jose 4.8.0 → 4.9.0

package/README.md

@@ -12,6 +12,7 @@ The following specifications are implemented by `jose`
 - JSON Web Algorithms (JWA) - [RFC7518][spec-jwa]
 - JSON Web Token (JWT) - [RFC7519][spec-jwt]
 - JSON Web Key Thumbprint - [RFC7638][spec-thumbprint]
+- JSON Web Key Thumbprint URI - [RFC9278][spec-thumbprint-uri]
 - JWS Unencoded Payload Option - [RFC7797][spec-b64]
 - CFRG Elliptic Curve ECDH and Signatures - [RFC8037][spec-okp]
 - secp256k1 EC Key curve support - [JOSE Registrations for WebAuthn Algorithms][spec-secp256k1]
@@ -19,9 +20,7 @@ The following specifications are implemented by `jose`
 The test suite utilizes examples defined in [RFC7520][spec-cookbook] to confirm its JOSE
 implementation is correct.
 
-## Support
-
-If you or your business use `jose`, please consider becoming a [sponsor][support-sponsor] so I can continue maintaining it and adding new features carefree.
+## [💗 Help the project](https://github.com/sponsors/panva)
 
 ## Documentation
 
@@ -58,8 +57,9 @@ import * as jose from 'https://deno.land/x/jose/index.ts'
   - Signing - [Compact](docs/classes/jws_compact_sign.CompactSign.md#readme), [Flattened](docs/classes/jws_flattened_sign.FlattenedSign.md#readme), [General](docs/classes/jws_general_sign.GeneralSign.md#readme)
   - Verification - [Compact](docs/functions/jws_compact_verify.compactVerify.md#readme), [Flattened](docs/functions/jws_flattened_verify.flattenedVerify.md#readme), [General](docs/functions/jws_general_verify.generalVerify.md#readme)
 - JSON Web Key (JWK)
-  - [Thumbprints](docs/functions/jwk_thumbprint.calculateJwkThumbprint.md#readme)
-  - [EmbeddedJWK](docs/functions/jwk_embedded.EmbeddedJWK.md#readme)
+  - [Calculating JWK Thumbprint](docs/functions/jwk_thumbprint.calculateJwkThumbprint.md#readme)
+  - [Calculating JWK Thumbprint URI](docs/functions/jwk_thumbprint.calculateJwkThumbprintUri.md#readme)
+  - [Verification using a JWK Embedded in a JWS Header](docs/functions/jwk_embedded.EmbeddedJWK.md#readme)
 - JSON Web Key Set (JWKS)
   - [Verify using a local JWKSet](docs/functions/jwks_local.createLocalJWKSet.md#readme)
   - [Verify using a remote JWKSet](docs/functions/jwks_remote.createRemoteJWKSet.md#readme)
@@ -91,10 +91,8 @@ import * as jose from 'https://deno.land/x/jose/index.ts'
 
 | Version | Security Fixes 🔑 | Other Bug Fixes 🐞 | New Features ⭐ |
 | ------- | --------- | -------- | -------- |
-| [4.x.x](https://github.com/panva/jose/tree/v4.x) | ✅ | ✅ | ✅ |
-| [3.x.x](https://github.com/panva/jose/tree/v3.x) | ✅ | ✅ until 2022-04-30 | ❌ |
-| [2.x.x](https://github.com/panva/jose/tree/v2.x) | ✅ | ✅ until 2022-04-30 | ❌ |
-| [1.x.x](https://github.com/panva/jose/tree/v1.x) | ✅ | ❌ | ❌ |
+| [v4.x](https://github.com/panva/jose/tree/v4.x) | ✅ | ✅ | ✅ |
+| [v3.x](https://github.com/panva/jose/tree/v3.x), [v2.x](https://github.com/panva/jose/tree/v2.x), [v1.x](https://github.com/panva/jose/tree/v1.x) | ✅ | ❌ | ❌ |
 
 #### Semver?
 
@@ -108,7 +106,7 @@ import * as jose from 'https://deno.land/x/jose/index.ts'
 - it supports JWK Key Format for all four key types (oct, RSA, EC and OKP)
 - it is exclusively using native platform Key object representations (CryptoKey and KeyObject)
 - there is JSON Web Encryption support
-- it supports the flattened JWS / JWE Serialization Syntaxes
+- it supports the General and Flattened JSON Serialization Syntaxes
 - it supports the "crit" member validations to make sure extensions are handled correctly
 
