unjwt 0.5.2 → 0.5.4

package/README.md

@@ -44,14 +44,25 @@ import { encrypt, decrypt } from "unjwt/jwe";
 // JWK functions
 import {
   generateKey,
-  deriveKeyFromPassword,
   importKey,
   exportKey,
   wrapKey,
   unwrapKey,
+  getJWKFromSet,
+  importJWKFromPEM,
+  exportJWKToPEM,
+  deriveKeyFromPassword,
 } from "unjwt/jwk";
 // Utility functions
-import { base64UrlEncode, base64UrlDecode, randomBytes } from "unjwt/utils";
+import {
+  isJWK,
+  isJWKSet,
+  isCryptoKey,
+  isCryptoKeyPair,
+  base64UrlEncode,
+  base64UrlDecode,
+  randomBytes,
+} from "unjwt/utils";
 ```
 
 **CDN** (Deno, Bun and Browsers)
@@ -65,14 +76,21 @@ import { encrypt, decrypt } from "https://esm.sh/unjwt/jwe";
 // JWK functions
 import {
   generateKey,
-  deriveKeyFromPassword,
   importKey,
   exportKey,
   wrapKey,
   unwrapKey,
+  getJWKFromSet,
+  importJWKFromPEM,
+  exportJWKToPEM,
+  deriveKeyFromPassword,
 } from "https://esm.sh/unjwt/jwk";
 // Utility functions
 import {
+  isJWK,
+  isJWKSet,
+  isCryptoKey,
+  isCryptoKeyPair,
   base64UrlEncode,
   base64UrlDecode,
   randomBytes,
@@ -129,8 +147,8 @@ console.log(token);
 Verifies a JWS token.
 
 - `jws`: The JWS token string.
-- `key`: The verification key (`CryptoKey`, `JWK`, `Uint8Array`, or a `KeyLookupFunction`).
-  A `KeyLookupFunction` has the signature `(header: JWSProtectedHeader) => Promise<CryptoKey | JWK | Uint8Array> | CryptoKey | JWK | Uint8Array`.
+- `key`: The verification key (`CryptoKey`, `JWK`, `JWKSet`, `Uint8Array`, or a `KeyLookupFunction`).
+  A `KeyLookupFunction` has the signature `(header: JWSProtectedHeader, jws: string) => Promise<CryptoKey | JWK | JWKSet | Uint8Array> | CryptoKey | JWK | JWKSet | Uint8Array`.
 - `options` (optional):
   - `algorithms`: An array of allowed JWS `alg` values. If not provided, the `alg` from the JWS header is used.
   - `critical`: An array of JWS header parameter names that the application understands and processes.

package/dist/index.d.mts

@@ -1,6 +1,6 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, B as JWKAlgorithm, E as JWKPEMAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, A as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, y as JWK_ED, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, z as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CxhGjEAX.mjs';
-export { b as JWT, a as JWTClaims, J as JoseHeaderParameters } from './shared/unjwt.Cd9nTEWg.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.kiNPBQh0.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.DQIYSlHj.mjs';
-export { i as utils } from './shared/unjwt.BJEchXrM.mjs';
-export { j as jwk } from './shared/unjwt.D1J1DelP.mjs';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.D9da8HQF.mjs';
+export { b as JWT, a as JWTClaims, J as JoseHeaderParameters } from './shared/unjwt.BvIkEGGz.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.CGkRbYL2.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.8w7jp2aw.mjs';
+export { i as utils } from './shared/unjwt.CbvzYE-m.mjs';
+export { j as jwk } from './shared/unjwt.DH1p_WL8.mjs';

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, B as JWKAlgorithm, E as JWKPEMAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, A as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, y as JWK_ED, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, z as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CxhGjEAX.js';
-export { b as JWT, a as JWTClaims, J as JoseHeaderParameters } from './shared/unjwt.BISJ5yt1.js';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.TbszLNOP.js';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.B0XDPf8a.js';
-export { i as utils } from './shared/unjwt.B5N3dPN9.js';
-export { j as jwk } from './shared/unjwt.WvWb2zNM.js';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.D9da8HQF.js';
+export { b as JWT, a as JWTClaims, J as JoseHeaderParameters } from './shared/unjwt.c10n3uM8.js';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.RZpKLLLg.js';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.CoSilGqk.js';
+export { i as utils } from './shared/unjwt.D4DUiNeM.js';
+export { j as jwk } from './shared/unjwt.CrcUJklb.js';

package/dist/index.mjs

@@ -1,5 +1,5 @@
-export { i as utils } from './shared/unjwt.DOI5UE8K.mjs';
-export { j as jwe } from './shared/unjwt.ByclPbtq.mjs';
-export { j as jwk } from './shared/unjwt.ZsOShfhX.mjs';
-export { j as jws } from './shared/unjwt.COPr8ebc.mjs';
-import './shared/unjwt.z_U3fRJ-.mjs';
+export { i as utils } from './shared/unjwt.X5vzu_l_.mjs';
+export { j as jwe } from './shared/unjwt.BQI798Cm.mjs';
+export { j as jwk } from './shared/unjwt.CdYPxnzf.mjs';
+export { j as jws } from './shared/unjwt.DGo0E5fc.mjs';
+import './shared/unjwt.2RUlMdtr.mjs';

package/dist/jwe.d.mts

@@ -1,3 +1,3 @@
-import './shared/unjwt.CxhGjEAX.mjs';
-import './shared/unjwt.Cd9nTEWg.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.DQIYSlHj.mjs';
+import './shared/unjwt.D9da8HQF.mjs';
+import './shared/unjwt.BvIkEGGz.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.8w7jp2aw.mjs';

package/dist/jwe.d.ts

@@ -1,3 +1,3 @@
-import './shared/unjwt.CxhGjEAX.js';
-import './shared/unjwt.BISJ5yt1.js';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.B0XDPf8a.js';
+import './shared/unjwt.D9da8HQF.js';
+import './shared/unjwt.c10n3uM8.js';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.CoSilGqk.js';

package/dist/jwe.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.ZsOShfhX.mjs';
-import './shared/unjwt.DOI5UE8K.mjs';
-export { d as decrypt, e as encrypt } from './shared/unjwt.ByclPbtq.mjs';
-import './shared/unjwt.z_U3fRJ-.mjs';
+import './shared/unjwt.CdYPxnzf.mjs';
+import './shared/unjwt.X5vzu_l_.mjs';
+export { d as decrypt, e as encrypt } from './shared/unjwt.BQI798Cm.mjs';
+import './shared/unjwt.2RUlMdtr.mjs';

package/dist/jwk.d.mts

@@ -1,2 +1,3 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, B as JWKAlgorithm, E as JWKPEMAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, A as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, y as JWK_ED, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, z as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CxhGjEAX.mjs';
-export { d as deriveKeyFromPassword, b as exportJWKToPEM, e as exportKey, g as generateKey, a as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.D1J1DelP.mjs';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.D9da8HQF.mjs';
+import './shared/unjwt.BvIkEGGz.mjs';
+export { d as deriveKeyFromPassword, b as exportJWKToPEM, e as exportKey, g as generateKey, c as getJWKFromSet, a as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.DH1p_WL8.mjs';

package/dist/jwk.d.ts

@@ -1,2 +1,3 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, B as JWKAlgorithm, E as JWKPEMAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, A as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, y as JWK_ED, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, z as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CxhGjEAX.js';
-export { d as deriveKeyFromPassword, b as exportJWKToPEM, e as exportKey, g as generateKey, a as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.WvWb2zNM.js';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.D9da8HQF.js';
+import './shared/unjwt.c10n3uM8.js';
+export { d as deriveKeyFromPassword, b as exportJWKToPEM, e as exportKey, g as generateKey, c as getJWKFromSet, a as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.CrcUJklb.js';

package/dist/jwk.mjs

@@ -1,2 +1,2 @@
-import './shared/unjwt.DOI5UE8K.mjs';
-export { o as deriveKeyFromPassword, s as exportJWKToPEM, p as exportKey, n as generateKey, r as importJWKFromPEM, i as importKey, l as unwrapKey, q as wrapKey } from './shared/unjwt.ZsOShfhX.mjs';
+import './shared/unjwt.X5vzu_l_.mjs';
+export { p as deriveKeyFromPassword, t as exportJWKToPEM, q as exportKey, o as generateKey, g as getJWKFromSet, s as importJWKFromPEM, i as importKey, m as unwrapKey, r as wrapKey } from './shared/unjwt.CdYPxnzf.mjs';

package/dist/jws.d.mts

@@ -1,3 +1,3 @@
-import './shared/unjwt.CxhGjEAX.mjs';
-import './shared/unjwt.Cd9nTEWg.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.kiNPBQh0.mjs';
+import './shared/unjwt.D9da8HQF.mjs';
+import './shared/unjwt.BvIkEGGz.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.CGkRbYL2.mjs';

package/dist/jws.d.ts

@@ -1,3 +1,3 @@
-import './shared/unjwt.CxhGjEAX.js';
-import './shared/unjwt.BISJ5yt1.js';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.TbszLNOP.js';
+import './shared/unjwt.D9da8HQF.js';
+import './shared/unjwt.c10n3uM8.js';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.RZpKLLLg.js';

package/dist/jws.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.ZsOShfhX.mjs';
-import './shared/unjwt.DOI5UE8K.mjs';
-import './shared/unjwt.z_U3fRJ-.mjs';
-export { s as sign, v as verify } from './shared/unjwt.COPr8ebc.mjs';
+import './shared/unjwt.CdYPxnzf.mjs';
+import './shared/unjwt.X5vzu_l_.mjs';
+import './shared/unjwt.2RUlMdtr.mjs';
+export { s as sign, v as verify } from './shared/unjwt.DGo0E5fc.mjs';

package/dist/shared/{unjwt.z_U3fRJ-.mjs → unjwt.2RUlMdtr.mjs}

@@ -1,4 +1,4 @@
-import { c as checkSigCryptoKey } from './unjwt.ZsOShfhX.mjs';
+import { c as checkSigCryptoKey } from './unjwt.CdYPxnzf.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.

