jose 5.1.3 → 5.2.1

package/README.md

@@ -28,10 +28,10 @@ const jose = require('jose')
 
 The `jose` module supports JSON Web Tokens (JWT) and provides functionality for signing and verifying tokens, as well as their JWT Claims Set validation.
 
+- [JWT Claims Set Validation & Signature Verification](docs/functions/jwt_verify.jwtVerify.md) using the `jwtVerify` function
+  - [Using a remote JSON Web Key Set (JWKS)](docs/functions/jwks_remote.createRemoteJWKSet.md)
+  - [Using a local JSON Web Key Set (JWKS)](docs/functions/jwks_local.createLocalJWKSet.md)
 - [Signing](docs/classes/jwt_sign.SignJWT.md) using the `SignJWT` class
-- [Verification & JWT Claims Set Validation](docs/functions/jwt_verify.jwtVerify.md) using the `jwtVerify` function
-  - [Using a remote JWKS](docs/functions/jwks_remote.createRemoteJWKSet.md)
-  - [Using a local JWKS](docs/functions/jwks_local.createLocalJWKSet.md)
 - Utility functions
   - [Decoding Token's Protected Header](docs/functions/util_decode_protected_header.decodeProtectedHeader.md)
   - [Decoding JWT Claims Set](docs/functions/util_decode_jwt.decodeJwt.md) prior to its validation
@@ -40,8 +40,8 @@ The `jose` module supports JSON Web Tokens (JWT) and provides functionality for
 
 The `jose` module supports encrypted JSON Web Tokens and provides functionality for encrypting and decrypting tokens, as well as their JWT Claims Set validation.
 
-- [Encryption](docs/classes/jwt_encrypt.EncryptJWT.md) using the `EncryptJWT` class
 - [Decryption & JWT Claims Set Validation](docs/functions/jwt_decrypt.jwtDecrypt.md) using the `jwtDecrypt` function
+- [Encryption](docs/classes/jwt_encrypt.EncryptJWT.md) using the `EncryptJWT` class
 - Utility functions
   - [Decoding Token's Protected Header](docs/functions/util_decode_protected_header.decodeProtectedHeader.md)
 
@@ -68,8 +68,8 @@ The `jose` module supports signing and verification of JWS messages with arbitra
 
 - Signing - [Compact](docs/classes/jws_compact_sign.CompactSign.md), [Flattened JSON](docs/classes/jws_flattened_sign.FlattenedSign.md), [General JSON](docs/classes/jws_general_sign.GeneralSign.md)
 - Verification - [Compact](docs/functions/jws_compact_verify.compactVerify.md), [Flattened JSON](docs/functions/jws_flattened_verify.flattenedVerify.md), [General JSON](docs/functions/jws_general_verify.generalVerify.md)
-  - [Verify using a remote JWKS](docs/functions/jwks_remote.createRemoteJWKSet.md)
-  - [Verify using a local JWKS](docs/functions/jwks_local.createLocalJWKSet.md)
+  - [Using a remote JSON Web Key Set (JWKS)](docs/functions/jwks_remote.createRemoteJWKSet.md)
+  - [Using a local JSON Web Key Set (JWKS)](docs/functions/jwks_local.createLocalJWKSet.md)
 - Utility functions
   - [Decoding Token's Protected Header](docs/functions/util_decode_protected_header.decodeProtectedHeader.md)
 

package/dist/browser/jwe/flattened/decrypt.js

@@ -131,7 +131,7 @@ export async function flattenedDecrypt(jwe, key, options) {
     catch {
         throw new JWEInvalid('Failed to base64url decode the ciphertext');
     }
-    let plaintext = await decrypt(enc, cek, ciphertext, iv, tag, additionalData);
+    const plaintext = await decrypt(enc, cek, ciphertext, iv, tag, additionalData);
     const result = { plaintext };
     if (jwe.protected !== undefined) {
         result.protectedHeader = parsedProt;

package/dist/browser/jwe/general/encrypt.js

@@ -68,7 +68,7 @@ export class GeneralEncrypt {
                 .setSharedUnprotectedHeader(this._unprotectedHeader)
                 .setUnprotectedHeader(recipient.unprotectedHeader)
                 .encrypt(recipient.key, { ...recipient.options });
-            let jwe = {
+            const jwe = {
                 ciphertext: flattened.ciphertext,
                 iv: flattened.iv,
                 recipients: [{}],
@@ -119,7 +119,7 @@ export class GeneralEncrypt {
             }
         }
         const cek = generateCek(enc);
-        let jwe = {
+        const jwe = {
             ciphertext: '',
             iv: '',
             recipients: [],

