jose 5.8.0 → 5.9.0

package/dist/node/cjs/runtime/verify.js

@@ -8,9 +8,9 @@ const sign_js_1 = require("./sign.js");
 const get_sign_verify_key_js_1 = require("./get_sign_verify_key.js");
 const oneShotVerify = (0, node_util_1.promisify)(crypto.verify);
 const verify = async (alg, key, signature, data) => {
-    const keyObject = (0, get_sign_verify_key_js_1.default)(alg, key, 'verify');
+    const k = (0, get_sign_verify_key_js_1.default)(alg, key, 'verify');
     if (alg.startsWith('HS')) {
-        const expected = await (0, sign_js_1.default)(alg, keyObject, data);
+        const expected = await (0, sign_js_1.default)(alg, k, data);
         const actual = signature;
         try {
             return crypto.timingSafeEqual(actual, expected);
@@ -20,7 +20,7 @@ const verify = async (alg, key, signature, data) => {
         }
     }
     const algorithm = (0, dsa_digest_js_1.default)(alg);
-    const keyInput = (0, node_key_js_1.default)(alg, keyObject);
+    const keyInput = (0, node_key_js_1.default)(alg, k);
     try {
         return await oneShotVerify(algorithm, data, keyInput, signature);
     }

package/dist/node/esm/jwks/remote.js

@@ -10,7 +10,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.8.0';
+    const VERSION = 'v5.9.0';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const jwksCache = Symbol();

package/dist/node/esm/jws/flattened/sign.js

@@ -3,7 +3,7 @@ import sign from '../../runtime/sign.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import { JWSInvalid } from '../../util/errors.js';
 import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
-import checkKeyType from '../../lib/check_key_type.js';
+import { checkKeyTypeWithJwk } from '../../lib/check_key_type.js';
 import validateCrit from '../../lib/validate_crit.js';
 export class FlattenedSign {
     _payload;
@@ -52,7 +52,7 @@ export class FlattenedSign {
         if (typeof alg !== 'string' || !alg) {
             throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
         }
-        checkKeyType(alg, key, 'sign');
+        checkKeyTypeWithJwk(alg, key, 'sign');
         let payload = this._payload;
         if (b64) {
             payload = encoder.encode(base64url(payload));

package/dist/node/esm/jws/flattened/verify.js

@@ -4,9 +4,11 @@ import { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from '.
 import { concat, encoder, decoder } from '../../lib/buffer_utils.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import isObject from '../../lib/is_object.js';
-import checkKeyType from '../../lib/check_key_type.js';
+import { checkKeyTypeWithJwk } from '../../lib/check_key_type.js';
 import validateCrit from '../../lib/validate_crit.js';
 import validateAlgorithms from '../../lib/validate_algorithms.js';
+import { isJWK } from '../../lib/is_jwk.js';
+import { importJWK } from '../../key/import.js';
 export async function flattenedVerify(jws, key, options) {
     if (!isObject(jws)) {
         throw new JWSInvalid('Flattened JWS must be an object');
@@ -71,8 +73,14 @@ export async function flattenedVerify(jws, key, options) {
     if (typeof key === 'function') {
         key = await key(parsedProt, jws);
         resolvedKey = true;
+        checkKeyTypeWithJwk(alg, key, 'verify');
+        if (isJWK(key)) {
+            key = await importJWK(key, alg);
+        }
+    }
+    else {
+        checkKeyTypeWithJwk(alg, key, 'verify');
     }
-    checkKeyType(alg, key, 'verify');
     const data = concat(encoder.encode(jws.protected ?? ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);
     let signature;
     try {

