unjwt 0.5.37 → 0.5.39

package/dist/_chunks/index.d.mts

@@ -0,0 +1,250 @@
+import { M as JWKSet, X as JWK_Private, Z as JWK_Public, _ as JWSProtectedHeader, c as JWEHeaderParameters, d as StrictOmit, g as ExpiresIn, it as JWK_Symmetric, m as JWTClaims, p as JWTClaimValidationOptions, s as JWEEncryptOptions, v as JWSSignOptions } from "./jwk.mjs";
+import { H3Event } from "h3";
+import { CookieSerializeOptions } from "cookie-es";
+
+//#region src/adapters/h3v1/session/types.d.ts
+interface SessionClaims extends Required<Pick<JWTClaims, "jti" | "iat">>, StrictOmit<JWTClaims, "jti" | "iat"> {}
+type SessionData<T extends Record<string, any> = SessionClaims> = StrictOmit<T, "jti" | "iat" | "exp">;
+type SessionUpdate<T extends Record<string, any> = SessionClaims> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
+interface SessionManager<T extends Record<string, any> = SessionClaims, ConfigMaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  readonly id: string | undefined;
+  readonly createdAt: number;
+  readonly expiresAt: ConfigMaxAge extends ExpiresIn ? number : "exp" extends keyof T ? T["exp"] : number | undefined;
+  readonly data: SessionData<T>;
+  readonly token: string | undefined;
+  update: (update: SessionUpdate<T>) => Promise<SessionManager<T, ConfigMaxAge> & {
+    readonly id: string;
+  }>;
+  clear: () => Promise<SessionManager<T, ConfigMaxAge>>;
+}
+//#endregion
+//#region src/adapters/h3v1/session/jwe.d.ts
+declare const kGetSessionPromise$1: unique symbol;
+interface SessionJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  id: string | undefined;
+  createdAt: number;
+  expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
+  data: SessionData<T>;
+  [kGetSessionPromise$1]?: Promise<SessionJWE<T, MaxAge>>;
+}
+interface SessionHooksJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  onRead?: (args: {
+    session: SessionJWE<T, MaxAge>;
+    event: H3Event;
+    config: SessionConfigJWE<T, MaxAge>;
+  }) => void | Promise<void>;
+  onUpdate?: (args: {
+    session: SessionJWE<T, MaxAge>;
+    oldSession: SessionJWE<T, MaxAge>;
+    event: H3Event;
+    config: SessionConfigJWE<T, MaxAge>;
+  }) => void | Promise<void>;
+  onClear?: (args: {
+    session: SessionJWE<T, MaxAge> | undefined;
+    event: H3Event;
+    config: Partial<SessionConfigJWE<T, MaxAge>>;
+  }) => void | Promise<void>;
+  onExpire?: (args: {
+    event: H3Event;
+    error: Error;
+    config: SessionConfigJWE<T, MaxAge>;
+  }) => void | Promise<void>;
+  onError?: (args: {
+    event: H3Event;
+    error: any;
+    config: SessionConfigJWE<T, MaxAge>;
+  }) => void | Promise<void>;
+  onUnsealKeyLookup?: (args: {
+    header: JWEHeaderParameters;
+    event: H3Event;
+    config: SessionConfigJWE<T, MaxAge>;
+  }) => JWK_Symmetric | JWK_Private | Promise<JWK_Symmetric | JWK_Private>;
+}
+interface SessionConfigJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  /** @deprecated use `key` instead */
+  secret?: string | JWK_Symmetric | {
+    privateKey: JWK_Private | JWK_Symmetric;
+    publicKey?: JWK_Public;
+  };
+  /** Shared key used, string for PBES2 or Json Web Key (JWK) */
+  key: string | JWK_Symmetric | JWK_Private | {
+    privateKey: JWK_Private | JWK_Symmetric;
+    publicKey?: JWK_Public;
+  };
+  /** Session lifetime in seconds (used to derive exp from iat) */
+  maxAge?: MaxAge;
+  /** Default is "h3" */
+  name?: string;
+  /** Default is secure, httpOnly, path="/" */
+  cookie?: false | CookieSerializeOptions;
+  /** Default is x-h3-session / x-{name}-session */
+  sessionHeader?: false | string;
+  /** Default is crypto.randomUUID */
+  generateId?: () => string;
+  /** JWE configuration overrides */
+  jwe?: {
+    encryptOptions?: Omit<JWEEncryptOptions, "expiresIn">;
+    decryptOptions?: JWTClaimValidationOptions;
+  };
+  hooks?: SessionHooksJWE<T, MaxAge>;
+}
+/**
+* @deprecated use `SessionConfigJWE` instead
+*/
+type SessionJWEConfig = SessionConfigJWE;
+type CompatEvent$1 = {
+  request: {
+    headers: Headers;
+  };
+  context: any;
+} | {
+  headers: Headers;
+  context: any;
+};
+/**
+* Create a session manager for the current request.
