unjwt 0.5.14 → 0.5.15

package/README.md

@@ -111,7 +111,7 @@ Creates a JWS token.
 - `key`: The signing key (`CryptoKey`, `JWK`, or `Uint8Array` for symmetric keys).
 - `options`:
   - `alg`: (Required) The JWS algorithm (e.g., `"HS256"`, `"RS256"`, `"ES256"`, `"PS256"`).
-  - `protectedHeader`: An object for additional JWS Protected Header parameters (e.g., `kid`, `typ`, `cty`, `crit`, `b64`). If `payload` is an object and `typ` is not set, it defaults to `"at+jwt"`. The `b64` parameter ([RFC7797 section-3](https://datatracker.ietf.org/doc/html/rfc7797#section-3)) controls payload encoding (defaults to `true`, meaning Base64URL encoded).
+  - `protectedHeader`: An object for additional JWS Protected Header parameters (e.g., `kid`, `typ`, `cty`, `crit`, `b64`). If `payload` is an object and `typ` is not set, it defaults to `"JWT"`. The `b64` parameter ([RFC7797 section-3](https://datatracker.ietf.org/doc/html/rfc7797#section-3)) controls payload encoding (defaults to `true`, meaning Base64URL encoded).
   - `expiresIn`: Sets an expiration time in seconds (e.g., `3600` for 1 hour). If `iat` is missing it will be set to the current time. If `exp` is missing it will be set to `iat + expiresIn`. This is only applied if `payload` is a JWT.
   - `currentDate`: The current date for computing `expiresIn` option. Defaults to `new Date()`.
 
@@ -155,6 +155,7 @@ Verifies a JWS token.
   A `KeyLookupFunction` has the signature `(header: JWSProtectedHeader, jws: string) => Promise<CryptoKey | JWK | JWKSet | Uint8Array> | CryptoKey | JWK | JWKSet | Uint8Array`.
 - `options` (optional):
   - `algorithms`: An array of allowed JWS `alg` values. If not provided, the `alg` from the JWS header is used.
+  - `validateJWT`: Unless false, will parse payload as JWT and validate claims if applicable (typ includes "jwt", case insensitive). Default `undefined`.
   - `critical`: An array of JWS header parameter names that the application understands and processes.
 
 Returns a `Promise<JWSVerifyResult<T>>` which is an object `{ payload: T, protectedHeader: JWSProtectedHeader }`.
@@ -170,7 +171,7 @@ const secret = "supersecretkey";
 
 const { payload, protectedHeader } = await verify(token, secret);
 console.log(payload); // { message: "My important data" }
-console.log(protectedHeader); // { alg: "HS256", typ: "at+jwt" }
+console.log(protectedHeader); // { alg: "HS256", typ: "JWT" }
 ```
 
 **Example (RS256 with key lookup):**
@@ -210,7 +211,7 @@ Encrypts data to produce a JWE token.
 - `options`:
   - `alg`: (Required) The JWE Key Management algorithm (e.g., `"A128KW"`, `"RSA-OAEP-256"`, `"PBES2-HS256+A128KW"`, `"ECDH-ES+A128KW"`), defaults depends on the key provided.
   - `enc`: (Required) The JWE Content Encryption algorithm (e.g., `"A128GCM"`, `"A256CBC-HS512"`), defaults depends on the key provided.
-  - `protectedHeader`: An object for JWE Protected Header parameters (e.g., `kid`, `typ`, `cty`, `crit`, `apu`, `apv`, `p2s`, `p2c`). If `payload` is an object and `typ` is not set, it defaults to `"at+jwt"`.
+  - `protectedHeader`: An object for JWE Protected Header parameters (e.g., `kid`, `typ`, `cty`, `crit`, `apu`, `apv`, `p2s`, `p2c`). If `payload` is an object and `typ` is not set, it defaults to `"JWT"`.
   - `cek`: (Optional) Provide your own Content Encryption Key (`CryptoKey` or `Uint8Array`).
   - `contentEncryptionIV`: (Optional) Provide your own Initialization Vector for content encryption (`Uint8Array`).
