAAM,GAAG,GAAG,IAAA,gBAAM,EAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAErC,4CAA4C;QAC5C,IAAI,GAAG,CAAC,GAAG,IAAI,IAAI,IAAI,IAAA,kBAAY,EAAC,GAAG,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,IAAI,CACV,4IAA4I,CAC7I,CAAA;YACD,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;YAC1D,OAAO,GAAG,CAAC,GAAG,CAAA;QAChB,CAAC;QAED,OAAO,IAAI,OAAO,CAAM,eAAS,CAAC,KAAK,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;IAC3D,CAAC;CACF;AAjND,0BAiNC","sourcesContent":["import {\n  type GenerateKeyPairOptions,\n  type GenerateKeyPairResult,\n  type JWK,\n  type JWTVerifyOptions,\n  type KeyLike,\n  SignJWT,\n  errors,\n  exportJWK,\n  generateKeyPair,\n  importJWK,\n  importPKCS8,\n  jwtVerify,\n} from 'jose'\nimport {\n  Jwk,\n  JwkError,\n  JwtCreateError,\n  JwtHeader,\n  JwtPayload,\n  JwtVerifyError,\n  Key,\n  SignedJwt,\n  VerifyOptions,\n  VerifyResult,\n  isPrivateJwk,\n  jwkSchema,\n  jwtHeaderSchema,\n  jwtPayloadSchema,\n} from '@atproto/jwk'\nimport { RequiredKey, either } from './util.js'\n\nconst { JOSEError } = errors\n\nexport {\n  type GenerateKeyPairOptions,\n  type GenerateKeyPairResult,\n  type Jwk,\n  type JwtHeader,\n  type JwtPayload,\n  type KeyLike,\n  type SignedJwt,\n  type VerifyOptions,\n}\n\nexport class JoseKey<J extends Jwk = Jwk> extends Key<J> {\n  /**\n   * Some runtimes (e.g. Bun) require an `alg` second argument to be set when\n   * invoking `importJWK`. In order to be compatible with these runtimes, we\n   * provide the following method to ensure the `alg` is always set. We also\n   * take the opportunity to ensure that the `alg` is compatible with this key.\n   */\n  protected async getKeyObj(alg: string) {\n    if (!this.algorithms.includes(alg)) {\n      throw new JwkError(`Key cannot be used with algorithm \"${alg}\"`)\n    }\n    try {\n      return await importJWK(this.jwk as JWK, alg)\n    } catch (cause) {\n      throw new JwkError('Failed to import JWK', undefined, { cause })\n    }\n  }\n\n  async createJwt(header: JwtHeader, payload: JwtPayload): Promise<SignedJwt> {\n    try {\n      const { kid } = header\n      if (kid && kid !== this.kid) {\n        throw new JwtCreateError(\n          `Invalid \"kid\" (${kid}) used to sign with key \"${this.kid}\"`,\n        )\n      }\n\n      const { alg } = header\n      if (!alg) {\n        throw new JwtCreateError('Missing \"alg\" in JWT header')\n      }\n\n      const keyObj = await this.getKeyObj(alg)\n      const jwtBuilder = new SignJWT(payload).setProtectedHeader({\n        ...header,\n        alg,\n        kid: this.kid,\n      })\n\n      const signedJwt = await jwtBuilder.sign(keyObj)\n\n      return signedJwt as SignedJwt\n    } catch (cause) {\n      if (cause instanceof JOSEError) {\n        throw new JwtCreateError(cause.message, cause.code, { cause })\n      } else {\n        throw JwtCreateError.from(cause)\n      }\n    }\n  }\n\n  async verifyJwt<C extends string = never>(\n    token: SignedJwt,\n    options?: VerifyOptions<C>,\n  ): Promise<VerifyResult<C>> {\n    try {\n      const result = await jwtVerify(\n        token,\n        async ({ alg }) => this.getKeyObj(alg),\n        { ...options, algorithms: this.algorithms } as JWTVerifyOptions,\n      )\n\n      // @NOTE if all tokens are signed exclusively through createJwt(), then\n      // there should be no need to parse the payload and headers here. But\n      // since the JWT could have been signed with the same key from somewhere\n      // else, let's parse it to ensure the integrity (and type safety) of the\n      // data.