unjwt 0.5.19 → 0.5.21

package/dist/shared/unjwt.9mL1vSFP.d.mts

@@ -0,0 +1,154 @@
+import { K as KeyManagementAlgorithm, f as ContentEncryptionAlgorithm, E as ExpiresIn, V as JoseHeaderParameters, h as JWK_EC_Public, i as JWK_EC_Private, v as JWK, Z as JWTClaimValidationOptions, X as JWTClaims } from './unjwt.CtHrClHc.mjs';
+
+/** Recognized JWE Header Parameters, any other Header Members may also be present. */
+interface JWEHeaderParameters extends JoseHeaderParameters {
+    /**
+     * `alg` (Algorithm): Header Parameter - Key Management Algorithm
+     */
+    alg?: string;
+    /**
+     * `enc` (Encryption Algorithm): Header Parameter - Content Encryption Algorithm
+     */
+    enc?: string;
+    /**
+     * `p2c` (PBES2 Count): Header Parameter
+     */
+    p2c?: number;
+    /**
+     * `p2s` (PBES2 Salt): Header Parameter. Base64URL encoded.
+     */
+    p2s?: string;
+    /**
+     * "iv" (Initialization Vector) Header Parameter for AES GCM Key Wrapping. Base64URL encoded.
+     */
+    iv?: string;
+    /**
+     * "tag" (Authentication Tag) Header Parameter for AES GCM Key Wrapping. Base64URL encoded.
+     */
+    tag?: string;
+    /**
+     * "epk" (Ephemeral Public Key) Header Parameter for ECDH-ES.
+     */
+    epk?: JWK_EC_Public;
+    /**
+     * "apu" (Agreement PartyUInfo) Header Parameter for ECDH-ES. Base64URL encoded.
+     */
+    apu?: string;
+    /**
+     * "apv" (Agreement PartyVInfo) Header Parameter for ECDH-ES. Base64URL encoded.
+     */
+    apv?: string;
+    /** Any other JWE Header member. */
+    [propName: string]: unknown;
+}
+/** Recognized JWE Key Management-related Header Parameters. */
+interface JWEKeyManagementHeaderParameters {
+    apu?: Uint8Array<ArrayBuffer>;
+    apv?: Uint8Array<ArrayBuffer>;
+    /**
+     * For Internal use only
+     */
+    p2c?: number;
+    /**
+     * For Internal use only
+     */
+    p2s?: Uint8Array<ArrayBuffer>;
+    /**
+     * For Internal use only
+     */
+    iv?: Uint8Array<ArrayBuffer>;
+    /**
+     * For Internal use only
+     */
+    epk?: CryptoKey | JWK_EC_Public;
+    /**
+     * For Internal use only
+     */
+    epkPrivateKey?: CryptoKey | JWK_EC_Private;
+}
+/**
+ * JWE (JSON Web Encryption) encryption options
+ */
+interface JWEEncryptOptions {
+    /** JWE "alg" (Algorithm) Header Parameter. Key Management Algorithm. */
+    alg?: KeyManagementAlgorithm;
+    /** JWE "enc" (Encryption Algorithm) Header Parameter. Content Encryption Algorithm. */
+    enc?: ContentEncryptionAlgorithm;
+    /** Date to use when computing NumericDate claims, defaults to `new Date()`. */
+    currentDate?: Date;
+    /** Time at which the JWT should expire, if no `exp` was already provided (only when typ is "JWT" or explicitly parsing JWT). */
+    expiresIn?: ExpiresIn;
+    /** Additional JWE Protected Header parameters. */
+    protectedHeader?: Omit<JWEHeaderParameters, "alg" | "enc" | "iv" | "tag" | "p2s" | "p2c" | "epk" | "apu" | "apv">;
+    /** Initialization Vector for AES-GCMKW key wrapping. Generated if not provided. */
+    keyManagementIV?: Uint8Array<ArrayBuffer>;
+    /** PBES2 Salt value (p2s). Required for PBES2 algorithms. */
+    p2s?: Uint8Array<ArrayBuffer>;
+    /** PBES2 Iteration count (p2c). Required for PBES2 algorithms. */
+    p2c?: number;
+    /** ECDH-ES specific options. */
+    ecdh?: {
+        /**
+         * ECDH-ES Ephemeral key material. Provide a private key (CryptoKey or JWK),
+         * a CryptoKeyPair, or an object exposing both public and private parts.
+         */
+        ephemeralKey?: CryptoKey | JWK_EC_Private | CryptoKeyPair | {
+            publicKey: CryptoKey | JWK_EC_Public;
+            privateKey: CryptoKey | JWK_EC_Private;
+        };
+        /** ECDH-ES Agreement PartyUInfo. */
+        partyUInfo?: Uint8Array<ArrayBuffer>;
+        /** ECDH-ES Agreement PartyVInfo. */
+        partyVInfo?: Uint8Array<ArrayBuffer>;
+    };
+    /**
+     * Content Encryption Key (CEK) to use.
+     * If provided, it will be used directly. Otherwise, a CEK will be generated.
+     */
+    cek?: Uint8Array<ArrayBuffer>;
+    /**
+     * Initialization Vector for content encryption.
+     * If provided, it will be used. Otherwise, one will be generated.
+     */
+    contentEncryptionIV?: Uint8Array<ArrayBuffer>;
+}
+/**
+ * Key lookup function for JWE decryption.
+ * @param header The JWE Protected Header.
+ * @returns The key material (CryptoKey, JWK, password string, or raw Uint8Array) or a Promise resolving to it.
+ */
+type JWEKeyLookupFunction = (header: JWEHeaderParameters, token: string) => CryptoKey | JWK | string | Uint8Array<ArrayBuffer> | Promise<CryptoKey | JWK | string | Uint8Array<ArrayBuffer>>;
+/**
+ * JWE (JSON Web Encryption) decryption options
+ */
+interface JWEDecryptOptions extends JWTClaimValidationOptions {
+    /** A list of allowed JWE "alg" (Algorithm) Header Parameter values for key management. */
+    algorithms?: KeyManagementAlgorithm[];
+    /** A list of allowed JWE "enc" (Encryption Algorithm) Header Parameter values for content encryption. */
+    encryptionAlgorithms?: ContentEncryptionAlgorithm[];
+    /** Algorithm to import the unwrapped CEK as (e.g., { name: 'AES-GCM' }). Defaults based on 'enc'. */
+    unwrappedKeyAlgorithm?: Parameters<typeof crypto.subtle.importKey>[2];
+    /** Key usages for the unwrapped CEK. Defaults based on 'enc' (typically ['encrypt', 'decrypt']). */
+    keyUsage?: KeyUsage[];
+    /** Mark the unwrapped CEK as extractable. Defaults to true. */
+    extractable?: boolean;
+    /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred based on JWE headers. */
+    forceUint8Array?: boolean;
+    /** Unless false, will parse payload as JWT and validate claims if applicable (typ "JWT"). */
+    validateJWT?: boolean;
+}
+/**
+ * Result of a JWE decryption operation.
+ */
+interface JWEDecryptResult<T extends JWTClaims | Uint8Array<ArrayBuffer> | string = JWTClaims | Uint8Array<ArrayBuffer> | string> {
+    /** The decrypted payload. */
+    payload: T;
+    /** The JWE Protected Header. */
+    protectedHeader: JWEHeaderParameters;
+    /** The Content Encryption Key (CEK) used for decryption, as Uint8Array. */
+    cek: Uint8Array<ArrayBuffer>;
+    /** The Additional Authenticated Data (AAD) used, as Uint8Array. */
+    aad: Uint8Array<ArrayBuffer>;
+}
+
+export type { JWEHeaderParameters as J, JWEKeyManagementHeaderParameters as a, JWEEncryptOptions as b, JWEKeyLookupFunction as c, JWEDecryptOptions as d, JWEDecryptResult as e };