package/dist/browser/jwks/local.js

@@ -79,7 +79,7 @@ export class LocalJWKSet {
         if (length === 0) {
             throw new JWKSNoMatchingKey();
         }
-        else if (length !== 1) {
+        if (length !== 1) {
             const error = new JWKSMultipleMatchingKeys();
             const { _cached } = this;
             error[Symbol.asyncIterator] = async function* () {
@@ -87,9 +87,7 @@ export class LocalJWKSet {
                     try {
                         yield await importWithAlgCache(_cached, jwk, alg);
                     }
-                    catch {
-                        continue;
-                    }
+                    catch { }
                 }
             };
             throw error;
@@ -110,7 +108,5 @@ async function importWithAlgCache(cache, jwk, alg) {
 }
 export function createLocalJWKSet(jwks) {
     const set = new LocalJWKSet(jwks);
-    return async function (protectedHeader, token) {
-        return set.getKey(protectedHeader, token);
-    };
+    return async (protectedHeader, token) => set.getKey(protectedHeader, token);
 }

package/dist/browser/jwks/remote.js

@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.1.3';
+    const VERSION = 'v5.2.1';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 class RemoteJWKSet extends LocalJWKSet {
@@ -81,7 +81,5 @@ class RemoteJWKSet extends LocalJWKSet {
 }
 export function createRemoteJWKSet(url, options) {
     const set = new RemoteJWKSet(url, options);
-    return async function (protectedHeader, token) {
-        return set.getKey(protectedHeader, token);
-    };
+    return async (protectedHeader, token) => set.getKey(protectedHeader, token);
 }

package/dist/browser/jwt/produce.js

@@ -61,6 +61,12 @@ export class ProduceJWT {
         else if (input instanceof Date) {
             this._payload = { ...this._payload, iat: validateInput('setIssuedAt', epoch(input)) };
         }
+        else if (typeof input === 'string') {
+            this._payload = {
+                ...this._payload,
+                iat: validateInput('setIssuedAt', epoch(new Date()) + secs(input)),
+            };
+        }
         else {
             this._payload = { ...this._payload, iat: validateInput('setIssuedAt', input) };
         }

package/dist/browser/lib/buffer_utils.js

@@ -6,10 +6,10 @@ export function concat(...buffers) {
     const size = buffers.reduce((acc, { length }) => acc + length, 0);
     const buf = new Uint8Array(size);
     let i = 0;
-    buffers.forEach((buffer) => {
+    for (const buffer of buffers) {
         buf.set(buffer, i);
         i += buffer.length;
-    });
+    }
     return buf;
 }
 export function p2s(alg, p2sInput) {

package/dist/browser/lib/invalid_key_input.js

@@ -16,7 +16,7 @@ function message(msg, actual, ...types) {
         msg += ` Received function ${actual.name}`;
     }
     else if (typeof actual === 'object' && actual != null) {
-        if (actual.constructor && actual.constructor.name) {
+        if (actual.constructor?.name) {
             msg += ` Received an instance of ${actual.constructor.name}`;
         }
     }

package/dist/browser/lib/secs.js

@@ -3,42 +3,53 @@ const hour = minute * 60;
 const day = hour * 24;
 const week = day * 7;
 const year = day * 365.25;
-const REGEX = /^(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)$/i;
+const REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
 export default (str) => {
     const matched = REGEX.exec(str);
-    if (!matched) {
+    if (!matched || (matched[4] && matched[1])) {
         throw new TypeError('Invalid time period format');
     }
-    const value = parseFloat(matched[1]);
-    const unit = matched[2].toLowerCase();
+    const value = parseFloat(matched[2]);
+    const unit = matched[3].toLowerCase();
+    let numericDate;
     switch (unit) {
         case 'sec':
         case 'secs':
         case 'second':
         case 'seconds':
         case 's':
-            return Math.round(value);
+            numericDate = Math.round(value);
+            break;
         case 'minute':
         case 'minutes':
         case 'min':
         case 'mins':
         case 'm':
-            return Math.round(value * minute);
+            numericDate = Math.round(value * minute);
+            break;
         case 'hour':
         case 'hours':
         case 'hr':
         case 'hrs':
         case 'h':
-            return Math.round(value * hour);
+            numericDate = Math.round(value * hour);
+            break;
         case 'day':
         case 'days':
         case 'd':
-            return Math.round(value * day);
+            numericDate = Math.round(value * day);
+            break;
         case 'week':
         case 'weeks':
         case 'w':
-            return Math.round(value * week);
+            numericDate = Math.round(value * week);
+            break;
         default:
-            return Math.round(value * year);
+            numericDate = Math.round(value * year);
+            break;
     }
+    if (matched[1] === '-' || matched[4] === 'ago') {
+        return -numericDate;
+    }
+    return numericDate;
 };