 #### How is it different from [`node-jose`](https://github.com/cisco/node-jose)?
@@ -146,6 +144,7 @@ install size should not be a cause for concern.
 [spec-okp]: https://www.rfc-editor.org/rfc/rfc8037
 [spec-secp256k1]: https://www.rfc-editor.org/rfc/rfc8812
 [spec-thumbprint]: https://www.rfc-editor.org/rfc/rfc7638
+[spec-thumbprint-uri]: https://www.rfc-editor.org/rfc/rfc9278
 [support-sponsor]: https://github.com/sponsors/panva
 [conditional-exports]: https://nodejs.org/api/packages.html#packages_conditional_exports
 [webcrypto]: https://www.w3.org/TR/WebCryptoAPI/

package/dist/browser/index.js

@@ -14,7 +14,7 @@ export { FlattenedSign } from './jws/flattened/sign.js';
 export { GeneralSign } from './jws/general/sign.js';
 export { SignJWT } from './jwt/sign.js';
 export { EncryptJWT } from './jwt/encrypt.js';
-export { calculateJwkThumbprint } from './jwk/thumbprint.js';
+export { calculateJwkThumbprint, calculateJwkThumbprintUri } from './jwk/thumbprint.js';
 export { EmbeddedJWK } from './jwk/embedded.js';
 export { createLocalJWKSet } from './jwks/local.js';
 export { createRemoteJWKSet } from './jwks/remote.js';

package/dist/browser/jwe/flattened/decrypt.js

@@ -43,8 +43,8 @@ export async function flattenedDecrypt(jwe, key, options) {
     }
     let parsedProt;
     if (jwe.protected) {
-        const protectedHeader = base64url(jwe.protected);
         try {
+            const protectedHeader = base64url(jwe.protected);
             parsedProt = JSON.parse(decoder.decode(protectedHeader));
         }
         catch (_b) {

package/dist/browser/jwk/thumbprint.js

@@ -8,10 +8,11 @@ const check = (value, description) => {
         throw new JWKInvalid(`${description} missing or invalid`);
     }
 };
-export async function calculateJwkThumbprint(jwk, digestAlgorithm = 'sha256') {
+export async function calculateJwkThumbprint(jwk, digestAlgorithm) {
     if (!isObject(jwk)) {
         throw new TypeError('JWK must be an object');
     }
+    digestAlgorithm !== null && digestAlgorithm !== void 0 ? digestAlgorithm : (digestAlgorithm = 'sha256');
     if (digestAlgorithm !== 'sha256' &&
         digestAlgorithm !== 'sha384' &&
         digestAlgorithm !== 'sha512') {
@@ -45,3 +46,8 @@ export async function calculateJwkThumbprint(jwk, digestAlgorithm = 'sha256') {
     const data = encoder.encode(JSON.stringify(components));
     return base64url(await digest(digestAlgorithm, data));
 }
+export async function calculateJwkThumbprintUri(jwk, digestAlgorithm) {
+    digestAlgorithm !== null && digestAlgorithm !== void 0 ? digestAlgorithm : (digestAlgorithm = 'sha256');
+    const thumbprint = await calculateJwkThumbprint(jwk, digestAlgorithm);
+    return `urn:ietf:params:oauth:jwk-thumbprint:sha-${digestAlgorithm.slice(-3)}:${thumbprint}`;
+}

package/dist/browser/jws/flattened/verify.js

@@ -29,8 +29,8 @@ export async function flattenedVerify(jws, key, options) {
     }
     let parsedProt = {};
     if (jws.protected) {
-        const protectedHeader = base64url(jws.protected);
         try {
+            const protectedHeader = base64url(jws.protected);
             parsedProt = JSON.parse(decoder.decode(protectedHeader));
         }
         catch (_b) {

package/dist/browser/lib/crypto_key.js

@@ -1,4 +1,4 @@
-import { isCloudflareWorkers, isNodeJs } from '../runtime/env.js';
+import { isCloudflareWorkers } from '../runtime/env.js';
 function unusable(name, prop = 'algorithm.name') {
     return new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
 }
@@ -71,11 +71,6 @@ export function checkSigCryptoKey(key, alg, ...usages) {
                 throw unusable(`SHA-${expected}`, 'algorithm.hash');
             break;
         }
-        case isNodeJs() && 'EdDSA': {
-            if (key.algorithm.name !== 'NODE-ED25519' && key.algorithm.name !== 'NODE-ED448')
-                throw unusable('NODE-ED25519 or NODE-ED448');
-            break;
-        }
         case isCloudflareWorkers() && 'EdDSA': {
             if (!isAlgorithm(key.algorithm, 'NODE-ED25519'))
                 throw unusable('NODE-ED25519');

