@zuplo/cli 7.4.5 → 7.4.6

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/types/jwks/remote.d.ts

@@ -36,17 +36,17 @@ export declare const jwksCache: unique symbol;
 export interface RemoteJWKSetOptions {
     /**
      * Timeout (in milliseconds) for the HTTP request. When reached the request will be aborted and
-     * the verification will fail. Default is 5000 (5 seconds).
+     * the verification will fail. Must be a non-negative integer. Default is 5000 (5 seconds).
      */
     timeoutDuration?: number;
     /**
      * Duration (in milliseconds) for which no more HTTP requests will be triggered after a previous
-     * successful fetch. Default is 30000 (30 seconds).
+     * successful fetch. Must not be `NaN`. Default is 30000 (30 seconds).
      */
     cooldownDuration?: number;
     /**
      * Maximum time (in milliseconds) between successful HTTP requests. Default is 600000 (10
-     * minutes).
+     * minutes). Must not be `NaN`.
      */
     cacheMaxAge?: number | typeof Infinity;
     /** Headers to be sent with the HTTP request. */
@@ -60,7 +60,7 @@ export interface RemoteJWKSetOptions {
 export interface ExportedJWKSCache {
     /** Current cached JSON Web Key Set */
     jwks: types.JSONWebKeySet;
-    /** Last updated at timestamp (seconds since epoch) */
+    /** Last updated at timestamp (milliseconds since epoch) */
     uat: number;
 }
 /** See {@link jwksCache}. */

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/types/jws/general/verify.d.ts

@@ -11,9 +11,9 @@ export interface GeneralVerifyGetKey<KeyType extends types.CryptoKey | Uint8Arra
  * > Note: The function iterates over the `signatures` array in the General JWS and returns the verification
  * > result of the first signature entry that can be successfully verified. The result only contains
  * > the payload, protected header, and unprotected header of that successfully verified signature
- * > entry. Other signature entries in the General JWS are not validated, and their headers are not
- * > included in the returned result. Recipients of a General JWS should only rely on the returned
- * > (verified) data.
+ * > entry. Other signature entries' headers may be inspected solely to reject inconsistent use of the
+ * > JWS Unencoded Payload Option, and their headers are not included in the returned result.
+ * > Recipients of a General JWS should only rely on the returned (verified) data.
  *
  * @param jws General JWS.
  * @param key Key to verify the JWS with. See

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/types/jwt/encrypt.d.ts

@@ -1,20 +1,13 @@
 import type * as types from '../types.d.ts';
+/**
+ * EncryptJWT constructor
+ *
+ * @param payload The JWT Claims Set object. Defaults to an empty object.
+ */
+declare const EncryptJWT_base: new (payload?: types.JWTPayload) => types.ProduceJWT;
 /** The EncryptJWT class is used to build and encrypt Compact JWE formatted JSON Web Tokens. */
-export declare class EncryptJWT implements types.ProduceJWT {
+export declare class EncryptJWT extends EncryptJWT_base {
     #private;
-    /**
-     * {@link EncryptJWT} constructor
-     *
-     * @param payload The JWT Claims Set object. Defaults to an empty object.
-     */
-    constructor(payload?: types.JWTPayload);
-    setIssuer(issuer: string): this;
-    setSubject(subject: string): this;
-    setAudience(audience: string | string[]): this;
-    setJti(jwtId: string): this;
-    setNotBefore(input: number | string | Date): this;
-    setExpirationTime(input: number | string | Date): this;
-    setIssuedAt(input?: number | string | Date): this;
     /**
      * Sets the JWE Protected Header on the EncryptJWT object.
      *
@@ -66,3 +59,4 @@ export declare class EncryptJWT implements types.ProduceJWT {
      */
     encrypt(key: types.KeyInput, options?: types.EncryptOptions): Promise<string>;
 }
+export {};