package/dist/browser/lib/validate_crit.js

@@ -25,7 +25,7 @@ function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader,
         if (joseHeader[parameter] === undefined) {
             throw new Err(`Extension Header Parameter "${parameter}" is missing`);
         }
-        else if (recognized.get(parameter) && protectedHeader[parameter] === undefined) {
+        if (recognized.get(parameter) && protectedHeader[parameter] === undefined) {
             throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
         }
     }

package/dist/browser/runtime/asn1.js

@@ -27,7 +27,7 @@ const findOid = (keyData, oid, from = 0) => {
         oid.unshift(oid.length);
         oid.unshift(0x06);
     }
-    let i = keyData.indexOf(oid[0], from);
+    const i = keyData.indexOf(oid[0], from);
     if (i === -1)
         return false;
     const sub = keyData.subarray(i, i + oid.length);
@@ -122,10 +122,10 @@ export const fromSPKI = (pem, alg, options) => {
     return genericImport(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g, 'spki', pem, alg, options);
 };
 function getElement(seq) {
-    let result = [];
+    const result = [];
     let next = 0;
     while (next < seq.length) {
-        let nextPart = parseElement(seq.subarray(next));
+        const nextPart = parseElement(seq.subarray(next));
         result.push(nextPart);
         next += nextPart.byteLength;
     }
@@ -165,7 +165,7 @@ function parseElement(bytes) {
         };
     }
     else {
-        let numberOfDigits = bytes[position] & 0x7f;
+        const numberOfDigits = bytes[position] & 0x7f;
         position++;
         length = 0;
         for (let i = 0; i < numberOfDigits; i++) {

package/dist/browser/runtime/generate.js

@@ -97,7 +97,7 @@ export async function generateKeyPair(alg, options) {
             algorithm = { name: 'ECDSA', namedCurve: 'P-521' };
             keyUsages = ['sign', 'verify'];
             break;
-        case 'EdDSA':
+        case 'EdDSA': {
             keyUsages = ['sign', 'verify'];
             const crv = options?.crv ?? 'Ed25519';
             switch (crv) {
@@ -109,6 +109,7 @@ export async function generateKeyPair(alg, options) {
                     throw new JOSENotSupported('Invalid or unsupported crv option provided');
             }
             break;
+        }
         case 'ECDH-ES':
         case 'ECDH-ES+A128KW':
         case 'ECDH-ES+A192KW':

package/dist/node/cjs/jwe/flattened/decrypt.js

@@ -134,7 +134,7 @@ async function flattenedDecrypt(jwe, key, options) {
     catch {
         throw new errors_js_1.JWEInvalid('Failed to base64url decode the ciphertext');
     }
-    let plaintext = await (0, decrypt_js_1.default)(enc, cek, ciphertext, iv, tag, additionalData);
+    const plaintext = await (0, decrypt_js_1.default)(enc, cek, ciphertext, iv, tag, additionalData);
     const result = { plaintext };
     if (jwe.protected !== undefined) {
         result.protectedHeader = parsedProt;

package/dist/node/cjs/jwe/general/encrypt.js

@@ -79,7 +79,7 @@ class GeneralEncrypt {
                 .setSharedUnprotectedHeader(this._unprotectedHeader)
                 .setUnprotectedHeader(recipient.unprotectedHeader)
                 .encrypt(recipient.key, { ...recipient.options });
-            let jwe = {
+            const jwe = {
                 ciphertext: flattened.ciphertext,
                 iv: flattened.iv,
                 recipients: [{}],
@@ -130,7 +130,7 @@ class GeneralEncrypt {
             }
         }
         const cek = (0, cek_js_1.default)(enc);
-        let jwe = {
+        const jwe = {
             ciphertext: '',
             iv: '',
             recipients: [],

package/dist/node/cjs/jwks/local.js

@@ -84,7 +84,7 @@ class LocalJWKSet {
         if (length === 0) {
             throw new errors_js_1.JWKSNoMatchingKey();
         }
-        else if (length !== 1) {
+        if (length !== 1) {
             const error = new errors_js_1.JWKSMultipleMatchingKeys();
             const { _cached } = this;
             error[Symbol.asyncIterator] = async function* () {
@@ -92,9 +92,7 @@ class LocalJWKSet {
                     try {
                         yield await importWithAlgCache(_cached, jwk, alg);
                     }
-                    catch {
-                        continue;
-                    }
+                    catch { }
                 }
             };
             throw error;
@@ -116,8 +114,6 @@ async function importWithAlgCache(cache, jwk, alg) {
 }
 function createLocalJWKSet(jwks) {
     const set = new LocalJWKSet(jwks);
-    return async function (protectedHeader, token) {
-        return set.getKey(protectedHeader, token);
-    };
+    return async (protectedHeader, token) => set.getKey(protectedHeader, token);
 }
 exports.createLocalJWKSet = createLocalJWKSet;

