unjwt 0.4.0 → 0.5.0

package/dist/shared/unjwt.B9uGngq-.d.mts

@@ -0,0 +1,154 @@
+import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, w as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, l as JWK_oct, m as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, C as CompositeKey, d as ContentEncryptionAlgorithm, A as JWKAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, z as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, n as JWK_HMAC, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, y as JWK_Symmetric_Algorithm } from './unjwt.C0bBN0AC.mjs';
+
+/**
+ * Generates a cryptographic key for the specified algorithm.
+ *
+ * @param alg The JWA algorithm identifier (e.g., "HS256", "RS256", "A128GCM").
+ * @param options Configuration options for key generation.
+ * @returns A Promise resolving to the generated key (CryptoKey, CryptoKeyPair, or Uint8Array) or its JWK representation.
+ */
+declare function generateKey<TAlg extends GenerateKeyAlgorithm, TOptions extends GenerateKeyOptions>(alg: TAlg, options?: TOptions): Promise<GenerateKeyReturn<TAlg, TOptions>>;
+/**
+ * Derives a key from a password using PBKDF2 as specified by PBES2 algorithms.
+ *
+ * @param password The password to derive the key from (string or Uint8Array).
+ * @param alg The PBES2 algorithm identifier (e.g., "PBES2-HS256+A128KW").
+ * @param options Configuration options including salt and iterations.
+ * @returns A Promise resolving to the derived key (CryptoKey) or its JWK_oct representation.
+ */
+declare function deriveKeyFromPassword<TAlg extends JWK_PBES2, TOptions extends DeriveKeyOptions>(password: string | Uint8Array, alg: TAlg, options: TOptions): Promise<DeriveKeyReturn<TOptions>>;
+/**
+ * Imports a key from various formats (CryptoKey, JWK, Uint8Array).
+ *
+ * - If `key` is a CryptoKey, it's returned directly.
+ * - If `key` is a Uint8Array, it's returned directly.
+ * - If `key` is a JWK_oct (symmetric key with 'k'), the raw key bytes are returned as Uint8Array.
+ * - If `key` is any other JWK type (asymmetric), the `alg` parameter is required, and a CryptoKey is returned.
+ *
+ * @param key The key to import.
+ * @param alg The algorithm hint, required when importing asymmetric JWKs.
+ * @returns A Promise resolving to the imported key as CryptoKey or Uint8Array.
+ */
+declare function importKey(key: string): Promise<Uint8Array>;
+declare function importKey(key: Uint8Array): Promise<Uint8Array>;
+declare function importKey(key: CryptoKey): Promise<CryptoKey>;
+declare function importKey(key: JWK_oct): Promise<Uint8Array>;
+declare function importKey(key: Exclude<JWK, JWK_oct>, alg: string): Promise<CryptoKey>;
+declare function importKey(key: CryptoKey | JWK | Uint8Array | string, alg?: string): Promise<CryptoKey | Uint8Array>;
+/**
+ * Exports a CryptoKey to a JWK (JSON Web Key) format.
+ *
+ * @param key The CryptoKey to export.
+ * @param jwk Optional partial JWK to merge with the exported key, allowing overrides.
+ * @returns A Promise resolving to the exported JWK.
+ */
+declare function exportKey(key: CryptoKey, jwk?: Partial<JWK>): Promise<JWK>;
+/**
+ * Wraps a Content Encryption Key (CEK) using the specified algorithm and wrapping key.
+ *
+ * @param alg The JWA key management algorithm (e.g., "A128KW", "RSA-OAEP", "PBES2-HS256+A128KW").
+ * @param keyToWrap The key to be wrapped (CEK), typically a symmetric key as Uint8Array or CryptoKey.
+ * @param wrappingKey The key used to wrap the CEK (CryptoKey, JWK, or password string/Uint8Array for PBES2).
+ * @param options Additional options required by certain algorithms (e.g., p2s, p2c for PBES2).
+ * @returns A Promise resolving to an object containing the wrapped key and any necessary parameters (iv, tag, epk, etc.).
+ */
+declare function wrapKey(alg: KeyManagementAlgorithm, keyToWrap: CryptoKey | Uint8Array, wrappingKey: CryptoKey | JWK | string | Uint8Array, options?: WrapKeyOptions): Promise<WrapKeyResult>;
+/**
+ * Unwraps a Content Encryption Key (CEK) using the specified algorithm and unwrapping key.
+ *
+ * @param alg The JWA key management algorithm (e.g., "A128KW", "RSA-OAEP", "PBES2-HS256+A128KW").
+ * @param wrappedKey The wrapped key (ciphertext) as Uint8Array.
+ * @param unwrappingKey The key used to unwrap the CEK (CryptoKey, JWK, or password string/Uint8Array for PBES2).
+ * @param options Additional options required by certain algorithms (e.g., iv, tag, p2s, p2c, epk).
+ * @returns A Promise resolving to the unwrapped key (CEK) as a CryptoKey or Uint8Array.
