jose 5.2.0 → 5.2.2

package/README.md

@@ -28,10 +28,10 @@ const jose = require('jose')
 
 The `jose` module supports JSON Web Tokens (JWT) and provides functionality for signing and verifying tokens, as well as their JWT Claims Set validation.
 
+- [JWT Claims Set Validation & Signature Verification](docs/functions/jwt_verify.jwtVerify.md) using the `jwtVerify` function
+  - [Using a remote JSON Web Key Set (JWKS)](docs/functions/jwks_remote.createRemoteJWKSet.md)
+  - [Using a local JSON Web Key Set (JWKS)](docs/functions/jwks_local.createLocalJWKSet.md)
 - [Signing](docs/classes/jwt_sign.SignJWT.md) using the `SignJWT` class
-- [Verification & JWT Claims Set Validation](docs/functions/jwt_verify.jwtVerify.md) using the `jwtVerify` function
-  - [Using a remote JWKS](docs/functions/jwks_remote.createRemoteJWKSet.md)
-  - [Using a local JWKS](docs/functions/jwks_local.createLocalJWKSet.md)
 - Utility functions
   - [Decoding Token's Protected Header](docs/functions/util_decode_protected_header.decodeProtectedHeader.md)
   - [Decoding JWT Claims Set](docs/functions/util_decode_jwt.decodeJwt.md) prior to its validation
@@ -40,8 +40,8 @@ The `jose` module supports JSON Web Tokens (JWT) and provides functionality for
 
 The `jose` module supports encrypted JSON Web Tokens and provides functionality for encrypting and decrypting tokens, as well as their JWT Claims Set validation.
 
-- [Encryption](docs/classes/jwt_encrypt.EncryptJWT.md) using the `EncryptJWT` class
 - [Decryption & JWT Claims Set Validation](docs/functions/jwt_decrypt.jwtDecrypt.md) using the `jwtDecrypt` function
+- [Encryption](docs/classes/jwt_encrypt.EncryptJWT.md) using the `EncryptJWT` class
 - Utility functions
   - [Decoding Token's Protected Header](docs/functions/util_decode_protected_header.decodeProtectedHeader.md)
 
@@ -68,8 +68,8 @@ The `jose` module supports signing and verification of JWS messages with arbitra
 
 - Signing - [Compact](docs/classes/jws_compact_sign.CompactSign.md), [Flattened JSON](docs/classes/jws_flattened_sign.FlattenedSign.md), [General JSON](docs/classes/jws_general_sign.GeneralSign.md)
 - Verification - [Compact](docs/functions/jws_compact_verify.compactVerify.md), [Flattened JSON](docs/functions/jws_flattened_verify.flattenedVerify.md), [General JSON](docs/functions/jws_general_verify.generalVerify.md)
-  - [Verify using a remote JWKS](docs/functions/jwks_remote.createRemoteJWKSet.md)
-  - [Verify using a local JWKS](docs/functions/jwks_local.createLocalJWKSet.md)
+  - [Using a remote JSON Web Key Set (JWKS)](docs/functions/jwks_remote.createRemoteJWKSet.md)
+  - [Using a local JSON Web Key Set (JWKS)](docs/functions/jwks_local.createLocalJWKSet.md)
 - Utility functions
   - [Decoding Token's Protected Header](docs/functions/util_decode_protected_header.decodeProtectedHeader.md)
 

package/dist/browser/jwe/compact/decrypt.js

@@ -14,9 +14,9 @@ export async function compactDecrypt(jwe, key, options) {
     }
     const decrypted = await flattenedDecrypt({
         ciphertext,
-        iv: (iv || undefined),
-        protected: protectedHeader || undefined,
-        tag: (tag || undefined),
+        iv: iv || undefined,
+        protected: protectedHeader,
+        tag: tag || undefined,
         encrypted_key: encryptedKey || undefined,
     }, key, options);
     const result = { plaintext: decrypted.plaintext, protectedHeader: decrypted.protectedHeader };

