jose 5.10.0 → 6.0.0

package/README.md

@@ -18,24 +18,18 @@ Support from the community to continue maintaining and improving this module is
 
 ## Dependencies: 0
 
-`jose` has no dependencies and it exports tree-shakeable ESM. CJS is also supported.
+`jose` has no dependencies and it exports tree-shakeable ESM[^cjs].
 
 ## Documentation
 
-`jose` is distributed via [npmjs.com](https://www.npmjs.com/package/jose), [deno.land/x](https://deno.land/x/jose), [cdnjs.com](https://cdnjs.com/libraries/jose), [jsdelivr.com](https://www.jsdelivr.com/package/npm/jose), and [github.com](https://github.com/panva/jose).
+`jose` is distributed via [npmjs.com](https://www.npmjs.com/package/jose), [jsr.io](https://jsr.io/@panva/jose), [deno.land/x](https://deno.land/x/jose), [cdnjs.com](https://cdnjs.com/libraries/jose), [jsdelivr.com](https://www.jsdelivr.com/package/npm/jose), and [github.com](https://github.com/panva/jose).
 
-**`example`** ESM import
+**`example`** ESM import[^cjs]
 
 ```js
 import * as jose from 'jose'
 ```
 
-**`example`** CJS require
-
-```js
-const jose = require('jose')
-```
-
 ### JSON Web Tokens (JWT)
 
 The `jose` module supports JSON Web Tokens (JWT) and provides functionality for signing and verifying tokens, as well as their JWT Claims Set validation.
@@ -122,11 +116,12 @@ Please note that certain algorithms may not be available depending on the runtim
 
 ## Supported Versions
 
-| Version                                         | Security Fixes 🔑 | Other Bug Fixes 🐞 | New Features ⭐ |
-| ----------------------------------------------- | ----------------- | ------------------ | --------------- |
-| [v5.x](https://github.com/panva/jose/tree/v5.x) | ✅                | ✅                 | ✅              |
-| [v4.x](https://github.com/panva/jose/tree/v4.x) | ✅                | ❌                 | ❌              |
-| [v2.x](https://github.com/panva/jose/tree/v2.x) | ✅                | ❌                 | ❌              |
+| Version                                         | Security Fixes 🔑 | Other Bug Fixes 🐞 | New Features ⭐ | Runtime and Module type         |
+| ----------------------------------------------- | ----------------- | ------------------ | --------------- | ------------------------------- |
+| [v6.x](https://github.com/panva/jose/tree/v6.x) | ✅                | ✅                 | ✅              | Universal[^universal] ESM[^cjs] |
+| [v5.x](https://github.com/panva/jose/tree/v5.x) | ✅                | ❌                 | ❌              | Universal[^universal] CJS + ESM |
+| [v4.x](https://github.com/panva/jose/tree/v4.x) | ✅                | ❌                 | ❌              | Universal[^universal] CJS + ESM |
+| [v2.x](https://github.com/panva/jose/tree/v2.x) | ✅                | ❌                 | ❌              | Node.js CJS                     |
 
 ## Specifications
 
@@ -142,10 +137,15 @@ Please note that certain algorithms may not be available depending on the runtim
 - JSON Web Key Thumbprint URI - [RFC9278](https://www.rfc-editor.org/rfc/rfc9278)
 - JWS Unencoded Payload Option - [RFC7797](https://www.rfc-editor.org/rfc/rfc7797)
 - CFRG Elliptic Curve ECDH and Signatures - [RFC8037](https://www.rfc-editor.org/rfc/rfc8037)
-- secp256k1 EC Key curve support - [RFC8812](https://www.rfc-editor.org/rfc/rfc8812)
 
 The algorithm implementations in `jose` have been tested using test vectors from their respective specifications as well as [RFC7520](https://www.rfc-editor.org/rfc/rfc7520).
 
 </details>
 
 [sponsor-auth0]: https://a0.to/signup/panva
+[WebCryptoAPI]: https://w3c.github.io/webcrypto/
+[Fetch API]: https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API
+
+[^cjs]: CJS style `let jose = require('jose')` is possible in Node.js versions where `process.features.require_module` is `true` by default (^20.19.0 || ^22.12.0 || >= 23.0.0) or with the `--experimental-require-module` Node.js CLI flag.
+
+[^universal]: Assumes runtime support of [WebCryptoAPI][] and [Fetch API][]

