jose 4.3.8 → 4.5.1

package/README.md

@@ -42,10 +42,10 @@ import * as jose from 'https://deno.land/x/jose/index.ts'
 
 - JSON Web Tokens (JWT)
   - [Signing](docs/classes/jwt_sign.SignJWT.md#readme)
-  - [Verification & Claims Set Validation](docs/functions/jwt_verify.jwtVerify.md#readme)
+  - [Verification & JWT Claims Set Validation](docs/functions/jwt_verify.jwtVerify.md#readme)
   - Encrypted JSON Web Tokens
     - [Encryption](docs/classes/jwt_encrypt.EncryptJWT.md#readme)
-    - [Decryption & Claims Set Validation](docs/functions/jwt_decrypt.jwtDecrypt.md#readme)
+    - [Decryption & JWT Claims Set Validation](docs/functions/jwt_decrypt.jwtDecrypt.md#readme)
 - Key Import
   - [JWK Import](docs/functions/key_import.importJWK.md#readme)
   - [Public Key Import (SPKI)](docs/functions/key_import.importSPKI.md#readme)
@@ -61,6 +61,7 @@ import * as jose from 'https://deno.land/x/jose/index.ts'
   - [Thumbprints](docs/functions/jwk_thumbprint.calculateJwkThumbprint.md#readme)
   - [EmbeddedJWK](docs/functions/jwk_embedded.EmbeddedJWK.md#readme)
 - JSON Web Key Set (JWKS)
+  - [Verify using a local JWKSet](docs/functions/jwks_local.createLocalJWKSet.md#readme)
   - [Verify using a remote JWKSet](docs/functions/jwks_remote.createRemoteJWKSet.md#readme)
 - Key Pair or Secret Generation
   - [Asymmetric Key Pair Generation](docs/functions/key_generate_key_pair.generateKeyPair.md#readme)
@@ -71,6 +72,7 @@ import * as jose from 'https://deno.land/x/jose/index.ts'
   - [Public Key Export](docs/functions/key_export.exportSPKI.md#readme)
 - Utilities
   - [Decoding Token's Protected Header](docs/functions/util_decode_protected_header.decodeProtectedHeader.md#readme)
+  - [Decoding JWT Claims Set](docs/functions/util_decode_jwt.decodeJwt.md#readme)
 - [Unsecured JWT](docs/classes/jwt_unsecured.UnsecuredJWT.md#readme)
 - [JOSE Errors](docs/modules/util_errors.md#readme)
 
@@ -89,7 +91,7 @@ import * as jose from 'https://deno.land/x/jose/index.ts'
 
 | Version | Security Fixes 🔑 | Other Bug Fixes 🐞 | New Features ⭐ |
 | ------- | --------- | -------- | -------- |
-| [4.x.x](https://github.com/panva/jose) | ✅ | ✅ | ✅ |
+| [4.x.x](https://github.com/panva/jose/tree/v4.x) | ✅ | ✅ | ✅ |
 | [3.x.x](https://github.com/panva/jose/tree/v3.x) | ✅ | ✅ until 2022-04-30 | ❌ |
 | [2.x.x](https://github.com/panva/jose/tree/v2.x) | ✅ | ✅ until 2022-04-30 | ❌ |
 | [1.x.x](https://github.com/panva/jose/tree/v1.x) | ✅ | ❌ | ❌ |
@@ -134,16 +136,16 @@ install size should not be a cause for concern.
 
 [documentation]: /docs/README.md
 [node-jose]: https://github.com/cisco/node-jose
-[spec-b64]: https://tools.ietf.org/html/rfc7797
-[spec-cookbook]: https://tools.ietf.org/html/rfc7520
-[spec-jwa]: https://tools.ietf.org/html/rfc7518
-[spec-jwe]: https://tools.ietf.org/html/rfc7516
-[spec-jwk]: https://tools.ietf.org/html/rfc7517
-[spec-jws]: https://tools.ietf.org/html/rfc7515
-[spec-jwt]: https://tools.ietf.org/html/rfc7519
-[spec-okp]: https://tools.ietf.org/html/rfc8037
-[spec-secp256k1]: https://tools.ietf.org/html/rfc8812
-[spec-thumbprint]: https://tools.ietf.org/html/rfc7638
+[spec-b64]: https://www.rfc-editor.org/rfc/rfc7797
+[spec-cookbook]: https://www.rfc-editor.org/rfc/rfc7520
+[spec-jwa]: https://www.rfc-editor.org/rfc/rfc7518
+[spec-jwe]: https://www.rfc-editor.org/rfc/rfc7516
+[spec-jwk]: https://www.rfc-editor.org/rfc/rfc7517
+[spec-jws]: https://www.rfc-editor.org/rfc/rfc7515
+[spec-jwt]: https://www.rfc-editor.org/rfc/rfc7519
+[spec-okp]: https://www.rfc-editor.org/rfc/rfc8037
+[spec-secp256k1]: https://www.rfc-editor.org/rfc/rfc8812
+[spec-thumbprint]: https://www.rfc-editor.org/rfc/rfc7638
 [support-sponsor]: https://github.com/sponsors/panva
 [conditional-exports]: https://nodejs.org/api/packages.html#packages_conditional_exports
 [webcrypto]: https://www.w3.org/TR/WebCryptoAPI/

package/dist/browser/index.js

@@ -16,11 +16,13 @@ export { SignJWT } from './jwt/sign.js';
 export { EncryptJWT } from './jwt/encrypt.js';
 export { calculateJwkThumbprint } from './jwk/thumbprint.js';
 export { EmbeddedJWK } from './jwk/embedded.js';
+export { createLocalJWKSet } from './jwks/local.js';
 export { createRemoteJWKSet } from './jwks/remote.js';
 export { UnsecuredJWT } from './jwt/unsecured.js';
 export { exportPKCS8, exportSPKI, exportJWK } from './key/export.js';
 export { importSPKI, importPKCS8, importX509, importJWK } from './key/import.js';
 export { decodeProtectedHeader } from './util/decode_protected_header.js';
+export { decodeJwt } from './util/decode_jwt.js';
 import * as errors_1 from './util/errors.js';
 export { errors_1 as errors };
 export { generateKeyPair } from './key/generate_key_pair.js';

package/dist/browser/jwk/thumbprint.js

@@ -12,6 +12,11 @@ export async function calculateJwkThumbprint(jwk, digestAlgorithm = 'sha256') {
     if (!isObject(jwk)) {
         throw new TypeError('JWK must be an object');
     }
+    if (digestAlgorithm !== 'sha256' &&
+        digestAlgorithm !== 'sha384' &&
+        digestAlgorithm !== 'sha512') {
+        throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');
+    }
     let components;
     switch (jwk.kty) {
         case 'EC':

