unjwt 0.5.14 → 0.5.16

package/README.md

@@ -111,7 +111,7 @@ Creates a JWS token.
 - `key`: The signing key (`CryptoKey`, `JWK`, or `Uint8Array` for symmetric keys).
 - `options`:
   - `alg`: (Required) The JWS algorithm (e.g., `"HS256"`, `"RS256"`, `"ES256"`, `"PS256"`).
-  - `protectedHeader`: An object for additional JWS Protected Header parameters (e.g., `kid`, `typ`, `cty`, `crit`, `b64`). If `payload` is an object and `typ` is not set, it defaults to `"at+jwt"`. The `b64` parameter ([RFC7797 section-3](https://datatracker.ietf.org/doc/html/rfc7797#section-3)) controls payload encoding (defaults to `true`, meaning Base64URL encoded).
+  - `protectedHeader`: An object for additional JWS Protected Header parameters (e.g., `kid`, `typ`, `cty`, `crit`, `b64`). If `payload` is an object and `typ` is not set, it defaults to `"JWT"`. The `b64` parameter ([RFC7797 section-3](https://datatracker.ietf.org/doc/html/rfc7797#section-3)) controls payload encoding (defaults to `true`, meaning Base64URL encoded).
   - `expiresIn`: Sets an expiration time in seconds (e.g., `3600` for 1 hour). If `iat` is missing it will be set to the current time. If `exp` is missing it will be set to `iat + expiresIn`. This is only applied if `payload` is a JWT.
   - `currentDate`: The current date for computing `expiresIn` option. Defaults to `new Date()`.
 
@@ -123,9 +123,9 @@ Returns a `Promise<string>` resolving to the JWS token in Compact Serialization
 import { sign } from "unjwt/jws";
 
 const payload = { message: "My important data" }; // Object payload
-const secret = "supersecretkey"; // String secret, will be imported (length depends on choosen alg)
+const key = await generateKey("HS256", { toJWK: true }); // Generates a JWK_oct
 
-const token = await sign(payload, secret, { alg: "HS256" });
+const token = await sign(payload, key);
 
 console.log(token);
 // eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
@@ -155,6 +155,7 @@ Verifies a JWS token.
   A `KeyLookupFunction` has the signature `(header: JWSProtectedHeader, jws: string) => Promise<CryptoKey | JWK | JWKSet | Uint8Array> | CryptoKey | JWK | JWKSet | Uint8Array`.
 - `options` (optional):
   - `algorithms`: An array of allowed JWS `alg` values. If not provided, the `alg` from the JWS header is used.
+  - `validateJWT`: Unless false, will parse payload as JWT and validate claims if applicable (typ includes "jwt", case insensitive). Default `undefined`.
   - `critical`: An array of JWS header parameter names that the application understands and processes.
 
 Returns a `Promise<JWSVerifyResult<T>>` which is an object `{ payload: T, protectedHeader: JWSProtectedHeader }`.
@@ -170,7 +171,7 @@ const secret = "supersecretkey";
 
 const { payload, protectedHeader } = await verify(token, secret);
 console.log(payload); // { message: "My important data" }
-console.log(protectedHeader); // { alg: "HS256", typ: "at+jwt" }
+console.log(protectedHeader); // { alg: "HS256", typ: "JWT" }
 ```
 
 **Example (RS256 with key lookup):**
@@ -210,7 +211,7 @@ Encrypts data to produce a JWE token.
 - `options`:
   - `alg`: (Required) The JWE Key Management algorithm (e.g., `"A128KW"`, `"RSA-OAEP-256"`, `"PBES2-HS256+A128KW"`, `"ECDH-ES+A128KW"`), defaults depends on the key provided.
   - `enc`: (Required) The JWE Content Encryption algorithm (e.g., `"A128GCM"`, `"A256CBC-HS512"`), defaults depends on the key provided.
-  - `protectedHeader`: An object for JWE Protected Header parameters (e.g., `kid`, `typ`, `cty`, `crit`, `apu`, `apv`, `p2s`, `p2c`). If `payload` is an object and `typ` is not set, it defaults to `"at+jwt"`.
+  - `protectedHeader`: An object for JWE Protected Header parameters (e.g., `kid`, `typ`, `cty`, `crit`, `apu`, `apv`, `p2s`, `p2c`). If `payload` is an object and `typ` is not set, it defaults to `"JWT"`.
   - `cek`: (Optional) Provide your own Content Encryption Key (`CryptoKey` or `Uint8Array`).
   - `contentEncryptionIV`: (Optional) Provide your own Initialization Vector for content encryption (`Uint8Array`).
   - Other algorithm-specific options like `p2s`, `p2c` (for PBES2), `keyManagementIV`, `ecdhPartyUInfo`, `ecdhPartyVInfo`.
@@ -259,6 +260,7 @@ Decrypts a JWE token.
   A `JWEKeyLookupFunction` has the signature `(header: JWEHeaderParameters) => Promise<CryptoKey | JWK | string | Uint8Array> | CryptoKey | JWK | string | Uint8Array`.
 - `options` (optional):
   - `algorithms`: Array of allowed JWE Key Management `alg` values.
+  - `validateJWT`: Unless false, will parse payload as JWT and validate claims if applicable (typ includes "jwt", case insensitive). Default `undefined`.
   - `encryptionAlgorithms`: Array of allowed JWE Content Encryption `enc` values.
   - `critical`: Array of JWE header parameter names that the application understands.
   - `unwrappedKeyAlgorithm`: (For `unwrapKey` internally) Algorithm details for the CEK after unwrapping.

