unjwt 0.5.16 → 0.5.17

package/dist/shared/{unjwt.BkUfaQRR.d.mts → unjwt.BQUETRUD.d.mts}

@@ -1,4 +1,4 @@
-import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, O as JoseHeaderParameters, f as JWK_EC_Public, r as JWK, R as JWTClaimValidationOptions, P as JWTClaims, C as CompositeKey, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, M as JWKAlgorithm, N as JWKPEMAlgorithm, J as JWKParameters, s as JWKSet, A as JWK_AES_CBC_HMAC, B as JWK_AES_GCM, z as JWK_AES_GCM_KW, y as JWK_AES_KW, L as JWK_Asymmetric_Algorithm, h as JWK_EC, F as JWK_ECDH_ES, w as JWK_ECDSA, g as JWK_EC_Private, t as JWK_HMAC, n as JWK_OKP, m as JWK_OKP_Private, l as JWK_OKP_Public, H as JWK_OKP_SIGN, E as JWK_PBES2, q as JWK_Private, p as JWK_Public, k as JWK_RSA, x as JWK_RSA_ENC, v as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, u as JWK_RSA_SIGN, I as JWK_Symmetric_Algorithm, o as JWK_oct, Q as JWT, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './unjwt.OzI0aGB_.mjs';
+import { K as KeyManagementAlgorithm, f as ContentEncryptionAlgorithm, Q as JoseHeaderParameters, h as JWK_EC_Public, i as JWK_EC_Private, t as JWK, T as JWTClaimValidationOptions, R as JWTClaims, C as CompositeKey, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, O as JWKAlgorithm, P as JWKPEMAlgorithm, J as JWKParameters, u as JWKSet, E as JWK_AES_CBC_HMAC, F as JWK_AES_GCM, B as JWK_AES_GCM_KW, A as JWK_AES_KW, N as JWK_Asymmetric_Algorithm, j as JWK_EC, I as JWK_ECDH_ES, y as JWK_ECDSA, v as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, L as JWK_OKP_SIGN, H as JWK_PBES2, s as JWK_Private, r as JWK_Public, m as JWK_RSA, z as JWK_RSA_ENC, x as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, w as JWK_RSA_SIGN, M as JWK_Symmetric_Algorithm, q as JWK_oct, S as JWT, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './unjwt.ClaeEBcy.mjs';
 
