jose 6.0.7 → 6.0.9

package/dist/webapi/index.js

@@ -17,7 +17,7 @@ export { EncryptJWT } from './jwt/encrypt.js';
 export { calculateJwkThumbprint, calculateJwkThumbprintUri } from './jwk/thumbprint.js';
 export { EmbeddedJWK } from './jwk/embedded.js';
 export { createLocalJWKSet } from './jwks/local.js';
-export { createRemoteJWKSet, jwksCache } from './jwks/remote.js';
+export { createRemoteJWKSet, jwksCache, customFetch } from './jwks/remote.js';
 export { UnsecuredJWT } from './jwt/unsecured.js';
 export { exportPKCS8, exportSPKI, exportJWK } from './key/export.js';
 export { importSPKI, importPKCS8, importX509, importJWK } from './key/import.js';

package/dist/webapi/jwe/compact/encrypt.js

@@ -1,27 +1,27 @@
 import { FlattenedEncrypt } from '../flattened/encrypt.js';
 export class CompactEncrypt {
-    _flattened;
+    #flattened;
     constructor(plaintext) {
-        this._flattened = new FlattenedEncrypt(plaintext);
+        this.#flattened = new FlattenedEncrypt(plaintext);
     }
     setContentEncryptionKey(cek) {
-        this._flattened.setContentEncryptionKey(cek);
+        this.#flattened.setContentEncryptionKey(cek);
         return this;
     }
     setInitializationVector(iv) {
-        this._flattened.setInitializationVector(iv);
+        this.#flattened.setInitializationVector(iv);
         return this;
     }
     setProtectedHeader(protectedHeader) {
-        this._flattened.setProtectedHeader(protectedHeader);
+        this.#flattened.setProtectedHeader(protectedHeader);
         return this;
     }
     setKeyManagementParameters(parameters) {
-        this._flattened.setKeyManagementParameters(parameters);
+        this.#flattened.setKeyManagementParameters(parameters);
         return this;
     }
     async encrypt(key, options) {
-        const jwe = await this._flattened.encrypt(key, options);
+        const jwe = await this.#flattened.encrypt(key, options);
         return [jwe.protected, jwe.encrypted_key, jwe.iv, jwe.ciphertext, jwe.tag].join('.');
     }
 }

