jose 4.2.1 → 4.3.4

package/README.md

@@ -25,6 +25,21 @@ If you or your business use `jose`, please consider becoming a [sponsor][support
 
 ## Documentation
 
+**`example`** ESM import
+```js
+import * as jose from 'jose'
+```
+
+**`example`** CJS require
+```js
+const jose = require('jose')
+```
+
+**`example`** Deno import
+```js
+import * as jose from 'https://deno.land/x/jose/index.ts'
+```
+
 - JSON Web Tokens (JWT)
   - [Signing](docs/classes/jwt_sign.SignJWT.md#readme)
   - [Verification & Claims Set Validation](docs/functions/jwt_verify.jwtVerify.md#readme)

package/dist/browser/jwe/general/encrypt.js

@@ -5,16 +5,28 @@ import isDisjoint from '../../lib/is_disjoint.js';
 import encryptKeyManagement from '../../lib/encrypt_key_management.js';
 import { encode as base64url } from '../../runtime/base64url.js';
 import validateCrit from '../../lib/validate_crit.js';
-const recipientRef = new WeakMap();
 class IndividualRecipient {
+    constructor(enc, key, options) {
+        this.parent = enc;
+        this.key = key;
+        this.options = options;
+    }
     setUnprotectedHeader(unprotectedHeader) {
-        const ref = recipientRef.get(this);
-        if (ref.unprotectedHeader) {
+        if (this.unprotectedHeader) {
             throw new TypeError('setUnprotectedHeader can only be called once');
         }
-        ref.unprotectedHeader = unprotectedHeader;
+        this.unprotectedHeader = unprotectedHeader;
         return this;
     }
+    addRecipient(...args) {
+        return this.parent.addRecipient(...args);
+    }
+    encrypt(...args) {
+        return this.parent.encrypt(...args);
+    }
+    done() {
+        return this.parent;
+    }
 }
 export class GeneralEncrypt {
     constructor(plaintext) {
@@ -22,8 +34,7 @@ export class GeneralEncrypt {
         this._plaintext = plaintext;
     }
     addRecipient(key, options) {
-        const recipient = new IndividualRecipient();
-        recipientRef.set(recipient, { key, options: { crit: options === null || options === void 0 ? void 0 : options.crit } });
+        const recipient = new IndividualRecipient(this, key, { crit: options === null || options === void 0 ? void 0 : options.crit });
         this._recipients.push(recipient);
         return recipient;
     }
@@ -46,19 +57,19 @@ export class GeneralEncrypt {
         return this;
     }
     async encrypt(options) {
-        var _a, _b;
+        var _a, _b, _c;
         if (!this._recipients.length) {
             throw new JWEInvalid('at least one recipient must be added');
         }
         options = { deflateRaw: options === null || options === void 0 ? void 0 : options.deflateRaw };
         if (this._recipients.length === 1) {
-            const { unprotectedHeader, options: recipientOpts, key, } = recipientRef.get(this._recipients[0]);
+            const [recipient] = this._recipients;
             const flattened = await new FlattenedEncrypt(this._plaintext)
                 .setAdditionalAuthenticatedData(this._aad)
                 .setProtectedHeader(this._protectedHeader)
                 .setSharedUnprotectedHeader(this._unprotectedHeader)
-                .setUnprotectedHeader(unprotectedHeader)
-                .encrypt(key, { ...recipientOpts, ...options });
+                .setUnprotectedHeader(recipient.unprotectedHeader)
+                .encrypt(recipient.key, { ...recipient.options, ...options });
             let jwe = {
                 ciphertext: flattened.ciphertext,
                 iv: flattened.iv,
@@ -80,14 +91,13 @@ export class GeneralEncrypt {
         let enc;
         for (let i = 0; i < this._recipients.length; i++) {
             const recipient = this._recipients[i];
-            const { unprotectedHeader, options: recipientOpts } = recipientRef.get(recipient);
-            if (!isDisjoint(this._protectedHeader, this._unprotectedHeader, unprotectedHeader)) {
+            if (!isDisjoint(this._protectedHeader, this._unprotectedHeader, recipient.unprotectedHeader)) {
                 throw new JWEInvalid('JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint');
             }
             const joseHeader = {
                 ...this._protectedHeader,
                 ...this._unprotectedHeader,
-                ...unprotectedHeader,
+                ...recipient.unprotectedHeader,
             };
             const { alg } = joseHeader;
             if (typeof alg !== 'string' || !alg) {
@@ -105,7 +115,7 @@ export class GeneralEncrypt {
             else if (enc !== joseHeader.enc) {
                 throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');
             }
-            validateCrit(JWEInvalid, new Map(), recipientOpts === null || recipientOpts === void 0 ? void 0 : recipientOpts.crit, this._protectedHeader, joseHeader);
+            validateCrit(JWEInvalid, new Map(), recipient.options.crit, this._protectedHeader, joseHeader);
             if (joseHeader.zip !== undefined) {
                 if (!this._protectedHeader || !this._protectedHeader.zip) {
                     throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
@@ -123,15 +133,18 @@ export class GeneralEncrypt {
             const recipient = this._recipients[i];
             const target = {};
             jwe.recipients.push(target);
-            const { unprotectedHeader, options: recipientOpts, key } = recipientRef.get(recipient);
             if (i === 0) {
                 const flattened = await new FlattenedEncrypt(this._plaintext)
                     .setAdditionalAuthenticatedData(this._aad)
                     .setContentEncryptionKey(cek)
                     .setProtectedHeader(this._protectedHeader)
                     .setSharedUnprotectedHeader(this._unprotectedHeader)
-                    .setUnprotectedHeader(unprotectedHeader)
-                    .encrypt(key, { ...recipientOpts, ...options, [unprotected]: true });
+                    .setUnprotectedHeader(recipient.unprotectedHeader)
+                    .encrypt(recipient.key, {
+                    ...recipient.options,
+                    ...options,
+                    [unprotected]: true,
+                });
                 jwe.ciphertext = flattened.ciphertext;
                 jwe.iv = flattened.iv;
                 jwe.tag = flattened.tag;
@@ -146,10 +159,12 @@ export class GeneralEncrypt {
                     target.header = flattened.header;
                 continue;
             }
-            const { encryptedKey, parameters } = await encryptKeyManagement((unprotectedHeader === null || unprotectedHeader === void 0 ? void 0 : unprotectedHeader.alg) || ((_a = this._protectedHeader) === null || _a === void 0 ? void 0 : _a.alg) || ((_b = this._unprotectedHeader) === null || _b === void 0 ? void 0 : _b.alg), enc, key, cek);
+            const { encryptedKey, parameters } = await encryptKeyManagement(((_a = recipient.unprotectedHeader) === null || _a === void 0 ? void 0 : _a.alg) ||
+                ((_b = this._protectedHeader) === null || _b === void 0 ? void 0 : _b.alg) ||
+                ((_c = this._unprotectedHeader) === null || _c === void 0 ? void 0 : _c.alg), enc, recipient.key, cek);
             target.encrypted_key = base64url(encryptedKey);
-            if (unprotectedHeader || parameters)
-                target.header = { ...unprotectedHeader, ...parameters };
+            if (recipient.unprotectedHeader || parameters)
+                target.header = { ...recipient.unprotectedHeader, ...parameters };
         }
         return jwe;
     }