\n      const headerParsed = jwtHeaderSchema.safeParse(result.protectedHeader)\n      if (!headerParsed.success) {\n        throw new JwtVerifyError('Invalid JWT header', undefined, {\n          cause: headerParsed.error,\n        })\n      }\n\n      const payloadParsed = jwtPayloadSchema.safeParse(result.payload)\n      if (!payloadParsed.success) {\n        throw new JwtVerifyError('Invalid JWT payload', undefined, {\n          cause: payloadParsed.error,\n        })\n      }\n\n      return {\n        protectedHeader: headerParsed.data,\n        // \"requiredClaims\" enforced by jwtVerify()\n        payload: payloadParsed.data as RequiredKey<JwtPayload, C>,\n      }\n    } catch (cause) {\n      if (cause instanceof JOSEError) {\n        throw new JwtVerifyError(cause.message, cause.code, { cause })\n      } else {\n        throw JwtVerifyError.from(cause)\n      }\n    }\n  }\n\n  static async generateKeyPair(\n    allowedAlgos: readonly string[] = ['ES256'],\n    options?: GenerateKeyPairOptions,\n  ) {\n    if (!allowedAlgos.length) {\n      throw new JwkError('No algorithms provided for key generation')\n    }\n\n    const errors: unknown[] = []\n    for (const alg of allowedAlgos) {\n      try {\n        return await generateKeyPair(alg, options)\n      } catch (err) {\n        errors.push(err)\n      }\n    }\n\n    throw new JwkError('Failed to generate key pair', undefined, {\n      cause: new AggregateError(errors, 'None of the algorithms worked'),\n    })\n  }\n\n  static async generate(\n    allowedAlgos: string[] = ['ES256'],\n    kid?: string,\n    options?: Omit<GenerateKeyPairOptions, 'extractable'>,\n  ): Promise<JoseKey> {\n    const kp = await this.generateKeyPair(allowedAlgos, {\n      ...options,\n      extractable: true,\n    })\n    return this.fromKeyLike(kp.privateKey, kid)\n  }\n\n  static async fromImportable(\n    input: string | KeyLike | Jwk,\n    kid?: string,\n  ): Promise<JoseKey> {\n    if (typeof input === 'string') {\n      // PKCS8\n      if (input.startsWith('-----')) {\n        // The \"alg\" is only needed in WebCrypto (NodeJS will be fine)\n        return this.fromPKCS8(input, '', kid)\n      }\n\n      // Jwk (string)\n      if (input.startsWith('{')) {\n        return this.fromJWK(input, kid)\n      }\n\n      throw new JwkError('Invalid input')\n    }\n\n    if (typeof input === 'object') {\n      // Jwk\n      if ('kty' in input || 'alg' in input) {\n        return this.fromJWK(input, kid)\n      }\n\n      // KeyLike\n      return this.fromKeyLike(input, kid)\n    }\n\n    throw new JwkError('Invalid input')\n  }\n\n  /**\n   * @see {@link exportJWK}\n   */\n  static async fromKeyLike(\n    keyLike: KeyLike | Uint8Array,\n    kid?: string,\n    alg?: string,\n  ): Promise<JoseKey> {\n    const jwk = await exportJWK(keyLike)\n    if (alg) {\n      if (!jwk.alg) jwk.alg = alg\n      else if (jwk.alg !== alg) throw new JwkError('Invalid \"alg\" in JWK')\n    }\n    return this.fromJWK(jwk, kid)\n  }\n\n  /**\n   * @see {@link importPKCS8}\n   */\n  static async fromPKCS8(\n    pem: string,\n    alg: string,\n    kid?: string,\n  ): Promise<JoseKey> {\n    const keyLike = await importPKCS8(pem, alg, { extractable: true })\n    return this.fromKeyLike(keyLike, kid)\n  }\n\n  static async fromJWK(\n    input: string | Record<string, unknown>,\n    inputKid?: string,\n  ): Promise<JoseKey> {\n    const jwk = typeof input === 'string' ? JSON.parse(input) : input\n    if (!jwk || typeof jwk !