unjwt 0.5.10 → 0.5.11

package/README.md

@@ -111,7 +111,7 @@ Creates a JWS token.
 - `key`: The signing key (`CryptoKey`, `JWK`, or `Uint8Array` for symmetric keys).
 - `options`:
   - `alg`: (Required) The JWS algorithm (e.g., `"HS256"`, `"RS256"`, `"ES256"`, `"PS256"`).
-  - `protectedHeader`: An object for additional JWS Protected Header parameters (e.g., `kid`, `typ`, `cty`, `crit`, `b64`). If `payload` is an object and `typ` is not set, it defaults to `"JWT"`. The `b64` parameter ([RFC7797 section-3](https://datatracker.ietf.org/doc/html/rfc7797#section-3)) controls payload encoding (defaults to `true`, meaning Base64URL encoded).
+  - `protectedHeader`: An object for additional JWS Protected Header parameters (e.g., `kid`, `typ`, `cty`, `crit`, `b64`). If `payload` is an object and `typ` is not set, it defaults to `"at+jwt"`. The `b64` parameter ([RFC7797 section-3](https://datatracker.ietf.org/doc/html/rfc7797#section-3)) controls payload encoding (defaults to `true`, meaning Base64URL encoded).
   - `expiresIn`: Sets an expiration time in seconds (e.g., `3600` for 1 hour). If `iat` is missing it will be set to the current time. If `exp` is missing it will be set to `iat + expiresIn`. This is only applied if `payload` is a JWT.
   - `currentDate`: The current date for computing `expiresIn` option. Defaults to `new Date()`.
 
@@ -170,7 +170,7 @@ const secret = "supersecretkey";
 
 const { payload, protectedHeader } = await verify(token, secret);
 console.log(payload); // { message: "My important data" }
-console.log(protectedHeader); // { alg: "HS256", typ: "JWT" }
+console.log(protectedHeader); // { alg: "HS256", typ: "at+jwt" }
 ```
 
 **Example (RS256 with key lookup):**
@@ -210,7 +210,7 @@ Encrypts data to produce a JWE token.
 - `options`:
   - `alg`: (Required) The JWE Key Management algorithm (e.g., `"A128KW"`, `"RSA-OAEP-256"`, `"PBES2-HS256+A128KW"`, `"ECDH-ES+A128KW"`), defaults depends on the key provided.
   - `enc`: (Required) The JWE Content Encryption algorithm (e.g., `"A128GCM"`, `"A256CBC-HS512"`), defaults depends on the key provided.
-  - `protectedHeader`: An object for JWE Protected Header parameters (e.g., `kid`, `typ`, `cty`, `crit`, `apu`, `apv`, `p2s`, `p2c`). If `payload` is an object and `typ` is not set, it defaults to `"JWT"`.
+  - `protectedHeader`: An object for JWE Protected Header parameters (e.g., `kid`, `typ`, `cty`, `crit`, `apu`, `apv`, `p2s`, `p2c`). If `payload` is an object and `typ` is not set, it defaults to `"at+jwt"`.
   - `cek`: (Optional) Provide your own Content Encryption Key (`CryptoKey` or `Uint8Array`).
   - `contentEncryptionIV`: (Optional) Provide your own Initialization Vector for content encryption (`Uint8Array`).
   - Other algorithm-specific options like `p2s`, `p2c` (for PBES2), `keyManagementIV`, `ecdhPartyUInfo`, `ecdhPartyVInfo`.