package/dist/shared/{unjwt.DMz8YzKh.d.mts → unjwt.BjP_dGnX.d.mts}

@@ -1,4 +1,4 @@
-import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, J as JWKParameters, c as GenerateJWKOptions, d as GenerateJWKReturn, H as JWK_PBES2, D as DeriveKeyOptions, e as DeriveKeyReturn, q as JWK_oct, t as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, g as WrapKeyResult, U as UnwrapKeyOptions, P as JWKPEMAlgorithm, u as JWKSet, Q as JoseHeaderParameters, C as CompositeKey, f as ContentEncryptionAlgorithm, O as JWKAlgorithm, E as JWK_AES_CBC_HMAC, F as JWK_AES_GCM, B as JWK_AES_GCM_KW, A as JWK_AES_KW, N as JWK_Asymmetric_Algorithm, j as JWK_EC, I as JWK_ECDH_ES, y as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, v as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, L as JWK_OKP_SIGN, s as JWK_Private, r as JWK_Public, m as JWK_RSA, z as JWK_RSA_ENC, x as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, w as JWK_RSA_SIGN, M as JWK_Symmetric_Algorithm, S as JWT, T as JWTClaimValidationOptions, R as JWTClaims } from './unjwt.Ca4-7Myr.mjs';
+import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, J as JWKParameters, c as GenerateJWKOptions, d as GenerateJWKReturn, N as JWK_PBES2, D as DeriveKeyOptions, e as DeriveKeyReturn, q as JWK_oct, v as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, g as WrapKeyResult, U as UnwrapKeyOptions, T as JWKPEMAlgorithm, w as JWKSet, V as JoseHeaderParameters, C as CompositeKey, f as ContentEncryptionAlgorithm, S as JWKAlgorithm, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, u as JWK_Private, t as JWK_Public, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, r as JWK_Symmetric, Q as JWK_Symmetric_Algorithm, Y as JWT, Z as JWTClaimValidationOptions, X as JWTClaims } from './unjwt.CtHrClHc.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -157,6 +157,7 @@ declare const jwk_JWK_AES_CBC_HMAC: typeof JWK_AES_CBC_HMAC;
 declare const jwk_JWK_AES_GCM: typeof JWK_AES_GCM;
 declare const jwk_JWK_AES_GCM_KW: typeof JWK_AES_GCM_KW;
 declare const jwk_JWK_AES_KW: typeof JWK_AES_KW;
+declare const jwk_JWK_Asymmetric: typeof JWK_Asymmetric;
 declare const jwk_JWK_Asymmetric_Algorithm: typeof JWK_Asymmetric_Algorithm;
 declare const jwk_JWK_EC: typeof JWK_EC;
 declare const jwk_JWK_ECDH_ES: typeof JWK_ECDH_ES;
@@ -177,6 +178,7 @@ declare const jwk_JWK_RSA_PSS: typeof JWK_RSA_PSS;
 declare const jwk_JWK_RSA_Private: typeof JWK_RSA_Private;
 declare const jwk_JWK_RSA_Public: typeof JWK_RSA_Public;
 declare const jwk_JWK_RSA_SIGN: typeof JWK_RSA_SIGN;
+declare const jwk_JWK_Symmetric: typeof JWK_Symmetric;
 declare const jwk_JWK_Symmetric_Algorithm: typeof JWK_Symmetric_Algorithm;
 declare const jwk_JWK_oct: typeof JWK_oct;
 declare const jwk_JWT: typeof JWT;
@@ -218,6 +220,7 @@ declare namespace jwk {
     jwk_JWK_AES_GCM as JWK_AES_GCM,
     jwk_JWK_AES_GCM_KW as JWK_AES_GCM_KW,
     jwk_JWK_AES_KW as JWK_AES_KW,
+    jwk_JWK_Asymmetric as JWK_Asymmetric,
     jwk_JWK_Asymmetric_Algorithm as JWK_Asymmetric_Algorithm,
     jwk_JWK_EC as JWK_EC,
     jwk_JWK_ECDH_ES as JWK_ECDH_ES,
@@ -238,6 +241,7 @@ declare namespace jwk {
     jwk_JWK_RSA_Private as JWK_RSA_Private,
     jwk_JWK_RSA_Public as JWK_RSA_Public,
     jwk_JWK_RSA_SIGN as JWK_RSA_SIGN,
+    jwk_JWK_Symmetric as JWK_Symmetric,
     jwk_JWK_Symmetric_Algorithm as JWK_Symmetric_Algorithm,
     jwk_JWK_oct as JWK_oct,
     jwk_JWT as JWT,
@@ -262,4 +266,4 @@ declare namespace jwk {
   };
 }
 
