jose 4.11.4 → 4.12.1

package/README.md

@@ -38,7 +38,7 @@ const jose = require('jose')
 
 **`example`** Deno import
 ```js
-import * as jose from 'https://deno.land/x/jose@v4.11.4/index.ts'
+import * as jose from 'https://deno.land/x/jose@v4.12.1/index.ts'
 ```
 
 - JSON Web Tokens (JWT)

package/dist/browser/jwks/local.js

@@ -38,7 +38,7 @@ export class LocalJWKSet {
         this._jwks = clone(jwks);
     }
     async getKey(protectedHeader, token) {
-        const { alg, kid } = { ...protectedHeader, ...token.header };
+        const { alg, kid } = { ...protectedHeader, ...token === null || token === void 0 ? void 0 : token.header };
         const kty = getKtyFromAlg(alg);
         const candidates = this._jwks.keys.filter((jwk) => {
             let candidate = kty === jwk.kty;
@@ -80,18 +80,33 @@ export class LocalJWKSet {
             throw new JWKSNoMatchingKey();
         }
         else if (length !== 1) {
-            throw new JWKSMultipleMatchingKeys();
+            const error = new JWKSMultipleMatchingKeys();
+            const { _cached } = this;
+            error[Symbol.asyncIterator] = async function* () {
+                for (const jwk of candidates) {
+                    try {
+                        yield await importWithAlgCache(_cached, jwk, alg);
+                    }
+                    catch (_a) {
+                        continue;
+                    }
+                }
+            };
+            throw error;
         }
-        const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
-        if (cached[alg] === undefined) {
-            const keyObject = await importJWK({ ...jwk, ext: true }, alg);
-            if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
-                throw new JWKSInvalid('JSON Web Key Set members must be public keys');
-            }
-            cached[alg] = keyObject;
+        return importWithAlgCache(this._cached, jwk, alg);
+    }
+}
+async function importWithAlgCache(cache, jwk, alg) {
+    const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk);
+    if (cached[alg] === undefined) {
+        const keyObject = await importJWK({ ...jwk, ext: true }, alg);
+        if (keyObject.type !== 'public') {
+            throw new JWKSInvalid('JSON Web Key Set members must be public keys');
         }
-        return cached[alg];
+        cached[alg] = keyObject;
     }
+    return cached[alg];
 }
 export function createLocalJWKSet(jwks) {
     return LocalJWKSet.prototype.getKey.bind(new LocalJWKSet(jwks));

package/dist/browser/key/import.js

@@ -1,102 +1,25 @@
-import { decode as decodeBase64URL, encodeBase64, decodeBase64 } from '../runtime/base64url.js';
-import { fromSPKI as importPublic } from '../runtime/asn1.js';
-import { fromPKCS8 as importPrivate } from '../runtime/asn1.js';
+import { decode as decodeBase64URL } from '../runtime/base64url.js';
+import { fromSPKI, fromPKCS8, fromX509 } from '../runtime/asn1.js';
 import asKeyObject from '../runtime/jwk_to_key.js';
 import { JOSENotSupported } from '../util/errors.js';
-import formatPEM from '../lib/format_pem.js';
 import isObject from '../lib/is_object.js';
-function getElement(seq) {
-    let result = [];
-    let next = 0;
-    while (next < seq.length) {
-        let nextPart = parseElement(seq.subarray(next));
-        result.push(nextPart);
-        next += nextPart.byteLength;
-    }
-    return result;
-}
-function parseElement(bytes) {
-    let position = 0;
-    let tag = bytes[0] & 0x1f;
-    position++;
-    if (tag === 0x1f) {
-        tag = 0;
-        while (bytes[position] >= 0x80) {
-            tag = tag * 128 + bytes[position] - 0x80;
-            position++;
-        }
-        tag = tag * 128 + bytes[position] - 0x80;
-        position++;
-    }
-    let length = 0;
-    if (bytes[position] < 0x80) {
-        length = bytes[position];
-        position++;
-    }
-    else if (length === 0x80) {
-        length = 0;
-        while (bytes[position + length] !== 0 || bytes[position + length + 1] !== 0) {
-            if (length > bytes.byteLength) {
-                throw new TypeError('invalid indefinite form length');
-            }
-            length++;
-        }
-        const byteLength = position + length + 2;
-        return {
-            byteLength,
-            contents: bytes.subarray(position, position + length),
-            raw: bytes.subarray(0, byteLength),
-        };
-    }
-    else {
-        let numberOfDigits = bytes[position] & 0x7f;
-        position++;
-        length = 0;
-        for (let i = 0; i < numberOfDigits; i++) {
-            length = length * 256 + bytes[position];
-            position++;
-        }
-    }
-    const byteLength = position + length;
-    return {
-        byteLength,
-        contents: bytes.subarray(position, byteLength),
-        raw: bytes.subarray(0, byteLength),
-    };
-}
-function spkiFromX509(buf) {
-    const tbsCertificate = getElement(getElement(parseElement(buf).contents)[0].contents);
-    return encodeBase64(tbsCertificate[tbsCertificate[0].raw[0] === 0xa0 ? 6 : 5].raw);
-}
-function getSPKI(x509) {
-    const pem = x509.replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g, '');
-    const raw = decodeBase64(pem);
-    return formatPEM(spkiFromX509(raw), 'PUBLIC KEY');
-}
 export async function importSPKI(spki, alg, options) {
     if (typeof spki !== 'string' || spki.indexOf('-----BEGIN PUBLIC KEY-----') !== 0) {
         throw new TypeError('"spki" must be SPKI formatted string');
     }
-    return importPublic(spki, alg, options);
+    return fromSPKI(spki, alg, options);
 }
 export async function importX509(x509, alg, options) {
     if (typeof x509 !== 'string' || x509.indexOf('-----BEGIN CERTIFICATE-----') !== 0) {
         throw new TypeError('"x509" must be X.509 formatted string');
     }
-    let spki;
-    try {
-        spki = getSPKI(x509);
-    }
-    catch (cause) {
-        throw new TypeError('failed to parse the X.509 certificate', { cause });
-    }
-    return importPublic(spki, alg, options);
+    return fromX509(x509, alg, options);
 }
 export async function importPKCS8(pkcs8, alg, options) {
     if (typeof pkcs8 !== 'string' || pkcs8.indexOf('-----BEGIN PRIVATE KEY-----') !== 0) {
         throw new TypeError('"pkcs8" must be PKCS#8 formatted string');
     }
-    return importPrivate(pkcs8, alg, options);
+    return fromPKCS8(pkcs8, alg, options);
 }
 export async function importJWK(jwk, alg, octAsKeyObject) {
     var _a;
@@ -104,9 +27,6 @@ export async function importJWK(jwk, alg, octAsKeyObject) {
         throw new TypeError('JWK must be an object');
     }
     alg || (alg = jwk.alg);
-    if (typeof alg !== 'string' || !alg) {
-        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
-    }
     switch (jwk.kty) {
         case 'oct':
             if (typeof jwk.k !== 'string' || !jwk.k) {