package/dist/types/index.d.ts

@@ -28,13 +28,13 @@ export { EncryptJWT } from './jwt/encrypt';
 export { calculateJwkThumbprint, calculateJwkThumbprintUri } from './jwk/thumbprint';
 export { EmbeddedJWK } from './jwk/embedded';
 export { createLocalJWKSet } from './jwks/local';
-export { createRemoteJWKSet, jwksCache, experimental_jwksCache } from './jwks/remote';
-export type { RemoteJWKSetOptions, JWKSCacheInput, ExportedJWKSCache } from './jwks/remote';
+export { createRemoteJWKSet, jwksCache } from './jwks/remote';
+export type { RemoteJWKSetOptions, JWKSCacheInput, ExportedJWKSCache, customFetch, FetchImplementation, } from './jwks/remote';
 export { UnsecuredJWT } from './jwt/unsecured';
 export type { UnsecuredResult } from './jwt/unsecured';
 export { exportPKCS8, exportSPKI, exportJWK } from './key/export';
 export { importSPKI, importPKCS8, importX509, importJWK } from './key/import';
-export type { PEMImportOptions } from './key/import';
+export type { KeyImportOptions } from './key/import';
 export { decodeProtectedHeader } from './util/decode_protected_header';
 export { decodeJwt } from './util/decode_jwt';
 export type { ProtectedHeaderParameters } from './util/decode_protected_header';
@@ -44,5 +44,5 @@ export type { GenerateKeyPairResult, GenerateKeyPairOptions } from './key/genera
 export { generateSecret } from './key/generate_secret';
 export type { GenerateSecretOptions } from './key/generate_secret';
 export * as base64url from './util/base64url';
-export type { KeyLike, JWK, JWKParameters, JWK_OKP_Public, JWK_OKP_Private, JWK_EC_Public, JWK_EC_Private, JWK_RSA_Public, JWK_RSA_Private, JWK_oct, FlattenedJWSInput, GeneralJWSInput, FlattenedJWS, GeneralJWS, JoseHeaderParameters, JWSHeaderParameters, JWEKeyManagementHeaderParameters, FlattenedJWE, GeneralJWE, JWEHeaderParameters, CritOption, DecryptOptions, EncryptOptions, JWTClaimVerificationOptions, VerifyOptions, SignOptions, JWTPayload, FlattenedDecryptResult, GeneralDecryptResult, CompactDecryptResult, FlattenedVerifyResult, GeneralVerifyResult, CompactVerifyResult, JWTVerifyResult, JWTDecryptResult, ResolvedKey, CompactJWEHeaderParameters, CompactJWSHeaderParameters, JWTHeaderParameters, JSONWebKeySet, CryptoRuntime, GetKeyFunction, } from './types';
-export { default as cryptoRuntime } from './util/runtime';
+export type { CompactDecryptResult, CompactJWEHeaderParameters, CompactJWSHeaderParameters, CompactVerifyResult, CritOption, CryptoKey, DecryptOptions, EncryptOptions, FlattenedDecryptResult, FlattenedJWE, FlattenedJWS, FlattenedJWSInput, FlattenedVerifyResult, GeneralDecryptResult, GeneralJWE, GeneralJWS, GeneralJWSInput, GeneralVerifyResult, GetKeyFunction, JoseHeaderParameters, JSONWebKeySet, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWK_EC_Private, JWK_EC_Public, JWK_oct, JWK_OKP_Private, JWK_OKP_Public, JWK_RSA_Private, JWK_RSA_Public, JWK, JWKParameters, JWSHeaderParameters, JWTClaimVerificationOptions, JWTDecryptResult, JWTHeaderParameters, JWTPayload, JWTVerifyResult, KeyObject, ResolvedKey, SignOptions, VerifyOptions, } from './types';
+export declare const cryptoRuntime = "WebCryptoAPI";

package/dist/types/jwe/compact/decrypt.d.ts

@@ -1,9 +1,9 @@
-import type { KeyLike, DecryptOptions, CompactJWEHeaderParameters, GetKeyFunction, FlattenedJWE, CompactDecryptResult, ResolvedKey } from '../../types';
+import type * as types from '../../types';
 /**
  * Interface for Compact JWE Decryption dynamic key resolution. No token components have been
  * verified at the time of this function call.
  */
-export interface CompactDecryptGetKey extends GetKeyFunction<CompactJWEHeaderParameters, FlattenedJWE> {
+export interface CompactDecryptGetKey extends types.GetKeyFunction<types.CompactJWEHeaderParameters, types.FlattenedJWE> {
 }
 /**
  * Decrypts a Compact JWE.
@@ -16,11 +16,11 @@ export interface CompactDecryptGetKey extends GetKeyFunction<CompactJWEHeaderPar
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  * @param options JWE Decryption options.
  */
-export declare function compactDecrypt(jwe: string | Uint8Array, key: KeyLike | Uint8Array, options?: DecryptOptions): Promise<CompactDecryptResult>;
+export declare function compactDecrypt(jwe: string | Uint8Array, key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array, options?: types.DecryptOptions): Promise<types.CompactDecryptResult>;
 /**
  * @param jwe Compact JWE.
  * @param getKey Function resolving Private Key or Secret to decrypt the JWE with. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  * @param options JWE Decryption options.
  */
-export declare function compactDecrypt<KeyLikeType extends KeyLike = KeyLike>(jwe: string | Uint8Array, getKey: CompactDecryptGetKey, options?: DecryptOptions): Promise<CompactDecryptResult & ResolvedKey<KeyLikeType>>;
+export declare function compactDecrypt(jwe: string | Uint8Array, getKey: CompactDecryptGetKey, options?: types.DecryptOptions): Promise<types.CompactDecryptResult & types.ResolvedKey>;

