jose 5.7.0 → 5.9.0

package/dist/types/jwk/thumbprint.d.ts

@@ -2,6 +2,9 @@ import type { JWK } from '../types';
 /**
  * Calculates a base64url-encoded JSON Web Key (JWK) Thumbprint
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jwk/thumbprint'`.
+ *
  * @param jwk JSON Web Key.
  * @param digestAlgorithm Digest Algorithm to use for calculating the thumbprint. Default is
  *   "sha256".
@@ -12,6 +15,9 @@ export declare function calculateJwkThumbprint(jwk: JWK, digestAlgorithm?: 'sha2
 /**
  * Calculates a JSON Web Key (JWK) Thumbprint URI
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jwk/thumbprint'`.
+ *
  * @param jwk JSON Web Key.
  * @param digestAlgorithm Digest Algorithm to use for calculating the thumbprint. Default is
  *   "sha256".

package/dist/types/jwks/local.d.ts

@@ -1,11 +1,4 @@
 import type { KeyLike, JWSHeaderParameters, JSONWebKeySet, FlattenedJWSInput } from '../types';
-/** @private */
-export declare class LocalJWKSet<KeyLikeType extends KeyLike = KeyLike> {
-    private _jwks?;
-    private _cached;
-    constructor(jwks: unknown);
-    getKey(protectedHeader?: JWSHeaderParameters, token?: FlattenedJWSInput): Promise<KeyLikeType>;
-}
 /**
  * Returns a function that resolves a JWS JOSE Header to a public key object from a locally stored,
  * or otherwise available, JSON Web Key Set.
@@ -22,6 +15,9 @@ export declare class LocalJWKSet<KeyLikeType extends KeyLike = KeyLike> {
  * Note: The function's purpose is to resolve public keys used for verifying signatures and will not
  * work for public encryption keys.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jwks/local'`.
+ *
  * @param jwks JSON Web Key Set formatted object.
  */
 export declare function createLocalJWKSet<KeyLikeType extends KeyLike = KeyLike>(jwks: JSONWebKeySet): (protectedHeader?: JWSHeaderParameters, token?: FlattenedJWSInput) => Promise<KeyLikeType>;

package/dist/types/jwks/remote.d.ts

@@ -108,6 +108,9 @@ export type JWKSCacheInput = ExportedJWKSCache | Record<string, never>;
  * Note: The function's purpose is to resolve public keys used for verifying signatures and will not
  * work for public encryption keys.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jwks/remote'`.
+ *
  * @param url URL to fetch the JSON Web Key Set from.
  * @param options Options for the remote JSON Web Key Set.
  */

package/dist/types/jws/compact/sign.d.ts

@@ -1,7 +1,10 @@
-import type { CompactJWSHeaderParameters, KeyLike, SignOptions } from '../../types';
+import type { JWK, CompactJWSHeaderParameters, KeyLike, SignOptions } from '../../types';
 /**
  * The CompactSign class is used to build and sign Compact JWS strings.
  *
+ * This class is exported (as a named export) from the main `'jose'` module entry point as well as
+ * from its subpath export `'jose/jws/compact/sign'`.
+ *
  */
 export declare class CompactSign {
     private _flattened;
@@ -20,5 +23,5 @@ export declare class CompactSign {
      *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
      * @param options JWS Sign options.
      */
-    sign(key: KeyLike | Uint8Array, options?: SignOptions): Promise<string>;
+    sign(key: KeyLike | Uint8Array | JWK, options?: SignOptions): Promise<string>;
 }