package/dist/browser/jwks/remote.js

@@ -37,17 +37,21 @@ class RemoteJWKSet {
         }
         return Date.now() < this._cooldownStarted + this._cooldownDuration;
     }
-    async getKey(protectedHeader) {
+    async getKey(protectedHeader, token) {
+        const joseHeader = {
+            ...protectedHeader,
+            ...token.header,
+        };
         if (!this._jwks) {
             await this.reload();
         }
         const candidates = this._jwks.keys.filter((jwk) => {
-            let candidate = jwk.kty === getKtyFromAlg(protectedHeader.alg);
-            if (candidate && typeof protectedHeader.kid === 'string') {
-                candidate = protectedHeader.kid === jwk.kid;
+            let candidate = jwk.kty === getKtyFromAlg(joseHeader.alg);
+            if (candidate && typeof joseHeader.kid === 'string') {
+                candidate = joseHeader.kid === jwk.kid;
             }
             if (candidate && typeof jwk.alg === 'string') {
-                candidate = protectedHeader.alg === jwk.alg;
+                candidate = joseHeader.alg === jwk.alg;
             }
             if (candidate && typeof jwk.use === 'string') {
                 candidate = jwk.use === 'sig';
@@ -55,11 +59,11 @@ class RemoteJWKSet {
             if (candidate && Array.isArray(jwk.key_ops)) {
                 candidate = jwk.key_ops.includes('verify');
             }
-            if (candidate && protectedHeader.alg === 'EdDSA') {
+            if (candidate && joseHeader.alg === 'EdDSA') {
                 candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
             }
             if (candidate) {
-                switch (protectedHeader.alg) {
+                switch (joseHeader.alg) {
                     case 'ES256':
                         candidate = jwk.crv === 'P-256';
                         break;
@@ -81,7 +85,7 @@ class RemoteJWKSet {
         if (length === 0) {
             if (this.coolingDown() === false) {
                 await this.reload();
-                return this.getKey(protectedHeader);
+                return this.getKey(protectedHeader, token);
             }
             throw new JWKSNoMatchingKey();
         }
@@ -89,14 +93,14 @@ class RemoteJWKSet {
             throw new JWKSMultipleMatchingKeys();
         }
         const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
-        if (cached[protectedHeader.alg] === undefined) {
-            const keyObject = await importJWK({ ...jwk, ext: true }, protectedHeader.alg);
+        if (cached[joseHeader.alg] === undefined) {
+            const keyObject = await importJWK({ ...jwk, ext: true }, joseHeader.alg);
             if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
                 throw new JWKSInvalid('JSON Web Key Set members must be public keys');
             }
-            cached[protectedHeader.alg] = keyObject;
+            cached[joseHeader.alg] = keyObject;
         }
-        return cached[protectedHeader.alg];
+        return cached[joseHeader.alg];
     }
     async reload() {
         if (!this._pendingFetch) {

package/dist/browser/jws/compact/verify.js

@@ -12,11 +12,7 @@ export async function compactVerify(jws, key, options) {
     if (length !== 3) {
         throw new JWSInvalid('Invalid Compact JWS');
     }
-    const verified = await flattenedVerify({
-        payload: (payload || undefined),
-        protected: protectedHeader || undefined,
-        signature: (signature || undefined),
-    }, key, options);
+    const verified = await flattenedVerify({ payload, protected: protectedHeader, signature }, key, options);
     const result = { payload: verified.payload, protectedHeader: verified.protectedHeader };
     if (typeof key === 'function') {
         return { ...result, key: verified.key };

package/dist/browser/jws/general/sign.js

@@ -1,23 +1,34 @@
 import { FlattenedSign } from '../flattened/sign.js';
 import { JWSInvalid } from '../../util/errors.js';
-const signatureRef = new WeakMap();
 class IndividualSignature {
+    constructor(sig, key, options) {
+        this.parent = sig;
+        this.key = key;
+        this.options = options;
+    }
     setProtectedHeader(protectedHeader) {
-        const ref = signatureRef.get(this);
-        if (ref.protectedHeader) {
+        if (this.protectedHeader) {
             throw new TypeError('setProtectedHeader can only be called once');
         }
-        ref.protectedHeader = protectedHeader;
+        this.protectedHeader = protectedHeader;
         return this;
     }
     setUnprotectedHeader(unprotectedHeader) {
-        const ref = signatureRef.get(this);
-        if (ref.unprotectedHeader) {
+        if (this.unprotectedHeader) {
             throw new TypeError('setUnprotectedHeader can only be called once');
         }
-        ref.unprotectedHeader = unprotectedHeader;
+        this.unprotectedHeader = unprotectedHeader;
         return this;
     }
+    addSignature(...args) {
+        return this.parent.addSignature(...args);
+    }
+    sign(...args) {
+        return this.parent.sign(...args);
+    }
+    done() {
+        return this.parent;
+    }
 }
 export class GeneralSign {
     constructor(payload) {
@@ -25,8 +36,7 @@ export class GeneralSign {
         this._payload = payload;
     }
     addSignature(key, options) {
-        const signature = new IndividualSignature();
-        signatureRef.set(signature, { key, options });
+        const signature = new IndividualSignature(this, key, options);
         this._signatures.push(signature);
         return signature;
     }
@@ -38,23 +48,19 @@ export class GeneralSign {
             signatures: [],
             payload: '',
         };
-        let payloads = new Set();
-        await Promise.all(this._signatures.map(async (sig) => {
-            const { protectedHeader, unprotectedHeader, options, key } = signatureRef.get(sig);
+        for (let i = 0; i < this._signatures.length; i++) {
+            const signature = this._signatures[i];
             const flattened = new FlattenedSign(this._payload);
-            if (protectedHeader) {
-                flattened.setProtectedHeader(protectedHeader);
+            flattened.setProtectedHeader(signature.protectedHeader);
+            flattened.setUnprotectedHeader(signature.unprotectedHeader);
+            const { payload, ...rest } = await flattened.sign(signature.key, signature.options);
+            if (i === 0) {
+                jws.payload = payload;
             }
-            if (unprotectedHeader) {
-                flattened.setUnprotectedHeader(unprotectedHeader);
+            else if (jws.payload !== payload) {
+                throw new JWSInvalid('inconsistent use of JWS Unencoded Payload Option (RFC7797)');
             }
-            const { payload, ...rest } = await flattened.sign(key, options);
-            payloads.add(payload);
-            jws.payload = payload;
             jws.signatures.push(rest);
-        }));
-        if (payloads.size !== 1) {
-            throw new JWSInvalid('inconsistent use of JWS Unencoded Payload Option (RFC7797)');
         }
         return jws;
     }

