unjwt 0.2.1 → 0.4.0

package/dist/index.mjs

@@ -1,141 +1,5 @@
-import { subtle } from 'unjwt/crypto';
-
-const DEFAULT_SIGNATURE_METHOD = "HMAC";
-const DEFAULT_HASH_METHODS = "SHA-256";
-const textEncoder = new TextEncoder();
-async function createSignature(key, algorithm, data) {
-  const encoded = textEncoder.encode(data);
-  const signature = await subtle.sign(algorithm, key, encoded);
-  return encodeToBase64Url(signature);
-}
-async function importKey(options) {
-  const {
-    secret,
-    usage = "sign",
-    name = DEFAULT_SIGNATURE_METHOD,
-    hash = DEFAULT_HASH_METHODS
-  } = { ...options };
-  const encodedKey = textEncoder.encode(secret);
-  return await subtle.importKey(
-    "raw",
-    encodedKey,
-    { name, hash },
-    false,
-    [usage]
-  );
-}
-function encodeToBase64Url(input) {
-  let data;
-  if (typeof input === "string")
-    data = textEncoder.encode(input);
-  else if (input instanceof ArrayBuffer)
-    data = new Uint8Array(input);
-  else
-    data = textEncoder.encode(JSON.stringify(input));
-  const base64 = btoa(String.fromCodePoint(...data));
-  return base64.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-function decodeFromBase64Url(base64Url) {
-  const base64 = base64Url.replace(/-/g, "+").replace(/_/g, "/");
-  return atob(base64);
-}
-function decodeFromBase64UrlToBuffer(base64Url) {
-  const bytes = decodeFromBase64Url(base64Url);
-  const buffer = Uint8Array.from(bytes, (c) => c.codePointAt(0));
-  return buffer.buffer;
-}
-
-function decodeJWT(token) {
-  try {
-    return _decodeJWT(token);
-  } catch {
-  }
-}
-function _decodeJWT(token) {
-  const parts = String(token).split(".");
-  if (parts.length !== 3)
-    throw new Error("Invalid token format");
-  const [, payload] = parts;
-  return JSON.parse(decodeFromBase64Url(payload));
-}
-
-const headerAlgMap = {
-  HMAC: "HS",
-  RSA: "RS",
-  ECDSA: "ES"
-};
-async function signJWT(options) {
-  const {
-    payload = {},
-    secret,
-    issuer,
-    audience,
-    expires = 30,
-    signatureMethod = DEFAULT_SIGNATURE_METHOD,
-    hashMethod = DEFAULT_HASH_METHODS
-  } = { ...options };
-  const key = await importKey({
-    secret,
-    name: signatureMethod,
-    hash: hashMethod
-  });
-  const header = {
-    typ: "JWT",
-    alg: `${headerAlgMap[signatureMethod]}${hashMethod.split("-")[1]}`
-  };
-  const iat = Math.floor(Date.now() / 1e3);
-  const exp = iat + expires * 24 * 60 * 60;
-  const jwtPayload = {
-    ...payload,
-    iss: issuer,
-    aud: audience,
-    iat,
-    exp
-  };
-  const signature = await createSignature(
-    key,
-    signatureMethod,
-    `${encodeToBase64Url(header)}.${encodeToBase64Url(jwtPayload)}`
-  );
-  return `${encodeToBase64Url(header)}.${encodeToBase64Url(
-    jwtPayload
-  )}.${signature}`;
-}
-
-async function verifyJWT(options) {
-  const {
-    token,
-    secret,
-    issuer,
-    audience,
-    leeway = 60,
-    signatureMethod = DEFAULT_SIGNATURE_METHOD,
-    hashMethod = DEFAULT_HASH_METHODS
-  } = { ...options };
-  const [header, payload, signature] = String(token).split(".");
-  const key = await importKey({
-    secret,
-    usage: "verify",
-    name: signatureMethod,
-    hash: hashMethod
-  });
-  const isValid = await subtle.verify(
-    signatureMethod,
-    key,
-    decodeFromBase64UrlToBuffer(signature),
-    textEncoder.encode(`${header}.${payload}`)
-  );
-  if (!isValid)
-    throw new Error("Invalid JWT signature");
-  let decodedPayload;
-  try {
-    decodedPayload = JSON.parse(decodeFromBase64Url(payload));
-  } catch {
-    throw new Error("Invalid JWT payload");
-  }
-  const now = Math.floor(Date.now() / 1e3);
-  if (issuer !== decodedPayload.iss || (Array.isArray(decodedPayload.aud) ? !decodedPayload.aud.includes(audience) : audience !== decodedPayload.aud) || decodedPayload.exp && now > decodedPayload.exp + leeway || decodedPayload.nbf && now < decodedPayload.nbf - leeway)
-    throw new Error("Invalid JWT claims");
-}
-
-export { _decodeJWT, decodeJWT, signJWT, verifyJWT };
+export { j as jwe } from './shared/unjwt._GivNhs2.mjs';
+export { j as jwk } from './shared/unjwt.C9ELsKeK.mjs';
+export { j as jws } from './shared/unjwt.KOd0vXyx.mjs';
+import './shared/unjwt.DPTwlVpK.mjs';
+import './shared/unjwt.DD0p18Gd.mjs';