package/dist/shared/{unjwt.DQIYSlHj.d.mts → unjwt.8w7jp2aw.d.mts}

@@ -1,5 +1,5 @@
-import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, f as JWK_EC_Public, m as JWK } from './unjwt.CxhGjEAX.mjs';
-import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.Cd9nTEWg.mjs';
+import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, f as JWK_EC_Public, m as JWK } from './unjwt.D9da8HQF.mjs';
+import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.BvIkEGGz.mjs';
 
 /** Recognized JWE Header Parameters, any other Header Members may also be present. */
 interface JWEHeaderParameters extends JoseHeaderParameters {
@@ -99,7 +99,7 @@ interface JWEEncryptOptions {
  * @param header The JWE Protected Header.
  * @returns The key material (CryptoKey, JWK, password string, or raw Uint8Array) or a Promise resolving to it.
  */
-type JWEKeyLookupFunction = (header: JWEHeaderParameters) => CryptoKey | JWK | string | Uint8Array | Promise<CryptoKey | JWK | string | Uint8Array>;
+type JWEKeyLookupFunction = (header: JWEHeaderParameters, token: string) => CryptoKey | JWK | string | Uint8Array | Promise<CryptoKey | JWK | string | Uint8Array>;
 /**
  * JWE (JSON Web Encryption) decryption options
  */
@@ -125,7 +125,7 @@ interface JWEDecryptOptions {
 /**
  * Result of a JWE decryption operation.
  */
-interface JWEDecryptResult<T = JWTClaims | string> {
+interface JWEDecryptResult<T extends JWTClaims | Uint8Array | string = JWTClaims | Uint8Array | string> {
     /** The decrypted payload. */
     payload: T;
     /** The JWE Protected Header. */
@@ -167,13 +167,13 @@ declare function encrypt(payload: string | Uint8Array | Record<string, any>, key
  * @returns A Promise resolving to an object containing the decrypted plaintext, protected header, CEK, and AAD.
  * @throws If JWE is invalid, decryption fails, or options are not met.
  */
-declare function decrypt<T = JWTClaims | string>(jwe: string, key: CryptoKey | JWK | string | Uint8Array | JWEKeyLookupFunction, options?: JWEDecryptOptions): Promise<JWEDecryptResult<T>>;
+declare function decrypt<T extends JWTClaims | Uint8Array | string>(jwe: string, key: CryptoKey | JWK | string | Uint8Array | JWEKeyLookupFunction, options?: JWEDecryptOptions): Promise<JWEDecryptResult<T>>;
 declare function decrypt(jwe: string, key: CryptoKey | JWK | string | Uint8Array | JWEKeyLookupFunction, options: JWEDecryptOptions & {
     forceUint8Array: true;
 }): Promise<JWEDecryptResult<Uint8Array>>;
 
 type jwe_JWEDecryptOptions = JWEDecryptOptions;
-type jwe_JWEDecryptResult<T = JWTClaims | string> = JWEDecryptResult<T>;
+type jwe_JWEDecryptResult<T extends JWTClaims | Uint8Array | string = JWTClaims | Uint8Array | string> = JWEDecryptResult<T>;
 type jwe_JWEEncryptOptions = JWEEncryptOptions;
 type jwe_JWEHeaderParameters = JWEHeaderParameters;
 type jwe_JWEKeyLookupFunction = JWEKeyLookupFunction;

package/dist/shared/{unjwt.ByclPbtq.mjs → unjwt.BQI798Cm.mjs}

@@ -1,6 +1,6 @@
-import { a as checkEncCryptoKey, u as uint32be, g as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, b as bitLengthCEK, d as jwkTokey, i as importKey, f as generateIV, h as encrypt$1, l as unwrapKey, m as decrypt$1 } from './unjwt.ZsOShfhX.mjs';
-import { e as concatUint8Arrays, t as textEncoder, f as assertCryptoKey, b as base64UrlEncode, g as isCryptoKey, a as isJWK, d as base64UrlDecode, r as randomBytes, c as textDecoder } from './unjwt.DOI5UE8K.mjs';
-import { c as checkKeyLength } from './unjwt.z_U3fRJ-.mjs';
+import { a as checkEncCryptoKey, u as uint32be, b as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, d as bitLengthCEK, f as jwkTokey, i as importKey, h as generateIV, l as encrypt$1, m as unwrapKey, n as decrypt$1 } from './unjwt.CdYPxnzf.mjs';
+import { f as concatUint8Arrays, t as textEncoder, g as assertCryptoKey, b as base64UrlEncode, h as isCryptoKey, a as isJWK, d as base64UrlDecode, r as randomBytes, c as textDecoder } from './unjwt.X5vzu_l_.mjs';
+import { c as checkKeyLength } from './unjwt.2RUlMdtr.mjs';
 
 function lengthAndInput(input) {
   return concatUint8Arrays(uint32be(input.length), input);
@@ -327,7 +327,7 @@ async function decrypt(jwe, key, options) {
   if (options?.encryptionAlgorithms && !options.encryptionAlgorithms.includes(enc)) {
     throw new Error(`Content encryption algorithm not allowed: ${enc}`);
   }
-  const resolvedKeyMaterial = typeof key === "function" ? await key(protectedHeader) : key;
+  const resolvedKeyMaterial = typeof key === "function" ? await key(protectedHeader, jwe) : key;
   const unwrappingKey = await importKey(resolvedKeyMaterial, alg);
   const encryptedKeyBytes = base64UrlDecode(encryptedKeyEncoded, false);
   const contentIVBytes = base64UrlDecode(ivEncoded, false);

package/dist/shared/{unjwt.Cd9nTEWg.d.mts → unjwt.BvIkEGGz.d.mts}

@@ -1,4 +1,4 @@
-import { i as JWK_RSA_Public } from './unjwt.CxhGjEAX.mjs';
+import { i as JWK_RSA_Public } from './unjwt.D9da8HQF.mjs';
 
 /** Header Parameters common to JWE and JWS */
 interface JoseHeaderParameters {

package/dist/shared/{unjwt.TbszLNOP.d.ts → unjwt.CGkRbYL2.d.mts}

@@ -1,5 +1,5 @@
-import { n as JWK_HMAC, o as JWK_RSA_SIGN, p as JWK_RSA_PSS, q as JWK_ECDSA, m as JWK } from './unjwt.CxhGjEAX.js';
-import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.BISJ5yt1.js';
+import { o as JWK_HMAC, p as JWK_RSA_SIGN, q as JWK_RSA_PSS, r as JWK_ECDSA, m as JWK, n as JWKSet } from './unjwt.D9da8HQF.mjs';
+import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.BvIkEGGz.mjs';
 
 type JWS_SIGN_EXTRA = "Ed25519" | "EdDSA";
 /** JWS Signing Algorithm Identifier. */
@@ -33,7 +33,7 @@ interface JWSSignOptions {
     protectedHeader?: JWSHeaderParameters;
 }
 /** Result of JWS verification */
-interface JWSVerifyResult<T = JWTClaims | Uint8Array | string> {
+interface JWSVerifyResult<T extends JWTClaims | Uint8Array | string = JWTClaims | Uint8Array | string> {
     /** The decoded and verified payload. */
     payload: T;
     /** The JWS Protected Header. */
@@ -101,6 +101,13 @@ interface JWSVerifyOptions {
      */
     critical?: string[];
 }
+/**
+ * Key lookup function for JWS verification.
