jose 6.0.6 → 6.0.7

package/dist/types/key/generate_secret.d.ts

@@ -6,7 +6,12 @@
 import type * as types from '../types.d.ts';
 /** Secret generation function options. */
 export interface GenerateSecretOptions {
-    /** The value to use as {@link !SubtleCrypto.generateKey} `extractable` argument. Default is false. */
+    /**
+     * The value to use as {@link !SubtleCrypto.generateKey} `extractable` argument. Default is false.
+     *
+     * Note: Because A128CBC-HS256, A192CBC-HS384, and A256CBC-HS512 secrets cannot be represented as
+     * {@link !CryptoKey} this option has no effect for them.
+     */
     extractable?: boolean;
 }
 /**
@@ -14,6 +19,9 @@ export interface GenerateSecretOptions {
  *
  * Note: The secret key is generated with `extractable` set to `false` by default.
  *
+ * Note: Because A128CBC-HS256, A192CBC-HS384, and A256CBC-HS512 secrets cannot be represented as
+ * {@link !CryptoKey} this method yields a {@link !Uint8Array} for them instead.
+ *
  * This function is exported (as a named export) from the main `'jose'` module entry point as well
  * as from its subpath export `'jose/generate/secret'`.
  *

package/dist/types/key/import.d.ts

@@ -8,7 +8,7 @@ import type * as types from '../types.d.ts';
 export interface KeyImportOptions {
     /**
      * The value to use as {@link !SubtleCrypto.importKey} `extractable` argument. Default is false for
-     * private and secret keys, true otherwise.
+     * private keys, true otherwise.
      */
     extractable?: boolean;
 }
@@ -59,11 +59,14 @@ export declare function importX509(x509: string, alg: string, options?: KeyImpor
 export declare function importPKCS8(pkcs8: string, alg: string, options?: KeyImportOptions): Promise<types.CryptoKey>;
 /**
  * Imports a JWK to a {@link !CryptoKey}. Either the JWK "alg" (Algorithm) Parameter, or the optional
- * "alg" argument, must be present.
+ * "alg" argument, must be present for asymmetric JSON Web Key imports.
  *
  * Note: The JSON Web Key parameters "use", "key_ops", and "ext" are also used in the
  * {@link !CryptoKey} import process.
  *
+ * Note: Symmetric JSON Web Keys (i.e. `kty: "oct"`) yield back an {@link !Uint8Array} instead of a
+ * {@link !CryptoKey}.
+ *
  * This function is exported (as a named export) from the main `'jose'` module entry point as well
  * as from its subpath export `'jose/key/import'`.
  *

package/dist/webapi/jwks/remote.js

@@ -9,16 +9,16 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v6.0.6';
+    const VERSION = 'v6.0.7';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const customFetch = Symbol();
-async function fetchJwks(url, options) {
-    const response = await (options?.[customFetch] || fetch)(url, {
+async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
+    const response = await fetchImpl(url, {
         method: 'GET',
-        signal: options.signal,
+        signal,
         redirect: 'manual',
-        headers: options.headers,
+        headers,
     }).catch((err) => {
         if (err.name === 'TimeoutError') {
             throw new JWKSTimeout();
@@ -58,7 +58,8 @@ class RemoteJWKSet {
     _cacheMaxAge;
     _jwksTimestamp;
     _pendingFetch;
-    _options;
+    _headers;
+    [customFetch];
     _local;
     _cache;
     constructor(url, options) {
@@ -66,12 +67,20 @@ class RemoteJWKSet {
             throw new TypeError('url must be an instance of URL');
         }
         this._url = new URL(url.href);
-        this._options = { headers: options?.headers };
         this._timeoutDuration =
             typeof options?.timeoutDuration === 'number' ? options?.timeoutDuration : 5000;
         this._cooldownDuration =
             typeof options?.cooldownDuration === 'number' ? options?.cooldownDuration : 30000;
         this._cacheMaxAge = typeof options?.cacheMaxAge === 'number' ? options?.cacheMaxAge : 600000;
+        this._headers = new Headers(options?.headers);
+        if (USER_AGENT && !this._headers.has('User-Agent')) {
+            this._headers.set('User-Agent', USER_AGENT);
+        }
+        if (!this._headers.has('accept')) {
+            this._headers.set('accept', 'application/json');
+            this._headers.append('accept', 'application/jwk-set+json');
+        }
+        this[customFetch] = options?.[customFetch];
         if (options?.[jwksCache] !== undefined) {
             this._cache = options?.[jwksCache];
             if (isFreshJwksCache(options?.[jwksCache], this._cacheMaxAge)) {
@@ -111,19 +120,7 @@ class RemoteJWKSet {
         if (this._pendingFetch && isCloudflareWorkers()) {
             this._pendingFetch = undefined;
         }
-        const headers = new Headers(this._options.headers);
-        if (USER_AGENT && !headers.has('User-Agent')) {
-            headers.set('User-Agent', USER_AGENT);
-            this._options.headers = Object.fromEntries(headers.entries());
-        }
-        if (!headers.has('accept')) {
-            headers.set('accept', 'application/json');
-            headers.append('accept', 'application/jwk-set+json');
-        }
-        this._pendingFetch ||= fetchJwks(this._url.href, {
-            headers,
-            signal: AbortSignal.timeout(this._timeoutDuration),
-        })
+        this._pendingFetch ||= fetchJwks(this._url.href, this._headers, AbortSignal.timeout(this._timeoutDuration), this[customFetch])
             .then((json) => {
             this._local = createLocalJWKSet(json);
             if (this._cache) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "6.0.6",
+  "version": "6.0.7",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "browser",