+*/
+declare function useJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
+/**
+* Get (and lazily initialize) the session for the current request.
+*/
+declare function getJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<SessionJWE<T, MaxAge>>;
+declare function getJWESessionToken<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): string | undefined;
+/**
+* Update the session (optionally mutating the session data) and re-issue the JWE token.
+*/
+declare function updateJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: SessionConfigJWE<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWE<T, MaxAge>>;
+/**
+* Produce a JWE for the current session.
+* Payload structure:
+* {
+*   jti: string;
+*   iat: number; (seconds)
+*   exp?: number; (seconds)
+*   data: Record<string, any>;
+* }
+*/
+declare function sealJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<string>;
+/**
+* Decrypt the JWE and return a Session-compatible object.
+*/
+declare function unsealJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>, sealed: string): Promise<Partial<SessionJWE<T, MaxAge>>>;
+/**
+* Clear the session (delete from context and drop cookie).
+*/
+declare function clearJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: Partial<SessionConfigJWE<T, MaxAge>>): Promise<void>;
+//#endregion
+//#region src/adapters/h3v1/session/jws.d.ts
+declare const kGetSessionPromise: unique symbol;
+interface SessionJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  id: string | undefined;
+  createdAt: number;
+  expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
+  data: SessionData<T>;
+  [kGetSessionPromise]?: Promise<SessionJWS<T, MaxAge>>;
+}
+interface SessionHooksJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  onRead?: (args: {
+    session: SessionJWS<T, MaxAge>;
+    event: H3Event;
+    config: SessionConfigJWS<T, MaxAge>;
+  }) => void | Promise<void>;
+  onUpdate?: (args: {
+    session: SessionJWS<T, MaxAge>;
+    oldSession: SessionJWS<T, MaxAge>;
+    event: H3Event;
+    config: SessionConfigJWS<T, MaxAge>;
+  }) => void | Promise<void>;
+  onClear?: (args: {
+    session: SessionJWS<T, MaxAge> | undefined;
+    event: H3Event;
+    config: Partial<SessionConfigJWS<T, MaxAge>>;
+  }) => void | Promise<void>;
+  onExpire?: (args: {
+    event: H3Event;
+    error: Error;
+    config: SessionConfigJWS<T, MaxAge>;
+  }) => void | Promise<void>;
+  onError?: (args: {
+    event: H3Event;
+    error: any;
+    config: SessionConfigJWS<T, MaxAge>;
+  }) => void | Promise<void>;
+  onVerifyKeyLookup?: (args: {
+    header: JWSProtectedHeader;
+    event: H3Event;
+    config: SessionConfigJWS<T, MaxAge>;
+  }) => JWKSet | JWK_Symmetric | JWK_Public | Promise<JWKSet | JWK_Symmetric | JWK_Public>;
+}
+interface SessionConfigJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  /**
+  * JWK (private for signing with RS/ES/PS, or symmetric oct) used for signing.
