@suveren/gateway 0.7.4 → 0.7.6

package/node_modules/jose/dist/webapi/lib/jwe_encrypt.js

@@ -1,30 +1,54 @@
 import { encode as b64u } from '../util/base64url.js';
 import { encrypt } from './content_encryption.js';
 import { encryptKeyManagement } from './key_management.js';
-import { JOSENotSupported, JWEInvalid } from '../util/errors.js';
-import { isDisjoint } from './type_checks.js';
+import { JWEInvalid } from '../util/errors.js';
+import { assertUint8Array, isDisjoint, isObject } from './type_checks.js';
 import { concat, encode } from './buffer_utils.js';
-import { validateCrit, JWE_RECOGNIZED } from './options.js';
+import { serializeJoseHeader, validateCrit, validateCritDuplicates, JWE_RECOGNIZED, } from './options.js';
 import { prepareKey } from './key.js';
 import { jweAlgorithm, jweEncryption } from './jwe_algorithms.js';
-import { compress } from './deflate.js';
-export function checkEncryptHeaders(input) {
-    const [, protectedHeader, unprotectedHeader, sharedUnprotectedHeader, , , , , crit] = input;
+import { compress, validateZip } from './deflate.js';
+import { unprotected } from './helpers.js';
+export function checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader) {
     if (!isDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader)) {
         throw new JWEInvalid('JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint');
     }
+}
+export function checkEncryptHeaders(input) {
+    let [, protectedHeader, unprotectedHeader, sharedUnprotectedHeader, aad, cek, iv, keyManagementParameters, crit,] = input;
+    if (aad !== undefined) {
+        assertUint8Array(aad, 'JWE Additional Authenticated Data');
+    }
+    if (cek !== undefined) {
+        assertUint8Array(cek, 'JWE Content Encryption Key');
+    }
+    if (iv !== undefined) {
+        assertUint8Array(iv, 'JWE Initialization Vector');
+    }
+    if (protectedHeader !== undefined) {
+        protectedHeader = serializeJoseHeader(JWEInvalid, protectedHeader)[0];
+        input[1] = protectedHeader;
+    }
+    if (unprotectedHeader !== undefined) {
+        unprotectedHeader = serializeJoseHeader(JWEInvalid, unprotectedHeader)[0];
+        input[2] = unprotectedHeader;
+    }
+    if (sharedUnprotectedHeader !== undefined) {
+        sharedUnprotectedHeader = serializeJoseHeader(JWEInvalid, sharedUnprotectedHeader)[0];
+        input[3] = sharedUnprotectedHeader;
+    }
+    if (keyManagementParameters !== undefined && !isObject(keyManagementParameters)) {
+        throw new TypeError('JWE Key Management Parameters must be an object');
+    }
+    checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader);
     const joseHeader = {
         ...protectedHeader,
         ...unprotectedHeader,
         ...sharedUnprotectedHeader,
     };
+    validateCritDuplicates(JWEInvalid, protectedHeader);
     validateCrit(JWEInvalid, JWE_RECOGNIZED, crit, protectedHeader, joseHeader);
-    if (joseHeader.zip !== undefined && joseHeader.zip !== 'DEF') {
-        throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value.');
-    }
-    if (joseHeader.zip !== undefined && !protectedHeader?.zip) {
-        throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header Parameter MUST be in a protected header.');
-    }
+    validateZip(joseHeader, protectedHeader);
     const { alg, enc } = joseHeader;
     if (typeof alg !== 'string' || !alg) {
         throw new JWEInvalid('JWE "alg" (Algorithm) Header Parameter missing or invalid');
@@ -52,6 +76,7 @@ export async function encryptJWE(input, checked, key) {
         else {
             protectedHeader = protectedHeader ? { ...protectedHeader, ...parameters } : parameters;
         }
+        checkDisjoint(protectedHeader, unprotectedHeader, sharedUnprotectedHeader);
     }
     let protectedHeaderS;
     let protectedHeaderB;
@@ -105,6 +130,13 @@ export async function encryptJWE(input, checked, key) {
     }
     return jwe;
 }
-export async function createJWE(input, key) {
+export async function createJWE(input, key, options) {
