jose 5.2.4 → 5.4.0

package/dist/browser/jwe/flattened/encrypt.js

@@ -99,13 +99,11 @@ export class FlattenedEncrypt {
                         this._unprotectedHeader = { ...this._unprotectedHeader, ...parameters };
                     }
                 }
+                else if (!this._protectedHeader) {
+                    this.setProtectedHeader(parameters);
+                }
                 else {
-                    if (!this._protectedHeader) {
-                        this.setProtectedHeader(parameters);
-                    }
-                    else {
-                        this._protectedHeader = { ...this._protectedHeader, ...parameters };
-                    }
+                    this._protectedHeader = { ...this._protectedHeader, ...parameters };
                 }
             }
         }

package/dist/browser/jwks/local.js

@@ -108,5 +108,14 @@ async function importWithAlgCache(cache, jwk, alg) {
 }
 export function createLocalJWKSet(jwks) {
     const set = new LocalJWKSet(jwks);
-    return async (protectedHeader, token) => set.getKey(protectedHeader, token);
+    const localJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
+    Object.defineProperties(localJWKSet, {
+        jwks: {
+            value: () => clone(set._jwks),
+            enumerable: true,
+            configurable: false,
+            writable: false,
+        },
+    });
+    return localJWKSet;
 }

package/dist/browser/jwks/remote.js

@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.2.4';
+    const VERSION = 'v5.4.0';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 class RemoteJWKSet {
@@ -76,5 +76,35 @@ class RemoteJWKSet {
 }
 export function createRemoteJWKSet(url, options) {
     const set = new RemoteJWKSet(url, options);
-    return async (protectedHeader, token) => set.getKey(protectedHeader, token);
+    const remoteJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
+    Object.defineProperties(remoteJWKSet, {
+        coolingDown: {
+            get: () => set.coolingDown(),
+            enumerable: true,
+            configurable: false,
+        },
+        fresh: {
+            get: () => set.fresh(),
+            enumerable: true,
+            configurable: false,
+        },
+        reload: {
+            value: () => set.reload(),
+            enumerable: true,
+            configurable: false,
+            writable: false,
+        },
+        reloading: {
+            get: () => !!set._pendingFetch,
+            enumerable: true,
+            configurable: false,
+        },
+        jwks: {
+            value: () => set._local?.jwks(),
+            enumerable: true,
+            configurable: false,
+            writable: false,
+        },
+    });
+    return remoteJWKSet;
 }

package/dist/browser/jwt/decrypt.js

@@ -6,14 +6,14 @@ export async function jwtDecrypt(jwt, key, options) {
     const payload = jwtPayload(decrypted.protectedHeader, decrypted.plaintext, options);
     const { protectedHeader } = decrypted;
     if (protectedHeader.iss !== undefined && protectedHeader.iss !== payload.iss) {
-        throw new JWTClaimValidationFailed('replicated "iss" claim header parameter mismatch', 'iss', 'mismatch');
+        throw new JWTClaimValidationFailed('replicated "iss" claim header parameter mismatch', payload, 'iss', 'mismatch');
     }
     if (protectedHeader.sub !== undefined && protectedHeader.sub !== payload.sub) {
-        throw new JWTClaimValidationFailed('replicated "sub" claim header parameter mismatch', 'sub', 'mismatch');
+        throw new JWTClaimValidationFailed('replicated "sub" claim header parameter mismatch', payload, 'sub', 'mismatch');
     }
     if (protectedHeader.aud !== undefined &&
         JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud)) {
-        throw new JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch', 'aud', 'mismatch');
+        throw new JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch', payload, 'aud', 'mismatch');
     }
     const result = { payload, protectedHeader };
     if (typeof key === 'function') {

