unjwt 0.5.8 → 0.5.10

package/dist/index.d.mts

@@ -1,6 +1,5 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.D9da8HQF.mjs';
-export { b as JWT, a as JWTClaims, J as JoseHeaderParameters } from './shared/unjwt.BvIkEGGz.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.D_Mabhgz.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.8w7jp2aw.mjs';
-export { i as utils } from './shared/unjwt.CbvzYE-m.mjs';
-export { j as jwk } from './shared/unjwt.DH1p_WL8.mjs';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, L as JWT, M as JWTClaimValidationOptions, I as JWTClaims, H as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CN1C8TlR.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.igKyF5q2.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.Dof5OLMV.mjs';
+export { i as utils } from './shared/unjwt.CUUg6g3N.mjs';
+export { j as jwk } from './shared/unjwt.Cz90HQhy.mjs';

package/dist/index.mjs

@@ -1,5 +1,5 @@
-export { i as utils } from './shared/unjwt.BHpknTpg.mjs';
-export { j as jwe } from './shared/unjwt.B2olxeGL.mjs';
-export { j as jwk } from './shared/unjwt.DRUXIabl.mjs';
-export { j as jws } from './shared/unjwt.BZCtr-eB.mjs';
-import './shared/unjwt.Ca03jPX3.mjs';
+export { i as utils } from './shared/unjwt.odifuYKu.mjs';
+export { j as jwe } from './shared/unjwt.D0WA_yog.mjs';
+export { j as jwk } from './shared/unjwt.BrOta13J.mjs';
+export { j as jws } from './shared/unjwt.B1dfkZSt.mjs';
+import './shared/unjwt.CEjyBwhK.mjs';

package/dist/jwe.d.mts

@@ -1,3 +1,2 @@
-import './shared/unjwt.D9da8HQF.mjs';
-import './shared/unjwt.BvIkEGGz.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.8w7jp2aw.mjs';
+import './shared/unjwt.CN1C8TlR.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.Dof5OLMV.mjs';

package/dist/jwe.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.DRUXIabl.mjs';
-import './shared/unjwt.BHpknTpg.mjs';
-export { d as decrypt, e as encrypt } from './shared/unjwt.B2olxeGL.mjs';
-import './shared/unjwt.Ca03jPX3.mjs';
+import './shared/unjwt.BrOta13J.mjs';
+import './shared/unjwt.odifuYKu.mjs';
+export { d as decrypt, e as encrypt } from './shared/unjwt.D0WA_yog.mjs';
+import './shared/unjwt.CEjyBwhK.mjs';

package/dist/jwk.d.mts

@@ -1,3 +1,2 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.D9da8HQF.mjs';
-import './shared/unjwt.BvIkEGGz.mjs';
-export { d as deriveKeyFromPassword, b as exportJWKToPEM, e as exportKey, g as generateKey, c as getJWKFromSet, a as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.DH1p_WL8.mjs';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CN1C8TlR.mjs';
+export { d as deriveKeyFromPassword, b as exportJWKToPEM, e as exportKey, g as generateKey, c as getJWKFromSet, a as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.Cz90HQhy.mjs';

package/dist/jwk.mjs

@@ -1,2 +1,2 @@
-import './shared/unjwt.BHpknTpg.mjs';
-export { p as deriveKeyFromPassword, t as exportJWKToPEM, q as exportKey, o as generateKey, g as getJWKFromSet, s as importJWKFromPEM, i as importKey, m as unwrapKey, r as wrapKey } from './shared/unjwt.DRUXIabl.mjs';
+import './shared/unjwt.odifuYKu.mjs';
+export { p as deriveKeyFromPassword, t as exportJWKToPEM, q as exportKey, o as generateKey, g as getJWKFromSet, s as importJWKFromPEM, i as importKey, m as unwrapKey, r as wrapKey } from './shared/unjwt.BrOta13J.mjs';

package/dist/jws.d.mts

@@ -1,3 +1,2 @@
-import './shared/unjwt.D9da8HQF.mjs';
-import './shared/unjwt.BvIkEGGz.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.D_Mabhgz.mjs';
+import './shared/unjwt.CN1C8TlR.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.igKyF5q2.mjs';