package/dist/jwe.d.mts

@@ -0,0 +1,3 @@
+export { J as JWE_DEFAULTS, s as seal, u as unseal } from './shared/unjwt.Dr-mxtq9.mjs';
+import './shared/unjwt.4uzJv0cA.mjs';
+import './shared/unjwt.zb2wBNCJ.mjs';

package/dist/jwe.d.ts

@@ -0,0 +1,3 @@
+export { J as JWE_DEFAULTS, s as seal, u as unseal } from './shared/unjwt.DGsIvgyn.js';
+import './shared/unjwt.ChP7VhqI.js';
+import './shared/unjwt.zb2wBNCJ.js';

package/dist/jwe.mjs

@@ -0,0 +1,3 @@
+import './shared/unjwt.DPTwlVpK.mjs';
+import './shared/unjwt.DD0p18Gd.mjs';
+export { J as JWE_DEFAULTS, s as seal, u as unseal } from './shared/unjwt._GivNhs2.mjs';

package/dist/jwk.d.mts

@@ -0,0 +1,2 @@
+import './shared/unjwt.zb2wBNCJ.mjs';
+export { e as exportKey, g as generateKey, i as importKey } from './shared/unjwt.A7HKFx3n.mjs';

package/dist/jwk.d.ts

@@ -0,0 +1,2 @@
+import './shared/unjwt.zb2wBNCJ.js';
+export { e as exportKey, g as generateKey, i as importKey } from './shared/unjwt.CVUxLNoy.js';

package/dist/jwk.mjs

@@ -0,0 +1,2 @@
+import './shared/unjwt.DPTwlVpK.mjs';
+export { e as exportKey, g as generateKey, i as importKey } from './shared/unjwt.C9ELsKeK.mjs';

package/dist/jws.d.mts

@@ -0,0 +1,3 @@
+import './shared/unjwt.zb2wBNCJ.mjs';
+export { J as JWS_DEFAULTS, s as sign, v as verify } from './shared/unjwt.BdjvpIUY.mjs';
+import './shared/unjwt.4uzJv0cA.mjs';

package/dist/jws.d.ts

@@ -0,0 +1,3 @@
+import './shared/unjwt.zb2wBNCJ.js';
+export { J as JWS_DEFAULTS, s as sign, v as verify } from './shared/unjwt.BmjmfFWo.js';
+import './shared/unjwt.ChP7VhqI.js';

package/dist/jws.mjs

@@ -0,0 +1,4 @@
+import './shared/unjwt.DPTwlVpK.mjs';
+import './shared/unjwt.DD0p18Gd.mjs';
+import './shared/unjwt.C9ELsKeK.mjs';
+export { J as JWS_DEFAULTS, s as sign, v as verify } from './shared/unjwt.KOd0vXyx.mjs';

