@pagopa/io-react-native-jwt 0.5.0 → 0.6.0

package/README.md

@@ -52,6 +52,20 @@ const {protectedHeader, payload} = await verify(jwt, pubJwk, options);
 console.log(protectedHeader, payload)
 ```
 
+### Verify JWT with JWKS fetched from remote URL
+
+```js
+import { verify, getRemoteJWKSet } from '@pagopa/io-react-native-jwt';
+
+// ...
+const wellKnownUrl = 'https://example.com/.well-known/openid-federation';
+const jwks = await getRemoteJWKSet(wellKnownUrl);
+
+const jwt = "eyJ0eXAiOiJlbnRpdHktc3.....";
+
+const {protectedHeader, payload} = await verify(jwt, jwks);
+console.log(protectedHeader, payload)
+```
 
 ### Verify a JWT signature (JWS)
 

package/lib/commonjs/jwk/index.js

@@ -3,8 +3,11 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.thumbprint = void 0;
+exports.thumbprint = exports.getRemoteJWKSet = void 0;
 var _proxy = require("../utils/proxy");
+var _types = require("../types");
+var _errors = require("../utils/errors");
+var _ = require("..");
 /**
  * Calculate JWK thumbprint
  *
@@ -25,5 +28,27 @@ var _proxy = require("../utils/proxy");
  * @param jwk JSON Web Key
  */
 const thumbprint = jwk => _proxy.IoReactNativeJwt.thumbprint(jwk);
+
+/**
+ * Returns a JSON Web Key Set (JWKS) downloaded from a remote endpoint,
+ * that is, for example, an OAuth 2.0 or OIDC jwks_uri.
+ *
+ * @param url URL string to fetch the JSON Web Key Set from.
+ * @param appFetch fetch function (optional)
+ */
 exports.thumbprint = thumbprint;
+const getRemoteJWKSet = async function (url) {
+  let appFetch = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : fetch;
+  let response = await appFetch(url);
+  if (response.status === 200) {
+    const jwt = await response.text();
+    const {
+      payload
+    } = await (0, _.decode)(jwt);
+    const parsedPayload = _types.WithJWKS.parse(payload);
+    return parsedPayload.jwks.keys;
+  }
+  throw new _errors.JWKSetInvalid(`Unable to obtain JWKSet from given url. Response status: ${response.status}`);
+};
+exports.getRemoteJWKSet = getRemoteJWKSet;
 //# sourceMappingURL=index.js.map

package/lib/commonjs/jwk/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["_proxy","require","thumbprint","jwk","IoReactNativeJwt","exports"],"sourceRoot":"../../../src","sources":["jwk/index.ts"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMC,UAAU,GAAIC,GAAQ,IACjCC,uBAAgB,CAACF,UAAU,CAACC,GAAG,CAAC;AAACE,OAAA,CAAAH,UAAA,GAAAA,UAAA"}
+{"version":3,"names":["_proxy","require","_types","_errors","_","thumbprint","jwk","IoReactNativeJwt","exports","getRemoteJWKSet","url","appFetch","arguments","length","undefined","fetch","response","status","jwt","text","payload","decode","parsedPayload","WithJWKS","parse","jwks","keys","JWKSetInvalid"],"sourceRoot":"../../../src","sources":["jwk/index.ts"],"mappings":";;;;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,MAAA,GAAAD,OAAA;AACA,IAAAE,OAAA,GAAAF,OAAA;AACA,IAAAG,CAAA,GAAAH,OAAA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMI,UAAU,GAAIC,GAAQ,IACjCC,uBAAgB,CAACF,UAAU,CAACC,GAAG,CAAC;;AAElC;AACA;AACA;AACA;AACA;AACA;AACA;AANAE,OAAA,CAAAH,UAAA,GAAAA,UAAA;AAOO,MAAMI,eAAe,GAAG,eAAAA,CAC7BC,GAAW,EAEQ;EAAA,IADnBC,QAA8B,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAGG,KAAK;EAEtC,IAAIC,QAAQ,GAAG,MAAML,QAAQ,CAACD,GAAG,CAAC;EAElC,IAAIM,QAAQ,CAACC,MAAM,KAAK,GAAG,EAAE;IAC3B,MAAMC,GAAG,GAAG,MAAMF,QAAQ,CAACG,IAAI,CAAC,CAAC;IACjC,MAAM;MAAEC;IAAQ,CAAC,GAAG,MAAM,IAAAC,QAAM,EAACH,GAAG,CAAC;IACrC,MAAMI,aAAa,GAAGC,eAAQ,CAACC,KAAK,CAACJ,OAAO,CAAC;IAC7C,OAAOE,aAAa,CAACG,IAAI,CAACC,IAAI;EAChC;EAEA,MAAM,IAAIC,qBAAa,CACpB,4DAA2DX,QAAQ,CAACC,MAAO,EAC9E,CAAC;AACH,CAAC;AAACT,OAAA,CAAAC,eAAA,GAAAA,eAAA"}

package/lib/commonjs/jwt/index.js

@@ -7,6 +7,7 @@ var _exportNames = {
   decode: true,
   isSignatureValid: true,
   verify: true,
+  getJwkFromHeader: true,
   derToJose: true,
   encodeBase64: true,
   decodeBase64: true,
@@ -31,7 +32,7 @@ Object.defineProperty(exports, "encodeBase64", {
     return _base.encodeBase64;
   }
 });
-exports.isSignatureValid = void 0;
+exports.isSignatureValid = exports.getJwkFromHeader = void 0;
 Object.defineProperty(exports, "sha256ToBase64", {
   enumerable: true,
   get: function () {
@@ -54,6 +55,7 @@ Object.keys(_sign).forEach(function (key) {
     }
   });
 });
+var _algorithms = require("../algorithms");
 var _produce = require("./produce");
 Object.keys(_produce).forEach(function (key) {
   if (key === "default" || key === "__esModule") return;
@@ -145,8 +147,23 @@ const isSignatureValid = (token, jwk) => _proxy.IoReactNativeJwt.verify(token, j
  * })
  * ```
  *
+ *  * @example Usage with a JWKSet
+ *
+ * ```js
+ * const wellKnownUrl = 'https://example.com/.well-known/openid-federation';
+ * const jwks = await getRemoteJWKSet(wellKnownUrl);
+ *
+ * const jwt =
+ *   'eyJ0eXAiOiJlbnRpdHktc3RhdGVtZW50K2p3dCIsImtpZCI6IkVDIzEiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0LyIsInN1YiI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvIiwibWV0YWRhdGEiOnsiZXVkaV93YWxsZXRfcHJvdmlkZXIiOnsiandrcyI6W3siY3J2IjoiUC0yNTYiLCJrdHkiOiJFQyIsIngiOiJxckpyajNBZl9CNTdzYk9JUnJjQk03YnI3d09jOHluajdsSEZQVGVmZlVrIiwieSI6IjFIMGNXRHlHZ3ZVOHcta1BLVV94eWNPQ1VOVDJvMGJ3c2xJUXRuUFU2aU0iLCJraWQiOiJFQyMxIn1dLCJ0b2tlbl9lbmRwb2ludCI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvdG9rZW4iLCJhc2NfdmFsdWVzX3N1cHBvcnRlZCI6WyJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0L0xvQS9iYXNpYyIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL21lZGl1bSIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL2hpZ2h0Il0sImdyYW50X3R5cGVzX3N1cHBvcnRlZCI6WyJ1cm46aWV0ZjpwYXJhbXM6b2F1dGg6Y2xpZW50LWFzc2VydGlvbi10eXBlOmp3dC1rZXktYXR0ZXN0YXRpb24iXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9tZXRob2RzX3N1cHBvcnRlZCI6WyJwcml2YXRlX2tleV9qd3QiXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9zaWduaW5nX2FsZ192YWx1ZXNfc3VwcG9ydGVkIjpbIkVTMjU2IiwiRVMyNTZLIiwiRVMzODQiLCJFUzUxMiIsIlJTMjU2IiwiUlMzODQiLCJSUzUxMiIsIlBTMjU2IiwiUFMzODQiLCJQUzUxMiJdfSwiZmVkZXJhdGlvbl9lbnRpdHkiOnsib3JnYW5pemF0aW9uX25hbWUiOiJQYWdvUGEgUy5wLkEuIiwiaG9tZXBhZ2VfdXJpIjoiaHR0cHM6Ly9pby5pdGFsaWEuaXQvIiwicG9saWN5X3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L3ByaXZhY3ktcG9saWN5LyIsInRvc191cmkiOiJodHRwczovL2lvLml0YWxpYS5pdC9wcml2YWN5LXBvbGljeS8iLCJsb2dvX3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L2Fzc2V0cy9pbWcvaW8taXQtbG9nby13aGl0ZS5zdmcifX0sImlhdCI6MTY4OTIzNjYzNSwiZXhwIjoxNjg5MjQwMjM1fQ.6wA0M6rNYNSFN_EylzMA6ElAibW7FVSZyoLNEkHU5c_RKuiNenT08YIMvbysYautLZotUedEMP5xCyNpY34x6Q'
+ *
+ * const { payload, protectedHeader } = await verify(jwt, jwks, {
+ *   typ: 'entity-statement+jwt',
+ *   requiredClaims: ['iss', 'sub', 'metadata'],
+ * })
+ * ```
+ *
  * @param jwt JSON Web Token value (encoded as JWS).
- * @param key Public key to verify the JWT in JWK format.
+ * @param key Public key to verify the JWT in JWK format or JWKS (array of JWK).
  * @param options JWT Decryption and JWT Claims Set validation options.
  */
 exports.isSignatureValid = isSignatureValid;
@@ -156,7 +173,8 @@ const verify = async function (token, jwk) {
     protectedHeader,
     payload
   } = await decode(token);
-  const signatureIsValid = await isSignatureValid(token, jwk);
+  const selectedJwk = Array.isArray(jwk) ? getJwkFromHeader(protectedHeader, jwk) : jwk;
+  const signatureIsValid = await isSignatureValid(token, selectedJwk);
   if (signatureIsValid) {
     const verifiedPayload = (0, _jwt_claims_set.default)(protectedHeader, payload, options);
     return {
@@ -167,5 +185,33 @@ const verify = async function (token, jwk) {
     throw new _errors.JWSSignatureVerificationFailed();
   }
 };
+
+/**
+ * Given the header of a JWT return the corresponding key from a JWKS.
+ *
+ * It uses the "alg" (JWS Algorithm) Header Parameter to determine the right JWK "kty" (Key Type),
+ * then proceeds to match the JWK "kid" (Key ID) with one found in the JWS Header Parameters (if
+ * there is one).
+ * Only a single public key must match the selection process.
+ *
+ * @param header JWT header
+ * @param jwks Json Web Key Set (JWKS)
+ *
+ */
 exports.verify = verify;
+const getJwkFromHeader = (header, jwks) => {
+  const {
+    alg,
+    kid
+  } = header;
+  if (alg && kid) {
+    const kty = (0, _algorithms.getKtyFromAlg)(alg);
+    const filteredJwks = jwks.find(el => el.kty === kty && el.kid === kid);
+    if (filteredJwks) {
+      return filteredJwks;
+    }
+  }
+  throw new _errors.JWKNotFound(`No JWKs found that match alg:${alg} and kid:${kid}`);
+};
+exports.getJwkFromHeader = getJwkFromHeader;
 //# sourceMappingURL=index.js.map