package/dist/index.d.mts

@@ -1,5 +1,5 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, r as JWK, M as JWKAlgorithm, N as JWKPEMAlgorithm, J as JWKParameters, s as JWKSet, A as JWK_AES_CBC_HMAC, B as JWK_AES_GCM, z as JWK_AES_GCM_KW, y as JWK_AES_KW, L as JWK_Asymmetric_Algorithm, h as JWK_EC, F as JWK_ECDH_ES, w as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, t as JWK_HMAC, n as JWK_OKP, m as JWK_OKP_Private, l as JWK_OKP_Public, H as JWK_OKP_SIGN, E as JWK_PBES2, q as JWK_Private, p as JWK_Public, k as JWK_RSA, x as JWK_RSA_ENC, v as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, u as JWK_RSA_SIGN, I as JWK_Symmetric_Algorithm, o as JWK_oct, Q as JWT, R as JWTClaimValidationOptions, P as JWTClaims, O as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.BsgIQHVD.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.qWts1U9J.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.Cf7vmOhS.mjs';
-export { i as utils } from './shared/unjwt.BYaxDvLV.mjs';
-export { j as jwk } from './shared/unjwt.C6b_GyXm.mjs';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, r as JWK, M as JWKAlgorithm, N as JWKPEMAlgorithm, J as JWKParameters, s as JWKSet, A as JWK_AES_CBC_HMAC, B as JWK_AES_GCM, z as JWK_AES_GCM_KW, y as JWK_AES_KW, L as JWK_Asymmetric_Algorithm, h as JWK_EC, F as JWK_ECDH_ES, w as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, t as JWK_HMAC, n as JWK_OKP, m as JWK_OKP_Private, l as JWK_OKP_Public, H as JWK_OKP_SIGN, E as JWK_PBES2, q as JWK_Private, p as JWK_Public, k as JWK_RSA, x as JWK_RSA_ENC, v as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, u as JWK_RSA_SIGN, I as JWK_Symmetric_Algorithm, o as JWK_oct, Q as JWT, R as JWTClaimValidationOptions, P as JWTClaims, O as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.OzI0aGB_.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.r8lbwWSJ.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.BkUfaQRR.mjs';
+export { i as utils } from './shared/unjwt.DUVOOOvO.mjs';
+export { j as jwk } from './shared/unjwt.CbxAdgsb.mjs';

package/dist/index.mjs

@@ -1,5 +1,5 @@
-export { i as utils } from './shared/unjwt.BEjwP_9W.mjs';
-export { j as jwe } from './shared/unjwt.B8wnSUll.mjs';
-export { j as jwk } from './shared/unjwt.BVlHlXdP.mjs';
-export { j as jws } from './shared/unjwt.skuKf53c.mjs';
-import './shared/unjwt.BaB7HUR1.mjs';
+export { i as utils } from './shared/unjwt.CRHfsi7v.mjs';
+export { j as jwe } from './shared/unjwt.BZ3B0Ak8.mjs';
+export { j as jwk } from './shared/unjwt.D1MC63Yb.mjs';
+export { j as jws } from './shared/unjwt.u3h40Nr-.mjs';
+import './shared/unjwt.BpusjhPR.mjs';

package/dist/jwe.d.mts

@@ -1,2 +1,2 @@
-export { Q as JWT, R as JWTClaimValidationOptions, P as JWTClaims, O as JoseHeaderParameters } from './shared/unjwt.BsgIQHVD.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.Cf7vmOhS.mjs';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, r as JWK, M as JWKAlgorithm, N as JWKPEMAlgorithm, J as JWKParameters, s as JWKSet, A as JWK_AES_CBC_HMAC, B as JWK_AES_GCM, z as JWK_AES_GCM_KW, y as JWK_AES_KW, L as JWK_Asymmetric_Algorithm, h as JWK_EC, F as JWK_ECDH_ES, w as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, t as JWK_HMAC, n as JWK_OKP, m as JWK_OKP_Private, l as JWK_OKP_Public, H as JWK_OKP_SIGN, E as JWK_PBES2, q as JWK_Private, p as JWK_Public, k as JWK_RSA, x as JWK_RSA_ENC, v as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, u as JWK_RSA_SIGN, I as JWK_Symmetric_Algorithm, o as JWK_oct, Q as JWT, R as JWTClaimValidationOptions, P as JWTClaims, O as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.OzI0aGB_.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.BkUfaQRR.mjs';

package/dist/jwe.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.BVlHlXdP.mjs';
-import './shared/unjwt.BEjwP_9W.mjs';
-export { d as decrypt, e as encrypt } from './shared/unjwt.B8wnSUll.mjs';
-import './shared/unjwt.BaB7HUR1.mjs';
+import './shared/unjwt.D1MC63Yb.mjs';
+import './shared/unjwt.CRHfsi7v.mjs';
+export { d as decrypt, e as encrypt } from './shared/unjwt.BZ3B0Ak8.mjs';
+import './shared/unjwt.BpusjhPR.mjs';

package/dist/jwk.d.mts

@@ -1,2 +1,2 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, r as JWK, M as JWKAlgorithm, N as JWKPEMAlgorithm, J as JWKParameters, s as JWKSet, A as JWK_AES_CBC_HMAC, B as JWK_AES_GCM, z as JWK_AES_GCM_KW, y as JWK_AES_KW, L as JWK_Asymmetric_Algorithm, h as JWK_EC, F as JWK_ECDH_ES, w as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, t as JWK_HMAC, n as JWK_OKP, m as JWK_OKP_Private, l as JWK_OKP_Public, H as JWK_OKP_SIGN, E as JWK_PBES2, q as JWK_Private, p as JWK_Public, k as JWK_RSA, x as JWK_RSA_ENC, v as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, u as JWK_RSA_SIGN, I as JWK_Symmetric_Algorithm, o as JWK_oct, Q as JWT, R as JWTClaimValidationOptions, P as JWTClaims, O as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.BsgIQHVD.mjs';
-export { d as deriveKeyFromPassword, b as exportJWKToPEM, e as exportKey, g as generateKey, c as getJWKFromSet, a as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.C6b_GyXm.mjs';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, r as JWK, M as JWKAlgorithm, N as JWKPEMAlgorithm, J as JWKParameters, s as JWKSet, A as JWK_AES_CBC_HMAC, B as JWK_AES_GCM, z as JWK_AES_GCM_KW, y as JWK_AES_KW, L as JWK_Asymmetric_Algorithm, h as JWK_EC, F as JWK_ECDH_ES, w as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, t as JWK_HMAC, n as JWK_OKP, m as JWK_OKP_Private, l as JWK_OKP_Public, H as JWK_OKP_SIGN, E as JWK_PBES2, q as JWK_Private, p as JWK_Public, k as JWK_RSA, x as JWK_RSA_ENC, v as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, u as JWK_RSA_SIGN, I as JWK_Symmetric_Algorithm, o as JWK_oct, Q as JWT, R as JWTClaimValidationOptions, P as JWTClaims, O as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.OzI0aGB_.mjs';
+export { d as deriveKeyFromPassword, b as exportJWKToPEM, e as exportKey, g as generateKey, c as getJWKFromSet, a as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.CbxAdgsb.mjs';

package/dist/jwk.mjs

@@ -1,2 +1,2 @@
-import './shared/unjwt.BEjwP_9W.mjs';
