jose 4.9.3 → 4.10.1

package/README.md

@@ -1,6 +1,6 @@
 # jose
 
-> "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto in Node.js, Browser, Cloudflare Workers, Electron, and Deno.
+> "JSON Web Almost Everything" - JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, and other Web-interoperable runtimes.
 
 ## Implemented specs & features
 
@@ -22,6 +22,8 @@ implementation is correct.
 
 ## [💗 Help the project](https://github.com/sponsors/panva)
 
+## Dependencies: 0
+
 ## Documentation
 
 **`example`** ESM import
@@ -94,31 +96,6 @@ import * as jose from 'https://deno.land/x/jose/index.ts'
 | [v4.x](https://github.com/panva/jose/tree/v4.x) | ✅ | ✅ | ✅ |
 | [v3.x](https://github.com/panva/jose/tree/v3.x), [v2.x](https://github.com/panva/jose/tree/v2.x), [v1.x](https://github.com/panva/jose/tree/v1.x) | ✅ | ❌ | ❌ |
 
-#### Semver?
-
-**Yes.** All module's public API is subject to [Semantic Versioning 2.0.0](https://semver.org/spec/v2.0.0.html).
-
-#### How is it different from [`jws`](https://github.com/brianloveswords/node-jws), [`jwa`](https://github.com/brianloveswords/node-jwa) or [`jsonwebtoken`](https://github.com/auth0/node-jsonwebtoken)?
-
-- it supports Browser, Cloudflare Workers, and Deno runtimes
-- it supports encrypted JWTs (i.e. in JWE format)
-- supports secp256k1, Ed25519, Ed448, X25519, and X448
-- it supports JWK Key Format for all four key types (oct, RSA, EC and OKP)
-- it is exclusively using native platform Key object representations (CryptoKey and KeyObject)
-- there is JSON Web Encryption support
-- it supports the General and Flattened JSON Serialization Syntaxes
-- it supports the "crit" member validations to make sure extensions are handled correctly
-
-#### How is it different from [`node-jose`](https://github.com/cisco/node-jose)?
-
-`node-jose` is built to work in any javascript runtime, to be able to do that it packs a lot of
-polyfills and javascript implementation code in the form of
-[`node-forge`](https://github.com/digitalbazaar/forge), this significantly increases the footprint
-of the modules with dependencies that either aren't ever used or have native implementation available
-in the runtime already, those are often times faster and more reliable.
-
-- supports secp256k1, Ed25519, Ed448, X25519, and X448
-
 #### Uint8Array?!
 
 - Whenever `Uint8Array` is a valid input, so is [`Buffer`](https://nodejs.org/api/buffer.html#buffer_buffer) since buffers are instances of Uint8Array.

package/dist/browser/key/import.js

@@ -33,18 +33,12 @@ function parseElement(bytes) {
         length = bytes[position];
         position++;
     }
-    else {
-        let numberOfDigits = bytes[position] & 0x7f;
-        position++;
-        length = 0;
-        for (let i = 0; i < numberOfDigits; i++) {
-            length = length * 256 + bytes[position];
-            position++;
-        }
-    }
-    if (length === 0x80) {
+    else if (length === 0x80) {
         length = 0;
         while (bytes[position + length] !== 0 || bytes[position + length + 1] !== 0) {
+            if (length > bytes.byteLength) {
+                throw new TypeError('invalid indefinite form length');
+            }
             length++;
         }
         const byteLength = position + length + 2;
@@ -54,6 +48,15 @@ function parseElement(bytes) {
             raw: bytes.subarray(0, byteLength),
         };
     }
+    else {
+        let numberOfDigits = bytes[position] & 0x7f;
+        position++;
+        length = 0;
+        for (let i = 0; i < numberOfDigits; i++) {
+            length = length * 256 + bytes[position];
+            position++;
+        }
+    }
     const byteLength = position + length;
     return {
         byteLength,
@@ -80,7 +83,13 @@ export async function importX509(x509, alg, options) {
     if (typeof x509 !== 'string' || x509.indexOf('-----BEGIN CERTIFICATE-----') !== 0) {
         throw new TypeError('"x509" must be X.509 formatted string');
     }
-    const spki = getSPKI(x509);
+    let spki;
+    try {
+        spki = getSPKI(x509);
+    }
+    catch (cause) {
+        throw new TypeError('failed to parse the X.509 certificate', { cause });
+    }
     return importPublic(spki, alg, options);
 }
 export async function importPKCS8(pkcs8, alg, options) {

