jose 6.2.9 → 6.2.11

package/dist/webapi/jwe/general/encrypt.js

@@ -1,170 +1,129 @@
-import { FlattenedEncrypt } from '../flattened/encrypt.js';
-import { assertNotSet } from '../../lib/helpers.js';
-import { JWEInvalid } from '../../util/errors.js';
-import { generateCek } from '../../lib/content_encryption.js';
-import { encryptKeyManagement } from '../../lib/key_management.js';
-import { encode as b64u } from '../../util/base64url.js';
-import { validateCritDuplicates } from '../../lib/options.js';
-import { checkDisjoint, checkEncryptHeaders, encryptJWE } from '../../lib/jwe_encrypt.js';
-import { prepareKey } from '../../lib/key.js';
-import { jweAlgorithm } from '../../lib/jwe_algorithms.js';
+import { assertNotSet } from "../../lib/helpers.js";
+import { JWEInvalid } from "../../util/errors.js";
+import { generateCek } from "../../lib/content_encryption.js";
+import { encode as b64u } from "../../util/base64url.js";
+import { checkDisjoint, checkEncryptHeaders, createJWE, encryptJWE, transportCek } from "../../lib/jwe_encrypt.js";
+import { JWE, isJWECEKTransport, jweAlgorithm } from "../../lib/jwe_algorithms.js";
+import { assertUint8Array } from "../../lib/type_checks.js";
 class IndividualRecipient {
-    #parent;
-    state;
-    constructor(enc, key, crit) {
-        this.#parent = enc;
-        this.state = [undefined, undefined, key, crit];
-    }
-    setUnprotectedHeader(unprotectedHeader) {
-        assertNotSet(this.state[0], 'setUnprotectedHeader');
-        this.state[0] = unprotectedHeader;
-        return this;
-    }
-    setKeyManagementParameters(parameters) {
-        assertNotSet(this.state[1], 'setKeyManagementParameters');
-        this.state[1] = parameters;
-        return this;
-    }
-    addRecipient(...args) {
-        return this.#parent.addRecipient(...args);
-    }
-    encrypt(...args) {
-        return this.#parent.encrypt(...args);
-    }
-    done() {
-        return this.#parent;
-    }
+  #parent;
+  state;
+  constructor(enc, key, crit) {
+    this.#parent = enc, this.state = [void 0, void 0, key, crit];
+  }
+  setUnprotectedHeader(unprotectedHeader) {
+    return assertNotSet(this.state[0], "setUnprotectedHeader"), this.state[0] = unprotectedHeader, this;
+  }
+  setKeyManagementParameters(parameters) {
+    return assertNotSet(this.state[1], "setKeyManagementParameters"), this.state[1] = parameters, this;
+  }
+  addRecipient(...args) {
+    return this.#parent.addRecipient(...args);
+  }
+  encrypt(...args) {
+    return this.#parent.encrypt(...args);
+  }
+  done() {
+    return this.#parent;
+  }
 }
 function copyOptionalMembers(flattened, jwe, recipient) {
-    const { aad, protected: protectedHeader, unprotected, header } = flattened;
-    if (aad)
-        jwe.aad = aad;
-    if (protectedHeader)
-        jwe.protected = protectedHeader;
-    if (unprotected)
-        jwe.unprotected = unprotected;
-    if (header)
-        recipient.header = header;
+  const { aad, protected: protectedHeader, unprotected, header } = flattened;
+  aad && (jwe.aad = aad), protectedHeader && (jwe.protected = protectedHeader), unprotected && (jwe.unprotected = unprotected), header && (recipient.header = header);
 }
-export class GeneralEncrypt {
-    #plaintext;
-    #recipients = [];
-    #protectedHeader;
-    #unprotectedHeader;
-    #aad;
-    constructor(plaintext) {
-        this.#plaintext = plaintext;
-    }
-    addRecipient(key, options) {
-        const recipient = new IndividualRecipient(this, key, options?.crit);
-        this.#recipients.push(recipient);
-        return recipient;
-    }
-    setProtectedHeader(protectedHeader) {
-        assertNotSet(this.#protectedHeader, 'setProtectedHeader');