-export { generateJWK as a, deriveJWKFromPassword as b, importJWKFromPEM as c, deriveKeyFromPassword as d, exportKey as e, exportJWKToPEM as f, generateKey as g, getJWKFromSet as h, importKey as i, jwk as j, unwrapKey as u, wrapKey as w };
+export { generateKey as a, deriveKeyFromPassword as b, importKey as c, deriveJWKFromPassword as d, exportJWKToPEM as e, exportKey as f, generateJWK as g, getJWKFromSet as h, importJWKFromPEM as i, jwk as j, unwrapKey as u, wrapKey as w };

package/dist/shared/{unjwt.cZWaB7OK.d.mts → unjwt.BrNGm4On.d.mts}

@@ -1,5 +1,4 @@
-import { R as JWTClaims, T as JWTClaimValidationOptions, t as JWK, u as JWKSet, q as JWK_oct, s as JWK_Private, r as JWK_Public } from './unjwt.Ca4-7Myr.mjs';
-import { E as ExpiresIn } from './unjwt.b323eNLO.mjs';
+import { E as ExpiresIn, X as JWTClaims, Z as JWTClaimValidationOptions, v as JWK, w as JWKSet, q as JWK_oct, u as JWK_Private, t as JWK_Public } from './unjwt.CtHrClHc.mjs';
 
 /**
  * Apply default typ/cty semantics shared by JWS & JWE.
@@ -39,6 +38,7 @@ declare function decodePayloadFromB64UrlSegment<T = unknown>(payloadEncoded: str
 /** Convert plaintext input to bytes, shared by JWS & JWE when preparing payload. */
 declare function getPlaintextBytes(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>): Uint8Array<ArrayBuffer>;
 declare function computeExpiresInSeconds(expiresIn: ExpiresIn): number;
+declare const computeMaxTokenAgeSeconds: typeof computeExpiresInSeconds;
 /** Optionally compute iat/exp when signing JWTs. */
 declare function computeJwtTimeClaims(payload: unknown, headerTyp: string | undefined, expiresIn?: ExpiresIn, currentDate?: Date): JWTClaims | undefined;
 /** Validate JWT claims under JWS verification rules (or custom JWE implementations). */
@@ -109,6 +109,7 @@ declare const index_base64UrlDecode: typeof base64UrlDecode;
 declare const index_base64UrlEncode: typeof base64UrlEncode;
 declare const index_computeExpiresInSeconds: typeof computeExpiresInSeconds;
 declare const index_computeJwtTimeClaims: typeof computeJwtTimeClaims;
+declare const index_computeMaxTokenAgeSeconds: typeof computeMaxTokenAgeSeconds;
 declare const index_concatUint8Arrays: typeof concatUint8Arrays;
 declare const index_decodeMaybeJWTString: typeof decodeMaybeJWTString;
 declare const index_decodePayloadFromB64UrlSegment: typeof decodePayloadFromB64UrlSegment;
@@ -141,6 +142,7 @@ declare namespace index {
     index_base64UrlEncode as base64UrlEncode,
     index_computeExpiresInSeconds as computeExpiresInSeconds,
     index_computeJwtTimeClaims as computeJwtTimeClaims,
+    index_computeMaxTokenAgeSeconds as computeMaxTokenAgeSeconds,
     index_concatUint8Arrays as concatUint8Arrays,
     index_decodeMaybeJWTString as decodeMaybeJWTString,
     index_decodePayloadFromB64UrlSegment as decodePayloadFromB64UrlSegment,
@@ -166,4 +168,4 @@ declare namespace index {
   };
 }
 