   - Other algorithm-specific options like `p2s`, `p2c` (for PBES2), `keyManagementIV`, `ecdhPartyUInfo`, `ecdhPartyVInfo`.
@@ -259,6 +260,7 @@ Decrypts a JWE token.
   A `JWEKeyLookupFunction` has the signature `(header: JWEHeaderParameters) => Promise<CryptoKey | JWK | string | Uint8Array> | CryptoKey | JWK | string | Uint8Array`.
 - `options` (optional):
   - `algorithms`: Array of allowed JWE Key Management `alg` values.
+  - `validateJWT`: Unless false, will parse payload as JWT and validate claims if applicable (typ includes "jwt", case insensitive). Default `undefined`.
   - `encryptionAlgorithms`: Array of allowed JWE Content Encryption `enc` values.
   - `critical`: Array of JWE header parameter names that the application understands.
   - `unwrappedKeyAlgorithm`: (For `unwrapKey` internally) Algorithm details for the CEK after unwrapping.

package/dist/index.d.mts

@@ -1,5 +1,5 @@
 export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, r as JWK, M as JWKAlgorithm, N as JWKPEMAlgorithm, J as JWKParameters, s as JWKSet, A as JWK_AES_CBC_HMAC, B as JWK_AES_GCM, z as JWK_AES_GCM_KW, y as JWK_AES_KW, L as JWK_Asymmetric_Algorithm, h as JWK_EC, F as JWK_ECDH_ES, w as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, t as JWK_HMAC, n as JWK_OKP, m as JWK_OKP_Private, l as JWK_OKP_Public, H as JWK_OKP_SIGN, E as JWK_PBES2, q as JWK_Private, p as JWK_Public, k as JWK_RSA, x as JWK_RSA_ENC, v as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, u as JWK_RSA_SIGN, I as JWK_Symmetric_Algorithm, o as JWK_oct, Q as JWT, R as JWTClaimValidationOptions, P as JWTClaims, O as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.BsgIQHVD.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.qWts1U9J.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.Cf7vmOhS.mjs';
-export { i as utils } from './shared/unjwt.BYaxDvLV.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.Bw4pzdE0.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.BeWVYyaf.mjs';
+export { i as utils } from './shared/unjwt.CfL4cArP.mjs';
 export { j as jwk } from './shared/unjwt.C6b_GyXm.mjs';

package/dist/index.mjs

@@ -1,5 +1,5 @@
-export { i as utils } from './shared/unjwt.BEjwP_9W.mjs';
-export { j as jwe } from './shared/unjwt.B8wnSUll.mjs';
-export { j as jwk } from './shared/unjwt.BVlHlXdP.mjs';
-export { j as jws } from './shared/unjwt.skuKf53c.mjs';
-import './shared/unjwt.BaB7HUR1.mjs';
+export { i as utils } from './shared/unjwt.CRHfsi7v.mjs';
+export { j as jwe } from './shared/unjwt.BZ3B0Ak8.mjs';
+export { j as jwk } from './shared/unjwt.D1MC63Yb.mjs';
+export { j as jws } from './shared/unjwt.u3h40Nr-.mjs';
+import './shared/unjwt.BpusjhPR.mjs';

package/dist/jwe.d.mts

@@ -1,2 +1,2 @@
 export { Q as JWT, R as JWTClaimValidationOptions, P as JWTClaims, O as JoseHeaderParameters } from './shared/unjwt.BsgIQHVD.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.Cf7vmOhS.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.BeWVYyaf.mjs';

package/dist/jwe.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.BVlHlXdP.mjs';
-import './shared/unjwt.BEjwP_9W.mjs';
-export { d as decrypt, e as encrypt } from './shared/unjwt.B8wnSUll.mjs';
-import './shared/unjwt.BaB7HUR1.mjs';
+import './shared/unjwt.D1MC63Yb.mjs';
+import './shared/unjwt.CRHfsi7v.mjs';
+export { d as decrypt, e as encrypt } from './shared/unjwt.BZ3B0Ak8.mjs';
+import './shared/unjwt.BpusjhPR.mjs';

package/dist/jwk.mjs

@@ -1,2 +1,2 @@
-import './shared/unjwt.BEjwP_9W.mjs';