 /** Recognized JWE Header Parameters, any other Header Members may also be present. */
 interface JWEHeaderParameters extends JoseHeaderParameters {
@@ -60,7 +60,11 @@ interface JWEKeyManagementHeaderParameters {
     /**
      * For Internal use only
      */
-    epk?: CryptoKey;
+    epk?: CryptoKey | JWK_EC_Public;
+    /**
+     * For Internal use only
+     */
+    epkPrivateKey?: CryptoKey | JWK_EC_Private;
 }
 /**
  * JWE (JSON Web Encryption) encryption options
@@ -75,17 +79,28 @@ interface JWEEncryptOptions {
     /** Time at which the JWT should expire, if no `exp` was already provided (only when typ is "JWT" or explicitly parsing JWT). */
     expiresIn?: number;
     /** Additional JWE Protected Header parameters. */
-    protectedHeader?: Omit<JWEHeaderParameters, "alg" | "enc" | "iv" | "tag" | "p2s" | "p2c" | "apu" | "apv">;
+    protectedHeader?: Omit<JWEHeaderParameters, "alg" | "enc" | "iv" | "tag" | "p2s" | "p2c" | "epk" | "apu" | "apv">;
     /** Initialization Vector for AES-GCMKW key wrapping. Generated if not provided. */
     keyManagementIV?: Uint8Array<ArrayBuffer>;
     /** PBES2 Salt value (p2s). Required for PBES2 algorithms. */
     p2s?: Uint8Array<ArrayBuffer>;
     /** PBES2 Iteration count (p2c). Required for PBES2 algorithms. */
     p2c?: number;
-    /** ECDH-ES Agreement PartyUInfo. */
-    ecdhPartyUInfo?: Uint8Array<ArrayBuffer>;
-    /** ECDH-ES Agreement PartyVInfo. */
-    ecdhPartyVInfo?: Uint8Array<ArrayBuffer>;
+    /** ECDH-ES specific options. */
+    ecdh?: {
+        /**
+         * ECDH-ES Ephemeral key material. Provide a private key (CryptoKey or JWK),
+         * a CryptoKeyPair, or an object exposing both public and private parts.
+         */
+        ephemeralKey?: CryptoKey | JWK_EC_Private | CryptoKeyPair | {
+            publicKey: CryptoKey | JWK_EC_Public;
+            privateKey: CryptoKey | JWK_EC_Private;
+        };
+        /** ECDH-ES Agreement PartyUInfo. */
+        partyUInfo?: Uint8Array<ArrayBuffer>;
+        /** ECDH-ES Agreement PartyVInfo. */
+        partyVInfo?: Uint8Array<ArrayBuffer>;
+    };
     /**
      * Content Encryption Key (CEK) to use.
      * If provided, it will be used directly. Otherwise, a CEK will be generated.
@@ -176,6 +191,8 @@ declare const jwe_CompositeKey: typeof CompositeKey;
 declare const jwe_ContentEncryptionAlgorithm: typeof ContentEncryptionAlgorithm;
 declare const jwe_DeriveKeyOptions: typeof DeriveKeyOptions;
 declare const jwe_DeriveKeyReturn: typeof DeriveKeyReturn;
+declare const jwe_GenerateJWKOptions: typeof GenerateJWKOptions;
+declare const jwe_GenerateJWKReturn: typeof GenerateJWKReturn;
 declare const jwe_GenerateKeyAlgorithm: typeof GenerateKeyAlgorithm;
 declare const jwe_GenerateKeyOptions: typeof GenerateKeyOptions;
 declare const jwe_GenerateKeyReturn: typeof GenerateKeyReturn;
@@ -227,7 +244,7 @@ declare const jwe_WrapKeyResult: typeof WrapKeyResult;
 declare const jwe_decrypt: typeof decrypt;
 declare const jwe_encrypt: typeof encrypt;
 declare namespace jwe {
-  export { jwe_CompositeKey as CompositeKey, jwe_ContentEncryptionAlgorithm as ContentEncryptionAlgorithm, jwe_DeriveKeyOptions as DeriveKeyOptions, jwe_DeriveKeyReturn as DeriveKeyReturn, jwe_GenerateKeyAlgorithm as GenerateKeyAlgorithm, jwe_GenerateKeyOptions as GenerateKeyOptions, jwe_GenerateKeyReturn as GenerateKeyReturn, jwe_JWK as JWK, jwe_JWKAlgorithm as JWKAlgorithm, jwe_JWKPEMAlgorithm as JWKPEMAlgorithm, jwe_JWKParameters as JWKParameters, jwe_JWKSet as JWKSet, jwe_JWK_AES_CBC_HMAC as JWK_AES_CBC_HMAC, jwe_JWK_AES_GCM as JWK_AES_GCM, jwe_JWK_AES_GCM_KW as JWK_AES_GCM_KW, jwe_JWK_AES_KW as JWK_AES_KW, jwe_JWK_Asymmetric_Algorithm as JWK_Asymmetric_Algorithm, jwe_JWK_EC as JWK_EC, jwe_JWK_ECDH_ES as JWK_ECDH_ES, jwe_JWK_ECDSA as JWK_ECDSA, jwe_JWK_EC_Private as JWK_EC_Private, jwe_JWK_EC_Public as JWK_EC_Public, jwe_JWK_HMAC as JWK_HMAC, jwe_JWK_OKP as