unjwt 0.5.40 → 0.6.0

package/dist/core/jws.d.mts

@@ -0,0 +1,31 @@
+import { L as JWKSet, N as JWKLookupFunction, d as JWSHeaderParameters, f as JWSProtectedHeader, g as JOSEPayload, h as JWSVerifyResult, m as JWSVerifyOptions, nt as JWK_Private, p as JWSSignOptions, rt as JWK_Public, u as JWSAlgorithm, ut as JWK_Symmetric } from "../_chunks/index.mjs";
+import { i as isJWTError, n as JWTErrorCauseMap, r as JWTErrorCode, t as JWTError } from "../_chunks/error.mjs";
+
+//#region src/core/jws.d.ts
+/**
+* Creates a JWS (JSON Web Signature) in Compact Serialization format.
+*
+* @param payload The payload to sign. Can be a string, Uint8Array, or an object (which will be JSON stringified).
+* @param key The signing key (CryptoKey, JWK, or raw symmetric key as Uint8Array).
+* @param options Signing options, including the algorithm (`alg`) and protected header parameters.
+* @returns A Promise resolving to the JWS Compact Serialization string.
+*/
+declare function sign(payload: JOSEPayload, key: JWK_Symmetric | JWK_Private, options?: JWSSignOptions): Promise<string>;
+declare function sign(payload: JOSEPayload, key: CryptoKey | Uint8Array<ArrayBuffer>, options: JWSSignOptions & {
+  alg: JWSAlgorithm;
+}): Promise<string>;
+/**
+* Verifies a JWS (JSON Web Signature) in Compact Serialization format.
+*
+* @param jws The JWS Compact Serialization string.
+* @param key The verification key (CryptoKey, JWK, JWKSet, raw symmetric key as Uint8Array, or a function resolving the key or set).
+* @param options Verification options, such as allowed algorithms.
+* @returns A Promise resolving to an object containing the verified payload and protected header.
+* @throws If the JWS is invalid, signature verification fails, or options are not met.
+*/
+declare function verify<T extends JOSEPayload>(jws: string, key: CryptoKey | JWKSet | JWK_Public | JWK_Symmetric | Uint8Array<ArrayBuffer> | JWKLookupFunction, options?: JWSVerifyOptions): Promise<JWSVerifyResult<T>>;
+declare function verify(jws: string, key: CryptoKey | JWKSet | JWK_Public | JWK_Symmetric | Uint8Array<ArrayBuffer> | JWKLookupFunction, options: JWSVerifyOptions & {
+  forceUint8Array: true;
+}): Promise<JWSVerifyResult<Uint8Array<ArrayBuffer>>>;
+//#endregion
+export { JWSAlgorithm, JWSHeaderParameters, JWSProtectedHeader, JWSSignOptions, JWSVerifyOptions, JWSVerifyResult, JWTError, type JWTErrorCauseMap, type JWTErrorCode, isJWTError, sign, verify };

