unjwt 0.4.0 → 0.5.0

package/dist/shared/unjwt.DYFIh1YE.d.mts

@@ -0,0 +1,100 @@
+import { n as JWK_HMAC, o as JWK_RSA_SIGN, p as JWK_RSA_PSS, q as JWK_ECDSA, m as JWK } from './unjwt.C0bBN0AC.mjs';
+import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.D90BbcE1.mjs';
+
+type JWS_SIGN_EXTRA = "Ed25519" | "EdDSA";
+/** JWS Signing Algorithm Identifier. */
+type JWSAlgorithm = JWK_HMAC | JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWS_SIGN_EXTRA;
+/** Recognized JWS Header Parameters, any other Header Members may also be present. */
+interface JWSHeaderParameters extends JoseHeaderParameters {
+    /** JWS "alg" (Algorithm) Header Parameter */
+    alg?: JWSAlgorithm;
+    /**
+     * This JWS Extension Header Parameter modifies the JWS Payload representation and the JWS Signing
+     * Input computation as per {@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}.
+     * If `false`, the payload is used directly without Base64URL encoding.
+     * Defaults to `true`.
+     */
+    b64?: boolean;
+}
+/** JWS Protected Header */
+interface JWSProtectedHeader extends JWSHeaderParameters {
+    alg: JWSAlgorithm;
+}
+/**
+ * JWS (JSON Web Signature) options for signing
+ */
+interface JWSSignOptions {
+    /** The JWS Algorithm to use. Must be provided. */
+    alg?: JWSAlgorithm;
+    /**
+     * Additional protected header parameters. `alg` is automatically included.
+     * `typ` defaults to "JWT" if not provided.
+     */
+    protectedHeader?: JWSHeaderParameters;
+}
+/** Result of JWS verification */
+interface JWSVerifyResult<T = JWTClaims | Uint8Array | string> {
+    /** The decoded and verified payload. */
+    payload: T;
+    /** The JWS Protected Header. */
+    protectedHeader: JWSProtectedHeader;
+}
+/** Options for JWS verification */
+interface JWSVerifyOptions {
+    /** List of allowed algorithms. If provided, the JWS `alg` must be in this list. */
+    algorithms?: JWSAlgorithm[];
+    /** List of critical header parameters that must be understood and processed. */
+    critical?: string[];
+    /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred. */
+    forceUint8Array?: boolean;
+}
+
+/**
+ * Creates a JWS (JSON Web Signature) in Compact Serialization format.
+ *
+ * @param payload The payload to sign. Can be a string, Uint8Array, or an object (which will be JSON stringified).
+ * @param key The signing key (CryptoKey, JWK, or raw symmetric key as Uint8Array).
+ * @param options Signing options, including the algorithm (`alg`) and protected header parameters.
+ * @returns A Promise resolving to the JWS Compact Serialization string.
+ */
+declare function sign(payload: JWTClaims, key: JWK | Uint8Array, options?: JWSSignOptions): Promise<string>;
+declare function sign(payload: string | Uint8Array | Record<string, any>, key: JWK | Uint8Array, options?: JWSSignOptions): Promise<string>;
+declare function sign(payload: JWTClaims, key: CryptoKey, options: JWSSignOptions & {
+    alg: JWSAlgorithm;
+}): Promise<string>;
+declare function sign(payload: string | Uint8Array | Record<string, any>, key: CryptoKey, options: JWSSignOptions & {
+    alg: JWSAlgorithm;
+}): Promise<string>;
+declare function sign(payload: string | Uint8Array | Record<string, any>, key: CryptoKey | JWK | Uint8Array, options: JWSSignOptions & {
+    alg: JWSAlgorithm;
+}): Promise<string>;
+type KeyLookupFunction = (header: JWSProtectedHeader) => CryptoKey | JWK | Uint8Array | Promise<CryptoKey | JWK | Uint8Array>;
+/**
+ * Verifies a JWS (JSON Web Signature) in Compact Serialization format.
+ *
+ * @param jws The JWS Compact Serialization string.
+ * @param key The verification key (CryptoKey, JWK, raw symmetric key as Uint8Array, or a function resolving the key).
+ * @param options Verification options, such as allowed algorithms.
+ * @returns A Promise resolving to an object containing the verified payload and protected header.
+ * @throws If the JWS is invalid, signature verification fails, or options are not met.
+ */
+declare function verify<T = JWTClaims | Uint8Array | string>(jws: string, key: CryptoKey | JWK | Uint8Array | KeyLookupFunction, options?: JWSVerifyOptions): Promise<JWSVerifyResult<T>>;
+declare function verify(jws: string, key: CryptoKey | JWK | Uint8Array | KeyLookupFunction, options: JWSVerifyOptions & {
+    forceUint8Array: true;
+}): Promise<JWSVerifyResult<Uint8Array>>;
+
+type jws_JWSAlgorithm = JWSAlgorithm;
+type jws_JWSHeaderParameters = JWSHeaderParameters;
+type jws_JWSProtectedHeader = JWSProtectedHeader;
+type jws_JWSSignOptions = JWSSignOptions;
+type jws_JWSVerifyOptions = JWSVerifyOptions;
+type jws_JWSVerifyResult<T = JWTClaims | Uint8Array | string> = JWSVerifyResult<T>;
+declare const jws_sign: typeof sign;
+declare const jws_verify: typeof verify;
+declare namespace jws {
+  export { jws_sign as sign, jws_verify as verify };
+  export type { jws_JWSAlgorithm as JWSAlgorithm, jws_JWSHeaderParameters as JWSHeaderParameters, jws_JWSProtectedHeader as JWSProtectedHeader, jws_JWSSignOptions as JWSSignOptions, jws_JWSVerifyOptions as JWSVerifyOptions, jws_JWSVerifyResult as JWSVerifyResult };
+}
+
+export { jws as j, sign as s, verify as v };
+export type { JWSAlgorithm as J, JWSHeaderParameters as a, JWSProtectedHeader as b, JWSSignOptions as c, JWSVerifyResult as d, JWSVerifyOptions as e };

