unjwt 0.5.17 → 0.5.19

package/README.md

@@ -36,24 +36,20 @@ import { encrypt, decrypt } from "unjwt/jwe";
 // JWK functions
 import {
   generateKey,
-  importKey,
-  exportKey,
-  wrapKey,
-  unwrapKey,
-  getJWKFromSet,
+  generateJWK,
   importJWKFromPEM,
   exportJWKToPEM,
   deriveKeyFromPassword,
+  deriveJWKFromPassword,
 } from "unjwt/jwk";
 // Utility functions
 import {
   isJWK,
   isJWKSet,
-  isCryptoKey,
-  isCryptoKeyPair,
-  base64UrlEncode,
-  base64UrlDecode,
-  randomBytes,
+  isSymmetricJWK,
+  isAsymmetricJWK,
+  isPrivateJWK,
+  isPublicJWK,
 } from "unjwt/utils";
 ```
 
@@ -68,24 +64,20 @@ import { encrypt, decrypt } from "https://esm.sh/unjwt/jwe";
 // JWK functions
 import {
   generateKey,
-  importKey,
-  exportKey,
-  wrapKey,
-  unwrapKey,
-  getJWKFromSet,
+  generateJWK,
   importJWKFromPEM,
   exportJWKToPEM,
   deriveKeyFromPassword,
+  deriveJWKFromPassword,
 } from "https://esm.sh/unjwt/jwk";
 // Utility functions
 import {
   isJWK,
   isJWKSet,
-  isCryptoKey,
-  isCryptoKeyPair,
-  base64UrlEncode,
-  base64UrlDecode,
-  randomBytes,
+  isSymmetricJWK,
+  isAsymmetricJWK,
+  isPrivateJWK,
+  isPublicJWK,
 } from "https://esm.sh/unjwt/utils";
 ```
 

package/dist/index.d.mts

@@ -1,5 +1,6 @@
-export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, t as JWK, O as JWKAlgorithm, P as JWKPEMAlgorithm, J as JWKParameters, u as JWKSet, E as JWK_AES_CBC_HMAC, F as JWK_AES_GCM, B as JWK_AES_GCM_KW, A as JWK_AES_KW, N as JWK_Asymmetric_Algorithm, j as JWK_EC, I as JWK_ECDH_ES, y as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, v as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, L as JWK_OKP_SIGN, H as JWK_PBES2, s as JWK_Private, r as JWK_Public, m as JWK_RSA, z as JWK_RSA_ENC, x as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, w as JWK_RSA_SIGN, M as JWK_Symmetric_Algorithm, q as JWK_oct, S as JWT, T as JWTClaimValidationOptions, R as JWTClaims, Q as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './shared/unjwt.ClaeEBcy.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.fumhLslo.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.BQUETRUD.mjs';
-export { i as utils } from './shared/unjwt.DuLUtSpD.mjs';
-export { j as jwk } from './shared/unjwt.Djt8pPsc.mjs';
+export { E as ExpiresIn } from './shared/unjwt.b323eNLO.mjs';
+export { i as utils } from './shared/unjwt.cZWaB7OK.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.BoKDWMcu.mjs';
+export { j as jwk } from './shared/unjwt.DMz8YzKh.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.DYM9KPZR.mjs';
+export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, t as JWK, O as JWKAlgorithm, P as JWKPEMAlgorithm, J as JWKParameters, u as JWKSet, E as JWK_AES_CBC_HMAC, F as JWK_AES_GCM, B as JWK_AES_GCM_KW, A as JWK_AES_KW, N as JWK_Asymmetric_Algorithm, j as JWK_EC, I as JWK_ECDH_ES, y as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, v as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, L as JWK_OKP_SIGN, H as JWK_PBES2, s as JWK_Private, r as JWK_Public, m as JWK_RSA, z as JWK_RSA_ENC, x as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, w as JWK_RSA_SIGN, M as JWK_Symmetric_Algorithm, q as JWK_oct, S as JWT, T as JWTClaimValidationOptions, R as JWTClaims, Q as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './shared/unjwt.Ca4-7Myr.mjs';

package/dist/index.mjs

@@ -1,4 +1,4 @@
-export { i as utils } from './shared/unjwt.tM5bsBSH.mjs';
-export { j as jwe } from './shared/unjwt.D5J5ziZr.mjs';
-export { j as jwk } from './shared/unjwt.A5jxFsjh.mjs';
-export { j as jws } from './shared/unjwt.Bui8we0H.mjs';
+export { i as utils } from './shared/unjwt.BhoZWy2Y.mjs';
+export { j as jwe } from './shared/unjwt.TAStXINk.mjs';
+export { j as jwk } from './shared/unjwt.kE816XJO.mjs';
+export { j as jws } from './shared/unjwt.CcMe4dwj.mjs';