-export { p as deriveKeyFromPassword, t as exportJWKToPEM, q as exportKey, o as generateKey, g as getJWKFromSet, s as importJWKFromPEM, i as importKey, m as unwrapKey, r as wrapKey } from './shared/unjwt.BVlHlXdP.mjs';
+import './shared/unjwt.CRHfsi7v.mjs';
+export { p as deriveKeyFromPassword, t as exportJWKToPEM, q as exportKey, o as generateKey, g as getJWKFromSet, s as importJWKFromPEM, i as importKey, m as unwrapKey, r as wrapKey } from './shared/unjwt.D1MC63Yb.mjs';

package/dist/jws.d.mts

@@ -1,2 +1,2 @@
 export { Q as JWT, R as JWTClaimValidationOptions, P as JWTClaims, O as JoseHeaderParameters } from './shared/unjwt.BsgIQHVD.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.qWts1U9J.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.Bw4pzdE0.mjs';

package/dist/jws.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.BVlHlXdP.mjs';
-import './shared/unjwt.BEjwP_9W.mjs';
-import './shared/unjwt.BaB7HUR1.mjs';
-export { s as sign, v as verify } from './shared/unjwt.skuKf53c.mjs';
+import './shared/unjwt.D1MC63Yb.mjs';
+import './shared/unjwt.CRHfsi7v.mjs';
+import './shared/unjwt.BpusjhPR.mjs';
+export { s as sign, v as verify } from './shared/unjwt.u3h40Nr-.mjs';

package/dist/shared/{unjwt.B8wnSUll.mjs → unjwt.BZ3B0Ak8.mjs}

@@ -1,6 +1,6 @@
-import { a as checkEncCryptoKey, u as uint32be, b as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, d as bitLengthCEK, f as jwkTokey, i as importKey, h as generateIV, l as encrypt$1, m as unwrapKey, n as decrypt$1 } from './unjwt.BVlHlXdP.mjs';
-import { k as concatUint8Arrays, t as textEncoder, l as assertCryptoKey, d as base64UrlEncode, m as isCryptoKey, a as isJWK, s as sanitizeObject, f as base64UrlDecode, r as randomBytes, b as applyTypCtyDefaults, c as computeJwtTimeClaims, n as getPlaintextBytes, o as decodePayloadFromBytes, p as validateCriticalHeadersJWE } from './unjwt.BEjwP_9W.mjs';
-import { c as checkKeyLength } from './unjwt.BaB7HUR1.mjs';
+import { a as checkEncCryptoKey, u as uint32be, b as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, d as bitLengthCEK, f as jwkTokey, i as importKey, h as generateIV, l as encrypt$1, m as unwrapKey, n as decrypt$1 } from './unjwt.D1MC63Yb.mjs';
+import { k as concatUint8Arrays, t as textEncoder, l as assertCryptoKey, d as base64UrlEncode, m as isCryptoKey, a as isJWK, s as sanitizeObject, f as base64UrlDecode, r as randomBytes, b as applyTypCtyDefaults, c as computeJwtTimeClaims, n as getPlaintextBytes, o as decodePayloadFromBytes, p as validateCriticalHeadersJWE, j as validateJwtClaims } from './unjwt.CRHfsi7v.mjs';
+import { c as checkKeyLength } from './unjwt.BpusjhPR.mjs';
 
 function lengthAndInput(input) {
   return concatUint8Arrays(uint32be(input.length), input);
@@ -293,7 +293,7 @@ async function encrypt(payload, key, options = {}) {
   ];
   return jweParts.join(".");
 }
-async function decrypt(jwe, key, options) {
+async function decrypt(jwe, key, options = {}) {
   const parts = jwe.split(".");
   if (parts.length !== 5) {
     throw new Error(
@@ -375,6 +375,9 @@ async function decrypt(jwe, key, options) {
     ...options?.critical || [],
     ...options?.requiredHeaders || []
   ]);
+  if (payload && typeof payload === "object" && options.validateJWT !== false && (options.validateJWT === true || protectedHeader.typ?.toLowerCase().includes("jwt")) && !options.forceUint8Array && !(payload instanceof Uint8Array)) {
+    validateJwtClaims(payload, options);
+  }
   return {
     payload,
     protectedHeader,

package/dist/shared/{unjwt.Cf7vmOhS.d.mts → unjwt.BeWVYyaf.d.mts}

@@ -72,7 +72,7 @@ interface JWEEncryptOptions {
     enc?: ContentEncryptionAlgorithm;
     /** Date to use when computing NumericDate claims, defaults to `new Date()`. */