+ * @param header The JWS Protected Header.
+ * @param token The JWS token.
+ * @returns The key material (CryptoKey, JWK, or raw Uint8Array) or a Promise resolving to it.
+ */
+type JWSKeyLookupFunction = (header: JWSProtectedHeader, token: string) => CryptoKey | JWK | JWKSet | Uint8Array | Promise<CryptoKey | JWK | JWKSet | Uint8Array>;
 
 /**
  * Creates a JWS (JSON Web Signature) in Compact Serialization format.
@@ -110,44 +117,50 @@ interface JWSVerifyOptions {
  * @param options Signing options, including the algorithm (`alg`) and protected header parameters.
  * @returns A Promise resolving to the JWS Compact Serialization string.
  */
-declare function sign(payload: JWTClaims, key: JWK | Uint8Array, options?: JWSSignOptions): Promise<string>;
-declare function sign(payload: string | Uint8Array | Record<string, any>, key: JWK | Uint8Array, options?: JWSSignOptions): Promise<string>;
+declare function sign(payload: JWTClaims, key: JWK, options?: JWSSignOptions): Promise<string>;
+declare function sign(payload: string | Uint8Array | Record<string, any>, key: JWK, options?: JWSSignOptions): Promise<string>;
 declare function sign(payload: JWTClaims, key: CryptoKey, options: JWSSignOptions & {
     alg: JWSAlgorithm;
 }): Promise<string>;
 declare function sign(payload: string | Uint8Array | Record<string, any>, key: CryptoKey, options: JWSSignOptions & {
     alg: JWSAlgorithm;
 }): Promise<string>;
+declare function sign(payload: JWTClaims, key: Uint8Array, options: JWSSignOptions & {
+    alg: JWSAlgorithm;
+}): Promise<string>;
+declare function sign(payload: string | Uint8Array | Record<string, any>, key: Uint8Array, options: JWSSignOptions & {
+    alg: JWSAlgorithm;
+}): Promise<string>;
 declare function sign(payload: string | Uint8Array | Record<string, any>, key: CryptoKey | JWK | Uint8Array, options: JWSSignOptions & {
     alg: JWSAlgorithm;
 }): Promise<string>;
-type KeyLookupFunction = (header: JWSProtectedHeader) => CryptoKey | JWK | Uint8Array | Promise<CryptoKey | JWK | Uint8Array>;
 /**
  * Verifies a JWS (JSON Web Signature) in Compact Serialization format.
  *
  * @param jws The JWS Compact Serialization string.
- * @param key The verification key (CryptoKey, JWK, raw symmetric key as Uint8Array, or a function resolving the key).
+ * @param key The verification key (CryptoKey, JWK, JWKSet, raw symmetric key as Uint8Array, or a function resolving the key or set).
  * @param options Verification options, such as allowed algorithms.
  * @returns A Promise resolving to an object containing the verified payload and protected header.
  * @throws If the JWS is invalid, signature verification fails, or options are not met.
  */
-declare function verify<T = JWTClaims | Uint8Array | string>(jws: string, key: CryptoKey | JWK | Uint8Array | KeyLookupFunction, options?: JWSVerifyOptions): Promise<JWSVerifyResult<T>>;
-declare function verify(jws: string, key: CryptoKey | JWK | Uint8Array | KeyLookupFunction, options: JWSVerifyOptions & {
+declare function verify<T extends JWTClaims | Uint8Array | string>(jws: string, key: CryptoKey | JWK | JWKSet | Uint8Array | JWSKeyLookupFunction, options?: JWSVerifyOptions): Promise<JWSVerifyResult<T>>;
+declare function verify(jws: string, key: CryptoKey | JWK | JWKSet | Uint8Array | JWSKeyLookupFunction, options: JWSVerifyOptions & {
     forceUint8Array: true;
 }): Promise<JWSVerifyResult<Uint8Array>>;
 
 type jws_JWSAlgorithm = JWSAlgorithm;
 type jws_JWSHeaderParameters = JWSHeaderParameters;
+type jws_JWSKeyLookupFunction = JWSKeyLookupFunction;
 type jws_JWSProtectedHeader = JWSProtectedHeader;
 type jws_JWSSignOptions = JWSSignOptions;
 type jws_JWSVerifyOptions = JWSVerifyOptions;
-type jws_JWSVerifyResult<T = JWTClaims | Uint8Array | string> = JWSVerifyResult<T>;
+type jws_JWSVerifyResult<T extends JWTClaims | Uint8Array | string = JWTClaims | Uint8Array | string> = JWSVerifyResult<T>;
 declare const jws_sign: typeof sign;
 declare const jws_verify: typeof verify;
 declare namespace jws {
   export { jws_sign as sign, jws_verify as verify };
-  export type { jws_JWSAlgorithm as JWSAlgorithm, jws_JWSHeaderParameters as JWSHeaderParameters, jws_JWSProtectedHeader as JWSProtectedHeader, jws_JWSSignOptions as JWSSignOptions, jws_JWSVerifyOptions as JWSVerifyOptions, jws_JWSVerifyResult as JWSVerifyResult };
+  export type { jws_JWSAlgorithm as JWSAlgorithm, jws_JWSHeaderParameters as JWSHeaderParameters, jws_JWSKeyLookupFunction as JWSKeyLookupFunction, jws_JWSProtectedHeader as JWSProtectedHeader, jws_JWSSignOptions as JWSSignOptions, jws_JWSVerifyOptions as JWSVerifyOptions, jws_JWSVerifyResult as JWSVerifyResult };
 }
 
 export { jws as j, sign as s, verify as v };
-export type { JWSAlgorithm as J, JWSHeaderParameters as a, JWSProtectedHeader as b, JWSSignOptions as c, JWSVerifyResult as d, JWSVerifyOptions as e };
+export type { JWSAlgorithm as J, JWSHeaderParameters as a, JWSProtectedHeader as b, JWSSignOptions as c, JWSVerifyResult as d, JWSVerifyOptions as e, JWSKeyLookupFunction as f };

package/dist/shared/{unjwt.BJEchXrM.d.mts → unjwt.CbvzYE-m.d.mts}

@@ -1,4 +1,4 @@
-import { m as JWK } from './unjwt.CxhGjEAX.mjs';
+import { m as JWK, n as JWKSet } from './unjwt.D9da8HQF.mjs';
 
 declare const textEncoder: TextEncoder;
 declare const textDecoder: TextDecoder;
@@ -17,6 +17,7 @@ declare function randomBytes(length: Readonly<number>): Uint8Array;
 declare function concatUint8Arrays(...arrays: Readonly<Uint8Array[]>): Uint8Array;
 declare function maybeArray<T>(item: T | T[]): T[];
 declare function isJWK(key: any): key is JWK;
+declare function isJWKSet(key: any): key is JWKSet;
 declare function assertCryptoKey(key: unknown): asserts key is CryptoKey;
 declare function isCryptoKey(key: unknown): key is CryptoKey;
 declare const isCryptoKeyPair: (key: any) => key is CryptoKeyPair;
@@ -30,6 +31,7 @@ declare const index_concatUint8Arrays: typeof concatUint8Arrays;
 declare const index_isCryptoKey: typeof isCryptoKey;
 declare const index_isCryptoKeyPair: typeof isCryptoKeyPair;
 declare const index_isJWK: typeof isJWK;
+declare const index_isJWKSet: typeof isJWKSet;
 declare const index_maybeArray: typeof maybeArray;
 declare const index_randomBytes: typeof randomBytes;
 declare const index_textDecoder: typeof textDecoder;
@@ -45,6 +47,7 @@ declare namespace index {
     index_isCryptoKey as isCryptoKey,
     index_isCryptoKeyPair as isCryptoKeyPair,
     index_isJWK as isJWK,
+    index_isJWKSet as isJWKSet,
     index_maybeArray as maybeArray,
     index_randomBytes as randomBytes,
     index_textDecoder as textDecoder,
@@ -52,4 +55,4 @@ declare namespace index {
   };
 }
 
-export { textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, assertCryptoKey as h, index as i, isCryptoKey as j, isCryptoKeyPair as k, maybeArray as m, randomBytes as r, textEncoder as t };
+export { textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, isJWKSet as h, index as i, assertCryptoKey as j, isCryptoKey as k, isCryptoKeyPair as l, maybeArray as m, randomBytes as r, textEncoder as t };

package/dist/shared/{unjwt.ZsOShfhX.mjs → unjwt.CdYPxnzf.mjs}

@@ -1,4 +1,4 @@
-import { g as isCryptoKey, e as concatUint8Arrays, b as base64UrlEncode, h as base64Decode, j as base64Encode, t as textEncoder, r as randomBytes, a as isJWK, d as base64UrlDecode } from './unjwt.DOI5UE8K.mjs';
+import { h as isCryptoKey, f as concatUint8Arrays, b as base64UrlEncode, j as base64Decode, k as base64Encode, t as textEncoder, r as randomBytes, a as isJWK, d as base64UrlDecode, e as isJWKSet } from './unjwt.X5vzu_l_.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -1095,12 +1095,12 @@ async function importKey(key, alg) {
     if ("k" in key && typeof key.k === "string") {
       return base64UrlDecode(key.k, false);
     } else {
-      if (!alg) {
+      if (!key.alg && !alg) {
         throw new TypeError(
           "Algorithm must be provided when importing non-oct JWK"
         );
       }
-      return jwkTokey({ ...key, alg });
+      return jwkTokey({ ...key, alg: key.alg || alg });
     }
   }
   throw new Error("Invalid key type provided to importKey");
@@ -1383,6 +1383,44 @@ async function exportJWKToPEM(jwk, pemFormat, algForCryptoKeyImport) {
     }
   }
 }
+function getJWKFromSet(jwkSet, kidOrProtectedHeader) {
+  if (!jwkSet || !isJWKSet(jwkSet)) {
+    throw new TypeError("Invalid JWK Set provided");
+  }
+  if (typeof kidOrProtectedHeader === "string") {
+    const kid = kidOrProtectedHeader;
+    const selectedKey = jwkSet.keys.find((k) => k.kid === kid);
+    if (!selectedKey) {
+      throw new Error(`No key found in JWK Set with kid "${kid}".`);
+    }
+    return selectedKey;
+  } else if (typeof kidOrProtectedHeader === "object") {
+    const { kid, alg, kty } = kidOrProtectedHeader;
+    if (!kid) {
+      throw new Error(
+        "JWS Protected Header is missing 'kid' (Key ID) and a JWK Set was provided. Cannot select key from JWK Set automatically."