package/dist/node/cjs/jwe/general/encrypt.js

@@ -8,16 +8,28 @@ const is_disjoint_js_1 = require("../../lib/is_disjoint.js");
 const encrypt_key_management_js_1 = require("../../lib/encrypt_key_management.js");
 const base64url_js_1 = require("../../runtime/base64url.js");
 const validate_crit_js_1 = require("../../lib/validate_crit.js");
-const recipientRef = new WeakMap();
 class IndividualRecipient {
+    constructor(enc, key, options) {
+        this.parent = enc;
+        this.key = key;
+        this.options = options;
+    }
     setUnprotectedHeader(unprotectedHeader) {
-        const ref = recipientRef.get(this);
-        if (ref.unprotectedHeader) {
+        if (this.unprotectedHeader) {
             throw new TypeError('setUnprotectedHeader can only be called once');
         }
-        ref.unprotectedHeader = unprotectedHeader;
+        this.unprotectedHeader = unprotectedHeader;
         return this;
     }
+    addRecipient(...args) {
+        return this.parent.addRecipient(...args);
+    }
+    encrypt(...args) {
+        return this.parent.encrypt(...args);
+    }
+    done() {
+        return this.parent;
+    }
 }
 class GeneralEncrypt {
     constructor(plaintext) {
@@ -25,8 +37,7 @@ class GeneralEncrypt {
         this._plaintext = plaintext;
     }
     addRecipient(key, options) {
-        const recipient = new IndividualRecipient();
-        recipientRef.set(recipient, { key, options: { crit: options === null || options === void 0 ? void 0 : options.crit } });
+        const recipient = new IndividualRecipient(this, key, { crit: options === null || options === void 0 ? void 0 : options.crit });
         this._recipients.push(recipient);
         return recipient;
     }
@@ -49,19 +60,19 @@ class GeneralEncrypt {
         return this;
     }
     async encrypt(options) {
-        var _a, _b;
+        var _a, _b, _c;
         if (!this._recipients.length) {
             throw new errors_js_1.JWEInvalid('at least one recipient must be added');
         }
         options = { deflateRaw: options === null || options === void 0 ? void 0 : options.deflateRaw };
         if (this._recipients.length === 1) {
-            const { unprotectedHeader, options: recipientOpts, key, } = recipientRef.get(this._recipients[0]);
+            const [recipient] = this._recipients;
             const flattened = await new encrypt_js_1.FlattenedEncrypt(this._plaintext)
                 .setAdditionalAuthenticatedData(this._aad)
                 .setProtectedHeader(this._protectedHeader)
                 .setSharedUnprotectedHeader(this._unprotectedHeader)
-                .setUnprotectedHeader(unprotectedHeader)
-                .encrypt(key, { ...recipientOpts, ...options });
+                .setUnprotectedHeader(recipient.unprotectedHeader)
+                .encrypt(recipient.key, { ...recipient.options, ...options });
             let jwe = {
                 ciphertext: flattened.ciphertext,
                 iv: flattened.iv,
@@ -83,14 +94,13 @@ class GeneralEncrypt {
         let enc;
         for (let i = 0; i < this._recipients.length; i++) {
             const recipient = this._recipients[i];
-            const { unprotectedHeader, options: recipientOpts } = recipientRef.get(recipient);
-            if (!(0, is_disjoint_js_1.default)(this._protectedHeader, this._unprotectedHeader, unprotectedHeader)) {
+            if (!(0, is_disjoint_js_1.default)(this._protectedHeader, this._unprotectedHeader, recipient.unprotectedHeader)) {
                 throw new errors_js_1.JWEInvalid('JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint');
             }
             const joseHeader = {
                 ...this._protectedHeader,
                 ...this._unprotectedHeader,
-                ...unprotectedHeader,
+                ...recipient.unprotectedHeader,
             };
             const { alg } = joseHeader;
             if (typeof alg !== 'string' || !alg) {
@@ -108,7 +118,7 @@ class GeneralEncrypt {
             else if (enc !== joseHeader.enc) {
                 throw new errors_js_1.JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');
             }
-            (0, validate_crit_js_1.default)(errors_js_1.JWEInvalid, new Map(), recipientOpts === null || recipientOpts === void 0 ? void 0 : recipientOpts.crit, this._protectedHeader, joseHeader);
+            (0, validate_crit_js_1.default)(errors_js_1.JWEInvalid, new Map(), recipient.options.crit, this._protectedHeader, joseHeader);
             if (joseHeader.zip !== undefined) {
                 if (!this._protectedHeader || !this._protectedHeader.zip) {
                     throw new errors_js_1.JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
@@ -126,15 +136,18 @@ class GeneralEncrypt {
             const recipient = this._recipients[i];
             const target = {};
             jwe.recipients.push(target);
-            const { unprotectedHeader, options: recipientOpts, key } = recipientRef.get(recipient);
             if (i === 0) {
                 const flattened = await new encrypt_js_1.FlattenedEncrypt(this._plaintext)
                     .setAdditionalAuthenticatedData(this._aad)
                     .setContentEncryptionKey(cek)
                     .setProtectedHeader(this._protectedHeader)
                     .setSharedUnprotectedHeader(this._unprotectedHeader)
-                    .setUnprotectedHeader(unprotectedHeader)
-                    .encrypt(key, { ...recipientOpts, ...options, [encrypt_js_1.unprotected]: true });
+                    .setUnprotectedHeader(recipient.unprotectedHeader)
+                    .encrypt(recipient.key, {
+                    ...recipient.options,
+                    ...options,
+                    [encrypt_js_1.unprotected]: true,
+                });
                 jwe.ciphertext = flattened.ciphertext;
                 jwe.iv = flattened.iv;
                 jwe.tag = flattened.tag;
@@ -149,10 +162,12 @@ class GeneralEncrypt {
                     target.header = flattened.header;
                 continue;
             }
-            const { encryptedKey, parameters } = await (0, encrypt_key_management_js_1.default)((unprotectedHeader === null || unprotectedHeader === void 0 ? void 0 : unprotectedHeader.alg) || ((_a = this._protectedHeader) === null || _a === void 0 ? void 0 : _a.alg) || ((_b = this._unprotectedHeader) === null || _b === void 0 ? void 0 : _b.alg), enc, key, cek);
+            const { encryptedKey, parameters } = await (0, encrypt_key_management_js_1.default)(((_a = recipient.unprotectedHeader) === null || _a === void 0 ? void 0 : _a.alg) ||
+                ((_b = this._protectedHeader) === null || _b === void 0 ? void 0 : _b.alg) ||
+                ((_c = this._unprotectedHeader) === null || _c === void 0 ? void 0 : _c.alg), enc, recipient.key, cek);
             target.encrypted_key = (0, base64url_js_1.encode)(encryptedKey);
-            if (unprotectedHeader || parameters)
-                target.header = { ...unprotectedHeader, ...parameters };
+            if (recipient.unprotectedHeader || parameters)
+                target.header = { ...recipient.unprotectedHeader, ...parameters };
         }
         return jwe;
     }

