unjwt 0.5.15 → 0.5.17

package/dist/shared/{unjwt.BeWVYyaf.d.mts → unjwt.BQUETRUD.d.mts}

@@ -1,4 +1,4 @@
-import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, O as JoseHeaderParameters, f as JWK_EC_Public, r as JWK, R as JWTClaimValidationOptions, P as JWTClaims, Q as JWT } from './unjwt.BsgIQHVD.mjs';
+import { K as KeyManagementAlgorithm, f as ContentEncryptionAlgorithm, Q as JoseHeaderParameters, h as JWK_EC_Public, i as JWK_EC_Private, t as JWK, T as JWTClaimValidationOptions, R as JWTClaims, C as CompositeKey, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, O as JWKAlgorithm, P as JWKPEMAlgorithm, J as JWKParameters, u as JWKSet, E as JWK_AES_CBC_HMAC, F as JWK_AES_GCM, B as JWK_AES_GCM_KW, A as JWK_AES_KW, N as JWK_Asymmetric_Algorithm, j as JWK_EC, I as JWK_ECDH_ES, y as JWK_ECDSA, v as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, L as JWK_OKP_SIGN, H as JWK_PBES2, s as JWK_Private, r as JWK_Public, m as JWK_RSA, z as JWK_RSA_ENC, x as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, w as JWK_RSA_SIGN, M as JWK_Symmetric_Algorithm, q as JWK_oct, S as JWT, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './unjwt.ClaeEBcy.mjs';
 
 /** Recognized JWE Header Parameters, any other Header Members may also be present. */
 interface JWEHeaderParameters extends JoseHeaderParameters {
@@ -60,7 +60,11 @@ interface JWEKeyManagementHeaderParameters {
     /**
      * For Internal use only
      */
-    epk?: CryptoKey;
+    epk?: CryptoKey | JWK_EC_Public;
+    /**
+     * For Internal use only
+     */
+    epkPrivateKey?: CryptoKey | JWK_EC_Private;
 }
 /**
  * JWE (JSON Web Encryption) encryption options
@@ -75,17 +79,28 @@ interface JWEEncryptOptions {
     /** Time at which the JWT should expire, if no `exp` was already provided (only when typ is "JWT" or explicitly parsing JWT). */
     expiresIn?: number;
     /** Additional JWE Protected Header parameters. */
-    protectedHeader?: Omit<JWEHeaderParameters, "alg" | "enc" | "iv" | "tag" | "p2s" | "p2c" | "apu" | "apv">;
+    protectedHeader?: Omit<JWEHeaderParameters, "alg" | "enc" | "iv" | "tag" | "p2s" | "p2c" | "epk" | "apu" | "apv">;
     /** Initialization Vector for AES-GCMKW key wrapping. Generated if not provided. */
     keyManagementIV?: Uint8Array<ArrayBuffer>;
     /** PBES2 Salt value (p2s). Required for PBES2 algorithms. */
     p2s?: Uint8Array<ArrayBuffer>;
     /** PBES2 Iteration count (p2c). Required for PBES2 algorithms. */
     p2c?: number;
-    /** ECDH-ES Agreement PartyUInfo. */
-    ecdhPartyUInfo?: Uint8Array<ArrayBuffer>;
-    /** ECDH-ES Agreement PartyVInfo. */
-    ecdhPartyVInfo?: Uint8Array<ArrayBuffer>;
+    /** ECDH-ES specific options. */
+    ecdh?: {
+        /**
+         * ECDH-ES Ephemeral key material. Provide a private key (CryptoKey or JWK),
+         * a CryptoKeyPair, or an object exposing both public and private parts.
+         */
+        ephemeralKey?: CryptoKey | JWK_EC_Private | CryptoKeyPair | {
+            publicKey: CryptoKey | JWK_EC_Public;
+            privateKey: CryptoKey | JWK_EC_Private;
+        };
+        /** ECDH-ES Agreement PartyUInfo. */
+        partyUInfo?: Uint8Array<ArrayBuffer>;
+        /** ECDH-ES Agreement PartyVInfo. */
+        partyVInfo?: Uint8Array<ArrayBuffer>;
+    };
     /**
      * Content Encryption Key (CEK) to use.
      * If provided, it will be used directly. Otherwise, a CEK will be generated.
@@ -172,20 +187,64 @@ declare function decrypt(jwe: string, key: CryptoKey | JWK | string | Uint8Array
     forceUint8Array: true;
 }): Promise<JWEDecryptResult<Uint8Array<ArrayBuffer>>>;
 