package/dist/browser/lib/jwt_claims_set.js

@@ -14,12 +14,6 @@ const checkAudiencePresence = (audPayload, audOption) => {
     return false;
 };
 export default (protectedHeader, encodedPayload, options = {}) => {
-    const { typ } = options;
-    if (typ &&
-        (typeof protectedHeader.typ !== 'string' ||
-            normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
-        throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', 'typ', 'check_failed');
-    }
     let payload;
     try {
         payload = JSON.parse(decoder.decode(encodedPayload));
@@ -29,6 +23,12 @@ export default (protectedHeader, encodedPayload, options = {}) => {
     if (!isObject(payload)) {
         throw new JWTInvalid('JWT Claims Set must be a top-level JSON object');
     }
+    const { typ } = options;
+    if (typ &&
+        (typeof protectedHeader.typ !== 'string' ||
+            normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
+        throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, 'typ', 'check_failed');
+    }
     const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
     const presenceCheck = [...requiredClaims];
     if (maxTokenAge !== undefined)
@@ -41,18 +41,18 @@ export default (protectedHeader, encodedPayload, options = {}) => {
         presenceCheck.push('iss');
     for (const claim of new Set(presenceCheck.reverse())) {
         if (!(claim in payload)) {
-            throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, claim, 'missing');
+            throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, 'missing');
         }
     }
     if (issuer && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {
-        throw new JWTClaimValidationFailed('unexpected "iss" claim value', 'iss', 'check_failed');
+        throw new JWTClaimValidationFailed('unexpected "iss" claim value', payload, 'iss', 'check_failed');
     }
     if (subject && payload.sub !== subject) {
-        throw new JWTClaimValidationFailed('unexpected "sub" claim value', 'sub', 'check_failed');
+        throw new JWTClaimValidationFailed('unexpected "sub" claim value', payload, 'sub', 'check_failed');
     }
     if (audience &&
         !checkAudiencePresence(payload.aud, typeof audience === 'string' ? [audience] : audience)) {
-        throw new JWTClaimValidationFailed('unexpected "aud" claim value', 'aud', 'check_failed');
+        throw new JWTClaimValidationFailed('unexpected "aud" claim value', payload, 'aud', 'check_failed');
     }
     let tolerance;
     switch (typeof options.clockTolerance) {
@@ -71,32 +71,32 @@ export default (protectedHeader, encodedPayload, options = {}) => {
     const { currentDate } = options;
     const now = epoch(currentDate || new Date());
     if ((payload.iat !== undefined || maxTokenAge) && typeof payload.iat !== 'number') {
-        throw new JWTClaimValidationFailed('"iat" claim must be a number', 'iat', 'invalid');
+        throw new JWTClaimValidationFailed('"iat" claim must be a number', payload, 'iat', 'invalid');
     }
     if (payload.nbf !== undefined) {
         if (typeof payload.nbf !== 'number') {
-            throw new JWTClaimValidationFailed('"nbf" claim must be a number', 'nbf', 'invalid');
+            throw new JWTClaimValidationFailed('"nbf" claim must be a number', payload, 'nbf', 'invalid');
         }
         if (payload.nbf > now + tolerance) {
-            throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', 'nbf', 'check_failed');
+            throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, 'nbf', 'check_failed');
         }
     }
     if (payload.exp !== undefined) {
         if (typeof payload.exp !== 'number') {
-            throw new JWTClaimValidationFailed('"exp" claim must be a number', 'exp', 'invalid');
+            throw new JWTClaimValidationFailed('"exp" claim must be a number', payload, 'exp', 'invalid');
         }
         if (payload.exp <= now - tolerance) {
-            throw new JWTExpired('"exp" claim timestamp check failed', 'exp', 'check_failed');
+            throw new JWTExpired('"exp" claim timestamp check failed', payload, 'exp', 'check_failed');
         }
     }
     if (maxTokenAge) {
         const age = now - payload.iat;
         const max = typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge);
         if (age - tolerance > max) {
-            throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', 'iat', 'check_failed');
+            throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, 'iat', 'check_failed');
         }
         if (age < 0 - tolerance) {
-            throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', 'iat', 'check_failed');
+            throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, 'iat', 'check_failed');
         }
     }
     return payload;

