jose 5.6.3 → 5.7.0

package/dist/browser/index.js

@@ -17,7 +17,7 @@ export { EncryptJWT } from './jwt/encrypt.js';
 export { calculateJwkThumbprint, calculateJwkThumbprintUri } from './jwk/thumbprint.js';
 export { EmbeddedJWK } from './jwk/embedded.js';
 export { createLocalJWKSet } from './jwks/local.js';
-export { createRemoteJWKSet, experimental_jwksCache } from './jwks/remote.js';
+export { createRemoteJWKSet, jwksCache, experimental_jwksCache } from './jwks/remote.js';
 export { UnsecuredJWT } from './jwt/unsecured.js';
 export { exportPKCS8, exportSPKI, exportJWK } from './key/export.js';
 export { importSPKI, importPKCS8, importX509, importJWK } from './key/import.js';

package/dist/browser/jwks/remote.js

@@ -10,10 +10,10 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.6.3';
+    const VERSION = 'v5.7.0';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
-export const experimental_jwksCache = Symbol();
+export const jwksCache = Symbol();
 function isFreshJwksCache(input, cacheMaxAge) {
     if (typeof input !== 'object' || input === null) {
         return false;
@@ -41,9 +41,9 @@ class RemoteJWKSet {
         this._cooldownDuration =
             typeof options?.cooldownDuration === 'number' ? options?.cooldownDuration : 30000;
         this._cacheMaxAge = typeof options?.cacheMaxAge === 'number' ? options?.cacheMaxAge : 600000;
-        if (options?.[experimental_jwksCache] !== undefined) {
-            this._cache = options?.[experimental_jwksCache];
-            if (isFreshJwksCache(options?.[experimental_jwksCache], this._cacheMaxAge)) {
+        if (options?.[jwksCache] !== undefined) {
+            this._cache = options?.[jwksCache];
+            if (isFreshJwksCache(options?.[jwksCache], this._cacheMaxAge)) {
                 this._jwksTimestamp = this._cache.uat;
                 this._local = createLocalJWKSet(this._cache.jwks);
             }
@@ -136,3 +136,4 @@ export function createRemoteJWKSet(url, options) {
     });
     return remoteJWKSet;
 }
+export const experimental_jwksCache = jwksCache;

package/dist/node/cjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.cryptoRuntime = exports.base64url = exports.generateSecret = exports.generateKeyPair = exports.errors = exports.decodeJwt = exports.decodeProtectedHeader = exports.importJWK = exports.importX509 = exports.importPKCS8 = exports.importSPKI = exports.exportJWK = exports.exportSPKI = exports.exportPKCS8 = exports.UnsecuredJWT = exports.experimental_jwksCache = exports.createRemoteJWKSet = exports.createLocalJWKSet = exports.EmbeddedJWK = exports.calculateJwkThumbprintUri = exports.calculateJwkThumbprint = exports.EncryptJWT = exports.SignJWT = exports.GeneralSign = exports.FlattenedSign = exports.CompactSign = exports.FlattenedEncrypt = exports.CompactEncrypt = exports.jwtDecrypt = exports.jwtVerify = exports.generalVerify = exports.flattenedVerify = exports.compactVerify = exports.GeneralEncrypt = exports.generalDecrypt = exports.flattenedDecrypt = exports.compactDecrypt = void 0;
+exports.cryptoRuntime = exports.base64url = exports.generateSecret = exports.generateKeyPair = exports.errors = exports.decodeJwt = exports.decodeProtectedHeader = exports.importJWK = exports.importX509 = exports.importPKCS8 = exports.importSPKI = exports.exportJWK = exports.exportSPKI = exports.exportPKCS8 = exports.UnsecuredJWT = exports.experimental_jwksCache = exports.jwksCache = exports.createRemoteJWKSet = exports.createLocalJWKSet = exports.EmbeddedJWK = exports.calculateJwkThumbprintUri = exports.calculateJwkThumbprint = exports.EncryptJWT = exports.SignJWT = exports.GeneralSign = exports.FlattenedSign = exports.CompactSign = exports.FlattenedEncrypt = exports.CompactEncrypt = exports.jwtDecrypt = exports.jwtVerify = exports.generalVerify = exports.flattenedVerify = exports.compactVerify = exports.GeneralEncrypt = exports.generalDecrypt = exports.flattenedDecrypt = exports.compactDecrypt = void 0;
 var decrypt_js_1 = require("./jwe/compact/decrypt.js");
 Object.defineProperty(exports, "compactDecrypt", { enumerable: true, get: function () { return decrypt_js_1.compactDecrypt; } });
 var decrypt_js_2 = require("./jwe/flattened/decrypt.js");
@@ -42,6 +42,7 @@ var local_js_1 = require("./jwks/local.js");
 Object.defineProperty(exports, "createLocalJWKSet", { enumerable: true, get: function () { return local_js_1.createLocalJWKSet; } });
 var remote_js_1 = require("./jwks/remote.js");
 Object.defineProperty(exports, "createRemoteJWKSet", { enumerable: true, get: function () { return remote_js_1.createRemoteJWKSet; } });
+Object.defineProperty(exports, "jwksCache", { enumerable: true, get: function () { return remote_js_1.jwksCache; } });
 Object.defineProperty(exports, "experimental_jwksCache", { enumerable: true, get: function () { return remote_js_1.experimental_jwksCache; } });
 var unsecured_js_1 = require("./jwt/unsecured.js");
 Object.defineProperty(exports, "UnsecuredJWT", { enumerable: true, get: function () { return unsecured_js_1.UnsecuredJWT; } });