package/dist/shared/unjwt.DoVzOnty.d.ts

@@ -0,0 +1,52 @@
+import { i as JWK_RSA_Public } from './unjwt.C0bBN0AC.js';
+
+/** Header Parameters common to JWE and JWS */
+interface JoseHeaderParameters {
+    /** "kid" (Key ID) Header Parameter */
+    kid?: string;
+    /** "x5t" (X.509 Certificate SHA-1 Thumbprint) Header Parameter */
+    x5t?: string;
+    /** "x5c" (X.509 Certificate Chain) Header Parameter */
+    x5c?: string[];
+    /** "x5u" (X.509 URL) Header Parameter */
+    x5u?: string;
+    /** "jku" (JWK Set URL) Header Parameter */
+    jku?: string;
+    /** "jwk" (JSON Web Key) Header Parameter */
+    jwk?: JWK_RSA_Public;
+    /** "typ" (Type) Header Parameter */
+    typ?: string;
+    /** "cty" (Content Type) Header Parameter */
+    cty?: string;
+    /** "crit" (Critical) Header Parameter */
+    crit?: string[];
+    /** Any other JWS/JWE Header member. */
+    [propName: string]: unknown;
+}
+interface JWTClaims {
+    /** "iss" (Issuer) Claim */
+    iss?: string;
+    /** "sub" (Subject) Claim */
+    sub?: string;
+    /** "aud" (Audience) Claim */
+    aud?: string | string[];
+    /** "exp" (Expiration Time) Claim */
+    exp?: number;
+    /** "nbf" (Not Before) Claim */
+    nbf?: number;
+    /** "iat" (Issued At) Claim */
+    iat?: number;
+    /** "jti" (JWT ID) Claim */
+    jti?: string;
+    /** Any other JWT member. */
+    [propName: string]: unknown;
+}
+interface JWT<T = JWTClaims> {
+    header: JoseHeaderParameters & {
+        /** "alg" (Algorithm) Header Parameter */
+        alg: string;
+    };
+    claims: T;
+}
+
+export type { JoseHeaderParameters as J, JWTClaims as a, JWT as b };

