@zuplo/cli 7.4.4 → 7.4.6

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwe/flattened/encrypt.js

@@ -1,7 +1,6 @@
-import { unprotected, assertNotSet } from '../../lib/helpers.js';
-import { JWEInvalid } from '../../util/errors.js';
+import { assertNotSet } from '../../lib/helpers.js';
 import { createJWE } from '../../lib/jwe_encrypt.js';
-import { validateCritDuplicates } from '../../lib/options.js';
+import { assertUint8Array } from '../../lib/type_checks.js';
 export class FlattenedEncrypt {
     #plaintext;
     #protectedHeader;
@@ -12,9 +11,7 @@ export class FlattenedEncrypt {
     #iv;
     #keyManagementParameters;
     constructor(plaintext) {
-        if (!(plaintext instanceof Uint8Array)) {
-            throw new TypeError('plaintext must be an instance of Uint8Array');
-        }
+        assertUint8Array(plaintext, 'plaintext');
         this.#plaintext = plaintext;
     }
     setKeyManagementParameters(parameters) {
@@ -52,10 +49,6 @@ export class FlattenedEncrypt {
         return this;
     }
     async encrypt(key, options) {
-        if (!this.#protectedHeader && !this.#unprotectedHeader && !this.#sharedUnprotectedHeader) {
-            throw new JWEInvalid('either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()');
-        }
-        validateCritDuplicates(JWEInvalid, this.#protectedHeader);
         return createJWE([
             this.#plaintext,
             this.#protectedHeader,
@@ -65,8 +58,8 @@ export class FlattenedEncrypt {
             this.#cek,
             this.#iv,
             this.#keyManagementParameters,
-            options?.crit,
-            options ? unprotected in options : false,
-        ], key);
+            undefined,
+            false,
+        ], key, options);
     }
 }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwe/general/decrypt.js

@@ -1,46 +1,46 @@
-import { prepareDecrypt, shareJWE, decryptRecipient, decryptResult, checkShared, checkRecipient, } from '../../lib/jwe_decrypt.js';
+import { prepareDecrypt, shareJWE, decryptRecipient, decryptResult, checkRecipient, snapshotSharedJWE, snapshotRecipientJWE, } from '../../lib/jwe_decrypt.js';
 import { JWEDecryptionFailed, JWEInvalid } from '../../util/errors.js';
 import { isObject } from '../../lib/type_checks.js';
 export async function generalDecrypt(jwe, key, options) {
     if (!isObject(jwe)) {
         throw new JWEInvalid('General JWE must be an object');
     }
-    if (!Array.isArray(jwe.recipients) || !jwe.recipients.every(isObject)) {
+    const inputRecipients = jwe.recipients;
+    if (!Array.isArray(inputRecipients)) {
         throw new JWEInvalid('JWE Recipients missing or incorrect type');
     }
-    if (!jwe.recipients.length) {
+    const recipients = Array.from(inputRecipients);
+    if (!recipients.every(isObject)) {
+        throw new JWEInvalid('JWE Recipients missing or incorrect type');
+    }
+    if (!recipients.length) {
         throw new JWEInvalid('JWE Recipients has no members');
     }
     let shared;
+    let sharedJwe;
     let token;
     try {
-        checkShared(jwe);
         shared = prepareDecrypt(options);
-        token = shareJWE(jwe);
+        sharedJwe = snapshotSharedJWE(jwe);
+        token = shareJWE(sharedJwe);
     }
     catch {
         throw new JWEDecryptionFailed();
     }
-    if (jwe.recipients.length > 1) {
-        for (const { header } of jwe.recipients) {
-            const alg = token[0]?.alg ?? header?.alg ?? jwe.unprotected?.alg;
+    const recipientSnapshots = recipients.map((recipient) => snapshotRecipientJWE(recipient));
+    if (recipients.length > 1) {
+        for (const [, headerAlg] of recipientSnapshots) {
+            const alg = token[0]?.alg ?? headerAlg ?? sharedJwe.unprotected?.alg;
             if (alg === 'dir' || alg === 'ECDH-ES') {
                 throw new JWEInvalid(`"${alg}" alg may only have a single recipient`);
             }
