jose 4.15.4 → 5.0.1

package/dist/node/cjs/util/errors.js

@@ -5,12 +5,11 @@ class JOSEError extends Error {
     static get code() {
         return 'ERR_JOSE_GENERIC';
     }
+    code = 'ERR_JOSE_GENERIC';
     constructor(message) {
-        var _a;
         super(message);
-        this.code = 'ERR_JOSE_GENERIC';
         this.name = this.constructor.name;
-        (_a = Error.captureStackTrace) === null || _a === void 0 ? void 0 : _a.call(Error, this, this.constructor);
+        Error.captureStackTrace?.(this, this.constructor);
     }
 }
 exports.JOSEError = JOSEError;
@@ -18,9 +17,11 @@ class JWTClaimValidationFailed extends JOSEError {
     static get code() {
         return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
     }
+    code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
+    claim;
+    reason;
     constructor(message, claim = 'unspecified', reason = 'unspecified') {
         super(message);
-        this.code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
         this.claim = claim;
         this.reason = reason;
     }
@@ -30,137 +31,103 @@ class JWTExpired extends JOSEError {
     static get code() {
         return 'ERR_JWT_EXPIRED';
     }
+    code = 'ERR_JWT_EXPIRED';
+    claim;
+    reason;
     constructor(message, claim = 'unspecified', reason = 'unspecified') {
         super(message);
-        this.code = 'ERR_JWT_EXPIRED';
         this.claim = claim;
         this.reason = reason;
     }
 }
 exports.JWTExpired = JWTExpired;
 class JOSEAlgNotAllowed extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JOSE_ALG_NOT_ALLOWED';
-    }
     static get code() {
         return 'ERR_JOSE_ALG_NOT_ALLOWED';
     }
+    code = 'ERR_JOSE_ALG_NOT_ALLOWED';
 }
 exports.JOSEAlgNotAllowed = JOSEAlgNotAllowed;
 class JOSENotSupported extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JOSE_NOT_SUPPORTED';
-    }
     static get code() {
         return 'ERR_JOSE_NOT_SUPPORTED';
     }
+    code = 'ERR_JOSE_NOT_SUPPORTED';
 }
 exports.JOSENotSupported = JOSENotSupported;
 class JWEDecryptionFailed extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWE_DECRYPTION_FAILED';
-        this.message = 'decryption operation failed';
-    }
     static get code() {
         return 'ERR_JWE_DECRYPTION_FAILED';
     }
+    code = 'ERR_JWE_DECRYPTION_FAILED';
+    message = 'decryption operation failed';
 }
 exports.JWEDecryptionFailed = JWEDecryptionFailed;
 class JWEInvalid extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWE_INVALID';
-    }
     static get code() {
         return 'ERR_JWE_INVALID';
     }
+    code = 'ERR_JWE_INVALID';
 }
 exports.JWEInvalid = JWEInvalid;
 class JWSInvalid extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWS_INVALID';
-    }
     static get code() {
         return 'ERR_JWS_INVALID';
     }
+    code = 'ERR_JWS_INVALID';
 }
 exports.JWSInvalid = JWSInvalid;
 class JWTInvalid extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWT_INVALID';
-    }
     static get code() {
         return 'ERR_JWT_INVALID';
     }
+    code = 'ERR_JWT_INVALID';
 }
 exports.JWTInvalid = JWTInvalid;
 class JWKInvalid extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWK_INVALID';
-    }
     static get code() {
         return 'ERR_JWK_INVALID';
     }
+    code = 'ERR_JWK_INVALID';
 }
 exports.JWKInvalid = JWKInvalid;
 class JWKSInvalid extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWKS_INVALID';
-    }
     static get code() {
         return 'ERR_JWKS_INVALID';
     }
+    code = 'ERR_JWKS_INVALID';
 }
 exports.JWKSInvalid = JWKSInvalid;
 class JWKSNoMatchingKey extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWKS_NO_MATCHING_KEY';
-        this.message = 'no applicable key found in the JSON Web Key Set';
-    }
     static get code() {
         return 'ERR_JWKS_NO_MATCHING_KEY';
     }
+    code = 'ERR_JWKS_NO_MATCHING_KEY';
+    message = 'no applicable key found in the JSON Web Key Set';
 }
 exports.JWKSNoMatchingKey = JWKSNoMatchingKey;
 class JWKSMultipleMatchingKeys extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
-        this.message = 'multiple matching keys found in the JSON Web Key Set';
-    }
+    [Symbol.asyncIterator];
     static get code() {
         return 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
     }
+    code = 'ERR_JWKS_MULTIPLE_MATCHING_KEYS';
+    message = 'multiple matching keys found in the JSON Web Key Set';
 }
 exports.JWKSMultipleMatchingKeys = JWKSMultipleMatchingKeys;
-Symbol.asyncIterator;
 class JWKSTimeout extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWKS_TIMEOUT';
-        this.message = 'request timed out';
-    }
     static get code() {
         return 'ERR_JWKS_TIMEOUT';
     }
+    code = 'ERR_JWKS_TIMEOUT';
+    message = 'request timed out';
 }
 exports.JWKSTimeout = JWKSTimeout;
 class JWSSignatureVerificationFailed extends JOSEError {
-    constructor() {
-        super(...arguments);
-        this.code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
-        this.message = 'signature verification failed';
-    }
     static get code() {
         return 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
     }
+    code = 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED';
+    message = 'signature verification failed';
 }
 exports.JWSSignatureVerificationFailed = JWSSignatureVerificationFailed;