package/dist/browser/jwks/local.js

@@ -0,0 +1,97 @@
+import { importJWK } from '../key/import.js';
+import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, } from '../util/errors.js';
+import isObject from '../lib/is_object.js';
+function getKtyFromAlg(alg) {
+    switch (typeof alg === 'string' && alg.slice(0, 2)) {
+        case 'RS':
+        case 'PS':
+            return 'RSA';
+        case 'ES':
+            return 'EC';
+        case 'Ed':
+            return 'OKP';
+        default:
+            throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
+    }
+}
+export function isJWKSLike(jwks) {
+    return (jwks &&
+        typeof jwks === 'object' &&
+        Array.isArray(jwks.keys) &&
+        jwks.keys.every(isJWKLike));
+}
+function isJWKLike(key) {
+    return isObject(key);
+}
+function clone(obj) {
+    if (typeof structuredClone === 'function') {
+        return structuredClone(obj);
+    }
+    return JSON.parse(JSON.stringify(obj));
+}
+export class LocalJWKSet {
+    constructor(jwks) {
+        this._cached = new WeakMap();
+        if (!isJWKSLike(jwks)) {
+            throw new JWKSInvalid('JSON Web Key Set malformed');
+        }
+        this._jwks = clone(jwks);
+    }
+    async getKey(protectedHeader, token) {
+        const { alg, kid } = { ...protectedHeader, ...token.header };
+        const candidates = this._jwks.keys.filter((jwk) => {
+            let candidate = jwk.kty === getKtyFromAlg(alg);
+            if (candidate && typeof kid === 'string') {
+                candidate = kid === jwk.kid;
+            }
+            if (candidate && typeof jwk.alg === 'string') {
+                candidate = alg === jwk.alg;
+            }
+            if (candidate && typeof jwk.use === 'string') {
+                candidate = jwk.use === 'sig';
+            }
+            if (candidate && Array.isArray(jwk.key_ops)) {
+                candidate = jwk.key_ops.includes('verify');
+            }
+            if (candidate && alg === 'EdDSA') {
+                candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
+            }
+            if (candidate) {
+                switch (alg) {
+                    case 'ES256':
+                        candidate = jwk.crv === 'P-256';
+                        break;
+                    case 'ES256K':
+                        candidate = jwk.crv === 'secp256k1';
+                        break;
+                    case 'ES384':
+                        candidate = jwk.crv === 'P-384';
+                        break;
+                    case 'ES512':
+                        candidate = jwk.crv === 'P-521';
+                        break;
+                }
+            }
+            return candidate;
+        });
+        const { 0: jwk, length } = candidates;
+        if (length === 0) {
+            throw new JWKSNoMatchingKey();
+        }
+        else if (length !== 1) {
+            throw new JWKSMultipleMatchingKeys();
+        }
+        const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
+        if (cached[alg] === undefined) {
+            const keyObject = await importJWK({ ...jwk, ext: true }, alg);
+            if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
+                throw new JWKSInvalid('JSON Web Key Set members must be public keys');
+            }
+            cached[alg] = keyObject;
+        }
+        return cached[alg];
+    }
+}
+export function createLocalJWKSet(jwks) {
+    return LocalJWKSet.prototype.getKey.bind(new LocalJWKSet(jwks));
+}

package/dist/browser/jwks/remote.js

@@ -1,26 +1,11 @@
 import fetchJwks from '../runtime/fetch_jwks.js';
-import { importJWK } from '../key/import.js';
-import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, } from '../util/errors.js';
-import isObject from '../lib/is_object.js';
-function getKtyFromAlg(alg) {
-    switch (typeof alg === 'string' && alg.slice(0, 2)) {
-        case 'RS':
-        case 'PS':
-            return 'RSA';
-        case 'ES':
-            return 'EC';
-        case 'Ed':
-            return 'OKP';
-        default:
-            throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
-    }
-}
-function isJWKLike(key) {
-    return isObject(key);
-}
-class RemoteJWKSet {
+import { isCloudflareWorkers } from '../runtime/env.js';
+import { JWKSInvalid, JWKSNoMatchingKey } from '../util/errors.js';
+import { isJWKSLike, LocalJWKSet } from './local.js';
+class RemoteJWKSet extends LocalJWKSet {
     constructor(url, options) {
-        this._cached = new WeakMap();
+        super({ keys: [] });
+        this._jwks = undefined;
         if (!(url instanceof URL)) {
             throw new TypeError('url must be an instance of URL');
         }
@@ -38,78 +23,40 @@ class RemoteJWKSet {
         return Date.now() < this._cooldownStarted + this._cooldownDuration;
     }
     async getKey(protectedHeader, token) {
-        const joseHeader = {
-            ...protectedHeader,
-            ...token.header,
-        };
         if (!this._jwks) {
             await this.reload();
         }
-        const candidates = this._jwks.keys.filter((jwk) => {
-            let candidate = jwk.kty === getKtyFromAlg(joseHeader.alg);
-            if (candidate && typeof joseHeader.kid === 'string') {
-                candidate = joseHeader.kid === jwk.kid;
-            }
-            if (candidate && typeof jwk.alg === 'string') {
-                candidate = joseHeader.alg === jwk.alg;
-            }
-            if (candidate && typeof jwk.use === 'string') {
-                candidate = jwk.use === 'sig';
-            }
-            if (candidate && Array.isArray(jwk.key_ops)) {
-                candidate = jwk.key_ops.includes('verify');
-            }
-            if (candidate && joseHeader.alg === 'EdDSA') {
-                candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
-            }
-            if (candidate) {
-                switch (joseHeader.alg) {
-                    case 'ES256':
-                        candidate = jwk.crv === 'P-256';
-                        break;
-                    case 'ES256K':
-                        candidate = jwk.crv === 'secp256k1';
-                        break;
-                    case 'ES384':
-                        candidate = jwk.crv === 'P-384';
-                        break;
-                    case 'ES512':
-                        candidate = jwk.crv === 'P-521';
-                        break;
-                    default:
-                }
-            }
-            return candidate;
-        });
-        const { 0: jwk, length } = candidates;
-        if (length === 0) {
-            if (this.coolingDown() === false) {
-                await this.reload();
-                return this.getKey(protectedHeader, token);
-            }
-            throw new JWKSNoMatchingKey();
-        }
-        else if (length !== 1) {
-            throw new JWKSMultipleMatchingKeys();
+        try {
+            return await super.getKey(protectedHeader, token);
         }
-        const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
-        if (cached[joseHeader.alg] === undefined) {
-            const keyObject = await importJWK({ ...jwk, ext: true }, joseHeader.alg);
-            if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
-                throw new JWKSInvalid('JSON Web Key Set members must be public keys');
+        catch (err) {
+            if (err instanceof JWKSNoMatchingKey) {
+                if (this.coolingDown() === false) {
+                    await this.reload();
+                    return super.getKey(protectedHeader, token);
+                }
             }
-            cached[joseHeader.alg] = keyObject;
+            throw err;
         }
-        return cached[joseHeader.alg];
     }
     async reload() {
+        if (this._pendingFetch && isCloudflareWorkers()) {
+            return new Promise((resolve) => {
+                const isDone = () => {
+                    if (this._pendingFetch === undefined) {
+                        resolve();
+                    }
+                    else {
+                        setTimeout(isDone, 5);
+                    }
+                };
+                isDone();
+            });
+        }
         if (!this._pendingFetch) {
             this._pendingFetch = fetchJwks(this._url, this._timeoutDuration, this._options)
                 .then((json) => {
-                if (typeof json !== 'object' ||
-                    !json ||
-                    !Array.isArray(json.keys) ||
-                    !json.keys.every(isJWKLike)) {
+                if (!isJWKSLike(json)) {
                     throw new JWKSInvalid('JSON Web Key Set malformed');
                 }
                 this._jwks = { keys: json.keys };

