jose 4.4.0 → 4.5.0

package/README.md

@@ -42,10 +42,10 @@ import * as jose from 'https://deno.land/x/jose/index.ts'
 
 - JSON Web Tokens (JWT)
   - [Signing](docs/classes/jwt_sign.SignJWT.md#readme)
-  - [Verification & Claims Set Validation](docs/functions/jwt_verify.jwtVerify.md#readme)
+  - [Verification & JWT Claims Set Validation](docs/functions/jwt_verify.jwtVerify.md#readme)
   - Encrypted JSON Web Tokens
     - [Encryption](docs/classes/jwt_encrypt.EncryptJWT.md#readme)
-    - [Decryption & Claims Set Validation](docs/functions/jwt_decrypt.jwtDecrypt.md#readme)
+    - [Decryption & JWT Claims Set Validation](docs/functions/jwt_decrypt.jwtDecrypt.md#readme)
 - Key Import
   - [JWK Import](docs/functions/key_import.importJWK.md#readme)
   - [Public Key Import (SPKI)](docs/functions/key_import.importSPKI.md#readme)
@@ -72,6 +72,7 @@ import * as jose from 'https://deno.land/x/jose/index.ts'
   - [Public Key Export](docs/functions/key_export.exportSPKI.md#readme)
 - Utilities
   - [Decoding Token's Protected Header](docs/functions/util_decode_protected_header.decodeProtectedHeader.md#readme)
+  - [Decoding JWT Claims Set](docs/functions/util_decode_jwt.decodeJwt.md#readme)
 - [Unsecured JWT](docs/classes/jwt_unsecured.UnsecuredJWT.md#readme)
 - [JOSE Errors](docs/modules/util_errors.md#readme)
 
@@ -90,7 +91,7 @@ import * as jose from 'https://deno.land/x/jose/index.ts'
 
 | Version | Security Fixes 🔑 | Other Bug Fixes 🐞 | New Features ⭐ |
 | ------- | --------- | -------- | -------- |
-| [4.x.x](https://github.com/panva/jose) | ✅ | ✅ | ✅ |
+| [4.x.x](https://github.com/panva/jose/tree/v4.x) | ✅ | ✅ | ✅ |
 | [3.x.x](https://github.com/panva/jose/tree/v3.x) | ✅ | ✅ until 2022-04-30 | ❌ |
 | [2.x.x](https://github.com/panva/jose/tree/v2.x) | ✅ | ✅ until 2022-04-30 | ❌ |
 | [1.x.x](https://github.com/panva/jose/tree/v1.x) | ✅ | ❌ | ❌ |

package/dist/browser/index.js

@@ -22,6 +22,7 @@ export { UnsecuredJWT } from './jwt/unsecured.js';
 export { exportPKCS8, exportSPKI, exportJWK } from './key/export.js';
 export { importSPKI, importPKCS8, importX509, importJWK } from './key/import.js';
 export { decodeProtectedHeader } from './util/decode_protected_header.js';
+export { decodeJwt } from './util/decode_jwt.js';
 import * as errors_1 from './util/errors.js';
 export { errors_1 as errors };
 export { generateKeyPair } from './key/generate_key_pair.js';