     currentDate?: Date;
-    /** Time at which the JWT should expire, if no `exp` was already provided (only when typ is "at+jwt"). */
+    /** Time at which the JWT should expire, if no `exp` was already provided (only when typ is "JWT" or explicitly parsing JWT). */
     expiresIn?: number;
     /** Additional JWE Protected Header parameters. */
     protectedHeader?: Omit<JWEHeaderParameters, "alg" | "enc" | "iv" | "tag" | "p2s" | "p2c" | "apu" | "apv">;
@@ -119,6 +119,8 @@ interface JWEDecryptOptions extends JWTClaimValidationOptions {
     extractable?: boolean;
     /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred based on JWE headers. */
     forceUint8Array?: boolean;
+    /** Unless false, will parse payload as JWT and validate claims if applicable (typ "JWT"). */
+    validateJWT?: boolean;
 }
 /**
  * Result of a JWE decryption operation.

package/dist/shared/{unjwt.BaB7HUR1.mjs → unjwt.BpusjhPR.mjs}

@@ -1,4 +1,4 @@
-import { c as checkSigCryptoKey } from './unjwt.BVlHlXdP.mjs';
+import { c as checkSigCryptoKey } from './unjwt.D1MC63Yb.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.

package/dist/shared/{unjwt.qWts1U9J.d.mts → unjwt.Bw4pzdE0.d.mts}

@@ -27,7 +27,7 @@ interface JWSSignOptions {
     alg?: JWSAlgorithm;
     /**
      * Additional protected header parameters. `alg` is automatically included.
-     * `typ` defaults to "at+jwt" if not provided.
+     * `typ` defaults to "JWT" if not provided and payload is an object.
      */
     protectedHeader?: JWSHeaderParameters;
     /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
@@ -50,6 +50,8 @@ interface JWSVerifyOptions extends JWTClaimValidationOptions {
     algorithms?: JWSAlgorithm[];
     /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred. */
     forceUint8Array?: boolean;
+    /** Unless false, will parse payload as JWT and validate claims if applicable (typ "JWT"). */
+    validateJWT?: boolean;
 }
 /**
  * Key lookup function for JWS verification.

package/dist/shared/{unjwt.BEjwP_9W.mjs → unjwt.CRHfsi7v.mjs}

@@ -1,22 +1,21 @@
 function applyTypCtyDefaults(header, payload) {
   const isObjectPayload = typeof payload === "object" && payload !== null && !(payload instanceof Uint8Array);
   if (header.typ === void 0 && isObjectPayload) {
-    header.typ = "at+jwt";
+    header.typ = "JWT";
   }
-  if ((header.typ === "at+jwt" || header.typ === "JWT") && isObjectPayload) {
+  if (header.typ?.toLowerCase().includes("jwt") && isObjectPayload) {
     header.cty ||= "application/json";
   }
   return header;
 }
-function isJsonContent(header) {
+function isJWTContent(header) {
   if (!header) return false;
-  if (header.typ === "at+jwt") return true;
-  if (header.typ === "JWT") return true;
+  if (header.typ?.toLowerCase().includes("jwt")) return true;
   const cty = header.cty?.toLowerCase();
   return cty === "json" || cty === "application/json" || !!cty && cty.endsWith("+json");
 }
-function decodeMaybeJsonString(decodedString, header) {
-  if (isJsonContent(header)) {
+function decodeMaybeJWTString(decodedString, header) {
+  if (isJWTContent(header)) {
     const looksLikeJson = decodedString.startsWith("{") && decodedString.endsWith("}") || decodedString.startsWith("[") && decodedString.endsWith("]");
     if (looksLikeJson) {
       try {
@@ -31,12 +30,12 @@ function decodeMaybeJsonString(decodedString, header) {
 function decodePayloadFromBytes(bytes, header, forceUint8Array) {
   if (forceUint8Array) return bytes;
   const decodedString = textDecoder.decode(bytes);