JWK_OKP, jwe_JWK_OKP_Private as JWK_OKP_Private, jwe_JWK_OKP_Public as JWK_OKP_Public, jwe_JWK_OKP_SIGN as JWK_OKP_SIGN, jwe_JWK_PBES2 as JWK_PBES2, jwe_JWK_Private as JWK_Private, jwe_JWK_Public as JWK_Public, jwe_JWK_RSA as JWK_RSA, jwe_JWK_RSA_ENC as JWK_RSA_ENC, jwe_JWK_RSA_PSS as JWK_RSA_PSS, jwe_JWK_RSA_Private as JWK_RSA_Private, jwe_JWK_RSA_Public as JWK_RSA_Public, jwe_JWK_RSA_SIGN as JWK_RSA_SIGN, jwe_JWK_Symmetric_Algorithm as JWK_Symmetric_Algorithm, jwe_JWK_oct as JWK_oct, jwe_JWT as JWT, jwe_JWTClaimValidationOptions as JWTClaimValidationOptions, jwe_JWTClaims as JWTClaims, jwe_JoseHeaderParameters as JoseHeaderParameters, jwe_KeyManagementAlgorithm as KeyManagementAlgorithm, jwe_UnwrapKeyOptions as UnwrapKeyOptions, jwe_WrapKeyOptions as WrapKeyOptions, jwe_WrapKeyResult as WrapKeyResult, jwe_decrypt as decrypt, jwe_encrypt as encrypt };
+  export { jwe_CompositeKey as CompositeKey, jwe_ContentEncryptionAlgorithm as ContentEncryptionAlgorithm, jwe_DeriveKeyOptions as DeriveKeyOptions, jwe_DeriveKeyReturn as DeriveKeyReturn, jwe_GenerateJWKOptions as GenerateJWKOptions, jwe_GenerateJWKReturn as GenerateJWKReturn, jwe_GenerateKeyAlgorithm as GenerateKeyAlgorithm, jwe_GenerateKeyOptions as GenerateKeyOptions, jwe_GenerateKeyReturn as GenerateKeyReturn, jwe_JWK as JWK, jwe_JWKAlgorithm as JWKAlgorithm, jwe_JWKPEMAlgorithm as JWKPEMAlgorithm, jwe_JWKParameters as JWKParameters, jwe_JWKSet as JWKSet, jwe_JWK_AES_CBC_HMAC as JWK_AES_CBC_HMAC, jwe_JWK_AES_GCM as JWK_AES_GCM, jwe_JWK_AES_GCM_KW as JWK_AES_GCM_KW, jwe_JWK_AES_KW as JWK_AES_KW, jwe_JWK_Asymmetric_Algorithm as JWK_Asymmetric_Algorithm, jwe_JWK_EC as JWK_EC, jwe_JWK_ECDH_ES as JWK_ECDH_ES, jwe_JWK_ECDSA as JWK_ECDSA, jwe_JWK_EC_Private as JWK_EC_Private, jwe_JWK_EC_Public as JWK_EC_Public, jwe_JWK_HMAC as JWK_HMAC, jwe_JWK_OKP as JWK_OKP, jwe_JWK_OKP_Private as JWK_OKP_Private, jwe_JWK_OKP_Public as JWK_OKP_Public, jwe_JWK_OKP_SIGN as JWK_OKP_SIGN, jwe_JWK_PBES2 as JWK_PBES2, jwe_JWK_Private as JWK_Private, jwe_JWK_Public as JWK_Public, jwe_JWK_RSA as JWK_RSA, jwe_JWK_RSA_ENC as JWK_RSA_ENC, jwe_JWK_RSA_PSS as JWK_RSA_PSS, jwe_JWK_RSA_Private as JWK_RSA_Private, jwe_JWK_RSA_Public as JWK_RSA_Public, jwe_JWK_RSA_SIGN as JWK_RSA_SIGN, jwe_JWK_Symmetric_Algorithm as JWK_Symmetric_Algorithm, jwe_JWK_oct as JWK_oct, jwe_JWT as JWT, jwe_JWTClaimValidationOptions as JWTClaimValidationOptions, jwe_JWTClaims as JWTClaims, jwe_JoseHeaderParameters as JoseHeaderParameters, jwe_KeyManagementAlgorithm as KeyManagementAlgorithm, jwe_UnwrapKeyOptions as UnwrapKeyOptions, jwe_WrapKeyOptions as WrapKeyOptions, jwe_WrapKeyResult as WrapKeyResult, jwe_decrypt as decrypt, jwe_encrypt as encrypt };
   export type { jwe_JWEDecryptOptions as JWEDecryptOptions, jwe_JWEDecryptResult as JWEDecryptResult, jwe_JWEEncryptOptions as JWEEncryptOptions, jwe_JWEHeaderParameters as JWEHeaderParameters, jwe_JWEKeyLookupFunction as JWEKeyLookupFunction, jwe_JWEKeyManagementHeaderParameters as JWEKeyManagementHeaderParameters };
 }
 

package/dist/shared/{unjwt.u3h40Nr-.mjs → unjwt.Bui8we0H.mjs}

@@ -1,6 +1,5 @@
-import { i as importKey, g as getJWKFromSet } from './unjwt.D1MC63Yb.mjs';
-import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, e as textDecoder, f as base64UrlDecode, g as isJWKSet, h as decodePayloadFromB64UrlSegment, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './unjwt.CRHfsi7v.mjs';
-import { s as sign$1, v as verify$1 } from './unjwt.BpusjhPR.mjs';
+import { i as importKey, s as sign$1, b as getJWKFromSet, v as verify$1 } from './unjwt.A5jxFsjh.mjs';
+import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, l as textDecoder, e as base64UrlDecode, m as isJWKSet, n as decodePayloadFromB64UrlSegment, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './unjwt.tM5bsBSH.mjs';
 
 async function sign(payload, key, options = {}) {
   const { protectedHeader: additionalProtectedHeader } = options;

