jose 4.15.4 → 5.0.1

package/dist/browser/runtime/generate.js

@@ -2,7 +2,6 @@ import crypto from './webcrypto.js';
 import { JOSENotSupported } from '../util/errors.js';
 import random from './random.js';
 export async function generateSecret(alg, options) {
-    var _a;
     let length;
     let algorithm;
     let keyUsages;
@@ -39,18 +38,16 @@ export async function generateSecret(alg, options) {
         default:
             throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
     }
-    return crypto.subtle.generateKey(algorithm, (_a = options === null || options === void 0 ? void 0 : options.extractable) !== null && _a !== void 0 ? _a : false, keyUsages);
+    return crypto.subtle.generateKey(algorithm, options?.extractable ?? false, keyUsages);
 }
 function getModulusLengthOption(options) {
-    var _a;
-    const modulusLength = (_a = options === null || options === void 0 ? void 0 : options.modulusLength) !== null && _a !== void 0 ? _a : 2048;
+    const modulusLength = options?.modulusLength ?? 2048;
     if (typeof modulusLength !== 'number' || modulusLength < 2048) {
         throw new JOSENotSupported('Invalid or unsupported modulusLength option provided, 2048 bits or larger keys must be used');
     }
     return modulusLength;
 }
 export async function generateKeyPair(alg, options) {
-    var _a, _b, _c;
     let algorithm;
     let keyUsages;
     switch (alg) {
@@ -102,7 +99,7 @@ export async function generateKeyPair(alg, options) {
             break;
         case 'EdDSA':
             keyUsages = ['sign', 'verify'];
-            const crv = (_a = options === null || options === void 0 ? void 0 : options.crv) !== null && _a !== void 0 ? _a : 'Ed25519';
+            const crv = options?.crv ?? 'Ed25519';
             switch (crv) {
                 case 'Ed25519':
                 case 'Ed448':
@@ -117,7 +114,7 @@ export async function generateKeyPair(alg, options) {
         case 'ECDH-ES+A192KW':
         case 'ECDH-ES+A256KW': {
             keyUsages = ['deriveKey', 'deriveBits'];
-            const crv = (_b = options === null || options === void 0 ? void 0 : options.crv) !== null && _b !== void 0 ? _b : 'P-256';
+            const crv = options?.crv ?? 'P-256';
             switch (crv) {
                 case 'P-256':
                 case 'P-384':
@@ -137,5 +134,5 @@ export async function generateKeyPair(alg, options) {
         default:
             throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
     }
-    return (crypto.subtle.generateKey(algorithm, (_c = options === null || options === void 0 ? void 0 : options.extractable) !== null && _c !== void 0 ? _c : false, keyUsages));
+    return (crypto.subtle.generateKey(algorithm, options?.extractable ?? false, keyUsages));
 }

package/dist/browser/runtime/jwk_to_key.js

@@ -1,48 +1,9 @@
 import crypto from './webcrypto.js';
 import { JOSENotSupported } from '../util/errors.js';
-import { decode as base64url } from './base64url.js';
 function subtleMapping(jwk) {
     let algorithm;
     let keyUsages;
     switch (jwk.kty) {
-        case 'oct': {
-            switch (jwk.alg) {
-                case 'HS256':
-                case 'HS384':
-                case 'HS512':
-                    algorithm = { name: 'HMAC', hash: `SHA-${jwk.alg.slice(-3)}` };
-                    keyUsages = ['sign', 'verify'];
-                    break;
-                case 'A128CBC-HS256':
-                case 'A192CBC-HS384':
-                case 'A256CBC-HS512':
-                    throw new JOSENotSupported(`${jwk.alg} keys cannot be imported as CryptoKey instances`);
-                case 'A128GCM':
-                case 'A192GCM':
-                case 'A256GCM':
-                case 'A128GCMKW':
-                case 'A192GCMKW':
-                case 'A256GCMKW':
-                    algorithm = { name: 'AES-GCM' };
-                    keyUsages = ['encrypt', 'decrypt'];
-                    break;
-                case 'A128KW':
-                case 'A192KW':
-                case 'A256KW':
-                    algorithm = { name: 'AES-KW' };
-                    keyUsages = ['wrapKey', 'unwrapKey'];
-                    break;
-                case 'PBES2-HS256+A128KW':
-                case 'PBES2-HS384+A192KW':
-                case 'PBES2-HS512+A256KW':
-                    algorithm = { name: 'PBKDF2' };
-                    keyUsages = ['deriveBits'];
-                    break;
-                default:
-                    throw new JOSENotSupported('Invalid or unsupported JWK "alg" (Algorithm) Parameter value');
-            }
-            break;
-        }
         case 'RSA': {
             switch (jwk.alg) {
                 case 'PS256':
@@ -122,19 +83,15 @@ function subtleMapping(jwk) {
     return { algorithm, keyUsages };
 }
 const parse = async (jwk) => {
-    var _a, _b;
     if (!jwk.alg) {
         throw new TypeError('"alg" argument is required when "jwk.alg" is not present');
     }
     const { algorithm, keyUsages } = subtleMapping(jwk);
     const rest = [
         algorithm,
-        (_a = jwk.ext) !== null && _a !== void 0 ? _a : false,
-        (_b = jwk.key_ops) !== null && _b !== void 0 ? _b : keyUsages,
+        jwk.ext ?? false,
+        jwk.key_ops ?? keyUsages,
     ];
-    if (algorithm.name === 'PBKDF2') {
-        return crypto.subtle.importKey('raw', base64url(jwk.k), ...rest);
-    }
     const keyData = { ...jwk };
     delete keyData.alg;
     delete keyData.use;

