unjwt 0.5.39 → 0.6.0

package/dist/adapters/{h3v2.mjs → h3v2/index.mjs}

@@ -1,9 +1,8 @@
-import { a as deriveJWKFromPassword, c as importJWKFromPEM, d as isSymmetricJWK, f as computeExpiresInSeconds, i as encrypt, l as isPrivateJWK, n as verify, o as exportJWKToPEM, r as decrypt, s as generateJWK, t as sign, u as isPublicJWK } from "../_chunks/jws.mjs";
+import { a as deriveJWKFromPassword, c as importFromPEM, d as isSymmetricJWK, f as computeExpiresInSeconds, i as encrypt, l as isPrivateJWK, m as isJWTError, n as verify, o as exportToPEM, p as JWTError, r as decrypt, s as generateJWK, t as sign, u as isPublicJWK } from "../../_chunks/jws.mjs";
 import { getChunkedCookie, getEventContext, setChunkedCookie } from "h3";
 import { NullProtoObj } from "rou3";
 //#region src/adapters/h3v2/session/jwe.ts
 const kGetSessionPromise$1 = Symbol("h3_jwe_getSession");
-const kSessionToken$1 = Symbol("h3_jwe_sessionToken");
 const DEFAULT_NAME$1 = "h3-jwe";
 const DEFAULT_COOKIE$1 = {
 	path: "/",
@@ -30,7 +29,7 @@ async function useJWESession(event, config) {
 			return getSessionFromContext$1(event, sessionName)?.data || {};
 		},
 		get token() {
-			return getSessionFromContext$1(event, sessionName)?.[kSessionToken$1] ?? getJWESessionToken(event, config);
+			return getSessionFromContext$1(event, sessionName)?.token ?? getJWESessionToken(event, config);
 		},
 		update: async (update) => {
 			await updateJWESession(event, config, update);
@@ -58,17 +57,44 @@ async function getJWESession(event, config) {
 		* unless we have a read-only event in which case we just return it as it was valid at the time of reading
 		* the cookie/header (like in a websocket upgrade)
 		*/
-		if (session.expiresAt !== void 0 && session.expiresAt < Date.now() && hasWritableResponse$1(event)) {
+		if (session.expiresAt !== void 0 && session.expiresAt < Date.now()) {
 			await config.hooks?.onExpire?.({
+				session: {
+					id: session.id,
+					createdAt: session.createdAt,
+					expiresAt: session.expiresAt,
+					token: session.token
+				},
 				event,
-				error: /* @__PURE__ */ new Error(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(session.expiresAt * 1e3)).toISOString()})`),
+				error: new JWTError(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(session.expiresAt * 1e3)).toISOString()})`, "ERR_JWT_EXPIRED", {
+					jti: session.id,
+					exp: session.expiresAt / 1e3
+				}),
 				config
 			});
-			return clearJWESession(event, config).then(() => getJWESession(event, config));
+			delete context.sessions[sessionName];
+			if (config.cookie !== false) if (hasWritableResponse$1(event)) setChunkedCookie(event, sessionName, "", {
+				...DEFAULT_COOKIE$1,
+				...config.cookie,
+				expires: /* @__PURE__ */ new Date(0),
+				maxAge: void 0
+			});
+			else console.warn("[unjwt/h3] Session expired but cookie cannot be cleared on a read-only event.");
+			const freshNow = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
+			const freshCreatedAt = freshNow - freshNow % 1e3;
+			const freshSession = {
+				id: void 0,
+				createdAt: freshCreatedAt,
+				expiresAt: config.maxAge === void 0 ? void 0 : freshCreatedAt + computeExpiresInSeconds(config.maxAge) * 1e3,
+				data: new NullProtoObj(),
+				token: void 0
+			};
+			context.sessions[sessionName] = freshSession;
+			return freshSession;
 		}
-		await config.hooks?.onRead?.({
-			event,
+		if (session.id !== void 0 && session.token !== void 0) await config.hooks?.onRead?.({
 			session,
+			event,
 			config
 		});
 		return session;
@@ -79,25 +105,29 @@ async function getJWESession(event, config) {
 		id: void 0,
 		createdAt,
 		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3,
-		data: new NullProtoObj()
+		data: new NullProtoObj(),
+		token: void 0
 	};
 	context.sessions[sessionName] = session;
 	const token = getJWESessionToken(event, config);
+	let exclusiveHookFired = false;
 	if (token) {
-		session[kSessionToken$1] = token;
+		session.token = token;