package/dist/shared/unjwt.4uzJv0cA.d.mts

@@ -0,0 +1,110 @@
+import { J as JWK } from './unjwt.zb2wBNCJ.mjs';
+
+/** Header Parameters common to JWE and JWS */
+interface JoseHeaderParameters {
+    /** "kid" (Key ID) Header Parameter */
+    kid?: string;
+    /** "x5t" (X.509 Certificate SHA-1 Thumbprint) Header Parameter */
+    x5t?: string;
+    /** "x5c" (X.509 Certificate Chain) Header Parameter */
+    x5c?: string[];
+    /** "x5u" (X.509 URL) Header Parameter */
+    x5u?: string;
+    /** "jku" (JWK Set URL) Header Parameter */
+    jku?: string;
+    /** "jwk" (JSON Web Key) Header Parameter */
+    jwk?: Pick<JWK, "kty" | "crv" | "x" | "y" | "e" | "n">;
+    /** "typ" (Type) Header Parameter */
+    typ?: string;
+    /** "cty" (Content Type) Header Parameter */
+    cty?: string;
+    /** "crit" (Critical) Header Parameter */
+    crit?: string[];
+    /** Any other JWS/JWE Header member. */
+    [propName: string]: unknown;
+}
+
+/**
+ * Supported key wrapping algorithms
+ */
+declare const KEY_WRAPPING_ALGORITHMS: Readonly<{
+    "PBES2-HS256+A128KW": {
+        hash: string;
+        keyLength: number;
+    };
+    "PBES2-HS384+A192KW": {
+        hash: string;
+        keyLength: number;
+    };
+    "PBES2-HS512+A256KW": {
+        hash: string;
+        keyLength: number;
+    };
+}>;
+/**
+ * Supported JWS symmetric algorithms
+ */
+declare const JWS_SYMMETRIC_ALGORITHMS: Readonly<{
+    HS256: {
+        hash: string;
+    };
+    HS384: {
+        hash: string;
+    };
+    HS512: {
+        hash: string;
+    };
+}>;
+/**
+ * Supported content encryption algorithms
+ */
+declare const CONTENT_ENCRYPTION_ALGORITHMS: Readonly<{
+    A128GCM: {
+        type: string;
+        keyLength: number;
+        tagLength: number;
+        ivLength: number;
+    };
+    A192GCM: {
+        type: string;
+        keyLength: number;
+        tagLength: number;
+        ivLength: number;
+    };
+    A256GCM: {
+        type: string;
+        keyLength: number;
+        tagLength: number;
+        ivLength: number;
+    };
+    "A128CBC-HS256": {
+        type: string;
+        keyLength: number;
+        encKeyLength: number;
+        macKeyLength: number;
+        tagLength: number;
+        ivLength: number;
+        macAlgorithm: string;
+    };
+    "A192CBC-HS384": {
+        type: string;
+        keyLength: number;
+        encKeyLength: number;
+        macKeyLength: number;
+        tagLength: number;
+        ivLength: number;
+        macAlgorithm: string;
+    };
+    "A256CBC-HS512": {
+        type: string;
+        keyLength: number;
+        encKeyLength: number;
+        macKeyLength: number;
+        tagLength: number;
+        ivLength: number;
+        macAlgorithm: string;
+    };
+}>;
+
+export { CONTENT_ENCRYPTION_ALGORITHMS as C, KEY_WRAPPING_ALGORITHMS as K, JWS_SYMMETRIC_ALGORITHMS as a };
+export type { JoseHeaderParameters as J };