package/dist/browser/jwks/local.js

@@ -38,17 +38,14 @@ export class LocalJWKSet {
         this._jwks = clone(jwks);
     }
     async getKey(protectedHeader, token) {
-        const joseHeader = {
-            ...protectedHeader,
-            ...token.header,
-        };
+        const { alg, kid } = { ...protectedHeader, ...token.header };
         const candidates = this._jwks.keys.filter((jwk) => {
-            let candidate = jwk.kty === getKtyFromAlg(joseHeader.alg);
-            if (candidate && typeof joseHeader.kid === 'string') {
-                candidate = joseHeader.kid === jwk.kid;
+            let candidate = jwk.kty === getKtyFromAlg(alg);
+            if (candidate && typeof kid === 'string') {
+                candidate = kid === jwk.kid;
             }
             if (candidate && typeof jwk.alg === 'string') {
-                candidate = joseHeader.alg === jwk.alg;
+                candidate = alg === jwk.alg;
             }
             if (candidate && typeof jwk.use === 'string') {
                 candidate = jwk.use === 'sig';
@@ -56,11 +53,11 @@ export class LocalJWKSet {
             if (candidate && Array.isArray(jwk.key_ops)) {
                 candidate = jwk.key_ops.includes('verify');
             }
-            if (candidate && joseHeader.alg === 'EdDSA') {
+            if (candidate && alg === 'EdDSA') {
                 candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
             }
             if (candidate) {
-                switch (joseHeader.alg) {
+                switch (alg) {
                     case 'ES256':
                         candidate = jwk.crv === 'P-256';
                         break;
@@ -73,7 +70,6 @@ export class LocalJWKSet {
                     case 'ES512':
                         candidate = jwk.crv === 'P-521';
                         break;
-                    default:
                 }
             }
             return candidate;
@@ -86,14 +82,14 @@ export class LocalJWKSet {
             throw new JWKSMultipleMatchingKeys();
         }
         const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
-        if (cached[joseHeader.alg] === undefined) {
-            const keyObject = await importJWK({ ...jwk, ext: true }, joseHeader.alg);
+        if (cached[alg] === undefined) {
+            const keyObject = await importJWK({ ...jwk, ext: true }, alg);
             if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
                 throw new JWKSInvalid('JSON Web Key Set members must be public keys');
             }
-            cached[joseHeader.alg] = keyObject;
+            cached[alg] = keyObject;
         }
-        return cached[joseHeader.alg];
+        return cached[alg];
     }
 }
 export function createLocalJWKSet(jwks) {

package/dist/browser/jwks/remote.js

@@ -1,4 +1,5 @@
 import fetchJwks from '../runtime/fetch_jwks.js';
+import { isCloudflareWorkers } from '../runtime/env.js';
 import { JWKSInvalid, JWKSNoMatchingKey } from '../util/errors.js';
 import { isJWKSLike, LocalJWKSet } from './local.js';
 class RemoteJWKSet extends LocalJWKSet {
@@ -39,6 +40,19 @@ class RemoteJWKSet extends LocalJWKSet {
         }
     }
     async reload() {
+        if (this._pendingFetch && isCloudflareWorkers()) {
+            return new Promise((resolve) => {
+                const isDone = () => {
+                    if (this._pendingFetch === undefined) {
+                        resolve();
+                    }
+                    else {
+                        setTimeout(isDone, 5);
+                    }
+                };
+                isDone();
+            });
+        }
         if (!this._pendingFetch) {
             this._pendingFetch = fetchJwks(this._url, this._timeoutDuration, this._options)
                 .then((json) => {

package/dist/browser/util/decode_jwt.js

@@ -0,0 +1,32 @@
+import { decode as base64url } from './base64url.js';
+import { decoder } from '../lib/buffer_utils.js';
+import isObject from '../lib/is_object.js';
+import { JWTInvalid } from './errors.js';
+export function decodeJwt(jwt) {
+    if (typeof jwt !== 'string')
+        throw new JWTInvalid('JWTs must use Compact JWS serialization, JWT must be a string');
+    const { 1: payload, length } = jwt.split('.');
+    if (length === 5)
+        throw new JWTInvalid('Only JWTs using Compact JWS serialization can be decoded');
+    if (length !== 3)
+        throw new JWTInvalid('Invalid JWT');
+    if (!payload)
+        throw new JWTInvalid('JWTs must contain a payload');
+    let decoded;
+    try {
+        decoded = base64url(payload);
+    }
+    catch (_a) {
+        throw new JWTInvalid('Failed to parse the base64url encoded payload');
+    }
+    let result;
+    try {
+        result = JSON.parse(decoder.decode(decoded));
+    }
+    catch (_b) {
+        throw new JWTInvalid('Failed to parse the decoded payload as JSON');
+    }
+    if (!isObject(result))
+        throw new JWTInvalid('Invalid JWT Claims Set');
+    return result;
+}