-export { computeJwtTimeClaims as A, validateJwtClaims as B, validateCriticalHeadersJWS as C, validateCriticalHeadersJWE as D, sanitizeObject as E, textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, isJWKSet as h, index as i, assertCryptoKey as j, isCryptoKey as k, isCryptoKeyPair as l, maybeArray as m, isSymmetricJWK as n, isAsymmetricJWK as o, isPrivateJWK as p, isPublicJWK as q, randomBytes as r, applyTypCtyDefaults as s, textEncoder as t, isJWTContent as u, decodeMaybeJWTString as v, decodePayloadFromBytes as w, decodePayloadFromB64UrlSegment as x, getPlaintextBytes as y, computeExpiresInSeconds as z };
+export { computeMaxTokenAgeSeconds as A, computeJwtTimeClaims as B, validateJwtClaims as C, validateCriticalHeadersJWS as D, validateCriticalHeadersJWE as E, sanitizeObject as F, textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, isJWKSet as h, index as i, assertCryptoKey as j, isCryptoKey as k, isCryptoKeyPair as l, maybeArray as m, isSymmetricJWK as n, isAsymmetricJWK as o, isPrivateJWK as p, isPublicJWK as q, randomBytes as r, applyTypCtyDefaults as s, textEncoder as t, isJWTContent as u, decodeMaybeJWTString as v, decodePayloadFromBytes as w, decodePayloadFromB64UrlSegment as x, getPlaintextBytes as y, computeExpiresInSeconds as z };

package/dist/shared/unjwt.BsLgL0DQ.d.mts

@@ -0,0 +1,64 @@
+import { x as JWK_HMAC, y as JWK_RSA_SIGN, z as JWK_RSA_PSS, A as JWK_ECDSA, V as JoseHeaderParameters, E as ExpiresIn, v as JWK, w as JWKSet, Z as JWTClaimValidationOptions, X as JWTClaims } from './unjwt.CtHrClHc.mjs';
+
+type JWS_SIGN_EXTRA = "Ed25519" | "EdDSA";
+/** JWS Signing Algorithm Identifier. */
+type JWSAlgorithm = JWK_HMAC | JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWS_SIGN_EXTRA;
+/** Recognized JWS Header Parameters, any other Header Members may also be present. */
+interface JWSHeaderParameters extends JoseHeaderParameters {
+    /** JWS "alg" (Algorithm) Header Parameter */
+    alg?: JWSAlgorithm;
+    /**
+     * This JWS Extension Header Parameter modifies the JWS Payload representation and the JWS Signing
+     * Input computation as per {@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}.
+     * If `false`, the payload is used directly without Base64URL encoding.
+     * Defaults to `true`.
+     */
+    b64?: boolean;
+}
+/** JWS Protected Header */
+interface JWSProtectedHeader extends JWSHeaderParameters {
+    alg: JWSAlgorithm;
+}
+/**
+ * JWS (JSON Web Signature) options for signing
+ */
+interface JWSSignOptions {
+    /** The JWS Algorithm to use. Must be provided. */
+    alg?: JWSAlgorithm;
+    /**
+     * Additional protected header parameters. `alg` is automatically included.
+     * `typ` defaults to "JWT" if not provided and payload is an object.
+     */
+    protectedHeader?: JWSHeaderParameters;
+    /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
+    currentDate?: Date;
+    /**
+     * Time at which the JWS should expire, if no `exp` was already provided.
+     */
+    expiresIn?: ExpiresIn;
+}
+/** Result of JWS verification */
+interface JWSVerifyResult<T extends JWTClaims | Uint8Array<ArrayBuffer> | string = JWTClaims | Uint8Array<ArrayBuffer> | string> {
+    /** The decoded and verified payload. */
+    payload: T;
+    /** The JWS Protected Header. */
+    protectedHeader: JWSProtectedHeader;
+}
+/** Options for JWS verification */
+interface JWSVerifyOptions extends JWTClaimValidationOptions {
+    /** List of allowed algorithms. If provided, the JWS `alg` must be in this list. */
+    algorithms?: JWSAlgorithm[];
+    /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred. */
+    forceUint8Array?: boolean;
+    /** Unless false, will parse payload as JWT and validate claims if applicable (typ "JWT"). */
+    validateJWT?: boolean;
+}
+/**
+ * Key lookup function for JWS verification.
+ * @param header The JWS Protected Header.
+ * @param token The JWS token.
+ * @returns The key material (CryptoKey, JWK, or raw Uint8Array) or a Promise resolving to it.
+ */
+type JWSKeyLookupFunction = (header: JWSProtectedHeader, token: string) => CryptoKey | JWK | JWKSet | Uint8Array<ArrayBuffer> | Promise<CryptoKey | JWK | JWKSet | Uint8Array<ArrayBuffer>>;
+
+export type { JWSAlgorithm as J, JWSHeaderParameters as a, JWSProtectedHeader as b, JWSSignOptions as c, JWSVerifyResult as d, JWSVerifyOptions as e, JWSKeyLookupFunction as f };