+    if (!input[1] && !input[2] && !input[3]) {
+        throw new JWEInvalid('either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()');
+    }
+    if (options !== undefined) {
+        input[8] = options?.crit;
+        input[9] = options ? unprotected in options : false;
+    }
     return encryptJWE(input, checkEncryptHeaders(input), key);
 }

package/node_modules/jose/dist/webapi/lib/jwk_metadata.js

@@ -0,0 +1,20 @@
+export function snapshotJwk(jwk) {
+    return { __proto__: null, ...jwk };
+}
+export function normalizeJwk(jwk) {
+    const normalized = snapshotJwk(jwk);
+    if (normalized.ext !== undefined && typeof normalized.ext !== 'boolean') {
+        throw new TypeError('"ext" (Extractable) Parameter must be a boolean');
+    }
+    if (normalized.key_ops !== undefined) {
+        const value = normalized.key_ops;
+        const keyOps = Array.isArray(value) ? [...value] : undefined;
+        if (!keyOps ||
+            keyOps.some((operation) => typeof operation !== 'string') ||
+            new Set(keyOps).size !== keyOps.length) {
+            throw new TypeError('"key_ops" (Key Operations) Parameter must be an array of unique strings');
+        }
+        normalized.key_ops = keyOps;
+    }
+    return normalized;
+}

package/node_modules/jose/dist/webapi/lib/jws_sign.js

@@ -4,15 +4,37 @@ import { jwsAlgorithm } from './jws_algorithms.js';
 import { isDisjoint } from './type_checks.js';
 import { JWSInvalid } from '../util/errors.js';
 import { concat, encode } from './buffer_utils.js';
-import { validateCrit, validateCritDuplicates, JWS_RECOGNIZED } from './options.js';
+import { serializeJoseHeader, validateB64, validateCrit, validateCritDuplicates, JWS_RECOGNIZED, } from './options.js';
 import { prepareKey } from './key.js';
-export function unencodedPayload(protectedHeader) {
-    return (protectedHeader?.b64 === false &&
-        Array.isArray(protectedHeader.crit) &&
-        protectedHeader.crit.includes('b64'));
+function serializeProtectedHeader(protectedHeader) {
+    if (protectedHeader === undefined)
+        return [undefined, ''];
+    const normalized = serializeJoseHeader(JWSInvalid, protectedHeader);
+    return [normalized[0], b64u(normalized[1])];
 }
-export async function createSignature(input, key) {
-    const { protectedHeader, unprotectedHeader } = input;
+function validateSignatureHeader(protectedHeader, joseHeader, crit) {
+    validateCritDuplicates(JWSInvalid, protectedHeader);
+    return validateB64(protectedHeader, validateCrit(JWSInvalid, JWS_RECOGNIZED, crit, protectedHeader, joseHeader));
+}
+function signatureAlgorithm(joseHeader) {
+    const alg = joseHeader.alg;
+    if (typeof alg !== 'string' || !alg) {
+        throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
+    }
+    return jwsAlgorithm(alg);
+}
+async function signSignature(protectedHeader, payload, entry, key) {
+    const data = concat(encode(protectedHeader), encode('.'), payload);
+    const k = await prepareKey(entry, key, 'sign');
+    return b64u(await sign(entry, k, data));
+}
+export async function createSignature(input, key, assertB64) {
+    let { protectedHeader, unprotectedHeader } = input;
+    let protectedHeaderString;
+    [protectedHeader, protectedHeaderString] = serializeProtectedHeader(protectedHeader);
+    if (unprotectedHeader !== undefined) {
+        unprotectedHeader = serializeJoseHeader(JWSInvalid, unprotectedHeader)[0];
+    }
     if (!protectedHeader && !unprotectedHeader) {
         throw new JWSInvalid('either setProtectedHeader or setUnprotectedHeader must be called before #sign()');
     }
@@ -20,20 +42,9 @@ export async function createSignature(input, key) {
         throw new JWSInvalid('JWS Protected and JWS Unprotected Header Parameter names must be disjoint');
     }
     const joseHeader = { ...protectedHeader, ...unprotectedHeader };
-    validateCritDuplicates(JWSInvalid, protectedHeader);
-    const extensions = validateCrit(JWSInvalid, JWS_RECOGNIZED, input.crit, protectedHeader, joseHeader);