package/dist/node/cjs/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.base64url = exports.generateSecret = exports.generateKeyPair = exports.errors = exports.decodeProtectedHeader = exports.importJWK = exports.importX509 = exports.importPKCS8 = exports.importSPKI = exports.exportJWK = exports.exportSPKI = exports.exportPKCS8 = exports.UnsecuredJWT = exports.createRemoteJWKSet = exports.createLocalJWKSet = exports.EmbeddedJWK = exports.calculateJwkThumbprint = exports.EncryptJWT = exports.SignJWT = exports.GeneralSign = exports.FlattenedSign = exports.CompactSign = exports.FlattenedEncrypt = exports.CompactEncrypt = exports.jwtDecrypt = exports.jwtVerify = exports.generalVerify = exports.flattenedVerify = exports.compactVerify = exports.GeneralEncrypt = exports.generalDecrypt = exports.flattenedDecrypt = exports.compactDecrypt = void 0;
+exports.base64url = exports.generateSecret = exports.generateKeyPair = exports.errors = exports.decodeJwt = exports.decodeProtectedHeader = exports.importJWK = exports.importX509 = exports.importPKCS8 = exports.importSPKI = exports.exportJWK = exports.exportSPKI = exports.exportPKCS8 = exports.UnsecuredJWT = exports.createRemoteJWKSet = exports.createLocalJWKSet = exports.EmbeddedJWK = exports.calculateJwkThumbprint = exports.EncryptJWT = exports.SignJWT = exports.GeneralSign = exports.FlattenedSign = exports.CompactSign = exports.FlattenedEncrypt = exports.CompactEncrypt = exports.jwtDecrypt = exports.jwtVerify = exports.generalVerify = exports.flattenedVerify = exports.compactVerify = exports.GeneralEncrypt = exports.generalDecrypt = exports.flattenedDecrypt = exports.compactDecrypt = void 0;
 var decrypt_js_1 = require("./jwe/compact/decrypt.js");
 Object.defineProperty(exports, "compactDecrypt", { enumerable: true, get: function () { return decrypt_js_1.compactDecrypt; } });
 var decrypt_js_2 = require("./jwe/flattened/decrypt.js");
@@ -54,6 +54,8 @@ Object.defineProperty(exports, "importX509", { enumerable: true, get: function (
 Object.defineProperty(exports, "importJWK", { enumerable: true, get: function () { return import_js_1.importJWK; } });
 var decode_protected_header_js_1 = require("./util/decode_protected_header.js");
 Object.defineProperty(exports, "decodeProtectedHeader", { enumerable: true, get: function () { return decode_protected_header_js_1.decodeProtectedHeader; } });
+var decode_jwt_js_1 = require("./util/decode_jwt.js");
+Object.defineProperty(exports, "decodeJwt", { enumerable: true, get: function () { return decode_jwt_js_1.decodeJwt; } });
 exports.errors = require("./util/errors.js");
 var generate_key_pair_js_1 = require("./key/generate_key_pair.js");
 Object.defineProperty(exports, "generateKeyPair", { enumerable: true, get: function () { return generate_key_pair_js_1.generateKeyPair; } });

package/dist/node/cjs/jwks/local.js

@@ -42,17 +42,14 @@ class LocalJWKSet {
         this._jwks = clone(jwks);
     }
     async getKey(protectedHeader, token) {
-        const joseHeader = {
-            ...protectedHeader,
-            ...token.header,
-        };
+        const { alg, kid } = { ...protectedHeader, ...token.header };
         const candidates = this._jwks.keys.filter((jwk) => {
-            let candidate = jwk.kty === getKtyFromAlg(joseHeader.alg);
-            if (candidate && typeof joseHeader.kid === 'string') {
-                candidate = joseHeader.kid === jwk.kid;
+            let candidate = jwk.kty === getKtyFromAlg(alg);
+            if (candidate && typeof kid === 'string') {
+                candidate = kid === jwk.kid;
             }
             if (candidate && typeof jwk.alg === 'string') {
-                candidate = joseHeader.alg === jwk.alg;
+                candidate = alg === jwk.alg;
             }
             if (candidate && typeof jwk.use === 'string') {
                 candidate = jwk.use === 'sig';
@@ -60,11 +57,11 @@ class LocalJWKSet {
             if (candidate && Array.isArray(jwk.key_ops)) {
                 candidate = jwk.key_ops.includes('verify');
             }
-            if (candidate && joseHeader.alg === 'EdDSA') {
+            if (candidate && alg === 'EdDSA') {
                 candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
             }
             if (candidate) {
-                switch (joseHeader.alg) {
+                switch (alg) {
                     case 'ES256':
                         candidate = jwk.crv === 'P-256';
                         break;
@@ -77,7 +74,6 @@ class LocalJWKSet {
                     case 'ES512':
                         candidate = jwk.crv === 'P-521';
                         break;
-                    default:
                 }
             }
             return candidate;
@@ -90,14 +86,14 @@ class LocalJWKSet {
             throw new errors_js_1.JWKSMultipleMatchingKeys();
         }
         const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
-        if (cached[joseHeader.alg] === undefined) {
-            const keyObject = await (0, import_js_1.importJWK)({ ...jwk, ext: true }, joseHeader.alg);
+        if (cached[alg] === undefined) {
+            const keyObject = await (0, import_js_1.importJWK)({ ...jwk, ext: true }, alg);
             if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
                 throw new errors_js_1.JWKSInvalid('JSON Web Key Set members must be public keys');
             }
-            cached[joseHeader.alg] = keyObject;
+            cached[alg] = keyObject;
         }
-        return cached[joseHeader.alg];
+        return cached[alg];
     }
 }
 exports.LocalJWKSet = LocalJWKSet;