package/dist/shared/{unjwt.OzI0aGB_.d.mts → unjwt.ClaeEBcy.d.mts}

@@ -5,7 +5,7 @@ type CompositeKey = {
     /** The HMAC key for integrity/authentication. */
     macKey: CryptoKey;
 };
-type GenerateKeyAlgorithm = Exclude<JWKAlgorithm, "none" | "dir" | JWK_PBES2 | JWK_ECDH_ES>;
+type GenerateKeyAlgorithm = Exclude<JWKAlgorithm, "none" | "dir" | JWK_PBES2>;
 /** Options for the generateKey function. */
 interface GenerateKeyOptions {
     /** Key usages for the generated key(s). Note: For composite keys (CBC), default usages are applied separately. */
@@ -16,15 +16,25 @@ interface GenerateKeyOptions {
     modulusLength?: number;
     /** RSA public exponent. Defaults to 65537 (0x010001). */
     publicExponent?: Uint8Array<ArrayBuffer>;
+    /** Named curve for EC or OKP keys. Defaults to "P-256" for EC and "Ed25519" for OKP. */
+    namedCurve?: "P-256" | "P-384" | "P-521" | "X25519" | "Ed25519" | "Ed448";
     /** Export the generated key(s) as JWK. If true, the key(s) will be returned in JWK format. */
     toJWK?: undefined | boolean | Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">;
 }
-type GenerateKeyReturnJWK<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_Asymmetric_Algorithm ? {
-    privateKey: JWK;
-    publicKey: JWK;
-} : JWK;
+type GenerateKeyReturnJWK<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_Asymmetric_Algorithm ? TAlg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC ? {
+    privateKey: JWK_RSA_Private;
+    publicKey: JWK_RSA_Public;
+} : TAlg extends JWK_ECDSA | JWK_ECDH_ES ? {
+    privateKey: JWK_EC_Private;
+    publicKey: JWK_EC_Public;
+} : TAlg extends JWK_OKP_SIGN ? {
+    privateKey: JWK_OKP_Private;
+    publicKey: JWK_OKP_Public;
+} : never : TAlg extends JWK_AES_CBC_HMAC | JWK_Symmetric_Algorithm ? JWK_oct : never;
 type GenerateKeyReturnCrypto<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_AES_CBC_HMAC ? Uint8Array<ArrayBuffer> : TAlg extends JWK_Asymmetric_Algorithm ? CryptoKeyPair : CryptoKey;
 type GenerateKeyReturn<TAlg extends GenerateKeyAlgorithm, TOptions extends GenerateKeyOptions> = TOptions["toJWK"] extends true ? GenerateKeyReturnJWK<TAlg> : TOptions["toJWK"] extends object ? GenerateKeyReturnJWK<TAlg> : GenerateKeyReturnCrypto<TAlg>;
+type GenerateJWKOptions = Omit<GenerateKeyOptions, "toJWK">;
+type GenerateJWKReturn<TAlg extends GenerateKeyAlgorithm> = GenerateKeyReturnJWK<TAlg>;
 /** Options for the deriveKeyFromPassword function. */
 interface DeriveKeyOptions {
     /** Salt value (p2s). Must be at least 8 bytes. */
@@ -86,11 +96,13 @@ interface UnwrapKeyOptions {
     /** PBES2 Iteration count (required for PBES2). */
     p2c?: number;
     /** ECDH-ES Ephemeral Public Key (required for ECDH-ES). */
-    epk?: JWK_EC_Public;
+    epk?: JWK_EC_Public | CryptoKey;
     /** ECDH-ES Agreement PartyUInfo. Base64URL encoded or Uint8Array. */
     apu?: Uint8Array<ArrayBuffer> | string;
     /** ECDH-ES Agreement PartyVInfo. Base64URL encoded or Uint8Array. */
     apv?: Uint8Array<ArrayBuffer> | string;
+    /** Content Encryption Algorithm used with ECDH-ES (required for direct key agreement). */
+    enc?: ContentEncryptionAlgorithm;
     /** Expected unwrapped key algorithm (e.g., 'AES-GCM', 'AES-CBC'). Used by crypto.subtle.unwrapKey. */
     unwrappedKeyAlgorithm?: string | Algorithm | RsaOaepParams | AesCtrParams | AesCbcParams | AesGcmParams;
     /** Expected key usages for the unwrapped key. */
@@ -227,7 +239,7 @@ type JWK_PBES2 = "PBES2-HS256+A128KW" | "PBES2-HS384+A192KW" | "PBES2-HS512+A256
 type JWK_ECDH_ES = "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A192KW" | "ECDH-ES+A256KW";
 type JWK_OKP_SIGN = "Ed25519" | "EdDSA";
 type JWK_Symmetric_Algorithm = JWK_HMAC | JWK_AES_KW | JWK_AES_GCM;
-type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA_ENC | JWK_OKP_SIGN;
+type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA_ENC | JWK_OKP_SIGN | JWK_ECDH_ES;
 type JWKAlgorithm = JWK_Symmetric_Algorithm | JWK_Asymmetric_Algorithm | JWK_AES_CBC_HMAC | JWK_PBES2 | JWK_ECDH_ES | ("none" | "dir");
 type JWKPEMAlgorithm = JWK_RSA_PSS | JWK_RSA_SIGN | JWK_RSA_ENC | JWK_ECDSA | JWK_ECDH_ES | JWK_OKP_SIGN;
 
@@ -306,4 +318,4 @@ interface JWTClaimValidationOptions {
     critical?: string[];
 }
 
-export type { JWK_AES_CBC_HMAC as A, JWK_AES_GCM as B, CompositeKey as C, DeriveKeyOptions as D, JWK_PBES2 as E, JWK_ECDH_ES as F, GenerateKeyAlgorithm as G, JWK_OKP_SIGN as H, JWK_Symmetric_Algorithm as I, JWKParameters as J, KeyManagementAlgorithm as K, JWK_Asymmetric_Algorithm as L, JWKAlgorithm as M, JWKPEMAlgorithm as N, JoseHeaderParameters as O, JWTClaims as P, JWT as Q, JWTClaimValidationOptions as R, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, DeriveKeyReturn as c, ContentEncryptionAlgorithm as d, WrapKeyResult as e, JWK_EC_Public as f, JWK_EC_Private as g, JWK_EC as h, JWK_RSA_Public as i, JWK_RSA_Private as j, JWK_RSA as k, JWK_OKP_Public as l, JWK_OKP_Private as m, JWK_OKP as n, JWK_oct as o, JWK_Public as p, JWK_Private as q, JWK as r, JWKSet as s, JWK_HMAC as t, JWK_RSA_SIGN as u, JWK_RSA_PSS as v, JWK_ECDSA as w, JWK_RSA_ENC as x, JWK_AES_KW as y, JWK_AES_GCM_KW as z };
+export type { JWK_AES_KW as A, JWK_AES_GCM_KW as B, CompositeKey as C, DeriveKeyOptions as D, JWK_AES_CBC_HMAC as E, JWK_AES_GCM as F, GenerateKeyAlgorithm as G, JWK_PBES2 as H, JWK_ECDH_ES as I, JWKParameters as J, KeyManagementAlgorithm as K, JWK_OKP_SIGN as L, JWK_Symmetric_Algorithm as M, JWK_Asymmetric_Algorithm as N, JWKAlgorithm as O, JWKPEMAlgorithm as P, JoseHeaderParameters as Q, JWTClaims as R, JWT as S, JWTClaimValidationOptions as T, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, GenerateJWKOptions as c, GenerateJWKReturn as d, DeriveKeyReturn as e, ContentEncryptionAlgorithm as f, WrapKeyResult as g, JWK_EC_Public as h, JWK_EC_Private as i, JWK_EC as j, JWK_RSA_Public as k, JWK_RSA_Private as l, JWK_RSA as m, JWK_OKP_Public as n, JWK_OKP_Private as o, JWK_OKP as p, JWK_oct as q, JWK_Public as r, JWK_Private as s, JWK as t, JWKSet as u, JWK_HMAC as v, JWK_RSA_SIGN as w, JWK_RSA_PSS as x, JWK_ECDSA as y, JWK_RSA_ENC as z };