package/dist/browser/runtime/asn1.js

@@ -1,7 +1,7 @@
 import { isCloudflareWorkers } from './env.js';
 import crypto, { isCryptoKey } from './webcrypto.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
-import { encodeBase64 } from './base64url.js';
+import { encodeBase64, decodeBase64 } from './base64url.js';
 import formatPEM from '../lib/format_pem.js';
 import { JOSENotSupported } from '../util/errors.js';
 import { types } from './is_key_like.js';
@@ -134,3 +134,81 @@ export const fromPKCS8 = (pem, alg, options) => {
 export const fromSPKI = (pem, alg, options) => {
     return genericImport(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g, 'spki', pem, alg, options);
 };
+function getElement(seq) {
+    let result = [];
+    let next = 0;
+    while (next < seq.length) {
+        let nextPart = parseElement(seq.subarray(next));
+        result.push(nextPart);
+        next += nextPart.byteLength;
+    }
+    return result;
+}
+function parseElement(bytes) {
+    let position = 0;
+    let tag = bytes[0] & 0x1f;
+    position++;
+    if (tag === 0x1f) {
+        tag = 0;
+        while (bytes[position] >= 0x80) {
+            tag = tag * 128 + bytes[position] - 0x80;
+            position++;
+        }
+        tag = tag * 128 + bytes[position] - 0x80;
+        position++;
+    }
+    let length = 0;
+    if (bytes[position] < 0x80) {
+        length = bytes[position];
+        position++;
+    }
+    else if (length === 0x80) {
+        length = 0;
+        while (bytes[position + length] !== 0 || bytes[position + length + 1] !== 0) {
+            if (length > bytes.byteLength) {
+                throw new TypeError('invalid indefinite form length');
+            }
+            length++;
+        }
+        const byteLength = position + length + 2;
+        return {
+            byteLength,
+            contents: bytes.subarray(position, position + length),
+            raw: bytes.subarray(0, byteLength),
+        };
+    }
+    else {
+        let numberOfDigits = bytes[position] & 0x7f;
+        position++;
+        length = 0;
+        for (let i = 0; i < numberOfDigits; i++) {
+            length = length * 256 + bytes[position];
+            position++;
+        }
+    }
+    const byteLength = position + length;
+    return {
+        byteLength,
+        contents: bytes.subarray(position, byteLength),
+        raw: bytes.subarray(0, byteLength),
+    };
+}
+function spkiFromX509(buf) {
+    const tbsCertificate = getElement(getElement(parseElement(buf).contents)[0].contents);
+    return encodeBase64(tbsCertificate[tbsCertificate[0].raw[0] === 0xa0 ? 6 : 5].raw);
+}
+function getSPKI(x509) {
+    const pem = x509.replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g, '');
+    const raw = decodeBase64(pem);
+    return formatPEM(spkiFromX509(raw), 'PUBLIC KEY');
+}
+export const fromX509 = (pem, alg, options) => {
+    let spki;
+    try {
+        spki = getSPKI(pem);
+    }
+    catch (cause) {
+        throw new TypeError('failed to parse the X.509 certificate', { cause });
+    }
+    return fromSPKI(spki, alg, options);
+};

