jose 4.8.3 → 4.9.2

package/README.md

@@ -12,6 +12,7 @@ The following specifications are implemented by `jose`
 - JSON Web Algorithms (JWA) - [RFC7518][spec-jwa]
 - JSON Web Token (JWT) - [RFC7519][spec-jwt]
 - JSON Web Key Thumbprint - [RFC7638][spec-thumbprint]
+- JSON Web Key Thumbprint URI - [RFC9278][spec-thumbprint-uri]
 - JWS Unencoded Payload Option - [RFC7797][spec-b64]
 - CFRG Elliptic Curve ECDH and Signatures - [RFC8037][spec-okp]
 - secp256k1 EC Key curve support - [JOSE Registrations for WebAuthn Algorithms][spec-secp256k1]
@@ -56,8 +57,9 @@ import * as jose from 'https://deno.land/x/jose/index.ts'
   - Signing - [Compact](docs/classes/jws_compact_sign.CompactSign.md#readme), [Flattened](docs/classes/jws_flattened_sign.FlattenedSign.md#readme), [General](docs/classes/jws_general_sign.GeneralSign.md#readme)
   - Verification - [Compact](docs/functions/jws_compact_verify.compactVerify.md#readme), [Flattened](docs/functions/jws_flattened_verify.flattenedVerify.md#readme), [General](docs/functions/jws_general_verify.generalVerify.md#readme)
 - JSON Web Key (JWK)
-  - [Thumbprints](docs/functions/jwk_thumbprint.calculateJwkThumbprint.md#readme)
-  - [EmbeddedJWK](docs/functions/jwk_embedded.EmbeddedJWK.md#readme)
+  - [Calculating JWK Thumbprint](docs/functions/jwk_thumbprint.calculateJwkThumbprint.md#readme)
+  - [Calculating JWK Thumbprint URI](docs/functions/jwk_thumbprint.calculateJwkThumbprintUri.md#readme)
+  - [Verification using a JWK Embedded in a JWS Header](docs/functions/jwk_embedded.EmbeddedJWK.md#readme)
 - JSON Web Key Set (JWKS)
   - [Verify using a local JWKSet](docs/functions/jwks_local.createLocalJWKSet.md#readme)
   - [Verify using a remote JWKSet](docs/functions/jwks_remote.createRemoteJWKSet.md#readme)
@@ -104,7 +106,7 @@ import * as jose from 'https://deno.land/x/jose/index.ts'
 - it supports JWK Key Format for all four key types (oct, RSA, EC and OKP)
 - it is exclusively using native platform Key object representations (CryptoKey and KeyObject)
 - there is JSON Web Encryption support
-- it supports the flattened JWS / JWE Serialization Syntaxes
+- it supports the General and Flattened JSON Serialization Syntaxes
 - it supports the "crit" member validations to make sure extensions are handled correctly
 
 #### How is it different from [`node-jose`](https://github.com/cisco/node-jose)?
@@ -142,6 +144,7 @@ install size should not be a cause for concern.
 [spec-okp]: https://www.rfc-editor.org/rfc/rfc8037
 [spec-secp256k1]: https://www.rfc-editor.org/rfc/rfc8812
 [spec-thumbprint]: https://www.rfc-editor.org/rfc/rfc7638
+[spec-thumbprint-uri]: https://www.rfc-editor.org/rfc/rfc9278
 [support-sponsor]: https://github.com/sponsors/panva
 [conditional-exports]: https://nodejs.org/api/packages.html#packages_conditional_exports
 [webcrypto]: https://www.w3.org/TR/WebCryptoAPI/

package/dist/browser/index.js

@@ -14,7 +14,7 @@ export { FlattenedSign } from './jws/flattened/sign.js';
 export { GeneralSign } from './jws/general/sign.js';
 export { SignJWT } from './jwt/sign.js';
 export { EncryptJWT } from './jwt/encrypt.js';
-export { calculateJwkThumbprint } from './jwk/thumbprint.js';
+export { calculateJwkThumbprint, calculateJwkThumbprintUri } from './jwk/thumbprint.js';
 export { EmbeddedJWK } from './jwk/embedded.js';
 export { createLocalJWKSet } from './jwks/local.js';
 export { createRemoteJWKSet } from './jwks/remote.js';

package/dist/browser/jwe/flattened/decrypt.js

@@ -43,8 +43,8 @@ export async function flattenedDecrypt(jwe, key, options) {
     }
     let parsedProt;
     if (jwe.protected) {
-        const protectedHeader = base64url(jwe.protected);
         try {
+            const protectedHeader = base64url(jwe.protected);
             parsedProt = JSON.parse(decoder.decode(protectedHeader));
         }
         catch (_b) {
@@ -95,10 +95,10 @@ export async function flattenedDecrypt(jwe, key, options) {
     }
     let cek;
     try {
-        cek = await decryptKeyManagement(alg, key, encryptedKey, joseHeader);
+        cek = await decryptKeyManagement(alg, key, encryptedKey, joseHeader, options);
     }
     catch (err) {
-        if (err instanceof TypeError) {
+        if (err instanceof TypeError || err instanceof JWEInvalid || err instanceof JOSENotSupported) {
             throw err;
         }
         cek = generateCek(enc);