package/dist/node/cjs/jwks/remote.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createRemoteJWKSet = exports.experimental_jwksCache = void 0;
+exports.experimental_jwksCache = exports.createRemoteJWKSet = exports.jwksCache = void 0;
 const fetch_jwks_js_1 = require("../runtime/fetch_jwks.js");
 const errors_js_1 = require("../util/errors.js");
 const local_js_1 = require("./local.js");
@@ -13,10 +13,10 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.6.3';
+    const VERSION = 'v5.7.0';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
-exports.experimental_jwksCache = Symbol();
+exports.jwksCache = Symbol();
 function isFreshJwksCache(input, cacheMaxAge) {
     if (typeof input !== 'object' || input === null) {
         return false;
@@ -53,9 +53,9 @@ class RemoteJWKSet {
         this._cooldownDuration =
             typeof options?.cooldownDuration === 'number' ? options?.cooldownDuration : 30000;
         this._cacheMaxAge = typeof options?.cacheMaxAge === 'number' ? options?.cacheMaxAge : 600000;
-        if (options?.[exports.experimental_jwksCache] !== undefined) {
-            this._cache = options?.[exports.experimental_jwksCache];
-            if (isFreshJwksCache(options?.[exports.experimental_jwksCache], this._cacheMaxAge)) {
+        if (options?.[exports.jwksCache] !== undefined) {
+            this._cache = options?.[exports.jwksCache];
+            if (isFreshJwksCache(options?.[exports.jwksCache], this._cacheMaxAge)) {
                 this._jwksTimestamp = this._cache.uat;
                 this._local = (0, local_js_1.createLocalJWKSet)(this._cache.jwks);
             }
@@ -149,3 +149,4 @@ function createRemoteJWKSet(url, options) {
     return remoteJWKSet;
 }
 exports.createRemoteJWKSet = createRemoteJWKSet;
+exports.experimental_jwksCache = exports.jwksCache;

package/dist/node/esm/index.js

@@ -17,7 +17,7 @@ export { EncryptJWT } from './jwt/encrypt.js';
 export { calculateJwkThumbprint, calculateJwkThumbprintUri } from './jwk/thumbprint.js';
 export { EmbeddedJWK } from './jwk/embedded.js';
 export { createLocalJWKSet } from './jwks/local.js';
-export { createRemoteJWKSet, experimental_jwksCache } from './jwks/remote.js';
+export { createRemoteJWKSet, jwksCache, experimental_jwksCache } from './jwks/remote.js';
 export { UnsecuredJWT } from './jwt/unsecured.js';
 export { exportPKCS8, exportSPKI, exportJWK } from './key/export.js';
 export { importSPKI, importPKCS8, importX509, importJWK } from './key/import.js';