-        this.#protectedHeader = protectedHeader;
-        return this;
-    }
-    setSharedUnprotectedHeader(sharedUnprotectedHeader) {
-        assertNotSet(this.#unprotectedHeader, 'setSharedUnprotectedHeader');
-        this.#unprotectedHeader = sharedUnprotectedHeader;
-        return this;
+class GeneralEncrypt {
+  #plaintext;
+  #recipients = [];
+  #protectedHeader;
+  #unprotectedHeader;
+  #aad;
+  constructor(plaintext) {
+    this.#plaintext = plaintext;
+  }
+  addRecipient(key, options) {
+    const recipient = new IndividualRecipient(this, key, options?.crit);
+    return this.#recipients.push(recipient), recipient;
+  }
+  setProtectedHeader(protectedHeader) {
+    return assertNotSet(this.#protectedHeader, "setProtectedHeader"), this.#protectedHeader = protectedHeader, this;
+  }
+  setSharedUnprotectedHeader(sharedUnprotectedHeader) {
+    return assertNotSet(this.#unprotectedHeader, "setSharedUnprotectedHeader"), this.#unprotectedHeader = sharedUnprotectedHeader, this;
+  }
+  setAdditionalAuthenticatedData(aad) {
+    return this.#aad = aad, this;
+  }
+  async encrypt() {
+    if (!this.#recipients.length)
+      throw new JWEInvalid("at least one recipient must be added");
+    if (assertUint8Array(this.#plaintext, "plaintext"), this.#recipients.length === 1) {
+      const [unprotectedHeader, keyManagementParameters, key, crit] = this.#recipients[0].state, flattened = await createJWE([
+        this.#plaintext,
+        this.#protectedHeader,
+        unprotectedHeader,
+        this.#unprotectedHeader,
+        this.#aad,
+        void 0,
+        void 0,
+        keyManagementParameters,
+        crit,
+        !1
+      ], key), jwe2 = {
+        ciphertext: flattened.ciphertext,
+        recipients: [{}]
+      };
+      return flattened.iv && (jwe2.iv = flattened.iv), flattened.tag && (jwe2.tag = flattened.tag), flattened.encrypted_key && (jwe2.recipients[0].encrypted_key = flattened.encrypted_key), copyOptionalMembers(flattened, jwe2, jwe2.recipients[0]), jwe2;
     }
-    setAdditionalAuthenticatedData(aad) {
-        this.#aad = aad;
-        return this;
+    let enc, protectedHeader = this.#protectedHeader, sharedUnprotectedHeader = this.#unprotectedHeader;
+    const inputs = [], checked = [];
+    for (let i = 0; i < this.#recipients.length; i++) {
+      const recipient = this.#recipients[i], [unprotectedHeader, keyManagementParameters, , crit] = recipient.state, input = [
+        this.#plaintext,
+        protectedHeader,
+        unprotectedHeader,
+        sharedUnprotectedHeader,
+        this.#aad,
+        void 0,
+        void 0,
+        keyManagementParameters,
+        crit,
+        !0
+      ], headers = checkEncryptHeaders(input);
+      inputs.push(input), checked.push(headers), i === 0 && (protectedHeader = input[1], sharedUnprotectedHeader = input[3]);
+      const algEntry = JWE[headers[1]];
+      if (algEntry && !isJWECEKTransport(algEntry))
+        throw new JWEInvalid(`"${headers[1]}" alg may only have a single recipient`);
+      if (!enc)
+        enc = headers[2];
+      else if (enc !== headers[2])
+        throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');
     }
-    async encrypt() {
-        if (!this.#recipients.length) {
-            throw new JWEInvalid('at least one recipient must be added');
-        }
-        if (!(this.#plaintext instanceof Uint8Array)) {
-            throw new TypeError('plaintext must be an instance of Uint8Array');
-        }
-        if (this.#recipients.length === 1) {
-            const [recipient] = this.#recipients;
-            const [unprotectedHeader, keyManagementParameters, key, crit] = recipient.state;
