jose 4.11.0 → 4.11.2

package/README.md

@@ -38,7 +38,7 @@ const jose = require('jose')
 
 **`example`** Deno import
 ```js
-import * as jose from 'https://deno.land/x/jose/index.ts'
+import * as jose from 'https://deno.land/x/jose@v4.11.2/index.ts'
 ```
 
 - JSON Web Tokens (JWT)

package/dist/browser/key/import.js

@@ -94,7 +94,7 @@ export async function importX509(x509, alg, options) {
 }
 export async function importPKCS8(pkcs8, alg, options) {
     if (typeof pkcs8 !== 'string' || pkcs8.indexOf('-----BEGIN PRIVATE KEY-----') !== 0) {
-        throw new TypeError('"pkcs8" must be PKCS8 formatted string');
+        throw new TypeError('"pkcs8" must be PKCS#8 formatted string');
     }
     return importPrivate(pkcs8, alg, options);
 }

package/dist/browser/util/errors.js

@@ -1,4 +1,7 @@
 export class JOSEError extends Error {
+    static get code() {
+        return 'ERR_JOSE_GENERIC';
+    }
     constructor(message) {
         var _a;
         super(message);
@@ -6,31 +9,28 @@ export class JOSEError extends Error {
         this.name = this.constructor.name;
         (_a = Error.captureStackTrace) === null || _a === void 0 ? void 0 : _a.call(Error, this, this.constructor);
     }
-    static get code() {
-        return 'ERR_JOSE_GENERIC';
-    }
 }
 export class JWTClaimValidationFailed extends JOSEError {
+    static get code() {
+        return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
+    }
     constructor(message, claim = 'unspecified', reason = 'unspecified') {
         super(message);
         this.code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
         this.claim = claim;
         this.reason = reason;
     }
-    static get code() {
-        return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
-    }
 }
 export class JWTExpired extends JOSEError {
+    static get code() {
+        return 'ERR_JWT_EXPIRED';
+    }
     constructor(message, claim = 'unspecified', reason = 'unspecified') {
         super(message);
         this.code = 'ERR_JWT_EXPIRED';
         this.claim = claim;
         this.reason = reason;
     }
-    static get code() {
-        return 'ERR_JWT_EXPIRED';
-    }
 }
 export class JOSEAlgNotAllowed extends JOSEError {
     constructor() {

package/dist/node/cjs/key/import.js

@@ -99,7 +99,7 @@ async function importX509(x509, alg, options) {
 exports.importX509 = importX509;
 async function importPKCS8(pkcs8, alg, options) {
     if (typeof pkcs8 !== 'string' || pkcs8.indexOf('-----BEGIN PRIVATE KEY-----') !== 0) {
-        throw new TypeError('"pkcs8" must be PKCS8 formatted string');
+        throw new TypeError('"pkcs8" must be PKCS#8 formatted string');
     }
     return (0, asn1_js_2.fromPKCS8)(pkcs8, alg, options);
 }

package/dist/node/cjs/runtime/flags.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.jwkImport = exports.jwkExport = exports.rsaPssParams = exports.oneShotCallback = void 0;
+const [major, minor] = process.versions.node.split('.').map((str) => parseInt(str, 10));
+exports.oneShotCallback = major >= 16 || (major === 15 && minor >= 13);
+exports.rsaPssParams = !('electron' in process.versions) && (major >= 17 || (major === 16 && minor >= 9));
+exports.jwkExport = major >= 16 || (major === 15 && minor >= 9);
+exports.jwkImport = major >= 16 || (major === 15 && minor >= 12);

package/dist/node/cjs/runtime/is_key_like.js

@@ -6,6 +6,6 @@ const is_key_object_js_1 = require("./is_key_object.js");
 exports.default = (key) => (0, is_key_object_js_1.default)(key) || (0, webcrypto_js_1.isCryptoKey)(key);
 const types = ['KeyObject'];
 exports.types = types;
-if (parseInt(process.versions.node) >= 16) {
+if (globalThis.CryptoKey || (webcrypto_js_1.default === null || webcrypto_js_1.default === void 0 ? void 0 : webcrypto_js_1.default.CryptoKey)) {
     types.push('CryptoKey');
 }

package/dist/node/cjs/runtime/jwk_to_key.js

@@ -7,13 +7,9 @@ const errors_js_1 = require("../util/errors.js");
 const get_named_curve_js_1 = require("./get_named_curve.js");
 const check_modulus_length_js_1 = require("./check_modulus_length.js");
 const asn1_sequence_encoder_js_1 = require("./asn1_sequence_encoder.js");
-const [major, minor] = process.version
-    .slice(1)
-    .split('.')
-    .map((str) => parseInt(str, 10));
-const jwkImportSupported = major >= 16 || (major === 15 && minor >= 12);
+const flags_js_1 = require("./flags.js");
 const parse = (jwk) => {
-    if (jwkImportSupported && jwk.kty !== 'oct') {
+    if (flags_js_1.jwkImport && jwk.kty !== 'oct') {
         return jwk.d
             ? (0, crypto_1.createPrivateKey)({ format: 'jwk', key: jwk })
             : (0, crypto_1.createPublicKey)({ format: 'jwk', key: jwk });

