unjwt 0.5.13 → 0.5.15

package/README.md

@@ -111,7 +111,7 @@ Creates a JWS token.
 - `key`: The signing key (`CryptoKey`, `JWK`, or `Uint8Array` for symmetric keys).
 - `options`:
   - `alg`: (Required) The JWS algorithm (e.g., `"HS256"`, `"RS256"`, `"ES256"`, `"PS256"`).
-  - `protectedHeader`: An object for additional JWS Protected Header parameters (e.g., `kid`, `typ`, `cty`, `crit`, `b64`). If `payload` is an object and `typ` is not set, it defaults to `"at+jwt"`. The `b64` parameter ([RFC7797 section-3](https://datatracker.ietf.org/doc/html/rfc7797#section-3)) controls payload encoding (defaults to `true`, meaning Base64URL encoded).
+  - `protectedHeader`: An object for additional JWS Protected Header parameters (e.g., `kid`, `typ`, `cty`, `crit`, `b64`). If `payload` is an object and `typ` is not set, it defaults to `"JWT"`. The `b64` parameter ([RFC7797 section-3](https://datatracker.ietf.org/doc/html/rfc7797#section-3)) controls payload encoding (defaults to `true`, meaning Base64URL encoded).
   - `expiresIn`: Sets an expiration time in seconds (e.g., `3600` for 1 hour). If `iat` is missing it will be set to the current time. If `exp` is missing it will be set to `iat + expiresIn`. This is only applied if `payload` is a JWT.
   - `currentDate`: The current date for computing `expiresIn` option. Defaults to `new Date()`.
 
@@ -155,6 +155,7 @@ Verifies a JWS token.
   A `KeyLookupFunction` has the signature `(header: JWSProtectedHeader, jws: string) => Promise<CryptoKey | JWK | JWKSet | Uint8Array> | CryptoKey | JWK | JWKSet | Uint8Array`.
 - `options` (optional):
   - `algorithms`: An array of allowed JWS `alg` values. If not provided, the `alg` from the JWS header is used.
+  - `validateJWT`: Unless false, will parse payload as JWT and validate claims if applicable (typ includes "jwt", case insensitive). Default `undefined`.
   - `critical`: An array of JWS header parameter names that the application understands and processes.
 
 Returns a `Promise<JWSVerifyResult<T>>` which is an object `{ payload: T, protectedHeader: JWSProtectedHeader }`.
@@ -170,7 +171,7 @@ const secret = "supersecretkey";
 
 const { payload, protectedHeader } = await verify(token, secret);
 console.log(payload); // { message: "My important data" }
-console.log(protectedHeader); // { alg: "HS256", typ: "at+jwt" }
+console.log(protectedHeader); // { alg: "HS256", typ: "JWT" }
 ```
 
 **Example (RS256 with key lookup):**
@@ -210,7 +211,7 @@ Encrypts data to produce a JWE token.
 - `options`:
   - `alg`: (Required) The JWE Key Management algorithm (e.g., `"A128KW"`, `"RSA-OAEP-256"`, `"PBES2-HS256+A128KW"`, `"ECDH-ES+A128KW"`), defaults depends on the key provided.
   - `enc`: (Required) The JWE Content Encryption algorithm (e.g., `"A128GCM"`, `"A256CBC-HS512"`), defaults depends on the key provided.
-  - `protectedHeader`: An object for JWE Protected Header parameters (e.g., `kid`, `typ`, `cty`, `crit`, `apu`, `apv`, `p2s`, `p2c`). If `payload` is an object and `typ` is not set, it defaults to `"at+jwt"`.
+  - `protectedHeader`: An object for JWE Protected Header parameters (e.g., `kid`, `typ`, `cty`, `crit`, `apu`, `apv`, `p2s`, `p2c`). If `payload` is an object and `typ` is not set, it defaults to `"JWT"`.
   - `cek`: (Optional) Provide your own Content Encryption Key (`CryptoKey` or `Uint8Array`).
   - `contentEncryptionIV`: (Optional) Provide your own Initialization Vector for content encryption (`Uint8Array`).
   - Other algorithm-specific options like `p2s`, `p2c` (for PBES2), `keyManagementIV`, `ecdhPartyUInfo`, `ecdhPartyVInfo`.
@@ -259,6 +260,7 @@ Decrypts a JWE token.
   A `JWEKeyLookupFunction` has the signature `(header: JWEHeaderParameters) => Promise<CryptoKey | JWK | string | Uint8Array> | CryptoKey | JWK | string | Uint8Array`.
 - `options` (optional):
   - `algorithms`: Array of allowed JWE Key Management `alg` values.
+  - `validateJWT`: Unless false, will parse payload as JWT and validate claims if applicable (typ includes "jwt", case insensitive). Default `undefined`.
   - `encryptionAlgorithms`: Array of allowed JWE Content Encryption `enc` values.
   - `critical`: Array of JWE header parameter names that the application understands.
   - `unwrappedKeyAlgorithm`: (For `unwrapKey` internally) Algorithm details for the CEK after unwrapping.

