unjwt 0.5.38 → 0.5.39

package/dist/shared/unjwt.Cy2MlkUe.d.mts

@@ -1,174 +0,0 @@
-import { E as ExpiresIn, X as JWTClaims, Z as JWTClaimValidationOptions, v as JWK, w as JWKSet, q as JWK_oct, u as JWK_Private, t as JWK_Public } from './unjwt.BCi3FEWr.mjs';
-import { S as StrictOmit } from './unjwt.JdKqVANs.mjs';
-
-/**
- * Apply default typ/cty semantics shared by JWS & JWE.
- * - If typ is undefined and payload is a non-Uint8Array object, set typ="JWT".
- * - If typ is "JWT" and payload is a non-Uint8Array object, ensure cty defaults to "application/json".
- */
-declare function applyTypCtyDefaults<T extends {
-    typ?: string;
-    cty?: string;
-}>(header: T, payload: unknown): T;
-/** Returns true when headers indicate JSON content. */
-declare function isJWTContent(header: {
-    typ?: string;
-    cty?: string;
-} | undefined): boolean;
-/**
- * Given a decoded string and JOSE headers, return an object if JSON, otherwise the string.
- */
-declare function decodeMaybeJWTString<T = unknown>(decodedString: string, header: {
-    typ?: string;
-    cty?: string;
-} | undefined): T | string;
-/**
- * Decode a payload that is represented as raw bytes into T | string, honoring forceUint8Array and headers.
- */
-declare function decodePayloadFromBytes<T = unknown>(bytes: Uint8Array<ArrayBuffer>, header: {
-    typ?: string;
-    cty?: string;
-} | undefined, forceUint8Array?: boolean): T | Uint8Array<ArrayBuffer> | string;
-/**
- * Decode a payload that is a Base64URL segment into T | string | Uint8Array based on flags and headers.
- */
-declare function decodePayloadFromB64UrlSegment<T = unknown>(payloadEncoded: string, header: {
-    typ?: string;
-    cty?: string;
-} | undefined, forceUint8Array?: boolean): T | Uint8Array<ArrayBuffer> | string;
-/** Convert plaintext input to bytes, shared by JWS & JWE when preparing payload. */
-declare function getPlaintextBytes(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>): Uint8Array<ArrayBuffer>;
-declare function computeExpiresInSeconds(expiresIn: ExpiresIn): number;
-declare const computeMaxTokenAgeSeconds: typeof computeExpiresInSeconds;
-/** Optionally compute iat/exp when signing JWTs. */
-declare function computeJwtTimeClaims(payload: unknown, headerTyp: string | undefined, expiresIn?: ExpiresIn, currentDate?: Date): JWTClaims | undefined;
-/** Validate JWT claims under JWS verification rules (or custom JWE implementations). */
-declare function validateJwtClaims(jwtClaims: JWTClaims, options?: JWTClaimValidationOptions): void;
-/** Validate critical headers in JWS semantics. */
-declare function validateCriticalHeadersJWS(protectedHeader: {
-    crit?: string[];
-} & Record<string, any>, requiredHeaders?: string[]): void;
-/** Validate critical headers in JWE semantics. */
-declare function validateCriticalHeadersJWE(protectedHeader: {
-    crit?: string[];
-} & Record<string, any>, understoodFromOptions?: string[]): void;
-
-/**
- * Forked from unsecure@0.0.4
- * Licensed under the MIT License.
- *
- * Source: https://github.com/sandros94/unsecure/blob/913ed5580c551153a19154b4916c67a8efb2be85/src/sanitize.ts
- */
-/**
- * Remove prototype-pollution vectors from a plain record in-place.
- * This strips __proto__, prototype, and constructor own properties.
- * Returns the same reference for convenience.