package/dist/node/cjs/jwks/remote.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createRemoteJWKSet = void 0;
 const fetch_jwks_js_1 = require("../runtime/fetch_jwks.js");
+const env_js_1 = require("../runtime/env.js");
 const errors_js_1 = require("../util/errors.js");
 const local_js_1 = require("./local.js");
 class RemoteJWKSet extends local_js_1.LocalJWKSet {
@@ -42,6 +43,19 @@ class RemoteJWKSet extends local_js_1.LocalJWKSet {
         }
     }
     async reload() {
+        if (this._pendingFetch && (0, env_js_1.isCloudflareWorkers)()) {
+            return new Promise((resolve) => {
+                const isDone = () => {
+                    if (this._pendingFetch === undefined) {
+                        resolve();
+                    }
+                    else {
+                        setTimeout(isDone, 5);
+                    }
+                };
+                isDone();
+            });
+        }
         if (!this._pendingFetch) {
             this._pendingFetch = (0, fetch_jwks_js_1.default)(this._url, this._timeoutDuration, this._options)
                 .then((json) => {

package/dist/node/cjs/runtime/base64url.js

@@ -3,7 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.decode = exports.encode = exports.encodeBase64 = exports.decodeBase64 = void 0;
 const buffer_1 = require("buffer");
 const buffer_utils_js_1 = require("../lib/buffer_utils.js");
-let encodeImpl;
+let encode;
+exports.encode = encode;
 function normalize(input) {
     let encoded = input;
     if (encoded instanceof Uint8Array) {
@@ -12,15 +13,14 @@ function normalize(input) {
     return encoded;
 }
 if (buffer_1.Buffer.isEncoding('base64url')) {
-    encodeImpl = (input) => buffer_1.Buffer.from(input).toString('base64url');
+    exports.encode = encode = (input) => buffer_1.Buffer.from(input).toString('base64url');
 }
 else {
-    encodeImpl = (input) => buffer_1.Buffer.from(input).toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+    exports.encode = encode = (input) => buffer_1.Buffer.from(input).toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
 }
 const decodeBase64 = (input) => buffer_1.Buffer.from(input, 'base64');
 exports.decodeBase64 = decodeBase64;
 const encodeBase64 = (input) => buffer_1.Buffer.from(input).toString('base64');
 exports.encodeBase64 = encodeBase64;
-exports.encode = encodeImpl;
 const decode = (input) => buffer_1.Buffer.from(normalize(input), 'base64');
 exports.decode = decode;

package/dist/node/cjs/util/decode_jwt.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.decodeJwt = void 0;
+const base64url_js_1 = require("./base64url.js");
+const buffer_utils_js_1 = require("../lib/buffer_utils.js");
+const is_object_js_1 = require("../lib/is_object.js");
+const errors_js_1 = require("./errors.js");
+function decodeJwt(jwt) {
+    if (typeof jwt !== 'string')
+        throw new errors_js_1.JWTInvalid('JWTs must use Compact JWS serialization, JWT must be a string');
+    const { 1: payload, length } = jwt.split('.');
+    if (length === 5)
+        throw new errors_js_1.JWTInvalid('Only JWTs using Compact JWS serialization can be decoded');
+    if (length !== 3)
+        throw new errors_js_1.JWTInvalid('Invalid JWT');
+    if (!payload)
+        throw new errors_js_1.JWTInvalid('JWTs must contain a payload');
+    let decoded;
+    try {
+        decoded = (0, base64url_js_1.decode)(payload);
+    }
+    catch {
+        throw new errors_js_1.JWTInvalid('Failed to parse the base64url encoded payload');
+    }
+    let result;
+    try {
+        result = JSON.parse(buffer_utils_js_1.decoder.decode(decoded));
+    }
+    catch {
+        throw new errors_js_1.JWTInvalid('Failed to parse the decoded payload as JSON');
+    }
+    if (!(0, is_object_js_1.default)(result))
+        throw new errors_js_1.JWTInvalid('Invalid JWT Claims Set');
+    return result;
+}
+exports.decodeJwt = decodeJwt;