-export { p as deriveKeyFromPassword, t as exportJWKToPEM, q as exportKey, o as generateKey, g as getJWKFromSet, s as importJWKFromPEM, i as importKey, m as unwrapKey, r as wrapKey } from './shared/unjwt.BVlHlXdP.mjs';
+import './shared/unjwt.CRHfsi7v.mjs';
+export { p as deriveKeyFromPassword, t as exportJWKToPEM, q as exportKey, o as generateKey, g as getJWKFromSet, s as importJWKFromPEM, i as importKey, m as unwrapKey, r as wrapKey } from './shared/unjwt.D1MC63Yb.mjs';

package/dist/jws.d.mts

@@ -1,2 +1,2 @@
-export { Q as JWT, R as JWTClaimValidationOptions, P as JWTClaims, O as JoseHeaderParameters } from './shared/unjwt.BsgIQHVD.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.qWts1U9J.mjs';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, r as JWK, M as JWKAlgorithm, N as JWKPEMAlgorithm, J as JWKParameters, s as JWKSet, A as JWK_AES_CBC_HMAC, B as JWK_AES_GCM, z as JWK_AES_GCM_KW, y as JWK_AES_KW, L as JWK_Asymmetric_Algorithm, h as JWK_EC, F as JWK_ECDH_ES, w as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, t as JWK_HMAC, n as JWK_OKP, m as JWK_OKP_Private, l as JWK_OKP_Public, H as JWK_OKP_SIGN, E as JWK_PBES2, q as JWK_Private, p as JWK_Public, k as JWK_RSA, x as JWK_RSA_ENC, v as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, u as JWK_RSA_SIGN, I as JWK_Symmetric_Algorithm, o as JWK_oct, Q as JWT, R as JWTClaimValidationOptions, P as JWTClaims, O as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.OzI0aGB_.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.r8lbwWSJ.mjs';

package/dist/jws.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.BVlHlXdP.mjs';
-import './shared/unjwt.BEjwP_9W.mjs';
-import './shared/unjwt.BaB7HUR1.mjs';
-export { s as sign, v as verify } from './shared/unjwt.skuKf53c.mjs';
+import './shared/unjwt.D1MC63Yb.mjs';
+import './shared/unjwt.CRHfsi7v.mjs';
+import './shared/unjwt.BpusjhPR.mjs';
+export { s as sign, v as verify } from './shared/unjwt.u3h40Nr-.mjs';

package/dist/shared/{unjwt.B8wnSUll.mjs → unjwt.BZ3B0Ak8.mjs}

@@ -1,6 +1,6 @@
-import { a as checkEncCryptoKey, u as uint32be, b as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, d as bitLengthCEK, f as jwkTokey, i as importKey, h as generateIV, l as encrypt$1, m as unwrapKey, n as decrypt$1 } from './unjwt.BVlHlXdP.mjs';
-import { k as concatUint8Arrays, t as textEncoder, l as assertCryptoKey, d as base64UrlEncode, m as isCryptoKey, a as isJWK, s as sanitizeObject, f as base64UrlDecode, r as randomBytes, b as applyTypCtyDefaults, c as computeJwtTimeClaims, n as getPlaintextBytes, o as decodePayloadFromBytes, p as validateCriticalHeadersJWE } from './unjwt.BEjwP_9W.mjs';
-import { c as checkKeyLength } from './unjwt.BaB7HUR1.mjs';
+import { a as checkEncCryptoKey, u as uint32be, b as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, d as bitLengthCEK, f as jwkTokey, i as importKey, h as generateIV, l as encrypt$1, m as unwrapKey, n as decrypt$1 } from './unjwt.D1MC63Yb.mjs';
+import { k as concatUint8Arrays, t as textEncoder, l as assertCryptoKey, d as base64UrlEncode, m as isCryptoKey, a as isJWK, s as sanitizeObject, f as base64UrlDecode, r as randomBytes, b as applyTypCtyDefaults, c as computeJwtTimeClaims, n as getPlaintextBytes, o as decodePayloadFromBytes, p as validateCriticalHeadersJWE, j as validateJwtClaims } from './unjwt.CRHfsi7v.mjs';
+import { c as checkKeyLength } from './unjwt.BpusjhPR.mjs';
 
 function lengthAndInput(input) {
   return concatUint8Arrays(uint32be(input.length), input);
@@ -293,7 +293,7 @@ async function encrypt(payload, key, options = {}) {
   ];
   return jweParts.join(".");
 }
-async function decrypt(jwe, key, options) {
+async function decrypt(jwe, key, options = {}) {
   const parts = jwe.split(".");
   if (parts.length !== 5) {
     throw new Error(
@@ -375,6 +375,9 @@ async function decrypt(jwe, key, options) {
     ...options?.critical || [],
     ...options?.requiredHeaders || []
   ]);
+  if (payload && typeof payload === "object" && options.validateJWT !== false && (options.validateJWT === true || protectedHeader.typ?.toLowerCase().includes("jwt")) && !options.forceUint8Array && !(payload instanceof Uint8Array)) {
+    validateJwtClaims(payload, options);
+  }
   return {
     payload,
     protectedHeader,

package/dist/shared/{unjwt.Cf7vmOhS.d.mts → unjwt.BkUfaQRR.d.mts}

@@ -1,4 +1,4 @@
-import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, O as JoseHeaderParameters, f as JWK_EC_Public, r as JWK, R as JWTClaimValidationOptions, P as JWTClaims, Q as JWT } from './unjwt.BsgIQHVD.mjs';
+import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, O as JoseHeaderParameters, f as JWK_EC_Public, r as JWK, R as JWTClaimValidationOptions, P as JWTClaims, C as CompositeKey, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, M as JWKAlgorithm, N as JWKPEMAlgorithm, J as JWKParameters, s as JWKSet, A as JWK_AES_CBC_HMAC, B as JWK_AES_GCM, z as JWK_AES_GCM_KW, y as JWK_AES_KW, L as JWK_Asymmetric_Algorithm, h as JWK_EC, F as JWK_ECDH_ES, w as JWK_ECDSA, g as JWK_EC_Private, t as JWK_HMAC, n as JWK_OKP, m as JWK_OKP_Private, l as JWK_OKP_Public, H as JWK_OKP_SIGN, E as JWK_PBES2, q as JWK_Private, p as JWK_Public, k as JWK_RSA, x as JWK_RSA_ENC, v as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, u as JWK_RSA_SIGN, I as JWK_Symmetric_Algorithm, o as JWK_oct, Q as JWT, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './unjwt.OzI0aGB_.mjs';
 
 /** Recognized JWE Header Parameters, any other Header Members may also be present. */
 interface JWEHeaderParameters extends JoseHeaderParameters {
@@ -72,7 +72,7 @@ interface JWEEncryptOptions {
     enc?: ContentEncryptionAlgorithm;
     /** Date to use when computing NumericDate claims, defaults to `new Date()`. */
     currentDate?: Date;
-    /** Time at which the JWT should expire, if no `exp` was already provided (only when typ is "at+jwt"). */
+    /** Time at which the JWT should expire, if no `exp` was already provided (only when typ is "JWT" or explicitly parsing JWT). */
     expiresIn?: number;
     /** Additional JWE Protected Header parameters. */
     protectedHeader?: Omit<JWEHeaderParameters, "alg" | "enc" | "iv" | "tag" | "p2s" | "p2c" | "apu" | "apv">;
@@ -119,6 +119,8 @@ interface JWEDecryptOptions extends JWTClaimValidationOptions {