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/types/jwt/sign.d.ts

@@ -1,20 +1,13 @@
 import type * as types from '../types.d.ts';
+/**
+ * SignJWT constructor
+ *
+ * @param payload The JWT Claims Set object. Defaults to an empty object.
+ */
+declare const SignJWT_base: new (payload?: types.JWTPayload) => types.ProduceJWT;
 /** The SignJWT class is used to build and sign Compact JWS formatted JSON Web Tokens. */
-export declare class SignJWT implements types.ProduceJWT {
+export declare class SignJWT extends SignJWT_base {
     #private;
-    /**
-     * {@link SignJWT} constructor
-     *
-     * @param payload The JWT Claims Set object. Defaults to an empty object.
-     */
-    constructor(payload?: types.JWTPayload);
-    setIssuer(issuer: string): this;
-    setSubject(subject: string): this;
-    setAudience(audience: string | string[]): this;
-    setJti(jwtId: string): this;
-    setNotBefore(input: number | string | Date): this;
-    setExpirationTime(input: number | string | Date): this;
-    setIssuedAt(input?: number | string | Date): this;
     /**
      * Sets the JWS Protected Header on the SignJWT object.
      *
@@ -30,3 +23,4 @@ export declare class SignJWT implements types.ProduceJWT {
      */
     sign(key: types.KeyInput, options?: types.SignOptions): Promise<string>;
 }
+export {};

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/types/jwt/unsecured.d.ts

@@ -6,24 +6,17 @@ export interface UnsecuredResult<PayloadType = types.JWTPayload> {
     /** The decoded JOSE Header; always `{ "alg": "none" }` for an Unsecured JWT. */
     header: types.JWSHeaderParameters;
 }
+/**
+ * UnsecuredJWT constructor
+ *
+ * @param payload The JWT Claims Set object. Defaults to an empty object.
+ */
+declare const UnsecuredJWT_base: new (payload?: types.JWTPayload) => types.ProduceJWT;
 /** The UnsecuredJWT class is a utility for dealing with `{ "alg": "none" }` Unsecured JWTs. */
-export declare class UnsecuredJWT implements types.ProduceJWT {
-    #private;
-    /**
-     * {@link UnsecuredJWT} constructor
-     *
-     * @param payload The JWT Claims Set object. Defaults to an empty object.
-     */
-    constructor(payload?: types.JWTPayload);
+export declare class UnsecuredJWT extends UnsecuredJWT_base {
+    private jwt;
     /** Encodes the Unsecured JWT. */
     encode(): string;
-    setIssuer(issuer: string): this;
-    setSubject(subject: string): this;
-    setAudience(audience: string | string[]): this;
-    setJti(jwtId: string): this;
-    setNotBefore(input: number | string | Date): this;
-    setExpirationTime(input: number | string | Date): this;
-    setIssuedAt(input?: number | string | Date): this;
     /**
      * Decodes an unsecured JWT.
      *
@@ -32,3 +25,4 @@ export declare class UnsecuredJWT implements types.ProduceJWT {
      */
     static decode<PayloadType = types.JWTPayload>(jwt: string, options?: types.JWTClaimVerificationOptions): UnsecuredResult<PayloadType>;
 }
+export {};

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/webapi/jwe/compact/encrypt.js

@@ -1,27 +1,49 @@
-import { FlattenedEncrypt } from '../flattened/encrypt.js';
+import { assertNotSet } from '../../lib/helpers.js';
+import { assertUint8Array } from '../../lib/type_checks.js';
+import { createJWE } from '../../lib/jwe_encrypt.js';
 export class CompactEncrypt {
-    #flattened;
+    #plaintext;
+    #protectedHeader;
+    #cek;
+    #iv;
+    #keyManagementParameters;
     constructor(plaintext) {
-        this.#flattened = new FlattenedEncrypt(plaintext);
+        assertUint8Array(plaintext, 'plaintext');
+        this.#plaintext = plaintext;
     }
     setContentEncryptionKey(cek) {
-        this.#flattened.setContentEncryptionKey(cek);
+        assertNotSet(this.#cek, 'setContentEncryptionKey');
+        this.#cek = cek;
         return this;
     }
     setInitializationVector(iv) {
-        this.#flattened.setInitializationVector(iv);
+        assertNotSet(this.#iv, 'setInitializationVector');
+        this.#iv = iv;
         return this;
     }
     setProtectedHeader(protectedHeader) {
-        this.#flattened.setProtectedHeader(protectedHeader);
+        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
+        this.#protectedHeader = protectedHeader;
         return this;
     }
     setKeyManagementParameters(parameters) {
-        this.#flattened.setKeyManagementParameters(parameters);
+        assertNotSet(this.#keyManagementParameters, 'setKeyManagementParameters');
+        this.#keyManagementParameters = parameters;
         return this;
     }
     async encrypt(key, options) {
-        const jwe = await this.#flattened.encrypt(key, options);
+        const jwe = await createJWE([
+            this.#plaintext,
+            this.#protectedHeader,
+            undefined,
+            undefined,
+            undefined,
+            this.#cek,
+            this.#iv,
+            this.#keyManagementParameters,
+            undefined,
+            false,
+        ], key, options);
         return [jwe.protected, jwe.encrypted_key, jwe.iv, jwe.ciphertext, jwe.tag].join('.');
     }
 }