package/dist/browser/runtime/asn1.js

@@ -1,4 +1,4 @@
-import { isCloudflareWorkers, isNodeJs } from './env.js';
+import { isCloudflareWorkers } from './env.js';
 import crypto, { isCryptoKey } from './webcrypto.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
 import { encodeBase64 } from './base64url.js';
@@ -44,10 +44,8 @@ const getNamedCurve = (keyData) => {
             return 'P-384';
         case findOid(keyData, [0x2b, 0x81, 0x04, 0x00, 0x23]):
             return 'P-521';
-        case (isCloudflareWorkers() || isNodeJs()) && findOid(keyData, [0x2b, 0x65, 0x70]):
+        case isCloudflareWorkers() && findOid(keyData, [0x2b, 0x65, 0x70]):
             return 'Ed25519';
-        case isNodeJs() && findOid(keyData, [0x2b, 0x65, 0x71]):
-            return 'Ed448';
         default:
             throw new JOSENotSupported('Invalid or unsupported EC Key Curve or OKP Key Sub Type');
     }
@@ -102,7 +100,7 @@ const genericImport = async (replace, keyFormat, pem, alg, options) => {
             algorithm = { name: 'ECDH', namedCurve: getNamedCurve(keyData) };
             keyUsages = isPublic ? [] : ['deriveBits'];
             break;
-        case (isCloudflareWorkers() || isNodeJs()) && 'EdDSA':
+        case isCloudflareWorkers() && 'EdDSA':
             const namedCurve = getNamedCurve(keyData).toUpperCase();
             algorithm = { name: `NODE-${namedCurve}`, namedCurve: `NODE-${namedCurve}` };
             keyUsages = isPublic ? ['verify'] : ['sign'];

package/dist/browser/runtime/env.js

@@ -1,11 +1,3 @@
 export function isCloudflareWorkers() {
     return typeof WebSocketPair === 'function';
 }
-export function isNodeJs() {
-    try {
-        return process.versions.node !== undefined;
-    }
-    catch (_a) {
-        return false;
-    }
-}

package/dist/browser/runtime/generate.js

@@ -1,4 +1,4 @@
-import { isCloudflareWorkers, isNodeJs } from './env.js';
+import { isCloudflareWorkers } from './env.js';
 import crypto from './webcrypto.js';
 import { JOSENotSupported } from '../util/errors.js';
 import random from './random.js';
@@ -101,19 +101,15 @@ export async function generateKeyPair(alg, options) {
             algorithm = { name: 'ECDSA', namedCurve: 'P-521' };
             keyUsages = ['sign', 'verify'];
             break;
-        case (isCloudflareWorkers() || isNodeJs()) && 'EdDSA':
+        case isCloudflareWorkers() && 'EdDSA':
             switch (options === null || options === void 0 ? void 0 : options.crv) {
                 case undefined:
                 case 'Ed25519':
                     algorithm = { name: 'NODE-ED25519', namedCurve: 'NODE-ED25519' };
                     keyUsages = ['sign', 'verify'];
                     break;
-                case isNodeJs() && 'Ed448':
-                    algorithm = { name: 'NODE-ED448', namedCurve: 'NODE-ED448' };
-                    keyUsages = ['sign', 'verify'];
-                    break;
                 default:
-                    throw new JOSENotSupported('Invalid or unsupported crv option provided, supported values are Ed25519 and Ed448');
+                    throw new JOSENotSupported('Invalid or unsupported crv option provided');
             }
             break;
         case 'ECDH-ES':

package/dist/browser/runtime/jwk_to_key.js

@@ -1,4 +1,4 @@
-import { isCloudflareWorkers, isNodeJs } from './env.js';
+import { isCloudflareWorkers } from './env.js';
 import crypto from './webcrypto.js';
 import { JOSENotSupported } from '../util/errors.js';
 import { decode as base64url } from './base64url.js';
@@ -99,7 +99,7 @@ function subtleMapping(jwk) {
             }
             break;
         }
-        case (isCloudflareWorkers() || isNodeJs()) && 'OKP':
+        case isCloudflareWorkers() && 'OKP':
             if (jwk.alg !== 'EdDSA') {
                 throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
             }
@@ -108,10 +108,6 @@ function subtleMapping(jwk) {
                     algorithm = { name: 'NODE-ED25519', namedCurve: 'NODE-ED25519' };
                     keyUsages = jwk.d ? ['sign'] : ['verify'];
                     break;
-                case isNodeJs() && 'Ed448':
-                    algorithm = { name: 'NODE-ED448', namedCurve: 'NODE-ED448' };
-                    keyUsages = jwk.d ? ['sign'] : ['verify'];
-                    break;
                 default:
                     throw new JOSENotSupported('Invalid or unsupported JWK "crv" (Subtype of Key Pair) Parameter value');
             }

package/dist/browser/runtime/subtle_dsa.js

@@ -1,4 +1,4 @@
-import { isCloudflareWorkers, isNodeJs } from './env.js';
+import { isCloudflareWorkers } from './env.js';
 import { JOSENotSupported } from '../util/errors.js';
 export default function subtleDsa(alg, algorithm) {
     const hash = `SHA-${alg.slice(-3)}`;
@@ -19,7 +19,7 @@ export default function subtleDsa(alg, algorithm) {
         case 'ES384':
         case 'ES512':
             return { hash, name: 'ECDSA', namedCurve: algorithm.namedCurve };
-        case (isCloudflareWorkers() || isNodeJs()) && 'EdDSA':
+        case isCloudflareWorkers() && 'EdDSA':
             const { namedCurve } = algorithm;
             return { name: namedCurve, namedCurve };
         default:

package/dist/node/cjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.base64url = exports.generateSecret = exports.generateKeyPair = exports.errors = exports.decodeJwt = exports.decodeProtectedHeader = exports.importJWK = exports.importX509 = exports.importPKCS8 = exports.importSPKI = exports.exportJWK = exports.exportSPKI = exports.exportPKCS8 = exports.UnsecuredJWT = exports.createRemoteJWKSet = exports.createLocalJWKSet = exports.EmbeddedJWK = exports.calculateJwkThumbprint = exports.EncryptJWT = exports.SignJWT = exports.GeneralSign = exports.FlattenedSign = exports.CompactSign = exports.FlattenedEncrypt = exports.CompactEncrypt = exports.jwtDecrypt = exports.jwtVerify = exports.generalVerify = exports.flattenedVerify = exports.compactVerify = exports.GeneralEncrypt = exports.generalDecrypt = exports.flattenedDecrypt = exports.compactDecrypt = void 0;
+exports.base64url = exports.generateSecret = exports.generateKeyPair = exports.errors = exports.decodeJwt = exports.decodeProtectedHeader = exports.importJWK = exports.importX509 = exports.importPKCS8 = exports.importSPKI = exports.exportJWK = exports.exportSPKI = exports.exportPKCS8 = exports.UnsecuredJWT = exports.createRemoteJWKSet = exports.createLocalJWKSet = exports.EmbeddedJWK = exports.calculateJwkThumbprintUri = exports.calculateJwkThumbprint = exports.EncryptJWT = exports.SignJWT = exports.GeneralSign = exports.FlattenedSign = exports.CompactSign = exports.FlattenedEncrypt = exports.CompactEncrypt = exports.jwtDecrypt = exports.jwtVerify = exports.generalVerify = exports.flattenedVerify = exports.compactVerify = exports.GeneralEncrypt = exports.generalDecrypt = exports.flattenedDecrypt = exports.compactDecrypt = void 0;
 var decrypt_js_1 = require("./jwe/compact/decrypt.js");
 Object.defineProperty(exports, "compactDecrypt", { enumerable: true, get: function () { return decrypt_js_1.compactDecrypt; } });
 var decrypt_js_2 = require("./jwe/flattened/decrypt.js");
@@ -35,6 +35,7 @@ var encrypt_js_4 = require("./jwt/encrypt.js");
 Object.defineProperty(exports, "EncryptJWT", { enumerable: true, get: function () { return encrypt_js_4.EncryptJWT; } });
 var thumbprint_js_1 = require("./jwk/thumbprint.js");
 Object.defineProperty(exports, "calculateJwkThumbprint", { enumerable: true, get: function () { return thumbprint_js_1.calculateJwkThumbprint; } });
+Object.defineProperty(exports, "calculateJwkThumbprintUri", { enumerable: true, get: function () { return thumbprint_js_1.calculateJwkThumbprintUri; } });
 var embedded_js_1 = require("./jwk/embedded.js");
 Object.defineProperty(exports, "EmbeddedJWK", { enumerable: true, get: function () { return embedded_js_1.EmbeddedJWK; } });
 var local_js_1 = require("./jwks/local.js");

package/dist/node/cjs/jwe/flattened/decrypt.js

@@ -46,8 +46,8 @@ async function flattenedDecrypt(jwe, key, options) {
     }
     let parsedProt;
     if (jwe.protected) {
-        const protectedHeader = (0, base64url_js_1.decode)(jwe.protected);
         try {
+            const protectedHeader = (0, base64url_js_1.decode)(jwe.protected);
             parsedProt = JSON.parse(buffer_utils_js_1.decoder.decode(protectedHeader));
         }
         catch {

package/dist/node/cjs/jwk/thumbprint.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.calculateJwkThumbprint = void 0;
+exports.calculateJwkThumbprintUri = exports.calculateJwkThumbprint = void 0;
 const digest_js_1 = require("../runtime/digest.js");
 const base64url_js_1 = require("../runtime/base64url.js");
 const errors_js_1 = require("../util/errors.js");
@@ -11,10 +11,11 @@ const check = (value, description) => {
         throw new errors_js_1.JWKInvalid(`${description} missing or invalid`);
     }
 };
-async function calculateJwkThumbprint(jwk, digestAlgorithm = 'sha256') {
+async function calculateJwkThumbprint(jwk, digestAlgorithm) {
     if (!(0, is_object_js_1.default)(jwk)) {
         throw new TypeError('JWK must be an object');
     }
+    digestAlgorithm !== null && digestAlgorithm !== void 0 ? digestAlgorithm : (digestAlgorithm = 'sha256');
     if (digestAlgorithm !== 'sha256' &&
         digestAlgorithm !== 'sha384' &&
         digestAlgorithm !== 'sha512') {
@@ -49,3 +50,9 @@ async function calculateJwkThumbprint(jwk, digestAlgorithm = 'sha256') {
     return (0, base64url_js_1.encode)(await (0, digest_js_1.default)(digestAlgorithm, data));
 }
 exports.calculateJwkThumbprint = calculateJwkThumbprint;
+async function calculateJwkThumbprintUri(jwk, digestAlgorithm) {
+    digestAlgorithm !== null && digestAlgorithm !== void 0 ? digestAlgorithm : (digestAlgorithm = 'sha256');
+    const thumbprint = await calculateJwkThumbprint(jwk, digestAlgorithm);
+    return `urn:ietf:params:oauth:jwk-thumbprint:sha-${digestAlgorithm.slice(-3)}:${thumbprint}`;
+}
+exports.calculateJwkThumbprintUri = calculateJwkThumbprintUri;