+ */
+declare function unwrapKey<T extends boolean | undefined = undefined>(alg: KeyManagementAlgorithm, wrappedKey: Uint8Array, unwrappingKey: CryptoKey | JWK | string | Uint8Array, options?: UnwrapKeyOptions & {
+    returnAs?: T;
+}): Promise<T extends false ? Uint8Array : CryptoKey>;
+
+declare const jwk_CompositeKey: typeof CompositeKey;
+declare const jwk_ContentEncryptionAlgorithm: typeof ContentEncryptionAlgorithm;
+declare const jwk_DeriveKeyOptions: typeof DeriveKeyOptions;
+declare const jwk_DeriveKeyReturn: typeof DeriveKeyReturn;
+declare const jwk_GenerateKeyAlgorithm: typeof GenerateKeyAlgorithm;
+declare const jwk_GenerateKeyOptions: typeof GenerateKeyOptions;
+declare const jwk_GenerateKeyReturn: typeof GenerateKeyReturn;
+declare const jwk_JWK: typeof JWK;
+declare const jwk_JWKAlgorithm: typeof JWKAlgorithm;
+declare const jwk_JWKParameters: typeof JWKParameters;
+declare const jwk_JWK_AES_CBC_HMAC: typeof JWK_AES_CBC_HMAC;
+declare const jwk_JWK_AES_GCM: typeof JWK_AES_GCM;
+declare const jwk_JWK_AES_GCM_KW: typeof JWK_AES_GCM_KW;
+declare const jwk_JWK_AES_KW: typeof JWK_AES_KW;
+declare const jwk_JWK_Asymmetric_Algorithm: typeof JWK_Asymmetric_Algorithm;
+declare const jwk_JWK_EC: typeof JWK_EC;
+declare const jwk_JWK_ECDH_ES: typeof JWK_ECDH_ES;
+declare const jwk_JWK_ECDSA: typeof JWK_ECDSA;
+declare const jwk_JWK_EC_Private: typeof JWK_EC_Private;
+declare const jwk_JWK_EC_Public: typeof JWK_EC_Public;
+declare const jwk_JWK_HMAC: typeof JWK_HMAC;
+declare const jwk_JWK_PBES2: typeof JWK_PBES2;
+declare const jwk_JWK_RSA: typeof JWK_RSA;
+declare const jwk_JWK_RSA_ENC: typeof JWK_RSA_ENC;
+declare const jwk_JWK_RSA_PSS: typeof JWK_RSA_PSS;
+declare const jwk_JWK_RSA_Private: typeof JWK_RSA_Private;
+declare const jwk_JWK_RSA_Public: typeof JWK_RSA_Public;
+declare const jwk_JWK_RSA_SIGN: typeof JWK_RSA_SIGN;
+declare const jwk_JWK_Symmetric_Algorithm: typeof JWK_Symmetric_Algorithm;
+declare const jwk_JWK_oct: typeof JWK_oct;
+declare const jwk_KeyManagementAlgorithm: typeof KeyManagementAlgorithm;
+declare const jwk_UnwrapKeyOptions: typeof UnwrapKeyOptions;
+declare const jwk_WrapKeyOptions: typeof WrapKeyOptions;
+declare const jwk_WrapKeyResult: typeof WrapKeyResult;
+declare const jwk_deriveKeyFromPassword: typeof deriveKeyFromPassword;
+declare const jwk_exportKey: typeof exportKey;
+declare const jwk_generateKey: typeof generateKey;
+declare const jwk_importKey: typeof importKey;
+declare const jwk_unwrapKey: typeof unwrapKey;
+declare const jwk_wrapKey: typeof wrapKey;
+declare namespace jwk {
+  export {
+    jwk_CompositeKey as CompositeKey,
+    jwk_ContentEncryptionAlgorithm as ContentEncryptionAlgorithm,
+    jwk_DeriveKeyOptions as DeriveKeyOptions,
+    jwk_DeriveKeyReturn as DeriveKeyReturn,
+    jwk_GenerateKeyAlgorithm as GenerateKeyAlgorithm,
+    jwk_GenerateKeyOptions as GenerateKeyOptions,
+    jwk_GenerateKeyReturn as GenerateKeyReturn,
+    jwk_JWK as JWK,
+    jwk_JWKAlgorithm as JWKAlgorithm,
+    jwk_JWKParameters as JWKParameters,
+    jwk_JWK_AES_CBC_HMAC as JWK_AES_CBC_HMAC,
+    jwk_JWK_AES_GCM as JWK_AES_GCM,
+    jwk_JWK_AES_GCM_KW as JWK_AES_GCM_KW,
+    jwk_JWK_AES_KW as JWK_AES_KW,
+    jwk_JWK_Asymmetric_Algorithm as JWK_Asymmetric_Algorithm,
+    jwk_JWK_EC as JWK_EC,
+    jwk_JWK_ECDH_ES as JWK_ECDH_ES,
+    jwk_JWK_ECDSA as JWK_ECDSA,
+    jwk_JWK_EC_Private as JWK_EC_Private,
+    jwk_JWK_EC_Public as JWK_EC_Public,
+    jwk_JWK_HMAC as JWK_HMAC,
+    jwk_JWK_PBES2 as JWK_PBES2,
+    jwk_JWK_RSA as JWK_RSA,
+    jwk_JWK_RSA_ENC as JWK_RSA_ENC,
+    jwk_JWK_RSA_PSS as JWK_RSA_PSS,
+    jwk_JWK_RSA_Private as JWK_RSA_Private,
+    jwk_JWK_RSA_Public as JWK_RSA_Public,