package/dist/jwe.d.mts

@@ -1,2 +1,3 @@
-export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, t as JWK, O as JWKAlgorithm, P as JWKPEMAlgorithm, J as JWKParameters, u as JWKSet, E as JWK_AES_CBC_HMAC, F as JWK_AES_GCM, B as JWK_AES_GCM_KW, A as JWK_AES_KW, N as JWK_Asymmetric_Algorithm, j as JWK_EC, I as JWK_ECDH_ES, y as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, v as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, L as JWK_OKP_SIGN, H as JWK_PBES2, s as JWK_Private, r as JWK_Public, m as JWK_RSA, z as JWK_RSA_ENC, x as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, w as JWK_RSA_SIGN, M as JWK_Symmetric_Algorithm, q as JWK_oct, S as JWT, T as JWTClaimValidationOptions, R as JWTClaims, Q as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './shared/unjwt.ClaeEBcy.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.BQUETRUD.mjs';
+export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, t as JWK, O as JWKAlgorithm, P as JWKPEMAlgorithm, J as JWKParameters, u as JWKSet, E as JWK_AES_CBC_HMAC, F as JWK_AES_GCM, B as JWK_AES_GCM_KW, A as JWK_AES_KW, N as JWK_Asymmetric_Algorithm, j as JWK_EC, I as JWK_ECDH_ES, y as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, v as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, L as JWK_OKP_SIGN, H as JWK_PBES2, s as JWK_Private, r as JWK_Public, m as JWK_RSA, z as JWK_RSA_ENC, x as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, w as JWK_RSA_SIGN, M as JWK_Symmetric_Algorithm, q as JWK_oct, S as JWT, T as JWTClaimValidationOptions, R as JWTClaims, Q as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './shared/unjwt.Ca4-7Myr.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.BoKDWMcu.mjs';
+import './shared/unjwt.b323eNLO.mjs';

package/dist/jwe.mjs

@@ -1,3 +1,3 @@
-import './shared/unjwt.A5jxFsjh.mjs';
-import './shared/unjwt.tM5bsBSH.mjs';
-export { d as decrypt, e as encrypt } from './shared/unjwt.D5J5ziZr.mjs';
+import './shared/unjwt.kE816XJO.mjs';
+import './shared/unjwt.BhoZWy2Y.mjs';
+export { d as decrypt, e as encrypt } from './shared/unjwt.TAStXINk.mjs';

package/dist/jwk.d.mts

@@ -1,2 +1,2 @@
-export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, t as JWK, O as JWKAlgorithm, P as JWKPEMAlgorithm, J as JWKParameters, u as JWKSet, E as JWK_AES_CBC_HMAC, F as JWK_AES_GCM, B as JWK_AES_GCM_KW, A as JWK_AES_KW, N as JWK_Asymmetric_Algorithm, j as JWK_EC, I as JWK_ECDH_ES, y as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, v as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, L as JWK_OKP_SIGN, H as JWK_PBES2, s as JWK_Private, r as JWK_Public, m as JWK_RSA, z as JWK_RSA_ENC, x as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, w as JWK_RSA_SIGN, M as JWK_Symmetric_Algorithm, q as JWK_oct, S as JWT, T as JWTClaimValidationOptions, R as JWTClaims, Q as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './shared/unjwt.ClaeEBcy.mjs';
-export { d as deriveKeyFromPassword, c as exportJWKToPEM, e as exportKey, a as generateJWK, g as generateKey, f as getJWKFromSet, b as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.Djt8pPsc.mjs';
+export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, t as JWK, O as JWKAlgorithm, P as JWKPEMAlgorithm, J as JWKParameters, u as JWKSet, E as JWK_AES_CBC_HMAC, F as JWK_AES_GCM, B as JWK_AES_GCM_KW, A as JWK_AES_KW, N as JWK_Asymmetric_Algorithm, j as JWK_EC, I as JWK_ECDH_ES, y as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, v as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, L as JWK_OKP_SIGN, H as JWK_PBES2, s as JWK_Private, r as JWK_Public, m as JWK_RSA, z as JWK_RSA_ENC, x as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, w as JWK_RSA_SIGN, M as JWK_Symmetric_Algorithm, q as JWK_oct, S as JWT, T as JWTClaimValidationOptions, R as JWTClaims, Q as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './shared/unjwt.Ca4-7Myr.mjs';
+export { b as deriveJWKFromPassword, d as deriveKeyFromPassword, f as exportJWKToPEM, e as exportKey, a as generateJWK, g as generateKey, h as getJWKFromSet, c as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.DMz8YzKh.mjs';

package/dist/jwk.mjs

@@ -1,2 +1,2 @@
-import './shared/unjwt.tM5bsBSH.mjs';
-export { h as deriveKeyFromPassword, m as exportJWKToPEM, k as exportKey, f as generateJWK, c as generateKey, b as getJWKFromSet, l as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.A5jxFsjh.mjs';
+import './shared/unjwt.BhoZWy2Y.mjs';
+export { k as deriveJWKFromPassword, h as deriveKeyFromPassword, n as exportJWKToPEM, l as exportKey, f as generateJWK, c as generateKey, b as getJWKFromSet, m as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.kE816XJO.mjs';

package/dist/jws.d.mts

@@ -1,2 +1,3 @@
-export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, t as JWK, O as JWKAlgorithm, P as JWKPEMAlgorithm, J as JWKParameters, u as JWKSet, E as JWK_AES_CBC_HMAC, F as JWK_AES_GCM, B as JWK_AES_GCM_KW, A as JWK_AES_KW, N as JWK_Asymmetric_Algorithm, j as JWK_EC, I as JWK_ECDH_ES, y as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, v as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, L as JWK_OKP_SIGN, H as JWK_PBES2, s as JWK_Private, r as JWK_Public, m as JWK_RSA, z as JWK_RSA_ENC, x as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, w as JWK_RSA_SIGN, M as JWK_Symmetric_Algorithm, q as JWK_oct, S as JWT, T as JWTClaimValidationOptions, R as JWTClaims, Q as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './shared/unjwt.ClaeEBcy.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.fumhLslo.mjs';
+export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, t as JWK, O as JWKAlgorithm, P as JWKPEMAlgorithm, J as JWKParameters, u as JWKSet, E as JWK_AES_CBC_HMAC, F as JWK_AES_GCM, B as JWK_AES_GCM_KW, A as JWK_AES_KW, N as JWK_Asymmetric_Algorithm, j as JWK_EC, I as JWK_ECDH_ES, y as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, v as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, L as JWK_OKP_SIGN, H as JWK_PBES2, s as JWK_Private, r as JWK_Public, m as JWK_RSA, z as JWK_RSA_ENC, x as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, w as JWK_RSA_SIGN, M as JWK_Symmetric_Algorithm, q as JWK_oct, S as JWT, T as JWTClaimValidationOptions, R as JWTClaims, Q as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './shared/unjwt.Ca4-7Myr.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.DYM9KPZR.mjs';
+import './shared/unjwt.b323eNLO.mjs';