package/dist/shared/unjwt.A7HKFx3n.d.mts

@@ -0,0 +1,52 @@
+import { J as JWK } from './unjwt.zb2wBNCJ.mjs';
+
+/**
+ * Generates a new cryptographic key as a JWK object.
+ * Currently supports symmetric keys ('oct'). Future versions will support asymmetric keys.
+ *
+ * @param type The type of key to generate. Currently only 'oct' (symmetric) is supported.
+ *             For 'oct': requires `length` option.
+ *             Future types like 'RSA' or 'EC' will require different options.
+ * @param options Generation options specific to the key type.
+ * @param options.length For 'oct' keys: Key length in bits (e.g., 128, 192, 256, 512).
+ * @param options.alg Optional JWA algorithm identifier (e.g., "HS256", "A128KW") to include in the JWK.
+ *
+ * @returns Promise resolving to the generated key as a JWK object.
+ * @throws Error if the key type or options are invalid/unsupported.
+ */
+declare function generateKey(type: "oct", length: 128 | 192 | 256 | 512, jwk?: Omit<JWK, "kty" | "k">): Promise<JWK>;
+/**
+ * Exports a CryptoKey to its JWK representation.
+ * Supports symmetric ('oct') keys. Future versions will support asymmetric keys.
+ *
+ * @param key The CryptoKey to export. Must be extractable.
+ *
+ * @returns Promise resolving to the JWK representation.
+ * @throws Error if the key is not extractable or its type is unsupported for export.
+ */
+declare function exportKey(key: CryptoKey): Promise<JWK>;
+/**
+ * Imports a symmetric key from various formats (JWK, raw bytes, string) into a CryptoKey.
+ *
+ * @param key The key material (JWK object, Uint8Array, or string).
+ * @param algorithm The Web Crypto AlgorithmIdentifier to import the key for (e.g., HmacImportParams, AesKeyAlgorithm).
+ * @param extractable Whether the imported key should be extractable.
+ * @param keyUsages The allowed key usages for the imported CryptoKey.
+ *
+ * @returns Promise resolving to the imported CryptoKey.
+ * @throws Error if the key format is invalid or unsupported for symmetric import.
+ */
+declare function importKey(key: JWK | string | Uint8Array, algorithm: AlgorithmIdentifier | HmacImportParams | AesKeyAlgorithm, extractable: boolean, keyUsages: KeyUsage[]): Promise<CryptoKey>;
+
+declare const jwk_exportKey: typeof exportKey;
+declare const jwk_generateKey: typeof generateKey;
+declare const jwk_importKey: typeof importKey;
+declare namespace jwk {
+  export {
+    jwk_exportKey as exportKey,
+    jwk_generateKey as generateKey,
+    jwk_importKey as importKey,
+  };
+}
+
+export { exportKey as e, generateKey as g, importKey as i, jwk as j };

package/dist/shared/unjwt.BdjvpIUY.d.mts

@@ -0,0 +1,79 @@
+import { J as JWK } from './unjwt.zb2wBNCJ.mjs';
+import { a as JWS_SYMMETRIC_ALGORITHMS, J as JoseHeaderParameters } from './unjwt.4uzJv0cA.mjs';
+
+/** Supported JWS Symmetric Algorithm types */
+type JWSSymmetricAlgorithm = keyof typeof JWS_SYMMETRIC_ALGORITHMS;
+/** Supported JWS Algorithm types */
+type JWSAlgorithm = JWSSymmetricAlgorithm;
+/** Recognized JWS Header Parameters, any other Header Members may also be present. */
+interface JWSHeaderParameters extends JoseHeaderParameters {
+    /** JWS "alg" (Algorithm) Header Parameter */
+    alg?: JWSAlgorithm;
+    /**
+     * This JWS Extension Header Parameter modifies the JWS Payload representation and the JWS Signing
+     * Input computation as per {@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}.
+     */
+    b64?: boolean;
+}
+/**
+ * JWS (JSON Web Signature) options for signing
+ */
+interface JWSSignOptions {
+    /**
+     * Additional protected header parameters
+     */
+    protectedHeader?: JWSHeaderParameters;
+}
+
+/** The default JWS algorithm. */
+declare const JWS_DEFAULTS: Readonly<{
+    alg: JWSSymmetricAlgorithm;
+}>;
+/**
+ * Signs data using JWS with a symmetric key (HMAC).
+ * @param payload The data to sign.
+ * @param secret The symmetric secret key.
+ * @param options Optional parameters for signing.
+ * @returns Promise resolving to the compact JWS token.
+ */
+declare function sign(payload: string | Uint8Array, secret: JWK | string | Uint8Array, options?: JWSSignOptions): Promise<string>;
+/**
+ * Verifies a JWS token signed with a symmetric key (HMAC).
+ * @param token The JWS token string in compact serialization format.
+ * @param secret The symmetric secret key used for signing.
+ * @returns Promise resolving to the verified payload as a string.
+ */
+declare function verify(token: string, secret: JWK | string | Uint8Array): Promise<string>;
+/**
+ * Verifies a JWS token signed with a symmetric key (HMAC).
+ * @param token The JWS token string in compact serialization format.
+ * @param secret The symmetric secret key used for signing.
+ * @param options Verification options.
+ * @returns Promise resolving to the verified payload as a string.
+ */
+declare function verify(token: string, secret: JWK | string | Uint8Array, options: {
+    textOutput: true;
+}): Promise<string>;
+/**
+ * Verifies a JWS token signed with a symmetric key (HMAC).
+ * @param token The JWS token string in compact serialization format.
+ * @param secret The symmetric secret key used for signing.
+ * @param options Verification options.
+ * @returns Promise resolving to the verified payload as a Uint8Array.
+ */
+declare function verify(token: string, secret: JWK | string | Uint8Array, options: {
+    textOutput: false;
+}): Promise<Uint8Array>;
+
+declare const jws_JWS_DEFAULTS: typeof JWS_DEFAULTS;
+declare const jws_sign: typeof sign;
+declare const jws_verify: typeof verify;
+declare namespace jws {
+  export {
+    jws_JWS_DEFAULTS as JWS_DEFAULTS,
+    jws_sign as sign,
+    jws_verify as verify,
+  };
+}
+
+export { JWS_DEFAULTS as J, jws as j, sign as s, verify as v };

