jose 5.7.0 → 5.9.0

package/dist/node/cjs/runtime/node_key.js

@@ -4,10 +4,6 @@ const node_crypto_1 = require("node:crypto");
 const get_named_curve_js_1 = require("./get_named_curve.js");
 const errors_js_1 = require("../util/errors.js");
 const check_key_length_js_1 = require("./check_key_length.js");
-const PSS = {
-    padding: node_crypto_1.constants.RSA_PKCS1_PSS_PADDING,
-    saltLength: node_crypto_1.constants.RSA_PSS_SALTLEN_DIGEST,
-};
 const ecCurveAlgMap = new Map([
     ['ES256', 'P-256'],
     ['ES256K', 'secp256k1'],
@@ -15,25 +11,57 @@ const ecCurveAlgMap = new Map([
     ['ES512', 'P-521'],
 ]);
 function keyForCrypto(alg, key) {
+    let asymmetricKeyType;
+    let asymmetricKeyDetails;
+    let isJWK;
+    if (key instanceof node_crypto_1.KeyObject) {
+        asymmetricKeyType = key.asymmetricKeyType;
+        asymmetricKeyDetails = key.asymmetricKeyDetails;
+    }
+    else {
+        isJWK = true;
+        switch (key.kty) {
+            case 'RSA':
+                asymmetricKeyType = 'rsa';
+                break;
+            case 'EC':
+                asymmetricKeyType = 'ec';
+                break;
+            case 'OKP': {
+                if (key.crv === 'Ed25519') {
+                    asymmetricKeyType = 'ed25519';
+                    break;
+                }
+                if (key.crv === 'Ed448') {
+                    asymmetricKeyType = 'ed448';
+                    break;
+                }
+                throw new TypeError('Invalid key for this operation, its crv must be Ed25519 or Ed448');
+            }
+            default:
+                throw new TypeError('Invalid key for this operation, its kty must be RSA, OKP, or EC');
+        }
+    }
+    let options;
     switch (alg) {
         case 'EdDSA':
-            if (!['ed25519', 'ed448'].includes(key.asymmetricKeyType)) {
+            if (!['ed25519', 'ed448'].includes(asymmetricKeyType)) {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be ed25519 or ed448');
             }
-            return key;
+            break;
         case 'RS256':
         case 'RS384':
         case 'RS512':
-            if (key.asymmetricKeyType !== 'rsa') {
+            if (asymmetricKeyType !== 'rsa') {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa');
             }
             (0, check_key_length_js_1.default)(key, alg);
-            return key;
+            break;
         case 'PS256':
         case 'PS384':
         case 'PS512':
-            if (key.asymmetricKeyType === 'rsa-pss') {
-                const { hashAlgorithm, mgf1HashAlgorithm, saltLength } = key.asymmetricKeyDetails;
+            if (asymmetricKeyType === 'rsa-pss') {
+                const { hashAlgorithm, mgf1HashAlgorithm, saltLength } = asymmetricKeyDetails;
                 const length = parseInt(alg.slice(-3), 10);
                 if (hashAlgorithm !== undefined &&
                     (hashAlgorithm !== `sha${length}` || mgf1HashAlgorithm !== hashAlgorithm)) {
@@ -43,16 +71,20 @@ function keyForCrypto(alg, key) {
                     throw new TypeError(`Invalid key for this operation, its RSA-PSS parameter saltLength does not meet the requirements of "alg" ${alg}`);
                 }
             }
-            else if (key.asymmetricKeyType !== 'rsa') {
+            else if (asymmetricKeyType !== 'rsa') {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa or rsa-pss');
             }
             (0, check_key_length_js_1.default)(key, alg);
-            return { key, ...PSS };
+            options = {
+                padding: node_crypto_1.constants.RSA_PKCS1_PSS_PADDING,
+                saltLength: node_crypto_1.constants.RSA_PSS_SALTLEN_DIGEST,
+            };
+            break;
         case 'ES256':
         case 'ES256K':
         case 'ES384':
         case 'ES512': {
-            if (key.asymmetricKeyType !== 'ec') {
+            if (asymmetricKeyType !== 'ec') {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be ec');
             }
             const actual = (0, get_named_curve_js_1.default)(key);
@@ -60,10 +92,15 @@ function keyForCrypto(alg, key) {
             if (actual !== expected) {
                 throw new TypeError(`Invalid key curve for the algorithm, its curve must be ${expected}, got ${actual}`);
             }
-            return { dsaEncoding: 'ieee-p1363', key };
+            options = { dsaEncoding: 'ieee-p1363' };
+            break;
         }
         default:
             throw new errors_js_1.JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
     }
+    if (isJWK) {
+        return { format: 'jwk', key, ...options };
+    }
+    return options ? { ...options, key } : key;
 }
 exports.default = keyForCrypto;

