jose 3.17.0 → 3.20.1

package/dist/node/esm/key/import.js

@@ -0,0 +1,119 @@
+import { decode as decodeBase64URL, encodeBase64, decodeBase64 } from '../runtime/base64url.js';
+import { fromSPKI as importPublic } from '../runtime/asn1.js';
+import { fromPKCS8 as importPrivate } from '../runtime/asn1.js';
+import asKeyObject from '../runtime/jwk_to_key.js';
+import { JOSENotSupported } from '../util/errors.js';
+import formatPEM from '../lib/format_pem.js';
+import isObject from '../lib/is_object.js';
+function getElement(seq) {
+    let result = [];
+    let next = 0;
+    while (next < seq.length) {
+        let nextPart = parseElement(seq.subarray(next));
+        result.push(nextPart);
+        next += nextPart.byteLength;
+    }
+    return result;
+}
+function parseElement(bytes) {
+    let position = 0;
+    let tag = bytes[0] & 0x1f;
+    position++;
+    if (tag === 0x1f) {
+        tag = 0;
+        while (bytes[position] >= 0x80) {
+            tag = tag * 128 + bytes[position] - 0x80;
+            position++;
+        }
+        tag = tag * 128 + bytes[position] - 0x80;
+        position++;
+    }
+    let length = 0;
+    if (bytes[position] < 0x80) {
+        length = bytes[position];
+        position++;
+    }
+    else {
+        let numberOfDigits = bytes[position] & 0x7f;
+        position++;
+        length = 0;
+        for (let i = 0; i < numberOfDigits; i++) {
+            length = length * 256 + bytes[position];
+            position++;
+        }
+    }
+    if (length === 0x80) {
+        length = 0;
+        while (bytes[position + length] !== 0 || bytes[position + length + 1] !== 0) {
+            length++;
+        }
+        const byteLength = position + length + 2;
+        return {
+            byteLength,
+            contents: bytes.subarray(position, position + length),
+            raw: bytes.subarray(0, byteLength),
+        };
+    }
+    const byteLength = position + length;
+    return {
+        byteLength,
+        contents: bytes.subarray(position, byteLength),
+        raw: bytes.subarray(0, byteLength),
+    };
+}
+function spkiFromX509(buf) {
+    return encodeBase64(getElement(getElement(parseElement(buf).contents)[0].contents)[6].raw);
+}
+function getSPKI(x509) {
+    const pem = x509.replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g, '');
+    const raw = decodeBase64(pem);
+    return formatPEM(spkiFromX509(raw), 'PUBLIC KEY');
+}
+export async function importSPKI(spki, alg, options) {
+    if (typeof spki !== 'string' || spki.indexOf('-----BEGIN PUBLIC KEY-----') !== 0) {
+        throw new TypeError('"spki" must be SPKI formatted string');
+    }
+    return importPublic(spki, alg, options);
+}
+export async function importX509(x509, alg, options) {
+    if (typeof x509 !== 'string' || x509.indexOf('-----BEGIN CERTIFICATE-----') !== 0) {
+        throw new TypeError('"x509" must be X.509 formatted string');
+    }
+    const spki = getSPKI(x509);
+    return importPublic(spki, alg, options);
+}
+export async function importPKCS8(pkcs8, alg, options) {
+    if (typeof pkcs8 !== 'string' || pkcs8.indexOf('-----BEGIN PRIVATE KEY-----') !== 0) {
+        throw new TypeError('"pkcs8" must be PCKS8 formatted string');
+    }
+    return importPrivate(pkcs8, alg, options);
+}
+export async function importJWK(jwk, alg, octAsKeyObject) {
+    if (!isObject(jwk)) {
+        throw new TypeError('JWK must be an object');
+    }
+    alg || (alg = jwk.alg);
+    if (typeof alg !== 'string' || !alg) {
+        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
+    }
+    switch (jwk.kty) {
+        case 'oct':
+            if (typeof jwk.k !== 'string' || !jwk.k) {
+                throw new TypeError('missing "k" (Key Value) Parameter value');
+            }
+            octAsKeyObject !== null && octAsKeyObject !== void 0 ? octAsKeyObject : (octAsKeyObject = jwk.ext !== true);
+            if (octAsKeyObject) {
+                return asKeyObject({ ...jwk, alg, ext: false });
+            }
+            return decodeBase64URL(jwk.k);
+        case 'RSA':
+            if (jwk.oth !== undefined) {
+                throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
+            }
+        case 'EC':
+        case 'OKP':
+            return asKeyObject({ ...jwk, alg });
+        default:
+            throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
+    }
+}

