unjwt 0.5.12 → 0.5.13

package/dist/index.d.mts

@@ -1,5 +1,5 @@
 export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, L as JWT, M as JWTClaimValidationOptions, I as JWTClaims, H as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CN1C8TlR.mjs';
 export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.BRtnm5sB.mjs';
 export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.B9sSOKE3.mjs';
-export { i as utils } from './shared/unjwt.df8yQ5_5.mjs';
+export { i as utils } from './shared/unjwt.Cay_cOOI.mjs';
 export { j as jwk } from './shared/unjwt.DtVML6Qp.mjs';

package/dist/index.mjs

@@ -1,5 +1,5 @@
-export { i as utils } from './shared/unjwt.Ce8yMcp_.mjs';
-export { j as jwe } from './shared/unjwt.DVMpKj8x.mjs';
-export { j as jwk } from './shared/unjwt.DuBBF25X.mjs';
-export { j as jws } from './shared/unjwt.D_JFPtpW.mjs';
-import './shared/unjwt.C_D0RMCp.mjs';
+export { i as utils } from './shared/unjwt.mBSKL6g4.mjs';
+export { j as jwe } from './shared/unjwt.UfthlTWt.mjs';
+export { j as jwk } from './shared/unjwt.CX8WRx20.mjs';
+export { j as jws } from './shared/unjwt.C6flzAeB.mjs';
+import './shared/unjwt.DFAKwqBz.mjs';

package/dist/jwe.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.DuBBF25X.mjs';
-import './shared/unjwt.Ce8yMcp_.mjs';
-export { d as decrypt, e as encrypt } from './shared/unjwt.DVMpKj8x.mjs';
-import './shared/unjwt.C_D0RMCp.mjs';
+import './shared/unjwt.CX8WRx20.mjs';
+import './shared/unjwt.mBSKL6g4.mjs';
+export { d as decrypt, e as encrypt } from './shared/unjwt.UfthlTWt.mjs';
+import './shared/unjwt.DFAKwqBz.mjs';

package/dist/jwk.mjs

@@ -1,2 +1,2 @@
-import './shared/unjwt.Ce8yMcp_.mjs';
-export { p as deriveKeyFromPassword, t as exportJWKToPEM, q as exportKey, o as generateKey, g as getJWKFromSet, s as importJWKFromPEM, i as importKey, m as unwrapKey, r as wrapKey } from './shared/unjwt.DuBBF25X.mjs';
+import './shared/unjwt.mBSKL6g4.mjs';
+export { p as deriveKeyFromPassword, t as exportJWKToPEM, q as exportKey, o as generateKey, g as getJWKFromSet, s as importJWKFromPEM, i as importKey, m as unwrapKey, r as wrapKey } from './shared/unjwt.CX8WRx20.mjs';

package/dist/jws.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.DuBBF25X.mjs';
-import './shared/unjwt.Ce8yMcp_.mjs';
-import './shared/unjwt.C_D0RMCp.mjs';
-export { s as sign, v as verify } from './shared/unjwt.D_JFPtpW.mjs';
+import './shared/unjwt.CX8WRx20.mjs';
+import './shared/unjwt.mBSKL6g4.mjs';
+import './shared/unjwt.DFAKwqBz.mjs';
+export { s as sign, v as verify } from './shared/unjwt.C6flzAeB.mjs';

package/dist/shared/{unjwt.D_JFPtpW.mjs → unjwt.C6flzAeB.mjs}

@@ -1,9 +1,12 @@
-import { i as importKey, g as getJWKFromSet } from './unjwt.DuBBF25X.mjs';
-import { a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, e as textDecoder, f as base64UrlDecode, g as isJWKSet, h as decodePayloadFromB64UrlSegment, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './unjwt.Ce8yMcp_.mjs';
-import { s as sign$1, v as verify$1 } from './unjwt.C_D0RMCp.mjs';
+import { i as importKey, g as getJWKFromSet } from './unjwt.CX8WRx20.mjs';
+import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, e as textDecoder, f as base64UrlDecode, g as isJWKSet, h as decodePayloadFromB64UrlSegment, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './unjwt.mBSKL6g4.mjs';
+import { s as sign$1, v as verify$1 } from './unjwt.DFAKwqBz.mjs';
 