package/dist/browser/runtime/jwk_to_key.js

@@ -124,6 +124,9 @@ function subtleMapping(jwk) {
 }
 const parse = async (jwk) => {
     var _a, _b;
+    if (!jwk.alg) {
+        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
+    }
     const { algorithm, keyUsages } = subtleMapping(jwk);
     const rest = [
         algorithm,

package/dist/browser/util/errors.js

@@ -125,6 +125,7 @@ export class JWKSMultipleMatchingKeys extends JOSEError {
         return 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
     }
 }
+Symbol.asyncIterator;
 export class JWKSTimeout extends JOSEError {
     constructor() {
         super(...arguments);

package/dist/node/cjs/jwks/local.js

@@ -42,7 +42,7 @@ class LocalJWKSet {
         this._jwks = clone(jwks);
     }
     async getKey(protectedHeader, token) {
-        const { alg, kid } = { ...protectedHeader, ...token.header };
+        const { alg, kid } = { ...protectedHeader, ...token === null || token === void 0 ? void 0 : token.header };
         const kty = getKtyFromAlg(alg);
         const candidates = this._jwks.keys.filter((jwk) => {
             let candidate = kty === jwk.kty;
@@ -84,20 +84,35 @@ class LocalJWKSet {
             throw new errors_js_1.JWKSNoMatchingKey();
         }
         else if (length !== 1) {
-            throw new errors_js_1.JWKSMultipleMatchingKeys();
-        }
-        const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
-        if (cached[alg] === undefined) {
-            const keyObject = await (0, import_js_1.importJWK)({ ...jwk, ext: true }, alg);
-            if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
-                throw new errors_js_1.JWKSInvalid('JSON Web Key Set members must be public keys');
-            }
-            cached[alg] = keyObject;
+            const error = new errors_js_1.JWKSMultipleMatchingKeys();
+            const { _cached } = this;
+            error[Symbol.asyncIterator] = async function* () {
+                for (const jwk of candidates) {
+                    try {
+                        yield await importWithAlgCache(_cached, jwk, alg);
+                    }
+                    catch {
+                        continue;
+                    }
+                }
+            };
+            throw error;
         }
-        return cached[alg];
+        return importWithAlgCache(this._cached, jwk, alg);
     }
 }
 exports.LocalJWKSet = LocalJWKSet;
+async function importWithAlgCache(cache, jwk, alg) {
+    const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk);
+    if (cached[alg] === undefined) {
+        const keyObject = await (0, import_js_1.importJWK)({ ...jwk, ext: true }, alg);
+        if (keyObject.type !== 'public') {
+            throw new errors_js_1.JWKSInvalid('JSON Web Key Set members must be public keys');
+        }
+        cached[alg] = keyObject;
+    }
+    return cached[alg];
+}
 function createLocalJWKSet(jwks) {
     return LocalJWKSet.prototype.getKey.bind(new LocalJWKSet(jwks));
 }