package/dist/node/esm/lib/check_key_type.js

@@ -1,28 +1,45 @@
 import invalidKeyInput from '../runtime/invalid_key_input.js';
-const checkKeyType = (alg, key, usage) => {
-    if (!(key instanceof Uint8Array) && !(key === null || key === void 0 ? void 0 : key.type)) {
-        throw new TypeError(invalidKeyInput(key, 'KeyObject', 'CryptoKey', 'Uint8Array'));
+import isKeyLike, { types } from '../runtime/is_key_like.js';
+const symmetricTypeCheck = (key) => {
+    if (key instanceof Uint8Array)
+        return;
+    if (!isKeyLike(key)) {
+        throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
     }
-    if (alg.startsWith('HS') ||
-        alg === 'dir' ||
-        alg.startsWith('PBES2') ||
-        alg.match(/^A\d{3}(?:GCM)?KW$/)) {
-        if (key instanceof Uint8Array || key.type === 'secret') {
-            return;
-        }
-        throw new TypeError('CryptoKey or KeyObject instances for symmetric algorithms must be of type "secret"');
+    if (key.type !== 'secret') {
+        throw new TypeError(`${types.join(' or ')} instances for symmetric algorithms must be of type "secret"`);
     }
-    if (key instanceof Uint8Array) {
-        throw new TypeError(invalidKeyInput(key, 'KeyObject', 'CryptoKey'));
+};
+const asymmetricTypeCheck = (key, usage) => {
+    if (!isKeyLike(key)) {
+        throw new TypeError(invalidKeyInput(key, ...types));
     }
     if (key.type === 'secret') {
-        throw new TypeError('CryptoKey or KeyObject instances for asymmetric algorithms must not be of type "secret"');
+        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithms must not be of type "secret"`);
     }
     if (usage === 'sign' && key.type === 'public') {
-        throw new TypeError('CryptoKey or KeyObject instances for asymmetric algorithm signing must be of type "private"');
+        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithm signing must be of type "private"`);
     }
     if (usage === 'decrypt' && key.type === 'public') {
-        throw new TypeError('CryptoKey or KeyObject instances for asymmetric algorithm decryption must be of type "private"');
+        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithm decryption must be of type "private"`);
+    }
+    if (key.algorithm && usage === 'verify' && key.type === 'private') {
+        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithm verifying must be of type "public"`);
+    }
+    if (key.algorithm && usage === 'encrypt' && key.type === 'private') {
+        throw new TypeError(`${types.join(' or ')} instances for asymmetric algorithm encryption must be of type "public"`);
+    }
+};
+const checkKeyType = (alg, key, usage) => {
+    const symmetric = alg.startsWith('HS') ||
+        alg === 'dir' ||
+        alg.startsWith('PBES2') ||
+        /^A\d{3}(?:GCM)?KW$/.test(alg);
+    if (symmetric) {
+        symmetricTypeCheck(key);
+    }
+    else {
+        asymmetricTypeCheck(key, usage);
     }
 };
 export default checkKeyType;