== 'object') throw new JwkError('Invalid JWK')\n\n    const kid = either(jwk.kid, inputKid)\n\n    // Backwards compatibility with old behavior\n    if (jwk.use != null && isPrivateJwk(jwk)) {\n      console.warn(\n        'Deprecation warning: Private JWK with a \"use\" property will be rejected in the future. Please remove replace \"use\" with (valid) \"key_ops\".',\n      )\n      jwk.key_ops ??= jwk.use === 'sig' ? ['sign'] : ['encrypt']\n      delete jwk.use\n    }\n\n    return new JoseKey<Jwk>(jwkSchema.parse({ ...jwk, kid }))\n  }\n}\n"]}
+{"version":3,"file":"jose-key.js","sourceRoot":"","sources":["../src/jose-key.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,OAAO,EACP,MAAM,EACN,SAAS,EACT,eAAe,EACf,SAAS,EACT,WAAW,EACX,SAAS,GACV,MAAM,MAAM,CAAA;AACb,OAAO,EAEL,QAAQ,EACR,cAAc,EAGd,cAAc,EACd,GAAG,EAIH,YAAY,EACZ,SAAS,EACT,eAAe,EACf,gBAAgB,GACjB,MAAM,cAAc,CAAA;AACrB,OAAO,EAAe,MAAM,EAAE,MAAM,WAAW,CAAA;AAE/C,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,CAAA;AAa5B,MAAM,OAAO,OAA6B,SAAQ,GAAM;IACtD;;;;;OAKG;IACO,KAAK,CAAC,SAAS,CAAC,GAAW;QACnC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,QAAQ,CAAC,sCAAsC,GAAG,GAAG,CAAC,CAAA;QAClE,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,SAAS,CAAC,IAAI,CAAC,GAAU,EAAE,GAAG,CAAC,CAAA;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,QAAQ,CAAC,sBAAsB,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;QAClE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,MAAiB,EAAE,OAAmB;QACpD,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;YACtB,IAAI,GAAG,IAAI,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC5B,MAAM,IAAI,cAAc,CACtB,kBAAkB,GAAG,4BAA4B,IAAI,CAAC,GAAG,GAAG,CAC7D,CAAA;YACH,CAAC;YAED,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;YACtB,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,cAAc,CAAC,6BAA6B,CAAC,CAAA;YACzD,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;YACxC,MAAM,UAAU,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC,kBAAkB,CAAC;gBACzD,GAAG,MAAM;gBACT,GAAG;gBACH,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CAAA;YAEF,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;YAE/C,OAAO,SAAsB,CAAA;QAC/B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;gBAC/B,MAAM,IAAI,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;YAChE,CAAC;iBAAM,CAAC;gBACN,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CACb,KAAgB,EAChB,OAA0B;QAE1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAC5B,KAAK,EACL,KAAK,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EACtC,EAAE,GAAG,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAsB,CAChE,CAAA;YAED,uEAAuE;YACvE,qEAAqE;YACrE,wEAAwE;YACxE,wEAAwE;YACxE,QAAQ;YACR,MAAM,YAAY,GAAG,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;YACtE,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;gBAC1B,MAAM,IAAI,cAAc,CAAC,oBAAoB,EAAE,SAAS,EAAE;oBACxD,KAAK,EAAE,YAAY,CAAC,KAAK;iBAC1B,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,aAAa,GAAG,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;YAChE,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;gBAC3B,MAAM,IAAI,cAAc,CAAC,qBAAqB,EAAE,SAAS,EAAE;oBACzD,KAAK,EAAE,aAAa,CAAC,KAAK;iBAC3B,CAAC,CAAA;YACJ,CAAC;YAED,OAAO;gBACL,eAAe,EAAE,YAAY,CAAC,IAAI;gBAClC,2CAA2C;gBAC3C,OAAO,EAAE,aAAa,CAAC,IAAkC;aAC1D,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;gBAC/B,MAAM,IAAI,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;YAChE,CAAC;iBAAM,CAAC;gBACN,MAAM,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAClC,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,eAAe,CAC1B,eAAkC,CAAC,OAAO,CAAC,EAC3C,OAAgC;QAEhC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;YACzB,MAAM,IAAI,QAAQ,CAAC,2CAA2C,CAAC,CAAA;QACjE,CAAC;QAED,MAAM,MAAM,GAAc,EAAE,CAAA;QAC5B,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,OAAO,MAAM,eAAe,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;YAC5C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAClB,CAAC;QACH,CAAC;QAED,MAAM,IAAI,QAAQ,CAAC,6BAA6B,EAAE,SAAS,EAAE;YAC3D,KAAK,EAAE,IAAI,cAAc,CAAC,MAAM,EAAE,+BAA+B,CAAC;SACnE,CAAC,CAAA;IACJ,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,QAAQ,CACnB,eAAyB,CAAC,OAAO,CAAC,EAClC,GAAY,EACZ,OAAqD;QAErD,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,EAAE;YAClD,GAAG,OAAO;YACV,WAAW,EAAE,IAAI;SAClB,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,UAAU,EAAE,GAAG,CAAC,CAAA;IAC7C,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,cAAc,CACzB,KAA6B,EAC7B,GAAY;QAEZ,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,QAAQ;YACR,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,8DAA8D;gBAC9D,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,CAAA;YACvC,CAAC;YAED,eAAe;YACf,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YACjC,CAAC;YAED,MAAM,IAAI,QAAQ,CAAC,eAAe,CAAC,CAAA;QACrC,CAAC;QAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM;YACN,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YACjC,CAAC;YAED,UAAU;YACV,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;QACrC,CAAC;QAED,MAAM,IAAI,QAAQ,CAAC,eAAe,CAAC,CAAA;IACrC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,WAAW,CACtB,OAA6B,EAC7B,GAAY,EACZ,GAAY;QAEZ,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAA;QACpC,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,CAAC,GAAG,CAAC,GAAG;gBAAE,GAAG,CAAC,GAAG,GAAG,GAAG,CAAA;iBACtB,IAAI,GAAG,CAAC,GAAG,KAAK,GAAG;gBAAE,MAAM,IAAI,QAAQ,CAAC,sBAAsB,CAAC,CAAA;QACtE,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IAC/B,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAK,CAAC,SAAS,CACpB,GAAW,EACX,GAAW,EACX,GAAY;QAEZ,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;QAClE,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACvC,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,OAAO,CAClB,KAAuC,EACvC,QAAiB;QAEjB,MAAM,GAAG,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;QACjE,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,MAAM,IAAI,QAAQ,CAAC,aAAa,CAAC,CAAA;QAEtE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;QAErC,4CAA4C;QAC5C,IAAI,GAAG,CAAC,GAAG,IAAI,IAAI,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,IAAI,CACV,4IAA4I,CAC7I,CAAA;YACD,GAAG,CAAC,OAAO,KAAK,GAAG,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;YAC1D,OAAO,GAAG,CAAC,GAAG,CAAA;QAChB,CAAC;QAED,OAAO,IAAI,OAAO,CAAM,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;IAC3D,CAAC;CACF","sourcesContent":["import {\n  type GenerateKeyPairOptions,\n  type GenerateKeyPairResult,\n  type JWK,\n  type JWTVerifyOptions,\n  type KeyLike,\n  SignJWT,\n  errors,\n  exportJWK,\n  generateKeyPair,\n  importJWK,\n  importPKCS8,\n  jwtVerify,\n} from 'jose'\nimport {\n  Jwk,\n  