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, L as JWT, M as JWTClaimValidationOptions, I as JWTClaims, H as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CN1C8TlR.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.BRtnm5sB.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.B9sSOKE3.mjs';
-export { i as utils } from './shared/unjwt.Cay_cOOI.mjs';
-export { j as jwk } from './shared/unjwt.DtVML6Qp.mjs';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, r as JWK, M as JWKAlgorithm, N as JWKPEMAlgorithm, J as JWKParameters, s as JWKSet, A as JWK_AES_CBC_HMAC, B as JWK_AES_GCM, z as JWK_AES_GCM_KW, y as JWK_AES_KW, L as JWK_Asymmetric_Algorithm, h as JWK_EC, F as JWK_ECDH_ES, w as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, t as JWK_HMAC, n as JWK_OKP, m as JWK_OKP_Private, l as JWK_OKP_Public, H as JWK_OKP_SIGN, E as JWK_PBES2, q as JWK_Private, p as JWK_Public, k as JWK_RSA, x as JWK_RSA_ENC, v as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, u as JWK_RSA_SIGN, I as JWK_Symmetric_Algorithm, o as JWK_oct, Q as JWT, R as JWTClaimValidationOptions, P as JWTClaims, O as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.BsgIQHVD.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.Bw4pzdE0.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.BeWVYyaf.mjs';
+export { i as utils } from './shared/unjwt.CfL4cArP.mjs';
+export { j as jwk } from './shared/unjwt.C6b_GyXm.mjs';

package/dist/index.mjs

@@ -1,5 +1,5 @@
-export { i as utils } from './shared/unjwt.mBSKL6g4.mjs';
-export { j as jwe } from './shared/unjwt.UfthlTWt.mjs';
-export { j as jwk } from './shared/unjwt.CX8WRx20.mjs';
-export { j as jws } from './shared/unjwt.C6flzAeB.mjs';
-import './shared/unjwt.DFAKwqBz.mjs';
+export { i as utils } from './shared/unjwt.CRHfsi7v.mjs';
+export { j as jwe } from './shared/unjwt.BZ3B0Ak8.mjs';
+export { j as jwk } from './shared/unjwt.D1MC63Yb.mjs';
+export { j as jws } from './shared/unjwt.u3h40Nr-.mjs';
+import './shared/unjwt.BpusjhPR.mjs';

package/dist/jwe.d.mts

@@ -1,2 +1,2 @@
-export { L as JWT, M as JWTClaimValidationOptions, I as JWTClaims, H as JoseHeaderParameters } from './shared/unjwt.CN1C8TlR.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.B9sSOKE3.mjs';
+export { Q as JWT, R as JWTClaimValidationOptions, P as JWTClaims, O as JoseHeaderParameters } from './shared/unjwt.BsgIQHVD.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.BeWVYyaf.mjs';

package/dist/jwe.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.CX8WRx20.mjs';
-import './shared/unjwt.mBSKL6g4.mjs';
-export { d as decrypt, e as encrypt } from './shared/unjwt.UfthlTWt.mjs';
-import './shared/unjwt.DFAKwqBz.mjs';
+import './shared/unjwt.D1MC63Yb.mjs';
+import './shared/unjwt.CRHfsi7v.mjs';
+export { d as decrypt, e as encrypt } from './shared/unjwt.BZ3B0Ak8.mjs';
+import './shared/unjwt.BpusjhPR.mjs';

package/dist/jwk.d.mts

@@ -1,2 +1,2 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, L as JWT, M as JWTClaimValidationOptions, I as JWTClaims, H as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CN1C8TlR.mjs';
-export { d as deriveKeyFromPassword, b as exportJWKToPEM, e as exportKey, g as generateKey, c as getJWKFromSet, a as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.DtVML6Qp.mjs';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, r as JWK, M as JWKAlgorithm, N as JWKPEMAlgorithm, J as JWKParameters, s as JWKSet, A as JWK_AES_CBC_HMAC, B as JWK_AES_GCM, z as JWK_AES_GCM_KW, y as JWK_AES_KW, L as JWK_Asymmetric_Algorithm, h as JWK_EC, F as JWK_ECDH_ES, w as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, t as JWK_HMAC, n as JWK_OKP, m as JWK_OKP_Private, l as JWK_OKP_Public, H as JWK_OKP_SIGN, E as JWK_PBES2, q as JWK_Private, p as JWK_Public, k as JWK_RSA, x as JWK_RSA_ENC, v as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, u as JWK_RSA_SIGN, I as JWK_Symmetric_Algorithm, o as JWK_oct, Q as JWT, R as JWTClaimValidationOptions, P as JWTClaims, O as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.BsgIQHVD.mjs';
+export { d as deriveKeyFromPassword, b as exportJWKToPEM, e as exportKey, g as generateKey, c as getJWKFromSet, a as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.C6b_GyXm.mjs';

package/dist/jwk.mjs

@@ -1,2 +1,2 @@
-import './shared/unjwt.mBSKL6g4.mjs';
-export { p as deriveKeyFromPassword, t as exportJWKToPEM, q as exportKey, o as generateKey, g as getJWKFromSet, s as importJWKFromPEM, i as importKey, m as unwrapKey, r as wrapKey } from './shared/unjwt.CX8WRx20.mjs';
+import './shared/unjwt.CRHfsi7v.mjs';
+export { p as deriveKeyFromPassword, t as exportJWKToPEM, q as exportKey, o as generateKey, g as getJWKFromSet, s as importJWKFromPEM, i as importKey, m as unwrapKey, r as wrapKey } from './shared/unjwt.D1MC63Yb.mjs';

package/dist/jws.d.mts

@@ -1,2 +1,2 @@
-export { L as JWT, M as JWTClaimValidationOptions, I as JWTClaims, H as JoseHeaderParameters } from './shared/unjwt.CN1C8TlR.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.BRtnm5sB.mjs';
+export { Q as JWT, R as JWTClaimValidationOptions, P as JWTClaims, O as JoseHeaderParameters } from './shared/unjwt.BsgIQHVD.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.Bw4pzdE0.mjs';

package/dist/jws.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.CX8WRx20.mjs';
-import './shared/unjwt.mBSKL6g4.mjs';
-import './shared/unjwt.DFAKwqBz.mjs';
-export { s as sign, v as verify } from './shared/unjwt.C6flzAeB.mjs';
+import './shared/unjwt.D1MC63Yb.mjs';
+import './shared/unjwt.CRHfsi7v.mjs';
+import './shared/unjwt.BpusjhPR.mjs';
+export { s as sign, v as verify } from './shared/unjwt.u3h40Nr-.mjs';

package/dist/shared/{unjwt.UfthlTWt.mjs → unjwt.BZ3B0Ak8.mjs}

@@ -1,6 +1,6 @@
-import { a as checkEncCryptoKey, u as uint32be, b as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, d as bitLengthCEK, f as jwkTokey, i as importKey, h as generateIV, l as encrypt$1, m as unwrapKey, n as decrypt$1 } from './unjwt.CX8WRx20.mjs';
-import { k as concatUint8Arrays, t as textEncoder, l as assertCryptoKey, d as base64UrlEncode, m as isCryptoKey, a as isJWK, s as sanitizeObject, f as base64UrlDecode, r as randomBytes, b as applyTypCtyDefaults, c as computeJwtTimeClaims, n as getPlaintextBytes, o as decodePayloadFromBytes, p as validateCriticalHeadersJWE } from './unjwt.mBSKL6g4.mjs';
-import { c as checkKeyLength } from './unjwt.DFAKwqBz.mjs';
+import { a as checkEncCryptoKey, u as uint32be, b as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, d as bitLengthCEK, f as jwkTokey, i as importKey, h as generateIV, l as encrypt$1, m as unwrapKey, n as decrypt$1 } from './unjwt.D1MC63Yb.mjs';
+import { k as concatUint8Arrays, t as textEncoder, l as assertCryptoKey, d as base64UrlEncode, m as isCryptoKey, a as isJWK, s as sanitizeObject, f as base64UrlDecode, r as randomBytes, b as applyTypCtyDefaults, c as computeJwtTimeClaims, n as getPlaintextBytes, o as decodePayloadFromBytes, p as validateCriticalHeadersJWE, j as validateJwtClaims } from './unjwt.CRHfsi7v.mjs';