         }
     }
-    for (const recipient of jwe.recipients) {
+    for (const [recipient] of recipientSnapshots) {
+        if (!recipient)
+            continue;
         try {
-            const flattened = {
-                aad: jwe.aad,
-                ciphertext: jwe.ciphertext,
-                encrypted_key: recipient.encrypted_key,
-                header: recipient.header,
-                iv: jwe.iv,
-                protected: jwe.protected,
-                tag: jwe.tag,
-                unprotected: jwe.unprotected,
-            };
+            const flattened = { ...sharedJwe, ...recipient };
             checkRecipient(flattened);
             return decryptResult(flattened, await decryptRecipient(flattened, token, shared, key));
         }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwe/general/encrypt.js

@@ -1,13 +1,12 @@
-import { FlattenedEncrypt } from '../flattened/encrypt.js';
 import { assertNotSet } from '../../lib/helpers.js';
 import { JWEInvalid } from '../../util/errors.js';
 import { generateCek } from '../../lib/content_encryption.js';
 import { encryptKeyManagement } from '../../lib/key_management.js';
 import { encode as b64u } from '../../util/base64url.js';
-import { validateCritDuplicates } from '../../lib/options.js';
-import { checkDisjoint, checkEncryptHeaders, encryptJWE } from '../../lib/jwe_encrypt.js';
+import { checkDisjoint, checkEncryptHeaders, createJWE, encryptJWE } from '../../lib/jwe_encrypt.js';
 import { prepareKey } from '../../lib/key.js';
 import { jweAlgorithm } from '../../lib/jwe_algorithms.js';
+import { assertUint8Array } from '../../lib/type_checks.js';
 class IndividualRecipient {
     #parent;
     state;
@@ -78,19 +77,21 @@ export class GeneralEncrypt {
         if (!this.#recipients.length) {
             throw new JWEInvalid('at least one recipient must be added');
         }
-        if (!(this.#plaintext instanceof Uint8Array)) {
-            throw new TypeError('plaintext must be an instance of Uint8Array');
-        }
+        assertUint8Array(this.#plaintext, 'plaintext');
         if (this.#recipients.length === 1) {
-            const [recipient] = this.#recipients;
-            const [unprotectedHeader, keyManagementParameters, key, crit] = recipient.state;
-            const flattened = await new FlattenedEncrypt(this.#plaintext)
-                .setAdditionalAuthenticatedData(this.#aad)
-                .setProtectedHeader(this.#protectedHeader)
-                .setSharedUnprotectedHeader(this.#unprotectedHeader)
-                .setUnprotectedHeader(unprotectedHeader)
-                .setKeyManagementParameters(keyManagementParameters)
-                .encrypt(key, { crit });
+            const [unprotectedHeader, keyManagementParameters, key, crit] = this.#recipients[0].state;
+            const flattened = await createJWE([
+                this.#plaintext,
+                this.#protectedHeader,
+                unprotectedHeader,
+                this.#unprotectedHeader,
+                this.#aad,
+                undefined,
+                undefined,
+                keyManagementParameters,
+                crit,
+                false,
+            ], key);
             const jwe = {
                 ciphertext: flattened.ciphertext,
                 iv: flattened.iv,
@@ -102,8 +103,9 @@ export class GeneralEncrypt {
             copyOptionalMembers(flattened, jwe, jwe.recipients[0]);
             return jwe;
         }
-        validateCritDuplicates(JWEInvalid, this.#protectedHeader);
         let enc;
+        let protectedHeader = this.#protectedHeader;
+        let sharedUnprotectedHeader = this.#unprotectedHeader;
         const inputs = [];
         const checked = [];
         for (let i = 0; i < this.#recipients.length; i++) {
@@ -111,9 +113,9 @@ export class GeneralEncrypt {
             const [unprotectedHeader, keyManagementParameters, , crit] = recipient.state;
