jose 3.16.0 → 3.19.0

package/dist/browser/runtime/aeskw.js

@@ -3,7 +3,7 @@ import crypto, { isCryptoKey } from './webcrypto.js';
 import invalidKeyInput from './invalid_key_input.js';
 function checkKeySize(key, alg) {
     if (key.algorithm.length !== parseInt(alg.substr(1, 3), 10)) {
-        throw new TypeError(`invalid key size for alg: ${alg}`);
+        throw new TypeError(`Invalid key size for alg: ${alg}`);
     }
 }
 function getCryptoKey(key, usage) {

package/dist/browser/runtime/asn1.js

@@ -0,0 +1,119 @@
+import globalThis, { isCloudflareWorkers, isNodeJs } from './global.js';
+import crypto, { isCryptoKey } from './webcrypto.js';
+import invalidKeyInput from './invalid_key_input.js';
+import { encodeBase64 } from './base64url.js';
+import formatPEM from '../lib/format_pem.js';
+import { JOSENotSupported } from '../util/errors.js';
+const genericExport = async (keyType, keyFormat, key) => {
+    if (!isCryptoKey(key)) {
+        throw new TypeError(invalidKeyInput(key, 'CryptoKey'));
+    }
+    if (!key.extractable) {
+        throw new TypeError('CryptoKey is not extractable');
+    }
+    if (key.type !== keyType) {
+        throw new TypeError(`key is not a ${keyType} key`);
+    }
+    return formatPEM(encodeBase64(new Uint8Array(await crypto.subtle.exportKey(keyFormat, key))), `${keyType.toUpperCase()} KEY`);
+};
+export const toSPKI = (key) => {
+    return genericExport('public', 'spki', key);
+};
+export const toPKCS8 = (key) => {
+    return genericExport('private', 'pkcs8', key);
+};
+const getNamedCurve = (keyData) => {
+    const keyDataStr = keyData.toString();
+    switch (true) {
+        case keyDataStr.includes(new Uint8Array([
+            0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x08, 0x2a, 0x86, 0x48, 0xce,
+            0x3d, 0x03, 0x01, 0x07,
+        ]).toString()):
+            return 'P-256';
+        case keyDataStr.includes(new Uint8Array([
+            0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x05, 0x2b, 0x81, 0x04, 0x00,
+            0x22,
+        ]).toString()):
+            return 'P-384';
+        case keyDataStr.includes(new Uint8Array([
+            0x06, 0x07, 0x2a, 0x86, 0x48, 0xce, 0x3d, 0x02, 0x01, 0x06, 0x05, 0x2b, 0x81, 0x04, 0x00,
+            0x23,
+        ]).toString()):
+            return 'P-521';
+        case (isCloudflareWorkers() || isNodeJs()) &&
+            keyDataStr.includes(new Uint8Array([0x06, 0x03, 0x2b, 0x65, 0x70]).toString()):
+            return 'Ed25519';
+        case isNodeJs() &&
+            keyDataStr.includes(new Uint8Array([0x06, 0x03, 0x2b, 0x65, 0x71]).toString()):
+            return 'Ed448';
+        default:
+            throw new JOSENotSupported('Invalid or unsupported EC Key Curve or OKP Key Sub Type');
+    }
+};
+const genericImport = async (replace, keyFormat, pem, alg, options) => {
+    var _a;
+    let algorithm;
+    let keyUsages;
+    const keyData = new Uint8Array(globalThis
+        .atob(pem.replace(replace, ''))
+        .split('')
+        .map((c) => c.charCodeAt(0)));
+    const isPublic = keyFormat === 'spki';
+    switch (alg) {
+        case 'PS256':
+        case 'PS384':
+        case 'PS512':
+            algorithm = { name: 'RSA-PSS', hash: { name: `SHA-${alg.substr(-3)}` } };
+            keyUsages = isPublic ? ['verify'] : ['sign'];
+            break;
+        case 'RS256':
+        case 'RS384':
+        case 'RS512':
+            algorithm = { name: 'RSASSA-PKCS1-v1_5', hash: { name: `SHA-${alg.substr(-3)}` } };
+            keyUsages = isPublic ? ['verify'] : ['sign'];
+            break;
+        case 'RSA-OAEP':
+        case 'RSA-OAEP-256':
+        case 'RSA-OAEP-384':
+        case 'RSA-OAEP-512':
+            algorithm = {
+                name: 'RSA-OAEP',
+                hash: { name: `SHA-${parseInt(alg.substr(-3), 10) || 1}` },
+            };
+            keyUsages = isPublic ? ['encrypt', 'wrapKey'] : ['decrypt', 'unwrapKey'];
+            break;
+        case 'ES256':
+            algorithm = { name: 'ECDSA', namedCurve: 'P-256' };
+            keyUsages = isPublic ? ['verify'] : ['sign'];
+            break;
+        case 'ES384':
+            algorithm = { name: 'ECDSA', namedCurve: 'P-384' };
+            keyUsages = isPublic ? ['verify'] : ['sign'];
+            break;
+        case 'ES512':
+            algorithm = { name: 'ECDSA', namedCurve: 'P-521' };
+            keyUsages = isPublic ? ['verify'] : ['sign'];
+            break;
+        case 'ECDH-ES':
+        case 'ECDH-ES+A128KW':
+        case 'ECDH-ES+A192KW':
+        case 'ECDH-ES+A256KW':
+            algorithm = { name: 'ECDH', namedCurve: getNamedCurve(keyData) };
+            keyUsages = isPublic ? [] : ['deriveBits'];
+            break;
+        case (isCloudflareWorkers() || isNodeJs()) && 'EdDSA':
+            const namedCurve = getNamedCurve(keyData).toUpperCase();
+            algorithm = { name: `NODE-${namedCurve}`, namedCurve: `NODE-${namedCurve}` };
+            keyUsages = isPublic ? ['verify'] : ['sign'];
+            break;
+        default:
+            throw new JOSENotSupported('Invalid or unsupported "alg" (Algorithm) value');
+    }
+    return crypto.subtle.importKey(keyFormat, keyData, algorithm, (_a = options === null || options === void 0 ? void 0 : options.extractable) !== null && _a !== void 0 ? _a : false, keyUsages);
+};
+export const fromPKCS8 = (pem, alg, options) => {
+    return genericImport(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, 'pkcs8', pem, alg, options);
+};
+export const fromSPKI = (pem, alg, options) => {
+    return genericImport(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g, 'spki', pem, alg, options);
+};

