unjwt 0.5.22 → 0.5.23

package/dist/h3.d.mts

@@ -9,7 +9,7 @@ export { d as deriveJWKFromPassword, e as exportJWKToPEM, g as generateJWK, i as
 
 /**
  * This is a fork of h3 library's session utility functions.
- * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/test/session.test.ts
+ * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/src/utils/session.ts
  * @license MIT https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/LICENSE
  */
 
@@ -24,11 +24,11 @@ interface SessionJWE<T extends SessionDataT$1 = SessionDataT$1> {
     [kGetSessionPromise$1]?: Promise<SessionJWE<T>>;
 }
 interface SessionHooksJWE {
-    onRead?: (session: SessionJWE, event: H3Event) => void | Promise<void>;
-    onUpdate?: (session: SessionJWE, event: H3Event) => void | Promise<void>;
-    onClear?: (event: H3Event) => void | Promise<void>;
-    onExpire?: (event: H3Event, error: any | undefined) => void | Promise<void>;
-    onError?: (event: H3Event, error: any) => void | Promise<void>;
+    onRead?: (session: SessionJWE, event: H3Event, config: SessionConfigJWE) => void | Promise<void>;
+    onUpdate?: (session: SessionJWE, event: H3Event, config: SessionConfigJWE) => void | Promise<void>;
+    onClear?: (event: H3Event, config: Partial<SessionConfigJWE>) => void | Promise<void>;
+    onExpire?: (event: H3Event, error: any | undefined, config: SessionConfigJWE) => void | Promise<void>;
+    onError?: (event: H3Event, error: any, config: SessionConfigJWE) => void | Promise<void>;
 }
 interface SessionManager<T extends SessionDataT$1 = SessionDataT$1> {
     readonly id: string | undefined;
@@ -39,8 +39,13 @@ interface SessionManager<T extends SessionDataT$1 = SessionDataT$1> {
     clear: () => Promise<SessionManager<T>>;
 }
 interface SessionConfigJWE {
-    /** Shared secret used, string for PBES2 or Json Web Key (JWK) */
-    secret: string | JWK_Symmetric | {
+    /** @deprecated use `key` instead */
+    secret?: string | JWK_Symmetric | {
+        privateKey: JWK_Private | JWK_Symmetric;
+        publicKey?: JWK_Public;
+    };
+    /** Shared key used, string for PBES2 or Json Web Key (JWK) */
+    key: string | JWK_Symmetric | JWK_Private | {
         privateKey: JWK_Private | JWK_Symmetric;
         publicKey?: JWK_Public;
     };
@@ -52,8 +57,6 @@ interface SessionConfigJWE {
     cookie?: false | CookieSerializeOptions;
     /** Default is x-h3-session / x-{name}-session */
     sessionHeader?: false | string;
-    /** Optional WebCrypto implementation override */
-    crypto?: Crypto;
     /** Default is crypto.randomUUID */
     generateId?: () => string;
     /** JWE configuration overrides */
@@ -111,7 +114,7 @@ declare function clearJWESession(event: H3Event, config: Partial<SessionConfigJW
 
 /**
  * This is a fork of h3 library's session utility functions.
- * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/test/session.test.ts
+ * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/src/utils/session.ts
  * @license MIT https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/LICENSE
  */
 