package/dist/shared/unjwt.C5jNR_1K.d.mts

@@ -0,0 +1,166 @@
+import { X as JWTClaims, r as JWK_Symmetric, u as JWK_Private, t as JWK_Public, w as JWKSet, C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, Z as JWTClaimValidationOptions, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './unjwt.CtHrClHc.mjs';
+import { c as JWSSignOptions, J as JWSAlgorithm, f as JWSKeyLookupFunction, e as JWSVerifyOptions, d as JWSVerifyResult, a as JWSHeaderParameters, b as JWSProtectedHeader } from './unjwt.BsLgL0DQ.mjs';
+
+/**
+ * Creates a JWS (JSON Web Signature) in Compact Serialization format.
+ *
+ * @param payload The payload to sign. Can be a string, Uint8Array, or an object (which will be JSON stringified).
+ * @param key The signing key (CryptoKey, JWK, or raw symmetric key as Uint8Array).
+ * @param options Signing options, including the algorithm (`alg`) and protected header parameters.
+ * @returns A Promise resolving to the JWS Compact Serialization string.
+ */
+declare function sign(payload: JWTClaims, key: JWK_Symmetric | JWK_Private, options?: JWSSignOptions): Promise<string>;
+declare function sign(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: JWK_Symmetric | JWK_Private, options?: JWSSignOptions): Promise<string>;
+declare function sign(payload: JWTClaims, key: CryptoKey, options: JWSSignOptions & {
+    alg: JWSAlgorithm;
+}): Promise<string>;
+declare function sign(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: CryptoKey, options: JWSSignOptions & {
+    alg: JWSAlgorithm;
+}): Promise<string>;
+declare function sign(payload: JWTClaims, key: Uint8Array<ArrayBuffer>, options: JWSSignOptions & {
+    alg: JWSAlgorithm;
+}): Promise<string>;
+declare function sign(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: Uint8Array<ArrayBuffer>, options: JWSSignOptions & {
+    alg: JWSAlgorithm;
+}): Promise<string>;
+declare function sign(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: CryptoKey | JWK_Symmetric | JWK_Private | Uint8Array<ArrayBuffer>, options: JWSSignOptions & {
+    alg: JWSAlgorithm;
+}): Promise<string>;
+/**
+ * Verifies a JWS (JSON Web Signature) in Compact Serialization format.
+ *
+ * @param jws The JWS Compact Serialization string.
+ * @param key The verification key (CryptoKey, JWK, JWKSet, raw symmetric key as Uint8Array, or a function resolving the key or set).
+ * @param options Verification options, such as allowed algorithms.
+ * @returns A Promise resolving to an object containing the verified payload and protected header.
+ * @throws If the JWS is invalid, signature verification fails, or options are not met.
+ */
+declare function verify<T extends JWTClaims | Uint8Array<ArrayBuffer> | string>(jws: string, key: CryptoKey | JWK_Symmetric | JWK_Public | JWKSet | Uint8Array<ArrayBuffer> | JWSKeyLookupFunction, options?: JWSVerifyOptions): Promise<JWSVerifyResult<T>>;
+declare function verify(jws: string, key: CryptoKey | JWK_Symmetric | JWK_Public | JWKSet | Uint8Array<ArrayBuffer> | JWSKeyLookupFunction, options: JWSVerifyOptions & {
+    forceUint8Array: true;
+}): Promise<JWSVerifyResult<Uint8Array<ArrayBuffer>>>;
+
+declare const jws_CompositeKey: typeof CompositeKey;
+declare const jws_ContentEncryptionAlgorithm: typeof ContentEncryptionAlgorithm;
+declare const jws_DeriveKeyOptions: typeof DeriveKeyOptions;
+declare const jws_DeriveKeyReturn: typeof DeriveKeyReturn;
+declare const jws_GenerateJWKOptions: typeof GenerateJWKOptions;
+declare const jws_GenerateJWKReturn: typeof GenerateJWKReturn;
+declare const jws_GenerateKeyAlgorithm: typeof GenerateKeyAlgorithm;
+declare const jws_GenerateKeyOptions: typeof GenerateKeyOptions;
+declare const jws_GenerateKeyReturn: typeof GenerateKeyReturn;
+declare const jws_JWK: typeof JWK;
+declare const jws_JWKAlgorithm: typeof JWKAlgorithm;
+declare const jws_JWKPEMAlgorithm: typeof JWKPEMAlgorithm;
+declare const jws_JWKParameters: typeof JWKParameters;
+declare const jws_JWKSet: typeof JWKSet;
+declare const jws_JWK_AES_CBC_HMAC: typeof JWK_AES_CBC_HMAC;
+declare const jws_JWK_AES_GCM: typeof JWK_AES_GCM;
+declare const jws_JWK_AES_GCM_KW: typeof JWK_AES_GCM_KW;
+declare const jws_JWK_AES_KW: typeof JWK_AES_KW;
+declare const jws_JWK_Asymmetric: typeof JWK_Asymmetric;
+declare const jws_JWK_Asymmetric_Algorithm: typeof JWK_Asymmetric_Algorithm;
+declare const jws_JWK_EC: typeof JWK_EC;
+declare const jws_JWK_ECDH_ES: typeof JWK_ECDH_ES;
+declare const jws_JWK_ECDSA: typeof JWK_ECDSA;
+declare const jws_JWK_EC_Private: typeof JWK_EC_Private;