package/dist/browser/lib/crypto_key.js

@@ -76,6 +76,12 @@ export function checkSigCryptoKey(key, alg, ...usages) {
                 throw unusable('NODE-ED25519');
             break;
         }
+        case 'EdDSA': {
+            if (key.algorithm.name !== 'Ed25519' && key.algorithm.name !== 'Ed448') {
+                throw unusable('Ed25519 or Ed448');
+            }
+            break;
+        }
         case 'ES256':
         case 'ES384':
         case 'ES512': {
@@ -116,10 +122,17 @@ export function checkEncCryptoKey(key, alg, ...usages) {
                 throw unusable(expected, 'algorithm.length');
             break;
         }
-        case 'ECDH':
-            if (!isAlgorithm(key.algorithm, 'ECDH'))
-                throw unusable('ECDH');
+        case 'ECDH': {
+            switch (key.algorithm.name) {
+                case 'ECDH':
+                case 'X25519':
+                case 'X448':
+                    break;
+                default:
+                    throw unusable('ECDH, X25519, or X448');
+            }
             break;
+        }
         case 'PBES2-HS256+A128KW':
         case 'PBES2-HS384+A192KW':
         case 'PBES2-HS512+A256KW':

package/dist/browser/runtime/asn1.js

@@ -44,8 +44,14 @@ const getNamedCurve = (keyData) => {
             return 'P-384';
         case findOid(keyData, [0x2b, 0x81, 0x04, 0x00, 0x23]):
             return 'P-521';
-        case isCloudflareWorkers() && findOid(keyData, [0x2b, 0x65, 0x70]):
+        case findOid(keyData, [0x2b, 0x65, 0x6e]):
+            return 'X25519';
+        case findOid(keyData, [0x2b, 0x65, 0x6f]):
+            return 'X448';
+        case findOid(keyData, [0x2b, 0x65, 0x70]):
             return 'Ed25519';
+        case findOid(keyData, [0x2b, 0x65, 0x71]):
+            return 'Ed448';
         default:
             throw new JOSENotSupported('Invalid or unsupported EC Key Curve or OKP Key Sub Type');
     }
@@ -96,15 +102,22 @@ const genericImport = async (replace, keyFormat, pem, alg, options) => {
         case 'ECDH-ES':
         case 'ECDH-ES+A128KW':
         case 'ECDH-ES+A192KW':
-        case 'ECDH-ES+A256KW':
-            algorithm = { name: 'ECDH', namedCurve: getNamedCurve(keyData) };
+        case 'ECDH-ES+A256KW': {
+            const namedCurve = getNamedCurve(keyData);
+            algorithm = namedCurve.startsWith('P-') ? { name: 'ECDH', namedCurve } : { name: namedCurve };
             keyUsages = isPublic ? [] : ['deriveBits'];
             break;
-        case isCloudflareWorkers() && 'EdDSA':
+        }
+        case isCloudflareWorkers() && 'EdDSA': {
             const namedCurve = getNamedCurve(keyData).toUpperCase();
             algorithm = { name: `NODE-${namedCurve}`, namedCurve: `NODE-${namedCurve}` };
             keyUsages = isPublic ? ['verify'] : ['sign'];
             break;
+        }
+        case 'EdDSA':
+            algorithm = { name: getNamedCurve(keyData) };
+            keyUsages = isPublic ? ['verify'] : ['sign'];
+            break;
         default:
             throw new JOSENotSupported('Invalid or unsupported "alg" (Algorithm) value');
     }