+  */
+  key: JWK_Symmetric | {
+    privateKey: JWK_Private;
+    publicKey: JWK_Public | JWK_Public[] | JWKSet;
+  };
+  /** Session lifetime in seconds (sets exp = iat + maxAge) */
+  maxAge?: MaxAge;
+  /** Default cookie / header name base */
+  name?: string;
+  /** Cookie options (false to disable cookies) */
+  cookie?: false | CookieSerializeOptions;
+  /** Custom header (false to disable header lookup) */
+  sessionHeader?: false | string;
+  /** Custom ID generator (defaults to crypto.randomUUID) */
+  generateId?: () => string;
+  /** JWS customization */
+  jws?: {
+    signOptions?: Omit<JWSSignOptions, "expiresIn">;
+    verifyOptions?: JWTClaimValidationOptions;
+  };
+  hooks?: SessionHooksJWS<T, MaxAge>;
+}
+/**
+* @deprecated use `SessionConfigJWS` instead
+*/
+type SessionJWSConfig = SessionConfigJWS;
+type CompatEvent = {
+  request: {
+    headers: Headers;
+  };
+  context: any;
+} | {
+  headers: Headers;
+  context: any;
+};
+/**
+* Create a session manager for the current request using JWS (signed only, not encrypted).
+* NOTE: Contents are visible to clients (Base64URL-decoded JSON). Do not store secrets in session data.
+*/
+declare function useJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
+/**
+* Retrieve (and lazily initialize) the session.
+*/
+declare function getJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionJWS<T, MaxAge>>;
+/**
+* Update session data (if provided) and reissue JWS.
+*/
+declare function updateJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: SessionConfigJWS<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWS<T, MaxAge>>;
+/**
+* Sign current session as a compact JWS.
+* Payload claims:
+*  jti, iat, exp?, data, plus optional extraClaims (cannot override reserved)
+*/
+declare function signJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<string>;
+/**
+* Verify and parse a compact JWS into a Session structure.
+* Performs:
+*  - cryptographic signature verification
+*  - (optional) standard claim checks if validateJWT true
+*  - ensures jti & iat presence
+*  - enforces maxAge if provided
+*/
+declare function verifyJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>, token: string): Promise<Partial<SessionJWS<T, MaxAge>>>;
+/**
+* Destroy the session (context + cookie).
+*/
+declare function clearJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: Partial<SessionConfigJWS<T, MaxAge>>): Promise<void>;
+//#endregion
+export { SessionData as C, SessionClaims as S, SessionUpdate as T, getJWESessionToken as _, clearJWSSession as a, updateJWESession as b, updateJWSSession as c, SessionConfigJWE as d, SessionHooksJWE as f, getJWESession as g, clearJWESession as h, SessionJWSConfig as i, useJWSSession as l, SessionJWEConfig as m, SessionHooksJWS as n, getJWSSession as o, SessionJWE as p, SessionJWS as r, signJWSSession as s, SessionConfigJWS as t, verifyJWSSession as u, sealJWESession as v, SessionManager as w, useJWESession as x, unsealJWESession as y };

package/dist/_chunks/index2.d.mts

@@ -0,0 +1,108 @@
+import { $ as JWK_Public, A as JWK, P as JWKSet, Q as JWK_Private, ct as JWK_oct, l as StrictOmit, t as ExpiresIn, v as JWTClaimValidationOptions, y as JWTClaims } from "./index.mjs";
+
+//#region src/core/utils/jwt.d.ts
+/**
+* Apply default typ/cty semantics shared by JWS & JWE.
+* - If typ is undefined and payload is a non-Uint8Array object, set typ="JWT".
+* - If typ is "JWT" and payload is a non-Uint8Array object, ensure cty defaults to "application/json".
+*/
+declare function applyTypCtyDefaults<T extends {
+  typ?: string;
+  cty?: string;
+}>(header: T, payload: unknown): T;
+/** Returns true when headers indicate JSON content. */
+declare function isJWTContent(header: {
+  typ?: string;
+  cty?: string;
+} | undefined): boolean;
+/**
+* Given a decoded string and JOSE headers, return an object if JSON, otherwise the string.
+*/
+declare function decodeMaybeJWTString<T = unknown>(decodedString: string, header: {
+  typ?: string;
+  cty?: string;
+} | undefined): T | string;
+/**
+* Decode a payload that is represented as raw bytes into T | string, honoring forceUint8Array and headers.
+*/
+declare function decodePayloadFromBytes<T = unknown>(bytes: Uint8Array<ArrayBuffer>, header: {
+  typ?: string;
+  cty?: string;
+} | undefined, forceUint8Array?: boolean): T | Uint8Array<ArrayBuffer> | string;
+/**
+* Decode a payload that is a Base64URL segment into T | string | Uint8Array based on flags and headers.