package/dist/node/esm/jwe/compact/encrypt.js

@@ -1,5 +1,6 @@
 import { FlattenedEncrypt } from '../flattened/encrypt.js';
 export class CompactEncrypt {
+    _flattened;
     constructor(plaintext) {
         this._flattened = new FlattenedEncrypt(plaintext);
     }

package/dist/node/esm/jwe/flattened/decrypt.js

@@ -1,6 +1,5 @@
 import { decode as base64url } from '../../runtime/base64url.js';
 import decrypt from '../../runtime/decrypt.js';
-import { inflate } from '../../runtime/zlib.js';
 import { JOSEAlgNotAllowed, JOSENotSupported, JWEInvalid } from '../../util/errors.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import isObject from '../../lib/is_object.js';
@@ -10,7 +9,6 @@ import generateCek from '../../lib/cek.js';
 import validateCrit from '../../lib/validate_crit.js';
 import validateAlgorithms from '../../lib/validate_algorithms.js';
 export async function flattenedDecrypt(jwe, key, options) {
-    var _a;
     if (!isObject(jwe)) {
         throw new JWEInvalid('Flattened JWE must be an object');
     }
@@ -59,14 +57,9 @@ export async function flattenedDecrypt(jwe, key, options) {
         ...jwe.header,
         ...jwe.unprotected,
     };
-    validateCrit(JWEInvalid, new Map(), options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
+    validateCrit(JWEInvalid, new Map(), options?.crit, parsedProt, joseHeader);
     if (joseHeader.zip !== undefined) {
-        if (!parsedProt || !parsedProt.zip) {
-            throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
-        }
-        if (joseHeader.zip !== 'DEF') {
-            throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value');
-        }
+        throw new JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');
     }
     const { alg, enc } = joseHeader;
     if (typeof alg !== 'string' || !alg) {
@@ -78,11 +71,12 @@ export async function flattenedDecrypt(jwe, key, options) {
     const keyManagementAlgorithms = options && validateAlgorithms('keyManagementAlgorithms', options.keyManagementAlgorithms);
     const contentEncryptionAlgorithms = options &&
         validateAlgorithms('contentEncryptionAlgorithms', options.contentEncryptionAlgorithms);
-    if (keyManagementAlgorithms && !keyManagementAlgorithms.has(alg)) {
-        throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter not allowed');
+    if ((keyManagementAlgorithms && !keyManagementAlgorithms.has(alg)) ||
+        (!keyManagementAlgorithms && alg.startsWith('PBES2'))) {
+        throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
     }
     if (contentEncryptionAlgorithms && !contentEncryptionAlgorithms.has(enc)) {
-        throw new JOSEAlgNotAllowed('"enc" (Encryption Algorithm) Header Parameter not allowed');
+        throw new JOSEAlgNotAllowed('"enc" (Encryption Algorithm) Header Parameter value not allowed');
     }
     let encryptedKey;
     if (jwe.encrypted_key !== undefined) {
@@ -122,7 +116,7 @@ export async function flattenedDecrypt(jwe, key, options) {
     catch {
         throw new JWEInvalid('Failed to base64url decode the tag');
     }
-    const protectedHeader = encoder.encode((_a = jwe.protected) !== null && _a !== void 0 ? _a : '');
+    const protectedHeader = encoder.encode(jwe.protected ?? '');
     let additionalData;
     if (jwe.aad !== undefined) {
         additionalData = concat(protectedHeader, encoder.encode('.'), encoder.encode(jwe.aad));
@@ -138,9 +132,6 @@ export async function flattenedDecrypt(jwe, key, options) {
         throw new JWEInvalid('Failed to base64url decode the ciphertext');
     }
     let plaintext = await decrypt(enc, cek, ciphertext, iv, tag, additionalData);
-    if (joseHeader.zip === 'DEF') {
-        plaintext = await ((options === null || options === void 0 ? void 0 : options.inflateRaw) || inflate)(plaintext);
-    }
     const result = { plaintext };
     if (jwe.protected !== undefined) {
         result.protectedHeader = parsedProt;

