jose 3.18.0 → 3.19.0

package/dist/browser/jwe/compact/decrypt.js

@@ -19,7 +19,11 @@ async function compactDecrypt(jwe, key, options) {
         tag: (tag || undefined),
         encrypted_key: encryptedKey || undefined,
     }, key, options);
-    return { plaintext: decrypted.plaintext, protectedHeader: decrypted.protectedHeader };
+    const result = { plaintext: decrypted.plaintext, protectedHeader: decrypted.protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: decrypted.key };
+    }
+    return result;
 }
 export { compactDecrypt };
 export default compactDecrypt;

package/dist/browser/jwe/flattened/decrypt.js

@@ -92,8 +92,10 @@ async function flattenedDecrypt(jwe, key, options) {
     if (jwe.encrypted_key !== undefined) {
         encryptedKey = base64url(jwe.encrypted_key);
     }
+    let resolvedKey = false;
     if (typeof key === 'function') {
         key = await key(parsedProt, jwe);
+        resolvedKey = true;
     }
     let cek;
     try {
@@ -132,6 +134,9 @@ async function flattenedDecrypt(jwe, key, options) {
     if (jwe.header !== undefined) {
         result.unprotectedHeader = jwe.header;
     }
+    if (resolvedKey) {
+        return { ...result, key };
+    }
     return result;
 }
 export { flattenedDecrypt };

package/dist/browser/jwk/embedded.js

@@ -1,4 +1,4 @@
-import parseJwk from './parse.js';
+import { importJWK } from '../key/import.js';
 import isObject from '../lib/is_object.js';
 import { JWSInvalid } from '../util/errors.js';
 async function EmbeddedJWK(protectedHeader, token) {
@@ -9,7 +9,7 @@ async function EmbeddedJWK(protectedHeader, token) {
     if (!isObject(joseHeader.jwk)) {
         throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');
     }
-    const key = await parseJwk(joseHeader.jwk, joseHeader.alg, true);
+    const key = (await importJWK({ ...joseHeader.jwk, ext: true }, joseHeader.alg, true));
     if (key.type !== 'public') {
         throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
     }

package/dist/browser/jwk/from_key_like.js

@@ -1,6 +1,6 @@
-import asJWK from '../runtime/key_to_jwk.js';
+import { exportJWK } from '../key/export.js';
 async function fromKeyLike(key) {
-    return asJWK(key);
+    return exportJWK(key);
 }
 export { fromKeyLike };
 export default fromKeyLike;

package/dist/browser/jwk/parse.js

@@ -1,35 +1,6 @@
-import { decode as base64url } from '../runtime/base64url.js';
-import asKeyObject from '../runtime/jwk_to_key.js';
-import { JOSENotSupported } from '../util/errors.js';
-import isObject from '../lib/is_object.js';
+import { importJWK } from '../key/import.js';
 async function parseJwk(jwk, alg, octAsKeyObject) {
-    if (!isObject(jwk)) {
-        throw new TypeError('JWK must be an object');
-    }
-    alg || (alg = jwk.alg);
-    if (typeof alg !== 'string' || !alg) {
-        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
-    }
-    switch (jwk.kty) {
-        case 'oct':
-            if (typeof jwk.k !== 'string' || !jwk.k) {
-                throw new TypeError('missing "k" (Key Value) Parameter value');
-            }
-            octAsKeyObject !== null && octAsKeyObject !== void 0 ? octAsKeyObject : (octAsKeyObject = jwk.ext !== true);
-            if (octAsKeyObject) {
-                return asKeyObject({ ...jwk, alg, ext: false });
-            }
-            return base64url(jwk.k);
-        case 'RSA':
-            if (jwk.oth !== undefined) {
-                throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
-            }
-        case 'EC':
-        case 'OKP':
-            return asKeyObject({ ...jwk, alg });
-        default:
-            throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
-    }
+    return importJWK(jwk, alg, octAsKeyObject);
 }
 export { parseJwk };
 export default parseJwk;

package/dist/browser/jwks/remote.js

@@ -93,7 +93,7 @@ class RemoteJWKSet {
         }
         const cached = this._cached.get(jwk);
         if (cached[protectedHeader.alg] === undefined) {
-            const keyObject = await parseJWK({ ...jwk, alg: protectedHeader.alg });
+            const keyObject = (await parseJWK({ ...jwk, alg: protectedHeader.alg, ext: true }));
             if (keyObject.type !== 'public') {
                 throw new JWKSInvalid('JSON Web Key Set members must be public keys');
             }

package/dist/browser/jws/compact/verify.js

@@ -17,7 +17,11 @@ async function compactVerify(jws, key, options) {
         protected: protectedHeader || undefined,
         signature: (signature || undefined),
     }, key, options);
-    return { payload: verified.payload, protectedHeader: verified.protectedHeader };
+    const result = { payload: verified.payload, protectedHeader: verified.protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: verified.key };
+    }
+    return result;
 }
 export { compactVerify };
 export default compactVerify;

package/dist/browser/jws/flattened/verify.js

@@ -70,8 +70,10 @@ async function flattenedVerify(jws, key, options) {
     else if (typeof jws.payload !== 'string' && !(jws.payload instanceof Uint8Array)) {
         throw new JWSInvalid('JWS Payload must be a string or an Uint8Array instance');
     }
+    let resolvedKey = false;
     if (typeof key === 'function') {
         key = await key(parsedProt, jws);
+        resolvedKey = true;
     }
     checkKeyType(alg, key, 'verify');
     const data = concat(encoder.encode((_a = jws.protected) !== null && _a !== void 0 ? _a : ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);
@@ -97,6 +99,9 @@ async function flattenedVerify(jws, key, options) {
     if (jws.header !== undefined) {
         result.unprotectedHeader = jws.header;
     }
+    if (resolvedKey) {
+        return { ...result, key };
+    }
     return result;
 }
 export { flattenedVerify };