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/webapi/jwe/flattened/decrypt.js

@@ -1,11 +1,15 @@
 import { JWEInvalid } from '../../util/errors.js';
 import { isObject } from '../../lib/type_checks.js';
-import { prepareDecrypt, decryptJWE, decryptResult, checkShared, checkRecipient, } from '../../lib/jwe_decrypt.js';
+import { prepareDecrypt, decryptJWE, decryptResult, checkRecipient, snapshotSharedJWE, snapshotRecipientJWE, } from '../../lib/jwe_decrypt.js';
 export async function flattenedDecrypt(jwe, key, options) {
     if (!isObject(jwe)) {
         throw new JWEInvalid('Flattened JWE must be an object');
     }
-    checkShared(jwe);
-    checkRecipient(jwe);
-    return decryptResult(jwe, await decryptJWE(jwe, prepareDecrypt(options), key));
+    const shared = snapshotSharedJWE(jwe);
+    const [recipient, , error] = snapshotRecipientJWE(jwe);
+    if (!recipient)
+        throw error;
+    const snapshot = { ...shared, ...recipient };
+    checkRecipient(snapshot);
+    return decryptResult(snapshot, await decryptJWE(snapshot, prepareDecrypt(options), key));
 }

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/webapi/jwe/flattened/encrypt.js

@@ -1,7 +1,6 @@
-import { unprotected, assertNotSet } from '../../lib/helpers.js';
-import { JWEInvalid } from '../../util/errors.js';
+import { assertNotSet } from '../../lib/helpers.js';
 import { createJWE } from '../../lib/jwe_encrypt.js';
-import { validateCritDuplicates } from '../../lib/options.js';
+import { assertUint8Array } from '../../lib/type_checks.js';
 export class FlattenedEncrypt {
     #plaintext;
     #protectedHeader;
@@ -12,9 +11,7 @@ export class FlattenedEncrypt {
     #iv;
     #keyManagementParameters;
     constructor(plaintext) {
-        if (!(plaintext instanceof Uint8Array)) {
-            throw new TypeError('plaintext must be an instance of Uint8Array');
-        }
+        assertUint8Array(plaintext, 'plaintext');
         this.#plaintext = plaintext;
     }
     setKeyManagementParameters(parameters) {
@@ -52,10 +49,6 @@ export class FlattenedEncrypt {
         return this;
     }
     async encrypt(key, options) {
-        if (!this.#protectedHeader && !this.#unprotectedHeader && !this.#sharedUnprotectedHeader) {
-            throw new JWEInvalid('either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()');
-        }
-        validateCritDuplicates(JWEInvalid, this.#protectedHeader);
         return createJWE([
             this.#plaintext,
             this.#protectedHeader,
@@ -65,8 +58,8 @@ export class FlattenedEncrypt {
             this.#cek,
             this.#iv,
             this.#keyManagementParameters,
-            options?.crit,
-            options ? unprotected in options : false,
-        ], key);
+            undefined,
+            false,
+        ], key, options);
     }
 }

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/webapi/jwe/general/decrypt.js