package/dist/node/cjs/key/import.js

@@ -3,79 +3,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.importJWK = exports.importPKCS8 = exports.importX509 = exports.importSPKI = void 0;
 const base64url_js_1 = require("../runtime/base64url.js");
 const asn1_js_1 = require("../runtime/asn1.js");
-const asn1_js_2 = require("../runtime/asn1.js");
 const jwk_to_key_js_1 = require("../runtime/jwk_to_key.js");
 const errors_js_1 = require("../util/errors.js");
-const format_pem_js_1 = require("../lib/format_pem.js");
 const is_object_js_1 = require("../lib/is_object.js");
-function getElement(seq) {
-    let result = [];
-    let next = 0;
-    while (next < seq.length) {
-        let nextPart = parseElement(seq.subarray(next));
-        result.push(nextPart);
-        next += nextPart.byteLength;
-    }
-    return result;
-}
-function parseElement(bytes) {
-    let position = 0;
-    let tag = bytes[0] & 0x1f;
-    position++;
-    if (tag === 0x1f) {
-        tag = 0;
-        while (bytes[position] >= 0x80) {
-            tag = tag * 128 + bytes[position] - 0x80;
-            position++;
-        }
-        tag = tag * 128 + bytes[position] - 0x80;
-        position++;
-    }
-    let length = 0;
-    if (bytes[position] < 0x80) {
-        length = bytes[position];
-        position++;
-    }
-    else if (length === 0x80) {
-        length = 0;
-        while (bytes[position + length] !== 0 || bytes[position + length + 1] !== 0) {
-            if (length > bytes.byteLength) {
-                throw new TypeError('invalid indefinite form length');
-            }
-            length++;
-        }
-        const byteLength = position + length + 2;
-        return {
-            byteLength,
-            contents: bytes.subarray(position, position + length),
-            raw: bytes.subarray(0, byteLength),
-        };
-    }
-    else {
-        let numberOfDigits = bytes[position] & 0x7f;
-        position++;
-        length = 0;
-        for (let i = 0; i < numberOfDigits; i++) {
-            length = length * 256 + bytes[position];
-            position++;
-        }
-    }
-    const byteLength = position + length;
-    return {
-        byteLength,
-        contents: bytes.subarray(position, byteLength),
-        raw: bytes.subarray(0, byteLength),
-    };
-}
-function spkiFromX509(buf) {
-    const tbsCertificate = getElement(getElement(parseElement(buf).contents)[0].contents);
-    return (0, base64url_js_1.encodeBase64)(tbsCertificate[tbsCertificate[0].raw[0] === 0xa0 ? 6 : 5].raw);
-}
-function getSPKI(x509) {
-    const pem = x509.replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g, '');
-    const raw = (0, base64url_js_1.decodeBase64)(pem);
-    return (0, format_pem_js_1.default)(spkiFromX509(raw), 'PUBLIC KEY');
-}
 async function importSPKI(spki, alg, options) {
     if (typeof spki !== 'string' || spki.indexOf('-----BEGIN PUBLIC KEY-----') !== 0) {
         throw new TypeError('"spki" must be SPKI formatted string');
@@ -87,21 +17,14 @@ async function importX509(x509, alg, options) {
     if (typeof x509 !== 'string' || x509.indexOf('-----BEGIN CERTIFICATE-----') !== 0) {
         throw new TypeError('"x509" must be X.509 formatted string');
     }
-    let spki;
-    try {
-        spki = getSPKI(x509);
-    }
-    catch (cause) {
-        throw new TypeError('failed to parse the X.509 certificate', { cause });
-    }
-    return (0, asn1_js_1.fromSPKI)(spki, alg, options);
+    return (0, asn1_js_1.fromX509)(x509, alg, options);
 }
 exports.importX509 = importX509;
 async function importPKCS8(pkcs8, alg, options) {
     if (typeof pkcs8 !== 'string' || pkcs8.indexOf('-----BEGIN PRIVATE KEY-----') !== 0) {
         throw new TypeError('"pkcs8" must be PKCS#8 formatted string');
     }
-    return (0, asn1_js_2.fromPKCS8)(pkcs8, alg, options);
+    return (0, asn1_js_1.fromPKCS8)(pkcs8, alg, options);
 }
 exports.importPKCS8 = importPKCS8;
 async function importJWK(jwk, alg, octAsKeyObject) {
@@ -110,9 +33,6 @@ async function importJWK(jwk, alg, octAsKeyObject) {
         throw new TypeError('JWK must be an object');
     }
     alg || (alg = jwk.alg);
-    if (typeof alg !== 'string' || !alg) {
-        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
-    }
     switch (jwk.kty) {
         case 'oct':
             if (typeof jwk.k !== 'string' || !jwk.k) {

package/dist/node/cjs/runtime/asn1.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.fromSPKI = exports.fromPKCS8 = exports.toPKCS8 = exports.toSPKI = void 0;
+exports.fromX509 = exports.fromSPKI = exports.fromPKCS8 = exports.toPKCS8 = exports.toSPKI = void 0;
 const crypto_1 = require("crypto");
 const buffer_1 = require("buffer");
 const webcrypto_js_1 = require("./webcrypto.js");
@@ -46,3 +46,9 @@ const fromSPKI = (pem) => (0, crypto_1.createPublicKey)({
     format: 'der',
 });
 exports.fromSPKI = fromSPKI;
+const fromX509 = (pem) => (0, crypto_1.createPublicKey)({
+    key: pem,
+    type: 'spki',
+    format: 'pem',
+});
+exports.fromX509 = fromX509;

package/dist/node/cjs/util/errors.js

@@ -141,6 +141,7 @@ class JWKSMultipleMatchingKeys extends JOSEError {
     }
 }
 exports.JWKSMultipleMatchingKeys = JWKSMultipleMatchingKeys;
+Symbol.asyncIterator;
 class JWKSTimeout extends JOSEError {
     constructor() {
         super(...arguments);