package/dist/node/cjs/runtime/sign.js

@@ -8,12 +8,12 @@ const node_key_js_1 = require("./node_key.js");
 const get_sign_verify_key_js_1 = require("./get_sign_verify_key.js");
 const oneShotSign = (0, node_util_1.promisify)(crypto.sign);
 const sign = async (alg, key, data) => {
-    const keyObject = (0, get_sign_verify_key_js_1.default)(alg, key, 'sign');
+    const k = (0, get_sign_verify_key_js_1.default)(alg, key, 'sign');
     if (alg.startsWith('HS')) {
-        const hmac = crypto.createHmac((0, hmac_digest_js_1.default)(alg), keyObject);
+        const hmac = crypto.createHmac((0, hmac_digest_js_1.default)(alg), k);
         hmac.update(data);
         return hmac.digest();
     }
-    return oneShotSign((0, dsa_digest_js_1.default)(alg), data, (0, node_key_js_1.default)(alg, keyObject));
+    return oneShotSign((0, dsa_digest_js_1.default)(alg), data, (0, node_key_js_1.default)(alg, k));
 };
 exports.default = sign;

package/dist/node/cjs/runtime/verify.js

@@ -8,9 +8,9 @@ const sign_js_1 = require("./sign.js");
 const get_sign_verify_key_js_1 = require("./get_sign_verify_key.js");
 const oneShotVerify = (0, node_util_1.promisify)(crypto.verify);
 const verify = async (alg, key, signature, data) => {
-    const keyObject = (0, get_sign_verify_key_js_1.default)(alg, key, 'verify');
+    const k = (0, get_sign_verify_key_js_1.default)(alg, key, 'verify');
     if (alg.startsWith('HS')) {
-        const expected = await (0, sign_js_1.default)(alg, keyObject, data);
+        const expected = await (0, sign_js_1.default)(alg, k, data);
         const actual = signature;
         try {
             return crypto.timingSafeEqual(actual, expected);
@@ -20,7 +20,7 @@ const verify = async (alg, key, signature, data) => {
         }
     }
     const algorithm = (0, dsa_digest_js_1.default)(alg);
-    const keyInput = (0, node_key_js_1.default)(alg, keyObject);
+    const keyInput = (0, node_key_js_1.default)(alg, k);
     try {
         return await oneShotVerify(algorithm, data, keyInput, signature);
     }

package/dist/node/esm/jwe/flattened/encrypt.js

@@ -1,11 +1,11 @@
 import { encode as base64url } from '../../runtime/base64url.js';
+import { unprotected } from '../../lib/private_symbols.js';
 import encrypt from '../../runtime/encrypt.js';
 import encryptKeyManagement from '../../lib/encrypt_key_management.js';
 import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
 import validateCrit from '../../lib/validate_crit.js';
-export const unprotected = Symbol();
 export class FlattenedEncrypt {
     _plaintext;
     _protectedHeader;

package/dist/node/esm/jwe/general/encrypt.js

@@ -1,4 +1,5 @@
-import { FlattenedEncrypt, unprotected } from '../flattened/encrypt.js';
+import { FlattenedEncrypt } from '../flattened/encrypt.js';
+import { unprotected } from '../../lib/private_symbols.js';
 import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
 import generateCek from '../../lib/cek.js';
 import isDisjoint from '../../lib/is_disjoint.js';