package/dist/node/esm/jwe/flattened/encrypt.js

@@ -1,6 +1,5 @@
 import { encode as base64url } from '../../runtime/base64url.js';
 import encrypt from '../../runtime/encrypt.js';
-import { deflate } from '../../runtime/zlib.js';
 import generateIv from '../../lib/iv.js';
 import encryptKeyManagement from '../../lib/encrypt_key_management.js';
 import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
@@ -9,6 +8,14 @@ import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
 import validateCrit from '../../lib/validate_crit.js';
 export const unprotected = Symbol();
 export class FlattenedEncrypt {
+    _plaintext;
+    _protectedHeader;
+    _sharedUnprotectedHeader;
+    _unprotectedHeader;
+    _aad;
+    _cek;
+    _iv;
+    _keyManagementParameters;
     constructor(plaintext) {
         if (!(plaintext instanceof Uint8Array)) {
             throw new TypeError('plaintext must be an instance of Uint8Array');
@@ -73,14 +80,9 @@ export class FlattenedEncrypt {
             ...this._unprotectedHeader,
             ...this._sharedUnprotectedHeader,
         };
-        validateCrit(JWEInvalid, new Map(), options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
+        validateCrit(JWEInvalid, new Map(), options?.crit, this._protectedHeader, joseHeader);
         if (joseHeader.zip !== undefined) {
-            if (!this._protectedHeader || !this._protectedHeader.zip) {
-                throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
-            }
-            if (joseHeader.zip !== 'DEF') {
-                throw new JOSENotSupported('Unsupported JWE "zip" (Compression Algorithm) Header Parameter value');
-            }
+            throw new JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');
         }
         const { alg, enc } = joseHeader;
         if (typeof alg !== 'string' || !alg) {
@@ -123,7 +125,7 @@ export class FlattenedEncrypt {
                 }
             }
         }
-        this._iv || (this._iv = generateIv(enc));
+        this._iv ||= generateIv(enc);
         let additionalData;
         let protectedHeader;
         let aadMember;
@@ -140,16 +142,7 @@ export class FlattenedEncrypt {
         else {
             additionalData = protectedHeader;
         }
-        let ciphertext;
-        let tag;
-        if (joseHeader.zip === 'DEF') {
-            const deflated = await ((options === null || options === void 0 ? void 0 : options.deflateRaw) || deflate)(this._plaintext);
-            ({ ciphertext, tag } = await encrypt(enc, deflated, cek, this._iv, additionalData));
-        }
-        else {
-            ;
-            ({ ciphertext, tag } = await encrypt(enc, this._plaintext, cek, this._iv, additionalData));
-        }
+        const { ciphertext, tag } = await encrypt(enc, this._plaintext, cek, this._iv, additionalData);
         const jwe = {
             ciphertext: base64url(ciphertext),
             iv: base64url(this._iv),