package/dist/shared/unjwt.Dz5Oe9BG.d.mts

@@ -0,0 +1,189 @@
+import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, f as JWK_EC_Public, m as JWK } from './unjwt.C0bBN0AC.mjs';
+import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.D90BbcE1.mjs';
+
+/** Recognized JWE Header Parameters, any other Header Members may also be present. */
+interface JWEHeaderParameters extends JoseHeaderParameters {
+    /**
+     * `alg` (Algorithm): Header Parameter - Key Management Algorithm
+     */
+    alg?: string;
+    /**
+     * `enc` (Encryption Algorithm): Header Parameter - Content Encryption Algorithm
+     */
+    enc?: string;
+    /**
+     * `p2c` (PBES2 Count): Header Parameter
+     */
+    p2c?: number;
+    /**
+     * `p2s` (PBES2 Salt): Header Parameter. Base64URL encoded.
+     */
+    p2s?: string;
+    /**
+     * "iv" (Initialization Vector) Header Parameter for AES GCM Key Wrapping. Base64URL encoded.
+     */
+    iv?: string;
+    /**
+     * "tag" (Authentication Tag) Header Parameter for AES GCM Key Wrapping. Base64URL encoded.
+     */
+    tag?: string;
+    /**
+     * "epk" (Ephemeral Public Key) Header Parameter for ECDH-ES.
+     */
+    epk?: JWK_EC_Public;
+    /**
+     * "apu" (Agreement PartyUInfo) Header Parameter for ECDH-ES. Base64URL encoded.
+     */
+    apu?: string;
+    /**
+     * "apv" (Agreement PartyVInfo) Header Parameter for ECDH-ES. Base64URL encoded.
+     */
+    apv?: string;
+    /** Any other JWE Header member. */
+    [propName: string]: unknown;
+}
+/** Recognized JWE Key Management-related Header Parameters. */
+interface JWEKeyManagementHeaderParameters {
+    apu?: Uint8Array;
+    apv?: Uint8Array;
+    /**
+     * For Internal use only
+     */
+    p2c?: number;
+    /**
+     * For Internal use only
+     */
+    p2s?: Uint8Array;
+    /**
+     * For Internal use only
+     */
+    iv?: Uint8Array;
+    /**
+     * For Internal use only
+     */
+    epk?: CryptoKey;
+}
+/**
+ * JWE (JSON Web Encryption) encryption options
+ */
+interface JWEEncryptOptions {
+    /** JWE "alg" (Algorithm) Header Parameter. Key Management Algorithm. */
+    alg?: KeyManagementAlgorithm;
+    /** JWE "enc" (Encryption Algorithm) Header Parameter. Content Encryption Algorithm. */
+    enc?: ContentEncryptionAlgorithm;
+    /** Additional JWE Protected Header parameters. */
+    protectedHeader?: Omit<JWEHeaderParameters, "alg" | "enc" | "iv" | "tag" | "p2s" | "p2c" | "apu" | "apv">;
+    /** Initialization Vector for AES-GCMKW key wrapping. Generated if not provided. */
+    keyManagementIV?: Uint8Array;
+    /** PBES2 Salt value (p2s). Required for PBES2 algorithms. */
+    p2s?: Uint8Array;
+    /** PBES2 Iteration count (p2c). Required for PBES2 algorithms. */
+    p2c?: number;
+    /** ECDH-ES Agreement PartyUInfo. */
+    ecdhPartyUInfo?: Uint8Array;
+    /** ECDH-ES Agreement PartyVInfo. */
+    ecdhPartyVInfo?: Uint8Array;
+    /**
+     * Content Encryption Key (CEK) to use.
+     * If provided, it will be used directly. Otherwise, a CEK will be generated.
+     */
+    cek?: Uint8Array;
+    /**
+     * Initialization Vector for content encryption.
+     * If provided, it will be used. Otherwise, one will be generated.
+     */
+    contentEncryptionIV?: Uint8Array;
+}
+/**
+ * Key lookup function for JWE decryption.
+ * @param header The JWE Protected Header.
+ * @returns The key material (CryptoKey, JWK, password string, or raw Uint8Array) or a Promise resolving to it.
+ */
+type JWEKeyLookupFunction = (header: JWEHeaderParameters) => CryptoKey | JWK | string | Uint8Array | Promise<CryptoKey | JWK | string | Uint8Array>;
+/**
+ * JWE (JSON Web Encryption) decryption options
+ */
+interface JWEDecryptOptions {
+    /** A list of allowed JWE "alg" (Algorithm) Header Parameter values for key management. */
+    algorithms?: KeyManagementAlgorithm[];
+    /** A list of allowed JWE "enc" (Encryption Algorithm) Header Parameter values for content encryption. */
+    encryptionAlgorithms?: ContentEncryptionAlgorithm[];
+    /**
+     * Critical Header Parameters to be understood and processed.
+     * If the JWE contains critical headers not in this list (and not inherently understood by the library), decryption will fail.
+     */
+    critical?: string[];