 		const promise = unsealJWESession(event, config, token).catch(async (error_) => {
-			if (error_ instanceof Error) {
-				const message = error_.message;
-				if (message.includes("Token has expired") || message.includes("Token is too old")) {
-					await config.hooks?.onExpire?.({
-						event,
-						error: error_,
-						config
-					});
-					return;
-				}
-			}
-			await config.hooks?.onError?.({
+			exclusiveHookFired = true;
+			if (isJWTError(error_, "ERR_JWT_EXPIRED")) await config.hooks?.onExpire?.({
+				session: {
+					id: error_.cause.jti,
+					createdAt: error_.cause.iat ? error_.cause.iat * 1e3 : void 0,
+					expiresAt: error_.cause.exp ? error_.cause.exp * 1e3 : void 0,
+					token
+				},
+				event,
+				error: error_,
+				config
+			});
+			else await config.hooks?.onError?.({
+				session,
 				event,
 				error: error_,
 				config
@@ -110,9 +140,9 @@ async function getJWESession(event, config) {
 		session[kGetSessionPromise$1] = promise;
 		await promise;
 	}
-	await config.hooks?.onRead?.({
-		event,
+	if (!exclusiveHookFired && session.id !== void 0 && session.token !== void 0) await config.hooks?.onRead?.({
 		session,
+		event,
 		config
 	});
 	return session;
@@ -136,22 +166,16 @@ function getJWESessionToken(event, config) {
 * Update the session data for the current request.
 */
 async function updateJWESession(event, config, update) {
+	const canWriteCookie = hasWritableResponse$1(event);
+	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot update session on read-only event.");
 	const sessionName = config.name || DEFAULT_NAME$1;
 	const session = getEventContext(event).sessions?.[sessionName] || await getJWESession(event, config);
 	if (typeof update === "function") update = update(session.data);
-	if (update) {
-		const oldSession = {
-			...session,
-			data: { ...session.data }
-		};
-		Object.assign(session.data, update);
-		await config.hooks?.onUpdate?.({
-			oldSession,
-			session,
-			event,
-			config
-		});
-	}
+	const oldSession = {
+		...session,
+		data: { ...session.data }
+	};
+	if (update) Object.assign(session.data, update);
 	const now = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
 	const createdAt = now - now % 1e3;
 	Object.assign(session, {
@@ -159,15 +183,36 @@ async function updateJWESession(event, config, update) {
 		createdAt,
 		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3
 	});
-	if (config.cookie !== false && hasWritableResponse$1(event)) {
-		const sealed = await sealJWESession(event, config);
-		session[kSessionToken$1] = sealed;
-		setChunkedCookie(event, sessionName, sealed, {
-			...DEFAULT_COOKIE$1,
-			expires: config.maxAge === void 0 ? void 0 : new Date(session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3),
-			...config.cookie
+	let sealed;
+	try {
+		sealed = await sealJWESession(event, config);
+	} catch (error_) {
+		Object.assign(session, {
+			id: oldSession.id,
+			createdAt: oldSession.createdAt,
+			expiresAt: oldSession.expiresAt
 		});
+		session.token = oldSession.token;
+		await config.hooks?.onError?.({
+			session,
+			event,
+			error: error_,
+			config
+		});
+		throw error_;
 	}
+	session.token = sealed;
+	if (config.cookie !== false && canWriteCookie) setChunkedCookie(event, sessionName, sealed, {
+		...DEFAULT_COOKIE$1,
+		expires: config.maxAge === void 0 ? void 0 : new Date(session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3),
+		...config.cookie
+	});
+	await config.hooks?.onUpdate?.({
+		session,
+		oldSession,
+		event,
+		config
+	});
 	return session;
 }
 /**
@@ -224,7 +269,7 @@ async function unsealJWESession(event, config, sealed) {
 		unwrappedKeyAlgorithm: void 0,
 		keyUsage: void 0,
 		forceUint8Array: false,
-		validateJWT: true
+		validateClaims: true
 	}).catch((error_) => {
 		if (error_ instanceof Error) throw error_;
 		throw new Error(String(error_));
@@ -241,24 +286,28 @@ async function unsealJWESession(event, config, sealed) {
 * Clear the session (delete from context and drop cookie).
