jose 5.6.3 → 5.8.0

package/dist/browser/index.js

@@ -17,7 +17,7 @@ export { EncryptJWT } from './jwt/encrypt.js';
 export { calculateJwkThumbprint, calculateJwkThumbprintUri } from './jwk/thumbprint.js';
 export { EmbeddedJWK } from './jwk/embedded.js';
 export { createLocalJWKSet } from './jwks/local.js';
-export { createRemoteJWKSet, experimental_jwksCache } from './jwks/remote.js';
+export { createRemoteJWKSet, jwksCache, experimental_jwksCache } from './jwks/remote.js';
 export { UnsecuredJWT } from './jwt/unsecured.js';
 export { exportPKCS8, exportSPKI, exportJWK } from './key/export.js';
 export { importSPKI, importPKCS8, importX509, importJWK } from './key/import.js';

package/dist/browser/jwe/flattened/encrypt.js

@@ -1,11 +1,11 @@
 import { encode as base64url } from '../../runtime/base64url.js';
+import { unprotected } from '../../lib/private_symbols.js';
 import encrypt from '../../runtime/encrypt.js';
 import encryptKeyManagement from '../../lib/encrypt_key_management.js';
 import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
 import validateCrit from '../../lib/validate_crit.js';
-export const unprotected = Symbol();
 export class FlattenedEncrypt {
     constructor(plaintext) {
         if (!(plaintext instanceof Uint8Array)) {

package/dist/browser/jwe/general/encrypt.js

@@ -1,4 +1,5 @@
-import { FlattenedEncrypt, unprotected } from '../flattened/encrypt.js';
+import { FlattenedEncrypt } from '../flattened/encrypt.js';
+import { unprotected } from '../../lib/private_symbols.js';
 import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
 import generateCek from '../../lib/cek.js';
 import isDisjoint from '../../lib/is_disjoint.js';

package/dist/browser/jwks/local.js

@@ -29,7 +29,7 @@ function clone(obj) {
     }
     return JSON.parse(JSON.stringify(obj));
 }
-export class LocalJWKSet {
+class LocalJWKSet {
     constructor(jwks) {
         this._cached = new WeakMap();
         if (!isJWKSLike(jwks)) {

package/dist/browser/jwks/remote.js

@@ -10,10 +10,10 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.6.3';
+    const VERSION = 'v5.8.0';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
-export const experimental_jwksCache = Symbol();
+export const jwksCache = Symbol();
 function isFreshJwksCache(input, cacheMaxAge) {
     if (typeof input !== 'object' || input === null) {
         return false;
@@ -41,9 +41,9 @@ class RemoteJWKSet {
         this._cooldownDuration =
             typeof options?.cooldownDuration === 'number' ? options?.cooldownDuration : 30000;
         this._cacheMaxAge = typeof options?.cacheMaxAge === 'number' ? options?.cacheMaxAge : 600000;
-        if (options?.[experimental_jwksCache] !== undefined) {
-            this._cache = options?.[experimental_jwksCache];
-            if (isFreshJwksCache(options?.[experimental_jwksCache], this._cacheMaxAge)) {
+        if (options?.[jwksCache] !== undefined) {
+            this._cache = options?.[jwksCache];
+            if (isFreshJwksCache(options?.[jwksCache], this._cacheMaxAge)) {
                 this._jwksTimestamp = this._cache.uat;
                 this._local = createLocalJWKSet(this._cache.jwks);
             }
@@ -136,3 +136,4 @@ export function createRemoteJWKSet(url, options) {
     });
     return remoteJWKSet;
 }
+export const experimental_jwksCache = jwksCache;

package/dist/browser/lib/private_symbols.js

@@ -0,0 +1 @@
+export const unprotected = Symbol();

package/dist/node/cjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.cryptoRuntime = exports.base64url = exports.generateSecret = exports.generateKeyPair = exports.errors = exports.decodeJwt = exports.decodeProtectedHeader = exports.importJWK = exports.importX509 = exports.importPKCS8 = exports.importSPKI = exports.exportJWK = exports.exportSPKI = exports.exportPKCS8 = exports.UnsecuredJWT = exports.experimental_jwksCache = exports.createRemoteJWKSet = exports.createLocalJWKSet = exports.EmbeddedJWK = exports.calculateJwkThumbprintUri = exports.calculateJwkThumbprint = exports.EncryptJWT = exports.SignJWT = exports.GeneralSign = exports.FlattenedSign = exports.CompactSign = exports.FlattenedEncrypt = exports.CompactEncrypt = exports.jwtDecrypt = exports.jwtVerify = exports.generalVerify = exports.flattenedVerify = exports.compactVerify = exports.GeneralEncrypt = exports.generalDecrypt = exports.flattenedDecrypt = exports.compactDecrypt = void 0;
+exports.cryptoRuntime = exports.base64url = exports.generateSecret = exports.generateKeyPair = exports.errors = exports.decodeJwt = exports.decodeProtectedHeader = exports.importJWK = exports.importX509 = exports.importPKCS8 = exports.importSPKI = exports.exportJWK = exports.exportSPKI = exports.exportPKCS8 = exports.UnsecuredJWT = exports.experimental_jwksCache = exports.jwksCache = exports.createRemoteJWKSet = exports.createLocalJWKSet = exports.EmbeddedJWK = exports.calculateJwkThumbprintUri = exports.calculateJwkThumbprint = exports.EncryptJWT = exports.SignJWT = exports.GeneralSign = exports.FlattenedSign = exports.CompactSign = exports.FlattenedEncrypt = exports.CompactEncrypt = exports.jwtDecrypt = exports.jwtVerify = exports.generalVerify = exports.flattenedVerify = exports.compactVerify = exports.GeneralEncrypt = exports.generalDecrypt = exports.flattenedDecrypt = exports.compactDecrypt = void 0;
 var decrypt_js_1 = require("./jwe/compact/decrypt.js");
 Object.defineProperty(exports, "compactDecrypt", { enumerable: true, get: function () { return decrypt_js_1.compactDecrypt; } });
 var decrypt_js_2 = require("./jwe/flattened/decrypt.js");
@@ -42,6 +42,7 @@ var local_js_1 = require("./jwks/local.js");
 Object.defineProperty(exports, "createLocalJWKSet", { enumerable: true, get: function () { return local_js_1.createLocalJWKSet; } });
 var remote_js_1 = require("./jwks/remote.js");
 Object.defineProperty(exports, "createRemoteJWKSet", { enumerable: true, get: function () { return remote_js_1.createRemoteJWKSet; } });
+Object.defineProperty(exports, "jwksCache", { enumerable: true, get: function () { return remote_js_1.jwksCache; } });
 Object.defineProperty(exports, "experimental_jwksCache", { enumerable: true, get: function () { return remote_js_1.experimental_jwksCache; } });
 var unsecured_js_1 = require("./jwt/unsecured.js");
 Object.defineProperty(exports, "UnsecuredJWT", { enumerable: true, get: function () { return unsecured_js_1.UnsecuredJWT; } });