@@ -125,11 +128,11 @@ interface SessionJWS<T extends SessionDataT = SessionDataT> {
     [kGetSessionPromise]?: Promise<SessionJWS<T>>;
 }
 interface SessionHooksJWS {
-    onRead?: (session: SessionJWS, event: H3Event) => void | Promise<void>;
-    onUpdate?: (session: SessionJWS, event: H3Event) => void | Promise<void>;
-    onClear?: (event: H3Event) => void | Promise<void>;
-    onExpire?: (event: H3Event, error: any | undefined) => void | Promise<void>;
-    onError?: (event: H3Event, error: any) => void | Promise<void>;
+    onRead?: (session: SessionJWS, event: H3Event, config: SessionConfigJWS) => void | Promise<void>;
+    onUpdate?: (session: SessionJWS, event: H3Event, config: SessionConfigJWS) => void | Promise<void>;
+    onClear?: (event: H3Event, config: Partial<SessionConfigJWS>) => void | Promise<void>;
+    onExpire?: (event: H3Event, error: any | undefined, config: SessionConfigJWS) => void | Promise<void>;
+    onError?: (event: H3Event, error: any, config: SessionConfigJWS) => void | Promise<void>;
 }
 interface SessionConfigJWS {
     /**
@@ -147,8 +150,6 @@ interface SessionConfigJWS {
     cookie?: false | CookieSerializeOptions;
     /** Custom header (false to disable header lookup) */
     sessionHeader?: false | string;
-    /** Provide a custom WebCrypto (if needed for algorithm operations) */
-    crypto?: Crypto;
     /** Custom ID generator (defaults to crypto.randomUUID) */
     generateId?: () => string;
     /** JWS customization */

package/dist/h3.mjs

@@ -1,13 +1,13 @@
-export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from './shared/unjwt.Vg02PZWw.mjs';
+export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from './shared/unjwt.epPK1KFr.mjs';
 import { isEvent, setCookie } from 'h3';
 import { parse } from 'cookie-es';
-import { e as encrypt, d as decrypt } from './shared/unjwt.CXl9FD-V.mjs';
-import { p as isSymmetricJWK, q as isPrivateJWK, u as isAsymmetricJWK } from './shared/unjwt.DCiTNyCM.mjs';
-import { s as sign, v as verify } from './shared/unjwt.DmRAjMp8.mjs';
+import { e as encrypt, d as decrypt } from './shared/unjwt.CiBEuvtQ.mjs';
+import { p as isSymmetricJWK, q as isPrivateJWK, u as isPublicJWK } from './shared/unjwt.C86hA0o-.mjs';
+import { s as sign, v as verify } from './shared/unjwt.D-FATaw1.mjs';
 