package/dist/browser/lib/buffer_utils.js

@@ -1,3 +1,4 @@
+import digest from '../runtime/digest.js';
 export const encoder = new TextEncoder();
 export const decoder = new TextDecoder();
 const MAX_INT32 = 2 ** 32;
@@ -36,7 +37,7 @@ export function uint32be(value) {
 export function lengthAndInput(input) {
     return concat(uint32be(input.length), input);
 }
-export async function concatKdf(digest, secret, bits, value) {
+export async function concatKdf(secret, bits, value) {
     const iterations = Math.ceil((bits >> 3) / 32);
     let res;
     for (let iter = 1; iter <= iterations; iter++) {

package/dist/browser/lib/encrypt_key_management.js

@@ -30,7 +30,9 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
             ephemeralKey || (ephemeralKey = (await ECDH.generateEpk(key)).privateKey);
             const { x, y, crv, kty } = await exportJWK(ephemeralKey);
             const sharedSecret = await ECDH.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, alg === 'ECDH-ES' ? cekLength(enc) : parseInt(alg.slice(-5, -2), 10), apu, apv);
-            parameters = { epk: { x, y, crv, kty } };
+            parameters = { epk: { x, crv, kty } };
+            if (kty === 'EC')
+                parameters.epk.y = y;
             if (apu)
                 parameters.apu = base64url(apu);
             if (apv)

package/dist/browser/runtime/ecdhes.js

@@ -1,7 +1,6 @@
 import { encoder, concat, uint32be, lengthAndInput, concatKdf } from '../lib/buffer_utils.js';
 import crypto, { isCryptoKey } from './webcrypto.js';
 import { checkEncCryptoKey } from '../lib/crypto_key.js';
-import digest from './digest.js';
 import invalidKeyInput from '../lib/invalid_key_input.js';
 import { types } from './is_key_like.js';
 export async function deriveKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) {
@@ -21,7 +20,7 @@ export async function deriveKey(publicKey, privateKey, algorithm, keyLength, apu
         name: 'ECDH',
         public: publicKey,
     }, privateKey, Math.ceil(parseInt(privateKey.algorithm.namedCurve.slice(-3), 10) / 8) << 3));
-    return concatKdf(digest, sharedSecret, keyLength, value);
+    return concatKdf(sharedSecret, keyLength, value);
 }
 export async function generateEpk(key) {
     if (!isCryptoKey(key)) {

package/dist/browser/util/decode_jwt.js

@@ -0,0 +1,32 @@
+import { decode as base64url } from './base64url.js';
+import { decoder } from '../lib/buffer_utils.js';
+import isObject from '../lib/is_object.js';
+import { JWTInvalid } from './errors.js';
+export function decodeJwt(jwt) {
+    if (typeof jwt !== 'string')
+        throw new JWTInvalid('JWTs must use Compact JWS serialization, JWT must be a string');
+    const { 1: payload, length } = jwt.split('.');
+    if (length === 5)
+        throw new JWTInvalid('Only JWTs using Compact JWS serialization can be decoded');
+    if (length !== 3)
+        throw new JWTInvalid('Invalid JWT');
+    if (!payload)
+        throw new JWTInvalid('JWTs must contain a payload');
+    let decoded;
+    try {
+        decoded = base64url(payload);
+    }
+    catch (_a) {
+        throw new JWTInvalid('Failed to parse the base64url encoded payload');
+    }
+    let result;
+    try {
+        result = JSON.parse(decoder.decode(decoded));
+    }
+    catch (_b) {
+        throw new JWTInvalid('Failed to parse the decoded payload as JSON');
+    }
+    if (!isObject(result))
+        throw new JWTInvalid('Invalid JWT Claims Set');
+    return result;
+}

package/dist/node/cjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.base64url = exports.generateSecret = exports.generateKeyPair = exports.errors = exports.decodeProtectedHeader = exports.importJWK = exports.importX509 = exports.importPKCS8 = exports.importSPKI = exports.exportJWK = exports.exportSPKI = exports.exportPKCS8 = exports.UnsecuredJWT = exports.createRemoteJWKSet = exports.EmbeddedJWK = exports.calculateJwkThumbprint = exports.EncryptJWT = exports.SignJWT = exports.GeneralSign = exports.FlattenedSign = exports.CompactSign = exports.FlattenedEncrypt = exports.CompactEncrypt = exports.jwtDecrypt = exports.jwtVerify = exports.generalVerify = exports.flattenedVerify = exports.compactVerify = exports.GeneralEncrypt = exports.generalDecrypt = exports.flattenedDecrypt = exports.compactDecrypt = void 0;
+exports.base64url = exports.generateSecret = exports.generateKeyPair = exports.errors = exports.decodeJwt = exports.decodeProtectedHeader = exports.importJWK = exports.importX509 = exports.importPKCS8 = exports.importSPKI = exports.exportJWK = exports.exportSPKI = exports.exportPKCS8 = exports.UnsecuredJWT = exports.createRemoteJWKSet = exports.createLocalJWKSet = exports.EmbeddedJWK = exports.calculateJwkThumbprint = exports.EncryptJWT = exports.SignJWT = exports.GeneralSign = exports.FlattenedSign = exports.CompactSign = exports.FlattenedEncrypt = exports.CompactEncrypt = exports.jwtDecrypt = exports.jwtVerify = exports.generalVerify = exports.flattenedVerify = exports.compactVerify = exports.GeneralEncrypt = exports.generalDecrypt = exports.flattenedDecrypt = exports.compactDecrypt = void 0;
 var decrypt_js_1 = require("./jwe/compact/decrypt.js");
 Object.defineProperty(exports, "compactDecrypt", { enumerable: true, get: function () { return decrypt_js_1.compactDecrypt; } });
 var decrypt_js_2 = require("./jwe/flattened/decrypt.js");
@@ -37,6 +37,8 @@ var thumbprint_js_1 = require("./jwk/thumbprint.js");
 Object.defineProperty(exports, "calculateJwkThumbprint", { enumerable: true, get: function () { return thumbprint_js_1.calculateJwkThumbprint; } });
 var embedded_js_1 = require("./jwk/embedded.js");
 Object.defineProperty(exports, "EmbeddedJWK", { enumerable: true, get: function () { return embedded_js_1.EmbeddedJWK; } });
+var local_js_1 = require("./jwks/local.js");
+Object.defineProperty(exports, "createLocalJWKSet", { enumerable: true, get: function () { return local_js_1.createLocalJWKSet; } });
 var remote_js_1 = require("./jwks/remote.js");
 Object.defineProperty(exports, "createRemoteJWKSet", { enumerable: true, get: function () { return remote_js_1.createRemoteJWKSet; } });
 var unsecured_js_1 = require("./jwt/unsecured.js");
@@ -52,6 +54,8 @@ Object.defineProperty(exports, "importX509", { enumerable: true, get: function (
 Object.defineProperty(exports, "importJWK", { enumerable: true, get: function () { return import_js_1.importJWK; } });
 var decode_protected_header_js_1 = require("./util/decode_protected_header.js");
 Object.defineProperty(exports, "decodeProtectedHeader", { enumerable: true, get: function () { return decode_protected_header_js_1.decodeProtectedHeader; } });
+var decode_jwt_js_1 = require("./util/decode_jwt.js");
+Object.defineProperty(exports, "decodeJwt", { enumerable: true, get: function () { return decode_jwt_js_1.decodeJwt; } });
 exports.errors = require("./util/errors.js");
 var generate_key_pair_js_1 = require("./key/generate_key_pair.js");
 Object.defineProperty(exports, "generateKeyPair", { enumerable: true, get: function () { return generate_key_pair_js_1.generateKeyPair; } });

