refactor(types): improve key and result inference

Thread resolver return types through verify and decrypt results. Add
overloads so wrappers can forward either keys or resolvers.

Infer importJWK and generateSecret results from their inputs. Keep JWT
payload generics unconstrained while rejecting known non-object shapes.

Signed-off-by: Filip Skokan <[email protected]>

docs/jwe/compact/decrypt/functions/compactDecrypt.md

@@ -18,7 +18,7 @@ as from its subpath export `'jose/jwe/compact/decrypt'`.
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
 | `jwe` | `string` \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) | Compact JWE. |
-| `key` | [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md) | Private Key or Secret to decrypt the JWE with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
+| `key` | [`KeyInput`](../../../../types/type-aliases/KeyInput.md) | Private Key or Secret to decrypt the JWE with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
 | `options?` | [`DecryptOptions`](../../../../types/interfaces/DecryptOptions.md) | JWE Decryption options. |
 
 ### Returns
@@ -39,16 +39,45 @@ console.log(new TextDecoder().decode(plaintext))
 
 ## Call Signature
 
-▸ **compactDecrypt**(`jwe`, `getKey`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`CompactDecryptResult`](../../../../types/interfaces/CompactDecryptResult.md) & [`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\>
+▸ **compactDecrypt**\<`KeyType`\>(`jwe`, `getKey`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`CompactDecryptResult`](../../../../types/interfaces/CompactDecryptResult.md) & [`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\<`KeyType`\>\>
+
+Decrypts a Compact JWE, resolving the key dynamically. The result additionally carries the
+[resolved key](../../../../types/interfaces/ResolvedKey.md#key).
+
+### Type Parameters
+
+| Type Parameter | Default type |
+| ------ | ------ |
+| `KeyType` *extends* [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) | [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) |
 
 ### Parameters
 
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
 | `jwe` | `string` \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) | Compact JWE. |
-| `getKey` | [`CompactDecryptGetKey`](../interfaces/CompactDecryptGetKey.md) | Function resolving Private Key or Secret to decrypt the JWE with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
+| `getKey` | [`CompactDecryptGetKey`](../interfaces/CompactDecryptGetKey.md)\<`KeyType`\> | Function resolving Private Key or Secret to decrypt the JWE with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
 | `options?` | [`DecryptOptions`](../../../../types/interfaces/DecryptOptions.md) | JWE Decryption options. |
 
 ### Returns
 
-[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`CompactDecryptResult`](../../../../types/interfaces/CompactDecryptResult.md) & [`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\>
+[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`CompactDecryptResult`](../../../../types/interfaces/CompactDecryptResult.md) & [`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\<`KeyType`\>\>
+
+## Call Signature
+
+▸ **compactDecrypt**(`jwe`, `key`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`CompactDecryptResult`](../../../../types/interfaces/CompactDecryptResult.md) & [`Partial`](https://www.typescriptlang.org/docs/handbook/utility-types.html#partialtype)\<[`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\>\>\>
+
+Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
+either a key or a key resolution function; `key` is present on the result only when a resolution
+function was used.
+
+### Parameters
+
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
+| `jwe` | `string` \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) | Compact JWE. |
+| `key` | [`KeyInput`](../../../../types/type-aliases/KeyInput.md) \| [`CompactDecryptGetKey`](../interfaces/CompactDecryptGetKey.md)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\> | Private Key or Secret, or a function resolving one, to decrypt the JWE with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
+| `options?` | [`DecryptOptions`](../../../../types/interfaces/DecryptOptions.md) | JWE Decryption options. |
+
+### Returns
+
+[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`CompactDecryptResult`](../../../../types/interfaces/CompactDecryptResult.md) & [`Partial`](https://www.typescriptlang.org/docs/handbook/utility-types.html#partialtype)\<[`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\>\>\>

docs/jwe/compact/decrypt/interfaces/CompactDecryptGetKey.md

@@ -1,4 +1,4 @@
-# Interface: CompactDecryptGetKey()
+# Interface: CompactDecryptGetKey()\<KeyType\>
 
 ## [💗 Help the project](https://github.com/sponsors/panva)
 
@@ -7,7 +7,13 @@ Support from the community to continue maintaining and improving this module is
 Interface for Compact JWE Decryption dynamic key resolution. No token components have been
 verified at the time of this function call.
 
-▸ **CompactDecryptGetKey**(`protectedHeader`, `token`): [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md)\>
+## Type Parameters
+
+| Type Parameter | Default type |
+| ------ | ------ |
+| `KeyType` *extends* [`CryptoKey`](../../../../types/type-aliases/CryptoKey.md) \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) | [`CryptoKey`](../../../../types/type-aliases/CryptoKey.md) \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) |
+
+▸ **CompactDecryptGetKey**(`protectedHeader`, `token`): [`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| `KeyType` \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| `KeyType`\>
 
 Dynamic key resolution function. No token components have been verified at the time of this
 function call.
@@ -23,4 +29,4 @@ If a suitable key for the token cannot be matched, throw an error instead.
 
 ## Returns
 
-[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md)\>
+[`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| `KeyType` \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| `KeyType`\>

docs/jwe/compact/encrypt/classes/CompactEncrypt.md

@@ -51,7 +51,7 @@ Encrypts and resolves the value of the Compact JWE string.
 
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
-| `key` | [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md) | Public Key or Secret to encrypt the JWE with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
+| `key` | [`KeyInput`](../../../../types/type-aliases/KeyInput.md) | Public Key or Secret to encrypt the JWE with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
 | `options?` | [`EncryptOptions`](../../../../types/interfaces/EncryptOptions.md) | JWE Encryption options. |
 
 #### Returns

docs/jwe/flattened/decrypt/functions/flattenedDecrypt.md

@@ -18,7 +18,7 @@ as from its subpath export `'jose/jwe/flattened/decrypt'`.
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
 | `jwe` | [`FlattenedJWE`](../../../../types/interfaces/FlattenedJWE.md) | Flattened JWE. |
-| `key` | [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md) | Private Key or Secret to decrypt the JWE with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
+| `key` | [`KeyInput`](../../../../types/type-aliases/KeyInput.md) | Private Key or Secret to decrypt the JWE with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
 | `options?` | [`DecryptOptions`](../../../../types/interfaces/DecryptOptions.md) | JWE Decryption options. |
 
 ### Returns
@@ -49,16 +49,45 @@ console.log(decoder.decode(additionalAuthenticatedData))
 
 ## Call Signature
 
-▸ **flattenedDecrypt**(`jwe`, `getKey`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`FlattenedDecryptResult`](../../../../types/interfaces/FlattenedDecryptResult.md) & [`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\>
+▸ **flattenedDecrypt**\<`KeyType`\>(`jwe`, `getKey`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`FlattenedDecryptResult`](../../../../types/interfaces/FlattenedDecryptResult.md) & [`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\<`KeyType`\>\>
+
+Decrypts a Flattened JWE, resolving the key dynamically. The result additionally carries the
+[resolved key](../../../../types/interfaces/ResolvedKey.md#key).
+
+### Type Parameters
+
+| Type Parameter | Default type |
+| ------ | ------ |
+| `KeyType` *extends* [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) | [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) |
 
 ### Parameters
 
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
 | `jwe` | [`FlattenedJWE`](../../../../types/interfaces/FlattenedJWE.md) | Flattened JWE. |
-| `getKey` | [`FlattenedDecryptGetKey`](../interfaces/FlattenedDecryptGetKey.md) | Function resolving Private Key or Secret to decrypt the JWE with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
+| `getKey` | [`FlattenedDecryptGetKey`](../interfaces/FlattenedDecryptGetKey.md)\<`KeyType`\> | Function resolving Private Key or Secret to decrypt the JWE with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
 | `options?` | [`DecryptOptions`](../../../../types/interfaces/DecryptOptions.md) | JWE Decryption options. |
 
 ### Returns
 
-[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`FlattenedDecryptResult`](../../../../types/interfaces/FlattenedDecryptResult.md) & [`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\>
+[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`FlattenedDecryptResult`](../../../../types/interfaces/FlattenedDecryptResult.md) & [`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\<`KeyType`\>\>
+
+## Call Signature
+
+▸ **flattenedDecrypt**(`jwe`, `key`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`FlattenedDecryptResult`](../../../../types/interfaces/FlattenedDecryptResult.md) & [`Partial`](https://www.typescriptlang.org/docs/handbook/utility-types.html#partialtype)\<[`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\>\>\>
+
+Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
+either a key or a key resolution function; `key` is present on the result only when a resolution
+function was used.
+
+### Parameters
+
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
+| `jwe` | [`FlattenedJWE`](../../../../types/interfaces/FlattenedJWE.md) | Flattened JWE. |
+| `key` | [`KeyInput`](../../../../types/type-aliases/KeyInput.md) \| [`FlattenedDecryptGetKey`](../interfaces/FlattenedDecryptGetKey.md)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\> | Private Key or Secret, or a function resolving one, to decrypt the JWE with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
+| `options?` | [`DecryptOptions`](../../../../types/interfaces/DecryptOptions.md) | JWE Decryption options. |
+
+### Returns
+
+[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`FlattenedDecryptResult`](../../../../types/interfaces/FlattenedDecryptResult.md) & [`Partial`](https://www.typescriptlang.org/docs/handbook/utility-types.html#partialtype)\<[`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\>\>\>

docs/jwe/flattened/decrypt/interfaces/FlattenedDecryptGetKey.md

@@ -1,4 +1,4 @@
-# Interface: FlattenedDecryptGetKey()
+# Interface: FlattenedDecryptGetKey()\<KeyType\>
 
 ## [💗 Help the project](https://github.com/sponsors/panva)
 
@@ -7,7 +7,13 @@ Support from the community to continue maintaining and improving this module is
 Interface for Flattened JWE Decryption dynamic key resolution. No token components have been
 verified at the time of this function call.
 
-▸ **FlattenedDecryptGetKey**(`protectedHeader`, `token`): [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md)\>
+## Type Parameters
+
+| Type Parameter | Default type |
+| ------ | ------ |
+| `KeyType` *extends* [`CryptoKey`](../../../../types/type-aliases/CryptoKey.md) \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) | [`CryptoKey`](../../../../types/type-aliases/CryptoKey.md) \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) |
+
+▸ **FlattenedDecryptGetKey**(`protectedHeader`, `token`): [`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| `KeyType` \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| `KeyType`\>
 
 Dynamic key resolution function. No token components have been verified at the time of this
 function call.
@@ -23,4 +29,4 @@ If a suitable key for the token cannot be matched, throw an error instead.
 
 ## Returns
 
-[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md)\>
+[`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| `KeyType` \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| `KeyType`\>

docs/jwe/flattened/encrypt/classes/FlattenedEncrypt.md

@@ -52,7 +52,7 @@ Encrypts and resolves the value of the Flattened JWE object.
 
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
-| `key` | [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md) | Public Key or Secret to encrypt the JWE with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
+| `key` | [`KeyInput`](../../../../types/type-aliases/KeyInput.md) | Public Key or Secret to encrypt the JWE with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
 | `options?` | [`EncryptOptions`](../../../../types/interfaces/EncryptOptions.md) | JWE Encryption options. |
 
 #### Returns

docs/jwe/general/decrypt/functions/generalDecrypt.md

@@ -25,7 +25,7 @@ as from its subpath export `'jose/jwe/general/decrypt'`.
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
 | `jwe` | [`GeneralJWE`](../../../../types/interfaces/GeneralJWE.md) | General JWE. |
-| `key` | [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md) | Private Key or Secret to decrypt the JWE with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
+| `key` | [`KeyInput`](../../../../types/type-aliases/KeyInput.md) | Private Key or Secret to decrypt the JWE with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
 | `options?` | [`DecryptOptions`](../../../../types/interfaces/DecryptOptions.md) | JWE Decryption options. |
 
 ### Returns
@@ -60,16 +60,45 @@ console.log(decoder.decode(additionalAuthenticatedData))
 
 ## Call Signature
 
-▸ **generalDecrypt**(`jwe`, `getKey`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`GeneralDecryptResult`](../../../../types/interfaces/GeneralDecryptResult.md) & [`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\>
+▸ **generalDecrypt**\<`KeyType`\>(`jwe`, `getKey`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`GeneralDecryptResult`](../../../../types/interfaces/GeneralDecryptResult.md) & [`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\<`KeyType`\>\>
+
+Decrypts a General JWE, resolving the key dynamically. The result additionally carries the
+[resolved key](../../../../types/interfaces/ResolvedKey.md#key).
+
+### Type Parameters
+
+| Type Parameter | Default type |
+| ------ | ------ |
+| `KeyType` *extends* [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) | [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) |
 
 ### Parameters
 
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
 | `jwe` | [`GeneralJWE`](../../../../types/interfaces/GeneralJWE.md) | General JWE. |
-| `getKey` | [`GeneralDecryptGetKey`](../interfaces/GeneralDecryptGetKey.md) | Function resolving Private Key or Secret to decrypt the JWE with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
+| `getKey` | [`GeneralDecryptGetKey`](../interfaces/GeneralDecryptGetKey.md)\<`KeyType`\> | Function resolving Private Key or Secret to decrypt the JWE with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
 | `options?` | [`DecryptOptions`](../../../../types/interfaces/DecryptOptions.md) | JWE Decryption options. |
 