package/dist/webapi/jwe/flattened/encrypt.js

@@ -9,79 +9,79 @@ import validateCrit from '../../lib/validate_crit.js';
 import normalizeKey from '../../lib/normalize_key.js';
 import checkKeyType from '../../lib/check_key_type.js';
 export class FlattenedEncrypt {
-    _plaintext;
-    _protectedHeader;
-    _sharedUnprotectedHeader;
-    _unprotectedHeader;
-    _aad;
-    _cek;
-    _iv;
-    _keyManagementParameters;
+    #plaintext;
+    #protectedHeader;
+    #sharedUnprotectedHeader;
+    #unprotectedHeader;
+    #aad;
+    #cek;
+    #iv;
+    #keyManagementParameters;
     constructor(plaintext) {
         if (!(plaintext instanceof Uint8Array)) {
             throw new TypeError('plaintext must be an instance of Uint8Array');
         }
-        this._plaintext = plaintext;
+        this.#plaintext = plaintext;
     }
     setKeyManagementParameters(parameters) {
-        if (this._keyManagementParameters) {
+        if (this.#keyManagementParameters) {
             throw new TypeError('setKeyManagementParameters can only be called once');
         }
-        this._keyManagementParameters = parameters;
+        this.#keyManagementParameters = parameters;
         return this;
     }
     setProtectedHeader(protectedHeader) {
-        if (this._protectedHeader) {
+        if (this.#protectedHeader) {
             throw new TypeError('setProtectedHeader can only be called once');
         }
-        this._protectedHeader = protectedHeader;
+        this.#protectedHeader = protectedHeader;
         return this;
     }
     setSharedUnprotectedHeader(sharedUnprotectedHeader) {
-        if (this._sharedUnprotectedHeader) {
+        if (this.#sharedUnprotectedHeader) {
             throw new TypeError('setSharedUnprotectedHeader can only be called once');
         }
-        this._sharedUnprotectedHeader = sharedUnprotectedHeader;
+        this.#sharedUnprotectedHeader = sharedUnprotectedHeader;
         return this;
     }
     setUnprotectedHeader(unprotectedHeader) {
-        if (this._unprotectedHeader) {
+        if (this.#unprotectedHeader) {
             throw new TypeError('setUnprotectedHeader can only be called once');
         }
-        this._unprotectedHeader = unprotectedHeader;
+        this.#unprotectedHeader = unprotectedHeader;
         return this;
     }
     setAdditionalAuthenticatedData(aad) {
-        this._aad = aad;
+        this.#aad = aad;
         return this;
     }
     setContentEncryptionKey(cek) {
-        if (this._cek) {
+        if (this.#cek) {
             throw new TypeError('setContentEncryptionKey can only be called once');
         }
-        this._cek = cek;
+        this.#cek = cek;
         return this;
     }
     setInitializationVector(iv) {
-        if (this._iv) {
+        if (this.#iv) {
             throw new TypeError('setInitializationVector can only be called once');
         }
-        this._iv = iv;
+        this.#iv = iv;
         return this;
     }
     async encrypt(key, options) {
-        if (!this._protectedHeader && !this._unprotectedHeader && !this._sharedUnprotectedHeader) {
+        if (!this.#protectedHeader && !this.#unprotectedHeader && !this.#sharedUnprotectedHeader) {
             throw new JWEInvalid('either setProtectedHeader, setUnprotectedHeader, or sharedUnprotectedHeader must be called before #encrypt()');
         }
-        if (!isDisjoint(this._protectedHeader, this._unprotectedHeader, this._sharedUnprotectedHeader)) {
+        if (!isDisjoint(this.#protectedHeader, this.#unprotectedHeader, this.#sharedUnprotectedHeader)) {
             throw new JWEInvalid('JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint');
         }
         const joseHeader = {
-            ...this._protectedHeader,
-            ...this._unprotectedHeader,
-            ...this._sharedUnprotectedHeader,
+            ...this.#protectedHeader,
+            ...this.#unprotectedHeader,
+            ...this.#sharedUnprotectedHeader,
         };