package/dist/browser/runtime/base64url.js

@@ -1,6 +1,6 @@
 import { encoder, decoder } from '../lib/buffer_utils.js';
 import globalThis from './global.js';
-export const encode = (input) => {
+export const encodeBase64 = (input) => {
     let unencoded = input;
     if (typeof unencoded === 'string') {
         unencoded = encoder.encode(unencoded);
@@ -10,8 +10,16 @@ export const encode = (input) => {
     for (let i = 0; i < unencoded.length; i += CHUNK_SIZE) {
         arr.push(String.fromCharCode.apply(null, unencoded.subarray(i, i + CHUNK_SIZE)));
     }
-    const base64string = globalThis.btoa(arr.join(''));
-    return base64string.replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+    return globalThis.btoa(arr.join(''));
+};
+export const encode = (input) => {
+    return encodeBase64(input).replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+};
+export const decodeBase64 = (encoded) => {
+    return new Uint8Array(globalThis
+        .atob(encoded)
+        .split('')
+        .map((c) => c.charCodeAt(0)));
 };
 export const decode = (input) => {
     let encoded = input;
@@ -20,10 +28,7 @@ export const decode = (input) => {
     }
     encoded = encoded.replace(/-/g, '+').replace(/_/g, '/').replace(/\s/g, '');
     try {
-        return new Uint8Array(globalThis
-            .atob(encoded)
-            .split('')
-            .map((c) => c.charCodeAt(0)));
+        return decodeBase64(encoded);
     }
     catch (_a) {
         throw new TypeError('The input to be decoded is not correctly encoded.');