- */
-declare function sanitizeObject<T extends Record<string, unknown> | undefined>(obj: T): T;
-
-declare const textEncoder: TextEncoder;
-declare const textDecoder: TextDecoder;
-declare function base64Encode(data: Uint8Array<ArrayBuffer> | string): string;
-declare function base64UrlEncode(data: Uint8Array<ArrayBuffer> | string): string;
-declare function base64Decode(str: string | undefined): string;
-declare function base64Decode<T extends boolean | undefined>(str?: string | undefined, toString?: T): T extends false ? Uint8Array<ArrayBuffer> : string;
-declare function base64UrlDecode(str: string | undefined): string;
-declare function base64UrlDecode<T extends boolean | undefined>(str?: string | undefined, toString?: T): T extends false ? Uint8Array<ArrayBuffer> : string;
-declare function randomBytes(length: Readonly<number>): Uint8Array<ArrayBuffer>;
-/**
- * Concatenates multiple Uint8Arrays
- * @param arrays Arrays to concatenate
- * @returns Concatenated array
- */
-declare function concatUint8Arrays(...arrays: Readonly<Uint8Array<ArrayBuffer>[]>): Uint8Array<ArrayBuffer>;
-declare function maybeArray<T>(item: T | T[]): T[];
-declare function isJWK(key: any): key is JWK;
-declare function isJWKSet(key: any): key is JWKSet;
-declare function assertCryptoKey(key: unknown): asserts key is CryptoKey;
-declare function isCryptoKey(key: unknown): key is CryptoKey;
-declare const isCryptoKeyPair: (key: any) => key is CryptoKeyPair;
-/** Returns true if the JWK is a symmetric (oct) key. */
-declare function isSymmetricJWK(key: unknown): key is Extract<JWK, JWK_oct>;
-/** Returns true if the JWK is an asymmetric (RSA, EC, OKP) key. */
-declare function isAsymmetricJWK(key: unknown): key is Exclude<JWK, JWK_oct>;
-/**
- * Type guard that checks if the provided JWK contains private key material.
- * It relies purely on the presence of private components (e.g. "d"), not on the alg value.
- */
-declare function isPrivateJWK(key: unknown): key is JWK_Private;
-/**
- * Type guard that checks if the provided JWK is a public (asymmetric) key.
- * This checks for the presence of public components and absence of private material.
- */
-declare function isPublicJWK(key: unknown): key is JWK_Public;
-
-declare const index_StrictOmit: typeof StrictOmit;
-declare const index_applyTypCtyDefaults: typeof applyTypCtyDefaults;
-declare const index_assertCryptoKey: typeof assertCryptoKey;
-declare const index_base64Decode: typeof base64Decode;
-declare const index_base64Encode: typeof base64Encode;
-declare const index_base64UrlDecode: typeof base64UrlDecode;
-declare const index_base64UrlEncode: typeof base64UrlEncode;
-declare const index_computeExpiresInSeconds: typeof computeExpiresInSeconds;
-declare const index_computeJwtTimeClaims: typeof computeJwtTimeClaims;
-declare const index_computeMaxTokenAgeSeconds: typeof computeMaxTokenAgeSeconds;
-declare const index_concatUint8Arrays: typeof concatUint8Arrays;
-declare const index_decodeMaybeJWTString: typeof decodeMaybeJWTString;
-declare const index_decodePayloadFromB64UrlSegment: typeof decodePayloadFromB64UrlSegment;
-declare const index_decodePayloadFromBytes: typeof decodePayloadFromBytes;
-declare const index_getPlaintextBytes: typeof getPlaintextBytes;
-declare const index_isAsymmetricJWK: typeof isAsymmetricJWK;
-declare const index_isCryptoKey: typeof isCryptoKey;
-declare const index_isCryptoKeyPair: typeof isCryptoKeyPair;
-declare const index_isJWK: typeof isJWK;
-declare const index_isJWKSet: typeof isJWKSet;
-declare const index_isJWTContent: typeof isJWTContent;
-declare const index_isPrivateJWK: typeof isPrivateJWK;
-declare const index_isPublicJWK: typeof isPublicJWK;
-declare const index_isSymmetricJWK: typeof isSymmetricJWK;
-declare const index_maybeArray: typeof maybeArray;
-declare const index_randomBytes: typeof randomBytes;
-declare const index_sanitizeObject: typeof sanitizeObject;
-declare const index_textDecoder: typeof textDecoder;
-declare const index_textEncoder: typeof textEncoder;
-declare const index_validateCriticalHeadersJWE: typeof validateCriticalHeadersJWE;
-declare const index_validateCriticalHeadersJWS: typeof validateCriticalHeadersJWS;
-declare const index_validateJwtClaims: typeof validateJwtClaims;
-declare namespace index {
-  export {
-    index_StrictOmit as StrictOmit,
-    index_applyTypCtyDefaults as applyTypCtyDefaults,