package/dist/node/cjs/jws/flattened/verify.js

@@ -32,8 +32,8 @@ async function flattenedVerify(jws, key, options) {
     }
     let parsedProt = {};
     if (jws.protected) {
-        const protectedHeader = (0, base64url_js_1.decode)(jws.protected);
         try {
+            const protectedHeader = (0, base64url_js_1.decode)(jws.protected);
             parsedProt = JSON.parse(buffer_utils_js_1.decoder.decode(protectedHeader));
         }
         catch {

package/dist/node/cjs/lib/crypto_key.js

@@ -74,11 +74,6 @@ function checkSigCryptoKey(key, alg, ...usages) {
                 throw unusable(`SHA-${expected}`, 'algorithm.hash');
             break;
         }
-        case (0, env_js_1.isNodeJs)() && 'EdDSA': {
-            if (key.algorithm.name !== 'NODE-ED25519' && key.algorithm.name !== 'NODE-ED448')
-                throw unusable('NODE-ED25519 or NODE-ED448');
-            break;
-        }
         case (0, env_js_1.isCloudflareWorkers)() && 'EdDSA': {
             if (!isAlgorithm(key.algorithm, 'NODE-ED25519'))
                 throw unusable('NODE-ED25519');

package/dist/node/cjs/runtime/env.js

@@ -1,11 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isNodeJs = exports.isCloudflareWorkers = void 0;
+exports.isCloudflareWorkers = void 0;
 function isCloudflareWorkers() {
     return false;
 }
 exports.isCloudflareWorkers = isCloudflareWorkers;
-function isNodeJs() {
-    return true;
-}
-exports.isNodeJs = isNodeJs;

package/dist/node/cjs/runtime/key_to_jwk.js

@@ -35,6 +35,10 @@ const keyToJWK = (key) => {
         throw new TypeError((0, invalid_key_input_js_1.default)(key, ...is_key_like_js_1.types, 'Uint8Array'));
     }
     if (jwkExportSupported) {
+        if (keyObject.type !== 'secret' &&
+            !['rsa', 'ec', 'ed25519', 'x25519', 'ed448', 'x448'].includes(keyObject.asymmetricKeyType)) {
+            throw new errors_js_1.JOSENotSupported('Unsupported key asymmetricKeyType');
+        }
         return keyObject.export({ format: 'jwk' });
     }
     switch (keyObject.type) {

package/dist/node/esm/index.js

@@ -14,7 +14,7 @@ export { FlattenedSign } from './jws/flattened/sign.js';
 export { GeneralSign } from './jws/general/sign.js';
 export { SignJWT } from './jwt/sign.js';
 export { EncryptJWT } from './jwt/encrypt.js';
-export { calculateJwkThumbprint } from './jwk/thumbprint.js';
+export { calculateJwkThumbprint, calculateJwkThumbprintUri } from './jwk/thumbprint.js';
 export { EmbeddedJWK } from './jwk/embedded.js';
 export { createLocalJWKSet } from './jwks/local.js';
 export { createRemoteJWKSet } from './jwks/remote.js';

package/dist/node/esm/jwe/flattened/decrypt.js

@@ -43,8 +43,8 @@ export async function flattenedDecrypt(jwe, key, options) {
     }
     let parsedProt;
     if (jwe.protected) {
-        const protectedHeader = base64url(jwe.protected);
         try {
+            const protectedHeader = base64url(jwe.protected);
             parsedProt = JSON.parse(decoder.decode(protectedHeader));
         }
         catch {