     extractable?: boolean;
     /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred based on JWE headers. */
     forceUint8Array?: boolean;
+    /** Unless false, will parse payload as JWT and validate claims if applicable (typ "JWT"). */
+    validateJWT?: boolean;
 }
 /**
  * Result of a JWE decryption operation.
@@ -170,20 +172,62 @@ declare function decrypt(jwe: string, key: CryptoKey | JWK | string | Uint8Array
     forceUint8Array: true;
 }): Promise<JWEDecryptResult<Uint8Array<ArrayBuffer>>>;
 
+declare const jwe_CompositeKey: typeof CompositeKey;
+declare const jwe_ContentEncryptionAlgorithm: typeof ContentEncryptionAlgorithm;
+declare const jwe_DeriveKeyOptions: typeof DeriveKeyOptions;
+declare const jwe_DeriveKeyReturn: typeof DeriveKeyReturn;
+declare const jwe_GenerateKeyAlgorithm: typeof GenerateKeyAlgorithm;
+declare const jwe_GenerateKeyOptions: typeof GenerateKeyOptions;
+declare const jwe_GenerateKeyReturn: typeof GenerateKeyReturn;
 type jwe_JWEDecryptOptions = JWEDecryptOptions;
 type jwe_JWEDecryptResult<T extends JWTClaims | Uint8Array<ArrayBuffer> | string = JWTClaims | Uint8Array<ArrayBuffer> | string> = JWEDecryptResult<T>;
 type jwe_JWEEncryptOptions = JWEEncryptOptions;
 type jwe_JWEHeaderParameters = JWEHeaderParameters;
 type jwe_JWEKeyLookupFunction = JWEKeyLookupFunction;
 type jwe_JWEKeyManagementHeaderParameters = JWEKeyManagementHeaderParameters;
+declare const jwe_JWK: typeof JWK;
+declare const jwe_JWKAlgorithm: typeof JWKAlgorithm;
+declare const jwe_JWKPEMAlgorithm: typeof JWKPEMAlgorithm;
+declare const jwe_JWKParameters: typeof JWKParameters;
+declare const jwe_JWKSet: typeof JWKSet;
+declare const jwe_JWK_AES_CBC_HMAC: typeof JWK_AES_CBC_HMAC;
+declare const jwe_JWK_AES_GCM: typeof JWK_AES_GCM;
+declare const jwe_JWK_AES_GCM_KW: typeof JWK_AES_GCM_KW;
+declare const jwe_JWK_AES_KW: typeof JWK_AES_KW;
+declare const jwe_JWK_Asymmetric_Algorithm: typeof JWK_Asymmetric_Algorithm;
+declare const jwe_JWK_EC: typeof JWK_EC;
+declare const jwe_JWK_ECDH_ES: typeof JWK_ECDH_ES;
+declare const jwe_JWK_ECDSA: typeof JWK_ECDSA;
+declare const jwe_JWK_EC_Private: typeof JWK_EC_Private;
+declare const jwe_JWK_EC_Public: typeof JWK_EC_Public;
+declare const jwe_JWK_HMAC: typeof JWK_HMAC;
+declare const jwe_JWK_OKP: typeof JWK_OKP;
+declare const jwe_JWK_OKP_Private: typeof JWK_OKP_Private;
+declare const jwe_JWK_OKP_Public: typeof JWK_OKP_Public;
+declare const jwe_JWK_OKP_SIGN: typeof JWK_OKP_SIGN;
+declare const jwe_JWK_PBES2: typeof JWK_PBES2;
+declare const jwe_JWK_Private: typeof JWK_Private;
+declare const jwe_JWK_Public: typeof JWK_Public;
+declare const jwe_JWK_RSA: typeof JWK_RSA;
+declare const jwe_JWK_RSA_ENC: typeof JWK_RSA_ENC;
+declare const jwe_JWK_RSA_PSS: typeof JWK_RSA_PSS;
+declare const jwe_JWK_RSA_Private: typeof JWK_RSA_Private;
+declare const jwe_JWK_RSA_Public: typeof JWK_RSA_Public;
+declare const jwe_JWK_RSA_SIGN: typeof JWK_RSA_SIGN;
+declare const jwe_JWK_Symmetric_Algorithm: typeof JWK_Symmetric_Algorithm;
+declare const jwe_JWK_oct: typeof JWK_oct;
 declare const jwe_JWT: typeof JWT;
 declare const jwe_JWTClaimValidationOptions: typeof JWTClaimValidationOptions;
 declare const jwe_JWTClaims: typeof JWTClaims;
 declare const jwe_JoseHeaderParameters: typeof JoseHeaderParameters;
+declare const jwe_KeyManagementAlgorithm: typeof KeyManagementAlgorithm;
+declare const jwe_UnwrapKeyOptions: typeof UnwrapKeyOptions;
+declare const jwe_WrapKeyOptions: typeof WrapKeyOptions;
+declare const jwe_WrapKeyResult: typeof WrapKeyResult;
 declare const jwe_decrypt: typeof decrypt;
 declare const jwe_encrypt: typeof encrypt;
 declare namespace jwe {
-  export { jwe_JWT as JWT, jwe_JWTClaimValidationOptions as JWTClaimValidationOptions, jwe_JWTClaims as JWTClaims, jwe_JoseHeaderParameters as JoseHeaderParameters, jwe_decrypt as decrypt, jwe_encrypt as encrypt };
+  export { jwe_CompositeKey as CompositeKey, jwe_ContentEncryptionAlgorithm as ContentEncryptionAlgorithm, jwe_DeriveKeyOptions as DeriveKeyOptions, jwe_DeriveKeyReturn as DeriveKeyReturn, jwe_GenerateKeyAlgorithm as GenerateKeyAlgorithm, jwe_GenerateKeyOptions as GenerateKeyOptions, jwe_GenerateKeyReturn as GenerateKeyReturn, jwe_JWK as JWK, jwe_JWKAlgorithm as JWKAlgorithm, jwe_JWKPEMAlgorithm as JWKPEMAlgorithm, jwe_JWKParameters as JWKParameters, jwe_JWKSet as JWKSet, jwe_JWK_AES_CBC_HMAC as JWK_AES_CBC_HMAC, jwe_JWK_AES_GCM as JWK_AES_GCM, jwe_JWK_AES_GCM_KW as JWK_AES_GCM_KW, jwe_JWK_AES_KW as JWK_AES_KW, jwe_JWK_Asymmetric_Algorithm as JWK_Asymmetric_Algorithm, jwe_JWK_EC as JWK_EC, jwe_JWK_ECDH_ES as JWK_ECDH_ES, jwe_JWK_ECDSA as JWK_ECDSA, jwe_JWK_EC_Private as JWK_EC_Private, jwe_JWK_EC_Public as JWK_EC_Public, jwe_JWK_HMAC as JWK_HMAC, jwe_JWK_OKP as JWK_OKP, jwe_JWK_OKP_Private as JWK_OKP_Private, jwe_JWK_OKP_Public as JWK_OKP_Public, jwe_JWK_OKP_SIGN as JWK_OKP_SIGN, jwe_JWK_PBES2 as JWK_PBES2, jwe_JWK_Private as JWK_Private, jwe_JWK_Public as JWK_Public, jwe_JWK_RSA as JWK_RSA, jwe_JWK_RSA_ENC as JWK_RSA_ENC, jwe_JWK_RSA_PSS as JWK_RSA_PSS, jwe_JWK_RSA_Private as JWK_RSA_Private, jwe_JWK_RSA_Public as JWK_RSA_Public, jwe_JWK_RSA_SIGN as JWK_RSA_SIGN, jwe_JWK_Symmetric_Algorithm as JWK_Symmetric_Algorithm, jwe_JWK_oct as JWK_oct, jwe_JWT as JWT, jwe_JWTClaimValidationOptions as JWTClaimValidationOptions, jwe_JWTClaims as JWTClaims, jwe_JoseHeaderParameters as JoseHeaderParameters, jwe_KeyManagementAlgorithm as KeyManagementAlgorithm, jwe_UnwrapKeyOptions as UnwrapKeyOptions, jwe_WrapKeyOptions as WrapKeyOptions, jwe_WrapKeyResult as WrapKeyResult, jwe_decrypt as decrypt, jwe_encrypt as encrypt };
   export type { jwe_JWEDecryptOptions as JWEDecryptOptions, jwe_JWEDecryptResult as JWEDecryptResult, jwe_JWEEncryptOptions as JWEEncryptOptions, jwe_JWEHeaderParameters as JWEHeaderParameters, jwe_JWEKeyLookupFunction as JWEKeyLookupFunction, jwe_JWEKeyManagementHeaderParameters as JWEKeyManagementHeaderParameters };
 }
 

package/dist/shared/{unjwt.BaB7HUR1.mjs → unjwt.BpusjhPR.mjs}

@@ -1,4 +1,4 @@
-import { c as checkSigCryptoKey } from './unjwt.BVlHlXdP.mjs';
+import { c as checkSigCryptoKey } from './unjwt.D1MC63Yb.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.