+    /** Algorithm to import the unwrapped CEK as (e.g., { name: 'AES-GCM' }). Defaults based on 'enc'. */
+    unwrappedKeyAlgorithm?: Parameters<typeof crypto.subtle.importKey>[2];
+    /** Key usages for the unwrapped CEK. Defaults based on 'enc' (typically ['encrypt', 'decrypt']). */
+    keyUsage?: KeyUsage[];
+    /** Mark the unwrapped CEK as extractable. Defaults to true. */
+    extractable?: boolean;
+    /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred based on JWE headers. */
+    forceUint8Array?: boolean;
+}
+/**
+ * Result of a JWE decryption operation.
+ */
+interface JWEDecryptResult<T = JWTClaims | string> {
+    /** The decrypted payload. */
+    payload: T;
+    /** The JWE Protected Header. */
+    protectedHeader: JWEHeaderParameters;
+    /** The Content Encryption Key (CEK) used for decryption, as Uint8Array. */
+    cek: Uint8Array;
+    /** The Additional Authenticated Data (AAD) used, as Uint8Array. */
+    aad: Uint8Array;
+}
+
+/**
+ * Encrypts a payload to produce a JWE Compact Serialization string.
+ *
+ * @param payload The payload to encrypt. Can be a string, Uint8Array, or a JSON-serializable object.
+ * @param key The key encryption key (KEK). Can be a CryptoKey, JWK, or for PBES2, a password string/Uint8Array.
+ * @param options JWE encryption options, including `alg` (key management algorithm) and `enc` (content encryption algorithm).
+ * @returns A Promise resolving to the JWE Compact Serialization string.
+ */
+declare function encrypt(payload: JWTClaims, key: JWK | string | Uint8Array, options?: JWEEncryptOptions): Promise<string>;
+declare function encrypt(payload: string | Uint8Array | Record<string, any>, key: JWK | string | Uint8Array, options?: JWEEncryptOptions): Promise<string>;
+declare function encrypt(payload: JWTClaims, key: CryptoKey, options: JWEEncryptOptions & {
+    alg: KeyManagementAlgorithm;
+    enc: ContentEncryptionAlgorithm;
+}): Promise<string>;
+declare function encrypt(payload: string | Uint8Array | Record<string, any>, key: CryptoKey, options: JWEEncryptOptions & {
+    alg: KeyManagementAlgorithm;
+    enc: ContentEncryptionAlgorithm;
+}): Promise<string>;
+declare function encrypt(payload: string | Uint8Array | Record<string, any>, key: CryptoKey | JWK | string | Uint8Array, options: JWEEncryptOptions & {
+    alg: KeyManagementAlgorithm;
+    enc: ContentEncryptionAlgorithm;
+}): Promise<string>;
+/**
+ * Decrypts a JWE Compact Serialization string.
+ *
+ * @param jwe The JWE Compact Serialization string.
+ * @param key The key decryption key (KEK) or a function to look up the key.
+ * @param options JWE decryption options.
+ * @returns A Promise resolving to an object containing the decrypted plaintext, protected header, CEK, and AAD.
+ * @throws If JWE is invalid, decryption fails, or options are not met.
+ */
+declare function decrypt<T = JWTClaims | string>(jwe: string, key: CryptoKey | JWK | string | Uint8Array | JWEKeyLookupFunction, options?: JWEDecryptOptions): Promise<JWEDecryptResult<T>>;
+declare function decrypt(jwe: string, key: CryptoKey | JWK | string | Uint8Array | JWEKeyLookupFunction, options: JWEDecryptOptions & {
+    forceUint8Array: true;
+}): Promise<JWEDecryptResult<Uint8Array>>;
+
+type jwe_JWEDecryptOptions = JWEDecryptOptions;
+type jwe_JWEDecryptResult<T = JWTClaims | string> = JWEDecryptResult<T>;
+type jwe_JWEEncryptOptions = JWEEncryptOptions;
+type jwe_JWEHeaderParameters = JWEHeaderParameters;
+type jwe_JWEKeyLookupFunction = JWEKeyLookupFunction;
+type jwe_JWEKeyManagementHeaderParameters = JWEKeyManagementHeaderParameters;
+declare const jwe_decrypt: typeof decrypt;
+declare const jwe_encrypt: typeof encrypt;
+declare namespace jwe {
+  export { jwe_decrypt as decrypt, jwe_encrypt as encrypt };
+  export type { jwe_JWEDecryptOptions as JWEDecryptOptions, jwe_JWEDecryptResult as JWEDecryptResult, jwe_JWEEncryptOptions as JWEEncryptOptions, jwe_JWEHeaderParameters as JWEHeaderParameters, jwe_JWEKeyLookupFunction as JWEKeyLookupFunction, jwe_JWEKeyManagementHeaderParameters as JWEKeyManagementHeaderParameters };
+}
+
+export { encrypt as f, decrypt as g, jwe as j };
+export type { JWEHeaderParameters as J, JWEKeyManagementHeaderParameters as a, JWEEncryptOptions as b, JWEKeyLookupFunction as c, JWEDecryptOptions as d, JWEDecryptResult as e };