package/lib/commonjs/jwt/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["_jwt_claims_set","_interopRequireDefault","require","_errors","_proxy","_sign","Object","keys","forEach","key","prototype","hasOwnProperty","call","_exportNames","exports","defineProperty","enumerable","get","_produce","_unsecured","_asn","_base","_hash","obj","__esModule","default","decode","token","SignJWT","isSignatureValid","jwk","IoReactNativeJwt","verify","options","arguments","length","undefined","protectedHeader","payload","signatureIsValid","verifiedPayload","jwtPayload","JWSSignatureVerificationFailed"],"sourceRoot":"../../../src","sources":["jwt/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,IAAAA,eAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAD,OAAA;AACA,IAAAE,MAAA,GAAAF,OAAA;AACA,IAAAG,KAAA,GAAAH,OAAA;AAIAI,MAAA,CAAAC,IAAA,CAAAF,KAAA,EAAAG,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAJ,KAAA,CAAAI,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAZ,KAAA,CAAAI,GAAA;IAAA;EAAA;AAAA;AADA,IAAAS,QAAA,GAAAhB,OAAA;AAAAI,MAAA,CAAAC,IAAA,CAAAW,QAAA,EAAAV,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAS,QAAA,CAAAT,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAC,QAAA,CAAAT,GAAA;IAAA;EAAA;AAAA;AAEA,IAAAU,UAAA,GAAAjB,OAAA;AAAAI,MAAA,CAAAC,IAAA,CAAAY,UAAA,EAAAX,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAU,UAAA,CAAAV,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAE,UAAA,CAAAV,GAAA;IAAA;EAAA;AAAA;AACA,IAAAW,IAAA,GAAAlB,OAAA;AACA,IAAAmB,KAAA,GAAAnB,OAAA;AACA,IAAAoB,KAAA,GAAApB,OAAA;AAAyC,SAAAD,uBAAAsB,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AACzC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMG,MAAM,GAAIC,KAAa,IAAsBC,aAAO,CAACF,MAAM,CAACC,KAAK,CAAC;;AAE/E;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AApBAb,OAAA,CAAAY,MAAA,GAAAA,MAAA;AAqBO,MAAMG,gBAAgB,GAAGA,CAACF,KAAa,EAAEG,GAAQ,KACtDC,uBAAgB,CAACC,MAAM,CAACL,KAAK,EAAEG,GAAG,CAAC;;AAErC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAzBAhB,OAAA,CAAAe,gBAAA,GAAAA,gBAAA;AA0BO,MAAMG,MAAM,GAAG,eAAAA,CACpBL,KAAa,EACbG,GAAQ,EAEqB;EAAA,IAD7BG,OAAoC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEzC,MAAM;IAAEG,eAAe;IAAEC;EAAQ,CAAC,GAAG,MAAMZ,MAAM,CAACC,KAAK,CAAC;EACxD,MAAMY,gBAAgB,GAAG,MAAMV,gBAAgB,CAACF,KAAK,EAAEG,GAAG,CAAC;EAE3D,IAAIS,gBAAgB,EAAE;IACpB,MAAMC,eAAe,GAAG,IAAAC,uBAAU,EAACJ,eAAe,EAAEC,OAAO,EAAEL,OAAO,CAAC;IACrE,OAAO;MAAEK,OAAO,EAAEE,eAAe;MAAEH;IAAgB,CAAC;EACtD,CAAC,MAAM;IACL,MAAM,IAAIK,sCAA8B,CAAC,CAAC;EAC5C;AACF,CAAC;AAAC5B,OAAA,CAAAkB,MAAA,GAAAA,MAAA"}
+{"version":3,"names":["_jwt_claims_set","_interopRequireDefault","require","_errors","_proxy","_sign","Object","keys","forEach","key","prototype","hasOwnProperty","call","_exportNames","exports","defineProperty","enumerable","get","_algorithms","_produce","_unsecured","_asn","_base","_hash","obj","__esModule","default","decode","token","SignJWT","isSignatureValid","jwk","IoReactNativeJwt","verify","options","arguments","length","undefined","protectedHeader","payload","selectedJwk","Array","isArray","getJwkFromHeader","signatureIsValid","verifiedPayload","jwtPayload","JWSSignatureVerificationFailed","header","jwks","alg","kid","kty","getKtyFromAlg","filteredJwks","find","el","JWKNotFound"],"sourceRoot":"../../../src","sources":["jwt/index.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKA,IAAAA,eAAA,GAAAC,sBAAA,CAAAC,OAAA;AACA,IAAAC,OAAA,GAAAD,OAAA;AACA,IAAAE,MAAA,GAAAF,OAAA;AACA,IAAAG,KAAA,GAAAH,OAAA;AAKAI,MAAA,CAAAC,IAAA,CAAAF,KAAA,EAAAG,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAJ,KAAA,CAAAI,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAZ,KAAA,CAAAI,GAAA;IAAA;EAAA;AAAA;AAHA,IAAAS,WAAA,GAAAhB,OAAA;AAEA,IAAAiB,QAAA,GAAAjB,OAAA;AAAAI,MAAA,CAAAC,IAAA,CAAAY,QAAA,EAAAX,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAU,QAAA,CAAAV,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAE,QAAA,CAAAV,GAAA;IAAA;EAAA;AAAA;AAEA,IAAAW,UAAA,GAAAlB,OAAA;AAAAI,MAAA,CAAAC,IAAA,CAAAa,UAAA,EAAAZ,OAAA,WAAAC,GAAA;EAAA,IAAAA,GAAA,kBAAAA,GAAA;EAAA,IAAAH,MAAA,CAAAI,SAAA,CAAAC,cAAA,CAAAC,IAAA,CAAAC,YAAA,EAAAJ,GAAA;EAAA,IAAAA,GAAA,IAAAK,OAAA,IAAAA,OAAA,CAAAL,GAAA,MAAAW,UAAA,CAAAX,GAAA;EAAAH,MAAA,CAAAS,cAAA,CAAAD,OAAA,EAAAL,GAAA;IAAAO,UAAA;IAAAC,GAAA,WAAAA,CAAA;MAAA,OAAAG,UAAA,CAAAX,GAAA;IAAA;EAAA;AAAA;AACA,IAAAY,IAAA,GAAAnB,OAAA;AACA,IAAAoB,KAAA,GAAApB,OAAA;AACA,IAAAqB,KAAA,GAAArB,OAAA;AAAyC,SAAAD,uBAAAuB,GAAA,WAAAA,GAAA,IAAAA,GAAA,CAAAC,UAAA,GAAAD,GAAA,KAAAE,OAAA,EAAAF,GAAA;AACzC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMG,MAAM,GAAIC,KAAa,IAAsBC,aAAO,CAACF,MAAM,CAACC,KAAK,CAAC;;AAE/E;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AApBAd,OAAA,CAAAa,MAAA,GAAAA,MAAA;AAqBO,MAAMG,gBAAgB,GAAGA,CAACF,KAAa,EAAEG,GAAQ,KACtDC,uBAAgB,CAACC,MAAM,CAACL,KAAK,EAAEG,GAAG,CAAC;;AAErC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAxCAjB,OAAA,CAAAgB,gBAAA,GAAAA,gBAAA;AAyCO,MAAMG,MAAM,GAAG,eAAAA,CACpBL,KAAa,EACbG,GAAgB,EAEa;EAAA,IAD7BG,OAAoC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEzC,MAAM;IAAEG,eAAe;IAAEC;EAAQ,CAAC,GAAG,MAAMZ,MAAM,CAACC,KAAK,CAAC;EAExD,MAAMY,WAAW,GAAGC,KAAK,CAACC,OAAO,CAACX,GAAG,CAAC,GAClCY,gBAAgB,CAACL,eAAe,EAAEP,GAAG,CAAC,GACtCA,GAAG;EAEP,MAAMa,gBAAgB,GAAG,MAAMd,gBAAgB,CAACF,KAAK,EAAEY,WAAW,CAAC;EACnE,IAAII,gBAAgB,EAAE;IACpB,MAAMC,eAAe,GAAG,IAAAC,uBAAU,EAACR,eAAe,EAAEC,OAAO,EAAEL,OAAO,CAAC;IACrE,OAAO;MAAEK,OAAO,EAAEM,eAAe;MAAEP;IAAgB,CAAC;EACtD,CAAC,MAAM;IACL,MAAM,IAAIS,sCAA8B,CAAC,CAAC;EAC5C;AACF,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAXAjC,OAAA,CAAAmB,MAAA,GAAAA,MAAA;AAYO,MAAMU,gBAAgB,GAAGA,CAC9BK,MAA2B,EAC3BC,IAAW,KACH;EACR,MAAM;IAAEC,GAAG;IAAEC;EAAI,CAAC,GAAGH,MAAM;EAC3B,IAAIE,GAAG,IAAIC,GAAG,EAAE;IACd,MAAMC,GAAG,GAAG,IAAAC,yBAAa,EAACH,GAAG,CAAC;IAC9B,MAAMI,YAAY,GAAGL,IAAI,CAACM,IAAI,CAAEC,EAAE,IAAKA,EAAE,CAACJ,GAAG,KAAKA,GAAG,IAAII,EAAE,CAACL,GAAG,KAAKA,GAAG,CAAC;IAExE,IAAIG,YAAY,EAAE;MAChB,OAAOA,YAAY;IACrB;EACF;EAEA,MAAM,IAAIG,mBAAW,CAAE,gCAA+BP,GAAI,YAAWC,GAAI,EAAC,CAAC;AAC7E,CAAC;AAACrC,OAAA,CAAA6B,gBAAA,GAAAA,gBAAA"}