package/dist/node/cjs/jwks/remote.js

@@ -40,17 +40,21 @@ class RemoteJWKSet {
         }
         return Date.now() < this._cooldownStarted + this._cooldownDuration;
     }
-    async getKey(protectedHeader) {
+    async getKey(protectedHeader, token) {
+        const joseHeader = {
+            ...protectedHeader,
+            ...token.header,
+        };
         if (!this._jwks) {
             await this.reload();
         }
         const candidates = this._jwks.keys.filter((jwk) => {
-            let candidate = jwk.kty === getKtyFromAlg(protectedHeader.alg);
-            if (candidate && typeof protectedHeader.kid === 'string') {
-                candidate = protectedHeader.kid === jwk.kid;
+            let candidate = jwk.kty === getKtyFromAlg(joseHeader.alg);
+            if (candidate && typeof joseHeader.kid === 'string') {
+                candidate = joseHeader.kid === jwk.kid;
             }
             if (candidate && typeof jwk.alg === 'string') {
-                candidate = protectedHeader.alg === jwk.alg;
+                candidate = joseHeader.alg === jwk.alg;
             }
             if (candidate && typeof jwk.use === 'string') {
                 candidate = jwk.use === 'sig';
@@ -58,11 +62,11 @@ class RemoteJWKSet {
             if (candidate && Array.isArray(jwk.key_ops)) {
                 candidate = jwk.key_ops.includes('verify');
             }
-            if (candidate && protectedHeader.alg === 'EdDSA') {
+            if (candidate && joseHeader.alg === 'EdDSA') {
                 candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
             }
             if (candidate) {
-                switch (protectedHeader.alg) {
+                switch (joseHeader.alg) {
                     case 'ES256':
                         candidate = jwk.crv === 'P-256';
                         break;
@@ -84,7 +88,7 @@ class RemoteJWKSet {
         if (length === 0) {
             if (this.coolingDown() === false) {
                 await this.reload();
-                return this.getKey(protectedHeader);
+                return this.getKey(protectedHeader, token);
             }
             throw new errors_js_1.JWKSNoMatchingKey();
         }
@@ -92,14 +96,14 @@ class RemoteJWKSet {
             throw new errors_js_1.JWKSMultipleMatchingKeys();
         }
         const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
-        if (cached[protectedHeader.alg] === undefined) {
-            const keyObject = await (0, import_js_1.importJWK)({ ...jwk, ext: true }, protectedHeader.alg);
+        if (cached[joseHeader.alg] === undefined) {
+            const keyObject = await (0, import_js_1.importJWK)({ ...jwk, ext: true }, joseHeader.alg);
             if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
                 throw new errors_js_1.JWKSInvalid('JSON Web Key Set members must be public keys');
             }
-            cached[protectedHeader.alg] = keyObject;
+            cached[joseHeader.alg] = keyObject;
         }
-        return cached[protectedHeader.alg];
+        return cached[joseHeader.alg];
     }
     async reload() {
         if (!this._pendingFetch) {

package/dist/node/cjs/jws/compact/verify.js

@@ -15,11 +15,7 @@ async function compactVerify(jws, key, options) {
     if (length !== 3) {
         throw new errors_js_1.JWSInvalid('Invalid Compact JWS');
     }
-    const verified = await (0, verify_js_1.flattenedVerify)({
-        payload: (payload || undefined),
-        protected: protectedHeader || undefined,
-        signature: (signature || undefined),
-    }, key, options);
+    const verified = await (0, verify_js_1.flattenedVerify)({ payload, protected: protectedHeader, signature }, key, options);
     const result = { payload: verified.payload, protectedHeader: verified.protectedHeader };
     if (typeof key === 'function') {
         return { ...result, key: verified.key };

package/dist/node/cjs/jws/general/sign.js

@@ -3,24 +3,35 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.GeneralSign = void 0;
 const sign_js_1 = require("../flattened/sign.js");
 const errors_js_1 = require("../../util/errors.js");
-const signatureRef = new WeakMap();
 class IndividualSignature {
+    constructor(sig, key, options) {
+        this.parent = sig;
+        this.key = key;
+        this.options = options;
+    }
     setProtectedHeader(protectedHeader) {
-        const ref = signatureRef.get(this);
-        if (ref.protectedHeader) {
+        if (this.protectedHeader) {
             throw new TypeError('setProtectedHeader can only be called once');
         }
-        ref.protectedHeader = protectedHeader;
+        this.protectedHeader = protectedHeader;
         return this;
     }
     setUnprotectedHeader(unprotectedHeader) {
-        const ref = signatureRef.get(this);
-        if (ref.unprotectedHeader) {
+        if (this.unprotectedHeader) {
             throw new TypeError('setUnprotectedHeader can only be called once');
         }
-        ref.unprotectedHeader = unprotectedHeader;
+        this.unprotectedHeader = unprotectedHeader;
         return this;
     }
+    addSignature(...args) {
+        return this.parent.addSignature(...args);
+    }
+    sign(...args) {
+        return this.parent.sign(...args);
+    }
+    done() {
+        return this.parent;
+    }
 }
 class GeneralSign {
     constructor(payload) {
@@ -28,8 +39,7 @@ class GeneralSign {
         this._payload = payload;
     }
     addSignature(key, options) {
-        const signature = new IndividualSignature();
-        signatureRef.set(signature, { key, options });
+        const signature = new IndividualSignature(this, key, options);
         this._signatures.push(signature);
         return signature;
     }
@@ -41,23 +51,19 @@ class GeneralSign {
             signatures: [],
             payload: '',
         };
-        let payloads = new Set();
-        await Promise.all(this._signatures.map(async (sig) => {
-            const { protectedHeader, unprotectedHeader, options, key } = signatureRef.get(sig);
+        for (let i = 0; i < this._signatures.length; i++) {
+            const signature = this._signatures[i];
             const flattened = new sign_js_1.FlattenedSign(this._payload);
-            if (protectedHeader) {
-                flattened.setProtectedHeader(protectedHeader);
+            flattened.setProtectedHeader(signature.protectedHeader);
+            flattened.setUnprotectedHeader(signature.unprotectedHeader);
+            const { payload, ...rest } = await flattened.sign(signature.key, signature.options);
+            if (i === 0) {
+                jws.payload = payload;
             }
-            if (unprotectedHeader) {
-                flattened.setUnprotectedHeader(unprotectedHeader);
+            else if (jws.payload !== payload) {
+                throw new errors_js_1.JWSInvalid('inconsistent use of JWS Unencoded Payload Option (RFC7797)');
             }
-            const { payload, ...rest } = await flattened.sign(key, options);
-            payloads.add(payload);
-            jws.payload = payload;
             jws.signatures.push(rest);
-        }));
-        if (payloads.size !== 1) {
-            throw new errors_js_1.JWSInvalid('inconsistent use of JWS Unencoded Payload Option (RFC7797)');
         }
         return jws;
     }