-    let b64 = true;
-    if (extensions.includes('b64')) {
-        b64 = protectedHeader.b64;
-        if (typeof b64 !== 'boolean') {
-            throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
-        }
-    }
-    const { alg } = joseHeader;
-    if (typeof alg !== 'string' || !alg) {
-        throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-    }
-    const entry = jwsAlgorithm(alg);
+    const b64 = validateSignatureHeader(protectedHeader, joseHeader, input.crit);
+    assertB64?.(b64);
+    const entry = signatureAlgorithm(joseHeader);
     let payloadS;
     let payloadB;
     if (b64) {
@@ -47,21 +58,8 @@ export async function createSignature(input, key) {
         payloadB = input.payload;
         payloadS = '';
     }
-    let protectedHeaderString;
-    let protectedHeaderBytes;
-    if (protectedHeader) {
-        protectedHeaderString = b64u(JSON.stringify(protectedHeader));
-        protectedHeaderBytes = encode(protectedHeaderString);
-    }
-    else {
-        protectedHeaderString = '';
-        protectedHeaderBytes = new Uint8Array();
-    }
-    const data = concat(protectedHeaderBytes, encode('.'), payloadB);
-    const k = await prepareKey(entry, key, 'sign');
-    const signature = await sign(entry, k, data);
     const jws = {
-        signature: b64u(signature),
+        signature: await signSignature(protectedHeaderString, payloadB, entry, key),
         payload: payloadS,
     };
     if (protectedHeader) {
@@ -70,5 +68,18 @@ export async function createSignature(input, key) {
     if (unprotectedHeader) {
         jws.header = unprotectedHeader;
     }
-    return jws;
+    return [jws, b64];
+}
+export async function createCompactSignature(payload, inputProtectedHeader, inputCrit, key, rejectUnencoded) {
+    const [protectedHeader, protectedHeaderString] = serializeProtectedHeader(inputProtectedHeader);
+    if (!protectedHeader) {
+        throw new JWSInvalid('either setProtectedHeader or setUnprotectedHeader must be called before #sign()');
+    }
+    const b64 = validateSignatureHeader(protectedHeader, protectedHeader, inputCrit);
+    if (!b64)
+        rejectUnencoded();
+    const entry = signatureAlgorithm(protectedHeader);
+    const encodedPayload = b64u(payload);
+    const signature = await signSignature(protectedHeaderString, encode(encodedPayload), entry, key);
+    return `${protectedHeaderString}.${encodedPayload}.${signature}`;
 }

package/node_modules/jose/dist/webapi/lib/jws_verify.js

@@ -3,9 +3,25 @@ import { jwsAlgorithm } from './jws_algorithms.js';
 import { JOSEAlgNotAllowed, JWSInvalid, JWSSignatureVerificationFailed } from '../util/errors.js';
 import { concat, decoder, encoder, encode } from './buffer_utils.js';
 import { decodeBase64url, encodeBase64url, parseJoseHeader } from './helpers.js';
-import { isDisjoint } from './type_checks.js';
-import { validateCrit, validateAlgorithms, JWS_RECOGNIZED } from './options.js';
+import { isDisjoint, isObject } from './type_checks.js';
+import { validateB64, validateCrit, validateAlgorithms, JWS_RECOGNIZED } from './options.js';
 import { prepareKey } from './key.js';
+export function snapshotJws(jws, sharedPayload) {
+    const encodedProtected = jws.protected;
+    const inputHeader = jws.header;
+    const header = isObject(inputHeader) ? { ...inputHeader } : inputHeader;
+    let payload = sharedPayload ? sharedPayload[0] : jws.payload;
+    if (!sharedPayload && payload instanceof Uint8Array) {
+        payload = new Uint8Array(payload);
+    }
+    const signature = jws.signature;
+    const snapshot = { payload, signature };
+    if (encodedProtected !== undefined)
+        snapshot.protected = encodedProtected;
+    if (inputHeader !== undefined)
+        snapshot.header = header;
+    return snapshot;
+}
 export function verifyResult(jws, verified) {
     const [payload, parsedProt, , key, resolvedKey] = verified;
     const result = { payload };
@@ -23,12 +39,24 @@ export function verifyResult(jws, verified) {