package/dist/index.d.mts

@@ -1,5 +1,5 @@
 export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, L as JWT, M as JWTClaimValidationOptions, I as JWTClaims, H as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CN1C8TlR.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.igKyF5q2.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.Dof5OLMV.mjs';
-export { i as utils } from './shared/unjwt.CUUg6g3N.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.QRureeXk.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.BvhKNVNR.mjs';
+export { i as utils } from './shared/unjwt.df8yQ5_5.mjs';
 export { j as jwk } from './shared/unjwt.Cz90HQhy.mjs';

package/dist/index.mjs

@@ -1,5 +1,5 @@
-export { i as utils } from './shared/unjwt.odifuYKu.mjs';
-export { j as jwe } from './shared/unjwt.D0WA_yog.mjs';
-export { j as jwk } from './shared/unjwt.BrOta13J.mjs';
-export { j as jws } from './shared/unjwt.B1dfkZSt.mjs';
-import './shared/unjwt.CEjyBwhK.mjs';
+export { i as utils } from './shared/unjwt.Ce8yMcp_.mjs';
+export { j as jwe } from './shared/unjwt.DVMpKj8x.mjs';
+export { j as jwk } from './shared/unjwt.DuBBF25X.mjs';
+export { j as jws } from './shared/unjwt.D_JFPtpW.mjs';
+import './shared/unjwt.C_D0RMCp.mjs';

package/dist/jwe.d.mts

@@ -1,2 +1,2 @@
 import './shared/unjwt.CN1C8TlR.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.Dof5OLMV.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.BvhKNVNR.mjs';

package/dist/jwe.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.BrOta13J.mjs';
-import './shared/unjwt.odifuYKu.mjs';
-export { d as decrypt, e as encrypt } from './shared/unjwt.D0WA_yog.mjs';
-import './shared/unjwt.CEjyBwhK.mjs';
+import './shared/unjwt.DuBBF25X.mjs';
+import './shared/unjwt.Ce8yMcp_.mjs';
+export { d as decrypt, e as encrypt } from './shared/unjwt.DVMpKj8x.mjs';
+import './shared/unjwt.C_D0RMCp.mjs';

package/dist/jwk.mjs

@@ -1,2 +1,2 @@
-import './shared/unjwt.odifuYKu.mjs';
-export { p as deriveKeyFromPassword, t as exportJWKToPEM, q as exportKey, o as generateKey, g as getJWKFromSet, s as importJWKFromPEM, i as importKey, m as unwrapKey, r as wrapKey } from './shared/unjwt.BrOta13J.mjs';
+import './shared/unjwt.Ce8yMcp_.mjs';
+export { p as deriveKeyFromPassword, t as exportJWKToPEM, q as exportKey, o as generateKey, g as getJWKFromSet, s as importJWKFromPEM, i as importKey, m as unwrapKey, r as wrapKey } from './shared/unjwt.DuBBF25X.mjs';

package/dist/jws.d.mts

@@ -1,2 +1,2 @@
 import './shared/unjwt.CN1C8TlR.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.igKyF5q2.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.QRureeXk.mjs';

package/dist/jws.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.BrOta13J.mjs';
-import './shared/unjwt.odifuYKu.mjs';
-import './shared/unjwt.CEjyBwhK.mjs';
-export { s as sign, v as verify } from './shared/unjwt.B1dfkZSt.mjs';
+import './shared/unjwt.DuBBF25X.mjs';
+import './shared/unjwt.Ce8yMcp_.mjs';
+import './shared/unjwt.C_D0RMCp.mjs';
+export { s as sign, v as verify } from './shared/unjwt.D_JFPtpW.mjs';

package/dist/shared/{unjwt.Dof5OLMV.d.mts → unjwt.BvhKNVNR.d.mts}

@@ -72,7 +72,7 @@ interface JWEEncryptOptions {
     enc?: ContentEncryptionAlgorithm;
     /** Date to use when computing NumericDate claims, defaults to `new Date()`. */
     currentDate?: Date;
-    /** Time at which the JWT should expire, if no `exp` was already provided (only when typ is JWT). */
+    /** Time at which the JWT should expire, if no `exp` was already provided (only when typ is "at+jwt"). */
     expiresIn?: number;
     /** Additional JWE Protected Header parameters. */
     protectedHeader?: Omit<JWEHeaderParameters, "alg" | "enc" | "iv" | "tag" | "p2s" | "p2c" | "apu" | "apv">;

package/dist/shared/{unjwt.CEjyBwhK.mjs → unjwt.C_D0RMCp.mjs}

@@ -1,4 +1,4 @@
-import { c as checkSigCryptoKey } from './unjwt.BrOta13J.mjs';
+import { c as checkSigCryptoKey } from './unjwt.DuBBF25X.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.