package/dist/browser/runtime/ecdhes.js

@@ -13,10 +13,21 @@ export async function deriveKey(publicKey, privateKey, algorithm, keyLength, apu
     }
     checkEncCryptoKey(privateKey, 'ECDH', 'deriveBits');
     const value = concat(lengthAndInput(encoder.encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength));
+    let length;
+    if (publicKey.algorithm.name === 'X25519') {
+        length = 256;
+    }
+    else if (publicKey.algorithm.name === 'X448') {
+        length = 448;
+    }
+    else {
+        length =
+            Math.ceil(parseInt(publicKey.algorithm.namedCurve.substr(-3), 10) / 8) << 3;
+    }
     const sharedSecret = new Uint8Array(await crypto.subtle.deriveBits({
-        name: 'ECDH',
+        name: publicKey.algorithm.name,
         public: publicKey,
-    }, privateKey, Math.ceil(parseInt(privateKey.algorithm.namedCurve.slice(-3), 10) / 8) << 3));
+    }, privateKey, length));
     return concatKdf(sharedSecret, keyLength, value);
 }
 export async function generateEpk(key) {
@@ -29,5 +40,7 @@ export function ecdhAllowed(key) {
     if (!isCryptoKey(key)) {
         throw new TypeError(invalidKeyInput(key, ...types));
     }
-    return ['P-256', 'P-384', 'P-521'].includes(key.algorithm.namedCurve);
+    return (['P-256', 'P-384', 'P-521'].includes(key.algorithm.namedCurve) ||
+        key.algorithm.name === 'X25519' ||
+        key.algorithm.name === 'X448');
 }

package/dist/browser/runtime/env.js

@@ -1,3 +1,5 @@
 export function isCloudflareWorkers() {
-    return typeof WebSocketPair === 'function';
+    return (typeof WebSocketPair !== 'undefined' ||
+        (typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers') ||
+        (typeof EdgeRuntime !== 'undefined' && EdgeRuntime === 'vercel'));
 }

package/dist/browser/runtime/generate.js

@@ -51,7 +51,7 @@ function getModulusLengthOption(options) {
     return modulusLength;
 }
 export async function generateKeyPair(alg, options) {
-    var _a, _b;
+    var _a, _b, _c;
     let algorithm;
     let keyUsages;
     switch (alg) {
@@ -112,15 +112,42 @@ export async function generateKeyPair(alg, options) {
                     throw new JOSENotSupported('Invalid or unsupported crv option provided');
             }
             break;
+        case 'EdDSA':
+            keyUsages = ['sign', 'verify'];
+            const crv = (_a = options === null || options === void 0 ? void 0 : options.crv) !== null && _a !== void 0 ? _a : 'Ed25519';
+            switch (crv) {
+                case 'Ed25519':
+                case 'Ed448':
+                    algorithm = { name: crv };
+                    break;
+                default:
+                    throw new JOSENotSupported('Invalid or unsupported crv option provided');
+            }
+            break;
         case 'ECDH-ES':
         case 'ECDH-ES+A128KW':
         case 'ECDH-ES+A192KW':
-        case 'ECDH-ES+A256KW':
-            algorithm = { name: 'ECDH', namedCurve: (_a = options === null || options === void 0 ? void 0 : options.crv) !== null && _a !== void 0 ? _a : 'P-256' };
+        case 'ECDH-ES+A256KW': {
             keyUsages = ['deriveKey', 'deriveBits'];
+            const crv = (_b = options === null || options === void 0 ? void 0 : options.crv) !== null && _b !== void 0 ? _b : 'P-256';
+            switch (crv) {
+                case 'P-256':
+                case 'P-384':
+                case 'P-521': {
+                    algorithm = { name: 'ECDH', namedCurve: crv };
+                    break;
+                }
+                case 'X25519':
+                case 'X448':
+                    algorithm = { name: crv };
+                    break;
+                default:
+                    throw new JOSENotSupported('Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, X25519, and X448');
+            }
             break;
+        }
         default:
             throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
     }
-    return (crypto.subtle.generateKey(algorithm, (_b = options === null || options === void 0 ? void 0 : options.extractable) !== null && _b !== void 0 ? _b : false, keyUsages));
+    return (crypto.subtle.generateKey(algorithm, (_c = options === null || options === void 0 ? void 0 : options.extractable) !== null && _c !== void 0 ? _c : false, keyUsages));
 }