 /**
  * This is a fork of h3 library's session utility functions.
- * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/test/session.test.ts
+ * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/src/utils/session.ts
  * @license MIT https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/LICENSE
  */
 const kGetSessionPromise$1 = Symbol("h3_jwe_getSession");
@@ -57,22 +57,15 @@ async function getJWESession(event, config) {
   }
   const existingSession = event.context.sessions[sessionName];
   if (existingSession) {
-    if (existingSession.expiresAt === void 0) {
-      const session2 = existingSession[kGetSessionPromise$1] || existingSession;
-      await config.hooks?.onRead?.(await session2, event);
-      return session2;
-    } else {
-      if (existingSession.expiresAt < Date.now() && isEvent(event)) {
-        await config.hooks?.onExpire?.(event, void 0);
-        return clearJWESession(event, config).then(
-          () => getJWESession(event, config)
-        );
-      } else {
-        const session2 = existingSession[kGetSessionPromise$1] || existingSession;
-        await config.hooks?.onRead?.(await session2, event);
-        return session2;
-      }
+    const session2 = existingSession[kGetSessionPromise$1] ? await existingSession[kGetSessionPromise$1] : existingSession;
+    if (session2.expiresAt !== void 0 && session2.expiresAt < Date.now() && isEvent(event)) {
+      await config.hooks?.onExpire?.(event, void 0, config);
+      return clearJWESession(event, config).then(
+        () => getJWESession(event, config)
+      );
     }
+    await config.hooks?.onRead?.(session2, event, config);
+    return session2;
   }
   const session = {
     id: "",
@@ -97,14 +90,11 @@ async function getJWESession(event, config) {
   }
   if (jweToken) {
     const promise = unsealJWESession(event, config, jweToken).catch(async (error_) => {
-      if (error_ instanceof Error) {
-        const message = error_.message;
-        if (message.includes("Token has expired") || message.includes("Token is too old")) {
-          await config.hooks?.onExpire?.(event, error_);
-          return void 0;
-        }
+      if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
+        await config.hooks?.onExpire?.(event, error_, config);
+        return void 0;
       }
-      await config.hooks?.onError?.(event, error_);
+      await config.hooks?.onError?.(event, error_, config);
       return void 0;
     }).then((unsealed) => {
       if (unsealed) {
@@ -122,13 +112,12 @@ async function getJWESession(event, config) {
         "Cannot initialize a new session. Use `useSession(event)` within the main handler."
       );
     }
-    session.id = config.generateId?.() ?? (config.crypto || crypto).randomUUID();
-    session.createdAt = config.jwe?.encryptOptions?.currentDate === void 0 ? Date.now() : config.jwe.encryptOptions.currentDate.getTime();
+    session.id = config.generateId?.() ?? crypto.randomUUID();
+    session.createdAt = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
     session.expiresAt = config.maxAge ? session.createdAt + config.maxAge * 1e3 : void 0;
-    session.data = /* @__PURE__ */ Object.create(null);
     await updateJWESession(event, config);
   }
-  await config.hooks?.onRead?.(session, event);
+  await config.hooks?.onRead?.(session, event, config);
   return session;
 }
 function _getReqHeader$1(event, name) {
@@ -150,7 +139,7 @@ async function updateJWESession(event, config, update) {
   }
   if (update) {
     Object.assign(session.data, update);
-    await config.hooks?.onUpdate?.(session, event);
+    await config.hooks?.onUpdate?.(session, event, config);
   }
   if (config.cookie !== false) {
     const sealed = await sealJWESession(event, config);
@@ -166,12 +155,7 @@ async function updateJWESession(event, config, update) {
   return session;
 }
 async function sealJWESession(event, config) {
