unjwt 0.3.0 → 0.4.0

package/dist/shared/unjwt.ChP7VhqI.d.ts

@@ -0,0 +1,110 @@
+import { J as JWK } from './unjwt.zb2wBNCJ.js';
+
+/** Header Parameters common to JWE and JWS */
+interface JoseHeaderParameters {
+    /** "kid" (Key ID) Header Parameter */
+    kid?: string;
+    /** "x5t" (X.509 Certificate SHA-1 Thumbprint) Header Parameter */
+    x5t?: string;
+    /** "x5c" (X.509 Certificate Chain) Header Parameter */
+    x5c?: string[];
+    /** "x5u" (X.509 URL) Header Parameter */
+    x5u?: string;
+    /** "jku" (JWK Set URL) Header Parameter */
+    jku?: string;
+    /** "jwk" (JSON Web Key) Header Parameter */
+    jwk?: Pick<JWK, "kty" | "crv" | "x" | "y" | "e" | "n">;
+    /** "typ" (Type) Header Parameter */
+    typ?: string;
+    /** "cty" (Content Type) Header Parameter */
+    cty?: string;
+    /** "crit" (Critical) Header Parameter */
+    crit?: string[];
+    /** Any other JWS/JWE Header member. */
+    [propName: string]: unknown;
+}
+
+/**
+ * Supported key wrapping algorithms
+ */
+declare const KEY_WRAPPING_ALGORITHMS: Readonly<{
+    "PBES2-HS256+A128KW": {
+        hash: string;
+        keyLength: number;
+    };
+    "PBES2-HS384+A192KW": {
+        hash: string;
+        keyLength: number;
+    };
+    "PBES2-HS512+A256KW": {
+        hash: string;
+        keyLength: number;
+    };
+}>;
+/**
+ * Supported JWS symmetric algorithms
+ */
+declare const JWS_SYMMETRIC_ALGORITHMS: Readonly<{
+    HS256: {
+        hash: string;
+    };
+    HS384: {
+        hash: string;
+    };
+    HS512: {
+        hash: string;
+    };
+}>;
+/**
+ * Supported content encryption algorithms
+ */
+declare const CONTENT_ENCRYPTION_ALGORITHMS: Readonly<{
+    A128GCM: {
+        type: string;
+        keyLength: number;
+        tagLength: number;
+        ivLength: number;
+    };
+    A192GCM: {
+        type: string;
+        keyLength: number;
+        tagLength: number;
+        ivLength: number;
+    };
+    A256GCM: {
+        type: string;
+        keyLength: number;
+        tagLength: number;
+        ivLength: number;
+    };
+    "A128CBC-HS256": {
+        type: string;
+        keyLength: number;
+        encKeyLength: number;
+        macKeyLength: number;
+        tagLength: number;
+        ivLength: number;
+        macAlgorithm: string;
+    };
+    "A192CBC-HS384": {
+        type: string;
+        keyLength: number;
+        encKeyLength: number;
+        macKeyLength: number;
+        tagLength: number;
+        ivLength: number;
+        macAlgorithm: string;
+    };
+    "A256CBC-HS512": {
+        type: string;
+        keyLength: number;
+        encKeyLength: number;
+        macKeyLength: number;
+        tagLength: number;
+        ivLength: number;
+        macAlgorithm: string;
+    };
+}>;
+
+export { CONTENT_ENCRYPTION_ALGORITHMS as C, KEY_WRAPPING_ALGORITHMS as K, JWS_SYMMETRIC_ALGORITHMS as a };
+export type { JoseHeaderParameters as J };