 */
 async function clearJWESession(event, config) {
+	const canWriteCookie = hasWritableResponse$1(event);
+	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot clear session on read-only event.");
 	const context = getEventContext(event);
 	const sessionName = config.name || DEFAULT_NAME$1;
 	let session = context.sessions?.[sessionName];
 	if (session && session[kGetSessionPromise$1]) session = await session[kGetSessionPromise$1];
+	const oldSession = session ? {
+		...session,
+		data: { ...session.data }
+	} : void 0;
 	if (context.sessions?.[sessionName]) delete context.sessions[sessionName];
-	if (config.cookie !== false && hasWritableResponse$1(event)) {
-		setChunkedCookie(event, sessionName, "", {
-			...DEFAULT_COOKIE$1,
-			...config.cookie,
-			expires: /* @__PURE__ */ new Date(0),
-			maxAge: void 0
-		});
-		await config.hooks?.onClear?.({
-			session,
-			event,
-			config
-		});
-	}
+	if (config.cookie !== false && canWriteCookie) setChunkedCookie(event, sessionName, "", {
+		...DEFAULT_COOKIE$1,
+		...config.cookie,
+		expires: /* @__PURE__ */ new Date(0),
+		maxAge: void 0
+	});
+	await config.hooks?.onClear?.({
+		oldSession,
+		event,
+		config
+	});
 }
 function getSessionFromContext$1(event, sessionName) {
 	return getEventContext(event).sessions?.[sessionName];
@@ -293,7 +342,6 @@ function findSetCookie$1(setCookie, name) {
 //#endregion
 //#region src/adapters/h3v2/session/jws.ts
 const kGetSessionPromise = Symbol("h3_jws_getSession");
-const kSessionToken = Symbol("h3_jws_sessionToken");
 const DEFAULT_NAME = "h3-jws";
 const DEFAULT_COOKIE = {
 	path: "/",
@@ -317,7 +365,7 @@ async function useJWSSession(event, config) {
 			return getSessionFromContext(event, sessionName)?.data || {};
 		},
 		get token() {
-			return getSessionFromContext(event, sessionName)?.[kSessionToken] ?? getJWSSessionToken(event, config);
+			return getSessionFromContext(event, sessionName)?.token ?? getJWSSessionToken(event, config);
 		},
 		update: async (update) => {
 			await updateJWSSession(event, config, update);
@@ -337,17 +385,44 @@ async function getJWSSession(event, config) {
 	const existingSession = context.sessions[sessionName];
 	if (existingSession) {
 		const session = existingSession[kGetSessionPromise] ? await existingSession[kGetSessionPromise] : existingSession;
-		if (session.expiresAt !== void 0 && session.expiresAt < Date.now() && hasWritableResponse(event)) {
+		if (session.expiresAt !== void 0 && session.expiresAt < Date.now()) {
 			await config.hooks?.onExpire?.({
+				session: {
+					id: session.id,
+					createdAt: session.createdAt,
+					expiresAt: session.expiresAt,
+					token: session.token
+				},
 				event,
-				error: /* @__PURE__ */ new Error(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(session.expiresAt * 1e3)).toISOString()})`),
+				error: new JWTError(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(session.expiresAt * 1e3)).toISOString()})`, "ERR_JWT_EXPIRED", {
+					jti: session.id,
+					exp: session.expiresAt / 1e3
+				}),
 				config
 			});
-			return clearJWSSession(event, config).then(() => getJWSSession(event, config));
+			delete context.sessions[sessionName];