package/dist/node/cjs/jwe/flattened/encrypt.js

@@ -1,14 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.FlattenedEncrypt = exports.unprotected = void 0;
+exports.FlattenedEncrypt = void 0;
 const base64url_js_1 = require("../../runtime/base64url.js");
+const private_symbols_js_1 = require("../../lib/private_symbols.js");
 const encrypt_js_1 = require("../../runtime/encrypt.js");
 const encrypt_key_management_js_1 = require("../../lib/encrypt_key_management.js");
 const errors_js_1 = require("../../util/errors.js");
 const is_disjoint_js_1 = require("../../lib/is_disjoint.js");
 const buffer_utils_js_1 = require("../../lib/buffer_utils.js");
 const validate_crit_js_1 = require("../../lib/validate_crit.js");
-exports.unprotected = Symbol();
 class FlattenedEncrypt {
     _plaintext;
     _protectedHeader;
@@ -102,7 +102,7 @@ class FlattenedEncrypt {
             let parameters;
             ({ cek, encryptedKey, parameters } = await (0, encrypt_key_management_js_1.default)(alg, enc, key, this._cek, this._keyManagementParameters));
             if (parameters) {
-                if (options && exports.unprotected in options) {
+                if (options && private_symbols_js_1.unprotected in options) {
                     if (!this._unprotectedHeader) {
                         this.setUnprotectedHeader(parameters);
                     }

package/dist/node/cjs/jwe/general/encrypt.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GeneralEncrypt = void 0;
 const encrypt_js_1 = require("../flattened/encrypt.js");
+const private_symbols_js_1 = require("../../lib/private_symbols.js");
 const errors_js_1 = require("../../util/errors.js");
 const cek_js_1 = require("../../lib/cek.js");
 const is_disjoint_js_1 = require("../../lib/is_disjoint.js");
@@ -156,7 +157,7 @@ class GeneralEncrypt {
                     .setKeyManagementParameters({ p2c })
                     .encrypt(recipient.key, {
                     ...recipient.options,
-                    [encrypt_js_1.unprotected]: true,
+                    [private_symbols_js_1.unprotected]: true,
                 });
                 jwe.ciphertext = flattened.ciphertext;
                 jwe.iv = flattened.iv;

package/dist/node/cjs/jwks/local.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createLocalJWKSet = exports.LocalJWKSet = void 0;
+exports.createLocalJWKSet = void 0;
 const import_js_1 = require("../key/import.js");
 const errors_js_1 = require("../util/errors.js");
 const is_object_js_1 = require("../lib/is_object.js");
@@ -99,7 +99,6 @@ class LocalJWKSet {
         return importWithAlgCache(this._cached, jwk, alg);
     }
 }
-exports.LocalJWKSet = LocalJWKSet;
 async function importWithAlgCache(cache, jwk, alg) {
     const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk);
     if (cached[alg] === undefined) {

package/dist/node/cjs/jwks/remote.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.createRemoteJWKSet = exports.experimental_jwksCache = void 0;
+exports.experimental_jwksCache = exports.createRemoteJWKSet = exports.jwksCache = void 0;
 const fetch_jwks_js_1 = require("../runtime/fetch_jwks.js");
 const errors_js_1 = require("../util/errors.js");
 const local_js_1 = require("./local.js");
@@ -13,10 +13,10 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.6.3';
+    const VERSION = 'v5.8.0';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
-exports.experimental_jwksCache = Symbol();
+exports.jwksCache = Symbol();
 function isFreshJwksCache(input, cacheMaxAge) {
     if (typeof input !== 'object' || input === null) {
         return false;
@@ -53,9 +53,9 @@ class RemoteJWKSet {
         this._cooldownDuration =
             typeof options?.cooldownDuration === 'number' ? options?.cooldownDuration : 30000;
         this._cacheMaxAge = typeof options?.cacheMaxAge === 'number' ? options?.cacheMaxAge : 600000;
-        if (options?.[exports.experimental_jwksCache] !== undefined) {
-            this._cache = options?.[exports.experimental_jwksCache];
-            if (isFreshJwksCache(options?.[exports.experimental_jwksCache], this._cacheMaxAge)) {
+        if (options?.[exports.jwksCache] !== undefined) {
+            this._cache = options?.[exports.jwksCache];
+            if (isFreshJwksCache(options?.[exports.jwksCache], this._cacheMaxAge)) {
                 this._jwksTimestamp = this._cache.uat;
                 this._local = (0, local_js_1.createLocalJWKSet)(this._cache.jwks);
             }
@@ -149,3 +149,4 @@ function createRemoteJWKSet(url, options) {
     return remoteJWKSet;
 }
 exports.createRemoteJWKSet = createRemoteJWKSet;
+exports.experimental_jwksCache = exports.jwksCache;

package/dist/node/cjs/lib/private_symbols.js

@@ -0,0 +1,4 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.unprotected = void 0;
+exports.unprotected = Symbol();

package/dist/node/esm/index.js

@@ -17,7 +17,7 @@ export { EncryptJWT } from './jwt/encrypt.js';
 export { calculateJwkThumbprint, calculateJwkThumbprintUri } from './jwk/thumbprint.js';
 export { EmbeddedJWK } from './jwk/embedded.js';
 export { createLocalJWKSet } from './jwks/local.js';
-export { createRemoteJWKSet, experimental_jwksCache } from './jwks/remote.js';
+export { createRemoteJWKSet, jwksCache, experimental_jwksCache } from './jwks/remote.js';
 export { UnsecuredJWT } from './jwt/unsecured.js';
 export { exportPKCS8, exportSPKI, exportJWK } from './key/export.js';
 export { importSPKI, importPKCS8, importX509, importJWK } from './key/import.js';

package/dist/node/esm/jwe/flattened/encrypt.js

@@ -1,11 +1,11 @@
 import { encode as base64url } from '../../runtime/base64url.js';
+import { unprotected } from '../../lib/private_symbols.js';
 import encrypt from '../../runtime/encrypt.js';
 import encryptKeyManagement from '../../lib/encrypt_key_management.js';
 import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
 import validateCrit from '../../lib/validate_crit.js';
-export const unprotected = Symbol();
 export class FlattenedEncrypt {
     _plaintext;
     _protectedHeader;

package/dist/node/esm/jwe/general/encrypt.js

@@ -1,4 +1,5 @@
-import { FlattenedEncrypt, unprotected } from '../flattened/encrypt.js';
+import { FlattenedEncrypt } from '../flattened/encrypt.js';
+import { unprotected } from '../../lib/private_symbols.js';
 import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
 import generateCek from '../../lib/cek.js';
 import isDisjoint from '../../lib/is_disjoint.js';