+*/
+declare function decodePayloadFromB64UrlSegment<T = unknown>(payloadEncoded: string, header: {
+  typ?: string;
+  cty?: string;
+} | undefined, forceUint8Array?: boolean): T | Uint8Array<ArrayBuffer> | string;
+/** Convert plaintext input to bytes, shared by JWS & JWE when preparing payload. */
+declare function getPlaintextBytes(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>): Uint8Array<ArrayBuffer>;
+declare function computeExpiresInSeconds(expiresIn: ExpiresIn): number;
+declare const computeMaxTokenAgeSeconds: (expiresIn: ExpiresIn) => number;
+/** Optionally compute iat/exp when signing JWTs. */
+declare function computeJwtTimeClaims(payload: unknown, headerTyp: string | undefined, expiresIn?: ExpiresIn, currentDate?: Date): JWTClaims | undefined;
+/** Validate JWT claims under JWS verification rules (or custom JWE implementations). */
+declare function validateJwtClaims(jwtClaims: JWTClaims, options?: JWTClaimValidationOptions): void;
+/** Validate critical headers in JWS semantics. */
+declare function validateCriticalHeadersJWS(protectedHeader: {
+  crit?: string[];
+} & Record<string, any>, requiredHeaders?: string[]): void;
+/** Validate critical headers in JWE semantics. */
+declare function validateCriticalHeadersJWE(protectedHeader: {
+  crit?: string[];
+} & Record<string, any>, understoodFromOptions?: string[]): void;
+//#endregion
+//#region src/core/utils/sanitize.d.ts
+/**
+* Forked from unsecure@0.0.4
+* Licensed under the MIT License.
+*
+* Source: https://github.com/sandros94/unsecure/blob/913ed5580c551153a19154b4916c67a8efb2be85/src/sanitize.ts
+*/
+/**
+* Remove prototype-pollution vectors from a plain record in-place.
+* This strips __proto__, prototype, and constructor own properties.
+* Returns the same reference for convenience.
+*/
+declare function sanitizeObject<T extends Record<string, unknown> | undefined>(obj: T): T;
+declare namespace index_d_exports {
+  export { StrictOmit, applyTypCtyDefaults, assertCryptoKey, base64Decode, base64Encode, base64UrlDecode, base64UrlEncode, computeExpiresInSeconds, computeJwtTimeClaims, computeMaxTokenAgeSeconds, concatUint8Arrays, decodeMaybeJWTString, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, randomBytes, sanitizeObject, textDecoder, textEncoder, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims };
+}
+declare const textEncoder: TextEncoder;
+declare const textDecoder: TextDecoder;
+declare function base64Encode(data: Uint8Array<ArrayBuffer> | string): string;
+declare function base64UrlEncode(data: Uint8Array<ArrayBuffer> | string): string;
+declare function base64Decode(str: string | undefined): string;
+declare function base64Decode<T extends boolean | undefined>(str?: string | undefined, toString?: T): T extends false ? Uint8Array<ArrayBuffer> : string;
+declare function base64UrlDecode(str: string | undefined): string;
+declare function base64UrlDecode<T extends boolean | undefined>(str?: string | undefined, toString?: T): T extends false ? Uint8Array<ArrayBuffer> : string;
+declare function randomBytes(length: Readonly<number>): Uint8Array<ArrayBuffer>;
+/**
+* Concatenates multiple Uint8Arrays
+* @param arrays Arrays to concatenate
+* @returns Concatenated array
+*/
+declare function concatUint8Arrays(...arrays: Readonly<Uint8Array<ArrayBuffer>[]>): Uint8Array<ArrayBuffer>;
+declare function maybeArray<T>(item: T | T[]): T[];
+declare function isJWK(key: any): key is JWK;
+declare function isJWKSet(key: any): key is JWKSet;
+declare function assertCryptoKey(key: unknown): asserts key is CryptoKey;
+declare function isCryptoKey(key: unknown): key is CryptoKey;
+declare const isCryptoKeyPair: (key: any) => key is CryptoKeyPair;
+/** Returns true if the JWK is a symmetric (oct) key. */
+declare function isSymmetricJWK(key: unknown): key is Extract<JWK, JWK_oct>;
+/** Returns true if the JWK is an asymmetric (RSA, EC, OKP) key. */
+declare function isAsymmetricJWK(key: unknown): key is Exclude<JWK, JWK_oct>;
+/**
+* Type guard that checks if the provided JWK contains private key material.