package/dist/jws.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.DRUXIabl.mjs';
-import './shared/unjwt.BHpknTpg.mjs';
-import './shared/unjwt.Ca03jPX3.mjs';
-export { s as sign, v as verify } from './shared/unjwt.BZCtr-eB.mjs';
+import './shared/unjwt.BrOta13J.mjs';
+import './shared/unjwt.odifuYKu.mjs';
+import './shared/unjwt.CEjyBwhK.mjs';
+export { s as sign, v as verify } from './shared/unjwt.B1dfkZSt.mjs';

package/dist/shared/unjwt.B1dfkZSt.mjs

@@ -0,0 +1,161 @@
+import { i as importKey, g as getJWKFromSet } from './unjwt.BrOta13J.mjs';
+import { a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, e as textDecoder, f as base64UrlDecode, g as isJWKSet, h as decodePayloadFromB64UrlSegment, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './unjwt.odifuYKu.mjs';
+import { s as sign$1, v as verify$1 } from './unjwt.CEjyBwhK.mjs';
+
+async function sign(payload, key, options = {}) {
+  const { protectedHeader: additionalProtectedHeader } = options;
+  let { alg } = options;
+  if (!alg) {
+    if (isJWK(key) && key.alg) {
+      alg = key.alg;
+    } else {
+      throw new TypeError('JWS "alg" (Algorithm) must be provided in options');
+    }
+  }
+  validateKeyLength(key, alg);
+  const signingKey = await importKey(key, alg);
+  const protectedHeader = {
+    ...additionalProtectedHeader,
+    ...isJWK(key) && key.kid ? { kid: additionalProtectedHeader?.kid || key.kid } : {},
+    // Include kid if available
+    alg,
+    typ: additionalProtectedHeader?.typ
+  };
+  applyTypCtyDefaults(protectedHeader, payload);
+  if (protectedHeader.b64 === true) {
+    delete protectedHeader.b64;
+  }
+  const computedPayload = computeJwtTimeClaims(
+    payload,
+    protectedHeader.typ,
+    options.expiresIn,
+    options.currentDate
+  );
+  const protectedHeaderString = JSON.stringify(protectedHeader);
+  const protectedHeaderEncoded = base64UrlEncode(protectedHeaderString);
+  let payloadBytes;
+  if (payload instanceof Uint8Array) {
+    payloadBytes = payload;
+  } else if (typeof payload === "string") {
+    payloadBytes = textEncoder.encode(payload);
+  } else if (typeof payload === "object" && payload !== null) {
+    payloadBytes = textEncoder.encode(
+      JSON.stringify(computedPayload || payload)
+    );
+  } else {
+    throw new TypeError(
+      "Payload must be a string, Uint8Array, or a JSON-serializable object."
+    );
+  }
+  const useB64 = protectedHeader.b64 !== false;
+  const payloadEncoded = useB64 ? base64UrlEncode(payloadBytes) : textDecoder.decode(payloadBytes);
+  const signingInputString = `${protectedHeaderEncoded}.${payloadEncoded}`;
+  const signingInputBytes = textEncoder.encode(signingInputString);
+  const signatureBytes = await sign$1(alg, signingKey, signingInputBytes);
+  const signatureEncoded = base64UrlEncode(signatureBytes);
+  return `${signingInputString}.${signatureEncoded}`;
+}
+async function verify(jws, key, options = {}) {
+  const parts = jws.split(".");
+  if (parts.length !== 3) {
+    throw new Error("Invalid JWS: Must contain three parts separated by dots.");
+  }
+  const [protectedHeaderEncoded, payloadEncoded, signatureEncoded] = parts;
+  let protectedHeader;
+  try {
+    const protectedHeaderString = base64UrlDecode(protectedHeaderEncoded);