package/dist/node/esm/index.js

@@ -22,6 +22,7 @@ export { UnsecuredJWT } from './jwt/unsecured.js';
 export { exportPKCS8, exportSPKI, exportJWK } from './key/export.js';
 export { importSPKI, importPKCS8, importX509, importJWK } from './key/import.js';
 export { decodeProtectedHeader } from './util/decode_protected_header.js';
+export { decodeJwt } from './util/decode_jwt.js';
 export * as errors from './util/errors.js';
 export { generateKeyPair } from './key/generate_key_pair.js';
 export { generateSecret } from './key/generate_secret.js';

package/dist/node/esm/jwks/local.js

@@ -38,17 +38,14 @@ export class LocalJWKSet {
         this._jwks = clone(jwks);
     }
     async getKey(protectedHeader, token) {
-        const joseHeader = {
-            ...protectedHeader,
-            ...token.header,
-        };
+        const { alg, kid } = { ...protectedHeader, ...token.header };
         const candidates = this._jwks.keys.filter((jwk) => {
-            let candidate = jwk.kty === getKtyFromAlg(joseHeader.alg);
-            if (candidate && typeof joseHeader.kid === 'string') {
-                candidate = joseHeader.kid === jwk.kid;
+            let candidate = jwk.kty === getKtyFromAlg(alg);
+            if (candidate && typeof kid === 'string') {
+                candidate = kid === jwk.kid;
             }
             if (candidate && typeof jwk.alg === 'string') {
-                candidate = joseHeader.alg === jwk.alg;
+                candidate = alg === jwk.alg;
             }
             if (candidate && typeof jwk.use === 'string') {
                 candidate = jwk.use === 'sig';
@@ -56,11 +53,11 @@ export class LocalJWKSet {
             if (candidate && Array.isArray(jwk.key_ops)) {
                 candidate = jwk.key_ops.includes('verify');
             }
-            if (candidate && joseHeader.alg === 'EdDSA') {
+            if (candidate && alg === 'EdDSA') {
                 candidate = jwk.crv === 'Ed25519' || jwk.crv === 'Ed448';
             }
             if (candidate) {
-                switch (joseHeader.alg) {
+                switch (alg) {
                     case 'ES256':
                         candidate = jwk.crv === 'P-256';
                         break;
@@ -73,7 +70,6 @@ export class LocalJWKSet {
                     case 'ES512':
                         candidate = jwk.crv === 'P-521';
                         break;
-                    default:
                 }
             }
             return candidate;
@@ -86,14 +82,14 @@ export class LocalJWKSet {
             throw new JWKSMultipleMatchingKeys();
         }
         const cached = this._cached.get(jwk) || this._cached.set(jwk, {}).get(jwk);
-        if (cached[joseHeader.alg] === undefined) {
-            const keyObject = await importJWK({ ...jwk, ext: true }, joseHeader.alg);
+        if (cached[alg] === undefined) {
+            const keyObject = await importJWK({ ...jwk, ext: true }, alg);
             if (keyObject instanceof Uint8Array || keyObject.type !== 'public') {
                 throw new JWKSInvalid('JSON Web Key Set members must be public keys');
             }
-            cached[joseHeader.alg] = keyObject;
+            cached[alg] = keyObject;
         }
-        return cached[joseHeader.alg];
+        return cached[alg];
     }
 }
 export function createLocalJWKSet(jwks) {