package/dist/browser/jwk/thumbprint.js

@@ -8,10 +8,11 @@ const check = (value, description) => {
         throw new JWKInvalid(`${description} missing or invalid`);
     }
 };
-export async function calculateJwkThumbprint(jwk, digestAlgorithm = 'sha256') {
+export async function calculateJwkThumbprint(jwk, digestAlgorithm) {
     if (!isObject(jwk)) {
         throw new TypeError('JWK must be an object');
     }
+    digestAlgorithm !== null && digestAlgorithm !== void 0 ? digestAlgorithm : (digestAlgorithm = 'sha256');
     if (digestAlgorithm !== 'sha256' &&
         digestAlgorithm !== 'sha384' &&
         digestAlgorithm !== 'sha512') {
@@ -45,3 +46,8 @@ export async function calculateJwkThumbprint(jwk, digestAlgorithm = 'sha256') {
     const data = encoder.encode(JSON.stringify(components));
     return base64url(await digest(digestAlgorithm, data));
 }
+export async function calculateJwkThumbprintUri(jwk, digestAlgorithm) {
+    digestAlgorithm !== null && digestAlgorithm !== void 0 ? digestAlgorithm : (digestAlgorithm = 'sha256');
+    const thumbprint = await calculateJwkThumbprint(jwk, digestAlgorithm);
+    return `urn:ietf:params:oauth:jwk-thumbprint:sha-${digestAlgorithm.slice(-3)}:${thumbprint}`;
+}

package/dist/browser/jws/flattened/verify.js

@@ -29,8 +29,8 @@ export async function flattenedVerify(jws, key, options) {
     }
     let parsedProt = {};
     if (jws.protected) {
-        const protectedHeader = base64url(jws.protected);
         try {
+            const protectedHeader = base64url(jws.protected);
             parsedProt = JSON.parse(decoder.decode(protectedHeader));
         }
         catch (_b) {

package/dist/browser/lib/decrypt_key_management.js

@@ -9,7 +9,7 @@ import { importJWK } from '../key/import.js';
 import checkKeyType from './check_key_type.js';
 import isObject from './is_object.js';
 import { unwrap as aesGcmKw } from './aesgcmkw.js';
-async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
+async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options) {
     checkKeyType(alg, key, 'decrypt');
     switch (alg) {
         case 'dir': {
@@ -63,6 +63,9 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
                 throw new JWEInvalid('JWE Encrypted Key missing');
             if (typeof joseHeader.p2c !== 'number')
                 throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);
+            const p2cLimit = (options === null || options === void 0 ? void 0 : options.maxPBES2Count) || 10000;
+            if (joseHeader.p2c > p2cLimit)
+                throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);
             if (typeof joseHeader.p2s !== 'string')
                 throw new JWEInvalid(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);
             return pbes2Kw(alg, key, encryptedKey, joseHeader.p2c, base64url(joseHeader.p2s));

package/dist/node/cjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.base64url = exports.generateSecret = exports.generateKeyPair = exports.errors = exports.decodeJwt = exports.decodeProtectedHeader = exports.importJWK = exports.importX509 = exports.importPKCS8 = exports.importSPKI = exports.exportJWK = exports.exportSPKI = exports.exportPKCS8 = exports.UnsecuredJWT = exports.createRemoteJWKSet = exports.createLocalJWKSet = exports.EmbeddedJWK = exports.calculateJwkThumbprint = exports.EncryptJWT = exports.SignJWT = exports.GeneralSign = exports.FlattenedSign = exports.CompactSign = exports.FlattenedEncrypt = exports.CompactEncrypt = exports.jwtDecrypt = exports.jwtVerify = exports.generalVerify = exports.flattenedVerify = exports.compactVerify = exports.GeneralEncrypt = exports.generalDecrypt = exports.flattenedDecrypt = exports.compactDecrypt = void 0;
+exports.base64url = exports.generateSecret = exports.generateKeyPair = exports.errors = exports.decodeJwt = exports.decodeProtectedHeader = exports.importJWK = exports.importX509 = exports.importPKCS8 = exports.importSPKI = exports.exportJWK = exports.exportSPKI = exports.exportPKCS8 = exports.UnsecuredJWT = exports.createRemoteJWKSet = exports.createLocalJWKSet = exports.EmbeddedJWK = exports.calculateJwkThumbprintUri = exports.calculateJwkThumbprint = exports.EncryptJWT = exports.SignJWT = exports.GeneralSign = exports.FlattenedSign = exports.CompactSign = exports.FlattenedEncrypt = exports.CompactEncrypt = exports.jwtDecrypt = exports.jwtVerify = exports.generalVerify = exports.flattenedVerify = exports.compactVerify = exports.GeneralEncrypt = exports.generalDecrypt = exports.flattenedDecrypt = exports.compactDecrypt = void 0;
 var decrypt_js_1 = require("./jwe/compact/decrypt.js");
 Object.defineProperty(exports, "compactDecrypt", { enumerable: true, get: function () { return decrypt_js_1.compactDecrypt; } });
 var decrypt_js_2 = require("./jwe/flattened/decrypt.js");
@@ -35,6 +35,7 @@ var encrypt_js_4 = require("./jwt/encrypt.js");
 Object.defineProperty(exports, "EncryptJWT", { enumerable: true, get: function () { return encrypt_js_4.EncryptJWT; } });
 var thumbprint_js_1 = require("./jwk/thumbprint.js");
 Object.defineProperty(exports, "calculateJwkThumbprint", { enumerable: true, get: function () { return thumbprint_js_1.calculateJwkThumbprint; } });
+Object.defineProperty(exports, "calculateJwkThumbprintUri", { enumerable: true, get: function () { return thumbprint_js_1.calculateJwkThumbprintUri; } });
 var embedded_js_1 = require("./jwk/embedded.js");
 Object.defineProperty(exports, "EmbeddedJWK", { enumerable: true, get: function () { return embedded_js_1.EmbeddedJWK; } });
 var local_js_1 = require("./jwks/local.js");

