jose 4.11.1 → 4.11.3

package/README.md

@@ -38,7 +38,7 @@ const jose = require('jose')
 
 **`example`** Deno import
 ```js
-import * as jose from 'https://deno.land/x/jose@v4.11.1/index.ts'
+import * as jose from 'https://deno.land/x/jose@v4.11.3/index.ts'
 ```
 
 - JSON Web Tokens (JWT)

package/dist/browser/lib/crypto_key.js

@@ -71,13 +71,13 @@ export function checkSigCryptoKey(key, alg, ...usages) {
                 throw unusable(`SHA-${expected}`, 'algorithm.hash');
             break;
         }
-        case isCloudflareWorkers() && 'EdDSA': {
-            if (!isAlgorithm(key.algorithm, 'NODE-ED25519'))
-                throw unusable('NODE-ED25519');
-            break;
-        }
         case 'EdDSA': {
             if (key.algorithm.name !== 'Ed25519' && key.algorithm.name !== 'Ed448') {
+                if (isCloudflareWorkers()) {
+                    if (isAlgorithm(key.algorithm, 'NODE-ED25519'))
+                        break;
+                    throw unusable('Ed25519, Ed448, or NODE-ED25519');
+                }
                 throw unusable('Ed25519 or Ed448');
             }
             break;

package/dist/browser/runtime/asn1.js

@@ -57,7 +57,7 @@ const getNamedCurve = (keyData) => {
     }
 };
 const genericImport = async (replace, keyFormat, pem, alg, options) => {
-    var _a;
+    var _a, _b;
     let algorithm;
     let keyUsages;
     const keyData = new Uint8Array(atob(pem.replace(replace, ''))
@@ -108,12 +108,6 @@ const genericImport = async (replace, keyFormat, pem, alg, options) => {
             keyUsages = isPublic ? [] : ['deriveBits'];
             break;
         }
-        case isCloudflareWorkers() && 'EdDSA': {
-            const namedCurve = getNamedCurve(keyData).toUpperCase();
-            algorithm = { name: `NODE-${namedCurve}`, namedCurve: `NODE-${namedCurve}` };
-            keyUsages = isPublic ? ['verify'] : ['sign'];
-            break;
-        }
         case 'EdDSA':
             algorithm = { name: getNamedCurve(keyData) };
             keyUsages = isPublic ? ['verify'] : ['sign'];
@@ -121,7 +115,18 @@ const genericImport = async (replace, keyFormat, pem, alg, options) => {
         default:
             throw new JOSENotSupported('Invalid or unsupported "alg" (Algorithm) value');
     }
-    return crypto.subtle.importKey(keyFormat, keyData, algorithm, (_a = options === null || options === void 0 ? void 0 : options.extractable) !== null && _a !== void 0 ? _a : false, keyUsages);
+    try {
+        return await crypto.subtle.importKey(keyFormat, keyData, algorithm, (_a = options === null || options === void 0 ? void 0 : options.extractable) !== null && _a !== void 0 ? _a : false, keyUsages);
+    }
+    catch (err) {
+        if (algorithm.name === 'Ed25519' &&
+            (err === null || err === void 0 ? void 0 : err.name) === 'NotSupportedError' &&
+            isCloudflareWorkers()) {
+            algorithm = { name: 'NODE-ED25519', namedCurve: 'NODE-ED25519' };
+            return await crypto.subtle.importKey(keyFormat, keyData, algorithm, (_b = options === null || options === void 0 ? void 0 : options.extractable) !== null && _b !== void 0 ? _b : false, keyUsages);
+        }
+        throw err;
+    }
 };
 export const fromPKCS8 = (pem, alg, options) => {
     return genericImport(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, 'pkcs8', pem, alg, options);