 export function prepareVerify(options) {
     return [options && validateAlgorithms('algorithms', options.algorithms), options?.crit];
 }
-export async function verifySignature(jws, shared, key) {
-    const { protected: encodedProtected, header, payload: inputPayload } = jws;
-    let parsedProt = {};
-    if (encodedProtected) {
-        parsedProt = parseJoseHeader(encodedProtected, JWSInvalid, 'JWS Protected Header is invalid');
+export function parseProtectedHeader(encodedProtected, parsedProtected = encodedProtected === undefined
+    ? {}
+    : parseJoseHeader(encodedProtected, JWSInvalid, 'JWS Protected Header is invalid')) {
+    return parsedProtected;
+}
+function validateJwsHeaders(parsedProt, joseHeader, shared) {
+    const b64 = validateB64(parsedProt, validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader));
+    const alg = joseHeader.alg;
+    if (typeof alg !== 'string' || !alg) {
+        throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
     }
+    if (shared[0] && !shared[0].has(alg)) {
+        throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
+    }
+    return [b64, alg];
+}
+export function parseJwsHeaders(encodedProtected, header, shared, parsedProtected) {
+    const parsedProt = parseProtectedHeader(encodedProtected, parsedProtected);
     let joseHeader;
     if (header !== undefined) {
         if (!isDisjoint(parsedProt, header)) {
@@ -39,58 +67,58 @@ export async function verifySignature(jws, shared, key) {
     else {
         joseHeader = parsedProt;
     }
-    const extensions = validateCrit(JWSInvalid, JWS_RECOGNIZED, shared[1], parsedProt, joseHeader);
-    let b64 = true;
-    if (extensions.includes('b64')) {
-        b64 = parsedProt.b64;
-        if (typeof b64 !== 'boolean') {
-            throw new JWSInvalid('The "b64" (base64url-encode payload) Header Parameter must be a boolean');
-        }
-    }
-    const { alg } = joseHeader;
-    if (typeof alg !== 'string' || !alg) {
-        throw new JWSInvalid('JWS "alg" (Algorithm) Header Parameter missing or invalid');
-    }
-    if (shared[0] && !shared[0].has(alg)) {
-        throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
-    }
-    if (b64) {
-        if (typeof inputPayload !== 'string') {
-            throw new JWSInvalid('JWS Payload must be a string');
-        }
+    return [parsedProt, joseHeader, ...validateJwsHeaders(parsedProt, joseHeader, shared)];
+}
+export function encodeJsonUnencodedPayload(payload) {
+    const invalid = /[\p{Cs}\p{Cn}]/u.exec(payload)?.[0];
+    if (invalid !== undefined) {
+        throw new JWSInvalid(/\p{Cs}/u.test(invalid)
+            ? 'JWS Payload must be a well-formed Unicode string'
+            : 'JWS Payload must not contain unassigned Unicode code points');
+    }
+    return encoder.encode(payload);
+}
+function encodeCompactUnencodedPayload(payload) {
+    try {
+        return encode(payload);
     }
-    else if (typeof inputPayload !== 'string' && !(inputPayload instanceof Uint8Array)) {
-        throw new JWSInvalid('JWS Payload must be a string or an Uint8Array instance');
+    catch {
+        throw new JWSInvalid('JWS Compact Serialization payload must use only ASCII characters');
     }
+}
+async function verifyPrepared(jws, shared, key, encodedProtected, parsedProt, alg, signingPayload) {
     let resolvedKey = false;
     if (typeof key === 'function') {
         key = await key(parsedProt, jws);
         resolvedKey = true;
     }
+    const b64 = typeof signingPayload === 'string';
     const entry = jwsAlgorithm(alg);
-    const data = concat(encodedProtected !== undefined ? encode(encodedProtected) : new Uint8Array(), encode('.'), typeof inputPayload === 'string'
-        ? b64
-            ?
-                (shared[2] ??= encodeBase64url(inputPayload, 'payload', JWSInvalid))
-            : encoder.encode(inputPayload)
-        : inputPayload);
+    const data = concat(encodedProtected !== undefined ? encode(encodedProtected) : new Uint8Array(), encode('.'), b64
+        ?
