jose 5.9.6 → 6.0.0

package/dist/types/jws/flattened/verify.d.ts

@@ -1,11 +1,11 @@
-import type { JWK, FlattenedVerifyResult, KeyLike, FlattenedJWSInput, JWSHeaderParameters, VerifyOptions, GenericGetKeyFunction, ResolvedKey } from '../../types';
+import type * as types from '../../types';
 /**
  * Interface for Flattened JWS Verification dynamic key resolution. No token components have been
  * verified at the time of this function call.
  *
  * @see {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} to verify using a remote JSON Web Key Set.
  */
-export interface FlattenedVerifyGetKey extends GenericGetKeyFunction<JWSHeaderParameters | undefined, FlattenedJWSInput, KeyLike | JWK | Uint8Array> {
+export interface FlattenedVerifyGetKey extends types.GenericGetKeyFunction<types.JWSHeaderParameters | undefined, types.FlattenedJWSInput, types.CryptoKey | types.KeyObject | types.JWK | Uint8Array> {
 }
 /**
  * Verifies the signature and format of and afterwards decodes the Flattened JWS.
@@ -18,11 +18,11 @@ export interface FlattenedVerifyGetKey extends GenericGetKeyFunction<JWSHeaderPa
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  * @param options JWS Verify options.
  */
-export declare function flattenedVerify(jws: FlattenedJWSInput, key: KeyLike | Uint8Array | JWK, options?: VerifyOptions): Promise<FlattenedVerifyResult>;
+export declare function flattenedVerify(jws: types.FlattenedJWSInput, key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array, options?: types.VerifyOptions): Promise<types.FlattenedVerifyResult>;
 /**
  * @param jws Flattened JWS.
  * @param getKey Function resolving a key to verify the JWS with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  * @param options JWS Verify options.
  */
-export declare function flattenedVerify<KeyLikeType extends KeyLike = KeyLike>(jws: FlattenedJWSInput, getKey: FlattenedVerifyGetKey, options?: VerifyOptions): Promise<FlattenedVerifyResult & ResolvedKey<KeyLikeType>>;
+export declare function flattenedVerify(jws: types.FlattenedJWSInput, getKey: FlattenedVerifyGetKey, options?: types.VerifyOptions): Promise<types.FlattenedVerifyResult & types.ResolvedKey>;

package/dist/types/jws/general/sign.d.ts

@@ -1,21 +1,21 @@
-import type { JWK, KeyLike, GeneralJWS, JWSHeaderParameters, SignOptions } from '../../types';
+import type * as types from '../../types';
 export interface Signature {
     /**
      * Sets the JWS Protected Header on the Signature object.
      *
      * @param protectedHeader JWS Protected Header.
      */
-    setProtectedHeader(protectedHeader: JWSHeaderParameters): Signature;
+    setProtectedHeader(protectedHeader: types.JWSHeaderParameters): Signature;
     /**
      * Sets the JWS Unprotected Header on the Signature object.
      *
      * @param unprotectedHeader JWS Unprotected Header.
      */
-    setUnprotectedHeader(unprotectedHeader: JWSHeaderParameters): Signature;
+    setUnprotectedHeader(unprotectedHeader: types.JWSHeaderParameters): Signature;
     /** A shorthand for calling addSignature() on the enclosing GeneralSign instance */
     addSignature(...args: Parameters<GeneralSign['addSignature']>): Signature;
     /** A shorthand for calling encrypt() on the enclosing GeneralSign instance */
-    sign(...args: Parameters<GeneralSign['sign']>): Promise<GeneralJWS>;
+    sign(...args: Parameters<GeneralSign['sign']>): Promise<types.GeneralJWS>;
     /** Returns the enclosing GeneralSign */
     done(): GeneralSign;
 }
@@ -38,7 +38,7 @@ export declare class GeneralSign {
      *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
      * @param options JWS Sign options.
      */
-    addSignature(key: KeyLike | Uint8Array | JWK, options?: SignOptions): Signature;
+    addSignature(key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array, options?: types.SignOptions): Signature;
     /** Signs and resolves the value of the General JWS object. */
-    sign(): Promise<GeneralJWS>;
+    sign(): Promise<types.GeneralJWS>;
 }

