unjwt 0.5.12 → 0.5.14

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, L as JWT, M as JWTClaimValidationOptions, I as JWTClaims, H as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CN1C8TlR.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.BRtnm5sB.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.B9sSOKE3.mjs';
-export { i as utils } from './shared/unjwt.df8yQ5_5.mjs';
-export { j as jwk } from './shared/unjwt.DtVML6Qp.mjs';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, r as JWK, M as JWKAlgorithm, N as JWKPEMAlgorithm, J as JWKParameters, s as JWKSet, A as JWK_AES_CBC_HMAC, B as JWK_AES_GCM, z as JWK_AES_GCM_KW, y as JWK_AES_KW, L as JWK_Asymmetric_Algorithm, h as JWK_EC, F as JWK_ECDH_ES, w as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, t as JWK_HMAC, n as JWK_OKP, m as JWK_OKP_Private, l as JWK_OKP_Public, H as JWK_OKP_SIGN, E as JWK_PBES2, q as JWK_Private, p as JWK_Public, k as JWK_RSA, x as JWK_RSA_ENC, v as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, u as JWK_RSA_SIGN, I as JWK_Symmetric_Algorithm, o as JWK_oct, Q as JWT, R as JWTClaimValidationOptions, P as JWTClaims, O as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.BsgIQHVD.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.qWts1U9J.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.Cf7vmOhS.mjs';
+export { i as utils } from './shared/unjwt.BYaxDvLV.mjs';
+export { j as jwk } from './shared/unjwt.C6b_GyXm.mjs';

package/dist/index.mjs

@@ -1,5 +1,5 @@
-export { i as utils } from './shared/unjwt.Ce8yMcp_.mjs';
-export { j as jwe } from './shared/unjwt.DVMpKj8x.mjs';
-export { j as jwk } from './shared/unjwt.DuBBF25X.mjs';
-export { j as jws } from './shared/unjwt.D_JFPtpW.mjs';
-import './shared/unjwt.C_D0RMCp.mjs';
+export { i as utils } from './shared/unjwt.BEjwP_9W.mjs';
+export { j as jwe } from './shared/unjwt.B8wnSUll.mjs';
+export { j as jwk } from './shared/unjwt.BVlHlXdP.mjs';
+export { j as jws } from './shared/unjwt.skuKf53c.mjs';
+import './shared/unjwt.BaB7HUR1.mjs';

package/dist/jwe.d.mts

@@ -1,2 +1,2 @@
-export { L as JWT, M as JWTClaimValidationOptions, I as JWTClaims, H as JoseHeaderParameters } from './shared/unjwt.CN1C8TlR.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.B9sSOKE3.mjs';
+export { Q as JWT, R as JWTClaimValidationOptions, P as JWTClaims, O as JoseHeaderParameters } from './shared/unjwt.BsgIQHVD.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.Cf7vmOhS.mjs';

package/dist/jwe.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.DuBBF25X.mjs';
-import './shared/unjwt.Ce8yMcp_.mjs';
-export { d as decrypt, e as encrypt } from './shared/unjwt.DVMpKj8x.mjs';
-import './shared/unjwt.C_D0RMCp.mjs';
+import './shared/unjwt.BVlHlXdP.mjs';
+import './shared/unjwt.BEjwP_9W.mjs';
+export { d as decrypt, e as encrypt } from './shared/unjwt.B8wnSUll.mjs';
+import './shared/unjwt.BaB7HUR1.mjs';

package/dist/jwk.d.mts

@@ -1,2 +1,2 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, L as JWT, M as JWTClaimValidationOptions, I as JWTClaims, H as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CN1C8TlR.mjs';
-export { d as deriveKeyFromPassword, b as exportJWKToPEM, e as exportKey, g as generateKey, c as getJWKFromSet, a as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.DtVML6Qp.mjs';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, r as JWK, M as JWKAlgorithm, N as JWKPEMAlgorithm, J as JWKParameters, s as JWKSet, A as JWK_AES_CBC_HMAC, B as JWK_AES_GCM, z as JWK_AES_GCM_KW, y as JWK_AES_KW, L as JWK_Asymmetric_Algorithm, h as JWK_EC, F as JWK_ECDH_ES, w as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, t as JWK_HMAC, n as JWK_OKP, m as JWK_OKP_Private, l as JWK_OKP_Public, H as JWK_OKP_SIGN, E as JWK_PBES2, q as JWK_Private, p as JWK_Public, k as JWK_RSA, x as JWK_RSA_ENC, v as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, u as JWK_RSA_SIGN, I as JWK_Symmetric_Algorithm, o as JWK_oct, Q as JWT, R as JWTClaimValidationOptions, P as JWTClaims, O as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.BsgIQHVD.mjs';
+export { d as deriveKeyFromPassword, b as exportJWKToPEM, e as exportKey, g as generateKey, c as getJWKFromSet, a as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.C6b_GyXm.mjs';

package/dist/jwk.mjs

@@ -1,2 +1,2 @@
-import './shared/unjwt.Ce8yMcp_.mjs';
-export { p as deriveKeyFromPassword, t as exportJWKToPEM, q as exportKey, o as generateKey, g as getJWKFromSet, s as importJWKFromPEM, i as importKey, m as unwrapKey, r as wrapKey } from './shared/unjwt.DuBBF25X.mjs';
+import './shared/unjwt.BEjwP_9W.mjs';
+export { p as deriveKeyFromPassword, t as exportJWKToPEM, q as exportKey, o as generateKey, g as getJWKFromSet, s as importJWKFromPEM, i as importKey, m as unwrapKey, r as wrapKey } from './shared/unjwt.BVlHlXdP.mjs';

package/dist/jws.d.mts

@@ -1,2 +1,2 @@
-export { L as JWT, M as JWTClaimValidationOptions, I as JWTClaims, H as JoseHeaderParameters } from './shared/unjwt.CN1C8TlR.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.BRtnm5sB.mjs';
+export { Q as JWT, R as JWTClaimValidationOptions, P as JWTClaims, O as JoseHeaderParameters } from './shared/unjwt.BsgIQHVD.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.qWts1U9J.mjs';