JwkError,\n  JwtCreateError,\n  JwtHeader,\n  JwtPayload,\n  JwtVerifyError,\n  Key,\n  SignedJwt,\n  VerifyOptions,\n  VerifyResult,\n  isPrivateJwk,\n  jwkSchema,\n  jwtHeaderSchema,\n  jwtPayloadSchema,\n} from '@atproto/jwk'\nimport { RequiredKey, either } from './util.js'\n\nconst { JOSEError } = errors\n\nexport {\n  type GenerateKeyPairOptions,\n  type GenerateKeyPairResult,\n  type Jwk,\n  type JwtHeader,\n  type JwtPayload,\n  type KeyLike,\n  type SignedJwt,\n  type VerifyOptions,\n}\n\nexport class JoseKey<J extends Jwk = Jwk> extends Key<J> {\n  /**\n   * Some runtimes (e.g. Bun) require an `alg` second argument to be set when\n   * invoking `importJWK`. In order to be compatible with these runtimes, we\n   * provide the following method to ensure the `alg` is always set. We also\n   * take the opportunity to ensure that the `alg` is compatible with this key.\n   */\n  protected async getKeyObj(alg: string) {\n    if (!this.algorithms.includes(alg)) {\n      throw new JwkError(`Key cannot be used with algorithm \"${alg}\"`)\n    }\n    try {\n      return await importJWK(this.jwk as JWK, alg)\n    } catch (cause) {\n      throw new JwkError('Failed to import JWK', undefined, { cause })\n    }\n  }\n\n  async createJwt(header: JwtHeader, payload: JwtPayload): Promise<SignedJwt> {\n    try {\n      const { kid } = header\n      if (kid && kid !== this.kid) {\n        throw new JwtCreateError(\n          `Invalid \"kid\" (${kid}) used to sign with key \"${this.kid}\"`,\n        )\n      }\n\n      const { alg } = header\n      if (!alg) {\n        throw new JwtCreateError('Missing \"alg\" in JWT header')\n      }\n\n      const keyObj = await this.getKeyObj(alg)\n      const jwtBuilder = new SignJWT(payload).setProtectedHeader({\n        ...header,\n        alg,\n        kid: this.kid,\n      })\n\n      const signedJwt = await jwtBuilder.sign(keyObj)\n\n      return signedJwt as SignedJwt\n    } catch (cause) {\n      if (cause instanceof JOSEError) {\n        throw new JwtCreateError(cause.message, cause.code, { cause })\n      } else {\n        throw JwtCreateError.from(cause)\n      }\n    }\n  }\n\n  async verifyJwt<C extends string = never>(\n    token: SignedJwt,\n    options?: VerifyOptions<C>,\n  ): Promise<VerifyResult<C>> {\n    try {\n      const result = await jwtVerify(\n        token,\n        async ({ alg }) => this.getKeyObj(alg),\n        { ...options, algorithms: this.algorithms } as JWTVerifyOptions,\n      )\n\n      // @NOTE if all tokens are signed exclusively through createJwt(), then\n      // there should be no need to parse the payload and headers here. But\n      // since the JWT could have been signed with the same key from somewhere\n      // else, let's parse it to ensure the integrity (and type safety) of the\n      // data.\n      const headerParsed = jwtHeaderSchema.safeParse(result.protectedHeader)\n      if (!headerParsed.success) {\n        throw new JwtVerifyError('Invalid JWT header', undefined, {\n          cause: headerParsed.error,\n        })\n      }\n\n      const payloadParsed = jwtPayloadSchema.safeParse(result.payload)\n      if (!payloadParsed.success) {\n        throw new JwtVerifyError('Invalid JWT payload', undefined, {\n          cause: payloadParsed.error,\n        })\n      }\n\n      return {\n        protectedHeader: headerParsed.data,\n        // \"requiredClaims\" enforced by