package/dist/browser/jwe/flattened/decrypt.js

@@ -15,14 +15,14 @@ export async function flattenedDecrypt(jwe, key, options) {
     if (jwe.protected === undefined && jwe.header === undefined && jwe.unprotected === undefined) {
         throw new JWEInvalid('JOSE Header missing');
     }
-    if (typeof jwe.iv !== 'string') {
-        throw new JWEInvalid('JWE Initialization Vector missing or incorrect type');
+    if (jwe.iv !== undefined && typeof jwe.iv !== 'string') {
+        throw new JWEInvalid('JWE Initialization Vector incorrect type');
     }
     if (typeof jwe.ciphertext !== 'string') {
         throw new JWEInvalid('JWE Ciphertext missing or incorrect type');
     }
-    if (typeof jwe.tag !== 'string') {
-        throw new JWEInvalid('JWE Authentication Tag missing or incorrect type');
+    if (jwe.tag !== undefined && typeof jwe.tag !== 'string') {
+        throw new JWEInvalid('JWE Authentication Tag incorrect type');
     }
     if (jwe.protected !== undefined && typeof jwe.protected !== 'string') {
         throw new JWEInvalid('JWE Protected Header incorrect type');
@@ -104,17 +104,21 @@ export async function flattenedDecrypt(jwe, key, options) {
     }
     let iv;
     let tag;
-    try {
-        iv = base64url(jwe.iv);
-    }
-    catch {
-        throw new JWEInvalid('Failed to base64url decode the iv');
-    }
-    try {
-        tag = base64url(jwe.tag);
+    if (jwe.iv !== undefined) {
+        try {
+            iv = base64url(jwe.iv);
+        }
+        catch {
+            throw new JWEInvalid('Failed to base64url decode the iv');
+        }
     }
-    catch {
-        throw new JWEInvalid('Failed to base64url decode the tag');
+    if (jwe.tag !== undefined) {
+        try {
+            tag = base64url(jwe.tag);
+        }
+        catch {
+            throw new JWEInvalid('Failed to base64url decode the tag');
+        }
     }
     const protectedHeader = encoder.encode(jwe.protected ?? '');
     let additionalData;
@@ -131,7 +135,7 @@ export async function flattenedDecrypt(jwe, key, options) {
     catch {
         throw new JWEInvalid('Failed to base64url decode the ciphertext');
     }
-    let plaintext = await decrypt(enc, cek, ciphertext, iv, tag, additionalData);
+    const plaintext = await decrypt(enc, cek, ciphertext, iv, tag, additionalData);
     const result = { plaintext };
     if (jwe.protected !== undefined) {
         result.protectedHeader = parsedProt;

package/dist/browser/jwe/general/encrypt.js

@@ -68,7 +68,7 @@ export class GeneralEncrypt {
                 .setSharedUnprotectedHeader(this._unprotectedHeader)
                 .setUnprotectedHeader(recipient.unprotectedHeader)
                 .encrypt(recipient.key, { ...recipient.options });
-            let jwe = {
+            const jwe = {
                 ciphertext: flattened.ciphertext,
                 iv: flattened.iv,
                 recipients: [{}],
@@ -119,7 +119,7 @@ export class GeneralEncrypt {
             }
         }
         const cek = generateCek(enc);
-        let jwe = {
+        const jwe = {
             ciphertext: '',
             iv: '',
             recipients: [],

package/dist/browser/jwks/local.js

@@ -79,7 +79,7 @@ export class LocalJWKSet {
         if (length === 0) {
             throw new JWKSNoMatchingKey();
         }
-        else if (length !== 1) {
+        if (length !== 1) {
             const error = new JWKSMultipleMatchingKeys();
             const { _cached } = this;
             error[Symbol.asyncIterator] = async function* () {
@@ -87,9 +87,7 @@ export class LocalJWKSet {
                     try {
                         yield await importWithAlgCache(_cached, jwk, alg);
                     }
-                    catch {
-                        continue;
-                    }
+                    catch { }
                 }
             };
             throw error;
@@ -110,7 +108,5 @@ async function importWithAlgCache(cache, jwk, alg) {
 }
 export function createLocalJWKSet(jwks) {
     const set = new LocalJWKSet(jwks);
-    return async function (protectedHeader, token) {
-        return set.getKey(protectedHeader, token);
-    };
+    return async (protectedHeader, token) => set.getKey(protectedHeader, token);
 }

package/dist/browser/jwks/remote.js

@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.2.0';
+    const VERSION = 'v5.2.2';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 class RemoteJWKSet extends LocalJWKSet {
@@ -81,7 +81,5 @@ class RemoteJWKSet extends LocalJWKSet {
 }
 export function createRemoteJWKSet(url, options) {
     const set = new RemoteJWKSet(url, options);
-    return async function (protectedHeader, token) {
-        return set.getKey(protectedHeader, token);
-    };
+    return async (protectedHeader, token) => set.getKey(protectedHeader, token);
 }

package/dist/browser/lib/buffer_utils.js

@@ -6,10 +6,10 @@ export function concat(...buffers) {
     const size = buffers.reduce((acc, { length }) => acc + length, 0);
     const buf = new Uint8Array(size);
     let i = 0;
-    buffers.forEach((buffer) => {
+    for (const buffer of buffers) {
         buf.set(buffer, i);
         i += buffer.length;
-    });
+    }
     return buf;
 }
 export function p2s(alg, p2sInput) {

package/dist/browser/lib/invalid_key_input.js

@@ -16,7 +16,7 @@ function message(msg, actual, ...types) {
         msg += ` Received function ${actual.name}`;
     }
     else if (typeof actual === 'object' && actual != null) {
-        if (actual.constructor && actual.constructor.name) {
+        if (actual.constructor?.name) {
             msg += ` Received an instance of ${actual.constructor.name}`;
         }
     }

package/dist/browser/lib/validate_crit.js

@@ -25,7 +25,7 @@ function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader,
         if (joseHeader[parameter] === undefined) {
             throw new Err(`Extension Header Parameter "${parameter}" is missing`);
         }
-        else if (recognized.get(parameter) && protectedHeader[parameter] === undefined) {
+        if (recognized.get(parameter) && protectedHeader[parameter] === undefined) {
             throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
         }
     }