+    protectedHeader = JSON.parse(protectedHeaderString);
+  } catch (error_) {
+    throw new Error(
+      `Invalid JWS: Protected header is not valid Base64URL or JSON (${error_ instanceof Error ? error_.message : error_})`
+    );
+  }
+  if (!protectedHeader || typeof protectedHeader !== "object" || !protectedHeader.alg) {
+    throw new Error(
+      'Invalid JWS: Protected header must be an object with an "alg" property.'
+    );
+  }
+  const alg = protectedHeader.alg;
+  if (options.algorithms && !options.algorithms.includes(alg)) {
+    throw new Error(`Algorithm not allowed: ${alg}`);
+  }
+  if (options.typ && protectedHeader.typ !== options.typ) {
+    throw new Error(
+      `Invalid JWS: "typ" (Type) Header Parameter mismatch. Expected "${options.typ}", got "${protectedHeader.typ}".`
+    );
+  }
+  let signatureBytes;
+  try {
+    signatureBytes = base64UrlDecode(signatureEncoded, false);
+  } catch (error_) {
+    throw new Error(
+      `Invalid JWS: Signature is not valid Base64URL (${error_ instanceof Error ? error_.message : error_})`
+    );
+  }
+  const keyInput = typeof key === "function" ? await key(protectedHeader, jws) : key;
+  const resolvedKey = isJWKSet(
+    keyInput
+  ) ? getJWKFromSet(keyInput, protectedHeader) : keyInput;
+  const verificationKey = await importKey(resolvedKey, alg);
+  const signingInputString = `${protectedHeaderEncoded}.${payloadEncoded}`;
+  const signingInputBytes = textEncoder.encode(signingInputString);
+  const isValid = await verify$1(
+    alg,
+    verificationKey,
+    signatureBytes,
+    signingInputBytes
+  );
+  if (!isValid) {
+    throw new Error("JWS signature verification failed.");
+  }
+  const useB64 = protectedHeader.b64 !== false;
+  let payload;
+  try {
+    payload = useB64 ? decodePayloadFromB64UrlSegment(
+      payloadEncoded,
+      protectedHeader,
+      options.forceUint8Array
+    ) : options.forceUint8Array ? textEncoder.encode(payloadEncoded) : payloadEncoded;
+  } catch (error_) {
+    throw new Error(
+      `Invalid JWS: Payload decoding failed (${error_ instanceof Error ? error_.message : error_})`
+    );
+  }
+  validateCriticalHeadersJWS(protectedHeader, [
+    ...options.critical || [],
+    ...options.requiredHeaders || []
+  ]);
+  if (payload && typeof payload === "object" && protectedHeader.typ === "JWT" && !options.forceUint8Array) {
+    validateJwtClaims(payload, options);
+  }
+  return {
+    payload,
+    protectedHeader
+  };
+}
+function validateKeyLength(key, alg) {
+  if (!alg || isJWK(key)) return;
+  if (alg.startsWith("HS") && key instanceof Uint8Array) {
+    const algLength = Number.parseInt(alg.slice(2)) / 8;
+    if (key.length < algLength) {
+      throw new TypeError(
+        `${alg} requires key length to be ${algLength} bytes or larger`
+      );
+    }
+  } else if ((alg.startsWith("RS") || alg.startsWith("PS")) && key instanceof CryptoKey) {
+    const { modulusLength } = key.algorithm;
+    if (typeof modulusLength !== "number" || modulusLength < 2048) {
+      throw new TypeError(
+        `${alg} requires key modulusLength to be 2048 bits or larger`
+      );
+    }
+  }
+}
+
+const jws = {
+  __proto__: null,
+  sign: sign,
+  verify: verify
+};
+
+export { jws as j, sign as s, verify as v };