+      );
+    }
+    const selectedKey = jwkSet.keys.find((k) => {
+      return k.kid === kid && (!alg || k.alg === alg) && (!kty || k.kty === kty);
+    });
+    if (!selectedKey) {
+      let errorMessage = `No key found in JWK Set with kid "${kid}"`;
+      if (alg) {
+        errorMessage += ` and alg "${alg}"`;
+      }
+      if (kty) {
+        errorMessage += ` and kty "${kty}"`;
+      }
+      errorMessage += ".";
+      throw new Error(errorMessage);
+    }
+    return selectedKey;
+  }
+  throw new TypeError(
+    "`kidOrProtectedHeader` must be a string (kid) or an object (JOSE Protected Header)."
+  );
+}
 function getGenerateKeyParams(alg, options) {
   let algorithm;
   let keyUsages;
@@ -1498,10 +1536,11 @@ const jwk = {
   exportJWKToPEM: exportJWKToPEM,
   exportKey: exportKey,
   generateKey: generateKey,
+  getJWKFromSet: getJWKFromSet,
   importJWKFromPEM: importJWKFromPEM,
   importKey: importKey,
   unwrapKey: unwrapKey,
   wrapKey: wrapKey
 };
 
-export { checkEncCryptoKey as a, bitLengthCEK as b, checkSigCryptoKey as c, jwkTokey as d, encryptIV as e, generateIV as f, generateCEK as g, encrypt as h, importKey as i, jwk as j, keyToJWK as k, unwrapKey as l, decrypt as m, generateKey as n, deriveKeyFromPassword as o, exportKey as p, wrapKey as q, importJWKFromPEM as r, exportJWKToPEM as s, uint32be as u, wrap as w };
+export { checkEncCryptoKey as a, generateCEK as b, checkSigCryptoKey as c, bitLengthCEK as d, encryptIV as e, jwkTokey as f, getJWKFromSet as g, generateIV as h, importKey as i, jwk as j, keyToJWK as k, encrypt as l, unwrapKey as m, decrypt as n, generateKey as o, deriveKeyFromPassword as p, exportKey as q, wrapKey as r, importJWKFromPEM as s, exportJWKToPEM as t, uint32be as u, wrap as w };

package/dist/shared/{unjwt.B0XDPf8a.d.ts → unjwt.CoSilGqk.d.ts}

@@ -1,5 +1,5 @@
-import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, f as JWK_EC_Public, m as JWK } from './unjwt.CxhGjEAX.js';
-import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.BISJ5yt1.js';
+import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, f as JWK_EC_Public, m as JWK } from './unjwt.D9da8HQF.js';
+import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.c10n3uM8.js';
 
 /** Recognized JWE Header Parameters, any other Header Members may also be present. */
 interface JWEHeaderParameters extends JoseHeaderParameters {
@@ -99,7 +99,7 @@ interface JWEEncryptOptions {
  * @param header The JWE Protected Header.
  * @returns The key material (CryptoKey, JWK, password string, or raw Uint8Array) or a Promise resolving to it.
  */
-type JWEKeyLookupFunction = (header: JWEHeaderParameters) => CryptoKey | JWK | string | Uint8Array | Promise<CryptoKey | JWK | string | Uint8Array>;
+type JWEKeyLookupFunction = (header: JWEHeaderParameters, token: string) => CryptoKey | JWK | string | Uint8Array | Promise<CryptoKey | JWK | string | Uint8Array>;
 /**
  * JWE (JSON Web Encryption) decryption options
  */
@@ -125,7 +125,7 @@ interface JWEDecryptOptions {
 /**
  * Result of a JWE decryption operation.
  */
-interface JWEDecryptResult<T = JWTClaims | string> {
+interface JWEDecryptResult<T extends JWTClaims | Uint8Array | string = JWTClaims | Uint8Array | string> {
     /** The decrypted payload. */
     payload: T;
     /** The JWE Protected Header. */
@@ -167,13 +167,13 @@ declare function encrypt(payload: string | Uint8Array | Record<string, any>, key
  * @returns A Promise resolving to an object containing the decrypted plaintext, protected header, CEK, and AAD.
  * @throws If JWE is invalid, decryption fails, or options are not met.
  */
-declare function decrypt<T = JWTClaims | string>(jwe: string, key: CryptoKey | JWK | string | Uint8Array | JWEKeyLookupFunction, options?: JWEDecryptOptions): Promise<JWEDecryptResult<T>>;
+declare function decrypt<T extends JWTClaims | Uint8Array | string>(jwe: string, key: CryptoKey | JWK | string | Uint8Array | JWEKeyLookupFunction, options?: JWEDecryptOptions): Promise<JWEDecryptResult<T>>;
 declare function decrypt(jwe: string, key: CryptoKey | JWK | string | Uint8Array | JWEKeyLookupFunction, options: JWEDecryptOptions & {
     forceUint8Array: true;
 }): Promise<JWEDecryptResult<Uint8Array>>;
 
 type jwe_JWEDecryptOptions = JWEDecryptOptions;
-type jwe_JWEDecryptResult<T = JWTClaims | string> = JWEDecryptResult<T>;
+type jwe_JWEDecryptResult<T extends JWTClaims | Uint8Array | string = JWTClaims | Uint8Array | string> = JWEDecryptResult<T>;
 type jwe_JWEEncryptOptions = JWEEncryptOptions;
 type jwe_JWEHeaderParameters = JWEHeaderParameters;
 type jwe_JWEKeyLookupFunction = JWEKeyLookupFunction;

package/dist/shared/{unjwt.D1J1DelP.d.mts → unjwt.CrcUJklb.d.ts}

@@ -1,4 +1,5 @@
-import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, w as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, l as JWK_oct, m as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, E as JWKPEMAlgorithm, C as CompositeKey, d as ContentEncryptionAlgorithm, B as JWKAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, A as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, y as JWK_ED, n as JWK_HMAC, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, z as JWK_Symmetric_Algorithm } from './unjwt.CxhGjEAX.mjs';
+import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, x as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, l as JWK_oct, m as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, F as JWKPEMAlgorithm, n as JWKSet, C as CompositeKey, d as ContentEncryptionAlgorithm, E as JWKAlgorithm, J as JWKParameters, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm } from './unjwt.D9da8HQF.js';
+import { J as JoseHeaderParameters } from './unjwt.c10n3uM8.js';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -47,7 +48,6 @@ declare function importKey(key: string): Promise<Uint8Array>;
 declare function importKey(key: Uint8Array): Promise<Uint8Array>;
 declare function importKey(key: CryptoKey): Promise<CryptoKey>;
 declare function importKey(key: JWK_oct): Promise<Uint8Array>;
-declare function importKey(key: Exclude<JWK, JWK_oct>, alg: string): Promise<CryptoKey>;
 declare function importKey(key: CryptoKey | JWK | Uint8Array | string, alg?: string): Promise<CryptoKey | Uint8Array>;
 /**
  * Exports a CryptoKey to a JWK (JSON Web Key) format.