package/dist/node/esm/jwks/local.js

@@ -38,7 +38,7 @@ export class LocalJWKSet {
         this._jwks = clone(jwks);
     }
     async getKey(protectedHeader, token) {
-        const { alg, kid } = { ...protectedHeader, ...token.header };
+        const { alg, kid } = { ...protectedHeader, ...token === null || token === void 0 ? void 0 : token.header };
         const kty = getKtyFromAlg(alg);
         const candidates = this._jwks.keys.filter((jwk) => {
             let candidate = kty === jwk.kty;
@@ -80,18 +80,33 @@ export class LocalJWKSet {
             throw new JWKSNoMatchingKey();
         }
         else if (length !== 1) {
-            throw new JWKSMultipleMatchingKeys();
+            const error = new JWKSMultipleMatchingKeys();
+            const { _cached } = this;
+            error[Symbol.asyncIterator] = async function* () {
+                for (const jwk of candidates) {
+                    try {
+                        yield await importWithAlgCache(_cached, jwk, alg);
+                    }
+                    catch {
+                        continue;
+                    }
+                }
+            };
+            throw error;
         }
-        const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
-        if (cached[alg] === undefined) {
-            const keyObject = await importJWK({ ...jwk, ext: true }, alg);
-            if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
-                throw new JWKSInvalid('JSON Web Key Set members must be public keys');
-            }
-            cached[alg] = keyObject;
+        return importWithAlgCache(this._cached, jwk, alg);
+    }
+}
+async function importWithAlgCache(cache, jwk, alg) {
+    const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk);
+    if (cached[alg] === undefined) {
+        const keyObject = await importJWK({ ...jwk, ext: true }, alg);
+        if (keyObject.type !== 'public') {
+            throw new JWKSInvalid('JSON Web Key Set members must be public keys');
         }
-        return cached[alg];
+        cached[alg] = keyObject;
     }
+    return cached[alg];
 }
 export function createLocalJWKSet(jwks) {
     return LocalJWKSet.prototype.getKey.bind(new LocalJWKSet(jwks));

package/dist/node/esm/key/import.js

@@ -1,102 +1,25 @@
-import { decode as decodeBase64URL, encodeBase64, decodeBase64 } from '../runtime/base64url.js';
-import { fromSPKI as importPublic } from '../runtime/asn1.js';
-import { fromPKCS8 as importPrivate } from '../runtime/asn1.js';
+import { decode as decodeBase64URL } from '../runtime/base64url.js';
+import { fromSPKI, fromPKCS8, fromX509 } from '../runtime/asn1.js';
 import asKeyObject from '../runtime/jwk_to_key.js';
 import { JOSENotSupported } from '../util/errors.js';
-import formatPEM from '../lib/format_pem.js';
 import isObject from '../lib/is_object.js';
-function getElement(seq) {
-    let result = [];
-    let next = 0;
-    while (next < seq.length) {
-        let nextPart = parseElement(seq.subarray(next));
-        result.push(nextPart);
-        next += nextPart.byteLength;
-    }
-    return result;
-}
-function parseElement(bytes) {
-    let position = 0;
-    let tag = bytes[0] & 0x1f;
-    position++;
-    if (tag === 0x1f) {
-        tag = 0;
-        while (bytes[position] >= 0x80) {
-            tag = tag * 128 + bytes[position] - 0x80;
-            position++;
-        }
-        tag = tag * 128 + bytes[position] - 0x80;
-        position++;
-    }
-    let length = 0;
-    if (bytes[position] < 0x80) {
-        length = bytes[position];
-        position++;
-    }
-    else if (length === 0x80) {
-        length = 0;
-        while (bytes[position + length] !== 0 || bytes[position + length + 1] !== 0) {
-            if (length > bytes.byteLength) {
-                throw new TypeError('invalid indefinite form length');
-            }
-            length++;
-        }
-        const byteLength = position + length + 2;
-        return {
-            byteLength,
-            contents: bytes.subarray(position, position + length),
-            raw: bytes.subarray(0, byteLength),
-        };
-    }
-    else {
-        let numberOfDigits = bytes[position] & 0x7f;
-        position++;
-        length = 0;
-        for (let i = 0; i < numberOfDigits; i++) {
-            length = length * 256 + bytes[position];
-            position++;
-        }
-    }
-    const byteLength = position + length;
-    return {
-        byteLength,
-        contents: bytes.subarray(position, byteLength),
-        raw: bytes.subarray(0, byteLength),
-    };
-}
-function spkiFromX509(buf) {
-    const tbsCertificate = getElement(getElement(parseElement(buf).contents)[0].contents);
-    return encodeBase64(tbsCertificate[tbsCertificate[0].raw[0] === 0xa0 ? 6 : 5].raw);
-}
-function getSPKI(x509) {
-    const pem = x509.replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g, '');
-    const raw = decodeBase64(pem);
-    return formatPEM(spkiFromX509(raw), 'PUBLIC KEY');
-}
 export async function importSPKI(spki, alg, options) {
     if (typeof spki !== 'string' || spki.indexOf('-----BEGIN PUBLIC KEY-----') !== 0) {
         throw new TypeError('"spki" must be SPKI formatted string');
     }
-    return importPublic(spki, alg, options);
+    return fromSPKI(spki, alg, options);
 }
 export async function importX509(x509, alg, options) {
     if (typeof x509 !== 'string' || x509.indexOf('-----BEGIN CERTIFICATE-----') !== 0) {
         throw new TypeError('"x509" must be X.509 formatted string');
     }
-    let spki;
-    try {
-        spki = getSPKI(x509);
-    }
-    catch (cause) {
-        throw new TypeError('failed to parse the X.509 certificate', { cause });
-    }
-    return importPublic(spki, alg, options);
+    return fromX509(x509, alg, options);
 }
 export async function importPKCS8(pkcs8, alg, options) {
     if (typeof pkcs8 !== 'string' || pkcs8.indexOf('-----BEGIN PRIVATE KEY-----') !== 0) {
         throw new TypeError('"pkcs8" must be PKCS#8 formatted string');
     }
-    return importPrivate(pkcs8, alg, options);
+    return fromPKCS8(pkcs8, alg, options);
 }
 export async function importJWK(jwk, alg, octAsKeyObject) {
     var _a;
@@ -104,9 +27,6 @@ export async function importJWK(jwk, alg, octAsKeyObject) {
         throw new TypeError('JWK must be an object');
     }
     alg || (alg = jwk.alg);
-    if (typeof alg !== 'string' || !alg) {
-        throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
-    }
     switch (jwk.kty) {
         case 'oct':
             if (typeof jwk.k !== 'string' || !jwk.k) {