             const input = [
                 this.#plaintext,
-                this.#protectedHeader,
+                protectedHeader,
                 unprotectedHeader,
-                this.#unprotectedHeader,
+                sharedUnprotectedHeader,
                 this.#aad,
                 undefined,
                 undefined,
@@ -124,6 +126,10 @@ export class GeneralEncrypt {
             const headers = checkEncryptHeaders(input);
             inputs.push(input);
             checked.push(headers);
+            if (i === 0) {
+                protectedHeader = input[1];
+                sharedUnprotectedHeader = input[3];
+            }
             if (headers[1] === 'dir' || headers[1] === 'ECDH-ES') {
                 throw new JWEInvalid(`"${headers[1]}" alg may only have a single recipient`);
             }
@@ -141,7 +147,7 @@ export class GeneralEncrypt {
         };
         for (let i = 0; i < this.#recipients.length; i++) {
             const recipient = this.#recipients[i];
-            const [unprotectedHeader, keyManagementParameters, key] = recipient.state;
+            const [, keyManagementParameters, key] = recipient.state;
             const target = {};
             jwe.recipients.push(target);
             if (i === 0) {
@@ -155,13 +161,14 @@ export class GeneralEncrypt {
                 continue;
             }
             const [, alg, , encEntry] = checked[i];
+            const unprotectedHeader = inputs[i][2];
             const k = await prepareKey(jweAlgorithm(alg), key, 'encrypt');
             const [, encryptedKey, parameters] = await encryptKeyManagement(alg, encEntry, k, cek, keyManagementParameters);
             target.encrypted_key = b64u(encryptedKey);
             if (unprotectedHeader || parameters) {
                 const header = { ...unprotectedHeader, ...parameters };
                 if (parameters)
-                    checkDisjoint(this.#protectedHeader, header, this.#unprotectedHeader);
+                    checkDisjoint(inputs[i][1], header, inputs[i][3]);
                 target.header = header;
             }
         }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwk/embedded.js

@@ -2,6 +2,7 @@ import { jwkToKey } from '../lib/jwk_to_key.js';
 import { jwsAlgorithm } from '../lib/jws_algorithms.js';
 import { isObject } from '../lib/type_checks.js';
 import { JWSInvalid } from '../util/errors.js';
+import { normalizeJwk } from '../lib/jwk_metadata.js';
 export async function EmbeddedJWK(protectedHeader, token) {
     const joseHeader = {
         ...protectedHeader,
@@ -10,8 +11,21 @@ export async function EmbeddedJWK(protectedHeader, token) {
     if (!isObject(joseHeader.jwk)) {
         throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');
     }
+    let jwk;
+    try {
+        jwk = normalizeJwk(joseHeader.jwk);
+    }
+    catch (cause) {
+        throw new JWSInvalid('Invalid Embedded JWK', { cause });
+    }
     const entry = jwsAlgorithm(joseHeader.alg);
-    const key = await jwkToKey(entry, { ...joseHeader.jwk, ext: true });
+    if (jwk.use !== undefined && jwk.use !== 'sig') {
+        throw new JWSInvalid('Invalid Embedded JWK, its "use" must be "sig" when present');
+    }
+    if (jwk.alg !== undefined && jwk.alg !== entry.alg) {
+        throw new JWSInvalid(`Invalid Embedded JWK, its "alg" must be "${entry.alg}" when present`);
+    }
+    const key = await jwkToKey(entry, { ...jwk, ext: true });
     if (key.type !== 'public') {
         throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
     }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwk/thumbprint.js

@@ -3,9 +3,10 @@ import { encode as b64u } from '../util/base64url.js';
 import { JOSENotSupported, JWKInvalid } from '../util/errors.js';
 import { encode } from '../lib/buffer_utils.js';
 import { isKeyLike } from '../lib/is_key_like.js';