package/dist/types/jwe/compact/encrypt.d.ts

@@ -1,4 +1,4 @@
-import type { KeyLike, JWEKeyManagementHeaderParameters, CompactJWEHeaderParameters, EncryptOptions } from '../../types';
+import type * as types from '../../types';
 /**
  * The CompactEncrypt class is used to build and encrypt Compact JWE strings.
  *
@@ -35,7 +35,7 @@ export declare class CompactEncrypt {
      *
      * @param protectedHeader JWE Protected Header object.
      */
-    setProtectedHeader(protectedHeader: CompactJWEHeaderParameters): this;
+    setProtectedHeader(protectedHeader: types.CompactJWEHeaderParameters): this;
     /**
      * Sets the JWE Key Management parameters to be used when encrypting the Content Encryption Key.
      * You do not need to invoke this method, it is only really intended for test and vector
@@ -43,7 +43,7 @@ export declare class CompactEncrypt {
      *
      * @param parameters JWE Key Management parameters.
      */
-    setKeyManagementParameters(parameters: JWEKeyManagementHeaderParameters): this;
+    setKeyManagementParameters(parameters: types.JWEKeyManagementHeaderParameters): this;
     /**
      * Encrypts and resolves the value of the Compact JWE string.
      *
@@ -51,5 +51,5 @@ export declare class CompactEncrypt {
      *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
      * @param options JWE Encryption options.
      */
-    encrypt(key: KeyLike | Uint8Array, options?: EncryptOptions): Promise<string>;
+    encrypt(key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array, options?: types.EncryptOptions): Promise<string>;
 }

package/dist/types/jwe/flattened/decrypt.d.ts

@@ -1,9 +1,9 @@
-import type { FlattenedDecryptResult, KeyLike, FlattenedJWE, JWEHeaderParameters, DecryptOptions, GetKeyFunction, ResolvedKey } from '../../types';
+import type * as types from '../../types';
 /**
  * Interface for Flattened JWE Decryption dynamic key resolution. No token components have been
  * verified at the time of this function call.
  */
-export interface FlattenedDecryptGetKey extends GetKeyFunction<JWEHeaderParameters | undefined, FlattenedJWE> {
+export interface FlattenedDecryptGetKey extends types.GetKeyFunction<types.JWEHeaderParameters | undefined, types.FlattenedJWE> {
 }
 /**
  * Decrypts a Flattened JWE.
@@ -16,11 +16,11 @@ export interface FlattenedDecryptGetKey extends GetKeyFunction<JWEHeaderParamete
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  * @param options JWE Decryption options.
  */
-export declare function flattenedDecrypt(jwe: FlattenedJWE, key: KeyLike | Uint8Array, options?: DecryptOptions): Promise<FlattenedDecryptResult>;
+export declare function flattenedDecrypt(jwe: types.FlattenedJWE, key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array, options?: types.DecryptOptions): Promise<types.FlattenedDecryptResult>;
 /**
  * @param jwe Flattened JWE.
  * @param getKey Function resolving Private Key or Secret to decrypt the JWE with. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  * @param options JWE Decryption options.
  */
-export declare function flattenedDecrypt<KeyLikeType extends KeyLike = KeyLike>(jwe: FlattenedJWE, getKey: FlattenedDecryptGetKey, options?: DecryptOptions): Promise<FlattenedDecryptResult & ResolvedKey<KeyLikeType>>;
+export declare function flattenedDecrypt(jwe: types.FlattenedJWE, getKey: FlattenedDecryptGetKey, options?: types.DecryptOptions): Promise<types.FlattenedDecryptResult & types.ResolvedKey>;