package/dist/node/cjs/runtime/key_to_jwk.js

@@ -9,11 +9,7 @@ const webcrypto_js_1 = require("./webcrypto.js");
 const is_key_object_js_1 = require("./is_key_object.js");
 const invalid_key_input_js_1 = require("../lib/invalid_key_input.js");
 const is_key_like_js_1 = require("./is_key_like.js");
-const [major, minor] = process.version
-    .slice(1)
-    .split('.')
-    .map((str) => parseInt(str, 10));
-const jwkExportSupported = major >= 16 || (major === 15 && minor >= 9);
+const flags_js_1 = require("./flags.js");
 const keyToJWK = (key) => {
     let keyObject;
     if ((0, webcrypto_js_1.isCryptoKey)(key)) {
@@ -34,7 +30,7 @@ const keyToJWK = (key) => {
     else {
         throw new TypeError((0, invalid_key_input_js_1.default)(key, ...is_key_like_js_1.types, 'Uint8Array'));
     }
-    if (jwkExportSupported) {
+    if (flags_js_1.jwkExport) {
         if (keyObject.type !== 'secret' &&
             !['rsa', 'ec', 'ed25519', 'x25519', 'ed448', 'x448'].includes(keyObject.asymmetricKeyType)) {
             throw new errors_js_1.JOSENotSupported('Unsupported key asymmetricKeyType');

package/dist/node/cjs/runtime/node_key.js

@@ -4,12 +4,7 @@ const crypto_1 = require("crypto");
 const get_named_curve_js_1 = require("./get_named_curve.js");
 const errors_js_1 = require("../util/errors.js");
 const check_modulus_length_js_1 = require("./check_modulus_length.js");
-const [major, minor] = process.version
-    .slice(1)
-    .split('.')
-    .map((str) => parseInt(str, 10));
-const electron = 'electron' in process.versions;
-const rsaPssParams = !electron && (major >= 17 || (major === 16 && minor >= 9));
+const flags_js_1 = require("./flags.js");
 const PSS = {
     padding: crypto_1.constants.RSA_PKCS1_PSS_PADDING,
     saltLength: crypto_1.constants.RSA_PSS_SALTLEN_DIGEST,
@@ -35,9 +30,9 @@ function keyForCrypto(alg, key) {
             }
             (0, check_modulus_length_js_1.default)(key, alg);
             return key;
-        case rsaPssParams && 'PS256':
-        case rsaPssParams && 'PS384':
-        case rsaPssParams && 'PS512':
+        case flags_js_1.rsaPssParams && 'PS256':
+        case flags_js_1.rsaPssParams && 'PS384':
+        case flags_js_1.rsaPssParams && 'PS512':
             if (key.asymmetricKeyType === 'rsa-pss') {
                 const { hashAlgorithm, mgf1HashAlgorithm, saltLength } = key.asymmetricKeyDetails;
                 const length = parseInt(alg.slice(-3), 10);
@@ -54,9 +49,9 @@ function keyForCrypto(alg, key) {
             }
             (0, check_modulus_length_js_1.default)(key, alg);
             return { key, ...PSS };
-        case !rsaPssParams && 'PS256':
-        case !rsaPssParams && 'PS384':
-        case !rsaPssParams && 'PS512':
+        case !flags_js_1.rsaPssParams && 'PS256':
+        case !flags_js_1.rsaPssParams && 'PS384':
+        case !flags_js_1.rsaPssParams && 'PS512':
             if (key.asymmetricKeyType !== 'rsa') {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa');
             }

package/dist/node/cjs/runtime/verify.js

@@ -6,13 +6,9 @@ const dsa_digest_js_1 = require("./dsa_digest.js");
 const node_key_js_1 = require("./node_key.js");
 const sign_js_1 = require("./sign.js");
 const get_sign_verify_key_js_1 = require("./get_sign_verify_key.js");
-const [major, minor] = process.version
-    .slice(1)
-    .split('.')
-    .map((str) => parseInt(str, 10));
-const oneShotCallbackSupported = major >= 16 || (major === 15 && minor >= 13);
+const flags_js_1 = require("./flags.js");
 let oneShotVerify;
-if (crypto.verify.length > 4 && oneShotCallbackSupported) {
+if (crypto.verify.length > 4 && flags_js_1.oneShotCallback) {
     oneShotVerify = (0, util_1.promisify)(crypto.verify);
 }
 else {

