unjwt 0.5.1 → 0.5.3

package/README.md

@@ -44,14 +44,25 @@ import { encrypt, decrypt } from "unjwt/jwe";
 // JWK functions
 import {
   generateKey,
-  deriveKeyFromPassword,
   importKey,
   exportKey,
   wrapKey,
   unwrapKey,
+  getJWKFromSet,
+  importJWKFromPEM,
+  exportJWKToPEM,
+  deriveKeyFromPassword,
 } from "unjwt/jwk";
 // Utility functions
-import { base64UrlEncode, base64UrlDecode, randomBytes } from "unjwt/utils";
+import {
+  isJWK,
+  isJWKSet,
+  isCryptoKey,
+  isCryptoKeyPair,
+  base64UrlEncode,
+  base64UrlDecode,
+  randomBytes,
+} from "unjwt/utils";
 ```
 
 **CDN** (Deno, Bun and Browsers)
@@ -65,14 +76,21 @@ import { encrypt, decrypt } from "https://esm.sh/unjwt/jwe";
 // JWK functions
 import {
   generateKey,
-  deriveKeyFromPassword,
   importKey,
   exportKey,
   wrapKey,
   unwrapKey,
+  getJWKFromSet,
+  importJWKFromPEM,
+  exportJWKToPEM,
+  deriveKeyFromPassword,
 } from "https://esm.sh/unjwt/jwk";
 // Utility functions
 import {
+  isJWK,
+  isJWKSet,
+  isCryptoKey,
+  isCryptoKeyPair,
   base64UrlEncode,
   base64UrlDecode,
   randomBytes,
@@ -129,8 +147,8 @@ console.log(token);
 Verifies a JWS token.
 
 - `jws`: The JWS token string.
-- `key`: The verification key (`CryptoKey`, `JWK`, `Uint8Array`, or a `KeyLookupFunction`).
-  A `KeyLookupFunction` has the signature `(header: JWSProtectedHeader) => Promise<CryptoKey | JWK | Uint8Array> | CryptoKey | JWK | Uint8Array`.
+- `key`: The verification key (`CryptoKey`, `JWK`, `JWKSet`, `Uint8Array`, or a `KeyLookupFunction`).
+  A `KeyLookupFunction` has the signature `(header: JWSProtectedHeader, jws: string) => Promise<CryptoKey | JWK | JWKSet | Uint8Array> | CryptoKey | JWK | JWKSet | Uint8Array`.
 - `options` (optional):
   - `algorithms`: An array of allowed JWS `alg` values. If not provided, the `alg` from the JWS header is used.
   - `critical`: An array of JWS header parameter names that the application understands and processes.

package/dist/index.d.mts

@@ -1,6 +1,6 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, B as JWKAlgorithm, E as JWKPEMAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, A as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, y as JWK_ED, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, z as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CxhGjEAX.mjs';
-export { b as JWT, a as JWTClaims, J as JoseHeaderParameters } from './shared/unjwt.Cd9nTEWg.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.BG_R52ey.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.DQIYSlHj.mjs';
-export { i as utils } from './shared/unjwt.B4fFiy1c.mjs';
-export { j as jwk } from './shared/unjwt.D1J1DelP.mjs';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.D9da8HQF.mjs';
+export { b as JWT, a as JWTClaims, J as JoseHeaderParameters } from './shared/unjwt.BvIkEGGz.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.BvA-8hLQ.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.DLOO5Rmq.mjs';
+export { i as utils } from './shared/unjwt.CbvzYE-m.mjs';
+export { j as jwk } from './shared/unjwt.DZjogLQk.mjs';

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, B as JWKAlgorithm, E as JWKPEMAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, A as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, y as JWK_ED, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, z as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CxhGjEAX.js';
-export { b as JWT, a as JWTClaims, J as JoseHeaderParameters } from './shared/unjwt.BISJ5yt1.js';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.CVKbKOFy.js';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.B0XDPf8a.js';
-export { i as utils } from './shared/unjwt.DqmNvXMd.js';
-export { j as jwk } from './shared/unjwt.WvWb2zNM.js';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.D9da8HQF.js';
+export { b as JWT, a as JWTClaims, J as JoseHeaderParameters } from './shared/unjwt.c10n3uM8.js';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.C5blWtcA.js';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.BJPVLhUb.js';
+export { i as utils } from './shared/unjwt.D4DUiNeM.js';
+export { j as jwk } from './shared/unjwt.B4NFVxpx.js';

package/dist/index.mjs

@@ -1,5 +1,5 @@
-export { i as utils } from './shared/unjwt.DHdDAH0L.mjs';
-export { j as jwe } from './shared/unjwt.Ce72NmIz.mjs';
-export { j as jwk } from './shared/unjwt.1gbuWbc6.mjs';
-export { j as jws } from './shared/unjwt.BxqF-n1S.mjs';
-import './shared/unjwt.C9Xhi7hE.mjs';
+export { i as utils } from './shared/unjwt.X5vzu_l_.mjs';
+export { j as jwe } from './shared/unjwt.BtEHeKmp.mjs';
+export { j as jwk } from './shared/unjwt.BPpolBff.mjs';
+export { j as jws } from './shared/unjwt.Dsh9nxbB.mjs';
+import './shared/unjwt.CauxOPN5.mjs';

package/dist/jwe.d.mts

@@ -1,3 +1,3 @@
-import './shared/unjwt.CxhGjEAX.mjs';
-import './shared/unjwt.Cd9nTEWg.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.DQIYSlHj.mjs';
+import './shared/unjwt.D9da8HQF.mjs';
+import './shared/unjwt.BvIkEGGz.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.DLOO5Rmq.mjs';

package/dist/jwe.d.ts

@@ -1,3 +1,3 @@
-import './shared/unjwt.CxhGjEAX.js';
-import './shared/unjwt.BISJ5yt1.js';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.B0XDPf8a.js';
+import './shared/unjwt.D9da8HQF.js';
+import './shared/unjwt.c10n3uM8.js';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.BJPVLhUb.js';

package/dist/jwe.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.1gbuWbc6.mjs';
-import './shared/unjwt.DHdDAH0L.mjs';
-export { d as decrypt, e as encrypt } from './shared/unjwt.Ce72NmIz.mjs';
-import './shared/unjwt.C9Xhi7hE.mjs';
+import './shared/unjwt.BPpolBff.mjs';
+import './shared/unjwt.X5vzu_l_.mjs';
+export { d as decrypt, e as encrypt } from './shared/unjwt.BtEHeKmp.mjs';
+import './shared/unjwt.CauxOPN5.mjs';

package/dist/jwk.d.mts

@@ -1,2 +1,3 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, B as JWKAlgorithm, E as JWKPEMAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, A as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, y as JWK_ED, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, z as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CxhGjEAX.mjs';
-export { d as deriveKeyFromPassword, b as exportJWKToPEM, e as exportKey, g as generateKey, a as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.D1J1DelP.mjs';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.D9da8HQF.mjs';
+import './shared/unjwt.BvIkEGGz.mjs';
+export { d as deriveKeyFromPassword, b as exportJWKToPEM, e as exportKey, g as generateKey, c as getJWKFromSet, a as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.DZjogLQk.mjs';

package/dist/jwk.d.ts

@@ -1,2 +1,3 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, B as JWKAlgorithm, E as JWKPEMAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, A as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, y as JWK_ED, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, z as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CxhGjEAX.js';
-export { d as deriveKeyFromPassword, b as exportJWKToPEM, e as exportKey, g as generateKey, a as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.WvWb2zNM.js';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.D9da8HQF.js';
+import './shared/unjwt.c10n3uM8.js';
+export { d as deriveKeyFromPassword, b as exportJWKToPEM, e as exportKey, g as generateKey, c as getJWKFromSet, a as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.B4NFVxpx.js';

package/dist/jwk.mjs

@@ -1,2 +1,2 @@
-import './shared/unjwt.DHdDAH0L.mjs';
-export { o as deriveKeyFromPassword, s as exportJWKToPEM, p as exportKey, n as generateKey, r as importJWKFromPEM, i as importKey, l as unwrapKey, q as wrapKey } from './shared/unjwt.1gbuWbc6.mjs';
+import './shared/unjwt.X5vzu_l_.mjs';
+export { p as deriveKeyFromPassword, t as exportJWKToPEM, q as exportKey, o as generateKey, g as getJWKFromSet, s as importJWKFromPEM, i as importKey, m as unwrapKey, r as wrapKey } from './shared/unjwt.BPpolBff.mjs';

package/dist/jws.d.mts

@@ -1,3 +1,3 @@
-import './shared/unjwt.CxhGjEAX.mjs';
-import './shared/unjwt.Cd9nTEWg.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.BG_R52ey.mjs';
+import './shared/unjwt.D9da8HQF.mjs';
+import './shared/unjwt.BvIkEGGz.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.BvA-8hLQ.mjs';

package/dist/jws.d.ts

@@ -1,3 +1,3 @@
-import './shared/unjwt.CxhGjEAX.js';
-import './shared/unjwt.BISJ5yt1.js';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.CVKbKOFy.js';
+import './shared/unjwt.D9da8HQF.js';
+import './shared/unjwt.c10n3uM8.js';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.C5blWtcA.js';

package/dist/jws.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.1gbuWbc6.mjs';
-import './shared/unjwt.DHdDAH0L.mjs';
-import './shared/unjwt.C9Xhi7hE.mjs';
-export { s as sign, v as verify } from './shared/unjwt.BxqF-n1S.mjs';
+import './shared/unjwt.BPpolBff.mjs';
+import './shared/unjwt.X5vzu_l_.mjs';
+import './shared/unjwt.CauxOPN5.mjs';
+export { s as sign, v as verify } from './shared/unjwt.Dsh9nxbB.mjs';

package/dist/shared/{unjwt.D1J1DelP.d.mts → unjwt.B4NFVxpx.d.ts}

@@ -1,4 +1,5 @@
-import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, w as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, l as JWK_oct, m as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, E as JWKPEMAlgorithm, C as CompositeKey, d as ContentEncryptionAlgorithm, B as JWKAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, A as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, y as JWK_ED, n as JWK_HMAC, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, z as JWK_Symmetric_Algorithm } from './unjwt.CxhGjEAX.mjs';
+import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, x as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, l as JWK_oct, m as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, F as JWKPEMAlgorithm, n as JWKSet, C as CompositeKey, d as ContentEncryptionAlgorithm, E as JWKAlgorithm, J as JWKParameters, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm } from './unjwt.D9da8HQF.js';
+import { J as JoseHeaderParameters } from './unjwt.c10n3uM8.js';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -101,6 +102,25 @@ declare function importJWKFromPEM(pem: string, pemType: "pkcs8" | "spki" | "x509
  * @returns A Promise resolving to the PEM-encoded key string.