-            const flattened = await new FlattenedEncrypt(this.#plaintext)
-                .setAdditionalAuthenticatedData(this.#aad)
-                .setProtectedHeader(this.#protectedHeader)
-                .setSharedUnprotectedHeader(this.#unprotectedHeader)
-                .setUnprotectedHeader(unprotectedHeader)
-                .setKeyManagementParameters(keyManagementParameters)
-                .encrypt(key, { crit });
-            const jwe = {
-                ciphertext: flattened.ciphertext,
-                iv: flattened.iv,
-                recipients: [{}],
-                tag: flattened.tag,
-            };
-            if (flattened.encrypted_key)
-                jwe.recipients[0].encrypted_key = flattened.encrypted_key;
-            copyOptionalMembers(flattened, jwe, jwe.recipients[0]);
-            return jwe;
-        }
-        validateCritDuplicates(JWEInvalid, this.#protectedHeader);
-        let enc;
-        const inputs = [];
-        const checked = [];
-        for (let i = 0; i < this.#recipients.length; i++) {
-            const recipient = this.#recipients[i];
-            const [unprotectedHeader, keyManagementParameters, , crit] = recipient.state;
-            const input = [
-                this.#plaintext,
-                this.#protectedHeader,
-                unprotectedHeader,
-                this.#unprotectedHeader,
-                this.#aad,
-                undefined,
-                undefined,
-                keyManagementParameters,
-                crit,
-                true,
-            ];
-            const headers = checkEncryptHeaders(input);
-            inputs.push(input);
-            checked.push(headers);
-            if (headers[1] === 'dir' || headers[1] === 'ECDH-ES') {
-                throw new JWEInvalid(`"${headers[1]}" alg may only have a single recipient`);
-            }
-            if (!enc) {
-                enc = headers[2];
-            }
-            else if (enc !== headers[2]) {
-                throw new JWEInvalid('JWE "enc" (Encryption Algorithm) Header Parameter must be the same for all recipients');
-            }
-        }
-        const cek = generateCek(checked[0][3]);
-        const jwe = {
-            ciphertext: '',
-            recipients: [],
-        };
-        for (let i = 0; i < this.#recipients.length; i++) {
-            const recipient = this.#recipients[i];
-            const [unprotectedHeader, keyManagementParameters, key] = recipient.state;
-            const target = {};
-            jwe.recipients.push(target);
-            if (i === 0) {
-                inputs[0][5] = cek;
-                const flattened = await encryptJWE(inputs[0], checked[0], key);
-                jwe.ciphertext = flattened.ciphertext;
-                jwe.iv = flattened.iv;
-                jwe.tag = flattened.tag;
-                target.encrypted_key = flattened.encrypted_key;
-                copyOptionalMembers(flattened, jwe, target);
-                continue;
-            }
-            const [, alg, , encEntry] = checked[i];
-            const k = await prepareKey(jweAlgorithm(alg), key, 'encrypt');
-            const [, encryptedKey, parameters] = await encryptKeyManagement(alg, encEntry, k, cek, keyManagementParameters);
-            target.encrypted_key = b64u(encryptedKey);
-            if (unprotectedHeader || parameters) {
-                const header = { ...unprotectedHeader, ...parameters };
-                if (parameters)
-                    checkDisjoint(this.#protectedHeader, header, this.#unprotectedHeader);
-                target.header = header;
-            }
-        }
-        return jwe;
+    const algEntries = checked.map(([, alg]) => {