package/dist/node/cjs/util/errors.js

@@ -2,6 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.JWSSignatureVerificationFailed = exports.JWKSTimeout = exports.JWKSMultipleMatchingKeys = exports.JWKSNoMatchingKey = exports.JWKSInvalid = exports.JWKInvalid = exports.JWTInvalid = exports.JWSInvalid = exports.JWEInvalid = exports.JWEDecryptionFailed = exports.JOSENotSupported = exports.JOSEAlgNotAllowed = exports.JWTExpired = exports.JWTClaimValidationFailed = exports.JOSEError = void 0;
 class JOSEError extends Error {
+    static get code() {
+        return 'ERR_JOSE_GENERIC';
+    }
     constructor(message) {
         var _a;
         super(message);
@@ -9,33 +12,30 @@ class JOSEError extends Error {
         this.name = this.constructor.name;
         (_a = Error.captureStackTrace) === null || _a === void 0 ? void 0 : _a.call(Error, this, this.constructor);
     }
-    static get code() {
-        return 'ERR_JOSE_GENERIC';
-    }
 }
 exports.JOSEError = JOSEError;
 class JWTClaimValidationFailed extends JOSEError {
+    static get code() {
+        return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
+    }
     constructor(message, claim = 'unspecified', reason = 'unspecified') {
         super(message);
         this.code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
         this.claim = claim;
         this.reason = reason;
     }
-    static get code() {
-        return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
-    }
 }
 exports.JWTClaimValidationFailed = JWTClaimValidationFailed;
 class JWTExpired extends JOSEError {
+    static get code() {
+        return 'ERR_JWT_EXPIRED';
+    }
     constructor(message, claim = 'unspecified', reason = 'unspecified') {
         super(message);
         this.code = 'ERR_JWT_EXPIRED';
         this.claim = claim;
         this.reason = reason;
     }
-    static get code() {
-        return 'ERR_JWT_EXPIRED';
-    }
 }
 exports.JWTExpired = JWTExpired;
 class JOSEAlgNotAllowed extends JOSEError {

package/dist/node/esm/key/import.js

@@ -94,7 +94,7 @@ export async function importX509(x509, alg, options) {
 }
 export async function importPKCS8(pkcs8, alg, options) {
     if (typeof pkcs8 !== 'string' || pkcs8.indexOf('-----BEGIN PRIVATE KEY-----') !== 0) {
-        throw new TypeError('"pkcs8" must be PKCS8 formatted string');
+        throw new TypeError('"pkcs8" must be PKCS#8 formatted string');
     }
     return importPrivate(pkcs8, alg, options);
 }

package/dist/node/esm/runtime/flags.js

@@ -0,0 +1,5 @@
+const [major, minor] = process.versions.node.split('.').map((str) => parseInt(str, 10));
+export const oneShotCallback = major >= 16 || (major === 15 && minor >= 13);
+export const rsaPssParams = !('electron' in process.versions) && (major >= 17 || (major === 16 && minor >= 9));
+export const jwkExport = major >= 16 || (major === 15 && minor >= 9);
+export const jwkImport = major >= 16 || (major === 15 && minor >= 12);

package/dist/node/esm/runtime/is_key_like.js

@@ -1,8 +1,8 @@
-import { isCryptoKey } from './webcrypto.js';
+import webcrypto, { isCryptoKey } from './webcrypto.js';
 import isKeyObject from './is_key_object.js';
 export default (key) => isKeyObject(key) || isCryptoKey(key);
 const types = ['KeyObject'];
-if (parseInt(process.versions.node) >= 16) {
+if (globalThis.CryptoKey || (webcrypto === null || webcrypto === void 0 ? void 0 : webcrypto.CryptoKey)) {
     types.push('CryptoKey');
 }
 export { types };

package/dist/node/esm/runtime/jwk_to_key.js

@@ -5,13 +5,9 @@ import { JOSENotSupported } from '../util/errors.js';
 import { setCurve } from './get_named_curve.js';
 import { setModulusLength } from './check_modulus_length.js';
 import Asn1SequenceEncoder from './asn1_sequence_encoder.js';
-const [major, minor] = process.version
-    .slice(1)
-    .split('.')
-    .map((str) => parseInt(str, 10));
-const jwkImportSupported = major >= 16 || (major === 15 && minor >= 12);
+import { jwkImport } from './flags.js';
 const parse = (jwk) => {
-    if (jwkImportSupported && jwk.kty !== 'oct') {
+    if (jwkImport && jwk.kty !== 'oct') {
         return jwk.d
             ? createPrivateKey({ format: 'jwk', key: jwk })
             : createPublicKey({ format: 'jwk', key: jwk });

package/dist/node/esm/runtime/key_to_jwk.js

@@ -7,11 +7,7 @@ import { isCryptoKey } from './webcrypto.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
 import { types } from './is_key_like.js';
-const [major, minor] = process.version
-    .slice(1)
-    .split('.')
-    .map((str) => parseInt(str, 10));
-const jwkExportSupported = major >= 16 || (major === 15 && minor >= 9);
+import { jwkExport } from './flags.js';
 const keyToJWK = (key) => {
     let keyObject;
     if (isCryptoKey(key)) {
@@ -32,7 +28,7 @@ const keyToJWK = (key) => {
     else {
         throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
     }
-    if (jwkExportSupported) {
+    if (jwkExport) {
         if (keyObject.type !== 'secret' &&
             !['rsa', 'ec', 'ed25519', 'x25519', 'ed448', 'x448'].includes(keyObject.asymmetricKeyType)) {
             throw new JOSENotSupported('Unsupported key asymmetricKeyType');

package/dist/node/esm/runtime/node_key.js

@@ -2,12 +2,7 @@ import { constants } from 'crypto';
 import getNamedCurve from './get_named_curve.js';
 import { JOSENotSupported } from '../util/errors.js';
 import checkModulusLength from './check_modulus_length.js';
-const [major, minor] = process.version
-    .slice(1)
-    .split('.')
-    .map((str) => parseInt(str, 10));
-const electron = 'electron' in process.versions;
-const rsaPssParams = !electron && (major >= 17 || (major === 16 && minor >= 9));
+import { rsaPssParams } from './flags.js';
 const PSS = {
     padding: constants.RSA_PKCS1_PSS_PADDING,
     saltLength: constants.RSA_PSS_SALTLEN_DIGEST,

