unjwt 0.5.1 → 0.5.2

package/dist/index.d.mts

@@ -1,6 +1,6 @@
 export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, B as JWKAlgorithm, E as JWKPEMAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, A as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, y as JWK_ED, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, z as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CxhGjEAX.mjs';
 export { b as JWT, a as JWTClaims, J as JoseHeaderParameters } from './shared/unjwt.Cd9nTEWg.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.BG_R52ey.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.kiNPBQh0.mjs';
 export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.DQIYSlHj.mjs';
-export { i as utils } from './shared/unjwt.B4fFiy1c.mjs';
+export { i as utils } from './shared/unjwt.BJEchXrM.mjs';
 export { j as jwk } from './shared/unjwt.D1J1DelP.mjs';

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, B as JWKAlgorithm, E as JWKPEMAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, A as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, y as JWK_ED, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, z as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CxhGjEAX.js';
 export { b as JWT, a as JWTClaims, J as JoseHeaderParameters } from './shared/unjwt.BISJ5yt1.js';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.CVKbKOFy.js';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.TbszLNOP.js';
 export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.B0XDPf8a.js';
-export { i as utils } from './shared/unjwt.DqmNvXMd.js';
+export { i as utils } from './shared/unjwt.B5N3dPN9.js';
 export { j as jwk } from './shared/unjwt.WvWb2zNM.js';

package/dist/index.mjs

@@ -1,5 +1,5 @@
-export { i as utils } from './shared/unjwt.DHdDAH0L.mjs';
-export { j as jwe } from './shared/unjwt.Ce72NmIz.mjs';
-export { j as jwk } from './shared/unjwt.1gbuWbc6.mjs';
-export { j as jws } from './shared/unjwt.BxqF-n1S.mjs';
-import './shared/unjwt.C9Xhi7hE.mjs';
+export { i as utils } from './shared/unjwt.DOI5UE8K.mjs';
+export { j as jwe } from './shared/unjwt.ByclPbtq.mjs';
+export { j as jwk } from './shared/unjwt.ZsOShfhX.mjs';
+export { j as jws } from './shared/unjwt.COPr8ebc.mjs';
+import './shared/unjwt.z_U3fRJ-.mjs';

package/dist/jwe.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.1gbuWbc6.mjs';
-import './shared/unjwt.DHdDAH0L.mjs';
-export { d as decrypt, e as encrypt } from './shared/unjwt.Ce72NmIz.mjs';
-import './shared/unjwt.C9Xhi7hE.mjs';
+import './shared/unjwt.ZsOShfhX.mjs';
+import './shared/unjwt.DOI5UE8K.mjs';
+export { d as decrypt, e as encrypt } from './shared/unjwt.ByclPbtq.mjs';
+import './shared/unjwt.z_U3fRJ-.mjs';

package/dist/jwk.mjs

@@ -1,2 +1,2 @@
-import './shared/unjwt.DHdDAH0L.mjs';
-export { o as deriveKeyFromPassword, s as exportJWKToPEM, p as exportKey, n as generateKey, r as importJWKFromPEM, i as importKey, l as unwrapKey, q as wrapKey } from './shared/unjwt.1gbuWbc6.mjs';
+import './shared/unjwt.DOI5UE8K.mjs';
+export { o as deriveKeyFromPassword, s as exportJWKToPEM, p as exportKey, n as generateKey, r as importJWKFromPEM, i as importKey, l as unwrapKey, q as wrapKey } from './shared/unjwt.ZsOShfhX.mjs';

package/dist/jws.d.mts

@@ -1,3 +1,3 @@
 import './shared/unjwt.CxhGjEAX.mjs';
 import './shared/unjwt.Cd9nTEWg.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.BG_R52ey.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.kiNPBQh0.mjs';

package/dist/jws.d.ts

@@ -1,3 +1,3 @@
 import './shared/unjwt.CxhGjEAX.js';
 import './shared/unjwt.BISJ5yt1.js';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.CVKbKOFy.js';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.TbszLNOP.js';

