unjwt 0.4.0 → 0.5.0

package/dist/shared/unjwt.DGsIvgyn.d.ts

@@ -1,106 +0,0 @@
-import { K as KEY_WRAPPING_ALGORITHMS, C as CONTENT_ENCRYPTION_ALGORITHMS, J as JoseHeaderParameters } from './unjwt.ChP7VhqI.js';
-
-type KeyWrappingAlgorithmType = keyof typeof KEY_WRAPPING_ALGORITHMS;
-type ContentEncryptionAlgorithmType = keyof typeof CONTENT_ENCRYPTION_ALGORITHMS;
-interface JWEHeaderParameters extends JoseHeaderParameters {
-    /**
-     * `alg` (Algorithm): Header Parameter
-     *
-     * @default "PBES2-HS256+A128KW"
-     */
-    alg?: KeyWrappingAlgorithmType;
-    /**
-     * `enc` (Encryption Algorithm): Header Parameter
-     *
-     * @default "A256GCM"
-     */
-    enc?: ContentEncryptionAlgorithmType;
-    /**
-     * `p2c` (PBES2 Count): Header Parameter
-     *
-     * @default 2048
-     */
-    p2c?: number;
-    /**
-     * `p2s` (PBES2 Salt): Header Parameter
-     */
-    p2s?: string;
-}
-/**
- * JWE (JSON Web Encryption) options
- */
-interface JWEOptions {
-    /**
-     * Number of iterations for PBES2 key derivation
-     * Also accessible as `protectedHeader.p2c`
-     *
-     * @default 2048
-     */
-    iterations?: number;
-    /**
-     * Size of the salt for PBES2 key derivation
-     *
-     * @default 16
-     */
-    saltSize?: number;
-    /**
-     * Additional protected header parameters
-     */
-    protectedHeader?: JWEHeaderParameters;
-}
-
-/** The default settings. */
-declare const JWE_DEFAULTS: Readonly<{
-    saltSize: 16;
-    iterations: 2048;
-    alg: KeyWrappingAlgorithmType;
-    enc: ContentEncryptionAlgorithmType;
-}>;
-/**
- * Seal (encrypt) data using JWE with configurable algorithms
- * @param data The data to encrypt
- * @param password The password to use for encryption
- * @param options Optional parameters
- * @returns Promise resolving to the compact JWE token
- */
-declare function seal(data: string | Uint8Array, password: string | Uint8Array, options?: JWEOptions): Promise<string>;
-/**
- * Decrypts a JWE (JSON Web Encryption) token
- * @param token The JWE token string in compact serialization format
- * @param password The password used to derive the encryption key
- * @returns The decrypted content as a string
- */
-declare function unseal(token: string, password: string | Uint8Array): Promise<string>;
-/**
- * Decrypts a JWE (JSON Web Encryption) token
- * @param token The JWE token string in compact serialization format
- * @param password The password used to derive the encryption key
- * @param options Decryption options
- * @returns The decrypted content as a string
- */
-declare function unseal(token: string, password: string | Uint8Array, options: {
-    textOutput: true;
-}): Promise<string>;
-/**
- * Decrypts a JWE (JSON Web Encryption) token
- * @param token The JWE token string in compact serialization format
- * @param password The password used to derive the encryption key
- * @param options Decryption options
- * @returns The decrypted content as a Uint8Array
- */
-declare function unseal(token: string, password: string | Uint8Array, options: {
-    textOutput: false;
-}): Promise<Uint8Array>;
-
-declare const jwe_JWE_DEFAULTS: typeof JWE_DEFAULTS;
-declare const jwe_seal: typeof seal;
-declare const jwe_unseal: typeof unseal;
-declare namespace jwe {
-  export {
-    jwe_JWE_DEFAULTS as JWE_DEFAULTS,
-    jwe_seal as seal,
-    jwe_unseal as unseal,
-  };
-}
-
-export { JWE_DEFAULTS as J, jwe as j, seal as s, unseal as u };