package/dist/node/esm/lib/decrypt_key_management.js

@@ -6,83 +6,83 @@ import { unwrap as aesGcmKw } from '../runtime/aesgcmkw.js';
 import { decode as base64url } from '../runtime/base64url.js';
 import { JOSENotSupported, JWEInvalid } from '../util/errors.js';
 import { bitLengths as cekLengths } from '../lib/cek.js';
-import { parseJwk } from '../jwk/parse.js';
+import { importJWK } from '../key/import.js';
 import checkKeyType from './check_key_type.js';
-function assertEnryptedKey(encryptedKey) {
-    if (!encryptedKey) {
-        throw new JWEInvalid('JWE Encrypted Key missing');
-    }
-}
-function assertHeaderParameter(joseHeader, parameter, name) {
-    if (joseHeader[parameter] === undefined) {
-        throw new JWEInvalid(`JOSE Header ${name} (${parameter}) missing`);
-    }
-}
+import isObject from './is_object.js';
 async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
     checkKeyType(alg, key, 'decrypt');
     switch (alg) {
         case 'dir': {
-            if (encryptedKey !== undefined) {
+            if (encryptedKey !== undefined)
                 throw new JWEInvalid('Encountered unexpected JWE Encrypted Key');
-            }
             return key;
         }
         case 'ECDH-ES':
-            if (encryptedKey !== undefined) {
+            if (encryptedKey !== undefined)
                 throw new JWEInvalid('Encountered unexpected JWE Encrypted Key');
-            }
         case 'ECDH-ES+A128KW':
         case 'ECDH-ES+A192KW':
         case 'ECDH-ES+A256KW': {
-            assertHeaderParameter(joseHeader, 'epk', 'Ephemeral Public Key');
-            if (!ECDH.ecdhAllowed(key)) {
+            if (!isObject(joseHeader.epk))
+                throw new JWEInvalid(`JOSE Header "epk" (Ephemeral Public Key) missing or invalid`);
+            if (!ECDH.ecdhAllowed(key))
                 throw new JOSENotSupported('ECDH-ES with the provided key is not allowed or not supported by your javascript runtime');
-            }
-            const epk = await parseJwk(joseHeader.epk, alg);
+            const epk = await importJWK(joseHeader.epk, alg);
             let partyUInfo;
             let partyVInfo;
-            if (joseHeader.apu !== undefined)
+            if (joseHeader.apu !== undefined) {
+                if (typeof joseHeader.apu !== 'string')
+                    throw new JWEInvalid(`JOSE Header "apu" (Agreement PartyUInfo) invalid`);
                 partyUInfo = base64url(joseHeader.apu);
-            if (joseHeader.apv !== undefined)
+            }
+            if (joseHeader.apv !== undefined) {
+                if (typeof joseHeader.apv !== 'string')
+                    throw new JWEInvalid(`JOSE Header "apv" (Agreement PartyVInfo) invalid`);
                 partyVInfo = base64url(joseHeader.apv);
+            }
             const sharedSecret = await ECDH.deriveKey(epk, key, alg === 'ECDH-ES' ? joseHeader.enc : alg, parseInt(alg.substr(-5, 3), 10) || cekLengths.get(joseHeader.enc), partyUInfo, partyVInfo);
-            if (alg === 'ECDH-ES') {
+            if (alg === 'ECDH-ES')
                 return sharedSecret;
-            }
-            assertEnryptedKey(encryptedKey);
-            const kwAlg = alg.substr(-6);
-            return aesKw(kwAlg, sharedSecret, encryptedKey);
+            if (encryptedKey === undefined)
+                throw new JWEInvalid('JWE Encrypted Key missing');
+            return aesKw(alg.substr(-6), sharedSecret, encryptedKey);
         }
         case 'RSA1_5':
         case 'RSA-OAEP':
         case 'RSA-OAEP-256':
         case 'RSA-OAEP-384':
         case 'RSA-OAEP-512': {
-            assertEnryptedKey(encryptedKey);
+            if (encryptedKey === undefined)
+                throw new JWEInvalid('JWE Encrypted Key missing');
             return rsaEs(alg, key, encryptedKey);
         }
         case 'PBES2-HS256+A128KW':
         case 'PBES2-HS384+A192KW':
         case 'PBES2-HS512+A256KW': {
-            assertEnryptedKey(encryptedKey);
-            assertHeaderParameter(joseHeader, 'p2c', 'PBES2 Count');
-            assertHeaderParameter(joseHeader, 'p2s', 'PBES2 Salt');
-            const { p2c } = joseHeader;
-            const p2s = base64url(joseHeader.p2s);
-            return pbes2Kw(alg, key, encryptedKey, p2c, p2s);
+            if (encryptedKey === undefined)
+                throw new JWEInvalid('JWE Encrypted Key missing');
+            if (typeof joseHeader.p2c !== 'number')
+                throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);
+            if (typeof joseHeader.p2s !== 'string')
+                throw new JWEInvalid(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);
+            return pbes2Kw(alg, key, encryptedKey, joseHeader.p2c, base64url(joseHeader.p2s));
         }
         case 'A128KW':
         case 'A192KW':
         case 'A256KW': {
-            assertEnryptedKey(encryptedKey);
+            if (encryptedKey === undefined)
+                throw new JWEInvalid('JWE Encrypted Key missing');
             return aesKw(alg, key, encryptedKey);
         }
         case 'A128GCMKW':
         case 'A192GCMKW':
         case 'A256GCMKW': {
-            assertEnryptedKey(encryptedKey);
-            assertHeaderParameter(joseHeader, 'iv', 'Initialization Vector');
-            assertHeaderParameter(joseHeader, 'tag', 'Authentication Tag');
+            if (encryptedKey === undefined)
+                throw new JWEInvalid('JWE Encrypted Key missing');
+            if (typeof joseHeader.iv !== 'string')
+                throw new JWEInvalid(`JOSE Header "iv" (Initialization Vector) missing or invalid`);
+            if (typeof joseHeader.tag !== 'string')
+                throw new JWEInvalid(`JOSE Header "tag" (Authentication Tag) missing or invalid`);
             const iv = base64url(joseHeader.iv);
             const tag = base64url(joseHeader.tag);
             return aesGcmKw(alg, key, encryptedKey, iv, tag);