package/dist/core/jws.mjs

@@ -0,0 +1,104 @@
+import { A as validateCriticalHeadersJWS, M as JWTError, N as isJWTError, S as computeJwtTimeClaims, T as decodePayloadFromB64UrlSegment, _ as textDecoder, a as base64UrlEncode, b as applyTypCtyDefaults, d as isJWKSet, i as base64UrlDecode, j as validateJwtClaims, u as isJWK, v as textEncoder, y as sanitizeObject } from "../_chunks/utils.mjs";
+import { D as verify$1, E as sign$1 } from "../_chunks/_crypto.mjs";
+import { getJWKsFromSet, importKey } from "./jwk.mjs";
+//#region src/core/jws.ts
+async function sign(payload, key, options = {}) {
+	const { protectedHeader: userHeader } = options;
+	let { alg } = options;
+	if (!alg) if (isJWK(key) && key.alg) alg = key.alg;
+	else throw new TypeError("JWS \"alg\" (Algorithm) must be provided in options");
+	if (alg === "none") throw new JWTError("\"none\" is not a valid signing algorithm", "ERR_JWS_ALG_NOT_ALLOWED");
+	const signingKey = await _resolveSigningKey(alg, await importKey(key, alg), "sign");
+	const protectedHeader = _buildJWSHeader(alg, key, userHeader, payload);
+	const computedPayload = computeJwtTimeClaims(payload, protectedHeader.typ, options.expiresIn, options.currentDate);
+	const protectedHeaderEncoded = base64UrlEncode(JSON.stringify(protectedHeader));
+	let payloadBytes;
+	if (payload instanceof Uint8Array) payloadBytes = payload;
+	else if (typeof payload === "string") payloadBytes = textEncoder.encode(payload);
+	else if (typeof payload === "object" && payload !== null) payloadBytes = textEncoder.encode(JSON.stringify(computedPayload || payload));
+	else throw new TypeError("Payload must be a string, Uint8Array, or a JSON-serializable object.");
+	const signingInputString = `${protectedHeaderEncoded}.${protectedHeader.b64 !== false ? base64UrlEncode(payloadBytes) : textDecoder.decode(payloadBytes)}`;
+	const signingInputBytes = textEncoder.encode(signingInputString);
+	return `${signingInputString}.${base64UrlEncode(await sign$1(alg, signingKey, signingInputBytes))}`;
+}
+async function verify(jws, key, options = {}) {
+	const parts = jws.split(".");
+	if (parts.length !== 3) throw new JWTError("Invalid JWS: Must contain three parts separated by dots.", "ERR_JWS_INVALID");
+	const [protectedHeaderEncoded, payloadEncoded, signatureEncoded] = parts;
+	let protectedHeader;
+	try {
+		const protectedHeaderString = base64UrlDecode(protectedHeaderEncoded);
+		protectedHeader = sanitizeObject(JSON.parse(protectedHeaderString));
+	} catch {
+		throw new JWTError("Invalid JWS: Protected header could not be decoded.", "ERR_JWS_INVALID");
+	}
+	if (!protectedHeader || typeof protectedHeader !== "object" || !protectedHeader.alg) throw new JWTError("Invalid JWS: Protected header must be an object with an \"alg\" property.", "ERR_JWS_INVALID");
+	const alg = protectedHeader.alg;
+	if (options.algorithms && !options.algorithms.includes(alg)) throw new JWTError(`Algorithm not allowed: ${alg}`, "ERR_JWS_ALG_NOT_ALLOWED");
+	if (options.typ && protectedHeader.typ !== options.typ) throw new JWTError(`Invalid JWS: "typ" (Type) Header Parameter mismatch. Expected "${options.typ}", got "${protectedHeader.typ}".`, "ERR_JWS_INVALID");
+	let signatureBytes;
+	try {
+		signatureBytes = base64UrlDecode(signatureEncoded, false);
+	} catch {
+		throw new JWTError("Invalid JWS: Signature could not be decoded.", "ERR_JWS_INVALID");
+	}
+	const keyInput = typeof key === "function" ? await key(protectedHeader, jws) : key;
+	const signingInputBytes = textEncoder.encode(`${protectedHeaderEncoded}.${payloadEncoded}`);
+	if (isJWKSet(keyInput)) {
+		const candidates = getJWKsFromSet(keyInput, _buildJWSSetFilter(protectedHeader));
+		if (candidates.length === 0) throw new JWTError(`No key found in JWK Set${protectedHeader.kid ? ` with kid "${protectedHeader.kid}"` : ""}.`, "ERR_JWK_KEY_NOT_FOUND");
+		let verified = false;
+		for (const candidate of candidates) try {
+			if (await verify$1(alg, await _resolveSigningKey(alg, await importKey(candidate, alg), "verify"), signatureBytes, signingInputBytes)) {
+				verified = true;
+				break;
+			}
+		} catch {}
+		if (!verified) throw new JWTError("JWS signature verification failed.", "ERR_JWS_SIGNATURE_INVALID");
+	} else if (!await verify$1(alg, await _resolveSigningKey(alg, await importKey(keyInput, alg), "verify"), signatureBytes, signingInputBytes)) throw new JWTError("JWS signature verification failed.", "ERR_JWS_SIGNATURE_INVALID");
+	const useB64 = protectedHeader.b64 !== false;
+	let payload;
+	try {
+		payload = useB64 ? decodePayloadFromB64UrlSegment(payloadEncoded, protectedHeader, options.forceUint8Array) : options.forceUint8Array ? textEncoder.encode(payloadEncoded) : payloadEncoded;
+	} catch (error_) {
+		throw new JWTError(`Invalid JWS: Payload decoding failed (${error_ instanceof Error ? error_.message : error_})`, "ERR_JWS_INVALID");
+	}
+	validateCriticalHeadersJWS(protectedHeader, options.recognizedHeaders);
+	if (payload && typeof payload === "object" && options.validateClaims !== false && (options.validateClaims === true || protectedHeader.typ?.toLowerCase().includes("jwt")) && !options.forceUint8Array && !(payload instanceof Uint8Array)) validateJwtClaims(payload, options);
+	return {
+		payload,
+		protectedHeader
+	};
+}
+async function _resolveSigningKey(alg, key, usage) {
+	if (key instanceof Uint8Array) {
+		const minBytes = Number.parseInt(alg.slice(2), 10) / 8;
+		if (key.length < minBytes) throw new JWTError(`${alg} requires a key of at least ${minBytes} bytes`, "ERR_JWK_INVALID");
+		return crypto.subtle.importKey("raw", key, {
+			name: "HMAC",
+			hash: `SHA-${alg.slice(-3)}`
+		}, false, [usage]);
+	}
+	if (alg.startsWith("RS") || alg.startsWith("PS")) {
+		const { modulusLength } = key.algorithm;
+		if (typeof modulusLength !== "number" || modulusLength < 2048) throw new JWTError(`${alg} requires a key modulusLength of at least 2048 bits`, "ERR_JWK_INVALID");
+	}
+	return key;
+}
+function _buildJWSSetFilter(header) {
+	const { kid, alg } = header;
+	return (k) => (!kid || k.kid === kid) && (!k.alg || k.alg === alg);
+}
+function _buildJWSHeader(alg, key, userHeader, payload) {
+	const safeHeader = sanitizeObject(userHeader);
+	const header = {
+		...isJWK(key) && key.kid ? { kid: key.kid } : {},
+		...safeHeader,
+		alg
+	};
+	applyTypCtyDefaults(header, payload);
+	if (header.b64 === true) delete header.b64;
+	return header;
+}
+//#endregion
+export { JWTError, isJWTError, sign, verify };

