unjwt 0.5.22 → 0.5.24

package/dist/adapters/h3v2.mjs

@@ -0,0 +1,618 @@
+export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from '../shared/unjwt.epPK1KFr.mjs';
+import { getEventContext } from 'h3';
+import { serialize, parseSetCookie, parse } from 'cookie-es';
+import { NullProtoObj } from 'rou3';
+import { e as encrypt, d as decrypt } from '../shared/unjwt.CiBEuvtQ.mjs';
+import { p as isSymmetricJWK, q as isPrivateJWK, u as isPublicJWK } from '../shared/unjwt.C86hA0o-.mjs';
+import { s as sign, v as verify } from '../shared/unjwt.D-FATaw1.mjs';
+
+const CHUNKED_COOKIE = "__chunked__";
+const CHUNKS_MAX_LENGTH = 4e3;
+function parseCookies(event) {
+  return parse(event.req.headers.get("cookie") || "");
+}
+function getCookie(event, name) {
+  return parseCookies(event)[name];
+}
+function setCookie(event, name, value, options) {
+  const newCookie = serialize(name, value, { path: "/", ...options });
+  const currentCookies = event.res.headers.getSetCookie();
+  if (currentCookies.length === 0) {
+    event.res.headers.set("set-cookie", newCookie);
+    return;
+  }
+  const newCookieKey = _getDistinctCookieKey(
+    name,
+    options || {}
+  );
+  event.res.headers.delete("set-cookie");
+  for (const cookie of currentCookies) {
+    const _key = _getDistinctCookieKey(
+      cookie.split("=")[0],
+      parseSetCookie(cookie)
+    );
+    if (_key === newCookieKey) {
+      continue;
+    }
+    event.res.headers.append("set-cookie", cookie);
+  }
+  event.res.headers.append("set-cookie", newCookie);
+}
+function deleteCookie(event, name, serializeOptions) {
+  setCookie(event, name, "", {
+    ...serializeOptions,
+    maxAge: 0
+  });
+}
+function getChunkedCookie(event, name) {
+  const mainCookie = getCookie(event, name);
+  if (!mainCookie || !mainCookie.startsWith(CHUNKED_COOKIE)) {
+    return mainCookie;
+  }
+  const chunksCount = getChunkedCookieCount(mainCookie);
+  if (chunksCount === 0) {
+    return void 0;
+  }
+  const chunks = [];
+  for (let i = 1; i <= chunksCount; i++) {
+    const chunk = getCookie(event, chunkCookieName(name, i));
+    if (!chunk) {
+      return void 0;
+    }
+    chunks.push(chunk);
+  }
+  return chunks.join("");
+}
+function setChunkedCookie(event, name, value, options) {
+  const chunkMaxLength = options?.chunkMaxLength || CHUNKS_MAX_LENGTH;
+  const chunkCount = Math.ceil(value.length / chunkMaxLength);
+  const previousCookie = getCookie(event, name);
+  if (previousCookie?.startsWith(CHUNKED_COOKIE)) {
+    const previousChunkCount = getChunkedCookieCount(previousCookie);
+    if (previousChunkCount > chunkCount) {
+      for (let i = chunkCount; i <= previousChunkCount; i++) {
+        deleteCookie(event, chunkCookieName(name, i), options);
+      }
+    }
+  }
+  if (chunkCount <= 1) {
+    setCookie(event, name, value, options);
+    return;
+  }
+  const mainCookieValue = `${CHUNKED_COOKIE}${chunkCount}`;
+  setCookie(event, name, mainCookieValue, options);
+  for (let i = 1; i <= chunkCount; i++) {
+    const start = (i - 1) * chunkMaxLength;
+    const end = start + chunkMaxLength;
+    const chunkValue = value.slice(start, end);
+    setCookie(event, chunkCookieName(name, i), chunkValue, options);
+  }
+}
+function _getDistinctCookieKey(name, options) {
+  return [name, options.domain || "", options.path || "/"].join(";");
+}
+function getChunkedCookieCount(cookie) {
+  if (!cookie?.startsWith(CHUNKED_COOKIE)) {
+    return Number.NaN;
+  }
+  return Number.parseInt(cookie.slice(CHUNKED_COOKIE.length));
+}
+function chunkCookieName(name, chunkNumber) {
+  return `${name}.${chunkNumber}`;
+}
+
+const kGetSessionPromise$1 = Symbol("h3_jwe_getSession");
+const DEFAULT_NAME$1 = "h3-jwe";
+const DEFAULT_COOKIE$1 = {
+  path: "/",
+  secure: true,
+  httpOnly: true
+};
+async function useJWESession(event, config) {
+  const sessionName = config.name || DEFAULT_NAME$1;
+  await getJWESession(event, config);
+  const sessionManager = {
+    get id() {
+      return getSessionFromContext$1(event, sessionName)?.id;
+    },
+    get createdAt() {
+      return getSessionFromContext$1(event, sessionName)?.createdAt ?? Date.now();
+    },
+    get expiresAt() {
+      return getSessionFromContext$1(event, sessionName)?.expiresAt;