  */
 declare function exportJWKToPEM(jwk: JWK, pemFormat: "pkcs8" | "spki", algForCryptoKeyImport?: JWKPEMAlgorithm): Promise<string>;
+/**
+ * Retrieves a JWK (JSON Web Key) from a JWKSet based on a key ID (kid) or
+ * properties from a JOSE Header.
+ *
+ * @param jwkSet The JWKSet to search within.
+ * @param kidOrProtectedHeader Either a string representing the 'kid' (Key ID)
+ *        or an object representing the JOSE Protected Header. If an object is
+ *        provided, it must contain a 'kid' property. It can optionally contain
+ *        'alg' (Algorithm) and 'kty' (Key Type) to further refine the search.
+ * @returns The matching JWK from the set.
+ * @throws TypeError if `jwkSet` is invalid or `kidOrProtectedHeader` is not a
+ *         string or a valid header object.
+ * @throws Error if no key is found matching the provided criteria, or if the
+ *         header object is missing the 'kid' property.
+ */
+declare function getJWKFromSet(jwkSet: JWKSet, kidOrProtectedHeader: string | (JoseHeaderParameters & {
+    alg?: string;
+    kty?: string;
+})): JWK;
 
 declare const jwk_CompositeKey: typeof CompositeKey;
 declare const jwk_ContentEncryptionAlgorithm: typeof ContentEncryptionAlgorithm;
@@ -113,6 +133,7 @@ declare const jwk_JWK: typeof JWK;
 declare const jwk_JWKAlgorithm: typeof JWKAlgorithm;
 declare const jwk_JWKPEMAlgorithm: typeof JWKPEMAlgorithm;
 declare const jwk_JWKParameters: typeof JWKParameters;
+declare const jwk_JWKSet: typeof JWKSet;
 declare const jwk_JWK_AES_CBC_HMAC: typeof JWK_AES_CBC_HMAC;
 declare const jwk_JWK_AES_GCM: typeof JWK_AES_GCM;
 declare const jwk_JWK_AES_GCM_KW: typeof JWK_AES_GCM_KW;
@@ -142,6 +163,7 @@ declare const jwk_deriveKeyFromPassword: typeof deriveKeyFromPassword;
 declare const jwk_exportJWKToPEM: typeof exportJWKToPEM;
 declare const jwk_exportKey: typeof exportKey;
 declare const jwk_generateKey: typeof generateKey;
+declare const jwk_getJWKFromSet: typeof getJWKFromSet;
 declare const jwk_importJWKFromPEM: typeof importJWKFromPEM;
 declare const jwk_importKey: typeof importKey;
 declare const jwk_unwrapKey: typeof unwrapKey;
@@ -159,6 +181,7 @@ declare namespace jwk {
     jwk_JWKAlgorithm as JWKAlgorithm,
     jwk_JWKPEMAlgorithm as JWKPEMAlgorithm,
     jwk_JWKParameters as JWKParameters,
+    jwk_JWKSet as JWKSet,
     jwk_JWK_AES_CBC_HMAC as JWK_AES_CBC_HMAC,
     jwk_JWK_AES_GCM as JWK_AES_GCM,
     jwk_JWK_AES_GCM_KW as JWK_AES_GCM_KW,
@@ -188,6 +211,7 @@ declare namespace jwk {
     jwk_exportJWKToPEM as exportJWKToPEM,
     jwk_exportKey as exportKey,
     jwk_generateKey as generateKey,
+    jwk_getJWKFromSet as getJWKFromSet,
     jwk_importJWKFromPEM as importJWKFromPEM,
     jwk_importKey as importKey,
     jwk_unwrapKey as unwrapKey,
@@ -195,4 +219,4 @@ declare namespace jwk {
   };
 }
 
-export { importJWKFromPEM as a, exportJWKToPEM as b, deriveKeyFromPassword as d, exportKey as e, generateKey as g, importKey as i, jwk as j, unwrapKey as u, wrapKey as w };
+export { importJWKFromPEM as a, exportJWKToPEM as b, getJWKFromSet as c, deriveKeyFromPassword as d, exportKey as e, generateKey as g, importKey as i, jwk as j, unwrapKey as u, wrapKey as w };

package/dist/shared/{unjwt.B0XDPf8a.d.ts → unjwt.BJPVLhUb.d.ts}

@@ -1,5 +1,5 @@
-import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, f as JWK_EC_Public, m as JWK } from './unjwt.CxhGjEAX.js';
-import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.BISJ5yt1.js';
+import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, f as JWK_EC_Public, m as JWK } from './unjwt.D9da8HQF.js';
+import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.c10n3uM8.js';
 
 /** Recognized JWE Header Parameters, any other Header Members may also be present. */
 interface JWEHeaderParameters extends JoseHeaderParameters {
@@ -99,7 +99,7 @@ interface JWEEncryptOptions {
  * @param header The JWE Protected Header.
  * @returns The key material (CryptoKey, JWK, password string, or raw Uint8Array) or a Promise resolving to it.
  */
-type JWEKeyLookupFunction = (header: JWEHeaderParameters) => CryptoKey | JWK | string | Uint8Array | Promise<CryptoKey | JWK | string | Uint8Array>;
+type JWEKeyLookupFunction = (header: JWEHeaderParameters, token: string) => CryptoKey | JWK | string | Uint8Array | Promise<CryptoKey | JWK | string | Uint8Array>;
 /**
  * JWE (JSON Web Encryption) decryption options
  */

package/dist/shared/{unjwt.1gbuWbc6.mjs → unjwt.BPpolBff.mjs}

@@ -1,4 +1,4 @@
-import { g as isCryptoKey, e as concatUint8Arrays, b as base64UrlEncode, h as base64Decode, j as base64Encode, t as textEncoder, r as randomBytes, a as isJWK, d as base64UrlDecode } from './unjwt.DHdDAH0L.mjs';
+import { h as isCryptoKey, f as concatUint8Arrays, b as base64UrlEncode, j as base64Decode, k as base64Encode, t as textEncoder, r as randomBytes, a as isJWK, d as base64UrlDecode, e as isJWKSet } from './unjwt.X5vzu_l_.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -1383,6 +1383,44 @@ async function exportJWKToPEM(jwk, pemFormat, algForCryptoKeyImport) {
     }
   }
 }
+function getJWKFromSet(jwkSet, kidOrProtectedHeader) {
+  if (!jwkSet || !isJWKSet(jwkSet)) {
+    throw new TypeError("Invalid JWK Set provided");
+  }
+  if (typeof kidOrProtectedHeader === "string") {
+    const kid = kidOrProtectedHeader;
+    const selectedKey = jwkSet.keys.find((k) => k.kid === kid);
+    if (!selectedKey) {
+      throw new Error(`No key found in JWK Set with kid "${kid}".`);
+    }
+    return selectedKey;
+  } else if (typeof kidOrProtectedHeader === "object") {
+    const { kid, alg, kty } = kidOrProtectedHeader;
+    if (!kid) {
+      throw new Error(
+        "JWS Protected Header is missing 'kid' (Key ID) and a JWK Set was provided. Cannot select key from JWK Set automatically."