package/dist/browser/runtime/generate.js

@@ -51,7 +51,7 @@ function getModulusLengthOption(options) {
     return modulusLength;
 }
 export async function generateKeyPair(alg, options) {
-    var _a, _b, _c;
+    var _a, _b, _c, _d;
     let algorithm;
     let keyUsages;
     switch (alg) {
@@ -101,17 +101,6 @@ export async function generateKeyPair(alg, options) {
             algorithm = { name: 'ECDSA', namedCurve: 'P-521' };
             keyUsages = ['sign', 'verify'];
             break;
-        case isCloudflareWorkers() && 'EdDSA':
-            switch (options === null || options === void 0 ? void 0 : options.crv) {
-                case undefined:
-                case 'Ed25519':
-                    algorithm = { name: 'NODE-ED25519', namedCurve: 'NODE-ED25519' };
-                    keyUsages = ['sign', 'verify'];
-                    break;
-                default:
-                    throw new JOSENotSupported('Invalid or unsupported crv option provided');
-            }
-            break;
         case 'EdDSA':
             keyUsages = ['sign', 'verify'];
             const crv = (_a = options === null || options === void 0 ? void 0 : options.crv) !== null && _a !== void 0 ? _a : 'Ed25519';
@@ -149,5 +138,16 @@ export async function generateKeyPair(alg, options) {
         default:
             throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
     }
-    return (crypto.subtle.generateKey(algorithm, (_c = options === null || options === void 0 ? void 0 : options.extractable) !== null && _c !== void 0 ? _c : false, keyUsages));
+    try {
+        return (await crypto.subtle.generateKey(algorithm, (_c = options === null || options === void 0 ? void 0 : options.extractable) !== null && _c !== void 0 ? _c : false, keyUsages));
+    }
+    catch (err) {
+        if (algorithm.name === 'Ed25519' &&
+            (err === null || err === void 0 ? void 0 : err.name) === 'NotSupportedError' &&
+            isCloudflareWorkers()) {
+            algorithm = { name: 'NODE-ED25519', namedCurve: 'NODE-ED25519' };
+            return (await crypto.subtle.generateKey(algorithm, (_d = options === null || options === void 0 ? void 0 : options.extractable) !== null && _d !== void 0 ? _d : false, keyUsages));
+        }
+        throw err;
+    }
 }

package/dist/browser/runtime/jwk_to_key.js

@@ -99,19 +99,6 @@ function subtleMapping(jwk) {
             }
             break;
         }
-        case isCloudflareWorkers() && 'OKP':
-            if (jwk.alg !== 'EdDSA') {
-                throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
-            }
-            switch (jwk.crv) {
-                case 'Ed25519':
-                    algorithm = { name: 'NODE-ED25519', namedCurve: 'NODE-ED25519' };
-                    keyUsages = jwk.d ? ['sign'] : ['verify'];
-                    break;
-                default:
-                    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
-            }
-            break;
         case 'OKP': {
             switch (jwk.alg) {
                 case 'EdDSA':
@@ -149,6 +136,17 @@ const parse = async (jwk) => {
     const keyData = { ...jwk };
     delete keyData.alg;
     delete keyData.use;
-    return crypto.subtle.importKey('jwk', keyData, ...rest);
+    try {
+        return await crypto.subtle.importKey('jwk', keyData, ...rest);
+    }
+    catch (err) {
+        if (algorithm.name === 'Ed25519' &&
+            (err === null || err === void 0 ? void 0 : err.name) === 'NotSupportedError' &&
+            isCloudflareWorkers()) {
+            rest[0] = { name: 'NODE-ED25519', namedCurve: 'NODE-ED25519' };
+            return await crypto.subtle.importKey('jwk', keyData, ...rest);
+        }
+        throw err;
+    }
 };
 export default parse;

package/dist/browser/runtime/subtle_dsa.js

@@ -19,10 +19,10 @@ export default function subtleDsa(alg, algorithm) {
         case 'ES384':
         case 'ES512':
             return { hash, name: 'ECDSA', namedCurve: algorithm.namedCurve };
-        case isCloudflareWorkers() && 'EdDSA':
-            const { namedCurve } = algorithm;
-            return { name: namedCurve, namedCurve };
         case 'EdDSA':
+            if (isCloudflareWorkers() && algorithm.name === 'NODE-ED25519') {
+                return { name: 'NODE-ED25519', namedCurve: 'NODE-ED25519' };
+            }
             return { name: algorithm.name };
         default:
             throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);