package/dist/types/jws/compact/verify.d.ts

@@ -1,21 +1,24 @@
-import type { CompactVerifyResult, FlattenedJWSInput, GetKeyFunction, CompactJWSHeaderParameters, KeyLike, VerifyOptions, ResolvedKey } from '../../types';
+import type { JWK, CompactVerifyResult, FlattenedJWSInput, GenericGetKeyFunction, CompactJWSHeaderParameters, KeyLike, VerifyOptions, ResolvedKey } from '../../types';
 /**
  * Interface for Compact JWS Verification dynamic key resolution. No token components have been
  * verified at the time of this function call.
  *
  * @see [createRemoteJWKSet](../functions/jwks_remote.createRemoteJWKSet.md#function-createremotejwkset) to verify using a remote JSON Web Key Set.
  */
-export interface CompactVerifyGetKey extends GetKeyFunction<CompactJWSHeaderParameters, FlattenedJWSInput> {
+export interface CompactVerifyGetKey extends GenericGetKeyFunction<CompactJWSHeaderParameters, FlattenedJWSInput, KeyLike | JWK | Uint8Array> {
 }
 /**
  * Verifies the signature and format of and afterwards decodes the Compact JWS.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jws/compact/verify'`.
+ *
  * @param jws Compact JWS.
  * @param key Key to verify the JWS with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  * @param options JWS Verify options.
  */
-export declare function compactVerify(jws: string | Uint8Array, key: KeyLike | Uint8Array, options?: VerifyOptions): Promise<CompactVerifyResult>;
+export declare function compactVerify(jws: string | Uint8Array, key: KeyLike | Uint8Array | JWK, options?: VerifyOptions): Promise<CompactVerifyResult>;
 /**
  * @param jws Compact JWS.
  * @param getKey Function resolving a key to verify the JWS with. See

package/dist/types/jws/flattened/sign.d.ts

@@ -1,7 +1,10 @@
-import type { KeyLike, FlattenedJWS, JWSHeaderParameters, SignOptions } from '../../types';
+import type { JWK, KeyLike, FlattenedJWS, JWSHeaderParameters, SignOptions } from '../../types';
 /**
  * The FlattenedSign class is used to build and sign Flattened JWS objects.
  *
+ * This class is exported (as a named export) from the main `'jose'` module entry point as well as
+ * from its subpath export `'jose/jws/flattened/sign'`.
+ *
  */
 export declare class FlattenedSign {
     private _payload;
@@ -28,5 +31,5 @@ export declare class FlattenedSign {
      *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
      * @param options JWS Sign options.
      */
-    sign(key: KeyLike | Uint8Array, options?: SignOptions): Promise<FlattenedJWS>;
+    sign(key: KeyLike | Uint8Array | JWK, options?: SignOptions): Promise<FlattenedJWS>;
 }

package/dist/types/jws/flattened/verify.d.ts

@@ -1,21 +1,24 @@
-import type { FlattenedVerifyResult, KeyLike, FlattenedJWSInput, JWSHeaderParameters, VerifyOptions, GetKeyFunction, ResolvedKey } from '../../types';
+import type { JWK, FlattenedVerifyResult, KeyLike, FlattenedJWSInput, JWSHeaderParameters, VerifyOptions, GenericGetKeyFunction, ResolvedKey } from '../../types';
 /**
  * Interface for Flattened JWS Verification dynamic key resolution. No token components have been
  * verified at the time of this function call.
  *
  * @see [createRemoteJWKSet](../functions/jwks_remote.createRemoteJWKSet.md#function-createremotejwkset) to verify using a remote JSON Web Key Set.
  */
-export interface FlattenedVerifyGetKey extends GetKeyFunction<JWSHeaderParameters | undefined, FlattenedJWSInput> {
+export interface FlattenedVerifyGetKey extends GenericGetKeyFunction<JWSHeaderParameters | undefined, FlattenedJWSInput, KeyLike | JWK | Uint8Array> {
 }
 /**
  * Verifies the signature and format of and afterwards decodes the Flattened JWS.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jws/flattened/verify'`.
+ *
  * @param jws Flattened JWS.
  * @param key Key to verify the JWS with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  * @param options JWS Verify options.
  */
-export declare function flattenedVerify(jws: FlattenedJWSInput, key: KeyLike | Uint8Array, options?: VerifyOptions): Promise<FlattenedVerifyResult>;
+export declare function flattenedVerify(jws: FlattenedJWSInput, key: KeyLike | Uint8Array | JWK, options?: VerifyOptions): Promise<FlattenedVerifyResult>;
 /**
  * @param jws Flattened JWS.
  * @param getKey Function resolving a key to verify the JWS with. See