 async function sign(payload, key, options = {}) {
   const { protectedHeader: additionalProtectedHeader } = options;
+  const safeAdditionalHeader = sanitizeObject(
+    additionalProtectedHeader
+  );
   let { alg } = options;
   if (!alg) {
     if (isJWK(key) && key.alg) {
@@ -15,11 +18,11 @@ async function sign(payload, key, options = {}) {
   validateKeyLength(key, alg);
   const signingKey = await importKey(key, alg);
   const protectedHeader = {
-    ...additionalProtectedHeader,
-    ...isJWK(key) && key.kid ? { kid: additionalProtectedHeader?.kid || key.kid } : {},
+    ...safeAdditionalHeader,
+    ...isJWK(key) && key.kid ? { kid: safeAdditionalHeader?.kid || key.kid } : {},
     // Include kid if available
     alg,
-    typ: additionalProtectedHeader?.typ
+    typ: safeAdditionalHeader?.typ
   };
   applyTypCtyDefaults(protectedHeader, payload);
   if (protectedHeader.b64 === true) {
@@ -64,7 +67,9 @@ async function verify(jws, key, options = {}) {
   let protectedHeader;
   try {
     const protectedHeaderString = base64UrlDecode(protectedHeaderEncoded);
-    protectedHeader = JSON.parse(protectedHeaderString);
+    protectedHeader = sanitizeObject(
+      JSON.parse(protectedHeaderString)
+    );
   } catch (error_) {
     throw new Error(
       `Invalid JWS: Protected header is not valid Base64URL or JSON (${error_ instanceof Error ? error_.message : error_})`

package/dist/shared/{unjwt.DuBBF25X.mjs → unjwt.CX8WRx20.mjs}

@@ -1,4 +1,4 @@
-import { m as isCryptoKey, k as concatUint8Arrays, d as base64UrlEncode, q as base64Decode, s as base64Encode, t as textEncoder, r as randomBytes, a as isJWK, f as base64UrlDecode, g as isJWKSet } from './unjwt.Ce8yMcp_.mjs';
+import { m as isCryptoKey, k as concatUint8Arrays, d as base64UrlEncode, q as base64Decode, u as base64Encode, s as sanitizeObject, t as textEncoder, r as randomBytes, a as isJWK, f as base64UrlDecode, g as isJWKSet } from './unjwt.mBSKL6g4.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -882,7 +882,7 @@ async function jwkTokey(jwk) {
     );
   }
   const { algorithm, keyUsages } = subtleMapping(jwk);
-  const keyData = { ...jwk };
+  const keyData = { ...sanitizeObject(jwk) };
   delete keyData.alg;
   delete keyData.use;
   return crypto.subtle.importKey(
@@ -1098,15 +1098,19 @@ async function importKey(key, alg) {
     return key;
   }
   if (isJWK(key)) {
-    if ("k" in key && typeof key.k === "string") {
-      return base64UrlDecode(key.k, false);
+    const safeJwk = sanitizeObject(key);
+    if ("k" in safeJwk && typeof safeJwk.k === "string") {
+      return base64UrlDecode(safeJwk.k, false);
     } else {
-      if (!key.alg && !alg) {
+      if (!safeJwk.alg && !alg) {
         throw new TypeError(
           "Algorithm must be provided when importing non-oct JWK"
         );
       }
-      return jwkTokey({ ...key, alg: key.alg || alg });
+      return jwkTokey({
+        ...safeJwk,
+        alg: safeJwk.alg || alg
+      });
     }
   }
   throw new Error("Invalid key type provided to importKey");
@@ -1114,7 +1118,7 @@ async function importKey(key, alg) {
 async function exportKey(key, jwk) {
   const exportedJwk = await keyToJWK(key);
   if (jwk) {
-    return { ...exportedJwk, ...jwk };
+    return { ...exportedJwk, ...sanitizeObject(jwk) };
   }
   return exportedJwk;
 }

package/dist/shared/{unjwt.df8yQ5_5.d.mts → unjwt.Cay_cOOI.d.mts}

@@ -50,6 +50,19 @@ declare function validateCriticalHeadersJWE(protectedHeader: {
     crit?: string[];
 } & Record<string, any>, understoodFromOptions?: string[]): void;
 