+declare const jwe_CompositeKey: typeof CompositeKey;
+declare const jwe_ContentEncryptionAlgorithm: typeof ContentEncryptionAlgorithm;
+declare const jwe_DeriveKeyOptions: typeof DeriveKeyOptions;
+declare const jwe_DeriveKeyReturn: typeof DeriveKeyReturn;
+declare const jwe_GenerateJWKOptions: typeof GenerateJWKOptions;
+declare const jwe_GenerateJWKReturn: typeof GenerateJWKReturn;
+declare const jwe_GenerateKeyAlgorithm: typeof GenerateKeyAlgorithm;
+declare const jwe_GenerateKeyOptions: typeof GenerateKeyOptions;
+declare const jwe_GenerateKeyReturn: typeof GenerateKeyReturn;
 type jwe_JWEDecryptOptions = JWEDecryptOptions;
 type jwe_JWEDecryptResult<T extends JWTClaims | Uint8Array<ArrayBuffer> | string = JWTClaims | Uint8Array<ArrayBuffer> | string> = JWEDecryptResult<T>;
 type jwe_JWEEncryptOptions = JWEEncryptOptions;
 type jwe_JWEHeaderParameters = JWEHeaderParameters;
 type jwe_JWEKeyLookupFunction = JWEKeyLookupFunction;
 type jwe_JWEKeyManagementHeaderParameters = JWEKeyManagementHeaderParameters;
+declare const jwe_JWK: typeof JWK;
+declare const jwe_JWKAlgorithm: typeof JWKAlgorithm;
+declare const jwe_JWKPEMAlgorithm: typeof JWKPEMAlgorithm;
+declare const jwe_JWKParameters: typeof JWKParameters;
+declare const jwe_JWKSet: typeof JWKSet;
+declare const jwe_JWK_AES_CBC_HMAC: typeof JWK_AES_CBC_HMAC;
+declare const jwe_JWK_AES_GCM: typeof JWK_AES_GCM;
+declare const jwe_JWK_AES_GCM_KW: typeof JWK_AES_GCM_KW;
+declare const jwe_JWK_AES_KW: typeof JWK_AES_KW;
+declare const jwe_JWK_Asymmetric_Algorithm: typeof JWK_Asymmetric_Algorithm;
+declare const jwe_JWK_EC: typeof JWK_EC;
+declare const jwe_JWK_ECDH_ES: typeof JWK_ECDH_ES;
+declare const jwe_JWK_ECDSA: typeof JWK_ECDSA;
+declare const jwe_JWK_EC_Private: typeof JWK_EC_Private;
+declare const jwe_JWK_EC_Public: typeof JWK_EC_Public;
+declare const jwe_JWK_HMAC: typeof JWK_HMAC;
+declare const jwe_JWK_OKP: typeof JWK_OKP;
+declare const jwe_JWK_OKP_Private: typeof JWK_OKP_Private;
+declare const jwe_JWK_OKP_Public: typeof JWK_OKP_Public;
+declare const jwe_JWK_OKP_SIGN: typeof JWK_OKP_SIGN;
+declare const jwe_JWK_PBES2: typeof JWK_PBES2;
+declare const jwe_JWK_Private: typeof JWK_Private;
+declare const jwe_JWK_Public: typeof JWK_Public;
+declare const jwe_JWK_RSA: typeof JWK_RSA;
+declare const jwe_JWK_RSA_ENC: typeof JWK_RSA_ENC;
+declare const jwe_JWK_RSA_PSS: typeof JWK_RSA_PSS;
+declare const jwe_JWK_RSA_Private: typeof JWK_RSA_Private;
+declare const jwe_JWK_RSA_Public: typeof JWK_RSA_Public;
+declare const jwe_JWK_RSA_SIGN: typeof JWK_RSA_SIGN;
+declare const jwe_JWK_Symmetric_Algorithm: typeof JWK_Symmetric_Algorithm;
+declare const jwe_JWK_oct: typeof JWK_oct;
 declare const jwe_JWT: typeof JWT;
 declare const jwe_JWTClaimValidationOptions: typeof JWTClaimValidationOptions;
 declare const jwe_JWTClaims: typeof JWTClaims;
 declare const jwe_JoseHeaderParameters: typeof JoseHeaderParameters;
+declare const jwe_KeyManagementAlgorithm: typeof KeyManagementAlgorithm;
+declare const jwe_UnwrapKeyOptions: typeof UnwrapKeyOptions;
+declare const jwe_WrapKeyOptions: typeof WrapKeyOptions;
+declare const jwe_WrapKeyResult: typeof WrapKeyResult;
 declare const jwe_decrypt: typeof decrypt;
 declare const jwe_encrypt: typeof encrypt;
 declare namespace jwe {
-  export { jwe_JWT as JWT, jwe_JWTClaimValidationOptions as JWTClaimValidationOptions, jwe_JWTClaims as JWTClaims, jwe_JoseHeaderParameters as JoseHeaderParameters, jwe_decrypt as decrypt, jwe_encrypt as encrypt };
+  export { jwe_CompositeKey as CompositeKey, jwe_ContentEncryptionAlgorithm as ContentEncryptionAlgorithm, jwe_DeriveKeyOptions as DeriveKeyOptions, jwe_DeriveKeyReturn as DeriveKeyReturn, jwe_GenerateJWKOptions as GenerateJWKOptions, jwe_GenerateJWKReturn as GenerateJWKReturn, jwe_GenerateKeyAlgorithm as GenerateKeyAlgorithm, jwe_GenerateKeyOptions as GenerateKeyOptions, jwe_GenerateKeyReturn as GenerateKeyReturn, jwe_JWK as JWK, jwe_JWKAlgorithm as JWKAlgorithm, jwe_JWKPEMAlgorithm as JWKPEMAlgorithm, jwe_JWKParameters as JWKParameters, jwe_JWKSet as JWKSet, jwe_JWK_AES_CBC_HMAC as JWK_AES_CBC_HMAC, jwe_JWK_AES_GCM as JWK_AES_GCM, jwe_JWK_AES_GCM_KW as JWK_AES_GCM_KW, jwe_JWK_AES_KW as JWK_AES_KW, jwe_JWK_Asymmetric_Algorithm as JWK_Asymmetric_Algorithm, jwe_JWK_EC as JWK_EC, jwe_JWK_ECDH_ES as JWK_ECDH_ES, jwe_JWK_ECDSA as JWK_ECDSA, jwe_JWK_EC_Private as JWK_EC_Private, jwe_JWK_EC_Public as JWK_EC_Public, jwe_JWK_HMAC as JWK_HMAC, jwe_JWK_OKP as JWK_OKP, jwe_JWK_OKP_Private as JWK_OKP_Private, jwe_JWK_OKP_Public as JWK_OKP_Public, jwe_JWK_OKP_SIGN as JWK_OKP_SIGN, jwe_JWK_PBES2 as JWK_PBES2, jwe_JWK_Private as JWK_Private, jwe_JWK_Public as JWK_Public, jwe_JWK_RSA as JWK_RSA, jwe_JWK_RSA_ENC as JWK_RSA_ENC, jwe_JWK_RSA_PSS as JWK_RSA_PSS, jwe_JWK_RSA_Private as JWK_RSA_Private, jwe_JWK_RSA_Public as JWK_RSA_Public, jwe_JWK_RSA_SIGN as JWK_RSA_SIGN, jwe_JWK_Symmetric_Algorithm as JWK_Symmetric_Algorithm, jwe_JWK_oct as JWK_oct, jwe_JWT as JWT, jwe_JWTClaimValidationOptions as JWTClaimValidationOptions, jwe_JWTClaims as JWTClaims, jwe_JoseHeaderParameters as JoseHeaderParameters, jwe_KeyManagementAlgorithm as KeyManagementAlgorithm, jwe_UnwrapKeyOptions as UnwrapKeyOptions, jwe_WrapKeyOptions as WrapKeyOptions, jwe_WrapKeyResult as WrapKeyResult, jwe_decrypt as decrypt, jwe_encrypt as encrypt };
   export type { jwe_JWEDecryptOptions as JWEDecryptOptions, jwe_JWEDecryptResult as JWEDecryptResult, jwe_JWEEncryptOptions as JWEEncryptOptions, jwe_JWEHeaderParameters as JWEHeaderParameters, jwe_JWEKeyLookupFunction as JWEKeyLookupFunction, jwe_JWEKeyManagementHeaderParameters as JWEKeyManagementHeaderParameters };
 }
 

package/dist/shared/{unjwt.u3h40Nr-.mjs → unjwt.Bui8we0H.mjs}

@@ -1,6 +1,5 @@
-import { i as importKey, g as getJWKFromSet } from './unjwt.D1MC63Yb.mjs';
-import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, e as textDecoder, f as base64UrlDecode, g as isJWKSet, h as decodePayloadFromB64UrlSegment, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './unjwt.CRHfsi7v.mjs';
-import { s as sign$1, v as verify$1 } from './unjwt.BpusjhPR.mjs';
+import { i as importKey, s as sign$1, b as getJWKFromSet, v as verify$1 } from './unjwt.A5jxFsjh.mjs';
+import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, l as textDecoder, e as base64UrlDecode, m as isJWKSet, n as decodePayloadFromB64UrlSegment, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './unjwt.tM5bsBSH.mjs';
 
 async function sign(payload, key, options = {}) {
   const { protectedHeader: additionalProtectedHeader } = options;