package/dist/node/cjs/jwks/remote.js

@@ -12,7 +12,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.1.3';
+    const VERSION = 'v5.2.1';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 class RemoteJWKSet extends local_js_1.LocalJWKSet {
@@ -91,8 +91,6 @@ class RemoteJWKSet extends local_js_1.LocalJWKSet {
 }
 function createRemoteJWKSet(url, options) {
     const set = new RemoteJWKSet(url, options);
-    return async function (protectedHeader, token) {
-        return set.getKey(protectedHeader, token);
-    };
+    return async (protectedHeader, token) => set.getKey(protectedHeader, token);
 }
 exports.createRemoteJWKSet = createRemoteJWKSet;

package/dist/node/cjs/jwt/produce.js

@@ -65,6 +65,12 @@ class ProduceJWT {
         else if (input instanceof Date) {
             this._payload = { ...this._payload, iat: validateInput('setIssuedAt', (0, epoch_js_1.default)(input)) };
         }
+        else if (typeof input === 'string') {
+            this._payload = {
+                ...this._payload,
+                iat: validateInput('setIssuedAt', (0, epoch_js_1.default)(new Date()) + (0, secs_js_1.default)(input)),
+            };
+        }
         else {
             this._payload = { ...this._payload, iat: validateInput('setIssuedAt', input) };
         }

package/dist/node/cjs/lib/buffer_utils.js

@@ -9,10 +9,10 @@ function concat(...buffers) {
     const size = buffers.reduce((acc, { length }) => acc + length, 0);
     const buf = new Uint8Array(size);
     let i = 0;
-    buffers.forEach((buffer) => {
+    for (const buffer of buffers) {
         buf.set(buffer, i);
         i += buffer.length;
-    });
+    }
     return buf;
 }
 exports.concat = concat;

package/dist/node/cjs/lib/invalid_key_input.js

@@ -19,7 +19,7 @@ function message(msg, actual, ...types) {
         msg += ` Received function ${actual.name}`;
     }
     else if (typeof actual === 'object' && actual != null) {
-        if (actual.constructor && actual.constructor.name) {
+        if (actual.constructor?.name) {
             msg += ` Received an instance of ${actual.constructor.name}`;
         }
     }

package/dist/node/cjs/lib/secs.js

@@ -5,42 +5,53 @@ const hour = minute * 60;
 const day = hour * 24;
 const week = day * 7;
 const year = day * 365.25;
-const REGEX = /^(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)$/i;
+const REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
 exports.default = (str) => {
     const matched = REGEX.exec(str);
-    if (!matched) {
+    if (!matched || (matched[4] && matched[1])) {
         throw new TypeError('Invalid time period format');
     }
-    const value = parseFloat(matched[1]);
-    const unit = matched[2].toLowerCase();
+    const value = parseFloat(matched[2]);
+    const unit = matched[3].toLowerCase();
+    let numericDate;
     switch (unit) {
         case 'sec':
         case 'secs':
         case 'second':
         case 'seconds':
         case 's':
-            return Math.round(value);
+            numericDate = Math.round(value);
+            break;
         case 'minute':
         case 'minutes':
         case 'min':
         case 'mins':
         case 'm':
-            return Math.round(value * minute);
+            numericDate = Math.round(value * minute);
+            break;
         case 'hour':
         case 'hours':
         case 'hr':
         case 'hrs':
         case 'h':
-            return Math.round(value * hour);
+            numericDate = Math.round(value * hour);
+            break;
         case 'day':
         case 'days':
         case 'd':
-            return Math.round(value * day);
+            numericDate = Math.round(value * day);
+            break;
         case 'week':
         case 'weeks':
         case 'w':
-            return Math.round(value * week);
+            numericDate = Math.round(value * week);
+            break;
         default:
-            return Math.round(value * year);
+            numericDate = Math.round(value * year);
+            break;
     }
+    if (matched[1] === '-' || matched[4] === 'ago') {
+        return -numericDate;
+    }
+    return numericDate;
 };

package/dist/node/cjs/lib/validate_crit.js

@@ -27,7 +27,7 @@ function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader,
         if (joseHeader[parameter] === undefined) {
             throw new Err(`Extension Header Parameter "${parameter}" is missing`);
         }
-        else if (recognized.get(parameter) && protectedHeader[parameter] === undefined) {
+        if (recognized.get(parameter) && protectedHeader[parameter] === undefined) {
             throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
         }
     }

package/dist/node/cjs/runtime/generate.js

@@ -79,7 +79,7 @@ async function generateKeyPair(alg, options) {
         case 'ECDH-ES':
         case 'ECDH-ES+A128KW':
         case 'ECDH-ES+A192KW':
-        case 'ECDH-ES+A256KW':
+        case 'ECDH-ES+A256KW': {
             const crv = options?.crv ?? 'P-256';
             switch (crv) {
                 case undefined:
@@ -94,6 +94,7 @@ async function generateKeyPair(alg, options) {
                 default:
                     throw new errors_js_1.JOSENotSupported('Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, X25519, and X448');
             }
+        }
         default:
             throw new errors_js_1.JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
     }