package/dist/node/cjs/jwk/thumbprint.js

@@ -15,6 +15,11 @@ async function calculateJwkThumbprint(jwk, digestAlgorithm = 'sha256') {
     if (!(0, is_object_js_1.default)(jwk)) {
         throw new TypeError('JWK must be an object');
     }
+    if (digestAlgorithm !== 'sha256' &&
+        digestAlgorithm !== 'sha384' &&
+        digestAlgorithm !== 'sha512') {
+        throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');
+    }
     let components;
     switch (jwk.kty) {
         case 'EC':

package/dist/node/cjs/jwks/local.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createLocalJWKSet = exports.LocalJWKSet = exports.isJWKSLike = void 0;
+const import_js_1 = require("../key/import.js");
+const errors_js_1 = require("../util/errors.js");
+const is_object_js_1 = require("../lib/is_object.js");
+function getKtyFromAlg(alg) {
+    switch (typeof alg === 'string' && alg.slice(0, 2)) {
+        case 'RS':
+        case 'PS':
+            return 'RSA';
+        case 'ES':
+            return 'EC';
+        case 'Ed':
+            return 'OKP';
+        default:
+            throw new errors_js_1.JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
+    }
+}
+function isJWKSLike(jwks) {
+    return (jwks &&
+        typeof jwks === 'object' &&
+        Array.isArray(jwks.keys) &&
+        jwks.keys.every(isJWKLike));
+}
+exports.isJWKSLike = isJWKSLike;
+function isJWKLike(key) {
+    return (0, is_object_js_1.default)(key);
+}
+function clone(obj) {
+    if (typeof structuredClone === 'function') {
+        return structuredClone(obj);
+    }
+    return JSON.parse(JSON.stringify(obj));
+}
+class LocalJWKSet {
+    constructor(jwks) {
+        this._cached = new WeakMap();
+        if (!isJWKSLike(jwks)) {
+            throw new errors_js_1.JWKSInvalid('JSON Web Key Set malformed');
+        }
+        this._jwks = clone(jwks);
+    }
+    async getKey(protectedHeader, token) {
+        const { alg, kid } = { ...protectedHeader, ...token.header };
+        const candidates = this._jwks.keys.filter((jwk) => {
+            let candidate = jwk.kty === getKtyFromAlg(alg);
+            if (candidate && typeof kid === 'string') {
+                candidate = kid === jwk.kid;
+            }
+            if (candidate && typeof jwk.alg === 'string') {
+                candidate = alg === jwk.alg;
+            }
+            if (candidate && typeof jwk.use === 'string') {
+                candidate = jwk.use === 'sig';
+            }
+            if (candidate && Array.isArray(jwk.key_ops)) {
+                candidate = jwk.key_ops.includes('verify');
+            }
+            if (candidate && alg === 'EdDSA') {
+                candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
+            }
+            if (candidate) {
+                switch (alg) {
+                    case 'ES256':
+                        candidate = jwk.crv === 'P-256';
+                        break;
+                    case 'ES256K':
+                        candidate = jwk.crv === 'secp256k1';
+                        break;
+                    case 'ES384':
+                        candidate = jwk.crv === 'P-384';
+                        break;
+                    case 'ES512':
+                        candidate = jwk.crv === 'P-521';
+                        break;
+                }
+            }
+            return candidate;
+        });
+        const { 0: jwk, length } = candidates;
+        if (length === 0) {
+            throw new errors_js_1.JWKSNoMatchingKey();
+        }
+        else if (length !== 1) {
+            throw new errors_js_1.JWKSMultipleMatchingKeys();
+        }
+        const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
+        if (cached[alg] === undefined) {
+            const keyObject = await (0, import_js_1.importJWK)({ ...jwk, ext: true }, alg);
+            if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
+                throw new errors_js_1.JWKSInvalid('JSON Web Key Set members must be public keys');
+            }
+            cached[alg] = keyObject;
+        }
+        return cached[alg];
+    }
+}
+exports.LocalJWKSet = LocalJWKSet;
+function createLocalJWKSet(jwks) {
+    return LocalJWKSet.prototype.getKey.bind(new LocalJWKSet(jwks));
+}
+exports.createLocalJWKSet = createLocalJWKSet;