+import { c as checkKeyLength } from './unjwt.BpusjhPR.mjs';
 
 function lengthAndInput(input) {
   return concatUint8Arrays(uint32be(input.length), input);
@@ -293,7 +293,7 @@ async function encrypt(payload, key, options = {}) {
   ];
   return jweParts.join(".");
 }
-async function decrypt(jwe, key, options) {
+async function decrypt(jwe, key, options = {}) {
   const parts = jwe.split(".");
   if (parts.length !== 5) {
     throw new Error(
@@ -375,6 +375,9 @@ async function decrypt(jwe, key, options) {
     ...options?.critical || [],
     ...options?.requiredHeaders || []
   ]);
+  if (payload && typeof payload === "object" && options.validateJWT !== false && (options.validateJWT === true || protectedHeader.typ?.toLowerCase().includes("jwt")) && !options.forceUint8Array && !(payload instanceof Uint8Array)) {
+    validateJwtClaims(payload, options);
+  }
   return {
     payload,
     protectedHeader,

package/dist/shared/{unjwt.B9sSOKE3.d.mts → unjwt.BeWVYyaf.d.mts}

@@ -1,4 +1,4 @@
-import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, H as JoseHeaderParameters, f as JWK_EC_Public, m as JWK, M as JWTClaimValidationOptions, I as JWTClaims, L as JWT } from './unjwt.CN1C8TlR.mjs';
+import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, O as JoseHeaderParameters, f as JWK_EC_Public, r as JWK, R as JWTClaimValidationOptions, P as JWTClaims, Q as JWT } from './unjwt.BsgIQHVD.mjs';
 
 /** Recognized JWE Header Parameters, any other Header Members may also be present. */
 interface JWEHeaderParameters extends JoseHeaderParameters {
@@ -72,7 +72,7 @@ interface JWEEncryptOptions {
     enc?: ContentEncryptionAlgorithm;
     /** Date to use when computing NumericDate claims, defaults to `new Date()`. */
     currentDate?: Date;
-    /** Time at which the JWT should expire, if no `exp` was already provided (only when typ is "at+jwt"). */
+    /** Time at which the JWT should expire, if no `exp` was already provided (only when typ is "JWT" or explicitly parsing JWT). */
     expiresIn?: number;
     /** Additional JWE Protected Header parameters. */
     protectedHeader?: Omit<JWEHeaderParameters, "alg" | "enc" | "iv" | "tag" | "p2s" | "p2c" | "apu" | "apv">;
@@ -119,6 +119,8 @@ interface JWEDecryptOptions extends JWTClaimValidationOptions {
     extractable?: boolean;
     /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred based on JWE headers. */
     forceUint8Array?: boolean;
+    /** Unless false, will parse payload as JWT and validate claims if applicable (typ "JWT"). */
+    validateJWT?: boolean;
 }
 /**
  * Result of a JWE decryption operation.

package/dist/shared/{unjwt.DFAKwqBz.mjs → unjwt.BpusjhPR.mjs}

@@ -1,4 +1,4 @@
-import { c as checkSigCryptoKey } from './unjwt.CX8WRx20.mjs';
+import { c as checkSigCryptoKey } from './unjwt.D1MC63Yb.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.

package/dist/shared/{unjwt.CN1C8TlR.d.mts → unjwt.BsgIQHVD.d.mts}

@@ -17,14 +17,14 @@ interface GenerateKeyOptions {
     /** RSA public exponent. Defaults to 65537 (0x010001). */
     publicExponent?: Uint8Array<ArrayBuffer>;
     /** Export the generated key(s) as JWK. If true, the key(s) will be returned in JWK format. */
-    toJWK?: boolean | undefined;
+    toJWK?: undefined | boolean | Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">;
 }
 type GenerateKeyReturnJWK<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_Asymmetric_Algorithm ? {
     privateKey: JWK;
     publicKey: JWK;
 } : JWK;
 type GenerateKeyReturnCrypto<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_AES_CBC_HMAC ? Uint8Array<ArrayBuffer> : TAlg extends JWK_Asymmetric_Algorithm ? CryptoKeyPair : CryptoKey;
-type GenerateKeyReturn<TAlg extends GenerateKeyAlgorithm, TOptions extends GenerateKeyOptions> = TOptions["toJWK"] extends true ? GenerateKeyReturnJWK<TAlg> : GenerateKeyReturnCrypto<TAlg>;
+type GenerateKeyReturn<TAlg extends GenerateKeyAlgorithm, TOptions extends GenerateKeyOptions> = TOptions["toJWK"] extends true ? GenerateKeyReturnJWK<TAlg> : TOptions["toJWK"] extends object ? GenerateKeyReturnJWK<TAlg> : GenerateKeyReturnCrypto<TAlg>;
 /** Options for the deriveKeyFromPassword function. */
 interface DeriveKeyOptions {
     /** Salt value (p2s). Must be at least 8 bytes. */
@@ -133,6 +133,8 @@ interface JWKParameters {
 }
 /** Public EC JSON Web Keys */
 interface JWK_EC_Public extends JWKParameters {
+    /** EC JWK "kty" (Key Type) Parameter */
+    kty: "EC";
     /** EC JWK "crv" (Curve) Parameter */
     crv: string;
     /** EC JWK "x" (X Coordinate) Parameter */
@@ -141,7 +143,7 @@ interface JWK_EC_Public extends JWKParameters {
     y: string;
 }
 /** Private EC JSON Web Keys */
-interface JWK_EC_Private extends JWK_EC_Public, JWKParameters {
+interface JWK_EC_Private extends JWK_EC_Public {
     /** EC JWK "d" (ECC Private Key) Parameter */
     d: string;
 }
@@ -149,6 +151,8 @@ interface JWK_EC_Private extends JWK_EC_Public, JWKParameters {
 type JWK_EC = JWK_EC_Public | JWK_EC_Private;
 /** Public RSA JSON Web Keys */
 interface JWK_RSA_Public extends JWKParameters {
+    /** RSA JWK "kty" (Key Type) Parameter */
+    kty: "RSA";
     /** RSA JWK "e" (Exponent) Parameter */
     e: string;
     /** RSA JWK "n" (Modulus) Parameter */
@@ -156,7 +160,7 @@ interface JWK_RSA_Public extends JWKParameters {
     oth?: RsaOtherPrimesInfo[];
 }
 /** Private RSA JSON Web Keys */
-interface JWK_RSA_Private extends JWK_RSA_Public, JWKParameters {
+interface JWK_RSA_Private extends JWK_RSA_Public {
     /** RSA JWK "d" (Private Exponent) Parameter */
     d: string;
     /** RSA JWK "dp" (First Factor CRT Exponent) Parameter */
@@ -172,15 +176,35 @@ interface JWK_RSA_Private extends JWK_RSA_Public, JWKParameters {
 }
 /** RSA JSON Web Keys */
 type JWK_RSA = JWK_RSA_Public | JWK_RSA_Private;
+/** Public ED JSON Web Keys */
+interface JWK_OKP_Public extends JWKParameters {
+    /** ED JWK "kty" (Key Type) Parameter */
+    kty: "OKP";
+    /** ED JWK "crv" (Curve) Parameter */
+    crv: string;
+    /** ED JWK "x" (X Coordinate) Parameter */
+    x: string;
+}
+/** Private ED JSON Web Keys */
+interface JWK_OKP_Private extends JWK_OKP_Public {
+    /** ED JWK "d" (Private Key) Parameter */
+    d: string;
+}
+/** OKP JSON Web Keys */
+type JWK_OKP = JWK_OKP_Public | JWK_OKP_Private;
 /** oct JSON Web Keys */
 interface JWK_oct extends JWKParameters {
     /** Oct JWK "k" (Key Value) Parameter */
     k: string;
 }
+/** Public JSON Web Keys */
+type JWK_Public = JWK_RSA_Public | JWK_EC_Public | JWK_OKP_Public | JWK_oct;
+/** Private JSON Web Keys */
+type JWK_Private = JWK_RSA_Private | JWK_EC_Private | JWK_OKP_Private;
 /**
- * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC" and "oct" key types are supported.
+ * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC", "OKP" and "oct" key types are supported.
  */
-type JWK = JWK_oct | JWK_RSA | JWK_EC;
+type JWK = JWK_oct | JWK_RSA | JWK_EC | JWK_OKP;
 /**
  * JSON Web Key Set ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK Set}). "RSA", "EC" and "oct" key types are supported.
  */
@@ -201,11 +225,11 @@ type JWK_AES_CBC_HMAC = "A128CBC-HS256" | "A192CBC-HS384" | "A256CBC-HS512";
 type JWK_AES_GCM = "A128GCM" | "A192GCM" | "A256GCM";
 type JWK_PBES2 = "PBES2-HS256+A128KW" | "PBES2-HS384+A192KW" | "PBES2-HS512+A256KW";
 type JWK_ECDH_ES = "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A192KW" | "ECDH-ES+A256KW";
-type JWK_ED = "Ed25519" | "EdDSA";
+type JWK_OKP_SIGN = "Ed25519" | "EdDSA";
 type JWK_Symmetric_Algorithm = JWK_HMAC | JWK_AES_KW | JWK_AES_GCM;
-type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA_ENC | JWK_ED;
+type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA_ENC | JWK_OKP_SIGN;
 type JWKAlgorithm = JWK_Symmetric_Algorithm | JWK_Asymmetric_Algorithm | JWK_AES_CBC_HMAC | JWK_PBES2 | JWK_ECDH_ES | ("none" | "dir");
-type JWKPEMAlgorithm = JWK_RSA_PSS | JWK_RSA_SIGN | JWK_RSA_ENC | JWK_ECDSA | JWK_ECDH_ES | JWK_ED;
+type JWKPEMAlgorithm = JWK_RSA_PSS | JWK_RSA_SIGN | JWK_RSA_ENC | JWK_ECDSA | JWK_ECDH_ES | JWK_OKP_SIGN;
 
 /** Header Parameters common to JWE and JWS */
 interface JoseHeaderParameters {
@@ -220,7 +244,7 @@ interface JoseHeaderParameters {
     /** "jku" (JWK Set URL) Header Parameter */
     jku?: string;
     /** "jwk" (JSON Web Key) Header Parameter */
-    jwk?: JWK_RSA_Public;
+    jwk?: JWK_Public;
     /** "typ" (Type) Header Parameter */
     typ?: string;
     /** "cty" (Content Type) Header Parameter */
@@ -282,4 +306,4 @@ interface JWTClaimValidationOptions {
     critical?: string[];
 }
 
-export type { JWK_Symmetric_Algorithm as A, JWK_Asymmetric_Algorithm as B, CompositeKey as C, DeriveKeyOptions as D, JWKAlgorithm as E, JWKPEMAlgorithm as F, GenerateKeyAlgorithm as G, JoseHeaderParameters as H, JWTClaims as I, JWKParameters as J, KeyManagementAlgorithm as K, JWT as L, JWTClaimValidationOptions as M, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, DeriveKeyReturn as c, ContentEncryptionAlgorithm as d, WrapKeyResult as e, JWK_EC_Public as f, JWK_EC_Private as g, JWK_EC as h, JWK_RSA_Public as i, JWK_RSA_Private as j, JWK_RSA as k, JWK_oct as l, JWK as m, JWKSet as n, JWK_HMAC as o, JWK_RSA_SIGN as p, JWK_RSA_PSS as q, JWK_ECDSA as r, JWK_RSA_ENC as s, JWK_AES_KW as t, JWK_AES_GCM_KW as u, JWK_AES_CBC_HMAC as v, JWK_AES_GCM as w, JWK_PBES2 as x, JWK_ECDH_ES as y, JWK_ED as z };
+export type { JWK_AES_CBC_HMAC as A, JWK_AES_GCM as B, CompositeKey as C, DeriveKeyOptions as D, JWK_PBES2 as E, JWK_ECDH_ES as F, GenerateKeyAlgorithm as G, JWK_OKP_SIGN as H, JWK_Symmetric_Algorithm as I, JWKParameters as J, KeyManagementAlgorithm as K, JWK_Asymmetric_Algorithm as L, JWKAlgorithm as M, JWKPEMAlgorithm as N, JoseHeaderParameters as O, JWTClaims as P, JWT as Q, JWTClaimValidationOptions as R, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, DeriveKeyReturn as c, ContentEncryptionAlgorithm as d, WrapKeyResult as e, JWK_EC_Public as f, JWK_EC_Private as g, JWK_EC as h, JWK_RSA_Public as i, JWK_RSA_Private as j, JWK_RSA as k, JWK_OKP_Public as l, JWK_OKP_Private as m, JWK_OKP as n, JWK_oct as o, JWK_Public as p, JWK_Private as q, JWK as r, JWKSet as s, JWK_HMAC as t, JWK_RSA_SIGN as u, JWK_RSA_PSS as v, JWK_ECDSA as w, JWK_RSA_ENC as x, JWK_AES_KW as y, JWK_AES_GCM_KW as z };

package/dist/shared/{unjwt.BRtnm5sB.d.mts → unjwt.Bw4pzdE0.d.mts}

@@ -1,4 +1,4 @@
-import { o as JWK_HMAC, p as JWK_RSA_SIGN, q as JWK_RSA_PSS, r as JWK_ECDSA, H as JoseHeaderParameters, m as JWK, n as JWKSet, M as JWTClaimValidationOptions, I as JWTClaims, L as JWT } from './unjwt.CN1C8TlR.mjs';
+import { t as JWK_HMAC, u as JWK_RSA_SIGN, v as JWK_RSA_PSS, w as JWK_ECDSA, O as JoseHeaderParameters, r as JWK, s as JWKSet, R as JWTClaimValidationOptions, P as JWTClaims, Q as JWT } from './unjwt.BsgIQHVD.mjs';
 
 type JWS_SIGN_EXTRA = "Ed25519" | "EdDSA";
 /** JWS Signing Algorithm Identifier. */
@@ -27,7 +27,7 @@ interface JWSSignOptions {
     alg?: JWSAlgorithm;
     /**
      * Additional protected header parameters. `alg` is automatically included.
-     * `typ` defaults to "at+jwt" if not provided.
+     * `typ` defaults to "JWT" if not provided and payload is an object.