package/dist/shared/unjwt.mc4AEAT7.d.ts

@@ -0,0 +1,46 @@
+import { m as JWK } from './unjwt.C0bBN0AC.js';
+
+declare const textEncoder: TextEncoder;
+declare const textDecoder: TextDecoder;
+declare function base64UrlEncode(data: Uint8Array | string): string;
+declare function base64UrlDecode(): string;
+declare function base64UrlDecode(str?: string | undefined): string;
+declare function base64UrlDecode<T extends boolean | undefined>(str?: string | undefined, toString?: T): T extends false ? Uint8Array : string;
+declare function randomBytes(length: Readonly<number>): Uint8Array;
+/**
+ * Concatenates multiple Uint8Arrays
+ * @param arrays Arrays to concatenate
+ * @returns Concatenated array
+ */
+declare function concatUint8Arrays(...arrays: Readonly<Uint8Array[]>): Uint8Array;
+declare function isJWK(key: any): key is JWK;
+declare function assertCryptoKey(key: unknown): asserts key is CryptoKey;
+declare function isCryptoKey(key: unknown): key is CryptoKey;
+declare const isCryptoKeyPair: (key: any) => key is CryptoKeyPair;
+
+declare const index_assertCryptoKey: typeof assertCryptoKey;
+declare const index_base64UrlDecode: typeof base64UrlDecode;
+declare const index_base64UrlEncode: typeof base64UrlEncode;
+declare const index_concatUint8Arrays: typeof concatUint8Arrays;
+declare const index_isCryptoKey: typeof isCryptoKey;
+declare const index_isCryptoKeyPair: typeof isCryptoKeyPair;
+declare const index_isJWK: typeof isJWK;
+declare const index_randomBytes: typeof randomBytes;
+declare const index_textDecoder: typeof textDecoder;
+declare const index_textEncoder: typeof textEncoder;
+declare namespace index {
+  export {
+    index_assertCryptoKey as assertCryptoKey,
+    index_base64UrlDecode as base64UrlDecode,
+    index_base64UrlEncode as base64UrlEncode,
+    index_concatUint8Arrays as concatUint8Arrays,
+    index_isCryptoKey as isCryptoKey,
+    index_isCryptoKeyPair as isCryptoKeyPair,
+    index_isJWK as isJWK,
+    index_randomBytes as randomBytes,
+    index_textDecoder as textDecoder,
+    index_textEncoder as textEncoder,
+  };
+}
+
+export { textDecoder as a, base64UrlEncode as b, base64UrlDecode as c, concatUint8Arrays as d, isJWK as e, assertCryptoKey as f, isCryptoKey as g, isCryptoKeyPair as h, index as i, randomBytes as r, textEncoder as t };