package/lib/commonjs/types.js

@@ -1,2 +1,65 @@
 "use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.WithJWKS = exports.JWK = void 0;
+var _zod = require("zod");
+/** Recognized JWS Header Parameters, any other Header Members may also be present. */
+
+/** Recognized Compact JWS Header Parameters, any other Header Members may also be present. */
+
+/** Recognized JWE Header Parameters, any other Header members may also be present. */
+
+/** Recognized JWT Claims Set members, any other members may also be present. */
+
+/** JWT Claims Set verification options. */
+
+const JWK = _zod.z.object({
+  'alg': _zod.z.string().optional(),
+  'crv': _zod.z.string().optional(),
+  'd': _zod.z.string().optional(),
+  'dp': _zod.z.string().optional(),
+  'dq': _zod.z.string().optional(),
+  'e': _zod.z.string().optional(),
+  /** JWK "ext" (Extractable) Parameter. */
+  'ext': _zod.z.boolean().optional(),
+  'k': _zod.z.string().optional(),
+  /** JWK "key_ops" (Key Operations) Parameter. */
+  'key_ops': _zod.z.array(_zod.z.string()).optional(),
+  /** JWK "kid" (Key ID) Parameter. */
+  'kid': _zod.z.string().optional(),
+  /** JWK "kty" (Key Type) Parameter.
+   * This attribute is required to discriminate the
+   * type of EC/RSA algorithm */
+  'kty': _zod.z.string(),
+  'n': _zod.z.string().optional(),
+  'oth': _zod.z.array(_zod.z.object({
+    d: _zod.z.string().optional(),
+    r: _zod.z.string().optional(),
+    t: _zod.z.string().optional()
+  })).optional(),
+  'p': _zod.z.string().optional(),
+  'q': _zod.z.string().optional(),
+  'qi': _zod.z.string().optional(),
+  /** JWK "use" (Public Key Use) Parameter. */
+  'use': _zod.z.string().optional(),
+  'x': _zod.z.string().optional(),
+  'y': _zod.z.string().optional(),
+  /** JWK "x5c" (X.509 Certificate Chain) Parameter. */
+  'x5c': _zod.z.array(_zod.z.string()).optional(),
+  /** JWK "x5t" (X.509 Certificate SHA-1 Thumbprint) Parameter. */
+  'x5t': _zod.z.string().optional(),
+  /** "x5t#S256" (X.509 Certificate SHA-256 Thumbprint) Parameter. */
+  'x5t#S256': _zod.z.string().optional(),
+  /** JWK "x5u" (X.509 URL) Parameter. */
+  'x5u': _zod.z.string().optional()
+});
+exports.JWK = JWK;
+const WithJWKS = _zod.z.object({
+  jwks: _zod.z.object({
+    keys: _zod.z.array(JWK)
+  })
+});
+exports.WithJWKS = WithJWKS;
 //# sourceMappingURL=types.js.map

package/lib/commonjs/types.js.map

@@ -1 +1 @@
-{"version":3,"names":[],"sourceRoot":"../../src","sources":["types.ts"],"mappings":""}
+{"version":3,"names":["_zod","require","JWK","z","object","string","optional","boolean","array","d","r","t","exports","WithJWKS","jwks","keys"],"sourceRoot":"../../src","sources":["types.ts"],"mappings":";;;;;;AAAA,IAAAA,IAAA,GAAAC,OAAA;AAoCA;;AAkBA;;AAKA;;AAYA;;AAuDA;;AA6CO,MAAMC,GAAG,GAAGC,MAAC,CAACC,MAAM,CAAC;EAC1B,KAAK,EAAED,MAAC,CAACE,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC5B,KAAK,EAAEH,MAAC,CAACE,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC5B,GAAG,EAAEH,MAAC,CAACE,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC1B,IAAI,EAAEH,MAAC,CAACE,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC3B,IAAI,EAAEH,MAAC,CAACE,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC3B,GAAG,EAAEH,MAAC,CAACE,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC1B;EACA,KAAK,EAAEH,MAAC,CAACI,OAAO,CAAC,CAAC,CAACD,QAAQ,CAAC,CAAC;EAC7B,GAAG,EAAEH,MAAC,CAACE,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC1B;EACA,SAAS,EAAEH,MAAC,CAACK,KAAK,CAACL,MAAC,CAACE,MAAM,CAAC,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EACzC;EACA,KAAK,EAAEH,MAAC,CAACE,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC5B;AACF;AACA;EACE,KAAK,EAAEH,MAAC,CAACE,MAAM,CAAC,CAAC;EACjB,GAAG,EAAEF,MAAC,CAACE,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC1B,KAAK,EAAEH,MAAC,CACLK,KAAK,CACJL,MAAC,CAACC,MAAM,CAAC;IACPK,CAAC,EAAEN,MAAC,CAACE,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;IACxBI,CAAC,EAAEP,MAAC,CAACE,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;IACxBK,CAAC,EAAER,MAAC,CAACE,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC;EACzB,CAAC,CACH,CAAC,CACAA,QAAQ,CAAC,CAAC;EACb,GAAG,EAAEH,MAAC,CAACE,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC1B,GAAG,EAAEH,MAAC,CAACE,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC1B,IAAI,EAAEH,MAAC,CAACE,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC3B;EACA,KAAK,EAAEH,MAAC,CAACE,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC5B,GAAG,EAAEH,MAAC,CAACE,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC1B,GAAG,EAAEH,MAAC,CAACE,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC1B;EACA,KAAK,EAAEH,MAAC,CAACK,KAAK,CAACL,MAAC,CAACE,MAAM,CAAC,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EACrC;EACA,KAAK,EAAEH,MAAC,CAACE,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC5B;EACA,UAAU,EAAEH,MAAC,CAACE,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EACjC;EACA,KAAK,EAAEH,MAAC,CAACE,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC;AAC7B,CAAC,CAAC;AAACM,OAAA,CAAAV,GAAA,GAAAA,GAAA;AAGI,MAAMW,QAAQ,GAAGV,MAAC,CAACC,MAAM,CAAC;EAC/BU,IAAI,EAAEX,MAAC,CAACC,MAAM,CAAC;IACbW,IAAI,EAAEZ,MAAC,CAACK,KAAK,CAACN,GAAG;EACnB,CAAC;AACH,CAAC,CAAC;AAACU,OAAA,CAAAC,QAAA,GAAAA,QAAA"}

package/lib/commonjs/utils/errors.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.JWTInvalid = exports.JWTExpired = exports.JWTClaimValidationFailed = exports.JWSSignatureVerificationFailed = exports.JWSInvalid = exports.JWEInvalid = exports.JOSENotSupported = exports.JOSEError = exports.JOSEAlgNotAllowed = void 0;
+exports.JWTInvalid = exports.JWTExpired = exports.JWTClaimValidationFailed = exports.JWSSignatureVerificationFailed = exports.JWSInvalid = exports.JWKSetInvalid = exports.JWKNotFound = exports.JWEInvalid = exports.JOSENotSupported = exports.JOSEError = exports.JOSEAlgNotAllowed = void 0;
 /**
  * A generic Error that all other JOSE specific Error subclasses extend.
  *
@@ -237,5 +237,27 @@ class JWEInvalid extends JOSEError {
   }
   code = 'ERR_JWE_INVALID';
 }
+
+/**
+ * An error subclass thrown when a JWKSet is invalid.
+ */
 exports.JWEInvalid = JWEInvalid;
+class JWKSetInvalid extends JOSEError {
+  static get code() {
+    return 'ERR_JWKS_INVALID';
+  }
+  code = 'ERR_JWKS_INVALID';
+}
+
+/**
+ * An error subclass thrown when a JWK is not found.
+ */
+exports.JWKSetInvalid = JWKSetInvalid;
+class JWKNotFound extends JOSEError {
+  static get code() {
+    return 'ERR_JWK_NOT_FOUND';
+  }
+  code = 'ERR_JWK_NOT_FOUND';
+}
+exports.JWKNotFound = JWKNotFound;
 //# sourceMappingURL=errors.js.map