+			if (config.cookie !== false) if (hasWritableResponse(event)) setChunkedCookie(event, sessionName, "", {
+				...DEFAULT_COOKIE,
+				...config.cookie,
+				expires: /* @__PURE__ */ new Date(0),
+				maxAge: void 0
+			});
+			else console.warn("[unjwt/h3] Session expired but cookie cannot be cleared on a read-only event.");
+			const freshNow = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
+			const freshCreatedAt = freshNow - freshNow % 1e3;
+			const freshSession = {
+				id: void 0,
+				createdAt: freshCreatedAt,
+				expiresAt: config.maxAge === void 0 ? void 0 : freshCreatedAt + computeExpiresInSeconds(config.maxAge) * 1e3,
+				data: new NullProtoObj(),
+				token: void 0
+			};
+			context.sessions[sessionName] = freshSession;
+			return freshSession;
 		}
-		await config.hooks?.onRead?.({
-			event,
+		if (session.id !== void 0 && session.token !== void 0) await config.hooks?.onRead?.({
 			session,
+			event,
 			config
 		});
 		return session;
@@ -358,22 +433,29 @@ async function getJWSSession(event, config) {
 		id: void 0,
 		createdAt,
 		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3,
-		data: new NullProtoObj()
+		data: new NullProtoObj(),
+		token: void 0
 	};
 	context.sessions[sessionName] = session;
 	const token = getJWSSessionToken(event, config);
+	let exclusiveHookFired = false;
 	if (token) {
-		session[kSessionToken] = token;
+		session.token = token;
 		const promise = verifyJWSSession(event, config, token).catch(async (error_) => {
-			if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
-				await config.hooks?.onExpire?.({
-					event,
-					error: error_,
-					config
-				});
-				return;
-			}
-			await config.hooks?.onError?.({
+			exclusiveHookFired = true;
+			if (isJWTError(error_, "ERR_JWT_EXPIRED")) await config.hooks?.onExpire?.({
+				session: {
+					id: error_.cause.jti,
+					createdAt: error_.cause.iat ? error_.cause.iat * 1e3 : void 0,
+					expiresAt: error_.cause.exp ? error_.cause.exp * 1e3 : void 0,
+					token
+				},
+				event,
+				error: error_,
+				config
+			});
+			else await config.hooks?.onError?.({
+				session,
 				event,
 				error: error_,
 				config
@@ -386,9 +468,9 @@ async function getJWSSession(event, config) {
 		session[kGetSessionPromise] = promise;
 		await promise;
 	}
-	await config.hooks?.onRead?.({
-		event,
+	if (!exclusiveHookFired && session.id !== void 0 && session.token !== void 0) await config.hooks?.onRead?.({
 		session,
+		event,
 		config
 	});
 	return session;
@@ -409,22 +491,16 @@ function getJWSSessionToken(event, config) {
 	return token;
 }
 async function updateJWSSession(event, config, update) {
+	const canWriteCookie = hasWritableResponse(event);
+	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot update session on read-only event.");
 	const sessionName = config.name || DEFAULT_NAME;
 	const session = getEventContext(event).sessions?.[sessionName] || await getJWSSession(event, config);
 	if (typeof update === "function") update = update(session.data);
-	if (update) {
-		const oldSession = {
-			...session,
-			data: { ...session.data }
-		};
-		Object.assign(session.data, update);
-		await config.hooks?.onUpdate?.({
-			session,
-			oldSession,
-			event,
-			config
-		});
-	}