-import { isJWK } from '../lib/type_checks.js';
+import { isObject } from '../lib/type_checks.js';
 import { exportJWK } from '../key/export.js';
 import { invalidKeyInput } from '../lib/invalid_key_input.js';
+import { snapshotJwk } from '../lib/jwk_metadata.js';
 const check = (value, description) => {
     if (typeof value !== 'string' || !value) {
         throw new JWKInvalid(`${description} missing or invalid`);
@@ -13,11 +14,14 @@ const check = (value, description) => {
 };
 export async function calculateJwkThumbprint(key, digestAlgorithm) {
     let jwk;
-    if (isJWK(key)) {
-        jwk = key;
+    if (isObject(key)) {
+        jwk = snapshotJwk(key);
+        if (typeof jwk.kty !== 'string') {
+            throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
+        }
     }
     else if (isKeyLike(key)) {
-        jwk = await exportJWK(key);
+        jwk = snapshotJwk(await exportJWK(key));
     }
     else {
         throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
@@ -52,7 +56,9 @@ export async function calculateJwkThumbprint(key, digestAlgorithm) {
             components = { e: jwk.e, kty: jwk.kty, n: jwk.n };
             break;
         case 'oct':
-            check(jwk.k, '"k" (Key Value) Parameter');
+            if (typeof jwk.k !== 'string') {
+                throw new JWKInvalid('"k" (Key Value) Parameter missing or invalid');
+            }
             components = { k: jwk.k, kty: jwk.kty };
             break;
         default:

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwks/local.js

@@ -1,78 +1,70 @@
 import { jwkToKey } from '../lib/jwk_to_key.js';
 import { JWS } from '../lib/jws_algorithms.js';
 import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, } from '../util/errors.js';
-import { isObject } from '../lib/type_checks.js';
-function signatureAlgorithm(alg) {
-    const entry = typeof alg === 'string' ? JWS[alg] : undefined;
-    if (!entry || entry.secret) {
-        throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
-    }
-    return entry;
+import { isJwkSet } from '../lib/type_checks.js';
+import { snapshotJwk } from '../lib/jwk_metadata.js';
+function isUsableJWK(jwk, entry, alg, kid) {
+    const { kty, key_ops, ext, kid: jwkKid, alg: jwkAlg, use, crv } = snapshotJwk(jwk);
+    const keyOps = Array.isArray(key_ops) ? [...key_ops] : key_ops;
+    return ((ext === undefined || typeof ext === 'boolean') &&
+        (keyOps === undefined ||
+            (Array.isArray(keyOps) &&
+                keyOps.every((operation, index) => typeof operation === 'string' && keyOps.indexOf(operation) === index) &&
+                keyOps.includes('verify'))) &&
+        entry.kty.includes(kty) &&
+        (kid === undefined || (typeof kid === 'string' && kid === jwkKid)) &&
+        (jwkAlg === undefined ? kty !== 'AKP' : alg === jwkAlg) &&
+        (use === undefined || use === 'sig') &&
+        (!entry.crv || crv === entry.crv));
 }
-function isJWKSLike(jwks) {
-    if (!jwks || typeof jwks !== 'object') {
-        return false;
+async function importWithAlgCache(cache, jwk, entry) {
+    const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk);
+    const { alg } = entry;
+    if (cached[alg] === undefined) {
+        const key = await jwkToKey(entry, { ...jwk, alg, ext: true });
+        if (key.type !== 'public') {
+            throw new JWKSInvalid('JSON Web Key Set members must be public keys');
+        }
+        cached[alg] = key;
     }
-    const { keys } = jwks;
-    return Array.isArray(keys) && keys.every((isObject));
+    return cached[alg];
 }
-class LocalJWKSetImpl {
-    #jwks;
-    #cached = new WeakMap();
-    constructor(jwks) {
-        if (!isJWKSLike(jwks)) {
-            throw new JWKSInvalid('JSON Web Key Set malformed');
-        }
-        this.#jwks = structuredClone(jwks);
+export function createLocalJWKSet(jwks) {
+    let snapshot;