package/dist/shared/{unjwt.BEjwP_9W.mjs → unjwt.CRHfsi7v.mjs}

@@ -1,22 +1,21 @@
 function applyTypCtyDefaults(header, payload) {
   const isObjectPayload = typeof payload === "object" && payload !== null && !(payload instanceof Uint8Array);
   if (header.typ === void 0 && isObjectPayload) {
-    header.typ = "at+jwt";
+    header.typ = "JWT";
   }
-  if ((header.typ === "at+jwt" || header.typ === "JWT") && isObjectPayload) {
+  if (header.typ?.toLowerCase().includes("jwt") && isObjectPayload) {
     header.cty ||= "application/json";
   }
   return header;
 }
-function isJsonContent(header) {
+function isJWTContent(header) {
   if (!header) return false;
-  if (header.typ === "at+jwt") return true;
-  if (header.typ === "JWT") return true;
+  if (header.typ?.toLowerCase().includes("jwt")) return true;
   const cty = header.cty?.toLowerCase();
   return cty === "json" || cty === "application/json" || !!cty && cty.endsWith("+json");
 }
-function decodeMaybeJsonString(decodedString, header) {
-  if (isJsonContent(header)) {
+function decodeMaybeJWTString(decodedString, header) {
+  if (isJWTContent(header)) {
     const looksLikeJson = decodedString.startsWith("{") && decodedString.endsWith("}") || decodedString.startsWith("[") && decodedString.endsWith("]");
     if (looksLikeJson) {
       try {
@@ -31,12 +30,12 @@ function decodeMaybeJsonString(decodedString, header) {
 function decodePayloadFromBytes(bytes, header, forceUint8Array) {
   if (forceUint8Array) return bytes;
   const decodedString = textDecoder.decode(bytes);
-  return decodeMaybeJsonString(decodedString, header);
+  return decodeMaybeJWTString(decodedString, header);
 }
 function decodePayloadFromB64UrlSegment(payloadEncoded, header, forceUint8Array) {
   if (forceUint8Array) return base64UrlDecode(payloadEncoded, false);
   const decodedString = base64UrlDecode(payloadEncoded);
-  return decodeMaybeJsonString(decodedString, header);
+  return decodeMaybeJWTString(decodedString, header);
 }
 function getPlaintextBytes(payload) {
   if (payload instanceof Uint8Array) return payload;
@@ -48,13 +47,13 @@ function getPlaintextBytes(payload) {
   );
 }
 function computeJwtTimeClaims(payload, headerTyp, expiresIn, currentDate = /* @__PURE__ */ new Date()) {
-  if (expiresIn === void 0 || headerTyp !== "at+jwt" && headerTyp !== "JWT" || !(payload && typeof payload === "object") || payload instanceof Uint8Array || payload.exp) {
+  if (expiresIn === void 0 || !headerTyp?.toLowerCase().includes("jwt") || !(payload && typeof payload === "object") || payload instanceof Uint8Array || payload.exp) {
     return void 0;
   }
   const now = Math.round(currentDate.getTime() / 1e3);
   const claims = { ...payload };
   claims.iat ||= now;
-  claims.exp = now + expiresIn;
+  claims.exp = claims.iat + expiresIn;
   return claims;
 }
 function validateJwtClaims(jwtClaims, options = {}) {
@@ -362,7 +361,7 @@ const index = {
   base64UrlEncode: base64UrlEncode,
   computeJwtTimeClaims: computeJwtTimeClaims,
   concatUint8Arrays: concatUint8Arrays,
-  decodeMaybeJsonString: decodeMaybeJsonString,
+  decodeMaybeJWTString: decodeMaybeJWTString,
   decodePayloadFromB64UrlSegment: decodePayloadFromB64UrlSegment,
   decodePayloadFromBytes: decodePayloadFromBytes,
   getPlaintextBytes: getPlaintextBytes,
@@ -371,7 +370,7 @@ const index = {
   isCryptoKeyPair: isCryptoKeyPair,
   isJWK: isJWK,
   isJWKSet: isJWKSet,
-  isJsonContent: isJsonContent,
+  isJWTContent: isJWTContent,
   isPrivateJWK: isPrivateJWK,
   isPublicJWK: isPublicJWK,
   isSymmetricJWK: isSymmetricJWK,
@@ -385,4 +384,4 @@ const index = {
   validateJwtClaims: validateJwtClaims
 };
 
-export { isPrivateJWK as A, isPublicJWK as B, isJsonContent as C, decodeMaybeJsonString as D, isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, textDecoder as e, base64UrlDecode as f, isJWKSet as g, decodePayloadFromB64UrlSegment as h, index as i, validateJwtClaims as j, concatUint8Arrays as k, assertCryptoKey as l, isCryptoKey as m, getPlaintextBytes as n, decodePayloadFromBytes as o, validateCriticalHeadersJWE as p, base64Decode as q, randomBytes as r, sanitizeObject as s, textEncoder as t, base64Encode as u, validateCriticalHeadersJWS as v, maybeArray as w, isCryptoKeyPair as x, isSymmetricJWK as y, isAsymmetricJWK as z };
+export { isPrivateJWK as A, isPublicJWK as B, isJWTContent as C, decodeMaybeJWTString as D, isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, textDecoder as e, base64UrlDecode as f, isJWKSet as g, decodePayloadFromB64UrlSegment as h, index as i, validateJwtClaims as j, concatUint8Arrays as k, assertCryptoKey as l, isCryptoKey as m, getPlaintextBytes as n, decodePayloadFromBytes as o, validateCriticalHeadersJWE as p, base64Decode as q, randomBytes as r, sanitizeObject as s, textEncoder as t, base64Encode as u, validateCriticalHeadersJWS as v, maybeArray as w, isCryptoKeyPair as x, isSymmetricJWK as y, isAsymmetricJWK as z };

package/dist/shared/{unjwt.C6b_GyXm.d.mts → unjwt.CbxAdgsb.d.mts}

@@ -1,4 +1,4 @@
-import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, E as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, o as JWK_oct, r as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, N as JWKPEMAlgorithm, s as JWKSet, O as JoseHeaderParameters, C as CompositeKey, d as ContentEncryptionAlgorithm, M as JWKAlgorithm, J as JWKParameters, A as JWK_AES_CBC_HMAC, B as JWK_AES_GCM, z as JWK_AES_GCM_KW, y as JWK_AES_KW, L as JWK_Asymmetric_Algorithm, h as JWK_EC, F as JWK_ECDH_ES, w as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, t as JWK_HMAC, n as JWK_OKP, m as JWK_OKP_Private, l as JWK_OKP_Public, H as JWK_OKP_SIGN, q as JWK_Private, p as JWK_Public, k as JWK_RSA, x as JWK_RSA_ENC, v as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, u as JWK_RSA_SIGN, I as JWK_Symmetric_Algorithm, Q as JWT, R as JWTClaimValidationOptions, P as JWTClaims } from './unjwt.BsgIQHVD.mjs';
+import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, E as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, o as JWK_oct, r as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, N as JWKPEMAlgorithm, s as JWKSet, O as JoseHeaderParameters, C as CompositeKey, d as ContentEncryptionAlgorithm, M as JWKAlgorithm, J as JWKParameters, A as JWK_AES_CBC_HMAC, B as JWK_AES_GCM, z as JWK_AES_GCM_KW, y as JWK_AES_KW, L as JWK_Asymmetric_Algorithm, h as JWK_EC, F as JWK_ECDH_ES, w as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, t as JWK_HMAC, n as JWK_OKP, m as JWK_OKP_Private, l as JWK_OKP_Public, H as JWK_OKP_SIGN, q as JWK_Private, p as JWK_Public, k as JWK_RSA, x as JWK_RSA_ENC, v as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, u as JWK_RSA_SIGN, I as JWK_Symmetric_Algorithm, Q as JWT, R as JWTClaimValidationOptions, P as JWTClaims } from './unjwt.OzI0aGB_.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.

package/dist/shared/{unjwt.BVlHlXdP.mjs → unjwt.D1MC63Yb.mjs}

@@ -1,4 +1,4 @@
-import { m as isCryptoKey, k as concatUint8Arrays, d as base64UrlEncode, q as base64Decode, u as base64Encode, s as sanitizeObject, t as textEncoder, r as randomBytes, a as isJWK, f as base64UrlDecode, g as isJWKSet } from './unjwt.BEjwP_9W.mjs';
+import { m as isCryptoKey, k as concatUint8Arrays, d as base64UrlEncode, q as base64Decode, u as base64Encode, s as sanitizeObject, t as textEncoder, r as randomBytes, a as isJWK, f as base64UrlDecode, g as isJWKSet } from './unjwt.CRHfsi7v.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.

package/dist/shared/{unjwt.BYaxDvLV.d.mts → unjwt.DUVOOOvO.d.mts}

@@ -1,23 +1,23 @@
-import { P as JWTClaims, R as JWTClaimValidationOptions, r as JWK, s as JWKSet, o as JWK_oct, q as JWK_Private, p as JWK_Public } from './unjwt.BsgIQHVD.mjs';
+import { P as JWTClaims, R as JWTClaimValidationOptions, r as JWK, s as JWKSet, o as JWK_oct, q as JWK_Private, p as JWK_Public } from './unjwt.OzI0aGB_.mjs';
 
 /**
  * Apply default typ/cty semantics shared by JWS & JWE.