-    index_assertCryptoKey as assertCryptoKey,
-    index_base64Decode as base64Decode,
-    index_base64Encode as base64Encode,
-    index_base64UrlDecode as base64UrlDecode,
-    index_base64UrlEncode as base64UrlEncode,
-    index_computeExpiresInSeconds as computeExpiresInSeconds,
-    index_computeJwtTimeClaims as computeJwtTimeClaims,
-    index_computeMaxTokenAgeSeconds as computeMaxTokenAgeSeconds,
-    index_concatUint8Arrays as concatUint8Arrays,
-    index_decodeMaybeJWTString as decodeMaybeJWTString,
-    index_decodePayloadFromB64UrlSegment as decodePayloadFromB64UrlSegment,
-    index_decodePayloadFromBytes as decodePayloadFromBytes,
-    index_getPlaintextBytes as getPlaintextBytes,
-    index_isAsymmetricJWK as isAsymmetricJWK,
-    index_isCryptoKey as isCryptoKey,
-    index_isCryptoKeyPair as isCryptoKeyPair,
-    index_isJWK as isJWK,
-    index_isJWKSet as isJWKSet,
-    index_isJWTContent as isJWTContent,
-    index_isPrivateJWK as isPrivateJWK,
-    index_isPublicJWK as isPublicJWK,
-    index_isSymmetricJWK as isSymmetricJWK,
-    index_maybeArray as maybeArray,
-    index_randomBytes as randomBytes,
-    index_sanitizeObject as sanitizeObject,
-    index_textDecoder as textDecoder,
-    index_textEncoder as textEncoder,
-    index_validateCriticalHeadersJWE as validateCriticalHeadersJWE,
-    index_validateCriticalHeadersJWS as validateCriticalHeadersJWS,
-    index_validateJwtClaims as validateJwtClaims,
-  };
-}
-
-export { computeMaxTokenAgeSeconds as A, computeJwtTimeClaims as B, validateJwtClaims as C, validateCriticalHeadersJWS as D, validateCriticalHeadersJWE as E, sanitizeObject as F, textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, isJWKSet as h, index as i, assertCryptoKey as j, isCryptoKey as k, isCryptoKeyPair as l, maybeArray as m, isSymmetricJWK as n, isAsymmetricJWK as o, isPrivateJWK as p, isPublicJWK as q, randomBytes as r, applyTypCtyDefaults as s, textEncoder as t, isJWTContent as u, decodeMaybeJWTString as v, decodePayloadFromBytes as w, decodePayloadFromB64UrlSegment as x, getPlaintextBytes as y, computeExpiresInSeconds as z };

package/dist/shared/unjwt.D0_ccT7g.d.mts

@@ -1,166 +0,0 @@
-import { X as JWTClaims, r as JWK_Symmetric, u as JWK_Private, t as JWK_Public, w as JWKSet, C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, H as JWK_AES_CBC_HMAC, I as JWK_AES_GCM, L as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, Z as JWTClaimValidationOptions, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './unjwt.BCi3FEWr.mjs';
-import { c as JWSSignOptions, J as JWSAlgorithm, f as JWSKeyLookupFunction, e as JWSVerifyOptions, d as JWSVerifyResult, a as JWSHeaderParameters, b as JWSProtectedHeader } from './unjwt.BqdNUKDr.mjs';
-
-/**
- * Creates a JWS (JSON Web Signature) in Compact Serialization format.
- *
- * @param payload The payload to sign. Can be a string, Uint8Array, or an object (which will be JSON stringified).
- * @param key The signing key (CryptoKey, JWK, or raw symmetric key as Uint8Array).
- * @param options Signing options, including the algorithm (`alg`) and protected header parameters.
- * @returns A Promise resolving to the JWS Compact Serialization string.
- */
-declare function sign(payload: JWTClaims, key: JWK_Symmetric | JWK_Private, options?: JWSSignOptions): Promise<string>;
-declare function sign(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: JWK_Symmetric | JWK_Private, options?: JWSSignOptions): Promise<string>;
-declare function sign(payload: JWTClaims, key: CryptoKey, options: JWSSignOptions & {
-    alg: JWSAlgorithm;
-}): Promise<string>;
-declare function sign(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: CryptoKey, options: JWSSignOptions & {
-    alg: JWSAlgorithm;
-}): Promise<string>;
-declare function sign(payload: JWTClaims, key: Uint8Array<ArrayBuffer>, options: JWSSignOptions & {
-    alg: JWSAlgorithm;
-}): Promise<string>;
-declare function sign(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: Uint8Array<ArrayBuffer>, options: JWSSignOptions & {
-    alg: JWSAlgorithm;
-}): Promise<string>;
-declare function sign(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: CryptoKey | JWK_Symmetric | JWK_Private | Uint8Array<ArrayBuffer>, options: JWSSignOptions & {
-    alg: JWSAlgorithm;
-}): Promise<string>;
-/**
- * Verifies a JWS (JSON Web Signature) in Compact Serialization format.