package/dist/shared/unjwt.DPTwlVpK.mjs

@@ -1,28 +0,0 @@
-const textEncoder = /* @__PURE__ */ new TextEncoder();
-const textDecoder = /* @__PURE__ */ new TextDecoder();
-function base64UrlEncode(data) {
-  return btoa(String.fromCodePoint(...data)).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
-}
-function base64UrlDecode(str) {
-  if (!str) {
-    return new Uint8Array(0);
-  }
-  str = str.replace(/-/g, "+").replace(/_/g, "/");
-  while (str.length % 4) str += "=";
-  return Uint8Array.from(atob(str), (b) => b.codePointAt(0));
-}
-function randomBytes(length) {
-  return crypto.getRandomValues(new Uint8Array(length));
-}
-function concatUint8Arrays(...arrays) {
-  const totalLength = arrays.reduce((length, arr) => length + arr.length, 0);
-  const result = new Uint8Array(totalLength);
-  let offset = 0;
-  for (const arr of arrays) {
-    result.set(arr, offset);
-    offset += arr.length;
-  }
-  return result;
-}
-
-export { textDecoder as a, base64UrlEncode as b, base64UrlDecode as c, concatUint8Arrays as d, randomBytes as r, textEncoder as t };

package/dist/shared/unjwt.Dr-mxtq9.d.mts

@@ -1,106 +0,0 @@
-import { K as KEY_WRAPPING_ALGORITHMS, C as CONTENT_ENCRYPTION_ALGORITHMS, J as JoseHeaderParameters } from './unjwt.4uzJv0cA.mjs';
-
-type KeyWrappingAlgorithmType = keyof typeof KEY_WRAPPING_ALGORITHMS;
-type ContentEncryptionAlgorithmType = keyof typeof CONTENT_ENCRYPTION_ALGORITHMS;
-interface JWEHeaderParameters extends JoseHeaderParameters {
-    /**
-     * `alg` (Algorithm): Header Parameter
-     *
-     * @default "PBES2-HS256+A128KW"
-     */
-    alg?: KeyWrappingAlgorithmType;
-    /**
-     * `enc` (Encryption Algorithm): Header Parameter
-     *
-     * @default "A256GCM"
-     */
-    enc?: ContentEncryptionAlgorithmType;
-    /**
-     * `p2c` (PBES2 Count): Header Parameter
-     *
-     * @default 2048
-     */
-    p2c?: number;
-    /**
-     * `p2s` (PBES2 Salt): Header Parameter
-     */
-    p2s?: string;
-}
-/**
- * JWE (JSON Web Encryption) options
- */
-interface JWEOptions {
-    /**
-     * Number of iterations for PBES2 key derivation
-     * Also accessible as `protectedHeader.p2c`
-     *
-     * @default 2048
-     */
-    iterations?: number;
-    /**
-     * Size of the salt for PBES2 key derivation
-     *
-     * @default 16
-     */
-    saltSize?: number;
-    /**
-     * Additional protected header parameters
-     */
-    protectedHeader?: JWEHeaderParameters;
-}
-
-/** The default settings. */
-declare const JWE_DEFAULTS: Readonly<{
-    saltSize: 16;
-    iterations: 2048;
-    alg: KeyWrappingAlgorithmType;
-    enc: ContentEncryptionAlgorithmType;
-}>;
-/**
- * Seal (encrypt) data using JWE with configurable algorithms
- * @param data The data to encrypt
- * @param password The password to use for encryption
- * @param options Optional parameters
- * @returns Promise resolving to the compact JWE token
- */
-declare function seal(data: string | Uint8Array, password: string | Uint8Array, options?: JWEOptions): Promise<string>;
-/**
- * Decrypts a JWE (JSON Web Encryption) token
- * @param token The JWE token string in compact serialization format
- * @param password The password used to derive the encryption key
- * @returns The decrypted content as a string
- */
-declare function unseal(token: string, password: string | Uint8Array): Promise<string>;
-/**
- * Decrypts a JWE (JSON Web Encryption) token
- * @param token The JWE token string in compact serialization format
- * @param password The password used to derive the encryption key
- * @param options Decryption options
- * @returns The decrypted content as a string
- */
-declare function unseal(token: string, password: string | Uint8Array, options: {
-    textOutput: true;
-}): Promise<string>;
-/**
- * Decrypts a JWE (JSON Web Encryption) token
- * @param token The JWE token string in compact serialization format
- * @param password The password used to derive the encryption key
- * @param options Decryption options
- * @returns The decrypted content as a Uint8Array
- */
-declare function unseal(token: string, password: string | Uint8Array, options: {
-    textOutput: false;
-}): Promise<Uint8Array>;
-
-declare const jwe_JWE_DEFAULTS: typeof JWE_DEFAULTS;
-declare const jwe_seal: typeof seal;
-declare const jwe_unseal: typeof unseal;
-declare namespace jwe {
-  export {
-    jwe_JWE_DEFAULTS as JWE_DEFAULTS,
-    jwe_seal as seal,
-    jwe_unseal as unseal,
-  };
-}
-
-export { JWE_DEFAULTS as J, jwe as j, seal as s, unseal as u };