      */
     protectedHeader?: JWSHeaderParameters;
     /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
@@ -50,6 +50,8 @@ interface JWSVerifyOptions extends JWTClaimValidationOptions {
     algorithms?: JWSAlgorithm[];
     /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred. */
     forceUint8Array?: boolean;
+    /** Unless false, will parse payload as JWT and validate claims if applicable (typ "JWT"). */
+    validateJWT?: boolean;
 }
 /**
  * Key lookup function for JWS verification.

package/dist/shared/{unjwt.DtVML6Qp.d.mts → unjwt.C6b_GyXm.d.mts}

@@ -1,4 +1,4 @@
-import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, x as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, l as JWK_oct, m as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, F as JWKPEMAlgorithm, n as JWKSet, H as JoseHeaderParameters, C as CompositeKey, d as ContentEncryptionAlgorithm, E as JWKAlgorithm, J as JWKParameters, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, L as JWT, M as JWTClaimValidationOptions, I as JWTClaims } from './unjwt.CN1C8TlR.mjs';
+import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, E as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, o as JWK_oct, r as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, N as JWKPEMAlgorithm, s as JWKSet, O as JoseHeaderParameters, C as CompositeKey, d as ContentEncryptionAlgorithm, M as JWKAlgorithm, J as JWKParameters, A as JWK_AES_CBC_HMAC, B as JWK_AES_GCM, z as JWK_AES_GCM_KW, y as JWK_AES_KW, L as JWK_Asymmetric_Algorithm, h as JWK_EC, F as JWK_ECDH_ES, w as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, t as JWK_HMAC, n as JWK_OKP, m as JWK_OKP_Private, l as JWK_OKP_Public, H as JWK_OKP_SIGN, q as JWK_Private, p as JWK_Public, k as JWK_RSA, x as JWK_RSA_ENC, v as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, u as JWK_RSA_SIGN, I as JWK_Symmetric_Algorithm, Q as JWT, R as JWTClaimValidationOptions, P as JWTClaims } from './unjwt.BsgIQHVD.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -142,9 +142,14 @@ declare const jwk_JWK_ECDH_ES: typeof JWK_ECDH_ES;
 declare const jwk_JWK_ECDSA: typeof JWK_ECDSA;
 declare const jwk_JWK_EC_Private: typeof JWK_EC_Private;
 declare const jwk_JWK_EC_Public: typeof JWK_EC_Public;
-declare const jwk_JWK_ED: typeof JWK_ED;
 declare const jwk_JWK_HMAC: typeof JWK_HMAC;
+declare const jwk_JWK_OKP: typeof JWK_OKP;
+declare const jwk_JWK_OKP_Private: typeof JWK_OKP_Private;
+declare const jwk_JWK_OKP_Public: typeof JWK_OKP_Public;
+declare const jwk_JWK_OKP_SIGN: typeof JWK_OKP_SIGN;
 declare const jwk_JWK_PBES2: typeof JWK_PBES2;
+declare const jwk_JWK_Private: typeof JWK_Private;
+declare const jwk_JWK_Public: typeof JWK_Public;
 declare const jwk_JWK_RSA: typeof JWK_RSA;
 declare const jwk_JWK_RSA_ENC: typeof JWK_RSA_ENC;
 declare const jwk_JWK_RSA_PSS: typeof JWK_RSA_PSS;
@@ -194,9 +199,14 @@ declare namespace jwk {
     jwk_JWK_ECDSA as JWK_ECDSA,
     jwk_JWK_EC_Private as JWK_EC_Private,
     jwk_JWK_EC_Public as JWK_EC_Public,
-    jwk_JWK_ED as JWK_ED,
     jwk_JWK_HMAC as JWK_HMAC,
+    jwk_JWK_OKP as JWK_OKP,
+    jwk_JWK_OKP_Private as JWK_OKP_Private,
+    jwk_JWK_OKP_Public as JWK_OKP_Public,
+    jwk_JWK_OKP_SIGN as JWK_OKP_SIGN,
     jwk_JWK_PBES2 as JWK_PBES2,
+    jwk_JWK_Private as JWK_Private,
+    jwk_JWK_Public as JWK_Public,
     jwk_JWK_RSA as JWK_RSA,
     jwk_JWK_RSA_ENC as JWK_RSA_ENC,
     jwk_JWK_RSA_PSS as JWK_RSA_PSS,

package/dist/shared/{unjwt.mBSKL6g4.mjs → unjwt.CRHfsi7v.mjs}

@@ -1,22 +1,21 @@
 function applyTypCtyDefaults(header, payload) {
   const isObjectPayload = typeof payload === "object" && payload !== null && !(payload instanceof Uint8Array);
   if (header.typ === void 0 && isObjectPayload) {
-    header.typ = "at+jwt";
+    header.typ = "JWT";
   }
-  if ((header.typ === "at+jwt" || header.typ === "JWT") && isObjectPayload) {
+  if (header.typ?.toLowerCase().includes("jwt") && isObjectPayload) {
     header.cty ||= "application/json";
   }
   return header;
 }
-function isJsonContent(header) {
+function isJWTContent(header) {
   if (!header) return false;
-  if (header.typ === "at+jwt") return true;
-  if (header.typ === "JWT") return true;
+  if (header.typ?.toLowerCase().includes("jwt")) return true;
   const cty = header.cty?.toLowerCase();
   return cty === "json" || cty === "application/json" || !!cty && cty.endsWith("+json");
 }
-function decodeMaybeJsonString(decodedString, header) {
-  if (isJsonContent(header)) {
+function decodeMaybeJWTString(decodedString, header) {
+  if (isJWTContent(header)) {
     const looksLikeJson = decodedString.startsWith("{") && decodedString.endsWith("}") || decodedString.startsWith("[") && decodedString.endsWith("]");
     if (looksLikeJson) {
       try {
@@ -31,12 +30,12 @@ function decodeMaybeJsonString(decodedString, header) {
 function decodePayloadFromBytes(bytes, header, forceUint8Array) {
   if (forceUint8Array) return bytes;
   const decodedString = textDecoder.decode(bytes);
-  return decodeMaybeJsonString(decodedString, header);
+  return decodeMaybeJWTString(decodedString, header);
 }
 function decodePayloadFromB64UrlSegment(payloadEncoded, header, forceUint8Array) {
   if (forceUint8Array) return base64UrlDecode(payloadEncoded, false);
   const decodedString = base64UrlDecode(payloadEncoded);
-  return decodeMaybeJsonString(decodedString, header);
+  return decodeMaybeJWTString(decodedString, header);
 }
 function getPlaintextBytes(payload) {
   if (payload instanceof Uint8Array) return payload;
@@ -48,13 +47,13 @@ function getPlaintextBytes(payload) {
   );
 }
 function computeJwtTimeClaims(payload, headerTyp, expiresIn, currentDate = /* @__PURE__ */ new Date()) {
-  if (expiresIn === void 0 || headerTyp !== "at+jwt" && headerTyp !== "JWT" || !(payload && typeof payload === "object") || payload instanceof Uint8Array || payload.exp) {