+	const oldSession = {
+		...session,
+		data: { ...session.data }
+	};
+	if (update) Object.assign(session.data, update);
 	const now = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
 	const createdAt = now - now % 1e3;
 	Object.assign(session, {
@@ -432,15 +508,36 @@ async function updateJWSSession(event, config, update) {
 		createdAt,
 		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3
 	});
-	if (config.cookie !== false && hasWritableResponse(event)) {
-		const token = await signJWSSession(event, config);
-		session[kSessionToken] = token;
-		setChunkedCookie(event, sessionName, token, {
-			...DEFAULT_COOKIE,
-			expires: config.maxAge === void 0 ? void 0 : new Date(session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3),
-			...config.cookie
+	let token;
+	try {
+		token = await signJWSSession(event, config);
+	} catch (error_) {
+		Object.assign(session, {
+			id: oldSession.id,
+			createdAt: oldSession.createdAt,
+			expiresAt: oldSession.expiresAt
+		});
+		session.token = oldSession.token;
+		await config.hooks?.onError?.({
+			session,
+			event,
+			error: error_,
+			config
 		});
+		throw error_;
 	}
+	session.token = token;
+	if (config.cookie !== false && canWriteCookie) setChunkedCookie(event, sessionName, token, {
+		...DEFAULT_COOKIE,
+		expires: config.maxAge === void 0 ? void 0 : new Date(session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3),
+		...config.cookie
+	});
+	await config.hooks?.onUpdate?.({
+		session,
+		oldSession,
+		event,
+		config
+	});
 	return session;
 }
 async function signJWSSession(event, config) {
@@ -487,8 +584,9 @@ async function verifyJWSSession(event, config, token) {
 		typ: typ || "JWT",
 		algorithms: alg ? [alg] : void 0,
 		forceUint8Array: false,
-		validateJWT: true
+		validateClaims: true
 	}).catch((error_) => {
+		if (isJWTError(error_, "ERR_JWT_EXPIRED")) throw error_;
 		const message = error_ instanceof Error ? error_.message : String(error_);
 		throw new Error(`Invalid session token: ${message}`);
 	});
@@ -501,24 +599,28 @@ async function verifyJWSSession(event, config, token) {
 	};
 }
 async function clearJWSSession(event, config) {
+	const canWriteCookie = hasWritableResponse(event);
+	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot clear session on read-only event.");
 	const context = getEventContext(event);
 	const sessionName = config.name || DEFAULT_NAME;
 	let session = context.sessions?.[sessionName];
 	if (session && session[kGetSessionPromise]) session = await session[kGetSessionPromise];
+	const oldSession = session ? {
+		...session,
+		data: { ...session.data }
+	} : void 0;
 	if (context.sessions?.[sessionName]) delete context.sessions[sessionName];
-	if (config.cookie !== false && hasWritableResponse(event)) {
-		setChunkedCookie(event, sessionName, "", {
-			...DEFAULT_COOKIE,
-			...config.cookie,
-			expires: /* @__PURE__ */ new Date(0),
-			maxAge: void 0
-		});
-		await config.hooks?.onClear?.({
-			session,
-			event,
-			config
-		});
-	}
+	if (config.cookie !== false && canWriteCookie) setChunkedCookie(event, sessionName, "", {
+		...DEFAULT_COOKIE,
+		...config.cookie,
+		expires: /* @__PURE__ */ new Date(0),
+		maxAge: void 0
+	});