@@ -101,6 +101,25 @@ declare function importJWKFromPEM(pem: string, pemType: "pkcs8" | "spki" | "x509
  * @returns A Promise resolving to the PEM-encoded key string.
  */
 declare function exportJWKToPEM(jwk: JWK, pemFormat: "pkcs8" | "spki", algForCryptoKeyImport?: JWKPEMAlgorithm): Promise<string>;
+/**
+ * Retrieves a JWK (JSON Web Key) from a JWKSet based on a key ID (kid) or
+ * properties from a JOSE Header.
+ *
+ * @param jwkSet The JWKSet to search within.
+ * @param kidOrProtectedHeader Either a string representing the 'kid' (Key ID)
+ *        or an object representing the JOSE Protected Header. If an object is
+ *        provided, it must contain a 'kid' property. It can optionally contain
+ *        'alg' (Algorithm) and 'kty' (Key Type) to further refine the search.
+ * @returns The matching JWK from the set.
+ * @throws TypeError if `jwkSet` is invalid or `kidOrProtectedHeader` is not a
+ *         string or a valid header object.
+ * @throws Error if no key is found matching the provided criteria, or if the
+ *         header object is missing the 'kid' property.
+ */
+declare function getJWKFromSet(jwkSet: JWKSet, kidOrProtectedHeader: string | (JoseHeaderParameters & {
+    alg?: string;
+    kty?: string;
+})): JWK;
 
 declare const jwk_CompositeKey: typeof CompositeKey;
 declare const jwk_ContentEncryptionAlgorithm: typeof ContentEncryptionAlgorithm;
@@ -113,6 +132,7 @@ declare const jwk_JWK: typeof JWK;
 declare const jwk_JWKAlgorithm: typeof JWKAlgorithm;
 declare const jwk_JWKPEMAlgorithm: typeof JWKPEMAlgorithm;
 declare const jwk_JWKParameters: typeof JWKParameters;
+declare const jwk_JWKSet: typeof JWKSet;
 declare const jwk_JWK_AES_CBC_HMAC: typeof JWK_AES_CBC_HMAC;
 declare const jwk_JWK_AES_GCM: typeof JWK_AES_GCM;
 declare const jwk_JWK_AES_GCM_KW: typeof JWK_AES_GCM_KW;
@@ -142,6 +162,7 @@ declare const jwk_deriveKeyFromPassword: typeof deriveKeyFromPassword;
 declare const jwk_exportJWKToPEM: typeof exportJWKToPEM;
 declare const jwk_exportKey: typeof exportKey;
 declare const jwk_generateKey: typeof generateKey;
+declare const jwk_getJWKFromSet: typeof getJWKFromSet;
 declare const jwk_importJWKFromPEM: typeof importJWKFromPEM;
 declare const jwk_importKey: typeof importKey;
 declare const jwk_unwrapKey: typeof unwrapKey;
@@ -159,6 +180,7 @@ declare namespace jwk {
     jwk_JWKAlgorithm as JWKAlgorithm,
     jwk_JWKPEMAlgorithm as JWKPEMAlgorithm,
     jwk_JWKParameters as JWKParameters,
+    jwk_JWKSet as JWKSet,
     jwk_JWK_AES_CBC_HMAC as JWK_AES_CBC_HMAC,
     jwk_JWK_AES_GCM as JWK_AES_GCM,
     jwk_JWK_AES_GCM_KW as JWK_AES_GCM_KW,
@@ -188,6 +210,7 @@ declare namespace jwk {
     jwk_exportJWKToPEM as exportJWKToPEM,
     jwk_exportKey as exportKey,
     jwk_generateKey as generateKey,
+    jwk_getJWKFromSet as getJWKFromSet,
     jwk_importJWKFromPEM as importJWKFromPEM,
     jwk_importKey as importKey,
     jwk_unwrapKey as unwrapKey,
@@ -195,4 +218,4 @@ declare namespace jwk {
   };
 }
 
-export { importJWKFromPEM as a, exportJWKToPEM as b, deriveKeyFromPassword as d, exportKey as e, generateKey as g, importKey as i, jwk as j, unwrapKey as u, wrapKey as w };
+export { importJWKFromPEM as a, exportJWKToPEM as b, getJWKFromSet as c, deriveKeyFromPassword as d, exportKey as e, generateKey as g, importKey as i, jwk as j, unwrapKey as u, wrapKey as w };

package/dist/shared/{unjwt.B5N3dPN9.d.ts → unjwt.D4DUiNeM.d.ts}

@@ -1,4 +1,4 @@
-import { m as JWK } from './unjwt.CxhGjEAX.js';
+import { m as JWK, n as JWKSet } from './unjwt.D9da8HQF.js';
 
 declare const textEncoder: TextEncoder;
 declare const textDecoder: TextDecoder;
@@ -17,6 +17,7 @@ declare function randomBytes(length: Readonly<number>): Uint8Array;
 declare function concatUint8Arrays(...arrays: Readonly<Uint8Array[]>): Uint8Array;
 declare function maybeArray<T>(item: T | T[]): T[];
 declare function isJWK(key: any): key is JWK;
+declare function isJWKSet(key: any): key is JWKSet;
 declare function assertCryptoKey(key: unknown): asserts key is CryptoKey;
 declare function isCryptoKey(key: unknown): key is CryptoKey;
 declare const isCryptoKeyPair: (key: any) => key is CryptoKeyPair;
@@ -30,6 +31,7 @@ declare const index_concatUint8Arrays: typeof concatUint8Arrays;
 declare const index_isCryptoKey: typeof isCryptoKey;
 declare const index_isCryptoKeyPair: typeof isCryptoKeyPair;
 declare const index_isJWK: typeof isJWK;
+declare const index_isJWKSet: typeof isJWKSet;
 declare const index_maybeArray: typeof maybeArray;
 declare const index_randomBytes: typeof randomBytes;
 declare const index_textDecoder: typeof textDecoder;
@@ -45,6 +47,7 @@ declare namespace index {
     index_isCryptoKey as isCryptoKey,
     index_isCryptoKeyPair as isCryptoKeyPair,
     index_isJWK as isJWK,
+    index_isJWKSet as isJWKSet,
     index_maybeArray as maybeArray,
     index_randomBytes as randomBytes,
     index_textDecoder as textDecoder,
@@ -52,4 +55,4 @@ declare namespace index {
   };
 }
 
-export { textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, assertCryptoKey as h, index as i, isCryptoKey as j, isCryptoKeyPair as k, maybeArray as m, randomBytes as r, textEncoder as t };
+export { textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, isJWKSet as h, index as i, assertCryptoKey as j, isCryptoKey as k, isCryptoKeyPair as l, maybeArray as m, randomBytes as r, textEncoder as t };

package/dist/shared/{unjwt.CxhGjEAX.d.ts → unjwt.D9da8HQF.d.mts}

@@ -178,9 +178,17 @@ interface JWK_oct extends JWKParameters {
     k: string;
 }
 /**
- * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA" and "oct" key types are supported.
+ * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC" and "oct" key types are supported.
  */
 type JWK = JWK_oct | JWK_RSA | JWK_EC;
+/**
+ * JSON Web Key Set ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK Set}). "RSA", "EC" and "oct" key types are supported.