package/dist/browser/runtime/verify.js

@@ -9,7 +9,7 @@ const verify = async (alg, key, signature, data) => {
     try {
         return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);
     }
-    catch (_a) {
+    catch {
         return false;
     }
 };

package/dist/browser/util/decode_jwt.js

@@ -16,14 +16,14 @@ export function decodeJwt(jwt) {
     try {
         decoded = base64url(payload);
     }
-    catch (_a) {
+    catch {
         throw new JWTInvalid('Failed to base64url decode the payload');
     }
     let result;
     try {
         result = JSON.parse(decoder.decode(decoded));
     }
-    catch (_b) {
+    catch {
         throw new JWTInvalid('Failed to parse the decoded payload as JSON');
     }
     if (!isObject(result))

package/dist/browser/util/decode_protected_header.js

@@ -28,7 +28,7 @@ export function decodeProtectedHeader(token) {
         }
         return result;
     }
-    catch (_a) {
+    catch {
         throw new TypeError('Invalid Token or Protected Header formatting');
     }
 }

package/dist/browser/util/errors.js

@@ -3,11 +3,10 @@ export class JOSEError extends Error {
         return 'ERR_JOSE_GENERIC';
     }
     constructor(message) {
-        var _a;
         super(message);
         this.code = 'ERR_JOSE_GENERIC';
         this.name = this.constructor.name;
-        (_a = Error.captureStackTrace) === null || _a === void 0 ? void 0 : _a.call(Error, this, this.constructor);
+        Error.captureStackTrace?.(this, this.constructor);
     }
 }
 export class JWTClaimValidationFailed extends JOSEError {

package/dist/node/cjs/jwe/compact/encrypt.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CompactEncrypt = void 0;
 const encrypt_js_1 = require("../flattened/encrypt.js");
 class CompactEncrypt {
+    _flattened;
     constructor(plaintext) {
         this._flattened = new encrypt_js_1.FlattenedEncrypt(plaintext);
     }