package/dist/node/esm/runtime/verify.js

@@ -4,13 +4,9 @@ import nodeDigest from './dsa_digest.js';
 import nodeKey from './node_key.js';
 import sign from './sign.js';
 import getVerifyKey from './get_sign_verify_key.js';
-const [major, minor] = process.version
-    .slice(1)
-    .split('.')
-    .map((str) => parseInt(str, 10));
-const oneShotCallbackSupported = major >= 16 || (major === 15 && minor >= 13);
+import { oneShotCallback } from './flags.js';
 let oneShotVerify;
-if (crypto.verify.length > 4 && oneShotCallbackSupported) {
+if (crypto.verify.length > 4 && oneShotCallback) {
     oneShotVerify = promisify(crypto.verify);
 }
 else {

package/dist/node/esm/util/errors.js

@@ -1,4 +1,7 @@
 export class JOSEError extends Error {
+    static get code() {
+        return 'ERR_JOSE_GENERIC';
+    }
     constructor(message) {
         var _a;
         super(message);
@@ -6,31 +9,28 @@ export class JOSEError extends Error {
         this.name = this.constructor.name;
         (_a = Error.captureStackTrace) === null || _a === void 0 ? void 0 : _a.call(Error, this, this.constructor);
     }
-    static get code() {
-        return 'ERR_JOSE_GENERIC';
-    }
 }
 export class JWTClaimValidationFailed extends JOSEError {
+    static get code() {
+        return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
+    }
     constructor(message, claim = 'unspecified', reason = 'unspecified') {
         super(message);
         this.code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
         this.claim = claim;
         this.reason = reason;
     }
-    static get code() {
-        return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
-    }
 }
 export class JWTExpired extends JOSEError {
+    static get code() {
+        return 'ERR_JWT_EXPIRED';
+    }
     constructor(message, claim = 'unspecified', reason = 'unspecified') {
         super(message);
         this.code = 'ERR_JWT_EXPIRED';
         this.claim = claim;
         this.reason = reason;
     }
-    static get code() {
-        return 'ERR_JWT_EXPIRED';
-    }
 }
 export class JOSEAlgNotAllowed extends JOSEError {
     constructor() {

package/dist/types/jwk/embedded.d.ts

@@ -3,7 +3,7 @@ import type { FlattenedJWSInput, JWSHeaderParameters } from '../types';
  * EmbeddedJWK is an implementation of a GetKeyFunction intended to be used with the JWS/JWT verify
  * operations whenever you need to opt-in to verify signatures with a public key embedded in the
  * token's "jwk" (JSON Web Key) Header Parameter. It is recommended to combine this with the verify
- * algorithms option to whitelist JWS algorithms to accept.
+ * function's `algorithms` option to define accepted JWS "alg" (Algorithm) Header Parameter values.
  *
  * @example Usage
  *