package/dist/browser/runtime/decrypt.js

@@ -66,7 +66,7 @@ const decrypt = async (enc, cek, ciphertext, iv, tag, aad) => {
         case 'A256GCM':
             return gcmDecrypt(cek, ciphertext, iv, tag, aad);
         default:
-            throw new JOSENotSupported('unsupported JWE Content Encryption Algorithm');
+            throw new JOSENotSupported('Unsupported JWE Content Encryption Algorithm');
     }
 };
 export default decrypt;

package/dist/browser/runtime/encrypt.js

@@ -49,7 +49,7 @@ const encrypt = async (enc, plaintext, cek, iv, aad) => {
         case 'A256GCM':
             return gcmEncrypt(plaintext, cek, iv, aad);
         default:
-            throw new JOSENotSupported('unsupported JWE Content Encryption Algorithm');
+            throw new JOSENotSupported('Unsupported JWE Content Encryption Algorithm');
     }
 };
 export default encrypt;

package/dist/browser/runtime/fetch_jwks.js

@@ -1,5 +1,5 @@
 import { JOSEError } from '../util/errors.js';
-import globalThis from './global.js';
+import globalThis, { isCloudflareWorkers } from './global.js';
 const fetchJwks = async (url, timeout) => {
     let controller;
     if (typeof AbortController === 'function') {
@@ -10,7 +10,7 @@ const fetchJwks = async (url, timeout) => {
         signal: controller ? controller.signal : undefined,
         redirect: 'manual',
         method: 'GET',
-        ...(typeof globalThis.WebSocketPair === 'undefined'
+        ...(!isCloudflareWorkers()
             ? {
                 referrerPolicy: 'no-referrer',
                 credentials: 'omit',

package/dist/browser/runtime/generate.js

@@ -1,3 +1,4 @@
+import { isCloudflareWorkers, isNodeJs } from './global.js';
 import crypto from './webcrypto.js';
 import { JOSENotSupported } from '../util/errors.js';
 import random from './random.js';
@@ -37,7 +38,7 @@ export async function generateSecret(alg, options) {
             keyUsages = ['encrypt', 'decrypt'];
             break;
         default:
-            throw new JOSENotSupported('unsupported or invalid JWK "alg" (Algorithm) Parameter value');
+            throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
     }
     return crypto.subtle.generateKey(algorithm, (_a = options === null || options === void 0 ? void 0 : options.extractable) !== null && _a !== void 0 ? _a : false, keyUsages);
 }
@@ -100,6 +101,21 @@ export async function generateKeyPair(alg, options) {
             algorithm = { name: 'ECDSA', namedCurve: 'P-521' };
             keyUsages = ['sign', 'verify'];
             break;
+        case (isCloudflareWorkers() || isNodeJs()) && 'EdDSA':
+            switch (options === null || options === void 0 ? void 0 : options.crv) {
+                case undefined:
+                case 'Ed25519':
+                    algorithm = { name: 'NODE-ED25519', namedCurve: 'NODE-ED25519' };
+                    keyUsages = ['sign', 'verify'];
+                    break;
+                case isNodeJs() && 'Ed448':
+                    algorithm = { name: 'NODE-ED448', namedCurve: 'NODE-ED448' };
+                    keyUsages = ['sign', 'verify'];
+                    break;
+                default:
+                    throw new JOSENotSupported('Invalid or unsupported crv option provided, supported values are Ed25519 and Ed448');
+            }
+            break;
         case 'ECDH-ES':
         case 'ECDH-ES+A128KW':
         case 'ECDH-ES+A192KW':
@@ -108,7 +124,7 @@ export async function generateKeyPair(alg, options) {
             keyUsages = ['deriveKey', 'deriveBits'];
             break;
         default:
-            throw new JOSENotSupported('unsupported or invalid JWK "alg" (Algorithm) Parameter value');
+            throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
     }
     return (crypto.subtle.generateKey(algorithm, (_b = options === null || options === void 0 ? void 0 : options.extractable) !== null && _b !== void 0 ? _b : false, keyUsages));
 }