+  if (expiresIn === void 0 || !headerTyp?.toLowerCase().includes("jwt") || !(payload && typeof payload === "object") || payload instanceof Uint8Array || payload.exp) {
     return void 0;
   }
   const now = Math.round(currentDate.getTime() / 1e3);
   const claims = { ...payload };
   claims.iat ||= now;
-  claims.exp = now + expiresIn;
+  claims.exp = claims.iat + expiresIn;
   return claims;
 }
 function validateJwtClaims(jwtClaims, options = {}) {
@@ -316,6 +315,41 @@ function isCryptoKey(key) {
   return key?.[Symbol.toStringTag] === "CryptoKey";
 }
 const isCryptoKeyPair = (key) => key && typeof key === "object" && isCryptoKey(key.publicKey) && isCryptoKey(key.privateKey);
+function isSymmetricJWK(key) {
+  return isJWK(key) && key.kty === "oct" && typeof key.k === "string";
+}
+function isAsymmetricJWK(key) {
+  return !isSymmetricJWK(key);
+}
+function isPrivateJWK(key) {
+  if (!isJWK(key)) return false;
+  if (key.kty === "EC") {
+    return typeof key.d === "string";
+  }
+  if (key.kty === "OKP") {
+    return typeof key.d === "string";
+  }
+  if (key.kty === "RSA") {
+    return typeof key.d === "string";
+  }
+  return false;
+}
+function isPublicJWK(key) {
+  if (!isJWK(key)) return false;
+  if (key.kty === "EC") {
+    const ec = key;
+    return typeof ec.x === "string" && typeof ec.y === "string" && typeof ec.d !== "string";
+  }
+  if (key.kty === "OKP") {
+    const okp = key;
+    return typeof okp.x === "string" && typeof okp.d !== "string";
+  }
+  if (key.kty === "RSA") {
+    const rsa = key;
+    return typeof rsa.n === "string" && typeof rsa.e === "string" && typeof rsa.d !== "string";
+  }
+  return false;
+}
 
 const index = {
   __proto__: null,
@@ -327,15 +361,19 @@ const index = {
   base64UrlEncode: base64UrlEncode,
   computeJwtTimeClaims: computeJwtTimeClaims,
   concatUint8Arrays: concatUint8Arrays,
-  decodeMaybeJsonString: decodeMaybeJsonString,
+  decodeMaybeJWTString: decodeMaybeJWTString,
   decodePayloadFromB64UrlSegment: decodePayloadFromB64UrlSegment,
   decodePayloadFromBytes: decodePayloadFromBytes,
   getPlaintextBytes: getPlaintextBytes,
+  isAsymmetricJWK: isAsymmetricJWK,
   isCryptoKey: isCryptoKey,
   isCryptoKeyPair: isCryptoKeyPair,
   isJWK: isJWK,
   isJWKSet: isJWKSet,
-  isJsonContent: isJsonContent,
+  isJWTContent: isJWTContent,
+  isPrivateJWK: isPrivateJWK,
+  isPublicJWK: isPublicJWK,
+  isSymmetricJWK: isSymmetricJWK,
   maybeArray: maybeArray,
   randomBytes: randomBytes,
   sanitizeObject: sanitizeObject,
@@ -346,4 +384,4 @@ const index = {
   validateJwtClaims: validateJwtClaims
 };
 
-export { isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, textDecoder as e, base64UrlDecode as f, isJWKSet as g, decodePayloadFromB64UrlSegment as h, index as i, validateJwtClaims as j, concatUint8Arrays as k, assertCryptoKey as l, isCryptoKey as m, getPlaintextBytes as n, decodePayloadFromBytes as o, validateCriticalHeadersJWE as p, base64Decode as q, randomBytes as r, sanitizeObject as s, textEncoder as t, base64Encode as u, validateCriticalHeadersJWS as v, maybeArray as w, isCryptoKeyPair as x, isJsonContent as y, decodeMaybeJsonString as z };
+export { isPrivateJWK as A, isPublicJWK as B, isJWTContent as C, decodeMaybeJWTString as D, isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, textDecoder as e, base64UrlDecode as f, isJWKSet as g, decodePayloadFromB64UrlSegment as h, index as i, validateJwtClaims as j, concatUint8Arrays as k, assertCryptoKey as l, isCryptoKey as m, getPlaintextBytes as n, decodePayloadFromBytes as o, validateCriticalHeadersJWE as p, base64Decode as q, randomBytes as r, sanitizeObject as s, textEncoder as t, base64Encode as u, validateCriticalHeadersJWS as v, maybeArray as w, isCryptoKeyPair as x, isSymmetricJWK as y, isAsymmetricJWK as z };

package/dist/shared/{unjwt.Cay_cOOI.d.mts → unjwt.CfL4cArP.d.mts}

@@ -1,23 +1,23 @@
-import { I as JWTClaims, M as JWTClaimValidationOptions, m as JWK, n as JWKSet } from './unjwt.CN1C8TlR.mjs';
+import { P as JWTClaims, R as JWTClaimValidationOptions, r as JWK, s as JWKSet, o as JWK_oct, q as JWK_Private, p as JWK_Public } from './unjwt.BsgIQHVD.mjs';
 
 /**
  * Apply default typ/cty semantics shared by JWS & JWE.
- * - If typ is undefined and payload is a non-Uint8Array object, set typ="at+jwt".
- * - If typ is "at+jwt" and payload is a non-Uint8Array object, ensure cty defaults to "application/json".
+ * - If typ is undefined and payload is a non-Uint8Array object, set typ="JWT".
+ * - If typ is "JWT" and payload is a non-Uint8Array object, ensure cty defaults to "application/json".
  */
 declare function applyTypCtyDefaults<T extends {
     typ?: string;
     cty?: string;
 }>(header: T, payload: unknown): T;
 /** Returns true when headers indicate JSON content. */
-declare function isJsonContent(header: {
+declare function isJWTContent(header: {
     typ?: string;
     cty?: string;
 } | undefined): boolean;
 /**
  * Given a decoded string and JOSE headers, return an object if JSON, otherwise the string.
  */
-declare function decodeMaybeJsonString<T = unknown>(decodedString: string, header: {
+declare function decodeMaybeJWTString<T = unknown>(decodedString: string, header: {
     typ?: string;
     cty?: string;
 } | undefined): T | string;
@@ -84,6 +84,20 @@ declare function isJWKSet(key: any): key is JWKSet;
 declare function assertCryptoKey(key: unknown): asserts key is CryptoKey;
 declare function isCryptoKey(key: unknown): key is CryptoKey;
 declare const isCryptoKeyPair: (key: any) => key is CryptoKeyPair;
+/** Returns true if the JWK is a symmetric (oct) key. */
+declare function isSymmetricJWK(key: unknown): key is JWK_oct;
+/** Returns true if the JWK is an asymmetric (RSA, EC, OKP) key. */
+declare function isAsymmetricJWK(key: unknown): key is JWK_oct;
+/**
+ * Type guard that checks if the provided JWK contains private key material.