package/dist/browser/util/errors.js

@@ -13,22 +13,24 @@ export class JWTClaimValidationFailed extends JOSEError {
     static get code() {
         return 'ERR_JWT_CLAIM_VALIDATION_FAILED';
     }
-    constructor(message, claim = 'unspecified', reason = 'unspecified') {
+    constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {
         super(message);
         this.code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
         this.claim = claim;
         this.reason = reason;
+        this.payload = payload;
     }
 }
 export class JWTExpired extends JOSEError {
     static get code() {
         return 'ERR_JWT_EXPIRED';
     }
-    constructor(message, claim = 'unspecified', reason = 'unspecified') {
+    constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {
         super(message);
         this.code = 'ERR_JWT_EXPIRED';
         this.claim = claim;
         this.reason = reason;
+        this.payload = payload;
     }
 }
 export class JOSEAlgNotAllowed extends JOSEError {

package/dist/node/cjs/jwe/flattened/encrypt.js

@@ -110,13 +110,11 @@ class FlattenedEncrypt {
                         this._unprotectedHeader = { ...this._unprotectedHeader, ...parameters };
                     }
                 }
+                else if (!this._protectedHeader) {
+                    this.setProtectedHeader(parameters);
+                }
                 else {
-                    if (!this._protectedHeader) {
-                        this.setProtectedHeader(parameters);
-                    }
-                    else {
-                        this._protectedHeader = { ...this._protectedHeader, ...parameters };
-                    }
+                    this._protectedHeader = { ...this._protectedHeader, ...parameters };
                 }
             }
         }

package/dist/node/cjs/jwks/local.js

@@ -113,6 +113,15 @@ async function importWithAlgCache(cache, jwk, alg) {
 }
 function createLocalJWKSet(jwks) {
     const set = new LocalJWKSet(jwks);
-    return async (protectedHeader, token) => set.getKey(protectedHeader, token);
+    const localJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
+    Object.defineProperties(localJWKSet, {
+        jwks: {
+            value: () => clone(set._jwks),
+            enumerable: true,
+            configurable: false,
+            writable: false,
+        },
+    });
+    return localJWKSet;
 }
 exports.createLocalJWKSet = createLocalJWKSet;

package/dist/node/cjs/jwks/remote.js

@@ -12,7 +12,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.2.4';
+    const VERSION = 'v5.4.0';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 class RemoteJWKSet {
@@ -87,6 +87,36 @@ class RemoteJWKSet {
 }
 function createRemoteJWKSet(url, options) {
     const set = new RemoteJWKSet(url, options);
-    return async (protectedHeader, token) => set.getKey(protectedHeader, token);
+    const remoteJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
+    Object.defineProperties(remoteJWKSet, {
+        coolingDown: {
+            get: () => set.coolingDown(),
+            enumerable: true,
+            configurable: false,
+        },
+        fresh: {
+            get: () => set.fresh(),
+            enumerable: true,
+            configurable: false,
+        },
+        reload: {
+            value: () => set.reload(),
+            enumerable: true,
+            configurable: false,
+            writable: false,
+        },
+        reloading: {
+            get: () => !!set._pendingFetch,
+            enumerable: true,
+            configurable: false,
+        },
+        jwks: {
+            value: () => set._local?.jwks(),
+            enumerable: true,
+            configurable: false,
+            writable: false,
+        },
+    });
+    return remoteJWKSet;
 }
 exports.createRemoteJWKSet = createRemoteJWKSet;