package/dist/shared/unjwt.ppm5Y0k7.d.ts

@@ -0,0 +1,100 @@
+import { n as JWK_HMAC, o as JWK_RSA_SIGN, p as JWK_RSA_PSS, q as JWK_ECDSA, m as JWK } from './unjwt.C0bBN0AC.js';
+import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.DoVzOnty.js';
+
+type JWS_SIGN_EXTRA = "Ed25519" | "EdDSA";
+/** JWS Signing Algorithm Identifier. */
+type JWSAlgorithm = JWK_HMAC | JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWS_SIGN_EXTRA;
+/** Recognized JWS Header Parameters, any other Header Members may also be present. */
+interface JWSHeaderParameters extends JoseHeaderParameters {
+    /** JWS "alg" (Algorithm) Header Parameter */
+    alg?: JWSAlgorithm;
+    /**
+     * This JWS Extension Header Parameter modifies the JWS Payload representation and the JWS Signing
+     * Input computation as per {@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}.
+     * If `false`, the payload is used directly without Base64URL encoding.
+     * Defaults to `true`.
+     */
+    b64?: boolean;
+}
+/** JWS Protected Header */
+interface JWSProtectedHeader extends JWSHeaderParameters {
+    alg: JWSAlgorithm;
+}
+/**
+ * JWS (JSON Web Signature) options for signing
+ */
+interface JWSSignOptions {
+    /** The JWS Algorithm to use. Must be provided. */
+    alg?: JWSAlgorithm;
+    /**
+     * Additional protected header parameters. `alg` is automatically included.
+     * `typ` defaults to "JWT" if not provided.
+     */
+    protectedHeader?: JWSHeaderParameters;
+}
+/** Result of JWS verification */
+interface JWSVerifyResult<T = JWTClaims | Uint8Array | string> {
+    /** The decoded and verified payload. */
+    payload: T;
+    /** The JWS Protected Header. */
+    protectedHeader: JWSProtectedHeader;
+}
+/** Options for JWS verification */
+interface JWSVerifyOptions {
+    /** List of allowed algorithms. If provided, the JWS `alg` must be in this list. */
+    algorithms?: JWSAlgorithm[];
+    /** List of critical header parameters that must be understood and processed. */
+    critical?: string[];
+    /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred. */
+    forceUint8Array?: boolean;
+}
+
+/**
+ * Creates a JWS (JSON Web Signature) in Compact Serialization format.
+ *
+ * @param payload The payload to sign. Can be a string, Uint8Array, or an object (which will be JSON stringified).
+ * @param key The signing key (CryptoKey, JWK, or raw symmetric key as Uint8Array).
+ * @param options Signing options, including the algorithm (`alg`) and protected header parameters.
+ * @returns A Promise resolving to the JWS Compact Serialization string.
+ */
+declare function sign(payload: JWTClaims, key: JWK | Uint8Array, options?: JWSSignOptions): Promise<string>;
+declare function sign(payload: string | Uint8Array | Record<string, any>, key: JWK | Uint8Array, options?: JWSSignOptions): Promise<string>;
+declare function sign(payload: JWTClaims, key: CryptoKey, options: JWSSignOptions & {
+    alg: JWSAlgorithm;
+}): Promise<string>;
+declare function sign(payload: string | Uint8Array | Record<string, any>, key: CryptoKey, options: JWSSignOptions & {
+    alg: JWSAlgorithm;
+}): Promise<string>;
+declare function sign(payload: string | Uint8Array | Record<string, any>, key: CryptoKey | JWK | Uint8Array, options: JWSSignOptions & {
+    alg: JWSAlgorithm;
+}): Promise<string>;
+type KeyLookupFunction = (header: JWSProtectedHeader) => CryptoKey | JWK | Uint8Array | Promise<CryptoKey | JWK | Uint8Array>;
+/**
+ * Verifies a JWS (JSON Web Signature) in Compact Serialization format.
+ *
+ * @param jws The JWS Compact Serialization string.
+ * @param key The verification key (CryptoKey, JWK, raw symmetric key as Uint8Array, or a function resolving the key).
+ * @param options Verification options, such as allowed algorithms.
+ * @returns A Promise resolving to an object containing the verified payload and protected header.
+ * @throws If the JWS is invalid, signature verification fails, or options are not met.
+ */
+declare function verify<T = JWTClaims | Uint8Array | string>(jws: string, key: CryptoKey | JWK | Uint8Array | KeyLookupFunction, options?: JWSVerifyOptions): Promise<JWSVerifyResult<T>>;
+declare function verify(jws: string, key: CryptoKey | JWK | Uint8Array | KeyLookupFunction, options: JWSVerifyOptions & {
+    forceUint8Array: true;
+}): Promise<JWSVerifyResult<Uint8Array>>;
+
+type jws_JWSAlgorithm = JWSAlgorithm;
+type jws_JWSHeaderParameters = JWSHeaderParameters;
+type jws_JWSProtectedHeader = JWSProtectedHeader;
+type jws_JWSSignOptions = JWSSignOptions;
+type jws_JWSVerifyOptions = JWSVerifyOptions;
+type jws_JWSVerifyResult<T = JWTClaims | Uint8Array | string> = JWSVerifyResult<T>;
+declare const jws_sign: typeof sign;
+declare const jws_verify: typeof verify;
+declare namespace jws {
+  export { jws_sign as sign, jws_verify as verify };
+  export type { jws_JWSAlgorithm as JWSAlgorithm, jws_JWSHeaderParameters as JWSHeaderParameters, jws_JWSProtectedHeader as JWSProtectedHeader, jws_JWSSignOptions as JWSSignOptions, jws_JWSVerifyOptions as JWSVerifyOptions, jws_JWSVerifyResult as JWSVerifyResult };
+}
+
+export { jws as j, sign as s, verify as v };
+export type { JWSAlgorithm as J, JWSHeaderParameters as a, JWSProtectedHeader as b, JWSSignOptions as c, JWSVerifyResult as d, JWSVerifyOptions as e };