package/dist/browser/jwt/decrypt.js

@@ -15,7 +15,11 @@ async function jwtDecrypt(jwt, key, options) {
         JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud)) {
         throw new JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch', 'aud', 'mismatch');
     }
-    return { payload, protectedHeader };
+    const result = { payload, protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: decrypted.key };
+    }
+    return result;
 }
 export { jwtDecrypt };
 export default jwtDecrypt;

package/dist/browser/jwt/verify.js

@@ -8,7 +8,11 @@ async function jwtVerify(jwt, key, options) {
         throw new JWTInvalid('JWTs MUST NOT use unencoded payload');
     }
     const payload = jwtPayload(verified.protectedHeader, verified.payload, options);
-    return { payload, protectedHeader: verified.protectedHeader };
+    const result = { payload, protectedHeader: verified.protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: verified.key };
+    }
+    return result;
 }
 export { jwtVerify };
 export default jwtVerify;

package/dist/browser/key/export.js

@@ -1,10 +1,12 @@
 import { toSPKI as exportPublic } from '../runtime/asn1.js';
 import { toPKCS8 as exportPrivate } from '../runtime/asn1.js';
-import { fromKeyLike } from '../jwk/from_key_like.js';
+import keyToJWK from '../runtime/key_to_jwk.js';
 export async function exportSPKI(key) {
     return exportPublic(key);
 }
 export async function exportPKCS8(key) {
     return exportPrivate(key);
 }
-export const exportJWK = (...args) => fromKeyLike(...args);
+export async function exportJWK(key) {
+    return keyToJWK(key);
+}

package/dist/browser/key/import.js

@@ -1,8 +1,10 @@
-import { encodeBase64, decodeBase64 } from '../runtime/base64url.js';
+import { decode as decodeBase64URL, encodeBase64, decodeBase64 } from '../runtime/base64url.js';
 import { fromSPKI as importPublic } from '../runtime/asn1.js';
 import { fromPKCS8 as importPrivate } from '../runtime/asn1.js';
+import asKeyObject from '../runtime/jwk_to_key.js';
+import { JOSENotSupported } from '../util/errors.js';
 import formatPEM from '../lib/format_pem.js';
-import { parseJwk as importJwk } from '../jwk/parse.js';
+import isObject from '../lib/is_object.js';
 function getElement(seq) {
     let result = [];
     let next = 0;
@@ -86,4 +88,32 @@ export async function importPKCS8(pkcs8, alg, options) {
     }
     return importPrivate(pkcs8, alg, options);
 }
-export const importJWK = (...args) => importJwk(...args);
+export async function importJWK(jwk, alg, octAsKeyObject) {
+    if (!isObject(jwk)) {
+        throw new TypeError('JWK must be an object');
+    }
+    alg || (alg = jwk.alg);
+    if (typeof alg !== 'string' || !alg) {
+        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
+    }
+    switch (jwk.kty) {
+        case 'oct':
+            if (typeof jwk.k !== 'string' || !jwk.k) {
+                throw new TypeError('missing "k" (Key Value) Parameter value');
+            }
+            octAsKeyObject !== null && octAsKeyObject !== void 0 ? octAsKeyObject : (octAsKeyObject = jwk.ext !== true);
+            if (octAsKeyObject) {
+                return asKeyObject({ ...jwk, alg, ext: false });
+            }
+            return decodeBase64URL(jwk.k);
+        case 'RSA':
+            if (jwk.oth !== undefined) {
+                throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
+            }
+        case 'EC':
+        case 'OKP':
+            return asKeyObject({ ...jwk, alg });
+        default:
+            throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
+    }
+}

package/dist/browser/lib/decrypt_key_management.js

@@ -6,7 +6,7 @@ import { unwrap as aesGcmKw } from '../runtime/aesgcmkw.js';
 import { decode as base64url } from '../runtime/base64url.js';
 import { JOSENotSupported, JWEInvalid } from '../util/errors.js';
 import { bitLengths as cekLengths } from '../lib/cek.js';
-import { parseJwk } from '../jwk/parse.js';
+import { importJWK } from '../key/import.js';
 import checkKeyType from './check_key_type.js';
 function assertEnryptedKey(encryptedKey) {
     if (!encryptedKey) {
@@ -38,7 +38,7 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
             if (!ECDH.ecdhAllowed(key)) {
                 throw new JOSENotSupported('ECDH-ES with the provided key is not allowed or not supported by your javascript runtime');
             }
-            const epk = await parseJwk(joseHeader.epk, alg);
+            const epk = await importJWK(joseHeader.epk, alg);
             let partyUInfo;
             let partyVInfo;
             if (joseHeader.apu !== undefined)

package/dist/node/cjs/jwe/compact/decrypt.js

@@ -22,7 +22,11 @@ async function compactDecrypt(jwe, key, options) {
         tag: (tag || undefined),
         encrypted_key: encryptedKey || undefined,
     }, key, options);
-    return { plaintext: decrypted.plaintext, protectedHeader: decrypted.protectedHeader };
+    const result = { plaintext: decrypted.plaintext, protectedHeader: decrypted.protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: decrypted.key };
+    }
+    return result;
 }
 exports.compactDecrypt = compactDecrypt;
 exports.default = compactDecrypt;

package/dist/node/cjs/jwe/flattened/decrypt.js

@@ -95,8 +95,10 @@ async function flattenedDecrypt(jwe, key, options) {
     if (jwe.encrypted_key !== undefined) {
         encryptedKey = (0, base64url_js_1.decode)(jwe.encrypted_key);
     }
+    let resolvedKey = false;
     if (typeof key === 'function') {
         key = await key(parsedProt, jwe);
+        resolvedKey = true;
     }
     let cek;
     try {
@@ -135,6 +137,9 @@ async function flattenedDecrypt(jwe, key, options) {
     if (jwe.header !== undefined) {
         result.unprotectedHeader = jwe.header;
     }
+    if (resolvedKey) {
+        return { ...result, key };
+    }
     return result;
 }
 exports.flattenedDecrypt = flattenedDecrypt;