package/dist/node/cjs/jwks/remote.js

@@ -2,28 +2,13 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createRemoteJWKSet = void 0;
 const fetch_jwks_js_1 = require("../runtime/fetch_jwks.js");
-const import_js_1 = require("../key/import.js");
+const env_js_1 = require("../runtime/env.js");
 const errors_js_1 = require("../util/errors.js");
-const is_object_js_1 = require("../lib/is_object.js");
-function getKtyFromAlg(alg) {
-    switch (typeof alg === 'string' && alg.slice(0, 2)) {
-        case 'RS':
-        case 'PS':
-            return 'RSA';
-        case 'ES':
-            return 'EC';
-        case 'Ed':
-            return 'OKP';
-        default:
-            throw new errors_js_1.JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
-    }
-}
-function isJWKLike(key) {
-    return (0, is_object_js_1.default)(key);
-}
-class RemoteJWKSet {
+const local_js_1 = require("./local.js");
+class RemoteJWKSet extends local_js_1.LocalJWKSet {
     constructor(url, options) {
-        this._cached = new WeakMap();
+        super({ keys: [] });
+        this._jwks = undefined;
         if (!(url instanceof URL)) {
             throw new TypeError('url must be an instance of URL');
         }
@@ -41,78 +26,40 @@ class RemoteJWKSet {
         return Date.now() < this._cooldownStarted + this._cooldownDuration;
     }
     async getKey(protectedHeader, token) {
-        const joseHeader = {
-            ...protectedHeader,
-            ...token.header,
-        };
         if (!this._jwks) {
             await this.reload();
         }
-        const candidates = this._jwks.keys.filter((jwk) => {
-            let candidate = jwk.kty === getKtyFromAlg(joseHeader.alg);
-            if (candidate && typeof joseHeader.kid === 'string') {
-                candidate = joseHeader.kid === jwk.kid;
-            }
-            if (candidate && typeof jwk.alg === 'string') {
-                candidate = joseHeader.alg === jwk.alg;
-            }
-            if (candidate && typeof jwk.use === 'string') {
-                candidate = jwk.use === 'sig';
-            }
-            if (candidate && Array.isArray(jwk.key_ops)) {
-                candidate = jwk.key_ops.includes('verify');
-            }
-            if (candidate && joseHeader.alg === 'EdDSA') {
-                candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
-            }
-            if (candidate) {
-                switch (joseHeader.alg) {
-                    case 'ES256':
-                        candidate = jwk.crv === 'P-256';
-                        break;
-                    case 'ES256K':
-                        candidate = jwk.crv === 'secp256k1';
-                        break;
-                    case 'ES384':
-                        candidate = jwk.crv === 'P-384';
-                        break;
-                    case 'ES512':
-                        candidate = jwk.crv === 'P-521';
-                        break;
-                    default:
-                }
-            }
-            return candidate;
-        });
-        const { 0: jwk, length } = candidates;
-        if (length === 0) {
-            if (this.coolingDown() === false) {
-                await this.reload();
-                return this.getKey(protectedHeader, token);
-            }
-            throw new errors_js_1.JWKSNoMatchingKey();
-        }
-        else if (length !== 1) {
-            throw new errors_js_1.JWKSMultipleMatchingKeys();
+        try {
+            return await super.getKey(protectedHeader, token);
         }
-        const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
-        if (cached[joseHeader.alg] === undefined) {
-            const keyObject = await (0, import_js_1.importJWK)({ ...jwk, ext: true }, joseHeader.alg);
-            if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
-                throw new errors_js_1.JWKSInvalid('JSON Web Key Set members must be public keys');
+        catch (err) {
+            if (err instanceof errors_js_1.JWKSNoMatchingKey) {
+                if (this.coolingDown() === false) {
+                    await this.reload();
+                    return super.getKey(protectedHeader, token);
+                }
             }
-            cached[joseHeader.alg] = keyObject;
+            throw err;
         }
-        return cached[joseHeader.alg];
     }
     async reload() {
+        if (this._pendingFetch && (0, env_js_1.isCloudflareWorkers)()) {
+            return new Promise((resolve) => {
+                const isDone = () => {
+                    if (this._pendingFetch === undefined) {
+                        resolve();
+                    }
+                    else {
+                        setTimeout(isDone, 5);
+                    }
+                };
+                isDone();
+            });
+        }
         if (!this._pendingFetch) {
             this._pendingFetch = (0, fetch_jwks_js_1.default)(this._url, this._timeoutDuration, this._options)
                 .then((json) => {
-                if (typeof json !== 'object' ||
-                    !json ||
-                    !Array.isArray(json.keys) ||
-                    !json.keys.every(isJWKLike)) {
+                if (!(0, local_js_1.isJWKSLike)(json)) {
                     throw new errors_js_1.JWKSInvalid('JSON Web Key Set malformed');
                 }
                 this._jwks = { keys: json.keys };

package/dist/node/cjs/lib/buffer_utils.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.concatKdf = exports.lengthAndInput = exports.uint32be = exports.uint64be = exports.p2s = exports.concat = exports.decoder = exports.encoder = void 0;
+const digest_js_1 = require("../runtime/digest.js");
 exports.encoder = new TextEncoder();
 exports.decoder = new TextDecoder();
 const MAX_INT32 = 2 ** 32;
@@ -44,7 +45,7 @@ function lengthAndInput(input) {
     return concat(uint32be(input.length), input);
 }
 exports.lengthAndInput = lengthAndInput;
-async function concatKdf(digest, secret, bits, value) {
+async function concatKdf(secret, bits, value) {
     const iterations = Math.ceil((bits >> 3) / 32);
     let res;
     for (let iter = 1; iter <= iterations; iter++) {
@@ -53,10 +54,10 @@ async function concatKdf(digest, secret, bits, value) {
         buf.set(secret, 4);
         buf.set(value, 4 + secret.length);
         if (!res) {
-            res = await digest('sha256', buf);
+            res = await (0, digest_js_1.default)('sha256', buf);
         }
         else {
-            res = concat(res, await digest('sha256', buf));
+            res = concat(res, await (0, digest_js_1.default)('sha256', buf));
         }
     }
     res = res.slice(0, bits >> 3);

package/dist/node/cjs/lib/encrypt_key_management.js

@@ -32,7 +32,9 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
             ephemeralKey || (ephemeralKey = (await ECDH.generateEpk(key)).privateKey);
             const { x, y, crv, kty } = await (0, export_js_1.exportJWK)(ephemeralKey);
             const sharedSecret = await ECDH.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, alg === 'ECDH-ES' ? (0, cek_js_1.bitLength)(enc) : parseInt(alg.slice(-5, -2), 10), apu, apv);
-            parameters = { epk: { x, y, crv, kty } };
+            parameters = { epk: { x, crv, kty } };
+            if (kty === 'EC')
+                parameters.epk.y = y;
             if (apu)
                 parameters.apu = (0, base64url_js_1.encode)(apu);
             if (apv)

package/dist/node/cjs/runtime/base64url.js

@@ -3,7 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.decode = exports.encode = exports.encodeBase64 = exports.decodeBase64 = void 0;
 const buffer_1 = require("buffer");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
-let encodeImpl;
+let encode;
+exports.encode = encode;
 function normalize(input) {
     let encoded = input;
     if (encoded instanceof Uint8Array) {
@@ -12,15 +13,14 @@ function normalize(input) {
     return encoded;
 }
 if (buffer_1.Buffer.isEncoding('base64url')) {
-    encodeImpl = (input) => buffer_1.Buffer.from(input).toString('base64url');
+    exports.encode = encode = (input) => buffer_1.Buffer.from(input).toString('base64url');
 }
 else {
-    encodeImpl = (input) => buffer_1.Buffer.from(input).toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+    exports.encode = encode = (input) => buffer_1.Buffer.from(input).toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
 }
 const decodeBase64 = (input) => buffer_1.Buffer.from(input, 'base64');
 exports.decodeBase64 = decodeBase64;
 const encodeBase64 = (input) => buffer_1.Buffer.from(input).toString('base64');
 exports.encodeBase64 = encodeBase64;
-exports.encode = encodeImpl;
 const decode = (input) => buffer_1.Buffer.from(normalize(input), 'base64');
 exports.decode = decode;

package/dist/node/cjs/runtime/ecdhes.js

@@ -5,7 +5,6 @@ const crypto_1 = require("crypto");
 const util_1 = require("util");
 const get_named_curve_js_1 = require("./get_named_curve.js");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
-const digest_js_1 = require("./digest.js");
 const errors_js_1 = require("../util/errors.js");
 const webcrypto_js_1 = require("./webcrypto.js");
 const crypto_key_js_1 = require("../lib/crypto_key.js");
@@ -38,7 +37,7 @@ async function deriveKey(publicKee, privateKee, algorithm, keyLength, apu = new
     }
     const value = (0, buffer_utils_js_1.concat)((0, buffer_utils_js_1.lengthAndInput)(buffer_utils_js_1.encoder.encode(algorithm)), (0, buffer_utils_js_1.lengthAndInput)(apu), (0, buffer_utils_js_1.lengthAndInput)(apv), (0, buffer_utils_js_1.uint32be)(keyLength));
     const sharedSecret = (0, crypto_1.diffieHellman)({ privateKey, publicKey });
-    return (0, buffer_utils_js_1.concatKdf)(digest_js_1.default, sharedSecret, keyLength, value);
+    return (0, buffer_utils_js_1.concatKdf)(sharedSecret, keyLength, value);
 }
 exports.deriveKey = deriveKey;
 async function generateEpk(kee) {