package/dist/browser/runtime/asn1.js

@@ -27,7 +27,7 @@ const findOid = (keyData, oid, from = 0) => {
         oid.unshift(oid.length);
         oid.unshift(0x06);
     }
-    let i = keyData.indexOf(oid[0], from);
+    const i = keyData.indexOf(oid[0], from);
     if (i === -1)
         return false;
     const sub = keyData.subarray(i, i + oid.length);
@@ -122,10 +122,10 @@ export const fromSPKI = (pem, alg, options) => {
     return genericImport(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g, 'spki', pem, alg, options);
 };
 function getElement(seq) {
-    let result = [];
+    const result = [];
     let next = 0;
     while (next < seq.length) {
-        let nextPart = parseElement(seq.subarray(next));
+        const nextPart = parseElement(seq.subarray(next));
         result.push(nextPart);
         next += nextPart.byteLength;
     }
@@ -165,7 +165,7 @@ function parseElement(bytes) {
         };
     }
     else {
-        let numberOfDigits = bytes[position] & 0x7f;
+        const numberOfDigits = bytes[position] & 0x7f;
         position++;
         length = 0;
         for (let i = 0; i < numberOfDigits; i++) {

package/dist/browser/runtime/decrypt.js

@@ -2,7 +2,7 @@ import { concat, uint64be } from '../lib/buffer_utils.js';
 import checkIvLength from '../lib/check_iv_length.js';
 import checkCekLength from './check_cek_length.js';
 import timingSafeEqual from './timing_safe_equal.js';
-import { JOSENotSupported, JWEDecryptionFailed } from '../util/errors.js';
+import { JOSENotSupported, JWEDecryptionFailed, JWEInvalid } from '../util/errors.js';
 import crypto, { isCryptoKey } from './webcrypto.js';
 import { checkEncCryptoKey } from '../lib/crypto_key.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
@@ -64,6 +64,12 @@ const decrypt = async (enc, cek, ciphertext, iv, tag, aad) => {
     if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) {
         throw new TypeError(invalidKeyInput(cek, ...types, 'Uint8Array'));
     }
+    if (!iv) {
+        throw new JWEInvalid('JWE Initialization Vector missing');
+    }
+    if (!tag) {
+        throw new JWEInvalid('JWE Authentication Tag missing');
+    }
     checkIvLength(enc, iv);
     switch (enc) {
         case 'A128CBC-HS256':

package/dist/browser/runtime/generate.js

@@ -97,7 +97,7 @@ export async function generateKeyPair(alg, options) {
             algorithm = { name: 'ECDSA', namedCurve: 'P-521' };
             keyUsages = ['sign', 'verify'];
             break;
-        case 'EdDSA':
+        case 'EdDSA': {
             keyUsages = ['sign', 'verify'];
             const crv = options?.crv ?? 'Ed25519';
             switch (crv) {
@@ -109,6 +109,7 @@ export async function generateKeyPair(alg, options) {
                     throw new JOSENotSupported('Invalid or unsupported crv option provided');
             }
             break;
+        }
         case 'ECDH-ES':
         case 'ECDH-ES+A128KW':
         case 'ECDH-ES+A192KW':

package/dist/node/cjs/jwe/compact/decrypt.js

@@ -17,9 +17,9 @@ async function compactDecrypt(jwe, key, options) {
     }
     const decrypted = await (0, decrypt_js_1.flattenedDecrypt)({
         ciphertext,
-        iv: (iv || undefined),
-        protected: protectedHeader || undefined,
-        tag: (tag || undefined),
+        iv: iv || undefined,
+        protected: protectedHeader,
+        tag: tag || undefined,
         encrypted_key: encryptedKey || undefined,
     }, key, options);
     const result = { plaintext: decrypted.plaintext, protectedHeader: decrypted.protectedHeader };