+	await config.hooks?.onClear?.({
+		oldSession,
+		event,
+		config
+	});
 }
 function getSessionFromContext(event, sessionName) {
 	return getEventContext(event).sessions?.[sessionName];
@@ -558,4 +660,4 @@ function findSetCookie(setCookie, name) {
 	return match ? match[1] : void 0;
 }
 //#endregion
-export { clearJWESession, clearJWSSession, deriveJWKFromPassword, exportJWKToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, getJWSSessionToken, importJWKFromPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+export { clearJWESession, clearJWSSession, deriveJWKFromPassword, exportToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importFromPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };

package/dist/core/_crypto/index.d.mts

@@ -0,0 +1,71 @@
+import { A as JWK, o as JWEHeaderParameters, s as JWEKeyManagementHeaderParameters } from "../../_chunks/index.mjs";
+
+//#region src/core/_crypto/_sign-verify.d.ts
+declare function sign(alg: string, key: CryptoKey, data: Uint8Array<ArrayBuffer>): Promise<Uint8Array<ArrayBuffer>>;
+declare function verify(alg: string, key: CryptoKey, signature: Uint8Array<ArrayBuffer>, data: Uint8Array<ArrayBuffer>): Promise<boolean>;
+//#endregion
+//#region src/core/_crypto/_aes.d.ts
+declare function generateIV(alg: string): Uint8Array<ArrayBuffer>;
+declare function bitLengthCEK(alg: string): number;
+declare function generateCEK(alg: string): Uint8Array<ArrayBuffer>;
+declare function aesKwWrap(alg: string, key: CryptoKey | Uint8Array<ArrayBuffer>, cek: Uint8Array<ArrayBuffer>): Promise<Uint8Array<ArrayBuffer>>;
+declare function aesKwUnwrap(alg: string, key: CryptoKey | Uint8Array<ArrayBuffer>, encryptedKey: Uint8Array<ArrayBuffer>): Promise<Uint8Array<ArrayBuffer>>;
+declare function gcmkwEncrypt(alg: string, key: CryptoKey | Uint8Array<ArrayBuffer>, plaintext: Uint8Array<ArrayBuffer>, iv?: Uint8Array<ArrayBuffer>): Promise<{
+  encryptedKey: Uint8Array<ArrayBuffer>;
+  iv: string;
+  tag: string;
+}>;
+declare function gcmkwDecrypt(alg: string, key: CryptoKey | Uint8Array<ArrayBuffer>, ciphertext: Uint8Array<ArrayBuffer>, iv: Uint8Array<ArrayBuffer>, tag: Uint8Array<ArrayBuffer>): Promise<Uint8Array<ArrayBuffer>>;
+declare function encrypt(enc: string, plaintext: Uint8Array<ArrayBuffer>, cek: Uint8Array<ArrayBuffer> | CryptoKey, iv: Uint8Array<ArrayBuffer> | undefined, aad: Uint8Array<ArrayBuffer>): Promise<{
+  ciphertext: Uint8Array<ArrayBuffer>;
+  tag: Uint8Array<ArrayBuffer> | undefined;
+  iv: Uint8Array<ArrayBuffer> | undefined;
+}>;
+declare function decrypt(enc: string, cek: Uint8Array<ArrayBuffer> | CryptoKey, ciphertext: Uint8Array<ArrayBuffer>, iv: Uint8Array<ArrayBuffer> | undefined, tag: Uint8Array<ArrayBuffer> | undefined, aad: Uint8Array<ArrayBuffer>): Promise<Uint8Array<ArrayBuffer>>;
+//#endregion
+//#region src/core/_crypto/_key-encryption.d.ts
+declare function encryptKey(alg: string, enc: string, key: CryptoKey | Uint8Array<ArrayBuffer>, providedCek?: Uint8Array<ArrayBuffer>, providedParameters?: JWEKeyManagementHeaderParameters): Promise<{
+  cek: CryptoKey | Uint8Array<ArrayBuffer>;
+  encryptedKey?: Uint8Array<ArrayBuffer>;
+  parameters?: JWEHeaderParameters;
+}>;