package/dist/node/cjs/util/decode_jwt.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeJwt = void 0;
+const base64url_js_1 = require("./base64url.js");
+const buffer_utils_js_1 = require("../lib/buffer_utils.js");
+const is_object_js_1 = require("../lib/is_object.js");
+const errors_js_1 = require("./errors.js");
+function decodeJwt(jwt) {
+    if (typeof jwt !== 'string')
+        throw new errors_js_1.JWTInvalid('JWTs must use Compact JWS serialization, JWT must be a string');
+    const { 1: payload, length } = jwt.split('.');
+    if (length === 5)
+        throw new errors_js_1.JWTInvalid('Only JWTs using Compact JWS serialization can be decoded');
+    if (length !== 3)
+        throw new errors_js_1.JWTInvalid('Invalid JWT');
+    if (!payload)
+        throw new errors_js_1.JWTInvalid('JWTs must contain a payload');
+    let decoded;
+    try {
+        decoded = (0, base64url_js_1.decode)(payload);
+    }
+    catch {
+        throw new errors_js_1.JWTInvalid('Failed to parse the base64url encoded payload');
+    }
+    let result;
+    try {
+        result = JSON.parse(buffer_utils_js_1.decoder.decode(decoded));
+    }
+    catch {
+        throw new errors_js_1.JWTInvalid('Failed to parse the decoded payload as JSON');
+    }
+    if (!(0, is_object_js_1.default)(result))
+        throw new errors_js_1.JWTInvalid('Invalid JWT Claims Set');
+    return result;
+}
+exports.decodeJwt = decodeJwt;

package/dist/node/esm/index.js

@@ -16,11 +16,13 @@ export { SignJWT } from './jwt/sign.js';
 export { EncryptJWT } from './jwt/encrypt.js';
 export { calculateJwkThumbprint } from './jwk/thumbprint.js';
 export { EmbeddedJWK } from './jwk/embedded.js';
+export { createLocalJWKSet } from './jwks/local.js';
 export { createRemoteJWKSet } from './jwks/remote.js';
 export { UnsecuredJWT } from './jwt/unsecured.js';
 export { exportPKCS8, exportSPKI, exportJWK } from './key/export.js';
 export { importSPKI, importPKCS8, importX509, importJWK } from './key/import.js';
 export { decodeProtectedHeader } from './util/decode_protected_header.js';
+export { decodeJwt } from './util/decode_jwt.js';
 export * as errors from './util/errors.js';
 export { generateKeyPair } from './key/generate_key_pair.js';
 export { generateSecret } from './key/generate_secret.js';

package/dist/node/esm/jwk/thumbprint.js

@@ -12,6 +12,11 @@ export async function calculateJwkThumbprint(jwk, digestAlgorithm = 'sha256') {
     if (!isObject(jwk)) {
         throw new TypeError('JWK must be an object');
     }
+    if (digestAlgorithm !== 'sha256' &&
+        digestAlgorithm !== 'sha384' &&
+        digestAlgorithm !== 'sha512') {
+        throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');
+    }
     let components;
     switch (jwk.kty) {
         case 'EC':

package/dist/node/esm/jwks/local.js

@@ -0,0 +1,97 @@
+import { importJWK } from '../key/import.js';
+import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, } from '../util/errors.js';
+import isObject from '../lib/is_object.js';
+function getKtyFromAlg(alg) {
+    switch (typeof alg === 'string' && alg.slice(0, 2)) {
+        case 'RS':
+        case 'PS':
+            return 'RSA';
+        case 'ES':
+            return 'EC';
+        case 'Ed':
+            return 'OKP';
+        default:
+            throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
+    }
+}
+export function isJWKSLike(jwks) {
+    return (jwks &&
+        typeof jwks === 'object' &&
+        Array.isArray(jwks.keys) &&
+        jwks.keys.every(isJWKLike));
+}
+function isJWKLike(key) {
+    return isObject(key);
+}
+function clone(obj) {
+    if (typeof structuredClone === 'function') {
+        return structuredClone(obj);
+    }
+    return JSON.parse(JSON.stringify(obj));
+}
+export class LocalJWKSet {
+    constructor(jwks) {
+        this._cached = new WeakMap();
+        if (!isJWKSLike(jwks)) {
+            throw new JWKSInvalid('JSON Web Key Set malformed');
+        }
+        this._jwks = clone(jwks);
+    }
+    async getKey(protectedHeader, token) {
+        const { alg, kid } = { ...protectedHeader, ...token.header };
+        const candidates = this._jwks.keys.filter((jwk) => {
+            let candidate = jwk.kty === getKtyFromAlg(alg);
+            if (candidate && typeof kid === 'string') {
+                candidate = kid === jwk.kid;
+            }
+            if (candidate && typeof jwk.alg === 'string') {
+                candidate = alg === jwk.alg;
+            }
+            if (candidate && typeof jwk.use === 'string') {
+                candidate = jwk.use === 'sig';
+            }
+            if (candidate && Array.isArray(jwk.key_ops)) {
+                candidate = jwk.key_ops.includes('verify');
+            }
+            if (candidate && alg === 'EdDSA') {
+                candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
+            }
+            if (candidate) {
+                switch (alg) {
+                    case 'ES256':
+                        candidate = jwk.crv === 'P-256';
+                        break;
+                    case 'ES256K':
+                        candidate = jwk.crv === 'secp256k1';
+                        break;
+                    case 'ES384':
+                        candidate = jwk.crv === 'P-384';
+                        break;
+                    case 'ES512':
+                        candidate = jwk.crv === 'P-521';
+                        break;
+                }
+            }
+            return candidate;
+        });
+        const { 0: jwk, length } = candidates;
+        if (length === 0) {
+            throw new JWKSNoMatchingKey();
+        }
+        else if (length !== 1) {
+            throw new JWKSMultipleMatchingKeys();
+        }
+        const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
+        if (cached[alg] === undefined) {
+            const keyObject = await importJWK({ ...jwk, ext: true }, alg);
+            if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
+                throw new JWKSInvalid('JSON Web Key Set members must be public keys');
+            }
+            cached[alg] = keyObject;
+        }
+        return cached[alg];
+    }
+}
+export function createLocalJWKSet(jwks) {
+    return LocalJWKSet.prototype.getKey.bind(new LocalJWKSet(jwks));
+}