package/dist/shared/unjwt.BmjmfFWo.d.ts

@@ -0,0 +1,79 @@
+import { J as JWK } from './unjwt.zb2wBNCJ.js';
+import { a as JWS_SYMMETRIC_ALGORITHMS, J as JoseHeaderParameters } from './unjwt.ChP7VhqI.js';
+
+/** Supported JWS Symmetric Algorithm types */
+type JWSSymmetricAlgorithm = keyof typeof JWS_SYMMETRIC_ALGORITHMS;
+/** Supported JWS Algorithm types */
+type JWSAlgorithm = JWSSymmetricAlgorithm;
+/** Recognized JWS Header Parameters, any other Header Members may also be present. */
+interface JWSHeaderParameters extends JoseHeaderParameters {
+    /** JWS "alg" (Algorithm) Header Parameter */
+    alg?: JWSAlgorithm;
+    /**
+     * This JWS Extension Header Parameter modifies the JWS Payload representation and the JWS Signing
+     * Input computation as per {@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}.
+     */
+    b64?: boolean;
+}
+/**
+ * JWS (JSON Web Signature) options for signing
+ */
+interface JWSSignOptions {
+    /**
+     * Additional protected header parameters
+     */
+    protectedHeader?: JWSHeaderParameters;
+}
+
+/** The default JWS algorithm. */
+declare const JWS_DEFAULTS: Readonly<{
+    alg: JWSSymmetricAlgorithm;
+}>;
+/**
+ * Signs data using JWS with a symmetric key (HMAC).
+ * @param payload The data to sign.
+ * @param secret The symmetric secret key.
+ * @param options Optional parameters for signing.
+ * @returns Promise resolving to the compact JWS token.
+ */
+declare function sign(payload: string | Uint8Array, secret: JWK | string | Uint8Array, options?: JWSSignOptions): Promise<string>;
+/**
+ * Verifies a JWS token signed with a symmetric key (HMAC).
+ * @param token The JWS token string in compact serialization format.
+ * @param secret The symmetric secret key used for signing.
+ * @returns Promise resolving to the verified payload as a string.
+ */
+declare function verify(token: string, secret: JWK | string | Uint8Array): Promise<string>;
+/**
+ * Verifies a JWS token signed with a symmetric key (HMAC).
+ * @param token The JWS token string in compact serialization format.
+ * @param secret The symmetric secret key used for signing.
+ * @param options Verification options.
+ * @returns Promise resolving to the verified payload as a string.
+ */
+declare function verify(token: string, secret: JWK | string | Uint8Array, options: {
+    textOutput: true;
+}): Promise<string>;
+/**
+ * Verifies a JWS token signed with a symmetric key (HMAC).
+ * @param token The JWS token string in compact serialization format.
+ * @param secret The symmetric secret key used for signing.
+ * @param options Verification options.
+ * @returns Promise resolving to the verified payload as a Uint8Array.
+ */
+declare function verify(token: string, secret: JWK | string | Uint8Array, options: {
+    textOutput: false;
+}): Promise<Uint8Array>;
+
+declare const jws_JWS_DEFAULTS: typeof JWS_DEFAULTS;
+declare const jws_sign: typeof sign;
+declare const jws_verify: typeof verify;
+declare namespace jws {
+  export {
+    jws_JWS_DEFAULTS as JWS_DEFAULTS,
+    jws_sign as sign,
+    jws_verify as verify,
+  };
+}
+
+export { JWS_DEFAULTS as J, jws as j, sign as s, verify as v };