package/dist/types/jws/general/verify.d.ts

@@ -1,11 +1,11 @@
-import type { JWK, GeneralJWSInput, GeneralVerifyResult, FlattenedJWSInput, GenericGetKeyFunction, JWSHeaderParameters, KeyLike, VerifyOptions, ResolvedKey } from '../../types';
+import type * as types from '../../types';
 /**
  * Interface for General JWS Verification dynamic key resolution. No token components have been
  * verified at the time of this function call.
  *
  * @see {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} to verify using a remote JSON Web Key Set.
  */
-export interface GeneralVerifyGetKey extends GenericGetKeyFunction<JWSHeaderParameters, FlattenedJWSInput, KeyLike | JWK | Uint8Array> {
+export interface GeneralVerifyGetKey extends types.GenericGetKeyFunction<types.JWSHeaderParameters, types.FlattenedJWSInput, types.CryptoKey | types.KeyObject | types.JWK | Uint8Array> {
 }
 /**
  * Verifies the signature and format of and afterwards decodes the General JWS.
@@ -18,11 +18,11 @@ export interface GeneralVerifyGetKey extends GenericGetKeyFunction<JWSHeaderPara
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  * @param options JWS Verify options.
  */
-export declare function generalVerify(jws: GeneralJWSInput, key: KeyLike | Uint8Array | JWK, options?: VerifyOptions): Promise<GeneralVerifyResult>;
+export declare function generalVerify(jws: types.GeneralJWSInput, key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array, options?: types.VerifyOptions): Promise<types.GeneralVerifyResult>;
 /**
  * @param jws General JWS.
  * @param getKey Function resolving a key to verify the JWS with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  * @param options JWS Verify options.
  */
-export declare function generalVerify<KeyLikeType extends KeyLike = KeyLike>(jws: GeneralJWSInput, getKey: GeneralVerifyGetKey, options?: VerifyOptions): Promise<GeneralVerifyResult & ResolvedKey<KeyLikeType>>;
+export declare function generalVerify(jws: types.GeneralJWSInput, getKey: GeneralVerifyGetKey, options?: types.VerifyOptions): Promise<types.GeneralVerifyResult & types.ResolvedKey>;

package/dist/types/jwt/decrypt.d.ts

@@ -1,12 +1,12 @@
-import type { JWTPayload, KeyLike, DecryptOptions, JWTClaimVerificationOptions, GetKeyFunction, CompactJWEHeaderParameters, FlattenedJWE, JWTDecryptResult, ResolvedKey } from '../types';
+import type * as types from '../types';
 /** Combination of JWE Decryption options and JWT Claims Set verification options. */
-export interface JWTDecryptOptions extends DecryptOptions, JWTClaimVerificationOptions {
+export interface JWTDecryptOptions extends types.DecryptOptions, types.JWTClaimVerificationOptions {
 }
 /**
  * Interface for JWT Decryption dynamic key resolution. No token components have been verified at
  * the time of this function call.
  */
-export interface JWTDecryptGetKey extends GetKeyFunction<CompactJWEHeaderParameters, FlattenedJWE> {
+export interface JWTDecryptGetKey extends types.GetKeyFunction<types.CompactJWEHeaderParameters, types.FlattenedJWE> {
 }
 /**
  * Verifies the JWT format (to be a JWE Compact format), decrypts the ciphertext, validates the JWT
@@ -20,11 +20,11 @@ export interface JWTDecryptGetKey extends GetKeyFunction<CompactJWEHeaderParamet
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  * @param options JWT Decryption and JWT Claims Set validation options.
  */
-export declare function jwtDecrypt<PayloadType = JWTPayload>(jwt: string | Uint8Array, key: KeyLike | Uint8Array, options?: JWTDecryptOptions): Promise<JWTDecryptResult<PayloadType>>;
+export declare function jwtDecrypt<PayloadType = types.JWTPayload>(jwt: string | Uint8Array, key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array, options?: JWTDecryptOptions): Promise<types.JWTDecryptResult<PayloadType>>;
 /**
  * @param jwt JSON Web Token value (encoded as JWE).
  * @param getKey Function resolving Private Key or Secret to decrypt and verify the JWT with. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  * @param options JWT Decryption and JWT Claims Set validation options.
  */
-export declare function jwtDecrypt<PayloadType = JWTPayload, KeyLikeType extends KeyLike = KeyLike>(jwt: string | Uint8Array, getKey: JWTDecryptGetKey, options?: JWTDecryptOptions): Promise<JWTDecryptResult<PayloadType> & ResolvedKey<KeyLikeType>>;
+export declare function jwtDecrypt<PayloadType = types.JWTPayload>(jwt: string | Uint8Array, getKey: JWTDecryptGetKey, options?: JWTDecryptOptions): Promise<types.JWTDecryptResult<PayloadType> & types.ResolvedKey>;