 ### Returns
 
-[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`GeneralDecryptResult`](../../../../types/interfaces/GeneralDecryptResult.md) & [`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\>
+[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`GeneralDecryptResult`](../../../../types/interfaces/GeneralDecryptResult.md) & [`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\<`KeyType`\>\>
+
+## Call Signature
+
+▸ **generalDecrypt**(`jwe`, `key`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`GeneralDecryptResult`](../../../../types/interfaces/GeneralDecryptResult.md) & [`Partial`](https://www.typescriptlang.org/docs/handbook/utility-types.html#partialtype)\<[`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\>\>\>
+
+Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
+either a key or a key resolution function; `key` is present on the result only when a resolution
+function was used.
+
+### Parameters
+
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
+| `jwe` | [`GeneralJWE`](../../../../types/interfaces/GeneralJWE.md) | General JWE. |
+| `key` | [`KeyInput`](../../../../types/type-aliases/KeyInput.md) \| [`GeneralDecryptGetKey`](../interfaces/GeneralDecryptGetKey.md)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\> | Private Key or Secret, or a function resolving one, to decrypt the JWE with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
+| `options?` | [`DecryptOptions`](../../../../types/interfaces/DecryptOptions.md) | JWE Decryption options. |
+
+### Returns
+
+[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`GeneralDecryptResult`](../../../../types/interfaces/GeneralDecryptResult.md) & [`Partial`](https://www.typescriptlang.org/docs/handbook/utility-types.html#partialtype)\<[`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\>\>\>

docs/jwe/general/decrypt/interfaces/GeneralDecryptGetKey.md

@@ -1,4 +1,4 @@
-# Interface: GeneralDecryptGetKey()
+# Interface: GeneralDecryptGetKey()\<KeyType\>
 
 ## [💗 Help the project](https://github.com/sponsors/panva)
 
@@ -7,7 +7,13 @@ Support from the community to continue maintaining and improving this module is
 Interface for General JWE Decryption dynamic key resolution. No token components have been
 verified at the time of this function call.
 
-▸ **GeneralDecryptGetKey**(`protectedHeader`, `token`): [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md)\>
+## Type Parameters
+
+| Type Parameter | Default type |
+| ------ | ------ |
+| `KeyType` *extends* [`CryptoKey`](../../../../types/type-aliases/CryptoKey.md) \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) | [`CryptoKey`](../../../../types/type-aliases/CryptoKey.md) \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) |
+
+▸ **GeneralDecryptGetKey**(`protectedHeader`, `token`): [`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| `KeyType` \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| `KeyType`\>
 
 Dynamic key resolution function. No token components have been verified at the time of this
 function call.
@@ -23,4 +29,4 @@ If a suitable key for the token cannot be matched, throw an error instead.
 
 ## Returns
 
-[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md)\>
+[`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| `KeyType` \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| `KeyType`\>

docs/jwe/general/encrypt/classes/GeneralEncrypt.md

@@ -55,7 +55,7 @@ Adds an additional recipient for the General JWE object.
 
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
-| `key` | [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md) | Public Key or Secret to encrypt the Content Encryption Key for the recipient with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
+| `key` | [`KeyInput`](../../../../types/type-aliases/KeyInput.md) | Public Key or Secret to encrypt the Content Encryption Key for the recipient with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
 | `options?` | [`CritOption`](../../../../types/interfaces/CritOption.md) | JWE Encryption options. |
 
 #### Returns

docs/jwe/general/encrypt/interfaces/Recipient.md

@@ -10,15 +10,17 @@ Used to build General JWE object's individual recipients.
 
 ### addRecipient()
 
-▸ **addRecipient**(...`args`): `Recipient`
+▸ **addRecipient**(`key`, `options?`): `Recipient`
 
-A shorthand for calling addRecipient() on the enclosing [GeneralEncrypt](../classes/GeneralEncrypt.md) instance
+A shorthand for calling [addRecipient()](../classes/GeneralEncrypt.md#addrecipient) on the enclosing
+[GeneralEncrypt](../classes/GeneralEncrypt.md) instance.
 
 #### Parameters
 
-| Parameter | Type |
-| ------ | ------ |
-| ...`args` | \[[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md), [`CritOption`](../../../../types/interfaces/CritOption.md)\] |
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
+| `key` | [`KeyInput`](../../../../types/type-aliases/KeyInput.md) | Public Key or Secret to encrypt the Content Encryption Key for the recipient with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
+| `options?` | [`CritOption`](../../../../types/interfaces/CritOption.md) | JWE Encryption options. |
 
 #### Returns
 
@@ -40,15 +42,11 @@ Returns the enclosing [GeneralEncrypt](../classes/GeneralEncrypt.md) instance
 
 ### encrypt()
 
-▸ **encrypt**(...`args`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`GeneralJWE`](../../../../types/interfaces/GeneralJWE.md)\>
+▸ **encrypt**(): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`GeneralJWE`](../../../../types/interfaces/GeneralJWE.md)\>
 
-A shorthand for calling encrypt() on the enclosing [GeneralEncrypt](../classes/GeneralEncrypt.md) instance
-
-#### Parameters
-
-| Parameter | Type |
-| ------ | ------ |
-| ...`args` | \[\] |
+A shorthand for calling [encrypt()](../classes/GeneralEncrypt.md#encrypt) on the enclosing
+[GeneralEncrypt](../classes/GeneralEncrypt.md) instance. Takes no arguments — each recipient's key is supplied to
+[addRecipient](#addrecipient).
 
 #### Returns
 

docs/jwk/thumbprint/functions/calculateJwkThumbprint.md

@@ -15,7 +15,7 @@ as from its subpath export `'jose/jwk/thumbprint'`.
 
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
-| `key` | [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../types/interfaces/KeyObject.md) | Key to calculate the thumbprint for. |
+| `key` | [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`KeyObject`](../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../types/type-aliases/JWK.md) | Key to calculate the thumbprint for. |
 | `digestAlgorithm?` | `"sha256"` \| `"sha384"` \| `"sha512"` | Digest Algorithm to use for calculating the thumbprint. Default is "sha256". |
 
 ## Returns

docs/jwk/thumbprint/functions/calculateJwkThumbprintUri.md

@@ -15,7 +15,7 @@ as from its subpath export `'jose/jwk/thumbprint'`.
 
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
-| `key` | [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../types/interfaces/KeyObject.md) | Key to calculate the thumbprint for. |
+| `key` | [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`KeyObject`](../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../types/type-aliases/JWK.md) | Key to calculate the thumbprint for. |
 | `digestAlgorithm?` | `"sha256"` \| `"sha384"` \| `"sha512"` | Digest Algorithm to use for calculating the thumbprint. Default is "sha256". |
 
 ## Returns

docs/jws/compact/sign/classes/CompactSign.md

@@ -69,7 +69,7 @@ Signs and resolves the value of the Compact JWS string.
 
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
-| `key` | [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md) | Private Key or Secret to sign the JWS with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
+| `key` | [`KeyInput`](../../../../types/type-aliases/KeyInput.md) | Private Key or Secret to sign the JWS with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
 | `options?` | [`SignOptions`](../../../../types/interfaces/SignOptions.md) | JWS Sign options. |
 
 #### Returns

docs/jws/compact/verify/functions/compactVerify.md

@@ -18,7 +18,7 @@ as from its subpath export `'jose/jws/compact/verify'`.
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
 | `jws` | `string` \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) | Compact JWS. |
-| `key` | [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md) | Key to verify the JWS with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
+| `key` | [`KeyInput`](../../../../types/type-aliases/KeyInput.md) | Key to verify the JWS with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
 | `options?` | [`VerifyOptions`](../../../../types/interfaces/VerifyOptions.md) | JWS Verify options. |
 
 ### Returns
@@ -39,16 +39,45 @@ console.log(new TextDecoder().decode(payload))
 
 ## Call Signature
 
-▸ **compactVerify**(`jws`, `getKey`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`CompactVerifyResult`](../../../../types/interfaces/CompactVerifyResult.md) & [`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\>
+▸ **compactVerify**\<`KeyType`\>(`jws`, `getKey`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`CompactVerifyResult`](../../../../types/interfaces/CompactVerifyResult.md) & [`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\<`KeyType`\>\>
+
+Verifies the signature and format of and afterwards decodes the Compact JWS, resolving the key
+dynamically. The result additionally carries the [resolved key](../../../../types/interfaces/ResolvedKey.md#key).
+
+### Type Parameters
+
+| Type Parameter | Default type |
+| ------ | ------ |
+| `KeyType` *extends* [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) | [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) |
 
 ### Parameters
 
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
 | `jws` | `string` \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) | Compact JWS. |
-| `getKey` | [`CompactVerifyGetKey`](../interfaces/CompactVerifyGetKey.md) | Function resolving a key to verify the JWS with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
+| `getKey` | [`CompactVerifyGetKey`](../interfaces/CompactVerifyGetKey.md)\<`KeyType`\> | Function resolving a key to verify the JWS with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
 | `options?` | [`VerifyOptions`](../../../../types/interfaces/VerifyOptions.md) | JWS Verify options. |
 
 ### Returns
 
-[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`CompactVerifyResult`](../../../../types/interfaces/CompactVerifyResult.md) & [`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\>
+[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`CompactVerifyResult`](../../../../types/interfaces/CompactVerifyResult.md) & [`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\<`KeyType`\>\>
+
+## Call Signature
+
+▸ **compactVerify**(`jws`, `key`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`CompactVerifyResult`](../../../../types/interfaces/CompactVerifyResult.md) & [`Partial`](https://www.typescriptlang.org/docs/handbook/utility-types.html#partialtype)\<[`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\>\>\>
+
+Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
+either a key or a key resolution function; `key` is present on the result only when a resolution
+function was used.
+
+### Parameters
+
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
+| `jws` | `string` \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) | Compact JWS. |
+| `key` | [`KeyInput`](../../../../types/type-aliases/KeyInput.md) \| [`CompactVerifyGetKey`](../interfaces/CompactVerifyGetKey.md)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\> | Key, or function resolving a key, to verify the JWS with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
+| `options?` | [`VerifyOptions`](../../../../types/interfaces/VerifyOptions.md) | JWS Verify options. |
+
+### Returns
+
+[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`CompactVerifyResult`](../../../../types/interfaces/CompactVerifyResult.md) & [`Partial`](https://www.typescriptlang.org/docs/handbook/utility-types.html#partialtype)\<[`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\>\>\>

docs/jws/compact/verify/interfaces/CompactVerifyGetKey.md

@@ -1,4 +1,4 @@
-# Interface: CompactVerifyGetKey()
+# Interface: CompactVerifyGetKey()\<KeyType\>
 
 ## [💗 Help the project](https://github.com/sponsors/panva)
 
@@ -11,7 +11,13 @@ verified at the time of this function call.
 
 [createRemoteJWKSet](../../../../jwks/remote/functions/createRemoteJWKSet.md) to verify using a remote JSON Web Key Set.
 
-▸ **CompactVerifyGetKey**(`protectedHeader`, `token`): [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md)\>
+## Type Parameters
+
+| Type Parameter | Default type |
+| ------ | ------ |
+| `KeyType` *extends* [`CryptoKey`](../../../../types/type-aliases/CryptoKey.md) \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) | [`CryptoKey`](../../../../types/type-aliases/CryptoKey.md) \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) |
+
+▸ **CompactVerifyGetKey**(`protectedHeader`, `token`): [`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| `KeyType` \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| `KeyType`\>
 
 Dynamic key resolution function. No token components have been verified at the time of this
 function call.
@@ -27,4 +33,4 @@ If a suitable key for the token cannot be matched, throw an error instead.
 
 ## Returns
 
-[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md)\>
+[`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| `KeyType` \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| `KeyType`\>

docs/jws/flattened/sign/classes/FlattenedSign.md

@@ -87,7 +87,7 @@ Signs and resolves the value of the Flattened JWS object.
 