package/dist/node/cjs/jwe/flattened/decrypt.js

@@ -46,8 +46,8 @@ async function flattenedDecrypt(jwe, key, options) {
     }
     let parsedProt;
     if (jwe.protected) {
-        const protectedHeader = (0, base64url_js_1.decode)(jwe.protected);
         try {
+            const protectedHeader = (0, base64url_js_1.decode)(jwe.protected);
             parsedProt = JSON.parse(buffer_utils_js_1.decoder.decode(protectedHeader));
         }
         catch {
@@ -98,10 +98,10 @@ async function flattenedDecrypt(jwe, key, options) {
     }
     let cek;
     try {
-        cek = await (0, decrypt_key_management_js_1.default)(alg, key, encryptedKey, joseHeader);
+        cek = await (0, decrypt_key_management_js_1.default)(alg, key, encryptedKey, joseHeader, options);
     }
     catch (err) {
-        if (err instanceof TypeError) {
+        if (err instanceof TypeError || err instanceof errors_js_1.JWEInvalid || err instanceof errors_js_1.JOSENotSupported) {
             throw err;
         }
         cek = (0, cek_js_1.default)(enc);

package/dist/node/cjs/jwk/thumbprint.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.calculateJwkThumbprint = void 0;
+exports.calculateJwkThumbprintUri = exports.calculateJwkThumbprint = void 0;
 const digest_js_1 = require("../runtime/digest.js");
 const base64url_js_1 = require("../runtime/base64url.js");
 const errors_js_1 = require("../util/errors.js");
@@ -11,10 +11,11 @@ const check = (value, description) => {
         throw new errors_js_1.JWKInvalid(`${description} missing or invalid`);
     }
 };
-async function calculateJwkThumbprint(jwk, digestAlgorithm = 'sha256') {
+async function calculateJwkThumbprint(jwk, digestAlgorithm) {
     if (!(0, is_object_js_1.default)(jwk)) {
         throw new TypeError('JWK must be an object');
     }
+    digestAlgorithm !== null && digestAlgorithm !== void 0 ? digestAlgorithm : (digestAlgorithm = 'sha256');
     if (digestAlgorithm !== 'sha256' &&
         digestAlgorithm !== 'sha384' &&
         digestAlgorithm !== 'sha512') {
@@ -49,3 +50,9 @@ async function calculateJwkThumbprint(jwk, digestAlgorithm = 'sha256') {
     return (0, base64url_js_1.encode)(await (0, digest_js_1.default)(digestAlgorithm, data));
 }
 exports.calculateJwkThumbprint = calculateJwkThumbprint;
+async function calculateJwkThumbprintUri(jwk, digestAlgorithm) {
+    digestAlgorithm !== null && digestAlgorithm !== void 0 ? digestAlgorithm : (digestAlgorithm = 'sha256');
+    const thumbprint = await calculateJwkThumbprint(jwk, digestAlgorithm);
+    return `urn:ietf:params:oauth:jwk-thumbprint:sha-${digestAlgorithm.slice(-3)}:${thumbprint}`;
+}
+exports.calculateJwkThumbprintUri = calculateJwkThumbprintUri;

package/dist/node/cjs/jws/flattened/verify.js

@@ -32,8 +32,8 @@ async function flattenedVerify(jws, key, options) {
     }
     let parsedProt = {};
     if (jws.protected) {
-        const protectedHeader = (0, base64url_js_1.decode)(jws.protected);
         try {
+            const protectedHeader = (0, base64url_js_1.decode)(jws.protected);
             parsedProt = JSON.parse(buffer_utils_js_1.decoder.decode(protectedHeader));
         }
         catch {