- * - If typ is undefined and payload is a non-Uint8Array object, set typ="at+jwt".
- * - If typ is "at+jwt" and payload is a non-Uint8Array object, ensure cty defaults to "application/json".
+ * - If typ is undefined and payload is a non-Uint8Array object, set typ="JWT".
+ * - If typ is "JWT" and payload is a non-Uint8Array object, ensure cty defaults to "application/json".
  */
 declare function applyTypCtyDefaults<T extends {
     typ?: string;
     cty?: string;
 }>(header: T, payload: unknown): T;
 /** Returns true when headers indicate JSON content. */
-declare function isJsonContent(header: {
+declare function isJWTContent(header: {
     typ?: string;
     cty?: string;
 } | undefined): boolean;
 /**
  * Given a decoded string and JOSE headers, return an object if JSON, otherwise the string.
  */
-declare function decodeMaybeJsonString<T = unknown>(decodedString: string, header: {
+declare function decodeMaybeJWTString<T = unknown>(decodedString: string, header: {
     typ?: string;
     cty?: string;
 } | undefined): T | string;
@@ -85,9 +85,9 @@ declare function assertCryptoKey(key: unknown): asserts key is CryptoKey;
 declare function isCryptoKey(key: unknown): key is CryptoKey;
 declare const isCryptoKeyPair: (key: any) => key is CryptoKeyPair;
 /** Returns true if the JWK is a symmetric (oct) key. */
-declare function isSymmetricJWK(key: unknown): key is JWK_oct;
+declare function isSymmetricJWK(key: unknown): key is Extract<JWK, JWK_oct>;
 /** Returns true if the JWK is an asymmetric (RSA, EC, OKP) key. */
-declare function isAsymmetricJWK(key: unknown): key is JWK_oct;
+declare function isAsymmetricJWK(key: unknown): key is Exclude<JWK, JWK_oct>;
 /**
  * Type guard that checks if the provided JWK contains private key material.
  * It relies purely on the presence of private components (e.g. "d"), not on the alg value.
@@ -107,7 +107,7 @@ declare const index_base64UrlDecode: typeof base64UrlDecode;
 declare const index_base64UrlEncode: typeof base64UrlEncode;
 declare const index_computeJwtTimeClaims: typeof computeJwtTimeClaims;
 declare const index_concatUint8Arrays: typeof concatUint8Arrays;
-declare const index_decodeMaybeJsonString: typeof decodeMaybeJsonString;
+declare const index_decodeMaybeJWTString: typeof decodeMaybeJWTString;
 declare const index_decodePayloadFromB64UrlSegment: typeof decodePayloadFromB64UrlSegment;
 declare const index_decodePayloadFromBytes: typeof decodePayloadFromBytes;
 declare const index_getPlaintextBytes: typeof getPlaintextBytes;
@@ -116,7 +116,7 @@ declare const index_isCryptoKey: typeof isCryptoKey;
 declare const index_isCryptoKeyPair: typeof isCryptoKeyPair;
 declare const index_isJWK: typeof isJWK;
 declare const index_isJWKSet: typeof isJWKSet;
-declare const index_isJsonContent: typeof isJsonContent;
+declare const index_isJWTContent: typeof isJWTContent;
 declare const index_isPrivateJWK: typeof isPrivateJWK;
 declare const index_isPublicJWK: typeof isPublicJWK;
 declare const index_isSymmetricJWK: typeof isSymmetricJWK;
@@ -138,7 +138,7 @@ declare namespace index {
     index_base64UrlEncode as base64UrlEncode,
     index_computeJwtTimeClaims as computeJwtTimeClaims,
     index_concatUint8Arrays as concatUint8Arrays,
-    index_decodeMaybeJsonString as decodeMaybeJsonString,
+    index_decodeMaybeJWTString as decodeMaybeJWTString,
     index_decodePayloadFromB64UrlSegment as decodePayloadFromB64UrlSegment,
     index_decodePayloadFromBytes as decodePayloadFromBytes,
     index_getPlaintextBytes as getPlaintextBytes,
@@ -147,7 +147,7 @@ declare namespace index {
     index_isCryptoKeyPair as isCryptoKeyPair,
     index_isJWK as isJWK,
     index_isJWKSet as isJWKSet,
-    index_isJsonContent as isJsonContent,
+    index_isJWTContent as isJWTContent,
     index_isPrivateJWK as isPrivateJWK,
     index_isPublicJWK as isPublicJWK,
     index_isSymmetricJWK as isSymmetricJWK,
@@ -162,4 +162,4 @@ declare namespace index {
   };
 }
 
-export { validateJwtClaims as A, validateCriticalHeadersJWS as B, validateCriticalHeadersJWE as C, sanitizeObject as D, textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, isJWKSet as h, index as i, assertCryptoKey as j, isCryptoKey as k, isCryptoKeyPair as l, maybeArray as m, isSymmetricJWK as n, isAsymmetricJWK as o, isPrivateJWK as p, isPublicJWK as q, randomBytes as r, applyTypCtyDefaults as s, textEncoder as t, isJsonContent as u, decodeMaybeJsonString as v, decodePayloadFromBytes as w, decodePayloadFromB64UrlSegment as x, getPlaintextBytes as y, computeJwtTimeClaims as z };
+export { validateJwtClaims as A, validateCriticalHeadersJWS as B, validateCriticalHeadersJWE as C, sanitizeObject as D, textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, isJWKSet as h, index as i, assertCryptoKey as j, isCryptoKey as k, isCryptoKeyPair as l, maybeArray as m, isSymmetricJWK as n, isAsymmetricJWK as o, isPrivateJWK as p, isPublicJWK as q, randomBytes as r, applyTypCtyDefaults as s, textEncoder as t, isJWTContent as u, decodeMaybeJWTString as v, decodePayloadFromBytes as w, decodePayloadFromB64UrlSegment as x, getPlaintextBytes as y, computeJwtTimeClaims as z };

package/dist/shared/{unjwt.BsgIQHVD.d.mts → unjwt.OzI0aGB_.d.mts}

@@ -198,7 +198,7 @@ interface JWK_oct extends JWKParameters {
     k: string;
 }
 /** Public JSON Web Keys */
-type JWK_Public = JWK_RSA_Public | JWK_EC_Public | JWK_OKP_Public | JWK_oct;
+type JWK_Public = JWK_RSA_Public | JWK_EC_Public | JWK_OKP_Public;
 /** Private JSON Web Keys */
 type JWK_Private = JWK_RSA_Private | JWK_EC_Private | JWK_OKP_Private;
 /**

package/dist/shared/{unjwt.qWts1U9J.d.mts → unjwt.r8lbwWSJ.d.mts}

@@ -1,4 +1,4 @@
-import { t as JWK_HMAC, u as JWK_RSA_SIGN, v as JWK_RSA_PSS, w as JWK_ECDSA, O as JoseHeaderParameters, r as JWK, s as JWKSet, R as JWTClaimValidationOptions, P as JWTClaims, Q as JWT } from './unjwt.BsgIQHVD.mjs';
+import { t as JWK_HMAC, u as JWK_RSA_SIGN, v as JWK_RSA_PSS, w as JWK_ECDSA, O as JoseHeaderParameters, r as JWK, s as JWKSet, R as JWTClaimValidationOptions, P as JWTClaims, C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, M as JWKAlgorithm, N as JWKPEMAlgorithm, J as JWKParameters, A as JWK_AES_CBC_HMAC, B as JWK_AES_GCM, z as JWK_AES_GCM_KW, y as JWK_AES_KW, L as JWK_Asymmetric_Algorithm, h as JWK_EC, F as JWK_ECDH_ES, g as JWK_EC_Private, f as JWK_EC_Public, n as JWK_OKP, m as JWK_OKP_Private, l as JWK_OKP_Public, H as JWK_OKP_SIGN, E as JWK_PBES2, q as JWK_Private, p as JWK_Public, k as JWK_RSA, x as JWK_RSA_ENC, j as JWK_RSA_Private, i as JWK_RSA_Public, I as JWK_Symmetric_Algorithm, o as JWK_oct, Q as JWT, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './unjwt.OzI0aGB_.mjs';
 
 type JWS_SIGN_EXTRA = "Ed25519" | "EdDSA";
 /** JWS Signing Algorithm Identifier. */
@@ -27,7 +27,7 @@ interface JWSSignOptions {
     alg?: JWSAlgorithm;
     /**
      * Additional protected header parameters. `alg` is automatically included.