package/dist/node/esm/lib/encrypt_key_management.js

@@ -7,7 +7,7 @@ import { wrap as aesGcmKw } from '../runtime/aesgcmkw.js';
 import { encode as base64url } from '../runtime/base64url.js';
 import cekFactory, { bitLengths as cekLengths } from '../lib/cek.js';
 import { JOSENotSupported } from '../util/errors.js';
-import { fromKeyLike } from '../jwk/from_key_like.js';
+import { exportJWK } from '../key/export.js';
 import checkKeyType from './check_key_type.js';
 const generateCek = cekFactory(random);
 async function encryptKeyManagement(alg, enc, key, providedCek, providedParameters = {}) {
@@ -30,7 +30,7 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
             const { apu, apv } = providedParameters;
             let { epk: ephemeralKey } = providedParameters;
             ephemeralKey || (ephemeralKey = await ECDH.generateEpk(key));
-            const { x, y, crv, kty } = await fromKeyLike(ephemeralKey);
+            const { x, y, crv, kty } = await exportJWK(ephemeralKey);
             const sharedSecret = await ECDH.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, parseInt(alg.substr(-5, 3), 10) || cekLengths.get(enc), apu, apv);
             parameters = { epk: { x, y, crv, kty } };
             if (apu)

package/dist/node/esm/lib/format_pem.js

@@ -0,0 +1,4 @@
+export default (b64, descriptor) => {
+    const newlined = (b64.match(/.{1,64}/g) || []).join('\n');
+    return `-----BEGIN ${descriptor}-----\n${newlined}\n-----END ${descriptor}-----`;
+};

package/dist/node/esm/runtime/asn1.js

@@ -0,0 +1,39 @@
+import { createPrivateKey, createPublicKey } from 'crypto';
+import { isCryptoKey, getKeyObject } from './webcrypto.js';
+import isKeyObject from './is_key_object.js';
+import invalidKeyInput from './invalid_key_input.js';
+const genericExport = (keyType, keyFormat, key) => {
+    let keyObject;
+    if (isCryptoKey(key)) {
+        if (!key.extractable) {
+            throw new TypeError('CryptoKey is not extractable');
+        }
+        keyObject = getKeyObject(key);
+    }
+    else if (isKeyObject(key)) {
+        keyObject = key;
+    }
+    else {
+        throw new TypeError(invalidKeyInput(key, 'KeyObject', 'CryptoKey'));
+    }
+    if (keyObject.type !== keyType) {
+        throw new TypeError(`key is not a ${keyType} key`);
+    }
+    return keyObject.export({ format: 'pem', type: keyFormat });
+};
+export const toSPKI = (key) => {
+    return genericExport('public', 'spki', key);
+};
+export const toPKCS8 = (key) => {
+    return genericExport('private', 'pkcs8', key);
+};
+export const fromPKCS8 = (pem) => createPrivateKey({
+    key: Buffer.from(pem.replace(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, ''), 'base64'),
+    type: 'pkcs8',
+    format: 'der',
+});
+export const fromSPKI = (pem) => createPublicKey({
+    key: Buffer.from(pem.replace(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g, ''), 'base64'),
+    type: 'spki',
+    format: 'der',
+});

package/dist/node/esm/runtime/base64url.js

@@ -13,5 +13,7 @@ if (Buffer.isEncoding('base64url')) {
 else {
     encodeImpl = (input) => Buffer.from(input).toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
 }
+export const decodeBase64 = (input) => Buffer.from(input, 'base64');
+export const encodeBase64 = (input) => Buffer.from(input).toString('base64');
 export const encode = encodeImpl;
 export const decode = (input) => Buffer.from(normalize(input), 'base64');