package/dist/types/jwt/decrypt.d.ts

@@ -15,10 +15,11 @@ export interface JWTDecryptGetKey extends GetKeyFunction<CompactJWEHeaderParamet
  * @example Usage
  *
  * ```js
+ * const secret = jose.base64url.decode('zH4NRP1HMALxxCFnRZABFA7GOJtzU_gIj02alfL1lvI')
  * const jwt =
- *   'eyJhbGciOiJkaXIiLCJlbmMiOiJBMjU2R0NNIn0..KVcNLqK-3-8ZkYIC.xSwF4VxO0kUMUD2W-cifsNUxnr-swyBq-nADBptyt6y9n79-iNc5b0AALJpRwc0wwDkJw8hNOMjApNUTMsK9b-asToZ3DXFMvwfJ6n1aWefvd7RsoZ2LInWFfVAuttJDzoGB.uuexQoWHwrLMEYRElT8pBQ'
+ *   'eyJhbGciOiJkaXIiLCJlbmMiOiJBMTI4Q0JDLUhTMjU2In0..MB66qstZBPxAXKdsjet_lA.WHbtJTl4taHp7otOHLq3hBvv0yNPsPEKHYInmCPdDDeyV1kU-f-tGEiU4FxlSqkqAT2hVs8_wMNiQFAzPU1PUgIqWCPsBrPP3TtxYsrtwagpn4SvCsUsx0Mhw9ZhliAO8CLmCBQkqr_T9AcYsz5uZw.7nX9m7BGUu_u1p1qFHzyIg'
  *
- * const { payload, protectedHeader } = await jose.jwtDecrypt(jwt, secretKey, {
+ * const { payload, protectedHeader } = await jose.jwtDecrypt(jwt, secret, {
  *   issuer: 'urn:example:issuer',
  *   audience: 'urn:example:audience',
  * })

package/dist/types/jwt/encrypt.d.ts

@@ -6,13 +6,14 @@ import { ProduceJWT } from './produce';
  * @example Usage
  *
  * ```js
+ * const secret = jose.base64url.decode('zH4NRP1HMALxxCFnRZABFA7GOJtzU_gIj02alfL1lvI')
  * const jwt = await new jose.EncryptJWT({ 'urn:example:claim': true })
- *   .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })
+ *   .setProtectedHeader({ alg: 'dir', enc: 'A128CBC-HS256' })
  *   .setIssuedAt()
  *   .setIssuer('urn:example:issuer')
  *   .setAudience('urn:example:audience')
  *   .setExpirationTime('2h')
- *   .encrypt(secretKey)
+ *   .encrypt(secret)
  *
  * console.log(jwt)
  * ```

package/dist/types/jwt/sign.d.ts

@@ -3,11 +3,89 @@ import { ProduceJWT } from './produce';
 /**
  * The SignJWT class is a utility for creating Compact JWS formatted JWT strings.
  *
- * @example Usage
+ * @example Usage with a symmetric secret
  *
  * ```js
+ * const secret = new TextEncoder().encode(
+ *   'cc7e0d44fd473002f1c42167459001140ec6389b7353f8088f4d9a95f2f596f2',
+ * )
+ * const alg = 'HS256'
+ *
+ * const jwt = await new jose.SignJWT({ 'urn:example:claim': true })
+ *   .setProtectedHeader({ alg })
+ *   .setIssuedAt()
+ *   .setIssuer('urn:example:issuer')
+ *   .setAudience('urn:example:audience')
+ *   .setExpirationTime('2h')
+ *   .sign(secret)
+ *
+ * console.log(jwt)
+ * ```
+ *
+ * @example Usage with a private PKCS#8 encoded RSA key
+ *
+ * ```js
+ * const alg = 'RS256'
+ * const pkcs8 = `-----BEGIN PRIVATE KEY-----
+ * MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDCFg4UrY5xtulv
+ * /NXKmL1J4qI1SopAfTNMo3X7p+kJO7plqUYjzaztcre1qfh0m33Sm1Q8oPbO/GpP
+ * MU1/HgcceytgJ/b4UwufVVMl9BrMDYG8moDBylbVupFQS3Ly1L9i/iFG9Z9A9xzY
+ * Zzf799A45bnvNXL6s2glzvjiRvfQ2NDF0anTcnZLcYtC7ugq1IMM+ihAcPfw8Qw2
+ * chN/SmP4qAM+PKaQwagmU7doqmmyN9u38AfoYZ1GCFhEs5TBBT6H6h9YdHeVtiIq
+ * 1c+fl03biSIfLrV7dUBD39gBmXBcL/30Ya3D82mCEUC4zg/UkOfQOmkmV3Lc8YUL
+ * QZ8EJkBLAgMBAAECggEAVuVE/KEP6323WjpbBdAIv7HGahGrgGANvbxZsIhm34ls
+ * VOPK0XDegZkhAybMZHjRhp+gwVxX5ChC+J3cUpOBH5FNxElgW6HizD2Jcq6t6LoL
+ * YgPSrfEHm71iHg8JsgrqfUnGYFzMJmv88C6WdCtpgG/qJV1K00/Ly1G1QKoBffEs
+ * +v4fAMJrCbUdCz1qWto+PU+HLMEo+krfEpGgcmtZeRlDADh8cETMQlgQfQX2VWq/
+ * aAP4a1SXmo+j0cvRU4W5Fj0RVwNesIpetX2ZFz4p/JmB5sWFEj/fC7h5z2lq+6Bm
+ * e2T3BHtXkIxoBW0/pYVnASC8P2puO5FnVxDmWuHDYQKBgQDTuuBd3+0tSFVEX+DU
+ * 5qpFmHm5nyGItZRJTS+71yg5pBxq1KqNCUjAtbxR0q//fwauakh+BwRVCPOrqsUG