+/**
+ * Forked from unsecure@0.0.4
+ * Licensed under the MIT License.
+ *
+ * Source: https://github.com/sandros94/unsecure/blob/913ed5580c551153a19154b4916c67a8efb2be85/src/sanitize.ts
+ */
+/**
+ * Remove prototype-pollution vectors from a plain record in-place.
+ * This strips __proto__, prototype, and constructor own properties.
+ * Returns the same reference for convenience.
+ */
+declare function sanitizeObject<T extends Record<string, unknown> | undefined>(obj: T): T;
+
 declare const textEncoder: TextEncoder;
 declare const textDecoder: TextDecoder;
 declare function base64Encode(data: Uint8Array<ArrayBuffer> | string): string;
@@ -91,6 +104,7 @@ declare const index_isJWKSet: typeof isJWKSet;
 declare const index_isJsonContent: typeof isJsonContent;
 declare const index_maybeArray: typeof maybeArray;
 declare const index_randomBytes: typeof randomBytes;
+declare const index_sanitizeObject: typeof sanitizeObject;
 declare const index_textDecoder: typeof textDecoder;
 declare const index_textEncoder: typeof textEncoder;
 declare const index_validateCriticalHeadersJWE: typeof validateCriticalHeadersJWE;
@@ -117,6 +131,7 @@ declare namespace index {
     index_isJsonContent as isJsonContent,
     index_maybeArray as maybeArray,
     index_randomBytes as randomBytes,
+    index_sanitizeObject as sanitizeObject,
     index_textDecoder as textDecoder,
     index_textEncoder as textEncoder,
     index_validateCriticalHeadersJWE as validateCriticalHeadersJWE,
@@ -125,4 +140,4 @@ declare namespace index {
   };
 }
 
-export { textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, isJWKSet as h, index as i, assertCryptoKey as j, isCryptoKey as k, isCryptoKeyPair as l, maybeArray as m, applyTypCtyDefaults as n, isJsonContent as o, decodeMaybeJsonString as p, decodePayloadFromBytes as q, randomBytes as r, decodePayloadFromB64UrlSegment as s, textEncoder as t, getPlaintextBytes as u, computeJwtTimeClaims as v, validateJwtClaims as w, validateCriticalHeadersJWS as x, validateCriticalHeadersJWE as y };
+export { textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, isJWKSet as h, index as i, assertCryptoKey as j, isCryptoKey as k, isCryptoKeyPair as l, maybeArray as m, applyTypCtyDefaults as n, isJsonContent as o, decodeMaybeJsonString as p, decodePayloadFromBytes as q, randomBytes as r, decodePayloadFromB64UrlSegment as s, textEncoder as t, getPlaintextBytes as u, computeJwtTimeClaims as v, validateJwtClaims as w, validateCriticalHeadersJWS as x, validateCriticalHeadersJWE as y, sanitizeObject as z };

package/dist/shared/{unjwt.C_D0RMCp.mjs → unjwt.DFAKwqBz.mjs}

@@ -1,4 +1,4 @@
-import { c as checkSigCryptoKey } from './unjwt.DuBBF25X.mjs';
+import { c as checkSigCryptoKey } from './unjwt.CX8WRx20.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.

package/dist/shared/{unjwt.DVMpKj8x.mjs → unjwt.UfthlTWt.mjs}

@@ -1,6 +1,6 @@
-import { a as checkEncCryptoKey, u as uint32be, b as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, d as bitLengthCEK, f as jwkTokey, i as importKey, h as generateIV, l as encrypt$1, m as unwrapKey, n as decrypt$1 } from './unjwt.DuBBF25X.mjs';
-import { k as concatUint8Arrays, t as textEncoder, l as assertCryptoKey, d as base64UrlEncode, m as isCryptoKey, a as isJWK, f as base64UrlDecode, r as randomBytes, b as applyTypCtyDefaults, c as computeJwtTimeClaims, n as getPlaintextBytes, o as decodePayloadFromBytes, p as validateCriticalHeadersJWE } from './unjwt.Ce8yMcp_.mjs';
-import { c as checkKeyLength } from './unjwt.C_D0RMCp.mjs';
+import { a as checkEncCryptoKey, u as uint32be, b as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, d as bitLengthCEK, f as jwkTokey, i as importKey, h as generateIV, l as encrypt$1, m as unwrapKey, n as decrypt$1 } from './unjwt.CX8WRx20.mjs';
+import { k as concatUint8Arrays, t as textEncoder, l as assertCryptoKey, d as base64UrlEncode, m as isCryptoKey, a as isJWK, s as sanitizeObject, f as base64UrlDecode, r as randomBytes, b as applyTypCtyDefaults, c as computeJwtTimeClaims, n as getPlaintextBytes, o as decodePayloadFromBytes, p as validateCriticalHeadersJWE } from './unjwt.mBSKL6g4.mjs';
+import { c as checkKeyLength } from './unjwt.DFAKwqBz.mjs';
 