package/dist/node/cjs/jwk/embedded.js

@@ -1,7 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EmbeddedJWK = void 0;
-const parse_js_1 = require("./parse.js");
+const import_js_1 = require("../key/import.js");
 const is_object_js_1 = require("../lib/is_object.js");
 const errors_js_1 = require("../util/errors.js");
 async function EmbeddedJWK(protectedHeader, token) {
@@ -12,7 +12,7 @@ async function EmbeddedJWK(protectedHeader, token) {
     if (!(0, is_object_js_1.default)(joseHeader.jwk)) {
         throw new errors_js_1.JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');
     }
-    const key = await (0, parse_js_1.default)(joseHeader.jwk, joseHeader.alg, true);
+    const key = (await (0, import_js_1.importJWK)({ ...joseHeader.jwk, ext: true }, joseHeader.alg, true));
     if (key.type !== 'public') {
         throw new errors_js_1.JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
     }

package/dist/node/cjs/jwk/from_key_like.js

@@ -1,9 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.fromKeyLike = void 0;
-const key_to_jwk_js_1 = require("../runtime/key_to_jwk.js");
+const export_js_1 = require("../key/export.js");
 async function fromKeyLike(key) {
-    return (0, key_to_jwk_js_1.default)(key);
+    return (0, export_js_1.exportJWK)(key);
 }
 exports.fromKeyLike = fromKeyLike;
 exports.default = fromKeyLike;

package/dist/node/cjs/jwk/parse.js

@@ -1,38 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseJwk = void 0;
-const base64url_js_1 = require("../runtime/base64url.js");
-const jwk_to_key_js_1 = require("../runtime/jwk_to_key.js");
-const errors_js_1 = require("../util/errors.js");
-const is_object_js_1 = require("../lib/is_object.js");
+const import_js_1 = require("../key/import.js");
 async function parseJwk(jwk, alg, octAsKeyObject) {
-    if (!(0, is_object_js_1.default)(jwk)) {
-        throw new TypeError('JWK must be an object');
-    }
-    alg || (alg = jwk.alg);
-    if (typeof alg !== 'string' || !alg) {
-        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
-    }
-    switch (jwk.kty) {
-        case 'oct':
-            if (typeof jwk.k !== 'string' || !jwk.k) {
-                throw new TypeError('missing "k" (Key Value) Parameter value');
-            }
-            octAsKeyObject !== null && octAsKeyObject !== void 0 ? octAsKeyObject : (octAsKeyObject = jwk.ext !== true);
-            if (octAsKeyObject) {
-                return (0, jwk_to_key_js_1.default)({ ...jwk, alg, ext: false });
-            }
-            return (0, base64url_js_1.decode)(jwk.k);
-        case 'RSA':
-            if (jwk.oth !== undefined) {
-                throw new errors_js_1.JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
-            }
-        case 'EC':
-        case 'OKP':
-            return (0, jwk_to_key_js_1.default)({ ...jwk, alg });
-        default:
-            throw new errors_js_1.JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
-    }
+    return (0, import_js_1.importJWK)(jwk, alg, octAsKeyObject);
 }
 exports.parseJwk = parseJwk;
 exports.default = parseJwk;

package/dist/node/cjs/jwks/remote.js

@@ -96,7 +96,7 @@ class RemoteJWKSet {
         }
         const cached = this._cached.get(jwk);
         if (cached[protectedHeader.alg] === undefined) {
-            const keyObject = await (0, parse_js_1.default)({ ...jwk, alg: protectedHeader.alg });
+            const keyObject = (await (0, parse_js_1.default)({ ...jwk, alg: protectedHeader.alg, ext: true }));
             if (keyObject.type !== 'public') {
                 throw new errors_js_1.JWKSInvalid('JSON Web Key Set members must be public keys');
             }

package/dist/node/cjs/jws/compact/verify.js

@@ -20,7 +20,11 @@ async function compactVerify(jws, key, options) {
         protected: protectedHeader || undefined,
         signature: (signature || undefined),
     }, key, options);
-    return { payload: verified.payload, protectedHeader: verified.protectedHeader };
+    const result = { payload: verified.payload, protectedHeader: verified.protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: verified.key };
+    }
+    return result;
 }
 exports.compactVerify = compactVerify;
 exports.default = compactVerify;

package/dist/node/cjs/jws/flattened/verify.js

@@ -73,8 +73,10 @@ async function flattenedVerify(jws, key, options) {
     else if (typeof jws.payload !== 'string' && !(jws.payload instanceof Uint8Array)) {
         throw new errors_js_1.JWSInvalid('JWS Payload must be a string or an Uint8Array instance');
     }
+    let resolvedKey = false;
     if (typeof key === 'function') {
         key = await key(parsedProt, jws);
+        resolvedKey = true;
     }
     (0, check_key_type_js_1.default)(alg, key, 'verify');
     const data = (0, buffer_utils_js_1.concat)(buffer_utils_js_1.encoder.encode((_a = jws.protected) !== null && _a !== void 0 ? _a : ''), buffer_utils_js_1.encoder.encode('.'), typeof jws.payload === 'string' ? buffer_utils_js_1.encoder.encode(jws.payload) : jws.payload);
@@ -100,6 +102,9 @@ async function flattenedVerify(jws, key, options) {
     if (jws.header !== undefined) {
         result.unprotectedHeader = jws.header;
     }
+    if (resolvedKey) {
+        return { ...result, key };
+    }
     return result;
 }
 exports.flattenedVerify = flattenedVerify;