+      );
+    }
+    const selectedKey = jwkSet.keys.find((k) => {
+      return k.kid === kid && (!alg || k.alg === alg) && (!kty || k.kty === kty);
+    });
+    if (!selectedKey) {
+      let errorMessage = `No key found in JWK Set with kid "${kid}"`;
+      if (alg) {
+        errorMessage += ` and alg "${alg}"`;
+      }
+      if (kty) {
+        errorMessage += ` and kty "${kty}"`;
+      }
+      errorMessage += ".";
+      throw new Error(errorMessage);
+    }
+    return selectedKey;
+  }
+  throw new TypeError(
+    "`kidOrProtectedHeader` must be a string (kid) or an object (JOSE Protected Header)."
+  );
+}
 function getGenerateKeyParams(alg, options) {
   let algorithm;
   let keyUsages;
@@ -1498,10 +1536,11 @@ const jwk = {
   exportJWKToPEM: exportJWKToPEM,
   exportKey: exportKey,
   generateKey: generateKey,
+  getJWKFromSet: getJWKFromSet,
   importJWKFromPEM: importJWKFromPEM,
   importKey: importKey,
   unwrapKey: unwrapKey,
   wrapKey: wrapKey
 };
 
-export { checkEncCryptoKey as a, bitLengthCEK as b, checkSigCryptoKey as c, jwkTokey as d, encryptIV as e, generateIV as f, generateCEK as g, encrypt as h, importKey as i, jwk as j, keyToJWK as k, unwrapKey as l, decrypt as m, generateKey as n, deriveKeyFromPassword as o, exportKey as p, wrapKey as q, importJWKFromPEM as r, exportJWKToPEM as s, uint32be as u, wrap as w };
+export { checkEncCryptoKey as a, generateCEK as b, checkSigCryptoKey as c, bitLengthCEK as d, encryptIV as e, jwkTokey as f, getJWKFromSet as g, generateIV as h, importKey as i, jwk as j, keyToJWK as k, encrypt as l, unwrapKey as m, decrypt as n, generateKey as o, deriveKeyFromPassword as p, exportKey as q, wrapKey as r, importJWKFromPEM as s, exportJWKToPEM as t, uint32be as u, wrap as w };

package/dist/shared/{unjwt.Ce72NmIz.mjs → unjwt.BtEHeKmp.mjs}

@@ -1,6 +1,6 @@
-import { a as checkEncCryptoKey, u as uint32be, g as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, b as bitLengthCEK, d as jwkTokey, i as importKey, f as generateIV, h as encrypt$1, l as unwrapKey, m as decrypt$1 } from './unjwt.1gbuWbc6.mjs';
-import { e as concatUint8Arrays, t as textEncoder, f as assertCryptoKey, b as base64UrlEncode, g as isCryptoKey, a as isJWK, d as base64UrlDecode, r as randomBytes, c as textDecoder } from './unjwt.DHdDAH0L.mjs';
-import { c as checkKeyLength } from './unjwt.C9Xhi7hE.mjs';
+import { a as checkEncCryptoKey, u as uint32be, b as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, d as bitLengthCEK, f as jwkTokey, i as importKey, h as generateIV, l as encrypt$1, m as unwrapKey, n as decrypt$1 } from './unjwt.BPpolBff.mjs';
+import { f as concatUint8Arrays, t as textEncoder, g as assertCryptoKey, b as base64UrlEncode, h as isCryptoKey, a as isJWK, d as base64UrlDecode, r as randomBytes, c as textDecoder } from './unjwt.X5vzu_l_.mjs';
+import { c as checkKeyLength } from './unjwt.CauxOPN5.mjs';
 
 function lengthAndInput(input) {
   return concatUint8Arrays(uint32be(input.length), input);
@@ -327,7 +327,7 @@ async function decrypt(jwe, key, options) {
   if (options?.encryptionAlgorithms && !options.encryptionAlgorithms.includes(enc)) {
     throw new Error(`Content encryption algorithm not allowed: ${enc}`);
   }
-  const resolvedKeyMaterial = typeof key === "function" ? await key(protectedHeader) : key;
+  const resolvedKeyMaterial = typeof key === "function" ? await key(protectedHeader, jwe) : key;
   const unwrappingKey = await importKey(resolvedKeyMaterial, alg);
   const encryptedKeyBytes = base64UrlDecode(encryptedKeyEncoded, false);
   const contentIVBytes = base64UrlDecode(ivEncoded, false);

package/dist/shared/{unjwt.BG_R52ey.d.mts → unjwt.BvA-8hLQ.d.mts}

@@ -1,5 +1,5 @@
-import { n as JWK_HMAC, o as JWK_RSA_SIGN, p as JWK_RSA_PSS, q as JWK_ECDSA, m as JWK } from './unjwt.CxhGjEAX.mjs';
-import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.Cd9nTEWg.mjs';
+import { o as JWK_HMAC, p as JWK_RSA_SIGN, q as JWK_RSA_PSS, r as JWK_ECDSA, m as JWK, n as JWKSet } from './unjwt.D9da8HQF.mjs';
+import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.BvIkEGGz.mjs';
 
 type JWS_SIGN_EXTRA = "Ed25519" | "EdDSA";
 /** JWS Signing Algorithm Identifier. */
@@ -43,11 +43,71 @@ interface JWSVerifyResult<T = JWTClaims | Uint8Array | string> {
 interface JWSVerifyOptions {
     /** List of allowed algorithms. If provided, the JWS `alg` must be in this list. */
     algorithms?: JWSAlgorithm[];
-    /** List of critical header parameters that must be understood and processed. */
-    critical?: string[];
     /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred. */
     forceUint8Array?: boolean;
+    /** List of critical header parameters that must be understood and processed. */
+    requiredHeaders?: string[];
+    /**
+     * Expected JWT "aud" (Audience) Claim value(s).
+     *
+     * This option makes the JWT "aud" (Audience) Claim presence required.
+     */
+    audience?: string | string[];
+    /**
+     * Clock skew tolerance (in seconds) for validating JWT claims.
+     *
+     * Used when validating the JWT "nbf" (Not Before) and "exp" (Expiration Time) claims, and when
+     * validating the "iat" (Issued At) claim if the {@link maxTokenAge `maxTokenAge` option} is set.
+     */
+    clockTolerance?: number;
+    /**
+     * Expected JWT "iss" (Issuer) Claim value(s).
+     *
+     * This option makes the JWT "iss" (Issuer) Claim presence required.
+     */
+    issuer?: string | string[];
+    /**
+     * Maximum time elapsed (in seconds) from the JWT "iat" (Issued At) Claim value.
+     *
+     * This option makes the JWT "iat" (Issued At) Claim presence required.
+     */
+    maxTokenAge?: number;
+    /**
+     * Expected JWT "sub" (Subject) Claim value.
+     *
+     * This option makes the JWT "sub" (Subject) Claim presence required.
+     */
+    subject?: string;
+    /**
+     * Expected JWT "typ" (Type) Header Parameter value.
+     *
+     * This option makes the JWT "typ" (Type) Header Parameter presence required.
+     */
+    typ?: string;
+    /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
+    currentDate?: Date;
+    /**
+     * Array of required Claim Names that must be present in the JWT Claims Set. Default is that: if
+     * the {@link issuer `issuer` option} is set, then JWT "iss" (Issuer) Claim must be present; if the
+     * {@link audience `audience` option} is set, then JWT "aud" (Audience) Claim must be present; if
+     * the {@link subject `subject` option} is set, then JWT "sub" (Subject) Claim must be present; if
+     * the {@link maxTokenAge `maxTokenAge` option} is set, then JWT "iat" (Issued At) Claim must be
+     * present.
+     */
+    requiredClaims?: string[];
+    /**
+     * List of critical header parameters that must be understood and processed.
+     * @deprecated use {@link requiredHeaders `recognizedHeaders` option} instead.
+     */
+    critical?: string[];
 }
+/**
+ * Key lookup function for JWS verification.
+ * @param header The JWS Protected Header.
+ * @param token The JWS token.
+ * @returns The key material (CryptoKey, JWK, or raw Uint8Array) or a Promise resolving to it.
+ */
+type JWSKeyLookupFunction = (header: JWSProtectedHeader, token: string) => CryptoKey | JWK | JWKSet | Uint8Array | Promise<CryptoKey | JWK | JWKSet | Uint8Array>;
 
 /**
  * Creates a JWS (JSON Web Signature) in Compact Serialization format.