package/dist/browser/util/errors.js

@@ -1,4 +1,7 @@
 export class JOSEError extends Error {
+    static get code() {
+        return 'ERR_JOSE_GENERIC';
+    }
     constructor(message) {
         var _a;
         super(message);
@@ -6,31 +9,28 @@ export class JOSEError extends Error {
         this.name = this.constructor.name;
         (_a = Error.captureStackTrace) === null || _a === void 0 ? void 0 : _a.call(Error, this, this.constructor);
     }
-    static get code() {
-        return 'ERR_JOSE_GENERIC';
-    }
 }
 export class JWTClaimValidationFailed extends JOSEError {
+    static get code() {
+        return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
+    }
     constructor(message, claim = 'unspecified', reason = 'unspecified') {
         super(message);
         this.code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
         this.claim = claim;
         this.reason = reason;
     }
-    static get code() {
-        return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
-    }
 }
 export class JWTExpired extends JOSEError {
+    static get code() {
+        return 'ERR_JWT_EXPIRED';
+    }
     constructor(message, claim = 'unspecified', reason = 'unspecified') {
         super(message);
         this.code = 'ERR_JWT_EXPIRED';
         this.claim = claim;
         this.reason = reason;
     }
-    static get code() {
-        return 'ERR_JWT_EXPIRED';
-    }
 }
 export class JOSEAlgNotAllowed extends JOSEError {
     constructor() {