package/dist/{_chunks/index2.d.mts → core/utils/index.d.mts}

@@ -1,4 +1,4 @@
-import { $ as JWK_Private, A as JWK, P as JWKSet, et as JWK_Public, l as StrictOmit, lt as JWK_oct, t as ExpiresIn, v as JWTClaimValidationOptions, y as JWTClaims } from "./index.mjs";
+import { A as JWK, L as JWKSet, ft as JWK_oct, l as StrictOmit, nt as JWK_Private, rt as JWK_Public, t as ExpiresIn, v as JWTClaimValidationOptions, y as JWTClaims } from "../../_chunks/index.mjs";
 
 //#region src/core/utils/jwt.d.ts
 /**
@@ -37,7 +37,7 @@ declare function decodePayloadFromB64UrlSegment<T = unknown>(payloadEncoded: str
   cty?: string;
 } | undefined, forceUint8Array?: boolean): T | Uint8Array<ArrayBuffer> | string;
 /** Convert plaintext input to bytes, shared by JWS & JWE when preparing payload. */
-declare function getPlaintextBytes(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>): Uint8Array<ArrayBuffer>;
+declare function getPlaintextBytes(payload: string | Uint8Array<ArrayBuffer> | Record<string, unknown>): Uint8Array<ArrayBuffer>;
 declare function computeExpiresInSeconds(expiresIn: ExpiresIn): number;
 declare const computeMaxTokenAgeSeconds: (expiresIn: ExpiresIn) => number;
 /** Optionally compute iat/exp when signing JWTs. */
@@ -47,28 +47,29 @@ declare function validateJwtClaims(jwtClaims: JWTClaims, options?: JWTClaimValid
 /** Validate critical headers in JWS semantics. */
 declare function validateCriticalHeadersJWS(protectedHeader: {
   crit?: string[];
-} & Record<string, any>, requiredHeaders?: string[]): void;
+} & Record<string, any>, recognizedHeaders?: string[]): void;
 /** Validate critical headers in JWE semantics. */
 declare function validateCriticalHeadersJWE(protectedHeader: {
   crit?: string[];
-} & Record<string, any>, understoodFromOptions?: string[]): void;
+} & Record<string, any>, recognizedHeaders?: string[]): void;
 //#endregion
 //#region src/core/utils/sanitize.d.ts
 /**
-* Forked from unsecure@0.0.4
+* Originally derived from unsecure@0.0.4
 * Licensed under the MIT License.
 *
 * Source: https://github.com/sandros94/unsecure/blob/913ed5580c551153a19154b4916c67a8efb2be85/src/sanitize.ts
 */
 /**
-* Remove prototype-pollution vectors from a plain record in-place.
-* This strips __proto__, prototype, and constructor own properties.
-* Returns the same reference for convenience.
+* Returns a deep structural copy of `obj` with prototype-pollution vectors
+* stripped at every level (`__proto__`, `prototype`, `constructor`).
+*
+* The input is never modified. Arrays are copied element-by-element;
+* nested objects are recursed with a WeakSet cycle guard.
 */
 declare function sanitizeObject<T extends Record<string, unknown> | undefined>(obj: T): T;
-declare namespace index_d_exports {
-  export { StrictOmit, applyTypCtyDefaults, assertCryptoKey, base64Decode, base64Encode, base64UrlDecode, base64UrlEncode, computeExpiresInSeconds, computeJwtTimeClaims, computeMaxTokenAgeSeconds, concatUint8Arrays, decodeMaybeJWTString, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, randomBytes, sanitizeObject, textDecoder, textEncoder, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims };
-}
+//#endregion
+//#region src/core/utils/index.d.ts
 declare const textEncoder: TextEncoder;
 declare const textDecoder: TextDecoder;
 declare function base64Encode(data: Uint8Array<ArrayBuffer> | string): string;
@@ -105,4 +106,4 @@ declare function isPrivateJWK(key: unknown): key is JWK_Private;
 */
 declare function isPublicJWK(key: unknown): key is JWK_Public;
 //#endregion
-export { validateCriticalHeadersJWE as A, computeJwtTimeClaims as C, decodePayloadFromBytes as D, decodePayloadFromB64UrlSegment as E, validateJwtClaims as M, getPlaintextBytes as O, computeExpiresInSeconds as S, decodeMaybeJWTString as T, randomBytes as _, base64UrlEncode as a, sanitizeObject as b, isAsymmetricJWK as c, isJWK as d, isJWKSet as f, maybeArray as g, isSymmetricJWK as h, base64UrlDecode as i, validateCriticalHeadersJWS as j, isJWTContent as k, isCryptoKey as l, isPublicJWK as m, base64Decode as n, concatUint8Arrays as o, isPrivateJWK as p, base64Encode as r, index_d_exports as s, assertCryptoKey as t, isCryptoKeyPair as u, textDecoder as v, computeMaxTokenAgeSeconds as w, applyTypCtyDefaults as x, textEncoder as y };
+export { StrictOmit, applyTypCtyDefaults, assertCryptoKey, base64Decode, base64Encode, base64UrlDecode, base64UrlEncode, computeExpiresInSeconds, computeJwtTimeClaims, computeMaxTokenAgeSeconds, concatUint8Arrays, decodeMaybeJWTString, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, randomBytes, sanitizeObject, textDecoder, textEncoder, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims };

package/dist/core/utils/index.mjs

@@ -0,0 +1,2 @@
+import { A as validateCriticalHeadersJWS, C as computeMaxTokenAgeSeconds, D as getPlaintextBytes, E as decodePayloadFromBytes, O as isJWTContent, S as computeJwtTimeClaims, T as decodePayloadFromB64UrlSegment, _ as textDecoder, a as base64UrlEncode, b as applyTypCtyDefaults, c as isCryptoKey, d as isJWKSet, f as isPrivateJWK, g as randomBytes, h as maybeArray, i as base64UrlDecode, j as validateJwtClaims, k as validateCriticalHeadersJWE, l as isCryptoKeyPair, m as isSymmetricJWK, n as base64Decode, o as concatUint8Arrays, p as isPublicJWK, r as base64Encode, s as isAsymmetricJWK, t as assertCryptoKey, u as isJWK, v as textEncoder, w as decodeMaybeJWTString, x as computeExpiresInSeconds, y as sanitizeObject } from "../../_chunks/utils.mjs";
+export { applyTypCtyDefaults, assertCryptoKey, base64Decode, base64Encode, base64UrlDecode, base64UrlEncode, computeExpiresInSeconds, computeJwtTimeClaims, computeMaxTokenAgeSeconds, concatUint8Arrays, decodeMaybeJWTString, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, randomBytes, sanitizeObject, textDecoder, textEncoder, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims };

package/dist/index.d.mts

@@ -1,6 +1,7 @@
-import { $ as JWK_Private, A as JWK, B as JWK_Asymmetric_Algorithm, C as DeriveKeyOptions, D as GenerateKeyAlgorithm, E as GenerateJWKReturn, F as JWK_AES_CBC_HMAC, G as JWK_EC_Public, H as JWK_ECDH_ES, I as JWK_AES_GCM, J as JWK_OKP_Private, K as JWK_HMAC, L as JWK_AES_GCM_KW, M as JWKPEMAlgorithm, N as JWKParameters, O as GenerateKeyOptions, P as JWKSet, Q as JWK_Pair, R as JWK_AES_KW, S as ContentEncryptionAlgorithm, T as GenerateJWKOptions, U as JWK_ECDSA, V as JWK_EC, W as JWK_EC_Private, X as JWK_OKP_SIGN, Y as JWK_OKP_Public, Z as JWK_PBES2, _ as JWT, a as JWEEncryptOptions, at as JWK_RSA_Public, b as JoseHeaderParameters, c as JWEKeyManagementHeaderParameters, ct as JWK_Symmetric_Algorithm, d as JWSHeaderParameters, dt as UnwrapKeyOptions, et as JWK_Public, f as JWSKeyLookupFunction, ft as WrapKeyOptions, g as JWSVerifyResult, h as JWSVerifyOptions, i as JWEDecryptResult, it as JWK_RSA_Private, j as JWKAlgorithm, k as GenerateKeyReturn, lt as JWK_oct, m as JWSSignOptions, n as MaxTokenAge, nt as JWK_RSA_ENC, o as JWEHeaderParameters, ot as JWK_RSA_SIGN, p as JWSProtectedHeader, pt as WrapKeyResult, q as JWK_OKP, r as JWEDecryptOptions, rt as JWK_RSA_PSS, s as JWEKeyLookupFunction, st as JWK_Symmetric, t as ExpiresIn, tt as JWK_RSA, u as JWSAlgorithm, ut as KeyManagementAlgorithm, v as JWTClaimValidationOptions, w as DeriveKeyReturn, x as CompositeKey, y as JWTClaims, z as JWK_Asymmetric } from "./_chunks/index.mjs";
-import { s as index_d_exports } from "./_chunks/index2.mjs";
-import { r as jwe_d_exports } from "./_chunks/jwe.mjs";
-import { u as jwk_d_exports } from "./_chunks/jwk.mjs";
-import { t as jws_d_exports } from "./_chunks/jws.mjs";
-export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEHeaderParameters, JWEKeyLookupFunction, JWEKeyManagementHeaderParameters, JWK, JWKAlgorithm, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSHeaderParameters, JWSKeyLookupFunction, JWSProtectedHeader, JWSSignOptions, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JoseHeaderParameters, KeyManagementAlgorithm, MaxTokenAge, UnwrapKeyOptions, WrapKeyOptions, WrapKeyResult, jwe_d_exports as jwe, jwk_d_exports as jwk, jws_d_exports as jws, index_d_exports as utils };
+import { $ as JWK_OKP_SIGN, A as JWK, B as JWK_AES_GCM_KW, C as DeriveKeyOptions, D as GenerateKeyAlgorithm, E as GenerateJWKReturn, F as JWKPEMAlgorithm, G as JWK_ECDH_ES, H as JWK_Asymmetric, I as JWKParameters, J as JWK_EC_Public, K as JWK_ECDSA, L as JWKSet, M as JWKCacheAdapter, N as JWKLookupFunction, O as GenerateKeyOptions, P as JWKLookupFunctionHeader, Q as JWK_OKP_Public, R as JWK_AES_CBC_HMAC, S as ContentEncryptionAlgorithm, T as GenerateJWKOptions, U as JWK_Asymmetric_Algorithm, V as JWK_AES_KW, W as JWK_EC, X as JWK_OKP, Y as JWK_HMAC, Z as JWK_OKP_Private, _ as JWT, a as JWEEncryptOptions, at as JWK_RSA_ENC, b as JoseHeaderParameters, c as JWEProtectedHeader, ct as JWK_RSA_Public, d as JWSHeaderParameters, dt as JWK_Symmetric_Algorithm, et as JWK_PBES2, f as JWSProtectedHeader, ft as JWK_oct, g as JOSEPayload, gt as WrapKeyResult, h as JWSVerifyResult, ht as WrapKeyOptions, i as JWEDecryptResult, it as JWK_RSA, j as JWKAlgorithm, k as GenerateKeyReturn, lt as JWK_RSA_SIGN, m as JWSVerifyOptions, mt as UnwrapKeyOptions, n as MaxTokenAge, nt as JWK_Private, o as JWEHeaderParameters, ot as JWK_RSA_PSS, p as JWSSignOptions, pt as KeyManagementAlgorithm, q as JWK_EC_Private, r as JWEDecryptOptions, rt as JWK_Public, s as JWEKeyManagementHeaderParameters, st as JWK_RSA_Private, t as ExpiresIn, tt as JWK_Pair, u as JWSAlgorithm, ut as JWK_Symmetric, v as JWTClaimValidationOptions, w as DeriveKeyReturn, x as CompositeKey, y as JWTClaims, z as JWK_AES_GCM } from "./_chunks/index.mjs";
+import { i as isJWTError, n as JWTErrorCauseMap, r as JWTErrorCode, t as JWTError } from "./_chunks/error.mjs";
+import { decrypt, encrypt } from "./core/jwe.mjs";
+import { WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportKey, exportToPEM, generateJWK, generateKey, getJWKFromSet, getJWKsFromSet, importFromPEM, importKey, unwrapKey, wrapKey } from "./core/jwk.mjs";
+import { sign, verify } from "./core/jws.mjs";
+import { assertCryptoKey, base64Decode, base64Encode, base64UrlDecode, base64UrlEncode, computeExpiresInSeconds, computeMaxTokenAgeSeconds, concatUint8Arrays, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, randomBytes, sanitizeObject, textDecoder, textEncoder, validateJwtClaims } from "./core/utils/index.mjs";
+export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JOSEPayload, JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSHeaderParameters, JWSProtectedHeader, JWSSignOptions, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JWTError, type JWTErrorCauseMap, type JWTErrorCode, JoseHeaderParameters, KeyManagementAlgorithm, MaxTokenAge, UnwrapKeyOptions, WeakMapJWKCache, WrapKeyOptions, WrapKeyResult, assertCryptoKey, base64Decode, base64Encode, base64UrlDecode, base64UrlEncode, clearJWKCache, computeExpiresInSeconds, computeMaxTokenAgeSeconds, concatUint8Arrays, configureJWKCache, decrypt, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, encrypt, exportKey, exportToPEM, generateJWK, generateKey, getJWKFromSet, getJWKsFromSet, importFromPEM, importKey, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, randomBytes, sanitizeObject, sign, textDecoder, textEncoder, unwrapKey, validateJwtClaims, verify, wrapKey };