+    try {
+        snapshot = structuredClone(jwks);
     }
-    jwks() {
-        return this.#jwks;
+    catch { }
+    if (!isJwkSet(snapshot)) {
+        throw new JWKSInvalid('JSON Web Key Set malformed');
     }
-    async getKey(protectedHeader, token) {
+    const cached = new WeakMap();
+    const localJWKSet = async (protectedHeader, token) => {
         const { alg, kid } = { ...protectedHeader, ...token?.header };
-        const entry = signatureAlgorithm(alg);
-        const candidates = this.#jwks.keys.filter((jwk) => entry.kty.includes(jwk.kty) &&
-            (typeof kid !== 'string' || kid === jwk.kid) &&
-            (!(typeof jwk.alg === 'string' || jwk.kty === 'AKP') || alg === jwk.alg) &&
-            (typeof jwk.use !== 'string' || jwk.use === 'sig') &&
-            (!Array.isArray(jwk.key_ops) || jwk.key_ops.includes('verify')) &&
-            (!entry.crv || jwk.crv === entry.crv));
+        const entry = typeof alg === 'string' ? JWS[alg] : undefined;
+        if (!entry || entry.secret) {
+            throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
+        }
+        const candidates = snapshot.keys.filter((jwk) => isUsableJWK(jwk, entry, alg, kid));
         const { 0: jwk, length } = candidates;
-        if (length === 0) {
+        if (!length) {
             throw new JWKSNoMatchingKey();
         }
         if (length !== 1) {
             const error = new JWKSMultipleMatchingKeys();
-            const _cached = this.#cached;
             error[Symbol.asyncIterator] = async function* () {
                 for (const jwk of candidates) {
                     try {
-                        yield await importWithAlgCache(_cached, jwk, entry);
+                        yield await importWithAlgCache(cached, jwk, entry);
                     }
                     catch { }
                 }
             };
             throw error;
         }
-        return importWithAlgCache(this.#cached, jwk, entry);
-    }
-}
-async function importWithAlgCache(cache, jwk, entry) {
-    const cached = cache.get(jwk) || cache.set(jwk, { __proto__: null }).get(jwk);
-    if (cached[entry.alg] === undefined) {
-        const key = await jwkToKey(entry, { ...jwk, alg: entry.alg, ext: true });
-        if (key.type !== 'public') {
-            throw new JWKSInvalid('JSON Web Key Set members must be public keys');
-        }
-        cached[entry.alg] = key;
-    }
-    return cached[entry.alg];
-}
-export function createLocalJWKSet(jwks) {
-    const set = new LocalJWKSetImpl(jwks);
-    const localJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
-    Object.defineProperty(localJWKSet, 'jwks', {
-        value: () => structuredClone(set.jwks()),
+        return importWithAlgCache(cached, jwk, entry);
+    };
+    return Object.defineProperty(localJWKSet, 'jwks', {
+        value: () => structuredClone(snapshot),
     });
-    return localJWKSet;
 }

package/node_modules/@modelcontextprotocol/sdk/node_modules/jose/dist/webapi/jwks/remote.js

@@ -1,6 +1,6 @@
 import { JOSEError, JWKSNoMatchingKey, JWKSTimeout } from '../util/errors.js';
 import { createLocalJWKSet } from './local.js';
-import { isObject } from '../lib/type_checks.js';
+import { isJwkSet } from '../lib/type_checks.js';
 function isCloudflareWorkers() {
     return (typeof WebSocketPair !== 'undefined' ||
         (typeof navigator !== 'undefined' && navigator.userAgent === 'Cloudflare-Workers') ||
@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v6.2.9';
+    const VERSION = 'v6.2.10';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const customFetch = Symbol();
@@ -36,135 +36,114 @@ async function fetchJwks(url, headers, signal, fetchImpl = fetch) {
     }
 }
 export const jwksCache = Symbol();
-function isFreshJwksCache(input, cacheMaxAge) {
-    if (typeof input !== 'object' || input === null) {
-        return false;
-    }