+    jwk_JWK_RSA_SIGN as JWK_RSA_SIGN,
+    jwk_JWK_Symmetric_Algorithm as JWK_Symmetric_Algorithm,
+    jwk_JWK_oct as JWK_oct,
+    jwk_KeyManagementAlgorithm as KeyManagementAlgorithm,
+    jwk_UnwrapKeyOptions as UnwrapKeyOptions,
+    jwk_WrapKeyOptions as WrapKeyOptions,
+    jwk_WrapKeyResult as WrapKeyResult,
+    jwk_deriveKeyFromPassword as deriveKeyFromPassword,
+    jwk_exportKey as exportKey,
+    jwk_generateKey as generateKey,
+    jwk_importKey as importKey,
+    jwk_unwrapKey as unwrapKey,
+    jwk_wrapKey as wrapKey,
+  };
+}
+
+export { deriveKeyFromPassword as d, exportKey as e, generateKey as g, importKey as i, jwk as j, unwrapKey as u, wrapKey as w };

package/dist/shared/unjwt.BKG_8Y9G.d.ts

@@ -0,0 +1,189 @@
+import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, f as JWK_EC_Public, m as JWK } from './unjwt.C0bBN0AC.js';
+import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.DoVzOnty.js';
+
+/** Recognized JWE Header Parameters, any other Header Members may also be present. */
+interface JWEHeaderParameters extends JoseHeaderParameters {
+    /**
+     * `alg` (Algorithm): Header Parameter - Key Management Algorithm
+     */
+    alg?: string;
+    /**
+     * `enc` (Encryption Algorithm): Header Parameter - Content Encryption Algorithm
+     */
+    enc?: string;
+    /**
+     * `p2c` (PBES2 Count): Header Parameter
+     */
+    p2c?: number;
+    /**
+     * `p2s` (PBES2 Salt): Header Parameter. Base64URL encoded.
+     */
+    p2s?: string;
+    /**
+     * "iv" (Initialization Vector) Header Parameter for AES GCM Key Wrapping. Base64URL encoded.
+     */
+    iv?: string;
+    /**
+     * "tag" (Authentication Tag) Header Parameter for AES GCM Key Wrapping. Base64URL encoded.
+     */
+    tag?: string;
+    /**
+     * "epk" (Ephemeral Public Key) Header Parameter for ECDH-ES.
+     */
+    epk?: JWK_EC_Public;
+    /**
+     * "apu" (Agreement PartyUInfo) Header Parameter for ECDH-ES. Base64URL encoded.
+     */
+    apu?: string;
+    /**
+     * "apv" (Agreement PartyVInfo) Header Parameter for ECDH-ES. Base64URL encoded.
+     */
+    apv?: string;
+    /** Any other JWE Header member. */
+    [propName: string]: unknown;
+}
+/** Recognized JWE Key Management-related Header Parameters. */
+interface JWEKeyManagementHeaderParameters {
+    apu?: Uint8Array;
+    apv?: Uint8Array;
+    /**
+     * For Internal use only
+     */
+    p2c?: number;
+    /**
+     * For Internal use only
+     */
+    p2s?: Uint8Array;
+    /**
+     * For Internal use only
+     */
+    iv?: Uint8Array;
+    /**
+     * For Internal use only
+     */
+    epk?: CryptoKey;
+}
+/**
+ * JWE (JSON Web Encryption) encryption options
+ */
+interface JWEEncryptOptions {
+    /** JWE "alg" (Algorithm) Header Parameter. Key Management Algorithm. */
+    alg?: KeyManagementAlgorithm;
+    /** JWE "enc" (Encryption Algorithm) Header Parameter. Content Encryption Algorithm. */
+    enc?: ContentEncryptionAlgorithm;
+    /** Additional JWE Protected Header parameters. */
+    protectedHeader?: Omit<JWEHeaderParameters, "alg" | "enc" | "iv" | "tag" | "p2s" | "p2c" | "apu" | "apv">;
+    /** Initialization Vector for AES-GCMKW key wrapping. Generated if not provided. */
+    keyManagementIV?: Uint8Array;
+    /** PBES2 Salt value (p2s). Required for PBES2 algorithms. */
+    p2s?: Uint8Array;
+    /** PBES2 Iteration count (p2c). Required for PBES2 algorithms. */
+    p2c?: number;
+    /** ECDH-ES Agreement PartyUInfo. */
+    ecdhPartyUInfo?: Uint8Array;
+    /** ECDH-ES Agreement PartyVInfo. */
+    ecdhPartyVInfo?: Uint8Array;
+    /**
+     * Content Encryption Key (CEK) to use.