package/dist/jws.mjs

@@ -1,3 +1,3 @@
-import './shared/unjwt.A5jxFsjh.mjs';
-import './shared/unjwt.tM5bsBSH.mjs';
-export { s as sign, v as verify } from './shared/unjwt.Bui8we0H.mjs';
+import './shared/unjwt.kE816XJO.mjs';
+import './shared/unjwt.BhoZWy2Y.mjs';
+export { s as sign, v as verify } from './shared/unjwt.CcMe4dwj.mjs';

package/dist/shared/{unjwt.tM5bsBSH.mjs → unjwt.BhoZWy2Y.mjs}

@@ -46,6 +46,54 @@ function getPlaintextBytes(payload) {
     "Plaintext must be a string, Uint8Array, or a JSON-serializable object."
   );
 }
+const TIME_CONSTANTS = Object.freeze({
+  s: 1,
+  second: 1,
+  seconds: 1,
+  m: 60,
+  minute: 60,
+  minutes: 60,
+  h: 3600,
+  hour: 3600,
+  hours: 3600,
+  D: 86400,
+  day: 86400,
+  days: 86400,
+  W: 604800,
+  week: 604800,
+  weeks: 604800,
+  M: 2592e3,
+  month: 2592e3,
+  months: 2592e3,
+  Y: 31536e3,
+  year: 31536e3,
+  years: 31536e3
+});
+const EXPIRES_IN_REGEX = /^(\d+)(s|second|seconds|m|minute|minutes|h|hour|hours|D|day|days|W|week|weeks|M|month|months|Y|year|years)?$/;
+function computeExpiresInSeconds(expiresIn) {
+  if (typeof expiresIn === "number") {
+    if (!Number.isInteger(expiresIn) || expiresIn <= 0) {
+      throw new TypeError(
+        "If 'expiresIn' is a number, it must be a positive integer representing seconds."
+      );
+    }
+    return expiresIn;
+  }
+  if (typeof expiresIn === "string") {
+    const match = expiresIn.match(EXPIRES_IN_REGEX);
+    if (!match || !match[1]) {
+      throw new TypeError(
+        "Invalid 'expiresIn' format. Must be a positive integer or a string like '10m', '2h', '7D', etc."
+      );
+    }
+    const value = Number.parseInt(match[1], 10);
+    const unit = match[2] || "s";
+    return value * TIME_CONSTANTS[unit];
+  }
+  throw new TypeError(
+    "'expiresIn' must be a number or a string representing time duration."
+  );
+}
 function computeJwtTimeClaims(payload, headerTyp, expiresIn, currentDate = /* @__PURE__ */ new Date()) {
   if (expiresIn === void 0 || !headerTyp?.toLowerCase().includes("jwt") || !(payload && typeof payload === "object") || payload instanceof Uint8Array || payload.exp) {
     return void 0;
@@ -53,7 +101,7 @@ function computeJwtTimeClaims(payload, headerTyp, expiresIn, currentDate = /* @_
   const now = Math.round(currentDate.getTime() / 1e3);
   const claims = { ...payload };
   claims.iat ||= now;
-  claims.exp = claims.iat + expiresIn;
+  claims.exp = claims.iat + computeExpiresInSeconds(expiresIn);
   return claims;
 }
 function validateJwtClaims(jwtClaims, options = {}) {
@@ -359,6 +407,7 @@ const index = {
   base64Encode: base64Encode,
   base64UrlDecode: base64UrlDecode,
   base64UrlEncode: base64UrlEncode,
+  computeExpiresInSeconds: computeExpiresInSeconds,
   computeJwtTimeClaims: computeJwtTimeClaims,
   concatUint8Arrays: concatUint8Arrays,
   decodeMaybeJWTString: decodeMaybeJWTString,
@@ -384,4 +433,4 @@ const index = {
   validateJwtClaims: validateJwtClaims
 };
 
-export { isPrivateJWK as A, isPublicJWK as B, isJWTContent as C, decodeMaybeJWTString as D, isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, base64UrlDecode as e, decodePayloadFromBytes as f, getPlaintextBytes as g, validateJwtClaims as h, index as i, isCryptoKeyPair as j, isCryptoKey as k, textDecoder as l, isJWKSet as m, decodePayloadFromB64UrlSegment as n, validateCriticalHeadersJWS as o, concatUint8Arrays as p, base64Decode as q, randomBytes as r, sanitizeObject as s, textEncoder as t, base64Encode as u, validateCriticalHeadersJWE as v, assertCryptoKey as w, isAsymmetricJWK as x, maybeArray as y, isSymmetricJWK as z };
+export { isPrivateJWK as A, isPublicJWK as B, isJWTContent as C, decodeMaybeJWTString as D, computeExpiresInSeconds as E, isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, base64UrlDecode as e, decodePayloadFromBytes as f, getPlaintextBytes as g, validateJwtClaims as h, index as i, isCryptoKeyPair as j, isCryptoKey as k, textDecoder as l, isJWKSet as m, decodePayloadFromB64UrlSegment as n, validateCriticalHeadersJWS as o, concatUint8Arrays as p, base64Decode as q, randomBytes as r, sanitizeObject as s, textEncoder as t, base64Encode as u, validateCriticalHeadersJWE as v, assertCryptoKey as w, isAsymmetricJWK as x, maybeArray as y, isSymmetricJWK as z };