package/lib/commonjs/utils/errors.js.map

@@ -1 +1 @@
-{"version":3,"names":["JOSEError","Error","code","constructor","message","_Error$captureStackTr","name","captureStackTrace","call","exports","JWTClaimValidationFailed","claim","arguments","length","undefined","reason","JWTExpired","JOSEAlgNotAllowed","JOSENotSupported","JWTInvalid","JWSInvalid","JWSSignatureVerificationFailed","JWEInvalid"],"sourceRoot":"../../../src","sources":["utils/errors.ts"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMA,SAAS,SAASC,KAAK,CAAC;EACnC;EACA,WAAWC,IAAIA,CAAA,EAAW;IACxB,OAAO,kBAAkB;EAC3B;;EAEA;EACAA,IAAI,GAAW,kBAAkB;EAEjCC,WAAWA,CAACC,OAAgB,EAAE;IAAA,IAAAC,qBAAA;IAC5B,KAAK,CAACD,OAAO,CAAC;IACd,IAAI,CAACE,IAAI,GAAG,IAAI,CAACH,WAAW,CAACG,IAAI;IACjC;IACA,CAAAD,qBAAA,GAAAJ,KAAK,CAACM,iBAAiB,cAAAF,qBAAA,uBAAvBA,qBAAA,CAAAG,IAAA,CAAAP,KAAK,EAAqB,IAAI,EAAE,IAAI,CAACE,WAAW,CAAC;EACnD;AACF;AAACM,OAAA,CAAAT,SAAA,GAAAA,SAAA;AACM,MAAMU,wBAAwB,SAASV,SAAS,CAAC;EACtD,WAAWE,IAAIA,CAAA,EAAsC;IACnD,OAAO,iCAAiC;EAC1C;EAEAA,IAAI,GAAG,iCAAiC;;EAExC;;EAGA;;EAGAC,WAAWA,CAACC,OAAe,EAAiD;IAAA,IAA/CO,KAAK,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,aAAa;IAAA,IAAEG,MAAM,GAAAH,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,aAAa;IACxE,KAAK,CAACR,OAAO,CAAC;IACd,IAAI,CAACO,KAAK,GAAGA,KAAK;IAClB,IAAI,CAACI,MAAM,GAAGA,MAAM;EACtB;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAlBAN,OAAA,CAAAC,wBAAA,GAAAA,wBAAA;AAmBO,MAAMM,UAAU,SAAShB,SAAS,CAAqC;EAC5E,WAAWE,IAAIA,CAAA,EAAsB;IACnC,OAAO,iBAAiB;EAC1B;EAEAA,IAAI,GAAG,iBAAiB;;EAExB;;EAGA;;EAGAC,WAAWA,CAACC,OAAe,EAAiD;IAAA,IAA/CO,KAAK,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,aAAa;IAAA,IAAEG,MAAM,GAAAH,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,aAAa;IACxE,KAAK,CAACR,OAAO,CAAC;IACd,IAAI,CAACO,KAAK,GAAGA,KAAK;IAClB,IAAI,CAACI,MAAM,GAAGA,MAAM;EACtB;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAlBAN,OAAA,CAAAO,UAAA,GAAAA,UAAA;AAmBO,MAAMC,iBAAiB,SAASjB,SAAS,CAAC;EAC/C,WAAWE,IAAIA,CAAA,EAA+B;IAC5C,OAAO,0BAA0B;EACnC;EAEAA,IAAI,GAAG,0BAA0B;AACnC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAnBAO,OAAA,CAAAQ,iBAAA,GAAAA,iBAAA;AAoBO,MAAMC,gBAAgB,SAASlB,SAAS,CAAC;EAC9C,WAAWE,IAAIA,CAAA,EAA6B;IAC1C,OAAO,wBAAwB;EACjC;EAEAA,IAAI,GAAG,wBAAwB;AACjC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAlBAO,OAAA,CAAAS,gBAAA,GAAAA,gBAAA;AAmBO,MAAMC,UAAU,SAASnB,SAAS,CAAC;EACxC,WAAWE,IAAIA,CAAA,EAAsB;IACnC,OAAO,iBAAiB;EAC1B;EAEAA,IAAI,GAAG,iBAAiB;AAC1B;;AAEA;AACA;AACA;AAFAO,OAAA,CAAAU,UAAA,GAAAA,UAAA;AAGO,MAAMC,UAAU,SAASpB,SAAS,CAAC;EACxC,WAAWE,IAAIA,CAAA,EAAsB;IACnC,OAAO,iBAAiB;EAC1B;EACAA,IAAI,GAAG,iBAAiB;AAC1B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAlBAO,OAAA,CAAAW,UAAA,GAAAA,UAAA;AAmBO,MAAMC,8BAA8B,SAASrB,SAAS,CAAC;EAC5D,WAAWE,IAAIA,CAAA,EAA4C;IACzD,OAAO,uCAAuC;EAChD;EAEAA,IAAI,GAAG,uCAAuC;EAE9CE,OAAO,GAAG,+BAA+B;AAC3C;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAlBAK,OAAA,CAAAY,8BAAA,GAAAA,8BAAA;AAmBO,MAAMC,UAAU,SAAStB,SAAS,CAAC;EACxC,WAAWE,IAAIA,CAAA,EAAsB;IACnC,OAAO,iBAAiB;EAC1B;EAEAA,IAAI,GAAG,iBAAiB;AAC1B;AAACO,OAAA,CAAAa,UAAA,GAAAA,UAAA"}
+{"version":3,"names":["JOSEError","Error","code","constructor","message","_Error$captureStackTr","name","captureStackTrace","call","exports","JWTClaimValidationFailed","claim","arguments","length","undefined","reason","JWTExpired","JOSEAlgNotAllowed","JOSENotSupported","JWTInvalid","JWSInvalid","JWSSignatureVerificationFailed","JWEInvalid","JWKSetInvalid","JWKNotFound"],"sourceRoot":"../../../src","sources":["utils/errors.ts"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMA,SAAS,SAASC,KAAK,CAAC;EACnC;EACA,WAAWC,IAAIA,CAAA,EAAW;IACxB,OAAO,kBAAkB;EAC3B;;EAEA;EACAA,IAAI,GAAW,kBAAkB;EAEjCC,WAAWA,CAACC,OAAgB,EAAE;IAAA,IAAAC,qBAAA;IAC5B,KAAK,CAACD,OAAO,CAAC;IACd,IAAI,CAACE,IAAI,GAAG,IAAI,CAACH,WAAW,CAACG,IAAI;IACjC;IACA,CAAAD,qBAAA,GAAAJ,KAAK,CAACM,iBAAiB,cAAAF,qBAAA,uBAAvBA,qBAAA,CAAAG,IAAA,CAAAP,KAAK,EAAqB,IAAI,EAAE,IAAI,CAACE,WAAW,CAAC;EACnD;AACF;AAACM,OAAA,CAAAT,SAAA,GAAAA,SAAA;AACM,MAAMU,wBAAwB,SAASV,SAAS,CAAC;EACtD,WAAWE,IAAIA,CAAA,EAAsC;IACnD,OAAO,iCAAiC;EAC1C;EAEAA,IAAI,GAAG,iCAAiC;;EAExC;;EAGA;;EAGAC,WAAWA,CAACC,OAAe,EAAiD;IAAA,IAA/CO,KAAK,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,aAAa;IAAA,IAAEG,MAAM,GAAAH,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,aAAa;IACxE,KAAK,CAACR,OAAO,CAAC;IACd,IAAI,CAACO,KAAK,GAAGA,KAAK;IAClB,IAAI,CAACI,MAAM,GAAGA,MAAM;EACtB;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAlBAN,OAAA,CAAAC,wBAAA,GAAAA,wBAAA;AAmBO,MAAMM,UAAU,SAAShB,SAAS,CAAqC;EAC5E,WAAWE,IAAIA,CAAA,EAAsB;IACnC,OAAO,iBAAiB;EAC1B;EAEAA,IAAI,GAAG,iBAAiB;;EAExB;;EAGA;;EAGAC,WAAWA,CAACC,OAAe,EAAiD;IAAA,IAA/CO,KAAK,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,aAAa;IAAA,IAAEG,MAAM,GAAAH,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,aAAa;IACxE,KAAK,CAACR,OAAO,CAAC;IACd,IAAI,CAACO,KAAK,GAAGA,KAAK;IAClB,IAAI,CAACI,MAAM,GAAGA,MAAM;EACtB;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAlBAN,OAAA,CAAAO,UAAA,GAAAA,UAAA;AAmBO,MAAMC,iBAAiB,SAASjB,SAAS,CAAC;EAC/C,WAAWE,IAAIA,CAAA,EAA+B;IAC5C,OAAO,0BAA0B;EACnC;EAEAA,IAAI,GAAG,0BAA0B;AACnC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAnBAO,OAAA,CAAAQ,iBAAA,GAAAA,iBAAA;AAoBO,MAAMC,gBAAgB,SAASlB,SAAS,CAAC;EAC9C,WAAWE,IAAIA,CAAA,EAA6B;IAC1C,OAAO,wBAAwB;EACjC;EAEAA,IAAI,GAAG,wBAAwB;AACjC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAlBAO,OAAA,CAAAS,gBAAA,GAAAA,gBAAA;AAmBO,MAAMC,UAAU,SAASnB,SAAS,CAAC;EACxC,WAAWE,IAAIA,CAAA,EAAsB;IACnC,OAAO,iBAAiB;EAC1B;EAEAA,IAAI,GAAG,iBAAiB;AAC1B;;AAEA;AACA;AACA;AAFAO,OAAA,CAAAU,UAAA,GAAAA,UAAA;AAGO,MAAMC,UAAU,SAASpB,SAAS,CAAC;EACxC,WAAWE,IAAIA,CAAA,EAAsB;IACnC,OAAO,iBAAiB;EAC1B;EACAA,IAAI,GAAG,iBAAiB;AAC1B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAlBAO,OAAA,CAAAW,UAAA,GAAAA,UAAA;AAmBO,MAAMC,8BAA8B,SAASrB,SAAS,CAAC;EAC5D,WAAWE,IAAIA,CAAA,EAA4C;IACzD,OAAO,uCAAuC;EAChD;EAEAA,IAAI,GAAG,uCAAuC;EAE9CE,OAAO,GAAG,+BAA+B;AAC3C;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AAlBAK,OAAA,CAAAY,8BAAA,GAAAA,8BAAA;AAmBO,MAAMC,UAAU,SAAStB,SAAS,CAAC;EACxC,WAAWE,IAAIA,CAAA,EAAsB;IACnC,OAAO,iBAAiB;EAC1B;EAEAA,IAAI,GAAG,iBAAiB;AAC1B;;AAEA;AACA;AACA;AAFAO,OAAA,CAAAa,UAAA,GAAAA,UAAA;AAGO,MAAMC,aAAa,SAASvB,SAAS,CAAC;EAC3C,WAAWE,IAAIA,CAAA,EAAuB;IACpC,OAAO,kBAAkB;EAC3B;EAEAA,IAAI,GAAG,kBAAkB;AAC3B;;AAEA;AACA;AACA;AAFAO,OAAA,CAAAc,aAAA,GAAAA,aAAA;AAGO,MAAMC,WAAW,SAASxB,SAAS,CAAC;EACzC,WAAWE,IAAIA,CAAA,EAAwB;IACrC,OAAO,mBAAmB;EAC5B;EAEAA,IAAI,GAAG,mBAAmB;AAC5B;AAACO,OAAA,CAAAe,WAAA,GAAAA,WAAA"}