package/dist/node/esm/lib/check_key_type.js

@@ -1,19 +1,49 @@
 import { withAlg as invalidKeyInput } from './invalid_key_input.js';
 import isKeyLike, { types } from '../runtime/is_key_like.js';
+import * as jwk from './is_jwk.js';
 const tag = (key) => key?.[Symbol.toStringTag];
-const symmetricTypeCheck = (alg, key) => {
+const jwkMatchesOp = (alg, key, usage) => {
+    if (key.use !== undefined && key.use !== 'sig') {
+        throw new TypeError('Invalid key for this operation, when present its use must be sig');
+    }
+    if (key.key_ops !== undefined && key.key_ops.includes?.(usage) !== true) {
+        throw new TypeError(`Invalid key for this operation, when present its key_ops must include ${usage}`);
+    }
+    if (key.alg !== undefined && key.alg !== alg) {
+        throw new TypeError(`Invalid key for this operation, when present its alg must be ${alg}`);
+    }
+    return true;
+};
+const symmetricTypeCheck = (alg, key, usage, allowJwk) => {
     if (key instanceof Uint8Array)
         return;
+    if (allowJwk && jwk.isJWK(key)) {
+        if (jwk.isSecretJWK(key) && jwkMatchesOp(alg, key, usage))
+            return;
+        throw new TypeError(`JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`);
+    }
     if (!isKeyLike(key)) {
-        throw new TypeError(invalidKeyInput(alg, key, ...types, 'Uint8Array'));
+        throw new TypeError(invalidKeyInput(alg, key, ...types, 'Uint8Array', allowJwk ? 'JSON Web Key' : null));
     }
     if (key.type !== 'secret') {
         throw new TypeError(`${tag(key)} instances for symmetric algorithms must be of type "secret"`);
     }
 };
-const asymmetricTypeCheck = (alg, key, usage) => {
+const asymmetricTypeCheck = (alg, key, usage, allowJwk) => {
+    if (allowJwk && jwk.isJWK(key)) {
+        switch (usage) {
+            case 'sign':
+                if (jwk.isPrivateJWK(key) && jwkMatchesOp(alg, key, usage))
+                    return;
+                throw new TypeError(`JSON Web Key for this operation be a private JWK`);
+            case 'verify':
+                if (jwk.isPublicJWK(key) && jwkMatchesOp(alg, key, usage))
+                    return;
+                throw new TypeError(`JSON Web Key for this operation be a public JWK`);
+        }
+    }
     if (!isKeyLike(key)) {
-        throw new TypeError(invalidKeyInput(alg, key, ...types));
+        throw new TypeError(invalidKeyInput(alg, key, ...types, allowJwk ? 'JSON Web Key' : null));
     }
     if (key.type === 'secret') {
         throw new TypeError(`${tag(key)} instances for asymmetric algorithms must not be of type "secret"`);
@@ -31,16 +61,17 @@ const asymmetricTypeCheck = (alg, key, usage) => {
         throw new TypeError(`${tag(key)} instances for asymmetric algorithm encryption must be of type "public"`);
     }
 };
-const checkKeyType = (alg, key, usage) => {
+function checkKeyType(allowJwk, alg, key, usage) {
     const symmetric = alg.startsWith('HS') ||
         alg === 'dir' ||
         alg.startsWith('PBES2') ||
         /^A\d{3}(?:GCM)?KW$/.test(alg);
     if (symmetric) {
-        symmetricTypeCheck(alg, key);
+        symmetricTypeCheck(alg, key, usage, allowJwk);
     }
     else {
-        asymmetricTypeCheck(alg, key, usage);
+        asymmetricTypeCheck(alg, key, usage, allowJwk);
     }
-};
-export default checkKeyType;
+}
+export default checkKeyType.bind(undefined, false);
+export const checkKeyTypeWithJwk = checkKeyType.bind(undefined, true);

package/dist/node/esm/lib/invalid_key_input.js

@@ -1,4 +1,5 @@
 function message(msg, actual, ...types) {
+    types = types.filter(Boolean);
     if (types.length > 2) {
         const last = types.pop();
         msg += `one of type ${types.join(', ')}, or ${last}.`;

package/dist/node/esm/lib/is_jwk.js

@@ -0,0 +1,13 @@
+import isObject from './is_object.js';
+export function isJWK(key) {
+    return isObject(key) && typeof key.kty === 'string';
+}
+export function isPrivateJWK(key) {
+    return key.kty !== 'oct' && typeof key.d === 'string';
+}
+export function isPublicJWK(key) {
+    return key.kty !== 'oct' && typeof key.d === 'undefined';
+}
+export function isSecretJWK(key) {
+    return isJWK(key) && key.kty === 'oct' && typeof key.k === 'string';
+}