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
-| `key` | [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md) | Private Key or Secret to sign the JWS with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
+| `key` | [`KeyInput`](../../../../types/type-aliases/KeyInput.md) | Private Key or Secret to sign the JWS with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
 | `options?` | [`SignOptions`](../../../../types/interfaces/SignOptions.md) | JWS Sign options. |
 
 #### Returns

docs/jws/flattened/verify/functions/flattenedVerify.md

@@ -18,7 +18,7 @@ as from its subpath export `'jose/jws/flattened/verify'`.
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
 | `jws` | [`FlattenedJWSInput`](../../../../types/interfaces/FlattenedJWSInput.md) | Flattened JWS. |
-| `key` | [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md) | Key to verify the JWS with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
+| `key` | [`KeyInput`](../../../../types/type-aliases/KeyInput.md) | Key to verify the JWS with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
 | `options?` | [`VerifyOptions`](../../../../types/interfaces/VerifyOptions.md) | JWS Verify options. |
 
 ### Returns
@@ -44,16 +44,45 @@ console.log(decoder.decode(payload))
 
 ## Call Signature
 
-▸ **flattenedVerify**(`jws`, `getKey`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`FlattenedVerifyResult`](../../../../types/interfaces/FlattenedVerifyResult.md) & [`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\>
+▸ **flattenedVerify**\<`KeyType`\>(`jws`, `getKey`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`FlattenedVerifyResult`](../../../../types/interfaces/FlattenedVerifyResult.md) & [`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\<`KeyType`\>\>
+
+Verifies the signature and format of and afterwards decodes the Flattened JWS, resolving the key
+dynamically. The result additionally carries the [resolved key](../../../../types/interfaces/ResolvedKey.md#key).
+
+### Type Parameters
+
+| Type Parameter | Default type |
+| ------ | ------ |
+| `KeyType` *extends* [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) | [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) |
 
 ### Parameters
 
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
 | `jws` | [`FlattenedJWSInput`](../../../../types/interfaces/FlattenedJWSInput.md) | Flattened JWS. |
-| `getKey` | [`FlattenedVerifyGetKey`](../interfaces/FlattenedVerifyGetKey.md) | Function resolving a key to verify the JWS with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
+| `getKey` | [`FlattenedVerifyGetKey`](../interfaces/FlattenedVerifyGetKey.md)\<`KeyType`\> | Function resolving a key to verify the JWS with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
 | `options?` | [`VerifyOptions`](../../../../types/interfaces/VerifyOptions.md) | JWS Verify options. |
 
 ### Returns
 
-[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`FlattenedVerifyResult`](../../../../types/interfaces/FlattenedVerifyResult.md) & [`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\>
+[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`FlattenedVerifyResult`](../../../../types/interfaces/FlattenedVerifyResult.md) & [`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\<`KeyType`\>\>
+
+## Call Signature
+
+▸ **flattenedVerify**(`jws`, `key`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`FlattenedVerifyResult`](../../../../types/interfaces/FlattenedVerifyResult.md) & [`Partial`](https://www.typescriptlang.org/docs/handbook/utility-types.html#partialtype)\<[`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\>\>\>
+
+Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
+either a key or a key resolution function; `key` is present on the result only when a resolution
+function was used.
+
+### Parameters
+
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
+| `jws` | [`FlattenedJWSInput`](../../../../types/interfaces/FlattenedJWSInput.md) | Flattened JWS. |
+| `key` | [`KeyInput`](../../../../types/type-aliases/KeyInput.md) \| [`FlattenedVerifyGetKey`](../interfaces/FlattenedVerifyGetKey.md)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\> | Key, or function resolving a key, to verify the JWS with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
+| `options?` | [`VerifyOptions`](../../../../types/interfaces/VerifyOptions.md) | JWS Verify options. |
+
+### Returns
+
+[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`FlattenedVerifyResult`](../../../../types/interfaces/FlattenedVerifyResult.md) & [`Partial`](https://www.typescriptlang.org/docs/handbook/utility-types.html#partialtype)\<[`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\>\>\>

docs/jws/flattened/verify/interfaces/FlattenedVerifyGetKey.md

@@ -1,4 +1,4 @@
-# Interface: FlattenedVerifyGetKey()
+# Interface: FlattenedVerifyGetKey()\<KeyType\>
 
 ## [💗 Help the project](https://github.com/sponsors/panva)
 
@@ -11,7 +11,13 @@ verified at the time of this function call.
 
 [createRemoteJWKSet](../../../../jwks/remote/functions/createRemoteJWKSet.md) to verify using a remote JSON Web Key Set.
 
-▸ **FlattenedVerifyGetKey**(`protectedHeader`, `token`): [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md)\>
+## Type Parameters
+
+| Type Parameter | Default type |
+| ------ | ------ |
+| `KeyType` *extends* [`CryptoKey`](../../../../types/type-aliases/CryptoKey.md) \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) | [`CryptoKey`](../../../../types/type-aliases/CryptoKey.md) \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) |
+
+▸ **FlattenedVerifyGetKey**(`protectedHeader`, `token`): [`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| `KeyType` \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| `KeyType`\>
 
 Dynamic key resolution function. No token components have been verified at the time of this
 function call.
@@ -27,4 +33,4 @@ If a suitable key for the token cannot be matched, throw an error instead.
 
 ## Returns
 
-[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md)\>
+[`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| `KeyType` \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| `KeyType`\>

docs/jws/general/sign/classes/GeneralSign.md

@@ -54,7 +54,7 @@ Adds an additional signature for the General JWS object.
 
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
-| `key` | [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md) | Private Key or Secret to sign the individual JWS signature with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
+| `key` | [`KeyInput`](../../../../types/type-aliases/KeyInput.md) | Private Key or Secret to sign the individual JWS signature with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
 | `options?` | [`SignOptions`](../../../../types/interfaces/SignOptions.md) | JWS Sign options. |
 
 #### Returns

docs/jws/general/sign/interfaces/Signature.md

@@ -10,15 +10,17 @@ Used to build General JWS object's individual signatures.
 
 ### addSignature()
 
-▸ **addSignature**(...`args`): `Signature`
+▸ **addSignature**(`key`, `options?`): `Signature`
 
-A shorthand for calling addSignature() on the enclosing [GeneralSign](../classes/GeneralSign.md) instance
+A shorthand for calling [addSignature()](../classes/GeneralSign.md#addsignature) on the enclosing
+[GeneralSign](../classes/GeneralSign.md) instance.
 
 #### Parameters
 
-| Parameter | Type |
-| ------ | ------ |
-| ...`args` | \[[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md), [`SignOptions`](../../../../types/interfaces/SignOptions.md)\] |
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
+| `key` | [`KeyInput`](../../../../types/type-aliases/KeyInput.md) | Private Key or Secret to sign the individual JWS signature with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
+| `options?` | [`SignOptions`](../../../../types/interfaces/SignOptions.md) | JWS Sign options. |
 
 #### Returns
 
@@ -76,15 +78,10 @@ Sets the JWS Unprotected Header on the Signature object.
 
 ### sign()
 
-▸ **sign**(...`args`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`GeneralJWS`](../../../../types/interfaces/GeneralJWS.md)\>
+▸ **sign**(): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`GeneralJWS`](../../../../types/interfaces/GeneralJWS.md)\>
 
-A shorthand for calling encrypt() on the enclosing [GeneralSign](../classes/GeneralSign.md) instance
-
-#### Parameters
-
-| Parameter | Type |
-| ------ | ------ |
-| ...`args` | \[\] |
+A shorthand for calling [sign()](../classes/GeneralSign.md#sign) on the enclosing [GeneralSign](../classes/GeneralSign.md)
+instance. Takes no arguments — each signature's key is supplied to [addSignature](#addsignature).
 
 #### Returns
 

docs/jws/general/verify/functions/generalVerify.md

@@ -26,7 +26,7 @@ as from its subpath export `'jose/jws/general/verify'`.
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
 | `jws` | [`GeneralJWSInput`](../../../../types/interfaces/GeneralJWSInput.md) | General JWS. |
-| `key` | [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md) | Key to verify the JWS with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
+| `key` | [`KeyInput`](../../../../types/type-aliases/KeyInput.md) | Key to verify the JWS with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
 | `options?` | [`VerifyOptions`](../../../../types/interfaces/VerifyOptions.md) | JWS Verify options. |
 
 ### Returns
@@ -55,16 +55,45 @@ console.log(new TextDecoder().decode(payload))
 
 ## Call Signature
 
-▸ **generalVerify**(`jws`, `getKey`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`GeneralVerifyResult`](../../../../types/interfaces/GeneralVerifyResult.md) & [`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\>
+▸ **generalVerify**\<`KeyType`\>(`jws`, `getKey`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`GeneralVerifyResult`](../../../../types/interfaces/GeneralVerifyResult.md) & [`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\<`KeyType`\>\>
+
+Verifies the signature and format of and afterwards decodes the General JWS, resolving the key
+dynamically. The result additionally carries the [resolved key](../../../../types/interfaces/ResolvedKey.md#key).
+
+### Type Parameters
+
+| Type Parameter | Default type |
+| ------ | ------ |
+| `KeyType` *extends* [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) | [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) |
 
 ### Parameters
 
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
 | `jws` | [`GeneralJWSInput`](../../../../types/interfaces/GeneralJWSInput.md) | General JWS. |
-| `getKey` | [`GeneralVerifyGetKey`](../interfaces/GeneralVerifyGetKey.md) | Function resolving a key to verify the JWS with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
+| `getKey` | [`GeneralVerifyGetKey`](../interfaces/GeneralVerifyGetKey.md)\<`KeyType`\> | Function resolving a key to verify the JWS with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
 | `options?` | [`VerifyOptions`](../../../../types/interfaces/VerifyOptions.md) | JWS Verify options. |
 
 ### Returns
 
-[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`GeneralVerifyResult`](../../../../types/interfaces/GeneralVerifyResult.md) & [`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\>
+[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`GeneralVerifyResult`](../../../../types/interfaces/GeneralVerifyResult.md) & [`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\<`KeyType`\>\>
+
+## Call Signature
+
+▸ **generalVerify**(`jws`, `key`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`GeneralVerifyResult`](../../../../types/interfaces/GeneralVerifyResult.md) & [`Partial`](https://www.typescriptlang.org/docs/handbook/utility-types.html#partialtype)\<[`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\>\>\>
+
+Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
+either a key or a key resolution function; `key` is present on the result only when a resolution
+function was used.
+
+### Parameters
+
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
+| `jws` | [`GeneralJWSInput`](../../../../types/interfaces/GeneralJWSInput.md) | General JWS. |
+| `key` | [`KeyInput`](../../../../types/type-aliases/KeyInput.md) \| [`GeneralVerifyGetKey`](../interfaces/GeneralVerifyGetKey.md)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\> | Key, or function resolving a key, to verify the JWS with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
+| `options?` | [`VerifyOptions`](../../../../types/interfaces/VerifyOptions.md) | JWS Verify options. |
+
+### Returns
+
+[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`GeneralVerifyResult`](../../../../types/interfaces/GeneralVerifyResult.md) & [`Partial`](https://www.typescriptlang.org/docs/handbook/utility-types.html#partialtype)\<[`ResolvedKey`](../../../../types/interfaces/ResolvedKey.md)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\>\>\>

docs/jws/general/verify/interfaces/GeneralVerifyGetKey.md

@@ -1,4 +1,4 @@
-# Interface: GeneralVerifyGetKey()
+# Interface: GeneralVerifyGetKey()\<KeyType\>
 
 ## [💗 Help the project](https://github.com/sponsors/panva)
 
@@ -11,7 +11,13 @@ verified at the time of this function call.
 
 [createRemoteJWKSet](../../../../jwks/remote/functions/createRemoteJWKSet.md) to verify using a remote JSON Web Key Set.
 
-▸ **GeneralVerifyGetKey**(`protectedHeader`, `token`): [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md)\>
+## Type Parameters
+
+| Type Parameter | Default type |
+| ------ | ------ |
+| `KeyType` *extends* [`CryptoKey`](../../../../types/type-aliases/CryptoKey.md) \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) | [`CryptoKey`](../../../../types/type-aliases/CryptoKey.md) \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) |
+
+▸ **GeneralVerifyGetKey**(`protectedHeader`, `token`): [`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| `KeyType` \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| `KeyType`\>
 
 Dynamic key resolution function. No token components have been verified at the time of this
 function call.
@@ -27,4 +33,4 @@ If a suitable key for the token cannot be matched, throw an error instead.
 
 ## Returns
 
-[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../../types/interfaces/KeyObject.md)\>
+[`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| `KeyType` \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`KeyObject`](../../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../../types/type-aliases/JWK.md) \| `KeyType`\>

docs/jwt/decrypt/functions/jwtDecrypt.md

@@ -25,7 +25,7 @@ as from its subpath export `'jose/jwt/decrypt'`.
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
 | `jwt` | `string` \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) | JSON Web Token value (encoded as JWE). |
-| `key` | [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../types/interfaces/KeyObject.md) | Private Key or Secret to decrypt and verify the JWT with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
+| `key` | [`KeyInput`](../../../types/type-aliases/KeyInput.md) | Private Key or Secret to decrypt and verify the JWT with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
 | `options?` | [`JWTDecryptOptions`](../interfaces/JWTDecryptOptions.md) | JWT Decryption and JWT Claims Set validation options. |
 
 ### Returns
@@ -50,7 +50,37 @@ console.log(payload)
 
 ## Call Signature
 
-▸ **jwtDecrypt**\<`PayloadType`\>(`jwt`, `getKey`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`JWTDecryptResult`](../../../types/interfaces/JWTDecryptResult.md)\<`PayloadType`\> & [`ResolvedKey`](../../../types/interfaces/ResolvedKey.md)\>
+▸ **jwtDecrypt**\<`PayloadType`, `KeyType`\>(`jwt`, `getKey`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`JWTDecryptResult`](../../../types/interfaces/JWTDecryptResult.md)\<`PayloadType`\> & [`ResolvedKey`](../../../types/interfaces/ResolvedKey.md)\<`KeyType`\>\>
+
+Decrypts a JWT and validates its JWT Claims Set, resolving the key dynamically. The result
+additionally carries the [resolved key](../../../types/interfaces/ResolvedKey.md#key).
+
+### Type Parameters
+
+| Type Parameter | Default type |
+| ------ | ------ |
+| `PayloadType` | [`JWTPayload`](../../../types/interfaces/JWTPayload.md) |
+| `KeyType` *extends* [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) | [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) |
+
+### Parameters
+
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
+| `jwt` | `string` \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) | JSON Web Token value (encoded as JWE). |
+| `getKey` | [`JWTDecryptGetKey`](../interfaces/JWTDecryptGetKey.md)\<`KeyType`\> | Function resolving Private Key or Secret to decrypt and verify the JWT with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
+| `options?` | [`JWTDecryptOptions`](../interfaces/JWTDecryptOptions.md) | JWT Decryption and JWT Claims Set validation options. |
+
+### Returns
+
+[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`JWTDecryptResult`](../../../types/interfaces/JWTDecryptResult.md)\<`PayloadType`\> & [`ResolvedKey`](../../../types/interfaces/ResolvedKey.md)\<`KeyType`\>\>
+
+## Call Signature
+
+▸ **jwtDecrypt**\<`PayloadType`\>(`jwt`, `key`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`JWTDecryptResult`](../../../types/interfaces/JWTDecryptResult.md)\<`PayloadType`\> & [`Partial`](https://www.typescriptlang.org/docs/handbook/utility-types.html#partialtype)\<[`ResolvedKey`](../../../types/interfaces/ResolvedKey.md)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\>\>\>
+
+Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
+either a key or a key resolution function; `key` is present on the result only when a resolution
+function was used.
 