+    },
+    get data() {
+      return getSessionFromContext$1(event, sessionName)?.data || {};
+    },
+    update: async (update) => {
+      await updateJWESession(event, config, update);
+      return sessionManager;
+    },
+    clear: async () => {
+      await clearJWESession(event, config);
+      return sessionManager;
+    }
+  };
+  return sessionManager;
+}
+async function getJWESession(event, config) {
+  const sessionName = config.name || DEFAULT_NAME$1;
+  const context = getEventContext(event);
+  if (!context.sessions) {
+    context.sessions = new NullProtoObj();
+  }
+  const existingSession = context.sessions[sessionName];
+  if (existingSession) {
+    const session2 = existingSession[kGetSessionPromise$1] ? await existingSession[kGetSessionPromise$1] : existingSession;
+    if (session2.expiresAt !== void 0 && session2.expiresAt < Date.now() && hasWritableResponse$1(event)) {
+      await config.hooks?.onExpire?.(event, void 0, config);
+      return clearJWESession(event, config).then(
+        () => getJWESession(event, config)
+      );
+    }
+    await config.hooks?.onRead?.(session2, event, config);
+    return session2;
+  }
+  const session = {
+    id: "",
+    createdAt: 0,
+    expiresAt: void 0,
+    data: new NullProtoObj()
+  };
+  context.sessions[sessionName] = session;
+  let jweToken;
+  if (config.sessionHeader !== false) {
+    const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
+    const headerValue = event.req.headers.get(headerName);
+    if (typeof headerValue === "string") {
+      jweToken = headerValue;
+    }
+  }
+  if (!jweToken) {
+    jweToken = getChunkedCookie(event, sessionName);
+  }
+  if (jweToken) {
+    const promise = unsealJWESession(event, config, jweToken).catch(async (error_) => {
+      if (error_ instanceof Error) {
+        const message = error_.message;
+        if (message.includes("Token has expired") || message.includes("Token is too old")) {
+          await config.hooks?.onExpire?.(event, error_, config);
+          return void 0;
+        }
+      }
+      await config.hooks?.onError?.(event, error_, config);
+      return void 0;
+    }).then((unsealed) => {
+      if (unsealed) {
+        Object.assign(session, unsealed);
+      }
+      delete session[kGetSessionPromise$1];
+      return session;
+    });
+    session[kGetSessionPromise$1] = promise;
+    await promise;
+  }
+  if (!session.id) {
+    session.id = config.generateId?.() ?? crypto.randomUUID();
+    session.createdAt = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
+    session.expiresAt = config.maxAge ? session.createdAt + config.maxAge * 1e3 : void 0;
+    await updateJWESession(event, config);
+  }
+  await config.hooks?.onRead?.(session, event, config);
+  return session;
+}
+async function updateJWESession(event, config, update) {
+  const sessionName = config.name || DEFAULT_NAME$1;
+  const context = getEventContext(event);
+  const session = context.sessions?.[sessionName] || await getJWESession(event, config);
+  if (typeof update === "function") {
+    update = update(session.data);
+  }
+  if (update) {
+    Object.assign(session.data, update);
+    await config.hooks?.onUpdate?.(session, event, config);
+  }
+  if (config.cookie !== false && hasWritableResponse$1(event)) {
+    const sealed = await sealJWESession(event, config);
+    setChunkedCookie(event, sessionName, sealed, {
+      ...DEFAULT_COOKIE$1,
+      expires: config.maxAge ? new Date(session.createdAt + config.maxAge * 1e3) : void 0,
+      ...config.cookie
+    });
+  }
+  return session;
+}
+async function sealJWESession(event, config) {
+  const key = getEncryptKey(config.key);
+  const sessionName = config.name || DEFAULT_NAME$1;
+  const context = getEventContext(event);
+  const session = context.sessions?.[sessionName] || await getJWESession(event, config);
+  const iatSeconds = Math.floor(session.createdAt / 1e3);
+  const expSeconds = config.maxAge == null ? void 0 : iatSeconds + config.maxAge;
+  const payload = {
+    ...session.data,
+    jti: session.id,
+    iat: iatSeconds
+  };
+  if (expSeconds) {
+    payload.exp = expSeconds;
+  }
+  let typ = void 0;