package/dist/node/esm/jwks/remote.js

@@ -10,10 +10,10 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.6.3';
+    const VERSION = 'v5.7.0';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
-export const experimental_jwksCache = Symbol();
+export const jwksCache = Symbol();
 function isFreshJwksCache(input, cacheMaxAge) {
     if (typeof input !== 'object' || input === null) {
         return false;
@@ -50,9 +50,9 @@ class RemoteJWKSet {
         this._cooldownDuration =
             typeof options?.cooldownDuration === 'number' ? options?.cooldownDuration : 30000;
         this._cacheMaxAge = typeof options?.cacheMaxAge === 'number' ? options?.cacheMaxAge : 600000;
-        if (options?.[experimental_jwksCache] !== undefined) {
-            this._cache = options?.[experimental_jwksCache];
-            if (isFreshJwksCache(options?.[experimental_jwksCache], this._cacheMaxAge)) {
+        if (options?.[jwksCache] !== undefined) {
+            this._cache = options?.[jwksCache];
+            if (isFreshJwksCache(options?.[jwksCache], this._cacheMaxAge)) {
                 this._jwksTimestamp = this._cache.uat;
                 this._local = createLocalJWKSet(this._cache.jwks);
             }
@@ -145,3 +145,4 @@ export function createRemoteJWKSet(url, options) {
     });
     return remoteJWKSet;
 }
+export const experimental_jwksCache = jwksCache;

package/dist/types/index.d.ts

@@ -28,7 +28,7 @@ export { EncryptJWT } from './jwt/encrypt';
 export { calculateJwkThumbprint, calculateJwkThumbprintUri } from './jwk/thumbprint';
 export { EmbeddedJWK } from './jwk/embedded';
 export { createLocalJWKSet } from './jwks/local';
-export { createRemoteJWKSet, experimental_jwksCache } from './jwks/remote';
+export { createRemoteJWKSet, jwksCache, experimental_jwksCache } from './jwks/remote';
 export type { RemoteJWKSetOptions, JWKSCacheInput, ExportedJWKSCache } from './jwks/remote';
 export { UnsecuredJWT } from './jwt/unsecured';
 export type { UnsecuredResult } from './jwt/unsecured';