package/dist/node/cjs/jwe/flattened/decrypt.js

@@ -18,14 +18,14 @@ async function flattenedDecrypt(jwe, key, options) {
     if (jwe.protected === undefined && jwe.header === undefined && jwe.unprotected === undefined) {
         throw new errors_js_1.JWEInvalid('JOSE Header missing');
     }
-    if (typeof jwe.iv !== 'string') {
-        throw new errors_js_1.JWEInvalid('JWE Initialization Vector missing or incorrect type');
+    if (jwe.iv !== undefined && typeof jwe.iv !== 'string') {
+        throw new errors_js_1.JWEInvalid('JWE Initialization Vector incorrect type');
     }
     if (typeof jwe.ciphertext !== 'string') {
         throw new errors_js_1.JWEInvalid('JWE Ciphertext missing or incorrect type');
     }
-    if (typeof jwe.tag !== 'string') {
-        throw new errors_js_1.JWEInvalid('JWE Authentication Tag missing or incorrect type');
+    if (jwe.tag !== undefined && typeof jwe.tag !== 'string') {
+        throw new errors_js_1.JWEInvalid('JWE Authentication Tag incorrect type');
     }
     if (jwe.protected !== undefined && typeof jwe.protected !== 'string') {
         throw new errors_js_1.JWEInvalid('JWE Protected Header incorrect type');
@@ -107,17 +107,21 @@ async function flattenedDecrypt(jwe, key, options) {
     }
     let iv;
     let tag;
-    try {
-        iv = (0, base64url_js_1.decode)(jwe.iv);
-    }
-    catch {
-        throw new errors_js_1.JWEInvalid('Failed to base64url decode the iv');
-    }
-    try {
-        tag = (0, base64url_js_1.decode)(jwe.tag);
+    if (jwe.iv !== undefined) {
+        try {
+            iv = (0, base64url_js_1.decode)(jwe.iv);
+        }
+        catch {
+            throw new errors_js_1.JWEInvalid('Failed to base64url decode the iv');
+        }
     }
-    catch {
-        throw new errors_js_1.JWEInvalid('Failed to base64url decode the tag');
+    if (jwe.tag !== undefined) {
+        try {
+            tag = (0, base64url_js_1.decode)(jwe.tag);
+        }
+        catch {
+            throw new errors_js_1.JWEInvalid('Failed to base64url decode the tag');
+        }
     }
     const protectedHeader = buffer_utils_js_1.encoder.encode(jwe.protected ?? '');
     let additionalData;
@@ -134,7 +138,7 @@ async function flattenedDecrypt(jwe, key, options) {
     catch {
         throw new errors_js_1.JWEInvalid('Failed to base64url decode the ciphertext');
     }
-    let plaintext = await (0, decrypt_js_1.default)(enc, cek, ciphertext, iv, tag, additionalData);
+    const plaintext = await (0, decrypt_js_1.default)(enc, cek, ciphertext, iv, tag, additionalData);
     const result = { plaintext };
     if (jwe.protected !== undefined) {
         result.protectedHeader = parsedProt;

package/dist/node/cjs/jwe/general/encrypt.js

@@ -79,7 +79,7 @@ class GeneralEncrypt {
                 .setSharedUnprotectedHeader(this._unprotectedHeader)
                 .setUnprotectedHeader(recipient.unprotectedHeader)
                 .encrypt(recipient.key, { ...recipient.options });
-            let jwe = {
+            const jwe = {
                 ciphertext: flattened.ciphertext,
                 iv: flattened.iv,
                 recipients: [{}],
@@ -130,7 +130,7 @@ class GeneralEncrypt {
             }
         }
         const cek = (0, cek_js_1.default)(enc);
-        let jwe = {
+        const jwe = {
             ciphertext: '',
             iv: '',
             recipients: [],

package/dist/node/cjs/jwks/local.js

@@ -84,7 +84,7 @@ class LocalJWKSet {
         if (length === 0) {
             throw new errors_js_1.JWKSNoMatchingKey();
         }
-        else if (length !== 1) {
+        if (length !== 1) {
             const error = new errors_js_1.JWKSMultipleMatchingKeys();
             const { _cached } = this;
             error[Symbol.asyncIterator] = async function* () {
@@ -92,9 +92,7 @@ class LocalJWKSet {
                     try {
                         yield await importWithAlgCache(_cached, jwk, alg);
                     }
-                    catch {
-                        continue;
-                    }
+                    catch { }
                 }
             };
             throw error;
@@ -116,8 +114,6 @@ async function importWithAlgCache(cache, jwk, alg) {
 }
 function createLocalJWKSet(jwks) {
     const set = new LocalJWKSet(jwks);
-    return async function (protectedHeader, token) {
-        return set.getKey(protectedHeader, token);
-    };
+    return async (protectedHeader, token) => set.getKey(protectedHeader, token);
 }
 exports.createLocalJWKSet = createLocalJWKSet;

package/dist/node/cjs/jwks/remote.js

@@ -12,7 +12,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.2.0';
+    const VERSION = 'v5.2.2';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 class RemoteJWKSet extends local_js_1.LocalJWKSet {
@@ -91,8 +91,6 @@ class RemoteJWKSet extends local_js_1.LocalJWKSet {
 }
 function createRemoteJWKSet(url, options) {
     const set = new RemoteJWKSet(url, options);
-    return async function (protectedHeader, token) {
-        return set.getKey(protectedHeader, token);
-    };
+    return async (protectedHeader, token) => set.getKey(protectedHeader, token);
 }
 exports.createRemoteJWKSet = createRemoteJWKSet;

package/dist/node/cjs/lib/buffer_utils.js

@@ -9,10 +9,10 @@ function concat(...buffers) {
     const size = buffers.reduce((acc, { length }) => acc + length, 0);
     const buf = new Uint8Array(size);
     let i = 0;
-    buffers.forEach((buffer) => {
+    for (const buffer of buffers) {
         buf.set(buffer, i);
         i += buffer.length;
-    });
+    }
     return buf;
 }
 exports.concat = concat;

package/dist/node/cjs/lib/invalid_key_input.js

@@ -19,7 +19,7 @@ function message(msg, actual, ...types) {
         msg += ` Received function ${actual.name}`;
     }
     else if (typeof actual === 'object' && actual != null) {
-        if (actual.constructor && actual.constructor.name) {
+        if (actual.constructor?.name) {
             msg += ` Received an instance of ${actual.constructor.name}`;
         }
     }