package/dist/node/cjs/lib/decrypt_key_management.js

@@ -11,7 +11,7 @@ const import_js_1 = require("../key/import.js");
 const check_key_type_js_1 = require("./check_key_type.js");
 const is_object_js_1 = require("./is_object.js");
 const aesgcmkw_js_1 = require("./aesgcmkw.js");
-async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
+async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options) {
     (0, check_key_type_js_1.default)(alg, key, 'decrypt');
     switch (alg) {
         case 'dir': {
@@ -65,6 +65,9 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
                 throw new errors_js_1.JWEInvalid('JWE Encrypted Key missing');
             if (typeof joseHeader.p2c !== 'number')
                 throw new errors_js_1.JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);
+            const p2cLimit = (options === null || options === void 0 ? void 0 : options.maxPBES2Count) || 10000;
+            if (joseHeader.p2c > p2cLimit)
+                throw new errors_js_1.JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);
             if (typeof joseHeader.p2s !== 'string')
                 throw new errors_js_1.JWEInvalid(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);
             return (0, pbes2kw_js_1.decrypt)(alg, key, encryptedKey, joseHeader.p2c, (0, base64url_js_1.decode)(joseHeader.p2s));

package/dist/node/cjs/runtime/key_to_jwk.js

@@ -35,6 +35,10 @@ const keyToJWK = (key) => {
         throw new TypeError((0, invalid_key_input_js_1.default)(key, ...is_key_like_js_1.types, 'Uint8Array'));
     }
     if (jwkExportSupported) {
+        if (keyObject.type !== 'secret' &&
+            !['rsa', 'ec', 'ed25519', 'x25519', 'ed448', 'x448'].includes(keyObject.asymmetricKeyType)) {
+            throw new errors_js_1.JOSENotSupported('Unsupported key asymmetricKeyType');
+        }
         return keyObject.export({ format: 'jwk' });
     }
     switch (keyObject.type) {

package/dist/node/esm/index.js

@@ -14,7 +14,7 @@ export { FlattenedSign } from './jws/flattened/sign.js';
 export { GeneralSign } from './jws/general/sign.js';
 export { SignJWT } from './jwt/sign.js';
 export { EncryptJWT } from './jwt/encrypt.js';
-export { calculateJwkThumbprint } from './jwk/thumbprint.js';
+export { calculateJwkThumbprint, calculateJwkThumbprintUri } from './jwk/thumbprint.js';
 export { EmbeddedJWK } from './jwk/embedded.js';
 export { createLocalJWKSet } from './jwks/local.js';
 export { createRemoteJWKSet } from './jwks/remote.js';

package/dist/node/esm/jwe/flattened/decrypt.js

@@ -43,8 +43,8 @@ export async function flattenedDecrypt(jwe, key, options) {
     }
     let parsedProt;
     if (jwe.protected) {
-        const protectedHeader = base64url(jwe.protected);
         try {
+            const protectedHeader = base64url(jwe.protected);
             parsedProt = JSON.parse(decoder.decode(protectedHeader));
         }
         catch {
@@ -95,10 +95,10 @@ export async function flattenedDecrypt(jwe, key, options) {
     }
     let cek;
     try {
-        cek = await decryptKeyManagement(alg, key, encryptedKey, joseHeader);
+        cek = await decryptKeyManagement(alg, key, encryptedKey, joseHeader, options);
     }
     catch (err) {
-        if (err instanceof TypeError) {
+        if (err instanceof TypeError || err instanceof JWEInvalid || err instanceof JOSENotSupported) {
             throw err;
         }
         cek = generateCek(enc);

package/dist/node/esm/jwk/thumbprint.js

@@ -8,10 +8,11 @@ const check = (value, description) => {
         throw new JWKInvalid(`${description} missing or invalid`);
     }
 };
-export async function calculateJwkThumbprint(jwk, digestAlgorithm = 'sha256') {
+export async function calculateJwkThumbprint(jwk, digestAlgorithm) {
     if (!isObject(jwk)) {
         throw new TypeError('JWK must be an object');
     }
+    digestAlgorithm !== null && digestAlgorithm !== void 0 ? digestAlgorithm : (digestAlgorithm = 'sha256');
     if (digestAlgorithm !== 'sha256' &&
         digestAlgorithm !== 'sha384' &&
         digestAlgorithm !== 'sha512') {
@@ -45,3 +46,8 @@ export async function calculateJwkThumbprint(jwk, digestAlgorithm = 'sha256') {
     const data = encoder.encode(JSON.stringify(components));
     return base64url(await digest(digestAlgorithm, data));
 }
+export async function calculateJwkThumbprintUri(jwk, digestAlgorithm) {
+    digestAlgorithm !== null && digestAlgorithm !== void 0 ? digestAlgorithm : (digestAlgorithm = 'sha256');
+    const thumbprint = await calculateJwkThumbprint(jwk, digestAlgorithm);
+    return `urn:ietf:params:oauth:jwk-thumbprint:sha-${digestAlgorithm.slice(-3)}:${thumbprint}`;
+}

package/dist/node/esm/jws/flattened/verify.js

@@ -29,8 +29,8 @@ export async function flattenedVerify(jws, key, options) {
     }
     let parsedProt = {};
     if (jws.protected) {
-        const protectedHeader = base64url(jws.protected);
         try {
+            const protectedHeader = base64url(jws.protected);
             parsedProt = JSON.parse(decoder.decode(protectedHeader));
         }
         catch {