package/dist/jws.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.1gbuWbc6.mjs';
-import './shared/unjwt.DHdDAH0L.mjs';
-import './shared/unjwt.C9Xhi7hE.mjs';
-export { s as sign, v as verify } from './shared/unjwt.BxqF-n1S.mjs';
+import './shared/unjwt.ZsOShfhX.mjs';
+import './shared/unjwt.DOI5UE8K.mjs';
+import './shared/unjwt.z_U3fRJ-.mjs';
+export { s as sign, v as verify } from './shared/unjwt.COPr8ebc.mjs';

package/dist/shared/{unjwt.DqmNvXMd.d.ts → unjwt.B5N3dPN9.d.ts}

@@ -15,6 +15,7 @@ declare function randomBytes(length: Readonly<number>): Uint8Array;
  * @returns Concatenated array
  */
 declare function concatUint8Arrays(...arrays: Readonly<Uint8Array[]>): Uint8Array;
+declare function maybeArray<T>(item: T | T[]): T[];
 declare function isJWK(key: any): key is JWK;
 declare function assertCryptoKey(key: unknown): asserts key is CryptoKey;
 declare function isCryptoKey(key: unknown): key is CryptoKey;
@@ -29,6 +30,7 @@ declare const index_concatUint8Arrays: typeof concatUint8Arrays;
 declare const index_isCryptoKey: typeof isCryptoKey;
 declare const index_isCryptoKeyPair: typeof isCryptoKeyPair;
 declare const index_isJWK: typeof isJWK;
+declare const index_maybeArray: typeof maybeArray;
 declare const index_randomBytes: typeof randomBytes;
 declare const index_textDecoder: typeof textDecoder;
 declare const index_textEncoder: typeof textEncoder;
@@ -43,10 +45,11 @@ declare namespace index {
     index_isCryptoKey as isCryptoKey,
     index_isCryptoKeyPair as isCryptoKeyPair,
     index_isJWK as isJWK,
+    index_maybeArray as maybeArray,
     index_randomBytes as randomBytes,
     index_textDecoder as textDecoder,
     index_textEncoder as textEncoder,
   };
 }
 
-export { textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, assertCryptoKey as h, index as i, isCryptoKey as j, isCryptoKeyPair as k, randomBytes as r, textEncoder as t };
+export { textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, assertCryptoKey as h, index as i, isCryptoKey as j, isCryptoKeyPair as k, maybeArray as m, randomBytes as r, textEncoder as t };

package/dist/shared/{unjwt.B4fFiy1c.d.mts → unjwt.BJEchXrM.d.mts}

@@ -15,6 +15,7 @@ declare function randomBytes(length: Readonly<number>): Uint8Array;
  * @returns Concatenated array
  */
 declare function concatUint8Arrays(...arrays: Readonly<Uint8Array[]>): Uint8Array;
+declare function maybeArray<T>(item: T | T[]): T[];
 declare function isJWK(key: any): key is JWK;
 declare function assertCryptoKey(key: unknown): asserts key is CryptoKey;
 declare function isCryptoKey(key: unknown): key is CryptoKey;
@@ -29,6 +30,7 @@ declare const index_concatUint8Arrays: typeof concatUint8Arrays;
 declare const index_isCryptoKey: typeof isCryptoKey;
 declare const index_isCryptoKeyPair: typeof isCryptoKeyPair;
 declare const index_isJWK: typeof isJWK;
+declare const index_maybeArray: typeof maybeArray;
 declare const index_randomBytes: typeof randomBytes;
 declare const index_textDecoder: typeof textDecoder;
 declare const index_textEncoder: typeof textEncoder;
@@ -43,10 +45,11 @@ declare namespace index {
     index_isCryptoKey as isCryptoKey,
     index_isCryptoKeyPair as isCryptoKeyPair,
     index_isJWK as isJWK,
+    index_maybeArray as maybeArray,
     index_randomBytes as randomBytes,
     index_textDecoder as textDecoder,
     index_textEncoder as textEncoder,
   };
 }
 