-    if (!('uat' in input) || typeof input.uat !== 'number' || Date.now() - input.uat >= cacheMaxAge) {
-        return false;
-    }
-    if (!('jwks' in input) ||
-        !isObject(input.jwks) ||
-        !Array.isArray(input.jwks.keys) ||
-        !Array.prototype.every.call(input.jwks.keys, isObject)) {
-        return false;
-    }
-    return true;
+function isFreshFor(timestamp, duration) {
+    return Number.isFinite(timestamp) && Date.now() < timestamp + duration;
 }
-class RemoteJWKSetImpl {
-    #url;
-    #timeoutDuration;
-    #cooldownDuration;
-    #cacheMaxAge;
-    #jwksTimestamp;
-    #pendingFetch;
-    #headers;
-    #customFetch;
-    #local;
-    #cache;
-    constructor(url, options) {
-        if (!(url instanceof URL)) {
-            throw new TypeError('url must be an instance of URL');
-        }
-        this.#url = new URL(url.href);
-        const opts = options ?? {};
-        this.#timeoutDuration = typeof opts.timeoutDuration === 'number' ? opts.timeoutDuration : 5000;
-        this.#cooldownDuration =
-            typeof opts.cooldownDuration === 'number' ? opts.cooldownDuration : 30000;
-        this.#cacheMaxAge = typeof opts.cacheMaxAge === 'number' ? opts.cacheMaxAge : 600000;
-        this.#headers = new Headers(opts.headers);
-        if (USER_AGENT && !this.#headers.has('User-Agent')) {
-            this.#headers.set('User-Agent', USER_AGENT);
-        }
-        if (!this.#headers.has('accept')) {
-            this.#headers.set('accept', 'application/json');
-            this.#headers.append('accept', 'application/jwk-set+json');
-        }
-        this.#customFetch = opts[customFetch];
-        const cache = opts[jwksCache];
-        if (cache !== undefined) {
-            this.#cache = cache;
-            if (isFreshJwksCache(cache, this.#cacheMaxAge)) {
-                this.#jwksTimestamp = this.#cache.uat;
-                this.#local = createLocalJWKSet(this.#cache.jwks);
-            }
-        }
+function validateDuration(value, fallback, option) {
+    if (Number.isNaN(value)) {
+        throw new TypeError(`"${option}" option must not be NaN`);
     }
-    pendingFetch() {
-        return !!this.#pendingFetch;
+    return typeof value === 'number' ? value : fallback;
+}
+export function createRemoteJWKSet(url, options) {
+    if (!(url instanceof URL)) {
+        throw new TypeError('url must be an instance of URL');
     }
-    #validFor(duration) {
-        return typeof this.#jwksTimestamp === 'number' && Date.now() < this.#jwksTimestamp + duration;
+    const href = new URL(url.href).href;
+    const opts = options ?? {};
+    const timeoutOption = opts.timeoutDuration;
+    if (typeof timeoutOption === 'number' &&
+        (!Number.isInteger(timeoutOption) || timeoutOption < 0)) {
+        throw new TypeError('"timeoutDuration" option must be a non-negative integer');
     }
-    coolingDown() {
-        return this.#validFor(this.#cooldownDuration);
+    const timeoutDuration = typeof timeoutOption === 'number' ? timeoutOption : 5000;
+    const cooldownDuration = validateDuration(opts.cooldownDuration, 30000, 'cooldownDuration');
+    const cacheMaxAge = validateDuration(opts.cacheMaxAge, 600000, 'cacheMaxAge');
+    const headers = new Headers(opts.headers);
+    if (USER_AGENT && !headers.has('User-Agent')) {
+        headers.set('User-Agent', USER_AGENT);
     }
-    fresh() {
-        return this.#validFor(this.#cacheMaxAge);
+    if (!headers.has('accept')) {
+        headers.set('accept', 'application/json, application/jwk-set+json');
     }
-    jwks() {
-        return this.#local?.jwks();
+    const fetchImpl = opts[customFetch];
+    const cache = opts[jwksCache];
+    let jwksTimestamp;
+    let pendingFetch;
+    let reloadSequence = 0;
+    let appliedSequence = 0;
+    let local;
+    if (cache && typeof cache === 'object') {
+        const { uat, jwks } = cache;