package/dist/node/esm/lib/decrypt_key_management.js

@@ -9,7 +9,7 @@ import { importJWK } from '../key/import.js';
 import checkKeyType from './check_key_type.js';
 import isObject from './is_object.js';
 import { unwrap as aesGcmKw } from './aesgcmkw.js';
-async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
+async function decryptKeyManagement(alg, key, encryptedKey, joseHeader, options) {
     checkKeyType(alg, key, 'decrypt');
     switch (alg) {
         case 'dir': {
@@ -63,6 +63,9 @@ async function decryptKeyManagement(alg, key, encryptedKey, joseHeader) {
                 throw new JWEInvalid('JWE Encrypted Key missing');
             if (typeof joseHeader.p2c !== 'number')
                 throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) missing or invalid`);
+            const p2cLimit = (options === null || options === void 0 ? void 0 : options.maxPBES2Count) || 10000;
+            if (joseHeader.p2c > p2cLimit)
+                throw new JWEInvalid(`JOSE Header "p2c" (PBES2 Count) out is of acceptable bounds`);
             if (typeof joseHeader.p2s !== 'string')
                 throw new JWEInvalid(`JOSE Header "p2s" (PBES2 Salt) missing or invalid`);
             return pbes2Kw(alg, key, encryptedKey, joseHeader.p2c, base64url(joseHeader.p2s));

package/dist/node/esm/runtime/key_to_jwk.js

@@ -33,6 +33,10 @@ const keyToJWK = (key) => {
         throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
     }
     if (jwkExportSupported) {
+        if (keyObject.type !== 'secret' &&
+            !['rsa', 'ec', 'ed25519', 'x25519', 'ed448', 'x448'].includes(keyObject.asymmetricKeyType)) {
+            throw new JOSENotSupported('Unsupported key asymmetricKeyType');
+        }
         return keyObject.export({ format: 'jwk' });
     }
     switch (keyObject.type) {

package/dist/types/index.d.ts

@@ -25,7 +25,7 @@ export { GeneralSign } from './jws/general/sign';
 export type { Signature } from './jws/general/sign';
 export { SignJWT } from './jwt/sign';
 export { EncryptJWT } from './jwt/encrypt';
-export { calculateJwkThumbprint } from './jwk/thumbprint';
+export { calculateJwkThumbprint, calculateJwkThumbprintUri } from './jwk/thumbprint';
 export { EmbeddedJWK } from './jwk/embedded';
 export { createLocalJWKSet } from './jwks/local';
 export { createRemoteJWKSet } from './jwks/remote';

package/dist/types/jwe/compact/decrypt.d.ts

@@ -1,26 +1,28 @@
 import type { KeyLike, DecryptOptions, CompactJWEHeaderParameters, GetKeyFunction, FlattenedJWE, CompactDecryptResult, ResolvedKey } from '../../types';
 /**
- * Interface for Compact JWE Decryption dynamic key resolution.
- * No token components have been verified at the time of this function call.
+ * Interface for Compact JWE Decryption dynamic key resolution. No token components have been
+ * verified at the time of this function call.
  */
 export interface CompactDecryptGetKey extends GetKeyFunction<CompactJWEHeaderParameters, FlattenedJWE> {
 }
 /**
  * Decrypts a Compact JWE.
  *
- * @param jwe Compact JWE.
- * @param key Private Key or Secret to decrypt the JWE with.
- * @param options JWE Decryption options.
- *
  * @example Usage
+ *
  * ```js
- * const jwe = 'eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.nyQ19eq9ogh9wA7fFtnI2oouzy5_8b5DeLkoRMfi2yijgfTs2zEnayCEofz_qhnL-nwszabd9qUeHv0-IwvhhJJS7GUJOU3ikiIe42qcIAFme1A_Fo9CTxw4XTOy-I5qanl8So91u6hwfyN1VxAqVLsSE7_23EC-gfGEg_5znew9PyXXsOIE-K_HH7IQowRrlZ1X_bM_Liu53RzDpLDvRz59mp3S8L56YqpM8FexFGTGpEaoTcEIst375qncYt3-79IVR7gZN1RWsWgjPatfvVbnh74PglQcATSf3UUhaW0OAKn6q7r3PDx6DIKQ35bgHQg5QopuN00eIfLQL2trGw.W3grIVj5HVuAb76X.6PcuDe5D6ttWFYyv0oqqdDXfI2R8wBg1F2Q80UUA_Gv8eEimNWfxIWdLxrjzgQGSvIhxmFKuLM0.a93_Ug3uZHuczj70Zavx8Q'
+ * const jwe =
+ *   'eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0.nyQ19eq9ogh9wA7fFtnI2oouzy5_8b5DeLkoRMfi2yijgfTs2zEnayCEofz_qhnL-nwszabd9qUeHv0-IwvhhJJS7GUJOU3ikiIe42qcIAFme1A_Fo9CTxw4XTOy-I5qanl8So91u6hwfyN1VxAqVLsSE7_23EC-gfGEg_5znew9PyXXsOIE-K_HH7IQowRrlZ1X_bM_Liu53RzDpLDvRz59mp3S8L56YqpM8FexFGTGpEaoTcEIst375qncYt3-79IVR7gZN1RWsWgjPatfvVbnh74PglQcATSf3UUhaW0OAKn6q7r3PDx6DIKQ35bgHQg5QopuN00eIfLQL2trGw.W3grIVj5HVuAb76X.6PcuDe5D6ttWFYyv0oqqdDXfI2R8wBg1F2Q80UUA_Gv8eEimNWfxIWdLxrjzgQGSvIhxmFKuLM0.a93_Ug3uZHuczj70Zavx8Q'
  *
  * const { plaintext, protectedHeader } = await jose.compactDecrypt(jwe, privateKey)
  *
  * console.log(protectedHeader)
  * console.log(new TextDecoder().decode(plaintext))
  * ```
+ *
+ * @param jwe Compact JWE.
+ * @param key Private Key or Secret to decrypt the JWE with.
+ * @param options JWE Decryption options.
  */
 export declare function compactDecrypt(jwe: string | Uint8Array, key: KeyLike | Uint8Array, options?: DecryptOptions): Promise<CompactDecryptResult>;
 /**