-        validateCrit(JWEInvalid, new Map(), options?.crit, this._protectedHeader, joseHeader);
+        validateCrit(JWEInvalid, new Map(), options?.crit, this.#protectedHeader, joseHeader);
         if (joseHeader.zip !== undefined) {
             throw new JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');
         }
@@ -93,7 +93,7 @@ export class FlattenedEncrypt {
             throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter missing or invalid');
         }
         let encryptedKey;
-        if (this._cek && (alg === 'dir' || alg === 'ECDH-ES')) {
+        if (this.#cek && (alg === 'dir' || alg === 'ECDH-ES')) {
             throw new TypeError(`setContentEncryptionKey cannot be called with JWE "alg" (Algorithm) Header ${alg}`);
         }
         checkKeyType(alg === 'dir' ? enc : alg, key, 'encrypt');
@@ -101,41 +101,41 @@ export class FlattenedEncrypt {
         {
             let parameters;
             const k = await normalizeKey(key, alg);
-            ({ cek, encryptedKey, parameters } = await encryptKeyManagement(alg, enc, k, this._cek, this._keyManagementParameters));
+            ({ cek, encryptedKey, parameters } = await encryptKeyManagement(alg, enc, k, this.#cek, this.#keyManagementParameters));
             if (parameters) {
                 if (options && unprotected in options) {
-                    if (!this._unprotectedHeader) {
+                    if (!this.#unprotectedHeader) {
                         this.setUnprotectedHeader(parameters);
                     }
                     else {
-                        this._unprotectedHeader = { ...this._unprotectedHeader, ...parameters };
+                        this.#unprotectedHeader = { ...this.#unprotectedHeader, ...parameters };
                     }
                 }
-                else if (!this._protectedHeader) {
+                else if (!this.#protectedHeader) {
                     this.setProtectedHeader(parameters);
                 }
                 else {
-                    this._protectedHeader = { ...this._protectedHeader, ...parameters };
+                    this.#protectedHeader = { ...this.#protectedHeader, ...parameters };
                 }
             }
         }
         let additionalData;
         let protectedHeader;
         let aadMember;
-        if (this._protectedHeader) {
-            protectedHeader = encoder.encode(b64u(JSON.stringify(this._protectedHeader)));
+        if (this.#protectedHeader) {
+            protectedHeader = encoder.encode(b64u(JSON.stringify(this.#protectedHeader)));
         }
         else {
             protectedHeader = encoder.encode('');
         }
-        if (this._aad) {
-            aadMember = b64u(this._aad);
+        if (this.#aad) {
+            aadMember = b64u(this.#aad);
             additionalData = concat(protectedHeader, encoder.encode('.'), encoder.encode(aadMember));
         }
         else {
             additionalData = protectedHeader;
         }
-        const { ciphertext, tag, iv } = await encrypt(enc, this._plaintext, cek, this._iv, additionalData);
+        const { ciphertext, tag, iv } = await encrypt(enc, this.#plaintext, cek, this.#iv, additionalData);
         const jwe = {
             ciphertext: b64u(ciphertext),
         };
@@ -151,14 +151,14 @@ export class FlattenedEncrypt {
         if (aadMember) {
             jwe.aad = aadMember;
         }
-        if (this._protectedHeader) {
+        if (this.#protectedHeader) {
             jwe.protected = decoder.decode(protectedHeader);
         }
-        if (this._sharedUnprotectedHeader) {
-            jwe.unprotected = this._sharedUnprotectedHeader;
+        if (this.#sharedUnprotectedHeader) {
+            jwe.unprotected = this.#sharedUnprotectedHeader;
         }
-        if (this._unprotectedHeader) {
-            jwe.header = this._unprotectedHeader;
+        if (this.#unprotectedHeader) {
+            jwe.header = this.#unprotectedHeader;
         }
         return jwe;
     }