package/dist/browser/runtime/jwk_to_key.js

@@ -109,9 +109,27 @@ function subtleMapping(jwk) {
                     keyUsages = jwk.d ? ['sign'] : ['verify'];
                     break;
                 default:
-                    throw new JOSENotSupported('Invalid or unsupported JWK "crv" (Subtype of Key Pair) Parameter value');
+                    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
             }
             break;
+        case 'OKP': {
+            switch (jwk.alg) {
+                case 'EdDSA':
+                    algorithm = { name: jwk.crv };
+                    keyUsages = jwk.d ? ['sign'] : ['verify'];
+                    break;
+                case 'ECDH-ES':
+                case 'ECDH-ES+A128KW':
+                case 'ECDH-ES+A192KW':
+                case 'ECDH-ES+A256KW':
+                    algorithm = { name: jwk.crv };
+                    keyUsages = jwk.d ? ['deriveBits'] : [];
+                    break;
+                default:
+                    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
+            }
+            break;
+        }
         default:
             throw new JOSENotSupported('Invalid or unsupported JWK "kty" (Key Type) Parameter value');
     }

package/dist/browser/runtime/subtle_dsa.js

@@ -22,6 +22,8 @@ export default function subtleDsa(alg, algorithm) {
         case isCloudflareWorkers() && 'EdDSA':
             const { namedCurve } = algorithm;
             return { name: namedCurve, namedCurve };
+        case 'EdDSA':
+            return { name: algorithm.name };
         default:
             throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
     }

package/dist/node/cjs/key/import.js

@@ -36,18 +36,12 @@ function parseElement(bytes) {
         length = bytes[position];
         position++;
     }
-    else {
-        let numberOfDigits = bytes[position] & 0x7f;
-        position++;
-        length = 0;
-        for (let i = 0; i < numberOfDigits; i++) {
-            length = length * 256 + bytes[position];
-            position++;
-        }
-    }
-    if (length === 0x80) {
+    else if (length === 0x80) {
         length = 0;
         while (bytes[position + length] !== 0 || bytes[position + length + 1] !== 0) {
+            if (length > bytes.byteLength) {
+                throw new TypeError('invalid indefinite form length');
+            }
             length++;
         }
         const byteLength = position + length + 2;
@@ -57,6 +51,15 @@ function parseElement(bytes) {
             raw: bytes.subarray(0, byteLength),
         };
     }
+    else {
+        let numberOfDigits = bytes[position] & 0x7f;
+        position++;
+        length = 0;
+        for (let i = 0; i < numberOfDigits; i++) {
+            length = length * 256 + bytes[position];
+            position++;
+        }
+    }
     const byteLength = position + length;
     return {
         byteLength,
@@ -84,7 +87,13 @@ async function importX509(x509, alg, options) {
     if (typeof x509 !== 'string' || x509.indexOf('-----BEGIN CERTIFICATE-----') !== 0) {
         throw new TypeError('"x509" must be X.509 formatted string');
     }
-    const spki = getSPKI(x509);
+    let spki;
+    try {
+        spki = getSPKI(x509);
+    }
+    catch (cause) {
+        throw new TypeError('failed to parse the X.509 certificate', { cause });
+    }
     return (0, asn1_js_1.fromSPKI)(spki, alg, options);
 }
 exports.importX509 = importX509;