+ * jBSb3NYE70Srp6elqxgkE54PwQx4Mr6exJPnseM9U4K+hULllf5yjM9edreJE1nV
+ * NVgFjeyafQhrHKwgr7PERJ/ikwKBgQDqqsT1M+EJLmI1HtCspOG6cu7q3gf/wKRh
+ * E8tu84i3YyBnI8uJkKy92RNVI5fvpBARe3tjSdM25rr2rcrcmF/5g6Q9ImxZPGCt
+ * 86eOgO9ErNtbc4TEgybsP319UE4O41aKeNiBTAZKoYCxv/dMqG0j4avmWzd+foHq
+ * gSNUvR2maQKBgQCYeqOsV2B6VPY7KIVFLd0AA9/dwvEmgAYLiA/RShDI+hwQ/5jX
+ * uxDu37KAhqeC65sHLrmIMUt4Zdr+DRyZK3aIDNEAesPMjw/X6lCXYp1ZISD2yyym
+ * MFGH8X8CIkstI9Faf9vf6PJKSFrC1/HA7wq17VCwrUzLvrljTMW8meM/CwKBgCpo
+ * 2leGHLFQFKeM/iF1WuYbR1pi7gcmhY6VyTowARFDdOOu8GXYI5/bz0afvCGvAMho
+ * DJCREv7lC/zww6zCTPYG+HOj+PjXlJFba3ixjIxYwPvyEJiDK1Ge18sB7Fl8dHNq
+ * C5ayaqCqN1voWYUdGzxU2IA1E/5kVo5O8FesJeOhAoGBAImJbZFf+D5kA32Xxhac
+ * 59lLWBCsocvvbd1cvDMNlRywAAyhsCb1SuX4nEAK9mrSBdfmoF2Nm3eilfsOds0f
+ * K5mX069IKG82CMqh3Mzptd7e7lyb9lsoGO0BAtjho3cWtha/UZ70vfaMzGuZ6JmQ
+ * ak6k+8+UFd93M4z0Qo74OhXB
+ * -----END PRIVATE KEY----`
+ * const privateKey = await jose.importPKCS8(pkcs8, alg)
+ *
+ * const jwt = await new jose.SignJWT({ 'urn:example:claim': true })
+ *   .setProtectedHeader({ alg })
+ *   .setIssuedAt()
+ *   .setIssuer('urn:example:issuer')
+ *   .setAudience('urn:example:audience')
+ *   .setExpirationTime('2h')
+ *   .sign(privateKey)
+ *
+ * console.log(jwt)
+ * ```
+ *
+ * @example Usage with a private JWK encoded RSA key
+ *
+ * ```js
+ * const alg = 'RS256'
+ * const jwk = {
+ *   kty: 'RSA',
+ *   n: 'whYOFK2Ocbbpb_zVypi9SeKiNUqKQH0zTKN1-6fpCTu6ZalGI82s7XK3tan4dJt90ptUPKD2zvxqTzFNfx4HHHsrYCf2-FMLn1VTJfQazA2BvJqAwcpW1bqRUEty8tS_Yv4hRvWfQPcc2Gc3-_fQOOW57zVy-rNoJc744kb30NjQxdGp03J2S3GLQu7oKtSDDPooQHD38PEMNnITf0pj-KgDPjymkMGoJlO3aKppsjfbt_AH6GGdRghYRLOUwQU-h-ofWHR3lbYiKtXPn5dN24kiHy61e3VAQ9_YAZlwXC_99GGtw_NpghFAuM4P1JDn0DppJldy3PGFC0GfBCZASw',
+ *   e: 'AQAB',
+ *   d: 'VuVE_KEP6323WjpbBdAIv7HGahGrgGANvbxZsIhm34lsVOPK0XDegZkhAybMZHjRhp-gwVxX5ChC-J3cUpOBH5FNxElgW6HizD2Jcq6t6LoLYgPSrfEHm71iHg8JsgrqfUnGYFzMJmv88C6WdCtpgG_qJV1K00_Ly1G1QKoBffEs-v4fAMJrCbUdCz1qWto-PU-HLMEo-krfEpGgcmtZeRlDADh8cETMQlgQfQX2VWq_aAP4a1SXmo-j0cvRU4W5Fj0RVwNesIpetX2ZFz4p_JmB5sWFEj_fC7h5z2lq-6Bme2T3BHtXkIxoBW0_pYVnASC8P2puO5FnVxDmWuHDYQ',
+ *   p: '07rgXd_tLUhVRF_g1OaqRZh5uZ8hiLWUSU0vu9coOaQcatSqjQlIwLW8UdKv_38GrmpIfgcEVQjzq6rFBowUm9zWBO9Eq6enpasYJBOeD8EMeDK-nsST57HjPVOCvoVC5ZX-cozPXna3iRNZ1TVYBY3smn0IaxysIK-zxESf4pM',
+ *   q: '6qrE9TPhCS5iNR7QrKThunLu6t4H_8CkYRPLbvOIt2MgZyPLiZCsvdkTVSOX76QQEXt7Y0nTNua69q3K3Jhf-YOkPSJsWTxgrfOnjoDvRKzbW3OExIMm7D99fVBODuNWinjYgUwGSqGAsb_3TKhtI-Gr5ls3fn6B6oEjVL0dpmk',
+ *   dp: 'mHqjrFdgelT2OyiFRS3dAAPf3cLxJoAGC4gP0UoQyPocEP-Y17sQ7t-ygIanguubBy65iDFLeGXa_g0cmSt2iAzRAHrDzI8P1-pQl2KdWSEg9ssspjBRh_F_AiJLLSPRWn_b3-jySkhawtfxwO8Kte1QsK1My765Y0zFvJnjPws',
+ *   dq: 'KmjaV4YcsVAUp4z-IXVa5htHWmLuByaFjpXJOjABEUN0467wZdgjn9vPRp-8Ia8AyGgMkJES_uUL_PDDrMJM9gb4c6P4-NeUkVtreLGMjFjA-_IQmIMrUZ7XywHsWXx0c2oLlrJqoKo3W-hZhR0bPFTYgDUT_mRWjk7wV6wl46E',
+ *   qi: 'iYltkV_4PmQDfZfGFpzn2UtYEKyhy-9t3Vy8Mw2VHLAADKGwJvVK5ficQAr2atIF1-agXY2bd6KV-w52zR8rmZfTr0gobzYIyqHczOm13t7uXJv2WygY7QEC2OGjdxa2Fr9RnvS99ozMa5nomZBqTqT7z5QV33czjPRCjvg6FcE',
+ * }
+ * const privateKey = await jose.importJWK(jwk, alg)
+ *
  * const jwt = await new jose.SignJWT({ 'urn:example:claim': true })
- *   .setProtectedHeader({ alg: 'ES256' })
+ *   .setProtectedHeader({ alg })
  *   .setIssuedAt()
  *   .setIssuer('urn:example:issuer')
  *   .setAudience('urn:example:audience')