package/dist/node/esm/runtime/base64url.js

@@ -11,4 +11,4 @@ const encode = (input) => Buffer.from(input).toString('base64url');
 export const decodeBase64 = (input) => new Uint8Array(Buffer.from(input, 'base64'));
 export const encodeBase64 = (input) => Buffer.from(input).toString('base64');
 export { encode };
-export const decode = (input) => new Uint8Array(Buffer.from(normalize(input), 'base64'));
+export const decode = (input) => new Uint8Array(Buffer.from(normalize(input), 'base64url'));

package/dist/node/esm/runtime/check_key_length.js

@@ -1,5 +1,15 @@
+import { KeyObject } from 'node:crypto';
 export default (key, alg) => {
-    const { modulusLength } = key.asymmetricKeyDetails;
+    let modulusLength;
+    try {
+        if (key instanceof KeyObject) {
+            modulusLength = key.asymmetricKeyDetails?.modulusLength;
+        }
+        else {
+            modulusLength = Buffer.from(key.n, 'base64url').byteLength << 3;
+        }
+    }
+    catch { }
     if (typeof modulusLength !== 'number' || modulusLength < 2048) {
         throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
     }

package/dist/node/esm/runtime/get_named_curve.js

@@ -4,6 +4,7 @@ import { isCryptoKey } from './webcrypto.js';
 import isKeyObject from './is_key_object.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
 import { types } from './is_key_like.js';
+import { isJWK } from '../lib/is_jwk.js';
 export const weakMap = new WeakMap();
 const namedCurveToJOSE = (namedCurve) => {
     switch (namedCurve) {
@@ -27,6 +28,9 @@ const getNamedCurve = (kee, raw) => {
     else if (isKeyObject(kee)) {
         key = kee;
     }
+    else if (isJWK(kee)) {
+        return kee.crv;
+    }
     else {
         throw new TypeError(invalidKeyInput(kee, ...types));
     }

package/dist/node/esm/runtime/get_sign_verify_key.js

@@ -3,6 +3,7 @@ import { isCryptoKey } from './webcrypto.js';
 import { checkSigCryptoKey } from '../lib/crypto_key.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
 import { types } from './is_key_like.js';
+import * as jwk from '../lib/is_jwk.js';
 export default function getSignVerifyKey(alg, key, usage) {
     if (key instanceof Uint8Array) {
         if (!alg.startsWith('HS')) {
@@ -17,5 +18,11 @@ export default function getSignVerifyKey(alg, key, usage) {
         checkSigCryptoKey(key, alg, usage);
         return KeyObject.from(key);
     }
-    throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array'));
+    if (jwk.isJWK(key)) {
+        if (alg.startsWith('HS')) {
+            return createSecretKey(Buffer.from(key.k, 'base64url'));
+        }
+        return key;
+    }
+    throw new TypeError(invalidKeyInput(key, ...types, 'Uint8Array', 'JSON Web Key'));
 }