package/dist/node/cjs/lib/crypto_key.js

@@ -79,6 +79,12 @@ function checkSigCryptoKey(key, alg, ...usages) {
                 throw unusable('NODE-ED25519');
             break;
         }
+        case 'EdDSA': {
+            if (key.algorithm.name !== 'Ed25519' && key.algorithm.name !== 'Ed448') {
+                throw unusable('Ed25519 or Ed448');
+            }
+            break;
+        }
         case 'ES256':
         case 'ES384':
         case 'ES512': {
@@ -120,10 +126,17 @@ function checkEncCryptoKey(key, alg, ...usages) {
                 throw unusable(expected, 'algorithm.length');
             break;
         }
-        case 'ECDH':
-            if (!isAlgorithm(key.algorithm, 'ECDH'))
-                throw unusable('ECDH');
+        case 'ECDH': {
+            switch (key.algorithm.name) {
+                case 'ECDH':
+                case 'X25519':
+                case 'X448':
+                    break;
+                default:
+                    throw unusable('ECDH, X25519, or X448');
+            }
             break;
+        }
         case 'PBES2-HS256+A128KW':
         case 'PBES2-HS384+A192KW':
         case 'PBES2-HS512+A256KW':

package/dist/node/esm/key/import.js

@@ -33,18 +33,12 @@ function parseElement(bytes) {
         length = bytes[position];
         position++;
     }
-    else {
-        let numberOfDigits = bytes[position] & 0x7f;
-        position++;
-        length = 0;
-        for (let i = 0; i < numberOfDigits; i++) {
-            length = length * 256 + bytes[position];
-            position++;
-        }
-    }
-    if (length === 0x80) {
+    else if (length === 0x80) {
         length = 0;
         while (bytes[position + length] !== 0 || bytes[position + length + 1] !== 0) {
+            if (length > bytes.byteLength) {
+                throw new TypeError('invalid indefinite form length');
+            }
             length++;
         }
         const byteLength = position + length + 2;
@@ -54,6 +48,15 @@ function parseElement(bytes) {
             raw: bytes.subarray(0, byteLength),
         };
     }
+    else {
+        let numberOfDigits = bytes[position] & 0x7f;
+        position++;
+        length = 0;
+        for (let i = 0; i < numberOfDigits; i++) {
+            length = length * 256 + bytes[position];
+            position++;
+        }
+    }
     const byteLength = position + length;
     return {
         byteLength,
@@ -80,7 +83,13 @@ export async function importX509(x509, alg, options) {
     if (typeof x509 !== 'string' || x509.indexOf('-----BEGIN CERTIFICATE-----') !== 0) {
         throw new TypeError('"x509" must be X.509 formatted string');
     }
-    const spki = getSPKI(x509);
+    let spki;
+    try {
+        spki = getSPKI(x509);
+    }
+    catch (cause) {
+        throw new TypeError('failed to parse the X.509 certificate', { cause });
+    }
     return importPublic(spki, alg, options);
 }
 export async function importPKCS8(pkcs8, alg, options) {

package/dist/node/esm/lib/crypto_key.js

@@ -76,6 +76,12 @@ export function checkSigCryptoKey(key, alg, ...usages) {
                 throw unusable('NODE-ED25519');
             break;
         }
+        case 'EdDSA': {
+            if (key.algorithm.name !== 'Ed25519' && key.algorithm.name !== 'Ed448') {
+                throw unusable('Ed25519 or Ed448');
+            }
+            break;
+        }
         case 'ES256':
         case 'ES384':
         case 'ES512': {
@@ -116,10 +122,17 @@ export function checkEncCryptoKey(key, alg, ...usages) {
                 throw unusable(expected, 'algorithm.length');
             break;
         }
-        case 'ECDH':
-            if (!isAlgorithm(key.algorithm, 'ECDH'))
-                throw unusable('ECDH');
+        case 'ECDH': {
+            switch (key.algorithm.name) {
+                case 'ECDH':
+                case 'X25519':
+                case 'X448':
+                    break;
+                default:
+                    throw unusable('ECDH, X25519, or X448');
+            }
             break;
+        }
         case 'PBES2-HS256+A128KW':
         case 'PBES2-HS384+A192KW':
         case 'PBES2-HS512+A256KW':