package/dist/shared/unjwt.KOd0vXyx.mjs

@@ -1,90 +0,0 @@
-import { b as base64UrlEncode, t as textEncoder, a as textDecoder, c as base64UrlDecode } from './unjwt.DPTwlVpK.mjs';
-import { l as lookupAlgorithm, J as JWS_SYMMETRIC_ALGORITHMS } from './unjwt.DD0p18Gd.mjs';
-import { i as importKey } from './unjwt.C9ELsKeK.mjs';
-
-const JWS_DEFAULTS = /* @__PURE__ */ Object.freeze({
-  alg: "HS256"
-});
-async function sign(payload, secret, options = {}) {
-  if (!secret) {
-    throw new Error("Missing secret key");
-  }
-  const protectedHeader = options.protectedHeader || {};
-  const alg = protectedHeader.alg || JWS_DEFAULTS.alg;
-  const algConfig = validateJwsAlgorithm(alg);
-  const header = {
-    alg,
-    typ: "JWT",
-    ...protectedHeader
-  };
-  const encodedHeader = base64UrlEncode(
-    textEncoder.encode(JSON.stringify(header))
-  );
-  const encodedPayload = base64UrlEncode(
-    typeof payload === "string" ? textEncoder.encode(payload) : payload
-  );
-  const signingInput = textEncoder.encode(`${encodedHeader}.${encodedPayload}`);
-  const cryptoKey = await importKey(
-    secret,
-    { name: "HMAC", hash: algConfig.hash },
-    false,
-    ["sign"]
-  );
-  const signature = await crypto.subtle.sign(
-    { name: "HMAC" },
-    cryptoKey,
-    signingInput
-  );
-  const encodedSignature = base64UrlEncode(new Uint8Array(signature));
-  return `${encodedHeader}.${encodedPayload}.${encodedSignature}`;
-}
-async function verify(token, secret, options = {}) {
-  if (!token) {
-    throw new Error("Missing JWS token");
-  }
-  if (!secret) {
-    throw new Error("Missing secret key");
-  }
-  const textOutput = options.textOutput !== false;
-  const parts = token.split(".");
-  if (parts.length !== 3) {
-    throw new Error("Invalid JWS token format");
-  }
-  const [encodedHeader, encodedPayload, encodedSignature] = parts;
-  const header = JSON.parse(
-    textDecoder.decode(base64UrlDecode(encodedHeader))
-  );
-  const alg = header.alg;
-  const algConfig = validateJwsAlgorithm(alg);
-  const signingInput = textEncoder.encode(`${encodedHeader}.${encodedPayload}`);
-  const signature = base64UrlDecode(encodedSignature);
-  const cryptoKey = await importKey(
-    secret,
-    { name: "HMAC", hash: algConfig.hash },
-    false,
-    ["verify"]
-  );
-  const isValid = await crypto.subtle.verify(
-    { name: "HMAC" },
-    cryptoKey,
-    signature,
-    signingInput
-  );
-  if (!isValid) {
-    throw new Error("Signature verification failed");
-  }
-  const payloadBytes = base64UrlDecode(encodedPayload);
-  return textOutput ? textDecoder.decode(payloadBytes) : payloadBytes;
-}
-function validateJwsAlgorithm(alg) {
-  return lookupAlgorithm(alg, JWS_SYMMETRIC_ALGORITHMS, "JWS");
-}
-
-const jws = {
-  __proto__: null,
-  JWS_DEFAULTS: JWS_DEFAULTS,
-  sign: sign,
-  verify: verify
-};
-
-export { JWS_DEFAULTS as J, jws as j, sign as s, verify as v };