+ * It relies purely on the presence of private components (e.g. "d"), not on the alg value.
+ */
+declare function isPrivateJWK(key: unknown): key is JWK_Private;
+/**
+ * Type guard that checks if the provided JWK is a public (asymmetric) key.
+ * This checks for the presence of public components and absence of private material.
+ */
+declare function isPublicJWK(key: unknown): key is JWK_Public;
 
 declare const index_applyTypCtyDefaults: typeof applyTypCtyDefaults;
 declare const index_assertCryptoKey: typeof assertCryptoKey;
@@ -93,15 +107,19 @@ declare const index_base64UrlDecode: typeof base64UrlDecode;
 declare const index_base64UrlEncode: typeof base64UrlEncode;
 declare const index_computeJwtTimeClaims: typeof computeJwtTimeClaims;
 declare const index_concatUint8Arrays: typeof concatUint8Arrays;
-declare const index_decodeMaybeJsonString: typeof decodeMaybeJsonString;
+declare const index_decodeMaybeJWTString: typeof decodeMaybeJWTString;
 declare const index_decodePayloadFromB64UrlSegment: typeof decodePayloadFromB64UrlSegment;
 declare const index_decodePayloadFromBytes: typeof decodePayloadFromBytes;
 declare const index_getPlaintextBytes: typeof getPlaintextBytes;
+declare const index_isAsymmetricJWK: typeof isAsymmetricJWK;
 declare const index_isCryptoKey: typeof isCryptoKey;
 declare const index_isCryptoKeyPair: typeof isCryptoKeyPair;
 declare const index_isJWK: typeof isJWK;
 declare const index_isJWKSet: typeof isJWKSet;
-declare const index_isJsonContent: typeof isJsonContent;
+declare const index_isJWTContent: typeof isJWTContent;
+declare const index_isPrivateJWK: typeof isPrivateJWK;
+declare const index_isPublicJWK: typeof isPublicJWK;
+declare const index_isSymmetricJWK: typeof isSymmetricJWK;
 declare const index_maybeArray: typeof maybeArray;
 declare const index_randomBytes: typeof randomBytes;
 declare const index_sanitizeObject: typeof sanitizeObject;
@@ -120,15 +138,19 @@ declare namespace index {
     index_base64UrlEncode as base64UrlEncode,
     index_computeJwtTimeClaims as computeJwtTimeClaims,
     index_concatUint8Arrays as concatUint8Arrays,
-    index_decodeMaybeJsonString as decodeMaybeJsonString,
+    index_decodeMaybeJWTString as decodeMaybeJWTString,
     index_decodePayloadFromB64UrlSegment as decodePayloadFromB64UrlSegment,
     index_decodePayloadFromBytes as decodePayloadFromBytes,
     index_getPlaintextBytes as getPlaintextBytes,
+    index_isAsymmetricJWK as isAsymmetricJWK,
     index_isCryptoKey as isCryptoKey,
     index_isCryptoKeyPair as isCryptoKeyPair,
     index_isJWK as isJWK,
     index_isJWKSet as isJWKSet,
-    index_isJsonContent as isJsonContent,
+    index_isJWTContent as isJWTContent,
+    index_isPrivateJWK as isPrivateJWK,
+    index_isPublicJWK as isPublicJWK,
+    index_isSymmetricJWK as isSymmetricJWK,
     index_maybeArray as maybeArray,
     index_randomBytes as randomBytes,
     index_sanitizeObject as sanitizeObject,
@@ -140,4 +162,4 @@ declare namespace index {
   };
 }
 
-export { textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, isJWKSet as h, index as i, assertCryptoKey as j, isCryptoKey as k, isCryptoKeyPair as l, maybeArray as m, applyTypCtyDefaults as n, isJsonContent as o, decodeMaybeJsonString as p, decodePayloadFromBytes as q, randomBytes as r, decodePayloadFromB64UrlSegment as s, textEncoder as t, getPlaintextBytes as u, computeJwtTimeClaims as v, validateJwtClaims as w, validateCriticalHeadersJWS as x, validateCriticalHeadersJWE as y, sanitizeObject as z };
+export { validateJwtClaims as A, validateCriticalHeadersJWS as B, validateCriticalHeadersJWE as C, sanitizeObject as D, textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, isJWKSet as h, index as i, assertCryptoKey as j, isCryptoKey as k, isCryptoKeyPair as l, maybeArray as m, isSymmetricJWK as n, isAsymmetricJWK as o, isPrivateJWK as p, isPublicJWK as q, randomBytes as r, applyTypCtyDefaults as s, textEncoder as t, isJWTContent as u, decodeMaybeJWTString as v, decodePayloadFromBytes as w, decodePayloadFromB64UrlSegment as x, getPlaintextBytes as y, computeJwtTimeClaims as z };

package/dist/shared/{unjwt.CX8WRx20.mjs → unjwt.D1MC63Yb.mjs}

@@ -1,4 +1,4 @@
-import { m as isCryptoKey, k as concatUint8Arrays, d as base64UrlEncode, q as base64Decode, u as base64Encode, s as sanitizeObject, t as textEncoder, r as randomBytes, a as isJWK, f as base64UrlDecode, g as isJWKSet } from './unjwt.mBSKL6g4.mjs';
+import { m as isCryptoKey, k as concatUint8Arrays, d as base64UrlEncode, q as base64Decode, u as base64Encode, s as sanitizeObject, t as textEncoder, r as randomBytes, a as isJWK, f as base64UrlDecode, g as isJWKSet } from './unjwt.CRHfsi7v.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -830,7 +830,10 @@ function subtleMapping(jwk) {
         case "ECDH-ES+A128KW":
         case "ECDH-ES+A192KW":
         case "ECDH-ES+A256KW": {
-          algorithm = { name: "ECDH", namedCurve: jwk.crv };
+          algorithm = {
+            name: "ECDH",
+            namedCurve: jwk.crv
+          };
           keyUsages = jwk.d ? ["deriveBits"] : [];
           break;
         }
@@ -1024,7 +1027,7 @@ async function _unwrap(alg, key, encryptedKey) {
 }
 
 async function generateKey(alg, options = {}) {
-  const exportToJWK = options.toJWK === true;
+  const exportToJWK = options.toJWK !== void 0 && options.toJWK !== false;
   const defaultExtractable = options.extractable !== false;
   if (alg === "A128CBC-HS256" || alg === "A192CBC-HS384" || alg === "A256CBC-HS512") {
     const keyLength = bitLengthCEK(alg);
@@ -1041,12 +1044,19 @@ async function generateKey(alg, options = {}) {
     keyUsages
   );
   if (exportToJWK) {
+    const {
+      alg: _a,
+      kty: _k,
+      key_ops: _ko,
+      ext: _e,
+      ...additionalKeyParams
+    } = typeof options.toJWK === "object" ? options.toJWK : {};
     if (key instanceof CryptoKey) {
-      return exportKey(key, { alg });