@@ -68,23 +128,23 @@ declare function sign(payload: string | Uint8Array | Record<string, any>, key: C
 declare function sign(payload: string | Uint8Array | Record<string, any>, key: CryptoKey | JWK | Uint8Array, options: JWSSignOptions & {
     alg: JWSAlgorithm;
 }): Promise<string>;
-type KeyLookupFunction = (header: JWSProtectedHeader) => CryptoKey | JWK | Uint8Array | Promise<CryptoKey | JWK | Uint8Array>;
 /**
  * Verifies a JWS (JSON Web Signature) in Compact Serialization format.
  *
  * @param jws The JWS Compact Serialization string.
- * @param key The verification key (CryptoKey, JWK, raw symmetric key as Uint8Array, or a function resolving the key).
+ * @param key The verification key (CryptoKey, JWK, JWKSet, raw symmetric key as Uint8Array, or a function resolving the key or set).
  * @param options Verification options, such as allowed algorithms.
  * @returns A Promise resolving to an object containing the verified payload and protected header.
  * @throws If the JWS is invalid, signature verification fails, or options are not met.
  */
-declare function verify<T = JWTClaims | Uint8Array | string>(jws: string, key: CryptoKey | JWK | Uint8Array | KeyLookupFunction, options?: JWSVerifyOptions): Promise<JWSVerifyResult<T>>;
-declare function verify(jws: string, key: CryptoKey | JWK | Uint8Array | KeyLookupFunction, options: JWSVerifyOptions & {
+declare function verify<T = JWTClaims | Uint8Array | string>(jws: string, key: CryptoKey | JWK | JWKSet | Uint8Array | JWSKeyLookupFunction, options?: JWSVerifyOptions): Promise<JWSVerifyResult<T>>;
+declare function verify(jws: string, key: CryptoKey | JWK | JWKSet | Uint8Array | JWSKeyLookupFunction, options: JWSVerifyOptions & {
     forceUint8Array: true;
 }): Promise<JWSVerifyResult<Uint8Array>>;
 
 type jws_JWSAlgorithm = JWSAlgorithm;
 type jws_JWSHeaderParameters = JWSHeaderParameters;
+type jws_JWSKeyLookupFunction = JWSKeyLookupFunction;
 type jws_JWSProtectedHeader = JWSProtectedHeader;
 type jws_JWSSignOptions = JWSSignOptions;
 type jws_JWSVerifyOptions = JWSVerifyOptions;
@@ -93,8 +153,8 @@ declare const jws_sign: typeof sign;
 declare const jws_verify: typeof verify;
 declare namespace jws {
   export { jws_sign as sign, jws_verify as verify };
-  export type { jws_JWSAlgorithm as JWSAlgorithm, jws_JWSHeaderParameters as JWSHeaderParameters, jws_JWSProtectedHeader as JWSProtectedHeader, jws_JWSSignOptions as JWSSignOptions, jws_JWSVerifyOptions as JWSVerifyOptions, jws_JWSVerifyResult as JWSVerifyResult };
+  export type { jws_JWSAlgorithm as JWSAlgorithm, jws_JWSHeaderParameters as JWSHeaderParameters, jws_JWSKeyLookupFunction as JWSKeyLookupFunction, jws_JWSProtectedHeader as JWSProtectedHeader, jws_JWSSignOptions as JWSSignOptions, jws_JWSVerifyOptions as JWSVerifyOptions, jws_JWSVerifyResult as JWSVerifyResult };
 }
 
 export { jws as j, sign as s, verify as v };
-export type { JWSAlgorithm as J, JWSHeaderParameters as a, JWSProtectedHeader as b, JWSSignOptions as c, JWSVerifyResult as d, JWSVerifyOptions as e };
+export type { JWSAlgorithm as J, JWSHeaderParameters as a, JWSProtectedHeader as b, JWSSignOptions as c, JWSVerifyResult as d, JWSVerifyOptions as e, JWSKeyLookupFunction as f };

package/dist/shared/{unjwt.Cd9nTEWg.d.mts → unjwt.BvIkEGGz.d.mts}

@@ -1,4 +1,4 @@
-import { i as JWK_RSA_Public } from './unjwt.CxhGjEAX.mjs';
+import { i as JWK_RSA_Public } from './unjwt.D9da8HQF.mjs';
 
 /** Header Parameters common to JWE and JWS */
 interface JoseHeaderParameters {

package/dist/shared/{unjwt.CVKbKOFy.d.ts → unjwt.C5blWtcA.d.ts}

@@ -1,5 +1,5 @@
-import { n as JWK_HMAC, o as JWK_RSA_SIGN, p as JWK_RSA_PSS, q as JWK_ECDSA, m as JWK } from './unjwt.CxhGjEAX.js';
-import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.BISJ5yt1.js';
+import { o as JWK_HMAC, p as JWK_RSA_SIGN, q as JWK_RSA_PSS, r as JWK_ECDSA, m as JWK, n as JWKSet } from './unjwt.D9da8HQF.js';
+import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.c10n3uM8.js';
 
 type JWS_SIGN_EXTRA = "Ed25519" | "EdDSA";
 /** JWS Signing Algorithm Identifier. */
@@ -43,11 +43,71 @@ interface JWSVerifyResult<T = JWTClaims | Uint8Array | string> {
 interface JWSVerifyOptions {
     /** List of allowed algorithms. If provided, the JWS `alg` must be in this list. */
     algorithms?: JWSAlgorithm[];
-    /** List of critical header parameters that must be understood and processed. */
-    critical?: string[];
     /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred. */
     forceUint8Array?: boolean;
+    /** List of critical header parameters that must be understood and processed. */
+    requiredHeaders?: string[];
+    /**
+     * Expected JWT "aud" (Audience) Claim value(s).
+     *
+     * This option makes the JWT "aud" (Audience) Claim presence required.
+     */
+    audience?: string | string[];
+    /**
+     * Clock skew tolerance (in seconds) for validating JWT claims.
+     *
+     * Used when validating the JWT "nbf" (Not Before) and "exp" (Expiration Time) claims, and when
+     * validating the "iat" (Issued At) claim if the {@link maxTokenAge `maxTokenAge` option} is set.
+     */
+    clockTolerance?: number;
+    /**
+     * Expected JWT "iss" (Issuer) Claim value(s).
+     *
+     * This option makes the JWT "iss" (Issuer) Claim presence required.
+     */
+    issuer?: string | string[];
+    /**
+     * Maximum time elapsed (in seconds) from the JWT "iat" (Issued At) Claim value.
+     *
+     * This option makes the JWT "iat" (Issued At) Claim presence required.
+     */
+    maxTokenAge?: number;
+    /**
+     * Expected JWT "sub" (Subject) Claim value.
+     *
+     * This option makes the JWT "sub" (Subject) Claim presence required.
+     */
+    subject?: string;
+    /**
+     * Expected JWT "typ" (Type) Header Parameter value.
+     *
+     * This option makes the JWT "typ" (Type) Header Parameter presence required.
+     */
+    typ?: string;
+    /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
+    currentDate?: Date;
+    /**
+     * Array of required Claim Names that must be present in the JWT Claims Set. Default is that: if
+     * the {@link issuer `issuer` option} is set, then JWT "iss" (Issuer) Claim must be present; if the
+     * {@link audience `audience` option} is set, then JWT "aud" (Audience) Claim must be present; if
+     * the {@link subject `subject` option} is set, then JWT "sub" (Subject) Claim must be present; if
+     * the {@link maxTokenAge `maxTokenAge` option} is set, then JWT "iat" (Issued At) Claim must be
+     * present.
+     */
+    requiredClaims?: string[];
+    /**
+     * List of critical header parameters that must be understood and processed.
+     * @deprecated use {@link requiredHeaders `recognizedHeaders` option} instead.
+     */
+    critical?: string[];
 }
+/**
+ * Key lookup function for JWS verification.
+ * @param header The JWS Protected Header.
+ * @param token The JWS token.
+ * @returns The key material (CryptoKey, JWK, or raw Uint8Array) or a Promise resolving to it.
+ */
+type JWSKeyLookupFunction = (header: JWSProtectedHeader, token: string) => CryptoKey | JWK | JWKSet | Uint8Array | Promise<CryptoKey | JWK | JWKSet | Uint8Array>;
 
 /**
  * Creates a JWS (JSON Web Signature) in Compact Serialization format.
@@ -68,23 +128,23 @@ declare function sign(payload: string | Uint8Array | Record<string, any>, key: C
 declare function sign(payload: string | Uint8Array | Record<string, any>, key: CryptoKey | JWK | Uint8Array, options: JWSSignOptions & {
     alg: JWSAlgorithm;
 }): Promise<string>;
-type KeyLookupFunction = (header: JWSProtectedHeader) => CryptoKey | JWK | Uint8Array | Promise<CryptoKey | JWK | Uint8Array>;
 /**
  * Verifies a JWS (JSON Web Signature) in Compact Serialization format.