package/dist/jws.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.DuBBF25X.mjs';
-import './shared/unjwt.Ce8yMcp_.mjs';
-import './shared/unjwt.C_D0RMCp.mjs';
-export { s as sign, v as verify } from './shared/unjwt.D_JFPtpW.mjs';
+import './shared/unjwt.BVlHlXdP.mjs';
+import './shared/unjwt.BEjwP_9W.mjs';
+import './shared/unjwt.BaB7HUR1.mjs';
+export { s as sign, v as verify } from './shared/unjwt.skuKf53c.mjs';

package/dist/shared/{unjwt.DVMpKj8x.mjs → unjwt.B8wnSUll.mjs}

@@ -1,6 +1,6 @@
-import { a as checkEncCryptoKey, u as uint32be, b as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, d as bitLengthCEK, f as jwkTokey, i as importKey, h as generateIV, l as encrypt$1, m as unwrapKey, n as decrypt$1 } from './unjwt.DuBBF25X.mjs';
-import { k as concatUint8Arrays, t as textEncoder, l as assertCryptoKey, d as base64UrlEncode, m as isCryptoKey, a as isJWK, f as base64UrlDecode, r as randomBytes, b as applyTypCtyDefaults, c as computeJwtTimeClaims, n as getPlaintextBytes, o as decodePayloadFromBytes, p as validateCriticalHeadersJWE } from './unjwt.Ce8yMcp_.mjs';
-import { c as checkKeyLength } from './unjwt.C_D0RMCp.mjs';
+import { a as checkEncCryptoKey, u as uint32be, b as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, d as bitLengthCEK, f as jwkTokey, i as importKey, h as generateIV, l as encrypt$1, m as unwrapKey, n as decrypt$1 } from './unjwt.BVlHlXdP.mjs';
+import { k as concatUint8Arrays, t as textEncoder, l as assertCryptoKey, d as base64UrlEncode, m as isCryptoKey, a as isJWK, s as sanitizeObject, f as base64UrlDecode, r as randomBytes, b as applyTypCtyDefaults, c as computeJwtTimeClaims, n as getPlaintextBytes, o as decodePayloadFromBytes, p as validateCriticalHeadersJWE } from './unjwt.BEjwP_9W.mjs';
+import { c as checkKeyLength } from './unjwt.BaB7HUR1.mjs';
 
 function lengthAndInput(input) {
   return concatUint8Arrays(uint32be(input.length), input);
@@ -183,10 +183,11 @@ async function normalizeKey(key, alg) {
     return key;
   }
   if (isJWK(key)) {
-    if ("k" in key && key.k) {
-      return base64UrlDecode(key.k, false);
+    const safeJwk = sanitizeObject(key);
+    if ("k" in safeJwk && safeJwk.k) {
+      return base64UrlDecode(safeJwk.k, false);
     }
-    return jwkTokey({ ...key, alg });
+    return jwkTokey({ ...safeJwk, alg });
   }
   throw new Error("unreachable");
 }
@@ -245,12 +246,12 @@ async function encrypt(payload, key, options = {}) {
   const baseProtectedHeader = { ...additionalProtectedHeader };
   delete baseProtectedHeader.alg;
   delete baseProtectedHeader.enc;
-  const jweProtectedHeader = {
+  const jweProtectedHeader = sanitizeObject({
     ...baseProtectedHeader,
     ...keyManagementHeaderParams,
     alg,
     enc
-  };
+  });
   const protectedHeader = applyTypCtyDefaults(jweProtectedHeader, payload);
   const computedPayload = computeJwtTimeClaims(
     payload,
@@ -309,7 +310,9 @@ async function decrypt(jwe, key, options) {
   let protectedHeader;
   try {
     const protectedHeaderJson = base64UrlDecode(protectedHeaderEncoded);
-    protectedHeader = JSON.parse(protectedHeaderJson);
+    protectedHeader = sanitizeObject(
+      JSON.parse(protectedHeaderJson)
+    );
   } catch (error_) {
     throw new Error(
       `Invalid JWE: Protected header is not valid Base64URL or JSON (${error_ instanceof Error ? error_.message : error_})`

package/dist/shared/{unjwt.Ce8yMcp_.mjs → unjwt.BEjwP_9W.mjs}

@@ -20,7 +20,8 @@ function decodeMaybeJsonString(decodedString, header) {
     const looksLikeJson = decodedString.startsWith("{") && decodedString.endsWith("}") || decodedString.startsWith("[") && decodedString.endsWith("]");
     if (looksLikeJson) {
       try {
-        return JSON.parse(decodedString);
+        const obj = JSON.parse(decodedString);
+        return sanitizeObject(obj);
       } catch {
       }
     }
@@ -193,6 +194,55 @@ function validateCriticalHeadersJWE(protectedHeader, understoodFromOptions) {
   }
 }
 