package/dist/node/esm/jwks/local.js

@@ -29,7 +29,7 @@ function clone(obj) {
     }
     return JSON.parse(JSON.stringify(obj));
 }
-export class LocalJWKSet {
+class LocalJWKSet {
     _jwks;
     _cached = new WeakMap();
     constructor(jwks) {

package/dist/node/esm/jwks/remote.js

@@ -10,7 +10,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.7.0';
+    const VERSION = 'v5.9.0';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const jwksCache = Symbol();

package/dist/node/esm/jws/flattened/sign.js

@@ -3,7 +3,7 @@ import sign from '../../runtime/sign.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import { JWSInvalid } from '../../util/errors.js';
 import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
-import checkKeyType from '../../lib/check_key_type.js';
+import { checkKeyTypeWithJwk } from '../../lib/check_key_type.js';
 import validateCrit from '../../lib/validate_crit.js';
 export class FlattenedSign {
     _payload;
@@ -52,7 +52,7 @@ export class FlattenedSign {
         if (typeof alg !== 'string' || !alg) {
             throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
         }
-        checkKeyType(alg, key, 'sign');
+        checkKeyTypeWithJwk(alg, key, 'sign');
         let payload = this._payload;
         if (b64) {
             payload = encoder.encode(base64url(payload));

package/dist/node/esm/jws/flattened/verify.js

@@ -4,9 +4,11 @@ import { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from '.
 import { concat, encoder, decoder } from '../../lib/buffer_utils.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import isObject from '../../lib/is_object.js';
-import checkKeyType from '../../lib/check_key_type.js';
+import { checkKeyTypeWithJwk } from '../../lib/check_key_type.js';
 import validateCrit from '../../lib/validate_crit.js';
 import validateAlgorithms from '../../lib/validate_algorithms.js';
+import { isJWK } from '../../lib/is_jwk.js';
+import { importJWK } from '../../key/import.js';
 export async function flattenedVerify(jws, key, options) {
     if (!isObject(jws)) {
         throw new JWSInvalid('Flattened JWS must be an object');
@@ -71,8 +73,14 @@ export async function flattenedVerify(jws, key, options) {
     if (typeof key === 'function') {
         key = await key(parsedProt, jws);
         resolvedKey = true;
+        checkKeyTypeWithJwk(alg, key, 'verify');
+        if (isJWK(key)) {
+            key = await importJWK(key, alg);
+        }
+    }
+    else {
+        checkKeyTypeWithJwk(alg, key, 'verify');
     }
-    checkKeyType(alg, key, 'verify');
     const data = concat(encoder.encode(jws.protected ?? ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);
     let signature;
     try {