package/dist/node/cjs/jwt/decrypt.js

@@ -9,14 +9,14 @@ async function jwtDecrypt(jwt, key, options) {
     const payload = (0, jwt_claims_set_js_1.default)(decrypted.protectedHeader, decrypted.plaintext, options);
     const { protectedHeader } = decrypted;
     if (protectedHeader.iss !== undefined && protectedHeader.iss !== payload.iss) {
-        throw new errors_js_1.JWTClaimValidationFailed('replicated "iss" claim header parameter mismatch', 'iss', 'mismatch');
+        throw new errors_js_1.JWTClaimValidationFailed('replicated "iss" claim header parameter mismatch', payload, 'iss', 'mismatch');
     }
     if (protectedHeader.sub !== undefined && protectedHeader.sub !== payload.sub) {
-        throw new errors_js_1.JWTClaimValidationFailed('replicated "sub" claim header parameter mismatch', 'sub', 'mismatch');
+        throw new errors_js_1.JWTClaimValidationFailed('replicated "sub" claim header parameter mismatch', payload, 'sub', 'mismatch');
     }
     if (protectedHeader.aud !== undefined &&
         JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud)) {
-        throw new errors_js_1.JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch', 'aud', 'mismatch');
+        throw new errors_js_1.JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch', payload, 'aud', 'mismatch');
     }
     const result = { payload, protectedHeader };
     if (typeof key === 'function') {

package/dist/node/cjs/lib/jwt_claims_set.js

@@ -16,12 +16,6 @@ const checkAudiencePresence = (audPayload, audOption) => {
     return false;
 };
 exports.default = (protectedHeader, encodedPayload, options = {}) => {
-    const { typ } = options;
-    if (typ &&
-        (typeof protectedHeader.typ !== 'string' ||
-            normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
-        throw new errors_js_1.JWTClaimValidationFailed('unexpected "typ" JWT header value', 'typ', 'check_failed');
-    }
     let payload;
     try {
         payload = JSON.parse(buffer_utils_js_1.decoder.decode(encodedPayload));
@@ -31,6 +25,12 @@ exports.default = (protectedHeader, encodedPayload, options = {}) => {
     if (!(0, is_object_js_1.default)(payload)) {
         throw new errors_js_1.JWTInvalid('JWT Claims Set must be a top-level JSON object');
     }
+    const { typ } = options;
+    if (typ &&
+        (typeof protectedHeader.typ !== 'string' ||
+            normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
+        throw new errors_js_1.JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, 'typ', 'check_failed');
+    }
     const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
     const presenceCheck = [...requiredClaims];
     if (maxTokenAge !== undefined)
@@ -43,18 +43,18 @@ exports.default = (protectedHeader, encodedPayload, options = {}) => {
         presenceCheck.push('iss');
     for (const claim of new Set(presenceCheck.reverse())) {
         if (!(claim in payload)) {
-            throw new errors_js_1.JWTClaimValidationFailed(`missing required "${claim}" claim`, claim, 'missing');
+            throw new errors_js_1.JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, 'missing');
         }
     }
     if (issuer && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {
-        throw new errors_js_1.JWTClaimValidationFailed('unexpected "iss" claim value', 'iss', 'check_failed');
+        throw new errors_js_1.JWTClaimValidationFailed('unexpected "iss" claim value', payload, 'iss', 'check_failed');
     }
     if (subject && payload.sub !== subject) {
-        throw new errors_js_1.JWTClaimValidationFailed('unexpected "sub" claim value', 'sub', 'check_failed');
+        throw new errors_js_1.JWTClaimValidationFailed('unexpected "sub" claim value', payload, 'sub', 'check_failed');
     }
     if (audience &&
         !checkAudiencePresence(payload.aud, typeof audience === 'string' ? [audience] : audience)) {
-        throw new errors_js_1.JWTClaimValidationFailed('unexpected "aud" claim value', 'aud', 'check_failed');
+        throw new errors_js_1.JWTClaimValidationFailed('unexpected "aud" claim value', payload, 'aud', 'check_failed');
     }
     let tolerance;
     switch (typeof options.clockTolerance) {
@@ -73,32 +73,32 @@ exports.default = (protectedHeader, encodedPayload, options = {}) => {
     const { currentDate } = options;
     const now = (0, epoch_js_1.default)(currentDate || new Date());
     if ((payload.iat !== undefined || maxTokenAge) && typeof payload.iat !== 'number') {
-        throw new errors_js_1.JWTClaimValidationFailed('"iat" claim must be a number', 'iat', 'invalid');
+        throw new errors_js_1.JWTClaimValidationFailed('"iat" claim must be a number', payload, 'iat', 'invalid');
     }
     if (payload.nbf !== undefined) {
         if (typeof payload.nbf !== 'number') {
-            throw new errors_js_1.JWTClaimValidationFailed('"nbf" claim must be a number', 'nbf', 'invalid');
+            throw new errors_js_1.JWTClaimValidationFailed('"nbf" claim must be a number', payload, 'nbf', 'invalid');
         }
         if (payload.nbf > now + tolerance) {
-            throw new errors_js_1.JWTClaimValidationFailed('"nbf" claim timestamp check failed', 'nbf', 'check_failed');
+            throw new errors_js_1.JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, 'nbf', 'check_failed');
         }
     }
     if (payload.exp !== undefined) {
         if (typeof payload.exp !== 'number') {
-            throw new errors_js_1.JWTClaimValidationFailed('"exp" claim must be a number', 'exp', 'invalid');
+            throw new errors_js_1.JWTClaimValidationFailed('"exp" claim must be a number', payload, 'exp', 'invalid');
         }
         if (payload.exp <= now - tolerance) {
-            throw new errors_js_1.JWTExpired('"exp" claim timestamp check failed', 'exp', 'check_failed');
+            throw new errors_js_1.JWTExpired('"exp" claim timestamp check failed', payload, 'exp', 'check_failed');
         }
     }
     if (maxTokenAge) {
         const age = now - payload.iat;
         const max = typeof maxTokenAge === 'number' ? maxTokenAge : (0, secs_js_1.default)(maxTokenAge);
         if (age - tolerance > max) {
-            throw new errors_js_1.JWTExpired('"iat" claim timestamp check failed (too far in the past)', 'iat', 'check_failed');
+            throw new errors_js_1.JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, 'iat', 'check_failed');
         }
         if (age < 0 - tolerance) {
-            throw new errors_js_1.JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', 'iat', 'check_failed');
+            throw new errors_js_1.JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, 'iat', 'check_failed');
         }
     }
     return payload;