-export { textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, assertCryptoKey as h, index as i, isCryptoKey as j, isCryptoKeyPair as k, randomBytes as r, textEncoder as t };
+export { textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, assertCryptoKey as h, index as i, isCryptoKey as j, isCryptoKeyPair as k, maybeArray as m, randomBytes as r, textEncoder as t };

package/dist/shared/{unjwt.Ce72NmIz.mjs → unjwt.ByclPbtq.mjs}

@@ -1,6 +1,6 @@
-import { a as checkEncCryptoKey, u as uint32be, g as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, b as bitLengthCEK, d as jwkTokey, i as importKey, f as generateIV, h as encrypt$1, l as unwrapKey, m as decrypt$1 } from './unjwt.1gbuWbc6.mjs';
-import { e as concatUint8Arrays, t as textEncoder, f as assertCryptoKey, b as base64UrlEncode, g as isCryptoKey, a as isJWK, d as base64UrlDecode, r as randomBytes, c as textDecoder } from './unjwt.DHdDAH0L.mjs';
-import { c as checkKeyLength } from './unjwt.C9Xhi7hE.mjs';
+import { a as checkEncCryptoKey, u as uint32be, g as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, b as bitLengthCEK, d as jwkTokey, i as importKey, f as generateIV, h as encrypt$1, l as unwrapKey, m as decrypt$1 } from './unjwt.ZsOShfhX.mjs';
+import { e as concatUint8Arrays, t as textEncoder, f as assertCryptoKey, b as base64UrlEncode, g as isCryptoKey, a as isJWK, d as base64UrlDecode, r as randomBytes, c as textDecoder } from './unjwt.DOI5UE8K.mjs';
+import { c as checkKeyLength } from './unjwt.z_U3fRJ-.mjs';
 
 function lengthAndInput(input) {
   return concatUint8Arrays(uint32be(input.length), input);

package/dist/shared/{unjwt.BxqF-n1S.mjs → unjwt.COPr8ebc.mjs}

@@ -1,6 +1,6 @@
-import { i as importKey } from './unjwt.1gbuWbc6.mjs';
-import { a as isJWK, b as base64UrlEncode, t as textEncoder, c as textDecoder, d as base64UrlDecode } from './unjwt.DHdDAH0L.mjs';
-import { s as sign$1, v as verify$1 } from './unjwt.C9Xhi7hE.mjs';
+import { i as importKey } from './unjwt.ZsOShfhX.mjs';
+import { a as isJWK, b as base64UrlEncode, t as textEncoder, c as textDecoder, d as base64UrlDecode, m as maybeArray } from './unjwt.DOI5UE8K.mjs';
+import { s as sign$1, v as verify$1 } from './unjwt.z_U3fRJ-.mjs';
 