-     * `typ` defaults to "at+jwt" if not provided.
+     * `typ` defaults to "JWT" if not provided and payload is an object.
      */
     protectedHeader?: JWSHeaderParameters;
     /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
@@ -50,6 +50,8 @@ interface JWSVerifyOptions extends JWTClaimValidationOptions {
     algorithms?: JWSAlgorithm[];
     /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred. */
     forceUint8Array?: boolean;
+    /** Unless false, will parse payload as JWT and validate claims if applicable (typ "JWT"). */
+    validateJWT?: boolean;
 }
 /**
  * Key lookup function for JWS verification.
@@ -98,6 +100,44 @@ declare function verify(jws: string, key: CryptoKey | JWK | JWKSet | Uint8Array<
     forceUint8Array: true;
 }): Promise<JWSVerifyResult<Uint8Array<ArrayBuffer>>>;
 
+declare const jws_CompositeKey: typeof CompositeKey;
+declare const jws_ContentEncryptionAlgorithm: typeof ContentEncryptionAlgorithm;
+declare const jws_DeriveKeyOptions: typeof DeriveKeyOptions;
+declare const jws_DeriveKeyReturn: typeof DeriveKeyReturn;
+declare const jws_GenerateKeyAlgorithm: typeof GenerateKeyAlgorithm;
+declare const jws_GenerateKeyOptions: typeof GenerateKeyOptions;
+declare const jws_GenerateKeyReturn: typeof GenerateKeyReturn;
+declare const jws_JWK: typeof JWK;
+declare const jws_JWKAlgorithm: typeof JWKAlgorithm;
+declare const jws_JWKPEMAlgorithm: typeof JWKPEMAlgorithm;
+declare const jws_JWKParameters: typeof JWKParameters;
+declare const jws_JWKSet: typeof JWKSet;
+declare const jws_JWK_AES_CBC_HMAC: typeof JWK_AES_CBC_HMAC;
+declare const jws_JWK_AES_GCM: typeof JWK_AES_GCM;
+declare const jws_JWK_AES_GCM_KW: typeof JWK_AES_GCM_KW;
+declare const jws_JWK_AES_KW: typeof JWK_AES_KW;
+declare const jws_JWK_Asymmetric_Algorithm: typeof JWK_Asymmetric_Algorithm;
+declare const jws_JWK_EC: typeof JWK_EC;
+declare const jws_JWK_ECDH_ES: typeof JWK_ECDH_ES;
+declare const jws_JWK_ECDSA: typeof JWK_ECDSA;
+declare const jws_JWK_EC_Private: typeof JWK_EC_Private;
+declare const jws_JWK_EC_Public: typeof JWK_EC_Public;
+declare const jws_JWK_HMAC: typeof JWK_HMAC;
+declare const jws_JWK_OKP: typeof JWK_OKP;
+declare const jws_JWK_OKP_Private: typeof JWK_OKP_Private;
+declare const jws_JWK_OKP_Public: typeof JWK_OKP_Public;
+declare const jws_JWK_OKP_SIGN: typeof JWK_OKP_SIGN;
+declare const jws_JWK_PBES2: typeof JWK_PBES2;
+declare const jws_JWK_Private: typeof JWK_Private;
+declare const jws_JWK_Public: typeof JWK_Public;
+declare const jws_JWK_RSA: typeof JWK_RSA;
+declare const jws_JWK_RSA_ENC: typeof JWK_RSA_ENC;
+declare const jws_JWK_RSA_PSS: typeof JWK_RSA_PSS;
+declare const jws_JWK_RSA_Private: typeof JWK_RSA_Private;
+declare const jws_JWK_RSA_Public: typeof JWK_RSA_Public;
+declare const jws_JWK_RSA_SIGN: typeof JWK_RSA_SIGN;
+declare const jws_JWK_Symmetric_Algorithm: typeof JWK_Symmetric_Algorithm;
+declare const jws_JWK_oct: typeof JWK_oct;
 type jws_JWSAlgorithm = JWSAlgorithm;
 type jws_JWSHeaderParameters = JWSHeaderParameters;
 type jws_JWSKeyLookupFunction = JWSKeyLookupFunction;
@@ -109,10 +149,14 @@ declare const jws_JWT: typeof JWT;
 declare const jws_JWTClaimValidationOptions: typeof JWTClaimValidationOptions;
 declare const jws_JWTClaims: typeof JWTClaims;
 declare const jws_JoseHeaderParameters: typeof JoseHeaderParameters;
+declare const jws_KeyManagementAlgorithm: typeof KeyManagementAlgorithm;
+declare const jws_UnwrapKeyOptions: typeof UnwrapKeyOptions;
+declare const jws_WrapKeyOptions: typeof WrapKeyOptions;
+declare const jws_WrapKeyResult: typeof WrapKeyResult;
 declare const jws_sign: typeof sign;
 declare const jws_verify: typeof verify;
 declare namespace jws {
-  export { jws_JWT as JWT, jws_JWTClaimValidationOptions as JWTClaimValidationOptions, jws_JWTClaims as JWTClaims, jws_JoseHeaderParameters as JoseHeaderParameters, jws_sign as sign, jws_verify as verify };
+  export { jws_CompositeKey as CompositeKey, jws_ContentEncryptionAlgorithm as ContentEncryptionAlgorithm, jws_DeriveKeyOptions as DeriveKeyOptions, jws_DeriveKeyReturn as DeriveKeyReturn, jws_GenerateKeyAlgorithm as GenerateKeyAlgorithm, jws_GenerateKeyOptions as GenerateKeyOptions, jws_GenerateKeyReturn as GenerateKeyReturn, jws_JWK as JWK, jws_JWKAlgorithm as JWKAlgorithm, jws_JWKPEMAlgorithm as JWKPEMAlgorithm, jws_JWKParameters as JWKParameters, jws_JWKSet as JWKSet, jws_JWK_AES_CBC_HMAC as JWK_AES_CBC_HMAC, jws_JWK_AES_GCM as JWK_AES_GCM, jws_JWK_AES_GCM_KW as JWK_AES_GCM_KW, jws_JWK_AES_KW as JWK_AES_KW, jws_JWK_Asymmetric_Algorithm as JWK_Asymmetric_Algorithm, jws_JWK_EC as JWK_EC, jws_JWK_ECDH_ES as JWK_ECDH_ES, jws_JWK_ECDSA as JWK_ECDSA, jws_JWK_EC_Private as JWK_EC_Private, jws_JWK_EC_Public as JWK_EC_Public, jws_JWK_HMAC as JWK_HMAC, jws_JWK_OKP as JWK_OKP, jws_JWK_OKP_Private as JWK_OKP_Private, jws_JWK_OKP_Public as JWK_OKP_Public, jws_JWK_OKP_SIGN as JWK_OKP_SIGN, jws_JWK_PBES2 as JWK_PBES2, jws_JWK_Private as JWK_Private, jws_JWK_Public as JWK_Public, jws_JWK_RSA as JWK_RSA, jws_JWK_RSA_ENC as JWK_RSA_ENC, jws_JWK_RSA_PSS as JWK_RSA_PSS, jws_JWK_RSA_Private as JWK_RSA_Private, jws_JWK_RSA_Public as JWK_RSA_Public, jws_JWK_RSA_SIGN as JWK_RSA_SIGN, jws_JWK_Symmetric_Algorithm as JWK_Symmetric_Algorithm, jws_JWK_oct as JWK_oct, jws_JWT as JWT, jws_JWTClaimValidationOptions as JWTClaimValidationOptions, jws_JWTClaims as JWTClaims, jws_JoseHeaderParameters as JoseHeaderParameters, jws_KeyManagementAlgorithm as KeyManagementAlgorithm, jws_UnwrapKeyOptions as UnwrapKeyOptions, jws_WrapKeyOptions as WrapKeyOptions, jws_WrapKeyResult as WrapKeyResult, jws_sign as sign, jws_verify as verify };