+      const algEntry = jweAlgorithm(alg);
+      if (!isJWECEKTransport(algEntry))
+        throw new JWEInvalid(`"${alg}" alg may only have a single recipient`);
+      return algEntry;
+    }), cek = generateCek(checked[0][3]), jwe = {
+      ciphertext: "",
+      recipients: []
+    };
+    for (let i = 0; i < this.#recipients.length; i++) {
+      const recipient = this.#recipients[i], [, keyManagementParameters, key] = recipient.state, target = {};
+      if (jwe.recipients.push(target), i === 0) {
+        inputs[0][5] = cek;
+        const flattened = await encryptJWE(inputs[0], checked[0], key, algEntries[0]);
+        jwe.ciphertext = flattened.ciphertext, flattened.iv && (jwe.iv = flattened.iv), flattened.tag && (jwe.tag = flattened.tag), flattened.encrypted_key && (target.encrypted_key = flattened.encrypted_key), copyOptionalMembers(flattened, jwe, target);
+        continue;
+      }
+      const [joseHeader, , , encEntry] = checked[i], unprotectedHeader = inputs[i][2], [, encryptedKey, parameters] = await transportCek(algEntries[i], encEntry, key, cek, joseHeader, keyManagementParameters);
+      if (target.encrypted_key = b64u(encryptedKey), unprotectedHeader || parameters) {
+        const header = { ...unprotectedHeader, ...parameters };
+        parameters && checkDisjoint(inputs[i][1], header, inputs[i][3]), target.header = header;
+      }
     }
+    return jwe;
+  }
 }
+export {
+  GeneralEncrypt
+};

package/dist/webapi/jwk/embedded.js

@@ -1,19 +1,31 @@
-import { jwkToKey } from '../lib/jwk_to_key.js';
-import { jwsAlgorithm } from '../lib/jws_algorithms.js';
-import { isObject } from '../lib/type_checks.js';
-import { JWSInvalid } from '../util/errors.js';
-export async function EmbeddedJWK(protectedHeader, token) {
-    const joseHeader = {
-        ...protectedHeader,
-        ...token?.header,
-    };
-    if (!isObject(joseHeader.jwk)) {
-        throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');
-    }
-    const entry = jwsAlgorithm(joseHeader.alg);
-    const key = await jwkToKey(entry, { ...joseHeader.jwk, ext: true });
-    if (key.type !== 'public') {
-        throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
-    }
-    return key;
+import { jwkToKey } from "../lib/jwk_to_key.js";
+import { jwsAlgorithm } from "../lib/jws_algorithms.js";
+import { isObject } from "../lib/type_checks.js";
+import { JWSInvalid } from "../util/errors.js";
+import { normalizeJwk } from "../lib/jwk_metadata.js";
+async function EmbeddedJWK(protectedHeader, token) {
+  const joseHeader = {
+    ...protectedHeader,
+    ...token?.header
+  };
+  if (!isObject(joseHeader.jwk))
+    throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a JSON object');
+  let jwk;
+  try {
+    jwk = normalizeJwk(joseHeader.jwk);
+  } catch (cause) {
+    throw new JWSInvalid("Invalid Embedded JWK", { cause });
+  }
+  const entry = jwsAlgorithm(joseHeader.alg);
+  if (jwk.use !== void 0 && jwk.use !== "sig")
+    throw new JWSInvalid('Invalid Embedded JWK, its "use" must be "sig" when present');
+  if (jwk.alg !== void 0 && jwk.alg !== entry.alg)
+    throw new JWSInvalid(`Invalid Embedded JWK, its "alg" must be "${entry.alg}" when present`);
+  const key = await jwkToKey(entry, { ...jwk, ext: !0 });
+  if (key.type !== "public")
+    throw new JWSInvalid('"jwk" (JSON Web Key) Header Parameter must be a public key');
+  return key;
 }
+export {
+  EmbeddedJWK
+};

package/dist/webapi/jwk/thumbprint.js

@@ -1,68 +1,58 @@
-import { digest } from '../lib/helpers.js';
-import { encode as b64u } from '../util/base64url.js';
-import { JOSENotSupported, JWKInvalid } from '../util/errors.js';
-import { encode } from '../lib/buffer_utils.js';
-import { isKeyLike } from '../lib/is_key_like.js';
-import { isJWK } from '../lib/type_checks.js';
-import { exportJWK } from '../key/export.js';
-import { invalidKeyInput } from '../lib/invalid_key_input.js';
+import { digest } from "../lib/helpers.js";
+import { encode as b64u } from "../util/base64url.js";
+import { JOSENotSupported, JWKInvalid } from "../util/errors.js";
+import { encode } from "../lib/buffer_utils.js";
+import { isKeyLike } from "../lib/is_key_like.js";
+import { isObject } from "../lib/type_checks.js";
+import { exportJWK } from "../key/export.js";
+import { invalidKeyInput } from "../lib/invalid_key_input.js";
+import { snapshotJwk } from "../lib/jwk_metadata.js";
 const check = (value, description) => {
-    if (typeof value !== 'string' || !value) {
-        throw new JWKInvalid(`${description} missing or invalid`);
-    }
+  if (typeof value != "string" || !value)
+    throw new JWKInvalid(`${description} missing or invalid`);
 };
-export async function calculateJwkThumbprint(key, digestAlgorithm) {
-    let jwk;
-    if (isJWK(key)) {
-        jwk = key;
-    }
-    else if (isKeyLike(key)) {
-        jwk = await exportJWK(key);
-    }
-    else {
-        throw new TypeError(invalidKeyInput(key, 'CryptoKey', 'KeyObject', 'JSON Web Key'));
-    }
-    digestAlgorithm ??= 'sha256';
-    if (digestAlgorithm !== 'sha256' &&
-        digestAlgorithm !== 'sha384' &&
-        digestAlgorithm !== 'sha512') {
-        throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');
-    }
-    let components;
-    switch (jwk.kty) {
-        case 'AKP':
-            check(jwk.alg, '"alg" (Algorithm) Parameter');
-            check(jwk.pub, '"pub" (Public key) Parameter');
-            components = { alg: jwk.alg, kty: jwk.kty, pub: jwk.pub };
-            break;
-        case 'EC':
-            check(jwk.crv, '"crv" (Curve) Parameter');
-            check(jwk.x, '"x" (X Coordinate) Parameter');
-            check(jwk.y, '"y" (Y Coordinate) Parameter');
-            components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y };
-            break;
-        case 'OKP':
-            check(jwk.crv, '"crv" (Subtype of Key Pair) Parameter');
-            check(jwk.x, '"x" (Public Key) Parameter');
-            components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x };
-            break;
-        case 'RSA':
-            check(jwk.e, '"e" (Exponent) Parameter');
-            check(jwk.n, '"n" (Modulus) Parameter');
-            components = { e: jwk.e, kty: jwk.kty, n: jwk.n };
-            break;
-        case 'oct':
-            check(jwk.k, '"k" (Key Value) Parameter');
-            components = { k: jwk.k, kty: jwk.kty };
-            break;
-        default:
-            throw new JOSENotSupported('"kty" (Key Type) Parameter missing or unsupported');
-    }
-    const data = encode(JSON.stringify(components));
-    return b64u(await digest(digestAlgorithm, data));
+async function calculateJwkThumbprint(key, digestAlgorithm) {
+  let jwk;
+  if (isObject(key)) {
+    if (jwk = snapshotJwk(key), typeof jwk.kty != "string")
+      throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
+  } else if (isKeyLike(key))
+    jwk = snapshotJwk(await exportJWK(key));
+  else
+    throw new TypeError(invalidKeyInput(key, "CryptoKey", "KeyObject", "JSON Web Key"));
+  if (digestAlgorithm ??= "sha256", digestAlgorithm !== "sha256" && digestAlgorithm !== "sha384" && digestAlgorithm !== "sha512")
+    throw new TypeError('digestAlgorithm must one of "sha256", "sha384", or "sha512"');
+  let components;
+  switch (jwk.kty) {
+    case "AKP":