package/dist/deno/README.md

@@ -0,0 +1,51 @@
+# `jose` Modules API Documentation
+
+> "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto.
+
+## [💗 Help the project](https://github.com/panva/jose/blob/v4.11.3/docs/https://github.com/sponsors/panva)
+
+## Available modules
+
+**`example`** Deno import
+```js
+import * as jose from 'https://deno.land/x/jose@v4.11.3/index.ts'
+```
+
+- JSON Web Tokens (JWT)
+  - [Signing](https://github.com/panva/jose/blob/v4.11.3/docs/classes/jwt_sign.SignJWT.md#readme)
+  - [Verification & JWT Claims Set Validation](https://github.com/panva/jose/blob/v4.11.3/docs/functions/jwt_verify.jwtVerify.md#readme)
+  - Encrypted JSON Web Tokens
+    - [Encryption](https://github.com/panva/jose/blob/v4.11.3/docs/classes/jwt_encrypt.EncryptJWT.md#readme)
+    - [Decryption & JWT Claims Set Validation](https://github.com/panva/jose/blob/v4.11.3/docs/functions/jwt_decrypt.jwtDecrypt.md#readme)
+- Key Import
+  - [JWK Import](https://github.com/panva/jose/blob/v4.11.3/docs/functions/key_import.importJWK.md#readme)
+  - [Public Key Import (SPKI)](https://github.com/panva/jose/blob/v4.11.3/docs/functions/key_import.importSPKI.md#readme)
+  - [Public Key Import (X.509 Certificate)](https://github.com/panva/jose/blob/v4.11.3/docs/functions/key_import.importX509.md#readme)
+  - [Private Key Import (PKCS #8)](https://github.com/panva/jose/blob/v4.11.3/docs/functions/key_import.importPKCS8.md#readme)
+- JSON Web Encryption (JWE)
+  - Encryption - [Compact](https://github.com/panva/jose/blob/v4.11.3/docs/classes/jwe_compact_encrypt.CompactEncrypt.md#readme), [Flattened](https://github.com/panva/jose/blob/v4.11.3/docs/classes/jwe_flattened_encrypt.FlattenedEncrypt.md#readme), [General](https://github.com/panva/jose/blob/v4.11.3/docs/classes/jwe_general_encrypt.GeneralEncrypt.md#readme)
+  - Decryption - [Compact](https://github.com/panva/jose/blob/v4.11.3/docs/functions/jwe_compact_decrypt.compactDecrypt.md#readme), [Flattened](https://github.com/panva/jose/blob/v4.11.3/docs/functions/jwe_flattened_decrypt.flattenedDecrypt.md#readme), [General](https://github.com/panva/jose/blob/v4.11.3/docs/functions/jwe_general_decrypt.generalDecrypt.md#readme)
+- JSON Web Signature (JWS)
+  - Signing - [Compact](https://github.com/panva/jose/blob/v4.11.3/docs/classes/jws_compact_sign.CompactSign.md#readme), [Flattened](https://github.com/panva/jose/blob/v4.11.3/docs/classes/jws_flattened_sign.FlattenedSign.md#readme), [General](https://github.com/panva/jose/blob/v4.11.3/docs/classes/jws_general_sign.GeneralSign.md#readme)
+  - Verification - [Compact](https://github.com/panva/jose/blob/v4.11.3/docs/functions/jws_compact_verify.compactVerify.md#readme), [Flattened](https://github.com/panva/jose/blob/v4.11.3/docs/functions/jws_flattened_verify.flattenedVerify.md#readme), [General](https://github.com/panva/jose/blob/v4.11.3/docs/functions/jws_general_verify.generalVerify.md#readme)
+- JSON Web Key (JWK)
+  - [Calculating JWK Thumbprint](https://github.com/panva/jose/blob/v4.11.3/docs/functions/jwk_thumbprint.calculateJwkThumbprint.md#readme)
+  - [Calculating JWK Thumbprint URI](https://github.com/panva/jose/blob/v4.11.3/docs/functions/jwk_thumbprint.calculateJwkThumbprintUri.md#readme)
+  - [Verification using a JWK Embedded in a JWS Header](https://github.com/panva/jose/blob/v4.11.3/docs/functions/jwk_embedded.EmbeddedJWK.md#readme)
+- JSON Web Key Set (JWKS)
+  - [Verify using a local JWKSet](https://github.com/panva/jose/blob/v4.11.3/docs/functions/jwks_local.createLocalJWKSet.md#readme)
+  - [Verify using a remote JWKSet](https://github.com/panva/jose/blob/v4.11.3/docs/functions/jwks_remote.createRemoteJWKSet.md#readme)
+- Key Pair or Secret Generation
+  - [Asymmetric Key Pair Generation](https://github.com/panva/jose/blob/v4.11.3/docs/functions/key_generate_key_pair.generateKeyPair.md#readme)
+  - [Symmetric Secret Generation](https://github.com/panva/jose/blob/v4.11.3/docs/functions/key_generate_secret.generateSecret.md#readme)
+- Key Export
+  - [JWK Export](https://github.com/panva/jose/blob/v4.11.3/docs/functions/key_export.exportJWK.md#readme)
+  - [Private Key Export](https://github.com/panva/jose/blob/v4.11.3/docs/functions/key_export.exportPKCS8.md#readme)
+  - [Public Key Export](https://github.com/panva/jose/blob/v4.11.3/docs/functions/key_export.exportSPKI.md#readme)
+- Utilities
+  - [Decoding Token's Protected Header](https://github.com/panva/jose/blob/v4.11.3/docs/functions/util_decode_protected_header.decodeProtectedHeader.md#readme)
+  - [Decoding JWT Claims Set](https://github.com/panva/jose/blob/v4.11.3/docs/functions/util_decode_jwt.decodeJwt.md#readme)
+- [Unsecured JWT](https://github.com/panva/jose/blob/v4.11.3/docs/classes/jwt_unsecured.UnsecuredJWT.md#readme)
+- [JOSE Errors](https://github.com/panva/jose/blob/v4.11.3/docs/modules/util_errors.md#readme)
+
+[support-sponsor]: https://github.com/sponsors/panva

package/dist/node/cjs/lib/crypto_key.js

@@ -74,13 +74,13 @@ function checkSigCryptoKey(key, alg, ...usages) {
                 throw unusable(`SHA-${expected}`, 'algorithm.hash');
             break;
         }
-        case (0, env_js_1.isCloudflareWorkers)() && 'EdDSA': {
-            if (!isAlgorithm(key.algorithm, 'NODE-ED25519'))
-                throw unusable('NODE-ED25519');
-            break;
-        }
         case 'EdDSA': {
             if (key.algorithm.name !== 'Ed25519' && key.algorithm.name !== 'Ed448') {
+                if ((0, env_js_1.isCloudflareWorkers)()) {
+                    if (isAlgorithm(key.algorithm, 'NODE-ED25519'))
+                        break;
+                    throw unusable('Ed25519, Ed448, or NODE-ED25519');
+                }
                 throw unusable('Ed25519 or Ed448');
             }
             break;