package/dist/shared/{unjwt.BQUETRUD.d.mts → unjwt.BoKDWMcu.d.mts}

@@ -1,4 +1,5 @@
-import { K as KeyManagementAlgorithm, f as ContentEncryptionAlgorithm, Q as JoseHeaderParameters, h as JWK_EC_Public, i as JWK_EC_Private, t as JWK, T as JWTClaimValidationOptions, R as JWTClaims, C as CompositeKey, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, O as JWKAlgorithm, P as JWKPEMAlgorithm, J as JWKParameters, u as JWKSet, E as JWK_AES_CBC_HMAC, F as JWK_AES_GCM, B as JWK_AES_GCM_KW, A as JWK_AES_KW, N as JWK_Asymmetric_Algorithm, j as JWK_EC, I as JWK_ECDH_ES, y as JWK_ECDSA, v as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, L as JWK_OKP_SIGN, H as JWK_PBES2, s as JWK_Private, r as JWK_Public, m as JWK_RSA, z as JWK_RSA_ENC, x as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, w as JWK_RSA_SIGN, M as JWK_Symmetric_Algorithm, q as JWK_oct, S as JWT, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './unjwt.ClaeEBcy.mjs';
+import { K as KeyManagementAlgorithm, f as ContentEncryptionAlgorithm, Q as JoseHeaderParameters, h as JWK_EC_Public, i as JWK_EC_Private, t as JWK, T as JWTClaimValidationOptions, R as JWTClaims, C as CompositeKey, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, O as JWKAlgorithm, P as JWKPEMAlgorithm, J as JWKParameters, u as JWKSet, E as JWK_AES_CBC_HMAC, F as JWK_AES_GCM, B as JWK_AES_GCM_KW, A as JWK_AES_KW, N as JWK_Asymmetric_Algorithm, j as JWK_EC, I as JWK_ECDH_ES, y as JWK_ECDSA, v as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, L as JWK_OKP_SIGN, H as JWK_PBES2, s as JWK_Private, r as JWK_Public, m as JWK_RSA, z as JWK_RSA_ENC, x as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, w as JWK_RSA_SIGN, M as JWK_Symmetric_Algorithm, q as JWK_oct, S as JWT, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './unjwt.Ca4-7Myr.mjs';
+import { E as ExpiresIn } from './unjwt.b323eNLO.mjs';
 
 /** Recognized JWE Header Parameters, any other Header Members may also be present. */
 interface JWEHeaderParameters extends JoseHeaderParameters {
@@ -77,7 +78,7 @@ interface JWEEncryptOptions {
     /** Date to use when computing NumericDate claims, defaults to `new Date()`. */
     currentDate?: Date;
     /** Time at which the JWT should expire, if no `exp` was already provided (only when typ is "JWT" or explicitly parsing JWT). */
-    expiresIn?: number;
+    expiresIn?: ExpiresIn;
     /** Additional JWE Protected Header parameters. */
     protectedHeader?: Omit<JWEHeaderParameters, "alg" | "enc" | "iv" | "tag" | "p2s" | "p2c" | "epk" | "apu" | "apv">;
     /** Initialization Vector for AES-GCMKW key wrapping. Generated if not provided. */

package/dist/shared/{unjwt.ClaeEBcy.d.mts → unjwt.Ca4-7Myr.d.mts}

@@ -46,9 +46,9 @@ interface DeriveKeyOptions {
     /** Mark the derived key as extractable. Defaults to false. */
     extractable?: boolean;
     /** Export the derived key as JWK. If true, the key will be returned in JWK_oct format. */
-    toJWK?: boolean | undefined;
+    toJWK?: undefined | boolean | Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">;
 }
-type DeriveKeyReturn<TOptions extends DeriveKeyOptions> = TOptions["toJWK"] extends true ? JWK_oct : CryptoKey;
+type DeriveKeyReturn<TOptions extends DeriveKeyOptions> = TOptions["toJWK"] extends true ? JWK_oct : TOptions["toJWK"] extends object ? JWK_oct : CryptoKey;
 type KeyManagementAlgorithm = JWK_RSA_ENC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_PBES2 | JWK_ECDH_ES;
 type ContentEncryptionAlgorithm = JWK_AES_GCM | JWK_AES_CBC_HMAC;
 /** Options for the wrapKey function. */

package/dist/shared/{unjwt.Bui8we0H.mjs → unjwt.CcMe4dwj.mjs}

@@ -1,5 +1,5 @@
-import { i as importKey, s as sign$1, b as getJWKFromSet, v as verify$1 } from './unjwt.A5jxFsjh.mjs';
-import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, l as textDecoder, e as base64UrlDecode, m as isJWKSet, n as decodePayloadFromB64UrlSegment, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './unjwt.tM5bsBSH.mjs';
+import { i as importKey, s as sign$1, b as getJWKFromSet, v as verify$1 } from './unjwt.kE816XJO.mjs';
+import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, l as textDecoder, e as base64UrlDecode, m as isJWKSet, n as decodePayloadFromB64UrlSegment, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './unjwt.BhoZWy2Y.mjs';
 
 async function sign(payload, key, options = {}) {
   const { protectedHeader: additionalProtectedHeader } = options;