+  if (config.jwe?.encryptOptions?.protectedHeader?.typ && typeof config.jwe.encryptOptions.protectedHeader.typ === "string" && config.jwe.encryptOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
+    typ = config.jwe.encryptOptions.protectedHeader.typ;
+  }
+  const token = await encrypt(payload, key, {
+    ...config.jwe?.encryptOptions,
+    expiresIn: void 0,
+    // controlled via 'exp' claim
+    protectedHeader: {
+      ...config.jwe?.encryptOptions?.protectedHeader,
+      typ: typ || "JWT",
+      cty: "application/json"
+    }
+  });
+  return token;
+}
+async function unsealJWESession(_event, config, sealed) {
+  const key = getDecryptKey(config.key);
+  const alg = config.jwe?.encryptOptions?.alg;
+  const enc = config.jwe?.encryptOptions?.enc;
+  if (config.jwe?.encryptOptions?.protectedHeader?.typ && typeof config.jwe.encryptOptions.protectedHeader.typ === "string" && config.jwe.encryptOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
+    config.jwe.encryptOptions.protectedHeader.typ;
+  }
+  const { payload } = await decrypt(sealed, key, {
+    ...config.jwe?.decryptOptions,
+    requiredClaims: [
+      ...config.jwe?.decryptOptions?.requiredClaims?.filter(
+        (claim) => claim !== "jti" && claim !== "iat"
+      ) || [],
+      "jti",
+      "iat"
+    ],
+    maxTokenAge: config.maxAge,
+    algorithms: alg ? [alg] : void 0,
+    encryptionAlgorithms: enc ? [enc] : void 0,
+    unwrappedKeyAlgorithm: void 0,
+    keyUsage: void 0,
+    forceUint8Array: false,
+    validateJWT: true
+  }).catch((error_) => {
+    if (error_ instanceof Error) {
+      throw error_;
+    }
+    throw new Error(String(error_));
+  });
+  const { jti, iat, exp, ...data } = payload;
+  return {
+    id: jti,
+    createdAt: iat * 1e3,
+    expiresAt: exp ? exp * 1e3 : void 0,
+    data: data && typeof data === "object" ? data : new NullProtoObj()
+  };
+}
+async function clearJWESession(event, config) {
+  const context = getEventContext(event);
+  const sessionName = config.name || DEFAULT_NAME$1;
+  if (context.sessions?.[sessionName]) {
+    delete context.sessions[sessionName];
+  }
+  if (config.cookie !== false && hasWritableResponse$1(event)) {
+    setChunkedCookie(event, sessionName, "", {
+      ...DEFAULT_COOKIE$1,
+      ...config.cookie,
+      expires: /* @__PURE__ */ new Date(0),
+      maxAge: void 0
+    });
+    await config.hooks?.onClear?.(event, config);
+  }
+}
+function getSessionFromContext$1(event, sessionName) {
+  const context = getEventContext(event);
+  return context.sessions?.[sessionName];
+}
+function hasWritableResponse$1(event) {
+  return Boolean(event.res);
+}
+function getEncryptKey(key) {
+  if (!key) {
+    throw new Error("Session: JWE key is required.");
+  }
+  let _key;
+  if (typeof key === "string") {
+    _key = key;
+  } else if (isSymmetricJWK(key) || isPrivateJWK(key)) {
+    _key = key;
+  } else if ("publicKey" in key && isPublicJWK(key.publicKey)) {
+    _key = key.publicKey;
+  } else if ("privateKey" in key && isPrivateJWK(key.privateKey)) {
+    _key = key.privateKey;
+  }
+  if (!_key) {
+    throw new Error(
+      "Session: Invalid JWE key. It must be a password string or valid JWK.",
+      { cause: key }
+    );
+  }
+  return _key;
+}
+function getDecryptKey(key) {
+  if (!key) {
+    throw new Error("Session: JWE key is required.");
+  }
+  let _key = void 0;
+  if (typeof key === "string") {
+    _key = key;
+  } else if (isSymmetricJWK(key)) {
+    _key = key;
+  } else if ("privateKey" in key) {
+    _key = key.privateKey;
+  }
+  if (!_key) {
+    throw new Error(
+      "Session: Invalid JWE key. It must be a password string or a valid private JWK.",
+      { cause: key }
+    );
+  }
+  return _key;
+}
+
+const kGetSessionPromise = Symbol("h3_jws_getSession");
+const DEFAULT_NAME = "h3-jws";
+const DEFAULT_COOKIE = {
+  path: "/",
+  secure: true,
+  httpOnly: false
+};
+async function useJWSSession(event, config) {
+  const sessionName = config.name || DEFAULT_NAME;
+  await getJWSSession(event, config);
+  const sessionManager = {
+    get id() {
+      return getSessionFromContext(event, sessionName)?.id;
+    },
+    get createdAt() {
+      return getSessionFromContext(event, sessionName)?.createdAt ?? Date.now();
+    },
+    get expiresAt() {