 ### Type Parameters
 
@@ -63,9 +93,9 @@ console.log(payload)
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
 | `jwt` | `string` \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) | JSON Web Token value (encoded as JWE). |
-| `getKey` | [`JWTDecryptGetKey`](../interfaces/JWTDecryptGetKey.md) | Function resolving Private Key or Secret to decrypt and verify the JWT with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
+| `key` | [`KeyInput`](../../../types/type-aliases/KeyInput.md) \| [`JWTDecryptGetKey`](../interfaces/JWTDecryptGetKey.md)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\> | Private Key or Secret, or a function resolving one, to decrypt and verify the JWT with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
 | `options?` | [`JWTDecryptOptions`](../interfaces/JWTDecryptOptions.md) | JWT Decryption and JWT Claims Set validation options. |
 
 ### Returns
 
-[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`JWTDecryptResult`](../../../types/interfaces/JWTDecryptResult.md)\<`PayloadType`\> & [`ResolvedKey`](../../../types/interfaces/ResolvedKey.md)\>
+[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`JWTDecryptResult`](../../../types/interfaces/JWTDecryptResult.md)\<`PayloadType`\> & [`Partial`](https://www.typescriptlang.org/docs/handbook/utility-types.html#partialtype)\<[`ResolvedKey`](../../../types/interfaces/ResolvedKey.md)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\>\>\>

docs/jwt/decrypt/interfaces/JWTDecryptGetKey.md

@@ -1,4 +1,4 @@
-# Interface: JWTDecryptGetKey()
+# Interface: JWTDecryptGetKey()\<KeyType\>
 
 ## [💗 Help the project](https://github.com/sponsors/panva)
 
@@ -7,7 +7,13 @@ Support from the community to continue maintaining and improving this module is
 Interface for JWT Decryption dynamic key resolution. No token components have been verified at
 the time of this function call.
 
-▸ **JWTDecryptGetKey**(`protectedHeader`, `token`): [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../types/interfaces/KeyObject.md) \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../types/interfaces/KeyObject.md)\>
+## Type Parameters
+
+| Type Parameter | Default type |
+| ------ | ------ |
+| `KeyType` *extends* [`CryptoKey`](../../../types/type-aliases/CryptoKey.md) \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) | [`CryptoKey`](../../../types/type-aliases/CryptoKey.md) \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) |
+
+▸ **JWTDecryptGetKey**(`protectedHeader`, `token`): [`KeyObject`](../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../types/type-aliases/JWK.md) \| `KeyType` \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`KeyObject`](../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../types/type-aliases/JWK.md) \| `KeyType`\>
 
 Dynamic key resolution function. No token components have been verified at the time of this
 function call.
@@ -23,4 +29,4 @@ If a suitable key for the token cannot be matched, throw an error instead.
 
 ## Returns
 
-[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../types/interfaces/KeyObject.md) \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../types/interfaces/KeyObject.md)\>
+[`KeyObject`](../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../types/type-aliases/JWK.md) \| `KeyType` \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`KeyObject`](../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../types/type-aliases/JWK.md) \| `KeyType`\>

docs/jwt/encrypt/classes/EncryptJWT.md

@@ -54,7 +54,7 @@ Encrypts and returns the JWT.
 
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
-| `key` | [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../types/interfaces/KeyObject.md) | Public Key or Secret to encrypt the JWT with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
+| `key` | [`KeyInput`](../../../types/type-aliases/KeyInput.md) | Public Key or Secret to encrypt the JWT with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jwe-alg). |
 | `options?` | [`EncryptOptions`](../../../types/interfaces/EncryptOptions.md) | JWE Encryption options. |
 
 #### Returns

docs/jwt/sign/classes/SignJWT.md

@@ -332,7 +332,7 @@ Signs and returns the JWT.
 
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
-| `key` | [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../types/interfaces/KeyObject.md) | Private Key or Secret to sign the JWT with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
+| `key` | [`KeyInput`](../../../types/type-aliases/KeyInput.md) | Private Key or Secret to sign the JWT with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
 | `options?` | [`SignOptions`](../../../types/interfaces/SignOptions.md) | JWT Sign options. |
 
 #### Returns

docs/jwt/verify/functions/jwtVerify.md

@@ -25,7 +25,7 @@ as from its subpath export `'jose/jwt/verify'`.
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
 | `jwt` | `string` \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) | JSON Web Token value (encoded as JWS). |
-| `key` | [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../types/interfaces/KeyObject.md) | Key to verify the JWT with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
+| `key` | [`KeyInput`](../../../types/type-aliases/KeyInput.md) | Key to verify the JWT with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
 | `options?` | [`JWTVerifyOptions`](../interfaces/JWTVerifyOptions.md) | JWT Decryption and JWT Claims Set validation options. |
 
 ### Returns
@@ -102,25 +102,26 @@ console.log(payload)
 
 ## Call Signature
 
-▸ **jwtVerify**\<`PayloadType`\>(`jwt`, `getKey`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`JWTVerifyResult`](../../../types/interfaces/JWTVerifyResult.md)\<`PayloadType`\> & [`ResolvedKey`](../../../types/interfaces/ResolvedKey.md)\>
+▸ **jwtVerify**\<`PayloadType`, `KeyType`\>(`jwt`, `getKey`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`JWTVerifyResult`](../../../types/interfaces/JWTVerifyResult.md)\<`PayloadType`\> & [`ResolvedKey`](../../../types/interfaces/ResolvedKey.md)\<`KeyType`\>\>
 
 ### Type Parameters
 
 | Type Parameter | Default type |
 | ------ | ------ |
 | `PayloadType` | [`JWTPayload`](../../../types/interfaces/JWTPayload.md) |
+| `KeyType` *extends* [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) | [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) |
 
 ### Parameters
 
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
 | `jwt` | `string` \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) | JSON Web Token value (encoded as JWS). |
-| `getKey` | [`JWTVerifyGetKey`](../interfaces/JWTVerifyGetKey.md) | Function resolving a key to verify the JWT with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
+| `getKey` | [`JWTVerifyGetKey`](../interfaces/JWTVerifyGetKey.md)\<`KeyType`\> | Function resolving a key to verify the JWT with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
 | `options?` | [`JWTVerifyOptions`](../interfaces/JWTVerifyOptions.md) | JWT Decryption and JWT Claims Set validation options. |
 
 ### Returns
 
-[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`JWTVerifyResult`](../../../types/interfaces/JWTVerifyResult.md)\<`PayloadType`\> & [`ResolvedKey`](../../../types/interfaces/ResolvedKey.md)\>
+[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`JWTVerifyResult`](../../../types/interfaces/JWTVerifyResult.md)\<`PayloadType`\> & [`ResolvedKey`](../../../types/interfaces/ResolvedKey.md)\<`KeyType`\>\>
 