package/lib/module/jwk/index.js

@@ -1,4 +1,8 @@
 import { IoReactNativeJwt } from '../utils/proxy';
+import { WithJWKS } from '../types';
+import { JWKSetInvalid } from '../utils/errors';
+import { decode } from '..';
+
 /**
  * Calculate JWK thumbprint
  *
@@ -19,4 +23,25 @@ import { IoReactNativeJwt } from '../utils/proxy';
  * @param jwk JSON Web Key
  */
 export const thumbprint = jwk => IoReactNativeJwt.thumbprint(jwk);
+
+/**
+ * Returns a JSON Web Key Set (JWKS) downloaded from a remote endpoint,
+ * that is, for example, an OAuth 2.0 or OIDC jwks_uri.
+ *
+ * @param url URL string to fetch the JSON Web Key Set from.
+ * @param appFetch fetch function (optional)
+ */
+export const getRemoteJWKSet = async function (url) {
+  let appFetch = arguments.length > 1 && arguments[1] !== undefined ? arguments[1] : fetch;
+  let response = await appFetch(url);
+  if (response.status === 200) {
+    const jwt = await response.text();
+    const {
+      payload
+    } = await decode(jwt);
+    const parsedPayload = WithJWKS.parse(payload);
+    return parsedPayload.jwks.keys;
+  }
+  throw new JWKSetInvalid(`Unable to obtain JWKSet from given url. Response status: ${response.status}`);
+};
 //# sourceMappingURL=index.js.map

package/lib/module/jwk/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["IoReactNativeJwt","thumbprint","jwk"],"sourceRoot":"../../../src","sources":["jwk/index.ts"],"mappings":"AAAA,SAASA,gBAAgB,QAAQ,gBAAgB;AAGjD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,UAAU,GAAIC,GAAQ,IACjCF,gBAAgB,CAACC,UAAU,CAACC,GAAG,CAAC"}
+{"version":3,"names":["IoReactNativeJwt","WithJWKS","JWKSetInvalid","decode","thumbprint","jwk","getRemoteJWKSet","url","appFetch","arguments","length","undefined","fetch","response","status","jwt","text","payload","parsedPayload","parse","jwks","keys"],"sourceRoot":"../../../src","sources":["jwk/index.ts"],"mappings":"AAAA,SAASA,gBAAgB,QAAQ,gBAAgB;AACjD,SAASC,QAAQ,QAAa,UAAU;AACxC,SAASC,aAAa,QAAQ,iBAAiB;AAC/C,SAASC,MAAM,QAAQ,IAAI;;AAE3B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,UAAU,GAAIC,GAAQ,IACjCL,gBAAgB,CAACI,UAAU,CAACC,GAAG,CAAC;;AAElC;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,eAAe,GAAG,eAAAA,CAC7BC,GAAW,EAEQ;EAAA,IADnBC,QAA8B,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAGG,KAAK;EAEtC,IAAIC,QAAQ,GAAG,MAAML,QAAQ,CAACD,GAAG,CAAC;EAElC,IAAIM,QAAQ,CAACC,MAAM,KAAK,GAAG,EAAE;IAC3B,MAAMC,GAAG,GAAG,MAAMF,QAAQ,CAACG,IAAI,CAAC,CAAC;IACjC,MAAM;MAAEC;IAAQ,CAAC,GAAG,MAAMd,MAAM,CAACY,GAAG,CAAC;IACrC,MAAMG,aAAa,GAAGjB,QAAQ,CAACkB,KAAK,CAACF,OAAO,CAAC;IAC7C,OAAOC,aAAa,CAACE,IAAI,CAACC,IAAI;EAChC;EAEA,MAAM,IAAInB,aAAa,CACpB,4DAA2DW,QAAQ,CAACC,MAAO,EAC9E,CAAC;AACH,CAAC"}