+     * If provided, it will be used directly. Otherwise, a CEK will be generated.
+     */
+    cek?: Uint8Array;
+    /**
+     * Initialization Vector for content encryption.
+     * If provided, it will be used. Otherwise, one will be generated.
+     */
+    contentEncryptionIV?: Uint8Array;
+}
+/**
+ * Key lookup function for JWE decryption.
+ * @param header The JWE Protected Header.
+ * @returns The key material (CryptoKey, JWK, password string, or raw Uint8Array) or a Promise resolving to it.
+ */
+type JWEKeyLookupFunction = (header: JWEHeaderParameters) => CryptoKey | JWK | string | Uint8Array | Promise<CryptoKey | JWK | string | Uint8Array>;
+/**
+ * JWE (JSON Web Encryption) decryption options
+ */
+interface JWEDecryptOptions {
+    /** A list of allowed JWE "alg" (Algorithm) Header Parameter values for key management. */
+    algorithms?: KeyManagementAlgorithm[];
+    /** A list of allowed JWE "enc" (Encryption Algorithm) Header Parameter values for content encryption. */
+    encryptionAlgorithms?: ContentEncryptionAlgorithm[];
+    /**
+     * Critical Header Parameters to be understood and processed.
+     * If the JWE contains critical headers not in this list (and not inherently understood by the library), decryption will fail.
+     */
+    critical?: string[];
+    /** Algorithm to import the unwrapped CEK as (e.g., { name: 'AES-GCM' }). Defaults based on 'enc'. */
+    unwrappedKeyAlgorithm?: Parameters<typeof crypto.subtle.importKey>[2];
+    /** Key usages for the unwrapped CEK. Defaults based on 'enc' (typically ['encrypt', 'decrypt']). */
+    keyUsage?: KeyUsage[];
+    /** Mark the unwrapped CEK as extractable. Defaults to true. */
+    extractable?: boolean;
+    /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred based on JWE headers. */
+    forceUint8Array?: boolean;
+}
+/**
+ * Result of a JWE decryption operation.
+ */
+interface JWEDecryptResult<T = JWTClaims | string> {
+    /** The decrypted payload. */
+    payload: T;
+    /** The JWE Protected Header. */
+    protectedHeader: JWEHeaderParameters;
+    /** The Content Encryption Key (CEK) used for decryption, as Uint8Array. */
+    cek: Uint8Array;
+    /** The Additional Authenticated Data (AAD) used, as Uint8Array. */
+    aad: Uint8Array;
+}
+
+/**
+ * Encrypts a payload to produce a JWE Compact Serialization string.
+ *
+ * @param payload The payload to encrypt. Can be a string, Uint8Array, or a JSON-serializable object.
+ * @param key The key encryption key (KEK). Can be a CryptoKey, JWK, or for PBES2, a password string/Uint8Array.
+ * @param options JWE encryption options, including `alg` (key management algorithm) and `enc` (content encryption algorithm).
+ * @returns A Promise resolving to the JWE Compact Serialization string.
+ */
+declare function encrypt(payload: JWTClaims, key: JWK | string | Uint8Array, options?: JWEEncryptOptions): Promise<string>;
+declare function encrypt(payload: string | Uint8Array | Record<string, any>, key: JWK | string | Uint8Array, options?: JWEEncryptOptions): Promise<string>;
+declare function encrypt(payload: JWTClaims, key: CryptoKey, options: JWEEncryptOptions & {
+    alg: KeyManagementAlgorithm;
+    enc: ContentEncryptionAlgorithm;
+}): Promise<string>;
+declare function encrypt(payload: string | Uint8Array | Record<string, any>, key: CryptoKey, options: JWEEncryptOptions & {
+    alg: KeyManagementAlgorithm;
+    enc: ContentEncryptionAlgorithm;
+}): Promise<string>;
+declare function encrypt(payload: string | Uint8Array | Record<string, any>, key: CryptoKey | JWK | string | Uint8Array, options: JWEEncryptOptions & {
+    alg: KeyManagementAlgorithm;
+    enc: ContentEncryptionAlgorithm;
+}): Promise<string>;
+/**
+ * Decrypts a JWE Compact Serialization string.
+ *
+ * @param jwe The JWE Compact Serialization string.
+ * @param key The key decryption key (KEK) or a function to look up the key.
+ * @param options JWE decryption options.
+ * @returns A Promise resolving to an object containing the decrypted plaintext, protected header, CEK, and AAD.
+ * @throws If JWE is invalid, decryption fails, or options are not met.