package/dist/node/cjs/jwe/flattened/decrypt.js

@@ -3,7 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.flattenedDecrypt = void 0;
 const base64url_js_1 = require("../../runtime/base64url.js");
 const decrypt_js_1 = require("../../runtime/decrypt.js");
-const zlib_js_1 = require("../../runtime/zlib.js");
 const errors_js_1 = require("../../util/errors.js");
 const is_disjoint_js_1 = require("../../lib/is_disjoint.js");
 const is_object_js_1 = require("../../lib/is_object.js");
@@ -13,7 +12,6 @@ const cek_js_1 = require("../../lib/cek.js");
 const validate_crit_js_1 = require("../../lib/validate_crit.js");
 const validate_algorithms_js_1 = require("../../lib/validate_algorithms.js");
 async function flattenedDecrypt(jwe, key, options) {
-    var _a;
     if (!(0, is_object_js_1.default)(jwe)) {
         throw new errors_js_1.JWEInvalid('Flattened JWE must be an object');
     }
@@ -62,14 +60,9 @@ async function flattenedDecrypt(jwe, key, options) {
         ...jwe.header,
         ...jwe.unprotected,
     };
-    (0, validate_crit_js_1.default)(errors_js_1.JWEInvalid, new Map(), options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
+    (0, validate_crit_js_1.default)(errors_js_1.JWEInvalid, new Map(), options?.crit, parsedProt, joseHeader);
     if (joseHeader.zip !== undefined) {
-        if (!parsedProt || !parsedProt.zip) {
-            throw new errors_js_1.JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
-        }
-        if (joseHeader.zip !== 'DEF') {
-            throw new errors_js_1.JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value');
-        }
+        throw new errors_js_1.JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');
     }
     const { alg, enc } = joseHeader;
     if (typeof alg !== 'string' || !alg) {
@@ -81,11 +74,12 @@ async function flattenedDecrypt(jwe, key, options) {
     const keyManagementAlgorithms = options && (0, validate_algorithms_js_1.default)('keyManagementAlgorithms', options.keyManagementAlgorithms);
     const contentEncryptionAlgorithms = options &&
         (0, validate_algorithms_js_1.default)('contentEncryptionAlgorithms', options.contentEncryptionAlgorithms);
-    if (keyManagementAlgorithms && !keyManagementAlgorithms.has(alg)) {
-        throw new errors_js_1.JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter not allowed');
+    if ((keyManagementAlgorithms && !keyManagementAlgorithms.has(alg)) ||
+        (!keyManagementAlgorithms && alg.startsWith('PBES2'))) {
+        throw new errors_js_1.JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
     }
     if (contentEncryptionAlgorithms && !contentEncryptionAlgorithms.has(enc)) {
-        throw new errors_js_1.JOSEAlgNotAllowed('"enc" (Encryption Algorithm) Header Parameter not allowed');
+        throw new errors_js_1.JOSEAlgNotAllowed('"enc" (Encryption Algorithm) Header Parameter value not allowed');
     }
     let encryptedKey;
     if (jwe.encrypted_key !== undefined) {
@@ -125,7 +119,7 @@ async function flattenedDecrypt(jwe, key, options) {
     catch {
         throw new errors_js_1.JWEInvalid('Failed to base64url decode the tag');
     }
-    const protectedHeader = buffer_utils_js_1.encoder.encode((_a = jwe.protected) !== null && _a !== void 0 ? _a : '');
+    const protectedHeader = buffer_utils_js_1.encoder.encode(jwe.protected ?? '');
     let additionalData;
     if (jwe.aad !== undefined) {
         additionalData = (0, buffer_utils_js_1.concat)(protectedHeader, buffer_utils_js_1.encoder.encode('.'), buffer_utils_js_1.encoder.encode(jwe.aad));
@@ -141,9 +135,6 @@ async function flattenedDecrypt(jwe, key, options) {
         throw new errors_js_1.JWEInvalid('Failed to base64url decode the ciphertext');
     }
     let plaintext = await (0, decrypt_js_1.default)(enc, cek, ciphertext, iv, tag, additionalData);
-    if (joseHeader.zip === 'DEF') {
-        plaintext = await ((options === null || options === void 0 ? void 0 : options.inflateRaw) || zlib_js_1.inflate)(plaintext);
-    }
     const result = { plaintext };
     if (jwe.protected !== undefined) {
         result.protectedHeader = parsedProt;