package/dist/node/cjs/util/errors.js

@@ -20,10 +20,12 @@ class JWTClaimValidationFailed extends JOSEError {
     code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
     claim;
     reason;
-    constructor(message, claim = 'unspecified', reason = 'unspecified') {
+    payload;
+    constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {
         super(message);
         this.claim = claim;
         this.reason = reason;
+        this.payload = payload;
     }
 }
 exports.JWTClaimValidationFailed = JWTClaimValidationFailed;
@@ -34,10 +36,12 @@ class JWTExpired extends JOSEError {
     code = 'ERR_JWT_EXPIRED';
     claim;
     reason;
-    constructor(message, claim = 'unspecified', reason = 'unspecified') {
+    payload;
+    constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {
         super(message);
         this.claim = claim;
         this.reason = reason;
+        this.payload = payload;
     }
 }
 exports.JWTExpired = JWTExpired;

package/dist/node/esm/jwe/flattened/encrypt.js

@@ -107,13 +107,11 @@ export class FlattenedEncrypt {
                         this._unprotectedHeader = { ...this._unprotectedHeader, ...parameters };
                     }
                 }
+                else if (!this._protectedHeader) {
+                    this.setProtectedHeader(parameters);
+                }
                 else {
-                    if (!this._protectedHeader) {
-                        this.setProtectedHeader(parameters);
-                    }
-                    else {
-                        this._protectedHeader = { ...this._protectedHeader, ...parameters };
-                    }
+                    this._protectedHeader = { ...this._protectedHeader, ...parameters };
                 }
             }
         }

package/dist/node/esm/jwks/local.js

@@ -109,5 +109,14 @@ async function importWithAlgCache(cache, jwk, alg) {
 }
 export function createLocalJWKSet(jwks) {
     const set = new LocalJWKSet(jwks);
-    return async (protectedHeader, token) => set.getKey(protectedHeader, token);
+    const localJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
+    Object.defineProperties(localJWKSet, {
+        jwks: {
+            value: () => clone(set._jwks),
+            enumerable: true,
+            configurable: false,
+            writable: false,
+        },
+    });
+    return localJWKSet;
 }