 ### Example
 
@@ -136,3 +137,29 @@ const { payload, protectedHeader } = await jose.jwtVerify(jwt, JWKS, {
 console.log(protectedHeader)
 console.log(payload)
 ```
+
+## Call Signature
+
+▸ **jwtVerify**\<`PayloadType`\>(`jwt`, `key`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`JWTVerifyResult`](../../../types/interfaces/JWTVerifyResult.md)\<`PayloadType`\> & [`Partial`](https://www.typescriptlang.org/docs/handbook/utility-types.html#partialtype)\<[`ResolvedKey`](../../../types/interfaces/ResolvedKey.md)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\>\>\>
+
+Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
+either a key or a key resolution function; `key` is present on the result only when a resolution
+function was used.
+
+### Type Parameters
+
+| Type Parameter | Default type |
+| ------ | ------ |
+| `PayloadType` | [`JWTPayload`](../../../types/interfaces/JWTPayload.md) |
+
+### Parameters
+
+| Parameter | Type | Description |
+| ------ | ------ | ------ |
+| `jwt` | `string` \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) | JSON Web Token value (encoded as JWS). |
+| `key` | [`KeyInput`](../../../types/type-aliases/KeyInput.md) \| [`JWTVerifyGetKey`](../interfaces/JWTVerifyGetKey.md)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\> | Key, or function resolving a key, to verify the JWT with. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210#jws-alg). |
+| `options?` | [`JWTVerifyOptions`](../interfaces/JWTVerifyOptions.md) | JWT Decryption and JWT Claims Set validation options. |
+
+### Returns
+
+[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`JWTVerifyResult`](../../../types/interfaces/JWTVerifyResult.md)\<`PayloadType`\> & [`Partial`](https://www.typescriptlang.org/docs/handbook/utility-types.html#partialtype)\<[`ResolvedKey`](../../../types/interfaces/ResolvedKey.md)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\>\>\>

docs/jwt/verify/interfaces/JWTVerifyGetKey.md

@@ -1,4 +1,4 @@
-# Interface: JWTVerifyGetKey()
+# Interface: JWTVerifyGetKey()\<KeyType\>
 
 ## [💗 Help the project](https://github.com/sponsors/panva)
 
@@ -11,7 +11,13 @@ the time of this function call.
 
 [createRemoteJWKSet](../../../jwks/remote/functions/createRemoteJWKSet.md) to verify using a remote JSON Web Key Set.
 
-▸ **JWTVerifyGetKey**(`protectedHeader`, `token`): [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../types/interfaces/KeyObject.md) \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../types/interfaces/KeyObject.md)\>
+## Type Parameters
+
+| Type Parameter | Default type |
+| ------ | ------ |
+| `KeyType` *extends* [`CryptoKey`](../../../types/type-aliases/CryptoKey.md) \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) | [`CryptoKey`](../../../types/type-aliases/CryptoKey.md) \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) |
+
+▸ **JWTVerifyGetKey**(`protectedHeader`, `token`): [`KeyObject`](../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../types/type-aliases/JWK.md) \| `KeyType` \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`KeyObject`](../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../types/type-aliases/JWK.md) \| `KeyType`\>
 
 Dynamic key resolution function. No token components have been verified at the time of this
 function call.
@@ -27,4 +33,4 @@ If a suitable key for the token cannot be matched, throw an error instead.
 
 ## Returns
 
-[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../types/interfaces/KeyObject.md) \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../../../types/type-aliases/JWK.md) \| [`KeyObject`](../../../types/interfaces/KeyObject.md)\>
+[`KeyObject`](../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../types/type-aliases/JWK.md) \| `KeyType` \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`KeyObject`](../../../types/interfaces/KeyObject.md) \| [`JWK`](../../../types/type-aliases/JWK.md) \| `KeyType`\>

docs/key/generate_secret/README.md

@@ -6,6 +6,10 @@ Symmetric key generation
 
 - [GenerateSecretOptions](interfaces/GenerateSecretOptions.md)
 
+## Type Aliases
+
+- [GeneratedSecret](type-aliases/GeneratedSecret.md)
+
 ## Functions
 
 - [generateSecret](functions/generateSecret.md)

docs/key/generate_secret/functions/generateSecret.md

@@ -4,7 +4,7 @@
 
 Support from the community to continue maintaining and improving this module is welcome. If you find the module useful, please consider supporting the project by [becoming a sponsor](https://github.com/sponsors/panva).
 
-▸ **generateSecret**(`alg`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\>
+▸ **generateSecret**\<`Alg`\>(`alg`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`GeneratedSecret`](../type-aliases/GeneratedSecret.md)\<`Alg`\>\>
 
 Generates a symmetric secret key for a given JWA algorithm identifier.
 
@@ -18,16 +18,22 @@ Generates a symmetric secret key for a given JWA algorithm identifier.
 This function is exported (as a named export) from the main `'jose'` module entry point as well
 as from its subpath export `'jose/generate/secret'`.
 
+## Type Parameters
+
+| Type Parameter |
+| ------ |
+| `Alg` *extends* `string` |
+
 ## Parameters
 
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
-| `alg` | `string` | JWA Algorithm Identifier to be used with the generated secret. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210). |
+| `alg` | `Alg` | JWA Algorithm Identifier to be used with the generated secret. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210). |
 | `options?` | [`GenerateSecretOptions`](../interfaces/GenerateSecretOptions.md) | Additional options passed down to the secret generation. |
 
 ## Returns
 
-[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\>
+[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`GeneratedSecret`](../type-aliases/GeneratedSecret.md)\<`Alg`\>\>
 
 ## Example
 

docs/key/generate_secret/type-aliases/GeneratedSecret.md

@@ -0,0 +1,20 @@
+# Type Alias: GeneratedSecret\<Alg\>
+
+## [💗 Help the project](https://github.com/sponsors/panva)
+
+Support from the community to continue maintaining and improving this module is welcome. If you find the module useful, please consider supporting the project by [becoming a sponsor](https://github.com/sponsors/panva).
+
+• **GeneratedSecret**\<`Alg`\> = `Alg` *extends* `"A128CBC-HS256"` \| `"A192CBC-HS384"` \| `"A256CBC-HS512"` ? [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) : `string` *extends* `Alg` ? [`CryptoKey`](../../../types/type-aliases/CryptoKey.md) \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) : [`CryptoKey`](../../../types/type-aliases/CryptoKey.md)
+
+Resolves what [generateSecret](../functions/generateSecret.md) returns for a given JWA Algorithm Identifier.
+
+The AES_CBC_HMAC_SHA2 content encryption algorithms have no [CryptoKey](https://developer.mozilla.org/docs/Web/API/CryptoKey) representation, so
+they yield a [Uint8Array](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array); every other supported identifier yields a
+[CryptoKey](../../../types/type-aliases/CryptoKey.md). When the identifier is not statically known this resolves to
+the union, as before.
+
+## Type Parameters
+
+| Type Parameter |
+| ------ |
+| `Alg` *extends* `string` |

docs/key/import/README.md

@@ -6,6 +6,10 @@ Cryptographic key import functions
 
 - [KeyImportOptions](interfaces/KeyImportOptions.md)
 
+## Type Aliases
+
+- [ImportedJWK](type-aliases/ImportedJWK.md)
+
 ## Functions
 
 - [importJWK](functions/importJWK.md)

docs/key/import/functions/importJWK.md

@@ -4,7 +4,7 @@
 
 Support from the community to continue maintaining and improving this module is welcome. If you find the module useful, please consider supporting the project by [becoming a sponsor](https://github.com/sponsors/panva).
 
-▸ **importJWK**(`jwk`, `alg?`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\>
+▸ **importJWK**\<`JWKType`\>(`jwk`, `alg?`, `options?`): [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`ImportedJWK`](../type-aliases/ImportedJWK.md)\<`JWKType`\>\>
 
 Imports a JWK to a [CryptoKey](https://developer.mozilla.org/docs/Web/API/CryptoKey). Either the JWK "alg" (Algorithm) Parameter, or the optional
 "alg" argument, must be present for asymmetric JSON Web Key imports.
@@ -20,17 +20,23 @@ Imports a JWK to a [CryptoKey](https://developer.mozilla.org/docs/Web/API/Crypto
 This function is exported (as a named export) from the main `'jose'` module entry point as well
 as from its subpath export `'jose/key/import'`.
 
+## Type Parameters
+
+| Type Parameter |
+| ------ |
+| `JWKType` *extends* [`JWK`](../../../types/type-aliases/JWK.md) |
+
 ## Parameters
 
 | Parameter | Type | Description |
 | ------ | ------ | ------ |
-| `jwk` | [`JWK`](../../../types/type-aliases/JWK.md) | JSON Web Key. |
+| `jwk` | `JWKType` | JSON Web Key. |
 | `alg?` | `string` | JSON Web Algorithm identifier to be used with the imported key. Default is the "alg" property on the JWK. See [Algorithm Key Requirements](https://github.com/panva/jose/issues/210). |
 | `options?` | [`KeyImportOptions`](../interfaces/KeyImportOptions.md) | - |
 
 ## Returns
 
-[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)\>
+[`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`ImportedJWK`](../type-aliases/ImportedJWK.md)\<`JWKType`\>\>
 
 ## Example
 

docs/key/import/type-aliases/ImportedJWK.md

@@ -0,0 +1,21 @@
+# Type Alias: ImportedJWK\<JWKType\>
+
+## [💗 Help the project](https://github.com/sponsors/panva)
+
+Support from the community to continue maintaining and improving this module is welcome. If you find the module useful, please consider supporting the project by [becoming a sponsor](https://github.com/sponsors/panva).
+
+• **ImportedJWK**\<`JWKType`\> = `JWKType` *extends* `object` ? [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) : `JWKType` *extends* `object` ? [`CryptoKey`](../../../types/type-aliases/CryptoKey.md) : [`CryptoKey`](../../../types/type-aliases/CryptoKey.md) \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array)
+
+Resolves what [importJWK](../functions/importJWK.md) returns for a given JWK type.
+
+The "kty" (Key Type) Parameter fully determines the outcome at runtime: `"oct"` yields a
+[Uint8Array](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) secret, every other supported key type yields a
+[CryptoKey](../../../types/type-aliases/CryptoKey.md). When "kty" is not statically known — the usual case for a JWK
+parsed from JSON, or for a value typed as [JWK](../../../types/type-aliases/JWK.md) — this resolves to the union, as
+before.
+
+## Type Parameters
+
+| Type Parameter |
+| ------ |
+| `JWKType` *extends* [`JWK`](../../../types/type-aliases/JWK.md) |

docs/types/README.md

@@ -52,3 +52,4 @@
 - [CryptoKey](type-aliases/CryptoKey.md)
 - [JWK](type-aliases/JWK.md)
 - [JWKParameters](type-aliases/JWKParameters.md)
+- [KeyInput](type-aliases/KeyInput.md)

docs/types/interfaces/GetKeyFunction.md

@@ -1,4 +1,4 @@
-# Interface: GetKeyFunction()\<IProtectedHeader, IToken\>
+# Interface: GetKeyFunction()\<IProtectedHeader, IToken, KeyTypes\>
 
 ## [💗 Help the project](https://github.com/sponsors/panva)
 
@@ -8,12 +8,13 @@ Interface for consuming operations dynamic key resolution.
 
 ## Type Parameters
 
-| Type Parameter | Description |
-| ------ | ------ |
-| `IProtectedHeader` | Type definition of the JWE or JWS Protected Header. |
-| `IToken` | Type definition of the consumed JWE or JWS token. |
+| Type Parameter | Default type | Description |
+| ------ | ------ | ------ |
+| `IProtectedHeader` | - | Type definition of the JWE or JWS Protected Header. |
+| `IToken` | - | Type definition of the consumed JWE or JWS token. |
+| `KeyTypes` *extends* [`KeyInput`](../type-aliases/KeyInput.md) | [`KeyInput`](../type-aliases/KeyInput.md) | Type definition of the keys the function may resolve. Narrowing this is what lets [ResolvedKey.key](ResolvedKey.md#key) be inferred at the call site. |
 
-▸ **GetKeyFunction**(`protectedHeader`, `token`): [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../type-aliases/JWK.md) \| [`KeyObject`](KeyObject.md) \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../type-aliases/JWK.md) \| [`KeyObject`](KeyObject.md)\>
+▸ **GetKeyFunction**(`protectedHeader`, `token`): `KeyTypes` \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<`KeyTypes`\>
 
 Dynamic key resolution function. No token components have been verified at the time of this
 function call.
@@ -29,4 +30,4 @@ If a suitable key for the token cannot be matched, throw an error instead.
 
 ## Returns
 
-[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../type-aliases/JWK.md) \| [`KeyObject`](KeyObject.md) \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<[`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey) \| [`JWK`](../type-aliases/JWK.md) \| [`KeyObject`](KeyObject.md)\>
+`KeyTypes` \| [`Promise`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Promise)\<`KeyTypes`\>

docs/types/interfaces/ResolvedKey.md

@@ -1,4 +1,4 @@
-# Interface: ResolvedKey
+# Interface: ResolvedKey\<KeyType\>
 
 ## [💗 Help the project](https://github.com/sponsors/panva)
 
@@ -6,10 +6,16 @@ Support from the community to continue maintaining and improving this module is
 
 When key resolver functions are used this becomes part of successful resolves
 
+## Type Parameters
+
+| Type Parameter | Default type | Description |
+| ------ | ------ | ------ |
+| `KeyType` *extends* [`CryptoKey`](../type-aliases/CryptoKey.md) \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) | [`CryptoKey`](../type-aliases/CryptoKey.md) \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) | Type of the resolved key. Inferred from the key resolver function's return type, so a resolver declared to return only [CryptoKey](../type-aliases/CryptoKey.md) — as [createRemoteJWKSet](../../jwks/remote/functions/createRemoteJWKSet.md), [createLocalJWKSet](../../jwks/local/functions/createLocalJWKSet.md), and [EmbeddedJWK](../../jwk/embedded/functions/EmbeddedJWK.md) all are — needs no narrowing at the call site. |
+
 ## Properties
 
 ### key
 
-• **key**: [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array) \| [`CryptoKey`](https://developer.mozilla.org/docs/Web/API/CryptoKey)