package/dist/node/cjs/jwe/flattened/encrypt.js

@@ -3,7 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.FlattenedEncrypt = exports.unprotected = void 0;
 const base64url_js_1 = require("../../runtime/base64url.js");
 const encrypt_js_1 = require("../../runtime/encrypt.js");
-const zlib_js_1 = require("../../runtime/zlib.js");
 const iv_js_1 = require("../../lib/iv.js");
 const encrypt_key_management_js_1 = require("../../lib/encrypt_key_management.js");
 const errors_js_1 = require("../../util/errors.js");
@@ -12,6 +11,14 @@ const buffer_utils_js_1 = require("../../lib/buffer_utils.js");
 const validate_crit_js_1 = require("../../lib/validate_crit.js");
 exports.unprotected = Symbol();
 class FlattenedEncrypt {
+    _plaintext;
+    _protectedHeader;
+    _sharedUnprotectedHeader;
+    _unprotectedHeader;
+    _aad;
+    _cek;
+    _iv;
+    _keyManagementParameters;
     constructor(plaintext) {
         if (!(plaintext instanceof Uint8Array)) {
             throw new TypeError('plaintext must be an instance of Uint8Array');
@@ -76,14 +83,9 @@ class FlattenedEncrypt {
             ...this._unprotectedHeader,
             ...this._sharedUnprotectedHeader,
         };
-        (0, validate_crit_js_1.default)(errors_js_1.JWEInvalid, new Map(), options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
+        (0, validate_crit_js_1.default)(errors_js_1.JWEInvalid, new Map(), options?.crit, this._protectedHeader, joseHeader);
         if (joseHeader.zip !== undefined) {
-            if (!this._protectedHeader || !this._protectedHeader.zip) {
-                throw new errors_js_1.JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
-            }
-            if (joseHeader.zip !== 'DEF') {
-                throw new errors_js_1.JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value');
-            }
+            throw new errors_js_1.JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');
         }
         const { alg, enc } = joseHeader;
         if (typeof alg !== 'string' || !alg) {
@@ -126,7 +128,7 @@ class FlattenedEncrypt {
                 }
             }
         }
-        this._iv || (this._iv = (0, iv_js_1.default)(enc));
+        this._iv ||= (0, iv_js_1.default)(enc);
         let additionalData;
         let protectedHeader;
         let aadMember;
@@ -143,16 +145,7 @@ class FlattenedEncrypt {
         else {
             additionalData = protectedHeader;
         }
-        let ciphertext;
-        let tag;
-        if (joseHeader.zip === 'DEF') {
-            const deflated = await ((options === null || options === void 0 ? void 0 : options.deflateRaw) || zlib_js_1.deflate)(this._plaintext);
-            ({ ciphertext, tag } = await (0, encrypt_js_1.default)(enc, deflated, cek, this._iv, additionalData));
-        }
-        else {
-            ;
-            ({ ciphertext, tag } = await (0, encrypt_js_1.default)(enc, this._plaintext, cek, this._iv, additionalData));
-        }
+        const { ciphertext, tag } = await (0, encrypt_js_1.default)(enc, this._plaintext, cek, this._iv, additionalData);
         const jwe = {
             ciphertext: (0, base64url_js_1.encode)(ciphertext),
             iv: (0, base64url_js_1.encode)(this._iv),

package/dist/node/cjs/jwe/general/encrypt.js

@@ -9,6 +9,10 @@ const encrypt_key_management_js_1 = require("../../lib/encrypt_key_management.js
 const base64url_js_1 = require("../../runtime/base64url.js");
 const validate_crit_js_1 = require("../../lib/validate_crit.js");
 class IndividualRecipient {
+    parent;
+    unprotectedHeader;
+    key;
+    options;
     constructor(enc, key, options) {
         this.parent = enc;
         this.key = key;
@@ -32,12 +36,16 @@ class IndividualRecipient {
     }
 }
 class GeneralEncrypt {
+    _plaintext;
+    _recipients = [];
+    _protectedHeader;
+    _unprotectedHeader;
+    _aad;
     constructor(plaintext) {
-        this._recipients = [];
         this._plaintext = plaintext;
     }
     addRecipient(key, options) {
-        const recipient = new IndividualRecipient(this, key, { crit: options === null || options === void 0 ? void 0 : options.crit });
+        const recipient = new IndividualRecipient(this, key, { crit: options?.crit });
         this._recipients.push(recipient);
         return recipient;
     }
@@ -59,12 +67,10 @@ class GeneralEncrypt {
         this._aad = aad;
         return this;
     }
-    async encrypt(options) {
-        var _a, _b, _c;
+    async encrypt() {
         if (!this._recipients.length) {
             throw new errors_js_1.JWEInvalid('at least one recipient must be added');
         }
-        options = { deflateRaw: options === null || options === void 0 ? void 0 : options.deflateRaw };
         if (this._recipients.length === 1) {
             const [recipient] = this._recipients;
             const flattened = await new encrypt_js_1.FlattenedEncrypt(this._plaintext)
@@ -72,7 +78,7 @@ class GeneralEncrypt {
                 .setProtectedHeader(this._protectedHeader)
                 .setSharedUnprotectedHeader(this._unprotectedHeader)
                 .setUnprotectedHeader(recipient.unprotectedHeader)
-                .encrypt(recipient.key, { ...recipient.options, ...options });
+                .encrypt(recipient.key, { ...recipient.options });
             let jwe = {
                 ciphertext: flattened.ciphertext,
                 iv: flattened.iv,
@@ -120,9 +126,7 @@ class GeneralEncrypt {
             }
             (0, validate_crit_js_1.default)(errors_js_1.JWEInvalid, new Map(), recipient.options.crit, this._protectedHeader, joseHeader);
             if (joseHeader.zip !== undefined) {
-                if (!this._protectedHeader || !this._protectedHeader.zip) {
-                    throw new errors_js_1.JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
-                }
+                throw new errors_js_1.JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');
             }
         }
         const cek = (0, cek_js_1.default)(enc);
@@ -152,7 +156,6 @@ class GeneralEncrypt {
                     .setKeyManagementParameters({ p2c })
                     .encrypt(recipient.key, {
                     ...recipient.options,
-                    ...options,
                     [encrypt_js_1.unprotected]: true,
                 });
                 jwe.ciphertext = flattened.ciphertext;
@@ -169,9 +172,9 @@ class GeneralEncrypt {
                     target.header = flattened.header;
                 continue;
             }
-            const { encryptedKey, parameters } = await (0, encrypt_key_management_js_1.default)(((_a = recipient.unprotectedHeader) === null || _a === void 0 ? void 0 : _a.alg) ||
-                ((_b = this._protectedHeader) === null || _b === void 0 ? void 0 : _b.alg) ||
-                ((_c = this._unprotectedHeader) === null || _c === void 0 ? void 0 : _c.alg), enc, recipient.key, cek, { p2c });
+            const { encryptedKey, parameters } = await (0, encrypt_key_management_js_1.default)(recipient.unprotectedHeader?.alg ||
+                this._protectedHeader?.alg ||
+                this._unprotectedHeader?.alg, enc, recipient.key, cek, { p2c });
             target.encrypted_key = (0, base64url_js_1.encode)(encryptedKey);
             if (recipient.unprotectedHeader || parameters)
                 target.header = { ...recipient.unprotectedHeader, ...parameters };