package/dist/types/jwe/flattened/encrypt.d.ts

@@ -1,4 +1,4 @@
-import type { KeyLike, FlattenedJWE, JWEHeaderParameters, JWEKeyManagementHeaderParameters, EncryptOptions } from '../../types';
+import type * as types from '../../types';
 /**
  * The FlattenedEncrypt class is used to build and encrypt Flattened JWE objects.
  *
@@ -25,25 +25,25 @@ export declare class FlattenedEncrypt {
      *
      * @param parameters JWE Key Management parameters.
      */
-    setKeyManagementParameters(parameters: JWEKeyManagementHeaderParameters): this;
+    setKeyManagementParameters(parameters: types.JWEKeyManagementHeaderParameters): this;
     /**
      * Sets the JWE Protected Header on the FlattenedEncrypt object.
      *
      * @param protectedHeader JWE Protected Header.
      */
-    setProtectedHeader(protectedHeader: JWEHeaderParameters): this;
+    setProtectedHeader(protectedHeader: types.JWEHeaderParameters): this;
     /**
      * Sets the JWE Shared Unprotected Header on the FlattenedEncrypt object.
      *
      * @param sharedUnprotectedHeader JWE Shared Unprotected Header.
      */
-    setSharedUnprotectedHeader(sharedUnprotectedHeader: JWEHeaderParameters): this;
+    setSharedUnprotectedHeader(sharedUnprotectedHeader: types.JWEHeaderParameters): this;
     /**
      * Sets the JWE Per-Recipient Unprotected Header on the FlattenedEncrypt object.
      *
      * @param unprotectedHeader JWE Per-Recipient Unprotected Header.
      */
-    setUnprotectedHeader(unprotectedHeader: JWEHeaderParameters): this;
+    setUnprotectedHeader(unprotectedHeader: types.JWEHeaderParameters): this;
     /**
      * Sets the Additional Authenticated Data on the FlattenedEncrypt object.
      *
@@ -77,5 +77,5 @@ export declare class FlattenedEncrypt {
      *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
      * @param options JWE Encryption options.
      */
-    encrypt(key: KeyLike | Uint8Array, options?: EncryptOptions): Promise<FlattenedJWE>;
+    encrypt(key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array, options?: types.EncryptOptions): Promise<types.FlattenedJWE>;
 }

package/dist/types/jwe/general/decrypt.d.ts

@@ -1,9 +1,9 @@
-import type { KeyLike, DecryptOptions, JWEHeaderParameters, GetKeyFunction, FlattenedJWE, GeneralJWE, GeneralDecryptResult, ResolvedKey } from '../../types';
+import type * as types from '../../types';
 /**
  * Interface for General JWE Decryption dynamic key resolution. No token components have been
  * verified at the time of this function call.
  */
-export interface GeneralDecryptGetKey extends GetKeyFunction<JWEHeaderParameters, FlattenedJWE> {
+export interface GeneralDecryptGetKey extends types.GetKeyFunction<types.JWEHeaderParameters, types.FlattenedJWE> {
 }
 /**
  * Decrypts a General JWE.
@@ -16,11 +16,11 @@ export interface GeneralDecryptGetKey extends GetKeyFunction<JWEHeaderParameters
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  * @param options JWE Decryption options.
  */
-export declare function generalDecrypt(jwe: GeneralJWE, key: KeyLike | Uint8Array, options?: DecryptOptions): Promise<GeneralDecryptResult>;
+export declare function generalDecrypt(jwe: types.GeneralJWE, key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array, options?: types.DecryptOptions): Promise<types.GeneralDecryptResult>;
 /**
  * @param jwe General JWE.
  * @param getKey Function resolving Private Key or Secret to decrypt the JWE with. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  * @param options JWE Decryption options.
  */
-export declare function generalDecrypt<KeyLikeType extends KeyLike = KeyLike>(jwe: GeneralJWE, getKey: GeneralDecryptGetKey, options?: DecryptOptions): Promise<GeneralDecryptResult & ResolvedKey<KeyLikeType>>;
+export declare function generalDecrypt(jwe: types.GeneralJWE, getKey: GeneralDecryptGetKey, options?: types.DecryptOptions): Promise<types.GeneralDecryptResult & types.ResolvedKey>;