package/dist/node/esm/jwks/local.js

@@ -29,7 +29,7 @@ function clone(obj) {
     }
     return JSON.parse(JSON.stringify(obj));
 }
-export class LocalJWKSet {
+class LocalJWKSet {
     _jwks;
     _cached = new WeakMap();
     constructor(jwks) {

package/dist/node/esm/jwks/remote.js

@@ -10,10 +10,10 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.6.3';
+    const VERSION = 'v5.8.0';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
-export const experimental_jwksCache = Symbol();
+export const jwksCache = Symbol();
 function isFreshJwksCache(input, cacheMaxAge) {
     if (typeof input !== 'object' || input === null) {
         return false;
@@ -50,9 +50,9 @@ class RemoteJWKSet {
         this._cooldownDuration =
             typeof options?.cooldownDuration === 'number' ? options?.cooldownDuration : 30000;
         this._cacheMaxAge = typeof options?.cacheMaxAge === 'number' ? options?.cacheMaxAge : 600000;
-        if (options?.[experimental_jwksCache] !== undefined) {
-            this._cache = options?.[experimental_jwksCache];
-            if (isFreshJwksCache(options?.[experimental_jwksCache], this._cacheMaxAge)) {
+        if (options?.[jwksCache] !== undefined) {
+            this._cache = options?.[jwksCache];
+            if (isFreshJwksCache(options?.[jwksCache], this._cacheMaxAge)) {
                 this._jwksTimestamp = this._cache.uat;
                 this._local = createLocalJWKSet(this._cache.jwks);
             }
@@ -145,3 +145,4 @@ export function createRemoteJWKSet(url, options) {
     });
     return remoteJWKSet;
 }
+export const experimental_jwksCache = jwksCache;

package/dist/node/esm/lib/private_symbols.js

@@ -0,0 +1 @@
+export const unprotected = Symbol();

package/dist/types/index.d.ts

@@ -28,7 +28,7 @@ export { EncryptJWT } from './jwt/encrypt';
 export { calculateJwkThumbprint, calculateJwkThumbprintUri } from './jwk/thumbprint';
 export { EmbeddedJWK } from './jwk/embedded';
 export { createLocalJWKSet } from './jwks/local';
-export { createRemoteJWKSet, experimental_jwksCache } from './jwks/remote';
+export { createRemoteJWKSet, jwksCache, experimental_jwksCache } from './jwks/remote';
 export type { RemoteJWKSetOptions, JWKSCacheInput, ExportedJWKSCache } from './jwks/remote';
 export { UnsecuredJWT } from './jwt/unsecured';
 export type { UnsecuredResult } from './jwt/unsecured';

package/dist/types/jwe/compact/decrypt.d.ts

@@ -8,6 +8,9 @@ export interface CompactDecryptGetKey extends GetKeyFunction<CompactJWEHeaderPar
 /**
  * Decrypts a Compact JWE.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jwe/compact/decrypt'`.
+ *
  * @param jwe Compact JWE.
  * @param key Private Key or Secret to decrypt the JWE with. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.

package/dist/types/jwe/compact/encrypt.d.ts

@@ -2,6 +2,9 @@ import type { KeyLike, JWEKeyManagementHeaderParameters, CompactJWEHeaderParamet
 /**
  * The CompactEncrypt class is used to build and encrypt Compact JWE strings.
  *
+ * This class is exported (as a named export) from the main `'jose'` module entry point as well as
+ * from its subpath export `'jose/jwe/compact/encrypt'`.
+ *
  */
 export declare class CompactEncrypt {
     private _flattened;

package/dist/types/jwe/flattened/decrypt.d.ts

@@ -8,6 +8,9 @@ export interface FlattenedDecryptGetKey extends GetKeyFunction<JWEHeaderParamete
 /**
  * Decrypts a Flattened JWE.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jwe/flattened/decrypt'`.
+ *
  * @param jwe Flattened JWE.
  * @param key Private Key or Secret to decrypt the JWE with. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.

package/dist/types/jwe/flattened/encrypt.d.ts

@@ -1,9 +1,10 @@
 import type { KeyLike, FlattenedJWE, JWEHeaderParameters, JWEKeyManagementHeaderParameters, EncryptOptions } from '../../types';
-/** @private */
-export declare const unprotected: unique symbol;
 /**
  * The FlattenedEncrypt class is used to build and encrypt Flattened JWE objects.
  *
+ * This class is exported (as a named export) from the main `'jose'` module entry point as well as
+ * from its subpath export `'jose/jwe/flattened/encrypt'`.
+ *
  */
 export declare class FlattenedEncrypt {
     private _plaintext;

package/dist/types/jwe/general/decrypt.d.ts

@@ -8,6 +8,9 @@ export interface GeneralDecryptGetKey extends GetKeyFunction<JWEHeaderParameters
 /**
  * Decrypts a General JWE.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jwe/general/decrypt'`.
+ *
  * @param jwe General JWE.
  * @param key Private Key or Secret to decrypt the JWE with. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.

package/dist/types/jwe/general/encrypt.d.ts

@@ -16,6 +16,9 @@ export interface Recipient {
 /**
  * The GeneralEncrypt class is used to build and encrypt General JWE objects.
  *
+ * This class is exported (as a named export) from the main `'jose'` module entry point as well as
+ * from its subpath export `'jose/jwe/general/encrypt'`.
+ *
  */
 export declare class GeneralEncrypt {
     private _plaintext;

package/dist/types/jwk/embedded.d.ts

@@ -5,5 +5,8 @@ import type { KeyLike, FlattenedJWSInput, JWSHeaderParameters } from '../types';
  * token's "jwk" (JSON Web Key) Header Parameter. It is recommended to combine this with the verify
  * function's `algorithms` option to define accepted JWS "alg" (Algorithm) Header Parameter values.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jwk/embedded'`.
+ *
  */
 export declare function EmbeddedJWK<KeyLikeType extends KeyLike = KeyLike>(protectedHeader?: JWSHeaderParameters, token?: FlattenedJWSInput): Promise<KeyLikeType>;

package/dist/types/jwk/thumbprint.d.ts

@@ -2,6 +2,9 @@ import type { JWK } from '../types';
 /**
  * Calculates a base64url-encoded JSON Web Key (JWK) Thumbprint
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jwk/thumbprint'`.
+ *
  * @param jwk JSON Web Key.
  * @param digestAlgorithm Digest Algorithm to use for calculating the thumbprint. Default is
  *   "sha256".
@@ -12,6 +15,9 @@ export declare function calculateJwkThumbprint(jwk: JWK, digestAlgorithm?: 'sha2
 /**
  * Calculates a JSON Web Key (JWK) Thumbprint URI
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jwk/thumbprint'`.
+ *
  * @param jwk JSON Web Key.
  * @param digestAlgorithm Digest Algorithm to use for calculating the thumbprint. Default is
  *   "sha256".