package/dist/node/cjs/jwk/embedded.js

@@ -7,12 +7,12 @@ const errors_js_1 = require("../util/errors.js");
 async function EmbeddedJWK(protectedHeader, token) {
     const joseHeader = {
         ...protectedHeader,
-        ...token === null || token === void 0 ? void 0 : token.header,
+        ...token?.header,
     };
     if (!(0, is_object_js_1.default)(joseHeader.jwk)) {
         throw new errors_js_1.JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');
     }
-    const key = await (0, import_js_1.importJWK)({ ...joseHeader.jwk, ext: true }, joseHeader.alg, true);
+    const key = await (0, import_js_1.importJWK)({ ...joseHeader.jwk, ext: true }, joseHeader.alg);
     if (key instanceof Uint8Array || key.type !== 'public') {
         throw new errors_js_1.JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
     }

package/dist/node/cjs/jwk/thumbprint.js

@@ -15,7 +15,7 @@ async function calculateJwkThumbprint(jwk, digestAlgorithm) {
     if (!(0, is_object_js_1.default)(jwk)) {
         throw new TypeError('JWK must be an object');
     }
-    digestAlgorithm !== null && digestAlgorithm !== void 0 ? digestAlgorithm : (digestAlgorithm = 'sha256');
+    digestAlgorithm ??= 'sha256';
     if (digestAlgorithm !== 'sha256' &&
         digestAlgorithm !== 'sha384' &&
         digestAlgorithm !== 'sha512') {
@@ -51,7 +51,7 @@ async function calculateJwkThumbprint(jwk, digestAlgorithm) {
 }
 exports.calculateJwkThumbprint = calculateJwkThumbprint;
 async function calculateJwkThumbprintUri(jwk, digestAlgorithm) {
-    digestAlgorithm !== null && digestAlgorithm !== void 0 ? digestAlgorithm : (digestAlgorithm = 'sha256');
+    digestAlgorithm ??= 'sha256';
     const thumbprint = await calculateJwkThumbprint(jwk, digestAlgorithm);
     return `urn:ietf:params:oauth:jwk-thumbprint:sha-${digestAlgorithm.slice(-3)}:${thumbprint}`;
 }