package/dist/node/cjs/jwt/decrypt.js

@@ -18,7 +18,11 @@ async function jwtDecrypt(jwt, key, options) {
         JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud)) {
         throw new errors_js_1.JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch', 'aud', 'mismatch');
     }
-    return { payload, protectedHeader };
+    const result = { payload, protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: decrypted.key };
+    }
+    return result;
 }
 exports.jwtDecrypt = jwtDecrypt;
 exports.default = jwtDecrypt;

package/dist/node/cjs/jwt/verify.js

@@ -11,7 +11,11 @@ async function jwtVerify(jwt, key, options) {
         throw new errors_js_1.JWTInvalid('JWTs MUST NOT use unencoded payload');
     }
     const payload = (0, jwt_claims_set_js_1.default)(verified.protectedHeader, verified.payload, options);
-    return { payload, protectedHeader: verified.protectedHeader };
+    const result = { payload, protectedHeader: verified.protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: verified.key };
+    }
+    return result;
 }
 exports.jwtVerify = jwtVerify;
 exports.default = jwtVerify;

package/dist/node/cjs/key/export.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.exportJWK = exports.exportPKCS8 = exports.exportSPKI = void 0;
 const asn1_js_1 = require("../runtime/asn1.js");
 const asn1_js_2 = require("../runtime/asn1.js");
-const from_key_like_js_1 = require("../jwk/from_key_like.js");
+const key_to_jwk_js_1 = require("../runtime/key_to_jwk.js");
 async function exportSPKI(key) {
     return (0, asn1_js_1.toSPKI)(key);
 }
@@ -12,5 +12,7 @@ async function exportPKCS8(key) {
     return (0, asn1_js_2.toPKCS8)(key);
 }
 exports.exportPKCS8 = exportPKCS8;
-const exportJWK = (...args) => (0, from_key_like_js_1.fromKeyLike)(...args);
+async function exportJWK(key) {
+    return (0, key_to_jwk_js_1.default)(key);
+}
 exports.exportJWK = exportJWK;

package/dist/node/cjs/key/import.js

@@ -4,8 +4,10 @@ exports.importJWK = exports.importPKCS8 = exports.importX509 = exports.importSPK
 const base64url_js_1 = require("../runtime/base64url.js");
 const asn1_js_1 = require("../runtime/asn1.js");
 const asn1_js_2 = require("../runtime/asn1.js");
+const jwk_to_key_js_1 = require("../runtime/jwk_to_key.js");
+const errors_js_1 = require("../util/errors.js");
 const format_pem_js_1 = require("../lib/format_pem.js");
-const parse_js_1 = require("../jwk/parse.js");
+const is_object_js_1 = require("../lib/is_object.js");
 function getElement(seq) {
     let result = [];
     let next = 0;
@@ -92,5 +94,33 @@ async function importPKCS8(pkcs8, alg, options) {
     return (0, asn1_js_2.fromPKCS8)(pkcs8, alg, options);
 }
 exports.importPKCS8 = importPKCS8;
-const importJWK = (...args) => (0, parse_js_1.parseJwk)(...args);
+async function importJWK(jwk, alg, octAsKeyObject) {
+    if (!(0, is_object_js_1.default)(jwk)) {
+        throw new TypeError('JWK must be an object');
+    }
+    alg || (alg = jwk.alg);
+    if (typeof alg !== 'string' || !alg) {
+        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
+    }
+    switch (jwk.kty) {
+        case 'oct':
+            if (typeof jwk.k !== 'string' || !jwk.k) {
+                throw new TypeError('missing "k" (Key Value) Parameter value');
+            }
+            octAsKeyObject !== null && octAsKeyObject !== void 0 ? octAsKeyObject : (octAsKeyObject = jwk.ext !== true);
+            if (octAsKeyObject) {
+                return (0, jwk_to_key_js_1.default)({ ...jwk, alg, ext: false });
+            }
+            return (0, base64url_js_1.decode)(jwk.k);
+        case 'RSA':
+            if (jwk.oth !== undefined) {
+                throw new errors_js_1.JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
+            }
+        case 'EC':
+        case 'OKP':
+            return (0, jwk_to_key_js_1.default)({ ...jwk, alg });
+        default:
+            throw new errors_js_1.JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
+    }
+}
 exports.importJWK = importJWK;

package/dist/node/cjs/lib/decrypt_key_management.js

@@ -8,7 +8,7 @@ const aesgcmkw_js_1 = require("../runtime/aesgcmkw.js");
 const base64url_js_1 = require("../runtime/base64url.js");
 const errors_js_1 = require("../util/errors.js");
 const cek_js_1 = require("../lib/cek.js");
-const parse_js_1 = require("../jwk/parse.js");
+const import_js_1 = require("../key/import.js");
 const check_key_type_js_1 = require("./check_key_type.js");
 function assertEnryptedKey(encryptedKey) {
     if (!encryptedKey) {
@@ -40,7 +40,7 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
             if (!ECDH.ecdhAllowed(key)) {
                 throw new errors_js_1.JOSENotSupported('ECDH-ES with the provided key is not allowed or not supported by your javascript runtime');
             }
-            const epk = await (0, parse_js_1.parseJwk)(joseHeader.epk, alg);
+            const epk = await (0, import_js_1.importJWK)(joseHeader.epk, alg);
             let partyUInfo;
             let partyVInfo;
             if (joseHeader.apu !== undefined)

package/dist/node/esm/jwe/compact/decrypt.js

@@ -19,7 +19,11 @@ async function compactDecrypt(jwe, key, options) {
         tag: (tag || undefined),
         encrypted_key: encryptedKey || undefined,
     }, key, options);
-    return { plaintext: decrypted.plaintext, protectedHeader: decrypted.protectedHeader };
+    const result = { plaintext: decrypted.plaintext, protectedHeader: decrypted.protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: decrypted.key };
+    }
+    return result;
 }
 export { compactDecrypt };
 export default compactDecrypt;