@@ -1,46 +1,46 @@
-import { prepareDecrypt, shareJWE, decryptRecipient, decryptResult, checkShared, checkRecipient, } from '../../lib/jwe_decrypt.js';
+import { prepareDecrypt, shareJWE, decryptRecipient, decryptResult, checkRecipient, snapshotSharedJWE, snapshotRecipientJWE, } from '../../lib/jwe_decrypt.js';
 import { JWEDecryptionFailed, JWEInvalid } from '../../util/errors.js';
 import { isObject } from '../../lib/type_checks.js';
 export async function generalDecrypt(jwe, key, options) {
     if (!isObject(jwe)) {
         throw new JWEInvalid('General JWE must be an object');
     }
-    if (!Array.isArray(jwe.recipients) || !jwe.recipients.every(isObject)) {
+    const inputRecipients = jwe.recipients;
+    if (!Array.isArray(inputRecipients)) {
         throw new JWEInvalid('JWE Recipients missing or incorrect type');
     }
-    if (!jwe.recipients.length) {
+    const recipients = Array.from(inputRecipients);
+    if (!recipients.every(isObject)) {
+        throw new JWEInvalid('JWE Recipients missing or incorrect type');
+    }
+    if (!recipients.length) {
         throw new JWEInvalid('JWE Recipients has no members');
     }
     let shared;
+    let sharedJwe;
     let token;
     try {
-        checkShared(jwe);
         shared = prepareDecrypt(options);
-        token = shareJWE(jwe);
+        sharedJwe = snapshotSharedJWE(jwe);
+        token = shareJWE(sharedJwe);
     }
     catch {
         throw new JWEDecryptionFailed();
     }
-    if (jwe.recipients.length > 1) {
-        for (const { header } of jwe.recipients) {
-            const alg = token[0]?.alg ?? header?.alg ?? jwe.unprotected?.alg;
+    const recipientSnapshots = recipients.map((recipient) => snapshotRecipientJWE(recipient));
+    if (recipients.length > 1) {
+        for (const [, headerAlg] of recipientSnapshots) {
+            const alg = token[0]?.alg ?? headerAlg ?? sharedJwe.unprotected?.alg;
             if (alg === 'dir' || alg === 'ECDH-ES') {
                 throw new JWEInvalid(`"${alg}" alg may only have a single recipient`);
             }
         }
     }
-    for (const recipient of jwe.recipients) {
+    for (const [recipient] of recipientSnapshots) {
+        if (!recipient)
+            continue;
         try {
-            const flattened = {
-                aad: jwe.aad,
-                ciphertext: jwe.ciphertext,
-                encrypted_key: recipient.encrypted_key,
-                header: recipient.header,
-                iv: jwe.iv,
-                protected: jwe.protected,
-                tag: jwe.tag,
-                unprotected: jwe.unprotected,
-            };
+            const flattened = { ...sharedJwe, ...recipient };
             checkRecipient(flattened);
             return decryptResult(flattened, await decryptRecipient(flattened, token, shared, key));
         }

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/webapi/jwe/general/encrypt.js