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { y as utils_exports } from "./_chunks/utils.mjs";
-import { u as jwk_exports } from "./_chunks/jwk.mjs";
-import { r as jwe_exports } from "./_chunks/jwe.mjs";
-import { t as jws_exports } from "./_chunks/jws.mjs";
-export { jwe_exports as jwe, jwk_exports as jwk, jws_exports as jws, utils_exports as utils };
+import { C as computeMaxTokenAgeSeconds, M as JWTError, N as isJWTError, _ as textDecoder, a as base64UrlEncode, c as isCryptoKey, d as isJWKSet, f as isPrivateJWK, g as randomBytes, h as maybeArray, i as base64UrlDecode, j as validateJwtClaims, l as isCryptoKeyPair, m as isSymmetricJWK, n as base64Decode, o as concatUint8Arrays, p as isPublicJWK, r as base64Encode, s as isAsymmetricJWK, t as assertCryptoKey, u as isJWK, v as textEncoder, x as computeExpiresInSeconds, y as sanitizeObject } from "./_chunks/utils.mjs";
+import { WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportKey, exportToPEM, generateJWK, generateKey, getJWKFromSet, getJWKsFromSet, importFromPEM, importKey, unwrapKey, wrapKey } from "./core/jwk.mjs";
+import { sign, verify } from "./core/jws.mjs";
+import { decrypt, encrypt } from "./core/jwe.mjs";
+export { JWTError, WeakMapJWKCache, assertCryptoKey, base64Decode, base64Encode, base64UrlDecode, base64UrlEncode, clearJWKCache, computeExpiresInSeconds, computeMaxTokenAgeSeconds, concatUint8Arrays, configureJWKCache, decrypt, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, encrypt, exportKey, exportToPEM, generateJWK, generateKey, getJWKFromSet, getJWKsFromSet, importFromPEM, importKey, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, randomBytes, sanitizeObject, sign, textDecoder, textEncoder, unwrapKey, validateJwtClaims, verify, wrapKey };