package/dist/shared/unjwt.D5J5ziZr.mjs

@@ -0,0 +1,247 @@
+import { i as importKey, e as encryptKey, g as generateIV, a as encrypt$1, u as unwrapKey, d as decrypt$1 } from './unjwt.A5jxFsjh.mjs';
+import { r as randomBytes, a as isJWK, s as sanitizeObject, b as applyTypCtyDefaults, c as computeJwtTimeClaims, g as getPlaintextBytes, d as base64UrlEncode, t as textEncoder, e as base64UrlDecode, f as decodePayloadFromBytes, v as validateCriticalHeadersJWE, h as validateJwtClaims, j as isCryptoKeyPair, k as isCryptoKey } from './unjwt.tM5bsBSH.mjs';
+
+async function encrypt(payload, key, options = {}) {
+  const {
+    protectedHeader: additionalProtectedHeader,
+    cek: providedCek,
+    contentEncryptionIV: providedContentIV,
+    keyManagementIV,
+    p2s = randomBytes(16),
+    p2c = 2048,
+    ecdh
+  } = options;
+  let { alg, enc } = options;
+  if (!alg) {
+    if (typeof key === "string" || key instanceof Uint8Array) {
+      alg = "PBES2-HS256+A128KW";
+    } else if (isJWK(key)) {
+      alg = key.alg;
+    }
+  }
+  if (!alg) {
+    throw new TypeError(
+      'JWE "alg" (Key Management Algorithm) must be provided in options or inferable from the key'
+    );
+  }
+  if (!enc) {
+    enc = isJWK(key) && "enc" in key ? key.enc : "A128GCM";
+  }
+  const jweKeyManagementParams = {};
+  if (keyManagementIV) jweKeyManagementParams.iv = keyManagementIV;
+  if (p2s) jweKeyManagementParams.p2s = p2s;
+  if (p2c) jweKeyManagementParams.p2c = p2c;
+  if (ecdh?.partyUInfo) jweKeyManagementParams.apu = ecdh.partyUInfo;
+  if (ecdh?.partyVInfo) jweKeyManagementParams.apv = ecdh.partyVInfo;
+  if (ecdh?.ephemeralKey) {
+    const { epk, epkPrivateKey } = parseEphemeralKey(ecdh.ephemeralKey);
+    jweKeyManagementParams.epk = epk;
+    jweKeyManagementParams.epkPrivateKey = epkPrivateKey;
+  }
+  const wrappingKeyMaterial = await importKey(key, alg);
+  const {
+    cek: finalCek,
+    // This is the CEK (CryptoKey | Uint8Array) to be used for content encryption
+    encryptedKey: jweEncryptedKey,
+    // This is the JWE Encrypted Key (Uint8Array | undefined)
+    parameters: keyManagementHeaderParams
+    // JWE header params from key encryption (e.g., epk, p2s, iv, tag)
+  } = await encryptKey(
+    alg,
+    enc,
+    wrappingKeyMaterial,
+    providedCek,
+    jweKeyManagementParams
+  );
+  const baseProtectedHeader = { ...additionalProtectedHeader };
+  delete baseProtectedHeader.alg;
+  delete baseProtectedHeader.enc;
+  const jweProtectedHeader = sanitizeObject({
+    ...baseProtectedHeader,
+    ...keyManagementHeaderParams,
+    alg,
+    enc
+  });
+  const protectedHeader = applyTypCtyDefaults(jweProtectedHeader, payload);
+  const computedPayload = computeJwtTimeClaims(
+    payload,
+    protectedHeader.typ,
+    options.expiresIn,
+    options.currentDate
+  );
+  const plaintextBytes = getPlaintextBytes(computedPayload || payload);
+  const protectedHeaderSerialized = JSON.stringify(protectedHeader);
+  const protectedHeaderEncoded = base64UrlEncode(protectedHeaderSerialized);
+  const aadBytes = textEncoder.encode(protectedHeaderEncoded);
+  const contentIVBytes = providedContentIV ?? generateIV(enc);
+  const {
+    ciphertext: contentCiphertext,
+    tag: contentAuthTag,
+    iv: actualContentIV
+  } = await encrypt$1(
+    enc,
+    plaintextBytes,
+    finalCek,
+    contentIVBytes,
+    aadBytes
+  );
+  if (!actualContentIV) {
+    throw new Error("Content encryption IV was not generated or returned.");
+  }
+  if (!contentAuthTag) {
+    throw new Error(
+      "Content encryption auth tag was not generated or returned."
+    );
+  }
+  const encryptedKeyEncoded = jweEncryptedKey ? base64UrlEncode(jweEncryptedKey) : "";
+  const jweParts = [
+    protectedHeaderEncoded,
+    encryptedKeyEncoded,
+    base64UrlEncode(actualContentIV),
+    base64UrlEncode(contentCiphertext),
+    base64UrlEncode(contentAuthTag)
+  ];
+  return jweParts.join(".");
+}
+async function decrypt(jwe, key, options = {}) {
+  const parts = jwe.split(".");
+  if (parts.length !== 5) {
+    throw new Error(
+      "Invalid JWE: Must contain five sections (RFC7516, section-3)."
+    );
+  }
+  const [
+    protectedHeaderEncoded,
+    encryptedKeyEncoded,
+    ivEncoded,
+    ciphertextEncoded,
+    authTagEncoded
+  ] = parts;
+  let protectedHeader;
+  try {
+    const protectedHeaderJson = base64UrlDecode(protectedHeaderEncoded);
+    protectedHeader = sanitizeObject(
+      JSON.parse(protectedHeaderJson)
+    );
+  } catch (error_) {
+    throw new Error(
+      `Invalid JWE: Protected header is not valid Base64URL or JSON (${error_ instanceof Error ? error_.message : error_})`
+    );
+  }
+  if (!protectedHeader || typeof protectedHeader !== "object" || !protectedHeader.alg || !protectedHeader.enc) {
+    throw new Error(
+      'Invalid JWE: Protected header must be an object with "alg" and "enc" properties.'
+    );
+  }
+  const alg = protectedHeader.alg;
+  const enc = protectedHeader.enc;
+  if (options?.algorithms && !options.algorithms.includes(alg)) {
+    throw new Error(`Key management algorithm not allowed: ${alg}`);
+  }
+  if (options?.encryptionAlgorithms && !options.encryptionAlgorithms.includes(enc)) {
+    throw new Error(`Content encryption algorithm not allowed: ${enc}`);
+  }
+  const resolvedKeyMaterial = typeof key === "function" ? await key(protectedHeader, jwe) : key;
+  const unwrappingKey = await importKey(resolvedKeyMaterial, alg);
+  const encryptedKeyBytes = base64UrlDecode(encryptedKeyEncoded, false);
+  const contentIVBytes = base64UrlDecode(ivEncoded, false);
+  const contentAuthTagBytes = base64UrlDecode(authTagEncoded, false);
+  const ciphertextBytes = base64UrlDecode(ciphertextEncoded, false);
+  const unwrapKeyOpts = {
+    iv: protectedHeader.iv,
+    tag: protectedHeader.tag,
+    p2s: protectedHeader.p2s,
+    p2c: protectedHeader.p2c,
+    epk: protectedHeader.epk,
+    apu: protectedHeader.apu,
+    apv: protectedHeader.apv,
+    enc,
+    unwrappedKeyAlgorithm: options?.unwrappedKeyAlgorithm,
+    keyUsage: options?.keyUsage,
+    extractable: options?.extractable,
+    returnAs: false
+    // Returning CEK as Uint8Array<ArrayBuffer>
+  };
+  const cekBytes = await unwrapKey(
+    alg,
+    encryptedKeyBytes,
+    unwrappingKey,
+    unwrapKeyOpts
+  );
+  const aadBytes = textEncoder.encode(protectedHeaderEncoded);
+  const plaintextBytes = await decrypt$1(
+    enc,
+    cekBytes,
+    ciphertextBytes,
+    contentIVBytes,
+    contentAuthTagBytes,
+    aadBytes
+  );
+  const payload = decodePayloadFromBytes(
+    plaintextBytes,
+    protectedHeader,
+    options?.forceUint8Array
+  );
+  validateCriticalHeadersJWE(protectedHeader, [
+    ...options?.critical || [],
+    ...options?.requiredHeaders || []
+  ]);
+  if (payload && typeof payload === "object" && options.validateJWT !== false && (options.validateJWT === true || protectedHeader.typ?.toLowerCase().includes("jwt")) && !options.forceUint8Array && !(payload instanceof Uint8Array)) {
+    validateJwtClaims(payload, options);
+  }
+  return {
+    payload,
+    protectedHeader,
+    cek: cekBytes,
+    aad: aadBytes
+  };
+}
+function parseEphemeralKey(ephemeralKey) {
+  let epk;
+  let epkPrivateKey;
+  if (isCryptoKeyPair(ephemeralKey)) {
+    epk = ephemeralKey.publicKey;
+    epkPrivateKey = ephemeralKey.privateKey;
+  } else if (typeof ephemeralKey === "object" && ephemeralKey !== null && "publicKey" in ephemeralKey && "privateKey" in ephemeralKey) {
+    const candidate = ephemeralKey;
+    if (!candidate.publicKey || !candidate.privateKey) {
+      throw new TypeError(
+        "ECDH-ES custom ephemeral key must include both publicKey and privateKey."
+      );
+    }
+    epk = candidate.publicKey;
+    epkPrivateKey = candidate.privateKey;
+  } else if (isCryptoKey(ephemeralKey)) {
+    if (ephemeralKey.type !== "private") {
+      throw new TypeError(
+        "ECDH-ES custom ephemeral CryptoKey must include private key material."
+      );
+    }
+    epk = ephemeralKey;
+    epkPrivateKey = ephemeralKey;
+  } else if (isJWK(ephemeralKey)) {
+    if (!("d" in ephemeralKey) || typeof ephemeralKey.d !== "string") {
+      throw new TypeError(
+        'ECDH-ES custom ephemeral JWK must include private parameter "d".'
+      );
+    }
+    epk = ephemeralKey;
+    epkPrivateKey = ephemeralKey;
+  } else {
+    throw new TypeError(
+      "Unsupported ECDH-ES ephemeral key material provided in options."
+    );
+  }
+  return {
+    epk,
+    epkPrivateKey
+  };
+}
+
+const jwe = {
+  __proto__: null,
+  decrypt: decrypt,
+  encrypt: encrypt
+};
+
+export { decrypt as d, encrypt as e, jwe as j };