-  return decodeMaybeJsonString(decodedString, header);
+  return decodeMaybeJWTString(decodedString, header);
 }
 function decodePayloadFromB64UrlSegment(payloadEncoded, header, forceUint8Array) {
   if (forceUint8Array) return base64UrlDecode(payloadEncoded, false);
   const decodedString = base64UrlDecode(payloadEncoded);
-  return decodeMaybeJsonString(decodedString, header);
+  return decodeMaybeJWTString(decodedString, header);
 }
 function getPlaintextBytes(payload) {
   if (payload instanceof Uint8Array) return payload;
@@ -48,13 +47,13 @@ function getPlaintextBytes(payload) {
   );
 }
 function computeJwtTimeClaims(payload, headerTyp, expiresIn, currentDate = /* @__PURE__ */ new Date()) {
-  if (expiresIn === void 0 || headerTyp !== "at+jwt" && headerTyp !== "JWT" || !(payload && typeof payload === "object") || payload instanceof Uint8Array || payload.exp) {
+  if (expiresIn === void 0 || !headerTyp?.toLowerCase().includes("jwt") || !(payload && typeof payload === "object") || payload instanceof Uint8Array || payload.exp) {
     return void 0;
   }
   const now = Math.round(currentDate.getTime() / 1e3);
   const claims = { ...payload };
   claims.iat ||= now;
-  claims.exp = now + expiresIn;
+  claims.exp = claims.iat + expiresIn;
   return claims;
 }
 function validateJwtClaims(jwtClaims, options = {}) {
@@ -362,7 +361,7 @@ const index = {
   base64UrlEncode: base64UrlEncode,
   computeJwtTimeClaims: computeJwtTimeClaims,
   concatUint8Arrays: concatUint8Arrays,
-  decodeMaybeJsonString: decodeMaybeJsonString,
+  decodeMaybeJWTString: decodeMaybeJWTString,
   decodePayloadFromB64UrlSegment: decodePayloadFromB64UrlSegment,
   decodePayloadFromBytes: decodePayloadFromBytes,
   getPlaintextBytes: getPlaintextBytes,
@@ -371,7 +370,7 @@ const index = {
   isCryptoKeyPair: isCryptoKeyPair,
   isJWK: isJWK,
   isJWKSet: isJWKSet,
-  isJsonContent: isJsonContent,
+  isJWTContent: isJWTContent,
   isPrivateJWK: isPrivateJWK,
   isPublicJWK: isPublicJWK,
   isSymmetricJWK: isSymmetricJWK,
@@ -385,4 +384,4 @@ const index = {
   validateJwtClaims: validateJwtClaims
 };
 
-export { isPrivateJWK as A, isPublicJWK as B, isJsonContent as C, decodeMaybeJsonString as D, isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, textDecoder as e, base64UrlDecode as f, isJWKSet as g, decodePayloadFromB64UrlSegment as h, index as i, validateJwtClaims as j, concatUint8Arrays as k, assertCryptoKey as l, isCryptoKey as m, getPlaintextBytes as n, decodePayloadFromBytes as o, validateCriticalHeadersJWE as p, base64Decode as q, randomBytes as r, sanitizeObject as s, textEncoder as t, base64Encode as u, validateCriticalHeadersJWS as v, maybeArray as w, isCryptoKeyPair as x, isSymmetricJWK as y, isAsymmetricJWK as z };
+export { isPrivateJWK as A, isPublicJWK as B, isJWTContent as C, decodeMaybeJWTString as D, isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, textDecoder as e, base64UrlDecode as f, isJWKSet as g, decodePayloadFromB64UrlSegment as h, index as i, validateJwtClaims as j, concatUint8Arrays as k, assertCryptoKey as l, isCryptoKey as m, getPlaintextBytes as n, decodePayloadFromBytes as o, validateCriticalHeadersJWE as p, base64Decode as q, randomBytes as r, sanitizeObject as s, textEncoder as t, base64Encode as u, validateCriticalHeadersJWS as v, maybeArray as w, isCryptoKeyPair as x, isSymmetricJWK as y, isAsymmetricJWK as z };

package/dist/shared/{unjwt.BYaxDvLV.d.mts → unjwt.CfL4cArP.d.mts}

@@ -2,22 +2,22 @@ import { P as JWTClaims, R as JWTClaimValidationOptions, r as JWK, s as JWKSet,
 
 /**
  * Apply default typ/cty semantics shared by JWS & JWE.