 async function sign(payload, key, options = {}) {
   const { protectedHeader: additionalProtectedHeader } = options;
@@ -48,7 +48,7 @@ async function sign(payload, key, options = {}) {
   const signatureEncoded = base64UrlEncode(signatureBytes);
   return `${signingInputString}.${signatureEncoded}`;
 }
-async function verify(jws, key, options) {
+async function verify(jws, key, options = {}) {
   const parts = jws.split(".");
   if (parts.length !== 3) {
     throw new Error("Invalid JWS: Must contain three parts separated by dots.");
@@ -69,9 +69,14 @@ async function verify(jws, key, options) {
     );
   }
   const alg = protectedHeader.alg;
-  if (options?.algorithms && !options.algorithms.includes(alg)) {
+  if (options.algorithms && !options.algorithms.includes(alg)) {
     throw new Error(`Algorithm not allowed: ${alg}`);
   }
+  if (options.typ && protectedHeader.typ !== options.typ) {
+    throw new Error(
+      `Invalid JWS: "typ" (Type) Header Parameter mismatch. Expected "${options.typ}", got "${protectedHeader.typ}".`
+    );
+  }
   let signatureBytes;
   try {
     signatureBytes = base64UrlDecode(signatureEncoded, false);
@@ -97,13 +102,13 @@ async function verify(jws, key, options) {
   let payload;
   try {
     if (useB64) {
-      if (options?.forceUint8Array) {
+      if (options.forceUint8Array) {
         payload = base64UrlDecode(payloadEncoded, false);
       } else {
         const cty = protectedHeader.cty?.toLowerCase();
         const isJsonOutput = protectedHeader.typ === "JWT" || cty === "json" || cty === "application/json" || cty && cty.endsWith("+json");
+        const decodedString = base64UrlDecode(payloadEncoded);
         if (isJsonOutput) {
-          const decodedString = base64UrlDecode(payloadEncoded, true);
           if (decodedString.startsWith("{") && decodedString.endsWith("}") || decodedString.startsWith("[") && decodedString.endsWith("]")) {
             try {
               payload = JSON.parse(decodedString);
@@ -114,21 +119,23 @@ async function verify(jws, key, options) {
             payload = decodedString;
           }
         } else {
-          payload = base64UrlDecode(payloadEncoded);
+          payload = decodedString;
         }
       }
     } else {
-      payload = textEncoder.encode(payloadEncoded);
+      payload = options.forceUint8Array ? textEncoder.encode(payloadEncoded) : payloadEncoded;
     }
   } catch (error_) {
     throw new Error(
       `Invalid JWS: Payload decoding failed (${error_ instanceof Error ? error_.message : error_})`
     );
   }
-  if (options?.critical && protectedHeader.crit) {
+  if (protectedHeader.crit) {
+    const missingHeaderParams = /* @__PURE__ */ new Set();
     const recognizedParams = /* @__PURE__ */ new Set([
-      ...Object.keys(protectedHeader),
       ...options.critical || [],
+      // TODO: remove deprecated option
+      ...options.requiredHeaders || [],
       "alg",
       "typ",
       "cty",
@@ -140,17 +147,88 @@ async function verify(jws, key, options) {
       "x5u",
       "b64"
     ]);
-    for (const critParam of protectedHeader.crit) {
-      if (!recognizedParams.has(critParam)) {
+    for (const param of protectedHeader.crit) {
+      if (recognizedParams.has(param) && (param in protectedHeader || param === "b64")) {
+        continue;
+      }
+      missingHeaderParams.add(param);
+    }
+    if (missingHeaderParams.size > 0) {
+      throw new Error(
+        `Missing critical header parameters: ${[...missingHeaderParams].join(", ")}`
+      );
+    }
+  }
+  if (payload && typeof payload === "object" && !options.forceUint8Array) {
+    const jwtClaims = payload;
+    const clockTolerance = (options.clockTolerance ?? 0) * 1e3;
+    const currentDate = options.currentDate ?? /* @__PURE__ */ new Date();
+    const currentTime = currentDate.getTime();
+    const allRequiredClaims = new Set(options.requiredClaims || []);
+    const missingClaims = /* @__PURE__ */ new Set();
+    if (options.issuer) allRequiredClaims.add("iss");
+    if (options.audience) allRequiredClaims.add("aud");
+    if (options.subject) allRequiredClaims.add("sub");
+    if (options.maxTokenAge) allRequiredClaims.add("iat");
+    for (const claimName of allRequiredClaims) {
+      if (!(claimName in jwtClaims)) {
+        missingClaims.add(claimName);
+      }
+    }
+    if (missingClaims.size > 0) {
+      throw new Error(
+        `Missing required JWT Claims: ${[...missingClaims].join(", ")}`
+      );
+    }
+    if (options.issuer) {
+      const expectedIssuers = maybeArray(options.issuer);
+      if (!jwtClaims.iss || !expectedIssuers.includes(jwtClaims.iss)) {
         throw new Error(
-          `Critical header parameter not understood: ${critParam}`
+          `Invalid JWT "iss" (Issuer) Claim: Expected ${expectedIssuers.join(" or ")}, got ${jwtClaims.iss}`
+        );
+      }
+    }
+    if (options.subject && jwtClaims.sub !== options.subject) {
+      throw new Error(
+        `Invalid JWT "sub" (Subject) Claim: Expected ${options.subject}, got ${jwtClaims.sub}`
+      );
+    }
+    if (options.audience) {
+      const expectedAudiences = maybeArray(options.audience);
+      const claimAudience = maybeArray(jwtClaims.aud || []);
+      if (!claimAudience.some((aud) => expectedAudiences.includes(aud))) {
+        throw new Error(
+          `Invalid JWT "aud" (Audience) Claim: Expected ${expectedAudiences.join(" or ")}, got ${claimAudience.join(", ")}`
+        );
+      }
+    }
+    if (typeof jwtClaims.nbf === "number" && jwtClaims.nbf * 1e3 > currentTime + clockTolerance) {
+      throw new Error(
+        `JWT "nbf" (Not Before) Claim validation failed: Token is not yet valid (nbf: ${new Date(jwtClaims.nbf * 1e3).toISOString()})`
+      );
+    }
+    if (typeof jwtClaims.exp === "number" && jwtClaims.exp * 1e3 <= currentTime - clockTolerance) {
+      throw new Error(
+        `JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${new Date(jwtClaims.exp * 1e3).toISOString()})`
+      );
+    }
+    if (options.maxTokenAge) {
+      if (typeof jwtClaims.iat !== "number") {
+        throw new TypeError(
+          'JWT "iat" (Issued At) Claim must be a number when maxTokenAge is set.'
+        );
+      }
+      if (jwtClaims.iat * 1e3 > currentTime + clockTolerance) {
+        throw new Error(
+          `JWT "iat" (Issued At) Claim validation failed: Token was issued in the future (iat: ${new Date(jwtClaims.iat * 1e3).toISOString()})`
+        );
+      }
+      if (jwtClaims.iat * 1e3 < currentTime - options.maxTokenAge * 1e3 - clockTolerance) {
+        throw new Error(
+          `JWT "iat" (Issued At) Claim validation failed: Token is too old (maxTokenAge: ${options.maxTokenAge}s, iat: ${new Date(jwtClaims.iat * 1e3).toISOString()})`
         );
       }
     }
-  } else if (!options?.critical && protectedHeader.crit) {
-    throw new Error(
-      `Unprocessed critical header parameters: ${protectedHeader.crit.join(", ")}`
-    );
   }
   return {
     payload,