package/dist/browser/runtime/global.js

@@ -8,3 +8,20 @@ function getGlobal() {
     throw new Error('unable to locate global object');
 }
 export default getGlobal();
+export function isCloudflareWorkers() {
+    try {
+        return getGlobal().WebSocketPair !== undefined;
+    }
+    catch (_a) {
+        return false;
+    }
+}
+export function isNodeJs() {
+    var _a, _b;
+    try {
+        return ((_b = (_a = getGlobal().process) === null || _a === void 0 ? void 0 : _a.versions) === null || _b === void 0 ? void 0 : _b.node) !== undefined;
+    }
+    catch (_c) {
+        return false;
+    }
+}

package/dist/browser/runtime/jwk_to_key.js

@@ -1,3 +1,4 @@
+import { isCloudflareWorkers, isNodeJs } from './global.js';
 import crypto from './webcrypto.js';
 import { JOSENotSupported } from '../util/errors.js';
 import { decode as base64url } from './base64url.js';
@@ -39,7 +40,7 @@ function subtleMapping(jwk) {
                     keyUsages = ['deriveBits'];
                     break;
                 default:
-                    throw new JOSENotSupported('unsupported or invalid JWK "alg" (Algorithm) Parameter value');
+                    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
             }
             break;
         }
@@ -68,16 +69,22 @@ function subtleMapping(jwk) {
                     keyUsages = jwk.d ? ['decrypt', 'unwrapKey'] : ['encrypt', 'wrapKey'];
                     break;
                 default:
-                    throw new JOSENotSupported('unsupported or invalid JWK "alg" (Algorithm) Parameter value');
+                    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
             }
             break;
         }
         case 'EC': {
             switch (jwk.alg) {
                 case 'ES256':
+                    algorithm = { name: 'ECDSA', namedCurve: 'P-256' };
+                    keyUsages = jwk.d ? ['sign'] : ['verify'];
+                    break;
                 case 'ES384':
+                    algorithm = { name: 'ECDSA', namedCurve: 'P-384' };
+                    keyUsages = jwk.d ? ['sign'] : ['verify'];
+                    break;
                 case 'ES512':
-                    algorithm = { name: 'ECDSA', namedCurve: jwk.crv };
+                    algorithm = { name: 'ECDSA', namedCurve: 'P-521' };
                     keyUsages = jwk.d ? ['sign'] : ['verify'];
                     break;
                 case 'ECDH-ES':
@@ -88,12 +95,29 @@ function subtleMapping(jwk) {
                     keyUsages = jwk.d ? ['deriveBits'] : [];
                     break;
                 default:
-                    throw new JOSENotSupported('unsupported or invalid JWK "alg" (Algorithm) Parameter value');
+                    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
             }
             break;
         }
+        case (isCloudflareWorkers() || isNodeJs()) && 'OKP':
+            if (jwk.alg !== 'EdDSA') {
+                throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+            }
+            switch (jwk.crv) {
+                case 'Ed25519':
+                    algorithm = { name: 'NODE-ED25519', namedCurve: 'NODE-ED25519' };
+                    keyUsages = jwk.d ? ['sign'] : ['verify'];
+                    break;
+                case isNodeJs() && 'Ed448':
+                    algorithm = { name: 'NODE-ED448', namedCurve: 'NODE-ED448' };
+                    keyUsages = jwk.d ? ['sign'] : ['verify'];
+                    break;
+                default:
+                    throw new JOSENotSupported('Invalid or unsupported JWK "crv" (Subtype of Key Pair) Parameter value');
+            }
+            break;
         default:
-            throw new JOSENotSupported('unsupported or invalid JWK "kty" (Key Type) Parameter value');
+            throw new JOSENotSupported('Invalid or unsupported JWK "kty" (Key Type) Parameter value');
     }
     return { algorithm, keyUsages };
 }

package/dist/browser/runtime/sign.js

@@ -5,7 +5,7 @@ import getSignKey from './get_sign_verify_key.js';
 const sign = async (alg, key, data) => {
     const cryptoKey = await getSignKey(alg, key, 'sign');
     checkKeyLength(alg, cryptoKey);
-    const signature = await crypto.subtle.sign(subtleAlgorithm(alg), cryptoKey, data);
+    const signature = await crypto.subtle.sign(subtleAlgorithm(alg, cryptoKey.algorithm.namedCurve), cryptoKey, data);
     return new Uint8Array(signature);
 };
 export default sign;