package/dist/types/jwt/encrypt.d.ts

@@ -1,4 +1,4 @@
-import type { EncryptOptions, CompactJWEHeaderParameters, JWEKeyManagementHeaderParameters, KeyLike } from '../types';
+import type * as types from '../types';
 import { ProduceJWT } from './produce';
 /**
  * The EncryptJWT class is used to build and encrypt Compact JWE formatted JSON Web Tokens.
@@ -21,7 +21,7 @@ export declare class EncryptJWT extends ProduceJWT {
      * @param protectedHeader JWE Protected Header. Must contain an "alg" (JWE Algorithm) and "enc"
      *   (JWE Encryption Algorithm) properties.
      */
-    setProtectedHeader(protectedHeader: CompactJWEHeaderParameters): this;
+    setProtectedHeader(protectedHeader: types.CompactJWEHeaderParameters): this;
     /**
      * Sets the JWE Key Management parameters to be used when encrypting. Use of this is method is
      * really only needed for ECDH based algorithms when utilizing the Agreement PartyUInfo or
@@ -30,7 +30,7 @@ export declare class EncryptJWT extends ProduceJWT {
      *
      * @param parameters JWE Key Management parameters.
      */
-    setKeyManagementParameters(parameters: JWEKeyManagementHeaderParameters): this;
+    setKeyManagementParameters(parameters: types.JWEKeyManagementHeaderParameters): this;
     /**
      * Sets a content encryption key to use, by default a random suitable one is generated for the JWE
      * enc" (Encryption Algorithm) Header Parameter.
@@ -76,5 +76,5 @@ export declare class EncryptJWT extends ProduceJWT {
      *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
      * @param options JWE Encryption options.
      */
-    encrypt(key: KeyLike | Uint8Array, options?: EncryptOptions): Promise<string>;
+    encrypt(key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array, options?: types.EncryptOptions): Promise<string>;
 }

package/dist/types/jwt/produce.d.ts

@@ -1,9 +1,9 @@
-import type { JWTPayload } from '../types';
+import type * as types from '../types';
 /** Generic class for JWT producing. */
 export declare class ProduceJWT {
-    protected _payload: JWTPayload;
+    protected _payload: types.JWTPayload;
     /** @param payload The JWT Claims Set object. Defaults to an empty object. */
-    constructor(payload?: JWTPayload);
+    constructor(payload?: types.JWTPayload);
     /**
      * Set the "iss" (Issuer) Claim.
      *

package/dist/types/jwt/sign.d.ts

@@ -1,4 +1,4 @@
-import type { JWK, JWTHeaderParameters, KeyLike, SignOptions } from '../types';
+import type * as types from '../types';
 import { ProduceJWT } from './produce';
 /**
  * The SignJWT class is used to build and sign Compact JWS formatted JSON Web Tokens.
@@ -14,7 +14,7 @@ export declare class SignJWT extends ProduceJWT {
      *
      * @param protectedHeader JWS Protected Header. Must contain an "alg" (JWS Algorithm) property.
      */
-    setProtectedHeader(protectedHeader: JWTHeaderParameters): this;
+    setProtectedHeader(protectedHeader: types.JWTHeaderParameters): this;
     /**
      * Signs and returns the JWT.
      *
@@ -22,5 +22,5 @@ export declare class SignJWT extends ProduceJWT {
      *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
      * @param options JWT Sign options.
      */
-    sign(key: KeyLike | Uint8Array | JWK, options?: SignOptions): Promise<string>;
+    sign(key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array, options?: types.SignOptions): Promise<string>;
 }

package/dist/types/jwt/unsecured.d.ts

@@ -1,8 +1,8 @@
-import type { JWSHeaderParameters, JWTClaimVerificationOptions, JWTPayload } from '../types';
+import type * as types from '../types';
 import { ProduceJWT } from './produce';
-export interface UnsecuredResult<PayloadType = JWTPayload> {
-    payload: PayloadType & JWTPayload;
-    header: JWSHeaderParameters;
+export interface UnsecuredResult<PayloadType = types.JWTPayload> {
+    payload: PayloadType & types.JWTPayload;
+    header: types.JWSHeaderParameters;
 }
 /**
  * The UnsecuredJWT class is a utility for dealing with `{ "alg": "none" }` Unsecured JWTs.
@@ -20,5 +20,5 @@ export declare class UnsecuredJWT extends ProduceJWT {
      * @param jwt Unsecured JWT to decode the payload of.
      * @param options JWT Claims Set validation options.
      */
-    static decode<PayloadType = JWTPayload>(jwt: string, options?: JWTClaimVerificationOptions): UnsecuredResult<PayloadType>;
+    static decode<PayloadType = types.JWTPayload>(jwt: string, options?: types.JWTClaimVerificationOptions): UnsecuredResult<PayloadType>;
 }