package/dist/node/esm/jwe/general/encrypt.js

@@ -5,16 +5,28 @@ import isDisjoint from '../../lib/is_disjoint.js';
 import encryptKeyManagement from '../../lib/encrypt_key_management.js';
 import { encode as base64url } from '../../runtime/base64url.js';
 import validateCrit from '../../lib/validate_crit.js';
-const recipientRef = new WeakMap();
 class IndividualRecipient {
+    constructor(enc, key, options) {
+        this.parent = enc;
+        this.key = key;
+        this.options = options;
+    }
     setUnprotectedHeader(unprotectedHeader) {
-        const ref = recipientRef.get(this);
-        if (ref.unprotectedHeader) {
+        if (this.unprotectedHeader) {
             throw new TypeError('setUnprotectedHeader can only be called once');
         }
-        ref.unprotectedHeader = unprotectedHeader;
+        this.unprotectedHeader = unprotectedHeader;
         return this;
     }
+    addRecipient(...args) {
+        return this.parent.addRecipient(...args);
+    }
+    encrypt(...args) {
+        return this.parent.encrypt(...args);
+    }
+    done() {
+        return this.parent;
+    }
 }
 export class GeneralEncrypt {
     constructor(plaintext) {
@@ -22,8 +34,7 @@ export class GeneralEncrypt {
         this._plaintext = plaintext;
     }
     addRecipient(key, options) {
-        const recipient = new IndividualRecipient();
-        recipientRef.set(recipient, { key, options: { crit: options === null || options === void 0 ? void 0 : options.crit } });
+        const recipient = new IndividualRecipient(this, key, { crit: options === null || options === void 0 ? void 0 : options.crit });
         this._recipients.push(recipient);
         return recipient;
     }
@@ -46,19 +57,19 @@ export class GeneralEncrypt {
         return this;
     }
     async encrypt(options) {
-        var _a, _b;
+        var _a, _b, _c;
         if (!this._recipients.length) {
             throw new JWEInvalid('at least one recipient must be added');
         }
         options = { deflateRaw: options === null || options === void 0 ? void 0 : options.deflateRaw };
         if (this._recipients.length === 1) {
-            const { unprotectedHeader, options: recipientOpts, key, } = recipientRef.get(this._recipients[0]);
+            const [recipient] = this._recipients;
             const flattened = await new FlattenedEncrypt(this._plaintext)
                 .setAdditionalAuthenticatedData(this._aad)
                 .setProtectedHeader(this._protectedHeader)
                 .setSharedUnprotectedHeader(this._unprotectedHeader)
-                .setUnprotectedHeader(unprotectedHeader)
-                .encrypt(key, { ...recipientOpts, ...options });
+                .setUnprotectedHeader(recipient.unprotectedHeader)
+                .encrypt(recipient.key, { ...recipient.options, ...options });
             let jwe = {
                 ciphertext: flattened.ciphertext,
                 iv: flattened.iv,
@@ -80,14 +91,13 @@ export class GeneralEncrypt {
         let enc;
         for (let i = 0; i < this._recipients.length; i++) {
             const recipient = this._recipients[i];
-            const { unprotectedHeader, options: recipientOpts } = recipientRef.get(recipient);
-            if (!isDisjoint(this._protectedHeader, this._unprotectedHeader, unprotectedHeader)) {
+            if (!isDisjoint(this._protectedHeader, this._unprotectedHeader, recipient.unprotectedHeader)) {
                 throw new JWEInvalid('JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint');
             }
             const joseHeader = {
                 ...this._protectedHeader,
                 ...this._unprotectedHeader,
-                ...unprotectedHeader,
+                ...recipient.unprotectedHeader,
             };
             const { alg } = joseHeader;
             if (typeof alg !== 'string' || !alg) {
@@ -105,7 +115,7 @@ export class GeneralEncrypt {
             else if (enc !== joseHeader.enc) {
                 throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');
             }
-            validateCrit(JWEInvalid, new Map(), recipientOpts === null || recipientOpts === void 0 ? void 0 : recipientOpts.crit, this._protectedHeader, joseHeader);
+            validateCrit(JWEInvalid, new Map(), recipient.options.crit, this._protectedHeader, joseHeader);
             if (joseHeader.zip !== undefined) {
                 if (!this._protectedHeader || !this._protectedHeader.zip) {
                     throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
@@ -123,15 +133,18 @@ export class GeneralEncrypt {
             const recipient = this._recipients[i];
             const target = {};
             jwe.recipients.push(target);
-            const { unprotectedHeader, options: recipientOpts, key } = recipientRef.get(recipient);
             if (i === 0) {
                 const flattened = await new FlattenedEncrypt(this._plaintext)
                     .setAdditionalAuthenticatedData(this._aad)
                     .setContentEncryptionKey(cek)
                     .setProtectedHeader(this._protectedHeader)
                     .setSharedUnprotectedHeader(this._unprotectedHeader)
-                    .setUnprotectedHeader(unprotectedHeader)
-                    .encrypt(key, { ...recipientOpts, ...options, [unprotected]: true });
+                    .setUnprotectedHeader(recipient.unprotectedHeader)
+                    .encrypt(recipient.key, {
+                    ...recipient.options,
+                    ...options,
+                    [unprotected]: true,
+                });
                 jwe.ciphertext = flattened.ciphertext;
                 jwe.iv = flattened.iv;
                 jwe.tag = flattened.tag;
@@ -146,10 +159,12 @@ export class GeneralEncrypt {
                     target.header = flattened.header;
                 continue;
             }
-            const { encryptedKey, parameters } = await encryptKeyManagement((unprotectedHeader === null || unprotectedHeader === void 0 ? void 0 : unprotectedHeader.alg) || ((_a = this._protectedHeader) === null || _a === void 0 ? void 0 : _a.alg) || ((_b = this._unprotectedHeader) === null || _b === void 0 ? void 0 : _b.alg), enc, key, cek);
+            const { encryptedKey, parameters } = await encryptKeyManagement(((_a = recipient.unprotectedHeader) === null || _a === void 0 ? void 0 : _a.alg) ||
+                ((_b = this._protectedHeader) === null || _b === void 0 ? void 0 : _b.alg) ||
+                ((_c = this._unprotectedHeader) === null || _c === void 0 ? void 0 : _c.alg), enc, recipient.key, cek);
             target.encrypted_key = base64url(encryptedKey);
-            if (unprotectedHeader || parameters)
-                target.header = { ...unprotectedHeader, ...parameters };
+            if (recipient.unprotectedHeader || parameters)
+                target.header = { ...recipient.unprotectedHeader, ...parameters };
         }
         return jwe;
     }

package/dist/node/esm/jwks/remote.js

@@ -37,17 +37,21 @@ class RemoteJWKSet {
         }
         return Date.now() < this._cooldownStarted + this._cooldownDuration;
     }
-    async getKey(protectedHeader) {
+    async getKey(protectedHeader, token) {
+        const joseHeader = {
+            ...protectedHeader,
+            ...token.header,
+        };
         if (!this._jwks) {
             await this.reload();
         }
         const candidates = this._jwks.keys.filter((jwk) => {
-            let candidate = jwk.kty === getKtyFromAlg(protectedHeader.alg);
-            if (candidate && typeof protectedHeader.kid === 'string') {
-                candidate = protectedHeader.kid === jwk.kid;
+            let candidate = jwk.kty === getKtyFromAlg(joseHeader.alg);
+            if (candidate && typeof joseHeader.kid === 'string') {
+                candidate = joseHeader.kid === jwk.kid;
             }
             if (candidate && typeof jwk.alg === 'string') {
-                candidate = protectedHeader.alg === jwk.alg;
+                candidate = joseHeader.alg === jwk.alg;
             }
             if (candidate && typeof jwk.use === 'string') {
                 candidate = jwk.use === 'sig';
@@ -55,11 +59,11 @@ class RemoteJWKSet {
             if (candidate && Array.isArray(jwk.key_ops)) {
                 candidate = jwk.key_ops.includes('verify');
             }
-            if (candidate && protectedHeader.alg === 'EdDSA') {
+            if (candidate && joseHeader.alg === 'EdDSA') {
                 candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
             }
             if (candidate) {
-                switch (protectedHeader.alg) {
+                switch (joseHeader.alg) {
                     case 'ES256':
                         candidate = jwk.crv === 'P-256';
                         break;
@@ -81,7 +85,7 @@ class RemoteJWKSet {
         if (length === 0) {
             if (this.coolingDown() === false) {
                 await this.reload();
-                return this.getKey(protectedHeader);
+                return this.getKey(protectedHeader, token);
             }
             throw new JWKSNoMatchingKey();
         }
@@ -89,14 +93,14 @@ class RemoteJWKSet {
             throw new JWKSMultipleMatchingKeys();
         }
         const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
-        if (cached[protectedHeader.alg] === undefined) {
-            const keyObject = await importJWK({ ...jwk, ext: true }, protectedHeader.alg);
+        if (cached[joseHeader.alg] === undefined) {
+            const keyObject = await importJWK({ ...jwk, ext: true }, joseHeader.alg);
             if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
                 throw new JWKSInvalid('JSON Web Key Set members must be public keys');
             }
-            cached[protectedHeader.alg] = keyObject;
+            cached[joseHeader.alg] = keyObject;
         }
-        return cached[protectedHeader.alg];
+        return cached[joseHeader.alg];
     }
     async reload() {
         if (!this._pendingFetch) {