package/dist/browser/runtime/subtle_dsa.js

@@ -1,5 +1,6 @@
+import { isCloudflareWorkers, isNodeJs } from './global.js';
 import { JOSENotSupported } from '../util/errors.js';
-export default function subtleDsa(alg) {
+export default function subtleDsa(alg, crv) {
     switch (alg) {
         case 'HS256':
             return { hash: { name: 'SHA-256' }, name: 'HMAC' };
@@ -37,6 +38,8 @@ export default function subtleDsa(alg) {
             return { hash: { name: 'SHA-384' }, name: 'ECDSA', namedCurve: 'P-384' };
         case 'ES512':
             return { hash: { name: 'SHA-512' }, name: 'ECDSA', namedCurve: 'P-521' };
+        case (isCloudflareWorkers() || isNodeJs()) && 'EdDSA':
+            return { name: crv, namedCurve: crv };
         default:
             throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
     }

package/dist/browser/runtime/verify.js

@@ -5,7 +5,7 @@ import getVerifyKey from './get_sign_verify_key.js';
 const verify = async (alg, key, signature, data) => {
     const cryptoKey = await getVerifyKey(alg, key, 'verify');
     checkKeyLength(alg, cryptoKey);
-    const algorithm = subtleAlgorithm(alg);
+    const algorithm = subtleAlgorithm(alg, cryptoKey.algorithm.namedCurve);
     try {
         return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);
     }

package/dist/node/cjs/jwe/compact/decrypt.js

@@ -22,7 +22,11 @@ async function compactDecrypt(jwe, key, options) {
         tag: (tag || undefined),
         encrypted_key: encryptedKey || undefined,
     }, key, options);
-    return { plaintext: decrypted.plaintext, protectedHeader: decrypted.protectedHeader };
+    const result = { plaintext: decrypted.plaintext, protectedHeader: decrypted.protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: decrypted.key };
+    }
+    return result;
 }
 exports.compactDecrypt = compactDecrypt;
 exports.default = compactDecrypt;

package/dist/node/cjs/jwe/flattened/decrypt.js

@@ -1,16 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.flattenedDecrypt = void 0;
-const errors_js_1 = require("../../util/errors.js");
-const is_disjoint_js_1 = require("../../lib/is_disjoint.js");
-const is_object_js_1 = require("../../lib/is_object.js");
 const base64url_js_1 = require("../../runtime/base64url.js");
 const decrypt_js_1 = require("../../runtime/decrypt.js");
 const zlib_js_1 = require("../../runtime/zlib.js");
+const random_js_1 = require("../../runtime/random.js");
+const errors_js_1 = require("../../util/errors.js");
+const is_disjoint_js_1 = require("../../lib/is_disjoint.js");
+const is_object_js_1 = require("../../lib/is_object.js");
 const decrypt_key_management_js_1 = require("../../lib/decrypt_key_management.js");
 const buffer_utils_js_1 = require("../../lib/buffer_utils.js");
 const cek_js_1 = require("../../lib/cek.js");
-const random_js_1 = require("../../runtime/random.js");
 const validate_crit_js_1 = require("../../lib/validate_crit.js");
 const validate_algorithms_js_1 = require("../../lib/validate_algorithms.js");
 const generateCek = (0, cek_js_1.default)(random_js_1.default);
@@ -73,7 +73,7 @@ async function flattenedDecrypt(jwe, key, options) {
             throw new errors_js_1.JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
         }
         if (joseHeader.zip !== 'DEF') {
-            throw new errors_js_1.JOSENotSupported('unsupported JWE "zip" (Compression Algorithm) Header Parameter value');
+            throw new errors_js_1.JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value');
         }
     }
     const { alg, enc } = joseHeader;
@@ -95,8 +95,10 @@ async function flattenedDecrypt(jwe, key, options) {
     if (jwe.encrypted_key !== undefined) {
         encryptedKey = (0, base64url_js_1.decode)(jwe.encrypted_key);
     }
+    let resolvedKey = false;
     if (typeof key === 'function') {
         key = await key(parsedProt, jwe);
+        resolvedKey = true;
     }
     let cek;
     try {
@@ -135,6 +137,9 @@ async function flattenedDecrypt(jwe, key, options) {
     if (jwe.header !== undefined) {
         result.unprotectedHeader = jwe.header;
     }
+    if (resolvedKey) {
+        return { ...result, key };
+    }
     return result;
 }
 exports.flattenedDecrypt = flattenedDecrypt;