package/dist/node/esm/runtime/node_key.js

@@ -1,11 +1,7 @@
-import { constants } from 'node:crypto';
+import { constants, KeyObject } from 'node:crypto';
 import getNamedCurve from './get_named_curve.js';
 import { JOSENotSupported } from '../util/errors.js';
 import checkKeyLength from './check_key_length.js';
-const PSS = {
-    padding: constants.RSA_PKCS1_PSS_PADDING,
-    saltLength: constants.RSA_PSS_SALTLEN_DIGEST,
-};
 const ecCurveAlgMap = new Map([
     ['ES256', 'P-256'],
     ['ES256K', 'secp256k1'],
@@ -13,25 +9,57 @@ const ecCurveAlgMap = new Map([
     ['ES512', 'P-521'],
 ]);
 export default function keyForCrypto(alg, key) {
+    let asymmetricKeyType;
+    let asymmetricKeyDetails;
+    let isJWK;
+    if (key instanceof KeyObject) {
+        asymmetricKeyType = key.asymmetricKeyType;
+        asymmetricKeyDetails = key.asymmetricKeyDetails;
+    }
+    else {
+        isJWK = true;
+        switch (key.kty) {
+            case 'RSA':
+                asymmetricKeyType = 'rsa';
+                break;
+            case 'EC':
+                asymmetricKeyType = 'ec';
+                break;
+            case 'OKP': {
+                if (key.crv === 'Ed25519') {
+                    asymmetricKeyType = 'ed25519';
+                    break;
+                }
+                if (key.crv === 'Ed448') {
+                    asymmetricKeyType = 'ed448';
+                    break;
+                }
+                throw new TypeError('Invalid key for this operation, its crv must be Ed25519 or Ed448');
+            }
+            default:
+                throw new TypeError('Invalid key for this operation, its kty must be RSA, OKP, or EC');
+        }
+    }
+    let options;
     switch (alg) {
         case 'EdDSA':
-            if (!['ed25519', 'ed448'].includes(key.asymmetricKeyType)) {
+            if (!['ed25519', 'ed448'].includes(asymmetricKeyType)) {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be ed25519 or ed448');
             }
-            return key;
+            break;
         case 'RS256':
         case 'RS384':
         case 'RS512':
-            if (key.asymmetricKeyType !== 'rsa') {
+            if (asymmetricKeyType !== 'rsa') {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa');
             }
             checkKeyLength(key, alg);
-            return key;
+            break;
         case 'PS256':
         case 'PS384':
         case 'PS512':
-            if (key.asymmetricKeyType === 'rsa-pss') {
-                const { hashAlgorithm, mgf1HashAlgorithm, saltLength } = key.asymmetricKeyDetails;
+            if (asymmetricKeyType === 'rsa-pss') {
+                const { hashAlgorithm, mgf1HashAlgorithm, saltLength } = asymmetricKeyDetails;
                 const length = parseInt(alg.slice(-3), 10);
                 if (hashAlgorithm !== undefined &&
                     (hashAlgorithm !== `sha${length}` || mgf1HashAlgorithm !== hashAlgorithm)) {
@@ -41,16 +69,20 @@ export default function keyForCrypto(alg, key) {
                     throw new TypeError(`Invalid key for this operation, its RSA-PSS parameter saltLength does not meet the requirements of "alg" ${alg}`);
                 }
             }
-            else if (key.asymmetricKeyType !== 'rsa') {
+            else if (asymmetricKeyType !== 'rsa') {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be rsa or rsa-pss');
             }
             checkKeyLength(key, alg);
-            return { key, ...PSS };
+            options = {
+                padding: constants.RSA_PKCS1_PSS_PADDING,
+                saltLength: constants.RSA_PSS_SALTLEN_DIGEST,
+            };
+            break;
         case 'ES256':
         case 'ES256K':
         case 'ES384':
         case 'ES512': {
-            if (key.asymmetricKeyType !== 'ec') {
+            if (asymmetricKeyType !== 'ec') {
                 throw new TypeError('Invalid key for this operation, its asymmetricKeyType must be ec');
             }
             const actual = getNamedCurve(key);
@@ -58,9 +90,14 @@ export default function keyForCrypto(alg, key) {
             if (actual !== expected) {
                 throw new TypeError(`Invalid key curve for the algorithm, its curve must be ${expected}, got ${actual}`);
             }
-            return { dsaEncoding: 'ieee-p1363', key };
+            options = { dsaEncoding: 'ieee-p1363' };
+            break;
         }
         default:
             throw new JOSENotSupported(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
     }
+    if (isJWK) {
+        return { format: 'jwk', key, ...options };
+    }
+    return options ? { ...options, key } : key;
 }

package/dist/node/esm/runtime/sign.js

@@ -6,12 +6,12 @@ import nodeKey from './node_key.js';
 import getSignKey from './get_sign_verify_key.js';
 const oneShotSign = promisify(crypto.sign);
 const sign = async (alg, key, data) => {
-    const keyObject = getSignKey(alg, key, 'sign');
+    const k = getSignKey(alg, key, 'sign');
     if (alg.startsWith('HS')) {
-        const hmac = crypto.createHmac(hmacDigest(alg), keyObject);
+        const hmac = crypto.createHmac(hmacDigest(alg), k);
         hmac.update(data);
         return hmac.digest();
     }
-    return oneShotSign(nodeDigest(alg), data, nodeKey(alg, keyObject));
+    return oneShotSign(nodeDigest(alg), data, nodeKey(alg, k));
 };
 export default sign;