+ */
+declare function decrypt<T = JWTClaims | string>(jwe: string, key: CryptoKey | JWK | string | Uint8Array | JWEKeyLookupFunction, options?: JWEDecryptOptions): Promise<JWEDecryptResult<T>>;
+declare function decrypt(jwe: string, key: CryptoKey | JWK | string | Uint8Array | JWEKeyLookupFunction, options: JWEDecryptOptions & {
+    forceUint8Array: true;
+}): Promise<JWEDecryptResult<Uint8Array>>;
+
+type jwe_JWEDecryptOptions = JWEDecryptOptions;
+type jwe_JWEDecryptResult<T = JWTClaims | string> = JWEDecryptResult<T>;
+type jwe_JWEEncryptOptions = JWEEncryptOptions;
+type jwe_JWEHeaderParameters = JWEHeaderParameters;
+type jwe_JWEKeyLookupFunction = JWEKeyLookupFunction;
+type jwe_JWEKeyManagementHeaderParameters = JWEKeyManagementHeaderParameters;
+declare const jwe_decrypt: typeof decrypt;
+declare const jwe_encrypt: typeof encrypt;
+declare namespace jwe {
+  export { jwe_decrypt as decrypt, jwe_encrypt as encrypt };
+  export type { jwe_JWEDecryptOptions as JWEDecryptOptions, jwe_JWEDecryptResult as JWEDecryptResult, jwe_JWEEncryptOptions as JWEEncryptOptions, jwe_JWEHeaderParameters as JWEHeaderParameters, jwe_JWEKeyLookupFunction as JWEKeyLookupFunction, jwe_JWEKeyManagementHeaderParameters as JWEKeyManagementHeaderParameters };
+}
+
+export { encrypt as f, decrypt as g, jwe as j };
+export type { JWEHeaderParameters as J, JWEKeyManagementHeaderParameters as a, JWEEncryptOptions as b, JWEKeyLookupFunction as c, JWEDecryptOptions as d, JWEDecryptResult as e };

package/dist/shared/unjwt.BOEZHxi_.d.ts

@@ -0,0 +1,154 @@
+import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, w as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, l as JWK_oct, m as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, C as CompositeKey, d as ContentEncryptionAlgorithm, A as JWKAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, z as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, n as JWK_HMAC, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, y as JWK_Symmetric_Algorithm } from './unjwt.C0bBN0AC.js';
+
+/**
+ * Generates a cryptographic key for the specified algorithm.
+ *
+ * @param alg The JWA algorithm identifier (e.g., "HS256", "RS256", "A128GCM").
+ * @param options Configuration options for key generation.
+ * @returns A Promise resolving to the generated key (CryptoKey, CryptoKeyPair, or Uint8Array) or its JWK representation.
+ */
+declare function generateKey<TAlg extends GenerateKeyAlgorithm, TOptions extends GenerateKeyOptions>(alg: TAlg, options?: TOptions): Promise<GenerateKeyReturn<TAlg, TOptions>>;
+/**
+ * Derives a key from a password using PBKDF2 as specified by PBES2 algorithms.
+ *
+ * @param password The password to derive the key from (string or Uint8Array).
+ * @param alg The PBES2 algorithm identifier (e.g., "PBES2-HS256+A128KW").
+ * @param options Configuration options including salt and iterations.
+ * @returns A Promise resolving to the derived key (CryptoKey) or its JWK_oct representation.
+ */
+declare function deriveKeyFromPassword<TAlg extends JWK_PBES2, TOptions extends DeriveKeyOptions>(password: string | Uint8Array, alg: TAlg, options: TOptions): Promise<DeriveKeyReturn<TOptions>>;
+/**
+ * Imports a key from various formats (CryptoKey, JWK, Uint8Array).
+ *
+ * - If `key` is a CryptoKey, it's returned directly.
+ * - If `key` is a Uint8Array, it's returned directly.
+ * - If `key` is a JWK_oct (symmetric key with 'k'), the raw key bytes are returned as Uint8Array.
+ * - If `key` is any other JWK type (asymmetric), the `alg` parameter is required, and a CryptoKey is returned.
+ *
+ * @param key The key to import.
+ * @param alg The algorithm hint, required when importing asymmetric JWKs.
+ * @returns A Promise resolving to the imported key as CryptoKey or Uint8Array.
+ */
+declare function importKey(key: string): Promise<Uint8Array>;
+declare function importKey(key: Uint8Array): Promise<Uint8Array>;
+declare function importKey(key: CryptoKey): Promise<CryptoKey>;
+declare function importKey(key: JWK_oct): Promise<Uint8Array>;
+declare function importKey(key: Exclude<JWK, JWK_oct>, alg: string): Promise<CryptoKey>;
+declare function importKey(key: CryptoKey | JWK | Uint8Array | string, alg?: string): Promise<CryptoKey | Uint8Array>;
+/**
+ * Exports a CryptoKey to a JWK (JSON Web Key) format.
+ *
+ * @param key The CryptoKey to export.
+ * @param jwk Optional partial JWK to merge with the exported key, allowing overrides.
+ * @returns A Promise resolving to the exported JWK.
+ */
+declare function exportKey(key: CryptoKey, jwk?: Partial<JWK>): Promise<JWK>;
+/**
+ * Wraps a Content Encryption Key (CEK) using the specified algorithm and wrapping key.