package/dist/types/jwk/thumbprint.d.ts

@@ -1,7 +1,6 @@
 import type { JWK } from '../types';
 /**
- * Calculates a base64url-encoded JSON Web Key (JWK) Thumbprint as per
- * [RFC7638](https://www.rfc-editor.org/rfc/rfc7638).
+ * Calculates a base64url-encoded JSON Web Key (JWK) Thumbprint
  *
  * @example Usage
  *
@@ -18,11 +17,13 @@ import type { JWK } from '../types';
  * ```
  *
  * @param jwk JSON Web Key.
- * @param digestAlgorithm Digest Algorithm to use for calculating the thumbprint. Default is "sha256".
+ * @param digestAlgorithm Digest Algorithm to use for calculating the thumbprint. Default is
+ *   "sha256".
+ * @see [RFC7638](https://www.rfc-editor.org/rfc/rfc7638)
  */
 export declare function calculateJwkThumbprint(jwk: JWK, digestAlgorithm?: 'sha256' | 'sha384' | 'sha512'): Promise<string>;
 /**
- * Calculates a JSON Web Key (JWK) Thumbprint URI as per [RFC9278](https://www.rfc-editor.org/rfc/rfc9278).
+ * Calculates a JSON Web Key (JWK) Thumbprint URI
  *
  * @example Usage
  *
@@ -39,6 +40,8 @@ export declare function calculateJwkThumbprint(jwk: JWK, digestAlgorithm?: 'sha2
  * ```
  *
  * @param jwk JSON Web Key.
- * @param digestAlgorithm Digest Algorithm to use for calculating the thumbprint. Default is "sha256".
+ * @param digestAlgorithm Digest Algorithm to use for calculating the thumbprint. Default is
+ *   "sha256".
+ * @see [RFC9278](https://www.rfc-editor.org/rfc/rfc9278)
  */
 export declare function calculateJwkThumbprintUri(jwk: JWK, digestAlgorithm?: 'sha256' | 'sha384' | 'sha512'): Promise<string>;

package/dist/types/jwks/remote.d.ts

@@ -11,7 +11,10 @@ export interface RemoteJWKSetOptions {
      * successful fetch. Default is 30000 (30 seconds).
      */
     cooldownDuration?: number;
-    /** Maximum time (in milliseconds) between successful HTTP requests. Default is 600000 (10 minutes). */
+    /**
+     * Maximum time (in milliseconds) between successful HTTP requests. Default is 600000 (10
+     * minutes).
+     */
     cacheMaxAge?: number | typeof Infinity;
     /**
      * An instance of [http.Agent](https://nodejs.org/api/http.html#class-httpagent) or
@@ -25,14 +28,12 @@ export interface RemoteJWKSetOptions {
     /** Optional headers to be sent with the HTTP request. */
     headers?: Record<string, string>;
 }
-interface URL {
-    href: string;
-}
 /**
  * Returns a function that resolves to a key object downloaded from a remote endpoint returning a
  * JSON Web Key Set, that is, for example, an OAuth 2.0 or OIDC jwks_uri. Only a single public key
  * must match the selection process. The JSON Web Key Set is fetched when no key matches the
- * selection process but only as frequently as the `cooldownDuration` option allows, to prevent abuse.
+ * selection process but only as frequently as the `cooldownDuration` option allows, to prevent
+ * abuse.
  *
  * @example Usage
  *
@@ -51,4 +52,3 @@ interface URL {
  * @param options Options for the remote JSON Web Key Set.
  */
 export declare function createRemoteJWKSet(url: URL, options?: RemoteJWKSetOptions): GetKeyFunction<JWSHeaderParameters, FlattenedJWSInput>;
-export {};

package/dist/types/jwt/produce.d.ts

@@ -47,7 +47,8 @@ export declare class ProduceJWT {
     /**
      * Set "iat" (Issued At) Claim.
      *
-     * @param input "iat" (Issued At) Claim value to set on the JWT Claims Set. Default is current timestamp.
+     * @param input "iat" (Issued At) Claim value to set on the JWT Claims Set. Default is current
+     *   timestamp.
      */
     setIssuedAt(input?: number): this;
 }