package/dist/types/jwt/verify.d.ts

@@ -1,6 +1,6 @@
-import type { JWK, JWTPayload, KeyLike, VerifyOptions, JWTClaimVerificationOptions, JWTHeaderParameters, GenericGetKeyFunction, FlattenedJWSInput, JWTVerifyResult, ResolvedKey } from '../types';
+import type * as types from '../types';
 /** Combination of JWS Verification options and JWT Claims Set verification options. */
-export interface JWTVerifyOptions extends VerifyOptions, JWTClaimVerificationOptions {
+export interface JWTVerifyOptions extends types.VerifyOptions, types.JWTClaimVerificationOptions {
 }
 /**
  * Interface for JWT Verification dynamic key resolution. No token components have been verified at
@@ -8,7 +8,7 @@ export interface JWTVerifyOptions extends VerifyOptions, JWTClaimVerificationOpt
  *
  * @see {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} to verify using a remote JSON Web Key Set.
  */
-export interface JWTVerifyGetKey extends GenericGetKeyFunction<JWTHeaderParameters, FlattenedJWSInput, KeyLike | JWK | Uint8Array> {
+export interface JWTVerifyGetKey extends types.GenericGetKeyFunction<types.JWTHeaderParameters, types.FlattenedJWSInput, types.CryptoKey | types.KeyObject | types.JWK | Uint8Array> {
 }
 /**
  * Verifies the JWT format (to be a JWS Compact format), verifies the JWS signature, validates the
@@ -22,11 +22,11 @@ export interface JWTVerifyGetKey extends GenericGetKeyFunction<JWTHeaderParamete
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  * @param options JWT Decryption and JWT Claims Set validation options.
  */
-export declare function jwtVerify<PayloadType = JWTPayload>(jwt: string | Uint8Array, key: KeyLike | Uint8Array | JWK, options?: JWTVerifyOptions): Promise<JWTVerifyResult<PayloadType>>;
+export declare function jwtVerify<PayloadType = types.JWTPayload>(jwt: string | Uint8Array, key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array, options?: JWTVerifyOptions): Promise<types.JWTVerifyResult<PayloadType>>;
 /**
  * @param jwt JSON Web Token value (encoded as JWS).
  * @param getKey Function resolving a key to verify the JWT with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  * @param options JWT Decryption and JWT Claims Set validation options.
  */
-export declare function jwtVerify<PayloadType = JWTPayload, KeyLikeType extends KeyLike = KeyLike>(jwt: string | Uint8Array, getKey: JWTVerifyGetKey, options?: JWTVerifyOptions): Promise<JWTVerifyResult<PayloadType> & ResolvedKey<KeyLikeType>>;
+export declare function jwtVerify<PayloadType = types.JWTPayload>(jwt: string | Uint8Array, getKey: JWTVerifyGetKey, options?: JWTVerifyOptions): Promise<types.JWTVerifyResult<PayloadType> & types.ResolvedKey>;

package/dist/types/key/export.d.ts

@@ -1,30 +1,28 @@
-import type { JWK, KeyLike } from '../types';
+import type * as types from '../types';
 /**
- * Exports a runtime-specific public key representation ({@link !KeyObject} or {@link !CryptoKey}) to
- * a PEM-encoded SPKI string format.
+ * Exports a public {@link !CryptoKey} or {@link !KeyObject} to a PEM-encoded SPKI string format.
  *
  * This function is exported (as a named export) from the main `'jose'` module entry point as well
  * as from its subpath export `'jose/key/export'`.
  *
- * @param key Key representation to transform to a PEM-encoded SPKI string format.
+ * @param key Key to export to a PEM-encoded SPKI string format.
  */
-export declare function exportSPKI(key: KeyLike): Promise<string>;
+export declare function exportSPKI(key: types.CryptoKey | types.KeyObject): Promise<string>;
 /**
- * Exports a runtime-specific private key representation ({@link !KeyObject} or {@link !CryptoKey}) to
- * a PEM-encoded PKCS8 string format.
+ * Exports a private {@link !CryptoKey} or {@link !KeyObject} to a PEM-encoded PKCS8 string format.
  *
  * This function is exported (as a named export) from the main `'jose'` module entry point as well
  * as from its subpath export `'jose/key/export'`.
  *
- * @param key Key representation to transform to a PEM-encoded PKCS8 string format.
+ * @param key Key to export to a PEM-encoded PKCS8 string format.
  */
-export declare function exportPKCS8(key: KeyLike): Promise<string>;
+export declare function exportPKCS8(key: types.CryptoKey | types.KeyObject): Promise<string>;
 /**
- * Exports a runtime-specific key representation (KeyLike) to a JWK.
+ * Exports a {@link !CryptoKey}, {@link !KeyObject}, or {@link !Uint8Array} to a JWK.
  *
  * This function is exported (as a named export) from the main `'jose'` module entry point as well
  * as from its subpath export `'jose/key/export'`.
  *
- * @param key Key representation to export as JWK.
+ * @param key Key to export as JWK.
  */
-export declare function exportJWK(key: KeyLike | Uint8Array): Promise<JWK>;
+export declare function exportJWK(key: types.CryptoKey | types.KeyObject | Uint8Array): Promise<types.JWK>;