+const DANGEROUS_KEYS = ["__proto__", "prototype", "constructor"];
+function sanitizeObject(obj) {
+  if (!obj || typeof obj !== "object") return obj;
+  const seen = /* @__PURE__ */ new WeakSet();
+  visit(obj, seen);
+  return obj;
+}
+function visit(current, seen) {
+  if (!current || typeof current !== "object") return;
+  if (seen.has(current)) return;
+  seen.add(current);
+  for (const key of DANGEROUS_KEYS) {
+    if (Object.prototype.hasOwnProperty.call(current, key)) {
+      try {
+        delete current[key];
+      } catch {
+      }
+      if (Object.prototype.hasOwnProperty.call(current, key)) {
+        try {
+          current[key] = void 0;
+          delete current[key];
+        } catch {
+        }
+      }
+      if (Object.prototype.hasOwnProperty.call(current, key)) {
+        try {
+          Object.defineProperty(current, key, {
+            value: void 0,
+            configurable: true,
+            enumerable: false,
+            writable: true
+          });
+          delete current[key];
+        } catch {
+        }
+      }
+    }
+  }
+  delete current["__proto__"];
+  delete current["prototype"];
+  delete current["constructor"];
+  if (Array.isArray(current)) {
+    for (const value of current) visit(value, seen);
+    return;
+  }
+  for (const k of Object.keys(current))
+    visit(current[k], seen);
+}
+
 const textEncoder = /* @__PURE__ */ new TextEncoder();
 const textDecoder = /* @__PURE__ */ new TextDecoder();
 function base64Encode(data) {
@@ -266,6 +316,41 @@ function isCryptoKey(key) {
   return key?.[Symbol.toStringTag] === "CryptoKey";
 }
 const isCryptoKeyPair = (key) => key && typeof key === "object" && isCryptoKey(key.publicKey) && isCryptoKey(key.privateKey);
+function isSymmetricJWK(key) {
+  return isJWK(key) && key.kty === "oct" && typeof key.k === "string";
+}
+function isAsymmetricJWK(key) {
+  return !isSymmetricJWK(key);
+}
+function isPrivateJWK(key) {
+  if (!isJWK(key)) return false;
+  if (key.kty === "EC") {
+    return typeof key.d === "string";
+  }
+  if (key.kty === "OKP") {
+    return typeof key.d === "string";
+  }
+  if (key.kty === "RSA") {
+    return typeof key.d === "string";
+  }
+  return false;
+}
+function isPublicJWK(key) {
+  if (!isJWK(key)) return false;
+  if (key.kty === "EC") {
+    const ec = key;
+    return typeof ec.x === "string" && typeof ec.y === "string" && typeof ec.d !== "string";
+  }
+  if (key.kty === "OKP") {
+    const okp = key;
+    return typeof okp.x === "string" && typeof okp.d !== "string";
+  }
+  if (key.kty === "RSA") {
+    const rsa = key;
+    return typeof rsa.n === "string" && typeof rsa.e === "string" && typeof rsa.d !== "string";
+  }
+  return false;
+}
 
 const index = {
   __proto__: null,
@@ -281,13 +366,18 @@ const index = {
   decodePayloadFromB64UrlSegment: decodePayloadFromB64UrlSegment,
   decodePayloadFromBytes: decodePayloadFromBytes,
   getPlaintextBytes: getPlaintextBytes,
+  isAsymmetricJWK: isAsymmetricJWK,
   isCryptoKey: isCryptoKey,
   isCryptoKeyPair: isCryptoKeyPair,
   isJWK: isJWK,
   isJWKSet: isJWKSet,
   isJsonContent: isJsonContent,
+  isPrivateJWK: isPrivateJWK,
+  isPublicJWK: isPublicJWK,
+  isSymmetricJWK: isSymmetricJWK,
   maybeArray: maybeArray,
   randomBytes: randomBytes,
+  sanitizeObject: sanitizeObject,
   textDecoder: textDecoder,
   textEncoder: textEncoder,
   validateCriticalHeadersJWE: validateCriticalHeadersJWE,
@@ -295,4 +385,4 @@ const index = {
   validateJwtClaims: validateJwtClaims
 };
 
-export { isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, textDecoder as e, base64UrlDecode as f, isJWKSet as g, decodePayloadFromB64UrlSegment as h, index as i, validateJwtClaims as j, concatUint8Arrays as k, assertCryptoKey as l, isCryptoKey as m, getPlaintextBytes as n, decodePayloadFromBytes as o, validateCriticalHeadersJWE as p, base64Decode as q, randomBytes as r, base64Encode as s, textEncoder as t, maybeArray as u, validateCriticalHeadersJWS as v, isCryptoKeyPair as w, isJsonContent as x, decodeMaybeJsonString as y };
+export { isPrivateJWK as A, isPublicJWK as B, isJsonContent as C, decodeMaybeJsonString as D, isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, textDecoder as e, base64UrlDecode as f, isJWKSet as g, decodePayloadFromB64UrlSegment as h, index as i, validateJwtClaims as j, concatUint8Arrays as k, assertCryptoKey as l, isCryptoKey as m, getPlaintextBytes as n, decodePayloadFromBytes as o, validateCriticalHeadersJWE as p, base64Decode as q, randomBytes as r, sanitizeObject as s, textEncoder as t, base64Encode as u, validateCriticalHeadersJWS as v, maybeArray as w, isCryptoKeyPair as x, isSymmetricJWK as y, isAsymmetricJWK as z };

package/dist/shared/{unjwt.DuBBF25X.mjs → unjwt.BVlHlXdP.mjs}

@@ -1,4 +1,4 @@
-import { m as isCryptoKey, k as concatUint8Arrays, d as base64UrlEncode, q as base64Decode, s as base64Encode, t as textEncoder, r as randomBytes, a as isJWK, f as base64UrlDecode, g as isJWKSet } from './unjwt.Ce8yMcp_.mjs';
+import { m as isCryptoKey, k as concatUint8Arrays, d as base64UrlEncode, q as base64Decode, u as base64Encode, s as sanitizeObject, t as textEncoder, r as randomBytes, a as isJWK, f as base64UrlDecode, g as isJWKSet } from './unjwt.BEjwP_9W.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -830,7 +830,10 @@ function subtleMapping(jwk) {
         case "ECDH-ES+A128KW":
         case "ECDH-ES+A192KW":
         case "ECDH-ES+A256KW": {
-          algorithm = { name: "ECDH", namedCurve: jwk.crv };
+          algorithm = {
+            name: "ECDH",
+            namedCurve: jwk.crv
+          };
           keyUsages = jwk.d ? ["deriveBits"] : [];
           break;
         }
@@ -882,7 +885,7 @@ async function jwkTokey(jwk) {
     );
   }
   const { algorithm, keyUsages } = subtleMapping(jwk);
-  const keyData = { ...jwk };
+  const keyData = { ...sanitizeObject(jwk) };
   delete keyData.alg;
   delete keyData.use;
   return crypto.subtle.importKey(
@@ -1024,7 +1027,7 @@ async function _unwrap(alg, key, encryptedKey) {
 }
 