package/dist/shared/unjwt.C9ELsKeK.mjs

@@ -0,0 +1,120 @@
+import { r as randomBytes, b as base64UrlEncode, t as textEncoder } from './unjwt.DPTwlVpK.mjs';
+
+async function generateKey(type, length, options) {
+  switch (type) {
+    case "oct": {
+      if (!length || typeof length !== "number" || ![128, 192, 256, 512].includes(length)) {
+        throw new Error(
+          "Invalid options for 'oct' key generation. 'length' (128, 192, 256, or 512) is required."
+        );
+      }
+      const keyBytes = randomBytes(length / 8);
+      const jwk = {
+        ext: true,
+        // Default extractable
+        ...options,
+        // TODO: do we want to allow this level of control?
+        kty: "oct",
+        k: base64UrlEncode(keyBytes)
+      };
+      return jwk;
+    }
+    // Add cases for 'RSA', 'EC'
+    default: {
+      throw new Error(`Unsupported key type for generation: ${type}`);
+    }
+  }
+}
+async function exportKey(key) {
+  if (!key.extractable) {
+    throw new Error("Key must be extractable to export to JWK format.");
+  }
+  if (key.type === "secret") {
+    try {
+      const jwk2 = await crypto.subtle.exportKey("jwk", key);
+      if (jwk2.kty === "oct" && typeof jwk2.k === "string") {
+        const finalJwk = {
+          ...jwk2,
+          kty: "oct",
+          key_ops: jwk2.key_ops || key.usages,
+          ext: jwk2.ext ?? key.extractable
+        };
+        if (!finalJwk.alg && key.algorithm.name === "HMAC") {
+          finalJwk.alg = `HS${key.algorithm.hash.name.split("-")[1]}`;
+        } else if (!finalJwk.alg) {
+          finalJwk.alg = key.algorithm.name;
+        }
+        return finalJwk;
+      }
+    } catch {
+    }
+    const rawKey = await crypto.subtle.exportKey("raw", key);
+    const jwk = {
+      kty: "oct",
+      k: base64UrlEncode(new Uint8Array(rawKey)),
+      // Infer JWA algorithm name
+      alg: key.algorithm.name === "HMAC" ? `HS${key.algorithm.hash.name.split("-")[1]}` : key.algorithm.name,
+      // Use algorithm name directly (e.g., AES-KW)
+      key_ops: key.usages,
+      ext: key.extractable
+    };
+    return jwk;
+  } else if (key.type === "public" || key.type === "private") {
+    try {
+      const jwk = await crypto.subtle.exportKey("jwk", key);
+      return jwk;
+    } catch (error) {
+      throw new Error(`Failed to export asymmetric key to JWK: ${error}`);
+    }
+  } else {
+    throw new Error(`Unsupported CryptoKey type for export: ${key.type}`);
+  }
+}
+async function importKey(key, algorithm, extractable, keyUsages) {
+  if (typeof key === "string") {
+    const keyData = textEncoder.encode(key);
+    return crypto.subtle.importKey(
+      "raw",
+      keyData,
+      algorithm,
+      extractable,
+      keyUsages
+    );
+  } else if (key instanceof Uint8Array) {
+    const keyData = key;
+    return crypto.subtle.importKey(
+      "raw",
+      keyData,
+      algorithm,
+      extractable,
+      keyUsages
+    );
+  } else if (typeof key === "object" && key !== null && key.kty === "oct") {
+    if (typeof key.k !== "string") {
+      throw new TypeError(
+        "Symmetric JWK must contain the 'k' parameter as a string"
+      );
+    }
+    const keyData = key;
+    return crypto.subtle.importKey(
+      "jwk",
+      keyData,
+      algorithm,
+      extractable,
+      keyUsages
+    );
+  } else {
+    throw new Error(
+      "Invalid key format. Expected symmetric JWK (oct), Uint8Array, or string."
+    );
+  }
+}
+
+const jwk = {
+  __proto__: null,
+  exportKey: exportKey,
+  generateKey: generateKey,
+  importKey: importKey
+};
+
+export { exportKey as e, generateKey as g, importKey as i, jwk as j };