+declare const jws_JWK_EC_Public: typeof JWK_EC_Public;
+declare const jws_JWK_HMAC: typeof JWK_HMAC;
+declare const jws_JWK_OKP: typeof JWK_OKP;
+declare const jws_JWK_OKP_Private: typeof JWK_OKP_Private;
+declare const jws_JWK_OKP_Public: typeof JWK_OKP_Public;
+declare const jws_JWK_OKP_SIGN: typeof JWK_OKP_SIGN;
+declare const jws_JWK_PBES2: typeof JWK_PBES2;
+declare const jws_JWK_Private: typeof JWK_Private;
+declare const jws_JWK_Public: typeof JWK_Public;
+declare const jws_JWK_RSA: typeof JWK_RSA;
+declare const jws_JWK_RSA_ENC: typeof JWK_RSA_ENC;
+declare const jws_JWK_RSA_PSS: typeof JWK_RSA_PSS;
+declare const jws_JWK_RSA_Private: typeof JWK_RSA_Private;
+declare const jws_JWK_RSA_Public: typeof JWK_RSA_Public;
+declare const jws_JWK_RSA_SIGN: typeof JWK_RSA_SIGN;
+declare const jws_JWK_Symmetric: typeof JWK_Symmetric;
+declare const jws_JWK_Symmetric_Algorithm: typeof JWK_Symmetric_Algorithm;
+declare const jws_JWK_oct: typeof JWK_oct;
+declare const jws_JWSAlgorithm: typeof JWSAlgorithm;
+declare const jws_JWSHeaderParameters: typeof JWSHeaderParameters;
+declare const jws_JWSKeyLookupFunction: typeof JWSKeyLookupFunction;
+declare const jws_JWSProtectedHeader: typeof JWSProtectedHeader;
+declare const jws_JWSSignOptions: typeof JWSSignOptions;
+declare const jws_JWSVerifyOptions: typeof JWSVerifyOptions;
+declare const jws_JWSVerifyResult: typeof JWSVerifyResult;
+declare const jws_JWT: typeof JWT;
+declare const jws_JWTClaimValidationOptions: typeof JWTClaimValidationOptions;
+declare const jws_JWTClaims: typeof JWTClaims;
+declare const jws_JoseHeaderParameters: typeof JoseHeaderParameters;
+declare const jws_KeyManagementAlgorithm: typeof KeyManagementAlgorithm;
+declare const jws_UnwrapKeyOptions: typeof UnwrapKeyOptions;
+declare const jws_WrapKeyOptions: typeof WrapKeyOptions;
+declare const jws_WrapKeyResult: typeof WrapKeyResult;
+declare const jws_sign: typeof sign;
+declare const jws_verify: typeof verify;
+declare namespace jws {
+  export {
+    jws_CompositeKey as CompositeKey,
+    jws_ContentEncryptionAlgorithm as ContentEncryptionAlgorithm,
+    jws_DeriveKeyOptions as DeriveKeyOptions,
+    jws_DeriveKeyReturn as DeriveKeyReturn,
+    jws_GenerateJWKOptions as GenerateJWKOptions,
+    jws_GenerateJWKReturn as GenerateJWKReturn,
+    jws_GenerateKeyAlgorithm as GenerateKeyAlgorithm,
+    jws_GenerateKeyOptions as GenerateKeyOptions,
+    jws_GenerateKeyReturn as GenerateKeyReturn,
+    jws_JWK as JWK,
+    jws_JWKAlgorithm as JWKAlgorithm,
+    jws_JWKPEMAlgorithm as JWKPEMAlgorithm,
+    jws_JWKParameters as JWKParameters,
+    jws_JWKSet as JWKSet,
+    jws_JWK_AES_CBC_HMAC as JWK_AES_CBC_HMAC,
+    jws_JWK_AES_GCM as JWK_AES_GCM,
+    jws_JWK_AES_GCM_KW as JWK_AES_GCM_KW,
+    jws_JWK_AES_KW as JWK_AES_KW,
+    jws_JWK_Asymmetric as JWK_Asymmetric,
+    jws_JWK_Asymmetric_Algorithm as JWK_Asymmetric_Algorithm,
+    jws_JWK_EC as JWK_EC,
+    jws_JWK_ECDH_ES as JWK_ECDH_ES,
+    jws_JWK_ECDSA as JWK_ECDSA,
+    jws_JWK_EC_Private as JWK_EC_Private,
+    jws_JWK_EC_Public as JWK_EC_Public,
+    jws_JWK_HMAC as JWK_HMAC,
+    jws_JWK_OKP as JWK_OKP,
+    jws_JWK_OKP_Private as JWK_OKP_Private,
+    jws_JWK_OKP_Public as JWK_OKP_Public,
+    jws_JWK_OKP_SIGN as JWK_OKP_SIGN,
+    jws_JWK_PBES2 as JWK_PBES2,
+    jws_JWK_Private as JWK_Private,
+    jws_JWK_Public as JWK_Public,
+    jws_JWK_RSA as JWK_RSA,
+    jws_JWK_RSA_ENC as JWK_RSA_ENC,
+    jws_JWK_RSA_PSS as JWK_RSA_PSS,
+    jws_JWK_RSA_Private as JWK_RSA_Private,
+    jws_JWK_RSA_Public as JWK_RSA_Public,
+    jws_JWK_RSA_SIGN as JWK_RSA_SIGN,
+    jws_JWK_Symmetric as JWK_Symmetric,
+    jws_JWK_Symmetric_Algorithm as JWK_Symmetric_Algorithm,
+    jws_JWK_oct as JWK_oct,
+    jws_JWSAlgorithm as JWSAlgorithm,
+    jws_JWSHeaderParameters as JWSHeaderParameters,
+    jws_JWSKeyLookupFunction as JWSKeyLookupFunction,
+    jws_JWSProtectedHeader as JWSProtectedHeader,
+    jws_JWSSignOptions as JWSSignOptions,
+    jws_JWSVerifyOptions as JWSVerifyOptions,
+    jws_JWSVerifyResult as JWSVerifyResult,
+    jws_JWT as JWT,
+    jws_JWTClaimValidationOptions as JWTClaimValidationOptions,
+    jws_JWTClaims as JWTClaims,
+    jws_JoseHeaderParameters as JoseHeaderParameters,
+    jws_KeyManagementAlgorithm as KeyManagementAlgorithm,
+    jws_UnwrapKeyOptions as UnwrapKeyOptions,
+    jws_WrapKeyOptions as WrapKeyOptions,
+    jws_WrapKeyResult as WrapKeyResult,
+    jws_sign as sign,
+    jws_verify as verify,
+  };
+}
+
+export { jws as j, sign as s, verify as v };