package/dist/node/esm/jwe/flattened/decrypt.js

@@ -92,8 +92,10 @@ async function flattenedDecrypt(jwe, key, options) {
     if (jwe.encrypted_key !== undefined) {
         encryptedKey = base64url(jwe.encrypted_key);
     }
+    let resolvedKey = false;
     if (typeof key === 'function') {
         key = await key(parsedProt, jwe);
+        resolvedKey = true;
     }
     let cek;
     try {
@@ -132,6 +134,9 @@ async function flattenedDecrypt(jwe, key, options) {
     if (jwe.header !== undefined) {
         result.unprotectedHeader = jwe.header;
     }
+    if (resolvedKey) {
+        return { ...result, key };
+    }
     return result;
 }
 export { flattenedDecrypt };

package/dist/node/esm/jwk/embedded.js

@@ -1,4 +1,4 @@
-import parseJwk from './parse.js';
+import { importJWK } from '../key/import.js';
 import isObject from '../lib/is_object.js';
 import { JWSInvalid } from '../util/errors.js';
 async function EmbeddedJWK(protectedHeader, token) {
@@ -9,7 +9,7 @@ async function EmbeddedJWK(protectedHeader, token) {
     if (!isObject(joseHeader.jwk)) {
         throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');
     }
-    const key = await parseJwk(joseHeader.jwk, joseHeader.alg, true);
+    const key = (await importJWK({ ...joseHeader.jwk, ext: true }, joseHeader.alg, true));
     if (key.type !== 'public') {
         throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
     }

package/dist/node/esm/jwk/from_key_like.js

@@ -1,6 +1,6 @@
-import asJWK from '../runtime/key_to_jwk.js';
+import { exportJWK } from '../key/export.js';
 async function fromKeyLike(key) {
-    return asJWK(key);
+    return exportJWK(key);
 }
 export { fromKeyLike };
 export default fromKeyLike;

package/dist/node/esm/jwk/parse.js

@@ -1,35 +1,6 @@
-import { decode as base64url } from '../runtime/base64url.js';
-import asKeyObject from '../runtime/jwk_to_key.js';
-import { JOSENotSupported } from '../util/errors.js';
-import isObject from '../lib/is_object.js';
+import { importJWK } from '../key/import.js';
 async function parseJwk(jwk, alg, octAsKeyObject) {
-    if (!isObject(jwk)) {
-        throw new TypeError('JWK must be an object');
-    }
-    alg || (alg = jwk.alg);
-    if (typeof alg !== 'string' || !alg) {
-        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
-    }
-    switch (jwk.kty) {
-        case 'oct':
-            if (typeof jwk.k !== 'string' || !jwk.k) {
-                throw new TypeError('missing "k" (Key Value) Parameter value');
-            }
-            octAsKeyObject !== null && octAsKeyObject !== void 0 ? octAsKeyObject : (octAsKeyObject = jwk.ext !== true);
-            if (octAsKeyObject) {
-                return asKeyObject({ ...jwk, alg, ext: false });
-            }
-            return base64url(jwk.k);
-        case 'RSA':
-            if (jwk.oth !== undefined) {
-                throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
-            }
-        case 'EC':
-        case 'OKP':
-            return asKeyObject({ ...jwk, alg });
-        default:
-            throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
-    }
+    return importJWK(jwk, alg, octAsKeyObject);
 }
 export { parseJwk };
 export default parseJwk;

package/dist/node/esm/jwks/remote.js

@@ -93,7 +93,7 @@ class RemoteJWKSet {
         }
         const cached = this._cached.get(jwk);
         if (cached[protectedHeader.alg] === undefined) {
-            const keyObject = await parseJWK({ ...jwk, alg: protectedHeader.alg });
+            const keyObject = (await parseJWK({ ...jwk, alg: protectedHeader.alg, ext: true }));
             if (keyObject.type !== 'public') {
                 throw new JWKSInvalid('JSON Web Key Set members must be public keys');
             }

package/dist/node/esm/jws/compact/verify.js

@@ -17,7 +17,11 @@ async function compactVerify(jws, key, options) {
         protected: protectedHeader || undefined,
         signature: (signature || undefined),
     }, key, options);
-    return { payload: verified.payload, protectedHeader: verified.protectedHeader };
+    const result = { payload: verified.payload, protectedHeader: verified.protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: verified.key };
+    }
+    return result;
 }
 export { compactVerify };
 export default compactVerify;

package/dist/node/esm/jws/flattened/verify.js

@@ -70,8 +70,10 @@ async function flattenedVerify(jws, key, options) {
     else if (typeof jws.payload !== 'string' && !(jws.payload instanceof Uint8Array)) {
         throw new JWSInvalid('JWS Payload must be a string or an Uint8Array instance');
     }
+    let resolvedKey = false;
     if (typeof key === 'function') {
         key = await key(parsedProt, jws);
+        resolvedKey = true;
     }
     checkKeyType(alg, key, 'verify');
     const data = concat(encoder.encode((_a = jws.protected) !== null && _a !== void 0 ? _a : ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);
@@ -97,6 +99,9 @@ async function flattenedVerify(jws, key, options) {
     if (jws.header !== undefined) {
         result.unprotectedHeader = jws.header;
     }
+    if (resolvedKey) {
+        return { ...result, key };
+    }
     return result;
 }
 export { flattenedVerify };

package/dist/node/esm/jwt/decrypt.js

@@ -15,7 +15,11 @@ async function jwtDecrypt(jwt, key, options) {
         JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud)) {
         throw new JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch', 'aud', 'mismatch');
     }
-    return { payload, protectedHeader };
+    const result = { payload, protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: decrypted.key };
+    }
+    return result;
 }
 export { jwtDecrypt };
 export default jwtDecrypt;