package/dist/node/esm/lib/check_key_type.js

@@ -1,19 +1,49 @@
 import { withAlg as invalidKeyInput } from './invalid_key_input.js';
 import isKeyLike, { types } from '../runtime/is_key_like.js';
+import * as jwk from './is_jwk.js';
 const tag = (key) => key?.[Symbol.toStringTag];
-const symmetricTypeCheck = (alg, key) => {
+const jwkMatchesOp = (alg, key, usage) => {
+    if (key.use !== undefined && key.use !== 'sig') {
+        throw new TypeError('Invalid key for this operation, when present its use must be sig');
+    }
+    if (key.key_ops !== undefined && key.key_ops.includes?.(usage) !== true) {
+        throw new TypeError(`Invalid key for this operation, when present its key_ops must include ${usage}`);
+    }
+    if (key.alg !== undefined && key.alg !== alg) {
+        throw new TypeError(`Invalid key for this operation, when present its alg must be ${alg}`);
+    }
+    return true;
+};
+const symmetricTypeCheck = (alg, key, usage, allowJwk) => {
     if (key instanceof Uint8Array)
         return;
+    if (allowJwk && jwk.isJWK(key)) {
+        if (jwk.isSecretJWK(key) && jwkMatchesOp(alg, key, usage))
+            return;
+        throw new TypeError(`JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`);
+    }
     if (!isKeyLike(key)) {
-        throw new TypeError(invalidKeyInput(alg, key, ...types, 'Uint8Array'));
+        throw new TypeError(invalidKeyInput(alg, key, ...types, 'Uint8Array', allowJwk ? 'JSON Web Key' : null));
     }
     if (key.type !== 'secret') {
         throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
     }
 };
-const asymmetricTypeCheck = (alg, key, usage) => {
+const asymmetricTypeCheck = (alg, key, usage, allowJwk) => {
+    if (allowJwk && jwk.isJWK(key)) {
+        switch (usage) {
+            case 'sign':
+                if (jwk.isPrivateJWK(key) && jwkMatchesOp(alg, key, usage))
+                    return;
+                throw new TypeError(`JSON Web Key for this operation be a private JWK`);
+            case 'verify':
+                if (jwk.isPublicJWK(key) && jwkMatchesOp(alg, key, usage))
+                    return;
+                throw new TypeError(`JSON Web Key for this operation be a public JWK`);
+        }
+    }
     if (!isKeyLike(key)) {
-        throw new TypeError(invalidKeyInput(alg, key, ...types));
+        throw new TypeError(invalidKeyInput(alg, key, ...types, allowJwk ? 'JSON Web Key' : null));
     }
     if (key.type === 'secret') {
         throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
@@ -31,16 +61,17 @@ const asymmetricTypeCheck = (alg, key, usage) => {
         throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type "public"`);
     }
 };
-const checkKeyType = (alg, key, usage) => {
+function checkKeyType(allowJwk, alg, key, usage) {
     const symmetric = alg.startsWith('HS') ||
         alg === 'dir' ||
         alg.startsWith('PBES2') ||
         /^A\d{3}(?:GCM)?KW$/.test(alg);
     if (symmetric) {
-        symmetricTypeCheck(alg, key);
+        symmetricTypeCheck(alg, key, usage, allowJwk);
     }
     else {
-        asymmetricTypeCheck(alg, key, usage);
+        asymmetricTypeCheck(alg, key, usage, allowJwk);
     }
-};
-export default checkKeyType;
+}
+export default checkKeyType.bind(undefined, false);
+export const checkKeyTypeWithJwk = checkKeyType.bind(undefined, true);

package/dist/node/esm/lib/invalid_key_input.js

@@ -1,4 +1,5 @@
 function message(msg, actual, ...types) {
+    types = types.filter(Boolean);
     if (types.length > 2) {
         const last = types.pop();
         msg += `one of type ${types.join(', ')}, or ${last}.`;

package/dist/node/esm/lib/is_jwk.js

@@ -0,0 +1,13 @@
+import isObject from './is_object.js';
+export function isJWK(key) {
+    return isObject(key) && typeof key.kty === 'string';
+}
+export function isPrivateJWK(key) {
+    return key.kty !== 'oct' && typeof key.d === 'string';
+}
+export function isPublicJWK(key) {
+    return key.kty !== 'oct' && typeof key.d === 'undefined';
+}
+export function isSecretJWK(key) {
+    return isJWK(key) && key.kty === 'oct' && typeof key.k === 'string';
+}

package/dist/node/esm/lib/private_symbols.js

@@ -0,0 +1 @@
+export const unprotected = Symbol();

package/dist/node/esm/runtime/base64url.js

@@ -11,4 +11,4 @@ const encode = (input) => Buffer.from(input).toString('base64url');
 export const decodeBase64 = (input) => new Uint8Array(Buffer.from(input, 'base64'));
 export const encodeBase64 = (input) => Buffer.from(input).toString('base64');
 export { encode };
-export const decode = (input) => new Uint8Array(Buffer.from(normalize(input), 'base64'));
+export const decode = (input) => new Uint8Array(Buffer.from(normalize(input), 'base64url'));