+• **key**: `KeyType`
 
 Key resolved from the key resolver function.

docs/types/type-aliases/KeyInput.md

@@ -0,0 +1,13 @@
+# Type Alias: KeyInput
+
+## [💗 Help the project](https://github.com/sponsors/panva)
+
+Support from the community to continue maintaining and improving this module is welcome. If you find the module useful, please consider supporting the project by [becoming a sponsor](https://github.com/sponsors/panva).
+
+• **KeyInput** = [`CryptoKey`](CryptoKey.md) \| [`KeyObject`](../interfaces/KeyObject.md) \| [`JWK`](JWK.md) \| [`Uint8Array`](https://developer.mozilla.org/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array)
+
+Key or secret input accepted by all sign, verify, encrypt, and decrypt operations.
+
+## See
+
+[Algorithm Key Requirements](https://github.com/panva/jose/issues/210)

src/index.ts

@@ -117,6 +117,7 @@ export type {
   JWTHeaderParameters,
   JWTPayload,
   JWTVerifyResult,
+  KeyInput,
   KeyObject,
   ProduceJWT,
   ResolvedKey,

src/jwe/compact/decrypt.ts

@@ -5,6 +5,7 @@
  */
 
 import { flattenedDecrypt } from '../flattened/decrypt.js'
+import type { FlattenedDecryptGetKey } from '../flattened/decrypt.js'
 import { JWEInvalid } from '../../util/errors.js'
 import { decoder } from '../../lib/buffer_utils.js'
 import type * as types from '../../types.d.ts'
@@ -13,9 +14,12 @@ import type * as types from '../../types.d.ts'
  * Interface for Compact JWE Decryption dynamic key resolution. No token components have been
  * verified at the time of this function call.
  */
-export interface CompactDecryptGetKey extends types.GetKeyFunction<
+export interface CompactDecryptGetKey<
+  KeyType extends types.CryptoKey | Uint8Array = types.CryptoKey | Uint8Array,
+> extends types.GetKeyFunction<
   types.CompactJWEHeaderParameters,
-  types.FlattenedJWE
+  types.FlattenedJWE,
+  KeyType | types.KeyObject | types.JWK
 > {}
 
 /**
@@ -41,25 +45,45 @@ export interface CompactDecryptGetKey extends types.GetKeyFunction<
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  * @param options JWE Decryption options.
  */
-export async function compactDecrypt(
+export function compactDecrypt(
   jwe: string | Uint8Array,
-  key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array,
+  key: types.KeyInput,
   options?: types.DecryptOptions,
 ): Promise<types.CompactDecryptResult>
 /**
+ * Decrypts a Compact JWE, resolving the key dynamically. The result additionally carries the
+ * {@link types.ResolvedKey.key resolved key}.
+ *
  * @param jwe Compact JWE.
  * @param getKey Function resolving Private Key or Secret to decrypt the JWE with. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  * @param options JWE Decryption options.
  */
-export async function compactDecrypt(
+export function compactDecrypt<
+  KeyType extends types.CryptoKey | Uint8Array = types.CryptoKey | Uint8Array,
+>(
   jwe: string | Uint8Array,
-  getKey: CompactDecryptGetKey,
+  getKey: CompactDecryptGetKey<KeyType>,
   options?: types.DecryptOptions,
-): Promise<types.CompactDecryptResult & types.ResolvedKey>
+): Promise<types.CompactDecryptResult & types.ResolvedKey<KeyType>>
+/**
+ * Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
+ * either a key or a key resolution function; `key` is present on the result only when a resolution
+ * function was used.
+ *
+ * @param jwe Compact JWE.
+ * @param key Private Key or Secret, or a function resolving one, to decrypt the JWE with. See
+ *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+ * @param options JWE Decryption options.
+ */
+export function compactDecrypt(
+  jwe: string | Uint8Array,
+  key: types.KeyInput | CompactDecryptGetKey,
+  options?: types.DecryptOptions,
+): Promise<types.CompactDecryptResult & Partial<types.ResolvedKey>>
 export async function compactDecrypt(
   jwe: string | Uint8Array,
-  key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array | CompactDecryptGetKey,
+  key: types.KeyInput | CompactDecryptGetKey,
   options?: types.DecryptOptions,
 ) {
   if (jwe instanceof Uint8Array) {
@@ -90,7 +114,7 @@ export async function compactDecrypt(
       tag: tag || undefined,
       encrypted_key: encryptedKey || undefined,
     },
-    key as Parameters<typeof flattenedDecrypt>[1],
+    key as types.KeyInput | FlattenedDecryptGetKey,
     options,
   )
 

src/jwe/compact/encrypt.ts

@@ -95,10 +95,7 @@ export class CompactEncrypt {
    *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
    * @param options JWE Encryption options.
    */
-  async encrypt(
-    key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array,
-    options?: types.EncryptOptions,
-  ): Promise<string> {
+  async encrypt(key: types.KeyInput, options?: types.EncryptOptions): Promise<string> {
     const jwe = await this.#flattened.encrypt(key, options)
 
     return [jwe.protected, jwe.encrypted_key, jwe.iv, jwe.ciphertext, jwe.tag].join('.')

src/jwe/flattened/decrypt.ts

@@ -24,9 +24,12 @@ import { decompress } from '../../lib/deflate.js'
  * Interface for Flattened JWE Decryption dynamic key resolution. No token components have been
  * verified at the time of this function call.
  */
-export interface FlattenedDecryptGetKey extends types.GetKeyFunction<
+export interface FlattenedDecryptGetKey<
+  KeyType extends types.CryptoKey | Uint8Array = types.CryptoKey | Uint8Array,
+> extends types.GetKeyFunction<
   types.JWEHeaderParameters | undefined,
-  types.FlattenedJWE
+  types.FlattenedJWE,
+  KeyType | types.KeyObject | types.JWK
 > {}
 
 /**
@@ -64,23 +67,43 @@ export interface FlattenedDecryptGetKey extends types.GetKeyFunction<
  */
 export function flattenedDecrypt(
   jwe: types.FlattenedJWE,
-  key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array,
+  key: types.KeyInput,
   options?: types.DecryptOptions,
 ): Promise<types.FlattenedDecryptResult>
 /**
+ * Decrypts a Flattened JWE, resolving the key dynamically. The result additionally carries the
+ * {@link types.ResolvedKey.key resolved key}.
+ *
  * @param jwe Flattened JWE.
  * @param getKey Function resolving Private Key or Secret to decrypt the JWE with. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  * @param options JWE Decryption options.
  */
+export function flattenedDecrypt<
+  KeyType extends types.CryptoKey | Uint8Array = types.CryptoKey | Uint8Array,
+>(
+  jwe: types.FlattenedJWE,
+  getKey: FlattenedDecryptGetKey<KeyType>,
+  options?: types.DecryptOptions,
+): Promise<types.FlattenedDecryptResult & types.ResolvedKey<KeyType>>
+/**
+ * Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
+ * either a key or a key resolution function; `key` is present on the result only when a resolution
+ * function was used.
+ *
+ * @param jwe Flattened JWE.
+ * @param key Private Key or Secret, or a function resolving one, to decrypt the JWE with. See
+ *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+ * @param options JWE Decryption options.
+ */
 export function flattenedDecrypt(
   jwe: types.FlattenedJWE,
-  getKey: FlattenedDecryptGetKey,
+  key: types.KeyInput | FlattenedDecryptGetKey,
   options?: types.DecryptOptions,
-): Promise<types.FlattenedDecryptResult & types.ResolvedKey>
+): Promise<types.FlattenedDecryptResult & Partial<types.ResolvedKey>>
 export async function flattenedDecrypt(
   jwe: types.FlattenedJWE,
-  key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array | FlattenedDecryptGetKey,
+  key: types.KeyInput | FlattenedDecryptGetKey,
   options?: types.DecryptOptions,
 ) {
   if (!isObject(jwe)) {

src/jwe/flattened/encrypt.ts

@@ -159,10 +159,7 @@ export class FlattenedEncrypt {
    *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
    * @param options JWE Encryption options.
    */
-  async encrypt(
-    key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array,
-    options?: types.EncryptOptions,
-  ): Promise<types.FlattenedJWE> {
+  async encrypt(key: types.KeyInput, options?: types.EncryptOptions): Promise<types.FlattenedJWE> {
     if (!this.#protectedHeader && !this.#unprotectedHeader && !this.#sharedUnprotectedHeader) {
       throw new JWEInvalid(
         'either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()',

src/jwe/general/decrypt.ts

@@ -13,9 +13,12 @@ import { isObject } from '../../lib/type_checks.js'
  * Interface for General JWE Decryption dynamic key resolution. No token components have been
  * verified at the time of this function call.
  */
-export interface GeneralDecryptGetKey extends types.GetKeyFunction<
+export interface GeneralDecryptGetKey<
+  KeyType extends types.CryptoKey | Uint8Array = types.CryptoKey | Uint8Array,
+> extends types.GetKeyFunction<
   types.JWEHeaderParameters | undefined,
-  types.FlattenedJWE
+  types.FlattenedJWE,
+  KeyType | types.KeyObject | types.JWK
 > {}
 
 /**
@@ -64,23 +67,43 @@ export interface GeneralDecryptGetKey extends types.GetKeyFunction<
  */
 export function generalDecrypt(
   jwe: types.GeneralJWE,
-  key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array,
+  key: types.KeyInput,
   options?: types.DecryptOptions,
 ): Promise<types.GeneralDecryptResult>
 /**
+ * Decrypts a General JWE, resolving the key dynamically. The result additionally carries the
+ * {@link types.ResolvedKey.key resolved key}.
+ *
  * @param jwe General JWE.
  * @param getKey Function resolving Private Key or Secret to decrypt the JWE with. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  * @param options JWE Decryption options.
  */
+export function generalDecrypt<
+  KeyType extends types.CryptoKey | Uint8Array = types.CryptoKey | Uint8Array,
+>(
+  jwe: types.GeneralJWE,
+  getKey: GeneralDecryptGetKey<KeyType>,
+  options?: types.DecryptOptions,
+): Promise<types.GeneralDecryptResult & types.ResolvedKey<KeyType>>
+/**
+ * Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
+ * either a key or a key resolution function; `key` is present on the result only when a resolution
+ * function was used.
+ *
+ * @param jwe General JWE.
+ * @param key Private Key or Secret, or a function resolving one, to decrypt the JWE with. See
+ *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+ * @param options JWE Decryption options.
+ */
 export function generalDecrypt(
   jwe: types.GeneralJWE,
-  getKey: GeneralDecryptGetKey,
+  key: types.KeyInput | GeneralDecryptGetKey,
   options?: types.DecryptOptions,
-): Promise<types.GeneralDecryptResult & types.ResolvedKey>
+): Promise<types.GeneralDecryptResult & Partial<types.ResolvedKey>>
 export async function generalDecrypt(
   jwe: types.GeneralJWE,
-  key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array | GeneralDecryptGetKey,
+  key: types.KeyInput | GeneralDecryptGetKey,
   options?: types.DecryptOptions,
 ) {
   if (!isObject(jwe)) {
@@ -108,7 +131,7 @@ export async function generalDecrypt(
           tag: jwe.tag,
           unprotected: jwe.unprotected,
         },
-        key as Parameters<typeof flattenedDecrypt>[1],
+        key,
         options,
       )
     } catch {

src/jwe/general/encrypt.ts

@@ -35,11 +35,22 @@ export interface Recipient {
    */
   setKeyManagementParameters(parameters: types.JWEKeyManagementHeaderParameters): Recipient
 
-  /** A shorthand for calling addRecipient() on the enclosing {@link GeneralEncrypt} instance */
-  addRecipient(...args: Parameters<GeneralEncrypt['addRecipient']>): Recipient
+  /**
+   * A shorthand for calling {@link GeneralEncrypt.addRecipient addRecipient()} on the enclosing
+   * {@link GeneralEncrypt} instance.
+   *
+   * @param key Public Key or Secret to encrypt the Content Encryption Key for the recipient with.
+   *   See {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+   * @param options JWE Encryption options.
+   */
+  addRecipient(key: types.KeyInput, options?: types.CritOption): Recipient
 
-  /** A shorthand for calling encrypt() on the enclosing {@link GeneralEncrypt} instance */
-  encrypt(...args: Parameters<GeneralEncrypt['encrypt']>): Promise<types.GeneralJWE>
+  /**
+   * A shorthand for calling {@link GeneralEncrypt.encrypt encrypt()} on the enclosing
+   * {@link GeneralEncrypt} instance. Takes no arguments — each recipient's key is supplied to
+   * {@link addRecipient}.
+   */
+  encrypt(): Promise<types.GeneralJWE>
 
   /** Returns the enclosing {@link GeneralEncrypt} instance */
   done(): GeneralEncrypt
@@ -49,14 +60,10 @@ class IndividualRecipient implements Recipient {
   #parent: GeneralEncrypt
   unprotectedHeader?: types.JWEHeaderParameters
   keyManagementParameters?: types.JWEKeyManagementHeaderParameters
-  key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array
+  key: types.KeyInput
   options: types.CritOption
 
-  constructor(
-    enc: GeneralEncrypt,
-    key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array,
-    options: types.CritOption,
-  ) {
+  constructor(enc: GeneralEncrypt, key: types.KeyInput, options: types.CritOption) {
     this.#parent = enc
     this.key = key
     this.options = options
@@ -136,10 +143,7 @@ export class GeneralEncrypt {
    *   See {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
    * @param options JWE Encryption options.
    */
-  addRecipient(
-    key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array,
-    options?: types.CritOption,
-  ): Recipient {
+  addRecipient(key: types.KeyInput, options?: types.CritOption): Recipient {
     const recipient = new IndividualRecipient(this, key, { crit: options?.crit })
     this.#recipients.push(recipient)
     return recipient
@@ -204,8 +208,8 @@ export class GeneralEncrypt {
       if (flattened.aad) jwe.aad = flattened.aad
       if (flattened.protected) jwe.protected = flattened.protected
       if (flattened.unprotected) jwe.unprotected = flattened.unprotected
-      if (flattened.encrypted_key) jwe.recipients![0].encrypted_key = flattened.encrypted_key
-      if (flattened.header) jwe.recipients![0].header = flattened.header
+      if (flattened.encrypted_key) jwe.recipients[0].encrypted_key = flattened.encrypted_key
+      if (flattened.header) jwe.recipients[0].header = flattened.header
 
       return jwe
     }
@@ -275,7 +279,7 @@ export class GeneralEncrypt {
     for (let i = 0; i < this.#recipients.length; i++) {