package/dist/node/cjs/jwks/local.js

@@ -34,15 +34,16 @@ function clone(obj) {
     return JSON.parse(JSON.stringify(obj));
 }
 class LocalJWKSet {
+    _jwks;
+    _cached = new WeakMap();
     constructor(jwks) {
-        this._cached = new WeakMap();
         if (!isJWKSLike(jwks)) {
             throw new errors_js_1.JWKSInvalid('JSON Web Key Set malformed');
         }
         this._jwks = clone(jwks);
     }
     async getKey(protectedHeader, token) {
-        const { alg, kid } = { ...protectedHeader, ...token === null || token === void 0 ? void 0 : token.header };
+        const { alg, kid } = { ...protectedHeader, ...token?.header };
         const kty = getKtyFromAlg(alg);
         const candidates = this._jwks.keys.filter((jwk) => {
             let candidate = kty === jwk.kty;

package/dist/node/cjs/jwks/remote.js

@@ -10,6 +10,13 @@ function isCloudflareWorkers() {
         (typeof EdgeRuntime !== 'undefined' && EdgeRuntime === 'vercel'));
 }
 class RemoteJWKSet extends local_js_1.LocalJWKSet {
+    _url;
+    _timeoutDuration;
+    _cooldownDuration;
+    _cacheMaxAge;
+    _jwksTimestamp;
+    _pendingFetch;
+    _options;
     constructor(url, options) {
         super({ keys: [] });
         this._jwks = undefined;
@@ -17,12 +24,12 @@ class RemoteJWKSet extends local_js_1.LocalJWKSet {
             throw new TypeError('url must be an instance of URL');
         }
         this._url = new URL(url.href);
-        this._options = { agent: options === null || options === void 0 ? void 0 : options.agent, headers: options === null || options === void 0 ? void 0 : options.headers };
+        this._options = { agent: options?.agent, headers: options?.headers };
         this._timeoutDuration =
-            typeof (options === null || options === void 0 ? void 0 : options.timeoutDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.timeoutDuration : 5000;
+            typeof options?.timeoutDuration === 'number' ? options?.timeoutDuration : 5000;
         this._cooldownDuration =
-            typeof (options === null || options === void 0 ? void 0 : options.cooldownDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.cooldownDuration : 30000;
-        this._cacheMaxAge = typeof (options === null || options === void 0 ? void 0 : options.cacheMaxAge) === 'number' ? options === null || options === void 0 ? void 0 : options.cacheMaxAge : 600000;
+            typeof options?.cooldownDuration === 'number' ? options?.cooldownDuration : 30000;
+        this._cacheMaxAge = typeof options?.cacheMaxAge === 'number' ? options?.cacheMaxAge : 600000;
     }
     coolingDown() {
         return typeof this._jwksTimestamp === 'number'
@@ -55,7 +62,7 @@ class RemoteJWKSet extends local_js_1.LocalJWKSet {
         if (this._pendingFetch && isCloudflareWorkers()) {
             this._pendingFetch = undefined;
         }
-        this._pendingFetch || (this._pendingFetch = (0, fetch_jwks_js_1.default)(this._url, this._timeoutDuration, this._options)
+        this._pendingFetch ||= (0, fetch_jwks_js_1.default)(this._url, this._timeoutDuration, this._options)
             .then((json) => {
             if (!(0, local_js_1.isJWKSLike)(json)) {
                 throw new errors_js_1.JWKSInvalid('JSON Web Key Set malformed');
@@ -67,7 +74,7 @@ class RemoteJWKSet extends local_js_1.LocalJWKSet {
             .catch((err) => {
             this._pendingFetch = undefined;
             throw err;
-        }));
+        });
         await this._pendingFetch;
     }
 }

package/dist/node/cjs/jws/compact/sign.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.CompactSign = void 0;
 const sign_js_1 = require("../flattened/sign.js");
 class CompactSign {
+    _flattened;
     constructor(payload) {
         this._flattened = new sign_js_1.FlattenedSign(payload);
     }

package/dist/node/cjs/jws/flattened/sign.js

@@ -9,6 +9,9 @@ const buffer_utils_js_1 = require("../../lib/buffer_utils.js");
 const check_key_type_js_1 = require("../../lib/check_key_type.js");
 const validate_crit_js_1 = require("../../lib/validate_crit.js");
 class FlattenedSign {
+    _payload;
+    _protectedHeader;
+    _unprotectedHeader;
     constructor(payload) {
         if (!(payload instanceof Uint8Array)) {
             throw new TypeError('payload must be an instance of Uint8Array');
@@ -40,7 +43,7 @@ class FlattenedSign {
             ...this._protectedHeader,
             ...this._unprotectedHeader,
         };
-        const extensions = (0, validate_crit_js_1.default)(errors_js_1.JWSInvalid, new Map([['b64', true]]), options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
+        const extensions = (0, validate_crit_js_1.default)(errors_js_1.JWSInvalid, new Map([['b64', true]]), options?.crit, this._protectedHeader, joseHeader);
         let b64 = true;
         if (extensions.has('b64')) {
             b64 = this._protectedHeader.b64;