package/dist/types/jws/general/sign.d.ts

@@ -1,4 +1,4 @@
-import type { KeyLike, GeneralJWS, JWSHeaderParameters, SignOptions } from '../../types';
+import type { JWK, KeyLike, GeneralJWS, JWSHeaderParameters, SignOptions } from '../../types';
 export interface Signature {
     /**
      * Sets the JWS Protected Header on the Signature object.
@@ -22,6 +22,9 @@ export interface Signature {
 /**
  * The GeneralSign class is used to build and sign General JWS objects.
  *
+ * This class is exported (as a named export) from the main `'jose'` module entry point as well as
+ * from its subpath export `'jose/jws/general/sign'`.
+ *
  */
 export declare class GeneralSign {
     private _payload;
@@ -35,7 +38,7 @@ export declare class GeneralSign {
      *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
      * @param options JWS Sign options.
      */
-    addSignature(key: KeyLike | Uint8Array, options?: SignOptions): Signature;
+    addSignature(key: KeyLike | Uint8Array | JWK, options?: SignOptions): Signature;
     /** Signs and resolves the value of the General JWS object. */
     sign(): Promise<GeneralJWS>;
 }

package/dist/types/jws/general/verify.d.ts

@@ -1,21 +1,24 @@
-import type { GeneralJWSInput, GeneralVerifyResult, FlattenedJWSInput, GetKeyFunction, JWSHeaderParameters, KeyLike, VerifyOptions, ResolvedKey } from '../../types';
+import type { JWK, GeneralJWSInput, GeneralVerifyResult, FlattenedJWSInput, GenericGetKeyFunction, JWSHeaderParameters, KeyLike, VerifyOptions, ResolvedKey } from '../../types';
 /**
  * Interface for General JWS Verification dynamic key resolution. No token components have been
  * verified at the time of this function call.
  *
  * @see [createRemoteJWKSet](../functions/jwks_remote.createRemoteJWKSet.md#function-createremotejwkset) to verify using a remote JSON Web Key Set.
  */
-export interface GeneralVerifyGetKey extends GetKeyFunction<JWSHeaderParameters, FlattenedJWSInput> {
+export interface GeneralVerifyGetKey extends GenericGetKeyFunction<JWSHeaderParameters, FlattenedJWSInput, KeyLike | JWK | Uint8Array> {
 }
 /**
  * Verifies the signature and format of and afterwards decodes the General JWS.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jws/general/verify'`.
+ *
  * @param jws General JWS.
  * @param key Key to verify the JWS with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  * @param options JWS Verify options.
  */
-export declare function generalVerify(jws: GeneralJWSInput, key: KeyLike | Uint8Array, options?: VerifyOptions): Promise<GeneralVerifyResult>;
+export declare function generalVerify(jws: GeneralJWSInput, key: KeyLike | Uint8Array | JWK, options?: VerifyOptions): Promise<GeneralVerifyResult>;
 /**
  * @param jws General JWS.
  * @param getKey Function resolving a key to verify the JWS with. See

package/dist/types/jwt/decrypt.d.ts

@@ -12,6 +12,9 @@ export interface JWTDecryptGetKey extends GetKeyFunction<CompactJWEHeaderParamet
  * Verifies the JWT format (to be a JWE Compact format), decrypts the ciphertext, validates the JWT
  * Claims Set.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jwt/decrypt'`.
+ *
  * @param jwt JSON Web Token value (encoded as JWE).
  * @param key Private Key or Secret to decrypt and verify the JWT with. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.