+ */
+interface JWKSet {
+    /** JWK Set "keys" Parameter */
+    keys: JWK[];
+    [parameter: string]: unknown;
+}
 /** JWK Key Algorithms */
 type JWK_HMAC = "HS256" | "HS384" | "HS512";
 type JWK_RSA_SIGN = "RS256" | "RS384" | "RS512";
@@ -199,4 +207,4 @@ type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA
 type JWKAlgorithm = JWK_Symmetric_Algorithm | JWK_Asymmetric_Algorithm | JWK_AES_CBC_HMAC | JWK_PBES2 | JWK_ECDH_ES | ("none" | "dir");
 type JWKPEMAlgorithm = JWK_RSA_PSS | JWK_RSA_SIGN | JWK_RSA_ENC | JWK_ECDSA | JWK_ECDH_ES | JWK_ED;
 
-export type { JWK_Asymmetric_Algorithm as A, JWKAlgorithm as B, CompositeKey as C, DeriveKeyOptions as D, JWKPEMAlgorithm as E, GenerateKeyAlgorithm as G, JWKParameters as J, KeyManagementAlgorithm as K, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, DeriveKeyReturn as c, ContentEncryptionAlgorithm as d, WrapKeyResult as e, JWK_EC_Public as f, JWK_EC_Private as g, JWK_EC as h, JWK_RSA_Public as i, JWK_RSA_Private as j, JWK_RSA as k, JWK_oct as l, JWK as m, JWK_HMAC as n, JWK_RSA_SIGN as o, JWK_RSA_PSS as p, JWK_ECDSA as q, JWK_RSA_ENC as r, JWK_AES_KW as s, JWK_AES_GCM_KW as t, JWK_AES_CBC_HMAC as u, JWK_AES_GCM as v, JWK_PBES2 as w, JWK_ECDH_ES as x, JWK_ED as y, JWK_Symmetric_Algorithm as z };
+export type { JWK_Symmetric_Algorithm as A, JWK_Asymmetric_Algorithm as B, CompositeKey as C, DeriveKeyOptions as D, JWKAlgorithm as E, JWKPEMAlgorithm as F, GenerateKeyAlgorithm as G, JWKParameters as J, KeyManagementAlgorithm as K, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, DeriveKeyReturn as c, ContentEncryptionAlgorithm as d, WrapKeyResult as e, JWK_EC_Public as f, JWK_EC_Private as g, JWK_EC as h, JWK_RSA_Public as i, JWK_RSA_Private as j, JWK_RSA as k, JWK_oct as l, JWK as m, JWKSet as n, JWK_HMAC as o, JWK_RSA_SIGN as p, JWK_RSA_PSS as q, JWK_ECDSA as r, JWK_RSA_ENC as s, JWK_AES_KW as t, JWK_AES_GCM_KW as u, JWK_AES_CBC_HMAC as v, JWK_AES_GCM as w, JWK_PBES2 as x, JWK_ECDH_ES as y, JWK_ED as z };

package/dist/shared/{unjwt.CxhGjEAX.d.mts → unjwt.D9da8HQF.d.ts}

@@ -178,9 +178,17 @@ interface JWK_oct extends JWKParameters {
     k: string;
 }
 /**
- * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA" and "oct" key types are supported.
+ * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC" and "oct" key types are supported.
  */
 type JWK = JWK_oct | JWK_RSA | JWK_EC;
+/**
+ * JSON Web Key Set ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK Set}). "RSA", "EC" and "oct" key types are supported.
+ */
+interface JWKSet {
+    /** JWK Set "keys" Parameter */
+    keys: JWK[];
+    [parameter: string]: unknown;
+}
 /** JWK Key Algorithms */
 type JWK_HMAC = "HS256" | "HS384" | "HS512";
 type JWK_RSA_SIGN = "RS256" | "RS384" | "RS512";
@@ -199,4 +207,4 @@ type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA
 type JWKAlgorithm = JWK_Symmetric_Algorithm | JWK_Asymmetric_Algorithm | JWK_AES_CBC_HMAC | JWK_PBES2 | JWK_ECDH_ES | ("none" | "dir");
 type JWKPEMAlgorithm = JWK_RSA_PSS | JWK_RSA_SIGN | JWK_RSA_ENC | JWK_ECDSA | JWK_ECDH_ES | JWK_ED;
 
-export type { JWK_Asymmetric_Algorithm as A, JWKAlgorithm as B, CompositeKey as C, DeriveKeyOptions as D, JWKPEMAlgorithm as E, GenerateKeyAlgorithm as G, JWKParameters as J, KeyManagementAlgorithm as K, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, DeriveKeyReturn as c, ContentEncryptionAlgorithm as d, WrapKeyResult as e, JWK_EC_Public as f, JWK_EC_Private as g, JWK_EC as h, JWK_RSA_Public as i, JWK_RSA_Private as j, JWK_RSA as k, JWK_oct as l, JWK as m, JWK_HMAC as n, JWK_RSA_SIGN as o, JWK_RSA_PSS as p, JWK_ECDSA as q, JWK_RSA_ENC as r, JWK_AES_KW as s, JWK_AES_GCM_KW as t, JWK_AES_CBC_HMAC as u, JWK_AES_GCM as v, JWK_PBES2 as w, JWK_ECDH_ES as x, JWK_ED as y, JWK_Symmetric_Algorithm as z };
+export type { JWK_Symmetric_Algorithm as A, JWK_Asymmetric_Algorithm as B, CompositeKey as C, DeriveKeyOptions as D, JWKAlgorithm as E, JWKPEMAlgorithm as F, GenerateKeyAlgorithm as G, JWKParameters as J, KeyManagementAlgorithm as K, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, DeriveKeyReturn as c, ContentEncryptionAlgorithm as d, WrapKeyResult as e, JWK_EC_Public as f, JWK_EC_Private as g, JWK_EC as h, JWK_RSA_Public as i, JWK_RSA_Private as j, JWK_RSA as k, JWK_oct as l, JWK as m, JWKSet as n, JWK_HMAC as o, JWK_RSA_SIGN as p, JWK_RSA_PSS as q, JWK_ECDSA as r, JWK_RSA_ENC as s, JWK_AES_KW as t, JWK_AES_GCM_KW as u, JWK_AES_CBC_HMAC as v, JWK_AES_GCM as w, JWK_PBES2 as x, JWK_ECDH_ES as y, JWK_ED as z };

package/dist/shared/{unjwt.COPr8ebc.mjs → unjwt.DGo0E5fc.mjs}

@@ -1,6 +1,6 @@
-import { i as importKey } from './unjwt.ZsOShfhX.mjs';
-import { a as isJWK, b as base64UrlEncode, t as textEncoder, c as textDecoder, d as base64UrlDecode, m as maybeArray } from './unjwt.DOI5UE8K.mjs';
-import { s as sign$1, v as verify$1 } from './unjwt.z_U3fRJ-.mjs';
+import { i as importKey, g as getJWKFromSet } from './unjwt.CdYPxnzf.mjs';
+import { a as isJWK, b as base64UrlEncode, t as textEncoder, c as textDecoder, d as base64UrlDecode, e as isJWKSet, m as maybeArray } from './unjwt.X5vzu_l_.mjs';
+import { s as sign$1, v as verify$1 } from './unjwt.2RUlMdtr.mjs';
 
 async function sign(payload, key, options = {}) {
   const { protectedHeader: additionalProtectedHeader } = options;
@@ -85,7 +85,8 @@ async function verify(jws, key, options = {}) {
       `Invalid JWS: Signature is not valid Base64URL (${error_ instanceof Error ? error_.message : error_})`
     );
   }
-  const resolvedKey = typeof key === "function" ? await key(protectedHeader) : key;
+  const keyInput = typeof key === "function" ? await key(protectedHeader, jws) : key;
+  const resolvedKey = isJWKSet(keyInput) ? getJWKFromSet(keyInput, protectedHeader) : keyInput;
   const verificationKey = await importKey(resolvedKey, alg);
   const signingInputString = `${protectedHeaderEncoded}.${payloadEncoded}`;
   const signingInputBytes = textEncoder.encode(signingInputString);

package/dist/shared/{unjwt.WvWb2zNM.d.ts → unjwt.DH1p_WL8.d.mts}

@@ -1,4 +1,5 @@
-import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, w as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, l as JWK_oct, m as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, E as JWKPEMAlgorithm, C as CompositeKey, d as ContentEncryptionAlgorithm, B as JWKAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, A as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, y as JWK_ED, n as JWK_HMAC, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, z as JWK_Symmetric_Algorithm } from './unjwt.CxhGjEAX.js';
+import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, x as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, l as JWK_oct, m as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, F as JWKPEMAlgorithm, n as JWKSet, C as CompositeKey, d as ContentEncryptionAlgorithm, E as JWKAlgorithm, J as JWKParameters, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm } from './unjwt.D9da8HQF.mjs';
+import { J as JoseHeaderParameters } from './unjwt.BvIkEGGz.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -47,7 +48,6 @@ declare function importKey(key: string): Promise<Uint8Array>;
 declare function importKey(key: Uint8Array): Promise<Uint8Array>;
 declare function importKey(key: CryptoKey): Promise<CryptoKey>;
 declare function importKey(key: JWK_oct): Promise<Uint8Array>;
-declare function importKey(key: Exclude<JWK, JWK_oct>, alg: string): Promise<CryptoKey>;
 declare function importKey(key: CryptoKey | JWK | Uint8Array | string, alg?: string): Promise<CryptoKey | Uint8Array>;
 /**
  * Exports a CryptoKey to a JWK (JSON Web Key) format.