package/dist/node/esm/runtime/fetch_jwks.js

@@ -1,7 +1,7 @@
 import { get as http } from 'http';
 import { get as https } from 'https';
 import { once } from 'events';
-import { JOSEError } from '../util/errors.js';
+import { JOSEError, JWKSTimeout } from '../util/errors.js';
 import { concat, decoder } from '../lib/buffer_utils.js';
 const protocols = {
     'https:': https,
@@ -16,7 +16,11 @@ const fetchJwks = async (url, timeout, options) => {
         agent,
         timeout,
     });
-    const [response] = await once(req, 'response');
+    const [response] = (await Promise.race([once(req, 'response'), once(req, 'timeout')]));
+    if (!response) {
+        req.destroy();
+        throw new JWKSTimeout();
+    }
     if (response.statusCode !== 200) {
         throw new JOSEError('Expected 200 OK from the JSON Web Key Set HTTP response');
     }

package/dist/node/esm/runtime/is_key_like.js

@@ -0,0 +1,8 @@
+import { isCryptoKey } from './webcrypto.js';
+import isKeyObject from './is_key_object.js';
+export default (key) => isKeyObject(key) || isCryptoKey(key);
+const types = ['KeyObject'];
+if (parseInt(process.versions.node) >= 16) {
+    types.push('CryptoKey');
+}
+export { types };

package/dist/node/esm/util/errors.js

@@ -1,11 +1,10 @@
 export class JOSEError extends Error {
     constructor(message) {
+        var _a;
         super(message);
         this.code = JOSEError.code;
         this.name = this.constructor.name;
-        if (Error.captureStackTrace) {
-            Error.captureStackTrace(this, this.constructor);
-        }
+        (_a = Error.captureStackTrace) === null || _a === void 0 ? void 0 : _a.call(Error, this, this.constructor);
     }
 }
 JOSEError.code = 'ERR_JOSE_GENERIC';
@@ -91,6 +90,14 @@ export class JWKSMultipleMatchingKeys extends JOSEError {
     }
 }
 JWKSMultipleMatchingKeys.code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
+export class JWKSTimeout extends JOSEError {
+    constructor() {
+        super(...arguments);
+        this.code = JWKSTimeout.code;
+        this.message = 'request timed out';
+    }
+}
+JWKSTimeout.code = 'ERR_JWKS_TIMEOUT';
 export class JWSSignatureVerificationFailed extends JOSEError {
     constructor() {
         super(...arguments);

package/dist/types/jwe/compact/decrypt.d.ts

@@ -1,7 +1,8 @@
-import type { KeyLike, DecryptOptions, JWEHeaderParameters, GetKeyFunction, FlattenedJWE, CompactDecryptResult } from '../../types';
+import type { KeyLike, DecryptOptions, JWEHeaderParameters, GetKeyFunction, FlattenedJWE, CompactDecryptResult, ResolvedKey } from '../../types';
 export interface CompactDecryptGetKey extends GetKeyFunction<JWEHeaderParameters, FlattenedJWE> {
 }
-declare function compactDecrypt(jwe: string | Uint8Array, key: KeyLike | CompactDecryptGetKey, options?: DecryptOptions): Promise<CompactDecryptResult>;
+declare function compactDecrypt(jwe: string | Uint8Array, key: KeyLike | Uint8Array, options?: DecryptOptions): Promise<CompactDecryptResult>;
+declare function compactDecrypt(jwe: string | Uint8Array, getKey: CompactDecryptGetKey, options?: DecryptOptions): Promise<CompactDecryptResult & ResolvedKey>;
 export { compactDecrypt };
 export default compactDecrypt;
 export type { KeyLike, DecryptOptions, CompactDecryptResult };

package/dist/types/jwe/compact/encrypt.d.ts

@@ -6,7 +6,7 @@ declare class CompactEncrypt {
     setInitializationVector(iv: Uint8Array): this;
     setProtectedHeader(protectedHeader: JWEHeaderParameters): this;
     setKeyManagementParameters(parameters: JWEKeyManagementHeaderParameters): this;
-    encrypt(key: KeyLike, options?: EncryptOptions): Promise<string>;
+    encrypt(key: KeyLike | Uint8Array, options?: EncryptOptions): Promise<string>;
 }
 export { CompactEncrypt };
 export default CompactEncrypt;