package/package.json

@@ -1,13 +1,16 @@
 {
   "name": "unjwt",
-  "version": "0.5.40",
+  "version": "0.6.0",
   "description": "Low-level JWT utilities",
   "license": "MIT",
   "author": {
     "name": "Sandro Circi",
     "email": "sandro.circi@digitoolmedia.com"
   },
-  "repository": "sandros94/unjwt",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/sandros94/unjwt.git"
+  },
   "files": [
     "dist"
   ],
@@ -21,48 +24,35 @@
       "types": "./dist/index.d.mts",
       "default": "./dist/index.mjs"
     },
-    "./jwe": {
-      "types": "./dist/jwe.d.mts",
-      "default": "./dist/jwe.mjs"
-    },
     "./jwk": {
-      "types": "./dist/jwk.d.mts",
-      "default": "./dist/jwk.mjs"
+      "types": "./dist/core/jwk.d.mts",
+      "default": "./dist/core/jwk.mjs"
     },
     "./jws": {
-      "types": "./dist/jws.d.mts",
-      "default": "./dist/jws.mjs"
+      "types": "./dist/core/jws.d.mts",
+      "default": "./dist/core/jws.mjs"
+    },
+    "./jwe": {
+      "types": "./dist/core/jwe.d.mts",
+      "default": "./dist/core/jwe.mjs"
     },
     "./utils": {
-      "types": "./dist/utils.d.mts",
-      "default": "./dist/utils.mjs"
+      "types": "./dist/core/utils/index.d.mts",
+      "default": "./dist/core/utils/index.mjs"
     },
     "./adapters/h3": {
-      "types": "./dist/adapters/h3.d.mts",
-      "default": "./dist/adapters/h3.mjs"
+      "types": "./dist/adapters/h3v1/index.d.mts",
+      "default": "./dist/adapters/h3v1/index.mjs"
     },
     "./adapters/h3v1": {
-      "types": "./dist/adapters/h3v1.d.mts",
-      "default": "./dist/adapters/h3v1.mjs"
+      "types": "./dist/adapters/h3v1/index.d.mts",
+      "default": "./dist/adapters/h3v1/index.mjs"
     },
     "./adapters/h3v2": {
-      "types": "./dist/adapters/h3v2.d.mts",
-      "default": "./dist/adapters/h3v2.mjs"
+      "types": "./dist/adapters/h3v2/index.d.mts",
+      "default": "./dist/adapters/h3v2/index.mjs"
     }
   },
-  "scripts": {
-    "build": "obuild",
-    "dev": "bun --watch ./playground/main.ts",
-    "dev:prepare": "obuild --stub",
-    "lint": "oxlint . && oxfmt --check .",
-    "fmt": "automd && oxlint --fix . && oxfmt .",
-    "prepack": "pnpm build",
-    "release": "pnpm test && pnpm prepack && changelogen --release --push",
-    "test": "vitest run --slowTestThreshold=1000",
-    "test:coverage": "vitest run --coverage --slowTestThreshold=1000",
-    "typecheck": "tsgo --noEmit",
-    "bench": "vitest bench --run"
-  },
   "devDependencies": {
     "@types/node": "^24",
     "@types/supertest": "^6.0.3",
@@ -72,20 +62,22 @@
     "changelogen": "^0.6.2",
     "cookie-esv1": "npm:cookie-es@^1.2.2",
     "cookie-esv2": "npm:cookie-es@^2.0.0",
-    "h3v1": "npm:h3@^1.15.4",
-    "h3v2": "npm:h3@^2.0.1-rc.14",
+    "h3v1": "npm:h3@^1.15.10",
+    "h3v2": "npm:h3@^2.0.1-rc.19",
     "jose": "^6.2.0",
+    "nano-staged": "^0.9.0",
     "obuild": "^0.4.32",
-    "oxfmt": "^0.41.0",
+    "oxfmt": "^0.43.0",
     "oxlint": "^1.51.0",
-    "rolldown": "1.0.0-rc.11",
+    "rolldown": "1.0.0-rc.12",
+    "simple-git-hooks": "^2.13.1",
     "supertest": "^7.2.2",
     "typescript": "^5.9.3",
     "vitest": "^4.0.18"
   },
   "peerDependencies": {
     "cookie-es": "^1.2.2 || ^2.0.0",
-    "h3": "^1.15.4 || >=2.0.1-rc.5 || ^2.0.1",
+    "h3": "^1.15.4 || >=2.0.1-rc.18 || ^2.0.1",
     "rou3": "^0.7.10"
   },
   "peerDependenciesMeta": {
@@ -99,8 +91,25 @@
       "optional": true
     }
   },
-  "engines": {
-    "node": "^22.12 || >=24"
+  "simple-git-hooks": {
+    "pre-commit": "./node_modules/.bin/nano-staged"
   },
-  "packageManager": "pnpm@10.30.3"
-}
+  "nano-staged": {
+    "*.{js,ts,mjs,cjs,json,yml,md}": [
+      "pnpm run fmt"
+    ]
+  },
+  "scripts": {
+    "postinstall": "obuild --stub && pnpm simple-git-hooks",
+    "build": "obuild",
+    "dev": "bun --watch ./playground/main.ts",
+    "dev:prepare": "obuild --stub",
+    "lint": "oxlint . && oxfmt --check .",
+    "fmt": "automd && oxlint --fix . && oxfmt .",
+    "release": "pnpm test && pnpm prepack && changelogen --release --push",
+    "test": "vitest run --slowTestThreshold=1000",
+    "test:coverage": "vitest run --coverage --slowTestThreshold=1000",
+    "typecheck": "tsgo --noEmit",
+    "bench": "vitest bench --run"
+  }
+}

package/dist/_chunks/chunk.mjs

@@ -1,13 +0,0 @@
-//#region \0rolldown/runtime.js
-var __defProp = Object.defineProperty;
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) __defProp(target, name, {
-		get: all[name],
-		enumerable: true
-	});
-	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
-	return target;
-};
-//#endregion
-export { __exportAll as t };