@@ -101,6 +101,25 @@ declare function importJWKFromPEM(pem: string, pemType: "pkcs8" | "spki" | "x509
  * @returns A Promise resolving to the PEM-encoded key string.
  */
 declare function exportJWKToPEM(jwk: JWK, pemFormat: "pkcs8" | "spki", algForCryptoKeyImport?: JWKPEMAlgorithm): Promise<string>;
+/**
+ * Retrieves a JWK (JSON Web Key) from a JWKSet based on a key ID (kid) or
+ * properties from a JOSE Header.
+ *
+ * @param jwkSet The JWKSet to search within.
+ * @param kidOrProtectedHeader Either a string representing the 'kid' (Key ID)
+ *        or an object representing the JOSE Protected Header. If an object is
+ *        provided, it must contain a 'kid' property. It can optionally contain
+ *        'alg' (Algorithm) and 'kty' (Key Type) to further refine the search.
+ * @returns The matching JWK from the set.
+ * @throws TypeError if `jwkSet` is invalid or `kidOrProtectedHeader` is not a
+ *         string or a valid header object.
+ * @throws Error if no key is found matching the provided criteria, or if the
+ *         header object is missing the 'kid' property.
+ */
+declare function getJWKFromSet(jwkSet: JWKSet, kidOrProtectedHeader: string | (JoseHeaderParameters & {
+    alg?: string;
+    kty?: string;
+})): JWK;
 
 declare const jwk_CompositeKey: typeof CompositeKey;
 declare const jwk_ContentEncryptionAlgorithm: typeof ContentEncryptionAlgorithm;
@@ -113,6 +132,7 @@ declare const jwk_JWK: typeof JWK;
 declare const jwk_JWKAlgorithm: typeof JWKAlgorithm;
 declare const jwk_JWKPEMAlgorithm: typeof JWKPEMAlgorithm;
 declare const jwk_JWKParameters: typeof JWKParameters;
+declare const jwk_JWKSet: typeof JWKSet;
 declare const jwk_JWK_AES_CBC_HMAC: typeof JWK_AES_CBC_HMAC;
 declare const jwk_JWK_AES_GCM: typeof JWK_AES_GCM;
 declare const jwk_JWK_AES_GCM_KW: typeof JWK_AES_GCM_KW;
@@ -142,6 +162,7 @@ declare const jwk_deriveKeyFromPassword: typeof deriveKeyFromPassword;
 declare const jwk_exportJWKToPEM: typeof exportJWKToPEM;
 declare const jwk_exportKey: typeof exportKey;
 declare const jwk_generateKey: typeof generateKey;
+declare const jwk_getJWKFromSet: typeof getJWKFromSet;
 declare const jwk_importJWKFromPEM: typeof importJWKFromPEM;
 declare const jwk_importKey: typeof importKey;
 declare const jwk_unwrapKey: typeof unwrapKey;
@@ -159,6 +180,7 @@ declare namespace jwk {
     jwk_JWKAlgorithm as JWKAlgorithm,
     jwk_JWKPEMAlgorithm as JWKPEMAlgorithm,
     jwk_JWKParameters as JWKParameters,
+    jwk_JWKSet as JWKSet,
     jwk_JWK_AES_CBC_HMAC as JWK_AES_CBC_HMAC,
     jwk_JWK_AES_GCM as JWK_AES_GCM,
     jwk_JWK_AES_GCM_KW as JWK_AES_GCM_KW,
@@ -188,6 +210,7 @@ declare namespace jwk {
     jwk_exportJWKToPEM as exportJWKToPEM,
     jwk_exportKey as exportKey,
     jwk_generateKey as generateKey,
+    jwk_getJWKFromSet as getJWKFromSet,
     jwk_importJWKFromPEM as importJWKFromPEM,
     jwk_importKey as importKey,
     jwk_unwrapKey as unwrapKey,
@@ -195,4 +218,4 @@ declare namespace jwk {
   };
 }
 
-export { importJWKFromPEM as a, exportJWKToPEM as b, deriveKeyFromPassword as d, exportKey as e, generateKey as g, importKey as i, jwk as j, unwrapKey as u, wrapKey as w };
+export { importJWKFromPEM as a, exportJWKToPEM as b, getJWKFromSet as c, deriveKeyFromPassword as d, exportKey as e, generateKey as g, importKey as i, jwk as j, unwrapKey as u, wrapKey as w };

package/dist/shared/{unjwt.kiNPBQh0.d.mts → unjwt.RZpKLLLg.d.ts}

@@ -1,5 +1,5 @@
-import { n as JWK_HMAC, o as JWK_RSA_SIGN, p as JWK_RSA_PSS, q as JWK_ECDSA, m as JWK } from './unjwt.CxhGjEAX.mjs';
-import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.Cd9nTEWg.mjs';
+import { o as JWK_HMAC, p as JWK_RSA_SIGN, q as JWK_RSA_PSS, r as JWK_ECDSA, m as JWK, n as JWKSet } from './unjwt.D9da8HQF.js';
+import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.c10n3uM8.js';
 
 type JWS_SIGN_EXTRA = "Ed25519" | "EdDSA";
 /** JWS Signing Algorithm Identifier. */
@@ -33,7 +33,7 @@ interface JWSSignOptions {
     protectedHeader?: JWSHeaderParameters;
 }
 /** Result of JWS verification */
-interface JWSVerifyResult<T = JWTClaims | Uint8Array | string> {
+interface JWSVerifyResult<T extends JWTClaims | Uint8Array | string = JWTClaims | Uint8Array | string> {
     /** The decoded and verified payload. */
     payload: T;
     /** The JWS Protected Header. */
@@ -101,6 +101,13 @@ interface JWSVerifyOptions {
      */
     critical?: string[];
 }
+/**
+ * Key lookup function for JWS verification.
+ * @param header The JWS Protected Header.
+ * @param token The JWS token.
+ * @returns The key material (CryptoKey, JWK, or raw Uint8Array) or a Promise resolving to it.
+ */
+type JWSKeyLookupFunction = (header: JWSProtectedHeader, token: string) => CryptoKey | JWK | JWKSet | Uint8Array | Promise<CryptoKey | JWK | JWKSet | Uint8Array>;
 
 /**
  * Creates a JWS (JSON Web Signature) in Compact Serialization format.
@@ -110,44 +117,50 @@ interface JWSVerifyOptions {
  * @param options Signing options, including the algorithm (`alg`) and protected header parameters.
  * @returns A Promise resolving to the JWS Compact Serialization string.
  */
-declare function sign(payload: JWTClaims, key: JWK | Uint8Array, options?: JWSSignOptions): Promise<string>;
-declare function sign(payload: string | Uint8Array | Record<string, any>, key: JWK | Uint8Array, options?: JWSSignOptions): Promise<string>;
+declare function sign(payload: JWTClaims, key: JWK, options?: JWSSignOptions): Promise<string>;
+declare function sign(payload: string | Uint8Array | Record<string, any>, key: JWK, options?: JWSSignOptions): Promise<string>;
 declare function sign(payload: JWTClaims, key: CryptoKey, options: JWSSignOptions & {
     alg: JWSAlgorithm;
 }): Promise<string>;
 declare function sign(payload: string | Uint8Array | Record<string, any>, key: CryptoKey, options: JWSSignOptions & {
     alg: JWSAlgorithm;
 }): Promise<string>;
+declare function sign(payload: JWTClaims, key: Uint8Array, options: JWSSignOptions & {
+    alg: JWSAlgorithm;
+}): Promise<string>;
+declare function sign(payload: string | Uint8Array | Record<string, any>, key: Uint8Array, options: JWSSignOptions & {
+    alg: JWSAlgorithm;
+}): Promise<string>;
 declare function sign(payload: string | Uint8Array | Record<string, any>, key: CryptoKey | JWK | Uint8Array, options: JWSSignOptions & {
     alg: JWSAlgorithm;
 }): Promise<string>;
-type KeyLookupFunction = (header: JWSProtectedHeader) => CryptoKey | JWK | Uint8Array | Promise<CryptoKey | JWK | Uint8Array>;
 /**
  * Verifies a JWS (JSON Web Signature) in Compact Serialization format.