package/dist/shared/{unjwt.BsgIQHVD.d.mts → unjwt.ClaeEBcy.d.mts}

@@ -5,7 +5,7 @@ type CompositeKey = {
     /** The HMAC key for integrity/authentication. */
     macKey: CryptoKey;
 };
-type GenerateKeyAlgorithm = Exclude<JWKAlgorithm, "none" | "dir" | JWK_PBES2 | JWK_ECDH_ES>;
+type GenerateKeyAlgorithm = Exclude<JWKAlgorithm, "none" | "dir" | JWK_PBES2>;
 /** Options for the generateKey function. */
 interface GenerateKeyOptions {
     /** Key usages for the generated key(s). Note: For composite keys (CBC), default usages are applied separately. */
@@ -16,15 +16,25 @@ interface GenerateKeyOptions {
     modulusLength?: number;
     /** RSA public exponent. Defaults to 65537 (0x010001). */
     publicExponent?: Uint8Array<ArrayBuffer>;
+    /** Named curve for EC or OKP keys. Defaults to "P-256" for EC and "Ed25519" for OKP. */
+    namedCurve?: "P-256" | "P-384" | "P-521" | "X25519" | "Ed25519" | "Ed448";
     /** Export the generated key(s) as JWK. If true, the key(s) will be returned in JWK format. */
     toJWK?: undefined | boolean | Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">;
 }
-type GenerateKeyReturnJWK<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_Asymmetric_Algorithm ? {
-    privateKey: JWK;
-    publicKey: JWK;
-} : JWK;
+type GenerateKeyReturnJWK<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_Asymmetric_Algorithm ? TAlg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC ? {
+    privateKey: JWK_RSA_Private;
+    publicKey: JWK_RSA_Public;
+} : TAlg extends JWK_ECDSA | JWK_ECDH_ES ? {
+    privateKey: JWK_EC_Private;
+    publicKey: JWK_EC_Public;
+} : TAlg extends JWK_OKP_SIGN ? {
+    privateKey: JWK_OKP_Private;
+    publicKey: JWK_OKP_Public;
+} : never : TAlg extends JWK_AES_CBC_HMAC | JWK_Symmetric_Algorithm ? JWK_oct : never;
 type GenerateKeyReturnCrypto<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_AES_CBC_HMAC ? Uint8Array<ArrayBuffer> : TAlg extends JWK_Asymmetric_Algorithm ? CryptoKeyPair : CryptoKey;
 type GenerateKeyReturn<TAlg extends GenerateKeyAlgorithm, TOptions extends GenerateKeyOptions> = TOptions["toJWK"] extends true ? GenerateKeyReturnJWK<TAlg> : TOptions["toJWK"] extends object ? GenerateKeyReturnJWK<TAlg> : GenerateKeyReturnCrypto<TAlg>;
+type GenerateJWKOptions = Omit<GenerateKeyOptions, "toJWK">;
+type GenerateJWKReturn<TAlg extends GenerateKeyAlgorithm> = GenerateKeyReturnJWK<TAlg>;
 /** Options for the deriveKeyFromPassword function. */
 interface DeriveKeyOptions {
     /** Salt value (p2s). Must be at least 8 bytes. */
@@ -86,11 +96,13 @@ interface UnwrapKeyOptions {
     /** PBES2 Iteration count (required for PBES2). */
     p2c?: number;
     /** ECDH-ES Ephemeral Public Key (required for ECDH-ES). */
-    epk?: JWK_EC_Public;
+    epk?: JWK_EC_Public | CryptoKey;
     /** ECDH-ES Agreement PartyUInfo. Base64URL encoded or Uint8Array. */
     apu?: Uint8Array<ArrayBuffer> | string;
     /** ECDH-ES Agreement PartyVInfo. Base64URL encoded or Uint8Array. */
     apv?: Uint8Array<ArrayBuffer> | string;
+    /** Content Encryption Algorithm used with ECDH-ES (required for direct key agreement). */
+    enc?: ContentEncryptionAlgorithm;
     /** Expected unwrapped key algorithm (e.g., 'AES-GCM', 'AES-CBC'). Used by crypto.subtle.unwrapKey. */
     unwrappedKeyAlgorithm?: string | Algorithm | RsaOaepParams | AesCtrParams | AesCbcParams | AesGcmParams;
     /** Expected key usages for the unwrapped key. */
@@ -198,7 +210,7 @@ interface JWK_oct extends JWKParameters {
     k: string;
 }
 /** Public JSON Web Keys */
-type JWK_Public = JWK_RSA_Public | JWK_EC_Public | JWK_OKP_Public | JWK_oct;
+type JWK_Public = JWK_RSA_Public | JWK_EC_Public | JWK_OKP_Public;
 /** Private JSON Web Keys */
 type JWK_Private = JWK_RSA_Private | JWK_EC_Private | JWK_OKP_Private;
 /**
@@ -227,7 +239,7 @@ type JWK_PBES2 = "PBES2-HS256+A128KW" | "PBES2-HS384+A192KW" | "PBES2-HS512+A256
 type JWK_ECDH_ES = "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A192KW" | "ECDH-ES+A256KW";
 type JWK_OKP_SIGN = "Ed25519" | "EdDSA";
 type JWK_Symmetric_Algorithm = JWK_HMAC | JWK_AES_KW | JWK_AES_GCM;
-type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA_ENC | JWK_OKP_SIGN;
+type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA_ENC | JWK_OKP_SIGN | JWK_ECDH_ES;
 type JWKAlgorithm = JWK_Symmetric_Algorithm | JWK_Asymmetric_Algorithm | JWK_AES_CBC_HMAC | JWK_PBES2 | JWK_ECDH_ES | ("none" | "dir");
 type JWKPEMAlgorithm = JWK_RSA_PSS | JWK_RSA_SIGN | JWK_RSA_ENC | JWK_ECDSA | JWK_ECDH_ES | JWK_OKP_SIGN;
 
@@ -306,4 +318,4 @@ interface JWTClaimValidationOptions {
     critical?: string[];
 }
 