package/dist/node/esm/jwe/general/encrypt.js

@@ -1,11 +1,15 @@
 import { FlattenedEncrypt, unprotected } from '../flattened/encrypt.js';
-import { JWEInvalid } from '../../util/errors.js';
+import { JOSENotSupported, JWEInvalid } from '../../util/errors.js';
 import generateCek from '../../lib/cek.js';
 import isDisjoint from '../../lib/is_disjoint.js';
 import encryptKeyManagement from '../../lib/encrypt_key_management.js';
 import { encode as base64url } from '../../runtime/base64url.js';
 import validateCrit from '../../lib/validate_crit.js';
 class IndividualRecipient {
+    parent;
+    unprotectedHeader;
+    key;
+    options;
     constructor(enc, key, options) {
         this.parent = enc;
         this.key = key;
@@ -29,12 +33,16 @@ class IndividualRecipient {
     }
 }
 export class GeneralEncrypt {
+    _plaintext;
+    _recipients = [];
+    _protectedHeader;
+    _unprotectedHeader;
+    _aad;
     constructor(plaintext) {
-        this._recipients = [];
         this._plaintext = plaintext;
     }
     addRecipient(key, options) {
-        const recipient = new IndividualRecipient(this, key, { crit: options === null || options === void 0 ? void 0 : options.crit });
+        const recipient = new IndividualRecipient(this, key, { crit: options?.crit });
         this._recipients.push(recipient);
         return recipient;
     }
@@ -56,12 +64,10 @@ export class GeneralEncrypt {
         this._aad = aad;
         return this;
     }
-    async encrypt(options) {
-        var _a, _b, _c;
+    async encrypt() {
         if (!this._recipients.length) {
             throw new JWEInvalid('at least one recipient must be added');
         }
-        options = { deflateRaw: options === null || options === void 0 ? void 0 : options.deflateRaw };
         if (this._recipients.length === 1) {
             const [recipient] = this._recipients;
             const flattened = await new FlattenedEncrypt(this._plaintext)
@@ -69,7 +75,7 @@ export class GeneralEncrypt {
                 .setProtectedHeader(this._protectedHeader)
                 .setSharedUnprotectedHeader(this._unprotectedHeader)
                 .setUnprotectedHeader(recipient.unprotectedHeader)
-                .encrypt(recipient.key, { ...recipient.options, ...options });
+                .encrypt(recipient.key, { ...recipient.options });
             let jwe = {
                 ciphertext: flattened.ciphertext,
                 iv: flattened.iv,
@@ -117,9 +123,7 @@ export class GeneralEncrypt {
             }
             validateCrit(JWEInvalid, new Map(), recipient.options.crit, this._protectedHeader, joseHeader);
             if (joseHeader.zip !== undefined) {
-                if (!this._protectedHeader || !this._protectedHeader.zip) {
-                    throw new JWEInvalid('JWE "zip" (Compression Algorithm) Header MUST be integrity protected');
-                }
+                throw new JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');
             }
         }
         const cek = generateCek(enc);
@@ -149,7 +153,6 @@ export class GeneralEncrypt {
                     .setKeyManagementParameters({ p2c })
                     .encrypt(recipient.key, {
                     ...recipient.options,
-                    ...options,
                     [unprotected]: true,
                 });
                 jwe.ciphertext = flattened.ciphertext;
@@ -166,9 +169,9 @@ export class GeneralEncrypt {
                     target.header = flattened.header;
                 continue;
             }
-            const { encryptedKey, parameters } = await encryptKeyManagement(((_a = recipient.unprotectedHeader) === null || _a === void 0 ? void 0 : _a.alg) ||
-                ((_b = this._protectedHeader) === null || _b === void 0 ? void 0 : _b.alg) ||
-                ((_c = this._unprotectedHeader) === null || _c === void 0 ? void 0 : _c.alg), enc, recipient.key, cek, { p2c });
+            const { encryptedKey, parameters } = await encryptKeyManagement(recipient.unprotectedHeader?.alg ||
+                this._protectedHeader?.alg ||
+                this._unprotectedHeader?.alg, enc, recipient.key, cek, { p2c });
             target.encrypted_key = base64url(encryptedKey);
             if (recipient.unprotectedHeader || parameters)
                 target.header = { ...recipient.unprotectedHeader, ...parameters };

package/dist/node/esm/jwk/embedded.js

@@ -4,12 +4,12 @@ import { JWSInvalid } from '../util/errors.js';
 export async function EmbeddedJWK(protectedHeader, token) {
     const joseHeader = {
         ...protectedHeader,
-        ...token === null || token === void 0 ? void 0 : token.header,
+        ...token?.header,
     };
     if (!isObject(joseHeader.jwk)) {
         throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');
     }
-    const key = await importJWK({ ...joseHeader.jwk, ext: true }, joseHeader.alg, true);
+    const key = await importJWK({ ...joseHeader.jwk, ext: true }, joseHeader.alg);
     if (key instanceof Uint8Array || key.type !== 'public') {
         throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
     }