  *
  * @param jws The JWS Compact Serialization string.
- * @param key The verification key (CryptoKey, JWK, raw symmetric key as Uint8Array, or a function resolving the key).
+ * @param key The verification key (CryptoKey, JWK, JWKSet, raw symmetric key as Uint8Array, or a function resolving the key or set).
  * @param options Verification options, such as allowed algorithms.
  * @returns A Promise resolving to an object containing the verified payload and protected header.
  * @throws If the JWS is invalid, signature verification fails, or options are not met.
  */
-declare function verify<T = JWTClaims | Uint8Array | string>(jws: string, key: CryptoKey | JWK | Uint8Array | KeyLookupFunction, options?: JWSVerifyOptions): Promise<JWSVerifyResult<T>>;
-declare function verify(jws: string, key: CryptoKey | JWK | Uint8Array | KeyLookupFunction, options: JWSVerifyOptions & {
+declare function verify<T = JWTClaims | Uint8Array | string>(jws: string, key: CryptoKey | JWK | JWKSet | Uint8Array | JWSKeyLookupFunction, options?: JWSVerifyOptions): Promise<JWSVerifyResult<T>>;
+declare function verify(jws: string, key: CryptoKey | JWK | JWKSet | Uint8Array | JWSKeyLookupFunction, options: JWSVerifyOptions & {
     forceUint8Array: true;
 }): Promise<JWSVerifyResult<Uint8Array>>;
 
 type jws_JWSAlgorithm = JWSAlgorithm;
 type jws_JWSHeaderParameters = JWSHeaderParameters;
+type jws_JWSKeyLookupFunction = JWSKeyLookupFunction;
 type jws_JWSProtectedHeader = JWSProtectedHeader;
 type jws_JWSSignOptions = JWSSignOptions;
 type jws_JWSVerifyOptions = JWSVerifyOptions;
@@ -93,8 +153,8 @@ declare const jws_sign: typeof sign;
 declare const jws_verify: typeof verify;
 declare namespace jws {
   export { jws_sign as sign, jws_verify as verify };
-  export type { jws_JWSAlgorithm as JWSAlgorithm, jws_JWSHeaderParameters as JWSHeaderParameters, jws_JWSProtectedHeader as JWSProtectedHeader, jws_JWSSignOptions as JWSSignOptions, jws_JWSVerifyOptions as JWSVerifyOptions, jws_JWSVerifyResult as JWSVerifyResult };
+  export type { jws_JWSAlgorithm as JWSAlgorithm, jws_JWSHeaderParameters as JWSHeaderParameters, jws_JWSKeyLookupFunction as JWSKeyLookupFunction, jws_JWSProtectedHeader as JWSProtectedHeader, jws_JWSSignOptions as JWSSignOptions, jws_JWSVerifyOptions as JWSVerifyOptions, jws_JWSVerifyResult as JWSVerifyResult };
 }
 
 export { jws as j, sign as s, verify as v };
-export type { JWSAlgorithm as J, JWSHeaderParameters as a, JWSProtectedHeader as b, JWSSignOptions as c, JWSVerifyResult as d, JWSVerifyOptions as e };
+export type { JWSAlgorithm as J, JWSHeaderParameters as a, JWSProtectedHeader as b, JWSSignOptions as c, JWSVerifyResult as d, JWSVerifyOptions as e, JWSKeyLookupFunction as f };

package/dist/shared/{unjwt.C9Xhi7hE.mjs → unjwt.CauxOPN5.mjs}

@@ -1,4 +1,4 @@
-import { c as checkSigCryptoKey } from './unjwt.1gbuWbc6.mjs';
+import { c as checkSigCryptoKey } from './unjwt.BPpolBff.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.

package/dist/shared/{unjwt.B4fFiy1c.d.mts → unjwt.CbvzYE-m.d.mts}

@@ -1,4 +1,4 @@
-import { m as JWK } from './unjwt.CxhGjEAX.mjs';
+import { m as JWK, n as JWKSet } from './unjwt.D9da8HQF.mjs';
 
 declare const textEncoder: TextEncoder;
 declare const textDecoder: TextDecoder;
@@ -15,7 +15,9 @@ declare function randomBytes(length: Readonly<number>): Uint8Array;
  * @returns Concatenated array
  */
 declare function concatUint8Arrays(...arrays: Readonly<Uint8Array[]>): Uint8Array;
+declare function maybeArray<T>(item: T | T[]): T[];
 declare function isJWK(key: any): key is JWK;
+declare function isJWKSet(key: any): key is JWKSet;
 declare function assertCryptoKey(key: unknown): asserts key is CryptoKey;
 declare function isCryptoKey(key: unknown): key is CryptoKey;
 declare const isCryptoKeyPair: (key: any) => key is CryptoKeyPair;
@@ -29,6 +31,8 @@ declare const index_concatUint8Arrays: typeof concatUint8Arrays;
 declare const index_isCryptoKey: typeof isCryptoKey;
 declare const index_isCryptoKeyPair: typeof isCryptoKeyPair;
 declare const index_isJWK: typeof isJWK;
+declare const index_isJWKSet: typeof isJWKSet;
+declare const index_maybeArray: typeof maybeArray;
 declare const index_randomBytes: typeof randomBytes;
 declare const index_textDecoder: typeof textDecoder;
 declare const index_textEncoder: typeof textEncoder;
@@ -43,10 +47,12 @@ declare namespace index {
     index_isCryptoKey as isCryptoKey,
     index_isCryptoKeyPair as isCryptoKeyPair,
     index_isJWK as isJWK,
+    index_isJWKSet as isJWKSet,
+    index_maybeArray as maybeArray,
     index_randomBytes as randomBytes,
     index_textDecoder as textDecoder,
     index_textEncoder as textEncoder,
   };
 }
 
-export { textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, assertCryptoKey as h, index as i, isCryptoKey as j, isCryptoKeyPair as k, randomBytes as r, textEncoder as t };
+export { textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, isJWKSet as h, index as i, assertCryptoKey as j, isCryptoKey as k, isCryptoKeyPair as l, maybeArray as m, randomBytes as r, textEncoder as t };

package/dist/shared/{unjwt.DqmNvXMd.d.ts → unjwt.D4DUiNeM.d.ts}

@@ -1,4 +1,4 @@
-import { m as JWK } from './unjwt.CxhGjEAX.js';
+import { m as JWK, n as JWKSet } from './unjwt.D9da8HQF.js';
 
 declare const textEncoder: TextEncoder;
 declare const textDecoder: TextDecoder;
@@ -15,7 +15,9 @@ declare function randomBytes(length: Readonly<number>): Uint8Array;
  * @returns Concatenated array
  */
 declare function concatUint8Arrays(...arrays: Readonly<Uint8Array[]>): Uint8Array;
+declare function maybeArray<T>(item: T | T[]): T[];
 declare function isJWK(key: any): key is JWK;
+declare function isJWKSet(key: any): key is JWKSet;
 declare function assertCryptoKey(key: unknown): asserts key is CryptoKey;
 declare function isCryptoKey(key: unknown): key is CryptoKey;
 declare const isCryptoKeyPair: (key: any) => key is CryptoKeyPair;
@@ -29,6 +31,8 @@ declare const index_concatUint8Arrays: typeof concatUint8Arrays;
 declare const index_isCryptoKey: typeof isCryptoKey;
 declare const index_isCryptoKeyPair: typeof isCryptoKeyPair;
 declare const index_isJWK: typeof isJWK;
+declare const index_isJWKSet: typeof isJWKSet;
+declare const index_maybeArray: typeof maybeArray;
 declare const index_randomBytes: typeof randomBytes;
 declare const index_textDecoder: typeof textDecoder;
 declare const index_textEncoder: typeof textEncoder;
@@ -43,10 +47,12 @@ declare namespace index {
     index_isCryptoKey as isCryptoKey,
     index_isCryptoKeyPair as isCryptoKeyPair,
     index_isJWK as isJWK,
+    index_isJWKSet as isJWKSet,
+    index_maybeArray as maybeArray,
     index_randomBytes as randomBytes,
     index_textDecoder as textDecoder,
     index_textEncoder as textEncoder,
   };
 }
 
-export { textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, assertCryptoKey as h, index as i, isCryptoKey as j, isCryptoKeyPair as k, randomBytes as r, textEncoder as t };
+export { textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, isJWKSet as h, index as i, assertCryptoKey as j, isCryptoKey as k, isCryptoKeyPair as l, maybeArray as m, randomBytes as r, textEncoder as t };

package/dist/shared/{unjwt.CxhGjEAX.d.mts → unjwt.D9da8HQF.d.mts}

@@ -178,9 +178,17 @@ interface JWK_oct extends JWKParameters {
     k: string;
 }
 /**
- * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA" and "oct" key types are supported.
+ * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC" and "oct" key types are supported.
  */
 type JWK = JWK_oct | JWK_RSA | JWK_EC;
+/**
+ * JSON Web Key Set ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK Set}). "RSA", "EC" and "oct" key types are supported.
+ */
+interface JWKSet {
+    /** JWK Set "keys" Parameter */
+    keys: JWK[];
+    [parameter: string]: unknown;
+}
 /** JWK Key Algorithms */
 type JWK_HMAC = "HS256" | "HS384" | "HS512";
 type JWK_RSA_SIGN = "RS256" | "RS384" | "RS512";
@@ -199,4 +207,4 @@ type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA
 type JWKAlgorithm = JWK_Symmetric_Algorithm | JWK_Asymmetric_Algorithm | JWK_AES_CBC_HMAC | JWK_PBES2 | JWK_ECDH_ES | ("none" | "dir");
 type JWKPEMAlgorithm = JWK_RSA_PSS | JWK_RSA_SIGN | JWK_RSA_ENC | JWK_ECDSA | JWK_ECDH_ES | JWK_ED;
 
-export type { JWK_Asymmetric_Algorithm as A, JWKAlgorithm as B, CompositeKey as C, DeriveKeyOptions as D, JWKPEMAlgorithm as E, GenerateKeyAlgorithm as G, JWKParameters as J, KeyManagementAlgorithm as K, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, DeriveKeyReturn as c, ContentEncryptionAlgorithm as d, WrapKeyResult as e, JWK_EC_Public as f, JWK_EC_Private as g, JWK_EC as h, JWK_RSA_Public as i, JWK_RSA_Private as j, JWK_RSA as k, JWK_oct as l, JWK as m, JWK_HMAC as n, JWK_RSA_SIGN as o, JWK_RSA_PSS as p, JWK_ECDSA as q, JWK_RSA_ENC as r, JWK_AES_KW as s, JWK_AES_GCM_KW as t, JWK_AES_CBC_HMAC as u, JWK_AES_GCM as v, JWK_PBES2 as w, JWK_ECDH_ES as x, JWK_ED as y, JWK_Symmetric_Algorithm as z };
+export type { JWK_Symmetric_Algorithm as A, JWK_Asymmetric_Algorithm as B, CompositeKey as C, DeriveKeyOptions as D, JWKAlgorithm as E, JWKPEMAlgorithm as F, GenerateKeyAlgorithm as G, JWKParameters as J, KeyManagementAlgorithm as K, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, DeriveKeyReturn as c, ContentEncryptionAlgorithm as d, WrapKeyResult as e, JWK_EC_Public as f, JWK_EC_Private as g, JWK_EC as h, JWK_RSA_Public as i, JWK_RSA_Private as j, JWK_RSA as k, JWK_oct as l, JWK as m, JWKSet as n, JWK_HMAC as o, JWK_RSA_SIGN as p, JWK_RSA_PSS as q, JWK_ECDSA as r, JWK_RSA_ENC as s, JWK_AES_KW as t, JWK_AES_GCM_KW as u, JWK_AES_CBC_HMAC as v, JWK_AES_GCM as w, JWK_PBES2 as x, JWK_ECDH_ES as y, JWK_ED as z };

package/dist/shared/{unjwt.CxhGjEAX.d.ts → unjwt.D9da8HQF.d.ts}

@@ -178,9 +178,17 @@ interface JWK_oct extends JWKParameters {
     k: string;
 }
 /**
- * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA" and "oct" key types are supported.
+ * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC" and "oct" key types are supported.
  */
 type JWK = JWK_oct | JWK_RSA | JWK_EC;
+/**
+ * JSON Web Key Set ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK Set}). "RSA", "EC" and "oct" key types are supported.
+ */
+interface JWKSet {
+    /** JWK Set "keys" Parameter */
+    keys: JWK[];
+    [parameter: string]: unknown;
+}
 /** JWK Key Algorithms */
 type JWK_HMAC = "HS256" | "HS384" | "HS512";
 type JWK_RSA_SIGN = "RS256" | "RS384" | "RS512";
@@ -199,4 +207,4 @@ type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA
 type JWKAlgorithm = JWK_Symmetric_Algorithm | JWK_Asymmetric_Algorithm | JWK_AES_CBC_HMAC | JWK_PBES2 | JWK_ECDH_ES | ("none" | "dir");
 type JWKPEMAlgorithm = JWK_RSA_PSS | JWK_RSA_SIGN | JWK_RSA_ENC | JWK_ECDSA | JWK_ECDH_ES | JWK_ED;
 
-export type { JWK_Asymmetric_Algorithm as A, JWKAlgorithm as B, CompositeKey as C, DeriveKeyOptions as D, JWKPEMAlgorithm as E, GenerateKeyAlgorithm as G, JWKParameters as J, KeyManagementAlgorithm as K, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, DeriveKeyReturn as c, ContentEncryptionAlgorithm as d, WrapKeyResult as e, JWK_EC_Public as f, JWK_EC_Private as g, JWK_EC as h, JWK_RSA_Public as i, JWK_RSA_Private as j, JWK_RSA as k, JWK_oct as l, JWK as m, JWK_HMAC as n, JWK_RSA_SIGN as o, JWK_RSA_PSS as p, JWK_ECDSA as q, JWK_RSA_ENC as r, JWK_AES_KW as s, JWK_AES_GCM_KW as t, JWK_AES_CBC_HMAC as u, JWK_AES_GCM as v, JWK_PBES2 as w, JWK_ECDH_ES as x, JWK_ED as y, JWK_Symmetric_Algorithm as z };
+export type { JWK_Symmetric_Algorithm as A, JWK_Asymmetric_Algorithm as B, CompositeKey as C, DeriveKeyOptions as D, JWKAlgorithm as E, JWKPEMAlgorithm as F, GenerateKeyAlgorithm as G, JWKParameters as J, KeyManagementAlgorithm as K, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, DeriveKeyReturn as c, ContentEncryptionAlgorithm as d, WrapKeyResult as e, JWK_EC_Public as f, JWK_EC_Private as g, JWK_EC as h, JWK_RSA_Public as i, JWK_RSA_Private as j, JWK_RSA as k, JWK_oct as l, JWK as m, JWKSet as n, JWK_HMAC as o, JWK_RSA_SIGN as p, JWK_RSA_PSS as q, JWK_ECDSA as r, JWK_RSA_ENC as s, JWK_AES_KW as t, JWK_AES_GCM_KW as u, JWK_AES_CBC_HMAC as v, JWK_AES_GCM as w, JWK_PBES2 as x, JWK_ECDH_ES as y, JWK_ED as z };

package/dist/shared/{unjwt.DQIYSlHj.d.mts → unjwt.DLOO5Rmq.d.mts}

@@ -1,5 +1,5 @@
-import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, f as JWK_EC_Public, m as JWK } from './unjwt.CxhGjEAX.mjs';
-import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.Cd9nTEWg.mjs';
+import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, f as JWK_EC_Public, m as JWK } from './unjwt.D9da8HQF.mjs';
+import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.BvIkEGGz.mjs';
 
 /** Recognized JWE Header Parameters, any other Header Members may also be present. */
 interface JWEHeaderParameters extends JoseHeaderParameters {
@@ -99,7 +99,7 @@ interface JWEEncryptOptions {
  * @param header The JWE Protected Header.
  * @returns The key material (CryptoKey, JWK, password string, or raw Uint8Array) or a Promise resolving to it.
  */
-type JWEKeyLookupFunction = (header: JWEHeaderParameters) => CryptoKey | JWK | string | Uint8Array | Promise<CryptoKey | JWK | string | Uint8Array>;
+type JWEKeyLookupFunction = (header: JWEHeaderParameters, token: string) => CryptoKey | JWK | string | Uint8Array | Promise<CryptoKey | JWK | string | Uint8Array>;
 /**
  * JWE (JSON Web Encryption) decryption options
  */

package/dist/shared/{unjwt.WvWb2zNM.d.ts → unjwt.DZjogLQk.d.mts}

@@ -1,4 +1,5 @@
-import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, w as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, l as JWK_oct, m as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, E as JWKPEMAlgorithm, C as CompositeKey, d as ContentEncryptionAlgorithm, B as JWKAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, A as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, y as JWK_ED, n as JWK_HMAC, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, z as JWK_Symmetric_Algorithm } from './unjwt.CxhGjEAX.js';
+import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, x as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, l as JWK_oct, m as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, F as JWKPEMAlgorithm, n as JWKSet, C as CompositeKey, d as ContentEncryptionAlgorithm, E as JWKAlgorithm, J as JWKParameters, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm } from './unjwt.D9da8HQF.mjs';
+import { J as JoseHeaderParameters } from './unjwt.BvIkEGGz.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -101,6 +102,25 @@ declare function importJWKFromPEM(pem: string, pemType: "pkcs8" | "spki" | "x509
  * @returns A Promise resolving to the PEM-encoded key string.