   export type { jws_JWSAlgorithm as JWSAlgorithm, jws_JWSHeaderParameters as JWSHeaderParameters, jws_JWSKeyLookupFunction as JWSKeyLookupFunction, jws_JWSProtectedHeader as JWSProtectedHeader, jws_JWSSignOptions as JWSSignOptions, jws_JWSVerifyOptions as JWSVerifyOptions, jws_JWSVerifyResult as JWSVerifyResult };
 }
 

package/dist/shared/{unjwt.skuKf53c.mjs → unjwt.u3h40Nr-.mjs}

@@ -1,6 +1,6 @@
-import { i as importKey, g as getJWKFromSet } from './unjwt.BVlHlXdP.mjs';
-import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, e as textDecoder, f as base64UrlDecode, g as isJWKSet, h as decodePayloadFromB64UrlSegment, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './unjwt.BEjwP_9W.mjs';
-import { s as sign$1, v as verify$1 } from './unjwt.BaB7HUR1.mjs';
+import { i as importKey, g as getJWKFromSet } from './unjwt.D1MC63Yb.mjs';
+import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, e as textDecoder, f as base64UrlDecode, g as isJWKSet, h as decodePayloadFromB64UrlSegment, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './unjwt.CRHfsi7v.mjs';
+import { s as sign$1, v as verify$1 } from './unjwt.BpusjhPR.mjs';
 
 async function sign(payload, key, options = {}) {
   const { protectedHeader: additionalProtectedHeader } = options;
@@ -130,7 +130,7 @@ async function verify(jws, key, options = {}) {
     ...options.critical || [],
     ...options.requiredHeaders || []
   ]);
-  if (payload && typeof payload === "object" && (protectedHeader.typ === "at+jwt" || protectedHeader.typ === "JWT") && !options.forceUint8Array) {
+  if (payload && typeof payload === "object" && options.validateJWT !== false && (options.validateJWT === true || protectedHeader.typ?.toLowerCase().includes("jwt")) && !options.forceUint8Array && !(payload instanceof Uint8Array)) {
     validateJwtClaims(payload, options);
   }
   return {

package/dist/utils.d.mts

@@ -1,2 +1,2 @@
-import './shared/unjwt.BsgIQHVD.mjs';
-export { s as applyTypCtyDefaults, j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, z as computeJwtTimeClaims, f as concatUint8Arrays, v as decodeMaybeJsonString, x as decodePayloadFromB64UrlSegment, w as decodePayloadFromBytes, y as getPlaintextBytes, o as isAsymmetricJWK, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, u as isJsonContent, p as isPrivateJWK, q as isPublicJWK, n as isSymmetricJWK, m as maybeArray, r as randomBytes, D as sanitizeObject, a as textDecoder, t as textEncoder, C as validateCriticalHeadersJWE, B as validateCriticalHeadersJWS, A as validateJwtClaims } from './shared/unjwt.BYaxDvLV.mjs';
+import './shared/unjwt.OzI0aGB_.mjs';
+export { s as applyTypCtyDefaults, j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, z as computeJwtTimeClaims, f as concatUint8Arrays, v as decodeMaybeJWTString, x as decodePayloadFromB64UrlSegment, w as decodePayloadFromBytes, y as getPlaintextBytes, o as isAsymmetricJWK, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, u as isJWTContent, p as isPrivateJWK, q as isPublicJWK, n as isSymmetricJWK, m as maybeArray, r as randomBytes, D as sanitizeObject, a as textDecoder, t as textEncoder, C as validateCriticalHeadersJWE, B as validateCriticalHeadersJWS, A as validateJwtClaims } from './shared/unjwt.DUVOOOvO.mjs';

package/dist/utils.mjs

@@ -1 +1 @@
-export { b as applyTypCtyDefaults, l as assertCryptoKey, q as base64Decode, u as base64Encode, f as base64UrlDecode, d as base64UrlEncode, c as computeJwtTimeClaims, k as concatUint8Arrays, D as decodeMaybeJsonString, h as decodePayloadFromB64UrlSegment, o as decodePayloadFromBytes, n as getPlaintextBytes, z as isAsymmetricJWK, m as isCryptoKey, x as isCryptoKeyPair, a as isJWK, g as isJWKSet, C as isJsonContent, A as isPrivateJWK, B as isPublicJWK, y as isSymmetricJWK, w as maybeArray, r as randomBytes, s as sanitizeObject, e as textDecoder, t as textEncoder, p as validateCriticalHeadersJWE, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './shared/unjwt.BEjwP_9W.mjs';
+export { b as applyTypCtyDefaults, l as assertCryptoKey, q as base64Decode, u as base64Encode, f as base64UrlDecode, d as base64UrlEncode, c as computeJwtTimeClaims, k as concatUint8Arrays, D as decodeMaybeJWTString, h as decodePayloadFromB64UrlSegment, o as decodePayloadFromBytes, n as getPlaintextBytes, z as isAsymmetricJWK, m as isCryptoKey, x as isCryptoKeyPair, a as isJWK, g as isJWKSet, C as isJWTContent, A as isPrivateJWK, B as isPublicJWK, y as isSymmetricJWK, w as maybeArray, r as randomBytes, s as sanitizeObject, e as textDecoder, t as textEncoder, p as validateCriticalHeadersJWE, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './shared/unjwt.CRHfsi7v.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.14",
+  "version": "0.5.16",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",
@@ -47,20 +47,21 @@
     "release": "pnpm test && pnpm prepack && changelogen --release --push --publish",
     "test": "pnpm lint && pnpm test:types && vitest run --slowTestThreshold=500",
     "test:coverage": "pnpm lint && pnpm test:types && vitest run --coverage --slowTestThreshold=500",
-    "test:types": "tsc --noEmit --skipLibCheck"
+    "test:types": "tsc --noEmit --skipLibCheck",
+    "bench": "vitest bench --run"
   },
   "devDependencies": {
-    "@types/node": "^22.13.14",
+    "@types/node": "^22",
     "@vitest/coverage-v8": "^3.2.4",
-    "automd": "^0.4.0",
+    "automd": "^0.4.2",
     "changelogen": "^0.6.2",
-    "eslint": "^9.34.0",
+    "eslint": "^9.36.0",
     "eslint-config-unjs": "^0.5.0",
-    "jose": "^6.0.13",
+    "jose": "^6.1.0",
     "prettier": "^3.6.2",
     "typescript": "^5.9.2",
     "unbuild": "^3.6.1",
     "vitest": "^3.2.4"
   },
-  "packageManager": "pnpm@10.15.0"
+  "packageManager": "pnpm@10.17.1"
 }