package/dist/types/jwt/verify.d.ts

@@ -16,11 +16,62 @@ export interface JWTVerifyGetKey extends GetKeyFunction<JWTHeaderParameters, Fla
  * Verifies the JWT format (to be a JWS Compact format), verifies the JWS signature, validates the
  * JWT Claims Set.
  *
- * @example Usage
+ * @example Usage with a symmetric secret
  *
  * ```js
+ * const secret = new TextEncoder().encode(
+ *   'cc7e0d44fd473002f1c42167459001140ec6389b7353f8088f4d9a95f2f596f2',
+ * )
  * const jwt =
- *   'eyJhbGciOiJFUzI1NiJ9.eyJ1cm46ZXhhbXBsZTpjbGFpbSI6dHJ1ZSwiaWF0IjoxNjA0MzE1MDc0LCJpc3MiOiJ1cm46ZXhhbXBsZTppc3N1ZXIiLCJhdWQiOiJ1cm46ZXhhbXBsZTphdWRpZW5jZSJ9.hx1nOfAT5LlXuzu8O-bhjXBGpklWDt2EsHw7-MDn49NrnwvVsstNhEnkW2ddauB7eSikFtUNeumLpFI9CWDBsg'
+ *   'eyJhbGciOiJIUzI1NiJ9.eyJ1cm46ZXhhbXBsZTpjbGFpbSI6dHJ1ZSwiaWF0IjoxNjY5MDU2MjMxLCJpc3MiOiJ1cm46ZXhhbXBsZTppc3N1ZXIiLCJhdWQiOiJ1cm46ZXhhbXBsZTphdWRpZW5jZSJ9.C4iSlLfAUMBq--wnC6VqD9gEOhwpRZpoRarE0m7KEnI'
+ *
+ * const { payload, protectedHeader } = await jose.jwtVerify(jwt, secret, {
+ *   issuer: 'urn:example:issuer',
+ *   audience: 'urn:example:audience',
+ * })
+ *
+ * console.log(protectedHeader)
+ * console.log(payload)
+ * ```
+ *
+ * @example Usage with a public SPKI encoded RSA key
+ *
+ * ```js
+ * const alg = 'RS256'
+ * const spki = `-----BEGIN PUBLIC KEY-----
+ * MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAwhYOFK2Ocbbpb/zVypi9
+ * SeKiNUqKQH0zTKN1+6fpCTu6ZalGI82s7XK3tan4dJt90ptUPKD2zvxqTzFNfx4H
+ * HHsrYCf2+FMLn1VTJfQazA2BvJqAwcpW1bqRUEty8tS/Yv4hRvWfQPcc2Gc3+/fQ
+ * OOW57zVy+rNoJc744kb30NjQxdGp03J2S3GLQu7oKtSDDPooQHD38PEMNnITf0pj
+ * +KgDPjymkMGoJlO3aKppsjfbt/AH6GGdRghYRLOUwQU+h+ofWHR3lbYiKtXPn5dN
+ * 24kiHy61e3VAQ9/YAZlwXC/99GGtw/NpghFAuM4P1JDn0DppJldy3PGFC0GfBCZA
+ * SwIDAQAB
+ * -----END PUBLIC KEY-----`
+ * const publicKey = await jose.importSPKI(spki, alg)
+ * const jwt =
+ *   'eyJhbGciOiJSUzI1NiJ9.eyJ1cm46ZXhhbXBsZTpjbGFpbSI6dHJ1ZSwiaWF0IjoxNjY5MDU2NDg4LCJpc3MiOiJ1cm46ZXhhbXBsZTppc3N1ZXIiLCJhdWQiOiJ1cm46ZXhhbXBsZTphdWRpZW5jZSJ9.gXrPZ3yM_60dMXGE69dusbpzYASNA-XIOwsb5D5xYnSxyj6_D6OR_uR_1vqhUm4AxZxcrH1_-XJAve9HCw8az_QzHcN-nETt-v6stCsYrn6Bv1YOc-mSJRZ8ll57KVqLbCIbjKwerNX5r2_Qg2TwmJzQdRs-AQDhy-s_DlJd8ql6wR4n-kDZpar-pwIvz4fFIN0Fj57SXpAbLrV6Eo4Byzl0xFD8qEYEpBwjrMMfxCZXTlAVhAq6KCoGlDTwWuExps342-0UErEtyIqDnDGcrfNWiUsoo8j-29IpKd-w9-C388u-ChCxoHz--H8WmMSZzx3zTXsZ5lXLZ9IKfanDKg'
+ *
+ * const { payload, protectedHeader } = await jose.jwtVerify(jwt, publicKey, {
+ *   issuer: 'urn:example:issuer',
+ *   audience: 'urn:example:audience',
+ * })
+ *
+ * console.log(protectedHeader)
+ * console.log(payload)
+ * ```
+ *
+ * @example Usage with a public JWK encoded RSA key
+ *
+ * ```js
+ * const alg = 'RS256'
+ * const jwk = {
+ *   kty: 'RSA',
+ *   n: 'whYOFK2Ocbbpb_zVypi9SeKiNUqKQH0zTKN1-6fpCTu6ZalGI82s7XK3tan4dJt90ptUPKD2zvxqTzFNfx4HHHsrYCf2-FMLn1VTJfQazA2BvJqAwcpW1bqRUEty8tS_Yv4hRvWfQPcc2Gc3-_fQOOW57zVy-rNoJc744kb30NjQxdGp03J2S3GLQu7oKtSDDPooQHD38PEMNnITf0pj-KgDPjymkMGoJlO3aKppsjfbt_AH6GGdRghYRLOUwQU-h-ofWHR3lbYiKtXPn5dN24kiHy61e3VAQ9_YAZlwXC_99GGtw_NpghFAuM4P1JDn0DppJldy3PGFC0GfBCZASw',
+ *   e: 'AQAB',
+ * }
+ * const publicKey = await jose.importJWK(jwk, alg)
+ * const jwt =