package/dist/node/esm/jwt/verify.js

@@ -8,7 +8,11 @@ async function jwtVerify(jwt, key, options) {
         throw new JWTInvalid('JWTs MUST NOT use unencoded payload');
     }
     const payload = jwtPayload(verified.protectedHeader, verified.payload, options);
-    return { payload, protectedHeader: verified.protectedHeader };
+    const result = { payload, protectedHeader: verified.protectedHeader };
+    if (typeof key === 'function') {
+        return { ...result, key: verified.key };
+    }
+    return result;
 }
 export { jwtVerify };
 export default jwtVerify;

package/dist/node/esm/key/export.js

@@ -1,10 +1,12 @@
 import { toSPKI as exportPublic } from '../runtime/asn1.js';
 import { toPKCS8 as exportPrivate } from '../runtime/asn1.js';
-import { fromKeyLike } from '../jwk/from_key_like.js';
+import keyToJWK from '../runtime/key_to_jwk.js';
 export async function exportSPKI(key) {
     return exportPublic(key);
 }
 export async function exportPKCS8(key) {
     return exportPrivate(key);
 }
-export const exportJWK = (...args) => fromKeyLike(...args);
+export async function exportJWK(key) {
+    return keyToJWK(key);
+}

package/dist/node/esm/key/import.js

@@ -1,8 +1,10 @@
-import { encodeBase64, decodeBase64 } from '../runtime/base64url.js';
+import { decode as decodeBase64URL, encodeBase64, decodeBase64 } from '../runtime/base64url.js';
 import { fromSPKI as importPublic } from '../runtime/asn1.js';
 import { fromPKCS8 as importPrivate } from '../runtime/asn1.js';
+import asKeyObject from '../runtime/jwk_to_key.js';
+import { JOSENotSupported } from '../util/errors.js';
 import formatPEM from '../lib/format_pem.js';
-import { parseJwk as importJwk } from '../jwk/parse.js';
+import isObject from '../lib/is_object.js';
 function getElement(seq) {
     let result = [];
     let next = 0;
@@ -86,4 +88,32 @@ export async function importPKCS8(pkcs8, alg, options) {
     }
     return importPrivate(pkcs8, alg, options);
 }
-export const importJWK = (...args) => importJwk(...args);
+export async function importJWK(jwk, alg, octAsKeyObject) {
+    if (!isObject(jwk)) {
+        throw new TypeError('JWK must be an object');
+    }
+    alg || (alg = jwk.alg);
+    if (typeof alg !== 'string' || !alg) {
+        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
+    }
+    switch (jwk.kty) {
+        case 'oct':
+            if (typeof jwk.k !== 'string' || !jwk.k) {
+                throw new TypeError('missing "k" (Key Value) Parameter value');
+            }
+            octAsKeyObject !== null && octAsKeyObject !== void 0 ? octAsKeyObject : (octAsKeyObject = jwk.ext !== true);
+            if (octAsKeyObject) {
+                return asKeyObject({ ...jwk, alg, ext: false });
+            }
+            return decodeBase64URL(jwk.k);
+        case 'RSA':
+            if (jwk.oth !== undefined) {
+                throw new JOSENotSupported('RSA JWK "oth" (Other Primes Info) Parameter value is not supported');
+            }
+        case 'EC':
+        case 'OKP':
+            return asKeyObject({ ...jwk, alg });
+        default:
+            throw new JOSENotSupported('Unsupported "kty" (Key Type) Parameter value');
+    }
+}

package/dist/node/esm/lib/decrypt_key_management.js

@@ -6,7 +6,7 @@ import { unwrap as aesGcmKw } from '../runtime/aesgcmkw.js';
 import { decode as base64url } from '../runtime/base64url.js';
 import { JOSENotSupported, JWEInvalid } from '../util/errors.js';
 import { bitLengths as cekLengths } from '../lib/cek.js';
-import { parseJwk } from '../jwk/parse.js';
+import { importJWK } from '../key/import.js';
 import checkKeyType from './check_key_type.js';
 function assertEnryptedKey(encryptedKey) {
     if (!encryptedKey) {
@@ -38,7 +38,7 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
             if (!ECDH.ecdhAllowed(key)) {
                 throw new JOSENotSupported('ECDH-ES with the provided key is not allowed or not supported by your javascript runtime');
             }
-            const epk = await parseJwk(joseHeader.epk, alg);
+            const epk = await importJWK(joseHeader.epk, alg);
             let partyUInfo;
             let partyVInfo;
             if (joseHeader.apu !== undefined)

package/dist/types/jwe/compact/decrypt.d.ts

@@ -1,7 +1,8 @@
-import type { KeyLike, DecryptOptions, JWEHeaderParameters, GetKeyFunction, FlattenedJWE, CompactDecryptResult } from '../../types';
+import type { KeyLike, DecryptOptions, JWEHeaderParameters, GetKeyFunction, FlattenedJWE, CompactDecryptResult, ResolvedKey } from '../../types';
 export interface CompactDecryptGetKey extends GetKeyFunction<JWEHeaderParameters, FlattenedJWE> {
 }
-declare function compactDecrypt(jwe: string | Uint8Array, key: KeyLike | CompactDecryptGetKey, options?: DecryptOptions): Promise<CompactDecryptResult>;
+declare function compactDecrypt(jwe: string | Uint8Array, key: KeyLike, options?: DecryptOptions): Promise<CompactDecryptResult>;
+declare function compactDecrypt(jwe: string | Uint8Array, getKey: CompactDecryptGetKey, options?: DecryptOptions): Promise<CompactDecryptResult & ResolvedKey>;
 export { compactDecrypt };
 export default compactDecrypt;
 export type { KeyLike, DecryptOptions, CompactDecryptResult };