package/dist/node/cjs/runtime/get_named_curve.js

@@ -44,7 +44,7 @@ const getNamedCurve = (kee, raw) => {
         case 'x448':
             return `X${key.asymmetricKeyType.slice(1)}`;
         case 'ec': {
-            let namedCurve = key.asymmetricKeyDetails.namedCurve;
+            const namedCurve = key.asymmetricKeyDetails.namedCurve;
             if (raw) {
                 return namedCurve;
             }

package/dist/node/esm/jwe/flattened/decrypt.js

@@ -131,7 +131,7 @@ export async function flattenedDecrypt(jwe, key, options) {
     catch {
         throw new JWEInvalid('Failed to base64url decode the ciphertext');
     }
-    let plaintext = await decrypt(enc, cek, ciphertext, iv, tag, additionalData);
+    const plaintext = await decrypt(enc, cek, ciphertext, iv, tag, additionalData);
     const result = { plaintext };
     if (jwe.protected !== undefined) {
         result.protectedHeader = parsedProt;

package/dist/node/esm/jwe/general/encrypt.js

@@ -76,7 +76,7 @@ export class GeneralEncrypt {
                 .setSharedUnprotectedHeader(this._unprotectedHeader)
                 .setUnprotectedHeader(recipient.unprotectedHeader)
                 .encrypt(recipient.key, { ...recipient.options });
-            let jwe = {
+            const jwe = {
                 ciphertext: flattened.ciphertext,
                 iv: flattened.iv,
                 recipients: [{}],
@@ -127,7 +127,7 @@ export class GeneralEncrypt {
             }
         }
         const cek = generateCek(enc);
-        let jwe = {
+        const jwe = {
             ciphertext: '',
             iv: '',
             recipients: [],

package/dist/node/esm/jwks/local.js

@@ -80,7 +80,7 @@ export class LocalJWKSet {
         if (length === 0) {
             throw new JWKSNoMatchingKey();
         }
-        else if (length !== 1) {
+        if (length !== 1) {
             const error = new JWKSMultipleMatchingKeys();
             const { _cached } = this;
             error[Symbol.asyncIterator] = async function* () {
@@ -88,9 +88,7 @@ export class LocalJWKSet {
                     try {
                         yield await importWithAlgCache(_cached, jwk, alg);
                     }
-                    catch {
-                        continue;
-                    }
+                    catch { }
                 }
             };
             throw error;
@@ -111,7 +109,5 @@ async function importWithAlgCache(cache, jwk, alg) {
 }
 export function createLocalJWKSet(jwks) {
     const set = new LocalJWKSet(jwks);
-    return async function (protectedHeader, token) {
-        return set.getKey(protectedHeader, token);
-    };
+    return async (protectedHeader, token) => set.getKey(protectedHeader, token);
 }

package/dist/node/esm/jwks/remote.js

@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.1.3';
+    const VERSION = 'v5.2.1';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 class RemoteJWKSet extends LocalJWKSet {
@@ -88,7 +88,5 @@ class RemoteJWKSet extends LocalJWKSet {
 }
 export function createRemoteJWKSet(url, options) {
     const set = new RemoteJWKSet(url, options);
-    return async function (protectedHeader, token) {
-        return set.getKey(protectedHeader, token);
-    };
+    return async (protectedHeader, token) => set.getKey(protectedHeader, token);
 }

package/dist/node/esm/jwt/produce.js

@@ -62,6 +62,12 @@ export class ProduceJWT {
         else if (input instanceof Date) {
             this._payload = { ...this._payload, iat: validateInput('setIssuedAt', epoch(input)) };
         }
+        else if (typeof input === 'string') {
+            this._payload = {
+                ...this._payload,
+                iat: validateInput('setIssuedAt', epoch(new Date()) + secs(input)),
+            };
+        }
         else {
             this._payload = { ...this._payload, iat: validateInput('setIssuedAt', input) };
         }

package/dist/node/esm/lib/buffer_utils.js

@@ -6,10 +6,10 @@ export function concat(...buffers) {
     const size = buffers.reduce((acc, { length }) => acc + length, 0);
     const buf = new Uint8Array(size);
     let i = 0;
-    buffers.forEach((buffer) => {
+    for (const buffer of buffers) {
         buf.set(buffer, i);
         i += buffer.length;
-    });
+    }
     return buf;
 }
 export function p2s(alg, p2sInput) {