-export type { JWK_AES_CBC_HMAC as A, JWK_AES_GCM as B, CompositeKey as C, DeriveKeyOptions as D, JWK_PBES2 as E, JWK_ECDH_ES as F, GenerateKeyAlgorithm as G, JWK_OKP_SIGN as H, JWK_Symmetric_Algorithm as I, JWKParameters as J, KeyManagementAlgorithm as K, JWK_Asymmetric_Algorithm as L, JWKAlgorithm as M, JWKPEMAlgorithm as N, JoseHeaderParameters as O, JWTClaims as P, JWT as Q, JWTClaimValidationOptions as R, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, DeriveKeyReturn as c, ContentEncryptionAlgorithm as d, WrapKeyResult as e, JWK_EC_Public as f, JWK_EC_Private as g, JWK_EC as h, JWK_RSA_Public as i, JWK_RSA_Private as j, JWK_RSA as k, JWK_OKP_Public as l, JWK_OKP_Private as m, JWK_OKP as n, JWK_oct as o, JWK_Public as p, JWK_Private as q, JWK as r, JWKSet as s, JWK_HMAC as t, JWK_RSA_SIGN as u, JWK_RSA_PSS as v, JWK_ECDSA as w, JWK_RSA_ENC as x, JWK_AES_KW as y, JWK_AES_GCM_KW as z };
+export type { JWK_AES_KW as A, JWK_AES_GCM_KW as B, CompositeKey as C, DeriveKeyOptions as D, JWK_AES_CBC_HMAC as E, JWK_AES_GCM as F, GenerateKeyAlgorithm as G, JWK_PBES2 as H, JWK_ECDH_ES as I, JWKParameters as J, KeyManagementAlgorithm as K, JWK_OKP_SIGN as L, JWK_Symmetric_Algorithm as M, JWK_Asymmetric_Algorithm as N, JWKAlgorithm as O, JWKPEMAlgorithm as P, JoseHeaderParameters as Q, JWTClaims as R, JWT as S, JWTClaimValidationOptions as T, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, GenerateJWKOptions as c, GenerateJWKReturn as d, DeriveKeyReturn as e, ContentEncryptionAlgorithm as f, WrapKeyResult as g, JWK_EC_Public as h, JWK_EC_Private as i, JWK_EC as j, JWK_RSA_Public as k, JWK_RSA_Private as l, JWK_RSA as m, JWK_OKP_Public as n, JWK_OKP_Private as o, JWK_OKP as p, JWK_oct as q, JWK_Public as r, JWK_Private as s, JWK as t, JWKSet as u, JWK_HMAC as v, JWK_RSA_SIGN as w, JWK_RSA_PSS as x, JWK_ECDSA as y, JWK_RSA_ENC as z };

package/dist/shared/unjwt.D5J5ziZr.mjs

@@ -0,0 +1,247 @@
+import { i as importKey, e as encryptKey, g as generateIV, a as encrypt$1, u as unwrapKey, d as decrypt$1 } from './unjwt.A5jxFsjh.mjs';
+import { r as randomBytes, a as isJWK, s as sanitizeObject, b as applyTypCtyDefaults, c as computeJwtTimeClaims, g as getPlaintextBytes, d as base64UrlEncode, t as textEncoder, e as base64UrlDecode, f as decodePayloadFromBytes, v as validateCriticalHeadersJWE, h as validateJwtClaims, j as isCryptoKeyPair, k as isCryptoKey } from './unjwt.tM5bsBSH.mjs';
+
+async function encrypt(payload, key, options = {}) {
+  const {
+    protectedHeader: additionalProtectedHeader,
+    cek: providedCek,
+    contentEncryptionIV: providedContentIV,
+    keyManagementIV,
+    p2s = randomBytes(16),
+    p2c = 2048,
+    ecdh
+  } = options;
+  let { alg, enc } = options;
+  if (!alg) {
+    if (typeof key === "string" || key instanceof Uint8Array) {
+      alg = "PBES2-HS256+A128KW";
+    } else if (isJWK(key)) {
+      alg = key.alg;
+    }
+  }
+  if (!alg) {
+    throw new TypeError(
+      'JWE "alg" (Key Management Algorithm) must be provided in options or inferable from the key'
+    );
+  }
+  if (!enc) {
+    enc = isJWK(key) && "enc" in key ? key.enc : "A128GCM";
+  }
+  const jweKeyManagementParams = {};
+  if (keyManagementIV) jweKeyManagementParams.iv = keyManagementIV;
+  if (p2s) jweKeyManagementParams.p2s = p2s;
+  if (p2c) jweKeyManagementParams.p2c = p2c;
+  if (ecdh?.partyUInfo) jweKeyManagementParams.apu = ecdh.partyUInfo;
+  if (ecdh?.partyVInfo) jweKeyManagementParams.apv = ecdh.partyVInfo;
+  if (ecdh?.ephemeralKey) {
+    const { epk, epkPrivateKey } = parseEphemeralKey(ecdh.ephemeralKey);
+    jweKeyManagementParams.epk = epk;
+    jweKeyManagementParams.epkPrivateKey = epkPrivateKey;
+  }
+  const wrappingKeyMaterial = await importKey(key, alg);
+  const {
+    cek: finalCek,
+    // This is the CEK (CryptoKey | Uint8Array) to be used for content encryption
+    encryptedKey: jweEncryptedKey,
+    // This is the JWE Encrypted Key (Uint8Array | undefined)
+    parameters: keyManagementHeaderParams
+    // JWE header params from key encryption (e.g., epk, p2s, iv, tag)
+  } = await encryptKey(
+    alg,
+    enc,
+    wrappingKeyMaterial,
+    providedCek,
+    jweKeyManagementParams
+  );
+  const baseProtectedHeader = { ...additionalProtectedHeader };
+  delete baseProtectedHeader.alg;
+  delete baseProtectedHeader.enc;
+  const jweProtectedHeader = sanitizeObject({
+    ...baseProtectedHeader,
+    ...keyManagementHeaderParams,
+    alg,
+    enc
+  });
+  const protectedHeader = applyTypCtyDefaults(jweProtectedHeader, payload);
+  const computedPayload = computeJwtTimeClaims(
+    payload,
+    protectedHeader.typ,
+    options.expiresIn,
+    options.currentDate
+  );
+  const plaintextBytes = getPlaintextBytes(computedPayload || payload);
+  const protectedHeaderSerialized = JSON.stringify(protectedHeader);
+  const protectedHeaderEncoded = base64UrlEncode(protectedHeaderSerialized);
+  const aadBytes = textEncoder.encode(protectedHeaderEncoded);
+  const contentIVBytes = providedContentIV ?? generateIV(enc);
+  const {
+    ciphertext: contentCiphertext,
+    tag: contentAuthTag,
+    iv: actualContentIV
+  } = await encrypt$1(
+    enc,
+    plaintextBytes,
+    finalCek,
+    contentIVBytes,
+    aadBytes
+  );
+  if (!actualContentIV) {