package/dist/shared/unjwt._GivNhs2.mjs

@@ -1,213 +0,0 @@
-import { t as textEncoder, r as randomBytes, b as base64UrlEncode, a as textDecoder, c as base64UrlDecode, d as concatUint8Arrays } from './unjwt.DPTwlVpK.mjs';
-import { l as lookupAlgorithm, K as KEY_WRAPPING_ALGORITHMS, C as CONTENT_ENCRYPTION_ALGORITHMS } from './unjwt.DD0p18Gd.mjs';
-
-const JWE_DEFAULTS = /* @__PURE__ */ Object.freeze({
-  saltSize: 16,
-  iterations: 2048,
-  alg: "PBES2-HS256+A128KW",
-  enc: "A256GCM"
-});
-async function seal(data, password, options = {}) {
-  const protectedHeader = options.protectedHeader || {};
-  const iterations = protectedHeader.p2c || options.iterations || JWE_DEFAULTS.iterations;
-  const saltSize = options.saltSize || JWE_DEFAULTS.saltSize;
-  const alg = protectedHeader.alg || JWE_DEFAULTS.alg;
-  const enc = protectedHeader.enc || JWE_DEFAULTS.enc;
-  validateKeyWrappingAlgorithm(alg);
-  const encConfig = validateContentEncryptionAlgorithm(enc);
-  const plaintext = typeof data === "string" ? textEncoder.encode(data) : data;
-  const saltInput = randomBytes(saltSize);
-  const header = {
-    alg,
-    enc,
-    p2s: base64UrlEncode(saltInput),
-    p2c: iterations,
-    ...protectedHeader
-  };
-  const encodedHeader = base64UrlEncode(
-    textEncoder.encode(JSON.stringify(header))
-  );
-  const derivedKey = await deriveKeyFromPassword(
-    password,
-    saltInput,
-    iterations,
-    alg
-  );
-  const {
-    wrappedKey,
-    rawCek: _,
-    cek
-  } = await generateAndWrapCEK(derivedKey, encConfig);
-  const iv = randomBytes(encConfig.ivLength);
-  let ciphertext;
-  let tag;
-  if (encConfig.type === "gcm") {
-    const result = await encryptGCM(
-      plaintext,
-      cek,
-      iv,
-      textEncoder.encode(encodedHeader),
-      encConfig
-    );
-    ciphertext = result.ciphertext;
-    tag = result.tag;
-  } else {
-    throw new Error(`Unsupported encryption type: ${encConfig.type}`);
-  }
-  return [
-    encodedHeader,
-    base64UrlEncode(new Uint8Array(wrappedKey)),
-    base64UrlEncode(iv),
-    base64UrlEncode(ciphertext),
-    base64UrlEncode(tag)
-  ].join(".");
-}
-async function unseal(token, password, options = {}) {
-  if (!token) {
-    throw new Error("Missing JWE token");
-  }
-  const textOutput = options.textOutput !== false;
-  const [
-    encodedHeader,
-    encryptedKey,
-    encodedIv,
-    encodedCiphertext,
-    encodedTag
-  ] = token.split(".");
-  const header = JSON.parse(textDecoder.decode(base64UrlDecode(encodedHeader)));
-  const alg = header.alg;
-  const enc = header.enc;
-  validateKeyWrappingAlgorithm(alg);
-  const encConfig = validateContentEncryptionAlgorithm(enc);
-  const iterations = header.p2c;
-  const saltInput = base64UrlDecode(header.p2s);
-  const derivedKey = await deriveKeyFromPassword(
-    password,
-    saltInput,
-    iterations,
-    alg
-  );
-  const wrappedKey = base64UrlDecode(encryptedKey);
-  const iv = base64UrlDecode(encodedIv);
-  const ciphertext = base64UrlDecode(encodedCiphertext);
-  const tag = base64UrlDecode(encodedTag);
-  const cek = await unwrapCEK(wrappedKey, derivedKey, encConfig);
-  let decrypted;
-  if (encConfig.type === "gcm") {