package/dist/node/cjs/lib/validate_crit.js

@@ -27,7 +27,7 @@ function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader,
         if (joseHeader[parameter] === undefined) {
             throw new Err(`Extension Header Parameter "${parameter}" is missing`);
         }
-        else if (recognized.get(parameter) && protectedHeader[parameter] === undefined) {
+        if (recognized.get(parameter) && protectedHeader[parameter] === undefined) {
             throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
         }
     }

package/dist/node/cjs/runtime/decrypt.js

@@ -79,6 +79,12 @@ const decrypt = (enc, cek, ciphertext, iv, tag, aad) => {
     else {
         throw new TypeError((0, invalid_key_input_js_1.default)(cek, ...is_key_like_js_1.types, 'Uint8Array'));
     }
+    if (!iv) {
+        throw new errors_js_1.JWEInvalid('JWE Initialization Vector missing');
+    }
+    if (!tag) {
+        throw new errors_js_1.JWEInvalid('JWE Authentication Tag missing');
+    }
     (0, check_cek_length_js_1.default)(enc, key);
     (0, check_iv_length_js_1.default)(enc, iv);
     switch (enc) {

package/dist/node/cjs/runtime/generate.js

@@ -79,7 +79,7 @@ async function generateKeyPair(alg, options) {
         case 'ECDH-ES':
         case 'ECDH-ES+A128KW':
         case 'ECDH-ES+A192KW':
-        case 'ECDH-ES+A256KW':
+        case 'ECDH-ES+A256KW': {
             const crv = options?.crv ?? 'P-256';
             switch (crv) {
                 case undefined:
@@ -94,6 +94,7 @@ async function generateKeyPair(alg, options) {
                 default:
                     throw new errors_js_1.JOSENotSupported('Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, X25519, and X448');
             }
+        }
         default:
             throw new errors_js_1.JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
     }

package/dist/node/cjs/runtime/get_named_curve.js

@@ -44,7 +44,7 @@ const getNamedCurve = (kee, raw) => {
         case 'x448':
             return `X${key.asymmetricKeyType.slice(1)}`;
         case 'ec': {
-            let namedCurve = key.asymmetricKeyDetails.namedCurve;
+            const namedCurve = key.asymmetricKeyDetails.namedCurve;
             if (raw) {
                 return namedCurve;
             }

package/dist/node/esm/jwe/compact/decrypt.js

@@ -14,9 +14,9 @@ export async function compactDecrypt(jwe, key, options) {
     }
     const decrypted = await flattenedDecrypt({
         ciphertext,
-        iv: (iv || undefined),
-        protected: protectedHeader || undefined,
-        tag: (tag || undefined),
+        iv: iv || undefined,
+        protected: protectedHeader,
+        tag: tag || undefined,
         encrypted_key: encryptedKey || undefined,
     }, key, options);
     const result = { plaintext: decrypted.plaintext, protectedHeader: decrypted.protectedHeader };

package/dist/node/esm/jwe/flattened/decrypt.js

@@ -15,14 +15,14 @@ export async function flattenedDecrypt(jwe, key, options) {
     if (jwe.protected === undefined && jwe.header === undefined && jwe.unprotected === undefined) {
         throw new JWEInvalid('JOSE Header missing');
     }
-    if (typeof jwe.iv !== 'string') {
-        throw new JWEInvalid('JWE Initialization Vector missing or incorrect type');
+    if (jwe.iv !== undefined && typeof jwe.iv !== 'string') {
+        throw new JWEInvalid('JWE Initialization Vector incorrect type');
     }
     if (typeof jwe.ciphertext !== 'string') {
         throw new JWEInvalid('JWE Ciphertext missing or incorrect type');
     }
-    if (typeof jwe.tag !== 'string') {
-        throw new JWEInvalid('JWE Authentication Tag missing or incorrect type');
+    if (jwe.tag !== undefined && typeof jwe.tag !== 'string') {
+        throw new JWEInvalid('JWE Authentication Tag incorrect type');
     }
     if (jwe.protected !== undefined && typeof jwe.protected !== 'string') {
         throw new JWEInvalid('JWE Protected Header incorrect type');
@@ -104,17 +104,21 @@ export async function flattenedDecrypt(jwe, key, options) {
     }
     let iv;
     let tag;
-    try {
-        iv = base64url(jwe.iv);
-    }
-    catch {
-        throw new JWEInvalid('Failed to base64url decode the iv');
-    }
-    try {
-        tag = base64url(jwe.tag);
+    if (jwe.iv !== undefined) {
+        try {
+            iv = base64url(jwe.iv);
+        }
+        catch {
+            throw new JWEInvalid('Failed to base64url decode the iv');
+        }
     }
-    catch {
-        throw new JWEInvalid('Failed to base64url decode the tag');
+    if (jwe.tag !== undefined) {
+        try {
+            tag = base64url(jwe.tag);
+        }
+        catch {
+            throw new JWEInvalid('Failed to base64url decode the tag');
+        }
     }
     const protectedHeader = encoder.encode(jwe.protected ?? '');
     let additionalData;
@@ -131,7 +135,7 @@ export async function flattenedDecrypt(jwe, key, options) {
     catch {
         throw new JWEInvalid('Failed to base64url decode the ciphertext');
     }
-    let plaintext = await decrypt(enc, cek, ciphertext, iv, tag, additionalData);
+    const plaintext = await decrypt(enc, cek, ciphertext, iv, tag, additionalData);
     const result = { plaintext };
     if (jwe.protected !== undefined) {
         result.protectedHeader = parsedProt;