+* It relies purely on the presence of private components (e.g. "d"), not on the alg value.
+*/
+declare function isPrivateJWK(key: unknown): key is JWK_Private;
+/**
+* Type guard that checks if the provided JWK is a public (asymmetric) key.
+* This checks for the presence of public components and absence of private material.
+*/
+declare function isPublicJWK(key: unknown): key is JWK_Public;
+//#endregion
+export { validateCriticalHeadersJWE as A, computeJwtTimeClaims as C, decodePayloadFromBytes as D, decodePayloadFromB64UrlSegment as E, validateJwtClaims as M, getPlaintextBytes as O, computeExpiresInSeconds as S, decodeMaybeJWTString as T, randomBytes as _, base64UrlEncode as a, sanitizeObject as b, isAsymmetricJWK as c, isJWK as d, isJWKSet as f, maybeArray as g, isSymmetricJWK as h, base64UrlDecode as i, validateCriticalHeadersJWS as j, isJWTContent as k, isCryptoKey as l, isPublicJWK as m, base64Decode as n, concatUint8Arrays as o, isPrivateJWK as p, base64Encode as r, index_d_exports as s, assertCryptoKey as t, isCryptoKeyPair as u, textDecoder as v, computeMaxTokenAgeSeconds as w, applyTypCtyDefaults as x, textEncoder as y };

package/dist/_chunks/jwe.d.mts

@@ -0,0 +1,43 @@
+import { $ as JWK_Public, A as JWK, B as JWK_Asymmetric_Algorithm, C as DeriveKeyOptions, D as GenerateKeyAlgorithm, E as GenerateJWKReturn, F as JWK_AES_CBC_HMAC, G as JWK_EC_Public, H as JWK_ECDH_ES, I as JWK_AES_GCM, J as JWK_OKP_Private, K as JWK_HMAC, L as JWK_AES_GCM_KW, M as JWKPEMAlgorithm, N as JWKParameters, O as GenerateKeyOptions, P as JWKSet, Q as JWK_Private, R as JWK_AES_KW, S as ContentEncryptionAlgorithm, T as GenerateJWKOptions, U as JWK_ECDSA, V as JWK_EC, W as JWK_EC_Private, X as JWK_OKP_SIGN, Y as JWK_OKP_Public, Z as JWK_PBES2, _ as JWT, a as JWEEncryptOptions, at as JWK_RSA_SIGN, b as JoseHeaderParameters, c as JWEKeyManagementHeaderParameters, ct as JWK_oct, dt as WrapKeyOptions, et as JWK_RSA, ft as WrapKeyResult, i as JWEDecryptResult, it as JWK_RSA_Public, j as JWKAlgorithm, k as GenerateKeyReturn, lt as KeyManagementAlgorithm, nt as JWK_RSA_PSS, o as JWEHeaderParameters, ot as JWK_Symmetric, q as JWK_OKP, r as JWEDecryptOptions, rt as JWK_RSA_Private, s as JWEKeyLookupFunction, st as JWK_Symmetric_Algorithm, tt as JWK_RSA_ENC, ut as UnwrapKeyOptions, v as JWTClaimValidationOptions, w as DeriveKeyReturn, x as CompositeKey, y as JWTClaims, z as JWK_Asymmetric } from "./index.mjs";
+
+//#region src/core/jwe.d.ts
+declare namespace jwe_d_exports {
+  export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEHeaderParameters, JWEKeyLookupFunction, JWEKeyManagementHeaderParameters, JWK, JWKAlgorithm, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWT, JWTClaimValidationOptions, JWTClaims, JoseHeaderParameters, KeyManagementAlgorithm, UnwrapKeyOptions, WrapKeyOptions, WrapKeyResult, decrypt, encrypt };
+}
+/**
+* Encrypts a payload to produce a JWE Compact Serialization string.
+*
+* @param payload The payload to encrypt. Can be a string, Uint8Array, or a JSON-serializable object.