package/lib/module/jwt/index.js

@@ -1,7 +1,8 @@
 import jwtPayload from './jwt_claims_set';
-import { JWSSignatureVerificationFailed } from '../utils/errors';
+import { JWKNotFound, JWSSignatureVerificationFailed } from '../utils/errors';
 import { IoReactNativeJwt } from '../utils/proxy';
 import { SignJWT } from './sign';
+import { getKtyFromAlg } from '../algorithms';
 export * from './produce';
 export * from './sign';
 export * from './unsecured';
@@ -70,8 +71,23 @@ export const isSignatureValid = (token, jwk) => IoReactNativeJwt.verify(token, j
  * })
  * ```
  *
+ *  * @example Usage with a JWKSet
+ *
+ * ```js
+ * const wellKnownUrl = 'https://example.com/.well-known/openid-federation';
+ * const jwks = await getRemoteJWKSet(wellKnownUrl);
+ *
+ * const jwt =
+ *   'eyJ0eXAiOiJlbnRpdHktc3RhdGVtZW50K2p3dCIsImtpZCI6IkVDIzEiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0LyIsInN1YiI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvIiwibWV0YWRhdGEiOnsiZXVkaV93YWxsZXRfcHJvdmlkZXIiOnsiandrcyI6W3siY3J2IjoiUC0yNTYiLCJrdHkiOiJFQyIsIngiOiJxckpyajNBZl9CNTdzYk9JUnJjQk03YnI3d09jOHluajdsSEZQVGVmZlVrIiwieSI6IjFIMGNXRHlHZ3ZVOHcta1BLVV94eWNPQ1VOVDJvMGJ3c2xJUXRuUFU2aU0iLCJraWQiOiJFQyMxIn1dLCJ0b2tlbl9lbmRwb2ludCI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvdG9rZW4iLCJhc2NfdmFsdWVzX3N1cHBvcnRlZCI6WyJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0L0xvQS9iYXNpYyIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL21lZGl1bSIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL2hpZ2h0Il0sImdyYW50X3R5cGVzX3N1cHBvcnRlZCI6WyJ1cm46aWV0ZjpwYXJhbXM6b2F1dGg6Y2xpZW50LWFzc2VydGlvbi10eXBlOmp3dC1rZXktYXR0ZXN0YXRpb24iXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9tZXRob2RzX3N1cHBvcnRlZCI6WyJwcml2YXRlX2tleV9qd3QiXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9zaWduaW5nX2FsZ192YWx1ZXNfc3VwcG9ydGVkIjpbIkVTMjU2IiwiRVMyNTZLIiwiRVMzODQiLCJFUzUxMiIsIlJTMjU2IiwiUlMzODQiLCJSUzUxMiIsIlBTMjU2IiwiUFMzODQiLCJQUzUxMiJdfSwiZmVkZXJhdGlvbl9lbnRpdHkiOnsib3JnYW5pemF0aW9uX25hbWUiOiJQYWdvUGEgUy5wLkEuIiwiaG9tZXBhZ2VfdXJpIjoiaHR0cHM6Ly9pby5pdGFsaWEuaXQvIiwicG9saWN5X3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L3ByaXZhY3ktcG9saWN5LyIsInRvc191cmkiOiJodHRwczovL2lvLml0YWxpYS5pdC9wcml2YWN5LXBvbGljeS8iLCJsb2dvX3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L2Fzc2V0cy9pbWcvaW8taXQtbG9nby13aGl0ZS5zdmcifX0sImlhdCI6MTY4OTIzNjYzNSwiZXhwIjoxNjg5MjQwMjM1fQ.6wA0M6rNYNSFN_EylzMA6ElAibW7FVSZyoLNEkHU5c_RKuiNenT08YIMvbysYautLZotUedEMP5xCyNpY34x6Q'
+ *
+ * const { payload, protectedHeader } = await verify(jwt, jwks, {
+ *   typ: 'entity-statement+jwt',
+ *   requiredClaims: ['iss', 'sub', 'metadata'],
+ * })
+ * ```
+ *
  * @param jwt JSON Web Token value (encoded as JWS).
- * @param key Public key to verify the JWT in JWK format.
+ * @param key Public key to verify the JWT in JWK format or JWKS (array of JWK).
  * @param options JWT Decryption and JWT Claims Set validation options.
  */
 export const verify = async function (token, jwk) {
@@ -80,7 +96,8 @@ export const verify = async function (token, jwk) {
     protectedHeader,
     payload
   } = await decode(token);
-  const signatureIsValid = await isSignatureValid(token, jwk);
+  const selectedJwk = Array.isArray(jwk) ? getJwkFromHeader(protectedHeader, jwk) : jwk;
+  const signatureIsValid = await isSignatureValid(token, selectedJwk);
   if (signatureIsValid) {
     const verifiedPayload = jwtPayload(protectedHeader, payload, options);
     return {
@@ -91,4 +108,31 @@ export const verify = async function (token, jwk) {
     throw new JWSSignatureVerificationFailed();
   }
 };
+
+/**
+ * Given the header of a JWT return the corresponding key from a JWKS.
+ *
+ * It uses the "alg" (JWS Algorithm) Header Parameter to determine the right JWK "kty" (Key Type),
+ * then proceeds to match the JWK "kid" (Key ID) with one found in the JWS Header Parameters (if
+ * there is one).
+ * Only a single public key must match the selection process.
+ *
+ * @param header JWT header
+ * @param jwks Json Web Key Set (JWKS)
+ *
+ */
+export const getJwkFromHeader = (header, jwks) => {
+  const {
+    alg,
+    kid
+  } = header;
+  if (alg && kid) {
+    const kty = getKtyFromAlg(alg);
+    const filteredJwks = jwks.find(el => el.kty === kty && el.kid === kid);
+    if (filteredJwks) {
+      return filteredJwks;
+    }
+  }
+  throw new JWKNotFound(`No JWKs found that match alg:${alg} and kid:${kid}`);
+};
 //# sourceMappingURL=index.js.map

package/lib/module/jwt/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["jwtPayload","JWSSignatureVerificationFailed","IoReactNativeJwt","SignJWT","derToJose","encodeBase64","decodeBase64","sha256ToBase64","decode","token","isSignatureValid","jwk","verify","options","arguments","length","undefined","protectedHeader","payload","signatureIsValid","verifiedPayload"],"sourceRoot":"../../../src","sources":["jwt/index.ts"],"mappings":"AACA,OAAOA,UAAU,MAAM,kBAAkB;AACzC,SAASC,8BAA8B,QAAQ,iBAAiB;AAChE,SAASC,gBAAgB,QAAQ,gBAAgB;AACjD,SAASC,OAAO,QAAQ,QAAQ;AAGhC,cAAc,WAAW;AACzB,cAAc,QAAQ;AACtB,cAAc,aAAa;AAC3B,SAASC,SAAS,QAAQ,eAAe;AACzC,SAASC,YAAY,EAAEC,YAAY,QAAQ,iBAAiB;AAC5D,SAASC,cAAc,QAAQ,SAAS;AACxC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,MAAM,GAAIC,KAAa,IAAsBN,OAAO,CAACK,MAAM,CAACC,KAAK,CAAC;;AAE/E;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,gBAAgB,GAAGA,CAACD,KAAa,EAAEE,GAAQ,KACtDT,gBAAgB,CAACU,MAAM,CAACH,KAAK,EAAEE,GAAG,CAAC;;AAErC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,MAAM,GAAG,eAAAA,CACpBH,KAAa,EACbE,GAAQ,EAEqB;EAAA,IAD7BE,OAAoC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEzC,MAAM;IAAEG,eAAe;IAAEC;EAAQ,CAAC,GAAG,MAAMV,MAAM,CAACC,KAAK,CAAC;EACxD,MAAMU,gBAAgB,GAAG,MAAMT,gBAAgB,CAACD,KAAK,EAAEE,GAAG,CAAC;EAE3D,IAAIQ,gBAAgB,EAAE;IACpB,MAAMC,eAAe,GAAGpB,UAAU,CAACiB,eAAe,EAAEC,OAAO,EAAEL,OAAO,CAAC;IACrE,OAAO;MAAEK,OAAO,EAAEE,eAAe;MAAEH;IAAgB,CAAC;EACtD,CAAC,MAAM;IACL,MAAM,IAAIhB,8BAA8B,CAAC,CAAC;EAC5C;AACF,CAAC"}
+{"version":3,"names":["jwtPayload","JWKNotFound","JWSSignatureVerificationFailed","IoReactNativeJwt","SignJWT","getKtyFromAlg","derToJose","encodeBase64","decodeBase64","sha256ToBase64","decode","token","isSignatureValid","jwk","verify","options","arguments","length","undefined","protectedHeader","payload","selectedJwk","Array","isArray","getJwkFromHeader","signatureIsValid","verifiedPayload","header","jwks","alg","kid","kty","filteredJwks","find","el"],"sourceRoot":"../../../src","sources":["jwt/index.ts"],"mappings":"AAKA,OAAOA,UAAU,MAAM,kBAAkB;AACzC,SAASC,WAAW,EAAEC,8BAA8B,QAAQ,iBAAiB;AAC7E,SAASC,gBAAgB,QAAQ,gBAAgB;AACjD,SAASC,OAAO,QAAQ,QAAQ;AAEhC,SAASC,aAAa,QAAQ,eAAe;AAE7C,cAAc,WAAW;AACzB,cAAc,QAAQ;AACtB,cAAc,aAAa;AAC3B,SAASC,SAAS,QAAQ,eAAe;AACzC,SAASC,YAAY,EAAEC,YAAY,QAAQ,iBAAiB;AAC5D,SAASC,cAAc,QAAQ,SAAS;AACxC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,MAAM,GAAIC,KAAa,IAAsBP,OAAO,CAACM,MAAM,CAACC,KAAK,CAAC;;AAE/E;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,gBAAgB,GAAGA,CAACD,KAAa,EAAEE,GAAQ,KACtDV,gBAAgB,CAACW,MAAM,CAACH,KAAK,EAAEE,GAAG,CAAC;;AAErC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,MAAM,GAAG,eAAAA,CACpBH,KAAa,EACbE,GAAgB,EAEa;EAAA,IAD7BE,OAAoC,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,CAAC,CAAC;EAEzC,MAAM;IAAEG,eAAe;IAAEC;EAAQ,CAAC,GAAG,MAAMV,MAAM,CAACC,KAAK,CAAC;EAExD,MAAMU,WAAW,GAAGC,KAAK,CAACC,OAAO,CAACV,GAAG,CAAC,GAClCW,gBAAgB,CAACL,eAAe,EAAEN,GAAG,CAAC,GACtCA,GAAG;EAEP,MAAMY,gBAAgB,GAAG,MAAMb,gBAAgB,CAACD,KAAK,EAAEU,WAAW,CAAC;EACnE,IAAII,gBAAgB,EAAE;IACpB,MAAMC,eAAe,GAAG1B,UAAU,CAACmB,eAAe,EAAEC,OAAO,EAAEL,OAAO,CAAC;IACrE,OAAO;MAAEK,OAAO,EAAEM,eAAe;MAAEP;IAAgB,CAAC;EACtD,CAAC,MAAM;IACL,MAAM,IAAIjB,8BAA8B,CAAC,CAAC;EAC5C;AACF,CAAC;;AAED;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMsB,gBAAgB,GAAGA,CAC9BG,MAA2B,EAC3BC,IAAW,KACH;EACR,MAAM;IAAEC,GAAG;IAAEC;EAAI,CAAC,GAAGH,MAAM;EAC3B,IAAIE,GAAG,IAAIC,GAAG,EAAE;IACd,MAAMC,GAAG,GAAG1B,aAAa,CAACwB,GAAG,CAAC;IAC9B,MAAMG,YAAY,GAAGJ,IAAI,CAACK,IAAI,CAAEC,EAAE,IAAKA,EAAE,CAACH,GAAG,KAAKA,GAAG,IAAIG,EAAE,CAACJ,GAAG,KAAKA,GAAG,CAAC;IAExE,IAAIE,YAAY,EAAE;MAChB,OAAOA,YAAY;IACrB;EACF;EAEA,MAAM,IAAI/B,WAAW,CAAE,gCAA+B4B,GAAI,YAAWC,GAAI,EAAC,CAAC;AAC7E,CAAC"}