package/dist/node/cjs/runtime/flags.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.jwkImport = exports.jwkExport = exports.rsaPssParams = exports.oneShotCallback = void 0;
+const [major, minor] = process.versions.node.split('.').map((str) => parseInt(str, 10));
+exports.oneShotCallback = major >= 16 || (major === 15 && minor >= 13);
+exports.rsaPssParams = !('electron' in process.versions) && (major >= 17 || (major === 16 && minor >= 9));
+exports.jwkExport = major >= 16 || (major === 15 && minor >= 9);
+exports.jwkImport = major >= 16 || (major === 15 && minor >= 12);

package/dist/node/cjs/runtime/is_key_like.js

@@ -6,6 +6,6 @@ const is_key_object_js_1 = require("./is_key_object.js");
 exports.default = (key) => (0, is_key_object_js_1.default)(key) || (0, webcrypto_js_1.isCryptoKey)(key);
 const types = ['KeyObject'];
 exports.types = types;
-if (parseInt(process.versions.node) >= 16) {
+if (globalThis.CryptoKey || (webcrypto_js_1.default === null || webcrypto_js_1.default === void 0 ? void 0 : webcrypto_js_1.default.CryptoKey)) {
     types.push('CryptoKey');
 }

package/dist/node/cjs/runtime/jwk_to_key.js

@@ -7,13 +7,9 @@ const errors_js_1 = require("../util/errors.js");
 const get_named_curve_js_1 = require("./get_named_curve.js");
 const check_modulus_length_js_1 = require("./check_modulus_length.js");
 const asn1_sequence_encoder_js_1 = require("./asn1_sequence_encoder.js");
-const [major, minor] = process.version
-    .slice(1)
-    .split('.')
-    .map((str) => parseInt(str, 10));
-const jwkImportSupported = major >= 16 || (major === 15 && minor >= 12);
+const flags_js_1 = require("./flags.js");
 const parse = (jwk) => {
-    if (jwkImportSupported && jwk.kty !== 'oct') {
+    if (flags_js_1.jwkImport && jwk.kty !== 'oct') {
         return jwk.d
             ? (0, crypto_1.createPrivateKey)({ format: 'jwk', key: jwk })
             : (0, crypto_1.createPublicKey)({ format: 'jwk', key: jwk });

package/dist/node/cjs/runtime/key_to_jwk.js

@@ -9,11 +9,7 @@ const webcrypto_js_1 = require("./webcrypto.js");
 const is_key_object_js_1 = require("./is_key_object.js");
 const invalid_key_input_js_1 = require("../lib/invalid_key_input.js");
 const is_key_like_js_1 = require("./is_key_like.js");
-const [major, minor] = process.version
-    .slice(1)
-    .split('.')
-    .map((str) => parseInt(str, 10));
-const jwkExportSupported = major >= 16 || (major === 15 && minor >= 9);
+const flags_js_1 = require("./flags.js");
 const keyToJWK = (key) => {
     let keyObject;
     if ((0, webcrypto_js_1.isCryptoKey)(key)) {
@@ -34,7 +30,7 @@ const keyToJWK = (key) => {
     else {
         throw new TypeError((0, invalid_key_input_js_1.default)(key, ...is_key_like_js_1.types, 'Uint8Array'));
     }
-    if (jwkExportSupported) {
+    if (flags_js_1.jwkExport) {
         if (keyObject.type !== 'secret' &&
             !['rsa', 'ec', 'ed25519', 'x25519', 'ed448', 'x448'].includes(keyObject.asymmetricKeyType)) {
             throw new errors_js_1.JOSENotSupported('Unsupported key asymmetricKeyType');