 async function generateKey(alg, options = {}) {
-  const exportToJWK = options.toJWK === true;
+  const exportToJWK = options.toJWK !== void 0 && options.toJWK !== false;
   const defaultExtractable = options.extractable !== false;
   if (alg === "A128CBC-HS256" || alg === "A192CBC-HS384" || alg === "A256CBC-HS512") {
     const keyLength = bitLengthCEK(alg);
@@ -1041,12 +1044,19 @@ async function generateKey(alg, options = {}) {
     keyUsages
   );
   if (exportToJWK) {
+    const {
+      alg: _a,
+      kty: _k,
+      key_ops: _ko,
+      ext: _e,
+      ...additionalKeyParams
+    } = typeof options.toJWK === "object" ? options.toJWK : {};
     if (key instanceof CryptoKey) {
-      return exportKey(key, { alg });
+      return exportKey(key, { ...additionalKeyParams, alg });
     } else {
       const [publicKey, privateKey] = await Promise.all([
-        exportKey(key.publicKey, { alg }),
-        exportKey(key.privateKey, { alg })
+        exportKey(key.publicKey, { ...additionalKeyParams, alg }),
+        exportKey(key.privateKey, { ...additionalKeyParams, alg })
       ]);
       return { privateKey, publicKey };
     }
@@ -1098,15 +1108,19 @@ async function importKey(key, alg) {
     return key;
   }
   if (isJWK(key)) {
-    if ("k" in key && typeof key.k === "string") {
-      return base64UrlDecode(key.k, false);
+    const safeJwk = sanitizeObject(key);
+    if ("k" in safeJwk && typeof safeJwk.k === "string") {
+      return base64UrlDecode(safeJwk.k, false);
     } else {
-      if (!key.alg && !alg) {
+      if (!safeJwk.alg && !alg) {
         throw new TypeError(
           "Algorithm must be provided when importing non-oct JWK"
         );
       }
-      return jwkTokey({ ...key, alg: key.alg || alg });
+      return jwkTokey({
+        ...safeJwk,
+        alg: safeJwk.alg || alg
+      });
     }
   }
   throw new Error("Invalid key type provided to importKey");
@@ -1114,7 +1128,7 @@ async function importKey(key, alg) {
 async function exportKey(key, jwk) {
   const exportedJwk = await keyToJWK(key);
   if (jwk) {
-    return { ...exportedJwk, ...jwk };
+    return { ...sanitizeObject(jwk), ...exportedJwk };
   }
   return exportedJwk;
 }

package/dist/shared/{unjwt.df8yQ5_5.d.mts → unjwt.BYaxDvLV.d.mts}

@@ -1,4 +1,4 @@
-import { I as JWTClaims, M as JWTClaimValidationOptions, m as JWK, n as JWKSet } from './unjwt.CN1C8TlR.mjs';
+import { P as JWTClaims, R as JWTClaimValidationOptions, r as JWK, s as JWKSet, o as JWK_oct, q as JWK_Private, p as JWK_Public } from './unjwt.BsgIQHVD.mjs';
 
 /**
  * Apply default typ/cty semantics shared by JWS & JWE.
@@ -50,6 +50,19 @@ declare function validateCriticalHeadersJWE(protectedHeader: {
     crit?: string[];
 } & Record<string, any>, understoodFromOptions?: string[]): void;
 
+/**
+ * Forked from unsecure@0.0.4
+ * Licensed under the MIT License.
+ *
+ * Source: https://github.com/sandros94/unsecure/blob/913ed5580c551153a19154b4916c67a8efb2be85/src/sanitize.ts
+ */
+/**
+ * Remove prototype-pollution vectors from a plain record in-place.
+ * This strips __proto__, prototype, and constructor own properties.
+ * Returns the same reference for convenience.
+ */
+declare function sanitizeObject<T extends Record<string, unknown> | undefined>(obj: T): T;
+
 declare const textEncoder: TextEncoder;
 declare const textDecoder: TextDecoder;
 declare function base64Encode(data: Uint8Array<ArrayBuffer> | string): string;
@@ -71,6 +84,20 @@ declare function isJWKSet(key: any): key is JWKSet;
 declare function assertCryptoKey(key: unknown): asserts key is CryptoKey;
 declare function isCryptoKey(key: unknown): key is CryptoKey;
 declare const isCryptoKeyPair: (key: any) => key is CryptoKeyPair;
+/** Returns true if the JWK is a symmetric (oct) key. */
+declare function isSymmetricJWK(key: unknown): key is JWK_oct;
+/** Returns true if the JWK is an asymmetric (RSA, EC, OKP) key. */
+declare function isAsymmetricJWK(key: unknown): key is JWK_oct;
+/**
+ * Type guard that checks if the provided JWK contains private key material.
+ * It relies purely on the presence of private components (e.g. "d"), not on the alg value.
+ */
+declare function isPrivateJWK(key: unknown): key is JWK_Private;
+/**
+ * Type guard that checks if the provided JWK is a public (asymmetric) key.
+ * This checks for the presence of public components and absence of private material.
+ */
+declare function isPublicJWK(key: unknown): key is JWK_Public;
 