package/dist/node/esm/jwks/remote.js

@@ -1,26 +1,11 @@
 import fetchJwks from '../runtime/fetch_jwks.js';
-import { importJWK } from '../key/import.js';
-import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, } from '../util/errors.js';
-import isObject from '../lib/is_object.js';
-function getKtyFromAlg(alg) {
-    switch (typeof alg === 'string' && alg.slice(0, 2)) {
-        case 'RS':
-        case 'PS':
-            return 'RSA';
-        case 'ES':
-            return 'EC';
-        case 'Ed':
-            return 'OKP';
-        default:
-            throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
-    }
-}
-function isJWKLike(key) {
-    return isObject(key);
-}
-class RemoteJWKSet {
+import { isCloudflareWorkers } from '../runtime/env.js';
+import { JWKSInvalid, JWKSNoMatchingKey } from '../util/errors.js';
+import { isJWKSLike, LocalJWKSet } from './local.js';
+class RemoteJWKSet extends LocalJWKSet {
     constructor(url, options) {
-        this._cached = new WeakMap();
+        super({ keys: [] });
+        this._jwks = undefined;
         if (!(url instanceof URL)) {
             throw new TypeError('url must be an instance of URL');
         }
@@ -38,78 +23,40 @@ class RemoteJWKSet {
         return Date.now() < this._cooldownStarted + this._cooldownDuration;
     }
     async getKey(protectedHeader, token) {
-        const joseHeader = {
-            ...protectedHeader,
-            ...token.header,
-        };
         if (!this._jwks) {
             await this.reload();
         }
-        const candidates = this._jwks.keys.filter((jwk) => {
-            let candidate = jwk.kty === getKtyFromAlg(joseHeader.alg);
-            if (candidate && typeof joseHeader.kid === 'string') {
-                candidate = joseHeader.kid === jwk.kid;
-            }
-            if (candidate && typeof jwk.alg === 'string') {
-                candidate = joseHeader.alg === jwk.alg;
-            }
-            if (candidate && typeof jwk.use === 'string') {
-                candidate = jwk.use === 'sig';
-            }
-            if (candidate && Array.isArray(jwk.key_ops)) {
-                candidate = jwk.key_ops.includes('verify');
-            }
-            if (candidate && joseHeader.alg === 'EdDSA') {
-                candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
-            }
-            if (candidate) {
-                switch (joseHeader.alg) {
-                    case 'ES256':
-                        candidate = jwk.crv === 'P-256';
-                        break;
-                    case 'ES256K':
-                        candidate = jwk.crv === 'secp256k1';
-                        break;
-                    case 'ES384':
-                        candidate = jwk.crv === 'P-384';
-                        break;
-                    case 'ES512':
-                        candidate = jwk.crv === 'P-521';
-                        break;
-                    default:
-                }
-            }
-            return candidate;
-        });
-        const { 0: jwk, length } = candidates;
-        if (length === 0) {
-            if (this.coolingDown() === false) {
-                await this.reload();
-                return this.getKey(protectedHeader, token);
-            }
-            throw new JWKSNoMatchingKey();
-        }
-        else if (length !== 1) {
-            throw new JWKSMultipleMatchingKeys();
+        try {
+            return await super.getKey(protectedHeader, token);
         }
-        const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
-        if (cached[joseHeader.alg] === undefined) {
-            const keyObject = await importJWK({ ...jwk, ext: true }, joseHeader.alg);
-            if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
-                throw new JWKSInvalid('JSON Web Key Set members must be public keys');
+        catch (err) {
+            if (err instanceof JWKSNoMatchingKey) {
+                if (this.coolingDown() === false) {
+                    await this.reload();
+                    return super.getKey(protectedHeader, token);
+                }
             }
-            cached[joseHeader.alg] = keyObject;
+            throw err;
         }
-        return cached[joseHeader.alg];
     }
     async reload() {
+        if (this._pendingFetch && isCloudflareWorkers()) {
+            return new Promise((resolve) => {
+                const isDone = () => {
+                    if (this._pendingFetch === undefined) {
+                        resolve();
+                    }
+                    else {
+                        setTimeout(isDone, 5);
+                    }
+                };
+                isDone();
+            });
+        }
         if (!this._pendingFetch) {
             this._pendingFetch = fetchJwks(this._url, this._timeoutDuration, this._options)
                 .then((json) => {
-                if (typeof json !== 'object' ||
-                    !json ||
-                    !Array.isArray(json.keys) ||
-                    !json.keys.every(isJWKLike)) {
+                if (!isJWKSLike(json)) {
                     throw new JWKSInvalid('JSON Web Key Set malformed');
                 }
                 this._jwks = { keys: json.keys };

package/dist/node/esm/lib/buffer_utils.js

@@ -1,3 +1,4 @@
+import digest from '../runtime/digest.js';
 export const encoder = new TextEncoder();
 export const decoder = new TextDecoder();
 const MAX_INT32 = 2 ** 32;
@@ -36,7 +37,7 @@ export function uint32be(value) {
 export function lengthAndInput(input) {
     return concat(uint32be(input.length), input);
 }
-export async function concatKdf(digest, secret, bits, value) {
+export async function concatKdf(secret, bits, value) {
     const iterations = Math.ceil((bits >> 3) / 32);
     let res;
     for (let iter = 1; iter <= iterations; iter++) {

package/dist/node/esm/lib/encrypt_key_management.js

@@ -30,7 +30,9 @@ async function encryptKeyManagement(alg, enc, key, providedCek, providedParamete
             ephemeralKey || (ephemeralKey = (await ECDH.generateEpk(key)).privateKey);
             const { x, y, crv, kty } = await exportJWK(ephemeralKey);
             const sharedSecret = await ECDH.deriveKey(key, ephemeralKey, alg === 'ECDH-ES' ? enc : alg, alg === 'ECDH-ES' ? cekLength(enc) : parseInt(alg.slice(-5, -2), 10), apu, apv);
-            parameters = { epk: { x, y, crv, kty } };
+            parameters = { epk: { x, crv, kty } };
+            if (kty === 'EC')
+                parameters.epk.y = y;
             if (apu)
                 parameters.apu = base64url(apu);
             if (apv)

package/dist/node/esm/runtime/base64url.js

@@ -1,6 +1,6 @@
 import { Buffer } from 'buffer';
 import { decoder } from '../lib/buffer_utils.js';
-let encodeImpl;
+let encode;
 function normalize(input) {
     let encoded = input;
     if (encoded instanceof Uint8Array) {
@@ -9,12 +9,12 @@ function normalize(input) {
     return encoded;
 }
 if (Buffer.isEncoding('base64url')) {
-    encodeImpl = (input) => Buffer.from(input).toString('base64url');
+    encode = (input) => Buffer.from(input).toString('base64url');
 }
 else {
-    encodeImpl = (input) => Buffer.from(input).toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+    encode = (input) => Buffer.from(input).toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
 }
 export const decodeBase64 = (input) => Buffer.from(input, 'base64');
 export const encodeBase64 = (input) => Buffer.from(input).toString('base64');
-export const encode = encodeImpl;
+export { encode };
 export const decode = (input) => Buffer.from(normalize(input), 'base64');