package/dist/shared/{unjwt.odifuYKu.mjs → unjwt.Ce8yMcp_.mjs}

@@ -1,15 +1,16 @@
 function applyTypCtyDefaults(header, payload) {
   const isObjectPayload = typeof payload === "object" && payload !== null && !(payload instanceof Uint8Array);
   if (header.typ === void 0 && isObjectPayload) {
-    header.typ = "JWT";
+    header.typ = "at+jwt";
   }
-  if (header.typ === "JWT" && isObjectPayload) {
-    header.cty ||= "json";
+  if ((header.typ === "at+jwt" || header.typ === "JWT") && isObjectPayload) {
+    header.cty ||= "application/json";
   }
   return header;
 }
 function isJsonContent(header) {
   if (!header) return false;
+  if (header.typ === "at+jwt") return true;
   if (header.typ === "JWT") return true;
   const cty = header.cty?.toLowerCase();
   return cty === "json" || cty === "application/json" || !!cty && cty.endsWith("+json");
@@ -46,7 +47,7 @@ function getPlaintextBytes(payload) {
   );
 }
 function computeJwtTimeClaims(payload, headerTyp, expiresIn, currentDate = /* @__PURE__ */ new Date()) {
-  if (expiresIn === void 0 || headerTyp !== "JWT" || !(payload && typeof payload === "object") || payload instanceof Uint8Array || payload.exp) {
+  if (expiresIn === void 0 || headerTyp !== "at+jwt" && headerTyp !== "JWT" || !(payload && typeof payload === "object") || payload instanceof Uint8Array || payload.exp) {
     return void 0;
   }
   const now = Math.round(currentDate.getTime() / 1e3);

package/dist/shared/{unjwt.D0WA_yog.mjs → unjwt.DVMpKj8x.mjs}

@@ -1,6 +1,6 @@
-import { a as checkEncCryptoKey, u as uint32be, b as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, d as bitLengthCEK, f as jwkTokey, i as importKey, h as generateIV, l as encrypt$1, m as unwrapKey, n as decrypt$1 } from './unjwt.BrOta13J.mjs';
-import { k as concatUint8Arrays, t as textEncoder, l as assertCryptoKey, d as base64UrlEncode, m as isCryptoKey, a as isJWK, f as base64UrlDecode, r as randomBytes, b as applyTypCtyDefaults, c as computeJwtTimeClaims, n as getPlaintextBytes, o as decodePayloadFromBytes, p as validateCriticalHeadersJWE } from './unjwt.odifuYKu.mjs';
-import { c as checkKeyLength } from './unjwt.CEjyBwhK.mjs';
+import { a as checkEncCryptoKey, u as uint32be, b as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, d as bitLengthCEK, f as jwkTokey, i as importKey, h as generateIV, l as encrypt$1, m as unwrapKey, n as decrypt$1 } from './unjwt.DuBBF25X.mjs';
+import { k as concatUint8Arrays, t as textEncoder, l as assertCryptoKey, d as base64UrlEncode, m as isCryptoKey, a as isJWK, f as base64UrlDecode, r as randomBytes, b as applyTypCtyDefaults, c as computeJwtTimeClaims, n as getPlaintextBytes, o as decodePayloadFromBytes, p as validateCriticalHeadersJWE } from './unjwt.Ce8yMcp_.mjs';
+import { c as checkKeyLength } from './unjwt.C_D0RMCp.mjs';
 
 function lengthAndInput(input) {
   return concatUint8Arrays(uint32be(input.length), input);

package/dist/shared/{unjwt.B1dfkZSt.mjs → unjwt.D_JFPtpW.mjs}

@@ -1,6 +1,6 @@
-import { i as importKey, g as getJWKFromSet } from './unjwt.BrOta13J.mjs';
-import { a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, e as textDecoder, f as base64UrlDecode, g as isJWKSet, h as decodePayloadFromB64UrlSegment, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './unjwt.odifuYKu.mjs';
-import { s as sign$1, v as verify$1 } from './unjwt.CEjyBwhK.mjs';
+import { i as importKey, g as getJWKFromSet } from './unjwt.DuBBF25X.mjs';
+import { a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, e as textDecoder, f as base64UrlDecode, g as isJWKSet, h as decodePayloadFromB64UrlSegment, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './unjwt.Ce8yMcp_.mjs';
+import { s as sign$1, v as verify$1 } from './unjwt.C_D0RMCp.mjs';
 
 async function sign(payload, key, options = {}) {
   const { protectedHeader: additionalProtectedHeader } = options;
@@ -125,7 +125,7 @@ async function verify(jws, key, options = {}) {
     ...options.critical || [],
     ...options.requiredHeaders || []
   ]);
-  if (payload && typeof payload === "object" && protectedHeader.typ === "JWT" && !options.forceUint8Array) {
+  if (payload && typeof payload === "object" && (protectedHeader.typ === "at+jwt" || protectedHeader.typ === "JWT") && !options.forceUint8Array) {
     validateJwtClaims(payload, options);
   }
   return {

package/dist/shared/{unjwt.BrOta13J.mjs → unjwt.DuBBF25X.mjs}

@@ -1,4 +1,4 @@
-import { m as isCryptoKey, k as concatUint8Arrays, d as base64UrlEncode, q as base64Decode, s as base64Encode, t as textEncoder, r as randomBytes, a as isJWK, f as base64UrlDecode, g as isJWKSet } from './unjwt.odifuYKu.mjs';
+import { m as isCryptoKey, k as concatUint8Arrays, d as base64UrlEncode, q as base64Decode, s as base64Encode, t as textEncoder, r as randomBytes, a as isJWK, f as base64UrlDecode, g as isJWKSet } from './unjwt.Ce8yMcp_.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.