package/dist/node/cjs/runtime/node_key.js

@@ -4,12 +4,7 @@ const crypto_1 = require("crypto");
 const get_named_curve_js_1 = require("./get_named_curve.js");
 const errors_js_1 = require("../util/errors.js");
 const check_modulus_length_js_1 = require("./check_modulus_length.js");
-const [major, minor] = process.version
-    .slice(1)
-    .split('.')
-    .map((str) => parseInt(str, 10));
-const electron = 'electron' in process.versions;
-const rsaPssParams = !electron && (major >= 17 || (major === 16 && minor >= 9));
+const flags_js_1 = require("./flags.js");
 const PSS = {
     padding: crypto_1.constants.RSA_PKCS1_PSS_PADDING,
     saltLength: crypto_1.constants.RSA_PSS_SALTLEN_DIGEST,
@@ -35,9 +30,9 @@ function keyForCrypto(alg, key) {
             }
             (0, check_modulus_length_js_1.default)(key, alg);
             return key;
-        case rsaPssParams && 'PS256':
-        case rsaPssParams && 'PS384':
-        case rsaPssParams && 'PS512':
+        case flags_js_1.rsaPssParams && 'PS256':
+        case flags_js_1.rsaPssParams && 'PS384':
+        case flags_js_1.rsaPssParams && 'PS512':
             if (key.asymmetricKeyType === 'rsa-pss') {
                 const { hashAlgorithm, mgf1HashAlgorithm, saltLength } = key.asymmetricKeyDetails;
                 const length = parseInt(alg.slice(-3), 10);
@@ -54,9 +49,9 @@ function keyForCrypto(alg, key) {
             }
             (0, check_modulus_length_js_1.default)(key, alg);
             return { key, ...PSS };
-        case !rsaPssParams && 'PS256':
-        case !rsaPssParams && 'PS384':
-        case !rsaPssParams && 'PS512':
+        case !flags_js_1.rsaPssParams && 'PS256':
+        case !flags_js_1.rsaPssParams && 'PS384':
+        case !flags_js_1.rsaPssParams && 'PS512':
             if (key.asymmetricKeyType !== 'rsa') {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa');
             }

package/dist/node/cjs/runtime/verify.js

@@ -6,13 +6,9 @@ const dsa_digest_js_1 = require("./dsa_digest.js");
 const node_key_js_1 = require("./node_key.js");
 const sign_js_1 = require("./sign.js");
 const get_sign_verify_key_js_1 = require("./get_sign_verify_key.js");
-const [major, minor] = process.version
-    .slice(1)
-    .split('.')
-    .map((str) => parseInt(str, 10));
-const oneShotCallbackSupported = major >= 16 || (major === 15 && minor >= 13);
+const flags_js_1 = require("./flags.js");
 let oneShotVerify;
-if (crypto.verify.length > 4 && oneShotCallbackSupported) {
+if (crypto.verify.length > 4 && flags_js_1.oneShotCallback) {
     oneShotVerify = (0, util_1.promisify)(crypto.verify);
 }
 else {

package/dist/node/cjs/util/errors.js

@@ -2,6 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.JWSSignatureVerificationFailed = exports.JWKSTimeout = exports.JWKSMultipleMatchingKeys = exports.JWKSNoMatchingKey = exports.JWKSInvalid = exports.JWKInvalid = exports.JWTInvalid = exports.JWSInvalid = exports.JWEInvalid = exports.JWEDecryptionFailed = exports.JOSENotSupported = exports.JOSEAlgNotAllowed = exports.JWTExpired = exports.JWTClaimValidationFailed = exports.JOSEError = void 0;
 class JOSEError extends Error {
+    static get code() {
+        return 'ERR_JOSE_GENERIC';
+    }
     constructor(message) {
         var _a;
         super(message);
@@ -9,33 +12,30 @@ class JOSEError extends Error {
         this.name = this.constructor.name;
         (_a = Error.captureStackTrace) === null || _a === void 0 ? void 0 : _a.call(Error, this, this.constructor);
     }
-    static get code() {
-        return 'ERR_JOSE_GENERIC';
-    }
 }
 exports.JOSEError = JOSEError;
 class JWTClaimValidationFailed extends JOSEError {
+    static get code() {
+        return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
+    }
     constructor(message, claim = 'unspecified', reason = 'unspecified') {
         super(message);
         this.code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
         this.claim = claim;
         this.reason = reason;
     }
-    static get code() {
-        return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
-    }
 }
 exports.JWTClaimValidationFailed = JWTClaimValidationFailed;
 class JWTExpired extends JOSEError {
+    static get code() {
+        return 'ERR_JWT_EXPIRED';
+    }
     constructor(message, claim = 'unspecified', reason = 'unspecified') {
         super(message);
         this.code = 'ERR_JWT_EXPIRED';
         this.claim = claim;
         this.reason = reason;
     }
-    static get code() {
-        return 'ERR_JWT_EXPIRED';
-    }
 }
 exports.JWTExpired = JWTExpired;
 class JOSEAlgNotAllowed extends JOSEError {