package/dist/node/esm/runtime/verify.js

@@ -6,9 +6,9 @@ import sign from './sign.js';
 import getVerifyKey from './get_sign_verify_key.js';
 const oneShotVerify = promisify(crypto.verify);
 const verify = async (alg, key, signature, data) => {
-    const keyObject = getVerifyKey(alg, key, 'verify');
+    const k = getVerifyKey(alg, key, 'verify');
     if (alg.startsWith('HS')) {
-        const expected = await sign(alg, keyObject, data);
+        const expected = await sign(alg, k, data);
         const actual = signature;
         try {
             return crypto.timingSafeEqual(actual, expected);
@@ -18,7 +18,7 @@ const verify = async (alg, key, signature, data) => {
         }
     }
     const algorithm = nodeDigest(alg);
-    const keyInput = nodeKey(alg, keyObject);
+    const keyInput = nodeKey(alg, k);
     try {
         return await oneShotVerify(algorithm, data, keyInput, signature);
     }

package/dist/types/jws/compact/sign.d.ts

@@ -1,4 +1,4 @@
-import type { CompactJWSHeaderParameters, KeyLike, SignOptions } from '../../types';
+import type { JWK, CompactJWSHeaderParameters, KeyLike, SignOptions } from '../../types';
 /**
  * The CompactSign class is used to build and sign Compact JWS strings.
  *
@@ -23,5 +23,5 @@ export declare class CompactSign {
      *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
      * @param options JWS Sign options.
      */
-    sign(key: KeyLike | Uint8Array, options?: SignOptions): Promise<string>;
+    sign(key: KeyLike | Uint8Array | JWK, options?: SignOptions): Promise<string>;
 }

package/dist/types/jws/compact/verify.d.ts

@@ -1,11 +1,11 @@
-import type { CompactVerifyResult, FlattenedJWSInput, GetKeyFunction, CompactJWSHeaderParameters, KeyLike, VerifyOptions, ResolvedKey } from '../../types';
+import type { JWK, CompactVerifyResult, FlattenedJWSInput, GenericGetKeyFunction, CompactJWSHeaderParameters, KeyLike, VerifyOptions, ResolvedKey } from '../../types';
 /**
  * Interface for Compact JWS Verification dynamic key resolution. No token components have been
  * verified at the time of this function call.
  *
  * @see [createRemoteJWKSet](../functions/jwks_remote.createRemoteJWKSet.md#function-createremotejwkset) to verify using a remote JSON Web Key Set.
  */
-export interface CompactVerifyGetKey extends GetKeyFunction<CompactJWSHeaderParameters, FlattenedJWSInput> {
+export interface CompactVerifyGetKey extends GenericGetKeyFunction<CompactJWSHeaderParameters, FlattenedJWSInput, KeyLike | JWK | Uint8Array> {
 }
 /**
  * Verifies the signature and format of and afterwards decodes the Compact JWS.
@@ -18,7 +18,7 @@ export interface CompactVerifyGetKey extends GetKeyFunction<CompactJWSHeaderPara
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  * @param options JWS Verify options.
  */
-export declare function compactVerify(jws: string | Uint8Array, key: KeyLike | Uint8Array, options?: VerifyOptions): Promise<CompactVerifyResult>;
+export declare function compactVerify(jws: string | Uint8Array, key: KeyLike | Uint8Array | JWK, options?: VerifyOptions): Promise<CompactVerifyResult>;
 /**
  * @param jws Compact JWS.
  * @param getKey Function resolving a key to verify the JWS with. See