package/dist/node/esm/runtime/check_key_length.js

@@ -1,5 +1,15 @@
+import { KeyObject } from 'node:crypto';
 export default (key, alg) => {
-    const { modulusLength } = key.asymmetricKeyDetails;
+    let modulusLength;
+    try {
+        if (key instanceof KeyObject) {
+            modulusLength = key.asymmetricKeyDetails?.modulusLength;
+        }
+        else {
+            modulusLength = Buffer.from(key.n, 'base64url').byteLength << 3;
+        }
+    }
+    catch { }
     if (typeof modulusLength !== 'number' || modulusLength < 2048) {
         throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
     }

package/dist/node/esm/runtime/get_named_curve.js

@@ -4,6 +4,7 @@ import { isCryptoKey } from './webcrypto.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
 import { types } from './is_key_like.js';
+import { isJWK } from '../lib/is_jwk.js';
 export const weakMap = new WeakMap();
 const namedCurveToJOSE = (namedCurve) => {
     switch (namedCurve) {
@@ -27,6 +28,9 @@ const getNamedCurve = (kee, raw) => {
     else if (isKeyObject(kee)) {
         key = kee;
     }
+    else if (isJWK(kee)) {
+        return kee.crv;
+    }
     else {
         throw new TypeError(invalidKeyInput(kee, ...types));
     }

package/dist/node/esm/runtime/get_sign_verify_key.js

@@ -3,6 +3,7 @@ import { isCryptoKey } from './webcrypto.js';
 import { checkSigCryptoKey } from '../lib/crypto_key.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
 import { types } from './is_key_like.js';
+import * as jwk from '../lib/is_jwk.js';
 export default function getSignVerifyKey(alg, key, usage) {
     if (key instanceof Uint8Array) {
         if (!alg.startsWith('HS')) {
@@ -17,5 +18,11 @@ export default function getSignVerifyKey(alg, key, usage) {
         checkSigCryptoKey(key, alg, usage);
         return KeyObject.from(key);
     }
-    throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
+    if (jwk.isJWK(key)) {
+        if (alg.startsWith('HS')) {
+            return createSecretKey(Buffer.from(key.k, 'base64url'));
+        }
+        return key;
+    }
+    throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array', 'JSON Web Key'));
 }