package/dist/types/jwe/flattened/decrypt.d.ts

@@ -1,7 +1,8 @@
-import type { FlattenedDecryptResult, KeyLike, FlattenedJWE, JWEHeaderParameters, DecryptOptions, GetKeyFunction } from '../../types';
+import type { FlattenedDecryptResult, KeyLike, FlattenedJWE, JWEHeaderParameters, DecryptOptions, GetKeyFunction, ResolvedKey } from '../../types';
 export interface FlattenedDecryptGetKey extends GetKeyFunction<JWEHeaderParameters | undefined, FlattenedJWE> {
 }
-declare function flattenedDecrypt(jwe: FlattenedJWE, key: KeyLike | FlattenedDecryptGetKey, options?: DecryptOptions): Promise<FlattenedDecryptResult>;
+declare function flattenedDecrypt(jwe: FlattenedJWE, key: KeyLike | Uint8Array, options?: DecryptOptions): Promise<FlattenedDecryptResult>;
+declare function flattenedDecrypt(jwe: FlattenedJWE, getKey: FlattenedDecryptGetKey, options?: DecryptOptions): Promise<FlattenedDecryptResult & ResolvedKey>;
 export { flattenedDecrypt };
 export default flattenedDecrypt;
 export type { KeyLike, FlattenedJWE, JWEHeaderParameters, DecryptOptions, FlattenedDecryptResult };

package/dist/types/jwe/flattened/encrypt.d.ts

@@ -16,7 +16,7 @@ declare class FlattenedEncrypt {
     setAdditionalAuthenticatedData(aad: Uint8Array): this;
     setContentEncryptionKey(cek: Uint8Array): this;
     setInitializationVector(iv: Uint8Array): this;
-    encrypt(key: KeyLike, options?: EncryptOptions): Promise<FlattenedJWE>;
+    encrypt(key: KeyLike | Uint8Array, options?: EncryptOptions): Promise<FlattenedJWE>;
 }
 export { FlattenedEncrypt };
 export default FlattenedEncrypt;

package/dist/types/jwe/general/decrypt.d.ts

@@ -1,7 +1,8 @@
-import type { KeyLike, DecryptOptions, JWEHeaderParameters, GetKeyFunction, FlattenedJWE, GeneralJWE, GeneralDecryptResult } from '../../types';
+import type { KeyLike, DecryptOptions, JWEHeaderParameters, GetKeyFunction, FlattenedJWE, GeneralJWE, GeneralDecryptResult, ResolvedKey } from '../../types';
 export interface GeneralDecryptGetKey extends GetKeyFunction<JWEHeaderParameters, FlattenedJWE> {
 }
-declare function generalDecrypt(jwe: GeneralJWE, key: KeyLike | GeneralDecryptGetKey, options?: DecryptOptions): Promise<GeneralDecryptResult>;
+declare function generalDecrypt(jwe: GeneralJWE, key: KeyLike | Uint8Array, options?: DecryptOptions): Promise<GeneralDecryptResult>;
+declare function generalDecrypt(jwe: GeneralJWE, getKey: GeneralDecryptGetKey, options?: DecryptOptions): Promise<GeneralDecryptResult & ResolvedKey>;
 export { generalDecrypt };
 export default generalDecrypt;
 export type { KeyLike, GeneralJWE, DecryptOptions, GeneralDecryptResult };

package/dist/types/jwk/embedded.d.ts

@@ -1,5 +1,4 @@
-/// <reference types="node" />
-import type { KeyObject, FlattenedJWSInput, JWSHeaderParameters } from '../types';
-declare function EmbeddedJWK(protectedHeader: JWSHeaderParameters, token: FlattenedJWSInput): Promise<CryptoKey | KeyObject>;
+import type { FlattenedJWSInput, JWSHeaderParameters } from '../types';
+declare function EmbeddedJWK(protectedHeader: JWSHeaderParameters, token: FlattenedJWSInput): Promise<import("../types.d").KeyLike>;
 export { EmbeddedJWK };
 export default EmbeddedJWK;

package/dist/types/jwk/from_key_like.d.ts

@@ -1,5 +1,5 @@
 import type { JWK, KeyLike } from '../types';
-declare function fromKeyLike(key: KeyLike): Promise<JWK>;
+declare function fromKeyLike(key: KeyLike | Uint8Array): Promise<JWK>;
 export { fromKeyLike };
 export default fromKeyLike;
 export type { KeyLike, JWK };