package/dist/node/esm/lib/crypto_key.js

@@ -71,13 +71,13 @@ export function checkSigCryptoKey(key, alg, ...usages) {
                 throw unusable(`SHA-${expected}`, 'algorithm.hash');
             break;
         }
-        case isCloudflareWorkers() && 'EdDSA': {
-            if (!isAlgorithm(key.algorithm, 'NODE-ED25519'))
-                throw unusable('NODE-ED25519');
-            break;
-        }
         case 'EdDSA': {
             if (key.algorithm.name !== 'Ed25519' && key.algorithm.name !== 'Ed448') {
+                if (isCloudflareWorkers()) {
+                    if (isAlgorithm(key.algorithm, 'NODE-ED25519'))
+                        break;
+                    throw unusable('Ed25519, Ed448, or NODE-ED25519');
+                }
                 throw unusable('Ed25519 or Ed448');
             }
             break;

package/dist/node/esm/runtime/flags.js

@@ -0,0 +1,5 @@
+const [major, minor] = process.versions.node.split('.').map((str) => parseInt(str, 10));
+export const oneShotCallback = major >= 16 || (major === 15 && minor >= 13);
+export const rsaPssParams = !('electron' in process.versions) && (major >= 17 || (major === 16 && minor >= 9));
+export const jwkExport = major >= 16 || (major === 15 && minor >= 9);
+export const jwkImport = major >= 16 || (major === 15 && minor >= 12);

package/dist/node/esm/runtime/is_key_like.js

@@ -1,8 +1,8 @@
-import { isCryptoKey } from './webcrypto.js';
+import webcrypto, { isCryptoKey } from './webcrypto.js';
 import isKeyObject from './is_key_object.js';
 export default (key) => isKeyObject(key) || isCryptoKey(key);
 const types = ['KeyObject'];
-if (parseInt(process.versions.node) >= 16) {
+if (globalThis.CryptoKey || (webcrypto === null || webcrypto === void 0 ? void 0 : webcrypto.CryptoKey)) {
     types.push('CryptoKey');
 }
 export { types };

package/dist/node/esm/runtime/jwk_to_key.js

@@ -5,13 +5,9 @@ import { JOSENotSupported } from '../util/errors.js';
 import { setCurve } from './get_named_curve.js';
 import { setModulusLength } from './check_modulus_length.js';
 import Asn1SequenceEncoder from './asn1_sequence_encoder.js';
-const [major, minor] = process.version
-    .slice(1)
-    .split('.')
-    .map((str) => parseInt(str, 10));
-const jwkImportSupported = major >= 16 || (major === 15 && minor >= 12);
+import { jwkImport } from './flags.js';
 const parse = (jwk) => {
-    if (jwkImportSupported && jwk.kty !== 'oct') {
+    if (jwkImport && jwk.kty !== 'oct') {
         return jwk.d
             ? createPrivateKey({ format: 'jwk', key: jwk })
             : createPublicKey({ format: 'jwk', key: jwk });

package/dist/node/esm/runtime/key_to_jwk.js

@@ -7,11 +7,7 @@ import { isCryptoKey } from './webcrypto.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
 import { types } from './is_key_like.js';
-const [major, minor] = process.version
-    .slice(1)
-    .split('.')
-    .map((str) => parseInt(str, 10));
-const jwkExportSupported = major >= 16 || (major === 15 && minor >= 9);
+import { jwkExport } from './flags.js';
 const keyToJWK = (key) => {
     let keyObject;
     if (isCryptoKey(key)) {
@@ -32,7 +28,7 @@ const keyToJWK = (key) => {
     else {
         throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
     }
-    if (jwkExportSupported) {
+    if (jwkExport) {
         if (keyObject.type !== 'secret' &&
             !['rsa', 'ec', 'ed25519', 'x25519', 'ed448', 'x448'].includes(keyObject.asymmetricKeyType)) {
             throw new JOSENotSupported('Unsupported key asymmetricKeyType');