package/dist/shared/unjwt.sux3_Z19.mjs

@@ -0,0 +1,101 @@
+import { c as checkSigCryptoKey } from './unjwt.DKq5VF7t.mjs';
+
+/**
+ * This is a fork of Jose library's utility functions.
+ * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/sign.ts
+ * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/verify.ts
+ * @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
+ */
+async function sign(alg, key, data) {
+  const cryptoKey = await getSignVerifyKey(alg, key, "sign");
+  checkKeyLength(alg, cryptoKey);
+  const signature = await crypto.subtle.sign(
+    subtleAlgorithm(alg, cryptoKey.algorithm),
+    cryptoKey,
+    data
+  );
+  return new Uint8Array(signature);
+}
+async function verify(alg, key, signature, data) {
+  const cryptoKey = await getSignVerifyKey(alg, key, "verify");
+  checkKeyLength(alg, cryptoKey);
+  const algorithm = subtleAlgorithm(alg, cryptoKey.algorithm);
+  try {
+    return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);
+  } catch {
+    return false;
+  }
+}
+function checkKeyLength(alg, key) {
+  if (alg.startsWith("RS") || alg.startsWith("PS")) {
+    const { modulusLength } = key.algorithm;
+    if (typeof modulusLength !== "number" || modulusLength < 2048) {
+      throw new TypeError(
+        `${alg} requires key modulusLength to be 2048 bits or larger`
+      );
+    }
+  }
+}
+async function getSignVerifyKey(alg, key, usage) {
+  if (key instanceof Uint8Array) {
+    if (!alg.startsWith("HS")) {
+      throw new TypeError(
+        `Key must be ${key} of type: CryptoKey or JSON Web Key`
+      );
+    }
+    return crypto.subtle.importKey(
+      "raw",
+      key,
+      { hash: `SHA-${alg.slice(-3)}`, name: "HMAC" },
+      false,
+      [usage]
+    );
+  }
+  checkSigCryptoKey(key, alg, usage);
+  return key;
+}
+function subtleAlgorithm(alg, algorithm) {
+  const hash = `SHA-${alg.slice(-3)}`;
+  switch (alg) {
+    case "HS256":
+    case "HS384":
+    case "HS512": {
+      return { hash, name: "HMAC" };
+    }
+    case "PS256":
+    case "PS384":
+    case "PS512": {
+      return {
+        hash,
+        name: "RSA-PSS",
+        saltLength: Number.parseInt(alg.slice(-3), 10) >> 3
+      };
+    }
+    case "RS256":
+    case "RS384":
+    case "RS512": {
+      return { hash, name: "RSASSA-PKCS1-v1_5" };
+    }
+    case "ES256":
+    case "ES384":
+    case "ES512": {
+      return {
+        hash,
+        name: "ECDSA",
+        namedCurve: algorithm.namedCurve
+      };
+    }
+    case "Ed25519":
+    // Fall through
+    case "EdDSA": {
+      return { name: "Ed25519" };
+    }
+    default: {
+      throw new Error(
+        `alg ${alg} is not supported either by JOSE or your javascript runtime`
+      );
+    }
+  }
+}
+
+export { checkKeyLength as c, sign as s, verify as v };