package/dist/node/esm/jwks/remote.js

@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v5.2.4';
+    const VERSION = 'v5.4.0';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 class RemoteJWKSet {
@@ -84,5 +84,35 @@ class RemoteJWKSet {
 }
 export function createRemoteJWKSet(url, options) {
     const set = new RemoteJWKSet(url, options);
-    return async (protectedHeader, token) => set.getKey(protectedHeader, token);
+    const remoteJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
+    Object.defineProperties(remoteJWKSet, {
+        coolingDown: {
+            get: () => set.coolingDown(),
+            enumerable: true,
+            configurable: false,
+        },
+        fresh: {
+            get: () => set.fresh(),
+            enumerable: true,
+            configurable: false,
+        },
+        reload: {
+            value: () => set.reload(),
+            enumerable: true,
+            configurable: false,
+            writable: false,
+        },
+        reloading: {
+            get: () => !!set._pendingFetch,
+            enumerable: true,
+            configurable: false,
+        },
+        jwks: {
+            value: () => set._local?.jwks(),
+            enumerable: true,
+            configurable: false,
+            writable: false,
+        },
+    });
+    return remoteJWKSet;
 }

package/dist/node/esm/jwt/decrypt.js

@@ -6,14 +6,14 @@ export async function jwtDecrypt(jwt, key, options) {
     const payload = jwtPayload(decrypted.protectedHeader, decrypted.plaintext, options);
     const { protectedHeader } = decrypted;
     if (protectedHeader.iss !== undefined && protectedHeader.iss !== payload.iss) {
-        throw new JWTClaimValidationFailed('replicated "iss" claim header parameter mismatch', 'iss', 'mismatch');
+        throw new JWTClaimValidationFailed('replicated "iss" claim header parameter mismatch', payload, 'iss', 'mismatch');
     }
     if (protectedHeader.sub !== undefined && protectedHeader.sub !== payload.sub) {
-        throw new JWTClaimValidationFailed('replicated "sub" claim header parameter mismatch', 'sub', 'mismatch');
+        throw new JWTClaimValidationFailed('replicated "sub" claim header parameter mismatch', payload, 'sub', 'mismatch');
     }
     if (protectedHeader.aud !== undefined &&
         JSON.stringify(protectedHeader.aud) !== JSON.stringify(payload.aud)) {
-        throw new JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch', 'aud', 'mismatch');
+        throw new JWTClaimValidationFailed('replicated "aud" claim header parameter mismatch', payload, 'aud', 'mismatch');
     }
     const result = { payload, protectedHeader };
     if (typeof key === 'function') {