- *
- * @param jws The JWS Compact Serialization string.
- * @param key The verification key (CryptoKey, JWK, JWKSet, raw symmetric key as Uint8Array, or a function resolving the key or set).
- * @param options Verification options, such as allowed algorithms.
- * @returns A Promise resolving to an object containing the verified payload and protected header.
- * @throws If the JWS is invalid, signature verification fails, or options are not met.
- */
-declare function verify<T extends JWTClaims | Uint8Array<ArrayBuffer> | string>(jws: string, key: CryptoKey | JWK_Symmetric | JWK_Public | JWKSet | Uint8Array<ArrayBuffer> | JWSKeyLookupFunction, options?: JWSVerifyOptions): Promise<JWSVerifyResult<T>>;
-declare function verify(jws: string, key: CryptoKey | JWK_Symmetric | JWK_Public | JWKSet | Uint8Array<ArrayBuffer> | JWSKeyLookupFunction, options: JWSVerifyOptions & {
-    forceUint8Array: true;
-}): Promise<JWSVerifyResult<Uint8Array<ArrayBuffer>>>;
-
-declare const jws_CompositeKey: typeof CompositeKey;
-declare const jws_ContentEncryptionAlgorithm: typeof ContentEncryptionAlgorithm;
-declare const jws_DeriveKeyOptions: typeof DeriveKeyOptions;
-declare const jws_DeriveKeyReturn: typeof DeriveKeyReturn;
-declare const jws_GenerateJWKOptions: typeof GenerateJWKOptions;
-declare const jws_GenerateJWKReturn: typeof GenerateJWKReturn;
-declare const jws_GenerateKeyAlgorithm: typeof GenerateKeyAlgorithm;
-declare const jws_GenerateKeyOptions: typeof GenerateKeyOptions;
-declare const jws_GenerateKeyReturn: typeof GenerateKeyReturn;
-declare const jws_JWK: typeof JWK;
-declare const jws_JWKAlgorithm: typeof JWKAlgorithm;
-declare const jws_JWKPEMAlgorithm: typeof JWKPEMAlgorithm;
-declare const jws_JWKParameters: typeof JWKParameters;
-declare const jws_JWKSet: typeof JWKSet;
-declare const jws_JWK_AES_CBC_HMAC: typeof JWK_AES_CBC_HMAC;
-declare const jws_JWK_AES_GCM: typeof JWK_AES_GCM;
-declare const jws_JWK_AES_GCM_KW: typeof JWK_AES_GCM_KW;
-declare const jws_JWK_AES_KW: typeof JWK_AES_KW;
-declare const jws_JWK_Asymmetric: typeof JWK_Asymmetric;
-declare const jws_JWK_Asymmetric_Algorithm: typeof JWK_Asymmetric_Algorithm;
-declare const jws_JWK_EC: typeof JWK_EC;
-declare const jws_JWK_ECDH_ES: typeof JWK_ECDH_ES;
-declare const jws_JWK_ECDSA: typeof JWK_ECDSA;
-declare const jws_JWK_EC_Private: typeof JWK_EC_Private;
-declare const jws_JWK_EC_Public: typeof JWK_EC_Public;
-declare const jws_JWK_HMAC: typeof JWK_HMAC;
-declare const jws_JWK_OKP: typeof JWK_OKP;
-declare const jws_JWK_OKP_Private: typeof JWK_OKP_Private;
-declare const jws_JWK_OKP_Public: typeof JWK_OKP_Public;
-declare const jws_JWK_OKP_SIGN: typeof JWK_OKP_SIGN;
-declare const jws_JWK_PBES2: typeof JWK_PBES2;
-declare const jws_JWK_Private: typeof JWK_Private;
-declare const jws_JWK_Public: typeof JWK_Public;
-declare const jws_JWK_RSA: typeof JWK_RSA;
-declare const jws_JWK_RSA_ENC: typeof JWK_RSA_ENC;