package/dist/shared/{unjwt.Djt8pPsc.d.mts → unjwt.DMz8YzKh.d.mts}

@@ -1,4 +1,4 @@
-import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, J as JWKParameters, c as GenerateJWKOptions, d as GenerateJWKReturn, H as JWK_PBES2, D as DeriveKeyOptions, e as DeriveKeyReturn, q as JWK_oct, t as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, g as WrapKeyResult, U as UnwrapKeyOptions, P as JWKPEMAlgorithm, u as JWKSet, Q as JoseHeaderParameters, C as CompositeKey, f as ContentEncryptionAlgorithm, O as JWKAlgorithm, E as JWK_AES_CBC_HMAC, F as JWK_AES_GCM, B as JWK_AES_GCM_KW, A as JWK_AES_KW, N as JWK_Asymmetric_Algorithm, j as JWK_EC, I as JWK_ECDH_ES, y as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, v as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, L as JWK_OKP_SIGN, s as JWK_Private, r as JWK_Public, m as JWK_RSA, z as JWK_RSA_ENC, x as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, w as JWK_RSA_SIGN, M as JWK_Symmetric_Algorithm, S as JWT, T as JWTClaimValidationOptions, R as JWTClaims } from './unjwt.ClaeEBcy.mjs';
+import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, J as JWKParameters, c as GenerateJWKOptions, d as GenerateJWKReturn, H as JWK_PBES2, D as DeriveKeyOptions, e as DeriveKeyReturn, q as JWK_oct, t as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, g as WrapKeyResult, U as UnwrapKeyOptions, P as JWKPEMAlgorithm, u as JWKSet, Q as JoseHeaderParameters, C as CompositeKey, f as ContentEncryptionAlgorithm, O as JWKAlgorithm, E as JWK_AES_CBC_HMAC, F as JWK_AES_GCM, B as JWK_AES_GCM_KW, A as JWK_AES_KW, N as JWK_Asymmetric_Algorithm, j as JWK_EC, I as JWK_ECDH_ES, y as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, v as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, L as JWK_OKP_SIGN, s as JWK_Private, r as JWK_Public, m as JWK_RSA, z as JWK_RSA_ENC, x as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, w as JWK_RSA_SIGN, M as JWK_Symmetric_Algorithm, S as JWT, T as JWTClaimValidationOptions, R as JWTClaims } from './unjwt.Ca4-7Myr.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -40,6 +40,16 @@ declare function generateJWK<TAlg extends GenerateKeyAlgorithm>(alg: TAlg, jwkPa
  * @returns A Promise resolving to the derived key (CryptoKey) or its JWK_oct representation.
  */
 declare function deriveKeyFromPassword<TAlg extends JWK_PBES2, TOptions extends DeriveKeyOptions>(password: string | Uint8Array<ArrayBuffer>, alg: TAlg, options: TOptions): Promise<DeriveKeyReturn<TOptions>>;
+/**
+ * Derives a Json Web Key (JWK) from a password using PBKDF2 as specified by PBES2 algorithms.
+ *
+ * @param password The password to derive the key from (string or Uint8Array).
+ * @param alg The PBES2 algorithm identifier (e.g., "PBES2-HS256+A128KW").
+ * @param jwkParams Optional partial JWK to merge with the generated key, allowing overrides.
+ * @param options Configuration options including salt and iterations.
+ * @returns A Promise resolving to the derived JWK (JWK_oct).
+ */
+declare function deriveJWKFromPassword(password: string | Uint8Array<ArrayBuffer>, alg: JWK_PBES2, options: Omit<DeriveKeyOptions, "toJWK">, jwkParams?: Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">): Promise<JWK_oct>;
 /**
  * Imports a key from various formats (CryptoKey, JWK, Uint8Array).
  *
@@ -177,6 +187,7 @@ declare const jwk_KeyManagementAlgorithm: typeof KeyManagementAlgorithm;
 declare const jwk_UnwrapKeyOptions: typeof UnwrapKeyOptions;
 declare const jwk_WrapKeyOptions: typeof WrapKeyOptions;
 declare const jwk_WrapKeyResult: typeof WrapKeyResult;
+declare const jwk_deriveJWKFromPassword: typeof deriveJWKFromPassword;
 declare const jwk_deriveKeyFromPassword: typeof deriveKeyFromPassword;
 declare const jwk_exportJWKToPEM: typeof exportJWKToPEM;
 declare const jwk_exportKey: typeof exportKey;
@@ -237,6 +248,7 @@ declare namespace jwk {
     jwk_UnwrapKeyOptions as UnwrapKeyOptions,
     jwk_WrapKeyOptions as WrapKeyOptions,
     jwk_WrapKeyResult as WrapKeyResult,
+    jwk_deriveJWKFromPassword as deriveJWKFromPassword,
     jwk_deriveKeyFromPassword as deriveKeyFromPassword,
     jwk_exportJWKToPEM as exportJWKToPEM,
     jwk_exportKey as exportKey,
@@ -250,4 +262,4 @@ declare namespace jwk {
   };
 }
 