-  const key = getEncryptKey(config.secret);
-  if (typeof key !== "string" && !isSymmetricJWK(key) && !isPrivateJWK(key)) {
-    throw new Error(
-      "Session: JWE secret must be a password string or a private JWK."
-    );
-  }
+  const key = getEncryptKey(config.key || config.secret);
   const sessionName = config.name || DEFAULT_NAME$1;
   const session = event.context.sessions?.[sessionName] || await getJWESession(event, config);
   const iatSeconds = Math.floor(session.createdAt / 1e3);
@@ -184,25 +168,30 @@ async function sealJWESession(event, config) {
   if (expSeconds) {
     payload.exp = expSeconds;
   }
+  let typ = void 0;
+  if (config.jwe?.encryptOptions?.protectedHeader?.typ && typeof config.jwe.encryptOptions.protectedHeader.typ === "string" && config.jwe.encryptOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
+    typ = config.jwe.encryptOptions.protectedHeader.typ;
+  }
   const token = await encrypt(payload, key, {
     ...config.jwe?.encryptOptions,
+    expiresIn: void 0,
+    // controlled via 'exp' claim
     protectedHeader: {
       ...config.jwe?.encryptOptions?.protectedHeader,
-      typ: "JWT",
+      kid: typeof key === "string" ? void 0 : key.kid,
+      typ: typ || "JWT",
       cty: "application/json"
     }
   });
   return token;
 }
 async function unsealJWESession(_event, config, sealed) {
-  const key = getDecryptKey(config.secret);
-  if (typeof key !== "string" && !isSymmetricJWK(key) && !isPrivateJWK(key)) {
-    throw new Error(
-      "Session: JWE secret must be a password string or a private JWK."
-    );
-  }
+  const key = getDecryptKey(config.key || config.secret);
   const alg = config.jwe?.encryptOptions?.alg;
   const enc = config.jwe?.encryptOptions?.enc;
+  if (config.jwe?.encryptOptions?.protectedHeader?.typ && typeof config.jwe.encryptOptions.protectedHeader.typ === "string" && config.jwe.encryptOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
+    config.jwe.encryptOptions.protectedHeader.typ;
+  }
   const { payload } = await decrypt(sealed, key, {
     ...config.jwe?.decryptOptions,
     requiredClaims: [
@@ -243,32 +232,57 @@ async function clearJWESession(event, config) {
   setCookie(event, sessionName, "", {
     ...DEFAULT_COOKIE$1,
     ...config.cookie,
-    // Optionally set expires in the past
     expires: /* @__PURE__ */ new Date(0),
     maxAge: void 0
   });
-  await config.hooks?.onClear?.(event);
+  await config.hooks?.onClear?.(event, config);
 }
-function getEncryptKey(secret) {
-  if (typeof secret === "string") {
-    return secret;
-  } else if (isSymmetricJWK(secret)) {
-    return secret;
+function getEncryptKey(key) {
+  if (!key) {
+    throw new Error("Session: JWE key is required.");
+  }
+  let _key;
+  if (typeof key === "string") {
+    _key = key;
+  } else if (isSymmetricJWK(key) || isPrivateJWK(key)) {
+    _key = key;
+  } else if ("publicKey" in key && isPublicJWK(key.publicKey)) {
+    _key = key.publicKey;
+  } else if ("privateKey" in key && isPrivateJWK(key.privateKey)) {
+    _key = key.privateKey;
+  }
+  if (!_key) {
+    throw new Error(
+      "Session: Invalid JWE key. It must be a password string or valid JWK.",
+      { cause: key }
+    );
   }
-  return secret.publicKey || secret.privateKey;
+  return _key;
 }
-function getDecryptKey(secret) {
-  if (typeof secret === "string") {
-    return secret;
-  } else if ("privateKey" in secret) {
-    return secret.privateKey;
+function getDecryptKey(key) {
+  if (!key) {
+    throw new Error("Session: JWE key is required.");
+  }
+  let _key = void 0;
+  if (typeof key === "string") {
+    _key = key;
+  } else if (isSymmetricJWK(key)) {
+    _key = key;
+  } else if ("privateKey" in key) {
+    _key = key.privateKey;
+  }
+  if (!_key) {
+    throw new Error(
+      "Session: Invalid JWE key. It must be a password string or a valid private JWK.",
+      { cause: key }
+    );
   }
-  return secret;
+  return _key;
 }
 