+            (shared[2] ??= encodeBase64url(signingPayload, 'payload', JWSInvalid))
+        : signingPayload);
     const signature = decodeBase64url(jws.signature, 'signature', JWSInvalid);
     const k = await prepareKey(entry, key, 'verify');
-    const verified = await verify(entry, k, signature, data);
-    if (!verified) {
+    if (!(await verify(entry, k, signature, data))) {
         throw new JWSSignatureVerificationFailed();
     }
-    let payload;
+    const payload = b64 ? decodeBase64url(signingPayload, 'payload', JWSInvalid) : signingPayload;
+    return [payload, parsedProt, b64, k, resolvedKey];
+}
+export async function verifySignature(jws, shared, key, encodeUnencodedPayload, parsedProtected) {
+    const { protected: encodedProtected, header, payload: inputPayload } = jws;
+    const [parsedProt, , b64, alg] = parseJwsHeaders(encodedProtected, header, shared, parsedProtected);
     if (b64) {
-        payload = decodeBase64url(inputPayload, 'payload', JWSInvalid);
-    }
-    else if (typeof inputPayload === 'string') {
-        payload = encoder.encode(inputPayload);
+        if (typeof inputPayload !== 'string') {
+            throw new JWSInvalid('JWS Payload must be a string');
+        }
     }
-    else {
-        payload = inputPayload;
+    else if (typeof inputPayload !== 'string' && !(inputPayload instanceof Uint8Array)) {
+        throw new JWSInvalid('JWS Payload must be a string or an Uint8Array instance');
     }
-    return [payload, parsedProt, b64, k, resolvedKey];
+    const signingPayload = b64 || typeof inputPayload !== 'string' ? inputPayload : encodeUnencodedPayload(inputPayload);
+    return verifyPrepared(jws, shared, key, encodedProtected, parsedProt, alg, signingPayload);
 }
 export async function verifyCompact(jws, shared, key) {
     if (jws instanceof Uint8Array) {
@@ -103,5 +131,9 @@ export async function verifyCompact(jws, shared, key) {
     if (length !== 3) {
         throw new JWSInvalid('Invalid Compact JWS');
     }
-    return verifySignature({ payload, protected: protectedHeader, signature }, shared, key);
+    const compactJws = { payload, protected: protectedHeader, signature };
+    const parsedProt = parseProtectedHeader(protectedHeader);
+    const [b64, alg] = validateJwsHeaders(parsedProt, parsedProt, shared);
+    const signingPayload = b64 ? payload : encodeCompactUnencodedPayload(payload);
+    return verifyPrepared(compactJws, shared, key, protectedHeader, parsedProt, alg, signingPayload);
 }

package/node_modules/jose/dist/webapi/lib/jwt_claims_set.js

@@ -12,13 +12,22 @@ const multipliers = {
 };
 const REGEX = /^(\+|\-)? ?(\d+|\d+\.\d+) ?(seconds?|secs?|s|minutes?|mins?|m|hours?|hrs?|h|days?|d|weeks?|w|years?|yrs?|y)(?: (ago|from now))?$/i;
 const checkFailed = 'check_failed';
+function invalidDuration() {
+    throw new TypeError('Invalid time period format');
+}
 export function secs(str) {
+    if (typeof str !== 'string') {
+        invalidDuration();
+    }
     const matched = REGEX.exec(str);
     if (!matched || (matched[4] && matched[1])) {
-        throw new TypeError('Invalid time period format');
+        invalidDuration();
     }
     const value = parseFloat(matched[2]);
     const numericDate = Math.round(value * multipliers[matched[3][0].toLowerCase()]);
+    if (!Number.isFinite(numericDate)) {
+        invalidDuration();
+    }
     if (matched[1] === '-' || matched[4] === 'ago') {
         return -numericDate;
     }
@@ -30,6 +39,17 @@ function validateInput(label, input) {
     }
     return input;
 }
+function validateStringClaim(claim, value) {
+    if (typeof value !== 'string') {
+        throw new TypeError(`"${claim}" claim must be a string`);
+    }
+}
+function validateAudienceClaim(value) {
+    if (typeof value !== 'string' &&
+        (!Array.isArray(value) || Array.from(value).some((member) => typeof member !== 'string'))) {
+        throw new TypeError('"aud" claim must be a string or an array of strings');
+    }
+}
 function numericDate(value, label) {
     if (typeof value === 'number')
         return validateInput(label, value);
@@ -38,10 +58,8 @@ function numericDate(value, label) {
     return epoch(new Date()) + secs(value);
 }
 const normalizeTyp = (value) => {
-    if (value.includes('/')) {