package/dist/_chunks/jwe.d.mts

@@ -1,43 +0,0 @@
-import { $ as JWK_Private, A as JWK, B as JWK_Asymmetric_Algorithm, C as DeriveKeyOptions, D as GenerateKeyAlgorithm, E as GenerateJWKReturn, F as JWK_AES_CBC_HMAC, G as JWK_EC_Public, H as JWK_ECDH_ES, I as JWK_AES_GCM, J as JWK_OKP_Private, K as JWK_HMAC, L as JWK_AES_GCM_KW, M as JWKPEMAlgorithm, N as JWKParameters, O as GenerateKeyOptions, P as JWKSet, Q as JWK_Pair, R as JWK_AES_KW, S as ContentEncryptionAlgorithm, T as GenerateJWKOptions, U as JWK_ECDSA, V as JWK_EC, W as JWK_EC_Private, X as JWK_OKP_SIGN, Y as JWK_OKP_Public, Z as JWK_PBES2, _ as JWT, a as JWEEncryptOptions, at as JWK_RSA_Public, b as JoseHeaderParameters, c as JWEKeyManagementHeaderParameters, ct as JWK_Symmetric_Algorithm, dt as UnwrapKeyOptions, et as JWK_Public, ft as WrapKeyOptions, i as JWEDecryptResult, it as JWK_RSA_Private, j as JWKAlgorithm, k as GenerateKeyReturn, lt as JWK_oct, nt as JWK_RSA_ENC, o as JWEHeaderParameters, ot as JWK_RSA_SIGN, pt as WrapKeyResult, q as JWK_OKP, r as JWEDecryptOptions, rt as JWK_RSA_PSS, s as JWEKeyLookupFunction, st as JWK_Symmetric, tt as JWK_RSA, ut as KeyManagementAlgorithm, v as JWTClaimValidationOptions, w as DeriveKeyReturn, x as CompositeKey, y as JWTClaims, z as JWK_Asymmetric } from "./index.mjs";
-
-//#region src/core/jwe.d.ts
-declare namespace jwe_d_exports {
-  export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEHeaderParameters, JWEKeyLookupFunction, JWEKeyManagementHeaderParameters, JWK, JWKAlgorithm, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWT, JWTClaimValidationOptions, JWTClaims, JoseHeaderParameters, KeyManagementAlgorithm, UnwrapKeyOptions, WrapKeyOptions, WrapKeyResult, decrypt, encrypt };
-}
-/**
-* Encrypts a payload to produce a JWE Compact Serialization string.
-*
-* @param payload The payload to encrypt. Can be a string, Uint8Array, or a JSON-serializable object.
-* @param key The key encryption key (KEK). Can be a CryptoKey, JWK, or for PBES2, a password string/Uint8Array.
-* @param options JWE encryption options, including `alg` (key management algorithm) and `enc` (content encryption algorithm).
-* @returns A Promise resolving to the JWE Compact Serialization string.
-*/
-declare function encrypt(payload: JWTClaims, key: JWK | string | Uint8Array<ArrayBuffer>, options?: JWEEncryptOptions): Promise<string>;
-declare function encrypt(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: JWK | string | Uint8Array<ArrayBuffer>, options?: JWEEncryptOptions): Promise<string>;
-declare function encrypt(payload: JWTClaims, key: CryptoKey, options: JWEEncryptOptions & {
-  alg: KeyManagementAlgorithm;
-  enc: ContentEncryptionAlgorithm;
-}): Promise<string>;
-declare function encrypt(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: CryptoKey, options: JWEEncryptOptions & {
-  alg: KeyManagementAlgorithm;
-  enc: ContentEncryptionAlgorithm;
-}): Promise<string>;
-declare function encrypt(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: CryptoKey | JWK | string | Uint8Array<ArrayBuffer>, options: JWEEncryptOptions & {
-  alg: KeyManagementAlgorithm;
-  enc: ContentEncryptionAlgorithm;
-}): Promise<string>;
-/**
-* Decrypts a JWE Compact Serialization string.
-*
-* @param jwe The JWE Compact Serialization string.
-* @param key The key decryption key (KEK) or a function to look up the key.
-* @param options JWE decryption options.
-* @returns A Promise resolving to an object containing the decrypted plaintext, protected header, CEK, and AAD.
-* @throws If JWE is invalid, decryption fails, or options are not met.
-*/
-declare function decrypt<T extends JWTClaims | Uint8Array<ArrayBuffer> | string>(jwe: string, key: CryptoKey | JWK_Symmetric | JWK_Private | string | Uint8Array<ArrayBuffer> | JWEKeyLookupFunction, options?: JWEDecryptOptions): Promise<JWEDecryptResult<T>>;
-declare function decrypt(jwe: string, key: CryptoKey | JWK_Symmetric | JWK_Private | string | Uint8Array<ArrayBuffer> | JWEKeyLookupFunction, options: JWEDecryptOptions & {
-  forceUint8Array: true;
-}): Promise<JWEDecryptResult<Uint8Array<ArrayBuffer>>>;
-//#endregion
-export { encrypt as n, jwe_d_exports as r, decrypt as t };