package/lib/module/types.js

@@ -1,2 +1,58 @@
+import { z } from 'zod';
 
+/** Recognized JWS Header Parameters, any other Header Members may also be present. */
+
+/** Recognized Compact JWS Header Parameters, any other Header Members may also be present. */
+
+/** Recognized JWE Header Parameters, any other Header members may also be present. */
+
+/** Recognized JWT Claims Set members, any other members may also be present. */
+
+/** JWT Claims Set verification options. */
+
+export const JWK = z.object({
+  'alg': z.string().optional(),
+  'crv': z.string().optional(),
+  'd': z.string().optional(),
+  'dp': z.string().optional(),
+  'dq': z.string().optional(),
+  'e': z.string().optional(),
+  /** JWK "ext" (Extractable) Parameter. */
+  'ext': z.boolean().optional(),
+  'k': z.string().optional(),
+  /** JWK "key_ops" (Key Operations) Parameter. */
+  'key_ops': z.array(z.string()).optional(),
+  /** JWK "kid" (Key ID) Parameter. */
+  'kid': z.string().optional(),
+  /** JWK "kty" (Key Type) Parameter.
+   * This attribute is required to discriminate the
+   * type of EC/RSA algorithm */
+  'kty': z.string(),
+  'n': z.string().optional(),
+  'oth': z.array(z.object({
+    d: z.string().optional(),
+    r: z.string().optional(),
+    t: z.string().optional()
+  })).optional(),
+  'p': z.string().optional(),
+  'q': z.string().optional(),
+  'qi': z.string().optional(),
+  /** JWK "use" (Public Key Use) Parameter. */
+  'use': z.string().optional(),
+  'x': z.string().optional(),
+  'y': z.string().optional(),
+  /** JWK "x5c" (X.509 Certificate Chain) Parameter. */
+  'x5c': z.array(z.string()).optional(),
+  /** JWK "x5t" (X.509 Certificate SHA-1 Thumbprint) Parameter. */
+  'x5t': z.string().optional(),
+  /** "x5t#S256" (X.509 Certificate SHA-256 Thumbprint) Parameter. */
+  'x5t#S256': z.string().optional(),
+  /** JWK "x5u" (X.509 URL) Parameter. */
+  'x5u': z.string().optional()
+});
+export const WithJWKS = z.object({
+  jwks: z.object({
+    keys: z.array(JWK)
+  })
+});
 //# sourceMappingURL=types.js.map

package/lib/module/types.js.map

@@ -1 +1 @@
-{"version":3,"names":[],"sourceRoot":"../../src","sources":["types.ts"],"mappings":""}
+{"version":3,"names":["z","JWK","object","string","optional","boolean","array","d","r","t","WithJWKS","jwks","keys"],"sourceRoot":"../../src","sources":["types.ts"],"mappings":"AAAA,SAASA,CAAC,QAAQ,KAAK;;AAoCvB;;AAkBA;;AAKA;;AAYA;;AAuDA;;AA6CA,OAAO,MAAMC,GAAG,GAAGD,CAAC,CAACE,MAAM,CAAC;EAC1B,KAAK,EAAEF,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC5B,KAAK,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC5B,GAAG,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC1B,IAAI,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC3B,IAAI,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC3B,GAAG,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC1B;EACA,KAAK,EAAEJ,CAAC,CAACK,OAAO,CAAC,CAAC,CAACD,QAAQ,CAAC,CAAC;EAC7B,GAAG,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC1B;EACA,SAAS,EAAEJ,CAAC,CAACM,KAAK,CAACN,CAAC,CAACG,MAAM,CAAC,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EACzC;EACA,KAAK,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC5B;AACF;AACA;EACE,KAAK,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC;EACjB,GAAG,EAAEH,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC1B,KAAK,EAAEJ,CAAC,CACLM,KAAK,CACJN,CAAC,CAACE,MAAM,CAAC;IACPK,CAAC,EAAEP,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;IACxBI,CAAC,EAAER,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;IACxBK,CAAC,EAAET,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC;EACzB,CAAC,CACH,CAAC,CACAA,QAAQ,CAAC,CAAC;EACb,GAAG,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC1B,GAAG,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC1B,IAAI,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC3B;EACA,KAAK,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC5B,GAAG,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC1B,GAAG,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC1B;EACA,KAAK,EAAEJ,CAAC,CAACM,KAAK,CAACN,CAAC,CAACG,MAAM,CAAC,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EACrC;EACA,KAAK,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EAC5B;EACA,UAAU,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC,CAAC;EACjC;EACA,KAAK,EAAEJ,CAAC,CAACG,MAAM,CAAC,CAAC,CAACC,QAAQ,CAAC;AAC7B,CAAC,CAAC;AAGF,OAAO,MAAMM,QAAQ,GAAGV,CAAC,CAACE,MAAM,CAAC;EAC/BS,IAAI,EAAEX,CAAC,CAACE,MAAM,CAAC;IACbU,IAAI,EAAEZ,CAAC,CAACM,KAAK,CAACL,GAAG;EACnB,CAAC;AACH,CAAC,CAAC"}

package/lib/module/utils/errors.js

@@ -223,4 +223,24 @@ export class JWEInvalid extends JOSEError {
   }
   code = 'ERR_JWE_INVALID';
 }
+
+/**
+ * An error subclass thrown when a JWKSet is invalid.
+ */
+export class JWKSetInvalid extends JOSEError {
+  static get code() {
+    return 'ERR_JWKS_INVALID';
+  }
+  code = 'ERR_JWKS_INVALID';
+}
+
+/**
+ * An error subclass thrown when a JWK is not found.
+ */
+export class JWKNotFound extends JOSEError {
+  static get code() {
+    return 'ERR_JWK_NOT_FOUND';
+  }
+  code = 'ERR_JWK_NOT_FOUND';
+}
 //# sourceMappingURL=errors.js.map

package/lib/module/utils/errors.js.map

@@ -1 +1 @@
-{"version":3,"names":["JOSEError","Error","code","constructor","message","_Error$captureStackTr","name","captureStackTrace","call","JWTClaimValidationFailed","claim","arguments","length","undefined","reason","JWTExpired","JOSEAlgNotAllowed","JOSENotSupported","JWTInvalid","JWSInvalid","JWSSignatureVerificationFailed","JWEInvalid"],"sourceRoot":"../../../src","sources":["utils/errors.ts"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMA,SAAS,SAASC,KAAK,CAAC;EACnC;EACA,WAAWC,IAAIA,CAAA,EAAW;IACxB,OAAO,kBAAkB;EAC3B;;EAEA;EACAA,IAAI,GAAW,kBAAkB;EAEjCC,WAAWA,CAACC,OAAgB,EAAE;IAAA,IAAAC,qBAAA;IAC5B,KAAK,CAACD,OAAO,CAAC;IACd,IAAI,CAACE,IAAI,GAAG,IAAI,CAACH,WAAW,CAACG,IAAI;IACjC;IACA,CAAAD,qBAAA,GAAAJ,KAAK,CAACM,iBAAiB,cAAAF,qBAAA,uBAAvBA,qBAAA,CAAAG,IAAA,CAAAP,KAAK,EAAqB,IAAI,EAAE,IAAI,CAACE,WAAW,CAAC;EACnD;AACF;AACA,OAAO,MAAMM,wBAAwB,SAAST,SAAS,CAAC;EACtD,WAAWE,IAAIA,CAAA,EAAsC;IACnD,OAAO,iCAAiC;EAC1C;EAEAA,IAAI,GAAG,iCAAiC;;EAExC;;EAGA;;EAGAC,WAAWA,CAACC,OAAe,EAAiD;IAAA,IAA/CM,KAAK,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,aAAa;IAAA,IAAEG,MAAM,GAAAH,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,aAAa;IACxE,KAAK,CAACP,OAAO,CAAC;IACd,IAAI,CAACM,KAAK,GAAGA,KAAK;IAClB,IAAI,CAACI,MAAM,GAAGA,MAAM;EACtB;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,UAAU,SAASf,SAAS,CAAqC;EAC5E,WAAWE,IAAIA,CAAA,EAAsB;IACnC,OAAO,iBAAiB;EAC1B;EAEAA,IAAI,GAAG,iBAAiB;;EAExB;;EAGA;;EAGAC,WAAWA,CAACC,OAAe,EAAiD;IAAA,IAA/CM,KAAK,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,aAAa;IAAA,IAAEG,MAAM,GAAAH,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,aAAa;IACxE,KAAK,CAACP,OAAO,CAAC;IACd,IAAI,CAACM,KAAK,GAAGA,KAAK;IAClB,IAAI,CAACI,MAAM,GAAGA,MAAM;EACtB;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAME,iBAAiB,SAAShB,SAAS,CAAC;EAC/C,WAAWE,IAAIA,CAAA,EAA+B;IAC5C,OAAO,0BAA0B;EACnC;EAEAA,IAAI,GAAG,0BAA0B;AACnC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMe,gBAAgB,SAASjB,SAAS,CAAC;EAC9C,WAAWE,IAAIA,CAAA,EAA6B;IAC1C,OAAO,wBAAwB;EACjC;EAEAA,IAAI,GAAG,wBAAwB;AACjC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMgB,UAAU,SAASlB,SAAS,CAAC;EACxC,WAAWE,IAAIA,CAAA,EAAsB;IACnC,OAAO,iBAAiB;EAC1B;EAEAA,IAAI,GAAG,iBAAiB;AAC1B;;AAEA;AACA;AACA;AACA,OAAO,MAAMiB,UAAU,SAASnB,SAAS,CAAC;EACxC,WAAWE,IAAIA,CAAA,EAAsB;IACnC,OAAO,iBAAiB;EAC1B;EACAA,IAAI,GAAG,iBAAiB;AAC1B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMkB,8BAA8B,SAASpB,SAAS,CAAC;EAC5D,WAAWE,IAAIA,CAAA,EAA4C;IACzD,OAAO,uCAAuC;EAChD;EAEAA,IAAI,GAAG,uCAAuC;EAE9CE,OAAO,GAAG,+BAA+B;AAC3C;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMiB,UAAU,SAASrB,SAAS,CAAC;EACxC,WAAWE,IAAIA,CAAA,EAAsB;IACnC,OAAO,iBAAiB;EAC1B;EAEAA,IAAI,GAAG,iBAAiB;AAC1B"}