 declare const index_applyTypCtyDefaults: typeof applyTypCtyDefaults;
 declare const index_assertCryptoKey: typeof assertCryptoKey;
@@ -84,13 +111,18 @@ declare const index_decodeMaybeJsonString: typeof decodeMaybeJsonString;
 declare const index_decodePayloadFromB64UrlSegment: typeof decodePayloadFromB64UrlSegment;
 declare const index_decodePayloadFromBytes: typeof decodePayloadFromBytes;
 declare const index_getPlaintextBytes: typeof getPlaintextBytes;
+declare const index_isAsymmetricJWK: typeof isAsymmetricJWK;
 declare const index_isCryptoKey: typeof isCryptoKey;
 declare const index_isCryptoKeyPair: typeof isCryptoKeyPair;
 declare const index_isJWK: typeof isJWK;
 declare const index_isJWKSet: typeof isJWKSet;
 declare const index_isJsonContent: typeof isJsonContent;
+declare const index_isPrivateJWK: typeof isPrivateJWK;
+declare const index_isPublicJWK: typeof isPublicJWK;
+declare const index_isSymmetricJWK: typeof isSymmetricJWK;
 declare const index_maybeArray: typeof maybeArray;
 declare const index_randomBytes: typeof randomBytes;
+declare const index_sanitizeObject: typeof sanitizeObject;
 declare const index_textDecoder: typeof textDecoder;
 declare const index_textEncoder: typeof textEncoder;
 declare const index_validateCriticalHeadersJWE: typeof validateCriticalHeadersJWE;
@@ -110,13 +142,18 @@ declare namespace index {
     index_decodePayloadFromB64UrlSegment as decodePayloadFromB64UrlSegment,
     index_decodePayloadFromBytes as decodePayloadFromBytes,
     index_getPlaintextBytes as getPlaintextBytes,
+    index_isAsymmetricJWK as isAsymmetricJWK,
     index_isCryptoKey as isCryptoKey,
     index_isCryptoKeyPair as isCryptoKeyPair,
     index_isJWK as isJWK,
     index_isJWKSet as isJWKSet,
     index_isJsonContent as isJsonContent,
+    index_isPrivateJWK as isPrivateJWK,
+    index_isPublicJWK as isPublicJWK,
+    index_isSymmetricJWK as isSymmetricJWK,
     index_maybeArray as maybeArray,
     index_randomBytes as randomBytes,
+    index_sanitizeObject as sanitizeObject,
     index_textDecoder as textDecoder,
     index_textEncoder as textEncoder,
     index_validateCriticalHeadersJWE as validateCriticalHeadersJWE,
@@ -125,4 +162,4 @@ declare namespace index {
   };
 }
 
-export { textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, isJWKSet as h, index as i, assertCryptoKey as j, isCryptoKey as k, isCryptoKeyPair as l, maybeArray as m, applyTypCtyDefaults as n, isJsonContent as o, decodeMaybeJsonString as p, decodePayloadFromBytes as q, randomBytes as r, decodePayloadFromB64UrlSegment as s, textEncoder as t, getPlaintextBytes as u, computeJwtTimeClaims as v, validateJwtClaims as w, validateCriticalHeadersJWS as x, validateCriticalHeadersJWE as y };
+export { validateJwtClaims as A, validateCriticalHeadersJWS as B, validateCriticalHeadersJWE as C, sanitizeObject as D, textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, isJWKSet as h, index as i, assertCryptoKey as j, isCryptoKey as k, isCryptoKeyPair as l, maybeArray as m, isSymmetricJWK as n, isAsymmetricJWK as o, isPrivateJWK as p, isPublicJWK as q, randomBytes as r, applyTypCtyDefaults as s, textEncoder as t, isJsonContent as u, decodeMaybeJsonString as v, decodePayloadFromBytes as w, decodePayloadFromB64UrlSegment as x, getPlaintextBytes as y, computeJwtTimeClaims as z };

package/dist/shared/{unjwt.C_D0RMCp.mjs → unjwt.BaB7HUR1.mjs}

@@ -1,4 +1,4 @@
-import { c as checkSigCryptoKey } from './unjwt.DuBBF25X.mjs';
+import { c as checkSigCryptoKey } from './unjwt.BVlHlXdP.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.