package/dist/shared/{unjwt.TAStXINk.mjs → unjwt.CXl9FD-V.mjs}

@@ -1,5 +1,5 @@
-import { i as importKey, e as encryptKey, g as generateIV, a as encrypt$1, u as unwrapKey, d as decrypt$1 } from './unjwt.kE816XJO.mjs';
-import { r as randomBytes, a as isJWK, s as sanitizeObject, b as applyTypCtyDefaults, c as computeJwtTimeClaims, g as getPlaintextBytes, d as base64UrlEncode, t as textEncoder, e as base64UrlDecode, f as decodePayloadFromBytes, v as validateCriticalHeadersJWE, h as validateJwtClaims, j as isCryptoKeyPair, k as isCryptoKey } from './unjwt.BhoZWy2Y.mjs';
+import { i as importKey, e as encryptKey, g as generateIV, a as encrypt$1, u as unwrapKey, d as decrypt$1 } from './unjwt.Vg02PZWw.mjs';
+import { r as randomBytes, a as isJWK, s as sanitizeObject, b as applyTypCtyDefaults, c as computeJwtTimeClaims, g as getPlaintextBytes, d as base64UrlEncode, t as textEncoder, e as base64UrlDecode, f as decodePayloadFromBytes, v as validateCriticalHeadersJWE, h as validateJwtClaims, j as isCryptoKeyPair, k as isCryptoKey } from './unjwt.DCiTNyCM.mjs';
 
 async function encrypt(payload, key, options = {}) {
   const {

package/dist/shared/{unjwt.Ca4-7Myr.d.mts → unjwt.CtHrClHc.d.mts}

@@ -209,6 +209,10 @@ interface JWK_oct extends JWKParameters {
     /** Oct JWK "k" (Key Value) Parameter */
     k: string;
 }
+/** Symmetric JSON Web Keys */
+type JWK_Symmetric = JWK_oct;
+/** Asymmetric JSON Web Keys */
+type JWK_Asymmetric = JWK_RSA | JWK_EC | JWK_OKP;
 /** Public JSON Web Keys */
 type JWK_Public = JWK_RSA_Public | JWK_EC_Public | JWK_OKP_Public;
 /** Private JSON Web Keys */
@@ -298,8 +302,8 @@ interface JWTClaimValidationOptions {
     issuer?: string | string[];
     /** Expected JWT "sub" (Subject) Claim value. Implies presence requirement. */
     subject?: string;
-    /** Maximum token age in seconds, from the JWT "iat" (Issued At) Claim value. Implies presence requirement. */
-    maxTokenAge?: number;
+    /** Maximum token age, from the JWT "iat" (Issued At) Claim value. Implies presence requirement. */
+    maxTokenAge?: MaxTokenAge;
     /** Clock skew tolerance (in seconds) for validating time-based claims (nbf/exp/iat). */
     clockTolerance?: number;
     /** Expected JWT "typ" (Type) Header Parameter value. Implies presence requirement. */
@@ -318,4 +322,7 @@ interface JWTClaimValidationOptions {
     critical?: string[];
 }
 
-export type { JWK_AES_KW as A, JWK_AES_GCM_KW as B, CompositeKey as C, DeriveKeyOptions as D, JWK_AES_CBC_HMAC as E, JWK_AES_GCM as F, GenerateKeyAlgorithm as G, JWK_PBES2 as H, JWK_ECDH_ES as I, JWKParameters as J, KeyManagementAlgorithm as K, JWK_OKP_SIGN as L, JWK_Symmetric_Algorithm as M, JWK_Asymmetric_Algorithm as N, JWKAlgorithm as O, JWKPEMAlgorithm as P, JoseHeaderParameters as Q, JWTClaims as R, JWT as S, JWTClaimValidationOptions as T, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, GenerateJWKOptions as c, GenerateJWKReturn as d, DeriveKeyReturn as e, ContentEncryptionAlgorithm as f, WrapKeyResult as g, JWK_EC_Public as h, JWK_EC_Private as i, JWK_EC as j, JWK_RSA_Public as k, JWK_RSA_Private as l, JWK_RSA as m, JWK_OKP_Public as n, JWK_OKP_Private as o, JWK_OKP as p, JWK_oct as q, JWK_Public as r, JWK_Private as s, JWK as t, JWKSet as u, JWK_HMAC as v, JWK_RSA_SIGN as w, JWK_RSA_PSS as x, JWK_ECDSA as y, JWK_RSA_ENC as z };
+type ExpiresIn = number | `${number}` | `${number}${"s" | "second" | "seconds" | "m" | "minute" | "minutes" | "h" | "hour" | "hours" | "D" | "day" | "days" | "W" | "week" | "weeks" | "M" | "month" | "months" | "Y" | "year" | "years"}`;
+type MaxTokenAge = ExpiresIn;
+
+export type { JWK_ECDSA as A, JWK_RSA_ENC as B, CompositeKey as C, DeriveKeyOptions as D, ExpiresIn as E, JWK_AES_KW as F, GenerateKeyAlgorithm as G, JWK_AES_GCM_KW as H, JWK_AES_CBC_HMAC as I, JWKParameters as J, KeyManagementAlgorithm as K, JWK_AES_GCM as L, MaxTokenAge as M, JWK_PBES2 as N, JWK_ECDH_ES as O, JWK_OKP_SIGN as P, JWK_Symmetric_Algorithm as Q, JWK_Asymmetric_Algorithm as R, JWKAlgorithm as S, JWKPEMAlgorithm as T, UnwrapKeyOptions as U, JoseHeaderParameters as V, WrapKeyOptions as W, JWTClaims as X, JWT as Y, JWTClaimValidationOptions as Z, GenerateKeyOptions as a, GenerateKeyReturn as b, GenerateJWKOptions as c, GenerateJWKReturn as d, DeriveKeyReturn as e, ContentEncryptionAlgorithm as f, WrapKeyResult as g, JWK_EC_Public as h, JWK_EC_Private as i, JWK_EC as j, JWK_RSA_Public as k, JWK_RSA_Private as l, JWK_RSA as m, JWK_OKP_Public as n, JWK_OKP_Private as o, JWK_OKP as p, JWK_oct as q, JWK_Symmetric as r, JWK_Asymmetric as s, JWK_Public as t, JWK_Private as u, JWK as v, JWKSet as w, JWK_HMAC as x, JWK_RSA_SIGN as y, JWK_RSA_PSS as z };