package/dist/utils.d.mts

@@ -0,0 +1,2 @@
+import './shared/unjwt.C0bBN0AC.mjs';
+export { f as assertCryptoKey, c as base64UrlDecode, b as base64UrlEncode, d as concatUint8Arrays, g as isCryptoKey, h as isCryptoKeyPair, e as isJWK, r as randomBytes, a as textDecoder, t as textEncoder } from './shared/unjwt.CJ_ohCFC.mjs';

package/dist/utils.d.ts

@@ -0,0 +1,2 @@
+import './shared/unjwt.C0bBN0AC.js';
+export { f as assertCryptoKey, c as base64UrlDecode, b as base64UrlEncode, d as concatUint8Arrays, g as isCryptoKey, h as isCryptoKeyPair, e as isJWK, r as randomBytes, a as textDecoder, t as textEncoder } from './shared/unjwt.mc4AEAT7.js';

package/dist/utils.mjs

@@ -0,0 +1 @@
+export { f as assertCryptoKey, d as base64UrlDecode, b as base64UrlEncode, e as concatUint8Arrays, g as isCryptoKey, h as isCryptoKeyPair, a as isJWK, r as randomBytes, c as textDecoder, t as textEncoder } from './shared/unjwt.CjHZv3F3.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",
@@ -26,6 +26,10 @@
     "./jws": {
       "types": "./dist/jws.d.mts",
       "default": "./dist/jws.mjs"
+    },
+    "./utils": {
+      "types": "./dist/utils.d.mts",
+      "default": "./dist/utils.mjs"
     }
   },
   "main": "./dist/index.mjs",
@@ -41,12 +45,12 @@
     "lint:fix": "automd && eslint . --fix && prettier -w .",
     "prepack": "pnpm build",
     "release": "pnpm test && pnpm prepack && changelogen --release --push --publish",
-    "test": "pnpm lint && pnpm test:types && vitest run --coverage",
+    "test": "pnpm lint && pnpm test:types && vitest run --coverage --slowTestThreshold=500",
     "test:types": "tsc --noEmit --skipLibCheck"
   },
   "devDependencies": {
     "@types/node": "^22.13.13",
-    "@vitest/coverage-v8": "^3.0.9",
+    "@vitest/coverage-v8": "^3.1.2",
     "automd": "^0.4.0",
     "changelogen": "^0.6.1",
     "eslint": "^9.23.0",
@@ -54,7 +58,7 @@
     "prettier": "^3.5.3",
     "typescript": "^5.8.2",
     "unbuild": "^3.5.0",
-    "vitest": "^3.0.9"
+    "vitest": "^3.1.2"
   },
   "packageManager": "pnpm@10.7.0"
 }