package/dist/node/esm/jwk/thumbprint.js

@@ -12,7 +12,7 @@ export async function calculateJwkThumbprint(jwk, digestAlgorithm) {
     if (!isObject(jwk)) {
         throw new TypeError('JWK must be an object');
     }
-    digestAlgorithm !== null && digestAlgorithm !== void 0 ? digestAlgorithm : (digestAlgorithm = 'sha256');
+    digestAlgorithm ??= 'sha256';
     if (digestAlgorithm !== 'sha256' &&
         digestAlgorithm !== 'sha384' &&
         digestAlgorithm !== 'sha512') {
@@ -47,7 +47,7 @@ export async function calculateJwkThumbprint(jwk, digestAlgorithm) {
     return base64url(await digest(digestAlgorithm, data));
 }
 export async function calculateJwkThumbprintUri(jwk, digestAlgorithm) {
-    digestAlgorithm !== null && digestAlgorithm !== void 0 ? digestAlgorithm : (digestAlgorithm = 'sha256');
+    digestAlgorithm ??= 'sha256';
     const thumbprint = await calculateJwkThumbprint(jwk, digestAlgorithm);
     return `urn:ietf:params:oauth:jwk-thumbprint:sha-${digestAlgorithm.slice(-3)}:${thumbprint}`;
 }

package/dist/node/esm/jwks/local.js

@@ -30,15 +30,16 @@ function clone(obj) {
     return JSON.parse(JSON.stringify(obj));
 }
 export class LocalJWKSet {
+    _jwks;
+    _cached = new WeakMap();
     constructor(jwks) {
-        this._cached = new WeakMap();
         if (!isJWKSLike(jwks)) {
             throw new JWKSInvalid('JSON Web Key Set malformed');
         }
         this._jwks = clone(jwks);
     }
     async getKey(protectedHeader, token) {
-        const { alg, kid } = { ...protectedHeader, ...token === null || token === void 0 ? void 0 : token.header };
+        const { alg, kid } = { ...protectedHeader, ...token?.header };
         const kty = getKtyFromAlg(alg);
         const candidates = this._jwks.keys.filter((jwk) => {
             let candidate = kty === jwk.kty;

package/dist/node/esm/jwks/remote.js

@@ -7,6 +7,13 @@ function isCloudflareWorkers() {
         (typeof EdgeRuntime !== 'undefined' && EdgeRuntime === 'vercel'));
 }
 class RemoteJWKSet extends LocalJWKSet {
+    _url;
+    _timeoutDuration;
+    _cooldownDuration;
+    _cacheMaxAge;
+    _jwksTimestamp;
+    _pendingFetch;
+    _options;
     constructor(url, options) {
         super({ keys: [] });
         this._jwks = undefined;
@@ -14,12 +21,12 @@ class RemoteJWKSet extends LocalJWKSet {
             throw new TypeError('url must be an instance of URL');
         }
         this._url = new URL(url.href);
-        this._options = { agent: options === null || options === void 0 ? void 0 : options.agent, headers: options === null || options === void 0 ? void 0 : options.headers };
+        this._options = { agent: options?.agent, headers: options?.headers };
         this._timeoutDuration =
-            typeof (options === null || options === void 0 ? void 0 : options.timeoutDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.timeoutDuration : 5000;
+            typeof options?.timeoutDuration === 'number' ? options?.timeoutDuration : 5000;
         this._cooldownDuration =
-            typeof (options === null || options === void 0 ? void 0 : options.cooldownDuration) === 'number' ? options === null || options === void 0 ? void 0 : options.cooldownDuration : 30000;
-        this._cacheMaxAge = typeof (options === null || options === void 0 ? void 0 : options.cacheMaxAge) === 'number' ? options === null || options === void 0 ? void 0 : options.cacheMaxAge : 600000;
+            typeof options?.cooldownDuration === 'number' ? options?.cooldownDuration : 30000;
+        this._cacheMaxAge = typeof options?.cacheMaxAge === 'number' ? options?.cacheMaxAge : 600000;
     }
     coolingDown() {
         return typeof this._jwksTimestamp === 'number'
@@ -52,7 +59,7 @@ class RemoteJWKSet extends LocalJWKSet {
         if (this._pendingFetch && isCloudflareWorkers()) {
             this._pendingFetch = undefined;
         }
-        this._pendingFetch || (this._pendingFetch = fetchJwks(this._url, this._timeoutDuration, this._options)
+        this._pendingFetch ||= fetchJwks(this._url, this._timeoutDuration, this._options)
             .then((json) => {
             if (!isJWKSLike(json)) {
                 throw new JWKSInvalid('JSON Web Key Set malformed');
@@ -64,7 +71,7 @@ class RemoteJWKSet extends LocalJWKSet {
             .catch((err) => {
             this._pendingFetch = undefined;
             throw err;
-        }));
+        });
         await this._pendingFetch;
     }
 }