package/dist/types/jwks/local.d.ts

@@ -1,11 +1,4 @@
 import type { KeyLike, JWSHeaderParameters, JSONWebKeySet, FlattenedJWSInput } from '../types';
-/** @private */
-export declare class LocalJWKSet<KeyLikeType extends KeyLike = KeyLike> {
-    private _jwks?;
-    private _cached;
-    constructor(jwks: unknown);
-    getKey(protectedHeader?: JWSHeaderParameters, token?: FlattenedJWSInput): Promise<KeyLikeType>;
-}
 /**
  * Returns a function that resolves a JWS JOSE Header to a public key object from a locally stored,
  * or otherwise available, JSON Web Key Set.
@@ -22,6 +15,9 @@ export declare class LocalJWKSet<KeyLikeType extends KeyLike = KeyLike> {
  * Note: The function's purpose is to resolve public keys used for verifying signatures and will not
  * work for public encryption keys.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jwks/local'`.
+ *
  * @param jwks JSON Web Key Set formatted object.
  */
 export declare function createLocalJWKSet<KeyLikeType extends KeyLike = KeyLike>(jwks: JSONWebKeySet): (protectedHeader?: JWSHeaderParameters, token?: FlattenedJWSInput) => Promise<KeyLikeType>;

package/dist/types/jwks/remote.d.ts

@@ -1,8 +1,5 @@
 import type { KeyLike, JWSHeaderParameters, FlattenedJWSInput, JSONWebKeySet } from '../types';
 /**
- * This is an experimental feature, it is not subject to semantic versioning rules. Non-backward
- * compatible changes or removal may occur in any future release.
- *
  * DANGER ZONE - This option has security implications that must be understood, assessed for
  * applicability, and accepted before use. It is critical that the JSON Web Key Set cache only be
  * writable by your own code.
@@ -25,7 +22,7 @@ import type { KeyLike, JWSHeaderParameters, FlattenedJWSInput, JSONWebKeySet } f
  *   previously cached object from a low-latency key-value store offered by the cloud computing
  *   runtime it is executed on;
  * - Default to an empty object `{}` instead when there's no previously cached value;
- * - Pass it in as {@link RemoteJWKSetOptions[experimental_jwksCache]};
+ * - Pass it in as {@link RemoteJWKSetOptions[jwksCache]};
  * - Afterwards, update the key-value storage if the {@link ExportedJWKSCache.uat `uat`} property of
  *   the object has changed.
  *
@@ -40,7 +37,7 @@ import type { KeyLike, JWSHeaderParameters, FlattenedJWSInput, JSONWebKeySet } f
  * const { uat } = jwksCache
  *
  * const JWKS = jose.createRemoteJWKSet(url, {
- *   [jose.experimental_jwksCache]: jwksCache,
+ *   [jose.jwksCache]: jwksCache,
  * })
  *
  * // Use JSON Web Key Set cache
@@ -52,7 +49,7 @@ import type { KeyLike, JWSHeaderParameters, FlattenedJWSInput, JSONWebKeySet } f
  * }
  * ```
  */
-export declare const experimental_jwksCache: unique symbol;
+export declare const jwksCache: unique symbol;
 /** Options for the remote JSON Web Key Set. */
 export interface RemoteJWKSetOptions {
     /**
@@ -85,8 +82,8 @@ export interface RemoteJWKSetOptions {
      * configuration would cause an unnecessary CORS preflight request.
      */
     headers?: Record<string, string>;
-    /** See {@link experimental_jwksCache}. */
-    [experimental_jwksCache]?: JWKSCacheInput;
+    /** See {@link jwksCache}. */
+    [jwksCache]?: JWKSCacheInput;
 }
 export interface ExportedJWKSCache {
     jwks: JSONWebKeySet;
@@ -111,6 +108,9 @@ export type JWKSCacheInput = ExportedJWKSCache | Record<string, never>;
  * Note: The function's purpose is to resolve public keys used for verifying signatures and will not
  * work for public encryption keys.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jwks/remote'`.
+ *
  * @param url URL to fetch the JSON Web Key Set from.
  * @param options Options for the remote JSON Web Key Set.
  */
@@ -127,3 +127,9 @@ export declare function createRemoteJWKSet<KeyLikeType extends KeyLike = KeyLike
     /** @ignore */
     jwks: () => JSONWebKeySet | undefined;
 };
+/**
+ * @ignore
+ *
+ * @deprecated Use {@link jwksCache}.
+ */
+export declare const experimental_jwksCache: symbol;

package/dist/types/jws/compact/sign.d.ts

@@ -2,6 +2,9 @@ import type { CompactJWSHeaderParameters, KeyLike, SignOptions } from '../../typ
 /**
  * The CompactSign class is used to build and sign Compact JWS strings.
  *
+ * This class is exported (as a named export) from the main `'jose'` module entry point as well as
+ * from its subpath export `'jose/jws/compact/sign'`.
+ *
  */
 export declare class CompactSign {
     private _flattened;

package/dist/types/jws/compact/verify.d.ts

@@ -10,6 +10,9 @@ export interface CompactVerifyGetKey extends GetKeyFunction<CompactJWSHeaderPara
 /**
  * Verifies the signature and format of and afterwards decodes the Compact JWS.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jws/compact/verify'`.
+ *
  * @param jws Compact JWS.
  * @param key Key to verify the JWS with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.

package/dist/types/jws/flattened/sign.d.ts

@@ -2,6 +2,9 @@ import type { KeyLike, FlattenedJWS, JWSHeaderParameters, SignOptions } from '..
 /**
  * The FlattenedSign class is used to build and sign Flattened JWS objects.
  *
+ * This class is exported (as a named export) from the main `'jose'` module entry point as well as
+ * from its subpath export `'jose/jws/flattened/sign'`.
+ *
  */
 export declare class FlattenedSign {
     private _payload;

package/dist/types/jws/flattened/verify.d.ts

@@ -10,6 +10,9 @@ export interface FlattenedVerifyGetKey extends GetKeyFunction<JWSHeaderParameter
 /**
  * Verifies the signature and format of and afterwards decodes the Flattened JWS.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jws/flattened/verify'`.
+ *
  * @param jws Flattened JWS.
  * @param key Key to verify the JWS with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.

package/dist/types/jws/general/sign.d.ts

@@ -22,6 +22,9 @@ export interface Signature {
 /**
  * The GeneralSign class is used to build and sign General JWS objects.
  *
+ * This class is exported (as a named export) from the main `'jose'` module entry point as well as
+ * from its subpath export `'jose/jws/general/sign'`.