+      check(jwk.alg, '"alg" (Algorithm) Parameter'), check(jwk.pub, '"pub" (Public key) Parameter'), components = { alg: jwk.alg, kty: jwk.kty, pub: jwk.pub };
+      break;
+    case "EC":
+      check(jwk.crv, '"crv" (Curve) Parameter'), check(jwk.x, '"x" (X Coordinate) Parameter'), check(jwk.y, '"y" (Y Coordinate) Parameter'), components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x, y: jwk.y };
+      break;
+    case "OKP":
+      check(jwk.crv, '"crv" (Subtype of Key Pair) Parameter'), check(jwk.x, '"x" (Public Key) Parameter'), components = { crv: jwk.crv, kty: jwk.kty, x: jwk.x };
+      break;
+    case "RSA":
+      check(jwk.e, '"e" (Exponent) Parameter'), check(jwk.n, '"n" (Modulus) Parameter'), components = { e: jwk.e, kty: jwk.kty, n: jwk.n };
+      break;
+    case "oct":
+      if (typeof jwk.k != "string")
+        throw new JWKInvalid('"k" (Key Value) Parameter missing or invalid');
+      components = { k: jwk.k, kty: jwk.kty };
+      break;
+    default:
+      throw new JOSENotSupported('"kty" (Key Type) Parameter missing or unsupported');
+  }
+  const data = encode(JSON.stringify(components));
+  return b64u(await digest(digestAlgorithm, data));
 }
-export async function calculateJwkThumbprintUri(key, digestAlgorithm) {
-    digestAlgorithm ??= 'sha256';
-    const thumbprint = await calculateJwkThumbprint(key, digestAlgorithm);
-    return `urn:ietf:params:oauth:jwk-thumbprint:sha-${digestAlgorithm.slice(-3)}:${thumbprint}`;
+async function calculateJwkThumbprintUri(key, digestAlgorithm) {
+  digestAlgorithm ??= "sha256";
+  const thumbprint = await calculateJwkThumbprint(key, digestAlgorithm);
+  return `urn:ietf:params:oauth:jwk-thumbprint:sha-${digestAlgorithm.slice(-3)}:${thumbprint}`;
 }
+export {
+  calculateJwkThumbprint,
+  calculateJwkThumbprintUri
+};

package/dist/webapi/jwks/local.js

@@ -1,78 +1,53 @@
-import { jwkToKey } from '../lib/jwk_to_key.js';
-import { JWS } from '../lib/jws_algorithms.js';
-import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys, } from '../util/errors.js';
-import { isObject } from '../lib/type_checks.js';
-function signatureAlgorithm(alg) {
-    const entry = typeof alg === 'string' ? JWS[alg] : undefined;
-    if (!entry || entry.secret) {
-        throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
-    }
-    return entry;
-}
-function isJWKSLike(jwks) {
-    if (!jwks || typeof jwks !== 'object') {
-        return false;
-    }
-    const { keys } = jwks;
-    return Array.isArray(keys) && keys.every((isObject));
-}
-class LocalJWKSetImpl {
-    #jwks;
-    #cached = new WeakMap();
-    constructor(jwks) {
-        if (!isJWKSLike(jwks)) {
-            throw new JWKSInvalid('JSON Web Key Set malformed');
-        }
-        this.#jwks = structuredClone(jwks);
-    }
-    jwks() {
-        return this.#jwks;
-    }
-    async getKey(protectedHeader, token) {
-        const { alg, kid } = { ...protectedHeader, ...token?.header };
-        const entry = signatureAlgorithm(alg);
-        const candidates = this.#jwks.keys.filter((jwk) => entry.kty.includes(jwk.kty) &&
-            (typeof kid !== 'string' || kid === jwk.kid) &&
-            (!(typeof jwk.alg === 'string' || jwk.kty === 'AKP') || alg === jwk.alg) &&
-            (typeof jwk.use !== 'string' || jwk.use === 'sig') &&
-            (!Array.isArray(jwk.key_ops) || jwk.key_ops.includes('verify')) &&
-            (!entry.crv || jwk.crv === entry.crv));
-        const { 0: jwk, length } = candidates;
-        if (length === 0) {
-            throw new JWKSNoMatchingKey();
-        }
-        if (length !== 1) {
-            const error = new JWKSMultipleMatchingKeys();
-            const _cached = this.#cached;
-            error[Symbol.asyncIterator] = async function* () {