package/dist/node/esm/runtime/node_key.js

@@ -2,12 +2,7 @@ import { constants } from 'crypto';
 import getNamedCurve from './get_named_curve.js';
 import { JOSENotSupported } from '../util/errors.js';
 import checkModulusLength from './check_modulus_length.js';
-const [major, minor] = process.version
-    .slice(1)
-    .split('.')
-    .map((str) => parseInt(str, 10));
-const electron = 'electron' in process.versions;
-const rsaPssParams = !electron && (major >= 17 || (major === 16 && minor >= 9));
+import { rsaPssParams } from './flags.js';
 const PSS = {
     padding: constants.RSA_PKCS1_PSS_PADDING,
     saltLength: constants.RSA_PSS_SALTLEN_DIGEST,

package/dist/node/esm/runtime/verify.js

@@ -4,13 +4,9 @@ import nodeDigest from './dsa_digest.js';
 import nodeKey from './node_key.js';
 import sign from './sign.js';
 import getVerifyKey from './get_sign_verify_key.js';
-const [major, minor] = process.version
-    .slice(1)
-    .split('.')
-    .map((str) => parseInt(str, 10));
-const oneShotCallbackSupported = major >= 16 || (major === 15 && minor >= 13);
+import { oneShotCallback } from './flags.js';
 let oneShotVerify;
-if (crypto.verify.length > 4 && oneShotCallbackSupported) {
+if (crypto.verify.length > 4 && oneShotCallback) {
     oneShotVerify = promisify(crypto.verify);
 }
 else {

package/dist/node/esm/util/errors.js

@@ -1,4 +1,7 @@
 export class JOSEError extends Error {
+    static get code() {
+        return 'ERR_JOSE_GENERIC';
+    }
     constructor(message) {
         var _a;
         super(message);
@@ -6,31 +9,28 @@ export class JOSEError extends Error {
         this.name = this.constructor.name;
         (_a = Error.captureStackTrace) === null || _a === void 0 ? void 0 : _a.call(Error, this, this.constructor);
     }
-    static get code() {
-        return 'ERR_JOSE_GENERIC';
-    }
 }
 export class JWTClaimValidationFailed extends JOSEError {
+    static get code() {
+        return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
+    }
     constructor(message, claim = 'unspecified', reason = 'unspecified') {
         super(message);
         this.code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
         this.claim = claim;
         this.reason = reason;
     }
-    static get code() {
-        return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
-    }
 }
 export class JWTExpired extends JOSEError {
+    static get code() {
+        return 'ERR_JWT_EXPIRED';
+    }
     constructor(message, claim = 'unspecified', reason = 'unspecified') {
         super(message);
         this.code = 'ERR_JWT_EXPIRED';
         this.claim = claim;
         this.reason = reason;
     }
-    static get code() {
-        return 'ERR_JWT_EXPIRED';
-    }
 }
 export class JOSEAlgNotAllowed extends JOSEError {
     constructor() {

package/dist/types/jwk/embedded.d.ts

@@ -3,7 +3,7 @@ import type { FlattenedJWSInput, JWSHeaderParameters } from '../types';
  * EmbeddedJWK is an implementation of a GetKeyFunction intended to be used with the JWS/JWT verify
  * operations whenever you need to opt-in to verify signatures with a public key embedded in the
  * token's "jwk" (JSON Web Key) Header Parameter. It is recommended to combine this with the verify
- * algorithms option to whitelist JWS algorithms to accept.
+ * function's `algorithms` option to define accepted JWS "alg" (Algorithm) Header Parameter values.
  *
  * @example Usage
  *

package/dist/types/util/decode_protected_header.d.ts

@@ -1,5 +1,5 @@
 import type { JWSHeaderParameters, JWEHeaderParameters } from '../types';
-export declare type ProtectedHeaderParameters = JWSHeaderParameters & JWEHeaderParameters;
+export type ProtectedHeaderParameters = JWSHeaderParameters & JWEHeaderParameters;
 /**
  * Decodes the Protected Header of a JWE/JWS/JWT token utilizing any JOSE serialization.
  *

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "4.11.1",
+  "version": "4.11.3",
   "description": "'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "browser",