package/dist/node/esm/jws/compact/verify.js

@@ -12,11 +12,7 @@ export async function compactVerify(jws, key, options) {
     if (length !== 3) {
         throw new JWSInvalid('Invalid Compact JWS');
     }
-    const verified = await flattenedVerify({
-        payload: (payload || undefined),
-        protected: protectedHeader || undefined,
-        signature: (signature || undefined),
-    }, key, options);
+    const verified = await flattenedVerify({ payload, protected: protectedHeader, signature }, key, options);
     const result = { payload: verified.payload, protectedHeader: verified.protectedHeader };
     if (typeof key === 'function') {
         return { ...result, key: verified.key };

package/dist/node/esm/jws/general/sign.js

@@ -1,23 +1,34 @@
 import { FlattenedSign } from '../flattened/sign.js';
 import { JWSInvalid } from '../../util/errors.js';
-const signatureRef = new WeakMap();
 class IndividualSignature {
+    constructor(sig, key, options) {
+        this.parent = sig;
+        this.key = key;
+        this.options = options;
+    }
     setProtectedHeader(protectedHeader) {
-        const ref = signatureRef.get(this);
-        if (ref.protectedHeader) {
+        if (this.protectedHeader) {
             throw new TypeError('setProtectedHeader can only be called once');
         }
-        ref.protectedHeader = protectedHeader;
+        this.protectedHeader = protectedHeader;
         return this;
     }
     setUnprotectedHeader(unprotectedHeader) {
-        const ref = signatureRef.get(this);
-        if (ref.unprotectedHeader) {
+        if (this.unprotectedHeader) {
             throw new TypeError('setUnprotectedHeader can only be called once');
         }
-        ref.unprotectedHeader = unprotectedHeader;
+        this.unprotectedHeader = unprotectedHeader;
         return this;
     }
+    addSignature(...args) {
+        return this.parent.addSignature(...args);
+    }
+    sign(...args) {
+        return this.parent.sign(...args);
+    }
+    done() {
+        return this.parent;
+    }
 }
 export class GeneralSign {
     constructor(payload) {
@@ -25,8 +36,7 @@ export class GeneralSign {
         this._payload = payload;
     }
     addSignature(key, options) {
-        const signature = new IndividualSignature();
-        signatureRef.set(signature, { key, options });
+        const signature = new IndividualSignature(this, key, options);
         this._signatures.push(signature);
         return signature;
     }
@@ -38,23 +48,19 @@ export class GeneralSign {
             signatures: [],
             payload: '',
         };
-        let payloads = new Set();
-        await Promise.all(this._signatures.map(async (sig) => {
-            const { protectedHeader, unprotectedHeader, options, key } = signatureRef.get(sig);
+        for (let i = 0; i < this._signatures.length; i++) {
+            const signature = this._signatures[i];
             const flattened = new FlattenedSign(this._payload);
-            if (protectedHeader) {
-                flattened.setProtectedHeader(protectedHeader);
+            flattened.setProtectedHeader(signature.protectedHeader);
+            flattened.setUnprotectedHeader(signature.unprotectedHeader);
+            const { payload, ...rest } = await flattened.sign(signature.key, signature.options);
+            if (i === 0) {
+                jws.payload = payload;
             }
-            if (unprotectedHeader) {
-                flattened.setUnprotectedHeader(unprotectedHeader);
+            else if (jws.payload !== payload) {
+                throw new JWSInvalid('inconsistent use of JWS Unencoded Payload Option (RFC7797)');
             }
-            const { payload, ...rest } = await flattened.sign(key, options);
-            payloads.add(payload);
-            jws.payload = payload;
             jws.signatures.push(rest);
-        }));
-        if (payloads.size !== 1) {
-            throw new JWSInvalid('inconsistent use of JWS Unencoded Payload Option (RFC7797)');
         }
         return jws;
     }

package/dist/types/index.d.ts

@@ -42,4 +42,4 @@ export type { GenerateKeyPairResult, GenerateKeyPairOptions } from './key/genera
 export { generateSecret } from './key/generate_secret';
 export type { GenerateSecretOptions } from './key/generate_secret';
 export * as base64url from './util/base64url';
-export type { KeyLike, JWK, FlattenedJWSInput, GeneralJWSInput, FlattenedJWS, GeneralJWS, JoseHeaderParameters, JWSHeaderParameters, JWEKeyManagementHeaderParameters, FlattenedJWE, GeneralJWE, JWEHeaderParameters, CritOption, DeflateOption, DecryptOptions, EncryptOptions, JWTClaimVerificationOptions, VerifyOptions, SignOptions, JWTPayload, DeflateFunction, InflateFunction, FlattenedDecryptResult, GeneralDecryptResult, CompactDecryptResult, FlattenedVerifyResult, GeneralVerifyResult, CompactVerifyResult, JWTVerifyResult, JWTDecryptResult, ResolvedKey, } from './types';
+export type { KeyLike, JWK, FlattenedJWSInput, GeneralJWSInput, FlattenedJWS, GeneralJWS, JoseHeaderParameters, JWSHeaderParameters, JWEKeyManagementHeaderParameters, FlattenedJWE, GeneralJWE, JWEHeaderParameters, CritOption, DeflateOption, DecryptOptions, EncryptOptions, JWTClaimVerificationOptions, VerifyOptions, SignOptions, JWTPayload, DeflateFunction, InflateFunction, FlattenedDecryptResult, GeneralDecryptResult, CompactDecryptResult, FlattenedVerifyResult, GeneralVerifyResult, CompactVerifyResult, JWTVerifyResult, JWTDecryptResult, ResolvedKey, CompactJWEHeaderParameters, CompactJWSHeaderParameters, JWTHeaderParameters, } from './types';