package/dist/webapi/jwe/general/encrypt.js

@@ -9,12 +9,12 @@ import validateCrit from '../../lib/validate_crit.js';
 import normalizeKey from '../../lib/normalize_key.js';
 import checkKeyType from '../../lib/check_key_type.js';
 class IndividualRecipient {
-    parent;
+    #parent;
     unprotectedHeader;
     key;
     options;
     constructor(enc, key, options) {
-        this.parent = enc;
+        this.#parent = enc;
         this.key = key;
         this.options = options;
     }
@@ -26,57 +26,57 @@ class IndividualRecipient {
         return this;
     }
     addRecipient(...args) {
-        return this.parent.addRecipient(...args);
+        return this.#parent.addRecipient(...args);
     }
     encrypt(...args) {
-        return this.parent.encrypt(...args);
+        return this.#parent.encrypt(...args);
     }
     done() {
-        return this.parent;
+        return this.#parent;
     }
 }
 export class GeneralEncrypt {
-    _plaintext;
-    _recipients = [];
-    _protectedHeader;
-    _unprotectedHeader;
-    _aad;
+    #plaintext;
+    #recipients = [];
+    #protectedHeader;
+    #unprotectedHeader;
+    #aad;
     constructor(plaintext) {
-        this._plaintext = plaintext;
+        this.#plaintext = plaintext;
     }
     addRecipient(key, options) {
         const recipient = new IndividualRecipient(this, key, { crit: options?.crit });
-        this._recipients.push(recipient);
+        this.#recipients.push(recipient);
         return recipient;
     }
     setProtectedHeader(protectedHeader) {
-        if (this._protectedHeader) {
+        if (this.#protectedHeader) {
             throw new TypeError('setProtectedHeader can only be called once');
         }
-        this._protectedHeader = protectedHeader;
+        this.#protectedHeader = protectedHeader;
         return this;
     }
     setSharedUnprotectedHeader(sharedUnprotectedHeader) {
-        if (this._unprotectedHeader) {
+        if (this.#unprotectedHeader) {
             throw new TypeError('setSharedUnprotectedHeader can only be called once');
         }
-        this._unprotectedHeader = sharedUnprotectedHeader;
+        this.#unprotectedHeader = sharedUnprotectedHeader;
         return this;
     }
     setAdditionalAuthenticatedData(aad) {
-        this._aad = aad;
+        this.#aad = aad;
         return this;
     }
     async encrypt() {
-        if (!this._recipients.length) {
+        if (!this.#recipients.length) {
             throw new JWEInvalid('at least one recipient must be added');
         }
-        if (this._recipients.length === 1) {
-            const [recipient] = this._recipients;
-            const flattened = await new FlattenedEncrypt(this._plaintext)
-                .setAdditionalAuthenticatedData(this._aad)
-                .setProtectedHeader(this._protectedHeader)
-                .setSharedUnprotectedHeader(this._unprotectedHeader)
+        if (this.#recipients.length === 1) {
+            const [recipient] = this.#recipients;
+            const flattened = await new FlattenedEncrypt(this.#plaintext)
+                .setAdditionalAuthenticatedData(this.#aad)
+                .setProtectedHeader(this.#protectedHeader)
+                .setSharedUnprotectedHeader(this.#unprotectedHeader)
                 .setUnprotectedHeader(recipient.unprotectedHeader)
                 .encrypt(recipient.key, { ...recipient.options });
             const jwe = {
@@ -98,14 +98,14 @@ export class GeneralEncrypt {
             return jwe;
         }
         let enc;
-        for (let i = 0; i < this._recipients.length; i++) {
-            const recipient = this._recipients[i];
-            if (!isDisjoint(this._protectedHeader, this._unprotectedHeader, recipient.unprotectedHeader)) {
+        for (let i = 0; i < this.#recipients.length; i++) {
+            const recipient = this.#recipients[i];
+            if (!isDisjoint(this.#protectedHeader, this.#unprotectedHeader, recipient.unprotectedHeader)) {
                 throw new JWEInvalid('JWE Protected, JWE Shared Unprotected and JWE Per-Recipient Header Parameter names must be disjoint');
             }
             const joseHeader = {
-                ...this._protectedHeader,
-                ...this._unprotectedHeader,
+                ...this.#protectedHeader,
+                ...this.#unprotectedHeader,
                 ...recipient.unprotectedHeader,
             };
             const { alg } = joseHeader;
@@ -124,7 +124,7 @@ export class GeneralEncrypt {
             else if (enc !== joseHeader.enc) {
                 throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');
             }
-            validateCrit(JWEInvalid, new Map(), recipient.options.crit, this._protectedHeader, joseHeader);
+            validateCrit(JWEInvalid, new Map(), recipient.options.crit, this.#protectedHeader, joseHeader);
             if (joseHeader.zip !== undefined) {
                 throw new JOSENotSupported('JWE "zip" (Compression Algorithm) Header Parameter is not supported.');
             }
@@ -136,22 +136,22 @@ export class GeneralEncrypt {
             recipients: [],
             tag: '',
         };
-        for (let i = 0; i < this._recipients.length; i++) {
-            const recipient = this._recipients[i];
+        for (let i = 0; i < this.#recipients.length; i++) {
+            const recipient = this.#recipients[i];
             const target = {};
             jwe.recipients.push(target);
             const joseHeader = {
-                ...this._protectedHeader,
-                ...this._unprotectedHeader,
+                ...this.#protectedHeader,
+                ...this.#unprotectedHeader,
                 ...recipient.unprotectedHeader,
             };
             const p2c = joseHeader.alg.startsWith('PBES2') ? 2048 + i : undefined;
             if (i === 0) {
-                const flattened = await new FlattenedEncrypt(this._plaintext)
-                    .setAdditionalAuthenticatedData(this._aad)
+                const flattened = await new FlattenedEncrypt(this.#plaintext)
+                    .setAdditionalAuthenticatedData(this.#aad)
                     .setContentEncryptionKey(cek)
-                    .setProtectedHeader(this._protectedHeader)
-                    .setSharedUnprotectedHeader(this._unprotectedHeader)
+                    .setProtectedHeader(this.#protectedHeader)
+                    .setSharedUnprotectedHeader(this.#unprotectedHeader)
                     .setUnprotectedHeader(recipient.unprotectedHeader)
                     .setKeyManagementParameters({ p2c })
                     .encrypt(recipient.key, {
@@ -173,8 +173,8 @@ export class GeneralEncrypt {
                 continue;
             }
             const alg = recipient.unprotectedHeader?.alg ||
-                this._protectedHeader?.alg ||
-                this._unprotectedHeader?.alg;
+                this.#protectedHeader?.alg ||
+                this.#unprotectedHeader?.alg;
             checkKeyType(alg === 'dir' ? enc : alg, recipient.key, 'encrypt');
             const k = await normalizeKey(recipient.key, alg);
             const { encryptedKey, parameters } = await encryptKeyManagement(alg, enc, k, cek, { p2c });