-        return value.toLowerCase();
-    }
-    return `application/${value.toLowerCase()}`;
+    const normalized = value.toLowerCase();
+    return value.includes('/') ? normalized : `application/${normalized}`;
 };
 const checkAudiencePresence = (audPayload, audOption) => {
     if (typeof audPayload === 'string') {
@@ -75,7 +93,7 @@ export function validateClaimsSet(protectedHeader, encodedPayload, options = {})
         throw new JWTInvalid('JWT Claims Set must be a top-level JSON object');
     }
     const { typ } = options;
-    if (typ &&
+    if (typ !== undefined &&
         (typeof protectedHeader.typ !== 'string' ||
             normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
         throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, 'typ', checkFailed);
@@ -119,7 +137,7 @@ export function validateClaimsSet(protectedHeader, encodedPayload, options = {})
     }
     validateInput('clockTolerance option', tolerance);
     const { currentDate } = options;
-    const now = validateInput('currentDate option', epoch(currentDate || new Date()));
+    const now = validateInput('currentDate option', epoch(currentDate === undefined ? new Date() : currentDate));
     const iat = validateNumericDate(payload, 'iat', maxTokenAge !== undefined);
     const nbf = validateNumericDate(payload, 'nbf');
     if (nbf !== undefined) {
@@ -135,63 +153,80 @@ export function validateClaimsSet(protectedHeader, encodedPayload, options = {})
     }
     if (maxTokenAge !== undefined) {
         const age = now - iat;
-        const max = typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge);
+        const max = validateInput('maxTokenAge option', typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge));
         if (age - tolerance > max) {
             throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, 'iat', checkFailed);
         }
-        if (age < 0 - tolerance) {
+        if (age < -tolerance) {
             throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, 'iat', checkFailed);
         }
     }
     return payload;
 }
+let producerPayloads;
+function producerPayload(producer) {
+    return producerPayloads.get(producer);
+}
+export function jwtData(producer) {
+    const payload = producerPayload(producer);
+    for (const claim of ['iat', 'nbf', 'exp']) {
+        const value = payload[claim];
+        if (typeof value === 'number' && !Number.isFinite(value)) {
+            throw new TypeError(`"${claim}" claim must be a finite number`);
+        }
+    }
+    return encoder.encode(JSON.stringify(payload));
+}
+export function jwtClaim(producer, claim) {
+    return producerPayload(producer)[claim];
+}
 export class JWTClaimsBuilder {
-    #payload;
-    constructor(payload) {
+    constructor(payload = {}) {
         if (!isObject(payload)) {
             throw new TypeError('JWT Claims Set MUST be an object');
         }
-        this.#payload = structuredClone(payload);
-    }
-    data() {
-        return encoder.encode(JSON.stringify(this.#payload));
-    }
-    get iss() {
-        return this.#payload.iss;
-    }
-    set iss(value) {
-        this.#payload.iss = value;
-    }
-    get sub() {
-        return this.#payload.sub;
-    }
-    set sub(value) {
-        this.#payload.sub = value;
-    }
-    get aud() {
-        return this.#payload.aud;
-    }
-    set aud(value) {
-        this.#payload.aud = value;
-    }
-    set jti(value) {
-        this.#payload.jti = value;
-    }
-    set nbf(value) {
-        this.#payload.nbf = numericDate(value, 'setNotBefore');
-    }
-    set exp(value) {
-        this.#payload.exp = numericDate(value, 'setExpirationTime');
-    }
-    set iat(value) {
+        ;
+        (producerPayloads ||= new WeakMap()).set(this, structuredClone(payload));
+    }
+    setIssuer(value) {
+        validateStringClaim('iss', value);
+        producerPayload(this).iss = value;
+        return this;
+    }
+    setSubject(value) {
+        validateStringClaim('sub', value);
+        producerPayload(this).sub = value;
+        return this;
+    }
+    setAudience(value) {
+        validateAudienceClaim(value);
+        producerPayload(this).aud = value;
+        return this;
+    }
+    setJti(value) {
+        validateStringClaim('jti', value);