package/dist/shared/{unjwt.DRUXIabl.mjs → unjwt.BrOta13J.mjs}

@@ -1,4 +1,4 @@
-import { h as isCryptoKey, f as concatUint8Arrays, b as base64UrlEncode, j as base64Decode, k as base64Encode, t as textEncoder, r as randomBytes, a as isJWK, d as base64UrlDecode, e as isJWKSet } from './unjwt.BHpknTpg.mjs';
+import { m as isCryptoKey, k as concatUint8Arrays, d as base64UrlEncode, q as base64Decode, s as base64Encode, t as textEncoder, r as randomBytes, a as isJWK, f as base64UrlDecode, g as isJWKSet } from './unjwt.odifuYKu.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -330,7 +330,7 @@ async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
 async function encrypt(enc, plaintext, cek, iv, aad) {
   if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) {
     throw new TypeError(
-      `Key must be ${cek} one of type: CryptoKey, Uint8Array, or JSON Web Key`
+      `Key must be ${cek} one of type: CryptoKey or Uint8Array`
     );
   }
   if (iv) {
@@ -461,7 +461,7 @@ async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
 async function decrypt(enc, cek, ciphertext, iv, tag, aad) {
   if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) {
     throw new TypeError(
-      `Key must be ${cek} one of type: CryptoKey, Uint8Array, or JSON Web Key`
+      `Key must be ${cek} one of type: CryptoKey or Uint8Array`
     );
   }
   if (!iv) {
@@ -497,18 +497,24 @@ async function decrypt(enc, cek, ciphertext, iv, tag, aad) {
  * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/aesgcmkw.ts
  * @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
  */
-async function encryptIV(alg, key, cek, iv) {
+async function encryptIV(alg, key, plaintext, iv) {
   const jweAlgorithm = alg.slice(0, 7);
-  const wrapped = await encrypt(jweAlgorithm, cek, key, iv, new Uint8Array(0));
+  const wrapped = await encrypt(
+    jweAlgorithm,
+    plaintext,
+    key,
+    iv,
+    new Uint8Array(0)
+  );
   return {
     encryptedKey: wrapped.ciphertext,
     iv: base64UrlEncode(wrapped.iv),
     tag: base64UrlEncode(wrapped.tag)
   };
 }
-async function decryptIV(alg, key, encryptedKey, iv, tag) {
+async function decryptIV(alg, key, ciphertext, iv, tag) {
   const jweAlgorithm = alg.slice(0, 7);
-  return decrypt(jweAlgorithm, key, encryptedKey, iv, tag, new Uint8Array(0));
+  return decrypt(jweAlgorithm, key, ciphertext, iv, tag, new Uint8Array(0));
 }
 