+        if (isFreshFor(uat, cacheMaxAge) && isJwkSet(jwks)) {
+            jwksTimestamp = uat;
+            local = createLocalJWKSet(jwks);
+        }
     }
-    async getKey(protectedHeader, token) {
-        if (!this.#local || !this.fresh()) {
-            await this.reload();
+    const reload = async () => {
+        if (pendingFetch && isCloudflareWorkers()) {
+            pendingFetch = undefined;
+        }
+        if (!pendingFetch) {
+            const sequence = ++reloadSequence;
+            const current = (pendingFetch = fetchJwks(href, headers, AbortSignal.timeout(timeoutDuration), fetchImpl)
+                .then((json) => {
+                const next = createLocalJWKSet(json);
+                if (sequence <= appliedSequence) {
+                    return;
+                }
+                local = next;
+                const updatedAt = Date.now();
+                if (cache) {
+                    cache.uat = updatedAt;
+                    cache.jwks = json;
+                }
+                jwksTimestamp = updatedAt;
+                appliedSequence = sequence;
+            })
+                .finally(() => {
+                if (pendingFetch === current) {
+                    pendingFetch = undefined;
+                }
+            }));
+        }
+        await pendingFetch;
+    };
+    const remoteJWKSet = async (protectedHeader, token) => {
+        if (!local || !isFreshFor(jwksTimestamp, cacheMaxAge)) {
+            await reload();
         }
         try {
-            return await this.#local(protectedHeader, token);
+            return await local(protectedHeader, token);
         }
         catch (err) {
-            if (err instanceof JWKSNoMatchingKey) {
-                if (this.coolingDown() === false) {
-                    await this.reload();
-                    return this.#local(protectedHeader, token);
-                }
+            if (err instanceof JWKSNoMatchingKey && !isFreshFor(jwksTimestamp, cooldownDuration)) {
+                await reload();
+                return local(protectedHeader, token);
             }
             throw err;
         }
-    }
-    async reload() {
-        if (this.#pendingFetch && isCloudflareWorkers()) {
-            this.#pendingFetch = undefined;
-        }
-        this.#pendingFetch ||= fetchJwks(this.#url.href, this.#headers, AbortSignal.timeout(this.#timeoutDuration), this.#customFetch)
-            .then((json) => {
-            this.#local = createLocalJWKSet(json);
-            if (this.#cache) {
-                this.#cache.uat = Date.now();
-                this.#cache.jwks = json;
-            }
-            this.#jwksTimestamp = Date.now();
-        })
-            .finally(() => {
-            this.#pendingFetch = undefined;
-        });
-        await this.#pendingFetch;
-    }
-}
-export function createRemoteJWKSet(url, options) {
-    const set = new RemoteJWKSetImpl(url, options);
-    const remoteJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
-    Object.defineProperties(remoteJWKSet, {
+    };
+    return Object.defineProperties(remoteJWKSet, {
         coolingDown: {
-            get: () => set.coolingDown(),
+            get: () => isFreshFor(jwksTimestamp, cooldownDuration),
             enumerable: true,
         },
         fresh: {
-            get: () => set.fresh(),
+            get: () => isFreshFor(jwksTimestamp, cacheMaxAge),
             enumerable: true,
         },
         reload: {
-            value: () => set.reload(),
+            value: reload,
             enumerable: true,
         },
         reloading: {
-            get: () => set.pendingFetch(),
+            get: () => !!pendingFetch,
             enumerable: true,
         },
         jwks: {
-            value: () => set.jwks(),
+            value: () => local?.jwks(),
             enumerable: true,
         },
     });
-    return remoteJWKSet;
 }