+    throw new Error("Content encryption IV was not generated or returned.");
+  }
+  if (!contentAuthTag) {
+    throw new Error(
+      "Content encryption auth tag was not generated or returned."
+    );
+  }
+  const encryptedKeyEncoded = jweEncryptedKey ? base64UrlEncode(jweEncryptedKey) : "";
+  const jweParts = [
+    protectedHeaderEncoded,
+    encryptedKeyEncoded,
+    base64UrlEncode(actualContentIV),
+    base64UrlEncode(contentCiphertext),
+    base64UrlEncode(contentAuthTag)
+  ];
+  return jweParts.join(".");
+}
+async function decrypt(jwe, key, options = {}) {
+  const parts = jwe.split(".");
+  if (parts.length !== 5) {
+    throw new Error(
+      "Invalid JWE: Must contain five sections (RFC7516, section-3)."
+    );
+  }
+  const [
+    protectedHeaderEncoded,
+    encryptedKeyEncoded,
+    ivEncoded,
+    ciphertextEncoded,
+    authTagEncoded
+  ] = parts;
+  let protectedHeader;
+  try {
+    const protectedHeaderJson = base64UrlDecode(protectedHeaderEncoded);
+    protectedHeader = sanitizeObject(
+      JSON.parse(protectedHeaderJson)
+    );
+  } catch (error_) {
+    throw new Error(
+      `Invalid JWE: Protected header is not valid Base64URL or JSON (${error_ instanceof Error ? error_.message : error_})`
+    );
+  }
+  if (!protectedHeader || typeof protectedHeader !== "object" || !protectedHeader.alg || !protectedHeader.enc) {
+    throw new Error(
+      'Invalid JWE: Protected header must be an object with "alg" and "enc" properties.'
+    );
+  }
+  const alg = protectedHeader.alg;
+  const enc = protectedHeader.enc;
+  if (options?.algorithms && !options.algorithms.includes(alg)) {
+    throw new Error(`Key management algorithm not allowed: ${alg}`);
+  }
+  if (options?.encryptionAlgorithms && !options.encryptionAlgorithms.includes(enc)) {
+    throw new Error(`Content encryption algorithm not allowed: ${enc}`);
+  }
+  const resolvedKeyMaterial = typeof key === "function" ? await key(protectedHeader, jwe) : key;
+  const unwrappingKey = await importKey(resolvedKeyMaterial, alg);
+  const encryptedKeyBytes = base64UrlDecode(encryptedKeyEncoded, false);
+  const contentIVBytes = base64UrlDecode(ivEncoded, false);
+  const contentAuthTagBytes = base64UrlDecode(authTagEncoded, false);
+  const ciphertextBytes = base64UrlDecode(ciphertextEncoded, false);
+  const unwrapKeyOpts = {
+    iv: protectedHeader.iv,
+    tag: protectedHeader.tag,
+    p2s: protectedHeader.p2s,
+    p2c: protectedHeader.p2c,
+    epk: protectedHeader.epk,
+    apu: protectedHeader.apu,
+    apv: protectedHeader.apv,
+    enc,
+    unwrappedKeyAlgorithm: options?.unwrappedKeyAlgorithm,
+    keyUsage: options?.keyUsage,
+    extractable: options?.extractable,
+    returnAs: false
+    // Returning CEK as Uint8Array<ArrayBuffer>
+  };
+  const cekBytes = await unwrapKey(
+    alg,
+    encryptedKeyBytes,
+    unwrappingKey,
+    unwrapKeyOpts
+  );
+  const aadBytes = textEncoder.encode(protectedHeaderEncoded);
+  const plaintextBytes = await decrypt$1(
+    enc,
+    cekBytes,
+    ciphertextBytes,
+    contentIVBytes,
+    contentAuthTagBytes,
+    aadBytes
+  );
+  const payload = decodePayloadFromBytes(
+    plaintextBytes,
+    protectedHeader,
+    options?.forceUint8Array
+  );
+  validateCriticalHeadersJWE(protectedHeader, [
+    ...options?.critical || [],
+    ...options?.requiredHeaders || []
+  ]);
+  if (payload && typeof payload === "object" && options.validateJWT !== false && (options.validateJWT === true || protectedHeader.typ?.toLowerCase().includes("jwt")) && !options.forceUint8Array && !(payload instanceof Uint8Array)) {
+    validateJwtClaims(payload, options);
+  }
+  return {
+    payload,
+    protectedHeader,
+    cek: cekBytes,
+    aad: aadBytes
+  };
+}
+function parseEphemeralKey(ephemeralKey) {
+  let epk;
+  let epkPrivateKey;
+  if (isCryptoKeyPair(ephemeralKey)) {
+    epk = ephemeralKey.publicKey;
+    epkPrivateKey = ephemeralKey.privateKey;
+  } else if (typeof ephemeralKey === "object" && ephemeralKey !== null && "publicKey" in ephemeralKey && "privateKey" in ephemeralKey) {
+    const candidate = ephemeralKey;
+    if (!candidate.publicKey || !candidate.privateKey) {
+      throw new TypeError(
+        "ECDH-ES custom ephemeral key must include both publicKey and privateKey."
+      );
+    }
+    epk = candidate.publicKey;
+    epkPrivateKey = candidate.privateKey;
+  } else if (isCryptoKey(ephemeralKey)) {
+    if (ephemeralKey.type !== "private") {
+      throw new TypeError(
+        "ECDH-ES custom ephemeral CryptoKey must include private key material."
+      );
+    }
+    epk = ephemeralKey;
+    epkPrivateKey = ephemeralKey;
+  } else if (isJWK(ephemeralKey)) {
+    if (!("d" in ephemeralKey) || typeof ephemeralKey.d !== "string") {
+      throw new TypeError(
+        'ECDH-ES custom ephemeral JWK must include private parameter "d".'
+      );
+    }
+    epk = ephemeralKey;
+    epkPrivateKey = ephemeralKey;
+  } else {
+    throw new TypeError(
+      "Unsupported ECDH-ES ephemeral key material provided in options."
+    );
+  }
+  return {
+    epk,
+    epkPrivateKey
+  };
+}
+
+const jwe = {
+  __proto__: null,
+  decrypt: decrypt,
+  encrypt: encrypt
+};
+
+export { decrypt as d, encrypt as e, jwe as j };