package/dist/types/jwe/compact/decrypt.d.ts

@@ -1,5 +1,5 @@
-import type { KeyLike, DecryptOptions, JWEHeaderParameters, GetKeyFunction, FlattenedJWE, CompactDecryptResult, ResolvedKey } from '../../types';
-export interface CompactDecryptGetKey extends GetKeyFunction<JWEHeaderParameters, FlattenedJWE> {
+import type { KeyLike, DecryptOptions, CompactJWEHeaderParameters, GetKeyFunction, FlattenedJWE, CompactDecryptResult, ResolvedKey } from '../../types';
+export interface CompactDecryptGetKey extends GetKeyFunction<CompactJWEHeaderParameters, FlattenedJWE> {
 }
 export declare function compactDecrypt(jwe: string | Uint8Array, key: KeyLike | Uint8Array, options?: DecryptOptions): Promise<CompactDecryptResult>;
 export declare function compactDecrypt(jwe: string | Uint8Array, getKey: CompactDecryptGetKey, options?: DecryptOptions): Promise<CompactDecryptResult & ResolvedKey>;

package/dist/types/jwe/compact/encrypt.d.ts

@@ -1,10 +1,10 @@
-import type { KeyLike, JWEKeyManagementHeaderParameters, JWEHeaderParameters, EncryptOptions } from '../../types';
+import type { KeyLike, JWEKeyManagementHeaderParameters, CompactJWEHeaderParameters, EncryptOptions } from '../../types';
 export declare class CompactEncrypt {
     private _flattened;
     constructor(plaintext: Uint8Array);
     setContentEncryptionKey(cek: Uint8Array): this;
     setInitializationVector(iv: Uint8Array): this;
-    setProtectedHeader(protectedHeader: JWEHeaderParameters): this;
+    setProtectedHeader(protectedHeader: CompactJWEHeaderParameters): this;
     setKeyManagementParameters(parameters: JWEKeyManagementHeaderParameters): this;
     encrypt(key: KeyLike | Uint8Array, options?: EncryptOptions): Promise<string>;
 }

package/dist/types/jwe/general/encrypt.d.ts

@@ -1,6 +1,9 @@
 import type { KeyLike, GeneralJWE, JWEHeaderParameters, CritOption, DeflateOption } from '../../types';
 export interface Recipient {
     setUnprotectedHeader(unprotectedHeader: JWEHeaderParameters): Recipient;
+    addRecipient(...args: Parameters<GeneralEncrypt['addRecipient']>): Recipient;
+    encrypt(...args: Parameters<GeneralEncrypt['encrypt']>): Promise<GeneralJWE>;
+    done(): GeneralEncrypt;
 }
 export declare class GeneralEncrypt {
     private _plaintext;

package/dist/types/jws/compact/sign.d.ts

@@ -1,7 +1,7 @@
-import type { JWSHeaderParameters, KeyLike, SignOptions } from '../../types';
+import type { CompactJWSHeaderParameters, KeyLike, SignOptions } from '../../types';
 export declare class CompactSign {
     private _flattened;
     constructor(payload: Uint8Array);
-    setProtectedHeader(protectedHeader: JWSHeaderParameters): this;
+    setProtectedHeader(protectedHeader: CompactJWSHeaderParameters): this;
     sign(key: KeyLike | Uint8Array, options?: SignOptions): Promise<string>;
 }

package/dist/types/jws/compact/verify.d.ts

@@ -1,5 +1,5 @@
-import type { CompactVerifyResult, FlattenedJWSInput, GetKeyFunction, JWSHeaderParameters, KeyLike, VerifyOptions, ResolvedKey } from '../../types';
-export interface CompactVerifyGetKey extends GetKeyFunction<JWSHeaderParameters, FlattenedJWSInput> {
+import type { CompactVerifyResult, FlattenedJWSInput, GetKeyFunction, CompactJWSHeaderParameters, KeyLike, VerifyOptions, ResolvedKey } from '../../types';
+export interface CompactVerifyGetKey extends GetKeyFunction<CompactJWSHeaderParameters, FlattenedJWSInput> {
 }
 export declare function compactVerify(jws: string | Uint8Array, key: KeyLike | Uint8Array, options?: VerifyOptions): Promise<CompactVerifyResult>;
 export declare function compactVerify(jws: string | Uint8Array, getKey: CompactVerifyGetKey, options?: VerifyOptions): Promise<CompactVerifyResult & ResolvedKey>;

package/dist/types/jws/general/sign.d.ts

@@ -2,6 +2,9 @@ import type { KeyLike, GeneralJWS, JWSHeaderParameters, SignOptions } from '../.
 export interface Signature {
     setProtectedHeader(protectedHeader: JWSHeaderParameters): Signature;
     setUnprotectedHeader(unprotectedHeader: JWSHeaderParameters): Signature;
+    addSignature(...args: Parameters<GeneralSign['addSignature']>): Signature;
+    sign(...args: Parameters<GeneralSign['sign']>): Promise<GeneralJWS>;
+    done(): GeneralSign;
 }
 export declare class GeneralSign {
     private _payload;

package/dist/types/jwt/decrypt.d.ts

@@ -1,7 +1,7 @@
-import type { KeyLike, DecryptOptions, JWTClaimVerificationOptions, GetKeyFunction, JWEHeaderParameters, FlattenedJWE, JWTDecryptResult, ResolvedKey } from '../types';
+import type { KeyLike, DecryptOptions, JWTClaimVerificationOptions, GetKeyFunction, CompactJWEHeaderParameters, FlattenedJWE, JWTDecryptResult, ResolvedKey } from '../types';
 export interface JWTDecryptOptions extends DecryptOptions, JWTClaimVerificationOptions {
 }
-export interface JWTDecryptGetKey extends GetKeyFunction<JWEHeaderParameters, FlattenedJWE> {
+export interface JWTDecryptGetKey extends GetKeyFunction<CompactJWEHeaderParameters, FlattenedJWE> {
 }
 export declare function jwtDecrypt(jwt: string | Uint8Array, key: KeyLike | Uint8Array, options?: JWTDecryptOptions): Promise<JWTDecryptResult>;
 export declare function jwtDecrypt(jwt: string | Uint8Array, getKey: JWTDecryptGetKey, options?: JWTDecryptOptions): Promise<JWTDecryptResult & ResolvedKey>;

package/dist/types/jwt/encrypt.d.ts

@@ -1,4 +1,4 @@
-import type { EncryptOptions, JWEHeaderParameters, JWEKeyManagementHeaderParameters, KeyLike } from '../types';
+import type { EncryptOptions, CompactJWEHeaderParameters, JWEKeyManagementHeaderParameters, KeyLike } from '../types';
 import { ProduceJWT } from './produce';
 export declare class EncryptJWT extends ProduceJWT {
     private _cek;
@@ -8,7 +8,7 @@ export declare class EncryptJWT extends ProduceJWT {
     private _replicateIssuerAsHeader;
     private _replicateSubjectAsHeader;
     private _replicateAudienceAsHeader;
-    setProtectedHeader(protectedHeader: JWEHeaderParameters): this;
+    setProtectedHeader(protectedHeader: CompactJWEHeaderParameters): this;
     setKeyManagementParameters(parameters: JWEKeyManagementHeaderParameters): this;
     setContentEncryptionKey(cek: Uint8Array): this;
     setInitializationVector(iv: Uint8Array): this;