package/dist/types/jwe/compact/encrypt.d.ts

@@ -3,11 +3,10 @@ import type { KeyLike, JWEKeyManagementHeaderParameters, CompactJWEHeaderParamet
  * The CompactEncrypt class is a utility for creating Compact JWE strings.
  *
  * @example Usage
+ *
  * ```js
  * const jwe = await new jose.CompactEncrypt(
- *   new TextEncoder().encode(
- *     'It’s a dangerous business, Frodo, going out your door.'
- *   )
+ *   new TextEncoder().encode('It’s a dangerous business, Frodo, going out your door.'),
  * )
  *   .setProtectedHeader({ alg: 'RSA-OAEP-256', enc: 'A256GCM' })
  *   .encrypt(publicKey)
@@ -17,29 +16,24 @@ import type { KeyLike, JWEKeyManagementHeaderParameters, CompactJWEHeaderParamet
  */
 export declare class CompactEncrypt {
     private _flattened;
-    /**
-     * @param plaintext Binary representation of the plaintext to encrypt.
-     */
+    /** @param plaintext Binary representation of the plaintext to encrypt. */
     constructor(plaintext: Uint8Array);
     /**
-     * Sets a content encryption key to use, by default a random suitable one
-     * is generated for the JWE enc" (Encryption Algorithm) Header Parameter.
+     * Sets a content encryption key to use, by default a random suitable one is generated for the JWE
+     * enc" (Encryption Algorithm) Header Parameter.
      *
+     * @deprecated You should not use this method. It is only really intended for test and vector
+     *   validation purposes.
      * @param cek JWE Content Encryption Key.
-     *
-     * @deprecated You should not use this method. It is only really intended
-     * for test and vector validation purposes.
      */
     setContentEncryptionKey(cek: Uint8Array): this;
     /**
-     * Sets the JWE Initialization Vector to use for content encryption, by default
-     * a random suitable one is generated for the JWE enc" (Encryption Algorithm)
-     * Header Parameter.
+     * Sets the JWE Initialization Vector to use for content encryption, by default a random suitable
+     * one is generated for the JWE enc" (Encryption Algorithm) Header Parameter.
      *
+     * @deprecated You should not use this method. It is only really intended for test and vector
+     *   validation purposes.
      * @param iv JWE Initialization Vector.
-     *
-     * @deprecated You should not use this method. It is only really intended
-     * for test and vector validation purposes.
      */
     setInitializationVector(iv: Uint8Array): this;
     /**
@@ -49,9 +43,9 @@ export declare class CompactEncrypt {
      */
     setProtectedHeader(protectedHeader: CompactJWEHeaderParameters): this;
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting the Content
-     * Encryption Key. You do not need to invoke this method, it is only really
-     * intended for test and vector validation purposes.
+     * Sets the JWE Key Management parameters to be used when encrypting the Content Encryption Key.
+     * You do not need to invoke this method, it is only really intended for test and vector
+     * validation purposes.
      *
      * @param parameters JWE Key Management parameters.
      */

package/dist/types/jwe/flattened/decrypt.d.ts

@@ -1,39 +1,38 @@
 import type { FlattenedDecryptResult, KeyLike, FlattenedJWE, JWEHeaderParameters, DecryptOptions, GetKeyFunction, ResolvedKey } from '../../types';
 /**
- * Interface for Flattened JWE Decryption dynamic key resolution.
- * No token components have been verified at the time of this function call.
+ * Interface for Flattened JWE Decryption dynamic key resolution. No token components have been
+ * verified at the time of this function call.
  */
 export interface FlattenedDecryptGetKey extends GetKeyFunction<JWEHeaderParameters | undefined, FlattenedJWE> {
 }
 /**
  * Decrypts a Flattened JWE.
  *
- * @param jwe Flattened JWE.
- * @param key Private Key or Secret to decrypt the JWE with.
- * @param options JWE Decryption options.
- *
  * @example Usage
+ *
  * ```js
  * const jwe = {
  *   ciphertext: '9EzjFISUyoG-ifC2mSihfP0DPC80yeyrxhTzKt1C_VJBkxeBG0MI4Te61Pk45RAGubUvBpU9jm4',
  *   iv: '8Fy7A_IuoX5VXG9s',
  *   tag: 'W76IYV6arGRuDSaSyWrQNg',
- *   encrypted_key: 'Z6eD4UK_yFb5ZoKvKkGAdqywEG_m0e4IYo0x8Vf30LAMJcsc-_zSgIeiF82teZyYi2YYduHKoqImk7MRnoPZOlEs0Q5BNK1OgBmSOhCE8DFyqh9Zh48TCTP6lmBQ52naqoUJFMtHzu-0LwZH26hxos0GP3Dt19O379MJB837TdKKa87skq0zHaVLAquRHOBF77GI54Bc7O49d8aOrSu1VEFGMThlW2caspPRiTSePDMDPq7_WGk50izRhB3Asl9wmP9wEeaTrkJKRnQj5ips1SAZ1hDBsqEQKKukxP1HtdcopHV5_qgwU8Hjm5EwSLMluMQuiE6hwlkXGOujZLVizA',
+ *   encrypted_key:
+ *     'Z6eD4UK_yFb5ZoKvKkGAdqywEG_m0e4IYo0x8Vf30LAMJcsc-_zSgIeiF82teZyYi2YYduHKoqImk7MRnoPZOlEs0Q5BNK1OgBmSOhCE8DFyqh9Zh48TCTP6lmBQ52naqoUJFMtHzu-0LwZH26hxos0GP3Dt19O379MJB837TdKKa87skq0zHaVLAquRHOBF77GI54Bc7O49d8aOrSu1VEFGMThlW2caspPRiTSePDMDPq7_WGk50izRhB3Asl9wmP9wEeaTrkJKRnQj5ips1SAZ1hDBsqEQKKukxP1HtdcopHV5_qgwU8Hjm5EwSLMluMQuiE6hwlkXGOujZLVizA',
  *   aad: 'VGhlIEZlbGxvd3NoaXAgb2YgdGhlIFJpbmc',
- *   protected: 'eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0'
+ *   protected: 'eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0',
  * }
  *
- * const {
- *   plaintext,
- *   protectedHeader,
- *   additionalAuthenticatedData
- * } = await jose.flattenedDecrypt(jwe, privateKey)
+ * const { plaintext, protectedHeader, additionalAuthenticatedData } =
+ *   await jose.flattenedDecrypt(jwe, privateKey)
  *
  * console.log(protectedHeader)
  * const decoder = new TextDecoder()
  * console.log(decoder.decode(plaintext))
  * console.log(decoder.decode(additionalAuthenticatedData))
  * ```
+ *
+ * @param jwe Flattened JWE.
+ * @param key Private Key or Secret to decrypt the JWE with.
+ * @param options JWE Decryption options.
  */
 export declare function flattenedDecrypt(jwe: FlattenedJWE, key: KeyLike | Uint8Array, options?: DecryptOptions): Promise<FlattenedDecryptResult>;
 /**

package/dist/types/jwe/flattened/encrypt.d.ts

@@ -1,18 +1,14 @@
 import type { KeyLike, FlattenedJWE, JWEHeaderParameters, JWEKeyManagementHeaderParameters, EncryptOptions } from '../../types';
-/**
- * @private
- */
+/** @private */
 export declare const unprotected: unique symbol;
 /**
- * The FlattenedEncrypt class is a utility for creating Flattened JWE
- * objects.
+ * The FlattenedEncrypt class is a utility for creating Flattened JWE objects.
  *
  * @example Usage
+ *
  * ```js
  * const jwe = await new jose.FlattenedEncrypt(
- *   new TextEncoder().encode(
- *     'It’s a dangerous business, Frodo, going out your door.'
- *   )
+ *   new TextEncoder().encode('It’s a dangerous business, Frodo, going out your door.'),
  * )
  *   .setProtectedHeader({ alg: 'RSA-OAEP-256', enc: 'A256GCM' })
  *   .setAdditionalAuthenticatedData(encoder.encode('The Fellowship of the Ring'))
@@ -30,15 +26,13 @@ export declare class FlattenedEncrypt {
     private _cek;
     private _iv;
     private _keyManagementParameters;
-    /**
-     * @param plaintext Binary representation of the plaintext to encrypt.
-     */
+    /** @param plaintext Binary representation of the plaintext to encrypt. */
     constructor(plaintext: Uint8Array);
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting.
-     * Use of this is method is really only needed for ECDH based algorithms
-     * when utilizing the Agreement PartyUInfo or Agreement PartyVInfo parameters.
-     * Other parameters will always be randomly generated when needed and missing.
+     * Sets the JWE Key Management parameters to be used when encrypting. Use of this is method is
+     * really only needed for ECDH based algorithms when utilizing the Agreement PartyUInfo or
+     * Agreement PartyVInfo parameters. Other parameters will always be randomly generated when needed
+     * and missing.
      *
      * @param parameters JWE Key Management parameters.
      */
@@ -68,24 +62,21 @@ export declare class FlattenedEncrypt {
      */
     setAdditionalAuthenticatedData(aad: Uint8Array): this;
     /**
-     * Sets a content encryption key to use, by default a random suitable one
-     * is generated for the JWE enc" (Encryption Algorithm) Header Parameter.
+     * Sets a content encryption key to use, by default a random suitable one is generated for the JWE
+     * enc" (Encryption Algorithm) Header Parameter.
      *
+     * @deprecated You should not use this method. It is only really intended for test and vector
+     *   validation purposes.
      * @param cek JWE Content Encryption Key.
-     *
-     * @deprecated You should not use this method. It is only really intended
-     * for test and vector validation purposes.
      */
     setContentEncryptionKey(cek: Uint8Array): this;
     /**
-     * Sets the JWE Initialization Vector to use for content encryption, by default
-     * a random suitable one is generated for the JWE enc" (Encryption Algorithm)
-     * Header Parameter.
+     * Sets the JWE Initialization Vector to use for content encryption, by default a random suitable
+     * one is generated for the JWE enc" (Encryption Algorithm) Header Parameter.
      *
+     * @deprecated You should not use this method. It is only really intended for test and vector
+     *   validation purposes.
      * @param iv JWE Initialization Vector.
-     *
-     * @deprecated You should not use this method. It is only really intended
-     * for test and vector validation purposes.
      */
     setInitializationVector(iv: Uint8Array): this;
     /**