package/dist/types/jwe/flattened/decrypt.d.ts

@@ -1,7 +1,8 @@
-import type { FlattenedDecryptResult, KeyLike, FlattenedJWE, JWEHeaderParameters, DecryptOptions, GetKeyFunction } from '../../types';
+import type { FlattenedDecryptResult, KeyLike, FlattenedJWE, JWEHeaderParameters, DecryptOptions, GetKeyFunction, ResolvedKey } from '../../types';
 export interface FlattenedDecryptGetKey extends GetKeyFunction<JWEHeaderParameters | undefined, FlattenedJWE> {
 }
-declare function flattenedDecrypt(jwe: FlattenedJWE, key: KeyLike | FlattenedDecryptGetKey, options?: DecryptOptions): Promise<FlattenedDecryptResult>;
+declare function flattenedDecrypt(jwe: FlattenedJWE, key: KeyLike, options?: DecryptOptions): Promise<FlattenedDecryptResult>;
+declare function flattenedDecrypt(jwe: FlattenedJWE, getKey: FlattenedDecryptGetKey, options?: DecryptOptions): Promise<FlattenedDecryptResult & ResolvedKey>;
 export { flattenedDecrypt };
 export default flattenedDecrypt;
 export type { KeyLike, FlattenedJWE, JWEHeaderParameters, DecryptOptions, FlattenedDecryptResult };

package/dist/types/jwe/general/decrypt.d.ts

@@ -1,7 +1,8 @@
-import type { KeyLike, DecryptOptions, JWEHeaderParameters, GetKeyFunction, FlattenedJWE, GeneralJWE, GeneralDecryptResult } from '../../types';
+import type { KeyLike, DecryptOptions, JWEHeaderParameters, GetKeyFunction, FlattenedJWE, GeneralJWE, GeneralDecryptResult, ResolvedKey } from '../../types';
 export interface GeneralDecryptGetKey extends GetKeyFunction<JWEHeaderParameters, FlattenedJWE> {
 }
-declare function generalDecrypt(jwe: GeneralJWE, key: KeyLike | GeneralDecryptGetKey, options?: DecryptOptions): Promise<GeneralDecryptResult>;
+declare function generalDecrypt(jwe: GeneralJWE, key: KeyLike, options?: DecryptOptions): Promise<GeneralDecryptResult>;
+declare function generalDecrypt(jwe: GeneralJWE, getKey: GeneralDecryptGetKey, options?: DecryptOptions): Promise<GeneralDecryptResult & ResolvedKey>;
 export { generalDecrypt };
 export default generalDecrypt;
 export type { KeyLike, GeneralJWE, DecryptOptions, GeneralDecryptResult };

package/dist/types/jws/compact/verify.d.ts

@@ -1,7 +1,8 @@
-import type { CompactVerifyResult, FlattenedJWSInput, GetKeyFunction, JWSHeaderParameters, KeyLike, VerifyOptions } from '../../types';
+import type { CompactVerifyResult, FlattenedJWSInput, GetKeyFunction, JWSHeaderParameters, KeyLike, VerifyOptions, ResolvedKey } from '../../types';
 export interface CompactVerifyGetKey extends GetKeyFunction<JWSHeaderParameters, FlattenedJWSInput> {
 }
-declare function compactVerify(jws: string | Uint8Array, key: KeyLike | CompactVerifyGetKey, options?: VerifyOptions): Promise<CompactVerifyResult>;
+declare function compactVerify(jws: string | Uint8Array, key: KeyLike, options?: VerifyOptions): Promise<CompactVerifyResult>;
+declare function compactVerify(jws: string | Uint8Array, getKey: CompactVerifyGetKey, options?: VerifyOptions): Promise<CompactVerifyResult & ResolvedKey>;
 export { compactVerify };
 export default compactVerify;
 export type { KeyLike, VerifyOptions, CompactVerifyResult };

package/dist/types/jws/flattened/verify.d.ts

@@ -1,7 +1,8 @@
-import type { FlattenedVerifyResult, KeyLike, FlattenedJWSInput, JWSHeaderParameters, VerifyOptions, GetKeyFunction } from '../../types';
+import type { FlattenedVerifyResult, KeyLike, FlattenedJWSInput, JWSHeaderParameters, VerifyOptions, GetKeyFunction, ResolvedKey } from '../../types';
 export interface FlattenedVerifyGetKey extends GetKeyFunction<JWSHeaderParameters | undefined, FlattenedJWSInput> {
 }
-declare function flattenedVerify(jws: FlattenedJWSInput, key: KeyLike | FlattenedVerifyGetKey, options?: VerifyOptions): Promise<FlattenedVerifyResult>;
+declare function flattenedVerify(jws: FlattenedJWSInput, key: KeyLike, options?: VerifyOptions): Promise<FlattenedVerifyResult>;
+declare function flattenedVerify(jws: FlattenedJWSInput, getKey: FlattenedVerifyGetKey, options?: VerifyOptions): Promise<FlattenedVerifyResult & ResolvedKey>;
 export { flattenedVerify };
 export default flattenedVerify;
 export type { KeyLike, FlattenedJWSInput, GetKeyFunction, JWSHeaderParameters, VerifyOptions, FlattenedVerifyResult, };