package/dist/shared/unjwt.CVUxLNoy.d.ts

@@ -0,0 +1,52 @@
+import { J as JWK } from './unjwt.zb2wBNCJ.js';
+
+/**
+ * Generates a new cryptographic key as a JWK object.
+ * Currently supports symmetric keys ('oct'). Future versions will support asymmetric keys.
+ *
+ * @param type The type of key to generate. Currently only 'oct' (symmetric) is supported.
+ *             For 'oct': requires `length` option.
+ *             Future types like 'RSA' or 'EC' will require different options.
+ * @param options Generation options specific to the key type.
+ * @param options.length For 'oct' keys: Key length in bits (e.g., 128, 192, 256, 512).
+ * @param options.alg Optional JWA algorithm identifier (e.g., "HS256", "A128KW") to include in the JWK.
+ *
+ * @returns Promise resolving to the generated key as a JWK object.
+ * @throws Error if the key type or options are invalid/unsupported.
+ */
+declare function generateKey(type: "oct", length: 128 | 192 | 256 | 512, jwk?: Omit<JWK, "kty" | "k">): Promise<JWK>;
+/**
+ * Exports a CryptoKey to its JWK representation.
+ * Supports symmetric ('oct') keys. Future versions will support asymmetric keys.
+ *
+ * @param key The CryptoKey to export. Must be extractable.
+ *
+ * @returns Promise resolving to the JWK representation.
+ * @throws Error if the key is not extractable or its type is unsupported for export.
+ */
+declare function exportKey(key: CryptoKey): Promise<JWK>;
+/**
+ * Imports a symmetric key from various formats (JWK, raw bytes, string) into a CryptoKey.
+ *
+ * @param key The key material (JWK object, Uint8Array, or string).
+ * @param algorithm The Web Crypto AlgorithmIdentifier to import the key for (e.g., HmacImportParams, AesKeyAlgorithm).
+ * @param extractable Whether the imported key should be extractable.
+ * @param keyUsages The allowed key usages for the imported CryptoKey.
+ *
+ * @returns Promise resolving to the imported CryptoKey.
+ * @throws Error if the key format is invalid or unsupported for symmetric import.
+ */
+declare function importKey(key: JWK | string | Uint8Array, algorithm: AlgorithmIdentifier | HmacImportParams | AesKeyAlgorithm, extractable: boolean, keyUsages: KeyUsage[]): Promise<CryptoKey>;
+
+declare const jwk_exportKey: typeof exportKey;
+declare const jwk_generateKey: typeof generateKey;
+declare const jwk_importKey: typeof importKey;
+declare namespace jwk {
+  export {
+    jwk_exportKey as exportKey,
+    jwk_generateKey as generateKey,
+    jwk_importKey as importKey,
+  };
+}
+
+export { exportKey as e, generateKey as g, importKey as i, jwk as j };