  */
 declare function exportJWKToPEM(jwk: JWK, pemFormat: "pkcs8" | "spki", algForCryptoKeyImport?: JWKPEMAlgorithm): Promise<string>;
+/**
+ * Retrieves a JWK (JSON Web Key) from a JWKSet based on a key ID (kid) or
+ * properties from a JOSE Header.
+ *
+ * @param jwkSet The JWKSet to search within.
+ * @param kidOrProtectedHeader Either a string representing the 'kid' (Key ID)
+ *        or an object representing the JOSE Protected Header. If an object is
+ *        provided, it must contain a 'kid' property. It can optionally contain
+ *        'alg' (Algorithm) and 'kty' (Key Type) to further refine the search.
+ * @returns The matching JWK from the set.
+ * @throws TypeError if `jwkSet` is invalid or `kidOrProtectedHeader` is not a
+ *         string or a valid header object.
+ * @throws Error if no key is found matching the provided criteria, or if the
+ *         header object is missing the 'kid' property.
+ */
+declare function getJWKFromSet(jwkSet: JWKSet, kidOrProtectedHeader: string | (JoseHeaderParameters & {
+    alg?: string;
+    kty?: string;
+})): JWK;
 
 declare const jwk_CompositeKey: typeof CompositeKey;
 declare const jwk_ContentEncryptionAlgorithm: typeof ContentEncryptionAlgorithm;
@@ -113,6 +133,7 @@ declare const jwk_JWK: typeof JWK;
 declare const jwk_JWKAlgorithm: typeof JWKAlgorithm;
 declare const jwk_JWKPEMAlgorithm: typeof JWKPEMAlgorithm;
 declare const jwk_JWKParameters: typeof JWKParameters;
+declare const jwk_JWKSet: typeof JWKSet;
 declare const jwk_JWK_AES_CBC_HMAC: typeof JWK_AES_CBC_HMAC;
 declare const jwk_JWK_AES_GCM: typeof JWK_AES_GCM;
 declare const jwk_JWK_AES_GCM_KW: typeof JWK_AES_GCM_KW;
@@ -142,6 +163,7 @@ declare const jwk_deriveKeyFromPassword: typeof deriveKeyFromPassword;
 declare const jwk_exportJWKToPEM: typeof exportJWKToPEM;
 declare const jwk_exportKey: typeof exportKey;
 declare const jwk_generateKey: typeof generateKey;
+declare const jwk_getJWKFromSet: typeof getJWKFromSet;
 declare const jwk_importJWKFromPEM: typeof importJWKFromPEM;
 declare const jwk_importKey: typeof importKey;
 declare const jwk_unwrapKey: typeof unwrapKey;
@@ -159,6 +181,7 @@ declare namespace jwk {
     jwk_JWKAlgorithm as JWKAlgorithm,
     jwk_JWKPEMAlgorithm as JWKPEMAlgorithm,
     jwk_JWKParameters as JWKParameters,
+    jwk_JWKSet as JWKSet,
     jwk_JWK_AES_CBC_HMAC as JWK_AES_CBC_HMAC,
     jwk_JWK_AES_GCM as JWK_AES_GCM,
     jwk_JWK_AES_GCM_KW as JWK_AES_GCM_KW,
@@ -188,6 +211,7 @@ declare namespace jwk {
     jwk_exportJWKToPEM as exportJWKToPEM,
     jwk_exportKey as exportKey,
     jwk_generateKey as generateKey,
+    jwk_getJWKFromSet as getJWKFromSet,
     jwk_importJWKFromPEM as importJWKFromPEM,
     jwk_importKey as importKey,
     jwk_unwrapKey as unwrapKey,
@@ -195,4 +219,4 @@ declare namespace jwk {
   };
 }
 
-export { importJWKFromPEM as a, exportJWKToPEM as b, deriveKeyFromPassword as d, exportKey as e, generateKey as g, importKey as i, jwk as j, unwrapKey as u, wrapKey as w };
+export { importJWKFromPEM as a, exportJWKToPEM as b, getJWKFromSet as c, deriveKeyFromPassword as d, exportKey as e, generateKey as g, importKey as i, jwk as j, unwrapKey as u, wrapKey as w };

package/dist/shared/{unjwt.BxqF-n1S.mjs → unjwt.Dsh9nxbB.mjs}

@@ -1,6 +1,6 @@
-import { i as importKey } from './unjwt.1gbuWbc6.mjs';
-import { a as isJWK, b as base64UrlEncode, t as textEncoder, c as textDecoder, d as base64UrlDecode } from './unjwt.DHdDAH0L.mjs';
-import { s as sign$1, v as verify$1 } from './unjwt.C9Xhi7hE.mjs';
+import { i as importKey, g as getJWKFromSet } from './unjwt.BPpolBff.mjs';
+import { a as isJWK, b as base64UrlEncode, t as textEncoder, c as textDecoder, d as base64UrlDecode, e as isJWKSet, m as maybeArray } from './unjwt.X5vzu_l_.mjs';
+import { s as sign$1, v as verify$1 } from './unjwt.CauxOPN5.mjs';
 
 async function sign(payload, key, options = {}) {
   const { protectedHeader: additionalProtectedHeader } = options;
@@ -48,7 +48,7 @@ async function sign(payload, key, options = {}) {
   const signatureEncoded = base64UrlEncode(signatureBytes);
   return `${signingInputString}.${signatureEncoded}`;
 }
-async function verify(jws, key, options) {
+async function verify(jws, key, options = {}) {
   const parts = jws.split(".");
   if (parts.length !== 3) {
     throw new Error("Invalid JWS: Must contain three parts separated by dots.");
@@ -69,9 +69,14 @@ async function verify(jws, key, options) {
     );
   }
   const alg = protectedHeader.alg;
-  if (options?.algorithms && !options.algorithms.includes(alg)) {
+  if (options.algorithms && !options.algorithms.includes(alg)) {
     throw new Error(`Algorithm not allowed: ${alg}`);
   }
+  if (options.typ && protectedHeader.typ !== options.typ) {
+    throw new Error(
+      `Invalid JWS: "typ" (Type) Header Parameter mismatch. Expected "${options.typ}", got "${protectedHeader.typ}".`
+    );
+  }
   let signatureBytes;
   try {
     signatureBytes = base64UrlDecode(signatureEncoded, false);
@@ -80,7 +85,8 @@ async function verify(jws, key, options) {
       `Invalid JWS: Signature is not valid Base64URL (${error_ instanceof Error ? error_.message : error_})`
     );
   }
-  const resolvedKey = typeof key === "function" ? await key(protectedHeader) : key;
+  const keyInput = typeof key === "function" ? await key(protectedHeader, jws) : key;
+  const resolvedKey = isJWKSet(keyInput) ? getJWKFromSet(keyInput, protectedHeader) : keyInput;
   const verificationKey = await importKey(resolvedKey, alg);
   const signingInputString = `${protectedHeaderEncoded}.${payloadEncoded}`;
   const signingInputBytes = textEncoder.encode(signingInputString);
@@ -97,13 +103,13 @@ async function verify(jws, key, options) {
   let payload;
   try {
     if (useB64) {
-      if (options?.forceUint8Array) {
+      if (options.forceUint8Array) {
         payload = base64UrlDecode(payloadEncoded, false);
       } else {
         const cty = protectedHeader.cty?.toLowerCase();
         const isJsonOutput = protectedHeader.typ === "JWT" || cty === "json" || cty === "application/json" || cty && cty.endsWith("+json");
+        const decodedString = base64UrlDecode(payloadEncoded);
         if (isJsonOutput) {
-          const decodedString = base64UrlDecode(payloadEncoded, true);
           if (decodedString.startsWith("{") && decodedString.endsWith("}") || decodedString.startsWith("[") && decodedString.endsWith("]")) {
             try {
               payload = JSON.parse(decodedString);
@@ -114,21 +120,23 @@ async function verify(jws, key, options) {
             payload = decodedString;
           }
         } else {
-          payload = base64UrlDecode(payloadEncoded);
+          payload = decodedString;
         }
       }
     } else {
-      payload = textEncoder.encode(payloadEncoded);
+      payload = options.forceUint8Array ? textEncoder.encode(payloadEncoded) : payloadEncoded;
     }
   } catch (error_) {
     throw new Error(
       `Invalid JWS: Payload decoding failed (${error_ instanceof Error ? error_.message : error_})`
     );
   }
-  if (options?.critical && protectedHeader.crit) {
+  if (protectedHeader.crit) {
+    const missingHeaderParams = /* @__PURE__ */ new Set();
     const recognizedParams = /* @__PURE__ */ new Set([
-      ...Object.keys(protectedHeader),
       ...options.critical || [],
+      // TODO: remove deprecated option
+      ...options.requiredHeaders || [],
       "alg",
       "typ",
       "cty",
@@ -140,17 +148,88 @@ async function verify(jws, key, options) {
       "x5u",