       const recipient = this.#recipients[i]
       const target: Record<string, string | types.JWEHeaderParameters> = {}
-      jwe.recipients!.push(target)
+      jwe.recipients.push(target)
 
       if (i === 0) {
         const flattened = await new FlattenedEncrypt(this.#plaintext)

src/jws/compact/sign.ts

@@ -56,10 +56,7 @@ export class CompactSign {
    *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
    * @param options JWS Sign options.
    */
-  async sign(
-    key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array,
-    options?: types.SignOptions,
-  ): Promise<string> {
+  async sign(key: types.KeyInput, options?: types.SignOptions): Promise<string> {
     const jws = await this.#flattened.sign(key, options)
 
     if (

src/jws/compact/verify.ts

@@ -6,6 +6,7 @@
 
 import type * as types from '../../types.d.ts'
 import { flattenedVerify } from '../flattened/verify.js'
+import type { FlattenedVerifyGetKey } from '../flattened/verify.js'
 import { JWSInvalid } from '../../util/errors.js'
 import { decoder } from '../../lib/buffer_utils.js'
 
@@ -15,9 +16,12 @@ import { decoder } from '../../lib/buffer_utils.js'
  *
  * @see {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} to verify using a remote JSON Web Key Set.
  */
-export interface CompactVerifyGetKey extends types.GetKeyFunction<
+export interface CompactVerifyGetKey<
+  KeyType extends types.CryptoKey | Uint8Array = types.CryptoKey | Uint8Array,
+> extends types.GetKeyFunction<
   types.CompactJWSHeaderParameters,
-  types.FlattenedJWSInput
+  types.FlattenedJWSInput,
+  KeyType | types.KeyObject | types.JWK
 > {}
 
 /**
@@ -45,23 +49,43 @@ export interface CompactVerifyGetKey extends types.GetKeyFunction<
  */
 export function compactVerify(
   jws: string | Uint8Array,
-  key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array,
+  key: types.KeyInput,
   options?: types.VerifyOptions,
 ): Promise<types.CompactVerifyResult>
 /**
+ * Verifies the signature and format of and afterwards decodes the Compact JWS, resolving the key
+ * dynamically. The result additionally carries the {@link types.ResolvedKey.key resolved key}.
+ *
  * @param jws Compact JWS.
  * @param getKey Function resolving a key to verify the JWS with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  * @param options JWS Verify options.
  */
+export function compactVerify<
+  KeyType extends types.CryptoKey | Uint8Array = types.CryptoKey | Uint8Array,
+>(
+  jws: string | Uint8Array,
+  getKey: CompactVerifyGetKey<KeyType>,
+  options?: types.VerifyOptions,
+): Promise<types.CompactVerifyResult & types.ResolvedKey<KeyType>>
+/**
+ * Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
+ * either a key or a key resolution function; `key` is present on the result only when a resolution
+ * function was used.
+ *
+ * @param jws Compact JWS.
+ * @param key Key, or function resolving a key, to verify the JWS with. See
+ *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ * @param options JWS Verify options.
+ */
 export function compactVerify(
   jws: string | Uint8Array,
-  getKey: CompactVerifyGetKey,
+  key: types.KeyInput | CompactVerifyGetKey,
   options?: types.VerifyOptions,
-): Promise<types.CompactVerifyResult & types.ResolvedKey>
+): Promise<types.CompactVerifyResult & Partial<types.ResolvedKey>>
 export async function compactVerify(
   jws: string | Uint8Array,
-  key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array | CompactVerifyGetKey,
+  key: types.KeyInput | CompactVerifyGetKey,
   options?: types.VerifyOptions,
 ) {
   if (jws instanceof Uint8Array) {
@@ -77,9 +101,12 @@ export async function compactVerify(
     throw new JWSInvalid('Invalid Compact JWS')
   }
 
+  // A CompactVerifyGetKey declares a narrower Protected Header than a FlattenedVerifyGetKey does,
+  // so it is not assignable to one. Delegating is nevertheless sound: flattenedVerify rejects a JWS
+  // whose Protected Header has no "alg" before it ever calls the resolver.
   const verified = await flattenedVerify(
     { payload, protected: protectedHeader, signature },
-    key as Parameters<typeof flattenedVerify>[1],
+    key as types.KeyInput | FlattenedVerifyGetKey,
     options,
   )
 

src/jws/flattened/sign.ts

@@ -82,10 +82,7 @@ export class FlattenedSign {
    *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
    * @param options JWS Sign options.
    */
-  async sign(
-    key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array,
-    options?: types.SignOptions,
-  ): Promise<types.FlattenedJWS> {
+  async sign(key: types.KeyInput, options?: types.SignOptions): Promise<types.FlattenedJWS> {
     if (!this.#protectedHeader && !this.#unprotectedHeader) {
       throw new JWSInvalid(
         'either setProtectedHeader or setUnprotectedHeader must be called before #sign()',

src/jws/flattened/verify.ts

@@ -24,9 +24,12 @@ import { normalizeKey } from '../../lib/normalize_key.js'
  *
  * @see {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} to verify using a remote JSON Web Key Set.
  */
-export interface FlattenedVerifyGetKey extends types.GetKeyFunction<
+export interface FlattenedVerifyGetKey<
+  KeyType extends types.CryptoKey | Uint8Array = types.CryptoKey | Uint8Array,
+> extends types.GetKeyFunction<
   types.JWSHeaderParameters,
-  types.FlattenedJWSInput
+  types.FlattenedJWSInput,
+  KeyType | types.KeyObject | types.JWK
 > {}
 
 /**
@@ -59,23 +62,43 @@ export interface FlattenedVerifyGetKey extends types.GetKeyFunction<
  */
 export function flattenedVerify(
   jws: types.FlattenedJWSInput,
-  key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array,
+  key: types.KeyInput,
   options?: types.VerifyOptions,
 ): Promise<types.FlattenedVerifyResult>
 /**
+ * Verifies the signature and format of and afterwards decodes the Flattened JWS, resolving the key
+ * dynamically. The result additionally carries the {@link types.ResolvedKey.key resolved key}.
+ *
  * @param jws Flattened JWS.
  * @param getKey Function resolving a key to verify the JWS with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  * @param options JWS Verify options.
  */
+export function flattenedVerify<
+  KeyType extends types.CryptoKey | Uint8Array = types.CryptoKey | Uint8Array,
+>(
+  jws: types.FlattenedJWSInput,
+  getKey: FlattenedVerifyGetKey<KeyType>,
+  options?: types.VerifyOptions,
+): Promise<types.FlattenedVerifyResult & types.ResolvedKey<KeyType>>
+/**
+ * Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
+ * either a key or a key resolution function; `key` is present on the result only when a resolution
+ * function was used.
+ *
+ * @param jws Flattened JWS.
+ * @param key Key, or function resolving a key, to verify the JWS with. See
+ *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ * @param options JWS Verify options.
+ */
 export function flattenedVerify(
   jws: types.FlattenedJWSInput,
-  getKey: FlattenedVerifyGetKey,
+  key: types.KeyInput | FlattenedVerifyGetKey,
   options?: types.VerifyOptions,
-): Promise<types.FlattenedVerifyResult & types.ResolvedKey>
+): Promise<types.FlattenedVerifyResult & Partial<types.ResolvedKey>>
 export async function flattenedVerify(
   jws: types.FlattenedJWSInput,
-  key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array | FlattenedVerifyGetKey,
+  key: types.KeyInput | FlattenedVerifyGetKey,
   options?: types.VerifyOptions,
 ) {
   if (!isObject(jws)) {

src/jws/general/sign.ts

@@ -25,11 +25,21 @@ export interface Signature {
    */
   setUnprotectedHeader(unprotectedHeader: types.JWSHeaderParameters): Signature
 
-  /** A shorthand for calling addSignature() on the enclosing {@link GeneralSign} instance */
-  addSignature(...args: Parameters<GeneralSign['addSignature']>): Signature
+  /**
+   * A shorthand for calling {@link GeneralSign.addSignature addSignature()} on the enclosing
+   * {@link GeneralSign} instance.
+   *
+   * @param key Private Key or Secret to sign the individual JWS signature with. See
+   *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+   * @param options JWS Sign options.
+   */
+  addSignature(key: types.KeyInput, options?: types.SignOptions): Signature
 
-  /** A shorthand for calling encrypt() on the enclosing {@link GeneralSign} instance */
-  sign(...args: Parameters<GeneralSign['sign']>): Promise<types.GeneralJWS>
+  /**
+   * A shorthand for calling {@link GeneralSign.sign sign()} on the enclosing {@link GeneralSign}
+   * instance. Takes no arguments — each signature's key is supplied to {@link addSignature}.
+   */
+  sign(): Promise<types.GeneralJWS>
 
   /** Returns the enclosing {@link GeneralSign} instance */
   done(): GeneralSign
@@ -41,13 +51,9 @@ class IndividualSignature implements Signature {
   protectedHeader?: types.JWSHeaderParameters
   unprotectedHeader?: types.JWSHeaderParameters
   options?: types.SignOptions
-  key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array
+  key: types.KeyInput
 
-  constructor(
-    sig: GeneralSign,
-    key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array,
-    options?: types.SignOptions,
-  ) {
+  constructor(sig: GeneralSign, key: types.KeyInput, options?: types.SignOptions) {
     this.#parent = sig
     this.key = key
     this.options = options
@@ -120,10 +126,7 @@ export class GeneralSign {
    *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
    * @param options JWS Sign options.
    */
-  addSignature(
-    key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array,
-    options?: types.SignOptions,
-  ): Signature {
+  addSignature(key: types.KeyInput, options?: types.SignOptions): Signature {
     const signature = new IndividualSignature(this, key, options)
     this.#signatures.push(signature)
     return signature

src/jws/general/verify.ts

@@ -15,9 +15,12 @@ import { isObject } from '../../lib/type_checks.js'
  *
  * @see {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} to verify using a remote JSON Web Key Set.
  */
-export interface GeneralVerifyGetKey extends types.GetKeyFunction<
+export interface GeneralVerifyGetKey<
+  KeyType extends types.CryptoKey | Uint8Array = types.CryptoKey | Uint8Array,
+> extends types.GetKeyFunction<
   types.JWSHeaderParameters,
-  types.FlattenedJWSInput
+  types.FlattenedJWSInput,
+  KeyType | types.KeyObject | types.JWK
 > {}
 
 /**
@@ -61,23 +64,43 @@ export interface GeneralVerifyGetKey extends types.GetKeyFunction<
  */
 export function generalVerify(
   jws: types.GeneralJWSInput,
-  key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array,
+  key: types.KeyInput,
   options?: types.VerifyOptions,
 ): Promise<types.GeneralVerifyResult>
 /**
+ * Verifies the signature and format of and afterwards decodes the General JWS, resolving the key
+ * dynamically. The result additionally carries the {@link types.ResolvedKey.key resolved key}.
+ *
  * @param jws General JWS.
  * @param getKey Function resolving a key to verify the JWS with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  * @param options JWS Verify options.
  */
+export function generalVerify<
+  KeyType extends types.CryptoKey | Uint8Array = types.CryptoKey | Uint8Array,
+>(
+  jws: types.GeneralJWSInput,
+  getKey: GeneralVerifyGetKey<KeyType>,
+  options?: types.VerifyOptions,
+): Promise<types.GeneralVerifyResult & types.ResolvedKey<KeyType>>
+/**
+ * Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
+ * either a key or a key resolution function; `key` is present on the result only when a resolution
+ * function was used.
+ *
+ * @param jws General JWS.
+ * @param key Key, or function resolving a key, to verify the JWS with. See
+ *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ * @param options JWS Verify options.
+ */
 export function generalVerify(
   jws: types.GeneralJWSInput,
-  getKey: GeneralVerifyGetKey,
+  key: types.KeyInput | GeneralVerifyGetKey,
   options?: types.VerifyOptions,
-): Promise<types.GeneralVerifyResult & types.ResolvedKey>
+): Promise<types.GeneralVerifyResult & Partial<types.ResolvedKey>>
 export async function generalVerify(
   jws: types.GeneralJWSInput,
-  key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array | GeneralVerifyGetKey,
+  key: types.KeyInput | GeneralVerifyGetKey,
   options?: types.VerifyOptions,
 ) {
   if (!isObject(jws)) {
@@ -97,7 +120,7 @@ export async function generalVerify(
           protected: signature.protected,
           signature: signature.signature,
         },
-        key as Parameters<typeof flattenedVerify>[1],
+        key,
         options,
       )
     } catch {

src/jwt/decrypt.ts

@@ -17,9 +17,12 @@ export interface JWTDecryptOptions
  * Interface for JWT Decryption dynamic key resolution. No token components have been verified at
  * the time of this function call.
  */
-export interface JWTDecryptGetKey extends types.GetKeyFunction<
+export interface JWTDecryptGetKey<
+  KeyType extends types.CryptoKey | Uint8Array = types.CryptoKey | Uint8Array,
+> extends types.GetKeyFunction<
   types.CompactJWEHeaderParameters,
-  types.FlattenedJWE
+  types.FlattenedJWE,
+  KeyType | types.KeyObject | types.JWK
 > {}
 
 /**
@@ -50,28 +53,49 @@ export interface JWTDecryptGetKey extends types.GetKeyFunction<
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  * @param options JWT Decryption and JWT Claims Set validation options.
  */
-export async function jwtDecrypt<PayloadType = types.JWTPayload>(
+export function jwtDecrypt<PayloadType = types.JWTPayload>(
   jwt: string | Uint8Array,
-  key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array,
+  key: types.KeyInput,
   options?: JWTDecryptOptions,
 ): Promise<types.JWTDecryptResult<PayloadType>>
 /**
+ * Decrypts a JWT and validates its JWT Claims Set, resolving the key dynamically. The result
+ * additionally carries the {@link types.ResolvedKey.key resolved key}.
+ *
  * @param jwt JSON Web Token value (encoded as JWE).
  * @param getKey Function resolving Private Key or Secret to decrypt and verify the JWT with. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  * @param options JWT Decryption and JWT Claims Set validation options.
  */
-export async function jwtDecrypt<PayloadType = types.JWTPayload>(
+export function jwtDecrypt<
+  PayloadType = types.JWTPayload,