package/dist/shared/{unjwt.C6b_GyXm.d.mts → unjwt.Djt8pPsc.d.mts}

@@ -1,4 +1,4 @@
-import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, E as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, o as JWK_oct, r as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, N as JWKPEMAlgorithm, s as JWKSet, O as JoseHeaderParameters, C as CompositeKey, d as ContentEncryptionAlgorithm, M as JWKAlgorithm, J as JWKParameters, A as JWK_AES_CBC_HMAC, B as JWK_AES_GCM, z as JWK_AES_GCM_KW, y as JWK_AES_KW, L as JWK_Asymmetric_Algorithm, h as JWK_EC, F as JWK_ECDH_ES, w as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, t as JWK_HMAC, n as JWK_OKP, m as JWK_OKP_Private, l as JWK_OKP_Public, H as JWK_OKP_SIGN, q as JWK_Private, p as JWK_Public, k as JWK_RSA, x as JWK_RSA_ENC, v as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, u as JWK_RSA_SIGN, I as JWK_Symmetric_Algorithm, Q as JWT, R as JWTClaimValidationOptions, P as JWTClaims } from './unjwt.BsgIQHVD.mjs';
+import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, J as JWKParameters, c as GenerateJWKOptions, d as GenerateJWKReturn, H as JWK_PBES2, D as DeriveKeyOptions, e as DeriveKeyReturn, q as JWK_oct, t as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, g as WrapKeyResult, U as UnwrapKeyOptions, P as JWKPEMAlgorithm, u as JWKSet, Q as JoseHeaderParameters, C as CompositeKey, f as ContentEncryptionAlgorithm, O as JWKAlgorithm, E as JWK_AES_CBC_HMAC, F as JWK_AES_GCM, B as JWK_AES_GCM_KW, A as JWK_AES_KW, N as JWK_Asymmetric_Algorithm, j as JWK_EC, I as JWK_ECDH_ES, y as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, v as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, L as JWK_OKP_SIGN, s as JWK_Private, r as JWK_Public, m as JWK_RSA, z as JWK_RSA_ENC, x as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, w as JWK_RSA_SIGN, M as JWK_Symmetric_Algorithm, S as JWT, T as JWTClaimValidationOptions, R as JWTClaims } from './unjwt.ClaeEBcy.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -22,6 +22,15 @@ interface KeyImportOptions {
  * @returns A Promise resolving to the generated key (CryptoKey, CryptoKeyPair, or Uint8Array) or its JWK representation.
  */
 declare function generateKey<TAlg extends GenerateKeyAlgorithm, TOptions extends GenerateKeyOptions>(alg: TAlg, options?: TOptions): Promise<GenerateKeyReturn<TAlg, TOptions>>;
+/**
+ * Generates a Json Web Key (JWK) for the specified algorithm.
+ *
+ * @param alg The JWA algorithm identifier (e.g., "HS256", "RS256", "A128GCM").
+ * @param jwkParams Optional partial JWK to merge with the generated key, allowing overrides.
+ * @param options Configuration options for key generation.
+ * @returns A Promise resolving to the generated JWK or JWK pair representation.
+ */
+declare function generateJWK<TAlg extends GenerateKeyAlgorithm>(alg: TAlg, jwkParams?: Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">, options?: GenerateJWKOptions): Promise<GenerateJWKReturn<TAlg>>;
 /**
  * Derives a key from a password using PBKDF2 as specified by PBES2 algorithms.
  *
@@ -124,6 +133,8 @@ declare const jwk_CompositeKey: typeof CompositeKey;
 declare const jwk_ContentEncryptionAlgorithm: typeof ContentEncryptionAlgorithm;
 declare const jwk_DeriveKeyOptions: typeof DeriveKeyOptions;
 declare const jwk_DeriveKeyReturn: typeof DeriveKeyReturn;
+declare const jwk_GenerateJWKOptions: typeof GenerateJWKOptions;
+declare const jwk_GenerateJWKReturn: typeof GenerateJWKReturn;
 declare const jwk_GenerateKeyAlgorithm: typeof GenerateKeyAlgorithm;
 declare const jwk_GenerateKeyOptions: typeof GenerateKeyOptions;
 declare const jwk_GenerateKeyReturn: typeof GenerateKeyReturn;
@@ -169,6 +180,7 @@ declare const jwk_WrapKeyResult: typeof WrapKeyResult;
 declare const jwk_deriveKeyFromPassword: typeof deriveKeyFromPassword;
 declare const jwk_exportJWKToPEM: typeof exportJWKToPEM;
 declare const jwk_exportKey: typeof exportKey;
+declare const jwk_generateJWK: typeof generateJWK;
 declare const jwk_generateKey: typeof generateKey;
 declare const jwk_getJWKFromSet: typeof getJWKFromSet;
 declare const jwk_importJWKFromPEM: typeof importJWKFromPEM;
@@ -181,6 +193,8 @@ declare namespace jwk {
     jwk_ContentEncryptionAlgorithm as ContentEncryptionAlgorithm,
     jwk_DeriveKeyOptions as DeriveKeyOptions,
     jwk_DeriveKeyReturn as DeriveKeyReturn,
+    jwk_GenerateJWKOptions as GenerateJWKOptions,
+    jwk_GenerateJWKReturn as GenerateJWKReturn,
     jwk_GenerateKeyAlgorithm as GenerateKeyAlgorithm,
     jwk_GenerateKeyOptions as GenerateKeyOptions,
     jwk_GenerateKeyReturn as GenerateKeyReturn,
@@ -226,6 +240,7 @@ declare namespace jwk {
     jwk_deriveKeyFromPassword as deriveKeyFromPassword,
     jwk_exportJWKToPEM as exportJWKToPEM,
     jwk_exportKey as exportKey,
+    jwk_generateJWK as generateJWK,
     jwk_generateKey as generateKey,
     jwk_getJWKFromSet as getJWKFromSet,
     jwk_importJWKFromPEM as importJWKFromPEM,
@@ -235,4 +250,4 @@ declare namespace jwk {
   };
 }
 
-export { importJWKFromPEM as a, exportJWKToPEM as b, getJWKFromSet as c, deriveKeyFromPassword as d, exportKey as e, generateKey as g, importKey as i, jwk as j, unwrapKey as u, wrapKey as w };
+export { generateJWK as a, importJWKFromPEM as b, exportJWKToPEM as c, deriveKeyFromPassword as d, exportKey as e, getJWKFromSet as f, generateKey as g, importKey as i, jwk as j, unwrapKey as u, wrapKey as w };

package/dist/shared/{unjwt.CfL4cArP.d.mts → unjwt.DuLUtSpD.d.mts}

@@ -1,4 +1,4 @@
-import { P as JWTClaims, R as JWTClaimValidationOptions, r as JWK, s as JWKSet, o as JWK_oct, q as JWK_Private, p as JWK_Public } from './unjwt.BsgIQHVD.mjs';
+import { R as JWTClaims, T as JWTClaimValidationOptions, t as JWK, u as JWKSet, q as JWK_oct, s as JWK_Private, r as JWK_Public } from './unjwt.ClaeEBcy.mjs';
 
 /**
  * Apply default typ/cty semantics shared by JWS & JWE.
@@ -85,9 +85,9 @@ declare function assertCryptoKey(key: unknown): asserts key is CryptoKey;
 declare function isCryptoKey(key: unknown): key is CryptoKey;
 declare const isCryptoKeyPair: (key: any) => key is CryptoKeyPair;
 /** Returns true if the JWK is a symmetric (oct) key. */
-declare function isSymmetricJWK(key: unknown): key is JWK_oct;
+declare function isSymmetricJWK(key: unknown): key is Extract<JWK, JWK_oct>;
 /** Returns true if the JWK is an asymmetric (RSA, EC, OKP) key. */
-declare function isAsymmetricJWK(key: unknown): key is JWK_oct;
+declare function isAsymmetricJWK(key: unknown): key is Exclude<JWK, JWK_oct>;
 /**
  * Type guard that checks if the provided JWK contains private key material.
  * It relies purely on the presence of private components (e.g. "d"), not on the alg value.