package/dist/shared/{unjwt.CbxAdgsb.d.mts → unjwt.Djt8pPsc.d.mts}

@@ -1,4 +1,4 @@
-import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, E as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, o as JWK_oct, r as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, N as JWKPEMAlgorithm, s as JWKSet, O as JoseHeaderParameters, C as CompositeKey, d as ContentEncryptionAlgorithm, M as JWKAlgorithm, J as JWKParameters, A as JWK_AES_CBC_HMAC, B as JWK_AES_GCM, z as JWK_AES_GCM_KW, y as JWK_AES_KW, L as JWK_Asymmetric_Algorithm, h as JWK_EC, F as JWK_ECDH_ES, w as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, t as JWK_HMAC, n as JWK_OKP, m as JWK_OKP_Private, l as JWK_OKP_Public, H as JWK_OKP_SIGN, q as JWK_Private, p as JWK_Public, k as JWK_RSA, x as JWK_RSA_ENC, v as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, u as JWK_RSA_SIGN, I as JWK_Symmetric_Algorithm, Q as JWT, R as JWTClaimValidationOptions, P as JWTClaims } from './unjwt.OzI0aGB_.mjs';
+import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, J as JWKParameters, c as GenerateJWKOptions, d as GenerateJWKReturn, H as JWK_PBES2, D as DeriveKeyOptions, e as DeriveKeyReturn, q as JWK_oct, t as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, g as WrapKeyResult, U as UnwrapKeyOptions, P as JWKPEMAlgorithm, u as JWKSet, Q as JoseHeaderParameters, C as CompositeKey, f as ContentEncryptionAlgorithm, O as JWKAlgorithm, E as JWK_AES_CBC_HMAC, F as JWK_AES_GCM, B as JWK_AES_GCM_KW, A as JWK_AES_KW, N as JWK_Asymmetric_Algorithm, j as JWK_EC, I as JWK_ECDH_ES, y as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, v as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, L as JWK_OKP_SIGN, s as JWK_Private, r as JWK_Public, m as JWK_RSA, z as JWK_RSA_ENC, x as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, w as JWK_RSA_SIGN, M as JWK_Symmetric_Algorithm, S as JWT, T as JWTClaimValidationOptions, R as JWTClaims } from './unjwt.ClaeEBcy.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -22,6 +22,15 @@ interface KeyImportOptions {
  * @returns A Promise resolving to the generated key (CryptoKey, CryptoKeyPair, or Uint8Array) or its JWK representation.
  */
 declare function generateKey<TAlg extends GenerateKeyAlgorithm, TOptions extends GenerateKeyOptions>(alg: TAlg, options?: TOptions): Promise<GenerateKeyReturn<TAlg, TOptions>>;
+/**
+ * Generates a Json Web Key (JWK) for the specified algorithm.
+ *
+ * @param alg The JWA algorithm identifier (e.g., "HS256", "RS256", "A128GCM").
+ * @param jwkParams Optional partial JWK to merge with the generated key, allowing overrides.
+ * @param options Configuration options for key generation.
+ * @returns A Promise resolving to the generated JWK or JWK pair representation.
+ */
+declare function generateJWK<TAlg extends GenerateKeyAlgorithm>(alg: TAlg, jwkParams?: Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">, options?: GenerateJWKOptions): Promise<GenerateJWKReturn<TAlg>>;
 /**
  * Derives a key from a password using PBKDF2 as specified by PBES2 algorithms.
  *
@@ -124,6 +133,8 @@ declare const jwk_CompositeKey: typeof CompositeKey;
 declare const jwk_ContentEncryptionAlgorithm: typeof ContentEncryptionAlgorithm;
 declare const jwk_DeriveKeyOptions: typeof DeriveKeyOptions;
 declare const jwk_DeriveKeyReturn: typeof DeriveKeyReturn;
+declare const jwk_GenerateJWKOptions: typeof GenerateJWKOptions;
+declare const jwk_GenerateJWKReturn: typeof GenerateJWKReturn;
 declare const jwk_GenerateKeyAlgorithm: typeof GenerateKeyAlgorithm;
 declare const jwk_GenerateKeyOptions: typeof GenerateKeyOptions;
 declare const jwk_GenerateKeyReturn: typeof GenerateKeyReturn;
@@ -169,6 +180,7 @@ declare const jwk_WrapKeyResult: typeof WrapKeyResult;
 declare const jwk_deriveKeyFromPassword: typeof deriveKeyFromPassword;
 declare const jwk_exportJWKToPEM: typeof exportJWKToPEM;
 declare const jwk_exportKey: typeof exportKey;
+declare const jwk_generateJWK: typeof generateJWK;
 declare const jwk_generateKey: typeof generateKey;
 declare const jwk_getJWKFromSet: typeof getJWKFromSet;
 declare const jwk_importJWKFromPEM: typeof importJWKFromPEM;
@@ -181,6 +193,8 @@ declare namespace jwk {
     jwk_ContentEncryptionAlgorithm as ContentEncryptionAlgorithm,
     jwk_DeriveKeyOptions as DeriveKeyOptions,
     jwk_DeriveKeyReturn as DeriveKeyReturn,
+    jwk_GenerateJWKOptions as GenerateJWKOptions,
+    jwk_GenerateJWKReturn as GenerateJWKReturn,
     jwk_GenerateKeyAlgorithm as GenerateKeyAlgorithm,
     jwk_GenerateKeyOptions as GenerateKeyOptions,
     jwk_GenerateKeyReturn as GenerateKeyReturn,
@@ -226,6 +240,7 @@ declare namespace jwk {
     jwk_deriveKeyFromPassword as deriveKeyFromPassword,
     jwk_exportJWKToPEM as exportJWKToPEM,
     jwk_exportKey as exportKey,
+    jwk_generateJWK as generateJWK,
     jwk_generateKey as generateKey,
     jwk_getJWKFromSet as getJWKFromSet,
     jwk_importJWKFromPEM as importJWKFromPEM,
@@ -235,4 +250,4 @@ declare namespace jwk {
   };
 }
 
-export { importJWKFromPEM as a, exportJWKToPEM as b, getJWKFromSet as c, deriveKeyFromPassword as d, exportKey as e, generateKey as g, importKey as i, jwk as j, unwrapKey as u, wrapKey as w };
+export { generateJWK as a, importJWKFromPEM as b, exportJWKToPEM as c, deriveKeyFromPassword as d, exportKey as e, getJWKFromSet as f, generateKey as g, importKey as i, jwk as j, unwrapKey as u, wrapKey as w };

package/dist/shared/{unjwt.DUVOOOvO.d.mts → unjwt.DuLUtSpD.d.mts}

@@ -1,4 +1,4 @@
-import { P as JWTClaims, R as JWTClaimValidationOptions, r as JWK, s as JWKSet, o as JWK_oct, q as JWK_Private, p as JWK_Public } from './unjwt.OzI0aGB_.mjs';
+import { R as JWTClaims, T as JWTClaimValidationOptions, t as JWK, u as JWKSet, q as JWK_oct, s as JWK_Private, r as JWK_Public } from './unjwt.ClaeEBcy.mjs';
 
 /**
  * Apply default typ/cty semantics shared by JWS & JWE.

package/dist/shared/{unjwt.r8lbwWSJ.d.mts → unjwt.fumhLslo.d.mts}

@@ -1,4 +1,4 @@
-import { t as JWK_HMAC, u as JWK_RSA_SIGN, v as JWK_RSA_PSS, w as JWK_ECDSA, O as JoseHeaderParameters, r as JWK, s as JWKSet, R as JWTClaimValidationOptions, P as JWTClaims, C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, M as JWKAlgorithm, N as JWKPEMAlgorithm, J as JWKParameters, A as JWK_AES_CBC_HMAC, B as JWK_AES_GCM, z as JWK_AES_GCM_KW, y as JWK_AES_KW, L as JWK_Asymmetric_Algorithm, h as JWK_EC, F as JWK_ECDH_ES, g as JWK_EC_Private, f as JWK_EC_Public, n as JWK_OKP, m as JWK_OKP_Private, l as JWK_OKP_Public, H as JWK_OKP_SIGN, E as JWK_PBES2, q as JWK_Private, p as JWK_Public, k as JWK_RSA, x as JWK_RSA_ENC, j as JWK_RSA_Private, i as JWK_RSA_Public, I as JWK_Symmetric_Algorithm, o as JWK_oct, Q as JWT, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './unjwt.OzI0aGB_.mjs';
+import { v as JWK_HMAC, w as JWK_RSA_SIGN, x as JWK_RSA_PSS, y as JWK_ECDSA, Q as JoseHeaderParameters, t as JWK, u as JWKSet, T as JWTClaimValidationOptions, R as JWTClaims, C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, O as JWKAlgorithm, P as JWKPEMAlgorithm, J as JWKParameters, E as JWK_AES_CBC_HMAC, F as JWK_AES_GCM, B as JWK_AES_GCM_KW, A as JWK_AES_KW, N as JWK_Asymmetric_Algorithm, j as JWK_EC, I as JWK_ECDH_ES, i as JWK_EC_Private, h as JWK_EC_Public, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, L as JWK_OKP_SIGN, H as JWK_PBES2, s as JWK_Private, r as JWK_Public, m as JWK_RSA, z as JWK_RSA_ENC, l as JWK_RSA_Private, k as JWK_RSA_Public, M as JWK_Symmetric_Algorithm, q as JWK_oct, S as JWT, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './unjwt.ClaeEBcy.mjs';
 