package/dist/types/jws/flattened/sign.d.ts

@@ -1,4 +1,4 @@
-import type { KeyLike, FlattenedJWS, JWSHeaderParameters, SignOptions } from '../../types';
+import type { JWK, KeyLike, FlattenedJWS, JWSHeaderParameters, SignOptions } from '../../types';
 /**
  * The FlattenedSign class is used to build and sign Flattened JWS objects.
  *
@@ -31,5 +31,5 @@ export declare class FlattenedSign {
      *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
      * @param options JWS Sign options.
      */
-    sign(key: KeyLike | Uint8Array, options?: SignOptions): Promise<FlattenedJWS>;
+    sign(key: KeyLike | Uint8Array | JWK, options?: SignOptions): Promise<FlattenedJWS>;
 }

package/dist/types/jws/flattened/verify.d.ts

@@ -1,11 +1,11 @@
-import type { FlattenedVerifyResult, KeyLike, FlattenedJWSInput, JWSHeaderParameters, VerifyOptions, GetKeyFunction, ResolvedKey } from '../../types';
+import type { JWK, FlattenedVerifyResult, KeyLike, FlattenedJWSInput, JWSHeaderParameters, VerifyOptions, GenericGetKeyFunction, ResolvedKey } from '../../types';
 /**
  * Interface for Flattened JWS Verification dynamic key resolution. No token components have been
  * verified at the time of this function call.
  *
  * @see [createRemoteJWKSet](../functions/jwks_remote.createRemoteJWKSet.md#function-createremotejwkset) to verify using a remote JSON Web Key Set.
  */
-export interface FlattenedVerifyGetKey extends GetKeyFunction<JWSHeaderParameters | undefined, FlattenedJWSInput> {
+export interface FlattenedVerifyGetKey extends GenericGetKeyFunction<JWSHeaderParameters | undefined, FlattenedJWSInput, KeyLike | JWK | Uint8Array> {
 }
 /**
  * Verifies the signature and format of and afterwards decodes the Flattened JWS.
@@ -18,7 +18,7 @@ export interface FlattenedVerifyGetKey extends GetKeyFunction<JWSHeaderParameter
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  * @param options JWS Verify options.
  */
-export declare function flattenedVerify(jws: FlattenedJWSInput, key: KeyLike | Uint8Array, options?: VerifyOptions): Promise<FlattenedVerifyResult>;
+export declare function flattenedVerify(jws: FlattenedJWSInput, key: KeyLike | Uint8Array | JWK, options?: VerifyOptions): Promise<FlattenedVerifyResult>;
 /**
  * @param jws Flattened JWS.
  * @param getKey Function resolving a key to verify the JWS with. See

package/dist/types/jws/general/sign.d.ts

@@ -1,4 +1,4 @@
-import type { KeyLike, GeneralJWS, JWSHeaderParameters, SignOptions } from '../../types';
+import type { JWK, KeyLike, GeneralJWS, JWSHeaderParameters, SignOptions } from '../../types';
 export interface Signature {
     /**
      * Sets the JWS Protected Header on the Signature object.
@@ -38,7 +38,7 @@ export declare class GeneralSign {
      *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
      * @param options JWS Sign options.
      */
-    addSignature(key: KeyLike | Uint8Array, options?: SignOptions): Signature;
+    addSignature(key: KeyLike | Uint8Array | JWK, options?: SignOptions): Signature;
     /** Signs and resolves the value of the General JWS object. */
     sign(): Promise<GeneralJWS>;
 }