+ *
+ * @param alg The JWA key management algorithm (e.g., "A128KW", "RSA-OAEP", "PBES2-HS256+A128KW").
+ * @param keyToWrap The key to be wrapped (CEK), typically a symmetric key as Uint8Array or CryptoKey.
+ * @param wrappingKey The key used to wrap the CEK (CryptoKey, JWK, or password string/Uint8Array for PBES2).
+ * @param options Additional options required by certain algorithms (e.g., p2s, p2c for PBES2).
+ * @returns A Promise resolving to an object containing the wrapped key and any necessary parameters (iv, tag, epk, etc.).
+ */
+declare function wrapKey(alg: KeyManagementAlgorithm, keyToWrap: CryptoKey | Uint8Array, wrappingKey: CryptoKey | JWK | string | Uint8Array, options?: WrapKeyOptions): Promise<WrapKeyResult>;
+/**
+ * Unwraps a Content Encryption Key (CEK) using the specified algorithm and unwrapping key.
+ *
+ * @param alg The JWA key management algorithm (e.g., "A128KW", "RSA-OAEP", "PBES2-HS256+A128KW").
+ * @param wrappedKey The wrapped key (ciphertext) as Uint8Array.
+ * @param unwrappingKey The key used to unwrap the CEK (CryptoKey, JWK, or password string/Uint8Array for PBES2).
+ * @param options Additional options required by certain algorithms (e.g., iv, tag, p2s, p2c, epk).
+ * @returns A Promise resolving to the unwrapped key (CEK) as a CryptoKey or Uint8Array.
+ */
+declare function unwrapKey<T extends boolean | undefined = undefined>(alg: KeyManagementAlgorithm, wrappedKey: Uint8Array, unwrappingKey: CryptoKey | JWK | string | Uint8Array, options?: UnwrapKeyOptions & {
+    returnAs?: T;
+}): Promise<T extends false ? Uint8Array : CryptoKey>;
+
+declare const jwk_CompositeKey: typeof CompositeKey;
+declare const jwk_ContentEncryptionAlgorithm: typeof ContentEncryptionAlgorithm;
+declare const jwk_DeriveKeyOptions: typeof DeriveKeyOptions;
+declare const jwk_DeriveKeyReturn: typeof DeriveKeyReturn;
+declare const jwk_GenerateKeyAlgorithm: typeof GenerateKeyAlgorithm;
+declare const jwk_GenerateKeyOptions: typeof GenerateKeyOptions;
+declare const jwk_GenerateKeyReturn: typeof GenerateKeyReturn;
+declare const jwk_JWK: typeof JWK;
+declare const jwk_JWKAlgorithm: typeof JWKAlgorithm;
+declare const jwk_JWKParameters: typeof JWKParameters;
+declare const jwk_JWK_AES_CBC_HMAC: typeof JWK_AES_CBC_HMAC;
+declare const jwk_JWK_AES_GCM: typeof JWK_AES_GCM;
+declare const jwk_JWK_AES_GCM_KW: typeof JWK_AES_GCM_KW;
+declare const jwk_JWK_AES_KW: typeof JWK_AES_KW;
+declare const jwk_JWK_Asymmetric_Algorithm: typeof JWK_Asymmetric_Algorithm;
+declare const jwk_JWK_EC: typeof JWK_EC;
+declare const jwk_JWK_ECDH_ES: typeof JWK_ECDH_ES;
+declare const jwk_JWK_ECDSA: typeof JWK_ECDSA;
+declare const jwk_JWK_EC_Private: typeof JWK_EC_Private;
+declare const jwk_JWK_EC_Public: typeof JWK_EC_Public;
+declare const jwk_JWK_HMAC: typeof JWK_HMAC;
+declare const jwk_JWK_PBES2: typeof JWK_PBES2;
+declare const jwk_JWK_RSA: typeof JWK_RSA;
+declare const jwk_JWK_RSA_ENC: typeof JWK_RSA_ENC;
+declare const jwk_JWK_RSA_PSS: typeof JWK_RSA_PSS;
+declare const jwk_JWK_RSA_Private: typeof JWK_RSA_Private;
+declare const jwk_JWK_RSA_Public: typeof JWK_RSA_Public;
+declare const jwk_JWK_RSA_SIGN: typeof JWK_RSA_SIGN;
+declare const jwk_JWK_Symmetric_Algorithm: typeof JWK_Symmetric_Algorithm;
+declare const jwk_JWK_oct: typeof JWK_oct;
+declare const jwk_KeyManagementAlgorithm: typeof KeyManagementAlgorithm;
+declare const jwk_UnwrapKeyOptions: typeof UnwrapKeyOptions;
+declare const jwk_WrapKeyOptions: typeof WrapKeyOptions;
+declare const jwk_WrapKeyResult: typeof WrapKeyResult;
+declare const jwk_deriveKeyFromPassword: typeof deriveKeyFromPassword;
+declare const jwk_exportKey: typeof exportKey;
+declare const jwk_generateKey: typeof generateKey;