package/dist/node/esm/lib/jwt_claims_set.js

@@ -14,12 +14,6 @@ const checkAudiencePresence = (audPayload, audOption) => {
     return false;
 };
 export default (protectedHeader, encodedPayload, options = {}) => {
-    const { typ } = options;
-    if (typ &&
-        (typeof protectedHeader.typ !== 'string' ||
-            normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
-        throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', 'typ', 'check_failed');
-    }
     let payload;
     try {
         payload = JSON.parse(decoder.decode(encodedPayload));
@@ -29,6 +23,12 @@ export default (protectedHeader, encodedPayload, options = {}) => {
     if (!isObject(payload)) {
         throw new JWTInvalid('JWT Claims Set must be a top-level JSON object');
     }
+    const { typ } = options;
+    if (typ &&
+        (typeof protectedHeader.typ !== 'string' ||
+            normalizeTyp(protectedHeader.typ) !== normalizeTyp(typ))) {
+        throw new JWTClaimValidationFailed('unexpected "typ" JWT header value', payload, 'typ', 'check_failed');
+    }
     const { requiredClaims = [], issuer, subject, audience, maxTokenAge } = options;
     const presenceCheck = [...requiredClaims];
     if (maxTokenAge !== undefined)
@@ -41,18 +41,18 @@ export default (protectedHeader, encodedPayload, options = {}) => {
         presenceCheck.push('iss');
     for (const claim of new Set(presenceCheck.reverse())) {
         if (!(claim in payload)) {
-            throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, claim, 'missing');
+            throw new JWTClaimValidationFailed(`missing required "${claim}" claim`, payload, claim, 'missing');
         }
     }
     if (issuer && !(Array.isArray(issuer) ? issuer : [issuer]).includes(payload.iss)) {
-        throw new JWTClaimValidationFailed('unexpected "iss" claim value', 'iss', 'check_failed');
+        throw new JWTClaimValidationFailed('unexpected "iss" claim value', payload, 'iss', 'check_failed');
     }
     if (subject && payload.sub !== subject) {
-        throw new JWTClaimValidationFailed('unexpected "sub" claim value', 'sub', 'check_failed');
+        throw new JWTClaimValidationFailed('unexpected "sub" claim value', payload, 'sub', 'check_failed');
     }
     if (audience &&
         !checkAudiencePresence(payload.aud, typeof audience === 'string' ? [audience] : audience)) {
-        throw new JWTClaimValidationFailed('unexpected "aud" claim value', 'aud', 'check_failed');
+        throw new JWTClaimValidationFailed('unexpected "aud" claim value', payload, 'aud', 'check_failed');
     }
     let tolerance;
     switch (typeof options.clockTolerance) {
@@ -71,32 +71,32 @@ export default (protectedHeader, encodedPayload, options = {}) => {
     const { currentDate } = options;
     const now = epoch(currentDate || new Date());
     if ((payload.iat !== undefined || maxTokenAge) && typeof payload.iat !== 'number') {
-        throw new JWTClaimValidationFailed('"iat" claim must be a number', 'iat', 'invalid');
+        throw new JWTClaimValidationFailed('"iat" claim must be a number', payload, 'iat', 'invalid');
     }
     if (payload.nbf !== undefined) {
         if (typeof payload.nbf !== 'number') {
-            throw new JWTClaimValidationFailed('"nbf" claim must be a number', 'nbf', 'invalid');
+            throw new JWTClaimValidationFailed('"nbf" claim must be a number', payload, 'nbf', 'invalid');
         }
         if (payload.nbf > now + tolerance) {
-            throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', 'nbf', 'check_failed');
+            throw new JWTClaimValidationFailed('"nbf" claim timestamp check failed', payload, 'nbf', 'check_failed');
         }
     }
     if (payload.exp !== undefined) {
         if (typeof payload.exp !== 'number') {
-            throw new JWTClaimValidationFailed('"exp" claim must be a number', 'exp', 'invalid');
+            throw new JWTClaimValidationFailed('"exp" claim must be a number', payload, 'exp', 'invalid');
         }
         if (payload.exp <= now - tolerance) {
-            throw new JWTExpired('"exp" claim timestamp check failed', 'exp', 'check_failed');
+            throw new JWTExpired('"exp" claim timestamp check failed', payload, 'exp', 'check_failed');
         }
     }
     if (maxTokenAge) {
         const age = now - payload.iat;
         const max = typeof maxTokenAge === 'number' ? maxTokenAge : secs(maxTokenAge);
         if (age - tolerance > max) {
-            throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', 'iat', 'check_failed');
+            throw new JWTExpired('"iat" claim timestamp check failed (too far in the past)', payload, 'iat', 'check_failed');
         }
         if (age < 0 - tolerance) {
-            throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', 'iat', 'check_failed');
+            throw new JWTClaimValidationFailed('"iat" claim timestamp check failed (it should be in the past)', payload, 'iat', 'check_failed');
         }
     }
     return payload;

package/dist/node/esm/util/errors.js

@@ -16,10 +16,12 @@ export class JWTClaimValidationFailed extends JOSEError {
     code = 'ERR_JWT_CLAIM_VALIDATION_FAILED';
     claim;
     reason;
-    constructor(message, claim = 'unspecified', reason = 'unspecified') {
+    payload;
+    constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {
         super(message);
         this.claim = claim;
         this.reason = reason;
+        this.payload = payload;
     }
 }
 export class JWTExpired extends JOSEError {
@@ -29,10 +31,12 @@ export class JWTExpired extends JOSEError {
     code = 'ERR_JWT_EXPIRED';
     claim;
     reason;
-    constructor(message, claim = 'unspecified', reason = 'unspecified') {
+    payload;
+    constructor(message, payload, claim = 'unspecified', reason = 'unspecified') {
         super(message);
         this.claim = claim;
         this.reason = reason;
+        this.payload = payload;
     }
 }
 export class JOSEAlgNotAllowed extends JOSEError {