+ *
  */
 export declare class GeneralSign {
     private _payload;

package/dist/types/jws/general/verify.d.ts

@@ -10,6 +10,9 @@ export interface GeneralVerifyGetKey extends GetKeyFunction<JWSHeaderParameters,
 /**
  * Verifies the signature and format of and afterwards decodes the General JWS.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jws/general/verify'`.
+ *
  * @param jws General JWS.
  * @param key Key to verify the JWS with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.

package/dist/types/jwt/decrypt.d.ts

@@ -12,6 +12,9 @@ export interface JWTDecryptGetKey extends GetKeyFunction<CompactJWEHeaderParamet
  * Verifies the JWT format (to be a JWE Compact format), decrypts the ciphertext, validates the JWT
  * Claims Set.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jwt/decrypt'`.
+ *
  * @param jwt JSON Web Token value (encoded as JWE).
  * @param key Private Key or Secret to decrypt and verify the JWT with. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.

package/dist/types/jwt/encrypt.d.ts

@@ -3,6 +3,9 @@ import { ProduceJWT } from './produce';
 /**
  * The EncryptJWT class is used to build and encrypt Compact JWE formatted JSON Web Tokens.
  *
+ * This class is exported (as a named export) from the main `'jose'` module entry point as well as
+ * from its subpath export `'jose/jwt/encrypt'`.
+ *
  */
 export declare class EncryptJWT extends ProduceJWT {
     private _cek;

package/dist/types/jwt/sign.d.ts

@@ -3,6 +3,9 @@ import { ProduceJWT } from './produce';
 /**
  * The SignJWT class is used to build and sign Compact JWS formatted JSON Web Tokens.
  *
+ * This class is exported (as a named export) from the main `'jose'` module entry point as well as
+ * from its subpath export `'jose/jwt/sign'`.
+ *
  */
 export declare class SignJWT extends ProduceJWT {
     private _protectedHeader;

package/dist/types/jwt/unsecured.d.ts

@@ -7,6 +7,9 @@ export interface UnsecuredResult<PayloadType = JWTPayload> {
 /**
  * The UnsecuredJWT class is a utility for dealing with `{ "alg": "none" }` Unsecured JWTs.
  *
+ * This class is exported (as a named export) from the main `'jose'` module entry point as well as
+ * from its subpath export `'jose/jwt/unsecured'`.
+ *
  */
 export declare class UnsecuredJWT extends ProduceJWT {
     /** Encodes the Unsecured JWT. */

package/dist/types/jwt/verify.d.ts

@@ -14,6 +14,9 @@ export interface JWTVerifyGetKey extends GetKeyFunction<JWTHeaderParameters, Fla
  * Verifies the JWT format (to be a JWS Compact format), verifies the JWS signature, validates the
  * JWT Claims Set.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jwt/verify'`.
+ *
  * @param jwt JSON Web Token value (encoded as JWS).
  * @param key Key to verify the JWT with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.

package/dist/types/key/export.d.ts

@@ -3,6 +3,9 @@ import type { JWK, KeyLike } from '../types';
  * Exports a runtime-specific public key representation (KeyObject or CryptoKey) to a PEM-encoded
  * SPKI string format.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/key/export'`.
+ *
  * @param key Key representation to transform to a PEM-encoded SPKI string format.
  */
 export declare function exportSPKI(key: KeyLike): Promise<string>;
@@ -10,12 +13,18 @@ export declare function exportSPKI(key: KeyLike): Promise<string>;
  * Exports a runtime-specific private key representation (KeyObject or CryptoKey) to a PEM-encoded
  * PKCS8 string format.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/key/export'`.
+ *
  * @param key Key representation to transform to a PEM-encoded PKCS8 string format.
  */
 export declare function exportPKCS8(key: KeyLike): Promise<string>;
 /**
  * Exports a runtime-specific key representation (KeyLike) to a JWK.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/key/export'`.
+ *
  * @param key Key representation to export as JWK.
  */
 export declare function exportJWK(key: KeyLike | Uint8Array): Promise<JWK>;

package/dist/types/key/generate_key_pair.d.ts

@@ -32,6 +32,9 @@ export interface GenerateKeyPairOptions {
  * `false` by default. See {@link GenerateKeyPairOptions.extractable} to generate an extractable
  * `privateKey`.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/generate/keypair'`.
+ *
  * @param alg JWA Algorithm Identifier to be used with the generated key pair.
  * @param options Additional options passed down to the key pair generation.
  */

package/dist/types/key/generate_secret.d.ts

@@ -13,6 +13,9 @@ export interface GenerateSecretOptions {
  * Note: Under Web Crypto API runtime the secret key is generated with `extractable` set to `false`
  * by default.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/generate/secret'`.
+ *
  * @param alg JWA Algorithm Identifier to be used with the generated secret.
  * @param options Additional options passed down to the secret generation.
  */

package/dist/types/key/import.d.ts

@@ -15,6 +15,9 @@ export interface PEMImportOptions {
  * {@link https://w3c.github.io/webcrypto/ Web Cryptography API}, use the OID rsaEncryption
  * (1.2.840.113549.1.1.1) instead for all RSA algorithms.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/key/import'`.
+ *
  * @param spki PEM-encoded SPKI string
  * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used
  *   with the imported key, its presence is only enforced in Web Crypto API runtimes. See
@@ -29,6 +32,9 @@ export declare function importSPKI<KeyLikeType extends KeyLike = KeyLike>(spki:
  * {@link https://w3c.github.io/webcrypto/ Web Cryptography API}, use the OID rsaEncryption
  * (1.2.840.113549.1.1.1) instead for all RSA algorithms.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/key/import'`.
+ *
  * @param x509 X.509 certificate string
  * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used
  *   with the imported key, its presence is only enforced in Web Crypto API runtimes. See
@@ -43,6 +49,9 @@ export declare function importX509<KeyLikeType extends KeyLike = KeyLike>(x509:
  * {@link https://w3c.github.io/webcrypto/ Web Cryptography API}, use the OID rsaEncryption