package/dist/types/jwe/general/encrypt.d.ts

@@ -1,15 +1,15 @@
-import type { KeyLike, GeneralJWE, JWEHeaderParameters, CritOption } from '../../types';
+import type * as types from '../../types';
 export interface Recipient {
     /**
      * Sets the JWE Per-Recipient Unprotected Header on the Recipient object.
      *
      * @param unprotectedHeader JWE Per-Recipient Unprotected Header.
      */
-    setUnprotectedHeader(unprotectedHeader: JWEHeaderParameters): Recipient;
+    setUnprotectedHeader(unprotectedHeader: types.JWEHeaderParameters): Recipient;
     /** A shorthand for calling addRecipient() on the enclosing GeneralEncrypt instance */
     addRecipient(...args: Parameters<GeneralEncrypt['addRecipient']>): Recipient;
     /** A shorthand for calling encrypt() on the enclosing GeneralEncrypt instance */
-    encrypt(...args: Parameters<GeneralEncrypt['encrypt']>): Promise<GeneralJWE>;
+    encrypt(...args: Parameters<GeneralEncrypt['encrypt']>): Promise<types.GeneralJWE>;
     /** Returns the enclosing GeneralEncrypt */
     done(): GeneralEncrypt;
 }
@@ -35,19 +35,19 @@ export declare class GeneralEncrypt {
      *   See {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
      * @param options JWE Encryption options.
      */
-    addRecipient(key: KeyLike | Uint8Array, options?: CritOption): Recipient;
+    addRecipient(key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array, options?: types.CritOption): Recipient;
     /**
      * Sets the JWE Protected Header on the GeneralEncrypt object.
      *
      * @param protectedHeader JWE Protected Header object.
      */
-    setProtectedHeader(protectedHeader: JWEHeaderParameters): this;
+    setProtectedHeader(protectedHeader: types.JWEHeaderParameters): this;
     /**
      * Sets the JWE Shared Unprotected Header on the GeneralEncrypt object.
      *
      * @param sharedUnprotectedHeader JWE Shared Unprotected Header object.
      */
-    setSharedUnprotectedHeader(sharedUnprotectedHeader: JWEHeaderParameters): this;
+    setSharedUnprotectedHeader(sharedUnprotectedHeader: types.JWEHeaderParameters): this;
     /**
      * Sets the Additional Authenticated Data on the GeneralEncrypt object.
      *
@@ -55,5 +55,5 @@ export declare class GeneralEncrypt {
      */
     setAdditionalAuthenticatedData(aad: Uint8Array): this;
     /** Encrypts and resolves the value of the General JWE object. */
-    encrypt(): Promise<GeneralJWE>;
+    encrypt(): Promise<types.GeneralJWE>;
 }

package/dist/types/jwk/embedded.d.ts

@@ -1,4 +1,4 @@
-import type { KeyLike, FlattenedJWSInput, JWSHeaderParameters } from '../types';
+import type * as types from '../types';
 /**
  * EmbeddedJWK is an implementation of a GetKeyFunction intended to be used with the JWS/JWT verify
  * operations whenever you need to opt-in to verify signatures with a public key embedded in the
@@ -9,4 +9,4 @@ import type { KeyLike, FlattenedJWSInput, JWSHeaderParameters } from '../types';
  * as from its subpath export `'jose/jwk/embedded'`.
  *
  */
-export declare function EmbeddedJWK<KeyLikeType extends KeyLike = KeyLike>(protectedHeader?: JWSHeaderParameters, token?: FlattenedJWSInput): Promise<KeyLikeType>;
+export declare function EmbeddedJWK(protectedHeader?: types.JWSHeaderParameters, token?: types.FlattenedJWSInput): Promise<types.CryptoKey>;

package/dist/types/jwk/thumbprint.d.ts

@@ -1,27 +1,27 @@
-import type { JWK } from '../types';
+import type * as types from '../types';
 /**
  * Calculates a base64url-encoded JSON Web Key (JWK) Thumbprint
  *
  * This function is exported (as a named export) from the main `'jose'` module entry point as well
  * as from its subpath export `'jose/jwk/thumbprint'`.
  *
- * @param jwk JSON Web Key.
+ * @param key Key to calculate the thumbprint for.
  * @param digestAlgorithm Digest Algorithm to use for calculating the thumbprint. Default is
  *   "sha256".
  *
  * @see {@link https://www.rfc-editor.org/rfc/rfc7638 RFC7638}
  */
-export declare function calculateJwkThumbprint(jwk: JWK, digestAlgorithm?: 'sha256' | 'sha384' | 'sha512'): Promise<string>;
+export declare function calculateJwkThumbprint(key: types.JWK | types.CryptoKey | types.KeyObject, digestAlgorithm?: 'sha256' | 'sha384' | 'sha512'): Promise<string>;
 /**
  * Calculates a JSON Web Key (JWK) Thumbprint URI
  *
  * This function is exported (as a named export) from the main `'jose'` module entry point as well
  * as from its subpath export `'jose/jwk/thumbprint'`.
  *
- * @param jwk JSON Web Key.
+ * @param key Key to calculate the thumbprint for.
  * @param digestAlgorithm Digest Algorithm to use for calculating the thumbprint. Default is
  *   "sha256".
  *
  * @see {@link https://www.rfc-editor.org/rfc/rfc9278 RFC9278}
  */
-export declare function calculateJwkThumbprintUri(jwk: JWK, digestAlgorithm?: 'sha256' | 'sha384' | 'sha512'): Promise<string>;
+export declare function calculateJwkThumbprintUri(key: types.CryptoKey | types.KeyObject | types.JWK, digestAlgorithm?: 'sha256' | 'sha384' | 'sha512'): Promise<string>;