package/dist/node/cjs/jwe/flattened/encrypt.js

@@ -1,11 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FlattenedEncrypt = void 0;
-const iv_js_1 = require("../../lib/iv.js");
 const base64url_js_1 = require("../../runtime/base64url.js");
 const random_js_1 = require("../../runtime/random.js");
 const encrypt_js_1 = require("../../runtime/encrypt.js");
 const zlib_js_1 = require("../../runtime/zlib.js");
+const iv_js_1 = require("../../lib/iv.js");
 const encrypt_key_management_js_1 = require("../../lib/encrypt_key_management.js");
 const errors_js_1 = require("../../util/errors.js");
 const is_disjoint_js_1 = require("../../lib/is_disjoint.js");
@@ -15,6 +15,9 @@ const generateIv = (0, iv_js_1.default)(random_js_1.default);
 const checkExtensions = validate_crit_js_1.default.bind(undefined, errors_js_1.JWEInvalid, new Map());
 class FlattenedEncrypt {
     constructor(plaintext) {
+        if (!(plaintext instanceof Uint8Array)) {
+            throw new TypeError('plaintext must be an instance of Uint8Array');
+        }
         this._plaintext = plaintext;
     }
     setKeyManagementParameters(parameters) {
@@ -81,7 +84,7 @@ class FlattenedEncrypt {
                 throw new errors_js_1.JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
             }
             if (joseHeader.zip !== 'DEF') {
-                throw new errors_js_1.JOSENotSupported('unsupported JWE "zip" (Compression Algorithm) Header Parameter value');
+                throw new errors_js_1.JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value');
             }
         }
         const { alg, enc } = joseHeader;

package/dist/node/cjs/jwk/embedded.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EmbeddedJWK = void 0;
-const parse_js_1 = require("./parse.js");
+const import_js_1 = require("../key/import.js");
 const is_object_js_1 = require("../lib/is_object.js");
 const errors_js_1 = require("../util/errors.js");
 async function EmbeddedJWK(protectedHeader, token) {
@@ -12,7 +12,7 @@ async function EmbeddedJWK(protectedHeader, token) {
     if (!(0, is_object_js_1.default)(joseHeader.jwk)) {
         throw new errors_js_1.JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');
     }
-    const key = await (0, parse_js_1.default)(joseHeader.jwk, joseHeader.alg, true);
+    const key = (await (0, import_js_1.importJWK)({ ...joseHeader.jwk, ext: true }, joseHeader.alg, true));
     if (key.type !== 'public') {
         throw new errors_js_1.JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
     }

package/dist/node/cjs/jwk/from_key_like.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.fromKeyLike = void 0;
-const key_to_jwk_js_1 = require("../runtime/key_to_jwk.js");
+const export_js_1 = require("../key/export.js");
 async function fromKeyLike(key) {
-    return (0, key_to_jwk_js_1.default)(key);
+    return (0, export_js_1.exportJWK)(key);
 }
 exports.fromKeyLike = fromKeyLike;
 exports.default = fromKeyLike;