+      return exportKey(key, { ...additionalKeyParams, alg });
     } else {
       const [publicKey, privateKey] = await Promise.all([
-        exportKey(key.publicKey, { alg }),
-        exportKey(key.privateKey, { alg })
+        exportKey(key.publicKey, { ...additionalKeyParams, alg }),
+        exportKey(key.privateKey, { ...additionalKeyParams, alg })
       ]);
       return { privateKey, publicKey };
     }
@@ -1118,7 +1128,7 @@ async function importKey(key, alg) {
 async function exportKey(key, jwk) {
   const exportedJwk = await keyToJWK(key);
   if (jwk) {
-    return { ...exportedJwk, ...sanitizeObject(jwk) };
+    return { ...sanitizeObject(jwk), ...exportedJwk };
   }
   return exportedJwk;
 }

package/dist/shared/{unjwt.C6flzAeB.mjs → unjwt.u3h40Nr-.mjs}

@@ -1,6 +1,6 @@
-import { i as importKey, g as getJWKFromSet } from './unjwt.CX8WRx20.mjs';
-import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, e as textDecoder, f as base64UrlDecode, g as isJWKSet, h as decodePayloadFromB64UrlSegment, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './unjwt.mBSKL6g4.mjs';
-import { s as sign$1, v as verify$1 } from './unjwt.DFAKwqBz.mjs';
+import { i as importKey, g as getJWKFromSet } from './unjwt.D1MC63Yb.mjs';
+import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, e as textDecoder, f as base64UrlDecode, g as isJWKSet, h as decodePayloadFromB64UrlSegment, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './unjwt.CRHfsi7v.mjs';
+import { s as sign$1, v as verify$1 } from './unjwt.BpusjhPR.mjs';
 
 async function sign(payload, key, options = {}) {
   const { protectedHeader: additionalProtectedHeader } = options;
@@ -130,7 +130,7 @@ async function verify(jws, key, options = {}) {
     ...options.critical || [],
     ...options.requiredHeaders || []
   ]);
-  if (payload && typeof payload === "object" && (protectedHeader.typ === "at+jwt" || protectedHeader.typ === "JWT") && !options.forceUint8Array) {
+  if (payload && typeof payload === "object" && options.validateJWT !== false && (options.validateJWT === true || protectedHeader.typ?.toLowerCase().includes("jwt")) && !options.forceUint8Array && !(payload instanceof Uint8Array)) {
     validateJwtClaims(payload, options);
   }
   return {

package/dist/utils.d.mts

@@ -1,2 +1,2 @@
-import './shared/unjwt.CN1C8TlR.mjs';
-export { n as applyTypCtyDefaults, j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, v as computeJwtTimeClaims, f as concatUint8Arrays, p as decodeMaybeJsonString, s as decodePayloadFromB64UrlSegment, q as decodePayloadFromBytes, u as getPlaintextBytes, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, o as isJsonContent, m as maybeArray, r as randomBytes, z as sanitizeObject, a as textDecoder, t as textEncoder, y as validateCriticalHeadersJWE, x as validateCriticalHeadersJWS, w as validateJwtClaims } from './shared/unjwt.Cay_cOOI.mjs';
+import './shared/unjwt.BsgIQHVD.mjs';
+export { s as applyTypCtyDefaults, j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, z as computeJwtTimeClaims, f as concatUint8Arrays, v as decodeMaybeJWTString, x as decodePayloadFromB64UrlSegment, w as decodePayloadFromBytes, y as getPlaintextBytes, o as isAsymmetricJWK, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, u as isJWTContent, p as isPrivateJWK, q as isPublicJWK, n as isSymmetricJWK, m as maybeArray, r as randomBytes, D as sanitizeObject, a as textDecoder, t as textEncoder, C as validateCriticalHeadersJWE, B as validateCriticalHeadersJWS, A as validateJwtClaims } from './shared/unjwt.CfL4cArP.mjs';

package/dist/utils.mjs

@@ -1 +1 @@
-export { b as applyTypCtyDefaults, l as assertCryptoKey, q as base64Decode, u as base64Encode, f as base64UrlDecode, d as base64UrlEncode, c as computeJwtTimeClaims, k as concatUint8Arrays, z as decodeMaybeJsonString, h as decodePayloadFromB64UrlSegment, o as decodePayloadFromBytes, n as getPlaintextBytes, m as isCryptoKey, x as isCryptoKeyPair, a as isJWK, g as isJWKSet, y as isJsonContent, w as maybeArray, r as randomBytes, s as sanitizeObject, e as textDecoder, t as textEncoder, p as validateCriticalHeadersJWE, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './shared/unjwt.mBSKL6g4.mjs';
+export { b as applyTypCtyDefaults, l as assertCryptoKey, q as base64Decode, u as base64Encode, f as base64UrlDecode, d as base64UrlEncode, c as computeJwtTimeClaims, k as concatUint8Arrays, D as decodeMaybeJWTString, h as decodePayloadFromB64UrlSegment, o as decodePayloadFromBytes, n as getPlaintextBytes, z as isAsymmetricJWK, m as isCryptoKey, x as isCryptoKeyPair, a as isJWK, g as isJWKSet, C as isJWTContent, A as isPrivateJWK, B as isPublicJWK, y as isSymmetricJWK, w as maybeArray, r as randomBytes, s as sanitizeObject, e as textDecoder, t as textEncoder, p as validateCriticalHeadersJWE, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './shared/unjwt.CRHfsi7v.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.13",
+  "version": "0.5.15",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",
@@ -47,20 +47,21 @@
     "release": "pnpm test && pnpm prepack && changelogen --release --push --publish",
     "test": "pnpm lint && pnpm test:types && vitest run --slowTestThreshold=500",
     "test:coverage": "pnpm lint && pnpm test:types && vitest run --coverage --slowTestThreshold=500",
-    "test:types": "tsc --noEmit --skipLibCheck"
+    "test:types": "tsc --noEmit --skipLibCheck",
+    "bench": "vitest bench --run"
   },
   "devDependencies": {
-    "@types/node": "^22.13.14",
+    "@types/node": "^22",
     "@vitest/coverage-v8": "^3.2.4",
-    "automd": "^0.4.0",
+    "automd": "^0.4.2",
     "changelogen": "^0.6.2",
-    "eslint": "^9.34.0",
+    "eslint": "^9.36.0",
     "eslint-config-unjs": "^0.5.0",
-    "jose": "^6.0.13",
+    "jose": "^6.1.0",
     "prettier": "^3.6.2",
     "typescript": "^5.9.2",
     "unbuild": "^3.6.1",
     "vitest": "^3.2.4"
   },
-  "packageManager": "pnpm@10.15.0"
+  "packageManager": "pnpm@10.17.1"
 }