Module not found: Can't resolve 'jose/jwt/sign'

[qikevinjkw]

Describe the bug

To Reproduce

1. npm install jose
2. Try to import like so: import { SignJWT } from "jose/jwt/sign";
3. Typescript compiler errors: Module not found: Can't resolve 'jose/jwt/sign'

Code to reproduce the behaviour: https://stackblitz.com/edit/react-ts-kkyw3y

Expected behaviour
Should import correctly with no errors

Environment:

• jose version: v3.11.6
• affected runtime is: Node.js 14.15.0
• other relevant library versions: typescript@4.2.4

[panva]

jose version: v3.11.6
affected runtime is: Node.js 14.15.0

works 🎉

❯ node -v
v14.15.0

❯ node -e 'import {SignJWT} from "jose/jwt/sign";console.log(SignJWT)' --input-type=module
[class SignJWT extends ProduceJWT]

I am unable to provide solutions for non-standard loaders or ecosystems that chose to build their own loaders are not keeping them up to date with node's own module resolution algorithm.

[tellnes]

I'm solving this problem by importing the relevant files directly. I put this into an intermediate file jose.ts and can then import like I expect to from that. Eg. like this:

import type * as T_SignJWT from 'jose/dist/types/jwt/sign'
export const { default: SignJWT } = require('jose/dist/node/cjs/jwt/sign') as typeof T_SignJWT

import type * as T_jwtVerify from 'jose/dist/types/jwt/verify'
export const { default: jwtVerify } = require('jose/dist/node/cjs/jwt/verify') as typeof T_jwtVerify

And then I can use it like this:

import { SignJWT } from './jose'

Yes I know I'm relying on internals here, but if it breaks, I can quickly fix it by editing one file on my end.

[robations]

In my experience, this can be caused by a missing "main" key in the package.json file, which is see is missing in 3.11.6.

But also, the paths in the documentation don't exist, so I don't see how the import would ever work as documented:

https://unpkg.com/browse/jose@3.11.6/

> var {jwtVerify} = require("jose/jwt/verify");
// Thrown:
{ Error: Cannot find module 'jose/jwt/verify'
    at Function.Module._resolveFilename (internal/modules/cjs/loader.js:636:15)
    at Function.Module._load (internal/modules/cjs/loader.js:562:25)
    at Module.require (internal/modules/cjs/loader.js:692:17)
    at require (internal/modules/cjs/helpers.js:25:18) code: 'MODULE_NOT_FOUND' }

Obviously there is no JS module at node_modules/jose/jwt/verify.js or node_modules/jose/jwt/verify/index.js. Only in the dist directory.

Am I missing something here?

[panva]

In my experience, this can be caused by a missing "main"

There's no "main" entry because there's no "main" package or export. It's just submodules, using a node loader feature present in the supported runtimes. Tooling is slowly catching up, but is just not quite there yet.

so I don't see how the import would ever work as documented

Well, clearly they do - there are plenty of consumers of this package major already. Plus, see the proof of working code i've posted above.

Am I missing something here?

https://nodejs.org/api/packages.html#packages_subpath_exports
https://nodejs.org/api/packages.html#packages_conditional_exports

[robations]

Well, clearly they do - there are plenty of consumers of this package

Yes, that's why I thought I was missing something...

Taking a look at the "exports" docs now, I've somehow not come across this before. I'm still stuck on nodejs 10 (and node loader support was added in 12) so I might need to use @tellnes's workaround for now.

Thanks for the quick reply.

[panva]

Well, node 10 is not a supported runtime. Not only because of the module features. But crypto itself requires node 12. LTS ^12.19.0 || ^14.15.0

[robations]

I did notice that (after commenting). What about adding an engines field? Might save you a few unnecessary reports.

https://docs.npmjs.com/cli/v7/configuring-npm/package-json#engines

[panva]

I'm aware of the engines field, but this is a universal package. Not sure how other runtimes would be affected.

[robations]

I see what you mean (eg installing with nodejs, but intended use for browser), but it's only advisory unless you use engine-strict:

Unless the user has set the engine-strict config flag, this field is advisory only and will only produce warnings when your package is installed as a dependency.

And this would allow me to continue using it until I get my stupid projects tested/updated with 12+...

But I only make a suggestion.

[panva]

And this would allow me to continue using it until I get my stupid projects tested/updated with 12+...

Can you elaborate, I'm afraid I don't quite follow.

[robations]

Sorry, ignore that sentence. I thought I had tested the functionality I needed working with nodejs 10, but I was still using 12.

// with nodejs 10
> var {jwtVerify} = require("jose/dist/node/cjs/jwt/verify");
Thrown:
ReferenceError: TextEncoder is not defined

Because of crypto requirements, as you stated.

[a7madgamal]

I have this error in a standard create-react-app typescript setup. I think this should be re-opened and investigated.
if we need to take care of something maybe the fix is just adding some guidance on the read.me file.