package/dist/shared/{unjwt.Bw4pzdE0.d.mts → unjwt.fumhLslo.d.mts}

@@ -1,4 +1,4 @@
-import { t as JWK_HMAC, u as JWK_RSA_SIGN, v as JWK_RSA_PSS, w as JWK_ECDSA, O as JoseHeaderParameters, r as JWK, s as JWKSet, R as JWTClaimValidationOptions, P as JWTClaims, Q as JWT } from './unjwt.BsgIQHVD.mjs';
+import { v as JWK_HMAC, w as JWK_RSA_SIGN, x as JWK_RSA_PSS, y as JWK_ECDSA, Q as JoseHeaderParameters, t as JWK, u as JWKSet, T as JWTClaimValidationOptions, R as JWTClaims, C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, O as JWKAlgorithm, P as JWKPEMAlgorithm, J as JWKParameters, E as JWK_AES_CBC_HMAC, F as JWK_AES_GCM, B as JWK_AES_GCM_KW, A as JWK_AES_KW, N as JWK_Asymmetric_Algorithm, j as JWK_EC, I as JWK_ECDH_ES, i as JWK_EC_Private, h as JWK_EC_Public, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, L as JWK_OKP_SIGN, H as JWK_PBES2, s as JWK_Private, r as JWK_Public, m as JWK_RSA, z as JWK_RSA_ENC, l as JWK_RSA_Private, k as JWK_RSA_Public, M as JWK_Symmetric_Algorithm, q as JWK_oct, S as JWT, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './unjwt.ClaeEBcy.mjs';
 
 type JWS_SIGN_EXTRA = "Ed25519" | "EdDSA";
 /** JWS Signing Algorithm Identifier. */
@@ -100,6 +100,46 @@ declare function verify(jws: string, key: CryptoKey | JWK | JWKSet | Uint8Array<
     forceUint8Array: true;
 }): Promise<JWSVerifyResult<Uint8Array<ArrayBuffer>>>;
 
+declare const jws_CompositeKey: typeof CompositeKey;
+declare const jws_ContentEncryptionAlgorithm: typeof ContentEncryptionAlgorithm;
+declare const jws_DeriveKeyOptions: typeof DeriveKeyOptions;
+declare const jws_DeriveKeyReturn: typeof DeriveKeyReturn;
+declare const jws_GenerateJWKOptions: typeof GenerateJWKOptions;
+declare const jws_GenerateJWKReturn: typeof GenerateJWKReturn;
+declare const jws_GenerateKeyAlgorithm: typeof GenerateKeyAlgorithm;
+declare const jws_GenerateKeyOptions: typeof GenerateKeyOptions;
+declare const jws_GenerateKeyReturn: typeof GenerateKeyReturn;
+declare const jws_JWK: typeof JWK;
+declare const jws_JWKAlgorithm: typeof JWKAlgorithm;
+declare const jws_JWKPEMAlgorithm: typeof JWKPEMAlgorithm;
+declare const jws_JWKParameters: typeof JWKParameters;
+declare const jws_JWKSet: typeof JWKSet;
+declare const jws_JWK_AES_CBC_HMAC: typeof JWK_AES_CBC_HMAC;
+declare const jws_JWK_AES_GCM: typeof JWK_AES_GCM;
+declare const jws_JWK_AES_GCM_KW: typeof JWK_AES_GCM_KW;
+declare const jws_JWK_AES_KW: typeof JWK_AES_KW;
+declare const jws_JWK_Asymmetric_Algorithm: typeof JWK_Asymmetric_Algorithm;
+declare const jws_JWK_EC: typeof JWK_EC;
+declare const jws_JWK_ECDH_ES: typeof JWK_ECDH_ES;
+declare const jws_JWK_ECDSA: typeof JWK_ECDSA;
+declare const jws_JWK_EC_Private: typeof JWK_EC_Private;
+declare const jws_JWK_EC_Public: typeof JWK_EC_Public;
+declare const jws_JWK_HMAC: typeof JWK_HMAC;
+declare const jws_JWK_OKP: typeof JWK_OKP;
+declare const jws_JWK_OKP_Private: typeof JWK_OKP_Private;
+declare const jws_JWK_OKP_Public: typeof JWK_OKP_Public;
+declare const jws_JWK_OKP_SIGN: typeof JWK_OKP_SIGN;
+declare const jws_JWK_PBES2: typeof JWK_PBES2;
+declare const jws_JWK_Private: typeof JWK_Private;
+declare const jws_JWK_Public: typeof JWK_Public;
+declare const jws_JWK_RSA: typeof JWK_RSA;
+declare const jws_JWK_RSA_ENC: typeof JWK_RSA_ENC;
+declare const jws_JWK_RSA_PSS: typeof JWK_RSA_PSS;
+declare const jws_JWK_RSA_Private: typeof JWK_RSA_Private;
+declare const jws_JWK_RSA_Public: typeof JWK_RSA_Public;
+declare const jws_JWK_RSA_SIGN: typeof JWK_RSA_SIGN;
+declare const jws_JWK_Symmetric_Algorithm: typeof JWK_Symmetric_Algorithm;
+declare const jws_JWK_oct: typeof JWK_oct;
 type jws_JWSAlgorithm = JWSAlgorithm;
 type jws_JWSHeaderParameters = JWSHeaderParameters;
 type jws_JWSKeyLookupFunction = JWSKeyLookupFunction;
@@ -111,10 +151,14 @@ declare const jws_JWT: typeof JWT;
 declare const jws_JWTClaimValidationOptions: typeof JWTClaimValidationOptions;
 declare const jws_JWTClaims: typeof JWTClaims;
 declare const jws_JoseHeaderParameters: typeof JoseHeaderParameters;
+declare const jws_KeyManagementAlgorithm: typeof KeyManagementAlgorithm;
+declare const jws_UnwrapKeyOptions: typeof UnwrapKeyOptions;
+declare const jws_WrapKeyOptions: typeof WrapKeyOptions;
+declare const jws_WrapKeyResult: typeof WrapKeyResult;
 declare const jws_sign: typeof sign;
 declare const jws_verify: typeof verify;
 declare namespace jws {
-  export { jws_JWT as JWT, jws_JWTClaimValidationOptions as JWTClaimValidationOptions, jws_JWTClaims as JWTClaims, jws_JoseHeaderParameters as JoseHeaderParameters, jws_sign as sign, jws_verify as verify };
+  export { jws_CompositeKey as CompositeKey, jws_ContentEncryptionAlgorithm as ContentEncryptionAlgorithm, jws_DeriveKeyOptions as DeriveKeyOptions, jws_DeriveKeyReturn as DeriveKeyReturn, jws_GenerateJWKOptions as GenerateJWKOptions, jws_GenerateJWKReturn as GenerateJWKReturn, jws_GenerateKeyAlgorithm as GenerateKeyAlgorithm, jws_GenerateKeyOptions as GenerateKeyOptions, jws_GenerateKeyReturn as GenerateKeyReturn, jws_JWK as JWK, jws_JWKAlgorithm as JWKAlgorithm, jws_JWKPEMAlgorithm as JWKPEMAlgorithm, jws_JWKParameters as JWKParameters, jws_JWKSet as JWKSet, jws_JWK_AES_CBC_HMAC as JWK_AES_CBC_HMAC, jws_JWK_AES_GCM as JWK_AES_GCM, jws_JWK_AES_GCM_KW as JWK_AES_GCM_KW, jws_JWK_AES_KW as JWK_AES_KW, jws_JWK_Asymmetric_Algorithm as JWK_Asymmetric_Algorithm, jws_JWK_EC as JWK_EC, jws_JWK_ECDH_ES as JWK_ECDH_ES, jws_JWK_ECDSA as JWK_ECDSA, jws_JWK_EC_Private as JWK_EC_Private, jws_JWK_EC_Public as JWK_EC_Public, jws_JWK_HMAC as JWK_HMAC, jws_JWK_OKP as JWK_OKP, jws_JWK_OKP_Private as JWK_OKP_Private, jws_JWK_OKP_Public as JWK_OKP_Public, jws_JWK_OKP_SIGN as JWK_OKP_SIGN, jws_JWK_PBES2 as JWK_PBES2, jws_JWK_Private as JWK_Private, jws_JWK_Public as JWK_Public, jws_JWK_RSA as JWK_RSA, jws_JWK_RSA_ENC as JWK_RSA_ENC, jws_JWK_RSA_PSS as JWK_RSA_PSS, jws_JWK_RSA_Private as JWK_RSA_Private, jws_JWK_RSA_Public as JWK_RSA_Public, jws_JWK_RSA_SIGN as JWK_RSA_SIGN, jws_JWK_Symmetric_Algorithm as JWK_Symmetric_Algorithm, jws_JWK_oct as JWK_oct, jws_JWT as JWT, jws_JWTClaimValidationOptions as JWTClaimValidationOptions, jws_JWTClaims as JWTClaims, jws_JoseHeaderParameters as JoseHeaderParameters, jws_KeyManagementAlgorithm as KeyManagementAlgorithm, jws_UnwrapKeyOptions as UnwrapKeyOptions, jws_WrapKeyOptions as WrapKeyOptions, jws_WrapKeyResult as WrapKeyResult, jws_sign as sign, jws_verify as verify };
   export type { jws_JWSAlgorithm as JWSAlgorithm, jws_JWSHeaderParameters as JWSHeaderParameters, jws_JWSKeyLookupFunction as JWSKeyLookupFunction, jws_JWSProtectedHeader as JWSProtectedHeader, jws_JWSSignOptions as JWSSignOptions, jws_JWSVerifyOptions as JWSVerifyOptions, jws_JWSVerifyResult as JWSVerifyResult };
 }
 