 /**
  * This is a fork of h3 library's session utility functions.
- * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/test/session.test.ts
+ * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/src/utils/session.ts
  * @license MIT https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/LICENSE
  */
 const kGetSessionPromise = Symbol("h3_jws_getSession");
@@ -318,22 +332,15 @@ async function getJWSSession(event, config) {
   }
   const existingSession = event.context.sessions[sessionName];
   if (existingSession) {
-    if (existingSession.expiresAt === void 0) {
-      const session2 = existingSession[kGetSessionPromise] || existingSession;
-      await config.hooks?.onRead?.(await session2, event);
-      return session2;
-    } else {
-      if (existingSession.expiresAt < Date.now() && isEvent(event)) {
-        await config.hooks?.onExpire?.(event, void 0);
-        return clearJWSSession(event, config).then(
-          () => getJWSSession(event, config)
-        );
-      } else {
-        const session2 = existingSession[kGetSessionPromise] || existingSession;
-        await config.hooks?.onRead?.(await session2, event);
-        return session2;
-      }
+    const session2 = existingSession[kGetSessionPromise] ? await existingSession[kGetSessionPromise] : existingSession;
+    if (session2.expiresAt !== void 0 && session2.expiresAt < Date.now() && isEvent(event)) {
+      await config.hooks?.onExpire?.(event, void 0, config);
+      return clearJWSSession(event, config).then(
+        () => getJWSSession(event, config)
+      );
     }
+    await config.hooks?.onRead?.(session2, event, config);
+    return session2;
   }
   const session = {
     id: "",
@@ -358,14 +365,11 @@ async function getJWSSession(event, config) {
   }
   if (token) {
     const promise = verifyJWSSession(event, config, token).catch(async (error_) => {
-      if (error_ instanceof Error) {
-        const message = error_.message;
-        if (message.includes("Token has expired") || message.includes("Token is too old")) {
-          await config.hooks?.onExpire?.(event, error_);
-          return void 0;
-        }
+      if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
+        await config.hooks?.onExpire?.(event, error_, config);
+        return void 0;
       }
-      await config.hooks?.onError?.(event, error_);
+      await config.hooks?.onError?.(event, error_, config);
       return void 0;
     }).then((unsealed) => {
       if (unsealed) {
@@ -383,13 +387,12 @@ async function getJWSSession(event, config) {
         "Cannot initialize a new session outside main handler. Use `useJWSSession(event)` properly."
       );
     }
-    session.id = config.generateId?.() ?? (config.crypto || globalThis.crypto).randomUUID();
-    session.createdAt = config.jws?.signOptions?.currentDate === void 0 ? Date.now() : config.jws.signOptions.currentDate.getTime();
+    session.id = config.generateId?.() ?? crypto.randomUUID();
+    session.createdAt = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
     session.expiresAt = config.maxAge ? session.createdAt + config.maxAge * 1e3 : void 0;
-    session.data = /* @__PURE__ */ Object.create(null);
     await updateJWSSession(event, config);
   }
-  await config.hooks?.onRead?.(session, event);
+  await config.hooks?.onRead?.(session, event, config);
   return session;
 }
 function _getReqHeader(event, name) {
@@ -411,7 +414,7 @@ async function updateJWSSession(event, config, update) {
   }
   if (update) {
     Object.assign(session.data, update);
-    await config.hooks?.onUpdate?.(session, event);
+    await config.hooks?.onUpdate?.(session, event, config);
   }
   if (config.cookie !== false) {
     const token = await signJWSSession(event, config);
@@ -425,9 +428,6 @@ async function updateJWSSession(event, config, update) {
 }
 async function signJWSSession(event, config) {
   const key = getSignKey(config.key);
-  if (isAsymmetricJWK(key) && !isPrivateJWK(key)) {
-    throw new Error("Session: JWS key cannot be a public asymmetric JWK.");
-  }
   const sessionName = config.name || DEFAULT_NAME;
   const session = event.context.sessions?.[sessionName] || await getJWSSession(event, config);
   const iatSeconds = Math.floor(session.createdAt / 1e3);
@@ -440,11 +440,19 @@ async function signJWSSession(event, config) {
   if (expSeconds) {
     payload.exp = expSeconds;
   }
+  let typ = void 0;
+  if (config.jws?.signOptions?.protectedHeader?.typ && typeof config.jws.signOptions.protectedHeader.typ === "string" && config.jws.signOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
+    typ = config.jws.signOptions.protectedHeader.typ;
+  }
   const token = await sign(payload, key, {
     ...config.jws?.signOptions,
+    expiresIn: void 0,
+    // controlled via 'exp' claim
     protectedHeader: {
       ...config.jws?.signOptions?.protectedHeader,
-      typ: "JWT"
+      kid: key.kid,
+      typ: typ || "JWT",
+      cty: "application/json"
     }
   });
   return token;
@@ -452,8 +460,9 @@ async function signJWSSession(event, config) {
 async function verifyJWSSession(_event, config, token) {
   const alg = config.jws?.signOptions?.alg;
   const jwk = getVerifyKey(config.key);
-  if (isAsymmetricJWK(jwk) && isPrivateJWK(jwk)) {
-    throw new Error("Session: JWS key cannot be a private asymmetric JWK.");
+  let typ = void 0;
+  if (config.jws?.signOptions?.protectedHeader?.typ && typeof config.jws.signOptions.protectedHeader.typ === "string" && config.jws.signOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
+    typ = config.jws.signOptions.protectedHeader.typ;
   }
   const { payload } = await verify(token, jwk, {
     ...config.jws?.verifyOptions,
@@ -464,7 +473,7 @@ async function verifyJWSSession(_event, config, token) {
       "jti",
       "iat"
     ],
-    typ: "JWT",
+    typ: typ || "JWT",
     algorithms: alg ? [alg] : void 0,
     forceUint8Array: false,
     validateJWT: true
@@ -492,19 +501,48 @@ async function clearJWSSession(event, config) {
     expires: /* @__PURE__ */ new Date(0),
     maxAge: void 0
   });
-  await config.hooks?.onClear?.(event);
+  await config.hooks?.onClear?.(event, config);
 }
 function getSignKey(key) {
-  if ("privateKey" in key) {
-    return key.privateKey;
+  if (!key) {
+    throw new Error("Session: JWS key is required.");
+  }
+  let _key = void 0;
+  if (isSymmetricJWK(key)) {
+    _key = key;
+  } else if ("privateKey" in key && isPrivateJWK(key.privateKey)) {
+    _key = key.privateKey;
   }
-  return key;
+  if (!_key) {
+    throw new Error(
+      "Session: Invalid JWS key. It must be a symmetric JWK or a private JWK.",
+      { cause: key }
+    );
+  }
+  return _key;
 }
 function getVerifyKey(key) {
-  if ("publicKey" in key) {
-    return Array.isArray(key.publicKey) ? { keys: key.publicKey } : key.publicKey;
+  if (!key) {
+    throw new Error("Session: JWS key is required.");
+  }
+  let _key = void 0;
+  if (isSymmetricJWK(key)) {
+    _key = key;
+  } else if ("publicKey" in key && isPublicJWK(key.publicKey)) {
+    _key = key.publicKey;
+  } else if ("publicKey" in key && Array.isArray(key.publicKey)) {
+    const keys = key.publicKey.filter((k) => isPublicJWK(k));
+    if (keys && keys.length > 0) {
+      _key = { keys };
+    }
+  }
+  if (!_key) {
+    throw new Error(
+      "Session: Invalid JWS key. It must be a symmetric JWK or a public JWK/set.",
+      { cause: key }
+    );
   }
-  return key;
+  return _key;
 }
 