-    decrypted = await decryptGCM(
-      ciphertext,
-      tag,
-      cek,
-      iv,
-      textEncoder.encode(encodedHeader)
-    );
-  } else {
-    throw new Error(`Unsupported encryption type: ${encConfig.type}`);
-  }
-  return textOutput ? textDecoder.decode(decrypted) : decrypted;
-}
-async function deriveKeyFromPassword(password, saltInput, iterations, alg) {
-  if (!password) {
-    throw new Error("Missing password");
-  }
-  const algConfig = validateKeyWrappingAlgorithm(alg);
-  const baseKey = await crypto.subtle.importKey(
-    "raw",
-    typeof password === "string" ? textEncoder.encode(password) : password,
-    { name: "PBKDF2" },
-    false,
-    ["deriveKey"]
-  );
-  const salt = concatUint8Arrays(
-    textEncoder.encode(alg),
-    new Uint8Array([0]),
-    saltInput
-  );
-  return crypto.subtle.deriveKey(
-    {
-      name: "PBKDF2",
-      hash: algConfig.hash,
-      salt,
-      iterations
-    },
-    baseKey,
-    { name: "AES-KW", length: algConfig.keyLength },
-    false,
-    ["wrapKey", "unwrapKey"]
-  );
-}
-function validateKeyWrappingAlgorithm(alg) {
-  return lookupAlgorithm(alg, KEY_WRAPPING_ALGORITHMS, "key wrapping");
-}
-function validateContentEncryptionAlgorithm(enc) {
-  return lookupAlgorithm(
-    enc,
-    CONTENT_ENCRYPTION_ALGORITHMS,
-    "content encryption"
-  );
-}
-async function generateAndWrapCEK(derivedKey, encConfig) {
-  if (encConfig.type === "gcm") {
-    const cek = await crypto.subtle.generateKey(
-      { name: "AES-GCM", length: encConfig.keyLength },
-      true,
-      ["encrypt", "decrypt", "wrapKey", "unwrapKey"]
-    );
-    const wrappedKey = await crypto.subtle.wrapKey("raw", cek, derivedKey, {
-      name: "AES-KW"
-    });
-    return { wrappedKey, rawCek: null, cek };
-  }
-  throw new Error(`Unsupported encryption type: ${encConfig.type}`);
-}
-async function unwrapCEK(wrappedKey, derivedKey, encConfig) {
-  if (encConfig.type === "gcm") {
-    return crypto.subtle.unwrapKey(
-      "raw",
-      wrappedKey,
-      derivedKey,
-      { name: "AES-KW" },
-      { name: "AES-GCM", length: encConfig.keyLength },
-      false,
-      ["decrypt"]
-    );
-  }
-  throw new Error(`Unsupported encryption type: ${encConfig.type}`);
-}
-async function encryptGCM(plaintext, cek, iv, aad, encConfig) {
-  const ciphertext = await crypto.subtle.encrypt(
-    {
-      name: "AES-GCM",
-      iv,
-      additionalData: aad
-    },
-    cek,
-    plaintext
-  );
-  const encrypted = new Uint8Array(ciphertext);
-  const tag = encrypted.slice(-encConfig.tagLength);
-  const ciphertextOutput = encrypted.slice(0, -encConfig.tagLength);
-  return { ciphertext: ciphertextOutput, tag };
-}
-async function decryptGCM(ciphertext, tag, cek, iv, aad) {
-  const encryptedData = concatUint8Arrays(ciphertext, tag);
-  const decrypted = await crypto.subtle.decrypt(
-    {
-      name: "AES-GCM",
-      iv,
-      additionalData: aad
-    },
-    cek,
-    encryptedData
-  );
-  return new Uint8Array(decrypted);
-}
-
-const jwe = {
-  __proto__: null,
-  JWE_DEFAULTS: JWE_DEFAULTS,
-  seal: seal,
-  unseal: unseal
-};
-
-export { JWE_DEFAULTS as J, jwe as j, seal as s, unseal as u };