package/dist/types/jwt/encrypt.d.ts

@@ -3,6 +3,9 @@ import { ProduceJWT } from './produce';
 /**
  * The EncryptJWT class is used to build and encrypt Compact JWE formatted JSON Web Tokens.
  *
+ * This class is exported (as a named export) from the main `'jose'` module entry point as well as
+ * from its subpath export `'jose/jwt/encrypt'`.
+ *
  */
 export declare class EncryptJWT extends ProduceJWT {
     private _cek;

package/dist/types/jwt/sign.d.ts

@@ -1,8 +1,11 @@
-import type { JWTHeaderParameters, KeyLike, SignOptions } from '../types';
+import type { JWK, JWTHeaderParameters, KeyLike, SignOptions } from '../types';
 import { ProduceJWT } from './produce';
 /**
  * The SignJWT class is used to build and sign Compact JWS formatted JSON Web Tokens.
  *
+ * This class is exported (as a named export) from the main `'jose'` module entry point as well as
+ * from its subpath export `'jose/jwt/sign'`.
+ *
  */
 export declare class SignJWT extends ProduceJWT {
     private _protectedHeader;
@@ -19,5 +22,5 @@ export declare class SignJWT extends ProduceJWT {
      *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
      * @param options JWT Sign options.
      */
-    sign(key: KeyLike | Uint8Array, options?: SignOptions): Promise<string>;
+    sign(key: KeyLike | Uint8Array | JWK, options?: SignOptions): Promise<string>;
 }

package/dist/types/jwt/unsecured.d.ts

@@ -7,6 +7,9 @@ export interface UnsecuredResult<PayloadType = JWTPayload> {
 /**
  * The UnsecuredJWT class is a utility for dealing with `{ "alg": "none" }` Unsecured JWTs.
  *
+ * This class is exported (as a named export) from the main `'jose'` module entry point as well as
+ * from its subpath export `'jose/jwt/unsecured'`.
+ *
  */
 export declare class UnsecuredJWT extends ProduceJWT {
     /** Encodes the Unsecured JWT. */

package/dist/types/jwt/verify.d.ts

@@ -1,4 +1,4 @@
-import type { JWTPayload, KeyLike, VerifyOptions, JWTClaimVerificationOptions, JWTHeaderParameters, GetKeyFunction, FlattenedJWSInput, JWTVerifyResult, ResolvedKey } from '../types';
+import type { JWK, JWTPayload, KeyLike, VerifyOptions, JWTClaimVerificationOptions, JWTHeaderParameters, GenericGetKeyFunction, FlattenedJWSInput, JWTVerifyResult, ResolvedKey } from '../types';
 /** Combination of JWS Verification options and JWT Claims Set verification options. */
 export interface JWTVerifyOptions extends VerifyOptions, JWTClaimVerificationOptions {
 }
@@ -8,18 +8,21 @@ export interface JWTVerifyOptions extends VerifyOptions, JWTClaimVerificationOpt
  *
  * @see [createRemoteJWKSet](../functions/jwks_remote.createRemoteJWKSet.md#function-createremotejwkset) to verify using a remote JSON Web Key Set.
  */
-export interface JWTVerifyGetKey extends GetKeyFunction<JWTHeaderParameters, FlattenedJWSInput> {
+export interface JWTVerifyGetKey extends GenericGetKeyFunction<JWTHeaderParameters, FlattenedJWSInput, KeyLike | JWK | Uint8Array> {
 }
 /**
  * Verifies the JWT format (to be a JWS Compact format), verifies the JWS signature, validates the
  * JWT Claims Set.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jwt/verify'`.
+ *
  * @param jwt JSON Web Token value (encoded as JWS).
  * @param key Key to verify the JWT with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  * @param options JWT Decryption and JWT Claims Set validation options.
  */
-export declare function jwtVerify<PayloadType = JWTPayload>(jwt: string | Uint8Array, key: KeyLike | Uint8Array, options?: JWTVerifyOptions): Promise<JWTVerifyResult<PayloadType>>;
+export declare function jwtVerify<PayloadType = JWTPayload>(jwt: string | Uint8Array, key: KeyLike | Uint8Array | JWK, options?: JWTVerifyOptions): Promise<JWTVerifyResult<PayloadType>>;
 /**
  * @param jwt JSON Web Token value (encoded as JWS).
  * @param getKey Function resolving a key to verify the JWT with. See