package/dist/webapi/jwks/local.js

@@ -23,25 +23,22 @@ function isJWKSLike(jwks) {
 function isJWKLike(key) {
     return isObject(key);
 }
-function clone(obj) {
-    if (typeof structuredClone === 'function') {
-        return structuredClone(obj);
-    }
-    return JSON.parse(JSON.stringify(obj));
-}
 class LocalJWKSet {
-    _jwks;
-    _cached = new WeakMap();
+    #jwks;
+    #cached = new WeakMap();
     constructor(jwks) {
         if (!isJWKSLike(jwks)) {
             throw new JWKSInvalid('JSON Web Key Set malformed');
         }
-        this._jwks = clone(jwks);
+        this.#jwks = structuredClone(jwks);
+    }
+    jwks() {
+        return this.#jwks;
     }
     async getKey(protectedHeader, token) {
         const { alg, kid } = { ...protectedHeader, ...token?.header };
         const kty = getKtyFromAlg(alg);
-        const candidates = this._jwks.keys.filter((jwk) => {
+        const candidates = this.#jwks.keys.filter((jwk) => {
             let candidate = kty === jwk.kty;
             if (candidate && typeof kid === 'string') {
                 candidate = kid === jwk.kid;
@@ -80,7 +77,7 @@ class LocalJWKSet {
         }
         if (length !== 1) {
             const error = new JWKSMultipleMatchingKeys();
-            const { _cached } = this;
+            const _cached = this.#cached;
             error[Symbol.asyncIterator] = async function* () {
                 for (const jwk of candidates) {
                     try {
@@ -91,7 +88,7 @@ class LocalJWKSet {
             };
             throw error;
         }
-        return importWithAlgCache(this._cached, jwk, alg);
+        return importWithAlgCache(this.#cached, jwk, alg);
     }
 }
 async function importWithAlgCache(cache, jwk, alg) {
@@ -110,8 +107,8 @@ export function createLocalJWKSet(jwks) {
     const localJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
     Object.defineProperties(localJWKSet, {
         jwks: {
-            value: () => clone(set._jwks),
-            enumerable: true,
+            value: () => structuredClone(set.jwks()),
+            enumerable: false,
             configurable: false,
             writable: false,
         },