package/dist/node/esm/runtime/ecdhes.js

@@ -2,7 +2,6 @@ import { diffieHellman, generateKeyPair as generateKeyPairCb, KeyObject } from '
 import { promisify } from 'util';
 import getNamedCurve from './get_named_curve.js';
 import { encoder, concat, uint32be, lengthAndInput, concatKdf } from '../lib/buffer_utils.js';
-import digest from './digest.js';
 import { JOSENotSupported } from '../util/errors.js';
 import { isCryptoKey } from './webcrypto.js';
 import { checkEncCryptoKey } from '../lib/crypto_key.js';
@@ -35,7 +34,7 @@ export async function deriveKey(publicKee, privateKee, algorithm, keyLength, apu
     }
     const value = concat(lengthAndInput(encoder.encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength));
     const sharedSecret = diffieHellman({ privateKey, publicKey });
-    return concatKdf(digest, sharedSecret, keyLength, value);
+    return concatKdf(sharedSecret, keyLength, value);
 }
 export async function generateEpk(kee) {
     let key;

package/dist/node/esm/util/decode_jwt.js

@@ -0,0 +1,32 @@
+import { decode as base64url } from './base64url.js';
+import { decoder } from '../lib/buffer_utils.js';
+import isObject from '../lib/is_object.js';
+import { JWTInvalid } from './errors.js';
+export function decodeJwt(jwt) {
+    if (typeof jwt !== 'string')
+        throw new JWTInvalid('JWTs must use Compact JWS serialization, JWT must be a string');
+    const { 1: payload, length } = jwt.split('.');
+    if (length === 5)
+        throw new JWTInvalid('Only JWTs using Compact JWS serialization can be decoded');
+    if (length !== 3)
+        throw new JWTInvalid('Invalid JWT');
+    if (!payload)
+        throw new JWTInvalid('JWTs must contain a payload');
+    let decoded;
+    try {
+        decoded = base64url(payload);
+    }
+    catch {
+        throw new JWTInvalid('Failed to parse the base64url encoded payload');
+    }
+    let result;
+    try {
+        result = JSON.parse(decoder.decode(decoded));
+    }
+    catch {
+        throw new JWTInvalid('Failed to parse the decoded payload as JSON');
+    }
+    if (!isObject(result))
+        throw new JWTInvalid('Invalid JWT Claims Set');
+    return result;
+}

package/dist/types/index.d.ts

@@ -27,6 +27,7 @@ export { SignJWT } from './jwt/sign';
 export { EncryptJWT } from './jwt/encrypt';
 export { calculateJwkThumbprint } from './jwk/thumbprint';
 export { EmbeddedJWK } from './jwk/embedded';
+export { createLocalJWKSet } from './jwks/local';
 export { createRemoteJWKSet } from './jwks/remote';
 export type { RemoteJWKSetOptions } from './jwks/remote';
 export { UnsecuredJWT } from './jwt/unsecured';
@@ -35,6 +36,7 @@ export { exportPKCS8, exportSPKI, exportJWK } from './key/export';
 export { importSPKI, importPKCS8, importX509, importJWK } from './key/import';
 export type { PEMImportOptions } from './key/import';
 export { decodeProtectedHeader } from './util/decode_protected_header';
+export { decodeJwt } from './util/decode_jwt';
 export type { ProtectedHeaderParameters } from './util/decode_protected_header';
 export * as errors from './util/errors';
 export { generateKeyPair } from './key/generate_key_pair';
@@ -42,4 +44,4 @@ export type { GenerateKeyPairResult, GenerateKeyPairOptions } from './key/genera
 export { generateSecret } from './key/generate_secret';
 export type { GenerateSecretOptions } from './key/generate_secret';
 export * as base64url from './util/base64url';
-export type { KeyLike, JWK, FlattenedJWSInput, GeneralJWSInput, FlattenedJWS, GeneralJWS, JoseHeaderParameters, JWSHeaderParameters, JWEKeyManagementHeaderParameters, FlattenedJWE, GeneralJWE, JWEHeaderParameters, CritOption, DeflateOption, DecryptOptions, EncryptOptions, JWTClaimVerificationOptions, VerifyOptions, SignOptions, JWTPayload, DeflateFunction, InflateFunction, FlattenedDecryptResult, GeneralDecryptResult, CompactDecryptResult, FlattenedVerifyResult, GeneralVerifyResult, CompactVerifyResult, JWTVerifyResult, JWTDecryptResult, ResolvedKey, CompactJWEHeaderParameters, CompactJWSHeaderParameters, JWTHeaderParameters, } from './types';
+export type { KeyLike, JWK, FlattenedJWSInput, GeneralJWSInput, FlattenedJWS, GeneralJWS, JoseHeaderParameters, JWSHeaderParameters, JWEKeyManagementHeaderParameters, FlattenedJWE, GeneralJWE, JWEHeaderParameters, CritOption, DeflateOption, DecryptOptions, EncryptOptions, JWTClaimVerificationOptions, VerifyOptions, SignOptions, JWTPayload, DeflateFunction, InflateFunction, FlattenedDecryptResult, GeneralDecryptResult, CompactDecryptResult, FlattenedVerifyResult, GeneralVerifyResult, CompactVerifyResult, JWTVerifyResult, JWTDecryptResult, ResolvedKey, CompactJWEHeaderParameters, CompactJWSHeaderParameters, JWTHeaderParameters, JSONWebKeySet, } from './types';

package/dist/types/jwks/local.d.ts

@@ -0,0 +1,9 @@
+import type { KeyLike, JWSHeaderParameters, JSONWebKeySet, FlattenedJWSInput, GetKeyFunction } from '../types';
+export declare function isJWKSLike(jwks: unknown): jwks is JSONWebKeySet;
+export declare class LocalJWKSet {
+    protected _jwks?: JSONWebKeySet;
+    private _cached;
+    constructor(jwks: unknown);
+    getKey(protectedHeader: JWSHeaderParameters, token: FlattenedJWSInput): Promise<KeyLike>;
+}
+export declare function createLocalJWKSet(jwks: JSONWebKeySet): GetKeyFunction<JWSHeaderParameters, FlattenedJWSInput>;

package/dist/types/types.d.ts

@@ -118,7 +118,7 @@ export interface JWK {
   [propName: string]: unknown
 }
 export interface GetKeyFunction<T, T2> {
-  (protectedHeader: T, token: T2): Promise<KeyLike | Uint8Array>
+  (protectedHeader: T, token: T2): Promise<KeyLike | Uint8Array> | KeyLike | Uint8Array
 }
 export interface FlattenedJWSInput {
   header?: JWSHeaderParameters
@@ -268,3 +268,6 @@ export interface CompactJWEHeaderParameters extends JWEHeaderParameters {
   alg: string
   enc: string
 }
+export interface JSONWebKeySet {
+  keys: JWK[]
+}

package/dist/types/util/decode_jwt.d.ts

@@ -0,0 +1,2 @@
+import type { JWTPayload } from '../types';
+export declare function decodeJwt(jwt: string): JWTPayload;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "4.3.8",
+  "version": "4.5.1",
   "description": "'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto",
   "keywords": [
     "browser",