+{"version":3,"names":["JOSEError","Error","code","constructor","message","_Error$captureStackTr","name","captureStackTrace","call","JWTClaimValidationFailed","claim","arguments","length","undefined","reason","JWTExpired","JOSEAlgNotAllowed","JOSENotSupported","JWTInvalid","JWSInvalid","JWSSignatureVerificationFailed","JWEInvalid","JWKSetInvalid","JWKNotFound"],"sourceRoot":"../../../src","sources":["utils/errors.ts"],"mappings":"AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMA,SAAS,SAASC,KAAK,CAAC;EACnC;EACA,WAAWC,IAAIA,CAAA,EAAW;IACxB,OAAO,kBAAkB;EAC3B;;EAEA;EACAA,IAAI,GAAW,kBAAkB;EAEjCC,WAAWA,CAACC,OAAgB,EAAE;IAAA,IAAAC,qBAAA;IAC5B,KAAK,CAACD,OAAO,CAAC;IACd,IAAI,CAACE,IAAI,GAAG,IAAI,CAACH,WAAW,CAACG,IAAI;IACjC;IACA,CAAAD,qBAAA,GAAAJ,KAAK,CAACM,iBAAiB,cAAAF,qBAAA,uBAAvBA,qBAAA,CAAAG,IAAA,CAAAP,KAAK,EAAqB,IAAI,EAAE,IAAI,CAACE,WAAW,CAAC;EACnD;AACF;AACA,OAAO,MAAMM,wBAAwB,SAAST,SAAS,CAAC;EACtD,WAAWE,IAAIA,CAAA,EAAsC;IACnD,OAAO,iCAAiC;EAC1C;EAEAA,IAAI,GAAG,iCAAiC;;EAExC;;EAGA;;EAGAC,WAAWA,CAACC,OAAe,EAAiD;IAAA,IAA/CM,KAAK,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,aAAa;IAAA,IAAEG,MAAM,GAAAH,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,aAAa;IACxE,KAAK,CAACP,OAAO,CAAC;IACd,IAAI,CAACM,KAAK,GAAGA,KAAK;IAClB,IAAI,CAACI,MAAM,GAAGA,MAAM;EACtB;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,UAAU,SAASf,SAAS,CAAqC;EAC5E,WAAWE,IAAIA,CAAA,EAAsB;IACnC,OAAO,iBAAiB;EAC1B;EAEAA,IAAI,GAAG,iBAAiB;;EAExB;;EAGA;;EAGAC,WAAWA,CAACC,OAAe,EAAiD;IAAA,IAA/CM,KAAK,GAAAC,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,aAAa;IAAA,IAAEG,MAAM,GAAAH,SAAA,CAAAC,MAAA,QAAAD,SAAA,QAAAE,SAAA,GAAAF,SAAA,MAAG,aAAa;IACxE,KAAK,CAACP,OAAO,CAAC;IACd,IAAI,CAACM,KAAK,GAAGA,KAAK;IAClB,IAAI,CAACI,MAAM,GAAGA,MAAM;EACtB;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAME,iBAAiB,SAAShB,SAAS,CAAC;EAC/C,WAAWE,IAAIA,CAAA,EAA+B;IAC5C,OAAO,0BAA0B;EACnC;EAEAA,IAAI,GAAG,0BAA0B;AACnC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMe,gBAAgB,SAASjB,SAAS,CAAC;EAC9C,WAAWE,IAAIA,CAAA,EAA6B;IAC1C,OAAO,wBAAwB;EACjC;EAEAA,IAAI,GAAG,wBAAwB;AACjC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMgB,UAAU,SAASlB,SAAS,CAAC;EACxC,WAAWE,IAAIA,CAAA,EAAsB;IACnC,OAAO,iBAAiB;EAC1B;EAEAA,IAAI,GAAG,iBAAiB;AAC1B;;AAEA;AACA;AACA;AACA,OAAO,MAAMiB,UAAU,SAASnB,SAAS,CAAC;EACxC,WAAWE,IAAIA,CAAA,EAAsB;IACnC,OAAO,iBAAiB;EAC1B;EACAA,IAAI,GAAG,iBAAiB;AAC1B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMkB,8BAA8B,SAASpB,SAAS,CAAC;EAC5D,WAAWE,IAAIA,CAAA,EAA4C;IACzD,OAAO,uCAAuC;EAChD;EAEAA,IAAI,GAAG,uCAAuC;EAE9CE,OAAO,GAAG,+BAA+B;AAC3C;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMiB,UAAU,SAASrB,SAAS,CAAC;EACxC,WAAWE,IAAIA,CAAA,EAAsB;IACnC,OAAO,iBAAiB;EAC1B;EAEAA,IAAI,GAAG,iBAAiB;AAC1B;;AAEA;AACA;AACA;AACA,OAAO,MAAMoB,aAAa,SAAStB,SAAS,CAAC;EAC3C,WAAWE,IAAIA,CAAA,EAAuB;IACpC,OAAO,kBAAkB;EAC3B;EAEAA,IAAI,GAAG,kBAAkB;AAC3B;;AAEA;AACA;AACA;AACA,OAAO,MAAMqB,WAAW,SAASvB,SAAS,CAAC;EACzC,WAAWE,IAAIA,CAAA,EAAwB;IACrC,OAAO,mBAAmB;EAC5B;EAEAA,IAAI,GAAG,mBAAmB;AAC5B"}

package/lib/typescript/jwk/index.d.ts

@@ -1,4 +1,4 @@
-import type { JWK } from '../types';
+import { JWK } from '../types';
 /**
  * Calculate JWK thumbprint
  *
@@ -19,4 +19,12 @@ import type { JWK } from '../types';
  * @param jwk JSON Web Key
  */
 export declare const thumbprint: (jwk: JWK) => Promise<string>;
+/**
+ * Returns a JSON Web Key Set (JWKS) downloaded from a remote endpoint,
+ * that is, for example, an OAuth 2.0 or OIDC jwks_uri.
+ *
+ * @param url URL string to fetch the JSON Web Key Set from.
+ * @param appFetch fetch function (optional)
+ */
+export declare const getRemoteJWKSet: (url: string, appFetch?: GlobalFetch['fetch']) => Promise<JWK[]>;
 //# sourceMappingURL=index.d.ts.map

package/lib/typescript/jwk/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/jwk/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,UAAU,CAAC;AAEpC;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,UAAU,QAAS,GAAG,KAAG,QAAQ,MAAM,CAClB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/jwk/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,GAAG,EAAE,MAAM,UAAU,CAAC;AAIzC;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,UAAU,QAAS,GAAG,KAAG,QAAQ,MAAM,CAClB,CAAC;AAEnC;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,QACrB,MAAM,aACD,WAAW,CAAC,OAAO,CAAC,KAC7B,QAAQ,GAAG,EAAE,CAaf,CAAC"}

package/lib/typescript/jwt/index.d.ts

@@ -1,4 +1,4 @@
-import type { JWTClaimVerificationOptions, JWTDecodeResult } from '../types';
+import type { JWSHeaderParameters, JWTClaimVerificationOptions, JWTDecodeResult } from '../types';
 import type { JWK } from '../types';
 export * from './produce';
 export * from './sign';
@@ -66,9 +66,37 @@ export declare const isSignatureValid: (token: string, jwk: JWK) => Promise<bool
  * })
  * ```
  *
+ *  * @example Usage with a JWKSet
+ *
+ * ```js
+ * const wellKnownUrl = 'https://example.com/.well-known/openid-federation';
+ * const jwks = await getRemoteJWKSet(wellKnownUrl);
+ *
+ * const jwt =
+ *   'eyJ0eXAiOiJlbnRpdHktc3RhdGVtZW50K2p3dCIsImtpZCI6IkVDIzEiLCJhbGciOiJFUzI1NiJ9.eyJpc3MiOiJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0LyIsInN1YiI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvIiwibWV0YWRhdGEiOnsiZXVkaV93YWxsZXRfcHJvdmlkZXIiOnsiandrcyI6W3siY3J2IjoiUC0yNTYiLCJrdHkiOiJFQyIsIngiOiJxckpyajNBZl9CNTdzYk9JUnJjQk03YnI3d09jOHluajdsSEZQVGVmZlVrIiwieSI6IjFIMGNXRHlHZ3ZVOHcta1BLVV94eWNPQ1VOVDJvMGJ3c2xJUXRuUFU2aU0iLCJraWQiOiJFQyMxIn1dLCJ0b2tlbl9lbmRwb2ludCI6Imh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvdG9rZW4iLCJhc2NfdmFsdWVzX3N1cHBvcnRlZCI6WyJodHRwczovL2lvLWQtd2FsbGV0LWl0LmF6dXJld2Vic2l0ZXMubmV0L0xvQS9iYXNpYyIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL21lZGl1bSIsImh0dHBzOi8vaW8tZC13YWxsZXQtaXQuYXp1cmV3ZWJzaXRlcy5uZXQvTG9BL2hpZ2h0Il0sImdyYW50X3R5cGVzX3N1cHBvcnRlZCI6WyJ1cm46aWV0ZjpwYXJhbXM6b2F1dGg6Y2xpZW50LWFzc2VydGlvbi10eXBlOmp3dC1rZXktYXR0ZXN0YXRpb24iXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9tZXRob2RzX3N1cHBvcnRlZCI6WyJwcml2YXRlX2tleV9qd3QiXSwidG9rZW5fZW5kcG9pbnRfYXV0aF9zaWduaW5nX2FsZ192YWx1ZXNfc3VwcG9ydGVkIjpbIkVTMjU2IiwiRVMyNTZLIiwiRVMzODQiLCJFUzUxMiIsIlJTMjU2IiwiUlMzODQiLCJSUzUxMiIsIlBTMjU2IiwiUFMzODQiLCJQUzUxMiJdfSwiZmVkZXJhdGlvbl9lbnRpdHkiOnsib3JnYW5pemF0aW9uX25hbWUiOiJQYWdvUGEgUy5wLkEuIiwiaG9tZXBhZ2VfdXJpIjoiaHR0cHM6Ly9pby5pdGFsaWEuaXQvIiwicG9saWN5X3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L3ByaXZhY3ktcG9saWN5LyIsInRvc191cmkiOiJodHRwczovL2lvLml0YWxpYS5pdC9wcml2YWN5LXBvbGljeS8iLCJsb2dvX3VyaSI6Imh0dHBzOi8vaW8uaXRhbGlhLml0L2Fzc2V0cy9pbWcvaW8taXQtbG9nby13aGl0ZS5zdmcifX0sImlhdCI6MTY4OTIzNjYzNSwiZXhwIjoxNjg5MjQwMjM1fQ.6wA0M6rNYNSFN_EylzMA6ElAibW7FVSZyoLNEkHU5c_RKuiNenT08YIMvbysYautLZotUedEMP5xCyNpY34x6Q'
+ *
+ * const { payload, protectedHeader } = await verify(jwt, jwks, {
+ *   typ: 'entity-statement+jwt',
+ *   requiredClaims: ['iss', 'sub', 'metadata'],
+ * })
+ * ```
+ *
  * @param jwt JSON Web Token value (encoded as JWS).
- * @param key Public key to verify the JWT in JWK format.
+ * @param key Public key to verify the JWT in JWK format or JWKS (array of JWK).
  * @param options JWT Decryption and JWT Claims Set validation options.
  */
-export declare const verify: (token: string, jwk: JWK, options?: JWTClaimVerificationOptions) => Promise<JWTDecodeResult>;
+export declare const verify: (token: string, jwk: JWK | JWK[], options?: JWTClaimVerificationOptions) => Promise<JWTDecodeResult>;
+/**
+ * Given the header of a JWT return the corresponding key from a JWKS.
+ *
+ * It uses the "alg" (JWS Algorithm) Header Parameter to determine the right JWK "kty" (Key Type),
+ * then proceeds to match the JWK "kid" (Key ID) with one found in the JWS Header Parameters (if
+ * there is one).
+ * Only a single public key must match the selection process.
+ *
+ * @param header JWT header
+ * @param jwks Json Web Key Set (JWKS)
+ *
+ */
+export declare const getJwkFromHeader: (header: JWSHeaderParameters, jwks: JWK[]) => JWK;
 //# sourceMappingURL=index.d.ts.map