package/dist/types/key/generate_key_pair.d.ts

@@ -1,9 +1,9 @@
-import type { KeyLike } from '../types';
-export interface GenerateKeyPairResult<KeyLikeType extends KeyLike = KeyLike> {
+import type * as types from '../types';
+export interface GenerateKeyPairResult {
     /** The generated Private Key. */
-    privateKey: KeyLikeType;
+    privateKey: types.CryptoKey;
     /** Public Key corresponding to the generated Private Key. */
-    publicKey: KeyLikeType;
+    publicKey: types.CryptoKey;
 }
 export interface GenerateKeyPairOptions {
     /**
@@ -17,8 +17,7 @@ export interface GenerateKeyPairOptions {
      */
     modulusLength?: number;
     /**
-     * (Only effective in Web Crypto API runtimes) The value to use as
-     * {@link !SubtleCrypto.generateKey} `extractable` argument. Default is false.
+     * The value to use as {@link !SubtleCrypto.generateKey} `extractable` argument. Default is false.
      *
      */
     extractable?: boolean;
@@ -27,14 +26,14 @@ export interface GenerateKeyPairOptions {
  * Generates a private and a public key for a given JWA algorithm identifier. This can only generate
  * asymmetric key pairs. For symmetric secrets use the `generateSecret` function.
  *
- * Note: Under Web Crypto API runtime the `privateKey` is generated with `extractable` set to
- * `false` by default. See {@link GenerateKeyPairOptions.extractable} to generate an extractable
- * `privateKey`.
+ * Note: The `privateKey` is generated with `extractable` set to `false` by default. See
+ * {@link GenerateKeyPairOptions.extractable} to generate an extractable `privateKey`.
  *
  * This function is exported (as a named export) from the main `'jose'` module entry point as well
  * as from its subpath export `'jose/generate/keypair'`.
  *
- * @param alg JWA Algorithm Identifier to be used with the generated key pair.
+ * @param alg JWA Algorithm Identifier to be used with the generated key pair. See
+ *   {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}.
  * @param options Additional options passed down to the key pair generation.
  */
-export declare function generateKeyPair<KeyLikeType extends KeyLike = KeyLike>(alg: string, options?: GenerateKeyPairOptions): Promise<GenerateKeyPairResult<KeyLikeType>>;
+export declare function generateKeyPair(alg: string, options?: GenerateKeyPairOptions): Promise<GenerateKeyPairResult>;

package/dist/types/key/generate_secret.d.ts

@@ -1,21 +1,18 @@
-import type { KeyLike } from '../types';
+import type * as types from '../types';
 export interface GenerateSecretOptions {
-    /**
-     * (Only effective in Web Crypto API runtimes) The value to use as
-     * {@link !SubtleCrypto.generateKey} `extractable` argument. Default is false.
-     */
+    /** The value to use as {@link !SubtleCrypto.generateKey} `extractable` argument. Default is false. */
     extractable?: boolean;
 }
 /**
  * Generates a symmetric secret key for a given JWA algorithm identifier.
  *
- * Note: Under Web Crypto API runtime the secret key is generated with `extractable` set to `false`
- * by default.
+ * Note: The secret key is generated with `extractable` set to `false` by default.
  *
  * This function is exported (as a named export) from the main `'jose'` module entry point as well
  * as from its subpath export `'jose/generate/secret'`.
  *
- * @param alg JWA Algorithm Identifier to be used with the generated secret.
+ * @param alg JWA Algorithm Identifier to be used with the generated secret. See
+ *   {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}.
  * @param options Additional options passed down to the secret generation.
  */
-export declare function generateSecret<KeyLikeType extends KeyLike = KeyLike>(alg: string, options?: GenerateSecretOptions): Promise<KeyLikeType | Uint8Array>;
+export declare function generateSecret(alg: string, options?: GenerateSecretOptions): Promise<types.CryptoKey | Uint8Array>;