+declare const jwk_importKey: typeof importKey;
+declare const jwk_unwrapKey: typeof unwrapKey;
+declare const jwk_wrapKey: typeof wrapKey;
+declare namespace jwk {
+  export {
+    jwk_CompositeKey as CompositeKey,
+    jwk_ContentEncryptionAlgorithm as ContentEncryptionAlgorithm,
+    jwk_DeriveKeyOptions as DeriveKeyOptions,
+    jwk_DeriveKeyReturn as DeriveKeyReturn,
+    jwk_GenerateKeyAlgorithm as GenerateKeyAlgorithm,
+    jwk_GenerateKeyOptions as GenerateKeyOptions,
+    jwk_GenerateKeyReturn as GenerateKeyReturn,
+    jwk_JWK as JWK,
+    jwk_JWKAlgorithm as JWKAlgorithm,
+    jwk_JWKParameters as JWKParameters,
+    jwk_JWK_AES_CBC_HMAC as JWK_AES_CBC_HMAC,
+    jwk_JWK_AES_GCM as JWK_AES_GCM,
+    jwk_JWK_AES_GCM_KW as JWK_AES_GCM_KW,
+    jwk_JWK_AES_KW as JWK_AES_KW,
+    jwk_JWK_Asymmetric_Algorithm as JWK_Asymmetric_Algorithm,
+    jwk_JWK_EC as JWK_EC,
+    jwk_JWK_ECDH_ES as JWK_ECDH_ES,
+    jwk_JWK_ECDSA as JWK_ECDSA,
+    jwk_JWK_EC_Private as JWK_EC_Private,
+    jwk_JWK_EC_Public as JWK_EC_Public,
+    jwk_JWK_HMAC as JWK_HMAC,
+    jwk_JWK_PBES2 as JWK_PBES2,
+    jwk_JWK_RSA as JWK_RSA,
+    jwk_JWK_RSA_ENC as JWK_RSA_ENC,
+    jwk_JWK_RSA_PSS as JWK_RSA_PSS,
+    jwk_JWK_RSA_Private as JWK_RSA_Private,
+    jwk_JWK_RSA_Public as JWK_RSA_Public,
+    jwk_JWK_RSA_SIGN as JWK_RSA_SIGN,
+    jwk_JWK_Symmetric_Algorithm as JWK_Symmetric_Algorithm,
+    jwk_JWK_oct as JWK_oct,
+    jwk_KeyManagementAlgorithm as KeyManagementAlgorithm,
+    jwk_UnwrapKeyOptions as UnwrapKeyOptions,
+    jwk_WrapKeyOptions as WrapKeyOptions,
+    jwk_WrapKeyResult as WrapKeyResult,
+    jwk_deriveKeyFromPassword as deriveKeyFromPassword,
+    jwk_exportKey as exportKey,
+    jwk_generateKey as generateKey,
+    jwk_importKey as importKey,
+    jwk_unwrapKey as unwrapKey,
+    jwk_wrapKey as wrapKey,
+  };
+}
+
+export { deriveKeyFromPassword as d, exportKey as e, generateKey as g, importKey as i, jwk as j, unwrapKey as u, wrapKey as w };

package/dist/shared/unjwt.Bzcov22m.mjs

@@ -0,0 +1,167 @@
+import { i as importKey } from './unjwt.DKq5VF7t.mjs';
+import { a as isJWK, b as base64UrlEncode, t as textEncoder, c as textDecoder, d as base64UrlDecode } from './unjwt.CjHZv3F3.mjs';
+import { s as sign$1, v as verify$1 } from './unjwt.sux3_Z19.mjs';
+
+async function sign(payload, key, options = {}) {
+  const { protectedHeader: additionalProtectedHeader } = options;
+  let { alg } = options;
+  if (!alg) {
+    if (isJWK(key) && key.alg) {
+      alg = key.alg;
+    } else {
+      throw new TypeError('JWS "alg" (Algorithm) must be provided in options');
+    }
+  }
+  const signingKey = await importKey(key, alg);
+  const protectedHeader = {
+    ...additionalProtectedHeader,
+    alg,
+    typ: additionalProtectedHeader?.typ ?? (typeof payload === "object" && !(payload instanceof Uint8Array) ? "JWT" : void 0)
+    // Default typ to JWT for objects
+  };
+  if (protectedHeader.typ === void 0 && typeof payload === "object" && !(payload instanceof Uint8Array)) {
+    protectedHeader.typ = "JWT";
+    protectedHeader.cty ||= "json";
+  }
+  if (protectedHeader.b64 === true) {
+    delete protectedHeader.b64;
+  }
+  const protectedHeaderString = JSON.stringify(protectedHeader);
+  const protectedHeaderEncoded = base64UrlEncode(protectedHeaderString);
+  let payloadBytes;
+  if (payload instanceof Uint8Array) {
+    payloadBytes = payload;
+  } else if (typeof payload === "string") {
+    payloadBytes = textEncoder.encode(payload);
+  } else if (typeof payload === "object" && payload !== null) {
+    payloadBytes = textEncoder.encode(JSON.stringify(payload));
+  } else {
+    throw new TypeError(
+      "Payload must be a string, Uint8Array, or a JSON-serializable object."