 /**
@@ -1479,7 +1485,12 @@ function getGenerateKeyParams(alg, options) {
       keyUsages = defaultKeyUsage ?? ["sign", "verify"];
       break;
     }
-    // EdDSA Signatures should be imported
+    case "Ed25519":
+    case "EdDSA": {
+      algorithm = { name: "Ed25519" };
+      keyUsages = defaultKeyUsage ?? ["sign", "verify"];
+      break;
+    }
     // RSA Encryption
     case "RSA-OAEP":
     case "RSA-OAEP-256":

package/dist/shared/{unjwt.Ca03jPX3.mjs → unjwt.CEjyBwhK.mjs}

@@ -1,4 +1,4 @@
-import { c as checkSigCryptoKey } from './unjwt.DRUXIabl.mjs';
+import { c as checkSigCryptoKey } from './unjwt.BrOta13J.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.

package/dist/shared/{unjwt.D9da8HQF.d.mts → unjwt.CN1C8TlR.d.mts}

@@ -15,7 +15,7 @@ interface GenerateKeyOptions {
     /** RSA modulus length. Defaults to 2048. */
     modulusLength?: number;
     /** RSA public exponent. Defaults to 65537 (0x010001). */
-    publicExponent?: Uint8Array;
+    publicExponent?: Uint8Array<ArrayBuffer>;
     /** Export the generated key(s) as JWK. If true, the key(s) will be returned in JWK format. */
     toJWK?: boolean | undefined;
 }
@@ -23,12 +23,12 @@ type GenerateKeyReturnJWK<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_
     privateKey: JWK;
     publicKey: JWK;
 } : JWK;
-type GenerateKeyReturnCrypto<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_AES_CBC_HMAC ? Uint8Array : TAlg extends JWK_Asymmetric_Algorithm ? CryptoKeyPair : CryptoKey;
+type GenerateKeyReturnCrypto<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_AES_CBC_HMAC ? Uint8Array<ArrayBuffer> : TAlg extends JWK_Asymmetric_Algorithm ? CryptoKeyPair : CryptoKey;
 type GenerateKeyReturn<TAlg extends GenerateKeyAlgorithm, TOptions extends GenerateKeyOptions> = TOptions["toJWK"] extends true ? GenerateKeyReturnJWK<TAlg> : GenerateKeyReturnCrypto<TAlg>;
 /** Options for the deriveKeyFromPassword function. */
 interface DeriveKeyOptions {
     /** Salt value (p2s). Must be at least 8 bytes. */
-    salt: Uint8Array;
+    salt: Uint8Array<ArrayBuffer>;
     /** Iteration count (p2c). Must be a positive integer. */
     iterations: number;
     /** Key usages for the derived key. Defaults to ["wrapKey", "unwrapKey"]. */
@@ -44,22 +44,22 @@ type ContentEncryptionAlgorithm = JWK_AES_GCM | JWK_AES_CBC_HMAC;
 /** Options for the wrapKey function. */
 interface WrapKeyOptions {
     /** Initialization Vector for AES-GCMKW. Generated if not provided. */
-    iv?: Uint8Array;
+    iv?: Uint8Array<ArrayBuffer>;
     /** PBES2 Salt value (p2s). Required for PBES2 algorithms. */
-    p2s?: Uint8Array;
+    p2s?: Uint8Array<ArrayBuffer>;
     /** PBES2 Iteration count (p2c). Required for PBES2 algorithms. */
     p2c?: number;
     /** ECDH-ES Ephemeral Public Key. Generated if not provided for ECDH-ES. */
     epk?: JWK_EC_Public;
     /** ECDH-ES Agreement PartyUInfo. */
-    apu?: Uint8Array;
+    apu?: Uint8Array<ArrayBuffer>;
     /** ECDH-ES Agreement PartyVInfo. */
-    apv?: Uint8Array;
+    apv?: Uint8Array<ArrayBuffer>;
 }
 /** Result of the wrapKey function. */
 interface WrapKeyResult {
     /** The wrapped key (Ciphertext). */
-    encryptedKey: Uint8Array;
+    encryptedKey: Uint8Array<ArrayBuffer>;
     /** Initialization Vector used (only for AES-GCMKW). Base64URL encoded. */
     iv?: string;
     /** Authentication Tag generated (only for AES-GCMKW). Base64URL encoded. */
@@ -78,19 +78,19 @@ interface WrapKeyResult {
 /** Options for the unwrapKey function. */
 interface UnwrapKeyOptions {
     /** Initialization Vector (required for AES-GCMKW). Base64URL encoded or Uint8Array. */
-    iv?: Uint8Array | string;
+    iv?: Uint8Array<ArrayBuffer> | string;
     /** Authentication Tag (required for AES-GCMKW). Base64URL encoded or Uint8Array. */
-    tag?: Uint8Array | string;
+    tag?: Uint8Array<ArrayBuffer> | string;
     /** PBES2 Salt value (required for PBES2). Base64URL encoded or Uint8Array. */
-    p2s?: Uint8Array | string;
+    p2s?: Uint8Array<ArrayBuffer> | string;
     /** PBES2 Iteration count (required for PBES2). */
     p2c?: number;
     /** ECDH-ES Ephemeral Public Key (required for ECDH-ES). */
     epk?: JWK_EC_Public;
     /** ECDH-ES Agreement PartyUInfo. Base64URL encoded or Uint8Array. */
-    apu?: Uint8Array | string;
+    apu?: Uint8Array<ArrayBuffer> | string;
     /** ECDH-ES Agreement PartyVInfo. Base64URL encoded or Uint8Array. */
-    apv?: Uint8Array | string;
+    apv?: Uint8Array<ArrayBuffer> | string;
     /** Expected unwrapped key algorithm (e.g., 'AES-GCM', 'AES-CBC'). Used by crypto.subtle.unwrapKey. */
     unwrappedKeyAlgorithm?: string | Algorithm | RsaOaepParams | AesCtrParams | AesCbcParams | AesGcmParams;
     /** Expected key usages for the unwrapped key. */
@@ -203,8 +203,83 @@ type JWK_PBES2 = "PBES2-HS256+A128KW" | "PBES2-HS384+A192KW" | "PBES2-HS512+A256
 type JWK_ECDH_ES = "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A192KW" | "ECDH-ES+A256KW";
 type JWK_ED = "Ed25519" | "EdDSA";
 type JWK_Symmetric_Algorithm = JWK_HMAC | JWK_AES_KW | JWK_AES_GCM;
-type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA_ENC;
+type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA_ENC | JWK_ED;
 type JWKAlgorithm = JWK_Symmetric_Algorithm | JWK_Asymmetric_Algorithm | JWK_AES_CBC_HMAC | JWK_PBES2 | JWK_ECDH_ES | ("none" | "dir");
 type JWKPEMAlgorithm = JWK_RSA_PSS | JWK_RSA_SIGN | JWK_RSA_ENC | JWK_ECDSA | JWK_ECDH_ES | JWK_ED;
 