package/dist/types/jwk/parse.d.ts

@@ -1,5 +1,5 @@
 import type { JWK, KeyLike } from '../types';
-declare function parseJwk(jwk: JWK, alg?: string, octAsKeyObject?: boolean): Promise<KeyLike>;
+declare function parseJwk(jwk: JWK, alg?: string, octAsKeyObject?: boolean): Promise<KeyLike | Uint8Array>;
 export { parseJwk };
 export default parseJwk;
 export type { KeyLike, JWK };

package/dist/types/jws/compact/sign.d.ts

@@ -3,7 +3,7 @@ declare class CompactSign {
     private _flattened;
     constructor(payload: Uint8Array);
     setProtectedHeader(protectedHeader: JWSHeaderParameters): this;
-    sign(key: KeyLike, options?: SignOptions): Promise<string>;
+    sign(key: KeyLike | Uint8Array, options?: SignOptions): Promise<string>;
 }
 export { CompactSign };
 export default CompactSign;

package/dist/types/jws/compact/verify.d.ts

@@ -1,7 +1,8 @@
-import type { CompactVerifyResult, FlattenedJWSInput, GetKeyFunction, JWSHeaderParameters, KeyLike, VerifyOptions } from '../../types';
+import type { CompactVerifyResult, FlattenedJWSInput, GetKeyFunction, JWSHeaderParameters, KeyLike, VerifyOptions, ResolvedKey } from '../../types';
 export interface CompactVerifyGetKey extends GetKeyFunction<JWSHeaderParameters, FlattenedJWSInput> {
 }
-declare function compactVerify(jws: string | Uint8Array, key: KeyLike | CompactVerifyGetKey, options?: VerifyOptions): Promise<CompactVerifyResult>;
+declare function compactVerify(jws: string | Uint8Array, key: KeyLike | Uint8Array, options?: VerifyOptions): Promise<CompactVerifyResult>;
+declare function compactVerify(jws: string | Uint8Array, getKey: CompactVerifyGetKey, options?: VerifyOptions): Promise<CompactVerifyResult & ResolvedKey>;
 export { compactVerify };
 export default compactVerify;
 export type { KeyLike, VerifyOptions, CompactVerifyResult };

package/dist/types/jws/flattened/sign.d.ts

@@ -6,7 +6,7 @@ declare class FlattenedSign {
     constructor(payload: Uint8Array);
     setProtectedHeader(protectedHeader: JWSHeaderParameters): this;
     setUnprotectedHeader(unprotectedHeader: JWSHeaderParameters): this;
-    sign(key: KeyLike, options?: SignOptions): Promise<FlattenedJWS>;
+    sign(key: KeyLike | Uint8Array, options?: SignOptions): Promise<FlattenedJWS>;
 }
 export { FlattenedSign };
 export default FlattenedSign;

package/dist/types/jws/flattened/verify.d.ts

@@ -1,7 +1,8 @@
-import type { FlattenedVerifyResult, KeyLike, FlattenedJWSInput, JWSHeaderParameters, VerifyOptions, GetKeyFunction } from '../../types';
+import type { FlattenedVerifyResult, KeyLike, FlattenedJWSInput, JWSHeaderParameters, VerifyOptions, GetKeyFunction, ResolvedKey } from '../../types';
 export interface FlattenedVerifyGetKey extends GetKeyFunction<JWSHeaderParameters | undefined, FlattenedJWSInput> {
 }
-declare function flattenedVerify(jws: FlattenedJWSInput, key: KeyLike | FlattenedVerifyGetKey, options?: VerifyOptions): Promise<FlattenedVerifyResult>;
+declare function flattenedVerify(jws: FlattenedJWSInput, key: KeyLike | Uint8Array, options?: VerifyOptions): Promise<FlattenedVerifyResult>;
+declare function flattenedVerify(jws: FlattenedJWSInput, getKey: FlattenedVerifyGetKey, options?: VerifyOptions): Promise<FlattenedVerifyResult & ResolvedKey>;
 export { flattenedVerify };
 export default flattenedVerify;
 export type { KeyLike, FlattenedJWSInput, GetKeyFunction, JWSHeaderParameters, VerifyOptions, FlattenedVerifyResult, };