+      return getSessionFromContext(event, sessionName)?.expiresAt;
+    },
+    get data() {
+      return getSessionFromContext(event, sessionName)?.data || {};
+    },
+    update: async (update) => {
+      await updateJWSSession(event, config, update);
+      return sessionManager;
+    },
+    clear: async () => {
+      await clearJWSSession(event, config);
+      return sessionManager;
+    }
+  };
+  return sessionManager;
+}
+async function getJWSSession(event, config) {
+  const sessionName = config.name || DEFAULT_NAME;
+  const context = getEventContext(event);
+  if (!context.sessions) {
+    context.sessions = new NullProtoObj();
+  }
+  const existingSession = context.sessions[sessionName];
+  if (existingSession) {
+    const session2 = existingSession[kGetSessionPromise] ? await existingSession[kGetSessionPromise] : existingSession;
+    if (session2.expiresAt !== void 0 && session2.expiresAt < Date.now() && hasWritableResponse(event)) {
+      await config.hooks?.onExpire?.(event, void 0, config);
+      return clearJWSSession(event, config).then(
+        () => getJWSSession(event, config)
+      );
+    }
+    await config.hooks?.onRead?.(session2, event, config);
+    return session2;
+  }
+  const session = {
+    id: "",
+    createdAt: 0,
+    expiresAt: void 0,
+    data: new NullProtoObj()
+  };
+  context.sessions[sessionName] = session;
+  let token;
+  if (config.sessionHeader !== false) {
+    const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
+    const headerValue = event.req.headers.get(headerName);
+    if (typeof headerValue === "string") {
+      token = headerValue;
+    }
+  }
+  if (!token) {
+    token = getChunkedCookie(event, sessionName);
+  }
+  if (token) {
+    const promise = verifyJWSSession(event, config, token).catch(async (error_) => {
+      if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
+        await config.hooks?.onExpire?.(event, error_, config);
+        return void 0;
+      }
+      await config.hooks?.onError?.(event, error_, config);
+      return void 0;
+    }).then((unsealed) => {
+      if (unsealed) {
+        Object.assign(session, unsealed);
+      }
+      delete session[kGetSessionPromise];
+      return session;
+    });
+    session[kGetSessionPromise] = promise;
+    await promise;
+  }
+  if (!session.id) {
+    session.id = config.generateId?.() ?? crypto.randomUUID();
+    session.createdAt = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
+    session.expiresAt = config.maxAge ? session.createdAt + config.maxAge * 1e3 : void 0;
+    await updateJWSSession(event, config);
+  }
+  await config.hooks?.onRead?.(session, event, config);
+  return session;
+}
+async function updateJWSSession(event, config, update) {
+  const sessionName = config.name || DEFAULT_NAME;
+  const context = getEventContext(event);
+  const session = context.sessions?.[sessionName] || await getJWSSession(event, config);
+  if (typeof update === "function") {
+    update = update(session.data);
+  }
+  if (update) {
+    Object.assign(session.data, update);
+    await config.hooks?.onUpdate?.(session, event, config);
+  }
+  if (config.cookie !== false && hasWritableResponse(event)) {
+    const token = await signJWSSession(event, config);
+    setChunkedCookie(event, sessionName, token, {
+      ...DEFAULT_COOKIE,
+      expires: config.maxAge ? new Date(session.createdAt + config.maxAge * 1e3) : void 0,
+      ...config.cookie
+    });
+  }
+  return session;
+}
+async function signJWSSession(event, config) {
+  const key = getSignKey(config.key);
+  const sessionName = config.name || DEFAULT_NAME;
+  const context = getEventContext(event);
+  const session = context.sessions?.[sessionName] || await getJWSSession(event, config);
+  const iatSeconds = Math.floor(session.createdAt / 1e3);
+  const expSeconds = config.maxAge == null ? void 0 : iatSeconds + config.maxAge;
+  const payload = {
+    ...session.data,
+    jti: session.id,
+    iat: iatSeconds
+  };
+  if (expSeconds) {
+    payload.exp = expSeconds;
+  }
+  let typ;
+  if (config.jws?.signOptions?.protectedHeader?.typ && typeof config.jws.signOptions.protectedHeader.typ === "string" && config.jws.signOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