package/dist/types/jwks/local.d.ts

@@ -1,4 +1,4 @@
-import type { KeyLike, JWSHeaderParameters, JSONWebKeySet, FlattenedJWSInput } from '../types';
+import type * as types from '../types';
 /**
  * Returns a function that resolves a JWS JOSE Header to a public key object from a locally stored,
  * or otherwise available, JSON Web Key Set.
@@ -20,4 +20,4 @@ import type { KeyLike, JWSHeaderParameters, JSONWebKeySet, FlattenedJWSInput } f
  *
  * @param jwks JSON Web Key Set formatted object.
  */
-export declare function createLocalJWKSet<KeyLikeType extends KeyLike = KeyLike>(jwks: JSONWebKeySet): (protectedHeader?: JWSHeaderParameters, token?: FlattenedJWSInput) => Promise<KeyLikeType>;
+export declare function createLocalJWKSet(jwks: types.JSONWebKeySet): (protectedHeader?: types.JWSHeaderParameters, token?: types.FlattenedJWSInput) => Promise<types.CryptoKey>;

package/dist/types/jwks/remote.d.ts

@@ -1,4 +1,100 @@
-import type { KeyLike, JWSHeaderParameters, FlattenedJWSInput, JSONWebKeySet } from '../types';
+import type * as types from '../types';
+/**
+ * When passed to {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} this allows the resolver
+ * to make use of advanced fetch configurations, HTTP Proxies, retry on network errors, etc.
+ *
+ * import ky from 'ky'
+ *
+ * let logRequest!: (request: Request) => void
+ * let logResponse!: (request: Request, response: Response) => void
+ * let logRetry!: (request: Request, error: Error, retryCount: number) => void
+ *
+ * const JWKS = jose.createRemoteJWKSet(url, {
+ *   [jose.customFetch]: (...args) =>
+ *     ky(args[0], {
+ *       ...args[1],
+ *       hooks: {
+ *         beforeRequest: [
+ *           (request) => {
+ *             logRequest(request)
+ *           },
+ *         ],
+ *         beforeRetry: [
+ *           ({ request, error, retryCount }) => {
+ *             logRetry(request, error, retryCount)
+ *           },
+ *         ],
+ *         afterResponse: [
+ *           (request, _, response) => {
+ *             logResponse(request, response)
+ *           },
+ *         ],
+ *       },
+ *     }),
+ * })
+ * ```
+ *
+ * import * as undici from 'undici'
+ *
+ * // see https://undici.nodejs.org/#/docs/api/EnvHttpProxyAgent
+ * let envHttpProxyAgent = new undici.EnvHttpProxyAgent()
+ *
+ * // @ts-ignore
+ * const JWKS = jose.createRemoteJWKSet(url, {
+ *   [jose.customFetch]: (...args) => {
+ *     // @ts-ignore
+ *     return undici.fetch(args[0], { ...args[1], dispatcher: envHttpProxyAgent }) // prettier-ignore
+ *   },
+ * })
+ * ```
+ *
+ * import * as undici from 'undici'
+ *
+ * // see https://undici.nodejs.org/#/docs/api/RetryAgent
+ * let retryAgent = new undici.RetryAgent(new undici.Agent(), {
+ *   statusCodes: [],
+ *   errorCodes: [
+ *     'ECONNRESET',
+ *     'ECONNREFUSED',
+ *     'ENOTFOUND',
+ *     'ENETDOWN',
+ *     'ENETUNREACH',
+ *     'EHOSTDOWN',
+ *     'UND_ERR_SOCKET',
+ *   ],
+ * })
+ *
+ * // @ts-ignore
+ * const JWKS = jose.createRemoteJWKSet(url, {
+ *   [jose.customFetch]: (...args) => {
+ *     // @ts-ignore
+ *     return undici.fetch(args[0], { ...args[1], dispatcher: retryAgent }) // prettier-ignore
+ *   },
+ * })
+ * ```
+ *
+ * import * as undici from 'undici'
+ *
+ * // see https://undici.nodejs.org/#/docs/api/MockAgent