package/dist/shared/unjwt.DD0p18Gd.mjs

@@ -0,0 +1,81 @@
+const KEY_WRAPPING_ALGORITHMS = /* @__PURE__ */ Object.freeze({
+  "PBES2-HS256+A128KW": {
+    hash: "SHA-256",
+    keyLength: 128
+  },
+  "PBES2-HS384+A192KW": {
+    hash: "SHA-384",
+    keyLength: 192
+  },
+  "PBES2-HS512+A256KW": {
+    hash: "SHA-512",
+    keyLength: 256
+  }
+});
+const JWS_SYMMETRIC_ALGORITHMS = /* @__PURE__ */ Object.freeze({
+  HS256: { hash: "SHA-256" },
+  HS384: { hash: "SHA-384" },
+  HS512: { hash: "SHA-512" }
+});
+const CONTENT_ENCRYPTION_ALGORITHMS = /* @__PURE__ */ Object.freeze({
+  // GCM algorithms
+  A128GCM: {
+    type: "gcm",
+    keyLength: 128,
+    tagLength: 16,
+    ivLength: 12
+  },
+  A192GCM: {
+    type: "gcm",
+    keyLength: 192,
+    tagLength: 16,
+    ivLength: 12
+  },
+  A256GCM: {
+    type: "gcm",
+    keyLength: 256,
+    tagLength: 16,
+    ivLength: 12
+  },
+  // TODO: implement future CBC algorithms
+  "A128CBC-HS256": {
+    type: "cbc",
+    keyLength: 256,
+    // Combined key length (encryption + HMAC)
+    encKeyLength: 128,
+    macKeyLength: 128,
+    tagLength: 16,
+    ivLength: 16,
+    macAlgorithm: "SHA-256"
+  },
+  "A192CBC-HS384": {
+    type: "cbc",
+    keyLength: 384,
+    // Combined key length (encryption + HMAC)
+    encKeyLength: 192,
+    macKeyLength: 192,
+    tagLength: 24,
+    ivLength: 16,
+    macAlgorithm: "SHA-384"
+  },
+  "A256CBC-HS512": {
+    type: "cbc",
+    keyLength: 512,
+    // Combined key length (encryption + HMAC)
+    encKeyLength: 256,
+    macKeyLength: 256,
+    tagLength: 32,
+    ivLength: 16,
+    macAlgorithm: "SHA-512"
+  }
+});
+
+function lookupAlgorithm(alg, supportedAlgorithms, algorithmType) {
+  const config = supportedAlgorithms[alg];
+  if (!config) {
+    throw new Error(`Unsupported ${algorithmType} algorithm: ${String(alg)}`);
+  }
+  return { ...config, alg };
+}
+
+export { CONTENT_ENCRYPTION_ALGORITHMS as C, JWS_SYMMETRIC_ALGORITHMS as J, KEY_WRAPPING_ALGORITHMS as K, lookupAlgorithm as l };

package/dist/shared/unjwt.DGsIvgyn.d.ts

@@ -0,0 +1,106 @@
+import { K as KEY_WRAPPING_ALGORITHMS, C as CONTENT_ENCRYPTION_ALGORITHMS, J as JoseHeaderParameters } from './unjwt.ChP7VhqI.js';
+
+type KeyWrappingAlgorithmType = keyof typeof KEY_WRAPPING_ALGORITHMS;
+type ContentEncryptionAlgorithmType = keyof typeof CONTENT_ENCRYPTION_ALGORITHMS;
+interface JWEHeaderParameters extends JoseHeaderParameters {
+    /**
+     * `alg` (Algorithm): Header Parameter
+     *
+     * @default "PBES2-HS256+A128KW"
+     */
+    alg?: KeyWrappingAlgorithmType;
+    /**
+     * `enc` (Encryption Algorithm): Header Parameter
+     *
+     * @default "A256GCM"
+     */
+    enc?: ContentEncryptionAlgorithmType;
+    /**
+     * `p2c` (PBES2 Count): Header Parameter
+     *
+     * @default 2048
+     */
+    p2c?: number;
+    /**
+     * `p2s` (PBES2 Salt): Header Parameter
+     */
+    p2s?: string;
+}
+/**
+ * JWE (JSON Web Encryption) options
+ */
+interface JWEOptions {
+    /**
+     * Number of iterations for PBES2 key derivation
+     * Also accessible as `protectedHeader.p2c`
+     *
+     * @default 2048
+     */
+    iterations?: number;
+    /**
+     * Size of the salt for PBES2 key derivation
+     *
+     * @default 16
+     */
+    saltSize?: number;
+    /**
+     * Additional protected header parameters
+     */
+    protectedHeader?: JWEHeaderParameters;
+}
+
+/** The default settings. */
+declare const JWE_DEFAULTS: Readonly<{
+    saltSize: 16;
+    iterations: 2048;
+    alg: KeyWrappingAlgorithmType;
+    enc: ContentEncryptionAlgorithmType;
+}>;
+/**
+ * Seal (encrypt) data using JWE with configurable algorithms
+ * @param data The data to encrypt
+ * @param password The password to use for encryption
+ * @param options Optional parameters
+ * @returns Promise resolving to the compact JWE token
+ */
+declare function seal(data: string | Uint8Array, password: string | Uint8Array, options?: JWEOptions): Promise<string>;
+/**
+ * Decrypts a JWE (JSON Web Encryption) token
+ * @param token The JWE token string in compact serialization format
+ * @param password The password used to derive the encryption key
+ * @returns The decrypted content as a string
+ */
+declare function unseal(token: string, password: string | Uint8Array): Promise<string>;
+/**
+ * Decrypts a JWE (JSON Web Encryption) token
+ * @param token The JWE token string in compact serialization format
+ * @param password The password used to derive the encryption key
+ * @param options Decryption options
+ * @returns The decrypted content as a string
+ */
+declare function unseal(token: string, password: string | Uint8Array, options: {
+    textOutput: true;
+}): Promise<string>;
+/**
+ * Decrypts a JWE (JSON Web Encryption) token
+ * @param token The JWE token string in compact serialization format
+ * @param password The password used to derive the encryption key
+ * @param options Decryption options
+ * @returns The decrypted content as a Uint8Array
+ */
+declare function unseal(token: string, password: string | Uint8Array, options: {
+    textOutput: false;
+}): Promise<Uint8Array>;
+
+declare const jwe_JWE_DEFAULTS: typeof JWE_DEFAULTS;
+declare const jwe_seal: typeof seal;
+declare const jwe_unseal: typeof unseal;
+declare namespace jwe {
+  export {
+    jwe_JWE_DEFAULTS as JWE_DEFAULTS,
+    jwe_seal as seal,
+    jwe_unseal as unseal,
+  };
+}
+
+export { JWE_DEFAULTS as J, jwe as j, seal as s, unseal as u };