-export { generateJWK as a, importJWKFromPEM as b, exportJWKToPEM as c, deriveKeyFromPassword as d, exportKey as e, getJWKFromSet as f, generateKey as g, importKey as i, jwk as j, unwrapKey as u, wrapKey as w };
+export { generateJWK as a, deriveJWKFromPassword as b, importJWKFromPEM as c, deriveKeyFromPassword as d, exportKey as e, exportJWKToPEM as f, generateKey as g, getJWKFromSet as h, importKey as i, jwk as j, unwrapKey as u, wrapKey as w };

package/dist/shared/{unjwt.fumhLslo.d.mts → unjwt.DYM9KPZR.d.mts}

@@ -1,4 +1,5 @@
-import { v as JWK_HMAC, w as JWK_RSA_SIGN, x as JWK_RSA_PSS, y as JWK_ECDSA, Q as JoseHeaderParameters, t as JWK, u as JWKSet, T as JWTClaimValidationOptions, R as JWTClaims, C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, O as JWKAlgorithm, P as JWKPEMAlgorithm, J as JWKParameters, E as JWK_AES_CBC_HMAC, F as JWK_AES_GCM, B as JWK_AES_GCM_KW, A as JWK_AES_KW, N as JWK_Asymmetric_Algorithm, j as JWK_EC, I as JWK_ECDH_ES, i as JWK_EC_Private, h as JWK_EC_Public, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, L as JWK_OKP_SIGN, H as JWK_PBES2, s as JWK_Private, r as JWK_Public, m as JWK_RSA, z as JWK_RSA_ENC, l as JWK_RSA_Private, k as JWK_RSA_Public, M as JWK_Symmetric_Algorithm, q as JWK_oct, S as JWT, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './unjwt.ClaeEBcy.mjs';
+import { v as JWK_HMAC, w as JWK_RSA_SIGN, x as JWK_RSA_PSS, y as JWK_ECDSA, Q as JoseHeaderParameters, t as JWK, u as JWKSet, T as JWTClaimValidationOptions, R as JWTClaims, C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, O as JWKAlgorithm, P as JWKPEMAlgorithm, J as JWKParameters, E as JWK_AES_CBC_HMAC, F as JWK_AES_GCM, B as JWK_AES_GCM_KW, A as JWK_AES_KW, N as JWK_Asymmetric_Algorithm, j as JWK_EC, I as JWK_ECDH_ES, i as JWK_EC_Private, h as JWK_EC_Public, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, L as JWK_OKP_SIGN, H as JWK_PBES2, s as JWK_Private, r as JWK_Public, m as JWK_RSA, z as JWK_RSA_ENC, l as JWK_RSA_Private, k as JWK_RSA_Public, M as JWK_Symmetric_Algorithm, q as JWK_oct, S as JWT, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './unjwt.Ca4-7Myr.mjs';
+import { E as ExpiresIn } from './unjwt.b323eNLO.mjs';
 
 type JWS_SIGN_EXTRA = "Ed25519" | "EdDSA";
 /** JWS Signing Algorithm Identifier. */
@@ -35,7 +36,7 @@ interface JWSSignOptions {
     /**
      * Time at which the JWS should expire, if no `exp` was already provided.
      */
-    expiresIn?: number;
+    expiresIn?: ExpiresIn;
 }
 /** Result of JWS verification */
 interface JWSVerifyResult<T extends JWTClaims | Uint8Array<ArrayBuffer> | string = JWTClaims | Uint8Array<ArrayBuffer> | string> {

package/dist/shared/{unjwt.D5J5ziZr.mjs → unjwt.TAStXINk.mjs}

@@ -1,5 +1,5 @@
-import { i as importKey, e as encryptKey, g as generateIV, a as encrypt$1, u as unwrapKey, d as decrypt$1 } from './unjwt.A5jxFsjh.mjs';
-import { r as randomBytes, a as isJWK, s as sanitizeObject, b as applyTypCtyDefaults, c as computeJwtTimeClaims, g as getPlaintextBytes, d as base64UrlEncode, t as textEncoder, e as base64UrlDecode, f as decodePayloadFromBytes, v as validateCriticalHeadersJWE, h as validateJwtClaims, j as isCryptoKeyPair, k as isCryptoKey } from './unjwt.tM5bsBSH.mjs';
+import { i as importKey, e as encryptKey, g as generateIV, a as encrypt$1, u as unwrapKey, d as decrypt$1 } from './unjwt.kE816XJO.mjs';
+import { r as randomBytes, a as isJWK, s as sanitizeObject, b as applyTypCtyDefaults, c as computeJwtTimeClaims, g as getPlaintextBytes, d as base64UrlEncode, t as textEncoder, e as base64UrlDecode, f as decodePayloadFromBytes, v as validateCriticalHeadersJWE, h as validateJwtClaims, j as isCryptoKeyPair, k as isCryptoKey } from './unjwt.BhoZWy2Y.mjs';
 
 async function encrypt(payload, key, options = {}) {
   const {

package/dist/shared/unjwt.b323eNLO.d.mts

@@ -0,0 +1,3 @@
+type ExpiresIn = number | `${number}` | `${number}${"s" | "second" | "seconds" | "m" | "minute" | "minutes" | "h" | "hour" | "hours" | "D" | "day" | "days" | "W" | "week" | "weeks" | "M" | "month" | "months" | "Y" | "year" | "years"}`;
+
+export type { ExpiresIn as E };

package/dist/shared/{unjwt.DuLUtSpD.d.mts → unjwt.cZWaB7OK.d.mts}

@@ -1,4 +1,5 @@
-import { R as JWTClaims, T as JWTClaimValidationOptions, t as JWK, u as JWKSet, q as JWK_oct, s as JWK_Private, r as JWK_Public } from './unjwt.ClaeEBcy.mjs';
+import { R as JWTClaims, T as JWTClaimValidationOptions, t as JWK, u as JWKSet, q as JWK_oct, s as JWK_Private, r as JWK_Public } from './unjwt.Ca4-7Myr.mjs';
+import { E as ExpiresIn } from './unjwt.b323eNLO.mjs';
 