-declare const jws_JWK_RSA_PSS: typeof JWK_RSA_PSS;
-declare const jws_JWK_RSA_Private: typeof JWK_RSA_Private;
-declare const jws_JWK_RSA_Public: typeof JWK_RSA_Public;
-declare const jws_JWK_RSA_SIGN: typeof JWK_RSA_SIGN;
-declare const jws_JWK_Symmetric: typeof JWK_Symmetric;
-declare const jws_JWK_Symmetric_Algorithm: typeof JWK_Symmetric_Algorithm;
-declare const jws_JWK_oct: typeof JWK_oct;
-declare const jws_JWSAlgorithm: typeof JWSAlgorithm;
-declare const jws_JWSHeaderParameters: typeof JWSHeaderParameters;
-declare const jws_JWSKeyLookupFunction: typeof JWSKeyLookupFunction;
-declare const jws_JWSProtectedHeader: typeof JWSProtectedHeader;
-declare const jws_JWSSignOptions: typeof JWSSignOptions;
-declare const jws_JWSVerifyOptions: typeof JWSVerifyOptions;
-declare const jws_JWSVerifyResult: typeof JWSVerifyResult;
-declare const jws_JWT: typeof JWT;
-declare const jws_JWTClaimValidationOptions: typeof JWTClaimValidationOptions;
-declare const jws_JWTClaims: typeof JWTClaims;
-declare const jws_JoseHeaderParameters: typeof JoseHeaderParameters;
-declare const jws_KeyManagementAlgorithm: typeof KeyManagementAlgorithm;
-declare const jws_UnwrapKeyOptions: typeof UnwrapKeyOptions;
-declare const jws_WrapKeyOptions: typeof WrapKeyOptions;
-declare const jws_WrapKeyResult: typeof WrapKeyResult;
-declare const jws_sign: typeof sign;
-declare const jws_verify: typeof verify;
-declare namespace jws {
-  export {
-    jws_CompositeKey as CompositeKey,
-    jws_ContentEncryptionAlgorithm as ContentEncryptionAlgorithm,
-    jws_DeriveKeyOptions as DeriveKeyOptions,
-    jws_DeriveKeyReturn as DeriveKeyReturn,
-    jws_GenerateJWKOptions as GenerateJWKOptions,
-    jws_GenerateJWKReturn as GenerateJWKReturn,
-    jws_GenerateKeyAlgorithm as GenerateKeyAlgorithm,
-    jws_GenerateKeyOptions as GenerateKeyOptions,
-    jws_GenerateKeyReturn as GenerateKeyReturn,
-    jws_JWK as JWK,
-    jws_JWKAlgorithm as JWKAlgorithm,
-    jws_JWKPEMAlgorithm as JWKPEMAlgorithm,
-    jws_JWKParameters as JWKParameters,
-    jws_JWKSet as JWKSet,
-    jws_JWK_AES_CBC_HMAC as JWK_AES_CBC_HMAC,
-    jws_JWK_AES_GCM as JWK_AES_GCM,
-    jws_JWK_AES_GCM_KW as JWK_AES_GCM_KW,
-    jws_JWK_AES_KW as JWK_AES_KW,
-    jws_JWK_Asymmetric as JWK_Asymmetric,
-    jws_JWK_Asymmetric_Algorithm as JWK_Asymmetric_Algorithm,
-    jws_JWK_EC as JWK_EC,
-    jws_JWK_ECDH_ES as JWK_ECDH_ES,
-    jws_JWK_ECDSA as JWK_ECDSA,
-    jws_JWK_EC_Private as JWK_EC_Private,
-    jws_JWK_EC_Public as JWK_EC_Public,
-    jws_JWK_HMAC as JWK_HMAC,
-    jws_JWK_OKP as JWK_OKP,
-    jws_JWK_OKP_Private as JWK_OKP_Private,
-    jws_JWK_OKP_Public as JWK_OKP_Public,
-    jws_JWK_OKP_SIGN as JWK_OKP_SIGN,
-    jws_JWK_PBES2 as JWK_PBES2,
-    jws_JWK_Private as JWK_Private,
-    jws_JWK_Public as JWK_Public,
-    jws_JWK_RSA as JWK_RSA,
-    jws_JWK_RSA_ENC as JWK_RSA_ENC,
-    jws_JWK_RSA_PSS as JWK_RSA_PSS,
-    jws_JWK_RSA_Private as JWK_RSA_Private,
-    jws_JWK_RSA_Public as JWK_RSA_Public,