package/dist/types/jwks/local.d.ts

@@ -1,7 +1,7 @@
 import type { KeyLike, JWSHeaderParameters, JSONWebKeySet, FlattenedJWSInput } from '../types';
 /** @private */
 export declare class LocalJWKSet<KeyLikeType extends KeyLike = KeyLike> {
-    protected _jwks?: JSONWebKeySet;
+    private _jwks?;
     private _cached;
     constructor(jwks: unknown);
     getKey(protectedHeader?: JWSHeaderParameters, token?: FlattenedJWSInput): Promise<KeyLikeType>;

package/dist/types/jwks/remote.d.ts

@@ -1,4 +1,4 @@
-import type { KeyLike, JWSHeaderParameters, FlattenedJWSInput } from '../types';
+import type { KeyLike, JWSHeaderParameters, FlattenedJWSInput, JSONWebKeySet } from '../types';
 /** Options for the remote JSON Web Key Set. */
 export interface RemoteJWKSetOptions {
     /**
@@ -53,4 +53,16 @@ export interface RemoteJWKSetOptions {
  * @param url URL to fetch the JSON Web Key Set from.
  * @param options Options for the remote JSON Web Key Set.
  */
-export declare function createRemoteJWKSet<KeyLikeType extends KeyLike = KeyLike>(url: URL, options?: RemoteJWKSetOptions): (protectedHeader?: JWSHeaderParameters, token?: FlattenedJWSInput) => Promise<KeyLikeType>;
+export declare function createRemoteJWKSet<KeyLikeType extends KeyLike = KeyLike>(url: URL, options?: RemoteJWKSetOptions): {
+    (protectedHeader?: JWSHeaderParameters, token?: FlattenedJWSInput): Promise<KeyLikeType>;
+    /** @ignore */
+    coolingDown: boolean;
+    /** @ignore */
+    fresh: boolean;
+    /** @ignore */
+    reloading: boolean;
+    /** @ignore */
+    reload: () => Promise<void>;
+    /** @ignore */
+    jwks: () => JSONWebKeySet | undefined;
+};

package/dist/types/util/errors.d.ts

@@ -1,4 +1,4 @@
-import type { KeyLike } from '../types';
+import type { JWTPayload, KeyLike } from '../types';
 /**
  * A generic Error that all other JOSE specific Error subclasses extend.
  *
@@ -27,8 +27,10 @@ export declare class JWTClaimValidationFailed extends JOSEError {
     claim: string;
     /** Reason code for the validation failure. */
     reason: string;
+    /** The parsed JWT payload. */
+    payload: JWTPayload;
     /** @ignore */
-    constructor(message: string, claim?: string, reason?: string);
+    constructor(message: string, payload: JWTPayload, claim?: string, reason?: string);
 }
 /**
  * An error subclass thrown when a JWT is expired.
@@ -42,8 +44,10 @@ export declare class JWTExpired extends JOSEError implements JWTClaimValidationF
     claim: string;
     /** Reason code for the validation failure. */
     reason: string;
+    /** The parsed JWT payload. */
+    payload: JWTPayload;
     /** @ignore */
-    constructor(message: string, claim?: string, reason?: string);
+    constructor(message: string, payload: JWTPayload, claim?: string, reason?: string);
 }
 /**
  * An error subclass thrown when a JOSE Algorithm is not allowed per developer preference.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jose",
-  "version": "5.2.4",
+  "version": "5.4.0",
   "description": "JWA, JWS, JWE, JWT, JWK, JWKS for Node.js, Browser, Cloudflare Workers, Deno, Bun, and other Web-interoperable runtimes",
   "keywords": [
     "browser",