package/dist/node/esm/jwe/general/encrypt.js

@@ -76,7 +76,7 @@ export class GeneralEncrypt {
                 .setSharedUnprotectedHeader(this._unprotectedHeader)
                 .setUnprotectedHeader(recipient.unprotectedHeader)
                 .encrypt(recipient.key, { ...recipient.options });
-            let jwe = {
+            const jwe = {
                 ciphertext: flattened.ciphertext,
                 iv: flattened.iv,
                 recipients: [{}],
@@ -127,7 +127,7 @@ export class GeneralEncrypt {
             }
         }
         const cek = generateCek(enc);
-        let jwe = {
+        const jwe = {
             ciphertext: '',
             iv: '',
             recipients: [],

package/dist/node/esm/jwks/local.js

@@ -80,7 +80,7 @@ export class LocalJWKSet {
         if (length === 0) {
             throw new JWKSNoMatchingKey();
         }
-        else if (length !== 1) {
+        if (length !== 1) {
             const error = new JWKSMultipleMatchingKeys();
             const { _cached } = this;
             error[Symbol.asyncIterator] = async function* () {
@@ -88,9 +88,7 @@ export class LocalJWKSet {
                     try {
                         yield await importWithAlgCache(_cached, jwk, alg);
                     }
-                    catch {
-                        continue;
-                    }
+                    catch { }
                 }
             };
             throw error;
@@ -111,7 +109,5 @@ async function importWithAlgCache(cache, jwk, alg) {
 }
 export function createLocalJWKSet(jwks) {
     const set = new LocalJWKSet(jwks);
-    return async function (protectedHeader, token) {
-        return set.getKey(protectedHeader, token);
-    };
+    return async (protectedHeader, token) => set.getKey(protectedHeader, token);
 }

package/dist/node/esm/jwks/remote.js

@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.2.0';
+    const VERSION = 'v5.2.2';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 class RemoteJWKSet extends LocalJWKSet {
@@ -88,7 +88,5 @@ class RemoteJWKSet extends LocalJWKSet {
 }
 export function createRemoteJWKSet(url, options) {
     const set = new RemoteJWKSet(url, options);
-    return async function (protectedHeader, token) {
-        return set.getKey(protectedHeader, token);
-    };
+    return async (protectedHeader, token) => set.getKey(protectedHeader, token);
 }

package/dist/node/esm/lib/buffer_utils.js

@@ -6,10 +6,10 @@ export function concat(...buffers) {
     const size = buffers.reduce((acc, { length }) => acc + length, 0);
     const buf = new Uint8Array(size);
     let i = 0;
-    buffers.forEach((buffer) => {
+    for (const buffer of buffers) {
         buf.set(buffer, i);
         i += buffer.length;
-    });
+    }
     return buf;
 }
 export function p2s(alg, p2sInput) {

package/dist/node/esm/lib/invalid_key_input.js

@@ -16,7 +16,7 @@ function message(msg, actual, ...types) {
         msg += ` Received function ${actual.name}`;
     }
     else if (typeof actual === 'object' && actual != null) {
-        if (actual.constructor && actual.constructor.name) {
+        if (actual.constructor?.name) {
             msg += ` Received an instance of ${actual.constructor.name}`;
         }
     }

package/dist/node/esm/lib/validate_crit.js

@@ -25,7 +25,7 @@ function validateCrit(Err, recognizedDefault, recognizedOption, protectedHeader,
         if (joseHeader[parameter] === undefined) {
             throw new Err(`Extension Header Parameter "${parameter}" is missing`);
         }
-        else if (recognized.get(parameter) && protectedHeader[parameter] === undefined) {
+        if (recognized.get(parameter) && protectedHeader[parameter] === undefined) {
             throw new Err(`Extension Header Parameter "${parameter}" MUST be integrity protected`);
         }
     }

package/dist/node/esm/runtime/decrypt.js

@@ -2,7 +2,7 @@ import { createDecipheriv, KeyObject } from 'node:crypto';
 import checkIvLength from '../lib/check_iv_length.js';
 import checkCekLength from './check_cek_length.js';
 import { concat } from '../lib/buffer_utils.js';
-import { JOSENotSupported, JWEDecryptionFailed } from '../util/errors.js';
+import { JOSENotSupported, JWEDecryptionFailed, JWEInvalid } from '../util/errors.js';
 import timingSafeEqual from './timing_safe_equal.js';
 import cbcTag from './cbc_tag.js';
 import { isCryptoKey } from './webcrypto.js';
@@ -77,6 +77,12 @@ const decrypt = (enc, cek, ciphertext, iv, tag, aad) => {
     else {
         throw new TypeError(invalidKeyInput(cek, ...types, 'Uint8Array'));
     }
+    if (!iv) {
+        throw new JWEInvalid('JWE Initialization Vector missing');
+    }
+    if (!tag) {
+        throw new JWEInvalid('JWE Authentication Tag missing');
+    }
     checkCekLength(enc, key);
     checkIvLength(enc, iv);
     switch (enc) {