- * - If typ is undefined and payload is a non-Uint8Array object, set typ="at+jwt".
- * - If typ is "at+jwt" and payload is a non-Uint8Array object, ensure cty defaults to "application/json".
+ * - If typ is undefined and payload is a non-Uint8Array object, set typ="JWT".
+ * - If typ is "JWT" and payload is a non-Uint8Array object, ensure cty defaults to "application/json".
  */
 declare function applyTypCtyDefaults<T extends {
     typ?: string;
     cty?: string;
 }>(header: T, payload: unknown): T;
 /** Returns true when headers indicate JSON content. */
-declare function isJsonContent(header: {
+declare function isJWTContent(header: {
     typ?: string;
     cty?: string;
 } | undefined): boolean;
 /**
  * Given a decoded string and JOSE headers, return an object if JSON, otherwise the string.
  */
-declare function decodeMaybeJsonString<T = unknown>(decodedString: string, header: {
+declare function decodeMaybeJWTString<T = unknown>(decodedString: string, header: {
     typ?: string;
     cty?: string;
 } | undefined): T | string;
@@ -107,7 +107,7 @@ declare const index_base64UrlDecode: typeof base64UrlDecode;
 declare const index_base64UrlEncode: typeof base64UrlEncode;
 declare const index_computeJwtTimeClaims: typeof computeJwtTimeClaims;
 declare const index_concatUint8Arrays: typeof concatUint8Arrays;
-declare const index_decodeMaybeJsonString: typeof decodeMaybeJsonString;
+declare const index_decodeMaybeJWTString: typeof decodeMaybeJWTString;
 declare const index_decodePayloadFromB64UrlSegment: typeof decodePayloadFromB64UrlSegment;
 declare const index_decodePayloadFromBytes: typeof decodePayloadFromBytes;
 declare const index_getPlaintextBytes: typeof getPlaintextBytes;
@@ -116,7 +116,7 @@ declare const index_isCryptoKey: typeof isCryptoKey;
 declare const index_isCryptoKeyPair: typeof isCryptoKeyPair;
 declare const index_isJWK: typeof isJWK;
 declare const index_isJWKSet: typeof isJWKSet;
-declare const index_isJsonContent: typeof isJsonContent;
+declare const index_isJWTContent: typeof isJWTContent;
 declare const index_isPrivateJWK: typeof isPrivateJWK;
 declare const index_isPublicJWK: typeof isPublicJWK;
 declare const index_isSymmetricJWK: typeof isSymmetricJWK;
@@ -138,7 +138,7 @@ declare namespace index {
     index_base64UrlEncode as base64UrlEncode,
     index_computeJwtTimeClaims as computeJwtTimeClaims,
     index_concatUint8Arrays as concatUint8Arrays,
-    index_decodeMaybeJsonString as decodeMaybeJsonString,
+    index_decodeMaybeJWTString as decodeMaybeJWTString,
     index_decodePayloadFromB64UrlSegment as decodePayloadFromB64UrlSegment,
     index_decodePayloadFromBytes as decodePayloadFromBytes,
     index_getPlaintextBytes as getPlaintextBytes,
@@ -147,7 +147,7 @@ declare namespace index {
     index_isCryptoKeyPair as isCryptoKeyPair,
     index_isJWK as isJWK,
     index_isJWKSet as isJWKSet,
-    index_isJsonContent as isJsonContent,
+    index_isJWTContent as isJWTContent,
     index_isPrivateJWK as isPrivateJWK,
     index_isPublicJWK as isPublicJWK,
     index_isSymmetricJWK as isSymmetricJWK,
@@ -162,4 +162,4 @@ declare namespace index {
   };
 }
 