package/dist/node/esm/runtime/node_key.js

@@ -1,11 +1,7 @@
-import { constants } from 'node:crypto';
+import { constants, KeyObject } from 'node:crypto';
 import getNamedCurve from './get_named_curve.js';
 import { JOSENotSupported } from '../util/errors.js';
 import checkKeyLength from './check_key_length.js';
-const PSS = {
-    padding: constants.RSA_PKCS1_PSS_PADDING,
-    saltLength: constants.RSA_PSS_SALTLEN_DIGEST,
-};
 const ecCurveAlgMap = new Map([
     ['ES256', 'P-256'],
     ['ES256K', 'secp256k1'],
@@ -13,25 +9,57 @@ const ecCurveAlgMap = new Map([
     ['ES512', 'P-521'],
 ]);
 export default function keyForCrypto(alg, key) {
+    let asymmetricKeyType;
+    let asymmetricKeyDetails;
+    let isJWK;
+    if (key instanceof KeyObject) {
+        asymmetricKeyType = key.asymmetricKeyType;
+        asymmetricKeyDetails = key.asymmetricKeyDetails;
+    }
+    else {
+        isJWK = true;
+        switch (key.kty) {
+            case 'RSA':
+                asymmetricKeyType = 'rsa';
+                break;
+            case 'EC':
+                asymmetricKeyType = 'ec';
+                break;
+            case 'OKP': {
+                if (key.crv === 'Ed25519') {
+                    asymmetricKeyType = 'ed25519';
+                    break;
+                }
+                if (key.crv === 'Ed448') {
+                    asymmetricKeyType = 'ed448';
+                    break;
+                }
+                throw new TypeError('Invalid key for this operation, its crv must be Ed25519 or Ed448');
+            }
+            default:
+                throw new TypeError('Invalid key for this operation, its kty must be RSA, OKP, or EC');
+        }
+    }
+    let options;
     switch (alg) {
         case 'EdDSA':
-            if (!['ed25519', 'ed448'].includes(key.asymmetricKeyType)) {
+            if (!['ed25519', 'ed448'].includes(asymmetricKeyType)) {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be ed25519 or ed448');
             }
-            return key;
+            break;
         case 'RS256':
         case 'RS384':
         case 'RS512':
-            if (key.asymmetricKeyType !== 'rsa') {
+            if (asymmetricKeyType !== 'rsa') {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa');
             }
             checkKeyLength(key, alg);
-            return key;
+            break;
         case 'PS256':
         case 'PS384':
         case 'PS512':
-            if (key.asymmetricKeyType === 'rsa-pss') {
-                const { hashAlgorithm, mgf1HashAlgorithm, saltLength } = key.asymmetricKeyDetails;
+            if (asymmetricKeyType === 'rsa-pss') {
+                const { hashAlgorithm, mgf1HashAlgorithm, saltLength } = asymmetricKeyDetails;
                 const length = parseInt(alg.slice(-3), 10);
                 if (hashAlgorithm !== undefined &&
                     (hashAlgorithm !== `sha${length}` || mgf1HashAlgorithm !== hashAlgorithm)) {
@@ -41,16 +69,20 @@ export default function keyForCrypto(alg, key) {
                     throw new TypeError(`Invalid key for this operation, its RSA-PSS parameter saltLength does not meet the requirements of "alg" ${alg}`);
                 }
             }
-            else if (key.asymmetricKeyType !== 'rsa') {
+            else if (asymmetricKeyType !== 'rsa') {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa or rsa-pss');
             }
             checkKeyLength(key, alg);
-            return { key, ...PSS };
+            options = {
+                padding: constants.RSA_PKCS1_PSS_PADDING,
+                saltLength: constants.RSA_PSS_SALTLEN_DIGEST,
+            };
+            break;
         case 'ES256':
         case 'ES256K':
         case 'ES384':
         case 'ES512': {
-            if (key.asymmetricKeyType !== 'ec') {
+            if (asymmetricKeyType !== 'ec') {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be ec');
             }
             const actual = getNamedCurve(key);
@@ -58,9 +90,14 @@ export default function keyForCrypto(alg, key) {
             if (actual !== expected) {
                 throw new TypeError(`Invalid key curve for the algorithm, its curve must be ${expected}, got ${actual}`);
             }
-            return { dsaEncoding: 'ieee-p1363', key };
+            options = { dsaEncoding: 'ieee-p1363' };
+            break;
         }
         default:
             throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
     }
+    if (isJWK) {
+        return { format: 'jwk', key, ...options };
+    }
+    return options ? { ...options, key } : key;
 }

package/dist/node/esm/runtime/sign.js

@@ -6,12 +6,12 @@ import nodeKey from './node_key.js';
 import getSignKey from './get_sign_verify_key.js';
 const oneShotSign = promisify(crypto.sign);
 const sign = async (alg, key, data) => {
-    const keyObject = getSignKey(alg, key, 'sign');
+    const k = getSignKey(alg, key, 'sign');
     if (alg.startsWith('HS')) {
-        const hmac = crypto.createHmac(hmacDigest(alg), keyObject);
+        const hmac = crypto.createHmac(hmacDigest(alg), k);
         hmac.update(data);
         return hmac.digest();
     }
-    return oneShotSign(nodeDigest(alg), data, nodeKey(alg, keyObject));
+    return oneShotSign(nodeDigest(alg), data, nodeKey(alg, k));
 };
 export default sign;