 export { clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-export { i as utils } from './shared/unjwt.DCiTNyCM.mjs';
-export { j as jwe } from './shared/unjwt.CXl9FD-V.mjs';
-export { j as jwk } from './shared/unjwt.Vg02PZWw.mjs';
-export { j as jws } from './shared/unjwt.DmRAjMp8.mjs';
+export { i as utils } from './shared/unjwt.C86hA0o-.mjs';
+export { j as jwe } from './shared/unjwt.CiBEuvtQ.mjs';
+export { j as jwk } from './shared/unjwt.epPK1KFr.mjs';
+export { j as jws } from './shared/unjwt.D-FATaw1.mjs';

package/dist/jwe.mjs

@@ -1,3 +1,3 @@
-import './shared/unjwt.Vg02PZWw.mjs';
-import './shared/unjwt.DCiTNyCM.mjs';
-export { d as decrypt, e as encrypt } from './shared/unjwt.CXl9FD-V.mjs';
+import './shared/unjwt.epPK1KFr.mjs';
+import './shared/unjwt.C86hA0o-.mjs';
+export { d as decrypt, e as encrypt } from './shared/unjwt.CiBEuvtQ.mjs';

package/dist/jwk.mjs

@@ -1,2 +1,2 @@
-import './shared/unjwt.DCiTNyCM.mjs';
-export { k as deriveJWKFromPassword, m as deriveKeyFromPassword, h as exportJWKToPEM, n as exportKey, c as generateJWK, l as generateKey, b as getJWKFromSet, f as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.Vg02PZWw.mjs';
+import './shared/unjwt.C86hA0o-.mjs';
+export { k as deriveJWKFromPassword, m as deriveKeyFromPassword, h as exportJWKToPEM, n as exportKey, c as generateJWK, l as generateKey, b as getJWKFromSet, f as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.epPK1KFr.mjs';

package/dist/jws.mjs

@@ -1,3 +1,3 @@
-import './shared/unjwt.Vg02PZWw.mjs';
-import './shared/unjwt.DCiTNyCM.mjs';
-export { s as sign, v as verify } from './shared/unjwt.DmRAjMp8.mjs';
+import './shared/unjwt.epPK1KFr.mjs';
+import './shared/unjwt.C86hA0o-.mjs';
+export { s as sign, v as verify } from './shared/unjwt.D-FATaw1.mjs';

package/dist/shared/{unjwt.DCiTNyCM.mjs → unjwt.C86hA0o-.mjs}

@@ -435,4 +435,4 @@ const index = {
   validateJwtClaims: validateJwtClaims
 };
 