package/dist/shared/{unjwt.DHdDAH0L.mjs → unjwt.DOI5UE8K.mjs}

@@ -51,6 +51,9 @@ function concatUint8Arrays(...arrays) {
   }
   return result;
 }
+function maybeArray(item) {
+  return Array.isArray(item) ? item : [item];
+}
 function isJWK(key) {
   return typeof key === "object" && key !== null && "kty" in key && typeof key.kty === "string";
 }
@@ -75,9 +78,10 @@ const index = {
   isCryptoKey: isCryptoKey,
   isCryptoKeyPair: isCryptoKeyPair,
   isJWK: isJWK,
+  maybeArray: maybeArray,
   randomBytes: randomBytes,
   textDecoder: textDecoder,
   textEncoder: textEncoder
 };
 
-export { isJWK as a, base64UrlEncode as b, textDecoder as c, base64UrlDecode as d, concatUint8Arrays as e, assertCryptoKey as f, isCryptoKey as g, base64Decode as h, index as i, base64Encode as j, isCryptoKeyPair as k, randomBytes as r, textEncoder as t };
+export { isJWK as a, base64UrlEncode as b, textDecoder as c, base64UrlDecode as d, concatUint8Arrays as e, assertCryptoKey as f, isCryptoKey as g, base64Decode as h, index as i, base64Encode as j, isCryptoKeyPair as k, maybeArray as m, randomBytes as r, textEncoder as t };