package/dist/node/esm/jwk/thumbprint.js

@@ -8,10 +8,11 @@ const check = (value, description) => {
         throw new JWKInvalid(`${description} missing or invalid`);
     }
 };
-export async function calculateJwkThumbprint(jwk, digestAlgorithm = 'sha256') {
+export async function calculateJwkThumbprint(jwk, digestAlgorithm) {
     if (!isObject(jwk)) {
         throw new TypeError('JWK must be an object');
     }
+    digestAlgorithm !== null && digestAlgorithm !== void 0 ? digestAlgorithm : (digestAlgorithm = 'sha256');
     if (digestAlgorithm !== 'sha256' &&
         digestAlgorithm !== 'sha384' &&
         digestAlgorithm !== 'sha512') {
@@ -45,3 +46,8 @@ export async function calculateJwkThumbprint(jwk, digestAlgorithm = 'sha256') {
     const data = encoder.encode(JSON.stringify(components));
     return base64url(await digest(digestAlgorithm, data));
 }
+export async function calculateJwkThumbprintUri(jwk, digestAlgorithm) {
+    digestAlgorithm !== null && digestAlgorithm !== void 0 ? digestAlgorithm : (digestAlgorithm = 'sha256');
+    const thumbprint = await calculateJwkThumbprint(jwk, digestAlgorithm);
+    return `urn:ietf:params:oauth:jwk-thumbprint:sha-${digestAlgorithm.slice(-3)}:${thumbprint}`;
+}

package/dist/node/esm/jws/flattened/verify.js

@@ -29,8 +29,8 @@ export async function flattenedVerify(jws, key, options) {
     }
     let parsedProt = {};
     if (jws.protected) {
-        const protectedHeader = base64url(jws.protected);
         try {
+            const protectedHeader = base64url(jws.protected);
             parsedProt = JSON.parse(decoder.decode(protectedHeader));
         }
         catch {

package/dist/node/esm/lib/crypto_key.js

@@ -1,4 +1,4 @@
-import { isCloudflareWorkers, isNodeJs } from '../runtime/env.js';
+import { isCloudflareWorkers } from '../runtime/env.js';
 function unusable(name, prop = 'algorithm.name') {
     return new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
 }
@@ -71,11 +71,6 @@ export function checkSigCryptoKey(key, alg, ...usages) {
                 throw unusable(`SHA-${expected}`, 'algorithm.hash');
             break;
         }
-        case isNodeJs() && 'EdDSA': {
-            if (key.algorithm.name !== 'NODE-ED25519' && key.algorithm.name !== 'NODE-ED448')
-                throw unusable('NODE-ED25519 or NODE-ED448');
-            break;
-        }
         case isCloudflareWorkers() && 'EdDSA': {
             if (!isAlgorithm(key.algorithm, 'NODE-ED25519'))
                 throw unusable('NODE-ED25519');

package/dist/node/esm/runtime/env.js

@@ -1,6 +1,3 @@
 export function isCloudflareWorkers() {
     return false;
 }
-export function isNodeJs() {
-    return true;
-}

package/dist/node/esm/runtime/key_to_jwk.js

@@ -33,6 +33,10 @@ const keyToJWK = (key) => {
         throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
     }
     if (jwkExportSupported) {
+        if (keyObject.type !== 'secret' &&
+            !['rsa', 'ec', 'ed25519', 'x25519', 'ed448', 'x448'].includes(keyObject.asymmetricKeyType)) {
+            throw new JOSENotSupported('Unsupported key asymmetricKeyType');
+        }
         return keyObject.export({ format: 'jwk' });
     }
     switch (keyObject.type) {

package/dist/types/index.d.ts

@@ -25,7 +25,7 @@ export { GeneralSign } from './jws/general/sign';
 export type { Signature } from './jws/general/sign';
 export { SignJWT } from './jwt/sign';
 export { EncryptJWT } from './jwt/encrypt';
-export { calculateJwkThumbprint } from './jwk/thumbprint';
+export { calculateJwkThumbprint, calculateJwkThumbprintUri } from './jwk/thumbprint';
 export { EmbeddedJWK } from './jwk/embedded';
 export { createLocalJWKSet } from './jwks/local';
 export { createRemoteJWKSet } from './jwks/remote';