package/dist/types/jwe/general/decrypt.d.ts

@@ -1,18 +1,15 @@
 import type { KeyLike, DecryptOptions, JWEHeaderParameters, GetKeyFunction, FlattenedJWE, GeneralJWE, GeneralDecryptResult, ResolvedKey } from '../../types';
 /**
- * Interface for General JWE Decryption dynamic key resolution.
- * No token components have been verified at the time of this function call.
+ * Interface for General JWE Decryption dynamic key resolution. No token components have been
+ * verified at the time of this function call.
  */
 export interface GeneralDecryptGetKey extends GetKeyFunction<JWEHeaderParameters, FlattenedJWE> {
 }
 /**
  * Decrypts a General JWE.
  *
- * @param jwe General JWE.
- * @param key Private Key or Secret to decrypt the JWE with.
- * @param options JWE Decryption options.
- *
  * @example Usage
+ *
  * ```js
  * const jwe = {
  *   ciphertext: '9EzjFISUyoG-ifC2mSihfP0DPC80yeyrxhTzKt1C_VJBkxeBG0MI4Te61Pk45RAGubUvBpU9jm4',
@@ -22,22 +19,24 @@ export interface GeneralDecryptGetKey extends GetKeyFunction<JWEHeaderParameters
  *   protected: 'eyJhbGciOiJSU0EtT0FFUC0yNTYiLCJlbmMiOiJBMjU2R0NNIn0',
  *   recipients: [
  *     {
- *       encrypted_key: 'Z6eD4UK_yFb5ZoKvKkGAdqywEG_m0e4IYo0x8Vf30LAMJcsc-_zSgIeiF82teZyYi2YYduHKoqImk7MRnoPZOlEs0Q5BNK1OgBmSOhCE8DFyqh9Zh48TCTP6lmBQ52naqoUJFMtHzu-0LwZH26hxos0GP3Dt19O379MJB837TdKKa87skq0zHaVLAquRHOBF77GI54Bc7O49d8aOrSu1VEFGMThlW2caspPRiTSePDMDPq7_WGk50izRhB3Asl9wmP9wEeaTrkJKRnQj5ips1SAZ1hDBsqEQKKukxP1HtdcopHV5_qgwU8Hjm5EwSLMluMQuiE6hwlkXGOujZLVizA'
- *     }
- *   ]
+ *       encrypted_key:
+ *         'Z6eD4UK_yFb5ZoKvKkGAdqywEG_m0e4IYo0x8Vf30LAMJcsc-_zSgIeiF82teZyYi2YYduHKoqImk7MRnoPZOlEs0Q5BNK1OgBmSOhCE8DFyqh9Zh48TCTP6lmBQ52naqoUJFMtHzu-0LwZH26hxos0GP3Dt19O379MJB837TdKKa87skq0zHaVLAquRHOBF77GI54Bc7O49d8aOrSu1VEFGMThlW2caspPRiTSePDMDPq7_WGk50izRhB3Asl9wmP9wEeaTrkJKRnQj5ips1SAZ1hDBsqEQKKukxP1HtdcopHV5_qgwU8Hjm5EwSLMluMQuiE6hwlkXGOujZLVizA',
+ *     },
+ *   ],
  * }
  *
- * const {
- *   plaintext,
- *   protectedHeader,
- *   additionalAuthenticatedData
- * } = await jose.generalDecrypt(jwe, privateKey)
+ * const { plaintext, protectedHeader, additionalAuthenticatedData } =
+ *   await jose.generalDecrypt(jwe, privateKey)
  *
  * console.log(protectedHeader)
  * const decoder = new TextDecoder()
  * console.log(decoder.decode(plaintext))
  * console.log(decoder.decode(additionalAuthenticatedData))
  * ```
+ *
+ * @param jwe General JWE.
+ * @param key Private Key or Secret to decrypt the JWE with.
+ * @param options JWE Decryption options.
  */
 export declare function generalDecrypt(jwe: GeneralJWE, key: KeyLike | Uint8Array, options?: DecryptOptions): Promise<GeneralDecryptResult>;
 /**