package/dist/types/jwks/remote.d.ts

@@ -1,8 +1,5 @@
 import type { KeyLike, JWSHeaderParameters, FlattenedJWSInput, JSONWebKeySet } from '../types';
 /**
- * This is an experimental feature, it is not subject to semantic versioning rules. Non-backward
- * compatible changes or removal may occur in any future release.
- *
  * DANGER ZONE - This option has security implications that must be understood, assessed for
  * applicability, and accepted before use. It is critical that the JSON Web Key Set cache only be
  * writable by your own code.
@@ -25,7 +22,7 @@ import type { KeyLike, JWSHeaderParameters, FlattenedJWSInput, JSONWebKeySet } f
  *   previously cached object from a low-latency key-value store offered by the cloud computing
  *   runtime it is executed on;
  * - Default to an empty object `{}` instead when there's no previously cached value;
- * - Pass it in as {@link RemoteJWKSetOptions[experimental_jwksCache]};
+ * - Pass it in as {@link RemoteJWKSetOptions[jwksCache]};
  * - Afterwards, update the key-value storage if the {@link ExportedJWKSCache.uat `uat`} property of
  *   the object has changed.
  *
@@ -40,7 +37,7 @@ import type { KeyLike, JWSHeaderParameters, FlattenedJWSInput, JSONWebKeySet } f
  * const { uat } = jwksCache
  *
  * const JWKS = jose.createRemoteJWKSet(url, {
- *   [jose.experimental_jwksCache]: jwksCache,
+ *   [jose.jwksCache]: jwksCache,
  * })
  *
  * // Use JSON Web Key Set cache
@@ -52,7 +49,7 @@ import type { KeyLike, JWSHeaderParameters, FlattenedJWSInput, JSONWebKeySet } f
  * }
  * ```
  */
-export declare const experimental_jwksCache: unique symbol;
+export declare const jwksCache: unique symbol;
 /** Options for the remote JSON Web Key Set. */
 export interface RemoteJWKSetOptions {
     /**
@@ -85,8 +82,8 @@ export interface RemoteJWKSetOptions {
      * configuration would cause an unnecessary CORS preflight request.
      */
     headers?: Record<string, string>;
-    /** See {@link experimental_jwksCache}. */
-    [experimental_jwksCache]?: JWKSCacheInput;
+    /** See {@link jwksCache}. */
+    [jwksCache]?: JWKSCacheInput;
 }
 export interface ExportedJWKSCache {
     jwks: JSONWebKeySet;
@@ -127,3 +124,9 @@ export declare function createRemoteJWKSet<KeyLikeType extends KeyLike = KeyLike
     /** @ignore */
     jwks: () => JSONWebKeySet | undefined;
 };
+/**
+ * @ignore
+ *
+ * @deprecated Use {@link jwksCache}.
+ */
+export declare const experimental_jwksCache: symbol;

package/dist/types/types.d.ts

@@ -370,7 +370,11 @@ export interface EncryptOptions extends CritOption {}
 
 /** JWT Claims Set verification options. */
 export interface JWTClaimVerificationOptions {
-  /** Expected JWT "aud" (Audience) Claim value(s). */
+  /**
+   * Expected JWT "aud" (Audience) Claim value(s).
+   *
+   * This option makes the JWT "aud" (Audience) Claim presence required.
+   */
   audience?: string | string[]
 
   /**
@@ -381,7 +385,11 @@ export interface JWTClaimVerificationOptions {
    */
   clockTolerance?: string | number
 
-  /** Expected JWT "iss" (Issuer) Claim value(s). */
+  /**
+   * Expected JWT "iss" (Issuer) Claim value(s).
+   *
+   * This option makes the JWT "iss" (Issuer) Claim presence required.
+   */
   issuer?: string | string[]
 
   /**
@@ -389,13 +397,23 @@ export interface JWTClaimVerificationOptions {
    *
    * - In seconds when number (e.g. 5)
    * - Parsed as seconds when a string (e.g. "5 seconds", "10 minutes", "2 hours").
+   *
+   * This option makes the JWT "iat" (Issued At) Claim presence required.
    */
   maxTokenAge?: string | number
 
-  /** Expected JWT "sub" (Subject) Claim value. */
+  /**
+   * Expected JWT "sub" (Subject) Claim value.
+   *
+   * This option makes the JWT "sub" (Subject) Claim presence required.
+   */
   subject?: string
 
-  /** Expected JWT "typ" (Type) Header Parameter value. */
+  /**
+   * Expected JWT "typ" (Type) Header Parameter value.
+   *
+   * This option makes the JWT "typ" (Type) Header Parameter presence required.
+   */
   typ?: string
 
   /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
@@ -403,11 +421,13 @@ export interface JWTClaimVerificationOptions {
 
   /**
    * Array of required Claim Names that must be present in the JWT Claims Set. Default is that: if
-   * the {@link JWTClaimVerificationOptions.issuer issuer option} is set, then "iss" must be present;
-   * if the {@link JWTClaimVerificationOptions.audience audience option} is set, then "aud" must be
-   * present; if the {@link JWTClaimVerificationOptions.subject subject option} is set, then "sub"
-   * must be present; if the {@link JWTClaimVerificationOptions.maxTokenAge maxTokenAge option} is
-   * set, then "iat" must be present.
+   * the {@link JWTClaimVerificationOptions.issuer `issuer` option} is set, then JWT "iss" (Issuer)
+   * Claim must be present; if the {@link JWTClaimVerificationOptions.audience `audience` option} is
+   * set, then JWT "aud" (Audience) Claim must be present; if the
+   * {@link JWTClaimVerificationOptions.subject `subject` option} is set, then JWT "sub" (Subject)
+   * Claim must be present; if the
+   * {@link JWTClaimVerificationOptions.maxTokenAge `maxTokenAge` option} is set, then JWT "iat"
+   * (Issued At) Claim must be present.
    */
   requiredClaims?: string[]
 }
@@ -416,8 +436,9 @@ export interface JWTClaimVerificationOptions {
 export interface VerifyOptions extends CritOption {
   /**
    * A list of accepted JWS "alg" (Algorithm) Header Parameter values. By default all "alg"
-   * (Algorithm) values applicable for the used key/secret are allowed. Note: "none" is never
-   * accepted.
+   * (Algorithm) values applicable for the used key/secret are allowed.
+   *
+   * Note: Unsecured JWTs (`{ "alg": "none" }`) are never accepted by this API.
    */
   algorithms?: string[]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "5.6.3",
+  "version": "5.7.0",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "browser",