package/dist/shared/{unjwt.CVKbKOFy.d.ts → unjwt.TbszLNOP.d.ts}

@@ -43,10 +43,63 @@ interface JWSVerifyResult<T = JWTClaims | Uint8Array | string> {
 interface JWSVerifyOptions {
     /** List of allowed algorithms. If provided, the JWS `alg` must be in this list. */
     algorithms?: JWSAlgorithm[];
-    /** List of critical header parameters that must be understood and processed. */
-    critical?: string[];
     /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred. */
     forceUint8Array?: boolean;
+    /** List of critical header parameters that must be understood and processed. */
+    requiredHeaders?: string[];
+    /**
+     * Expected JWT "aud" (Audience) Claim value(s).
+     *
+     * This option makes the JWT "aud" (Audience) Claim presence required.
+     */
+    audience?: string | string[];
+    /**
+     * Clock skew tolerance (in seconds) for validating JWT claims.
+     *
+     * Used when validating the JWT "nbf" (Not Before) and "exp" (Expiration Time) claims, and when
+     * validating the "iat" (Issued At) claim if the {@link maxTokenAge `maxTokenAge` option} is set.
+     */
+    clockTolerance?: number;
+    /**
+     * Expected JWT "iss" (Issuer) Claim value(s).
+     *
+     * This option makes the JWT "iss" (Issuer) Claim presence required.
+     */
+    issuer?: string | string[];
+    /**
+     * Maximum time elapsed (in seconds) from the JWT "iat" (Issued At) Claim value.
+     *
+     * This option makes the JWT "iat" (Issued At) Claim presence required.
+     */
+    maxTokenAge?: number;
+    /**
+     * Expected JWT "sub" (Subject) Claim value.
+     *
+     * This option makes the JWT "sub" (Subject) Claim presence required.
+     */
+    subject?: string;
+    /**
+     * Expected JWT "typ" (Type) Header Parameter value.
+     *
+     * This option makes the JWT "typ" (Type) Header Parameter presence required.
+     */
+    typ?: string;
+    /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
+    currentDate?: Date;
+    /**
+     * Array of required Claim Names that must be present in the JWT Claims Set. Default is that: if
+     * the {@link issuer `issuer` option} is set, then JWT "iss" (Issuer) Claim must be present; if the
+     * {@link audience `audience` option} is set, then JWT "aud" (Audience) Claim must be present; if
+     * the {@link subject `subject` option} is set, then JWT "sub" (Subject) Claim must be present; if
+     * the {@link maxTokenAge `maxTokenAge` option} is set, then JWT "iat" (Issued At) Claim must be
+     * present.
+     */
+    requiredClaims?: string[];
+    /**
+     * List of critical header parameters that must be understood and processed.
+     * @deprecated use {@link requiredHeaders `recognizedHeaders` option} instead.
+     */
+    critical?: string[];
 }
 
 /**

package/dist/shared/{unjwt.1gbuWbc6.mjs → unjwt.ZsOShfhX.mjs}

@@ -1,4 +1,4 @@
-import { g as isCryptoKey, e as concatUint8Arrays, b as base64UrlEncode, h as base64Decode, j as base64Encode, t as textEncoder, r as randomBytes, a as isJWK, d as base64UrlDecode } from './unjwt.DHdDAH0L.mjs';
+import { g as isCryptoKey, e as concatUint8Arrays, b as base64UrlEncode, h as base64Decode, j as base64Encode, t as textEncoder, r as randomBytes, a as isJWK, d as base64UrlDecode } from './unjwt.DOI5UE8K.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.