package/dist/node/esm/lib/invalid_key_input.js

@@ -16,7 +16,7 @@ function message(msg, actual, ...types) {
         msg += ` Received function ${actual.name}`;
     }
     else if (typeof actual === 'object' && actual != null) {
-        if (actual.constructor && actual.constructor.name) {
+        if (actual.constructor?.name) {
             msg += ` Received an instance of ${actual.constructor.name}`;
         }
     }

package/dist/node/esm/lib/secs.js

@@ -3,42 +3,53 @@ const hour = minute * 60;
 const day = hour * 24;
 const week = day * 7;
 const year = day * 365.25;
-const REGEX = /^(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)$/i;
+const REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
 export default (str) => {
     const matched = REGEX.exec(str);
-    if (!matched) {
+    if (!matched || (matched[4] && matched[1])) {
         throw new TypeError('Invalid time period format');
     }
-    const value = parseFloat(matched[1]);
-    const unit = matched[2].toLowerCase();
+    const value = parseFloat(matched[2]);
+    const unit = matched[3].toLowerCase();
+    let numericDate;
     switch (unit) {
         case 'sec':
         case 'secs':
         case 'second':
         case 'seconds':
         case 's':
-            return Math.round(value);
+            numericDate = Math.round(value);
+            break;
         case 'minute':
         case 'minutes':
         case 'min':
         case 'mins':
         case 'm':
-            return Math.round(value * minute);
+            numericDate = Math.round(value * minute);
+            break;
         case 'hour':
         case 'hours':
         case 'hr':
         case 'hrs':
         case 'h':
-            return Math.round(value * hour);
+            numericDate = Math.round(value * hour);
+            break;
         case 'day':
         case 'days':
         case 'd':
-            return Math.round(value * day);
+            numericDate = Math.round(value * day);
+            break;
         case 'week':
         case 'weeks':
         case 'w':
-            return Math.round(value * week);
+            numericDate = Math.round(value * week);
+            break;
         default:
-            return Math.round(value * year);
+            numericDate = Math.round(value * year);
+            break;
     }
+    if (matched[1] === '-' || matched[4] === 'ago') {
+        return -numericDate;
+    }
+    return numericDate;
 };

package/dist/node/esm/lib/validate_crit.js

@@ -25,7 +25,7 @@ function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader,
         if (joseHeader[parameter] === undefined) {
             throw new Err(`Extension Header Parameter "${parameter}" is missing`);
         }
-        else if (recognized.get(parameter) && protectedHeader[parameter] === undefined) {
+        if (recognized.get(parameter) && protectedHeader[parameter] === undefined) {
             throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
         }
     }

package/dist/node/esm/runtime/generate.js

@@ -75,7 +75,7 @@ export async function generateKeyPair(alg, options) {
         case 'ECDH-ES':
         case 'ECDH-ES+A128KW':
         case 'ECDH-ES+A192KW':
-        case 'ECDH-ES+A256KW':
+        case 'ECDH-ES+A256KW': {
             const crv = options?.crv ?? 'P-256';
             switch (crv) {
                 case undefined:
@@ -90,6 +90,7 @@ export async function generateKeyPair(alg, options) {
                 default:
                     throw new JOSENotSupported('Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, X25519, and X448');
             }
+        }
         default:
             throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
     }

package/dist/node/esm/runtime/get_named_curve.js

@@ -41,7 +41,7 @@ const getNamedCurve = (kee, raw) => {
         case 'x448':
             return `X${key.asymmetricKeyType.slice(1)}`;
         case 'ec': {
-            let namedCurve = key.asymmetricKeyDetails.namedCurve;
+            const namedCurve = key.asymmetricKeyDetails.namedCurve;
             if (raw) {
                 return namedCurve;
             }