 /**
  * Apply default typ/cty semantics shared by JWS & JWE.
@@ -37,8 +38,9 @@ declare function decodePayloadFromB64UrlSegment<T = unknown>(payloadEncoded: str
 } | undefined, forceUint8Array?: boolean): T | Uint8Array<ArrayBuffer> | string;
 /** Convert plaintext input to bytes, shared by JWS & JWE when preparing payload. */
 declare function getPlaintextBytes(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>): Uint8Array<ArrayBuffer>;
+declare function computeExpiresInSeconds(expiresIn: ExpiresIn): number;
 /** Optionally compute iat/exp when signing JWTs. */
-declare function computeJwtTimeClaims(payload: unknown, headerTyp: string | undefined, expiresIn?: number, currentDate?: Date): JWTClaims | undefined;
+declare function computeJwtTimeClaims(payload: unknown, headerTyp: string | undefined, expiresIn?: ExpiresIn, currentDate?: Date): JWTClaims | undefined;
 /** Validate JWT claims under JWS verification rules (or custom JWE implementations). */
 declare function validateJwtClaims(jwtClaims: JWTClaims, options?: JWTClaimValidationOptions): void;
 /** Validate critical headers in JWS semantics. */
@@ -105,6 +107,7 @@ declare const index_base64Decode: typeof base64Decode;
 declare const index_base64Encode: typeof base64Encode;
 declare const index_base64UrlDecode: typeof base64UrlDecode;
 declare const index_base64UrlEncode: typeof base64UrlEncode;
+declare const index_computeExpiresInSeconds: typeof computeExpiresInSeconds;
 declare const index_computeJwtTimeClaims: typeof computeJwtTimeClaims;
 declare const index_concatUint8Arrays: typeof concatUint8Arrays;
 declare const index_decodeMaybeJWTString: typeof decodeMaybeJWTString;
@@ -136,6 +139,7 @@ declare namespace index {
     index_base64Encode as base64Encode,
     index_base64UrlDecode as base64UrlDecode,
     index_base64UrlEncode as base64UrlEncode,
+    index_computeExpiresInSeconds as computeExpiresInSeconds,
     index_computeJwtTimeClaims as computeJwtTimeClaims,
     index_concatUint8Arrays as concatUint8Arrays,
     index_decodeMaybeJWTString as decodeMaybeJWTString,
@@ -162,4 +166,4 @@ declare namespace index {
   };
 }
 
-export { validateJwtClaims as A, validateCriticalHeadersJWS as B, validateCriticalHeadersJWE as C, sanitizeObject as D, textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, isJWKSet as h, index as i, assertCryptoKey as j, isCryptoKey as k, isCryptoKeyPair as l, maybeArray as m, isSymmetricJWK as n, isAsymmetricJWK as o, isPrivateJWK as p, isPublicJWK as q, randomBytes as r, applyTypCtyDefaults as s, textEncoder as t, isJWTContent as u, decodeMaybeJWTString as v, decodePayloadFromBytes as w, decodePayloadFromB64UrlSegment as x, getPlaintextBytes as y, computeJwtTimeClaims as z };
+export { computeJwtTimeClaims as A, validateJwtClaims as B, validateCriticalHeadersJWS as C, validateCriticalHeadersJWE as D, sanitizeObject as E, textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, isJWKSet as h, index as i, assertCryptoKey as j, isCryptoKey as k, isCryptoKeyPair as l, maybeArray as m, isSymmetricJWK as n, isAsymmetricJWK as o, isPrivateJWK as p, isPublicJWK as q, randomBytes as r, applyTypCtyDefaults as s, textEncoder as t, isJWTContent as u, decodeMaybeJWTString as v, decodePayloadFromBytes as w, decodePayloadFromB64UrlSegment as x, getPlaintextBytes as y, computeExpiresInSeconds as z };

package/dist/shared/{unjwt.A5jxFsjh.mjs → unjwt.kE816XJO.mjs}

@@ -1,4 +1,4 @@
-import { k as isCryptoKey, p as concatUint8Arrays, d as base64UrlEncode, q as base64Decode, u as base64Encode, t as textEncoder, s as sanitizeObject, w as assertCryptoKey, a as isJWK, e as base64UrlDecode, x as isAsymmetricJWK, r as randomBytes, m as isJWKSet } from './unjwt.tM5bsBSH.mjs';
+import { k as isCryptoKey, p as concatUint8Arrays, d as base64UrlEncode, q as base64Decode, u as base64Encode, t as textEncoder, s as sanitizeObject, w as assertCryptoKey, a as isJWK, e as base64UrlDecode, x as isAsymmetricJWK, r as randomBytes, m as isJWKSet } from './unjwt.BhoZWy2Y.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -1488,7 +1488,8 @@ async function generateJWK(alg, jwkParams, options = {}) {
   });
 }
 async function deriveKeyFromPassword(password, alg, options) {
-  const { salt, iterations, toJWK, extractable, keyUsage } = options;
+  const { salt, iterations, extractable, keyUsage } = options;
+  const exportToJWK = options.toJWK !== void 0 && options.toJWK !== false;
   if (!(salt instanceof Uint8Array) || salt.length < 8) {
     throw new Error("PBES2 Salt Input (salt) must be 8 or more octets");
   }
@@ -1507,7 +1508,7 @@ async function deriveKeyFromPassword(password, alg, options) {
   const wrappingAlg = alg.slice(-6);
   const defaultUsages = ["wrapKey", "unwrapKey"];
   const finalUsages = keyUsage ?? defaultUsages;
-  const finalExtractable = toJWK === true ? true : extractable === true;
+  const finalExtractable = exportToJWK ? true : extractable === true;
   const derivedKey = await crypto.subtle.importKey(
     "raw",
     derivedBytes,
@@ -1515,12 +1516,30 @@ async function deriveKeyFromPassword(password, alg, options) {
     finalExtractable,
     finalUsages
   );
-  if (toJWK === true) {
+  if (exportToJWK) {
     const jwk = await keyToJWK(derivedKey);
-    return { ...jwk, alg: wrappingAlg, kty: "oct" };
+    const {
+      alg: _a,
+      kty: _k,
+      key_ops: _ko,
+      ext: _e,
+      ...additionalKeyParams
+    } = typeof options.toJWK === "object" ? options.toJWK : {};
+    return { ...additionalKeyParams, ...jwk, alg: wrappingAlg, kty: "oct" };
   }
   return derivedKey;
 }
+async function deriveJWKFromPassword(password, alg, options, jwkParams) {
+  const {
+    // @ts-expect-error destructuring just to avoid passing it down
+    toJWK: _,
+    ...opts
+  } = options;
+  return deriveKeyFromPassword(password, alg, {
+    ...opts,
+    toJWK: jwkParams || true
+  });
+}
 async function importKey(key, alg) {
   if (typeof key === "string") {
     key = textEncoder.encode(key);
@@ -2090,6 +2109,7 @@ function inferAesImportAlgorithm(enc, cekLengthBytes) {
 