-    jws_JWK_RSA_SIGN as JWK_RSA_SIGN,
-    jws_JWK_Symmetric as JWK_Symmetric,
-    jws_JWK_Symmetric_Algorithm as JWK_Symmetric_Algorithm,
-    jws_JWK_oct as JWK_oct,
-    jws_JWSAlgorithm as JWSAlgorithm,
-    jws_JWSHeaderParameters as JWSHeaderParameters,
-    jws_JWSKeyLookupFunction as JWSKeyLookupFunction,
-    jws_JWSProtectedHeader as JWSProtectedHeader,
-    jws_JWSSignOptions as JWSSignOptions,
-    jws_JWSVerifyOptions as JWSVerifyOptions,
-    jws_JWSVerifyResult as JWSVerifyResult,
-    jws_JWT as JWT,
-    jws_JWTClaimValidationOptions as JWTClaimValidationOptions,
-    jws_JWTClaims as JWTClaims,
-    jws_JoseHeaderParameters as JoseHeaderParameters,
-    jws_KeyManagementAlgorithm as KeyManagementAlgorithm,
-    jws_UnwrapKeyOptions as UnwrapKeyOptions,
-    jws_WrapKeyOptions as WrapKeyOptions,
-    jws_WrapKeyResult as WrapKeyResult,
-    jws_sign as sign,
-    jws_verify as verify,
-  };
-}
-
-export { jws as j, sign as s, verify as v };

package/dist/shared/unjwt.DdLN9vwI.mjs

@@ -1,163 +0,0 @@
-import { i as importKey, s as sign$1, b as getJWKFromSet, v as verify$1 } from './unjwt.Dpl__ZAR.mjs';
-import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, l as textDecoder, e as base64UrlDecode, m as isJWKSet, n as decodePayloadFromB64UrlSegment, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './unjwt.Be8NxwFK.mjs';
-
-async function sign(payload, key, options = {}) {
-  const { protectedHeader: additionalProtectedHeader } = options;
-  const safeAdditionalHeader = sanitizeObject(
-    additionalProtectedHeader
-  );
-  let { alg } = options;
-  if (!alg) {
-    if (isJWK(key) && key.alg) {
-      alg = key.alg;
-    } else {
-      throw new TypeError('JWS "alg" (Algorithm) must be provided in options');
-    }
-  }
-  validateKeyLength(key, alg);
-  const signingKey = await importKey(key, alg);
-  const protectedHeader = {
-    ...safeAdditionalHeader,
-    ...isJWK(key) && key.kid ? { kid: key.kid } : {},
-    // Include kid if available
-    alg,
-    typ: safeAdditionalHeader?.typ
-  };
-  applyTypCtyDefaults(protectedHeader, payload);
-  if (protectedHeader.b64 === true) {
-    delete protectedHeader.b64;
-  }
-  const computedPayload = computeJwtTimeClaims(
-    payload,
-    protectedHeader.typ,
-    options.expiresIn,
-    options.currentDate
-  );
-  const protectedHeaderString = JSON.stringify(protectedHeader);
-  const protectedHeaderEncoded = base64UrlEncode(protectedHeaderString);
-  let payloadBytes;
-  if (payload instanceof Uint8Array) {
-    payloadBytes = payload;
-  } else if (typeof payload === "string") {
-    payloadBytes = textEncoder.encode(payload);
-  } else if (typeof payload === "object" && payload !== null) {
-    payloadBytes = textEncoder.encode(
-      JSON.stringify(computedPayload || payload)
-    );
-  } else {
-    throw new TypeError(
-      "Payload must be a string, Uint8Array, or a JSON-serializable object."