-export { validateJwtClaims as A, validateCriticalHeadersJWS as B, validateCriticalHeadersJWE as C, sanitizeObject as D, textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, isJWKSet as h, index as i, assertCryptoKey as j, isCryptoKey as k, isCryptoKeyPair as l, maybeArray as m, isSymmetricJWK as n, isAsymmetricJWK as o, isPrivateJWK as p, isPublicJWK as q, randomBytes as r, applyTypCtyDefaults as s, textEncoder as t, isJsonContent as u, decodeMaybeJsonString as v, decodePayloadFromBytes as w, decodePayloadFromB64UrlSegment as x, getPlaintextBytes as y, computeJwtTimeClaims as z };
+export { validateJwtClaims as A, validateCriticalHeadersJWS as B, validateCriticalHeadersJWE as C, sanitizeObject as D, textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, isJWKSet as h, index as i, assertCryptoKey as j, isCryptoKey as k, isCryptoKeyPair as l, maybeArray as m, isSymmetricJWK as n, isAsymmetricJWK as o, isPrivateJWK as p, isPublicJWK as q, randomBytes as r, applyTypCtyDefaults as s, textEncoder as t, isJWTContent as u, decodeMaybeJWTString as v, decodePayloadFromBytes as w, decodePayloadFromB64UrlSegment as x, getPlaintextBytes as y, computeJwtTimeClaims as z };

package/dist/shared/{unjwt.BVlHlXdP.mjs → unjwt.D1MC63Yb.mjs}

@@ -1,4 +1,4 @@
-import { m as isCryptoKey, k as concatUint8Arrays, d as base64UrlEncode, q as base64Decode, u as base64Encode, s as sanitizeObject, t as textEncoder, r as randomBytes, a as isJWK, f as base64UrlDecode, g as isJWKSet } from './unjwt.BEjwP_9W.mjs';
+import { m as isCryptoKey, k as concatUint8Arrays, d as base64UrlEncode, q as base64Decode, u as base64Encode, s as sanitizeObject, t as textEncoder, r as randomBytes, a as isJWK, f as base64UrlDecode, g as isJWKSet } from './unjwt.CRHfsi7v.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.

package/dist/shared/{unjwt.skuKf53c.mjs → unjwt.u3h40Nr-.mjs}

@@ -1,6 +1,6 @@
-import { i as importKey, g as getJWKFromSet } from './unjwt.BVlHlXdP.mjs';
-import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, e as textDecoder, f as base64UrlDecode, g as isJWKSet, h as decodePayloadFromB64UrlSegment, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './unjwt.BEjwP_9W.mjs';
-import { s as sign$1, v as verify$1 } from './unjwt.BaB7HUR1.mjs';
+import { i as importKey, g as getJWKFromSet } from './unjwt.D1MC63Yb.mjs';
+import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, e as textDecoder, f as base64UrlDecode, g as isJWKSet, h as decodePayloadFromB64UrlSegment, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './unjwt.CRHfsi7v.mjs';
+import { s as sign$1, v as verify$1 } from './unjwt.BpusjhPR.mjs';
 
 async function sign(payload, key, options = {}) {
   const { protectedHeader: additionalProtectedHeader } = options;
@@ -130,7 +130,7 @@ async function verify(jws, key, options = {}) {
     ...options.critical || [],
     ...options.requiredHeaders || []
   ]);
-  if (payload && typeof payload === "object" && (protectedHeader.typ === "at+jwt" || protectedHeader.typ === "JWT") && !options.forceUint8Array) {
+  if (payload && typeof payload === "object" && options.validateJWT !== false && (options.validateJWT === true || protectedHeader.typ?.toLowerCase().includes("jwt")) && !options.forceUint8Array && !(payload instanceof Uint8Array)) {
     validateJwtClaims(payload, options);
   }
   return {

package/dist/utils.d.mts

@@ -1,2 +1,2 @@
 import './shared/unjwt.BsgIQHVD.mjs';