-export type { JWK_Symmetric_Algorithm as A, JWK_Asymmetric_Algorithm as B, CompositeKey as C, DeriveKeyOptions as D, JWKAlgorithm as E, JWKPEMAlgorithm as F, GenerateKeyAlgorithm as G, JWKParameters as J, KeyManagementAlgorithm as K, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, DeriveKeyReturn as c, ContentEncryptionAlgorithm as d, WrapKeyResult as e, JWK_EC_Public as f, JWK_EC_Private as g, JWK_EC as h, JWK_RSA_Public as i, JWK_RSA_Private as j, JWK_RSA as k, JWK_oct as l, JWK as m, JWKSet as n, JWK_HMAC as o, JWK_RSA_SIGN as p, JWK_RSA_PSS as q, JWK_ECDSA as r, JWK_RSA_ENC as s, JWK_AES_KW as t, JWK_AES_GCM_KW as u, JWK_AES_CBC_HMAC as v, JWK_AES_GCM as w, JWK_PBES2 as x, JWK_ECDH_ES as y, JWK_ED as z };
+/** Header Parameters common to JWE and JWS */
+interface JoseHeaderParameters {
+    /** "kid" (Key ID) Header Parameter */
+    kid?: string;
+    /** "x5t" (X.509 Certificate SHA-1 Thumbprint) Header Parameter */
+    x5t?: string;
+    /** "x5c" (X.509 Certificate Chain) Header Parameter */
+    x5c?: string[];
+    /** "x5u" (X.509 URL) Header Parameter */
+    x5u?: string;
+    /** "jku" (JWK Set URL) Header Parameter */
+    jku?: string;
+    /** "jwk" (JSON Web Key) Header Parameter */
+    jwk?: JWK_RSA_Public;
+    /** "typ" (Type) Header Parameter */
+    typ?: string;
+    /** "cty" (Content Type) Header Parameter */
+    cty?: string;
+    /** "crit" (Critical) Header Parameter */
+    crit?: string[];
+    /** Any other JWS/JWE Header member. */
+    [propName: string]: unknown;
+}
+interface JWTClaims {
+    /** "iss" (Issuer) Claim */
+    iss?: string;
+    /** "sub" (Subject) Claim */
+    sub?: string;
+    /** "aud" (Audience) Claim */
+    aud?: string | string[];
+    /** "exp" (Expiration Time) Claim */
+    exp?: number;
+    /** "nbf" (Not Before) Claim */
+    nbf?: number;
+    /** "iat" (Issued At) Claim */
+    iat?: number;
+    /** "jti" (JWT ID) Claim */
+    jti?: string;
+    /** Any other JWT member. */
+    [propName: string]: unknown;
+}
+interface JWT<T = JWTClaims> {
+    header: JoseHeaderParameters & {
+        /** "alg" (Algorithm) Header Parameter */
+        alg: string;
+    };
+    claims: T;
+}
+interface JWTClaimValidationOptions {
+    /** Expected JWT "aud" (Audience) Claim value(s). Implies presence requirement. */
+    audience?: string | string[];
+    /** Expected JWT "iss" (Issuer) Claim value(s). Implies presence requirement. */
+    issuer?: string | string[];
+    /** Expected JWT "sub" (Subject) Claim value. Implies presence requirement. */
+    subject?: string;
+    /** Maximum token age in seconds, from the JWT "iat" (Issued At) Claim value. Implies presence requirement. */
+    maxTokenAge?: number;
+    /** Clock skew tolerance (in seconds) for validating time-based claims (nbf/exp/iat). */
+    clockTolerance?: number;
+    /** Expected JWT "typ" (Type) Header Parameter value. Implies presence requirement. */
+    typ?: string;
+    /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
+    currentDate?: Date;
+    /** Additional required claim names. */
+    requiredClaims?: string[];
+    /** List of critical header parameters that must be understood and processed. */
+    requiredHeaders?: string[];
+    /**
+     * Critical Header Parameters to be understood and processed.
+     * If the JWT contains critical headers not in this list (and not inherently understood by the library), decryption will fail.
+     * @deprecated use {@link requiredHeaders `recognizedHeaders` option} instead.
+     */
+    critical?: string[];
+}
+
+export type { JWK_Symmetric_Algorithm as A, JWK_Asymmetric_Algorithm as B, CompositeKey as C, DeriveKeyOptions as D, JWKAlgorithm as E, JWKPEMAlgorithm as F, GenerateKeyAlgorithm as G, JoseHeaderParameters as H, JWTClaims as I, JWKParameters as J, KeyManagementAlgorithm as K, JWT as L, JWTClaimValidationOptions as M, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, DeriveKeyReturn as c, ContentEncryptionAlgorithm as d, WrapKeyResult as e, JWK_EC_Public as f, JWK_EC_Private as g, JWK_EC as h, JWK_RSA_Public as i, JWK_RSA_Private as j, JWK_RSA as k, JWK_oct as l, JWK as m, JWKSet as n, JWK_HMAC as o, JWK_RSA_SIGN as p, JWK_RSA_PSS as q, JWK_ECDSA as r, JWK_RSA_ENC as s, JWK_AES_KW as t, JWK_AES_GCM_KW as u, JWK_AES_CBC_HMAC as v, JWK_AES_GCM as w, JWK_PBES2 as x, JWK_ECDH_ES as y, JWK_ED as z };