+    typ = config.jws.signOptions.protectedHeader.typ;
+  }
+  const token = await sign(payload, key, {
+    ...config.jws?.signOptions,
+    expiresIn: void 0,
+    // controlled via 'exp' claim
+    protectedHeader: {
+      ...config.jws?.signOptions?.protectedHeader,
+      kid: "kid" in key ? key.kid : void 0,
+      typ: typ || "JWT",
+      cty: "application/json"
+    }
+  });
+  return token;
+}
+async function verifyJWSSession(_event, config, token) {
+  const jwk = getVerifyKey(config.key);
+  const alg = config.jws?.signOptions?.alg;
+  let typ;
+  if (config.jws?.signOptions?.protectedHeader?.typ && typeof config.jws.signOptions.protectedHeader.typ === "string" && config.jws.signOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
+    typ = config.jws.signOptions.protectedHeader.typ;
+  }
+  const { payload } = await verify(token, jwk, {
+    ...config.jws?.verifyOptions,
+    requiredClaims: [
+      ...config.jws?.verifyOptions?.requiredClaims?.filter(
+        (claim) => claim !== "jti" && claim !== "iat"
+      ) || [],
+      "jti",
+      "iat"
+    ],
+    typ: typ || "JWT",
+    algorithms: alg ? [alg] : void 0,
+    forceUint8Array: false,
+    validateJWT: true
+  }).catch((error_) => {
+    const message = error_ instanceof Error ? error_.message : String(error_);
+    throw new Error(`Invalid session token: ${message}`);
+  });
+  const { jti, iat, exp, ...data } = payload;
+  return {
+    id: jti,
+    createdAt: iat * 1e3,
+    expiresAt: exp ? exp * 1e3 : void 0,
+    data: data && typeof data === "object" ? data : new NullProtoObj()
+  };
+}
+async function clearJWSSession(event, config) {
+  const context = getEventContext(event);
+  const sessionName = config.name || DEFAULT_NAME;
+  if (context.sessions?.[sessionName]) {
+    delete context.sessions[sessionName];
+  }
+  if (config.cookie !== false && hasWritableResponse(event)) {
+    setChunkedCookie(event, sessionName, "", {
+      ...DEFAULT_COOKIE,
+      ...config.cookie,
+      expires: /* @__PURE__ */ new Date(0),
+      maxAge: void 0
+    });
+    await config.hooks?.onClear?.(event, config);
+  }
+}
+function getSessionFromContext(event, sessionName) {
+  const context = getEventContext(event);
+  return context.sessions?.[sessionName];
+}
+function hasWritableResponse(event) {
+  return Boolean(event.res);
+}
+function getSignKey(key) {
+  if (!key) {
+    throw new Error("Session: JWS key is required.");
+  }
+  let _key;
+  if (isSymmetricJWK(key)) {
+    _key = key;
+  } else if ("privateKey" in key && isPrivateJWK(key.privateKey)) {
+    _key = key.privateKey;
+  }
+  if (!_key) {
+    throw new Error(
+      "Session: Invalid JWS key. It must be a symmetric JWK or a private JWK.",
+      { cause: key }
+    );
+  }
+  return _key;
+}
+function getVerifyKey(key) {
+  if (!key) {
+    throw new Error("Session: JWS key is required.");
+  }
+  let _key;
+  if (isSymmetricJWK(key)) {
+    _key = key;
+  } else if ("publicKey" in key) {
+    const publicKey = key.publicKey;
+    if (isPublicJWK(publicKey)) {
+      _key = publicKey;
+    } else if (Array.isArray(publicKey)) {
+      const keys = publicKey.filter(
+        (candidate) => isPublicJWK(candidate)
+      );
+      if (keys.length > 0) {
+        _key = { keys };
+      }
+    } else if (publicKey && typeof publicKey === "object" && Array.isArray(publicKey.keys)) {
+      const keys = publicKey.keys.filter(
+        (candidate) => isPublicJWK(candidate)
+      );
+      if (keys.length > 0) {
+        _key = { keys };
+      }
+    }
+  }
+  if (!_key) {
+    throw new Error(
+      "Session: Invalid JWS key. It must be a symmetric JWK or a public JWK/set.",
+      { cause: key }
+    );
+  }
+  return _key;
+}
+
+export { clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-export { i as utils } from './shared/unjwt.DCiTNyCM.mjs';
-export { j as jwe } from './shared/unjwt.CXl9FD-V.mjs';
-export { j as jwk } from './shared/unjwt.Vg02PZWw.mjs';
-export { j as jws } from './shared/unjwt.DmRAjMp8.mjs';
+export { i as utils } from './shared/unjwt.C86hA0o-.mjs';
+export { j as jwe } from './shared/unjwt.CiBEuvtQ.mjs';
+export { j as jwk } from './shared/unjwt.epPK1KFr.mjs';
+export { j as jws } from './shared/unjwt.D-FATaw1.mjs';