-export { maybeArray as A, isPublicJWK as B, isJWTContent as C, decodeMaybeJWTString as D, computeExpiresInSeconds as E, computeMaxTokenAgeSeconds as F, isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, base64UrlDecode as e, decodePayloadFromBytes as f, getPlaintextBytes as g, validateJwtClaims as h, index as i, isCryptoKeyPair as j, isCryptoKey as k, textDecoder as l, isJWKSet as m, decodePayloadFromB64UrlSegment as n, validateCriticalHeadersJWS as o, isSymmetricJWK as p, isPrivateJWK as q, randomBytes as r, sanitizeObject as s, textEncoder as t, isAsymmetricJWK as u, validateCriticalHeadersJWE as v, concatUint8Arrays as w, base64Decode as x, base64Encode as y, assertCryptoKey as z };
+export { isAsymmetricJWK as A, maybeArray as B, isJWTContent as C, decodeMaybeJWTString as D, computeExpiresInSeconds as E, computeMaxTokenAgeSeconds as F, isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, base64UrlDecode as e, decodePayloadFromBytes as f, getPlaintextBytes as g, validateJwtClaims as h, index as i, isCryptoKeyPair as j, isCryptoKey as k, textDecoder as l, isJWKSet as m, decodePayloadFromB64UrlSegment as n, validateCriticalHeadersJWS as o, isSymmetricJWK as p, isPrivateJWK as q, randomBytes as r, sanitizeObject as s, textEncoder as t, isPublicJWK as u, validateCriticalHeadersJWE as v, concatUint8Arrays as w, base64Decode as x, base64Encode as y, assertCryptoKey as z };

package/dist/shared/{unjwt.CXl9FD-V.mjs → unjwt.CiBEuvtQ.mjs}

@@ -1,5 +1,5 @@
-import { i as importKey, e as encryptKey, g as generateIV, a as encrypt$1, u as unwrapKey, d as decrypt$1 } from './unjwt.Vg02PZWw.mjs';
-import { r as randomBytes, a as isJWK, s as sanitizeObject, b as applyTypCtyDefaults, c as computeJwtTimeClaims, g as getPlaintextBytes, d as base64UrlEncode, t as textEncoder, e as base64UrlDecode, f as decodePayloadFromBytes, v as validateCriticalHeadersJWE, h as validateJwtClaims, j as isCryptoKeyPair, k as isCryptoKey } from './unjwt.DCiTNyCM.mjs';
+import { i as importKey, e as encryptKey, g as generateIV, a as encrypt$1, u as unwrapKey, d as decrypt$1 } from './unjwt.epPK1KFr.mjs';
+import { r as randomBytes, a as isJWK, s as sanitizeObject, b as applyTypCtyDefaults, c as computeJwtTimeClaims, g as getPlaintextBytes, d as base64UrlEncode, t as textEncoder, e as base64UrlDecode, f as decodePayloadFromBytes, v as validateCriticalHeadersJWE, h as validateJwtClaims, j as isCryptoKeyPair, k as isCryptoKey } from './unjwt.C86hA0o-.mjs';
 
 async function encrypt(payload, key, options = {}) {
   const {

package/dist/shared/{unjwt.DmRAjMp8.mjs → unjwt.D-FATaw1.mjs}

@@ -1,5 +1,5 @@
-import { i as importKey, s as sign$1, b as getJWKFromSet, v as verify$1 } from './unjwt.Vg02PZWw.mjs';
-import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, l as textDecoder, e as base64UrlDecode, m as isJWKSet, n as decodePayloadFromB64UrlSegment, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './unjwt.DCiTNyCM.mjs';
+import { i as importKey, s as sign$1, b as getJWKFromSet, v as verify$1 } from './unjwt.epPK1KFr.mjs';
+import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, l as textDecoder, e as base64UrlDecode, m as isJWKSet, n as decodePayloadFromB64UrlSegment, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './unjwt.C86hA0o-.mjs';
 