+declare function normalizeKey(key: CryptoKey | JWK | Uint8Array<ArrayBuffer>, alg: string): Promise<CryptoKey | Uint8Array<ArrayBuffer>>;
+//#endregion
+//#region src/core/_crypto/_key-codec.d.ts
+declare function jwkTokey(jwk: JWK): Promise<CryptoKey>;
+declare function keyToJWK<T extends JWK>(key: Uint8Array<ArrayBuffer> | CryptoKey): Promise<T>;
+//#endregion
+//#region src/core/_crypto/_pbes2.d.ts
+declare function pbes2Wrap(alg: string, key: CryptoKey | Uint8Array<ArrayBuffer>, cek: Uint8Array<ArrayBuffer>, p2c: number, p2s: Uint8Array<ArrayBuffer>): Promise<{
+  encryptedKey: Uint8Array<ArrayBuffer>;
+  p2c: number;
+  p2s: string;
+}>;
+declare function pbes2Unwrap(alg: string, key: CryptoKey | Uint8Array<ArrayBuffer>, encryptedKey: Uint8Array<ArrayBuffer>, p2c: number, p2s: Uint8Array<ArrayBuffer>): Promise<Uint8Array<ArrayBuffer>>;
+declare function deriveKey(p2s: Uint8Array<ArrayBuffer>, alg: string, p2c: number, key: CryptoKey | Uint8Array<ArrayBuffer>): Promise<Uint8Array<ArrayBuffer>>;
+//#endregion
+//#region src/core/_crypto/_ecdh.d.ts
+declare function deriveECDHESKey(publicKey: CryptoKey, privateKey: CryptoKey, algorithm: string, keyLength: number, apu?: Uint8Array<ArrayBuffer>, apv?: Uint8Array<ArrayBuffer>): Promise<Uint8Array<ArrayBuffer>>;
+declare function isECDHKeyAllowed(key: CryptoKey): boolean;
+//#endregion
+//#region src/core/_crypto/_rsa.d.ts
+declare function encryptRSAES(alg: string, key: CryptoKey, cek: Uint8Array<ArrayBuffer>): Promise<Uint8Array<ArrayBuffer>>;
+declare function decryptRSAES(alg: string, key: CryptoKey, encryptedKey: Uint8Array<ArrayBuffer>): Promise<Uint8Array<ArrayBuffer>>;
+//#endregion
+//#region src/core/_crypto/_pem.d.ts
+/** Key Import Function options. */
+interface KeyImportOptions {
+  /**
+  * The value to use as {@link !SubtleCrypto.importKey} `extractable` argument. Default is false for
+  * private keys, true otherwise.
+  */
+  extractable?: boolean;
+}
+declare const toSPKI: (key: unknown) => Promise<string>;
+declare const toPKCS8: (key: unknown) => Promise<string>;
+declare const fromPKCS8: PEMImportFunction;
+declare const fromSPKI: PEMImportFunction;
+declare const fromX509: PEMImportFunction;
+type PEMImportFunction = (pem: string, alg: string, options?: KeyImportOptions) => Promise<CryptoKey>;
+//#endregion
+export { type KeyImportOptions, aesKwUnwrap, aesKwWrap, bitLengthCEK, decrypt, decryptRSAES, deriveECDHESKey, deriveKey as deriveKeyPBES2, encrypt, encryptKey, encryptRSAES, fromPKCS8, fromSPKI, fromX509, gcmkwDecrypt, gcmkwEncrypt, generateCEK, generateIV, isECDHKeyAllowed, jwkTokey, keyToJWK, normalizeKey, pbes2Unwrap, pbes2Wrap, sign, toPKCS8, toSPKI, verify };

package/dist/core/_crypto/index.mjs

@@ -0,0 +1,2 @@
+import { C as gcmkwEncrypt, D as verify, E as sign, S as gcmkwDecrypt, T as generateIV, _ as aesKwUnwrap, a as toSPKI, b as decrypt, c as deriveKey, d as deriveECDHESKey, f as isECDHKeyAllowed, g as keyToJWK, h as jwkTokey, i as toPKCS8, l as pbes2Unwrap, m as encryptRSAES, n as fromSPKI, o as encryptKey, p as decryptRSAES, r as fromX509, s as normalizeKey, t as fromPKCS8, u as pbes2Wrap, v as aesKwWrap, w as generateCEK, x as encrypt, y as bitLengthCEK } from "../../_chunks/_crypto.mjs";