package/dist/types/key/import.d.ts

@@ -1,14 +1,13 @@
-import type { JWK, KeyLike } from '../types';
-export interface PEMImportOptions {
+import type * as types from '../types';
+export interface KeyImportOptions {
     /**
-     * (Only effective in Web Crypto API runtimes) The value to use as {@link !SubtleCrypto.importKey}
-     * `extractable` argument. Default is false.
+     * The value to use as {@link !SubtleCrypto.importKey} `extractable` argument. Default is false for
+     * private and secret keys, true otherwise.
      */
     extractable?: boolean;
 }
 /**
- * Imports a PEM-encoded SPKI string as a runtime-specific public key representation
- * ({@link !KeyObject} or {@link !CryptoKey}).
+ * Imports a PEM-encoded SPKI string as a {@link !CryptoKey}.
  *
  * Note: The OID id-RSASSA-PSS (1.2.840.113549.1.1.10) is not supported in
  * {@link https://w3c.github.io/webcrypto/ Web Cryptography API}, use the OID rsaEncryption
@@ -18,14 +17,12 @@ export interface PEMImportOptions {
  * as from its subpath export `'jose/key/import'`.
  *
  * @param spki PEM-encoded SPKI string
- * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used
- *   with the imported key, its presence is only enforced in Web Crypto API runtimes. See
+ * @param alg JSON Web Algorithm identifier to be used with the imported key. See
  *   {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}.
  */
-export declare function importSPKI<KeyLikeType extends KeyLike = KeyLike>(spki: string, alg: string, options?: PEMImportOptions): Promise<KeyLikeType>;
+export declare function importSPKI(spki: string, alg: string, options?: KeyImportOptions): Promise<types.CryptoKey>;
 /**
- * Imports the SPKI from an X.509 string certificate as a runtime-specific public key representation
- * ({@link !KeyObject} or {@link !CryptoKey}).
+ * Imports the SPKI from an X.509 string certificate as a {@link !CryptoKey}.
  *
  * Note: The OID id-RSASSA-PSS (1.2.840.113549.1.1.10) is not supported in
  * {@link https://w3c.github.io/webcrypto/ Web Cryptography API}, use the OID rsaEncryption
@@ -35,14 +32,12 @@ export declare function importSPKI<KeyLikeType extends KeyLike = KeyLike>(spki:
  * as from its subpath export `'jose/key/import'`.
  *
  * @param x509 X.509 certificate string
- * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used
- *   with the imported key, its presence is only enforced in Web Crypto API runtimes. See
+ * @param alg JSON Web Algorithm identifier to be used with the imported key. See
  *   {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}.
  */
-export declare function importX509<KeyLikeType extends KeyLike = KeyLike>(x509: string, alg: string, options?: PEMImportOptions): Promise<KeyLikeType>;
+export declare function importX509(x509: string, alg: string, options?: KeyImportOptions): Promise<types.CryptoKey>;
 /**
- * Imports a PEM-encoded PKCS#8 string as a runtime-specific private key representation
- * ({@link !KeyObject} or {@link !CryptoKey}).
+ * Imports a PEM-encoded PKCS#8 string as a {@link !CryptoKey}.
  *
  * Note: The OID id-RSASSA-PSS (1.2.840.113549.1.1.10) is not supported in
  * {@link https://w3c.github.io/webcrypto/ Web Cryptography API}, use the OID rsaEncryption
@@ -52,25 +47,23 @@ export declare function importX509<KeyLikeType extends KeyLike = KeyLike>(x509:
  * as from its subpath export `'jose/key/import'`.
  *
  * @param pkcs8 PEM-encoded PKCS#8 string
- * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used
- *   with the imported key, its presence is only enforced in Web Crypto API runtimes. See
+ * @param alg JSON Web Algorithm identifier to be used with the imported key. See
  *   {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}.
  */
-export declare function importPKCS8<KeyLikeType extends KeyLike = KeyLike>(pkcs8: string, alg: string, options?: PEMImportOptions): Promise<KeyLikeType>;
+export declare function importPKCS8(pkcs8: string, alg: string, options?: KeyImportOptions): Promise<types.CryptoKey>;
 /**
- * Imports a JWK to a runtime-specific key representation (KeyLike). Either the JWK "alg"
- * (Algorithm) Parameter, or the optional "alg" argument, must be present.
+ * Imports a JWK to a {@link !CryptoKey}. Either the JWK "alg" (Algorithm) Parameter, or the optional
+ * "alg" argument, must be present.
  *
- * Note: When the runtime is using {@link https://w3c.github.io/webcrypto/ Web Cryptography API} the
- * jwk parameters "use", "key_ops", and "ext" are also used in the resulting {@link !CryptoKey}.
+ * Note: The JSON Web Key parameters "use", "key_ops", and "ext" are also used in the
+ * {@link !CryptoKey} import process.
  *
  * This function is exported (as a named export) from the main `'jose'` module entry point as well
  * as from its subpath export `'jose/key/import'`.
  *
  * @param jwk JSON Web Key.
- * @param alg (Only effective in Web Crypto API runtimes) JSON Web Algorithm identifier to be used
- *   with the imported key. Default is the "alg" property on the JWK, its presence is only enforced
- *   in Web Crypto API runtimes. See
+ * @param alg JSON Web Algorithm identifier to be used with the imported key. Default is the "alg"
+ *   property on the JWK. See
  *   {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}.
  */
-export declare function importJWK<KeyLikeType extends KeyLike = KeyLike>(jwk: JWK, alg?: string): Promise<KeyLikeType | Uint8Array>;
+export declare function importJWK(jwk: types.JWK, alg?: string, options?: KeyImportOptions): Promise<types.CryptoKey | Uint8Array>;