package/dist/shared/{unjwt.igKyF5q2.d.mts → unjwt.QRureeXk.d.mts}

@@ -27,7 +27,7 @@ interface JWSSignOptions {
     alg?: JWSAlgorithm;
     /**
      * Additional protected header parameters. `alg` is automatically included.
-     * `typ` defaults to "JWT" if not provided.
+     * `typ` defaults to "at+jwt" if not provided.
      */
     protectedHeader?: JWSHeaderParameters;
     /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */

package/dist/shared/{unjwt.CUUg6g3N.d.mts → unjwt.df8yQ5_5.d.mts}

@@ -2,8 +2,8 @@ import { I as JWTClaims, M as JWTClaimValidationOptions, m as JWK, n as JWKSet }
 
 /**
  * Apply default typ/cty semantics shared by JWS & JWE.
- * - If typ is undefined and payload is a non-Uint8Array object, set typ="JWT".
- * - If typ is "JWT" and payload is a non-Uint8Array object, ensure cty defaults to "json".
+ * - If typ is undefined and payload is a non-Uint8Array object, set typ="at+jwt".
+ * - If typ is "at+jwt" and payload is a non-Uint8Array object, ensure cty defaults to "application/json".
  */
 declare function applyTypCtyDefaults<T extends {
     typ?: string;

package/dist/utils.d.mts

@@ -1,2 +1,2 @@
 import './shared/unjwt.CN1C8TlR.mjs';
-export { n as applyTypCtyDefaults, j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, v as computeJwtTimeClaims, f as concatUint8Arrays, p as decodeMaybeJsonString, s as decodePayloadFromB64UrlSegment, q as decodePayloadFromBytes, u as getPlaintextBytes, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, o as isJsonContent, m as maybeArray, r as randomBytes, a as textDecoder, t as textEncoder, y as validateCriticalHeadersJWE, x as validateCriticalHeadersJWS, w as validateJwtClaims } from './shared/unjwt.CUUg6g3N.mjs';
+export { n as applyTypCtyDefaults, j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, v as computeJwtTimeClaims, f as concatUint8Arrays, p as decodeMaybeJsonString, s as decodePayloadFromB64UrlSegment, q as decodePayloadFromBytes, u as getPlaintextBytes, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, o as isJsonContent, m as maybeArray, r as randomBytes, a as textDecoder, t as textEncoder, y as validateCriticalHeadersJWE, x as validateCriticalHeadersJWS, w as validateJwtClaims } from './shared/unjwt.df8yQ5_5.mjs';

package/dist/utils.mjs

@@ -1 +1 @@
-export { b as applyTypCtyDefaults, l as assertCryptoKey, q as base64Decode, s as base64Encode, f as base64UrlDecode, d as base64UrlEncode, c as computeJwtTimeClaims, k as concatUint8Arrays, y as decodeMaybeJsonString, h as decodePayloadFromB64UrlSegment, o as decodePayloadFromBytes, n as getPlaintextBytes, m as isCryptoKey, w as isCryptoKeyPair, a as isJWK, g as isJWKSet, x as isJsonContent, u as maybeArray, r as randomBytes, e as textDecoder, t as textEncoder, p as validateCriticalHeadersJWE, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './shared/unjwt.odifuYKu.mjs';
+export { b as applyTypCtyDefaults, l as assertCryptoKey, q as base64Decode, s as base64Encode, f as base64UrlDecode, d as base64UrlEncode, c as computeJwtTimeClaims, k as concatUint8Arrays, y as decodeMaybeJsonString, h as decodePayloadFromB64UrlSegment, o as decodePayloadFromBytes, n as getPlaintextBytes, m as isCryptoKey, w as isCryptoKeyPair, a as isJWK, g as isJWKSet, x as isJsonContent, u as maybeArray, r as randomBytes, e as textDecoder, t as textEncoder, p as validateCriticalHeadersJWE, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './shared/unjwt.Ce8yMcp_.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.10",
+  "version": "0.5.11",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",