package/dist/jwe.mjs

@@ -1,3 +1,3 @@
-import './shared/unjwt.Vg02PZWw.mjs';
-import './shared/unjwt.DCiTNyCM.mjs';
-export { d as decrypt, e as encrypt } from './shared/unjwt.CXl9FD-V.mjs';
+import './shared/unjwt.epPK1KFr.mjs';
+import './shared/unjwt.C86hA0o-.mjs';
+export { d as decrypt, e as encrypt } from './shared/unjwt.CiBEuvtQ.mjs';

package/dist/jwk.mjs

@@ -1,2 +1,2 @@
-import './shared/unjwt.DCiTNyCM.mjs';
-export { k as deriveJWKFromPassword, m as deriveKeyFromPassword, h as exportJWKToPEM, n as exportKey, c as generateJWK, l as generateKey, b as getJWKFromSet, f as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.Vg02PZWw.mjs';
+import './shared/unjwt.C86hA0o-.mjs';
+export { k as deriveJWKFromPassword, m as deriveKeyFromPassword, h as exportJWKToPEM, n as exportKey, c as generateJWK, l as generateKey, b as getJWKFromSet, f as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.epPK1KFr.mjs';

package/dist/jws.mjs

@@ -1,3 +1,3 @@
-import './shared/unjwt.Vg02PZWw.mjs';
-import './shared/unjwt.DCiTNyCM.mjs';
-export { s as sign, v as verify } from './shared/unjwt.DmRAjMp8.mjs';
+import './shared/unjwt.epPK1KFr.mjs';
+import './shared/unjwt.C86hA0o-.mjs';
+export { s as sign, v as verify } from './shared/unjwt.D-FATaw1.mjs';

package/dist/shared/{unjwt.DCiTNyCM.mjs → unjwt.C86hA0o-.mjs}

@@ -435,4 +435,4 @@ const index = {
   validateJwtClaims: validateJwtClaims
 };
 
-export { maybeArray as A, isPublicJWK as B, isJWTContent as C, decodeMaybeJWTString as D, computeExpiresInSeconds as E, computeMaxTokenAgeSeconds as F, isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, base64UrlDecode as e, decodePayloadFromBytes as f, getPlaintextBytes as g, validateJwtClaims as h, index as i, isCryptoKeyPair as j, isCryptoKey as k, textDecoder as l, isJWKSet as m, decodePayloadFromB64UrlSegment as n, validateCriticalHeadersJWS as o, isSymmetricJWK as p, isPrivateJWK as q, randomBytes as r, sanitizeObject as s, textEncoder as t, isAsymmetricJWK as u, validateCriticalHeadersJWE as v, concatUint8Arrays as w, base64Decode as x, base64Encode as y, assertCryptoKey as z };
+export { isAsymmetricJWK as A, maybeArray as B, isJWTContent as C, decodeMaybeJWTString as D, computeExpiresInSeconds as E, computeMaxTokenAgeSeconds as F, isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, base64UrlDecode as e, decodePayloadFromBytes as f, getPlaintextBytes as g, validateJwtClaims as h, index as i, isCryptoKeyPair as j, isCryptoKey as k, textDecoder as l, isJWKSet as m, decodePayloadFromB64UrlSegment as n, validateCriticalHeadersJWS as o, isSymmetricJWK as p, isPrivateJWK as q, randomBytes as r, sanitizeObject as s, textEncoder as t, isPublicJWK as u, validateCriticalHeadersJWE as v, concatUint8Arrays as w, base64Decode as x, base64Encode as y, assertCryptoKey as z };