package/dist/types/types.d.ts

@@ -1,27 +1,3 @@
-/**
- * KeyLike are runtime-specific classes representing asymmetric keys or symmetric secrets. These are
- * instances of {@link !CryptoKey} and additionally {@link !KeyObject} in Node.js runtime.
- * {@link !Uint8Array} instances are also accepted as symmetric secret representation only.
- *
- * {@link key/import Key Import Functions} can be used to import PEM, or JWK formatted asymmetric
- * keys and certificates to these runtime-specific representations.
- *
- * In Node.js the {@link !Buffer} class is a subclass of {@link !Uint8Array} and so {@link !Buffer} can
- * be provided for symmetric secrets as well.
- *
- * {@link !KeyObject} is a representation of a key/secret available in the Node.js runtime. In
- * addition to the {@link key/import Key Import Functions} you may use the runtime APIs
- * {@link !createPublicKey}, {@link !createPrivateKey}, and {@link !createSecretKey} to obtain a
- * {@link !KeyObject} from your existing key material.
- *
- * {@link !CryptoKey} is a representation of a key/secret available in the Browser and
- * Web-interoperable runtimes. In addition to the {@link key/import Key Import Functions} you may use
- * the {@link !SubtleCrypto.importKey} API to obtain a {@link !CryptoKey} from your existing key
- * material.
- *
- */
-export type KeyLike = { type: string }
-
 /** Generic JSON Web Key Parameters. */
 export interface JWKParameters {
   /** JWK "kty" (Key Type) Parameter */
@@ -96,16 +72,6 @@ export interface JWK_RSA_Private extends JWK_RSA_Public, JWKParameters {
   dp: string
   /** RSA JWK "dq" (Second Factor CRT Exponent) Parameter */
   dq: string
-  /**
-   * RSA JWK "oth" (Other Primes Info) Parameter
-   *
-   * This parameter is not supported
-   */
-  oth?: Array<{
-    d?: string
-    r?: string
-    t?: string
-  }>
   /** RSA JWK "p" (First Prime Factor) Parameter */
   p: string
   /** RSA JWK "q" (Second Prime Factor) Parameter */
@@ -154,16 +120,6 @@ export interface JWK extends JWKParameters {
   k?: string
   /** RSA JWK "n" (Modulus) Parameter */
   n?: string
-  /**
-   * Private RSA JWK "oth" (Other Primes Info) Parameter
-   *
-   * This parameter is not supported
-   */
-  oth?: Array<{
-    d?: string
-    r?: string
-    t?: string
-  }>
   /** Private RSA JWK "p" (First Prime Factor) Parameter */
   p?: string
   /** Private RSA JWK "q" (Second Prime Factor) Parameter */
@@ -204,7 +160,11 @@ export interface GenericGetKeyFunction<IProtectedHeader, IToken, ReturnKeyTypes>
  * @param IToken Type definition of the consumed JWE or JWS token.
  */
 export interface GetKeyFunction<IProtectedHeader, IToken>
-  extends GenericGetKeyFunction<IProtectedHeader, IToken, KeyLike | Uint8Array> {}
+  extends GenericGetKeyFunction<
+    IProtectedHeader,
+    IToken,
+    CryptoKey | KeyObject | JWK | Uint8Array
+  > {}
 
 /**
  * Flattened JWS definition for verify function inputs, allows payload as {@link !Uint8Array} for
@@ -344,7 +304,7 @@ export interface JWEKeyManagementHeaderParameters {
    * @deprecated You should not use this parameter. It is only really intended for test and vector
    *   validation purposes.
    */
-  epk?: KeyLike
+  epk?: CryptoKey | KeyObject
 }
 
 /** Flattened JWE definition. */
@@ -499,10 +459,13 @@ export interface JWTClaimVerificationOptions {
   audience?: string | string[]
 