package/dist/node/esm/runtime/generate.js

@@ -75,7 +75,7 @@ export async function generateKeyPair(alg, options) {
         case 'ECDH-ES':
         case 'ECDH-ES+A128KW':
         case 'ECDH-ES+A192KW':
-        case 'ECDH-ES+A256KW':
+        case 'ECDH-ES+A256KW': {
             const crv = options?.crv ?? 'P-256';
             switch (crv) {
                 case undefined:
@@ -90,6 +90,7 @@ export async function generateKeyPair(alg, options) {
                 default:
                     throw new JOSENotSupported('Invalid or unsupported crv option provided, supported values are P-256, P-384, P-521, X25519, and X448');
             }
+        }
         default:
             throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
     }

package/dist/node/esm/runtime/get_named_curve.js

@@ -41,7 +41,7 @@ const getNamedCurve = (kee, raw) => {
         case 'x448':
             return `X${key.asymmetricKeyType.slice(1)}`;
         case 'ec': {
-            let namedCurve = key.asymmetricKeyDetails.namedCurve;
+            const namedCurve = key.asymmetricKeyDetails.namedCurve;
             if (raw) {
                 return namedCurve;
             }

package/dist/types/key/import.d.ts

@@ -11,7 +11,11 @@ export interface PEMImportOptions {
  * Imports a PEM-encoded SPKI string as a runtime-specific public key representation (KeyObject or
  * CryptoKey).
  *
- * @param pem PEM-encoded SPKI string
+ * Note: The OID id-RSASSA-PSS (1.2.840.113549.1.1.10) is not supported in
+ * {@link https://w3c.github.io/webcrypto/ Web Cryptography API}, use the OID rsaEncryption
+ * (1.2.840.113549.1.1.1) instead for all RSA algorithms.
+ *
+ * @param spki PEM-encoded SPKI string
  * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used
  *   with the imported key, its presence is only enforced in Web Crypto API runtimes. See
  *   {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}.
@@ -21,7 +25,11 @@ export declare function importSPKI<KeyLikeType extends KeyLike = KeyLike>(spki:
  * Imports the SPKI from an X.509 string certificate as a runtime-specific public key representation
  * (KeyObject or CryptoKey).
  *
- * @param pem X.509 certificate string
+ * Note: The OID id-RSASSA-PSS (1.2.840.113549.1.1.10) is not supported in
+ * {@link https://w3c.github.io/webcrypto/ Web Cryptography API}, use the OID rsaEncryption
+ * (1.2.840.113549.1.1.1) instead for all RSA algorithms.
+ *
+ * @param x509 X.509 certificate string
  * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used
  *   with the imported key, its presence is only enforced in Web Crypto API runtimes. See
  *   {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}.
@@ -31,17 +39,22 @@ export declare function importX509<KeyLikeType extends KeyLike = KeyLike>(x509:
  * Imports a PEM-encoded PKCS#8 string as a runtime-specific private key representation (KeyObject
  * or CryptoKey).
  *
- * @param pem PEM-encoded PKCS#8 string
+ * Note: The OID id-RSASSA-PSS (1.2.840.113549.1.1.10) is not supported in
+ * {@link https://w3c.github.io/webcrypto/ Web Cryptography API}, use the OID rsaEncryption
+ * (1.2.840.113549.1.1.1) instead for all RSA algorithms.
+ *
+ * @param pkcs8 PEM-encoded PKCS#8 string
  * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used
  *   with the imported key, its presence is only enforced in Web Crypto API runtimes. See
  *   {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}.
  */
 export declare function importPKCS8<KeyLikeType extends KeyLike = KeyLike>(pkcs8: string, alg: string, options?: PEMImportOptions): Promise<KeyLikeType>;
 /**
- * Imports a JWK to a runtime-specific key representation (KeyLike). Either JWK "alg" (Algorithm)
- * Parameter must be present or the optional "alg" argument. When running on a runtime using
- * {@link https://www.w3.org/TR/WebCryptoAPI/ Web Cryptography API} the jwk parameters "use",
- * "key_ops", and "ext" are also used in the resulting `CryptoKey`.
+ * Imports a JWK to a runtime-specific key representation (KeyLike). Either the JWK "alg"
+ * (Algorithm) Parameter, or the optional "alg" argument, must be present.
+ *
+ * Note: When the runtime is using {@link https://w3c.github.io/webcrypto/ Web Cryptography API} the
+ * jwk parameters "use", "key_ops", and "ext" are also used in the resulting `CryptoKey`.
  *
  * @param jwk JSON Web Key.
  * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used

package/dist/types/types.d.ts

@@ -264,7 +264,7 @@ export interface FlattenedJWE {
    * The "iv" member MUST be present and contain the value BASE64URL(JWE Initialization Vector) when
    * the JWE Initialization Vector value is non-empty; otherwise, it MUST be absent.
    */
-  iv: string
+  iv?: string
 