@@ -1,13 +1,12 @@
-import { FlattenedEncrypt } from '../flattened/encrypt.js';
 import { assertNotSet } from '../../lib/helpers.js';
 import { JWEInvalid } from '../../util/errors.js';
 import { generateCek } from '../../lib/content_encryption.js';
 import { encryptKeyManagement } from '../../lib/key_management.js';
 import { encode as b64u } from '../../util/base64url.js';
-import { validateCritDuplicates } from '../../lib/options.js';
-import { checkDisjoint, checkEncryptHeaders, encryptJWE } from '../../lib/jwe_encrypt.js';
+import { checkDisjoint, checkEncryptHeaders, createJWE, encryptJWE } from '../../lib/jwe_encrypt.js';
 import { prepareKey } from '../../lib/key.js';
 import { jweAlgorithm } from '../../lib/jwe_algorithms.js';
+import { assertUint8Array } from '../../lib/type_checks.js';
 class IndividualRecipient {
     #parent;
     state;
@@ -78,19 +77,21 @@ export class GeneralEncrypt {
         if (!this.#recipients.length) {
             throw new JWEInvalid('at least one recipient must be added');
         }
-        if (!(this.#plaintext instanceof Uint8Array)) {
-            throw new TypeError('plaintext must be an instance of Uint8Array');
-        }
+        assertUint8Array(this.#plaintext, 'plaintext');
         if (this.#recipients.length === 1) {
-            const [recipient] = this.#recipients;
-            const [unprotectedHeader, keyManagementParameters, key, crit] = recipient.state;
-            const flattened = await new FlattenedEncrypt(this.#plaintext)
-                .setAdditionalAuthenticatedData(this.#aad)
-                .setProtectedHeader(this.#protectedHeader)
-                .setSharedUnprotectedHeader(this.#unprotectedHeader)
-                .setUnprotectedHeader(unprotectedHeader)
-                .setKeyManagementParameters(keyManagementParameters)
-                .encrypt(key, { crit });
+            const [unprotectedHeader, keyManagementParameters, key, crit] = this.#recipients[0].state;
+            const flattened = await createJWE([
+                this.#plaintext,
+                this.#protectedHeader,
+                unprotectedHeader,
+                this.#unprotectedHeader,
+                this.#aad,
+                undefined,
+                undefined,
+                keyManagementParameters,
+                crit,
+                false,
+            ], key);
             const jwe = {
                 ciphertext: flattened.ciphertext,
                 iv: flattened.iv,
@@ -102,8 +103,9 @@ export class GeneralEncrypt {
             copyOptionalMembers(flattened, jwe, jwe.recipients[0]);
             return jwe;
         }
-        validateCritDuplicates(JWEInvalid, this.#protectedHeader);
         let enc;
+        let protectedHeader = this.#protectedHeader;
+        let sharedUnprotectedHeader = this.#unprotectedHeader;
         const inputs = [];
         const checked = [];
         for (let i = 0; i < this.#recipients.length; i++) {
@@ -111,9 +113,9 @@ export class GeneralEncrypt {
             const [unprotectedHeader, keyManagementParameters, , crit] = recipient.state;
             const input = [
                 this.#plaintext,
-                this.#protectedHeader,
+                protectedHeader,
                 unprotectedHeader,
-                this.#unprotectedHeader,
+                sharedUnprotectedHeader,
                 this.#aad,
                 undefined,
                 undefined,
@@ -124,6 +126,10 @@ export class GeneralEncrypt {
             const headers = checkEncryptHeaders(input);
             inputs.push(input);
             checked.push(headers);
+            if (i === 0) {
+                protectedHeader = input[1];
+                sharedUnprotectedHeader = input[3];
+            }
             if (headers[1] === 'dir' || headers[1] === 'ECDH-ES') {
                 throw new JWEInvalid(`"${headers[1]}" alg may only have a single recipient`);
             }
@@ -141,7 +147,7 @@ export class GeneralEncrypt {
         };
         for (let i = 0; i < this.#recipients.length; i++) {
             const recipient = this.#recipients[i];
-            const [unprotectedHeader, keyManagementParameters, key] = recipient.state;
+            const [, keyManagementParameters, key] = recipient.state;
             const target = {};
             jwe.recipients.push(target);
             if (i === 0) {
@@ -155,13 +161,14 @@ export class GeneralEncrypt {
                 continue;
             }
             const [, alg, , encEntry] = checked[i];
+            const unprotectedHeader = inputs[i][2];
             const k = await prepareKey(jweAlgorithm(alg), key, 'encrypt');
             const [, encryptedKey, parameters] = await encryptKeyManagement(alg, encEntry, k, cek, keyManagementParameters);
             target.encrypted_key = b64u(encryptedKey);
             if (unprotectedHeader || parameters) {
                 const header = { ...unprotectedHeader, ...parameters };
                 if (parameters)
-                    checkDisjoint(this.#protectedHeader, header, this.#unprotectedHeader);
+                    checkDisjoint(inputs[i][1], header, inputs[i][3]);
                 target.header = header;
             }
         }