package/dist/shared/{unjwt.CN1C8TlR.d.mts → unjwt.BsgIQHVD.d.mts}

@@ -17,14 +17,14 @@ interface GenerateKeyOptions {
     /** RSA public exponent. Defaults to 65537 (0x010001). */
     publicExponent?: Uint8Array<ArrayBuffer>;
     /** Export the generated key(s) as JWK. If true, the key(s) will be returned in JWK format. */
-    toJWK?: boolean | undefined;
+    toJWK?: undefined | boolean | Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">;
 }
 type GenerateKeyReturnJWK<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_Asymmetric_Algorithm ? {
     privateKey: JWK;
     publicKey: JWK;
 } : JWK;
 type GenerateKeyReturnCrypto<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_AES_CBC_HMAC ? Uint8Array<ArrayBuffer> : TAlg extends JWK_Asymmetric_Algorithm ? CryptoKeyPair : CryptoKey;
-type GenerateKeyReturn<TAlg extends GenerateKeyAlgorithm, TOptions extends GenerateKeyOptions> = TOptions["toJWK"] extends true ? GenerateKeyReturnJWK<TAlg> : GenerateKeyReturnCrypto<TAlg>;
+type GenerateKeyReturn<TAlg extends GenerateKeyAlgorithm, TOptions extends GenerateKeyOptions> = TOptions["toJWK"] extends true ? GenerateKeyReturnJWK<TAlg> : TOptions["toJWK"] extends object ? GenerateKeyReturnJWK<TAlg> : GenerateKeyReturnCrypto<TAlg>;
 /** Options for the deriveKeyFromPassword function. */
 interface DeriveKeyOptions {
     /** Salt value (p2s). Must be at least 8 bytes. */
@@ -133,6 +133,8 @@ interface JWKParameters {
 }
 /** Public EC JSON Web Keys */
 interface JWK_EC_Public extends JWKParameters {
+    /** EC JWK "kty" (Key Type) Parameter */
+    kty: "EC";
     /** EC JWK "crv" (Curve) Parameter */
     crv: string;
     /** EC JWK "x" (X Coordinate) Parameter */
@@ -141,7 +143,7 @@ interface JWK_EC_Public extends JWKParameters {
     y: string;
 }
 /** Private EC JSON Web Keys */
-interface JWK_EC_Private extends JWK_EC_Public, JWKParameters {
+interface JWK_EC_Private extends JWK_EC_Public {
     /** EC JWK "d" (ECC Private Key) Parameter */
     d: string;
 }
@@ -149,6 +151,8 @@ interface JWK_EC_Private extends JWK_EC_Public, JWKParameters {
 type JWK_EC = JWK_EC_Public | JWK_EC_Private;
 /** Public RSA JSON Web Keys */
 interface JWK_RSA_Public extends JWKParameters {
+    /** RSA JWK "kty" (Key Type) Parameter */
+    kty: "RSA";
     /** RSA JWK "e" (Exponent) Parameter */
     e: string;
     /** RSA JWK "n" (Modulus) Parameter */
@@ -156,7 +160,7 @@ interface JWK_RSA_Public extends JWKParameters {
     oth?: RsaOtherPrimesInfo[];
 }
 /** Private RSA JSON Web Keys */
-interface JWK_RSA_Private extends JWK_RSA_Public, JWKParameters {
+interface JWK_RSA_Private extends JWK_RSA_Public {
     /** RSA JWK "d" (Private Exponent) Parameter */
     d: string;
     /** RSA JWK "dp" (First Factor CRT Exponent) Parameter */
@@ -172,15 +176,35 @@ interface JWK_RSA_Private extends JWK_RSA_Public, JWKParameters {
 }
 /** RSA JSON Web Keys */
 type JWK_RSA = JWK_RSA_Public | JWK_RSA_Private;
+/** Public ED JSON Web Keys */
+interface JWK_OKP_Public extends JWKParameters {
+    /** ED JWK "kty" (Key Type) Parameter */
+    kty: "OKP";
+    /** ED JWK "crv" (Curve) Parameter */
+    crv: string;
+    /** ED JWK "x" (X Coordinate) Parameter */
+    x: string;
+}
+/** Private ED JSON Web Keys */
+interface JWK_OKP_Private extends JWK_OKP_Public {
+    /** ED JWK "d" (Private Key) Parameter */
+    d: string;
+}
+/** OKP JSON Web Keys */
+type JWK_OKP = JWK_OKP_Public | JWK_OKP_Private;
 /** oct JSON Web Keys */
 interface JWK_oct extends JWKParameters {
     /** Oct JWK "k" (Key Value) Parameter */
     k: string;
 }
+/** Public JSON Web Keys */
+type JWK_Public = JWK_RSA_Public | JWK_EC_Public | JWK_OKP_Public | JWK_oct;
+/** Private JSON Web Keys */
+type JWK_Private = JWK_RSA_Private | JWK_EC_Private | JWK_OKP_Private;
 /**
- * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC" and "oct" key types are supported.
+ * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC", "OKP" and "oct" key types are supported.
  */
-type JWK = JWK_oct | JWK_RSA | JWK_EC;
+type JWK = JWK_oct | JWK_RSA | JWK_EC | JWK_OKP;
 /**
  * JSON Web Key Set ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK Set}). "RSA", "EC" and "oct" key types are supported.
  */
@@ -201,11 +225,11 @@ type JWK_AES_CBC_HMAC = "A128CBC-HS256" | "A192CBC-HS384" | "A256CBC-HS512";
 type JWK_AES_GCM = "A128GCM" | "A192GCM" | "A256GCM";
 type JWK_PBES2 = "PBES2-HS256+A128KW" | "PBES2-HS384+A192KW" | "PBES2-HS512+A256KW";
 type JWK_ECDH_ES = "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A192KW" | "ECDH-ES+A256KW";
-type JWK_ED = "Ed25519" | "EdDSA";
+type JWK_OKP_SIGN = "Ed25519" | "EdDSA";
 type JWK_Symmetric_Algorithm = JWK_HMAC | JWK_AES_KW | JWK_AES_GCM;
-type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA_ENC | JWK_ED;
+type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA_ENC | JWK_OKP_SIGN;
 type JWKAlgorithm = JWK_Symmetric_Algorithm | JWK_Asymmetric_Algorithm | JWK_AES_CBC_HMAC | JWK_PBES2 | JWK_ECDH_ES | ("none" | "dir");
-type JWKPEMAlgorithm = JWK_RSA_PSS | JWK_RSA_SIGN | JWK_RSA_ENC | JWK_ECDSA | JWK_ECDH_ES | JWK_ED;
+type JWKPEMAlgorithm = JWK_RSA_PSS | JWK_RSA_SIGN | JWK_RSA_ENC | JWK_ECDSA | JWK_ECDH_ES | JWK_OKP_SIGN;
 
 /** Header Parameters common to JWE and JWS */
 interface JoseHeaderParameters {
@@ -220,7 +244,7 @@ interface JoseHeaderParameters {
     /** "jku" (JWK Set URL) Header Parameter */
     jku?: string;
     /** "jwk" (JSON Web Key) Header Parameter */
-    jwk?: JWK_RSA_Public;
+    jwk?: JWK_Public;
     /** "typ" (Type) Header Parameter */
     typ?: string;
     /** "cty" (Content Type) Header Parameter */
@@ -282,4 +306,4 @@ interface JWTClaimValidationOptions {
     critical?: string[];
 }
 
-export type { JWK_Symmetric_Algorithm as A, JWK_Asymmetric_Algorithm as B, CompositeKey as C, DeriveKeyOptions as D, JWKAlgorithm as E, JWKPEMAlgorithm as F, GenerateKeyAlgorithm as G, JoseHeaderParameters as H, JWTClaims as I, JWKParameters as J, KeyManagementAlgorithm as K, JWT as L, JWTClaimValidationOptions as M, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, DeriveKeyReturn as c, ContentEncryptionAlgorithm as d, WrapKeyResult as e, JWK_EC_Public as f, JWK_EC_Private as g, JWK_EC as h, JWK_RSA_Public as i, JWK_RSA_Private as j, JWK_RSA as k, JWK_oct as l, JWK as m, JWKSet as n, JWK_HMAC as o, JWK_RSA_SIGN as p, JWK_RSA_PSS as q, JWK_ECDSA as r, JWK_RSA_ENC as s, JWK_AES_KW as t, JWK_AES_GCM_KW as u, JWK_AES_CBC_HMAC as v, JWK_AES_GCM as w, JWK_PBES2 as x, JWK_ECDH_ES as y, JWK_ED as z };
+export type { JWK_AES_CBC_HMAC as A, JWK_AES_GCM as B, CompositeKey as C, DeriveKeyOptions as D, JWK_PBES2 as E, JWK_ECDH_ES as F, GenerateKeyAlgorithm as G, JWK_OKP_SIGN as H, JWK_Symmetric_Algorithm as I, JWKParameters as J, KeyManagementAlgorithm as K, JWK_Asymmetric_Algorithm as L, JWKAlgorithm as M, JWKPEMAlgorithm as N, JoseHeaderParameters as O, JWTClaims as P, JWT as Q, JWTClaimValidationOptions as R, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, DeriveKeyReturn as c, ContentEncryptionAlgorithm as d, WrapKeyResult as e, JWK_EC_Public as f, JWK_EC_Private as g, JWK_EC as h, JWK_RSA_Public as i, JWK_RSA_Private as j, JWK_RSA as k, JWK_OKP_Public as l, JWK_OKP_Private as m, JWK_OKP as n, JWK_oct as o, JWK_Public as p, JWK_Private as q, JWK as r, JWKSet as s, JWK_HMAC as t, JWK_RSA_SIGN as u, JWK_RSA_PSS as v, JWK_ECDSA as w, JWK_RSA_ENC as x, JWK_AES_KW as y, JWK_AES_GCM_KW as z };