package/dist/shared/{unjwt.BG_R52ey.d.mts → unjwt.kiNPBQh0.d.mts}

@@ -43,10 +43,63 @@ interface JWSVerifyResult<T = JWTClaims | Uint8Array | string> {
 interface JWSVerifyOptions {
     /** List of allowed algorithms. If provided, the JWS `alg` must be in this list. */
     algorithms?: JWSAlgorithm[];
-    /** List of critical header parameters that must be understood and processed. */
-    critical?: string[];
     /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred. */
     forceUint8Array?: boolean;
+    /** List of critical header parameters that must be understood and processed. */
+    requiredHeaders?: string[];
+    /**
+     * Expected JWT "aud" (Audience) Claim value(s).
+     *
+     * This option makes the JWT "aud" (Audience) Claim presence required.
+     */
+    audience?: string | string[];
+    /**
+     * Clock skew tolerance (in seconds) for validating JWT claims.
+     *
+     * Used when validating the JWT "nbf" (Not Before) and "exp" (Expiration Time) claims, and when
+     * validating the "iat" (Issued At) claim if the {@link maxTokenAge `maxTokenAge` option} is set.
+     */
+    clockTolerance?: number;
+    /**
+     * Expected JWT "iss" (Issuer) Claim value(s).
+     *
+     * This option makes the JWT "iss" (Issuer) Claim presence required.
+     */
+    issuer?: string | string[];
+    /**
+     * Maximum time elapsed (in seconds) from the JWT "iat" (Issued At) Claim value.
+     *
+     * This option makes the JWT "iat" (Issued At) Claim presence required.
+     */
+    maxTokenAge?: number;
+    /**
+     * Expected JWT "sub" (Subject) Claim value.
+     *
+     * This option makes the JWT "sub" (Subject) Claim presence required.
+     */
+    subject?: string;
+    /**
+     * Expected JWT "typ" (Type) Header Parameter value.
+     *
+     * This option makes the JWT "typ" (Type) Header Parameter presence required.
+     */
+    typ?: string;
+    /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
+    currentDate?: Date;
+    /**
+     * Array of required Claim Names that must be present in the JWT Claims Set. Default is that: if
+     * the {@link issuer `issuer` option} is set, then JWT "iss" (Issuer) Claim must be present; if the
+     * {@link audience `audience` option} is set, then JWT "aud" (Audience) Claim must be present; if
+     * the {@link subject `subject` option} is set, then JWT "sub" (Subject) Claim must be present; if
+     * the {@link maxTokenAge `maxTokenAge` option} is set, then JWT "iat" (Issued At) Claim must be
+     * present.
+     */
+    requiredClaims?: string[];
+    /**
+     * List of critical header parameters that must be understood and processed.
+     * @deprecated use {@link requiredHeaders `recognizedHeaders` option} instead.
+     */
+    critical?: string[];
 }
 
 /**

package/dist/shared/{unjwt.C9Xhi7hE.mjs → unjwt.z_U3fRJ-.mjs}

@@ -1,4 +1,4 @@
-import { c as checkSigCryptoKey } from './unjwt.1gbuWbc6.mjs';
+import { c as checkSigCryptoKey } from './unjwt.ZsOShfhX.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.

package/dist/utils.d.mts

@@ -1,2 +1,2 @@
 import './shared/unjwt.CxhGjEAX.mjs';
-export { h as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, f as concatUint8Arrays, j as isCryptoKey, k as isCryptoKeyPair, g as isJWK, r as randomBytes, a as textDecoder, t as textEncoder } from './shared/unjwt.B4fFiy1c.mjs';
+export { h as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, f as concatUint8Arrays, j as isCryptoKey, k as isCryptoKeyPair, g as isJWK, m as maybeArray, r as randomBytes, a as textDecoder, t as textEncoder } from './shared/unjwt.BJEchXrM.mjs';

package/dist/utils.d.ts

@@ -1,2 +1,2 @@
 import './shared/unjwt.CxhGjEAX.js';
-export { h as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, f as concatUint8Arrays, j as isCryptoKey, k as isCryptoKeyPair, g as isJWK, r as randomBytes, a as textDecoder, t as textEncoder } from './shared/unjwt.DqmNvXMd.js';
+export { h as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, f as concatUint8Arrays, j as isCryptoKey, k as isCryptoKeyPair, g as isJWK, m as maybeArray, r as randomBytes, a as textDecoder, t as textEncoder } from './shared/unjwt.B5N3dPN9.js';

package/dist/utils.mjs

@@ -1 +1 @@
-export { f as assertCryptoKey, h as base64Decode, j as base64Encode, d as base64UrlDecode, b as base64UrlEncode, e as concatUint8Arrays, g as isCryptoKey, k as isCryptoKeyPair, a as isJWK, r as randomBytes, c as textDecoder, t as textEncoder } from './shared/unjwt.DHdDAH0L.mjs';
+export { f as assertCryptoKey, h as base64Decode, j as base64Encode, d as base64UrlDecode, b as base64UrlEncode, e as concatUint8Arrays, g as isCryptoKey, k as isCryptoKeyPair, a as isJWK, m as maybeArray, r as randomBytes, c as textDecoder, t as textEncoder } from './shared/unjwt.DOI5UE8K.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.1",
+  "version": "0.5.2",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",