package/dist/types/jwe/compact/decrypt.d.ts

@@ -1,26 +1,28 @@
 import type { KeyLike, DecryptOptions, CompactJWEHeaderParameters, GetKeyFunction, FlattenedJWE, CompactDecryptResult, ResolvedKey } from '../../types';
 /**
- * Interface for Compact JWE Decryption dynamic key resolution.
- * No token components have been verified at the time of this function call.
+ * Interface for Compact JWE Decryption dynamic key resolution. No token components have been
+ * verified at the time of this function call.
  */
 export interface CompactDecryptGetKey extends GetKeyFunction<CompactJWEHeaderParameters, FlattenedJWE> {
 }
 /**
  * Decrypts a Compact JWE.
  *
- * @param jwe Compact JWE.
- * @param key Private Key or Secret to decrypt the JWE with.
- * @param options JWE Decryption options.
- *
  * @example Usage
+ *
  * ```js
- * const jwe = 'eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.nyQ19eq9ogh9wA7fFtnI2oouzy5_8b5DeLkoRMfi2yijgfTs2zEnayCEofz_qhnL-nwszabd9qUeHv0-IwvhhJJS7GUJOU3ikiIe42qcIAFme1A_Fo9CTxw4XTOy-I5qanl8So91u6hwfyN1VxAqVLsSE7_23EC-gfGEg_5znew9PyXXsOIE-K_HH7IQowRrlZ1X_bM_Liu53RzDpLDvRz59mp3S8L56YqpM8FexFGTGpEaoTcEIst375qncYt3-79IVR7gZN1RWsWgjPatfvVbnh74PglQcATSf3UUhaW0OAKn6q7r3PDx6DIKQ35bgHQg5QopuN00eIfLQL2trGw.W3grIVj5HVuAb76X.6PcuDe5D6ttWFYyv0oqqdDXfI2R8wBg1F2Q80UUA_Gv8eEimNWfxIWdLxrjzgQGSvIhxmFKuLM0.a93_Ug3uZHuczj70Zavx8Q'
+ * const jwe =
+ *   'eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.nyQ19eq9ogh9wA7fFtnI2oouzy5_8b5DeLkoRMfi2yijgfTs2zEnayCEofz_qhnL-nwszabd9qUeHv0-IwvhhJJS7GUJOU3ikiIe42qcIAFme1A_Fo9CTxw4XTOy-I5qanl8So91u6hwfyN1VxAqVLsSE7_23EC-gfGEg_5znew9PyXXsOIE-K_HH7IQowRrlZ1X_bM_Liu53RzDpLDvRz59mp3S8L56YqpM8FexFGTGpEaoTcEIst375qncYt3-79IVR7gZN1RWsWgjPatfvVbnh74PglQcATSf3UUhaW0OAKn6q7r3PDx6DIKQ35bgHQg5QopuN00eIfLQL2trGw.W3grIVj5HVuAb76X.6PcuDe5D6ttWFYyv0oqqdDXfI2R8wBg1F2Q80UUA_Gv8eEimNWfxIWdLxrjzgQGSvIhxmFKuLM0.a93_Ug3uZHuczj70Zavx8Q'
  *
  * const { plaintext, protectedHeader } = await jose.compactDecrypt(jwe, privateKey)
  *
  * console.log(protectedHeader)
  * console.log(new TextDecoder().decode(plaintext))
  * ```
+ *
+ * @param jwe Compact JWE.
+ * @param key Private Key or Secret to decrypt the JWE with.
+ * @param options JWE Decryption options.
  */
 export declare function compactDecrypt(jwe: string | Uint8Array, key: KeyLike | Uint8Array, options?: DecryptOptions): Promise<CompactDecryptResult>;
 /**