package/dist/shared/unjwt.DPTwlVpK.mjs

@@ -0,0 +1,28 @@
+const textEncoder = /* @__PURE__ */ new TextEncoder();
+const textDecoder = /* @__PURE__ */ new TextDecoder();
+function base64UrlEncode(data) {
+  return btoa(String.fromCodePoint(...data)).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+}
+function base64UrlDecode(str) {
+  if (!str) {
+    return new Uint8Array(0);
+  }
+  str = str.replace(/-/g, "+").replace(/_/g, "/");
+  while (str.length % 4) str += "=";
+  return Uint8Array.from(atob(str), (b) => b.codePointAt(0));
+}
+function randomBytes(length) {
+  return crypto.getRandomValues(new Uint8Array(length));
+}
+function concatUint8Arrays(...arrays) {
+  const totalLength = arrays.reduce((length, arr) => length + arr.length, 0);
+  const result = new Uint8Array(totalLength);
+  let offset = 0;
+  for (const arr of arrays) {
+    result.set(arr, offset);
+    offset += arr.length;
+  }
+  return result;
+}
+
+export { textDecoder as a, base64UrlEncode as b, base64UrlDecode as c, concatUint8Arrays as d, randomBytes as r, textEncoder as t };

package/dist/shared/unjwt.Dr-mxtq9.d.mts

@@ -0,0 +1,106 @@
+import { K as KEY_WRAPPING_ALGORITHMS, C as CONTENT_ENCRYPTION_ALGORITHMS, J as JoseHeaderParameters } from './unjwt.4uzJv0cA.mjs';
+
+type KeyWrappingAlgorithmType = keyof typeof KEY_WRAPPING_ALGORITHMS;
+type ContentEncryptionAlgorithmType = keyof typeof CONTENT_ENCRYPTION_ALGORITHMS;
+interface JWEHeaderParameters extends JoseHeaderParameters {
+    /**
+     * `alg` (Algorithm): Header Parameter
+     *
+     * @default "PBES2-HS256+A128KW"
+     */
+    alg?: KeyWrappingAlgorithmType;
+    /**
+     * `enc` (Encryption Algorithm): Header Parameter
+     *
+     * @default "A256GCM"
+     */
+    enc?: ContentEncryptionAlgorithmType;
+    /**
+     * `p2c` (PBES2 Count): Header Parameter
+     *
+     * @default 2048
+     */
+    p2c?: number;
+    /**
+     * `p2s` (PBES2 Salt): Header Parameter
+     */
+    p2s?: string;
+}
+/**
+ * JWE (JSON Web Encryption) options
+ */
+interface JWEOptions {
+    /**
+     * Number of iterations for PBES2 key derivation
+     * Also accessible as `protectedHeader.p2c`
+     *
+     * @default 2048
+     */
+    iterations?: number;
+    /**
+     * Size of the salt for PBES2 key derivation
+     *
+     * @default 16
+     */
+    saltSize?: number;
+    /**
+     * Additional protected header parameters
+     */
+    protectedHeader?: JWEHeaderParameters;
+}
+
+/** The default settings. */
+declare const JWE_DEFAULTS: Readonly<{
+    saltSize: 16;
+    iterations: 2048;
+    alg: KeyWrappingAlgorithmType;
+    enc: ContentEncryptionAlgorithmType;
+}>;
+/**
+ * Seal (encrypt) data using JWE with configurable algorithms
+ * @param data The data to encrypt
+ * @param password The password to use for encryption
+ * @param options Optional parameters
+ * @returns Promise resolving to the compact JWE token
+ */
+declare function seal(data: string | Uint8Array, password: string | Uint8Array, options?: JWEOptions): Promise<string>;
+/**
+ * Decrypts a JWE (JSON Web Encryption) token
+ * @param token The JWE token string in compact serialization format
+ * @param password The password used to derive the encryption key
+ * @returns The decrypted content as a string
+ */
+declare function unseal(token: string, password: string | Uint8Array): Promise<string>;
+/**
+ * Decrypts a JWE (JSON Web Encryption) token
+ * @param token The JWE token string in compact serialization format
+ * @param password The password used to derive the encryption key
+ * @param options Decryption options
+ * @returns The decrypted content as a string
+ */
+declare function unseal(token: string, password: string | Uint8Array, options: {
+    textOutput: true;
+}): Promise<string>;
+/**
+ * Decrypts a JWE (JSON Web Encryption) token
+ * @param token The JWE token string in compact serialization format
+ * @param password The password used to derive the encryption key
+ * @param options Decryption options
+ * @returns The decrypted content as a Uint8Array
+ */
+declare function unseal(token: string, password: string | Uint8Array, options: {
+    textOutput: false;
+}): Promise<Uint8Array>;
+
+declare const jwe_JWE_DEFAULTS: typeof JWE_DEFAULTS;
+declare const jwe_seal: typeof seal;
+declare const jwe_unseal: typeof unseal;
+declare namespace jwe {
+  export {
+    jwe_JWE_DEFAULTS as JWE_DEFAULTS,
+    jwe_seal as seal,
+    jwe_unseal as unseal,
+  };
+}
+
+export { JWE_DEFAULTS as J, jwe as j, seal as s, unseal as u };