package/dist/types/jws/general/verify.d.ts

@@ -1,7 +1,8 @@
-import type { GeneralJWSInput, GeneralVerifyResult, FlattenedJWSInput, GetKeyFunction, JWSHeaderParameters, KeyLike, VerifyOptions } from '../../types';
+import type { GeneralJWSInput, GeneralVerifyResult, FlattenedJWSInput, GetKeyFunction, JWSHeaderParameters, KeyLike, VerifyOptions, ResolvedKey } from '../../types';
 export interface GeneralVerifyGetKey extends GetKeyFunction<JWSHeaderParameters, FlattenedJWSInput> {
 }
-declare function generalVerify(jws: GeneralJWSInput, key: KeyLike | GeneralVerifyGetKey, options?: VerifyOptions): Promise<GeneralVerifyResult>;
+declare function generalVerify(jws: GeneralJWSInput, key: KeyLike, options?: VerifyOptions): Promise<GeneralVerifyResult>;
+declare function generalVerify(jws: GeneralJWSInput, getKey: GeneralVerifyGetKey, options?: VerifyOptions): Promise<GeneralVerifyResult & ResolvedKey>;
 export { generalVerify };
 export default generalVerify;
 export type { KeyLike, GeneralJWSInput, VerifyOptions, GeneralVerifyResult };

package/dist/types/jwt/decrypt.d.ts

@@ -1,9 +1,10 @@
-import type { KeyLike, DecryptOptions, JWTPayload, JWTClaimVerificationOptions, GetKeyFunction, JWEHeaderParameters, FlattenedJWE, JWTDecryptResult } from '../types';
+import type { KeyLike, DecryptOptions, JWTPayload, JWTClaimVerificationOptions, GetKeyFunction, JWEHeaderParameters, FlattenedJWE, JWTDecryptResult, ResolvedKey } from '../types';
 interface JWTDecryptOptions extends DecryptOptions, JWTClaimVerificationOptions {
 }
 export interface JWTDecryptGetKey extends GetKeyFunction<JWEHeaderParameters, FlattenedJWE> {
 }
-declare function jwtDecrypt(jwt: string | Uint8Array, key: KeyLike | JWTDecryptGetKey, options?: JWTDecryptOptions): Promise<JWTDecryptResult>;
+declare function jwtDecrypt(jwt: string | Uint8Array, key: KeyLike, options?: JWTDecryptOptions): Promise<JWTDecryptResult>;
+declare function jwtDecrypt(jwt: string | Uint8Array, getKey: JWTDecryptGetKey, options?: JWTDecryptOptions): Promise<JWTDecryptResult & ResolvedKey>;
 export { jwtDecrypt };
 export default jwtDecrypt;
 export type { KeyLike, DecryptOptions, JWTPayload, JWTDecryptOptions, JWTDecryptResult };

package/dist/types/jwt/verify.d.ts

@@ -1,9 +1,10 @@
-import type { KeyLike, VerifyOptions, JWTPayload, JWTClaimVerificationOptions, JWSHeaderParameters, GetKeyFunction, FlattenedJWSInput, JWTVerifyResult } from '../types';
+import type { KeyLike, VerifyOptions, JWTPayload, JWTClaimVerificationOptions, JWSHeaderParameters, GetKeyFunction, FlattenedJWSInput, JWTVerifyResult, ResolvedKey } from '../types';
 interface JWTVerifyOptions extends VerifyOptions, JWTClaimVerificationOptions {
 }
 export interface JWTVerifyGetKey extends GetKeyFunction<JWSHeaderParameters, FlattenedJWSInput> {
 }
-declare function jwtVerify(jwt: string | Uint8Array, key: KeyLike | JWTVerifyGetKey, options?: JWTVerifyOptions): Promise<JWTVerifyResult>;
+declare function jwtVerify(jwt: string | Uint8Array, key: KeyLike, options?: JWTVerifyOptions): Promise<JWTVerifyResult>;
+declare function jwtVerify(jwt: string | Uint8Array, getKey: JWTVerifyGetKey, options?: JWTVerifyOptions): Promise<JWTVerifyResult & ResolvedKey>;
 export { jwtVerify };
 export default jwtVerify;
 export type { KeyLike, JWTPayload, JWTVerifyOptions, JWSHeaderParameters, GetKeyFunction, JWTVerifyResult, };

package/dist/types/key/export.d.ts

@@ -1,6 +1,5 @@
-import { fromKeyLike } from '../jwk/from_key_like';
-import type { KeyLike } from '../types';
+import type { JWK, KeyLike } from '../types';
 export declare function exportSPKI(key: Exclude<KeyLike, Uint8Array>): Promise<string>;
 export declare function exportPKCS8(key: Exclude<KeyLike, Uint8Array>): Promise<string>;
-export declare const exportJWK: typeof fromKeyLike;
-export type { KeyLike };
+export declare function exportJWK(key: KeyLike): Promise<JWK>;
+export type { KeyLike, JWK };

package/dist/types/key/import.d.ts

@@ -1,10 +1,9 @@
-import { parseJwk as importJwk } from '../jwk/parse';
-import type { KeyLike } from '../types';
+import type { JWK, KeyLike } from '../types';
 export interface PEMImportOptions {
     extractable?: boolean;
 }
 export declare function importSPKI(spki: string, alg: string, options?: PEMImportOptions): Promise<Exclude<KeyLike, Uint8Array>>;
 export declare function importX509(x509: string, alg: string, options?: PEMImportOptions): Promise<Exclude<KeyLike, Uint8Array>>;
 export declare function importPKCS8(pkcs8: string, alg: string, options?: PEMImportOptions): Promise<Exclude<KeyLike, Uint8Array>>;
-export declare const importJWK: typeof importJwk;
-export type { KeyLike };
+export declare function importJWK(jwk: JWK, alg?: string, octAsKeyObject?: boolean): Promise<KeyLike>;
+export type { KeyLike, JWK };

package/dist/types/types.d.ts

@@ -169,3 +169,6 @@ export interface JWTDecryptResult {
   payload: JWTPayload
   protectedHeader: JWEHeaderParameters
 }
+export interface ResolvedKey {
+  key: KeyLike
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "3.18.0",
+  "version": "3.19.0",
   "description": "Universal 'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK with no dependencies",
   "keywords": [
     "browser",