package/dist/node/esm/runtime/asn1.js

@@ -39,3 +39,8 @@ export const fromSPKI = (pem) => createPublicKey({
     type: 'spki',
     format: 'der',
 });
+export const fromX509 = (pem) => createPublicKey({
+    key: pem,
+    type: 'spki',
+    format: 'pem',
+});

package/dist/node/esm/util/errors.js

@@ -125,6 +125,7 @@ export class JWKSMultipleMatchingKeys extends JOSEError {
         return 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
     }
 }
+Symbol.asyncIterator;
 export class JWKSTimeout extends JOSEError {
     constructor() {
         super(...arguments);

package/dist/types/jwks/local.d.ts

@@ -1,4 +1,4 @@
-import type { KeyLike, JWSHeaderParameters, JSONWebKeySet, FlattenedJWSInput, GetKeyFunction } from '../types';
+import type { KeyLike, JWSHeaderParameters, JSONWebKeySet, FlattenedJWSInput } from '../types';
 /** @private */
 export declare function isJWKSLike(jwks: unknown): jwks is JSONWebKeySet;
 /** @private */
@@ -6,13 +6,20 @@ export declare class LocalJWKSet {
     protected _jwks?: JSONWebKeySet;
     private _cached;
     constructor(jwks: unknown);
-    getKey(protectedHeader: JWSHeaderParameters, token: FlattenedJWSInput): Promise<KeyLike>;
+    getKey(protectedHeader?: JWSHeaderParameters, token?: FlattenedJWSInput): Promise<KeyLike>;
 }
 /**
  * Returns a function that resolves to a key object from a locally stored, or otherwise available,
  * JSON Web Key Set.
  *
- * Only a single public key must match the selection process.
+ * It uses the "alg" (JWS Algorithm) Header Parameter to determine the right JWK "kty" (Key Type),
+ * then proceeds to match the JWK "kid" (Key ID) with one found in the JWS Header Parameters (if
+ * there is one) while also respecting the JWK "use" (Public Key Use) and JWK "key_ops" (Key
+ * Operations) Parameters (if they are present on the JWK).
+ *
+ * Only a single public key must match the selection process. As shown in the example below when
+ * multiple keys get matched it is possible to opt-in to iterate over the matched keys and attempt
+ * verification in an iterative manner.
  *
  * @example Usage
  *
@@ -43,6 +50,36 @@ export declare class LocalJWKSet {
  * console.log(payload)
  * ```
  *
+ * @example Opting-in to multiple JWKS matches using `createLocalJWKSet`
+ *
+ * ```js
+ * const options = {
+ *   issuer: 'urn:example:issuer',
+ *   audience: 'urn:example:audience',
+ * }
+ * const { payload, protectedHeader } = await jose
+ *   .jwtVerify(jwt, JWKS, options)
+ *   .catch(async (error) => {
+ *     if (error?.code === 'ERR_JWKS_MULTIPLE_MATCHING_KEYS') {
+ *       for await (const publicKey of error) {
+ *         try {
+ *           return await jose.jwtVerify(jwt, publicKey, options)
+ *         } catch (innerError) {
+ *           if (innerError?.code === 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED') {
+ *             continue
+ *           }
+ *           throw innerError
+ *         }
+ *       }
+ *       throw new jose.errors.JWSSignatureVerificationFailed()
+ *     }
+ *
+ *     throw error
+ *   })
+ * console.log(protectedHeader)
+ * console.log(payload)
+ * ```
+ *
  * @param jwks JSON Web Key Set formatted object.
  */
-export declare function createLocalJWKSet(jwks: JSONWebKeySet): GetKeyFunction<JWSHeaderParameters, FlattenedJWSInput>;
+export declare function createLocalJWKSet(jwks: JSONWebKeySet): (protectedHeader?: JWSHeaderParameters | undefined, token?: FlattenedJWSInput | undefined) => Promise<KeyLike>;

package/dist/types/jwks/remote.d.ts

@@ -1,4 +1,4 @@
-import type { JWSHeaderParameters, FlattenedJWSInput, GetKeyFunction } from '../types';
+import type { KeyLike, JWSHeaderParameters, FlattenedJWSInput } from '../types';
 /** Options for the remote JSON Web Key Set. */
 export interface RemoteJWKSetOptions {
     /**
@@ -30,10 +30,18 @@ export interface RemoteJWKSetOptions {
 }
 /**
  * Returns a function that resolves to a key object downloaded from a remote endpoint returning a
- * JSON Web Key Set, that is, for example, an OAuth 2.0 or OIDC jwks_uri. Only a single public key
- * must match the selection process. The JSON Web Key Set is fetched when no key matches the
- * selection process but only as frequently as the `cooldownDuration` option allows, to prevent
- * abuse.
+ * JSON Web Key Set, that is, for example, an OAuth 2.0 or OIDC jwks_uri. The JSON Web Key Set is
+ * fetched when no key matches the selection process but only as frequently as the
+ * `cooldownDuration` option allows to prevent abuse.
+ *
+ * It uses the "alg" (JWS Algorithm) Header Parameter to determine the right JWK "kty" (Key Type),
+ * then proceeds to match the JWK "kid" (Key ID) with one found in the JWS Header Parameters (if
+ * there is one) while also respecting the JWK "use" (Public Key Use) and JWK "key_ops" (Key
+ * Operations) Parameters (if they are present on the JWK).
+ *
+ * Only a single public key must match the selection process. As shown in the example below when
+ * multiple keys get matched it is possible to opt-in to iterate over the matched keys and attempt
+ * verification in an iterative manner.
  *
  * @example Usage
  *
@@ -48,7 +56,37 @@ export interface RemoteJWKSetOptions {
  * console.log(payload)
  * ```
  *
+ * @example Opting-in to multiple JWKS matches using `createRemoteJWKSet`
+ *
+ * ```js
+ * const options = {
+ *   issuer: 'urn:example:issuer',
+ *   audience: 'urn:example:audience',
+ * }
+ * const { payload, protectedHeader } = await jose
+ *   .jwtVerify(jwt, JWKS, options)
+ *   .catch(async (error) => {
+ *     if (error?.code === 'ERR_JWKS_MULTIPLE_MATCHING_KEYS') {
+ *       for await (const publicKey of error) {
+ *         try {
+ *           return await jose.jwtVerify(jwt, publicKey, options)
+ *         } catch (innerError) {
+ *           if (innerError?.code === 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED') {
+ *             continue
+ *           }
+ *           throw innerError
+ *         }
+ *       }
+ *       throw new jose.errors.JWSSignatureVerificationFailed()
+ *     }
+ *
+ *     throw error
+ *   })
+ * console.log(protectedHeader)
+ * console.log(payload)
+ * ```
+ *
  * @param url URL to fetch the JSON Web Key Set from.
  * @param options Options for the remote JSON Web Key Set.
  */
-export declare function createRemoteJWKSet(url: URL, options?: RemoteJWKSetOptions): GetKeyFunction<JWSHeaderParameters, FlattenedJWSInput>;
+export declare function createRemoteJWKSet(url: URL, options?: RemoteJWKSetOptions): (protectedHeader?: JWSHeaderParameters | undefined, token?: FlattenedJWSInput | undefined) => Promise<KeyLike>;