package/dist/shared/unjwt.zb2wBNCJ.d.mts

@@ -1,82 +0,0 @@
-/**
-Based on https://github.com/panva/jose/tree/v6.0.10
-Copyright (c) 2018 Filip Skokan.
-https://github.com/panva/jose/blob/v6.0.10/LICENSE.md
- */
-/** Generic JSON Web Key Parameters. */
-interface JWKParameters {
-    /** JWK "kty" (Key Type) Parameter */
-    kty?: string;
-    /**
-     * JWK "alg" (Algorithm) Parameter
-     *
-     * @see {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}
-     */
-    alg?: string;
-    /** JWK "key_ops" (Key Operations) Parameter */
-    key_ops?: string[];
-    /** JWK "ext" (Extractable) Parameter */
-    ext?: boolean;
-    /** JWK "use" (Public Key Use) Parameter */
-    use?: string;
-    /** JWK "x5c" (X.509 Certificate Chain) Parameter */
-    x5c?: string[];
-    /** JWK "x5t" (X.509 Certificate SHA-1 Thumbprint) Parameter */
-    x5t?: string;
-    /** JWK "x5t#S256" (X.509 Certificate SHA-256 Thumbprint) Parameter */
-    "x5t#S256"?: string;
-    /** JWK "x5u" (X.509 URL) Parameter */
-    x5u?: string;
-    /** JWK "kid" (Key ID) Parameter */
-    kid?: string;
-}
-/**
- * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC", "OKP", and "oct"
- * key types are supported.
- *
- * @see {@link JWK_OKP_Public}
- * @see {@link JWK_OKP_Private}
- * @see {@link JWK_EC_Public}
- * @see {@link JWK_EC_Private}
- * @see {@link JWK_RSA_Public}
- * @see {@link JWK_RSA_Private}
- * @see {@link JWK_oct}
- */
-interface JWK extends JWKParameters {
-    /**
-     * - EC JWK "crv" (Curve) Parameter
-     * - OKP JWK "crv" (The Subtype of Key Pair) Parameter
-     */
-    crv?: string;
-    /**
-     * - Private RSA JWK "d" (Private Exponent) Parameter
-     * - Private EC JWK "d" (ECC Private Key) Parameter
-     * - Private OKP JWK "d" (The Private Key) Parameter
-     */
-    d?: string;
-    /** Private RSA JWK "dp" (First Factor CRT Exponent) Parameter */
-    dp?: string;
-    /** Private RSA JWK "dq" (Second Factor CRT Exponent) Parameter */
-    dq?: string;
-    /** RSA JWK "e" (Exponent) Parameter */
-    e?: string;
-    /** Oct JWK "k" (Key Value) Parameter */
-    k?: string;
-    /** RSA JWK "n" (Modulus) Parameter */
-    n?: string;
-    /** Private RSA JWK "p" (First Prime Factor) Parameter */
-    p?: string;
-    /** Private RSA JWK "q" (Second Prime Factor) Parameter */
-    q?: string;
-    /** Private RSA JWK "qi" (First CRT Coefficient) Parameter */
-    qi?: string;
-    /**
-     * - EC JWK "x" (X Coordinate) Parameter
-     * - OKP JWK "x" (The public key) Parameter
-     */
-    x?: string;
-    /** EC JWK "y" (Y Coordinate) Parameter */
-    y?: string;
-}
-
-export type { JWK as J };