   /**
-   * Expected clock tolerance
+   * Clock skew tolerance
    *
    * - In seconds when number (e.g. 5)
-   * - Parsed as seconds when a string (e.g. "5 seconds", "10 minutes", "2 hours").
+   * - Resolved into a number of seconds when a string (e.g. "5 seconds", "10 minutes", "2 hours").
+   *
+   * Used when validating the JWT "nbf" (Not Before) and "exp" (Expiration Time) claims, and when
+   * validating the "iat" (Issued At) claim if the {@link maxTokenAge `maxTokenAge` option} is set.
    */
   clockTolerance?: string | number
 
@@ -517,7 +480,7 @@ export interface JWTClaimVerificationOptions {
    * Maximum time elapsed (in seconds) from the JWT "iat" (Issued At) Claim value.
    *
    * - In seconds when number (e.g. 5)
-   * - Parsed as seconds when a string (e.g. "5 seconds", "10 minutes", "2 hours").
+   * - Resolved into a number of seconds when a string (e.g. "5 seconds", "10 minutes", "2 hours").
    *
    * This option makes the JWT "iat" (Issued At) Claim presence required.
    */
@@ -542,13 +505,11 @@ export interface JWTClaimVerificationOptions {
 
   /**
    * Array of required Claim Names that must be present in the JWT Claims Set. Default is that: if
-   * the {@link JWTClaimVerificationOptions.issuer `issuer` option} is set, then JWT "iss" (Issuer)
-   * Claim must be present; if the {@link JWTClaimVerificationOptions.audience `audience` option} is
-   * set, then JWT "aud" (Audience) Claim must be present; if the
-   * {@link JWTClaimVerificationOptions.subject `subject` option} is set, then JWT "sub" (Subject)
-   * Claim must be present; if the
-   * {@link JWTClaimVerificationOptions.maxTokenAge `maxTokenAge` option} is set, then JWT "iat"
-   * (Issued At) Claim must be present.
+   * the {@link issuer `issuer` option} is set, then JWT "iss" (Issuer) Claim must be present; if the
+   * {@link audience `audience` option} is set, then JWT "aud" (Audience) Claim must be present; if
+   * the {@link subject `subject` option} is set, then JWT "sub" (Subject) Claim must be present; if
+   * the {@link maxTokenAge `maxTokenAge` option} is set, then JWT "iat" (Issued At) Claim must be
+   * present.
    */
   requiredClaims?: string[]
 }
@@ -686,9 +647,9 @@ export interface JWTDecryptResult<PayloadType = JWTPayload> {
   protectedHeader: CompactJWEHeaderParameters
 }
 
-export interface ResolvedKey<KeyLikeType extends KeyLike = KeyLike> {
+export interface ResolvedKey {
   /** Key resolved from the key resolver function. */
-  key: KeyLikeType | Uint8Array
+  key: CryptoKey | Uint8Array
 }
 
 /** Recognized Compact JWS Header Parameters, any other Header Members may also be present. */
@@ -712,4 +673,22 @@ export interface JSONWebKeySet {
   keys: JWK[]
 }
 
-export type CryptoRuntime = 'WebCryptoAPI' | 'node:crypto'
+/**
+ * {@link !KeyObject} is a representation of a key/secret available in the Node.js runtime. You may
+ * use the Node.js runtime APIs {@link !createPublicKey}, {@link !createPrivateKey}, and
+ * {@link !createSecretKey} to obtain a {@link !KeyObject} from your existing key material.
+ */
+export interface KeyObject {
+  type: string
+}
+
+/**
+ * {@link !CryptoKey} is a representation of a key/secret available in all supported runtimes. In
+ * addition to the {@link key/import Key Import Functions} you may use the
+ * {@link !SubtleCrypto.importKey} API to obtain a {@link !CryptoKey} from your existing key
+ * material.
+ */
+export type CryptoKey = Extract<
+  Awaited<ReturnType<typeof crypto.subtle.generateKey>>,
+  { type: string }
+>

package/dist/types/util/decode_jwt.d.ts

@@ -1,4 +1,4 @@
-import type { JWTPayload } from '../types';
+import type * as types from '../types';
 /**
  * Decodes a signed JSON Web Token payload. This does not validate the JWT Claims Set types or
  * values. This does not validate the JWS Signature. For a proper Signed JWT Claims Set validation
@@ -10,4 +10,4 @@ import type { JWTPayload } from '../types';
  *
  * @param jwt JWT token in compact JWS serialization.
  */
-export declare function decodeJwt<PayloadType = JWTPayload>(jwt: string): PayloadType & JWTPayload;
+export declare function decodeJwt<PayloadType = types.JWTPayload>(jwt: string): PayloadType & types.JWTPayload;