-                for (const jwk of candidates) {
-                    try {
-                        yield await importWithAlgCache(_cached, jwk, entry);
-                    }
-                    catch { }
-                }
-            };
-            throw error;
-        }
-        return importWithAlgCache(this.#cached, jwk, entry);
-    }
+import { jwkToKey } from "../lib/jwk_to_key.js";
+import { JWS } from "../lib/jws_algorithms.js";
+import { JWKSInvalid, JOSENotSupported, JWKSNoMatchingKey, JWKSMultipleMatchingKeys } from "../util/errors.js";
+import { isJwkSet } from "../lib/type_checks.js";
+import { snapshotJwk } from "../lib/jwk_metadata.js";
+function isUsableJWK(jwk, entry, alg, kid) {
+  const { kty, key_ops, ext, kid: jwkKid, alg: jwkAlg, use, crv } = snapshotJwk(jwk), keyOps = Array.isArray(key_ops) ? [...key_ops] : key_ops;
+  return (ext === void 0 || typeof ext == "boolean") && (keyOps === void 0 || Array.isArray(keyOps) && keyOps.every((operation, index) => typeof operation == "string" && keyOps.indexOf(operation) === index) && keyOps.includes("verify")) && entry.kty.includes(kty) && (kid === void 0 || typeof kid == "string" && kid === jwkKid) && (jwkAlg === void 0 ? kty !== "AKP" : alg === jwkAlg) && (use === void 0 || use === "sig") && (!entry.crv || crv === entry.crv);
 }
 async function importWithAlgCache(cache, jwk, entry) {
-    const cached = cache.get(jwk) || cache.set(jwk, { __proto__: null }).get(jwk);
-    if (cached[entry.alg] === undefined) {
-        const key = await jwkToKey(entry, { ...jwk, alg: entry.alg, ext: true });
-        if (key.type !== 'public') {
-            throw new JWKSInvalid('JSON Web Key Set members must be public keys');
-        }
-        cached[entry.alg] = key;
-    }
-    return cached[entry.alg];
+  const cached = cache.get(jwk) || cache.set(jwk, {}).get(jwk), { alg } = entry;
+  if (cached[alg] === void 0) {
+    const key = await jwkToKey(entry, { ...jwk, alg, ext: !0 });
+    if (key.type !== "public")
+      throw new JWKSInvalid("JSON Web Key Set members must be public keys");
+    cached[alg] = key;
+  }
+  return cached[alg];
 }
-export function createLocalJWKSet(jwks) {
-    const set = new LocalJWKSetImpl(jwks);
-    const localJWKSet = async (protectedHeader, token) => set.getKey(protectedHeader, token);
-    Object.defineProperty(localJWKSet, 'jwks', {
-        value: () => structuredClone(set.jwks()),
-    });
-    return localJWKSet;
+function createLocalJWKSet(jwks) {
+  let snapshot;
+  try {
+    snapshot = structuredClone(jwks);
+  } catch {
+  }
+  if (!isJwkSet(snapshot))
+    throw new JWKSInvalid("JSON Web Key Set malformed");
+  const cached = /* @__PURE__ */ new WeakMap();
+  return Object.defineProperty(async (protectedHeader, token) => {
+    const { alg, kid } = { ...protectedHeader, ...token?.header }, entry = typeof alg == "string" ? JWS[alg] : void 0;
+    if (!entry || entry.secret)
+      throw new JOSENotSupported('Unsupported "alg" value for a JSON Web Key Set');
+    const candidates = snapshot.keys.filter((jwk2) => isUsableJWK(jwk2, entry, alg, kid)), { 0: jwk, length } = candidates;
+    if (!length)
+      throw new JWKSNoMatchingKey();
+    if (length !== 1) {
+      const error = new JWKSMultipleMatchingKeys();
+      throw error[Symbol.asyncIterator] = async function* () {
+        for (const jwk2 of candidates)
+          try {
+            yield await importWithAlgCache(cached, jwk2, entry);
+          } catch {
+          }
+      }, error;
+    }
+    return importWithAlgCache(cached, jwk, entry);
+  }, "jwks", {
+    value: () => structuredClone(snapshot)
+  });
 }
+export {
+  createLocalJWKSet
+};