jwtVerify()\n        payload: payloadParsed.data as RequiredKey<JwtPayload, C>,\n      }\n    } catch (cause) {\n      if (cause instanceof JOSEError) {\n        throw new JwtVerifyError(cause.message, cause.code, { cause })\n      } else {\n        throw JwtVerifyError.from(cause)\n      }\n    }\n  }\n\n  static async generateKeyPair(\n    allowedAlgos: readonly string[] = ['ES256'],\n    options?: GenerateKeyPairOptions,\n  ) {\n    if (!allowedAlgos.length) {\n      throw new JwkError('No algorithms provided for key generation')\n    }\n\n    const errors: unknown[] = []\n    for (const alg of allowedAlgos) {\n      try {\n        return await generateKeyPair(alg, options)\n      } catch (err) {\n        errors.push(err)\n      }\n    }\n\n    throw new JwkError('Failed to generate key pair', undefined, {\n      cause: new AggregateError(errors, 'None of the algorithms worked'),\n    })\n  }\n\n  static async generate(\n    allowedAlgos: string[] = ['ES256'],\n    kid?: string,\n    options?: Omit<GenerateKeyPairOptions, 'extractable'>,\n  ): Promise<JoseKey> {\n    const kp = await this.generateKeyPair(allowedAlgos, {\n      ...options,\n      extractable: true,\n    })\n    return this.fromKeyLike(kp.privateKey, kid)\n  }\n\n  static async fromImportable(\n    input: string | KeyLike | Jwk,\n    kid?: string,\n  ): Promise<JoseKey> {\n    if (typeof input === 'string') {\n      // PKCS8\n      if (input.startsWith('-----')) {\n        // The \"alg\" is only needed in WebCrypto (NodeJS will be fine)\n        return this.fromPKCS8(input, '', kid)\n      }\n\n      // Jwk (string)\n      if (input.startsWith('{')) {\n        return this.fromJWK(input, kid)\n      }\n\n      throw new JwkError('Invalid input')\n    }\n\n    if (typeof input === 'object') {\n      // Jwk\n      if ('kty' in input || 'alg' in input) {\n        return this.fromJWK(input, kid)\n      }\n\n      // KeyLike\n      return this.fromKeyLike(input, kid)\n    }\n\n    throw new JwkError('Invalid input')\n  }\n\n  /**\n   * @see {@link exportJWK}\n   */\n  static async fromKeyLike(\n    keyLike: KeyLike | Uint8Array,\n    kid?: string,\n    alg?: string,\n  ): Promise<JoseKey> {\n    const jwk = await exportJWK(keyLike)\n    if (alg) {\n      if (!jwk.alg) jwk.alg = alg\n      else if (jwk.alg !== alg) throw new JwkError('Invalid \"alg\" in JWK')\n    }\n    return this.fromJWK(jwk, kid)\n  }\n\n  /**\n   * @see {@link importPKCS8}\n   */\n  static async fromPKCS8(\n    pem: string,\n    alg: string,\n    kid?: string,\n  ): Promise<JoseKey> {\n    const keyLike = await importPKCS8(pem, alg, { extractable: true })\n    return this.fromKeyLike(keyLike, kid)\n  }\n\n  static async fromJWK(\n    input: string | Record<string, unknown>,\n    inputKid?: string,\n  ): Promise<JoseKey> {\n    const jwk = typeof input === 'string' ? JSON.parse(input) : input\n    if (!jwk || typeof jwk !== 'object') throw new JwkError('Invalid JWK')\n\n    const kid = either(jwk.kid, inputKid)\n\n    // Backwards compatibility with old behavior\n    if (jwk.use != null && isPrivateJwk(jwk)) {\n      console.warn(\n        'Deprecation warning: Private JWK with a \"use\" property will be rejected in the future. Please remove replace \"use\" with (valid) \"key_ops\".',\n      )\n      jwk.key_ops ??= jwk.use === 'sig' ? ['sign'] : ['encrypt']\n      delete jwk.use\n    }\n\n    return new JoseKey<Jwk>(jwkSchema.parse({ ...jwk, kid }))\n  }\n}\n"]}