package/dist/types/key/export.d.ts

@@ -3,6 +3,9 @@ import type { JWK, KeyLike } from '../types';
  * Exports a runtime-specific public key representation (KeyObject or CryptoKey) to a PEM-encoded
  * SPKI string format.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/key/export'`.
+ *
  * @param key Key representation to transform to a PEM-encoded SPKI string format.
  */
 export declare function exportSPKI(key: KeyLike): Promise<string>;
@@ -10,12 +13,18 @@ export declare function exportSPKI(key: KeyLike): Promise<string>;
  * Exports a runtime-specific private key representation (KeyObject or CryptoKey) to a PEM-encoded
  * PKCS8 string format.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/key/export'`.
+ *
  * @param key Key representation to transform to a PEM-encoded PKCS8 string format.
  */
 export declare function exportPKCS8(key: KeyLike): Promise<string>;
 /**
  * Exports a runtime-specific key representation (KeyLike) to a JWK.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/key/export'`.
+ *
  * @param key Key representation to export as JWK.
  */
 export declare function exportJWK(key: KeyLike | Uint8Array): Promise<JWK>;

package/dist/types/key/generate_key_pair.d.ts

@@ -32,6 +32,9 @@ export interface GenerateKeyPairOptions {
  * `false` by default. See {@link GenerateKeyPairOptions.extractable} to generate an extractable
  * `privateKey`.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/generate/keypair'`.
+ *
  * @param alg JWA Algorithm Identifier to be used with the generated key pair.
  * @param options Additional options passed down to the key pair generation.
  */

package/dist/types/key/generate_secret.d.ts

@@ -13,6 +13,9 @@ export interface GenerateSecretOptions {
  * Note: Under Web Crypto API runtime the secret key is generated with `extractable` set to `false`
  * by default.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/generate/secret'`.
+ *
  * @param alg JWA Algorithm Identifier to be used with the generated secret.
  * @param options Additional options passed down to the secret generation.
  */

package/dist/types/key/import.d.ts

@@ -15,6 +15,9 @@ export interface PEMImportOptions {
  * {@link https://w3c.github.io/webcrypto/ Web Cryptography API}, use the OID rsaEncryption
  * (1.2.840.113549.1.1.1) instead for all RSA algorithms.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/key/import'`.
+ *
  * @param spki PEM-encoded SPKI string
  * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used
  *   with the imported key, its presence is only enforced in Web Crypto API runtimes. See
@@ -29,6 +32,9 @@ export declare function importSPKI<KeyLikeType extends KeyLike = KeyLike>(spki:
  * {@link https://w3c.github.io/webcrypto/ Web Cryptography API}, use the OID rsaEncryption
  * (1.2.840.113549.1.1.1) instead for all RSA algorithms.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/key/import'`.
+ *
  * @param x509 X.509 certificate string
  * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used
  *   with the imported key, its presence is only enforced in Web Crypto API runtimes. See
@@ -43,6 +49,9 @@ export declare function importX509<KeyLikeType extends KeyLike = KeyLike>(x509:
  * {@link https://w3c.github.io/webcrypto/ Web Cryptography API}, use the OID rsaEncryption
  * (1.2.840.113549.1.1.1) instead for all RSA algorithms.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/key/import'`.
+ *
  * @param pkcs8 PEM-encoded PKCS#8 string
  * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used
  *   with the imported key, its presence is only enforced in Web Crypto API runtimes. See
@@ -56,6 +65,9 @@ export declare function importPKCS8<KeyLikeType extends KeyLike = KeyLike>(pkcs8
  * Note: When the runtime is using {@link https://w3c.github.io/webcrypto/ Web Cryptography API} the
  * jwk parameters "use", "key_ops", and "ext" are also used in the resulting `CryptoKey`.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/key/import'`.
+ *
  * @param jwk JSON Web Key.
  * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used
  *   with the imported key. Default is the "alg" property on the JWK, its presence is only enforced