package/dist/types/jwt/produce.d.ts

@@ -31,24 +31,74 @@ export declare class ProduceJWT {
     /**
      * Set the "nbf" (Not Before) Claim.
      *
-     * @param input "nbf" (Not Before) Claim value to set on the JWT Claims Set. When number is passed
-     *   that is used as a value, when string is passed it is resolved to a time span and added to the
-     *   current timestamp.
+     * - If a `number` is passed as an argument it is used as the claim directly.
+     * - If a `Date` instance is passed as an argument it is converted to unix timestamp and used as the
+     *   claim.
+     * - If a `string` is passed as an argument it is resolved to a time span, and then added to the
+     *   current unix timestamp and used as the claim.
+     *
+     * Format used for time span should be a number followed by a unit, such as "5 minutes" or "1
+     * day".
+     *
+     * Valid units are: "sec", "secs", "second", "seconds", "s", "minute", "minutes", "min", "mins",
+     * "m", "hour", "hours", "hr", "hrs", "h", "day", "days", "d", "week", "weeks", "w", "year",
+     * "years", "yr", "yrs", and "y". It is not possible to specify months. 365.25 days is used as an
+     * alias for a year.
+     *
+     * If the string is suffixed with "ago", or prefixed with a "-", the resulting time span gets
+     * subtracted from the current unix timestamp. A "from now" suffix can also be used for
+     * readability when adding to the current unix timestamp.
+     *
+     * @param input "nbf" (Not Before) Claim value to set on the JWT Claims Set.
      */
     setNotBefore(input: number | string | Date): this;
     /**
      * Set the "exp" (Expiration Time) Claim.
      *
-     * @param input "exp" (Expiration Time) Claim value to set on the JWT Claims Set. When number is
-     *   passed that is used as a value, when string is passed it is resolved to a time span and added
-     *   to the current timestamp.
+     * - If a `number` is passed as an argument it is used as the claim directly.
+     * - If a `Date` instance is passed as an argument it is converted to unix timestamp and used as the
+     *   claim.
+     * - If a `string` is passed as an argument it is resolved to a time span, and then added to the
+     *   current unix timestamp and used as the claim.
+     *
+     * Format used for time span should be a number followed by a unit, such as "5 minutes" or "1
+     * day".
+     *
+     * Valid units are: "sec", "secs", "second", "seconds", "s", "minute", "minutes", "min", "mins",
+     * "m", "hour", "hours", "hr", "hrs", "h", "day", "days", "d", "week", "weeks", "w", "year",
+     * "years", "yr", "yrs", and "y". It is not possible to specify months. 365.25 days is used as an
+     * alias for a year.
+     *
+     * If the string is suffixed with "ago", or prefixed with a "-", the resulting time span gets
+     * subtracted from the current unix timestamp. A "from now" suffix can also be used for
+     * readability when adding to the current unix timestamp.
+     *
+     * @param input "exp" (Expiration Time) Claim value to set on the JWT Claims Set.
      */
     setExpirationTime(input: number | string | Date): this;
     /**
      * Set the "iat" (Issued At) Claim.
      *
-     * @param input "iat" (Issued At) Claim value to set on the JWT Claims Set. Default is current
-     *   timestamp.
+     * - If no argument is used the current unix timestamp is used as the claim.
+     * - If a `number` is passed as an argument it is used as the claim directly.
+     * - If a `Date` instance is passed as an argument it is converted to unix timestamp and used as the
+     *   claim.
+     * - If a `string` is passed as an argument it is resolved to a time span, and then added to the
+     *   current unix timestamp and used as the claim.
+     *
+     * Format used for time span should be a number followed by a unit, such as "5 minutes" or "1
+     * day".
+     *
+     * Valid units are: "sec", "secs", "second", "seconds", "s", "minute", "minutes", "min", "mins",
+     * "m", "hour", "hours", "hr", "hrs", "h", "day", "days", "d", "week", "weeks", "w", "year",
+     * "years", "yr", "yrs", and "y". It is not possible to specify months. 365.25 days is used as an
+     * alias for a year.
+     *
+     * If the string is suffixed with "ago", or prefixed with a "-", the resulting time span gets
+     * subtracted from the current unix timestamp. A "from now" suffix can also be used for
+     * readability when adding to the current unix timestamp.
+     *
+     * @param input "iat" (Expiration Time) Claim value to set on the JWT Claims Set.
      */
-    setIssuedAt(input?: number | Date): this;
+    setIssuedAt(input?: number | string | Date): this;
 }

package/dist/types/key/import.d.ts

@@ -11,7 +11,7 @@ export interface PEMImportOptions {
  * Imports a PEM-encoded SPKI string as a runtime-specific public key representation (KeyObject or
  * CryptoKey).
  *
- * @param pem PEM-encoded SPKI string
+ * @param spki PEM-encoded SPKI string
  * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used
  *   with the imported key, its presence is only enforced in Web Crypto API runtimes. See
  *   {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}.
@@ -21,7 +21,7 @@ export declare function importSPKI<KeyLikeType extends KeyLike = KeyLike>(spki:
  * Imports the SPKI from an X.509 string certificate as a runtime-specific public key representation
  * (KeyObject or CryptoKey).
  *
- * @param pem X.509 certificate string
+ * @param x509 X.509 certificate string
  * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used
  *   with the imported key, its presence is only enforced in Web Crypto API runtimes. See
  *   {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}.
@@ -31,7 +31,7 @@ export declare function importX509<KeyLikeType extends KeyLike = KeyLike>(x509:
  * Imports a PEM-encoded PKCS#8 string as a runtime-specific private key representation (KeyObject
  * or CryptoKey).
  *
- * @param pem PEM-encoded PKCS#8 string
+ * @param pkcs8 PEM-encoded PKCS#8 string
  * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used
  *   with the imported key, its presence is only enforced in Web Crypto API runtimes. See
  *   {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}.