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/webapi/jwk/embedded.js

@@ -2,6 +2,7 @@ import { jwkToKey } from '../lib/jwk_to_key.js';
 import { jwsAlgorithm } from '../lib/jws_algorithms.js';
 import { isObject } from '../lib/type_checks.js';
 import { JWSInvalid } from '../util/errors.js';
+import { normalizeJwk } from '../lib/jwk_metadata.js';
 export async function EmbeddedJWK(protectedHeader, token) {
     const joseHeader = {
         ...protectedHeader,
@@ -10,8 +11,21 @@ export async function EmbeddedJWK(protectedHeader, token) {
     if (!isObject(joseHeader.jwk)) {
         throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');
     }
+    let jwk;
+    try {
+        jwk = normalizeJwk(joseHeader.jwk);
+    }
+    catch (cause) {
+        throw new JWSInvalid('Invalid Embedded JWK', { cause });
+    }
     const entry = jwsAlgorithm(joseHeader.alg);
-    const key = await jwkToKey(entry, { ...joseHeader.jwk, ext: true });
+    if (jwk.use !== undefined && jwk.use !== 'sig') {
+        throw new JWSInvalid('Invalid Embedded JWK, its "use" must be "sig" when present');
+    }
+    if (jwk.alg !== undefined && jwk.alg !== entry.alg) {
+        throw new JWSInvalid(`Invalid Embedded JWK, its "alg" must be "${entry.alg}" when present`);
+    }
+    const key = await jwkToKey(entry, { ...jwk, ext: true });
     if (key.type !== 'public') {
         throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
     }

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/webapi/jwk/thumbprint.js

@@ -3,9 +3,10 @@ import { encode as b64u } from '../util/base64url.js';
 import { JOSENotSupported, JWKInvalid } from '../util/errors.js';
 import { encode } from '../lib/buffer_utils.js';
 import { isKeyLike } from '../lib/is_key_like.js';
-import { isJWK } from '../lib/type_checks.js';
+import { isObject } from '../lib/type_checks.js';
 import { exportJWK } from '../key/export.js';
 import { invalidKeyInput } from '../lib/invalid_key_input.js';
+import { snapshotJwk } from '../lib/jwk_metadata.js';
 const check = (value, description) => {
     if (typeof value !== 'string' || !value) {
         throw new JWKInvalid(`${description} missing or invalid`);
@@ -13,11 +14,14 @@ const check = (value, description) => {
 };
 export async function calculateJwkThumbprint(key, digestAlgorithm) {
     let jwk;
-    if (isJWK(key)) {
-        jwk = key;
+    if (isObject(key)) {
+        jwk = snapshotJwk(key);
+        if (typeof jwk.kty !== 'string') {
+            throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
+        }
     }
     else if (isKeyLike(key)) {
-        jwk = await exportJWK(key);
+        jwk = snapshotJwk(await exportJWK(key));
     }
     else {
         throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
@@ -52,7 +56,9 @@ export async function calculateJwkThumbprint(key, digestAlgorithm) {
             components = { e: jwk.e, kty: jwk.kty, n: jwk.n };
             break;
         case 'oct':
-            check(jwk.k, '"k" (Key Value) Parameter');
+            if (typeof jwk.k !== 'string') {
+                throw new JWKInvalid('"k" (Key Value) Parameter missing or invalid');
+            }
             components = { k: jwk.k, kty: jwk.kty };
             break;
         default:

package/node_modules/@modelcontextprotocol/client/node_modules/jose/dist/webapi/jwks/local.js