  * (1.2.840.113549.1.1.1) instead for all RSA algorithms.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/key/import'`.
+ *
  * @param pkcs8 PEM-encoded PKCS#8 string
  * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used
  *   with the imported key, its presence is only enforced in Web Crypto API runtimes. See
@@ -56,6 +65,9 @@ export declare function importPKCS8<KeyLikeType extends KeyLike = KeyLike>(pkcs8
  * Note: When the runtime is using {@link https://w3c.github.io/webcrypto/ Web Cryptography API} the
  * jwk parameters "use", "key_ops", and "ext" are also used in the resulting `CryptoKey`.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/key/import'`.
+ *
  * @param jwk JSON Web Key.
  * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used
  *   with the imported key. Default is the "alg" property on the JWK, its presence is only enforced

package/dist/types/types.d.ts

@@ -370,7 +370,11 @@ export interface EncryptOptions extends CritOption {}
 
 /** JWT Claims Set verification options. */
 export interface JWTClaimVerificationOptions {
-  /** Expected JWT "aud" (Audience) Claim value(s). */
+  /**
+   * Expected JWT "aud" (Audience) Claim value(s).
+   *
+   * This option makes the JWT "aud" (Audience) Claim presence required.
+   */
   audience?: string | string[]
 
   /**
@@ -381,7 +385,11 @@ export interface JWTClaimVerificationOptions {
    */
   clockTolerance?: string | number
 
-  /** Expected JWT "iss" (Issuer) Claim value(s). */
+  /**
+   * Expected JWT "iss" (Issuer) Claim value(s).
+   *
+   * This option makes the JWT "iss" (Issuer) Claim presence required.
+   */
   issuer?: string | string[]
 
   /**
@@ -389,13 +397,23 @@ export interface JWTClaimVerificationOptions {
    *
    * - In seconds when number (e.g. 5)
    * - Parsed as seconds when a string (e.g. "5 seconds", "10 minutes", "2 hours").
+   *
+   * This option makes the JWT "iat" (Issued At) Claim presence required.
    */
   maxTokenAge?: string | number
 
-  /** Expected JWT "sub" (Subject) Claim value. */
+  /**
+   * Expected JWT "sub" (Subject) Claim value.
+   *
+   * This option makes the JWT "sub" (Subject) Claim presence required.
+   */
   subject?: string
 
-  /** Expected JWT "typ" (Type) Header Parameter value. */
+  /**
+   * Expected JWT "typ" (Type) Header Parameter value.
+   *
+   * This option makes the JWT "typ" (Type) Header Parameter presence required.
+   */
   typ?: string
 
   /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
@@ -403,11 +421,13 @@ export interface JWTClaimVerificationOptions {
 
   /**
    * Array of required Claim Names that must be present in the JWT Claims Set. Default is that: if
-   * the {@link JWTClaimVerificationOptions.issuer issuer option} is set, then "iss" must be present;
-   * if the {@link JWTClaimVerificationOptions.audience audience option} is set, then "aud" must be
-   * present; if the {@link JWTClaimVerificationOptions.subject subject option} is set, then "sub"
-   * must be present; if the {@link JWTClaimVerificationOptions.maxTokenAge maxTokenAge option} is
-   * set, then "iat" must be present.
+   * the {@link JWTClaimVerificationOptions.issuer `issuer` option} is set, then JWT "iss" (Issuer)
+   * Claim must be present; if the {@link JWTClaimVerificationOptions.audience `audience` option} is
+   * set, then JWT "aud" (Audience) Claim must be present; if the
+   * {@link JWTClaimVerificationOptions.subject `subject` option} is set, then JWT "sub" (Subject)
+   * Claim must be present; if the
+   * {@link JWTClaimVerificationOptions.maxTokenAge `maxTokenAge` option} is set, then JWT "iat"
+   * (Issued At) Claim must be present.
    */
   requiredClaims?: string[]
 }
@@ -416,8 +436,9 @@ export interface JWTClaimVerificationOptions {
 export interface VerifyOptions extends CritOption {
   /**
    * A list of accepted JWS "alg" (Algorithm) Header Parameter values. By default all "alg"
-   * (Algorithm) values applicable for the used key/secret are allowed. Note: "none" is never
-   * accepted.
+   * (Algorithm) values applicable for the used key/secret are allowed.
+   *
+   * Note: Unsecured JWTs (`{ "alg": "none" }`) are never accepted by this API.
    */
   algorithms?: string[]
 }

package/dist/types/util/decode_jwt.d.ts

@@ -5,6 +5,9 @@ import type { JWTPayload } from '../types';
  * and JWS signature verification use `jose.jwtVerify()`. For an encrypted JWT Claims Set validation
  * and JWE decryption use `jose.jwtDecrypt()`.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jwt/decode'`.
+ *
  * @param jwt JWT token in compact JWS serialization.
  */
 export declare function decodeJwt<PayloadType = JWTPayload>(jwt: string): PayloadType & JWTPayload;

package/dist/types/util/decode_protected_header.d.ts

@@ -3,6 +3,9 @@ export type ProtectedHeaderParameters = JWSHeaderParameters & JWEHeaderParameter
 /**
  * Decodes the Protected Header of a JWE/JWS/JWT token utilizing any JOSE serialization.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/decode/protected_header'`.
+ *
  * @param token JWE/JWS/JWT token in any JOSE serialization.
  */
 export declare function decodeProtectedHeader(token: string | object): ProtectedHeaderParameters;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "5.6.3",
+  "version": "5.8.0",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "browser",
@@ -70,6 +70,276 @@
       "import": "./dist/node/esm/index.js",
       "require": "./dist/node/cjs/index.js"
     },
+    "./jwk/embedded": {
+      "types": "./dist/types/jwk/embedded.d.ts",
+      "bun": "./dist/browser/jwk/embedded.js",
+      "deno": "./dist/browser/jwk/embedded.js",
+      "browser": "./dist/browser/jwk/embedded.js",
+      "worker": "./dist/browser/jwk/embedded.js",
+      "workerd": "./dist/browser/jwk/embedded.js",
+      "import": "./dist/node/esm/jwk/embedded.js",
+      "require": "./dist/node/cjs/jwk/embedded.js"
+    },
+    "./jwk/thumbprint": {
+      "types": "./dist/types/jwk/thumbprint.d.ts",
+      "bun": "./dist/browser/jwk/thumbprint.js",
+      "deno": "./dist/browser/jwk/thumbprint.js",