 type JWS_SIGN_EXTRA = "Ed25519" | "EdDSA";
 /** JWS Signing Algorithm Identifier. */
@@ -104,6 +104,8 @@ declare const jws_CompositeKey: typeof CompositeKey;
 declare const jws_ContentEncryptionAlgorithm: typeof ContentEncryptionAlgorithm;
 declare const jws_DeriveKeyOptions: typeof DeriveKeyOptions;
 declare const jws_DeriveKeyReturn: typeof DeriveKeyReturn;
+declare const jws_GenerateJWKOptions: typeof GenerateJWKOptions;
+declare const jws_GenerateJWKReturn: typeof GenerateJWKReturn;
 declare const jws_GenerateKeyAlgorithm: typeof GenerateKeyAlgorithm;
 declare const jws_GenerateKeyOptions: typeof GenerateKeyOptions;
 declare const jws_GenerateKeyReturn: typeof GenerateKeyReturn;
@@ -156,7 +158,7 @@ declare const jws_WrapKeyResult: typeof WrapKeyResult;
 declare const jws_sign: typeof sign;
 declare const jws_verify: typeof verify;
 declare namespace jws {
-  export { jws_CompositeKey as CompositeKey, jws_ContentEncryptionAlgorithm as ContentEncryptionAlgorithm, jws_DeriveKeyOptions as DeriveKeyOptions, jws_DeriveKeyReturn as DeriveKeyReturn, jws_GenerateKeyAlgorithm as GenerateKeyAlgorithm, jws_GenerateKeyOptions as GenerateKeyOptions, jws_GenerateKeyReturn as GenerateKeyReturn, jws_JWK as JWK, jws_JWKAlgorithm as JWKAlgorithm, jws_JWKPEMAlgorithm as JWKPEMAlgorithm, jws_JWKParameters as JWKParameters, jws_JWKSet as JWKSet, jws_JWK_AES_CBC_HMAC as JWK_AES_CBC_HMAC, jws_JWK_AES_GCM as JWK_AES_GCM, jws_JWK_AES_GCM_KW as JWK_AES_GCM_KW, jws_JWK_AES_KW as JWK_AES_KW, jws_JWK_Asymmetric_Algorithm as JWK_Asymmetric_Algorithm, jws_JWK_EC as JWK_EC, jws_JWK_ECDH_ES as JWK_ECDH_ES, jws_JWK_ECDSA as JWK_ECDSA, jws_JWK_EC_Private as JWK_EC_Private, jws_JWK_EC_Public as JWK_EC_Public, jws_JWK_HMAC as JWK_HMAC, jws_JWK_OKP as JWK_OKP, jws_JWK_OKP_Private as JWK_OKP_Private, jws_JWK_OKP_Public as JWK_OKP_Public, jws_JWK_OKP_SIGN as JWK_OKP_SIGN, jws_JWK_PBES2 as JWK_PBES2, jws_JWK_Private as JWK_Private, jws_JWK_Public as JWK_Public, jws_JWK_RSA as JWK_RSA, jws_JWK_RSA_ENC as JWK_RSA_ENC, jws_JWK_RSA_PSS as JWK_RSA_PSS, jws_JWK_RSA_Private as JWK_RSA_Private, jws_JWK_RSA_Public as JWK_RSA_Public, jws_JWK_RSA_SIGN as JWK_RSA_SIGN, jws_JWK_Symmetric_Algorithm as JWK_Symmetric_Algorithm, jws_JWK_oct as JWK_oct, jws_JWT as JWT, jws_JWTClaimValidationOptions as JWTClaimValidationOptions, jws_JWTClaims as JWTClaims, jws_JoseHeaderParameters as JoseHeaderParameters, jws_KeyManagementAlgorithm as KeyManagementAlgorithm, jws_UnwrapKeyOptions as UnwrapKeyOptions, jws_WrapKeyOptions as WrapKeyOptions, jws_WrapKeyResult as WrapKeyResult, jws_sign as sign, jws_verify as verify };
+  export { jws_CompositeKey as CompositeKey, jws_ContentEncryptionAlgorithm as ContentEncryptionAlgorithm, jws_DeriveKeyOptions as DeriveKeyOptions, jws_DeriveKeyReturn as DeriveKeyReturn, jws_GenerateJWKOptions as GenerateJWKOptions, jws_GenerateJWKReturn as GenerateJWKReturn, jws_GenerateKeyAlgorithm as GenerateKeyAlgorithm, jws_GenerateKeyOptions as GenerateKeyOptions, jws_GenerateKeyReturn as GenerateKeyReturn, jws_JWK as JWK, jws_JWKAlgorithm as JWKAlgorithm, jws_JWKPEMAlgorithm as JWKPEMAlgorithm, jws_JWKParameters as JWKParameters, jws_JWKSet as JWKSet, jws_JWK_AES_CBC_HMAC as JWK_AES_CBC_HMAC, jws_JWK_AES_GCM as JWK_AES_GCM, jws_JWK_AES_GCM_KW as JWK_AES_GCM_KW, jws_JWK_AES_KW as JWK_AES_KW, jws_JWK_Asymmetric_Algorithm as JWK_Asymmetric_Algorithm, jws_JWK_EC as JWK_EC, jws_JWK_ECDH_ES as JWK_ECDH_ES, jws_JWK_ECDSA as JWK_ECDSA, jws_JWK_EC_Private as JWK_EC_Private, jws_JWK_EC_Public as JWK_EC_Public, jws_JWK_HMAC as JWK_HMAC, jws_JWK_OKP as JWK_OKP, jws_JWK_OKP_Private as JWK_OKP_Private, jws_JWK_OKP_Public as JWK_OKP_Public, jws_JWK_OKP_SIGN as JWK_OKP_SIGN, jws_JWK_PBES2 as JWK_PBES2, jws_JWK_Private as JWK_Private, jws_JWK_Public as JWK_Public, jws_JWK_RSA as JWK_RSA, jws_JWK_RSA_ENC as JWK_RSA_ENC, jws_JWK_RSA_PSS as JWK_RSA_PSS, jws_JWK_RSA_Private as JWK_RSA_Private, jws_JWK_RSA_Public as JWK_RSA_Public, jws_JWK_RSA_SIGN as JWK_RSA_SIGN, jws_JWK_Symmetric_Algorithm as JWK_Symmetric_Algorithm, jws_JWK_oct as JWK_oct, jws_JWT as JWT, jws_JWTClaimValidationOptions as JWTClaimValidationOptions, jws_JWTClaims as JWTClaims, jws_JoseHeaderParameters as JoseHeaderParameters, jws_KeyManagementAlgorithm as KeyManagementAlgorithm, jws_UnwrapKeyOptions as UnwrapKeyOptions, jws_WrapKeyOptions as WrapKeyOptions, jws_WrapKeyResult as WrapKeyResult, jws_sign as sign, jws_verify as verify };
   export type { jws_JWSAlgorithm as JWSAlgorithm, jws_JWSHeaderParameters as JWSHeaderParameters, jws_JWSKeyLookupFunction as JWSKeyLookupFunction, jws_JWSProtectedHeader as JWSProtectedHeader, jws_JWSSignOptions as JWSSignOptions, jws_JWSVerifyOptions as JWSVerifyOptions, jws_JWSVerifyResult as JWSVerifyResult };
 }
 