package/dist/node/esm/jwks/remote.js

@@ -1,4 +1,5 @@
 import fetchJwks from '../runtime/fetch_jwks.js';
+import { isCloudflareWorkers } from '../runtime/env.js';
 import { JWKSInvalid, JWKSNoMatchingKey } from '../util/errors.js';
 import { isJWKSLike, LocalJWKSet } from './local.js';
 class RemoteJWKSet extends LocalJWKSet {
@@ -39,6 +40,19 @@ class RemoteJWKSet extends LocalJWKSet {
         }
     }
     async reload() {
+        if (this._pendingFetch && isCloudflareWorkers()) {
+            return new Promise((resolve) => {
+                const isDone = () => {
+                    if (this._pendingFetch === undefined) {
+                        resolve();
+                    }
+                    else {
+                        setTimeout(isDone, 5);
+                    }
+                };
+                isDone();
+            });
+        }
         if (!this._pendingFetch) {
             this._pendingFetch = fetchJwks(this._url, this._timeoutDuration, this._options)
                 .then((json) => {

package/dist/node/esm/runtime/base64url.js

@@ -1,6 +1,6 @@
 import { Buffer } from 'buffer';
 import { decoder } from '../lib/buffer_utils.js';
-let encodeImpl;
+let encode;
 function normalize(input) {
     let encoded = input;
     if (encoded instanceof Uint8Array) {
@@ -9,12 +9,12 @@ function normalize(input) {
     return encoded;
 }
 if (Buffer.isEncoding('base64url')) {
-    encodeImpl = (input) => Buffer.from(input).toString('base64url');
+    encode = (input) => Buffer.from(input).toString('base64url');
 }
 else {
-    encodeImpl = (input) => Buffer.from(input).toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
+    encode = (input) => Buffer.from(input).toString('base64').replace(/=/g, '').replace(/\+/g, '-').replace(/\//g, '_');
 }
 export const decodeBase64 = (input) => Buffer.from(input, 'base64');
 export const encodeBase64 = (input) => Buffer.from(input).toString('base64');
-export const encode = encodeImpl;
+export { encode };
 export const decode = (input) => Buffer.from(normalize(input), 'base64');

package/dist/node/esm/util/decode_jwt.js

@@ -0,0 +1,32 @@
+import { decode as base64url } from './base64url.js';
+import { decoder } from '../lib/buffer_utils.js';
+import isObject from '../lib/is_object.js';
+import { JWTInvalid } from './errors.js';
+export function decodeJwt(jwt) {
+    if (typeof jwt !== 'string')
+        throw new JWTInvalid('JWTs must use Compact JWS serialization, JWT must be a string');
+    const { 1: payload, length } = jwt.split('.');
+    if (length === 5)
+        throw new JWTInvalid('Only JWTs using Compact JWS serialization can be decoded');
+    if (length !== 3)
+        throw new JWTInvalid('Invalid JWT');
+    if (!payload)
+        throw new JWTInvalid('JWTs must contain a payload');
+    let decoded;
+    try {
+        decoded = base64url(payload);
+    }
+    catch {
+        throw new JWTInvalid('Failed to parse the base64url encoded payload');
+    }
+    let result;
+    try {
+        result = JSON.parse(decoder.decode(decoded));
+    }
+    catch {
+        throw new JWTInvalid('Failed to parse the decoded payload as JSON');
+    }
+    if (!isObject(result))
+        throw new JWTInvalid('Invalid JWT Claims Set');
+    return result;
+}

package/dist/types/index.d.ts

@@ -36,6 +36,7 @@ export { exportPKCS8, exportSPKI, exportJWK } from './key/export';
 export { importSPKI, importPKCS8, importX509, importJWK } from './key/import';
 export type { PEMImportOptions } from './key/import';
 export { decodeProtectedHeader } from './util/decode_protected_header';
+export { decodeJwt } from './util/decode_jwt';
 export type { ProtectedHeaderParameters } from './util/decode_protected_header';
 export * as errors from './util/errors';
 export { generateKeyPair } from './key/generate_key_pair';

package/dist/types/util/decode_jwt.d.ts

@@ -0,0 +1,2 @@
+import type { JWTPayload } from '../types';
+export declare function decodeJwt(jwt: string): JWTPayload;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "4.4.0",
+  "version": "4.5.0",
   "description": "'JSON Web Almost Everything' - JWA, JWS, JWE, JWT, JWK, JWKS with no dependencies using runtime's native crypto",
   "keywords": [
     "browser",