+ * let mockAgent = new undici.MockAgent()
+ * mockAgent.disableNetConnect()
+ *
+ * // @ts-ignore
+ * const JWKS = jose.createRemoteJWKSet(url, {
+ *   [jose.customFetch]: (...args) => {
+ *     // @ts-ignore
+ *     return undici.fetch(args[0], { ...args[1], dispatcher: mockAgent }) // prettier-ignore
+ *   },
+ * })
+ * ```
+ */
+export declare const customFetch: unique symbol;
+export type FetchImplementation = (url: string, options: {
+    headers: Headers;
+    method: 'GET';
+    redirect: 'manual';
+    signal: AbortSignal;
+}) => Promise<Response>;
 /**
  * DANGER ZONE - This option has security implications that must be understood, assessed for
  * applicability, and accepted before use. It is critical that the JSON Web Key Set cache only be
@@ -67,26 +163,15 @@ export interface RemoteJWKSetOptions {
      * minutes).
      */
     cacheMaxAge?: number | typeof Infinity;
-    /**
-     * An instance of {@link https://nodejs.org/api/http.html#class-httpagent http.Agent} or
-     * {@link https://nodejs.org/api/https.html#class-httpsagent https.Agent} to pass to the
-     * {@link https://nodejs.org/api/http.html#httpgetoptions-callback http.get} or
-     * {@link https://nodejs.org/api/https.html#httpsgetoptions-callback https.get} method's options.
-     * Use when behind an http(s) proxy. This is a Node.js runtime specific option, it is ignored when
-     * used outside of Node.js runtime.
-     */
-    agent?: any;
-    /**
-     * Headers to be sent with the HTTP request. Default is that `User-Agent: jose/v${version}` header
-     * is added unless the runtime is a browser in which adding an explicit headers fetch
-     * configuration would cause an unnecessary CORS preflight request.
-     */
+    /** Headers to be sent with the HTTP request. */
     headers?: Record<string, string>;
     /** See {@link jwksCache}. */
     [jwksCache]?: JWKSCacheInput;
+    /** See {@link customFetch}. */
+    [customFetch]?: FetchImplementation;
 }
 export interface ExportedJWKSCache {
-    jwks: JSONWebKeySet;
+    jwks: types.JSONWebKeySet;
     uat: number;
 }
 export type JWKSCacheInput = ExportedJWKSCache | Record<string, never>;
@@ -114,8 +199,8 @@ export type JWKSCacheInput = ExportedJWKSCache | Record<string, never>;
  * @param url URL to fetch the JSON Web Key Set from.
  * @param options Options for the remote JSON Web Key Set.
  */
-export declare function createRemoteJWKSet<KeyLikeType extends KeyLike = KeyLike>(url: URL, options?: RemoteJWKSetOptions): {
-    (protectedHeader?: JWSHeaderParameters, token?: FlattenedJWSInput): Promise<KeyLikeType>;
+export declare function createRemoteJWKSet(url: URL, options?: RemoteJWKSetOptions): {
+    (protectedHeader?: types.JWSHeaderParameters, token?: types.FlattenedJWSInput): Promise<types.CryptoKey>;
     /** @ignore */
     coolingDown: boolean;
     /** @ignore */
@@ -125,11 +210,5 @@ export declare function createRemoteJWKSet<KeyLikeType extends KeyLike = KeyLike
     /** @ignore */
     reload: () => Promise<void>;
     /** @ignore */
-    jwks: () => JSONWebKeySet | undefined;
+    jwks: () => types.JSONWebKeySet | undefined;
 };
-/**
- * @ignore
- *
- * @deprecated Use {@link jwksCache}.
- */
-export declare const experimental_jwksCache: symbol;