package/dist/types/jwt/sign.d.ts

@@ -1,7 +1,7 @@
-import type { JWSHeaderParameters, KeyLike, SignOptions } from '../types';
+import type { JWTHeaderParameters, KeyLike, SignOptions } from '../types';
 import { ProduceJWT } from './produce';
 export declare class SignJWT extends ProduceJWT {
     private _protectedHeader;
-    setProtectedHeader(protectedHeader: JWSHeaderParameters): this;
+    setProtectedHeader(protectedHeader: JWTHeaderParameters): this;
     sign(key: KeyLike | Uint8Array, options?: SignOptions): Promise<string>;
 }

package/dist/types/jwt/verify.d.ts

@@ -1,7 +1,7 @@
-import type { KeyLike, VerifyOptions, JWTClaimVerificationOptions, JWSHeaderParameters, GetKeyFunction, FlattenedJWSInput, JWTVerifyResult, ResolvedKey } from '../types';
+import type { KeyLike, VerifyOptions, JWTClaimVerificationOptions, JWTHeaderParameters, GetKeyFunction, FlattenedJWSInput, JWTVerifyResult, ResolvedKey } from '../types';
 export interface JWTVerifyOptions extends VerifyOptions, JWTClaimVerificationOptions {
 }
-export interface JWTVerifyGetKey extends GetKeyFunction<JWSHeaderParameters, FlattenedJWSInput> {
+export interface JWTVerifyGetKey extends GetKeyFunction<JWTHeaderParameters, FlattenedJWSInput> {
 }
 export declare function jwtVerify(jwt: string | Uint8Array, key: KeyLike | Uint8Array, options?: JWTVerifyOptions): Promise<JWTVerifyResult>;
 export declare function jwtVerify(jwt: string | Uint8Array, getKey: JWTVerifyGetKey, options?: JWTVerifyOptions): Promise<JWTVerifyResult & ResolvedKey>;

package/dist/types/types.d.ts

@@ -35,20 +35,16 @@
  *
  * @example Import a PEM-encoded SPKI Public Key
  * ```js
- * import { importSPKI } from 'jose'
- *
  * const algorithm = 'ES256'
  * const spki = `-----BEGIN PUBLIC KEY-----
  * MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEFlHHWfLk0gLBbsLTcuCrbCqoHqmM
  * YJepMC+Q+Dd6RBmBiA41evUsNMwLeN+PNFqib+xwi9JkJ8qhZkq8Y/IzGg==
  * -----END PUBLIC KEY-----`
- * const ecPublicKey = await importSPKI(spki, algorithm)
+ * const ecPublicKey = await jose.importSPKI(spki, algorithm)
  * ```
  *
  * @example Import a X.509 Certificate
  * ```js
- * import { importX509 } from 'jose'
- *
  * const algorithm = 'ES256'
  * const x509 = `-----BEGIN CERTIFICATE-----
  * MIIBXjCCAQSgAwIBAgIGAXvykuMKMAoGCCqGSM49BAMCMDYxNDAyBgNVBAMMK3Np
@@ -60,34 +56,30 @@
  * 1yyMTRe66MhEXID9+uVub7woMkNYd0LhSHwKSPMUUTkCIFQGsfm1ecXOpeGOufAh
  * v+A1QWZMuTWqYt+uh/YSRNDn
  * -----END CERTIFICATE-----`
- * const ecPublicKey = await importX509(x509, algorithm)
+ * const ecPublicKey = await jose.importX509(x509, algorithm)
  * ```
  *
  * @example Import a PEM-encoded PKCS8 Private Key
  * ```js
- * import { importPKCS8 } from 'jose'
- *
  * const algorithm = 'ES256'
  * const pkcs8 = `-----BEGIN PRIVATE KEY-----
  * MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgiyvo0X+VQ0yIrOaN
  * nlrnUclopnvuuMfoc8HHly3505OhRANCAAQWUcdZ8uTSAsFuwtNy4KtsKqgeqYxg
  * l6kwL5D4N3pEGYGIDjV69Sw0zAt43480WqJv7HCL0mQnyqFmSrxj8jMa
  * -----END PRIVATE KEY-----`
- * const ecPrivateKey = await importPKCS8(pkcs8, algorithm)
+ * const ecPrivateKey = await jose.importPKCS8(pkcs8, algorithm)
  * ```
  *
  * @example Import a JSON Web Key (JWK)
  * ```js
- * import { importJWK } from 'jose'
- *
- * const ecPublicKey = await importJWK({
+ * const ecPublicKey = await jose.importJWK({
  *   crv: 'P-256',
  *   kty: 'EC',
  *   x: 'ySK38C1jBdLwDsNWKzzBHqKYEE5Cgv-qjWvorUXk9fw',
  *   y: '_LeQBw07cf5t57Iavn4j-BqJsAD1dpoz8gokd3sBsOo'
  * }, 'ES256')
  *
- * const rsaPublicKey = await importJWK({
+ * const rsaPublicKey = await jose.importJWK({
  *   kty: 'RSA',
  *   e: 'AQAB',
  *   n: '12oBZRhCiZFJLcPg59LkZZ9mdhSMTKAQZYq32k_ti5SBB6jerkh-WzOMAO664r_qyLkqHUSp3u5SbXtseZEpN3XPWGKSxjsy-1JyEFTdLSYe6f9gfrmxkUF_7DTpq0gn6rntP05g2-wFW50YO7mosfdslfrTJYWHFhJALabAeYirYD7-9kqq9ebfFMF4sRRELbv9oi36As6Q9B3Qb5_C1rAzqfao_PCsf9EPsTZsVVVkA5qoIAr47lo1ipfiBPxUCCNSdvkmDTYgvvRm6ZoMjFbvOtgyts55fXKdMWv7I9HMD5HwE9uW839PWA514qhbcIsXEYSFMPMV6fnlsiZvQQ'
@@ -243,7 +235,7 @@ export interface FlattenedDecryptResult {
 export interface GeneralDecryptResult extends FlattenedDecryptResult {}
 export interface CompactDecryptResult {
   plaintext: Uint8Array
-  protectedHeader: JWEHeaderParameters
+  protectedHeader: CompactJWEHeaderParameters
 }
 export interface FlattenedVerifyResult {
   payload: Uint8Array
@@ -253,16 +245,26 @@ export interface FlattenedVerifyResult {
 export interface GeneralVerifyResult extends FlattenedVerifyResult {}
 export interface CompactVerifyResult {
   payload: Uint8Array
-  protectedHeader: JWSHeaderParameters
+  protectedHeader: CompactJWSHeaderParameters
 }
 export interface JWTVerifyResult {
   payload: JWTPayload
-  protectedHeader: JWSHeaderParameters
+  protectedHeader: JWTHeaderParameters
 }
 export interface JWTDecryptResult {
   payload: JWTPayload
-  protectedHeader: JWEHeaderParameters
+  protectedHeader: CompactJWEHeaderParameters
 }
 export interface ResolvedKey {
   key: KeyLike | Uint8Array
 }
+export interface CompactJWSHeaderParameters extends JWSHeaderParameters {
+  alg: string
+}
+export interface JWTHeaderParameters extends CompactJWSHeaderParameters {
+  b64: never
+}
+export interface CompactJWEHeaderParameters extends JWEHeaderParameters {
+  alg: string
+  enc: string
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "4.2.1",
+  "version": "4.3.4",
   "description": "'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto",
   "keywords": [
     "browser",