package/dist/node/cjs/jws/flattened/verify.js

@@ -11,7 +11,6 @@ const check_key_type_js_1 = require("../../lib/check_key_type.js");
 const validate_crit_js_1 = require("../../lib/validate_crit.js");
 const validate_algorithms_js_1 = require("../../lib/validate_algorithms.js");
 async function flattenedVerify(jws, key, options) {
-    var _a;
     if (!(0, is_object_js_1.default)(jws)) {
         throw new errors_js_1.JWSInvalid('Flattened JWS must be an object');
     }
@@ -47,7 +46,7 @@ async function flattenedVerify(jws, key, options) {
         ...parsedProt,
         ...jws.header,
     };
-    const extensions = (0, validate_crit_js_1.default)(errors_js_1.JWSInvalid, new Map([['b64', true]]), options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
+    const extensions = (0, validate_crit_js_1.default)(errors_js_1.JWSInvalid, new Map([['b64', true]]), options?.crit, parsedProt, joseHeader);
     let b64 = true;
     if (extensions.has('b64')) {
         b64 = parsedProt.b64;
@@ -61,7 +60,7 @@ async function flattenedVerify(jws, key, options) {
     }
     const algorithms = options && (0, validate_algorithms_js_1.default)('algorithms', options.algorithms);
     if (algorithms && !algorithms.has(alg)) {
-        throw new errors_js_1.JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter not allowed');
+        throw new errors_js_1.JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
     }
     if (b64) {
         if (typeof jws.payload !== 'string') {
@@ -77,7 +76,7 @@ async function flattenedVerify(jws, key, options) {
         resolvedKey = true;
     }
     (0, check_key_type_js_1.default)(alg, key, 'verify');
-    const data = (0, buffer_utils_js_1.concat)(buffer_utils_js_1.encoder.encode((_a = jws.protected) !== null && _a !== void 0 ? _a : ''), buffer_utils_js_1.encoder.encode('.'), typeof jws.payload === 'string' ? buffer_utils_js_1.encoder.encode(jws.payload) : jws.payload);
+    const data = (0, buffer_utils_js_1.concat)(buffer_utils_js_1.encoder.encode(jws.protected ?? ''), buffer_utils_js_1.encoder.encode('.'), typeof jws.payload === 'string' ? buffer_utils_js_1.encoder.encode(jws.payload) : jws.payload);
     let signature;
     try {
         signature = (0, base64url_js_1.decode)(jws.signature);

package/dist/node/cjs/jws/general/sign.js

@@ -4,6 +4,11 @@ exports.GeneralSign = void 0;
 const sign_js_1 = require("../flattened/sign.js");
 const errors_js_1 = require("../../util/errors.js");
 class IndividualSignature {
+    parent;
+    protectedHeader;
+    unprotectedHeader;
+    options;
+    key;
     constructor(sig, key, options) {
         this.parent = sig;
         this.key = key;
@@ -34,8 +39,9 @@ class IndividualSignature {
     }
 }
 class GeneralSign {
+    _payload;
+    _signatures = [];
     constructor(payload) {
-        this._signatures = [];
         this._payload = payload;
     }
     addSignature(key, options) {

package/dist/node/cjs/jwt/encrypt.js

@@ -5,6 +5,13 @@ const encrypt_js_1 = require("../jwe/compact/encrypt.js");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
 const produce_js_1 = require("./produce.js");
 class EncryptJWT extends produce_js_1.ProduceJWT {
+    _cek;
+    _iv;
+    _keyManagementParameters;
+    _protectedHeader;
+    _replicateIssuerAsHeader;
+    _replicateSubjectAsHeader;
+    _replicateAudienceAsHeader;
     setProtectedHeader(protectedHeader) {
         if (this._protectedHeader) {
             throw new TypeError('setProtectedHeader can only be called once');