  *
  * @param jws The JWS Compact Serialization string.
- * @param key The verification key (CryptoKey, JWK, raw symmetric key as Uint8Array, or a function resolving the key).
+ * @param key The verification key (CryptoKey, JWK, JWKSet, raw symmetric key as Uint8Array, or a function resolving the key or set).
  * @param options Verification options, such as allowed algorithms.
  * @returns A Promise resolving to an object containing the verified payload and protected header.
  * @throws If the JWS is invalid, signature verification fails, or options are not met.
  */
-declare function verify<T = JWTClaims | Uint8Array | string>(jws: string, key: CryptoKey | JWK | Uint8Array | KeyLookupFunction, options?: JWSVerifyOptions): Promise<JWSVerifyResult<T>>;
-declare function verify(jws: string, key: CryptoKey | JWK | Uint8Array | KeyLookupFunction, options: JWSVerifyOptions & {
+declare function verify<T extends JWTClaims | Uint8Array | string>(jws: string, key: CryptoKey | JWK | JWKSet | Uint8Array | JWSKeyLookupFunction, options?: JWSVerifyOptions): Promise<JWSVerifyResult<T>>;
+declare function verify(jws: string, key: CryptoKey | JWK | JWKSet | Uint8Array | JWSKeyLookupFunction, options: JWSVerifyOptions & {
     forceUint8Array: true;
 }): Promise<JWSVerifyResult<Uint8Array>>;
 
 type jws_JWSAlgorithm = JWSAlgorithm;
 type jws_JWSHeaderParameters = JWSHeaderParameters;
+type jws_JWSKeyLookupFunction = JWSKeyLookupFunction;
 type jws_JWSProtectedHeader = JWSProtectedHeader;
 type jws_JWSSignOptions = JWSSignOptions;
 type jws_JWSVerifyOptions = JWSVerifyOptions;
-type jws_JWSVerifyResult<T = JWTClaims | Uint8Array | string> = JWSVerifyResult<T>;
+type jws_JWSVerifyResult<T extends JWTClaims | Uint8Array | string = JWTClaims | Uint8Array | string> = JWSVerifyResult<T>;
 declare const jws_sign: typeof sign;
 declare const jws_verify: typeof verify;
 declare namespace jws {
   export { jws_sign as sign, jws_verify as verify };
-  export type { jws_JWSAlgorithm as JWSAlgorithm, jws_JWSHeaderParameters as JWSHeaderParameters, jws_JWSProtectedHeader as JWSProtectedHeader, jws_JWSSignOptions as JWSSignOptions, jws_JWSVerifyOptions as JWSVerifyOptions, jws_JWSVerifyResult as JWSVerifyResult };
+  export type { jws_JWSAlgorithm as JWSAlgorithm, jws_JWSHeaderParameters as JWSHeaderParameters, jws_JWSKeyLookupFunction as JWSKeyLookupFunction, jws_JWSProtectedHeader as JWSProtectedHeader, jws_JWSSignOptions as JWSSignOptions, jws_JWSVerifyOptions as JWSVerifyOptions, jws_JWSVerifyResult as JWSVerifyResult };
 }
 
 export { jws as j, sign as s, verify as v };
-export type { JWSAlgorithm as J, JWSHeaderParameters as a, JWSProtectedHeader as b, JWSSignOptions as c, JWSVerifyResult as d, JWSVerifyOptions as e };
+export type { JWSAlgorithm as J, JWSHeaderParameters as a, JWSProtectedHeader as b, JWSSignOptions as c, JWSVerifyResult as d, JWSVerifyOptions as e, JWSKeyLookupFunction as f };

package/dist/shared/{unjwt.DOI5UE8K.mjs → unjwt.X5vzu_l_.mjs}

@@ -57,6 +57,9 @@ function maybeArray(item) {
 function isJWK(key) {
   return typeof key === "object" && key !== null && "kty" in key && typeof key.kty === "string";
 }
+function isJWKSet(key) {
+  return key && typeof key === "object" && "keys" in key && Array.isArray(key.keys);
+}
 function assertCryptoKey(key) {
   if (!isCryptoKey(key)) {
     throw new Error("CryptoKey instance expected");
@@ -78,10 +81,11 @@ const index = {
   isCryptoKey: isCryptoKey,
   isCryptoKeyPair: isCryptoKeyPair,
   isJWK: isJWK,
+  isJWKSet: isJWKSet,
   maybeArray: maybeArray,
   randomBytes: randomBytes,
   textDecoder: textDecoder,
   textEncoder: textEncoder
 };
 
-export { isJWK as a, base64UrlEncode as b, textDecoder as c, base64UrlDecode as d, concatUint8Arrays as e, assertCryptoKey as f, isCryptoKey as g, base64Decode as h, index as i, base64Encode as j, isCryptoKeyPair as k, maybeArray as m, randomBytes as r, textEncoder as t };
+export { isJWK as a, base64UrlEncode as b, textDecoder as c, base64UrlDecode as d, isJWKSet as e, concatUint8Arrays as f, assertCryptoKey as g, isCryptoKey as h, index as i, base64Decode as j, base64Encode as k, isCryptoKeyPair as l, maybeArray as m, randomBytes as r, textEncoder as t };

package/dist/shared/{unjwt.BISJ5yt1.d.ts → unjwt.c10n3uM8.d.ts}

@@ -1,4 +1,4 @@
-import { i as JWK_RSA_Public } from './unjwt.CxhGjEAX.js';
+import { i as JWK_RSA_Public } from './unjwt.D9da8HQF.js';
 
 /** Header Parameters common to JWE and JWS */
 interface JoseHeaderParameters {

package/dist/utils.d.mts

@@ -1,2 +1,2 @@
-import './shared/unjwt.CxhGjEAX.mjs';
-export { h as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, f as concatUint8Arrays, j as isCryptoKey, k as isCryptoKeyPair, g as isJWK, m as maybeArray, r as randomBytes, a as textDecoder, t as textEncoder } from './shared/unjwt.BJEchXrM.mjs';
+import './shared/unjwt.D9da8HQF.mjs';
+export { j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, f as concatUint8Arrays, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, m as maybeArray, r as randomBytes, a as textDecoder, t as textEncoder } from './shared/unjwt.CbvzYE-m.mjs';

package/dist/utils.d.ts

@@ -1,2 +1,2 @@
-import './shared/unjwt.CxhGjEAX.js';
-export { h as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, f as concatUint8Arrays, j as isCryptoKey, k as isCryptoKeyPair, g as isJWK, m as maybeArray, r as randomBytes, a as textDecoder, t as textEncoder } from './shared/unjwt.B5N3dPN9.js';
+import './shared/unjwt.D9da8HQF.js';
+export { j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, f as concatUint8Arrays, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, m as maybeArray, r as randomBytes, a as textDecoder, t as textEncoder } from './shared/unjwt.D4DUiNeM.js';

package/dist/utils.mjs

@@ -1 +1 @@
-export { f as assertCryptoKey, h as base64Decode, j as base64Encode, d as base64UrlDecode, b as base64UrlEncode, e as concatUint8Arrays, g as isCryptoKey, k as isCryptoKeyPair, a as isJWK, m as maybeArray, r as randomBytes, c as textDecoder, t as textEncoder } from './shared/unjwt.DOI5UE8K.mjs';
+export { g as assertCryptoKey, j as base64Decode, k as base64Encode, d as base64UrlDecode, b as base64UrlEncode, f as concatUint8Arrays, h as isCryptoKey, l as isCryptoKeyPair, a as isJWK, e as isJWKSet, m as maybeArray, r as randomBytes, c as textDecoder, t as textEncoder } from './shared/unjwt.X5vzu_l_.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",
@@ -45,7 +45,8 @@
     "lint:fix": "automd && eslint . --fix && prettier -w .",
     "prepack": "pnpm build",
     "release": "pnpm test && pnpm prepack && changelogen --release --push --publish",
-    "test": "pnpm lint && pnpm test:types && vitest run --coverage --slowTestThreshold=500",
+    "test": "pnpm lint && pnpm test:types && vitest run --slowTestThreshold=500",
+    "test:coverage": "pnpm lint && pnpm test:types && vitest run --coverage --slowTestThreshold=500",
     "test:types": "tsc --noEmit --skipLibCheck"
   },
   "devDependencies": {