package/dist/node/cjs/jwk/parse.js

@@ -1,38 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseJwk = void 0;
-const base64url_js_1 = require("../runtime/base64url.js");
-const jwk_to_key_js_1 = require("../runtime/jwk_to_key.js");
-const errors_js_1 = require("../util/errors.js");
-const is_object_js_1 = require("../lib/is_object.js");
+const import_js_1 = require("../key/import.js");
 async function parseJwk(jwk, alg, octAsKeyObject) {
-    if (!(0, is_object_js_1.default)(jwk)) {
-        throw new TypeError('JWK must be an object');
-    }
-    alg || (alg = jwk.alg);
-    if (typeof alg !== 'string' || !alg) {
-        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
-    }
-    switch (jwk.kty) {
-        case 'oct':
-            if (typeof jwk.k !== 'string' || !jwk.k) {
-                throw new TypeError('missing "k" (Key Value) Parameter value');
-            }
-            octAsKeyObject !== null && octAsKeyObject !== void 0 ? octAsKeyObject : (octAsKeyObject = jwk.ext !== true);
-            if (octAsKeyObject) {
-                return (0, jwk_to_key_js_1.default)({ ...jwk, alg, ext: false });
-            }
-            return (0, base64url_js_1.decode)(jwk.k);
-        case 'RSA':
-            if (jwk.oth !== undefined) {
-                throw new errors_js_1.JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
-            }
-        case 'EC':
-        case 'OKP':
-            return (0, jwk_to_key_js_1.default)({ ...jwk, alg });
-        default:
-            throw new errors_js_1.JOSENotSupported('unsupported "kty" (Key Type) Parameter value');
-    }
+    return (0, import_js_1.importJWK)(jwk, alg, octAsKeyObject);
 }
 exports.parseJwk = parseJwk;
 exports.default = parseJwk;

package/dist/node/cjs/jwk/thumbprint.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.calculateThumbprint = void 0;
-const errors_js_1 = require("../util/errors.js");
 const digest_js_1 = require("../runtime/digest.js");
 const base64url_js_1 = require("../runtime/base64url.js");
+const errors_js_1 = require("../util/errors.js");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
 const is_object_js_1 = require("../lib/is_object.js");
 const check = (value, description) => {

package/dist/node/cjs/jwks/remote.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createRemoteJWKSet = void 0;
+const fetch_jwks_js_1 = require("../runtime/fetch_jwks.js");
 const parse_js_1 = require("../jwk/parse.js");
 const errors_js_1 = require("../util/errors.js");
-const fetch_jwks_js_1 = require("../runtime/fetch_jwks.js");
 const is_object_js_1 = require("../lib/is_object.js");
 function getKtyFromAlg(alg) {
     switch (alg.substr(0, 2)) {
@@ -96,7 +96,7 @@ class RemoteJWKSet {
         }
         const cached = this._cached.get(jwk);
         if (cached[protectedHeader.alg] === undefined) {
-            const keyObject = await (0, parse_js_1.default)({ ...jwk, alg: protectedHeader.alg });
+            const keyObject = (await (0, parse_js_1.default)({ ...jwk, alg: protectedHeader.alg, ext: true }));
             if (keyObject.type !== 'public') {
                 throw new errors_js_1.JWKSInvalid('JSON Web Key Set members must be public keys');
             }

package/dist/node/cjs/jws/compact/verify.js

@@ -20,7 +20,11 @@ async function compactVerify(jws, key, options) {
         protected: protectedHeader || undefined,
         signature: (signature || undefined),
     }, key, options);
-    return { payload: verified.payload, protectedHeader: verified.protectedHeader };
+    const result = { payload: verified.payload, protectedHeader: verified.protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: verified.key };
+    }
+    return result;
 }
 exports.compactVerify = compactVerify;
 exports.default = compactVerify;

package/dist/node/cjs/jws/flattened/sign.js

@@ -1,16 +1,19 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.FlattenedSign = void 0;
+const base64url_js_1 = require("../../runtime/base64url.js");
+const sign_js_1 = require("../../runtime/sign.js");
 const is_disjoint_js_1 = require("../../lib/is_disjoint.js");
 const errors_js_1 = require("../../util/errors.js");
 const buffer_utils_js_1 = require("../../lib/buffer_utils.js");
-const base64url_js_1 = require("../../runtime/base64url.js");
-const sign_js_1 = require("../../runtime/sign.js");
 const check_key_type_js_1 = require("../../lib/check_key_type.js");
 const validate_crit_js_1 = require("../../lib/validate_crit.js");
 const checkExtensions = validate_crit_js_1.default.bind(undefined, errors_js_1.JWSInvalid, new Map([['b64', true]]));
 class FlattenedSign {
     constructor(payload) {
+        if (!(payload instanceof Uint8Array)) {
+            throw new TypeError('payload must be an instance of Uint8Array');
+        }
         this._payload = payload;
     }
     setProtectedHeader(protectedHeader) {