package/dist/shared/{unjwt.DtVML6Qp.d.mts → unjwt.C6b_GyXm.d.mts}

@@ -1,4 +1,4 @@
-import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, x as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, l as JWK_oct, m as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, F as JWKPEMAlgorithm, n as JWKSet, H as JoseHeaderParameters, C as CompositeKey, d as ContentEncryptionAlgorithm, E as JWKAlgorithm, J as JWKParameters, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, L as JWT, M as JWTClaimValidationOptions, I as JWTClaims } from './unjwt.CN1C8TlR.mjs';
+import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, E as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, o as JWK_oct, r as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, N as JWKPEMAlgorithm, s as JWKSet, O as JoseHeaderParameters, C as CompositeKey, d as ContentEncryptionAlgorithm, M as JWKAlgorithm, J as JWKParameters, A as JWK_AES_CBC_HMAC, B as JWK_AES_GCM, z as JWK_AES_GCM_KW, y as JWK_AES_KW, L as JWK_Asymmetric_Algorithm, h as JWK_EC, F as JWK_ECDH_ES, w as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, t as JWK_HMAC, n as JWK_OKP, m as JWK_OKP_Private, l as JWK_OKP_Public, H as JWK_OKP_SIGN, q as JWK_Private, p as JWK_Public, k as JWK_RSA, x as JWK_RSA_ENC, v as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, u as JWK_RSA_SIGN, I as JWK_Symmetric_Algorithm, Q as JWT, R as JWTClaimValidationOptions, P as JWTClaims } from './unjwt.BsgIQHVD.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -142,9 +142,14 @@ declare const jwk_JWK_ECDH_ES: typeof JWK_ECDH_ES;
 declare const jwk_JWK_ECDSA: typeof JWK_ECDSA;
 declare const jwk_JWK_EC_Private: typeof JWK_EC_Private;
 declare const jwk_JWK_EC_Public: typeof JWK_EC_Public;
-declare const jwk_JWK_ED: typeof JWK_ED;
 declare const jwk_JWK_HMAC: typeof JWK_HMAC;
+declare const jwk_JWK_OKP: typeof JWK_OKP;
+declare const jwk_JWK_OKP_Private: typeof JWK_OKP_Private;
+declare const jwk_JWK_OKP_Public: typeof JWK_OKP_Public;
+declare const jwk_JWK_OKP_SIGN: typeof JWK_OKP_SIGN;
 declare const jwk_JWK_PBES2: typeof JWK_PBES2;
+declare const jwk_JWK_Private: typeof JWK_Private;
+declare const jwk_JWK_Public: typeof JWK_Public;
 declare const jwk_JWK_RSA: typeof JWK_RSA;
 declare const jwk_JWK_RSA_ENC: typeof JWK_RSA_ENC;
 declare const jwk_JWK_RSA_PSS: typeof JWK_RSA_PSS;
@@ -194,9 +199,14 @@ declare namespace jwk {
     jwk_JWK_ECDSA as JWK_ECDSA,
     jwk_JWK_EC_Private as JWK_EC_Private,
     jwk_JWK_EC_Public as JWK_EC_Public,
-    jwk_JWK_ED as JWK_ED,
     jwk_JWK_HMAC as JWK_HMAC,
+    jwk_JWK_OKP as JWK_OKP,
+    jwk_JWK_OKP_Private as JWK_OKP_Private,
+    jwk_JWK_OKP_Public as JWK_OKP_Public,
+    jwk_JWK_OKP_SIGN as JWK_OKP_SIGN,
     jwk_JWK_PBES2 as JWK_PBES2,
+    jwk_JWK_Private as JWK_Private,
+    jwk_JWK_Public as JWK_Public,
     jwk_JWK_RSA as JWK_RSA,
     jwk_JWK_RSA_ENC as JWK_RSA_ENC,
     jwk_JWK_RSA_PSS as JWK_RSA_PSS,

package/dist/shared/{unjwt.B9sSOKE3.d.mts → unjwt.Cf7vmOhS.d.mts}

@@ -1,4 +1,4 @@
-import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, H as JoseHeaderParameters, f as JWK_EC_Public, m as JWK, M as JWTClaimValidationOptions, I as JWTClaims, L as JWT } from './unjwt.CN1C8TlR.mjs';
+import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, O as JoseHeaderParameters, f as JWK_EC_Public, r as JWK, R as JWTClaimValidationOptions, P as JWTClaims, Q as JWT } from './unjwt.BsgIQHVD.mjs';
 