package/dist/types/jwt/sign.d.ts

@@ -53,7 +53,7 @@ import { ProduceJWT } from './produce';
  * 59lLWBCsocvvbd1cvDMNlRywAAyhsCb1SuX4nEAK9mrSBdfmoF2Nm3eilfsOds0f
  * K5mX069IKG82CMqh3Mzptd7e7lyb9lsoGO0BAtjho3cWtha/UZ70vfaMzGuZ6JmQ
  * ak6k+8+UFd93M4z0Qo74OhXB
- * -----END PRIVATE KEY----`
+ * -----END PRIVATE KEY-----`
  * const privateKey = await jose.importPKCS8(pkcs8, alg)
  *
  * const jwt = await new jose.SignJWT({ 'urn:example:claim': true })

package/dist/types/key/generate_key_pair.d.ts

@@ -17,7 +17,7 @@ export interface GenerateKeyPairOptions {
      */
     modulusLength?: number;
     /**
-     * (Web Cryptography API specific) The value to use as
+     * (Only effective in Web Crypto API runtimes) The value to use as
      * [SubtleCrypto.generateKey()](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/generateKey)
      * `extractable` argument. Default is false.
      */
@@ -27,7 +27,7 @@ export interface GenerateKeyPairOptions {
  * Generates a private and a public key for a given JWA algorithm identifier. This can only generate
  * asymmetric key pairs. For symmetric secrets use the `generateSecret` function.
  *
- * Note: Under Web Cryptography API runtime the `privateKey` is generated with `extractable` set to
+ * Note: Under Web Crypto API runtime the `privateKey` is generated with `extractable` set to
  * `false` by default.
  *
  * @example Usage