package/dist/shared/{unjwt.CXl9FD-V.mjs → unjwt.CiBEuvtQ.mjs}

@@ -1,5 +1,5 @@
-import { i as importKey, e as encryptKey, g as generateIV, a as encrypt$1, u as unwrapKey, d as decrypt$1 } from './unjwt.Vg02PZWw.mjs';
-import { r as randomBytes, a as isJWK, s as sanitizeObject, b as applyTypCtyDefaults, c as computeJwtTimeClaims, g as getPlaintextBytes, d as base64UrlEncode, t as textEncoder, e as base64UrlDecode, f as decodePayloadFromBytes, v as validateCriticalHeadersJWE, h as validateJwtClaims, j as isCryptoKeyPair, k as isCryptoKey } from './unjwt.DCiTNyCM.mjs';
+import { i as importKey, e as encryptKey, g as generateIV, a as encrypt$1, u as unwrapKey, d as decrypt$1 } from './unjwt.epPK1KFr.mjs';
+import { r as randomBytes, a as isJWK, s as sanitizeObject, b as applyTypCtyDefaults, c as computeJwtTimeClaims, g as getPlaintextBytes, d as base64UrlEncode, t as textEncoder, e as base64UrlDecode, f as decodePayloadFromBytes, v as validateCriticalHeadersJWE, h as validateJwtClaims, j as isCryptoKeyPair, k as isCryptoKey } from './unjwt.C86hA0o-.mjs';
 
 async function encrypt(payload, key, options = {}) {
   const {

package/dist/shared/{unjwt.DmRAjMp8.mjs → unjwt.D-FATaw1.mjs}

@@ -1,5 +1,5 @@
-import { i as importKey, s as sign$1, b as getJWKFromSet, v as verify$1 } from './unjwt.Vg02PZWw.mjs';
-import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, l as textDecoder, e as base64UrlDecode, m as isJWKSet, n as decodePayloadFromB64UrlSegment, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './unjwt.DCiTNyCM.mjs';
+import { i as importKey, s as sign$1, b as getJWKFromSet, v as verify$1 } from './unjwt.epPK1KFr.mjs';
+import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, l as textDecoder, e as base64UrlDecode, m as isJWKSet, n as decodePayloadFromB64UrlSegment, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './unjwt.C86hA0o-.mjs';
 
 async function sign(payload, key, options = {}) {
   const { protectedHeader: additionalProtectedHeader } = options;

package/dist/shared/{unjwt.Vg02PZWw.mjs → unjwt.epPK1KFr.mjs}

@@ -1,4 +1,4 @@
-import { k as isCryptoKey, w as concatUint8Arrays, d as base64UrlEncode, x as base64Decode, y as base64Encode, t as textEncoder, s as sanitizeObject, z as assertCryptoKey, a as isJWK, e as base64UrlDecode, u as isAsymmetricJWK, r as randomBytes, m as isJWKSet } from './unjwt.DCiTNyCM.mjs';
+import { k as isCryptoKey, w as concatUint8Arrays, d as base64UrlEncode, x as base64Decode, y as base64Encode, t as textEncoder, s as sanitizeObject, z as assertCryptoKey, a as isJWK, e as base64UrlDecode, A as isAsymmetricJWK, r as randomBytes, m as isJWKSet } from './unjwt.C86hA0o-.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -1482,7 +1482,10 @@ async function generateJWK(alg, jwkParams, options = {}) {
   } = options;
   return generateKey(alg, {
     ...opts,
-    toJWK: jwkParams || true
+    toJWK: {
+      kid: typeof jwkParams?.kid === "string" ? jwkParams.kid : crypto.randomUUID(),
+      ...jwkParams
+    }
   });
 }
 async function deriveKeyFromPassword(password, alg, options) {