package/dist/types/types.d.ts

@@ -368,7 +368,7 @@ export interface CritOption {
    * for those is either `true` or `false`. `true` when the Header Parameter MUST be integrity
    * protected, `false` when it's irrelevant.
    *
-   * This makes the "Extension Header Parameter "${parameter}" is not recognized" error go away.
+   * This makes the "Extension Header Parameter "..." is not recognized" error go away.
    *
    * Use this when a given JWS/JWT/JWE profile requires the use of proprietary non-registered "crit"
    * (Critical) Header Parameters. This will only make sure the Header Parameter is syntactically
@@ -378,7 +378,8 @@ export interface CritOption {
    * the operation succeeds.
    *
    * The JWS extension Header Parameter `b64` is always recognized and processed properly. No other
-   * registered Header Parameters that need this kind of default built-in treatment are currently available.
+   * registered Header Parameters that need this kind of default built-in treatment are currently
+   * available.
    */
   crit?: {
     [propName: string]: boolean
@@ -460,7 +461,8 @@ export interface JWTClaimVerificationOptions {
 export interface VerifyOptions extends CritOption {
   /**
    * A list of accepted JWS "alg" (Algorithm) Header Parameter values. By default all "alg"
-   * (Algorithm) values applicable for the used key/secret are allowed. Note: "none" is never accepted.
+   * (Algorithm) values applicable for the used key/secret are allowed. Note: "none" is never
+   * accepted.
    */
   algorithms?: string[]
 }
@@ -470,25 +472,49 @@ export interface SignOptions extends CritOption {}
 
 /** Recognized JWT Claims Set members, any other members may also be present. */
 export interface JWTPayload {
-  /** JWT Issuer - [RFC7519#section-4.1.1](https://www.rfc-editor.org/rfc/rfc7519#section-4.1.1). */
+  /**
+   * JWT Issuer
+   *
+   * @see [RFC7519#section-4.1.1](https://www.rfc-editor.org/rfc/rfc7519#section-4.1.1)
+   */
   iss?: string
 
-  /** JWT Subject - [RFC7519#section-4.1.2](https://www.rfc-editor.org/rfc/rfc7519#section-4.1.2). */
+  /**
+   * JWT Subject
+   *
+   * @see [RFC7519#section-4.1.2](https://www.rfc-editor.org/rfc/rfc7519#section-4.1.2)
+   */
   sub?: string
 
   /** JWT Audience [RFC7519#section-4.1.3](https://www.rfc-editor.org/rfc/rfc7519#section-4.1.3). */
   aud?: string | string[]
 
-  /** JWT ID - [RFC7519#section-4.1.7](https://www.rfc-editor.org/rfc/rfc7519#section-4.1.7). */
+  /**
+   * JWT ID
+   *
+   * @see [RFC7519#section-4.1.7](https://www.rfc-editor.org/rfc/rfc7519#section-4.1.7)
+   */
   jti?: string
 
-  /** JWT Not Before - [RFC7519#section-4.1.5](https://www.rfc-editor.org/rfc/rfc7519#section-4.1.5). */
+  /**
+   * JWT Not Before
+   *
+   * @see [RFC7519#section-4.1.5](https://www.rfc-editor.org/rfc/rfc7519#section-4.1.5)
+   */
   nbf?: number
 
-  /** JWT Expiration Time - [RFC7519#section-4.1.4](https://www.rfc-editor.org/rfc/rfc7519#section-4.1.4). */
+  /**
+   * JWT Expiration Time
+   *
+   * @see [RFC7519#section-4.1.4](https://www.rfc-editor.org/rfc/rfc7519#section-4.1.4)
+   */
   exp?: number
 
-  /** JWT Issued At - [RFC7519#section-4.1.6](https://www.rfc-editor.org/rfc/rfc7519#section-4.1.6). */
+  /**
+   * JWT Issued At
+   *
+   * @see [RFC7519#section-4.1.6](https://www.rfc-editor.org/rfc/rfc7519#section-4.1.6)
+   */
   iat?: number
 
   /** Any other JWT Claim Set member. */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "jose",
-  "version": "4.9.3",
-  "description": "'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto",
+  "version": "4.10.1",
+  "description": "'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, and other Web-interoperable runtimes",
   "keywords": [
     "browser",
     "cloudflare",