package/dist/shared/{unjwt.BhoZWy2Y.mjs → unjwt.DCiTNyCM.mjs}

@@ -94,6 +94,7 @@ function computeExpiresInSeconds(expiresIn) {
     "'expiresIn' must be a number or a string representing time duration."
   );
 }
+const computeMaxTokenAgeSeconds = computeExpiresInSeconds;
 function computeJwtTimeClaims(payload, headerTyp, expiresIn, currentDate = /* @__PURE__ */ new Date()) {
   if (expiresIn === void 0 || !headerTyp?.toLowerCase().includes("jwt") || !(payload && typeof payload === "object") || payload instanceof Uint8Array || payload.exp) {
     return void 0;
@@ -166,7 +167,7 @@ function validateJwtClaims(jwtClaims, options = {}) {
         `JWT "iat" (Issued At) Claim validation failed: Token was issued in the future (iat: ${new Date(jwtClaims.iat * 1e3).toISOString()})`
       );
     }
-    if (jwtClaims.iat < currentTime - options.maxTokenAge - clockTolerance) {
+    if (jwtClaims.iat < currentTime - computeMaxTokenAgeSeconds(options.maxTokenAge) - clockTolerance) {
       throw new Error(
         `JWT "iat" (Issued At) Claim validation failed: Token is too old (maxTokenAge: ${options.maxTokenAge}s, iat: ${new Date(jwtClaims.iat * 1e3).toISOString()})`
       );
@@ -409,6 +410,7 @@ const index = {
   base64UrlEncode: base64UrlEncode,
   computeExpiresInSeconds: computeExpiresInSeconds,
   computeJwtTimeClaims: computeJwtTimeClaims,
+  computeMaxTokenAgeSeconds: computeMaxTokenAgeSeconds,
   concatUint8Arrays: concatUint8Arrays,
   decodeMaybeJWTString: decodeMaybeJWTString,
   decodePayloadFromB64UrlSegment: decodePayloadFromB64UrlSegment,
@@ -433,4 +435,4 @@ const index = {
   validateJwtClaims: validateJwtClaims
 };
 
-export { isPrivateJWK as A, isPublicJWK as B, isJWTContent as C, decodeMaybeJWTString as D, computeExpiresInSeconds as E, isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, base64UrlDecode as e, decodePayloadFromBytes as f, getPlaintextBytes as g, validateJwtClaims as h, index as i, isCryptoKeyPair as j, isCryptoKey as k, textDecoder as l, isJWKSet as m, decodePayloadFromB64UrlSegment as n, validateCriticalHeadersJWS as o, concatUint8Arrays as p, base64Decode as q, randomBytes as r, sanitizeObject as s, textEncoder as t, base64Encode as u, validateCriticalHeadersJWE as v, assertCryptoKey as w, isAsymmetricJWK as x, maybeArray as y, isSymmetricJWK as z };
+export { maybeArray as A, isPublicJWK as B, isJWTContent as C, decodeMaybeJWTString as D, computeExpiresInSeconds as E, computeMaxTokenAgeSeconds as F, isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, base64UrlDecode as e, decodePayloadFromBytes as f, getPlaintextBytes as g, validateJwtClaims as h, index as i, isCryptoKeyPair as j, isCryptoKey as k, textDecoder as l, isJWKSet as m, decodePayloadFromB64UrlSegment as n, validateCriticalHeadersJWS as o, isSymmetricJWK as p, isPrivateJWK as q, randomBytes as r, sanitizeObject as s, textEncoder as t, isAsymmetricJWK as u, validateCriticalHeadersJWE as v, concatUint8Arrays as w, base64Decode as x, base64Encode as y, assertCryptoKey as z };

package/dist/shared/{unjwt.CcMe4dwj.mjs → unjwt.DmRAjMp8.mjs}

@@ -1,5 +1,5 @@
-import { i as importKey, s as sign$1, b as getJWKFromSet, v as verify$1 } from './unjwt.kE816XJO.mjs';
-import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, l as textDecoder, e as base64UrlDecode, m as isJWKSet, n as decodePayloadFromB64UrlSegment, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './unjwt.BhoZWy2Y.mjs';
+import { i as importKey, s as sign$1, b as getJWKFromSet, v as verify$1 } from './unjwt.Vg02PZWw.mjs';
+import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, l as textDecoder, e as base64UrlDecode, m as isJWKSet, n as decodePayloadFromB64UrlSegment, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './unjwt.DCiTNyCM.mjs';
 
 async function sign(payload, key, options = {}) {
   const { protectedHeader: additionalProtectedHeader } = options;
@@ -97,9 +97,7 @@ async function verify(jws, key, options = {}) {
     );
   }
   const keyInput = typeof key === "function" ? await key(protectedHeader, jws) : key;
-  const resolvedKey = isJWKSet(
-    keyInput
-  ) ? getJWKFromSet(keyInput, protectedHeader) : keyInput;
+  const resolvedKey = isJWKSet(keyInput) ? getJWKFromSet(keyInput, protectedHeader) : keyInput;
   const verificationKey = await importKey(resolvedKey, alg);
   const signingInputString = `${protectedHeaderEncoded}.${payloadEncoded}`;
   const signingInputBytes = textEncoder.encode(signingInputString);