package/dist/webapi/jwks/remote.js

@@ -9,7 +9,7 @@ function isCloudflareWorkers() {
 let USER_AGENT;
 if (typeof navigator === 'undefined' || !navigator.userAgent?.startsWith?.('Mozilla/5.0 ')) {
     const NAME = 'jose';
-    const VERSION = 'v6.0.7';
+    const VERSION = 'v6.0.9';
     USER_AGENT = `${NAME}/${VERSION}`;
 }
 export const customFetch = Symbol();
@@ -52,89 +52,95 @@ function isFreshJwksCache(input, cacheMaxAge) {
     return true;
 }
 class RemoteJWKSet {
-    _url;
-    _timeoutDuration;
-    _cooldownDuration;
-    _cacheMaxAge;
-    _jwksTimestamp;
-    _pendingFetch;
-    _headers;
-    [customFetch];
-    _local;
-    _cache;
+    #url;
+    #timeoutDuration;
+    #cooldownDuration;
+    #cacheMaxAge;
+    #jwksTimestamp;
+    #pendingFetch;
+    #headers;
+    #customFetch;
+    #local;
+    #cache;
     constructor(url, options) {
         if (!(url instanceof URL)) {
             throw new TypeError('url must be an instance of URL');
         }
-        this._url = new URL(url.href);
-        this._timeoutDuration =
+        this.#url = new URL(url.href);
+        this.#timeoutDuration =
             typeof options?.timeoutDuration === 'number' ? options?.timeoutDuration : 5000;
-        this._cooldownDuration =
+        this.#cooldownDuration =
             typeof options?.cooldownDuration === 'number' ? options?.cooldownDuration : 30000;
-        this._cacheMaxAge = typeof options?.cacheMaxAge === 'number' ? options?.cacheMaxAge : 600000;
-        this._headers = new Headers(options?.headers);
-        if (USER_AGENT && !this._headers.has('User-Agent')) {
-            this._headers.set('User-Agent', USER_AGENT);
+        this.#cacheMaxAge = typeof options?.cacheMaxAge === 'number' ? options?.cacheMaxAge : 600000;
+        this.#headers = new Headers(options?.headers);
+        if (USER_AGENT && !this.#headers.has('User-Agent')) {
+            this.#headers.set('User-Agent', USER_AGENT);
         }
-        if (!this._headers.has('accept')) {
-            this._headers.set('accept', 'application/json');
-            this._headers.append('accept', 'application/jwk-set+json');
+        if (!this.#headers.has('accept')) {
+            this.#headers.set('accept', 'application/json');
+            this.#headers.append('accept', 'application/jwk-set+json');
         }
-        this[customFetch] = options?.[customFetch];
+        this.#customFetch = options?.[customFetch];
         if (options?.[jwksCache] !== undefined) {
-            this._cache = options?.[jwksCache];
-            if (isFreshJwksCache(options?.[jwksCache], this._cacheMaxAge)) {
-                this._jwksTimestamp = this._cache.uat;
-                this._local = createLocalJWKSet(this._cache.jwks);
+            this.#cache = options?.[jwksCache];
+            if (isFreshJwksCache(options?.[jwksCache], this.#cacheMaxAge)) {
+                this.#jwksTimestamp = this.#cache.uat;
+                this.#local = createLocalJWKSet(this.#cache.jwks);
             }
         }
     }
+    pendingFetch() {
+        return !!this.#pendingFetch;
+    }
     coolingDown() {
-        return typeof this._jwksTimestamp === 'number'
-            ? Date.now() < this._jwksTimestamp + this._cooldownDuration
+        return typeof this.#jwksTimestamp === 'number'
+            ? Date.now() < this.#jwksTimestamp + this.#cooldownDuration
             : false;
     }
     fresh() {
-        return typeof this._jwksTimestamp === 'number'
-            ? Date.now() < this._jwksTimestamp + this._cacheMaxAge
+        return typeof this.#jwksTimestamp === 'number'
+            ? Date.now() < this.#jwksTimestamp + this.#cacheMaxAge
             : false;
     }
+    jwks() {
+        return this.#local?.jwks();
+    }
     async getKey(protectedHeader, token) {
-        if (!this._local || !this.fresh()) {
+        if (!this.#local || !this.fresh()) {
             await this.reload();
         }
         try {
-            return await this._local(protectedHeader, token);
+            return await this.#local(protectedHeader, token);
         }
         catch (err) {
             if (err instanceof JWKSNoMatchingKey) {
                 if (this.coolingDown() === false) {
                     await this.reload();
-                    return this._local(protectedHeader, token);
+                    return this.#local(protectedHeader, token);
                 }
             }
             throw err;
         }
     }
     async reload() {
-        if (this._pendingFetch && isCloudflareWorkers()) {
-            this._pendingFetch = undefined;
+        if (this.#pendingFetch && isCloudflareWorkers()) {
+            this.#pendingFetch = undefined;
         }
-        this._pendingFetch ||= fetchJwks(this._url.href, this._headers, AbortSignal.timeout(this._timeoutDuration), this[customFetch])
+        this.#pendingFetch ||= fetchJwks(this.#url.href, this.#headers, AbortSignal.timeout(this.#timeoutDuration), this.#customFetch)
             .then((json) => {
-            this._local = createLocalJWKSet(json);
-            if (this._cache) {
-                this._cache.uat = Date.now();
-                this._cache.jwks = json;
+            this.#local = createLocalJWKSet(json);
+            if (this.#cache) {
+                this.#cache.uat = Date.now();
+                this.#cache.jwks = json;
             }
-            this._jwksTimestamp = Date.now();
-            this._pendingFetch = undefined;
+            this.#jwksTimestamp = Date.now();
+            this.#pendingFetch = undefined;
         })
             .catch((err) => {
-            this._pendingFetch = undefined;
+            this.#pendingFetch = undefined;
             throw err;
         });
-        await this._pendingFetch;
+        await this.#pendingFetch;
     }
 }
 export function createRemoteJWKSet(url, options) {
@@ -158,12 +164,12 @@ export function createRemoteJWKSet(url, options) {
             writable: false,
         },
         reloading: {
-            get: () => !!set._pendingFetch,
+            get: () => set.pendingFetch(),
             enumerable: true,
             configurable: false,
         },
         jwks: {
-            value: () => set._local?.jwks(),
+            value: () => set.jwks(),
             enumerable: true,
             configurable: false,
             writable: false,

package/dist/webapi/jws/compact/sign.js

@@ -1,15 +1,15 @@
 import { FlattenedSign } from '../flattened/sign.js';
 export class CompactSign {
-    _flattened;
+    #flattened;
     constructor(payload) {
-        this._flattened = new FlattenedSign(payload);
+        this.#flattened = new FlattenedSign(payload);
     }
     setProtectedHeader(protectedHeader) {
-        this._flattened.setProtectedHeader(protectedHeader);
+        this.#flattened.setProtectedHeader(protectedHeader);
         return this;
     }
     async sign(key, options) {
-        const jws = await this._flattened.sign(key, options);
+        const jws = await this.#flattened.sign(key, options);
         if (jws.payload === undefined) {
             throw new TypeError('use the flattened module for creating JWS with b64: false');
         }