-    );
-  }
-  const useB64 = protectedHeader.b64 !== false;
-  const payloadEncoded = useB64 ? base64UrlEncode(payloadBytes) : textDecoder.decode(payloadBytes);
-  const signingInputString = `${protectedHeaderEncoded}.${payloadEncoded}`;
-  const signingInputBytes = textEncoder.encode(signingInputString);
-  const signatureBytes = await sign$1(alg, signingKey, signingInputBytes);
-  const signatureEncoded = base64UrlEncode(signatureBytes);
-  return `${signingInputString}.${signatureEncoded}`;
-}
-async function verify(jws, key, options = {}) {
-  const parts = jws.split(".");
-  if (parts.length !== 3) {
-    throw new Error("Invalid JWS: Must contain three parts separated by dots.");
-  }
-  const [protectedHeaderEncoded, payloadEncoded, signatureEncoded] = parts;
-  let protectedHeader;
-  try {
-    const protectedHeaderString = base64UrlDecode(protectedHeaderEncoded);
-    protectedHeader = sanitizeObject(
-      JSON.parse(protectedHeaderString)
-    );
-  } catch (error_) {
-    throw new Error(
-      `Invalid JWS: Protected header is not valid Base64URL or JSON (${error_ instanceof Error ? error_.message : error_})`
-    );
-  }
-  if (!protectedHeader || typeof protectedHeader !== "object" || !protectedHeader.alg) {
-    throw new Error(
-      'Invalid JWS: Protected header must be an object with an "alg" property.'
-    );
-  }
-  const alg = protectedHeader.alg;
-  if (options.algorithms && !options.algorithms.includes(alg)) {
-    throw new Error(`Algorithm not allowed: ${alg}`);
-  }
-  if (options.typ && protectedHeader.typ !== options.typ) {
-    throw new Error(
-      `Invalid JWS: "typ" (Type) Header Parameter mismatch. Expected "${options.typ}", got "${protectedHeader.typ}".`
-    );
-  }
-  let signatureBytes;
-  try {
-    signatureBytes = base64UrlDecode(signatureEncoded, false);
-  } catch (error_) {
-    throw new Error(
-      `Invalid JWS: Signature is not valid Base64URL (${error_ instanceof Error ? error_.message : error_})`
-    );
-  }
-  const keyInput = typeof key === "function" ? await key(protectedHeader, jws) : key;
-  const resolvedKey = isJWKSet(keyInput) ? getJWKFromSet(keyInput, protectedHeader) : keyInput;
-  const verificationKey = await importKey(resolvedKey, alg);
-  const signingInputString = `${protectedHeaderEncoded}.${payloadEncoded}`;
-  const signingInputBytes = textEncoder.encode(signingInputString);
-  const isValid = await verify$1(
-    alg,
-    verificationKey,
-    signatureBytes,
-    signingInputBytes
-  );
-  if (!isValid) {
-    throw new Error("JWS signature verification failed.");
-  }
-  const useB64 = protectedHeader.b64 !== false;
-  let payload;
-  try {
-    payload = useB64 ? decodePayloadFromB64UrlSegment(
-      payloadEncoded,
-      protectedHeader,
-      options.forceUint8Array
-    ) : options.forceUint8Array ? textEncoder.encode(payloadEncoded) : payloadEncoded;
-  } catch (error_) {
-    throw new Error(
-      `Invalid JWS: Payload decoding failed (${error_ instanceof Error ? error_.message : error_})`
-    );
-  }
-  validateCriticalHeadersJWS(protectedHeader, [
-    ...options.critical || [],
-    ...options.requiredHeaders || []
-  ]);
-  if (payload && typeof payload === "object" && options.validateJWT !== false && (options.validateJWT === true || protectedHeader.typ?.toLowerCase().includes("jwt")) && !options.forceUint8Array && !(payload instanceof Uint8Array)) {
-    validateJwtClaims(payload, options);
-  }
-  return {
-    payload,
-    protectedHeader
-  };
-}
-function validateKeyLength(key, alg) {
-  if (!alg || isJWK(key)) return;
-  if (alg.startsWith("HS") && key instanceof Uint8Array) {
-    const algLength = Number.parseInt(alg.slice(2)) / 8;
-    if (key.length < algLength) {
-      throw new TypeError(
-        `${alg} requires key length to be ${algLength} bytes or larger`
-      );
-    }
-  } else if ((alg.startsWith("RS") || alg.startsWith("PS")) && key instanceof CryptoKey) {
-    const { modulusLength } = key.algorithm;
-    if (typeof modulusLength !== "number" || modulusLength < 2048) {
-      throw new TypeError(
-        `${alg} requires key modulusLength to be 2048 bits or larger`
-      );
-    }
-  }
-}
-
-const jws = {
-  __proto__: null,
-  sign: sign,
-  verify: verify
-};
-
-export { jws as j, sign as s, verify as v };