+* @param key The key encryption key (KEK). Can be a CryptoKey, JWK, or for PBES2, a password string/Uint8Array.
+* @param options JWE encryption options, including `alg` (key management algorithm) and `enc` (content encryption algorithm).
+* @returns A Promise resolving to the JWE Compact Serialization string.
+*/
+declare function encrypt(payload: JWTClaims, key: JWK | string | Uint8Array<ArrayBuffer>, options?: JWEEncryptOptions): Promise<string>;
+declare function encrypt(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: JWK | string | Uint8Array<ArrayBuffer>, options?: JWEEncryptOptions): Promise<string>;
+declare function encrypt(payload: JWTClaims, key: CryptoKey, options: JWEEncryptOptions & {
+  alg: KeyManagementAlgorithm;
+  enc: ContentEncryptionAlgorithm;
+}): Promise<string>;
+declare function encrypt(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: CryptoKey, options: JWEEncryptOptions & {
+  alg: KeyManagementAlgorithm;
+  enc: ContentEncryptionAlgorithm;
+}): Promise<string>;
+declare function encrypt(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: CryptoKey | JWK | string | Uint8Array<ArrayBuffer>, options: JWEEncryptOptions & {
+  alg: KeyManagementAlgorithm;
+  enc: ContentEncryptionAlgorithm;
+}): Promise<string>;
+/**
+* Decrypts a JWE Compact Serialization string.
+*
+* @param jwe The JWE Compact Serialization string.
+* @param key The key decryption key (KEK) or a function to look up the key.
+* @param options JWE decryption options.
+* @returns A Promise resolving to an object containing the decrypted plaintext, protected header, CEK, and AAD.
+* @throws If JWE is invalid, decryption fails, or options are not met.
+*/
+declare function decrypt<T extends JWTClaims | Uint8Array<ArrayBuffer> | string>(jwe: string, key: CryptoKey | JWK_Symmetric | JWK_Private | string | Uint8Array<ArrayBuffer> | JWEKeyLookupFunction, options?: JWEDecryptOptions): Promise<JWEDecryptResult<T>>;
+declare function decrypt(jwe: string, key: CryptoKey | JWK_Symmetric | JWK_Private | string | Uint8Array<ArrayBuffer> | JWEKeyLookupFunction, options: JWEDecryptOptions & {
+  forceUint8Array: true;
+}): Promise<JWEDecryptResult<Uint8Array<ArrayBuffer>>>;
+//#endregion
+export { encrypt as n, jwe_d_exports as r, decrypt as t };

package/dist/_chunks/jwe.mjs

@@ -0,0 +1,132 @@
+import { t as __exportAll } from "./chunk.mjs";
+import { A as validateCriticalHeadersJWE, C as computeJwtTimeClaims, D as decodePayloadFromBytes, M as validateJwtClaims, O as getPlaintextBytes, a as base64UrlEncode, b as sanitizeObject, c as isCryptoKey, g as randomBytes, i as base64UrlDecode, l as isCryptoKeyPair, u as isJWK, v as textEncoder, x as applyTypCtyDefaults } from "./utils.mjs";
+import { d as unwrapKey, g as generateIV, h as encrypt$1, l as importKey, m as decrypt$1, p as encryptKey } from "./jwk.mjs";
+//#region src/core/jwe.ts
+var jwe_exports = /* @__PURE__ */ __exportAll({
+	decrypt: () => decrypt,
+	encrypt: () => encrypt
+});
+async function encrypt(payload, key, options = {}) {
+	const { protectedHeader: additionalProtectedHeader, cek: providedCek, contentEncryptionIV: providedContentIV, keyManagementIV, p2s, p2c, ecdh } = options;
+	let { alg, enc } = options;
+	if (!alg) {
+		if (typeof key === "string" || key instanceof Uint8Array) alg = "PBES2-HS256+A128KW";
+		else if (isJWK(key)) alg = key.alg === "A128GCM" || key.alg === "A192GCM" || key.alg === "A256GCM" ? `${key.alg}KW` : key.alg;
+	}