+        producerPayload(this).jti = value;
+        return this;
+    }
+    setNotBefore(value) {
+        producerPayload(this).nbf = numericDate(value, 'setNotBefore');
+        return this;
+    }
+    setExpirationTime(value) {
+        producerPayload(this).exp = numericDate(value, 'setExpirationTime');
+        return this;
+    }
+    setIssuedAt(value) {
+        const payload = producerPayload(this);
         if (value === undefined) {
-            this.#payload.iat = epoch(new Date());
+            payload.iat = epoch(new Date());
         }
         else if (typeof value === 'string') {
-            this.#payload.iat = validateInput('setIssuedAt', epoch(new Date()) + secs(value));
+            payload.iat = validateInput('setIssuedAt', epoch(new Date()) + secs(value));
         }
         else {
-            this.#payload.iat = numericDate(value, 'setIssuedAt');
+            payload.iat = numericDate(value, 'setIssuedAt');
         }
+        return this;
     }
 }

package/node_modules/jose/dist/webapi/lib/key.js

@@ -1,8 +1,9 @@
 import { withAlg as invalidKeyInput } from './invalid_key_input.js';
 import { isKeyLike, isCryptoKey } from './is_key_like.js';
-import * as jwk from './type_checks.js';
+import { isObject } from './type_checks.js';
 import { decode } from '../util/base64url.js';
 import { jwkToKey } from './jwk_to_key.js';
+import { normalizeJwk } from './jwk_metadata.js';
 const tag = (key) => key[Symbol.toStringTag];
 const jwkMatchesOp = (entry, key, usage) => {
     const { alg } = entry;
@@ -27,14 +28,27 @@ export function checkKeyType(entry, key, usage) {
     const privateKey = usage === 'decrypt' || usage === 'sign';
     if (secret && key instanceof Uint8Array)
         return [BYTES, key];
-    if (jwk.isJWK(key)) {
-        if (secret ? !jwk.isSecretJWK(key) : !(privateKey ? jwk.isPrivateJWK(key) : jwk.isPublicJWK(key))) {
+    if (isObject(key)) {
+        const normalized = normalizeJwk(key);
+        if (typeof normalized.kty !== 'string') {
+            throw new TypeError(secret
+                ? invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key', 'Uint8Array')
+                : invalidKeyInput(alg, key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
+        }
+        const valid = secret
+            ? normalized.kty === 'oct' && typeof normalized.k === 'string'
+            : normalized.kty !== 'oct' &&
+                (privateKey
+                    ? (normalized.kty === 'AKP' && typeof normalized.priv === 'string') ||
+                        typeof normalized.d === 'string'
+                    : normalized.d === undefined && normalized.priv === undefined);
+        if (!valid) {
             throw new TypeError(secret
                 ? `JSON Web Key for symmetric algorithms must have JWK "kty" (Key Type) equal to "oct" and the JWK "k" (Key Value) present`
                 : `JSON Web Key for this operation must be a ${privateKey ? 'private' : 'public'} JWK`);
         }
-        jwkMatchesOp(entry, key, usage);
-        return [JWK, key];
+        jwkMatchesOp(entry, normalized, usage);
+        return [JWK, key, normalized];
     }
     if (!isKeyLike(key)) {
         throw new TypeError(secret
@@ -81,7 +95,7 @@ function cached(key, alg, value) {
             entry[alg] = value;
         }
         else {
-            cache.set(key, { __proto__: null, [alg]: value });
+            cache.set(key, { [alg]: value });
         }
     }
     return value ?? entry?.[alg];
@@ -107,8 +121,9 @@ export async function prepareKey(entry, key, usage) {
             return tagged[1];
         case JWK: {
             const key = tagged[1];
-            if (key.k) {
-                return decode(key.k);
+            const normalized = tagged[2];
+            if (normalized.kty === 'oct') {
+                return decode(normalized.k);
             }
             if (!Object.isFrozen(key)) {
                 const { key_ops } = key;
@@ -116,7 +131,7 @@ export async function prepareKey(entry, key, usage) {
                     Object.freeze(key_ops);
                 Object.freeze(key);
             }
-            return handleJWK(key, key, entry);
+            return handleJWK(key, normalized, entry);
         }
         case KEYOBJECT: {
             const keyObject = tagged[1];