 const jwk = {
   __proto__: null,
+  deriveJWKFromPassword: deriveJWKFromPassword,
   deriveKeyFromPassword: deriveKeyFromPassword,
   exportJWKToPEM: exportJWKToPEM,
   exportKey: exportKey,
@@ -2102,4 +2122,4 @@ const jwk = {
   wrapKey: wrapKey
 };
 
-export { encrypt as a, getJWKFromSet as b, generateKey as c, decrypt as d, encryptKey as e, generateJWK as f, generateIV as g, deriveKeyFromPassword as h, importKey as i, jwk as j, exportKey as k, importJWKFromPEM as l, exportJWKToPEM as m, sign as s, unwrapKey as u, verify as v, wrapKey as w };
+export { encrypt as a, getJWKFromSet as b, generateKey as c, decrypt as d, encryptKey as e, generateJWK as f, generateIV as g, deriveKeyFromPassword as h, importKey as i, jwk as j, deriveJWKFromPassword as k, exportKey as l, importJWKFromPEM as m, exportJWKToPEM as n, sign as s, unwrapKey as u, verify as v, wrapKey as w };

package/dist/utils.d.mts

@@ -1,2 +1,3 @@
-import './shared/unjwt.ClaeEBcy.mjs';
-export { s as applyTypCtyDefaults, j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, z as computeJwtTimeClaims, f as concatUint8Arrays, v as decodeMaybeJWTString, x as decodePayloadFromB64UrlSegment, w as decodePayloadFromBytes, y as getPlaintextBytes, o as isAsymmetricJWK, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, u as isJWTContent, p as isPrivateJWK, q as isPublicJWK, n as isSymmetricJWK, m as maybeArray, r as randomBytes, D as sanitizeObject, a as textDecoder, t as textEncoder, C as validateCriticalHeadersJWE, B as validateCriticalHeadersJWS, A as validateJwtClaims } from './shared/unjwt.DuLUtSpD.mjs';
+import './shared/unjwt.Ca4-7Myr.mjs';
+export { s as applyTypCtyDefaults, j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, z as computeExpiresInSeconds, A as computeJwtTimeClaims, f as concatUint8Arrays, v as decodeMaybeJWTString, x as decodePayloadFromB64UrlSegment, w as decodePayloadFromBytes, y as getPlaintextBytes, o as isAsymmetricJWK, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, u as isJWTContent, p as isPrivateJWK, q as isPublicJWK, n as isSymmetricJWK, m as maybeArray, r as randomBytes, E as sanitizeObject, a as textDecoder, t as textEncoder, D as validateCriticalHeadersJWE, C as validateCriticalHeadersJWS, B as validateJwtClaims } from './shared/unjwt.cZWaB7OK.mjs';
+import './shared/unjwt.b323eNLO.mjs';

package/dist/utils.mjs

@@ -1 +1 @@
-export { b as applyTypCtyDefaults, w as assertCryptoKey, q as base64Decode, u as base64Encode, e as base64UrlDecode, d as base64UrlEncode, c as computeJwtTimeClaims, p as concatUint8Arrays, D as decodeMaybeJWTString, n as decodePayloadFromB64UrlSegment, f as decodePayloadFromBytes, g as getPlaintextBytes, x as isAsymmetricJWK, k as isCryptoKey, j as isCryptoKeyPair, a as isJWK, m as isJWKSet, C as isJWTContent, A as isPrivateJWK, B as isPublicJWK, z as isSymmetricJWK, y as maybeArray, r as randomBytes, s as sanitizeObject, l as textDecoder, t as textEncoder, v as validateCriticalHeadersJWE, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './shared/unjwt.tM5bsBSH.mjs';
+export { b as applyTypCtyDefaults, w as assertCryptoKey, q as base64Decode, u as base64Encode, e as base64UrlDecode, d as base64UrlEncode, E as computeExpiresInSeconds, c as computeJwtTimeClaims, p as concatUint8Arrays, D as decodeMaybeJWTString, n as decodePayloadFromB64UrlSegment, f as decodePayloadFromBytes, g as getPlaintextBytes, x as isAsymmetricJWK, k as isCryptoKey, j as isCryptoKeyPair, a as isJWK, m as isJWKSet, C as isJWTContent, A as isPrivateJWK, B as isPublicJWK, z as isSymmetricJWK, y as maybeArray, r as randomBytes, s as sanitizeObject, l as textDecoder, t as textEncoder, v as validateCriticalHeadersJWE, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './shared/unjwt.BhoZWy2Y.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.17",
+  "version": "0.5.19",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",