 async function sign(payload, key, options = {}) {
   const { protectedHeader: additionalProtectedHeader } = options;

package/dist/shared/{unjwt.Vg02PZWw.mjs → unjwt.epPK1KFr.mjs}

@@ -1,4 +1,4 @@
-import { k as isCryptoKey, w as concatUint8Arrays, d as base64UrlEncode, x as base64Decode, y as base64Encode, t as textEncoder, s as sanitizeObject, z as assertCryptoKey, a as isJWK, e as base64UrlDecode, u as isAsymmetricJWK, r as randomBytes, m as isJWKSet } from './unjwt.DCiTNyCM.mjs';
+import { k as isCryptoKey, w as concatUint8Arrays, d as base64UrlEncode, x as base64Decode, y as base64Encode, t as textEncoder, s as sanitizeObject, z as assertCryptoKey, a as isJWK, e as base64UrlDecode, A as isAsymmetricJWK, r as randomBytes, m as isJWKSet } from './unjwt.C86hA0o-.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -1482,7 +1482,10 @@ async function generateJWK(alg, jwkParams, options = {}) {
   } = options;
   return generateKey(alg, {
     ...opts,
-    toJWK: jwkParams || true
+    toJWK: {
+      kid: typeof jwkParams?.kid === "string" ? jwkParams.kid : crypto.randomUUID(),
+      ...jwkParams
+    }
   });
 }
 async function deriveKeyFromPassword(password, alg, options) {

package/dist/utils.mjs

@@ -1 +1 @@
-export { b as applyTypCtyDefaults, z as assertCryptoKey, x as base64Decode, y as base64Encode, e as base64UrlDecode, d as base64UrlEncode, E as computeExpiresInSeconds, c as computeJwtTimeClaims, F as computeMaxTokenAgeSeconds, w as concatUint8Arrays, D as decodeMaybeJWTString, n as decodePayloadFromB64UrlSegment, f as decodePayloadFromBytes, g as getPlaintextBytes, u as isAsymmetricJWK, k as isCryptoKey, j as isCryptoKeyPair, a as isJWK, m as isJWKSet, C as isJWTContent, q as isPrivateJWK, B as isPublicJWK, p as isSymmetricJWK, A as maybeArray, r as randomBytes, s as sanitizeObject, l as textDecoder, t as textEncoder, v as validateCriticalHeadersJWE, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './shared/unjwt.DCiTNyCM.mjs';
+export { b as applyTypCtyDefaults, z as assertCryptoKey, x as base64Decode, y as base64Encode, e as base64UrlDecode, d as base64UrlEncode, E as computeExpiresInSeconds, c as computeJwtTimeClaims, F as computeMaxTokenAgeSeconds, w as concatUint8Arrays, D as decodeMaybeJWTString, n as decodePayloadFromB64UrlSegment, f as decodePayloadFromBytes, g as getPlaintextBytes, A as isAsymmetricJWK, k as isCryptoKey, j as isCryptoKeyPair, a as isJWK, m as isJWKSet, C as isJWTContent, q as isPrivateJWK, u as isPublicJWK, p as isSymmetricJWK, B as maybeArray, r as randomBytes, s as sanitizeObject, l as textDecoder, t as textEncoder, v as validateCriticalHeadersJWE, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './shared/unjwt.C86hA0o-.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.22",
+  "version": "0.5.23",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",
@@ -44,7 +44,7 @@
   ],
   "scripts": {
     "build": "unbuild",
-    "dev": "vitest dev",
+    "dev": "bun --watch ./playground/main.ts",
     "lint": "eslint . && prettier -c .",
     "lint:fix": "automd && eslint . --fix && prettier -w .",
     "prepack": "pnpm build",