package/dist/types/types.d.ts

@@ -29,59 +29,153 @@
  */
 export type KeyLike = { type: string }
 
+/** Generic JSON Web Key Parameters. */
+export interface JWKParameters {
+  /** JWK "kty" (Key Type) Parameter. */
+  kty: string
+  /** JWK "alg" (Algorithm) Parameter. */
+  alg?: string
+  /** JWK "key_ops" (Key Operations) Parameter. */
+  key_ops?: string[]
+  /** JWK "ext" (Extractable) Parameter. */
+  ext?: boolean
+  /** JWK "use" (Public Key Use) Parameter. */
+  use?: string
+  /** JWK "x5c" (X.509 Certificate Chain) Parameter. */
+  x5c?: string[]
+  /** JWK "x5t" (X.509 Certificate SHA-1 Thumbprint) Parameter. */
+  x5t?: string
+  /** "x5t#S256" (X.509 Certificate SHA-256 Thumbprint) Parameter. */
+  'x5t#S256'?: string
+  /** JWK "x5u" (X.509 URL) Parameter. */
+  x5u?: string
+  /** JWK "kid" (Key ID) Parameter. */
+  kid?: string
+}
+
+/** Convenience interface for Public OKP JSON Web Keys */
+export interface JWK_OKP_Public extends JWKParameters {
+  /** The Subtype of Key Pair */
+  crv: string
+  /** The public key */
+  x: string
+}
+
+/** Convenience interface for Private OKP JSON Web Keys */
+export interface JWK_OKP_Private extends JWK_OKP_Public, JWKParameters {
+  /** The Private Key */
+  d: string
+}
+
+/** Convenience interface for Public EC JSON Web Keys */
+export interface JWK_EC_Public extends JWKParameters {
+  /** Curve */
+  crv: string
+  /** X Coordinate */
+  x: string
+  /** Y Coordinate */
+  y: string
+}
+
+/** Convenience interface for Private EC JSON Web Keys */
+export interface JWK_EC_Private extends JWK_EC_Public, JWKParameters {
+  /** ECC Private Key */
+  d: string
+}
+
+/** Convenience interface for Public RSA JSON Web Keys */
+export interface JWK_RSA_Public extends JWKParameters {
+  /** Exponent */
+  e: string
+  /** Modulus */
+  n: string
+}
+
+/** Convenience interface for Private RSA JSON Web Keys */
+export interface JWK_RSA_Private extends JWK_RSA_Public, JWKParameters {
+  /** Private Exponent */
+  d: string
+  /** First Factor CRT Exponent */
+  dp: string
+  /** Second Factor CRT Exponent */
+  dq: string
+  /** Other Primes Info. This parameter is not supported. */
+  oth?: Array<{
+    d?: string
+    r?: string
+    t?: string
+  }>
+  /** First Prime Factor */
+  p: string
+  /** Second Prime Factor */
+  q: string
+  /** First CRT Coefficient */
+  qi: string
+}
+
+/**
+ * Convenience interface for oct JSON Web Keys
+ */
+export interface JWK_oct extends JWKParameters {
+  /** Key Value */
+  k: string
+}
+
 /**
  * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC", "OKP", and "oct"
  * key types are supported.
  */
-export interface JWK {
-  /** JWK "alg" (Algorithm) Parameter. */
-  alg?: string
+export interface JWK extends JWKParameters {
+  /**
+   * - (EC) Curve
+   * - (OKP) The Subtype of Key Pair
+   */
   crv?: string
+  /**
+   * - (Private RSA) Private Exponent
+   * - (Private EC) ECC Private Key
+   * - (Private OKP) The Private Key
+   */
   d?: string
+  /** (Private RSA) First Factor CRT Exponent */
   dp?: string
+  /** (Private RSA) Second Factor CRT Exponent */
   dq?: string
+  /** (RSA) Exponent */
   e?: string
-  /** JWK "ext" (Extractable) Parameter. */
-  ext?: boolean
+  /** (oct) Key Value */
   k?: string
-  /** JWK "key_ops" (Key Operations) Parameter. */
-  key_ops?: string[]
-  /** JWK "kid" (Key ID) Parameter. */
-  kid?: string
-  /** JWK "kty" (Key Type) Parameter. */
-  kty?: string
+  /** (RSA) Modulus */
   n?: string
+  /** (Private RSA) Other Primes Info. This parameter is not supported. */
   oth?: Array<{
     d?: string
     r?: string
     t?: string
   }>
+  /** (Private RSA) First Prime Factor */
   p?: string
+  /** (Private RSA) Second Prime Factor */
   q?: string
+  /** (Private RSA) First CRT Coefficient */
   qi?: string
-  /** JWK "use" (Public Key Use) Parameter. */
-  use?: string
+  /**
+   * - (EC) X Coordinate
+   * - (OKP) The public key
+   */
   x?: string
+  /** (EC) Y Coordinate */
   y?: string
-  /** JWK "x5c" (X.509 Certificate Chain) Parameter. */
-  x5c?: string[]
-  /** JWK "x5t" (X.509 Certificate SHA-1 Thumbprint) Parameter. */
-  x5t?: string
-  /** "x5t#S256" (X.509 Certificate SHA-256 Thumbprint) Parameter. */
-  'x5t#S256'?: string
-  /** JWK "x5u" (X.509 URL) Parameter. */
-  x5u?: string
 