+ *   'eyJhbGciOiJSUzI1NiJ9.eyJ1cm46ZXhhbXBsZTpjbGFpbSI6dHJ1ZSwiaWF0IjoxNjY5MDU2NDg4LCJpc3MiOiJ1cm46ZXhhbXBsZTppc3N1ZXIiLCJhdWQiOiJ1cm46ZXhhbXBsZTphdWRpZW5jZSJ9.gXrPZ3yM_60dMXGE69dusbpzYASNA-XIOwsb5D5xYnSxyj6_D6OR_uR_1vqhUm4AxZxcrH1_-XJAve9HCw8az_QzHcN-nETt-v6stCsYrn6Bv1YOc-mSJRZ8ll57KVqLbCIbjKwerNX5r2_Qg2TwmJzQdRs-AQDhy-s_DlJd8ql6wR4n-kDZpar-pwIvz4fFIN0Fj57SXpAbLrV6Eo4Byzl0xFD8qEYEpBwjrMMfxCZXTlAVhAq6KCoGlDTwWuExps342-0UErEtyIqDnDGcrfNWiUsoo8j-29IpKd-w9-C388u-ChCxoHz--H8WmMSZzx3zTXsZ5lXLZ9IKfanDKg'
  *
  * const { payload, protectedHeader } = await jose.jwtVerify(jwt, publicKey, {
  *   issuer: 'urn:example:issuer',
@@ -37,6 +88,19 @@ export interface JWTVerifyGetKey extends GetKeyFunction<JWTHeaderParameters, Fla
  */
 export declare function jwtVerify(jwt: string | Uint8Array, key: KeyLike | Uint8Array, options?: JWTVerifyOptions): Promise<JWTVerifyResult>;
 /**
+ * @example Usage with a public JSON Web Key Set hosted on a remote URL
+ *
+ * ```js
+ * const JWKS = jose.createRemoteJWKSet(new URL('https://www.googleapis.com/oauth2/v3/certs'))
+ *
+ * const { payload, protectedHeader } = await jose.jwtVerify(jwt, JWKS, {
+ *   issuer: 'urn:example:issuer',
+ *   audience: 'urn:example:audience',
+ * })
+ * console.log(protectedHeader)
+ * console.log(payload)
+ * ```
+ *
  * @param jwt JSON Web Token value (encoded as JWS).
  * @param getKey Function resolving a key to verify the JWT with.
  * @param options JWT Decryption and JWT Claims Set validation options.

package/dist/types/key/import.d.ts

@@ -55,9 +55,9 @@ export declare function importSPKI(spki: string, alg: string, options?: PEMImpor
  */
 export declare function importX509(x509: string, alg: string, options?: PEMImportOptions): Promise<KeyLike>;
 /**
- * Imports a PEM-encoded PKCS8 string as a runtime-specific private key representation (KeyObject or
- * CryptoKey). See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210) to learn
- * about key to algorithm requirements and mapping. Encrypted keys are not supported.
+ * Imports a PEM-encoded PKCS#8 string as a runtime-specific private key representation (KeyObject
+ * or CryptoKey). See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210) to
+ * learn about key to algorithm requirements and mapping. Encrypted keys are not supported.
  *
  * @example Usage
  *
@@ -71,7 +71,7 @@ export declare function importX509(x509: string, alg: string, options?: PEMImpor
  * const ecPrivateKey = await jose.importPKCS8(pkcs8, algorithm)
  * ```
  *
- * @param pem PEM-encoded PKCS8 string
+ * @param pem PEM-encoded PKCS#8 string
  * @param alg JSON Web Algorithm identifier to be used with the imported key.
  */
 export declare function importPKCS8(pkcs8: string, alg: string, options?: PEMImportOptions): Promise<KeyLike>;

package/dist/types/util/decode_protected_header.d.ts

@@ -1,5 +1,5 @@
 import type { JWSHeaderParameters, JWEHeaderParameters } from '../types';
-export declare type ProtectedHeaderParameters = JWSHeaderParameters & JWEHeaderParameters;
+export type ProtectedHeaderParameters = JWSHeaderParameters & JWEHeaderParameters;
 /**
  * Decodes the Protected Header of a JWE/JWS/JWT token utilizing any JOSE serialization.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "4.11.0",
+  "version": "4.11.2",
   "description": "'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "browser",