package/dist/node/esm/jws/compact/sign.js

@@ -1,5 +1,6 @@
 import { FlattenedSign } from '../flattened/sign.js';
 export class CompactSign {
+    _flattened;
     constructor(payload) {
         this._flattened = new FlattenedSign(payload);
     }

package/dist/node/esm/jws/flattened/sign.js

@@ -6,6 +6,9 @@ import { encoder, decoder, concat } from '../../lib/buffer_utils.js';
 import checkKeyType from '../../lib/check_key_type.js';
 import validateCrit from '../../lib/validate_crit.js';
 export class FlattenedSign {
+    _payload;
+    _protectedHeader;
+    _unprotectedHeader;
     constructor(payload) {
         if (!(payload instanceof Uint8Array)) {
             throw new TypeError('payload must be an instance of Uint8Array');
@@ -37,7 +40,7 @@ export class FlattenedSign {
             ...this._protectedHeader,
             ...this._unprotectedHeader,
         };
-        const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options === null || options === void 0 ? void 0 : options.crit, this._protectedHeader, joseHeader);
+        const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options?.crit, this._protectedHeader, joseHeader);
         let b64 = true;
         if (extensions.has('b64')) {
             b64 = this._protectedHeader.b64;

package/dist/node/esm/jws/flattened/verify.js

@@ -8,7 +8,6 @@ import checkKeyType from '../../lib/check_key_type.js';
 import validateCrit from '../../lib/validate_crit.js';
 import validateAlgorithms from '../../lib/validate_algorithms.js';
 export async function flattenedVerify(jws, key, options) {
-    var _a;
     if (!isObject(jws)) {
         throw new JWSInvalid('Flattened JWS must be an object');
     }
@@ -44,7 +43,7 @@ export async function flattenedVerify(jws, key, options) {
         ...parsedProt,
         ...jws.header,
     };
-    const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options === null || options === void 0 ? void 0 : options.crit, parsedProt, joseHeader);
+    const extensions = validateCrit(JWSInvalid, new Map([['b64', true]]), options?.crit, parsedProt, joseHeader);
     let b64 = true;
     if (extensions.has('b64')) {
         b64 = parsedProt.b64;
@@ -58,7 +57,7 @@ export async function flattenedVerify(jws, key, options) {
     }
     const algorithms = options && validateAlgorithms('algorithms', options.algorithms);
     if (algorithms && !algorithms.has(alg)) {
-        throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter not allowed');
+        throw new JOSEAlgNotAllowed('"alg" (Algorithm) Header Parameter value not allowed');
     }
     if (b64) {
         if (typeof jws.payload !== 'string') {
@@ -74,7 +73,7 @@ export async function flattenedVerify(jws, key, options) {
         resolvedKey = true;
     }
     checkKeyType(alg, key, 'verify');
-    const data = concat(encoder.encode((_a = jws.protected) !== null && _a !== void 0 ? _a : ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);
+    const data = concat(encoder.encode(jws.protected ?? ''), encoder.encode('.'), typeof jws.payload === 'string' ? encoder.encode(jws.payload) : jws.payload);
     let signature;
     try {
         signature = base64url(jws.signature);

package/dist/node/esm/jws/general/sign.js

@@ -1,6 +1,11 @@
 import { FlattenedSign } from '../flattened/sign.js';
 import { JWSInvalid } from '../../util/errors.js';
 class IndividualSignature {
+    parent;
+    protectedHeader;
+    unprotectedHeader;
+    options;
+    key;
     constructor(sig, key, options) {
         this.parent = sig;
         this.key = key;
@@ -31,8 +36,9 @@ class IndividualSignature {
     }
 }
 export class GeneralSign {
+    _payload;
+    _signatures = [];
     constructor(payload) {
-        this._signatures = [];
         this._payload = payload;
     }
     addSignature(key, options) {

package/dist/node/esm/jwt/encrypt.js

@@ -2,6 +2,13 @@ import { CompactEncrypt } from '../jwe/compact/encrypt.js';
 import { encoder } from '../lib/buffer_utils.js';
 import { ProduceJWT } from './produce.js';
 export class EncryptJWT extends ProduceJWT {
+    _cek;
+    _iv;
+    _keyManagementParameters;
+    _protectedHeader;
+    _replicateIssuerAsHeader;
+    _replicateSubjectAsHeader;
+    _replicateAudienceAsHeader;
     setProtectedHeader(protectedHeader) {
         if (this._protectedHeader) {
             throw new TypeError('setProtectedHeader can only be called once');