   /**
    * The "protected" member MUST be present and contain the value BASE64URL(UTF8(JWE Protected
@@ -277,7 +277,7 @@ export interface FlattenedJWE {
    * The "tag" member MUST be present and contain the value BASE64URL(JWE Authentication Tag) when
    * the JWE Authentication Tag value is non-empty; otherwise, it MUST be absent.
    */
-  tag: string
+  tag?: string
 
   /**
    * The "unprotected" member MUST be present and contain the value JWE Shared Unprotected Header

package/dist/types/util/errors.d.ts

@@ -4,10 +4,15 @@ import type { KeyLike } from '../types';
  *
  */
 export declare class JOSEError extends Error {
-    /** A unique error code for the particular error subclass. */
+    /**
+     * A unique error code for the particular error subclass.
+     *
+     * @ignore
+     */
     static get code(): string;
-    /** A unique error code for the particular error subclass. */
+    /** A unique error code for this particular error subclass. */
     code: string;
+    /** @ignore */
     constructor(message?: string);
 }
 /**
@@ -15,12 +20,14 @@ export declare class JOSEError extends Error {
  *
  */
 export declare class JWTClaimValidationFailed extends JOSEError {
+    /** @ignore */
     static get code(): 'ERR_JWT_CLAIM_VALIDATION_FAILED';
     code: string;
     /** The Claim for which the validation failed. */
     claim: string;
     /** Reason code for the validation failure. */
     reason: string;
+    /** @ignore */
     constructor(message: string, claim?: string, reason?: string);
 }
 /**
@@ -28,12 +35,14 @@ export declare class JWTClaimValidationFailed extends JOSEError {
  *
  */
 export declare class JWTExpired extends JOSEError implements JWTClaimValidationFailed {
+    /** @ignore */
     static get code(): 'ERR_JWT_EXPIRED';
     code: string;
     /** The Claim for which the validation failed. */
     claim: string;
     /** Reason code for the validation failure. */
     reason: string;
+    /** @ignore */
     constructor(message: string, claim?: string, reason?: string);
 }
 /**
@@ -41,6 +50,7 @@ export declare class JWTExpired extends JOSEError implements JWTClaimValidationF
  *
  */
 export declare class JOSEAlgNotAllowed extends JOSEError {
+    /** @ignore */
     static get code(): 'ERR_JOSE_ALG_NOT_ALLOWED';
     code: string;
 }
@@ -50,6 +60,7 @@ export declare class JOSEAlgNotAllowed extends JOSEError {
  *
  */
 export declare class JOSENotSupported extends JOSEError {
+    /** @ignore */
     static get code(): 'ERR_JOSE_NOT_SUPPORTED';
     code: string;
 }
@@ -58,6 +69,7 @@ export declare class JOSENotSupported extends JOSEError {
  *
  */
 export declare class JWEDecryptionFailed extends JOSEError {
+    /** @ignore */
     static get code(): 'ERR_JWE_DECRYPTION_FAILED';
     code: string;
     message: string;
@@ -67,6 +79,7 @@ export declare class JWEDecryptionFailed extends JOSEError {
  *
  */
 export declare class JWEInvalid extends JOSEError {
+    /** @ignore */
     static get code(): 'ERR_JWE_INVALID';
     code: string;
 }
@@ -75,6 +88,7 @@ export declare class JWEInvalid extends JOSEError {
  *
  */
 export declare class JWSInvalid extends JOSEError {
+    /** @ignore */
     static get code(): 'ERR_JWS_INVALID';
     code: string;
 }
@@ -83,6 +97,7 @@ export declare class JWSInvalid extends JOSEError {
  *
  */
 export declare class JWTInvalid extends JOSEError {
+    /** @ignore */
     static get code(): 'ERR_JWT_INVALID';
     code: string;
 }
@@ -91,6 +106,7 @@ export declare class JWTInvalid extends JOSEError {
  *
  */
 export declare class JWKInvalid extends JOSEError {
+    /** @ignore */
     static get code(): 'ERR_JWK_INVALID';
     code: string;
 }
@@ -99,6 +115,7 @@ export declare class JWKInvalid extends JOSEError {
  *
  */
 export declare class JWKSInvalid extends JOSEError {
+    /** @ignore */
     static get code(): 'ERR_JWKS_INVALID';
     code: string;
 }
@@ -107,6 +124,7 @@ export declare class JWKSInvalid extends JOSEError {
  *
  */
 export declare class JWKSNoMatchingKey extends JOSEError {
+    /** @ignore */
     static get code(): 'ERR_JWKS_NO_MATCHING_KEY';
     code: string;
     message: string;
@@ -127,6 +145,7 @@ export declare class JWKSMultipleMatchingKeys extends JOSEError {
  *
  */
 export declare class JWKSTimeout extends JOSEError {
+    /** @ignore */
     static get code(): 'ERR_JWKS_TIMEOUT';
     code: string;
     message: string;
@@ -136,6 +155,7 @@ export declare class JWKSTimeout extends JOSEError {
  *
  */
 export declare class JWSSignatureVerificationFailed extends JOSEError {
+    /** @ignore */
     static get code(): 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
     code: string;
     message: string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "jose",
-  "version": "5.2.0",
-  "description": "'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
+  "version": "5.2.2",
+  "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "browser",
     "bun",