package/dist/shared/unjwt.KOd0vXyx.mjs

@@ -0,0 +1,90 @@
+import { b as base64UrlEncode, t as textEncoder, a as textDecoder, c as base64UrlDecode } from './unjwt.DPTwlVpK.mjs';
+import { l as lookupAlgorithm, J as JWS_SYMMETRIC_ALGORITHMS } from './unjwt.DD0p18Gd.mjs';
+import { i as importKey } from './unjwt.C9ELsKeK.mjs';
+
+const JWS_DEFAULTS = /* @__PURE__ */ Object.freeze({
+  alg: "HS256"
+});
+async function sign(payload, secret, options = {}) {
+  if (!secret) {
+    throw new Error("Missing secret key");
+  }
+  const protectedHeader = options.protectedHeader || {};
+  const alg = protectedHeader.alg || JWS_DEFAULTS.alg;
+  const algConfig = validateJwsAlgorithm(alg);
+  const header = {
+    alg,
+    typ: "JWT",
+    ...protectedHeader
+  };
+  const encodedHeader = base64UrlEncode(
+    textEncoder.encode(JSON.stringify(header))
+  );
+  const encodedPayload = base64UrlEncode(
+    typeof payload === "string" ? textEncoder.encode(payload) : payload
+  );
+  const signingInput = textEncoder.encode(`${encodedHeader}.${encodedPayload}`);
+  const cryptoKey = await importKey(
+    secret,
+    { name: "HMAC", hash: algConfig.hash },
+    false,
+    ["sign"]
+  );
+  const signature = await crypto.subtle.sign(
+    { name: "HMAC" },
+    cryptoKey,
+    signingInput
+  );
+  const encodedSignature = base64UrlEncode(new Uint8Array(signature));
+  return `${encodedHeader}.${encodedPayload}.${encodedSignature}`;
+}
+async function verify(token, secret, options = {}) {
+  if (!token) {
+    throw new Error("Missing JWS token");
+  }
+  if (!secret) {
+    throw new Error("Missing secret key");
+  }
+  const textOutput = options.textOutput !== false;
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    throw new Error("Invalid JWS token format");
+  }
+  const [encodedHeader, encodedPayload, encodedSignature] = parts;
+  const header = JSON.parse(
+    textDecoder.decode(base64UrlDecode(encodedHeader))
+  );
+  const alg = header.alg;
+  const algConfig = validateJwsAlgorithm(alg);
+  const signingInput = textEncoder.encode(`${encodedHeader}.${encodedPayload}`);
+  const signature = base64UrlDecode(encodedSignature);
+  const cryptoKey = await importKey(
+    secret,
+    { name: "HMAC", hash: algConfig.hash },
+    false,
+    ["verify"]
+  );
+  const isValid = await crypto.subtle.verify(
+    { name: "HMAC" },
+    cryptoKey,
+    signature,
+    signingInput
+  );
+  if (!isValid) {
+    throw new Error("Signature verification failed");
+  }
+  const payloadBytes = base64UrlDecode(encodedPayload);
+  return textOutput ? textDecoder.decode(payloadBytes) : payloadBytes;
+}
+function validateJwsAlgorithm(alg) {
+  return lookupAlgorithm(alg, JWS_SYMMETRIC_ALGORITHMS, "JWS");
+}
+
+const jws = {
+  __proto__: null,
+  JWS_DEFAULTS: JWS_DEFAULTS,
+  sign: sign,
+  verify: verify
+};
+
+export { JWS_DEFAULTS as J, jws as j, sign as s, verify as v };