+      "browser": "./dist/browser/jwk/thumbprint.js",
+      "worker": "./dist/browser/jwk/thumbprint.js",
+      "workerd": "./dist/browser/jwk/thumbprint.js",
+      "import": "./dist/node/esm/jwk/thumbprint.js",
+      "require": "./dist/node/cjs/jwk/thumbprint.js"
+    },
+    "./key/import": {
+      "types": "./dist/types/key/import.d.ts",
+      "bun": "./dist/browser/key/import.js",
+      "deno": "./dist/browser/key/import.js",
+      "browser": "./dist/browser/key/import.js",
+      "worker": "./dist/browser/key/import.js",
+      "workerd": "./dist/browser/key/import.js",
+      "import": "./dist/node/esm/key/import.js",
+      "require": "./dist/node/cjs/key/import.js"
+    },
+    "./key/export": {
+      "types": "./dist/types/key/export.d.ts",
+      "bun": "./dist/browser/key/export.js",
+      "deno": "./dist/browser/key/export.js",
+      "browser": "./dist/browser/key/export.js",
+      "worker": "./dist/browser/key/export.js",
+      "workerd": "./dist/browser/key/export.js",
+      "import": "./dist/node/esm/key/export.js",
+      "require": "./dist/node/cjs/key/export.js"
+    },
+    "./key/generate/keypair": {
+      "types": "./dist/types/key/generate_key_pair.d.ts",
+      "bun": "./dist/browser/key/generate_key_pair.js",
+      "deno": "./dist/browser/key/generate_key_pair.js",
+      "browser": "./dist/browser/key/generate_key_pair.js",
+      "worker": "./dist/browser/key/generate_key_pair.js",
+      "workerd": "./dist/browser/key/generate_key_pair.js",
+      "import": "./dist/node/esm/key/generate_key_pair.js",
+      "require": "./dist/node/cjs/key/generate_key_pair.js"
+    },
+    "./key/generate/secret": {
+      "types": "./dist/types/key/generate_secret.d.ts",
+      "bun": "./dist/browser/key/generate_secret.js",
+      "deno": "./dist/browser/key/generate_secret.js",
+      "browser": "./dist/browser/key/generate_secret.js",
+      "worker": "./dist/browser/key/generate_secret.js",
+      "workerd": "./dist/browser/key/generate_secret.js",
+      "import": "./dist/node/esm/key/generate_secret.js",
+      "require": "./dist/node/cjs/key/generate_secret.js"
+    },
+    "./jwks/remote": {
+      "types": "./dist/types/jwks/remote.d.ts",
+      "bun": "./dist/browser/jwks/remote.js",
+      "deno": "./dist/browser/jwks/remote.js",
+      "browser": "./dist/browser/jwks/remote.js",
+      "worker": "./dist/browser/jwks/remote.js",
+      "workerd": "./dist/browser/jwks/remote.js",
+      "import": "./dist/node/esm/jwks/remote.js",
+      "require": "./dist/node/cjs/jwks/remote.js"
+    },
+    "./jwks/local": {
+      "types": "./dist/types/jwks/local.d.ts",
+      "bun": "./dist/browser/jwks/local.js",
+      "deno": "./dist/browser/jwks/local.js",
+      "browser": "./dist/browser/jwks/local.js",
+      "worker": "./dist/browser/jwks/local.js",
+      "workerd": "./dist/browser/jwks/local.js",
+      "import": "./dist/node/esm/jwks/local.js",
+      "require": "./dist/node/cjs/jwks/local.js"
+    },
+    "./jwt/sign": {
+      "types": "./dist/types/jwt/sign.d.ts",
+      "bun": "./dist/browser/jwt/sign.js",
+      "deno": "./dist/browser/jwt/sign.js",
+      "browser": "./dist/browser/jwt/sign.js",
+      "worker": "./dist/browser/jwt/sign.js",
+      "workerd": "./dist/browser/jwt/sign.js",
+      "import": "./dist/node/esm/jwt/sign.js",
+      "require": "./dist/node/cjs/jwt/sign.js"
+    },
+    "./jwt/verify": {
+      "types": "./dist/types/jwt/verify.d.ts",
+      "bun": "./dist/browser/jwt/verify.js",
+      "deno": "./dist/browser/jwt/verify.js",
+      "browser": "./dist/browser/jwt/verify.js",
+      "worker": "./dist/browser/jwt/verify.js",
+      "workerd": "./dist/browser/jwt/verify.js",
+      "import": "./dist/node/esm/jwt/verify.js",
+      "require": "./dist/node/cjs/jwt/verify.js"
+    },
+    "./jwt/encrypt": {
+      "types": "./dist/types/jwt/encrypt.d.ts",
+      "bun": "./dist/browser/jwt/encrypt.js",
+      "deno": "./dist/browser/jwt/encrypt.js",
+      "browser": "./dist/browser/jwt/encrypt.js",
+      "worker": "./dist/browser/jwt/encrypt.js",
+      "workerd": "./dist/browser/jwt/encrypt.js",
+      "import": "./dist/node/esm/jwt/encrypt.js",
+      "require": "./dist/node/cjs/jwt/encrypt.js"
+    },
+    "./jwt/decrypt": {
+      "types": "./dist/types/jwt/decrypt.d.ts",
+      "bun": "./dist/browser/jwt/decrypt.js",
+      "deno": "./dist/browser/jwt/decrypt.js",
+      "browser": "./dist/browser/jwt/decrypt.js",
+      "worker": "./dist/browser/jwt/decrypt.js",
+      "workerd": "./dist/browser/jwt/decrypt.js",
+      "import": "./dist/node/esm/jwt/decrypt.js",
+      "require": "./dist/node/cjs/jwt/decrypt.js"
+    },
+    "./jwt/unsecured": {
+      "types": "./dist/types/jwt/unsecured.d.ts",
+      "bun": "./dist/browser/jwt/unsecured.js",
+      "deno": "./dist/browser/jwt/unsecured.js",
+      "browser": "./dist/browser/jwt/unsecured.js",
+      "worker": "./dist/browser/jwt/unsecured.js",
+      "workerd": "./dist/browser/jwt/unsecured.js",
+      "import": "./dist/node/esm/jwt/unsecured.js",
+      "require": "./dist/node/cjs/jwt/unsecured.js"
+    },
+    "./jwt/decode": {
+      "types": "./dist/types/util/decode_jwt.d.ts",
+      "bun": "./dist/browser/util/decode_jwt.js",
+      "deno": "./dist/browser/util/decode_jwt.js",
+      "browser": "./dist/browser/util/decode_jwt.js",
+      "worker": "./dist/browser/util/decode_jwt.js",
+      "workerd": "./dist/browser/util/decode_jwt.js",
+      "import": "./dist/node/esm/util/decode_jwt.js",
+      "require": "./dist/node/cjs/util/decode_jwt.js"
+    },
+    "./decode/protected_header": {
+      "types": "./dist/types/util/decode_protected_header.d.ts",
+      "bun": "./dist/browser/util/decode_protected_header.js",
+      "deno": "./dist/browser/util/decode_protected_header.js",
+      "browser": "./dist/browser/util/decode_protected_header.js",
+      "worker": "./dist/browser/util/decode_protected_header.js",
+      "workerd": "./dist/browser/util/decode_protected_header.js",
+      "import": "./dist/node/esm/util/decode_protected_header.js",
+      "require": "./dist/node/cjs/util/decode_protected_header.js"