   [propName: string]: unknown
 }
 
 /**
- * Generic Interface for consuming operations dynamic key resolution.
+ * @private
  *
- * @param IProtectedHeader Type definition of the JWE or JWS Protected Header.
- * @param IToken Type definition of the consumed JWE or JWS token.
+ * @internal
  */
-export interface GetKeyFunction<IProtectedHeader, IToken> {
+export interface GenericGetKeyFunction<IProtectedHeader, IToken, ReturnKeyTypes> {
   /**
    * Dynamic key resolution function. No token components have been verified at the time of this
    * function call.
@@ -91,12 +185,18 @@ export interface GetKeyFunction<IProtectedHeader, IToken> {
    * @param protectedHeader JWE or JWS Protected Header.
    * @param token The consumed JWE or JWS token.
    */
-  (
-    protectedHeader: IProtectedHeader,
-    token: IToken,
-  ): Promise<KeyLike | Uint8Array> | KeyLike | Uint8Array
+  (protectedHeader: IProtectedHeader, token: IToken): Promise<ReturnKeyTypes> | ReturnKeyTypes
 }
 
+/**
+ * Generic Interface for consuming operations dynamic key resolution.
+ *
+ * @param IProtectedHeader Type definition of the JWE or JWS Protected Header.
+ * @param IToken Type definition of the consumed JWE or JWS token.
+ */
+export interface GetKeyFunction<IProtectedHeader, IToken>
+  extends GenericGetKeyFunction<IProtectedHeader, IToken, KeyLike | Uint8Array> {}
+
 /**
  * Flattened JWS definition for verify function inputs, allows payload as Uint8Array for detached
  * signature validation.

package/dist/types/util/decode_jwt.d.ts

@@ -5,6 +5,9 @@ import type { JWTPayload } from '../types';
  * and JWS signature verification use `jose.jwtVerify()`. For an encrypted JWT Claims Set validation
  * and JWE decryption use `jose.jwtDecrypt()`.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/jwt/decode'`.
+ *
  * @param jwt JWT token in compact JWS serialization.
  */
 export declare function decodeJwt<PayloadType = JWTPayload>(jwt: string): PayloadType & JWTPayload;

package/dist/types/util/decode_protected_header.d.ts

@@ -3,6 +3,9 @@ export type ProtectedHeaderParameters = JWSHeaderParameters & JWEHeaderParameter
 /**
  * Decodes the Protected Header of a JWE/JWS/JWT token utilizing any JOSE serialization.
  *
+ * This function is exported (as a named export) from the main `'jose'` module entry point as well
+ * as from its subpath export `'jose/decode/protected_header'`.
+ *
  * @param token JWE/JWS/JWT token in any JOSE serialization.
  */
 export declare function decodeProtectedHeader(token: string | object): ProtectedHeaderParameters;