+    );
+  }
+  const useB64 = protectedHeader.b64 !== false;
+  const payloadEncoded = useB64 ? base64UrlEncode(payloadBytes) : textDecoder.decode(payloadBytes);
+  const signingInputString = `${protectedHeaderEncoded}.${payloadEncoded}`;
+  const signingInputBytes = textEncoder.encode(signingInputString);
+  const signatureBytes = await sign$1(alg, signingKey, signingInputBytes);
+  const signatureEncoded = base64UrlEncode(signatureBytes);
+  return `${signingInputString}.${signatureEncoded}`;
+}
+async function verify(jws, key, options) {
+  const parts = jws.split(".");
+  if (parts.length !== 3) {
+    throw new Error("Invalid JWS: Must contain three parts separated by dots.");
+  }
+  const [protectedHeaderEncoded, payloadEncoded, signatureEncoded] = parts;
+  let protectedHeader;
+  try {
+    const protectedHeaderJson = base64UrlDecode(protectedHeaderEncoded);
+    protectedHeader = JSON.parse(protectedHeaderJson);
+  } catch (error_) {
+    throw new Error(
+      `Invalid JWS: Protected header is not valid Base64URL or JSON (${error_ instanceof Error ? error_.message : error_})`
+    );
+  }
+  if (!protectedHeader || typeof protectedHeader !== "object" || !protectedHeader.alg) {
+    throw new Error(
+      'Invalid JWS: Protected header must be an object with an "alg" property.'
+    );
+  }
+  const alg = protectedHeader.alg;
+  if (options?.algorithms && !options.algorithms.includes(alg)) {
+    throw new Error(`Algorithm not allowed: ${alg}`);
+  }
+  let signatureBytes;
+  try {
+    signatureBytes = base64UrlDecode(signatureEncoded, false);
+  } catch (error_) {
+    throw new Error(
+      `Invalid JWS: Signature is not valid Base64URL (${error_ instanceof Error ? error_.message : error_})`
+    );
+  }
+  const resolvedKey = typeof key === "function" ? await key(protectedHeader) : key;
+  const verificationKey = await importKey(resolvedKey, alg);
+  const signingInputString = `${protectedHeaderEncoded}.${payloadEncoded}`;
+  const signingInputBytes = textEncoder.encode(signingInputString);
+  const isValid = await verify$1(
+    alg,
+    verificationKey,
+    signatureBytes,
+    signingInputBytes
+  );
+  if (!isValid) {
+    throw new Error("JWS signature verification failed.");
+  }
+  const useB64 = protectedHeader.b64 !== false;
+  let payload;
+  try {
+    if (useB64) {
+      if (options?.forceUint8Array) {
+        payload = base64UrlDecode(payloadEncoded, false);
+      } else {
+        const cty = protectedHeader.cty?.toLowerCase();
+        const isJsonOutput = protectedHeader.typ === "JWT" || cty === "json" || cty === "application/json" || cty && cty.endsWith("+json");
+        if (isJsonOutput) {
+          const decodedString = base64UrlDecode(payloadEncoded, true);
+          if (decodedString.startsWith("{") && decodedString.endsWith("}") || decodedString.startsWith("[") && decodedString.endsWith("]")) {
+            try {
+              payload = JSON.parse(decodedString);
+            } catch {
+              payload = decodedString;
+            }
+          } else {
+            payload = decodedString;
+          }
+        } else {
+          payload = base64UrlDecode(payloadEncoded);
+        }
+      }
+    } else {
+      payload = textEncoder.encode(payloadEncoded);
+    }
+  } catch (error_) {
+    throw new Error(
+      `Invalid JWS: Payload decoding failed (${error_ instanceof Error ? error_.message : error_})`
+    );
+  }
+  if (options?.critical && protectedHeader.crit) {
+    const recognizedParams = /* @__PURE__ */ new Set([
+      ...Object.keys(protectedHeader),
+      ...options.critical || [],
+      "alg",
+      "typ",
+      "cty",
+      "kid",
+      "jwk",
+      "jku",
+      "x5c",
+      "x5t",
+      "x5u",
+      "b64"
+    ]);
+    for (const critParam of protectedHeader.crit) {
+      if (!recognizedParams.has(critParam)) {
+        throw new Error(
+          `Critical header parameter not understood: ${critParam}`
+        );
+      }
+    }
+  } else if (!options?.critical && protectedHeader.crit) {
+    throw new Error(
+      `Unprocessed critical header parameters: ${protectedHeader.crit.join(", ")}`
+    );
+  }
+  return {
+    payload,
+    protectedHeader
+  };
+}
+
+const jws = {
+  __proto__: null,
+  sign: sign,
+  verify: verify
+};
+
+export { jws as j, sign as s, verify as v };