package/dist/shared/unjwt.CUUg6g3N.d.mts

@@ -0,0 +1,128 @@
+import { I as JWTClaims, M as JWTClaimValidationOptions, m as JWK, n as JWKSet } from './unjwt.CN1C8TlR.mjs';
+
+/**
+ * Apply default typ/cty semantics shared by JWS & JWE.
+ * - If typ is undefined and payload is a non-Uint8Array object, set typ="JWT".
+ * - If typ is "JWT" and payload is a non-Uint8Array object, ensure cty defaults to "json".
+ */
+declare function applyTypCtyDefaults<T extends {
+    typ?: string;
+    cty?: string;
+}>(header: T, payload: unknown): T;
+/** Returns true when headers indicate JSON content. */
+declare function isJsonContent(header: {
+    typ?: string;
+    cty?: string;
+} | undefined): boolean;
+/**
+ * Given a decoded string and JOSE headers, return an object if JSON, otherwise the string.
+ */
+declare function decodeMaybeJsonString<T = unknown>(decodedString: string, header: {
+    typ?: string;
+    cty?: string;
+} | undefined): T | string;
+/**
+ * Decode a payload that is represented as raw bytes into T | string, honoring forceUint8Array and headers.
+ */
+declare function decodePayloadFromBytes<T = unknown>(bytes: Uint8Array<ArrayBuffer>, header: {
+    typ?: string;
+    cty?: string;
+} | undefined, forceUint8Array?: boolean): T | Uint8Array<ArrayBuffer> | string;
+/**
+ * Decode a payload that is a Base64URL segment into T | string | Uint8Array based on flags and headers.
+ */
+declare function decodePayloadFromB64UrlSegment<T = unknown>(payloadEncoded: string, header: {
+    typ?: string;
+    cty?: string;
+} | undefined, forceUint8Array?: boolean): T | Uint8Array<ArrayBuffer> | string;
+/** Convert plaintext input to bytes, shared by JWS & JWE when preparing payload. */
+declare function getPlaintextBytes(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>): Uint8Array<ArrayBuffer>;
+/** Optionally compute iat/exp when signing JWTs. */
+declare function computeJwtTimeClaims(payload: unknown, headerTyp: string | undefined, expiresIn?: number, currentDate?: Date): JWTClaims | undefined;
+/** Validate JWT claims under JWS verification rules (or custom JWE implementations). */
+declare function validateJwtClaims(jwtClaims: JWTClaims, options?: JWTClaimValidationOptions): void;
+/** Validate critical headers in JWS semantics. */
+declare function validateCriticalHeadersJWS(protectedHeader: {
+    crit?: string[];
+} & Record<string, any>, requiredHeaders?: string[]): void;
+/** Validate critical headers in JWE semantics. */
+declare function validateCriticalHeadersJWE(protectedHeader: {
+    crit?: string[];
+} & Record<string, any>, understoodFromOptions?: string[]): void;
+
+declare const textEncoder: TextEncoder;
+declare const textDecoder: TextDecoder;
+declare function base64Encode(data: Uint8Array<ArrayBuffer> | string): string;
+declare function base64UrlEncode(data: Uint8Array<ArrayBuffer> | string): string;
+declare function base64Decode(str: string | undefined): string;
+declare function base64Decode<T extends boolean | undefined>(str?: string | undefined, toString?: T): T extends false ? Uint8Array<ArrayBuffer> : string;
+declare function base64UrlDecode(str: string | undefined): string;
+declare function base64UrlDecode<T extends boolean | undefined>(str?: string | undefined, toString?: T): T extends false ? Uint8Array<ArrayBuffer> : string;
+declare function randomBytes(length: Readonly<number>): Uint8Array<ArrayBuffer>;
+/**
+ * Concatenates multiple Uint8Arrays
+ * @param arrays Arrays to concatenate
+ * @returns Concatenated array
+ */
+declare function concatUint8Arrays(...arrays: Readonly<Uint8Array<ArrayBuffer>[]>): Uint8Array<ArrayBuffer>;