package/dist/types/jwe/compact/encrypt.d.ts

@@ -3,11 +3,10 @@ import type { KeyLike, JWEKeyManagementHeaderParameters, CompactJWEHeaderParamet
  * The CompactEncrypt class is a utility for creating Compact JWE strings.
  *
  * @example Usage
+ *
  * ```js
  * const jwe = await new jose.CompactEncrypt(
- *   new TextEncoder().encode(
- *     'It’s a dangerous business, Frodo, going out your door.'
- *   )
+ *   new TextEncoder().encode('It’s a dangerous business, Frodo, going out your door.'),
  * )
  *   .setProtectedHeader({ alg: 'RSA-OAEP-256', enc: 'A256GCM' })
  *   .encrypt(publicKey)
@@ -17,29 +16,24 @@ import type { KeyLike, JWEKeyManagementHeaderParameters, CompactJWEHeaderParamet
  */
 export declare class CompactEncrypt {
     private _flattened;
-    /**
-     * @param plaintext Binary representation of the plaintext to encrypt.
-     */
+    /** @param plaintext Binary representation of the plaintext to encrypt. */
     constructor(plaintext: Uint8Array);
     /**
-     * Sets a content encryption key to use, by default a random suitable one
-     * is generated for the JWE enc" (Encryption Algorithm) Header Parameter.
+     * Sets a content encryption key to use, by default a random suitable one is generated for the JWE
+     * enc" (Encryption Algorithm) Header Parameter.
      *
+     * @deprecated You should not use this method. It is only really intended for test and vector
+     *   validation purposes.
      * @param cek JWE Content Encryption Key.
-     *
-     * @deprecated You should not use this method. It is only really intended
-     * for test and vector validation purposes.
      */
     setContentEncryptionKey(cek: Uint8Array): this;
     /**
-     * Sets the JWE Initialization Vector to use for content encryption, by default
-     * a random suitable one is generated for the JWE enc" (Encryption Algorithm)
-     * Header Parameter.
+     * Sets the JWE Initialization Vector to use for content encryption, by default a random suitable
+     * one is generated for the JWE enc" (Encryption Algorithm) Header Parameter.
      *
+     * @deprecated You should not use this method. It is only really intended for test and vector
+     *   validation purposes.
      * @param iv JWE Initialization Vector.
-     *
-     * @deprecated You should not use this method. It is only really intended
-     * for test and vector validation purposes.
      */
     setInitializationVector(iv: Uint8Array): this;
     /**
@@ -49,9 +43,9 @@ export declare class CompactEncrypt {
      */
     setProtectedHeader(protectedHeader: CompactJWEHeaderParameters): this;
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting the Content
-     * Encryption Key. You do not need to invoke this method, it is only really
-     * intended for test and vector validation purposes.
+     * Sets the JWE Key Management parameters to be used when encrypting the Content Encryption Key.
+     * You do not need to invoke this method, it is only really intended for test and vector
+     * validation purposes.
      *
      * @param parameters JWE Key Management parameters.
      */

package/dist/types/jwe/flattened/decrypt.d.ts

@@ -1,39 +1,38 @@
 import type { FlattenedDecryptResult, KeyLike, FlattenedJWE, JWEHeaderParameters, DecryptOptions, GetKeyFunction, ResolvedKey } from '../../types';
 /**
- * Interface for Flattened JWE Decryption dynamic key resolution.
- * No token components have been verified at the time of this function call.
+ * Interface for Flattened JWE Decryption dynamic key resolution. No token components have been
+ * verified at the time of this function call.
  */
 export interface FlattenedDecryptGetKey extends GetKeyFunction<JWEHeaderParameters | undefined, FlattenedJWE> {
 }
 /**
  * Decrypts a Flattened JWE.
  *
- * @param jwe Flattened JWE.
- * @param key Private Key or Secret to decrypt the JWE with.
- * @param options JWE Decryption options.
- *
  * @example Usage
+ *
  * ```js
  * const jwe = {
  *   ciphertext: '9EzjFISUyoG-ifC2mSihfP0DPC80yeyrxhTzKt1C_VJBkxeBG0MI4Te61Pk45RAGubUvBpU9jm4',
  *   iv: '8Fy7A_IuoX5VXG9s',
  *   tag: 'W76IYV6arGRuDSaSyWrQNg',
- *   encrypted_key: 'Z6eD4UK_yFb5ZoKvKkGAdqywEG_m0e4IYo0x8Vf30LAMJcsc-_zSgIeiF82teZyYi2YYduHKoqImk7MRnoPZOlEs0Q5BNK1OgBmSOhCE8DFyqh9Zh48TCTP6lmBQ52naqoUJFMtHzu-0LwZH26hxos0GP3Dt19O379MJB837TdKKa87skq0zHaVLAquRHOBF77GI54Bc7O49d8aOrSu1VEFGMThlW2caspPRiTSePDMDPq7_WGk50izRhB3Asl9wmP9wEeaTrkJKRnQj5ips1SAZ1hDBsqEQKKukxP1HtdcopHV5_qgwU8Hjm5EwSLMluMQuiE6hwlkXGOujZLVizA',
+ *   encrypted_key:
+ *     'Z6eD4UK_yFb5ZoKvKkGAdqywEG_m0e4IYo0x8Vf30LAMJcsc-_zSgIeiF82teZyYi2YYduHKoqImk7MRnoPZOlEs0Q5BNK1OgBmSOhCE8DFyqh9Zh48TCTP6lmBQ52naqoUJFMtHzu-0LwZH26hxos0GP3Dt19O379MJB837TdKKa87skq0zHaVLAquRHOBF77GI54Bc7O49d8aOrSu1VEFGMThlW2caspPRiTSePDMDPq7_WGk50izRhB3Asl9wmP9wEeaTrkJKRnQj5ips1SAZ1hDBsqEQKKukxP1HtdcopHV5_qgwU8Hjm5EwSLMluMQuiE6hwlkXGOujZLVizA',
  *   aad: 'VGhlIEZlbGxvd3NoaXAgb2YgdGhlIFJpbmc',
- *   protected: 'eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0'
+ *   protected: 'eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0',
  * }
  *
- * const {
- *   plaintext,
- *   protectedHeader,
- *   additionalAuthenticatedData
- * } = await jose.flattenedDecrypt(jwe, privateKey)
+ * const { plaintext, protectedHeader, additionalAuthenticatedData } =
+ *   await jose.flattenedDecrypt(jwe, privateKey)
  *
  * console.log(protectedHeader)
  * const decoder = new TextDecoder()
  * console.log(decoder.decode(plaintext))
  * console.log(decoder.decode(additionalAuthenticatedData))
  * ```
+ *
+ * @param jwe Flattened JWE.
+ * @param key Private Key or Secret to decrypt the JWE with.
+ * @param options JWE Decryption options.
  */
 export declare function flattenedDecrypt(jwe: FlattenedJWE, key: KeyLike | Uint8Array, options?: DecryptOptions): Promise<FlattenedDecryptResult>;
 /**