+	if (!alg) throw new TypeError("JWE \"alg\" (Key Management Algorithm) must be provided in options or inferable from the key");
+	if (!enc) enc = isJWK(key) && "enc" in key ? key.enc : "A128GCM";
+	const jweKeyManagementParams = {};
+	if (keyManagementIV) jweKeyManagementParams.iv = keyManagementIV;
+	if (p2s) jweKeyManagementParams.p2s = p2s;
+	else if (alg?.startsWith("PBES2")) jweKeyManagementParams.p2s = randomBytes(16);
+	if (p2c) jweKeyManagementParams.p2c = p2c;
+	else if (alg?.startsWith("PBES2")) jweKeyManagementParams.p2c = 2048;
+	if (ecdh?.partyUInfo) jweKeyManagementParams.apu = ecdh.partyUInfo;
+	if (ecdh?.partyVInfo) jweKeyManagementParams.apv = ecdh.partyVInfo;
+	if (ecdh?.ephemeralKey) {
+		const { epk, epkPrivateKey } = parseEphemeralKey(ecdh.ephemeralKey);
+		jweKeyManagementParams.epk = epk;
+		jweKeyManagementParams.epkPrivateKey = epkPrivateKey;
+	}
+	const wrappingKeyMaterial = await importKey(key, alg);
+	const { cek: finalCek, encryptedKey: jweEncryptedKey, parameters: keyManagementHeaderParams } = await encryptKey(alg, enc, wrappingKeyMaterial, providedCek, jweKeyManagementParams);
+	const jweProtectedHeader = {
+		...additionalProtectedHeader,
+		...keyManagementHeaderParams,
+		alg,
+		enc
+	};
+	if (isJWK(key) && key.kid) jweProtectedHeader.kid = key.kid;
+	const protectedHeader = applyTypCtyDefaults(jweProtectedHeader, payload);
+	const plaintextBytes = getPlaintextBytes(computeJwtTimeClaims(payload, protectedHeader.typ, options.expiresIn, options.currentDate) || payload);
+	const protectedHeaderEncoded = base64UrlEncode(JSON.stringify(protectedHeader));
+	const aadBytes = textEncoder.encode(protectedHeaderEncoded);
+	const contentIVBytes = providedContentIV ?? generateIV(enc);
+	const { ciphertext: contentCiphertext, tag: contentAuthTag, iv: actualContentIV } = await encrypt$1(enc, plaintextBytes, finalCek, contentIVBytes, aadBytes);
+	if (!actualContentIV) throw new Error("Content encryption IV was not generated or returned.");
+	if (!contentAuthTag) throw new Error("Content encryption auth tag was not generated or returned.");
+	return [
+		protectedHeaderEncoded,
+		jweEncryptedKey ? base64UrlEncode(jweEncryptedKey) : "",
+		base64UrlEncode(actualContentIV),
+		base64UrlEncode(contentCiphertext),
+		base64UrlEncode(contentAuthTag)
+	].join(".");
+}
+async function decrypt(jwe, key, options = {}) {
+	const parts = jwe.split(".");
+	if (parts.length !== 5) throw new Error("Invalid JWE: Must contain five sections (RFC7516, section-3).");
+	const [protectedHeaderEncoded, encryptedKeyEncoded, ivEncoded, ciphertextEncoded, authTagEncoded] = parts;
+	let protectedHeader;
+	try {
+		const protectedHeaderJson = base64UrlDecode(protectedHeaderEncoded);
+		protectedHeader = sanitizeObject(JSON.parse(protectedHeaderJson));
+	} catch {
+		throw new Error("Invalid JWE: Protected header could not be decoded.");
+	}
+	if (!protectedHeader || typeof protectedHeader !== "object" || !protectedHeader.alg || !protectedHeader.enc) throw new Error("Invalid JWE: Protected header must be an object with \"alg\" and \"enc\" properties.");
+	const alg = protectedHeader.alg;
+	const enc = protectedHeader.enc;
+	if (options?.algorithms && !options.algorithms.includes(alg)) throw new Error(`Key management algorithm not allowed: ${alg}`);
+	if (options?.encryptionAlgorithms && !options.encryptionAlgorithms.includes(enc)) throw new Error(`Content encryption algorithm not allowed: ${enc}`);