 function lengthAndInput(input) {
   return concatUint8Arrays(uint32be(input.length), input);
@@ -183,10 +183,11 @@ async function normalizeKey(key, alg) {
     return key;
   }
   if (isJWK(key)) {
-    if ("k" in key && key.k) {
-      return base64UrlDecode(key.k, false);
+    const safeJwk = sanitizeObject(key);
+    if ("k" in safeJwk && safeJwk.k) {
+      return base64UrlDecode(safeJwk.k, false);
     }
-    return jwkTokey({ ...key, alg });
+    return jwkTokey({ ...safeJwk, alg });
   }
   throw new Error("unreachable");
 }
@@ -245,12 +246,12 @@ async function encrypt(payload, key, options = {}) {
   const baseProtectedHeader = { ...additionalProtectedHeader };
   delete baseProtectedHeader.alg;
   delete baseProtectedHeader.enc;
-  const jweProtectedHeader = {
+  const jweProtectedHeader = sanitizeObject({
     ...baseProtectedHeader,
     ...keyManagementHeaderParams,
     alg,
     enc
-  };
+  });
   const protectedHeader = applyTypCtyDefaults(jweProtectedHeader, payload);
   const computedPayload = computeJwtTimeClaims(
     payload,
@@ -309,7 +310,9 @@ async function decrypt(jwe, key, options) {
   let protectedHeader;
   try {
     const protectedHeaderJson = base64UrlDecode(protectedHeaderEncoded);
-    protectedHeader = JSON.parse(protectedHeaderJson);
+    protectedHeader = sanitizeObject(
+      JSON.parse(protectedHeaderJson)
+    );
   } catch (error_) {
     throw new Error(
       `Invalid JWE: Protected header is not valid Base64URL or JSON (${error_ instanceof Error ? error_.message : error_})`

package/dist/shared/{unjwt.Ce8yMcp_.mjs → unjwt.mBSKL6g4.mjs}

@@ -20,7 +20,8 @@ function decodeMaybeJsonString(decodedString, header) {
     const looksLikeJson = decodedString.startsWith("{") && decodedString.endsWith("}") || decodedString.startsWith("[") && decodedString.endsWith("]");
     if (looksLikeJson) {
       try {
-        return JSON.parse(decodedString);
+        const obj = JSON.parse(decodedString);
+        return sanitizeObject(obj);
       } catch {
       }
     }
@@ -193,6 +194,55 @@ function validateCriticalHeadersJWE(protectedHeader, understoodFromOptions) {
   }
 }
 
+const DANGEROUS_KEYS = ["__proto__", "prototype", "constructor"];
+function sanitizeObject(obj) {
+  if (!obj || typeof obj !== "object") return obj;
+  const seen = /* @__PURE__ */ new WeakSet();
+  visit(obj, seen);
+  return obj;
+}
+function visit(current, seen) {
+  if (!current || typeof current !== "object") return;
+  if (seen.has(current)) return;
+  seen.add(current);
+  for (const key of DANGEROUS_KEYS) {
+    if (Object.prototype.hasOwnProperty.call(current, key)) {
+      try {
+        delete current[key];
+      } catch {
+      }
+      if (Object.prototype.hasOwnProperty.call(current, key)) {
+        try {
+          current[key] = void 0;
+          delete current[key];
+        } catch {
+        }
+      }
+      if (Object.prototype.hasOwnProperty.call(current, key)) {
+        try {
+          Object.defineProperty(current, key, {
+            value: void 0,
+            configurable: true,
+            enumerable: false,
+            writable: true
+          });
+          delete current[key];
+        } catch {
+        }
+      }
+    }
+  }
+  delete current["__proto__"];
+  delete current["prototype"];
+  delete current["constructor"];
+  if (Array.isArray(current)) {
+    for (const value of current) visit(value, seen);
+    return;
+  }
+  for (const k of Object.keys(current))
+    visit(current[k], seen);
+}
+
 const textEncoder = /* @__PURE__ */ new TextEncoder();
 const textDecoder = /* @__PURE__ */ new TextDecoder();
 function base64Encode(data) {
@@ -288,6 +338,7 @@ const index = {
   isJsonContent: isJsonContent,
   maybeArray: maybeArray,
   randomBytes: randomBytes,
+  sanitizeObject: sanitizeObject,
   textDecoder: textDecoder,
   textEncoder: textEncoder,
   validateCriticalHeadersJWE: validateCriticalHeadersJWE,
@@ -295,4 +346,4 @@ const index = {
   validateJwtClaims: validateJwtClaims
 };
 