package/dist/shared/{unjwt.CRHfsi7v.mjs → unjwt.tM5bsBSH.mjs}

@@ -384,4 +384,4 @@ const index = {
   validateJwtClaims: validateJwtClaims
 };
 
-export { isPrivateJWK as A, isPublicJWK as B, isJWTContent as C, decodeMaybeJWTString as D, isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, textDecoder as e, base64UrlDecode as f, isJWKSet as g, decodePayloadFromB64UrlSegment as h, index as i, validateJwtClaims as j, concatUint8Arrays as k, assertCryptoKey as l, isCryptoKey as m, getPlaintextBytes as n, decodePayloadFromBytes as o, validateCriticalHeadersJWE as p, base64Decode as q, randomBytes as r, sanitizeObject as s, textEncoder as t, base64Encode as u, validateCriticalHeadersJWS as v, maybeArray as w, isCryptoKeyPair as x, isSymmetricJWK as y, isAsymmetricJWK as z };
+export { isPrivateJWK as A, isPublicJWK as B, isJWTContent as C, decodeMaybeJWTString as D, isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, base64UrlDecode as e, decodePayloadFromBytes as f, getPlaintextBytes as g, validateJwtClaims as h, index as i, isCryptoKeyPair as j, isCryptoKey as k, textDecoder as l, isJWKSet as m, decodePayloadFromB64UrlSegment as n, validateCriticalHeadersJWS as o, concatUint8Arrays as p, base64Decode as q, randomBytes as r, sanitizeObject as s, textEncoder as t, base64Encode as u, validateCriticalHeadersJWE as v, assertCryptoKey as w, isAsymmetricJWK as x, maybeArray as y, isSymmetricJWK as z };

package/dist/utils.d.mts

@@ -1,2 +1,2 @@
-import './shared/unjwt.OzI0aGB_.mjs';
-export { s as applyTypCtyDefaults, j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, z as computeJwtTimeClaims, f as concatUint8Arrays, v as decodeMaybeJWTString, x as decodePayloadFromB64UrlSegment, w as decodePayloadFromBytes, y as getPlaintextBytes, o as isAsymmetricJWK, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, u as isJWTContent, p as isPrivateJWK, q as isPublicJWK, n as isSymmetricJWK, m as maybeArray, r as randomBytes, D as sanitizeObject, a as textDecoder, t as textEncoder, C as validateCriticalHeadersJWE, B as validateCriticalHeadersJWS, A as validateJwtClaims } from './shared/unjwt.DUVOOOvO.mjs';
+import './shared/unjwt.ClaeEBcy.mjs';
+export { s as applyTypCtyDefaults, j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, z as computeJwtTimeClaims, f as concatUint8Arrays, v as decodeMaybeJWTString, x as decodePayloadFromB64UrlSegment, w as decodePayloadFromBytes, y as getPlaintextBytes, o as isAsymmetricJWK, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, u as isJWTContent, p as isPrivateJWK, q as isPublicJWK, n as isSymmetricJWK, m as maybeArray, r as randomBytes, D as sanitizeObject, a as textDecoder, t as textEncoder, C as validateCriticalHeadersJWE, B as validateCriticalHeadersJWS, A as validateJwtClaims } from './shared/unjwt.DuLUtSpD.mjs';

package/dist/utils.mjs

@@ -1 +1 @@
-export { b as applyTypCtyDefaults, l as assertCryptoKey, q as base64Decode, u as base64Encode, f as base64UrlDecode, d as base64UrlEncode, c as computeJwtTimeClaims, k as concatUint8Arrays, D as decodeMaybeJWTString, h as decodePayloadFromB64UrlSegment, o as decodePayloadFromBytes, n as getPlaintextBytes, z as isAsymmetricJWK, m as isCryptoKey, x as isCryptoKeyPair, a as isJWK, g as isJWKSet, C as isJWTContent, A as isPrivateJWK, B as isPublicJWK, y as isSymmetricJWK, w as maybeArray, r as randomBytes, s as sanitizeObject, e as textDecoder, t as textEncoder, p as validateCriticalHeadersJWE, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './shared/unjwt.CRHfsi7v.mjs';
+export { b as applyTypCtyDefaults, w as assertCryptoKey, q as base64Decode, u as base64Encode, e as base64UrlDecode, d as base64UrlEncode, c as computeJwtTimeClaims, p as concatUint8Arrays, D as decodeMaybeJWTString, n as decodePayloadFromB64UrlSegment, f as decodePayloadFromBytes, g as getPlaintextBytes, x as isAsymmetricJWK, k as isCryptoKey, j as isCryptoKeyPair, a as isJWK, m as isJWKSet, C as isJWTContent, A as isPrivateJWK, B as isPublicJWK, z as isSymmetricJWK, y as maybeArray, r as randomBytes, s as sanitizeObject, l as textDecoder, t as textEncoder, v as validateCriticalHeadersJWE, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './shared/unjwt.tM5bsBSH.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.16",
+  "version": "0.5.17",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",
@@ -45,8 +45,8 @@
     "lint:fix": "automd && eslint . --fix && prettier -w .",
     "prepack": "pnpm build",
     "release": "pnpm test && pnpm prepack && changelogen --release --push --publish",
-    "test": "pnpm lint && pnpm test:types && vitest run --slowTestThreshold=500",
-    "test:coverage": "pnpm lint && pnpm test:types && vitest run --coverage --slowTestThreshold=500",
+    "test": "pnpm lint && pnpm test:types && vitest run --slowTestThreshold=1000",
+    "test:coverage": "pnpm lint && pnpm test:types && vitest run --coverage --slowTestThreshold=1000",
     "test:types": "tsc --noEmit --skipLibCheck",
     "bench": "vitest bench --run"
   },