package/dist/types/key/generate_secret.d.ts

@@ -1,7 +1,7 @@
 import type { KeyLike } from '../types';
 export interface GenerateSecretOptions {
     /**
-     * (Web Cryptography API specific) The value to use as
+     * (Only effective in Web Crypto API runtimes) The value to use as
      * [SubtleCrypto.generateKey()](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/generateKey)
      * `extractable` argument. Default is false.
      */
@@ -10,8 +10,8 @@ export interface GenerateSecretOptions {
 /**
  * Generates a symmetric secret key for a given JWA algorithm identifier.
  *
- * Note: Under Web Cryptography API runtime the secret key is generated with `extractable` set to
- * `false` by default.
+ * Note: Under Web Crypto API runtime the secret key is generated with `extractable` set to `false`
+ * by default.
  *
  * @example Usage
  *

package/dist/types/key/import.d.ts

@@ -1,7 +1,7 @@
 import type { JWK, KeyLike } from '../types';
 export interface PEMImportOptions {
     /**
-     * (Web Cryptography API specific) The value to use as
+     * (Only effective in Web Crypto API runtimes) The value to use as
      * [SubtleCrypto.importKey()](https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey)
      * `extractable` argument. Default is false.
      */
@@ -24,7 +24,8 @@ export interface PEMImportOptions {
  * ```
  *
  * @param pem PEM-encoded SPKI string
- * @param alg JSON Web Algorithm identifier to be used with the imported key.
+ * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used
+ *   with the imported key, its presence is only enforced in Web Crypto API runtimes.
  */
 export declare function importSPKI(spki: string, alg: string, options?: PEMImportOptions): Promise<KeyLike>;
 /**
@@ -51,7 +52,8 @@ export declare function importSPKI(spki: string, alg: string, options?: PEMImpor
  * ```
  *
  * @param pem X.509 certificate string
- * @param alg JSON Web Algorithm identifier to be used with the imported key.
+ * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used
+ *   with the imported key, its presence is only enforced in Web Crypto API runtimes.
  */
 export declare function importX509(x509: string, alg: string, options?: PEMImportOptions): Promise<KeyLike>;
 /**
@@ -72,7 +74,8 @@ export declare function importX509(x509: string, alg: string, options?: PEMImpor
  * ```
  *
  * @param pem PEM-encoded PKCS#8 string
- * @param alg JSON Web Algorithm identifier to be used with the imported key.
+ * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used
+ *   with the imported key, its presence is only enforced in Web Crypto API runtimes.
  */
 export declare function importPKCS8(pkcs8: string, alg: string, options?: PEMImportOptions): Promise<KeyLike>;
 /**
@@ -107,8 +110,9 @@ export declare function importPKCS8(pkcs8: string, alg: string, options?: PEMImp
  * ```
  *
  * @param jwk JSON Web Key.
- * @param alg JSON Web Algorithm identifier to be used with the imported key. Default is the "alg"
- *   property on the JWK.
+ * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used
+ *   with the imported key. Default is the "alg" property on the JWK, its presence is only enforced
+ *   in Web Crypto API runtimes.
  * @param octAsKeyObject Forces a symmetric key to be imported to a KeyObject or CryptoKey. Default
  *   is true unless JWK "ext" (Extractable) is true.
  */

package/dist/types/types.d.ts

@@ -36,7 +36,7 @@
  * const ecPublicKey = await jose.importSPKI(spki, algorithm)
  * ```
  *
- * @example Import a X.509 Certificate
+ * @example Import SPKI from an X.509 Certificate
  *
  * ```js
  * const algorithm = 'ES256'

package/dist/types/util/errors.d.ts

@@ -1,3 +1,4 @@
+import type { KeyLike } from '../types';
 /** A generic Error subclass that all other specific JOSE Error subclasses inherit from. */
 export declare class JOSEError extends Error {
     /** A unique error code for the particular error subclass. */
@@ -78,6 +79,8 @@ export declare class JWKSNoMatchingKey extends JOSEError {
 }
 /** An error subclass thrown when multiple keys match from a JWKS. */
 export declare class JWKSMultipleMatchingKeys extends JOSEError {
+    /** @ignore */
+    [Symbol.asyncIterator]: () => AsyncIterableIterator<KeyLike>;
     static get code(): 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
     code: string;
     message: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "4.11.4",
+  "version": "4.12.1",
   "description": "'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "browser",

package/dist/node/cjs/lib/format_pem.js

@@ -1,6 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.default = (b64, descriptor) => {
-    const newlined = (b64.match(/.{1,64}/g) || []).join('\n');
-    return `-----BEGIN ${descriptor}-----\n${newlined}\n-----END ${descriptor}-----`;
-};

package/dist/node/esm/lib/format_pem.js

@@ -1,4 +0,0 @@
-export default (b64, descriptor) => {
-    const newlined = (b64.match(/.{1,64}/g) || []).join('\n');
-    return `-----BEGIN ${descriptor}-----\n${newlined}\n-----END ${descriptor}-----`;
-};