-export { isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, textDecoder as e, base64UrlDecode as f, isJWKSet as g, decodePayloadFromB64UrlSegment as h, index as i, validateJwtClaims as j, concatUint8Arrays as k, assertCryptoKey as l, isCryptoKey as m, getPlaintextBytes as n, decodePayloadFromBytes as o, validateCriticalHeadersJWE as p, base64Decode as q, randomBytes as r, base64Encode as s, textEncoder as t, maybeArray as u, validateCriticalHeadersJWS as v, isCryptoKeyPair as w, isJsonContent as x, decodeMaybeJsonString as y };
+export { isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, textDecoder as e, base64UrlDecode as f, isJWKSet as g, decodePayloadFromB64UrlSegment as h, index as i, validateJwtClaims as j, concatUint8Arrays as k, assertCryptoKey as l, isCryptoKey as m, getPlaintextBytes as n, decodePayloadFromBytes as o, validateCriticalHeadersJWE as p, base64Decode as q, randomBytes as r, sanitizeObject as s, textEncoder as t, base64Encode as u, validateCriticalHeadersJWS as v, maybeArray as w, isCryptoKeyPair as x, isJsonContent as y, decodeMaybeJsonString as z };

package/dist/utils.d.mts

@@ -1,2 +1,2 @@
 import './shared/unjwt.CN1C8TlR.mjs';
-export { n as applyTypCtyDefaults, j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, v as computeJwtTimeClaims, f as concatUint8Arrays, p as decodeMaybeJsonString, s as decodePayloadFromB64UrlSegment, q as decodePayloadFromBytes, u as getPlaintextBytes, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, o as isJsonContent, m as maybeArray, r as randomBytes, a as textDecoder, t as textEncoder, y as validateCriticalHeadersJWE, x as validateCriticalHeadersJWS, w as validateJwtClaims } from './shared/unjwt.df8yQ5_5.mjs';
+export { n as applyTypCtyDefaults, j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, v as computeJwtTimeClaims, f as concatUint8Arrays, p as decodeMaybeJsonString, s as decodePayloadFromB64UrlSegment, q as decodePayloadFromBytes, u as getPlaintextBytes, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, o as isJsonContent, m as maybeArray, r as randomBytes, z as sanitizeObject, a as textDecoder, t as textEncoder, y as validateCriticalHeadersJWE, x as validateCriticalHeadersJWS, w as validateJwtClaims } from './shared/unjwt.Cay_cOOI.mjs';

package/dist/utils.mjs

@@ -1 +1 @@
-export { b as applyTypCtyDefaults, l as assertCryptoKey, q as base64Decode, s as base64Encode, f as base64UrlDecode, d as base64UrlEncode, c as computeJwtTimeClaims, k as concatUint8Arrays, y as decodeMaybeJsonString, h as decodePayloadFromB64UrlSegment, o as decodePayloadFromBytes, n as getPlaintextBytes, m as isCryptoKey, w as isCryptoKeyPair, a as isJWK, g as isJWKSet, x as isJsonContent, u as maybeArray, r as randomBytes, e as textDecoder, t as textEncoder, p as validateCriticalHeadersJWE, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './shared/unjwt.Ce8yMcp_.mjs';
+export { b as applyTypCtyDefaults, l as assertCryptoKey, q as base64Decode, u as base64Encode, f as base64UrlDecode, d as base64UrlEncode, c as computeJwtTimeClaims, k as concatUint8Arrays, z as decodeMaybeJsonString, h as decodePayloadFromB64UrlSegment, o as decodePayloadFromBytes, n as getPlaintextBytes, m as isCryptoKey, x as isCryptoKeyPair, a as isJWK, g as isJWKSet, y as isJsonContent, w as maybeArray, r as randomBytes, s as sanitizeObject, e as textDecoder, t as textEncoder, p as validateCriticalHeadersJWE, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './shared/unjwt.mBSKL6g4.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.12",
+  "version": "0.5.13",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",