package/dist/node/esm/runtime/verify.js

@@ -6,9 +6,9 @@ import sign from './sign.js';
 import getVerifyKey from './get_sign_verify_key.js';
 const oneShotVerify = promisify(crypto.verify);
 const verify = async (alg, key, signature, data) => {
-    const keyObject = getVerifyKey(alg, key, 'verify');
+    const k = getVerifyKey(alg, key, 'verify');
     if (alg.startsWith('HS')) {
-        const expected = await sign(alg, keyObject, data);
+        const expected = await sign(alg, k, data);
         const actual = signature;
         try {
             return crypto.timingSafeEqual(actual, expected);
@@ -18,7 +18,7 @@ const verify = async (alg, key, signature, data) => {
         }
     }
     const algorithm = nodeDigest(alg);
-    const keyInput = nodeKey(alg, keyObject);
+    const keyInput = nodeKey(alg, k);
     try {
         return await oneShotVerify(algorithm, data, keyInput, signature);
     }

package/dist/types/jwe/compact/decrypt.d.ts

@@ -8,6 +8,9 @@ export interface CompactDecryptGetKey extends GetKeyFunction<CompactJWEHeaderPar
 /**
  * Decrypts a Compact JWE.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jwe/compact/decrypt'`.
+ *
  * @param jwe Compact JWE.
  * @param key Private Key or Secret to decrypt the JWE with. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.

package/dist/types/jwe/compact/encrypt.d.ts

@@ -2,6 +2,9 @@ import type { KeyLike, JWEKeyManagementHeaderParameters, CompactJWEHeaderParamet
 /**
  * The CompactEncrypt class is used to build and encrypt Compact JWE strings.
  *
+ * This class is exported (as a named export) from the main `'jose'` module entry point as well as
+ * from its subpath export `'jose/jwe/compact/encrypt'`.
+ *
  */
 export declare class CompactEncrypt {
     private _flattened;

package/dist/types/jwe/flattened/decrypt.d.ts

@@ -8,6 +8,9 @@ export interface FlattenedDecryptGetKey extends GetKeyFunction<JWEHeaderParamete
 /**
  * Decrypts a Flattened JWE.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jwe/flattened/decrypt'`.
+ *
  * @param jwe Flattened JWE.
  * @param key Private Key or Secret to decrypt the JWE with. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.

package/dist/types/jwe/flattened/encrypt.d.ts

@@ -1,9 +1,10 @@
 import type { KeyLike, FlattenedJWE, JWEHeaderParameters, JWEKeyManagementHeaderParameters, EncryptOptions } from '../../types';
-/** @private */
-export declare const unprotected: unique symbol;
 /**
  * The FlattenedEncrypt class is used to build and encrypt Flattened JWE objects.
  *
+ * This class is exported (as a named export) from the main `'jose'` module entry point as well as
+ * from its subpath export `'jose/jwe/flattened/encrypt'`.
+ *
  */
 export declare class FlattenedEncrypt {
     private _plaintext;

package/dist/types/jwe/general/decrypt.d.ts

@@ -8,6 +8,9 @@ export interface GeneralDecryptGetKey extends GetKeyFunction<JWEHeaderParameters
 /**
  * Decrypts a General JWE.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jwe/general/decrypt'`.
+ *
  * @param jwe General JWE.
  * @param key Private Key or Secret to decrypt the JWE with. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.

package/dist/types/jwe/general/encrypt.d.ts

@@ -16,6 +16,9 @@ export interface Recipient {
 /**
  * The GeneralEncrypt class is used to build and encrypt General JWE objects.
  *
+ * This class is exported (as a named export) from the main `'jose'` module entry point as well as
+ * from its subpath export `'jose/jwe/general/encrypt'`.
+ *
  */
 export declare class GeneralEncrypt {
     private _plaintext;

package/dist/types/jwk/embedded.d.ts

@@ -5,5 +5,8 @@ import type { KeyLike, FlattenedJWSInput, JWSHeaderParameters } from '../types';
  * token's "jwk" (JSON Web Key) Header Parameter. It is recommended to combine this with the verify
  * function's `algorithms` option to define accepted JWS "alg" (Algorithm) Header Parameter values.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jwk/embedded'`.
+ *
  */
 export declare function EmbeddedJWK<KeyLikeType extends KeyLike = KeyLike>(protectedHeader?: JWSHeaderParameters, token?: FlattenedJWSInput): Promise<KeyLikeType>;