+	const unwrappingKey = await importKey(typeof key === "function" ? await key(protectedHeader, jwe) : key, alg);
+	const encryptedKeyBytes = base64UrlDecode(encryptedKeyEncoded, false);
+	const contentIVBytes = base64UrlDecode(ivEncoded, false);
+	const contentAuthTagBytes = base64UrlDecode(authTagEncoded, false);
+	const ciphertextBytes = base64UrlDecode(ciphertextEncoded, false);
+	const unwrapKeyOpts = {
+		enc,
+		returnAs: enc.includes("GCM"),
+		keyUsage: options?.keyUsage || ["decrypt"]
+	};
+	if (protectedHeader.iv) unwrapKeyOpts.iv = protectedHeader.iv;
+	if (protectedHeader.tag) unwrapKeyOpts.tag = protectedHeader.tag;
+	if (protectedHeader.p2s) unwrapKeyOpts.p2s = protectedHeader.p2s;
+	if (protectedHeader.p2c) unwrapKeyOpts.p2c = protectedHeader.p2c;
+	if (protectedHeader.epk) unwrapKeyOpts.epk = protectedHeader.epk;
+	if (protectedHeader.apu) unwrapKeyOpts.apu = protectedHeader.apu;
+	if (protectedHeader.apv) unwrapKeyOpts.apv = protectedHeader.apv;
+	if (options?.unwrappedKeyAlgorithm) unwrapKeyOpts.unwrappedKeyAlgorithm = options.unwrappedKeyAlgorithm;
+	if (options?.extractable) unwrapKeyOpts.extractable = options.extractable;
+	const cek = await unwrapKey(alg, encryptedKeyBytes, unwrappingKey, unwrapKeyOpts);
+	const aadBytes = textEncoder.encode(protectedHeaderEncoded);
+	const payload = decodePayloadFromBytes(await decrypt$1(enc, cek, ciphertextBytes, contentIVBytes, contentAuthTagBytes, aadBytes), protectedHeader, options?.forceUint8Array);
+	if (protectedHeader.crit || options?.critical?.length || options?.requiredHeaders?.length) validateCriticalHeadersJWE(protectedHeader, [...options?.critical || [], ...options?.requiredHeaders || []]);
+	if (payload && typeof payload === "object" && options.validateJWT !== false && (options.validateJWT === true || protectedHeader.typ?.toLowerCase().includes("jwt")) && !options.forceUint8Array && !(payload instanceof Uint8Array)) validateJwtClaims(payload, options);
+	const result = {
+		payload,
+		protectedHeader
+	};
+	if (options.returnCek) {
+		result.cek = isCryptoKey(cek) ? new Uint8Array(await crypto.subtle.exportKey("raw", cek)) : cek;
+		result.aad = aadBytes;
+	}
+	return result;
+}
+function parseEphemeralKey(ephemeralKey) {
+	let epk;
+	let epkPrivateKey;
+	if (isCryptoKeyPair(ephemeralKey)) {
+		epk = ephemeralKey.publicKey;
+		epkPrivateKey = ephemeralKey.privateKey;
+	} else if (typeof ephemeralKey === "object" && ephemeralKey !== null && "publicKey" in ephemeralKey && "privateKey" in ephemeralKey) {
+		const candidate = ephemeralKey;
+		if (!candidate.publicKey || !candidate.privateKey) throw new TypeError("ECDH-ES custom ephemeral key must include both publicKey and privateKey.");
+		epk = candidate.publicKey;
+		epkPrivateKey = candidate.privateKey;
+	} else if (isCryptoKey(ephemeralKey)) {
+		if (ephemeralKey.type !== "private") throw new TypeError("ECDH-ES custom ephemeral CryptoKey must include private key material.");
+		epk = ephemeralKey;
+		epkPrivateKey = ephemeralKey;
+	} else if (isJWK(ephemeralKey)) {
+		if (!("d" in ephemeralKey) || typeof ephemeralKey.d !== "string") throw new TypeError("ECDH-ES custom ephemeral JWK must include private parameter \"d\".");
+		epk = ephemeralKey;
+		epkPrivateKey = ephemeralKey;
+	} else throw new TypeError("Unsupported ECDH-ES ephemeral key material provided in options.");
+	return {
+		epk,
+		epkPrivateKey
+	};
+}
+//#endregion
+export { encrypt as n, jwe_exports as r, decrypt as t };