package/dist/util.js

@@ -1,7 +1,4 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.either = either;
-function either(a, b) {
+export function either(a, b) {
     if (a != null && b != null && a !== b) {
         throw new TypeError(`Expected "${b}", got "${a}"`);
     }

package/dist/util.js.map

@@ -1 +1 @@
-{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":";;AAWA,wBAQC;AARD,SAAgB,MAAM,CACpB,CAAK,EACL,CAAK;IAEL,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACpD,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,IAAI,SAAS,CAAA;AAC5B,CAAC","sourcesContent":["// eslint-disable-next-line @typescript-eslint/ban-types\nexport type Simplify<T> = { [K in keyof T]: T[K] } & {}\n\nexport type RequiredKey<T, K extends keyof T = never> = Simplify<\n  T & {\n    [L in K]-?: unknown extends T[L]\n      ? NonNullable<unknown> | null\n      : Exclude<T[L], undefined>\n  }\n>\n\nexport function either<T extends string | number | boolean>(\n  a?: T,\n  b?: T,\n): T | undefined {\n  if (a != null && b != null && a !== b) {\n    throw new TypeError(`Expected \"${b}\", got \"${a}\"`)\n  }\n  return a ?? b ?? undefined\n}\n"]}
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../src/util.ts"],"names":[],"mappings":"AAWA,MAAM,UAAU,MAAM,CACpB,CAAK,EACL,CAAK;IAEL,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACpD,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,IAAI,SAAS,CAAA;AAC5B,CAAC","sourcesContent":["// eslint-disable-next-line @typescript-eslint/no-empty-object-type\nexport type Simplify<T> = { [K in keyof T]: T[K] } & {}\n\nexport type RequiredKey<T, K extends keyof T = never> = Simplify<\n  T & {\n    [L in K]-?: unknown extends T[L]\n      ? NonNullable<unknown> | null\n      : Exclude<T[L], undefined>\n  }\n>\n\nexport function either<T extends string | number | boolean>(\n  a?: T,\n  b?: T,\n): T | undefined {\n  if (a != null && b != null && a !== b) {\n    throw new TypeError(`Expected \"${b}\", got \"${a}\"`)\n  }\n  return a ?? b ?? undefined\n}\n"]}

package/package.json

@@ -1,6 +1,9 @@
 {
   "name": "@atproto/jwk-jose",
-  "version": "0.1.11",
+  "version": "0.2.0-next.0",
+  "engines": {
+    "node": ">=22"
+  },
   "license": "MIT",
   "description": "`jose` based implementation of @atproto/jwk Key's",
   "keywords": [
@@ -14,9 +17,7 @@
     "url": "https://github.com/bluesky-social/atproto",
     "directory": "packages/oauth/jwk-jose"
   },
-  "type": "commonjs",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
+  "type": "module",
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
@@ -25,10 +26,10 @@
   },
   "dependencies": {
     "jose": "^5.2.0",
-    "@atproto/jwk": "0.6.0"
+    "@atproto/jwk": "^0.7.0-next.0"
   },
   "devDependencies": {
-    "typescript": "^5.6.3"
+    "typescript": "^6.0.3"
   },
   "scripts": {
     "build": "tsc --build tsconfig.build.json"

package/src/util.ts

@@ -1,4 +1,4 @@
-// eslint-disable-next-line @typescript-eslint/ban-types
+// eslint-disable-next-line @typescript-eslint/no-empty-object-type
 export type Simplify<T> = { [K in keyof T]: T[K] } & {}
 
 export type RequiredKey<T, K extends keyof T = never> = Simplify<

package/tsconfig.build.tsbuildinfo

@@ -1 +1 @@
-{"root":["./src/index.ts","./src/jose-key.ts","./src/util.ts"],"version":"5.8.2"}
+{"root":["./src/index.ts","./src/jose-key.ts","./src/util.ts"],"version":"6.0.3"}