package/dist/shared/{unjwt.CRHfsi7v.mjs → unjwt.tM5bsBSH.mjs}

@@ -384,4 +384,4 @@ const index = {
   validateJwtClaims: validateJwtClaims
 };
 
-export { isPrivateJWK as A, isPublicJWK as B, isJWTContent as C, decodeMaybeJWTString as D, isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, textDecoder as e, base64UrlDecode as f, isJWKSet as g, decodePayloadFromB64UrlSegment as h, index as i, validateJwtClaims as j, concatUint8Arrays as k, assertCryptoKey as l, isCryptoKey as m, getPlaintextBytes as n, decodePayloadFromBytes as o, validateCriticalHeadersJWE as p, base64Decode as q, randomBytes as r, sanitizeObject as s, textEncoder as t, base64Encode as u, validateCriticalHeadersJWS as v, maybeArray as w, isCryptoKeyPair as x, isSymmetricJWK as y, isAsymmetricJWK as z };
+export { isPrivateJWK as A, isPublicJWK as B, isJWTContent as C, decodeMaybeJWTString as D, isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, base64UrlDecode as e, decodePayloadFromBytes as f, getPlaintextBytes as g, validateJwtClaims as h, index as i, isCryptoKeyPair as j, isCryptoKey as k, textDecoder as l, isJWKSet as m, decodePayloadFromB64UrlSegment as n, validateCriticalHeadersJWS as o, concatUint8Arrays as p, base64Decode as q, randomBytes as r, sanitizeObject as s, textEncoder as t, base64Encode as u, validateCriticalHeadersJWE as v, assertCryptoKey as w, isAsymmetricJWK as x, maybeArray as y, isSymmetricJWK as z };

package/dist/utils.d.mts

@@ -1,2 +1,2 @@
-import './shared/unjwt.BsgIQHVD.mjs';
-export { s as applyTypCtyDefaults, j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, z as computeJwtTimeClaims, f as concatUint8Arrays, v as decodeMaybeJWTString, x as decodePayloadFromB64UrlSegment, w as decodePayloadFromBytes, y as getPlaintextBytes, o as isAsymmetricJWK, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, u as isJWTContent, p as isPrivateJWK, q as isPublicJWK, n as isSymmetricJWK, m as maybeArray, r as randomBytes, D as sanitizeObject, a as textDecoder, t as textEncoder, C as validateCriticalHeadersJWE, B as validateCriticalHeadersJWS, A as validateJwtClaims } from './shared/unjwt.CfL4cArP.mjs';
+import './shared/unjwt.ClaeEBcy.mjs';
+export { s as applyTypCtyDefaults, j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, z as computeJwtTimeClaims, f as concatUint8Arrays, v as decodeMaybeJWTString, x as decodePayloadFromB64UrlSegment, w as decodePayloadFromBytes, y as getPlaintextBytes, o as isAsymmetricJWK, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, u as isJWTContent, p as isPrivateJWK, q as isPublicJWK, n as isSymmetricJWK, m as maybeArray, r as randomBytes, D as sanitizeObject, a as textDecoder, t as textEncoder, C as validateCriticalHeadersJWE, B as validateCriticalHeadersJWS, A as validateJwtClaims } from './shared/unjwt.DuLUtSpD.mjs';

package/dist/utils.mjs

@@ -1 +1 @@
-export { b as applyTypCtyDefaults, l as assertCryptoKey, q as base64Decode, u as base64Encode, f as base64UrlDecode, d as base64UrlEncode, c as computeJwtTimeClaims, k as concatUint8Arrays, D as decodeMaybeJWTString, h as decodePayloadFromB64UrlSegment, o as decodePayloadFromBytes, n as getPlaintextBytes, z as isAsymmetricJWK, m as isCryptoKey, x as isCryptoKeyPair, a as isJWK, g as isJWKSet, C as isJWTContent, A as isPrivateJWK, B as isPublicJWK, y as isSymmetricJWK, w as maybeArray, r as randomBytes, s as sanitizeObject, e as textDecoder, t as textEncoder, p as validateCriticalHeadersJWE, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './shared/unjwt.CRHfsi7v.mjs';
+export { b as applyTypCtyDefaults, w as assertCryptoKey, q as base64Decode, u as base64Encode, e as base64UrlDecode, d as base64UrlEncode, c as computeJwtTimeClaims, p as concatUint8Arrays, D as decodeMaybeJWTString, n as decodePayloadFromB64UrlSegment, f as decodePayloadFromBytes, g as getPlaintextBytes, x as isAsymmetricJWK, k as isCryptoKey, j as isCryptoKeyPair, a as isJWK, m as isJWKSet, C as isJWTContent, A as isPrivateJWK, B as isPublicJWK, z as isSymmetricJWK, y as maybeArray, r as randomBytes, s as sanitizeObject, l as textDecoder, t as textEncoder, v as validateCriticalHeadersJWE, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './shared/unjwt.tM5bsBSH.mjs';