+export { aesKwUnwrap, aesKwWrap, bitLengthCEK, decrypt, decryptRSAES, deriveECDHESKey, deriveKey as deriveKeyPBES2, encrypt, encryptKey, encryptRSAES, fromPKCS8, fromSPKI, fromX509, gcmkwDecrypt, gcmkwEncrypt, generateCEK, generateIV, isECDHKeyAllowed, jwkTokey, keyToJWK, normalizeKey, pbes2Unwrap, pbes2Wrap, sign, toPKCS8, toSPKI, verify };

package/dist/core/jwe.d.mts

@@ -0,0 +1,40 @@
+import { A as JWK, L as JWKSet, N as JWKLookupFunction, S as ContentEncryptionAlgorithm, a as JWEEncryptOptions, c as JWEProtectedHeader, g as JOSEPayload, i as JWEDecryptResult, nt as JWK_Private, o as JWEHeaderParameters, pt as KeyManagementAlgorithm, r as JWEDecryptOptions, s as JWEKeyManagementHeaderParameters, ut as JWK_Symmetric } from "../_chunks/index.mjs";
+import { i as isJWTError, n as JWTErrorCauseMap, r as JWTErrorCode, t as JWTError } from "../_chunks/error.mjs";
+
+//#region src/core/jwe.d.ts
+/**
+* Encrypts a payload to produce a JWE Compact Serialization string.
+*
+* @param payload The payload to encrypt. Can be a string, Uint8Array, or a JSON-serializable object.
+* @param key The key encryption key (KEK). Can be a CryptoKey, JWK, or for PBES2, a password string/Uint8Array.
+* @param options JWE encryption options, including `alg` (key management algorithm) and `enc` (content encryption algorithm).
+* @returns A Promise resolving to the JWE Compact Serialization string.
+*/
+declare function encrypt(payload: JOSEPayload, key: JWK | string | Uint8Array<ArrayBuffer>, options?: JWEEncryptOptions): Promise<string>;
+declare function encrypt(payload: JOSEPayload, key: CryptoKey | JWK_Symmetric | Uint8Array<ArrayBuffer>, options: JWEEncryptOptions & {
+  alg: "dir";
+  enc: ContentEncryptionAlgorithm;
+}): Promise<string>;
+declare function encrypt(payload: JOSEPayload, key: CryptoKey, options: JWEEncryptOptions & {
+  alg: KeyManagementAlgorithm;
+  enc: ContentEncryptionAlgorithm;
+}): Promise<string>;
+declare function encrypt(payload: JOSEPayload, key: CryptoKey | JWK | string | Uint8Array<ArrayBuffer>, options: JWEEncryptOptions & {
+  alg: KeyManagementAlgorithm;
+  enc: ContentEncryptionAlgorithm;
+}): Promise<string>;
+/**
+* Decrypts a JWE Compact Serialization string.
+*
+* @param jwe The JWE Compact Serialization string.
+* @param key The key decryption key (KEK) or a function to look up the key.
+* @param options JWE decryption options.
+* @returns A Promise resolving to an object containing the decrypted plaintext, protected header, CEK, and AAD.
+* @throws If JWE is invalid, decryption fails, or options are not met.
+*/
+declare function decrypt<T extends JOSEPayload>(jwe: string, key: CryptoKey | JWKSet | JWK_Private | JWK_Symmetric | string | Uint8Array<ArrayBuffer> | JWKLookupFunction, options?: JWEDecryptOptions): Promise<JWEDecryptResult<T>>;
+declare function decrypt(jwe: string, key: CryptoKey | JWKSet | JWK_Private | JWK_Symmetric | string | Uint8Array<ArrayBuffer> | JWKLookupFunction, options: JWEDecryptOptions & {
+  forceUint8Array: true;
+}): Promise<JWEDecryptResult<Uint8Array<ArrayBuffer>>>;
+//#endregion
+export { JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEProtectedHeader, JWTError, type JWTErrorCauseMap, type JWTErrorCode, decrypt, encrypt, isJWTError };