+  KeyType extends types.CryptoKey | Uint8Array = types.CryptoKey | Uint8Array,
+>(
   jwt: string | Uint8Array,
-  getKey: JWTDecryptGetKey,
+  getKey: JWTDecryptGetKey<KeyType>,
   options?: JWTDecryptOptions,
-): Promise<types.JWTDecryptResult<PayloadType> & types.ResolvedKey>
+): Promise<types.JWTDecryptResult<PayloadType> & types.ResolvedKey<KeyType>>
+/**
+ * Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
+ * either a key or a key resolution function; `key` is present on the result only when a resolution
+ * function was used.
+ *
+ * @param jwt JSON Web Token value (encoded as JWE).
+ * @param key Private Key or Secret, or a function resolving one, to decrypt and verify the JWT
+ *   with. See {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+ * @param options JWT Decryption and JWT Claims Set validation options.
+ */
+export function jwtDecrypt<PayloadType = types.JWTPayload>(
+  jwt: string | Uint8Array,
+  key: types.KeyInput | JWTDecryptGetKey,
+  options?: JWTDecryptOptions,
+): Promise<types.JWTDecryptResult<PayloadType> & Partial<types.ResolvedKey>>
 export async function jwtDecrypt(
   jwt: string | Uint8Array,
-  key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array | JWTDecryptGetKey,
+  key: types.KeyInput | JWTDecryptGetKey,
   options?: JWTDecryptOptions,
 ) {
-  const decrypted = await compactDecrypt(jwt, key as Parameters<typeof compactDecrypt>[1], options)
+  const decrypted = await compactDecrypt(jwt, key, options)
   const payload = validateClaimsSet(decrypted.protectedHeader, decrypted.plaintext, options)
 
   const { protectedHeader } = decrypted

src/jwt/encrypt.ts

@@ -184,10 +184,7 @@ export class EncryptJWT implements types.ProduceJWT {
    *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
    * @param options JWE Encryption options.
    */
-  async encrypt(
-    key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array,
-    options?: types.EncryptOptions,
-  ): Promise<string> {
+  async encrypt(key: types.KeyInput, options?: types.EncryptOptions): Promise<string> {
     const enc = new CompactEncrypt(this.#jwt.data())
     if (
       this.#protectedHeader &&

src/jwt/sign.ts

@@ -179,10 +179,7 @@ export class SignJWT implements types.ProduceJWT {
    *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
    * @param options JWT Sign options.
    */
-  async sign(
-    key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array,
-    options?: types.SignOptions,
-  ): Promise<string> {
+  async sign(key: types.KeyInput, options?: types.SignOptions): Promise<string> {
     const sig = new CompactSign(this.#jwt.data())
     sig.setProtectedHeader(this.#protectedHeader)
     if (

src/jwt/unsecured.ts

@@ -13,7 +13,10 @@ import { validateClaimsSet, JWTClaimsBuilder } from '../lib/jwt_claims_set.js'
 
 /** Result of decoding an Unsecured JWT. */
 export interface UnsecuredResult<PayloadType = types.JWTPayload> {
-  payload: PayloadType & types.JWTPayload
+  payload: PayloadType &
+    types.JWTPayload &
+    ([PayloadType] extends [object] ? unknown : unknown extends PayloadType ? unknown : never)
+
   header: types.JWSHeaderParameters
 }
 

src/jwt/verify.ts

@@ -18,9 +18,12 @@ export interface JWTVerifyOptions extends types.VerifyOptions, types.JWTClaimVer
  *
  * @see {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} to verify using a remote JSON Web Key Set.
  */
-export interface JWTVerifyGetKey extends types.GetKeyFunction<
+export interface JWTVerifyGetKey<
+  KeyType extends types.CryptoKey | Uint8Array = types.CryptoKey | Uint8Array,
+> extends types.GetKeyFunction<
   types.CompactJWSHeaderParameters,
-  types.FlattenedJWSInput
+  types.FlattenedJWSInput,
+  KeyType | types.KeyObject | types.JWK
 > {}
 
 /**
@@ -109,7 +112,7 @@ export interface JWTVerifyGetKey extends types.GetKeyFunction<
  */
 export async function jwtVerify<PayloadType = types.JWTPayload>(
   jwt: string | Uint8Array,
-  key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array,
+  key: types.KeyInput,
   options?: JWTVerifyOptions,
 ): Promise<types.JWTVerifyResult<PayloadType>>
 
@@ -134,18 +137,37 @@ export async function jwtVerify<PayloadType = types.JWTPayload>(
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  * @param options JWT Decryption and JWT Claims Set validation options.
  */
+export async function jwtVerify<
+  PayloadType = types.JWTPayload,
+  KeyType extends types.CryptoKey | Uint8Array = types.CryptoKey | Uint8Array,
+>(
+  jwt: string | Uint8Array,
+  getKey: JWTVerifyGetKey<KeyType>,
+  options?: JWTVerifyOptions,
+): Promise<types.JWTVerifyResult<PayloadType> & types.ResolvedKey<KeyType>>
+
+/**
+ * Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
+ * either a key or a key resolution function; `key` is present on the result only when a resolution
+ * function was used.
+ *
+ * @param jwt JSON Web Token value (encoded as JWS).
+ * @param key Key, or function resolving a key, to verify the JWT with. See
+ *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ * @param options JWT Decryption and JWT Claims Set validation options.
+ */
 export async function jwtVerify<PayloadType = types.JWTPayload>(
   jwt: string | Uint8Array,
-  getKey: JWTVerifyGetKey,
+  key: types.KeyInput | JWTVerifyGetKey,
   options?: JWTVerifyOptions,
-): Promise<types.JWTVerifyResult<PayloadType> & types.ResolvedKey>
+): Promise<types.JWTVerifyResult<PayloadType> & Partial<types.ResolvedKey>>
 
 export async function jwtVerify(
   jwt: string | Uint8Array,
-  key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array | JWTVerifyGetKey,
+  key: types.KeyInput | JWTVerifyGetKey,
   options?: JWTVerifyOptions,
 ) {
-  const verified = await compactVerify(jwt, key as Parameters<typeof compactVerify>[1], options)
+  const verified = await compactVerify(jwt, key, options)
   if (verified.protectedHeader.crit?.includes('b64') && verified.protectedHeader.b64 === false) {
     throw new JWTInvalid('JWTs MUST NOT use unencoded payload')
   }

src/key/generate_secret.ts

@@ -33,6 +33,21 @@ export type GenerateSecretAlgorithm =
   | 'A256GCM'
   | (string & {})
 
+/**
+ * Resolves what {@link generateSecret} returns for a given JWA Algorithm Identifier.
+ *
+ * The AES_CBC_HMAC_SHA2 content encryption algorithms have no {@link !CryptoKey} representation, so
+ * they yield a {@link !Uint8Array}; every other supported identifier yields a
+ * {@link types.CryptoKey CryptoKey}. When the identifier is not statically known this resolves to
+ * the union, as before.
+ */
+export type GeneratedSecret<Alg extends string> = Alg extends
+  'A128CBC-HS256' | 'A192CBC-HS384' | 'A256CBC-HS512'
+  ? Uint8Array
+  : string extends Alg
+    ? types.CryptoKey | Uint8Array
+    : types.CryptoKey
+
 /** Secret generation function options. */
 export interface GenerateSecretOptions {
   /**
@@ -69,8 +84,12 @@ export interface GenerateSecretOptions {
  *   {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}.
  * @param options Additional options passed down to the secret generation.
  */
+export function generateSecret<Alg extends GenerateSecretAlgorithm>(
+  alg: Alg,
+  options?: GenerateSecretOptions,
+): Promise<GeneratedSecret<Alg>>
 export async function generateSecret(
-  alg: GenerateSecretAlgorithm,
+  alg: string,
   options?: GenerateSecretOptions,
 ): Promise<types.CryptoKey | Uint8Array> {
   let length: number

src/key/import.ts

@@ -12,6 +12,21 @@ import { JOSENotSupported } from '../util/errors.js'
 import { isObject } from '../lib/type_checks.js'
 import type * as types from '../types.d.ts'
 
+/**
+ * Resolves what {@link importJWK} returns for a given JWK type.
+ *
+ * The "kty" (Key Type) Parameter fully determines the outcome at runtime: `"oct"` yields a
+ * {@link !Uint8Array} secret, every other supported key type yields a
+ * {@link types.CryptoKey CryptoKey}. When "kty" is not statically known — the usual case for a JWK
+ * parsed from JSON, or for a value typed as {@link types.JWK JWK} — this resolves to the union, as
+ * before.
+ */
+export type ImportedJWK<JWKType extends types.JWK> = JWKType extends { kty: 'oct' }
+  ? Uint8Array
+  : JWKType extends { kty: 'AKP' | 'EC' | 'OKP' | 'RSA' }
+    ? types.CryptoKey
+    : types.CryptoKey | Uint8Array
+
 /** Key Import Function options. */
 export interface KeyImportOptions {
   /**
@@ -182,6 +197,11 @@ export async function importPKCS8(
  *   property on the JWK. See
  *   {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}.
  */
+export function importJWK<JWKType extends types.JWK>(
+  jwk: JWKType,
+  alg?: string,
+  options?: KeyImportOptions,
+): Promise<ImportedJWK<JWKType>>
 export async function importJWK(
   jwk: types.JWK,
   alg?: string,

src/lib/normalize_key.ts

@@ -197,7 +197,7 @@ const handleKeyObject = (keyObject: ConvertableKeyObject, alg: string) => {
 }
 
 export async function normalizeKey(
-  key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array,
+  key: types.KeyInput,
   alg: string,
 ): Promise<types.CryptoKey | Uint8Array> {
   if (key instanceof Uint8Array) {

src/types.d.ts

@@ -114,6 +114,13 @@ export type JWKParameters = {
   kid?: string
 }
 
+/**
+ * Key or secret input accepted by all sign, verify, encrypt, and decrypt operations.
+ *
+ * @see {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}
+ */
+export type KeyInput = CryptoKey | KeyObject | JWK | Uint8Array
+
 /** Convenience interface for Public OKP JSON Web Keys */
 export interface JWK_OKP_Public extends JWKParameters {
   /** OKP JWK "crv" (The Subtype of Key Pair) Parameter */
@@ -342,12 +349,14 @@ export interface GenericGetKeyFunction<IProtectedHeader, IToken, ReturnKeyTypes>
  *
  * @typeParam IProtectedHeader Type definition of the JWE or JWS Protected Header.
  * @typeParam IToken Type definition of the consumed JWE or JWS token.
+ * @typeParam KeyTypes Type definition of the keys the function may resolve. Narrowing this is what
+ *   lets {@link ResolvedKey.key} be inferred at the call site.
  */
-export interface GetKeyFunction<IProtectedHeader, IToken> extends GenericGetKeyFunction<
+export interface GetKeyFunction<
   IProtectedHeader,
   IToken,
-  CryptoKey | KeyObject | JWK | Uint8Array
-> {}
+  KeyTypes extends KeyInput = KeyInput,
+> extends GenericGetKeyFunction<IProtectedHeader, IToken, KeyTypes> {}
 
 /**
  * Flattened JWS definition for verify function inputs, allows payload as {@link !Uint8Array} for
@@ -850,7 +859,9 @@ export interface CompactVerifyResult {
 /** Signed JSON Web Token (JWT) verification result */
 export interface JWTVerifyResult<PayloadType = JWTPayload> {
   /** JWT Claims Set. */
-  payload: PayloadType & JWTPayload
+  payload: PayloadType &
+    JWTPayload &
+    ([PayloadType] extends [object] ? unknown : unknown extends PayloadType ? unknown : never)
 
   /** JWS Protected Header. */
   protectedHeader: JWTHeaderParameters
@@ -859,16 +870,26 @@ export interface JWTVerifyResult<PayloadType = JWTPayload> {
 /** Encrypted JSON Web Token (JWT) decryption result */
 export interface JWTDecryptResult<PayloadType = JWTPayload> {
   /** JWT Claims Set. */
-  payload: PayloadType & JWTPayload
+  payload: PayloadType &
+    JWTPayload &
+    ([PayloadType] extends [object] ? unknown : unknown extends PayloadType ? unknown : never)
 
   /** JWE Protected Header. */
   protectedHeader: CompactJWEHeaderParameters
 }
 
-/** When key resolver functions are used this becomes part of successful resolves */
-export interface ResolvedKey {
+/**
+ * When key resolver functions are used this becomes part of successful resolves
+ *
+ * @param KeyType Type of the resolved key. Inferred from the key resolver function's return type,
+ *   so a resolver declared to return only {@link CryptoKey} — as
+ *   {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet},
+ *   {@link jwks/local.createLocalJWKSet createLocalJWKSet}, and
+ *   {@link jwk/embedded.EmbeddedJWK EmbeddedJWK} all are — needs no narrowing at the call site.
+ */
+export interface ResolvedKey<KeyType extends CryptoKey | Uint8Array = CryptoKey | Uint8Array> {
   /** Key resolved from the key resolver function. */
-  key: CryptoKey | Uint8Array
+  key: KeyType
 }
 
 /** Recognized Compact JWS Header Parameters, any other Header Members may also be present. */

src/util/decode_jwt.ts

@@ -30,7 +30,9 @@ import { JWTInvalid } from './errors.js'
  */
 export function decodeJwt<PayloadType = types.JWTPayload>(
   jwt: string,
-): PayloadType & types.JWTPayload {
+): PayloadType &
+  types.JWTPayload &
+  ([PayloadType] extends [object] ? unknown : unknown extends PayloadType ? unknown : never) {
   if (typeof jwt !== 'string')
     throw new JWTInvalid('JWTs must use Compact JWS serialization, JWT must be a string')
 
@@ -54,8 +56,9 @@ export function decodeJwt<PayloadType = types.JWTPayload>(
     throw new JWTInvalid('Failed to parse the decoded payload as JSON')
   }
 
-  if (!isObject<PayloadType & types.JWTPayload>(result))
-    throw new JWTInvalid('Invalid JWT Claims Set')
+  if (!isObject<types.JWTPayload>(result)) throw new JWTInvalid('Invalid JWT Claims Set')
 
-  return result
+  return result as PayloadType &
+    types.JWTPayload &
+    ([PayloadType] extends [object] ? unknown : unknown extends PayloadType ? unknown : never)
 }

tools/docs.cjs

@@ -48,6 +48,15 @@ globSync('docs/**/*.md').forEach((file) => {
     // before listing the members under "Type Declaration" anyway - so the line carries nothing an
     // interface's page would have had, and goes.
     .replace(/^• \*\*\w+\*\* = `object`\n\n/gm, '')
+    // The JWT Claims Set types carry a third intersection member that is `unknown` for every type
+    // able to describe a Claims Set and `never` for the rest, so that a payload type parameter can
+    // be rejected without constraining it - constraining rejects a wrapper forwarding an
+    // unconstrained type parameter of its own. It contributes nothing to what the payload IS, so a
+    // reader is left with the intersection these pages have always stated.
+    .replace(
+      / & \\\[`(\w+)`\\\] \*extends\* \\\[`object`\\\] \? `unknown` : `unknown` \*extends\* `\1` \? `unknown` : `never`/g,
+      '',
+    )
 
   writeFileSync(file, content, 'utf-8')
 })