+    },
+    "./jws/compact/sign": {
+      "types": "./dist/types/jws/compact/sign.d.ts",
+      "bun": "./dist/browser/jws/compact/sign.js",
+      "deno": "./dist/browser/jws/compact/sign.js",
+      "browser": "./dist/browser/jws/compact/sign.js",
+      "worker": "./dist/browser/jws/compact/sign.js",
+      "workerd": "./dist/browser/jws/compact/sign.js",
+      "import": "./dist/node/esm/jws/compact/sign.js",
+      "require": "./dist/node/cjs/jws/compact/sign.js"
+    },
+    "./jws/compact/verify": {
+      "types": "./dist/types/jws/compact/verify.d.ts",
+      "bun": "./dist/browser/jws/compact/verify.js",
+      "deno": "./dist/browser/jws/compact/verify.js",
+      "browser": "./dist/browser/jws/compact/verify.js",
+      "worker": "./dist/browser/jws/compact/verify.js",
+      "workerd": "./dist/browser/jws/compact/verify.js",
+      "import": "./dist/node/esm/jws/compact/verify.js",
+      "require": "./dist/node/cjs/jws/compact/verify.js"
+    },
+    "./jws/flattened/sign": {
+      "types": "./dist/types/jws/flattened/sign.d.ts",
+      "bun": "./dist/browser/jws/flattened/sign.js",
+      "deno": "./dist/browser/jws/flattened/sign.js",
+      "browser": "./dist/browser/jws/flattened/sign.js",
+      "worker": "./dist/browser/jws/flattened/sign.js",
+      "workerd": "./dist/browser/jws/flattened/sign.js",
+      "import": "./dist/node/esm/jws/flattened/sign.js",
+      "require": "./dist/node/cjs/jws/flattened/sign.js"
+    },
+    "./jws/flattened/verify": {
+      "types": "./dist/types/jws/flattened/verify.d.ts",
+      "bun": "./dist/browser/jws/flattened/verify.js",
+      "deno": "./dist/browser/jws/flattened/verify.js",
+      "browser": "./dist/browser/jws/flattened/verify.js",
+      "worker": "./dist/browser/jws/flattened/verify.js",
+      "workerd": "./dist/browser/jws/flattened/verify.js",
+      "import": "./dist/node/esm/jws/flattened/verify.js",
+      "require": "./dist/node/cjs/jws/flattened/verify.js"
+    },
+    "./jws/general/sign": {
+      "types": "./dist/types/jws/general/sign.d.ts",
+      "bun": "./dist/browser/jws/general/sign.js",
+      "deno": "./dist/browser/jws/general/sign.js",
+      "browser": "./dist/browser/jws/general/sign.js",
+      "worker": "./dist/browser/jws/general/sign.js",
+      "workerd": "./dist/browser/jws/general/sign.js",
+      "import": "./dist/node/esm/jws/general/sign.js",
+      "require": "./dist/node/cjs/jws/general/sign.js"
+    },
+    "./jws/general/verify": {
+      "types": "./dist/types/jws/general/verify.d.ts",
+      "bun": "./dist/browser/jws/general/verify.js",
+      "deno": "./dist/browser/jws/general/verify.js",
+      "browser": "./dist/browser/jws/general/verify.js",
+      "worker": "./dist/browser/jws/general/verify.js",
+      "workerd": "./dist/browser/jws/general/verify.js",
+      "import": "./dist/node/esm/jws/general/verify.js",
+      "require": "./dist/node/cjs/jws/general/verify.js"
+    },
+    "./jwe/compact/encrypt": {
+      "types": "./dist/types/jwe/compact/encrypt.d.ts",
+      "bun": "./dist/browser/jwe/compact/encrypt.js",
+      "deno": "./dist/browser/jwe/compact/encrypt.js",
+      "browser": "./dist/browser/jwe/compact/encrypt.js",
+      "worker": "./dist/browser/jwe/compact/encrypt.js",
+      "workerd": "./dist/browser/jwe/compact/encrypt.js",
+      "import": "./dist/node/esm/jwe/compact/encrypt.js",
+      "require": "./dist/node/cjs/jwe/compact/encrypt.js"
+    },
+    "./jwe/compact/decrypt": {
+      "types": "./dist/types/jwe/compact/decrypt.d.ts",
+      "bun": "./dist/browser/jwe/compact/decrypt.js",
+      "deno": "./dist/browser/jwe/compact/decrypt.js",
+      "browser": "./dist/browser/jwe/compact/decrypt.js",
+      "worker": "./dist/browser/jwe/compact/decrypt.js",
+      "workerd": "./dist/browser/jwe/compact/decrypt.js",
+      "import": "./dist/node/esm/jwe/compact/decrypt.js",
+      "require": "./dist/node/cjs/jwe/compact/decrypt.js"
+    },
+    "./jwe/flattened/encrypt": {
+      "types": "./dist/types/jwe/flattened/encrypt.d.ts",
+      "bun": "./dist/browser/jwe/flattened/encrypt.js",
+      "deno": "./dist/browser/jwe/flattened/encrypt.js",
+      "browser": "./dist/browser/jwe/flattened/encrypt.js",
+      "worker": "./dist/browser/jwe/flattened/encrypt.js",
+      "workerd": "./dist/browser/jwe/flattened/encrypt.js",
+      "import": "./dist/node/esm/jwe/flattened/encrypt.js",
+      "require": "./dist/node/cjs/jwe/flattened/encrypt.js"
+    },
+    "./jwe/flattened/decrypt": {
+      "types": "./dist/types/jwe/flattened/decrypt.d.ts",
+      "bun": "./dist/browser/jwe/flattened/decrypt.js",
+      "deno": "./dist/browser/jwe/flattened/decrypt.js",
+      "browser": "./dist/browser/jwe/flattened/decrypt.js",
+      "worker": "./dist/browser/jwe/flattened/decrypt.js",
+      "workerd": "./dist/browser/jwe/flattened/decrypt.js",
+      "import": "./dist/node/esm/jwe/flattened/decrypt.js",
+      "require": "./dist/node/cjs/jwe/flattened/decrypt.js"
+    },
+    "./jwe/general/encrypt": {
+      "types": "./dist/types/jwe/general/encrypt.d.ts",
+      "bun": "./dist/browser/jwe/general/encrypt.js",
+      "deno": "./dist/browser/jwe/general/encrypt.js",
+      "browser": "./dist/browser/jwe/general/encrypt.js",
+      "worker": "./dist/browser/jwe/general/encrypt.js",
+      "workerd": "./dist/browser/jwe/general/encrypt.js",
+      "import": "./dist/node/esm/jwe/general/encrypt.js",
+      "require": "./dist/node/cjs/jwe/general/encrypt.js"
+    },
+    "./jwe/general/decrypt": {
+      "types": "./dist/types/jwe/general/decrypt.d.ts",
+      "bun": "./dist/browser/jwe/general/decrypt.js",
+      "deno": "./dist/browser/jwe/general/decrypt.js",
+      "browser": "./dist/browser/jwe/general/decrypt.js",
+      "worker": "./dist/browser/jwe/general/decrypt.js",
+      "workerd": "./dist/browser/jwe/general/decrypt.js",
+      "import": "./dist/node/esm/jwe/general/decrypt.js",
+      "require": "./dist/node/cjs/jwe/general/decrypt.js"
+    },
     "./errors": {
       "types": "./dist/types/util/errors.d.ts",
       "bun": "./dist/browser/util/errors.js",