package/dist/types/jws/general/verify.d.ts

@@ -1,11 +1,11 @@
-import type { GeneralJWSInput, GeneralVerifyResult, FlattenedJWSInput, GetKeyFunction, JWSHeaderParameters, KeyLike, VerifyOptions, ResolvedKey } from '../../types';
+import type { JWK, GeneralJWSInput, GeneralVerifyResult, FlattenedJWSInput, GenericGetKeyFunction, JWSHeaderParameters, KeyLike, VerifyOptions, ResolvedKey } from '../../types';
 /**
  * Interface for General JWS Verification dynamic key resolution. No token components have been
  * verified at the time of this function call.
  *
  * @see [createRemoteJWKSet](../functions/jwks_remote.createRemoteJWKSet.md#function-createremotejwkset) to verify using a remote JSON Web Key Set.
  */
-export interface GeneralVerifyGetKey extends GetKeyFunction<JWSHeaderParameters, FlattenedJWSInput> {
+export interface GeneralVerifyGetKey extends GenericGetKeyFunction<JWSHeaderParameters, FlattenedJWSInput, KeyLike | JWK | Uint8Array> {
 }
 /**
  * Verifies the signature and format of and afterwards decodes the General JWS.
@@ -18,7 +18,7 @@ export interface GeneralVerifyGetKey extends GetKeyFunction<JWSHeaderParameters,
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  * @param options JWS Verify options.
  */
-export declare function generalVerify(jws: GeneralJWSInput, key: KeyLike | Uint8Array, options?: VerifyOptions): Promise<GeneralVerifyResult>;
+export declare function generalVerify(jws: GeneralJWSInput, key: KeyLike | Uint8Array | JWK, options?: VerifyOptions): Promise<GeneralVerifyResult>;
 /**
  * @param jws General JWS.
  * @param getKey Function resolving a key to verify the JWS with. See

package/dist/types/jwt/sign.d.ts

@@ -1,4 +1,4 @@
-import type { JWTHeaderParameters, KeyLike, SignOptions } from '../types';
+import type { JWK, JWTHeaderParameters, KeyLike, SignOptions } from '../types';
 import { ProduceJWT } from './produce';
 /**
  * The SignJWT class is used to build and sign Compact JWS formatted JSON Web Tokens.
@@ -22,5 +22,5 @@ export declare class SignJWT extends ProduceJWT {
      *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
      * @param options JWT Sign options.
      */
-    sign(key: KeyLike | Uint8Array, options?: SignOptions): Promise<string>;
+    sign(key: KeyLike | Uint8Array | JWK, options?: SignOptions): Promise<string>;
 }

package/dist/types/jwt/verify.d.ts

@@ -1,4 +1,4 @@
-import type { JWTPayload, KeyLike, VerifyOptions, JWTClaimVerificationOptions, JWTHeaderParameters, GetKeyFunction, FlattenedJWSInput, JWTVerifyResult, ResolvedKey } from '../types';
+import type { JWK, JWTPayload, KeyLike, VerifyOptions, JWTClaimVerificationOptions, JWTHeaderParameters, GenericGetKeyFunction, FlattenedJWSInput, JWTVerifyResult, ResolvedKey } from '../types';
 /** Combination of JWS Verification options and JWT Claims Set verification options. */
 export interface JWTVerifyOptions extends VerifyOptions, JWTClaimVerificationOptions {
 }
@@ -8,7 +8,7 @@ export interface JWTVerifyOptions extends VerifyOptions, JWTClaimVerificationOpt
  *
  * @see [createRemoteJWKSet](../functions/jwks_remote.createRemoteJWKSet.md#function-createremotejwkset) to verify using a remote JSON Web Key Set.
  */
-export interface JWTVerifyGetKey extends GetKeyFunction<JWTHeaderParameters, FlattenedJWSInput> {
+export interface JWTVerifyGetKey extends GenericGetKeyFunction<JWTHeaderParameters, FlattenedJWSInput, KeyLike | JWK | Uint8Array> {
 }
 /**
  * Verifies the JWT format (to be a JWS Compact format), verifies the JWS signature, validates the
@@ -22,7 +22,7 @@ export interface JWTVerifyGetKey extends GetKeyFunction<JWTHeaderParameters, Fla
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  * @param options JWT Decryption and JWT Claims Set validation options.
  */
-export declare function jwtVerify<PayloadType = JWTPayload>(jwt: string | Uint8Array, key: KeyLike | Uint8Array, options?: JWTVerifyOptions): Promise<JWTVerifyResult<PayloadType>>;
+export declare function jwtVerify<PayloadType = JWTPayload>(jwt: string | Uint8Array, key: KeyLike | Uint8Array | JWK, options?: JWTVerifyOptions): Promise<JWTVerifyResult<PayloadType>>;
 /**
  * @param jwt JSON Web Token value (encoded as JWS).
  * @param getKey Function resolving a key to verify the JWT with. See