+declare function maybeArray<T>(item: T | T[]): T[];
+declare function isJWK(key: any): key is JWK;
+declare function isJWKSet(key: any): key is JWKSet;
+declare function assertCryptoKey(key: unknown): asserts key is CryptoKey;
+declare function isCryptoKey(key: unknown): key is CryptoKey;
+declare const isCryptoKeyPair: (key: any) => key is CryptoKeyPair;
+
+declare const index_applyTypCtyDefaults: typeof applyTypCtyDefaults;
+declare const index_assertCryptoKey: typeof assertCryptoKey;
+declare const index_base64Decode: typeof base64Decode;
+declare const index_base64Encode: typeof base64Encode;
+declare const index_base64UrlDecode: typeof base64UrlDecode;
+declare const index_base64UrlEncode: typeof base64UrlEncode;
+declare const index_computeJwtTimeClaims: typeof computeJwtTimeClaims;
+declare const index_concatUint8Arrays: typeof concatUint8Arrays;
+declare const index_decodeMaybeJsonString: typeof decodeMaybeJsonString;
+declare const index_decodePayloadFromB64UrlSegment: typeof decodePayloadFromB64UrlSegment;
+declare const index_decodePayloadFromBytes: typeof decodePayloadFromBytes;
+declare const index_getPlaintextBytes: typeof getPlaintextBytes;
+declare const index_isCryptoKey: typeof isCryptoKey;
+declare const index_isCryptoKeyPair: typeof isCryptoKeyPair;
+declare const index_isJWK: typeof isJWK;
+declare const index_isJWKSet: typeof isJWKSet;
+declare const index_isJsonContent: typeof isJsonContent;
+declare const index_maybeArray: typeof maybeArray;
+declare const index_randomBytes: typeof randomBytes;
+declare const index_textDecoder: typeof textDecoder;
+declare const index_textEncoder: typeof textEncoder;
+declare const index_validateCriticalHeadersJWE: typeof validateCriticalHeadersJWE;
+declare const index_validateCriticalHeadersJWS: typeof validateCriticalHeadersJWS;
+declare const index_validateJwtClaims: typeof validateJwtClaims;
+declare namespace index {
+  export {
+    index_applyTypCtyDefaults as applyTypCtyDefaults,
+    index_assertCryptoKey as assertCryptoKey,
+    index_base64Decode as base64Decode,
+    index_base64Encode as base64Encode,
+    index_base64UrlDecode as base64UrlDecode,
+    index_base64UrlEncode as base64UrlEncode,
+    index_computeJwtTimeClaims as computeJwtTimeClaims,
+    index_concatUint8Arrays as concatUint8Arrays,
+    index_decodeMaybeJsonString as decodeMaybeJsonString,
+    index_decodePayloadFromB64UrlSegment as decodePayloadFromB64UrlSegment,
+    index_decodePayloadFromBytes as decodePayloadFromBytes,
+    index_getPlaintextBytes as getPlaintextBytes,
+    index_isCryptoKey as isCryptoKey,
+    index_isCryptoKeyPair as isCryptoKeyPair,
+    index_isJWK as isJWK,
+    index_isJWKSet as isJWKSet,
+    index_isJsonContent as isJsonContent,
+    index_maybeArray as maybeArray,
+    index_randomBytes as randomBytes,
+    index_textDecoder as textDecoder,
+    index_textEncoder as textEncoder,
+    index_validateCriticalHeadersJWE as validateCriticalHeadersJWE,
+    index_validateCriticalHeadersJWS as validateCriticalHeadersJWS,
+    index_validateJwtClaims as validateJwtClaims,
+  };
+}
+
+export { textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, isJWKSet as h, index as i, assertCryptoKey as j, isCryptoKey as k, isCryptoKeyPair as l, maybeArray as m, applyTypCtyDefaults as n, isJsonContent as o, decodeMaybeJsonString as p, decodePayloadFromBytes as q, randomBytes as r, decodePayloadFromB64UrlSegment as s, textEncoder as t, getPlaintextBytes as u, computeJwtTimeClaims as v, validateJwtClaims as w, validateCriticalHeadersJWS as x, validateCriticalHeadersJWE as y };