package/dist/types/jws/general/sign.d.ts

@@ -7,7 +7,7 @@ declare class GeneralSign {
     private _payload;
     private _signatures;
     constructor(payload: Uint8Array);
-    addSignature(key: KeyLike, options?: SignOptions): Signature;
+    addSignature(key: KeyLike | Uint8Array, options?: SignOptions): Signature;
     sign(): Promise<GeneralJWS>;
 }
 export { GeneralSign };

package/dist/types/jws/general/verify.d.ts

@@ -1,7 +1,8 @@
-import type { GeneralJWSInput, GeneralVerifyResult, FlattenedJWSInput, GetKeyFunction, JWSHeaderParameters, KeyLike, VerifyOptions } from '../../types';
+import type { GeneralJWSInput, GeneralVerifyResult, FlattenedJWSInput, GetKeyFunction, JWSHeaderParameters, KeyLike, VerifyOptions, ResolvedKey } from '../../types';
 export interface GeneralVerifyGetKey extends GetKeyFunction<JWSHeaderParameters, FlattenedJWSInput> {
 }
-declare function generalVerify(jws: GeneralJWSInput, key: KeyLike | GeneralVerifyGetKey, options?: VerifyOptions): Promise<GeneralVerifyResult>;
+declare function generalVerify(jws: GeneralJWSInput, key: KeyLike | Uint8Array, options?: VerifyOptions): Promise<GeneralVerifyResult>;
+declare function generalVerify(jws: GeneralJWSInput, getKey: GeneralVerifyGetKey, options?: VerifyOptions): Promise<GeneralVerifyResult & ResolvedKey>;
 export { generalVerify };
 export default generalVerify;
 export type { KeyLike, GeneralJWSInput, VerifyOptions, GeneralVerifyResult };

package/dist/types/jwt/decrypt.d.ts

@@ -1,9 +1,10 @@
-import type { KeyLike, DecryptOptions, JWTPayload, JWTClaimVerificationOptions, GetKeyFunction, JWEHeaderParameters, FlattenedJWE, JWTDecryptResult } from '../types';
+import type { KeyLike, DecryptOptions, JWTPayload, JWTClaimVerificationOptions, GetKeyFunction, JWEHeaderParameters, FlattenedJWE, JWTDecryptResult, ResolvedKey } from '../types';
 interface JWTDecryptOptions extends DecryptOptions, JWTClaimVerificationOptions {
 }
 export interface JWTDecryptGetKey extends GetKeyFunction<JWEHeaderParameters, FlattenedJWE> {
 }
-declare function jwtDecrypt(jwt: string | Uint8Array, key: KeyLike | JWTDecryptGetKey, options?: JWTDecryptOptions): Promise<JWTDecryptResult>;
+declare function jwtDecrypt(jwt: string | Uint8Array, key: KeyLike | Uint8Array, options?: JWTDecryptOptions): Promise<JWTDecryptResult>;
+declare function jwtDecrypt(jwt: string | Uint8Array, getKey: JWTDecryptGetKey, options?: JWTDecryptOptions): Promise<JWTDecryptResult & ResolvedKey>;
 export { jwtDecrypt };
 export default jwtDecrypt;
 export type { KeyLike, DecryptOptions, JWTPayload, JWTDecryptOptions, JWTDecryptResult };

package/dist/types/jwt/encrypt.d.ts

@@ -1,5 +1,5 @@
 import type { EncryptOptions, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWTPayload, KeyLike } from '../types';
-import ProduceJWT from '../lib/jwt_producer';
+import { ProduceJWT } from './produce';
 declare class EncryptJWT extends ProduceJWT {
     private _cek;
     private _iv;
@@ -15,7 +15,7 @@ declare class EncryptJWT extends ProduceJWT {
     replicateIssuerAsHeader(): this;
     replicateSubjectAsHeader(): this;
     replicateAudienceAsHeader(): this;
-    encrypt(key: KeyLike, options?: EncryptOptions): Promise<string>;
+    encrypt(key: KeyLike | Uint8Array, options?: EncryptOptions): Promise<string>;
 }
 export { EncryptJWT };
 export default EncryptJWT;

package/dist/types/{lib/jwt_producer.d.ts → jwt/produce.d.ts}

@@ -1,5 +1,5 @@
 import type { JWTPayload } from '../types';
-export default class ProduceJWT {
+export declare class ProduceJWT {
     protected _payload: JWTPayload;
     constructor(payload: JWTPayload);
     setIssuer(issuer: string): this;