 /** Recognized JWE Header Parameters, any other Header Members may also be present. */
 interface JWEHeaderParameters extends JoseHeaderParameters {

package/dist/shared/{unjwt.BRtnm5sB.d.mts → unjwt.qWts1U9J.d.mts}

@@ -1,4 +1,4 @@
-import { o as JWK_HMAC, p as JWK_RSA_SIGN, q as JWK_RSA_PSS, r as JWK_ECDSA, H as JoseHeaderParameters, m as JWK, n as JWKSet, M as JWTClaimValidationOptions, I as JWTClaims, L as JWT } from './unjwt.CN1C8TlR.mjs';
+import { t as JWK_HMAC, u as JWK_RSA_SIGN, v as JWK_RSA_PSS, w as JWK_ECDSA, O as JoseHeaderParameters, r as JWK, s as JWKSet, R as JWTClaimValidationOptions, P as JWTClaims, Q as JWT } from './unjwt.BsgIQHVD.mjs';
 
 type JWS_SIGN_EXTRA = "Ed25519" | "EdDSA";
 /** JWS Signing Algorithm Identifier. */

package/dist/shared/{unjwt.D_JFPtpW.mjs → unjwt.skuKf53c.mjs}

@@ -1,9 +1,12 @@
-import { i as importKey, g as getJWKFromSet } from './unjwt.DuBBF25X.mjs';
-import { a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, e as textDecoder, f as base64UrlDecode, g as isJWKSet, h as decodePayloadFromB64UrlSegment, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './unjwt.Ce8yMcp_.mjs';
-import { s as sign$1, v as verify$1 } from './unjwt.C_D0RMCp.mjs';
+import { i as importKey, g as getJWKFromSet } from './unjwt.BVlHlXdP.mjs';
+import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, e as textDecoder, f as base64UrlDecode, g as isJWKSet, h as decodePayloadFromB64UrlSegment, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './unjwt.BEjwP_9W.mjs';
+import { s as sign$1, v as verify$1 } from './unjwt.BaB7HUR1.mjs';
 
 async function sign(payload, key, options = {}) {
   const { protectedHeader: additionalProtectedHeader } = options;
+  const safeAdditionalHeader = sanitizeObject(
+    additionalProtectedHeader
+  );
   let { alg } = options;
   if (!alg) {
     if (isJWK(key) && key.alg) {
@@ -15,11 +18,11 @@ async function sign(payload, key, options = {}) {
   validateKeyLength(key, alg);
   const signingKey = await importKey(key, alg);
   const protectedHeader = {
-    ...additionalProtectedHeader,
-    ...isJWK(key) && key.kid ? { kid: additionalProtectedHeader?.kid || key.kid } : {},
+    ...safeAdditionalHeader,
+    ...isJWK(key) && key.kid ? { kid: safeAdditionalHeader?.kid || key.kid } : {},
     // Include kid if available
     alg,
-    typ: additionalProtectedHeader?.typ
+    typ: safeAdditionalHeader?.typ
   };
   applyTypCtyDefaults(protectedHeader, payload);
   if (protectedHeader.b64 === true) {
@@ -64,7 +67,9 @@ async function verify(jws, key, options = {}) {
   let protectedHeader;
   try {
     const protectedHeaderString = base64UrlDecode(protectedHeaderEncoded);
-    protectedHeader = JSON.parse(protectedHeaderString);
+    protectedHeader = sanitizeObject(
+      JSON.parse(protectedHeaderString)
+    );
   } catch (error_) {
     throw new Error(
       `Invalid JWS: Protected header is not valid Base64URL or JSON (${error_ instanceof Error ? error_.message : error_})`

package/dist/utils.d.mts

@@ -1,2 +1,2 @@
-import './shared/unjwt.CN1C8TlR.mjs';
-export { n as applyTypCtyDefaults, j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, v as computeJwtTimeClaims, f as concatUint8Arrays, p as decodeMaybeJsonString, s as decodePayloadFromB64UrlSegment, q as decodePayloadFromBytes, u as getPlaintextBytes, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, o as isJsonContent, m as maybeArray, r as randomBytes, a as textDecoder, t as textEncoder, y as validateCriticalHeadersJWE, x as validateCriticalHeadersJWS, w as validateJwtClaims } from './shared/unjwt.df8yQ5_5.mjs';
+import './shared/unjwt.BsgIQHVD.mjs';
+export { s as applyTypCtyDefaults, j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, z as computeJwtTimeClaims, f as concatUint8Arrays, v as decodeMaybeJsonString, x as decodePayloadFromB64UrlSegment, w as decodePayloadFromBytes, y as getPlaintextBytes, o as isAsymmetricJWK, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, u as isJsonContent, p as isPrivateJWK, q as isPublicJWK, n as isSymmetricJWK, m as maybeArray, r as randomBytes, D as sanitizeObject, a as textDecoder, t as textEncoder, C as validateCriticalHeadersJWE, B as validateCriticalHeadersJWS, A as validateJwtClaims } from './shared/unjwt.BYaxDvLV.mjs';

package/dist/utils.mjs

@@ -1 +1 @@
-export { b as applyTypCtyDefaults, l as assertCryptoKey, q as base64Decode, s as base64Encode, f as base64UrlDecode, d as base64UrlEncode, c as computeJwtTimeClaims, k as concatUint8Arrays, y as decodeMaybeJsonString, h as decodePayloadFromB64UrlSegment, o as decodePayloadFromBytes, n as getPlaintextBytes, m as isCryptoKey, w as isCryptoKeyPair, a as isJWK, g as isJWKSet, x as isJsonContent, u as maybeArray, r as randomBytes, e as textDecoder, t as textEncoder, p as validateCriticalHeadersJWE, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './shared/unjwt.Ce8yMcp_.mjs';
+export { b as applyTypCtyDefaults, l as assertCryptoKey, q as base64Decode, u as base64Encode, f as base64UrlDecode, d as base64UrlEncode, c as computeJwtTimeClaims, k as concatUint8Arrays, D as decodeMaybeJsonString, h as decodePayloadFromB64UrlSegment, o as decodePayloadFromBytes, n as getPlaintextBytes, z as isAsymmetricJWK, m as isCryptoKey, x as isCryptoKeyPair, a as isJWK, g as isJWKSet, C as isJsonContent, A as isPrivateJWK, B as isPublicJWK, y as isSymmetricJWK, w as maybeArray, r as randomBytes, s as sanitizeObject, e as textDecoder, t as textEncoder, p as validateCriticalHeadersJWE, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './shared/unjwt.BEjwP_9W.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.12",
+  "version": "0.5.14",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",