@@ -1,78 +1,70 @@
 import { jwkToKey } from '../lib/jwk_to_key.js';
 import { JWS } from '../lib/jws_algorithms.js';
 import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, } from '../util/errors.js';
-import { isObject } from '../lib/type_checks.js';
-function signatureAlgorithm(alg) {
-    const entry = typeof alg === 'string' ? JWS[alg] : undefined;
-    if (!entry || entry.secret) {
-        throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
-    }
-    return entry;
+import { isJwkSet } from '../lib/type_checks.js';
+import { snapshotJwk } from '../lib/jwk_metadata.js';
+function isUsableJWK(jwk, entry, alg, kid) {
+    const { kty, key_ops, ext, kid: jwkKid, alg: jwkAlg, use, crv } = snapshotJwk(jwk);
+    const keyOps = Array.isArray(key_ops) ? [...key_ops] : key_ops;
+    return ((ext === undefined || typeof ext === 'boolean') &&
+        (keyOps === undefined ||
+            (Array.isArray(keyOps) &&
+                keyOps.every((operation, index) => typeof operation === 'string' && keyOps.indexOf(operation) === index) &&
+                keyOps.includes('verify'))) &&
+        entry.kty.includes(kty) &&
+        (kid === undefined || (typeof kid === 'string' && kid === jwkKid)) &&
+        (jwkAlg === undefined ? kty !== 'AKP' : alg === jwkAlg) &&
+        (use === undefined || use === 'sig') &&
+        (!entry.crv || crv === entry.crv));
 }
-function isJWKSLike(jwks) {
-    if (!jwks || typeof jwks !== 'object') {
-        return false;
+async function importWithAlgCache(cache, jwk, entry) {
+    const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk);
+    const { alg } = entry;
+    if (cached[alg] === undefined) {
+        const key = await jwkToKey(entry, { ...jwk, alg, ext: true });
+        if (key.type !== 'public') {
+            throw new JWKSInvalid('JSON Web Key Set members must be public keys');
+        }
+        cached[alg] = key;
     }
-    const { keys } = jwks;
-    return Array.isArray(keys) && keys.every((isObject));
+    return cached[alg];
 }
-class LocalJWKSetImpl {
-    #jwks;
-    #cached = new WeakMap();
-    constructor(jwks) {
-        if (!isJWKSLike(jwks)) {
-            throw new JWKSInvalid('JSON Web Key Set malformed');
-        }
-        this.#jwks = structuredClone(jwks);
+export function createLocalJWKSet(jwks) {
+    let snapshot;
+    try {
+        snapshot = structuredClone(jwks);
     }
-    jwks() {
-        return this.#jwks;
+    catch { }
+    if (!isJwkSet(snapshot)) {
+        throw new JWKSInvalid('JSON Web Key Set malformed');
     }
-    async getKey(protectedHeader, token) {
+    const cached = new WeakMap();
+    const localJWKSet = async (protectedHeader, token) => {
         const { alg, kid } = { ...protectedHeader, ...token?.header };
-        const entry = signatureAlgorithm(alg);
-        const candidates = this.#jwks.keys.filter((jwk) => entry.kty.includes(jwk.kty) &&
-            (typeof kid !== 'string' || kid === jwk.kid) &&
-            (!(typeof jwk.alg === 'string' || jwk.kty === 'AKP') || alg === jwk.alg) &&
-            (typeof jwk.use !== 'string' || jwk.use === 'sig') &&
-            (!Array.isArray(jwk.key_ops) || jwk.key_ops.includes('verify')) &&
-            (!entry.crv || jwk.crv === entry.crv));
+        const entry = typeof alg === 'string' ? JWS[alg] : undefined;
+        if (!entry || entry.secret) {
+            throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
+        }
+        const candidates = snapshot.keys.filter((jwk) => isUsableJWK(jwk, entry, alg, kid));
         const { 0: jwk, length } = candidates;
-        if (length === 0) {
+        if (!length) {
             throw new JWKSNoMatchingKey();
         }
         if (length !== 1) {
             const error = new JWKSMultipleMatchingKeys();
-            const _cached = this.#cached;
             error[Symbol.asyncIterator] = async function* () {
                 for (const jwk of candidates) {
                     try {
-                        yield await importWithAlgCache(_cached, jwk, entry);
+                        yield await importWithAlgCache(cached, jwk, entry);
                     }
                     catch { }
                 }
             };
             throw error;
         }
-        return importWithAlgCache(this.#cached, jwk, entry);
-    }
-}
-async function importWithAlgCache(cache, jwk, entry) {
-    const cached = cache.get(jwk) || cache.set(jwk, { __proto__: null }).get(jwk);
-    if (cached[entry.alg] === undefined) {
-        const key = await jwkToKey(entry, { ...jwk, alg: entry.alg, ext: true });
-        if (key.type !== 'public') {
-            throw new JWKSInvalid('JSON Web Key Set members must be public keys');
-        }
-        cached[entry.alg] = key;
-    }
-    return cached[entry.alg];
-}
-export function createLocalJWKSet(jwks) {
-    const set = new LocalJWKSetImpl(jwks);
-    const localJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
-    Object.defineProperty(localJWKSet, 'jwks', {
-        value: () => structuredClone(set.jwks()),
+        return importWithAlgCache(cached, jwk, entry);
+    };
+    return Object.defineProperty(localJWKSet, 'jwks', {
+        value: () => structuredClone(snapshot),
     });
-    return localJWKSet;
 }