package/dist/types/jws/compact/sign.d.ts

@@ -1,4 +1,4 @@
-import type { JWK, CompactJWSHeaderParameters, KeyLike, SignOptions } from '../../types';
+import type * as types from '../../types';
 /**
  * The CompactSign class is used to build and sign Compact JWS strings.
  *
@@ -11,11 +11,11 @@ export declare class CompactSign {
     /** @param payload Binary representation of the payload to sign. */
     constructor(payload: Uint8Array);
     /**
-     * Sets the JWS Protected Header on the Sign object.
+     * Sets the JWS Protected Header on the CompactSign object.
      *
      * @param protectedHeader JWS Protected Header.
      */
-    setProtectedHeader(protectedHeader: CompactJWSHeaderParameters): this;
+    setProtectedHeader(protectedHeader: types.CompactJWSHeaderParameters): this;
     /**
      * Signs and resolves the value of the Compact JWS string.
      *
@@ -23,5 +23,5 @@ export declare class CompactSign {
      *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
      * @param options JWS Sign options.
      */
-    sign(key: KeyLike | Uint8Array | JWK, options?: SignOptions): Promise<string>;
+    sign(key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array, options?: types.SignOptions): Promise<string>;
 }

package/dist/types/jws/compact/verify.d.ts

@@ -1,11 +1,11 @@
-import type { JWK, CompactVerifyResult, FlattenedJWSInput, GenericGetKeyFunction, CompactJWSHeaderParameters, KeyLike, VerifyOptions, ResolvedKey } from '../../types';
+import type * as types from '../../types';
 /**
  * Interface for Compact JWS Verification dynamic key resolution. No token components have been
  * verified at the time of this function call.
  *
  * @see {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} to verify using a remote JSON Web Key Set.
  */
-export interface CompactVerifyGetKey extends GenericGetKeyFunction<CompactJWSHeaderParameters, FlattenedJWSInput, KeyLike | JWK | Uint8Array> {
+export interface CompactVerifyGetKey extends types.GenericGetKeyFunction<types.CompactJWSHeaderParameters, types.FlattenedJWSInput, types.CryptoKey | types.KeyObject | types.JWK | Uint8Array> {
 }
 /**
  * Verifies the signature and format of and afterwards decodes the Compact JWS.
@@ -18,11 +18,11 @@ export interface CompactVerifyGetKey extends GenericGetKeyFunction<CompactJWSHea
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  * @param options JWS Verify options.
  */
-export declare function compactVerify(jws: string | Uint8Array, key: KeyLike | Uint8Array | JWK, options?: VerifyOptions): Promise<CompactVerifyResult>;
+export declare function compactVerify(jws: string | Uint8Array, key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array, options?: types.VerifyOptions): Promise<types.CompactVerifyResult>;
 /**
  * @param jws Compact JWS.
  * @param getKey Function resolving a key to verify the JWS with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  * @param options JWS Verify options.
  */
-export declare function compactVerify<KeyLikeType extends KeyLike = KeyLike>(jws: string | Uint8Array, getKey: CompactVerifyGetKey, options?: VerifyOptions): Promise<CompactVerifyResult & ResolvedKey<KeyLikeType>>;
+export declare function compactVerify(jws: string | Uint8Array, getKey: CompactVerifyGetKey, options?: types.VerifyOptions): Promise<types.CompactVerifyResult & types.ResolvedKey>;

package/dist/types/jws/flattened/sign.d.ts

@@ -1,4 +1,4 @@
-import type { JWK, KeyLike, FlattenedJWS, JWSHeaderParameters, SignOptions } from '../../types';
+import type * as types from '../../types';
 /**
  * The FlattenedSign class is used to build and sign Flattened JWS objects.
  *
@@ -17,13 +17,13 @@ export declare class FlattenedSign {
      *
      * @param protectedHeader JWS Protected Header.
      */
-    setProtectedHeader(protectedHeader: JWSHeaderParameters): this;
+    setProtectedHeader(protectedHeader: types.JWSHeaderParameters): this;
     /**
      * Sets the JWS Unprotected Header on the FlattenedSign object.
      *
      * @param unprotectedHeader JWS Unprotected Header.
      */
-    setUnprotectedHeader(unprotectedHeader: JWSHeaderParameters): this;
+    setUnprotectedHeader(unprotectedHeader: types.JWSHeaderParameters): this;
     /**
      * Signs and resolves the value of the Flattened JWS object.
      *
@@ -31,5 +31,5 @@ export declare class FlattenedSign {
      *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
      * @param options JWS Sign options.
      */
-    sign(key: KeyLike | Uint8Array | JWK, options?: SignOptions): Promise<FlattenedJWS>;
+    sign(key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array, options?: types.SignOptions): Promise<types.FlattenedJWS>;
 }

package/dist/types/jws/flattened/verify.d.ts

@@ -1,11 +1,11 @@
-import type { JWK, FlattenedVerifyResult, KeyLike, FlattenedJWSInput, JWSHeaderParameters, VerifyOptions, GenericGetKeyFunction, ResolvedKey } from '../../types';
+import type * as types from '../../types';
 /**
  * Interface for Flattened JWS Verification dynamic key resolution. No token components have been
  * verified at the time of this function call.
  *
  * @see {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} to verify using a remote JSON Web Key Set.
  */
-export interface FlattenedVerifyGetKey extends GenericGetKeyFunction<JWSHeaderParameters | undefined, FlattenedJWSInput, KeyLike | JWK | Uint8Array> {
+export interface FlattenedVerifyGetKey extends types.GenericGetKeyFunction<types.JWSHeaderParameters | undefined, types.FlattenedJWSInput, types.CryptoKey | types.KeyObject | types.JWK | Uint8Array> {
 }
 /**
  * Verifies the signature and format of and afterwards decodes the Flattened JWS.
@@ -18,11 +18,11 @@ export interface FlattenedVerifyGetKey extends GenericGetKeyFunction<JWSHeaderPa
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  * @param options JWS Verify options.
  */
-export declare function flattenedVerify(jws: FlattenedJWSInput, key: KeyLike | Uint8Array | JWK, options?: VerifyOptions): Promise<FlattenedVerifyResult>;
+export declare function flattenedVerify(jws: types.FlattenedJWSInput, key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array, options?: types.VerifyOptions): Promise<types.FlattenedVerifyResult>;
 /**
  * @param jws Flattened JWS.
  * @param getKey Function resolving a key to verify the JWS with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  * @param options JWS Verify options.
  */
-export declare function flattenedVerify<KeyLikeType extends KeyLike = KeyLike>(jws: FlattenedJWSInput, getKey: FlattenedVerifyGetKey, options?: VerifyOptions): Promise<FlattenedVerifyResult & ResolvedKey<KeyLikeType>>;
+export declare function flattenedVerify(jws: types.FlattenedJWSInput, getKey: FlattenedVerifyGetKey, options?: types.VerifyOptions): Promise<types.FlattenedVerifyResult & types.ResolvedKey>;