package/dist/types/util/errors.d.ts

@@ -4,10 +4,15 @@ import type { KeyLike } from '../types';
  *
  */
 export declare class JOSEError extends Error {
-    /** A unique error code for the particular error subclass. */
+    /**
+     * A unique error code for the particular error subclass.
+     *
+     * @ignore
+     */
     static get code(): string;
-    /** A unique error code for the particular error subclass. */
+    /** A unique error code for this particular error subclass. */
     code: string;
+    /** @ignore */
     constructor(message?: string);
 }
 /**
@@ -15,12 +20,14 @@ export declare class JOSEError extends Error {
  *
  */
 export declare class JWTClaimValidationFailed extends JOSEError {
+    /** @ignore */
     static get code(): 'ERR_JWT_CLAIM_VALIDATION_FAILED';
     code: string;
     /** The Claim for which the validation failed. */
     claim: string;
     /** Reason code for the validation failure. */
     reason: string;
+    /** @ignore */
     constructor(message: string, claim?: string, reason?: string);
 }
 /**
@@ -28,12 +35,14 @@ export declare class JWTClaimValidationFailed extends JOSEError {
  *
  */
 export declare class JWTExpired extends JOSEError implements JWTClaimValidationFailed {
+    /** @ignore */
     static get code(): 'ERR_JWT_EXPIRED';
     code: string;
     /** The Claim for which the validation failed. */
     claim: string;
     /** Reason code for the validation failure. */
     reason: string;
+    /** @ignore */
     constructor(message: string, claim?: string, reason?: string);
 }
 /**
@@ -41,6 +50,7 @@ export declare class JWTExpired extends JOSEError implements JWTClaimValidationF
  *
  */
 export declare class JOSEAlgNotAllowed extends JOSEError {
+    /** @ignore */
     static get code(): 'ERR_JOSE_ALG_NOT_ALLOWED';
     code: string;
 }
@@ -50,6 +60,7 @@ export declare class JOSEAlgNotAllowed extends JOSEError {
  *
  */
 export declare class JOSENotSupported extends JOSEError {
+    /** @ignore */
     static get code(): 'ERR_JOSE_NOT_SUPPORTED';
     code: string;
 }
@@ -58,6 +69,7 @@ export declare class JOSENotSupported extends JOSEError {
  *
  */
 export declare class JWEDecryptionFailed extends JOSEError {
+    /** @ignore */
     static get code(): 'ERR_JWE_DECRYPTION_FAILED';
     code: string;
     message: string;
@@ -67,6 +79,7 @@ export declare class JWEDecryptionFailed extends JOSEError {
  *
  */
 export declare class JWEInvalid extends JOSEError {
+    /** @ignore */
     static get code(): 'ERR_JWE_INVALID';
     code: string;
 }
@@ -75,6 +88,7 @@ export declare class JWEInvalid extends JOSEError {
  *
  */
 export declare class JWSInvalid extends JOSEError {
+    /** @ignore */
     static get code(): 'ERR_JWS_INVALID';
     code: string;
 }
@@ -83,6 +97,7 @@ export declare class JWSInvalid extends JOSEError {
  *
  */
 export declare class JWTInvalid extends JOSEError {
+    /** @ignore */
     static get code(): 'ERR_JWT_INVALID';
     code: string;
 }
@@ -91,6 +106,7 @@ export declare class JWTInvalid extends JOSEError {
  *
  */
 export declare class JWKInvalid extends JOSEError {
+    /** @ignore */
     static get code(): 'ERR_JWK_INVALID';
     code: string;
 }
@@ -99,6 +115,7 @@ export declare class JWKInvalid extends JOSEError {
  *
  */
 export declare class JWKSInvalid extends JOSEError {
+    /** @ignore */
     static get code(): 'ERR_JWKS_INVALID';
     code: string;
 }
@@ -107,6 +124,7 @@ export declare class JWKSInvalid extends JOSEError {
  *
  */
 export declare class JWKSNoMatchingKey extends JOSEError {
+    /** @ignore */
     static get code(): 'ERR_JWKS_NO_MATCHING_KEY';
     code: string;
     message: string;
@@ -127,6 +145,7 @@ export declare class JWKSMultipleMatchingKeys extends JOSEError {
  *
  */
 export declare class JWKSTimeout extends JOSEError {
+    /** @ignore */
     static get code(): 'ERR_JWKS_TIMEOUT';
     code: string;
     message: string;
@@ -136,6 +155,7 @@ export declare class JWKSTimeout extends JOSEError {
  *
  */
 export declare class JWSSignatureVerificationFailed extends JOSEError {
+    /** @ignore */
     static get code(): 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
     code: string;
     message: string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "jose",
-  "version": "5.1.3",
-  "description": "'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
+  "version": "5.2.1",
+  "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "browser",
     "bun",