-export { s as applyTypCtyDefaults, j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, z as computeJwtTimeClaims, f as concatUint8Arrays, v as decodeMaybeJsonString, x as decodePayloadFromB64UrlSegment, w as decodePayloadFromBytes, y as getPlaintextBytes, o as isAsymmetricJWK, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, u as isJsonContent, p as isPrivateJWK, q as isPublicJWK, n as isSymmetricJWK, m as maybeArray, r as randomBytes, D as sanitizeObject, a as textDecoder, t as textEncoder, C as validateCriticalHeadersJWE, B as validateCriticalHeadersJWS, A as validateJwtClaims } from './shared/unjwt.BYaxDvLV.mjs';
+export { s as applyTypCtyDefaults, j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, z as computeJwtTimeClaims, f as concatUint8Arrays, v as decodeMaybeJWTString, x as decodePayloadFromB64UrlSegment, w as decodePayloadFromBytes, y as getPlaintextBytes, o as isAsymmetricJWK, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, u as isJWTContent, p as isPrivateJWK, q as isPublicJWK, n as isSymmetricJWK, m as maybeArray, r as randomBytes, D as sanitizeObject, a as textDecoder, t as textEncoder, C as validateCriticalHeadersJWE, B as validateCriticalHeadersJWS, A as validateJwtClaims } from './shared/unjwt.CfL4cArP.mjs';

package/dist/utils.mjs

@@ -1 +1 @@
-export { b as applyTypCtyDefaults, l as assertCryptoKey, q as base64Decode, u as base64Encode, f as base64UrlDecode, d as base64UrlEncode, c as computeJwtTimeClaims, k as concatUint8Arrays, D as decodeMaybeJsonString, h as decodePayloadFromB64UrlSegment, o as decodePayloadFromBytes, n as getPlaintextBytes, z as isAsymmetricJWK, m as isCryptoKey, x as isCryptoKeyPair, a as isJWK, g as isJWKSet, C as isJsonContent, A as isPrivateJWK, B as isPublicJWK, y as isSymmetricJWK, w as maybeArray, r as randomBytes, s as sanitizeObject, e as textDecoder, t as textEncoder, p as validateCriticalHeadersJWE, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './shared/unjwt.BEjwP_9W.mjs';
+export { b as applyTypCtyDefaults, l as assertCryptoKey, q as base64Decode, u as base64Encode, f as base64UrlDecode, d as base64UrlEncode, c as computeJwtTimeClaims, k as concatUint8Arrays, D as decodeMaybeJWTString, h as decodePayloadFromB64UrlSegment, o as decodePayloadFromBytes, n as getPlaintextBytes, z as isAsymmetricJWK, m as isCryptoKey, x as isCryptoKeyPair, a as isJWK, g as isJWKSet, C as isJWTContent, A as isPrivateJWK, B as isPublicJWK, y as isSymmetricJWK, w as maybeArray, r as randomBytes, s as sanitizeObject, e as textDecoder, t as textEncoder, p as validateCriticalHeadersJWE, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './shared/unjwt.CRHfsi7v.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.14",
+  "version": "0.5.15",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",
@@ -47,20 +47,21 @@
     "release": "pnpm test && pnpm prepack && changelogen --release --push --publish",
     "test": "pnpm lint && pnpm test:types && vitest run --slowTestThreshold=500",
     "test:coverage": "pnpm lint && pnpm test:types && vitest run --coverage --slowTestThreshold=500",
-    "test:types": "tsc --noEmit --skipLibCheck"
+    "test:types": "tsc --noEmit --skipLibCheck",
+    "bench": "vitest bench --run"
   },
   "devDependencies": {
-    "@types/node": "^22.13.14",
+    "@types/node": "^22",
     "@vitest/coverage-v8": "^3.2.4",
-    "automd": "^0.4.0",
+    "automd": "^0.4.2",
     "changelogen": "^0.6.2",
-    "eslint": "^9.34.0",
+    "eslint": "^9.36.0",
     "eslint-config-unjs": "^0.5.0",
-    "jose": "^6.0.13",
+    "jose": "^6.1.0",
     "prettier": "^3.6.2",
     "typescript": "^5.9.2",
     "unbuild": "^3.6.1",
     "vitest": "^3.2.4"
   },
-  "packageManager": "pnpm@10.15.0"
+  "packageManager": "pnpm@10.17.1"
 }