       "b64"
     ]);
-    for (const critParam of protectedHeader.crit) {
-      if (!recognizedParams.has(critParam)) {
+    for (const param of protectedHeader.crit) {
+      if (recognizedParams.has(param) && (param in protectedHeader || param === "b64")) {
+        continue;
+      }
+      missingHeaderParams.add(param);
+    }
+    if (missingHeaderParams.size > 0) {
+      throw new Error(
+        `Missing critical header parameters: ${[...missingHeaderParams].join(", ")}`
+      );
+    }
+  }
+  if (payload && typeof payload === "object" && !options.forceUint8Array) {
+    const jwtClaims = payload;
+    const clockTolerance = (options.clockTolerance ?? 0) * 1e3;
+    const currentDate = options.currentDate ?? /* @__PURE__ */ new Date();
+    const currentTime = currentDate.getTime();
+    const allRequiredClaims = new Set(options.requiredClaims || []);
+    const missingClaims = /* @__PURE__ */ new Set();
+    if (options.issuer) allRequiredClaims.add("iss");
+    if (options.audience) allRequiredClaims.add("aud");
+    if (options.subject) allRequiredClaims.add("sub");
+    if (options.maxTokenAge) allRequiredClaims.add("iat");
+    for (const claimName of allRequiredClaims) {
+      if (!(claimName in jwtClaims)) {
+        missingClaims.add(claimName);
+      }
+    }
+    if (missingClaims.size > 0) {
+      throw new Error(
+        `Missing required JWT Claims: ${[...missingClaims].join(", ")}`
+      );
+    }
+    if (options.issuer) {
+      const expectedIssuers = maybeArray(options.issuer);
+      if (!jwtClaims.iss || !expectedIssuers.includes(jwtClaims.iss)) {
         throw new Error(
-          `Critical header parameter not understood: ${critParam}`
+          `Invalid JWT "iss" (Issuer) Claim: Expected ${expectedIssuers.join(" or ")}, got ${jwtClaims.iss}`
+        );
+      }
+    }
+    if (options.subject && jwtClaims.sub !== options.subject) {
+      throw new Error(
+        `Invalid JWT "sub" (Subject) Claim: Expected ${options.subject}, got ${jwtClaims.sub}`
+      );
+    }
+    if (options.audience) {
+      const expectedAudiences = maybeArray(options.audience);
+      const claimAudience = maybeArray(jwtClaims.aud || []);
+      if (!claimAudience.some((aud) => expectedAudiences.includes(aud))) {
+        throw new Error(
+          `Invalid JWT "aud" (Audience) Claim: Expected ${expectedAudiences.join(" or ")}, got ${claimAudience.join(", ")}`
+        );
+      }
+    }
+    if (typeof jwtClaims.nbf === "number" && jwtClaims.nbf * 1e3 > currentTime + clockTolerance) {
+      throw new Error(
+        `JWT "nbf" (Not Before) Claim validation failed: Token is not yet valid (nbf: ${new Date(jwtClaims.nbf * 1e3).toISOString()})`
+      );
+    }
+    if (typeof jwtClaims.exp === "number" && jwtClaims.exp * 1e3 <= currentTime - clockTolerance) {
+      throw new Error(
+        `JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${new Date(jwtClaims.exp * 1e3).toISOString()})`
+      );
+    }
+    if (options.maxTokenAge) {
+      if (typeof jwtClaims.iat !== "number") {
+        throw new TypeError(
+          'JWT "iat" (Issued At) Claim must be a number when maxTokenAge is set.'
+        );
+      }
+      if (jwtClaims.iat * 1e3 > currentTime + clockTolerance) {
+        throw new Error(
+          `JWT "iat" (Issued At) Claim validation failed: Token was issued in the future (iat: ${new Date(jwtClaims.iat * 1e3).toISOString()})`
+        );
+      }
+      if (jwtClaims.iat * 1e3 < currentTime - options.maxTokenAge * 1e3 - clockTolerance) {
+        throw new Error(
+          `JWT "iat" (Issued At) Claim validation failed: Token is too old (maxTokenAge: ${options.maxTokenAge}s, iat: ${new Date(jwtClaims.iat * 1e3).toISOString()})`
         );
       }
     }
-  } else if (!options?.critical && protectedHeader.crit) {
-    throw new Error(
-      `Unprocessed critical header parameters: ${protectedHeader.crit.join(", ")}`
-    );
   }
   return {
     payload,

package/dist/shared/{unjwt.DHdDAH0L.mjs → unjwt.X5vzu_l_.mjs}

@@ -51,9 +51,15 @@ function concatUint8Arrays(...arrays) {
   }
   return result;
 }
+function maybeArray(item) {
+  return Array.isArray(item) ? item : [item];
+}
 function isJWK(key) {
   return typeof key === "object" && key !== null && "kty" in key && typeof key.kty === "string";
 }
+function isJWKSet(key) {
+  return key && typeof key === "object" && "keys" in key && Array.isArray(key.keys);
+}
 function assertCryptoKey(key) {
   if (!isCryptoKey(key)) {
     throw new Error("CryptoKey instance expected");
@@ -75,9 +81,11 @@ const index = {
   isCryptoKey: isCryptoKey,
   isCryptoKeyPair: isCryptoKeyPair,
   isJWK: isJWK,
+  isJWKSet: isJWKSet,
+  maybeArray: maybeArray,
   randomBytes: randomBytes,
   textDecoder: textDecoder,
   textEncoder: textEncoder
 };
 
-export { isJWK as a, base64UrlEncode as b, textDecoder as c, base64UrlDecode as d, concatUint8Arrays as e, assertCryptoKey as f, isCryptoKey as g, base64Decode as h, index as i, base64Encode as j, isCryptoKeyPair as k, randomBytes as r, textEncoder as t };
+export { isJWK as a, base64UrlEncode as b, textDecoder as c, base64UrlDecode as d, isJWKSet as e, concatUint8Arrays as f, assertCryptoKey as g, isCryptoKey as h, index as i, base64Decode as j, base64Encode as k, isCryptoKeyPair as l, maybeArray as m, randomBytes as r, textEncoder as t };

package/dist/shared/{unjwt.BISJ5yt1.d.ts → unjwt.c10n3uM8.d.ts}

@@ -1,4 +1,4 @@
-import { i as JWK_RSA_Public } from './unjwt.CxhGjEAX.js';
+import { i as JWK_RSA_Public } from './unjwt.D9da8HQF.js';
 
 /** Header Parameters common to JWE and JWS */
 interface JoseHeaderParameters {

package/dist/utils.d.mts

@@ -1,2 +1,2 @@
-import './shared/unjwt.CxhGjEAX.mjs';
-export { h as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, f as concatUint8Arrays, j as isCryptoKey, k as isCryptoKeyPair, g as isJWK, r as randomBytes, a as textDecoder, t as textEncoder } from './shared/unjwt.B4fFiy1c.mjs';
+import './shared/unjwt.D9da8HQF.mjs';
+export { j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, f as concatUint8Arrays, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, m as maybeArray, r as randomBytes, a as textDecoder, t as textEncoder } from './shared/unjwt.CbvzYE-m.mjs';

package/dist/utils.d.ts

@@ -1,2 +1,2 @@
-import './shared/unjwt.CxhGjEAX.js';
-export { h as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, f as concatUint8Arrays, j as isCryptoKey, k as isCryptoKeyPair, g as isJWK, r as randomBytes, a as textDecoder, t as textEncoder } from './shared/unjwt.DqmNvXMd.js';
+import './shared/unjwt.D9da8HQF.js';
+export { j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, f as concatUint8Arrays, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, m as maybeArray, r as randomBytes, a as textDecoder, t as textEncoder } from './shared/unjwt.D4DUiNeM.js';

package/dist/utils.mjs

@@ -1 +1 @@
-export { f as assertCryptoKey, h as base64Decode, j as base64Encode, d as base64UrlDecode, b as base64UrlEncode, e as concatUint8Arrays, g as isCryptoKey, k as isCryptoKeyPair, a as isJWK, r as randomBytes, c as textDecoder, t as textEncoder } from './shared/unjwt.DHdDAH0L.mjs';
+export { g as assertCryptoKey, j as base64Decode, k as base64Encode, d as base64UrlDecode, b as base64UrlEncode, f as concatUint8Arrays, h as isCryptoKey, l as isCryptoKeyPair, a as isJWK, e as isJWKSet, m as maybeArray, r as randomBytes, c as textDecoder, t as textEncoder } from './shared/unjwt.X5vzu_l_.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",