unjwt 0.5.8 → 0.5.10

package/dist/shared/{unjwt.CrcUJklb.d.ts → unjwt.Cz90HQhy.d.mts}

@@ -1,5 +1,4 @@
-import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, x as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, l as JWK_oct, m as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, F as JWKPEMAlgorithm, n as JWKSet, C as CompositeKey, d as ContentEncryptionAlgorithm, E as JWKAlgorithm, J as JWKParameters, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm } from './unjwt.D9da8HQF.js';
-import { J as JoseHeaderParameters } from './unjwt.c10n3uM8.js';
+import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, x as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, l as JWK_oct, m as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, F as JWKPEMAlgorithm, n as JWKSet, H as JoseHeaderParameters, C as CompositeKey, d as ContentEncryptionAlgorithm, E as JWKAlgorithm, J as JWKParameters, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm } from './unjwt.CN1C8TlR.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -31,7 +30,7 @@ declare function generateKey<TAlg extends GenerateKeyAlgorithm, TOptions extends
  * @param options Configuration options including salt and iterations.
  * @returns A Promise resolving to the derived key (CryptoKey) or its JWK_oct representation.
  */
-declare function deriveKeyFromPassword<TAlg extends JWK_PBES2, TOptions extends DeriveKeyOptions>(password: string | Uint8Array, alg: TAlg, options: TOptions): Promise<DeriveKeyReturn<TOptions>>;
+declare function deriveKeyFromPassword<TAlg extends JWK_PBES2, TOptions extends DeriveKeyOptions>(password: string | Uint8Array<ArrayBuffer>, alg: TAlg, options: TOptions): Promise<DeriveKeyReturn<TOptions>>;
 /**
  * Imports a key from various formats (CryptoKey, JWK, Uint8Array).
  *
@@ -44,11 +43,11 @@ declare function deriveKeyFromPassword<TAlg extends JWK_PBES2, TOptions extends
  * @param alg The algorithm hint, required when importing asymmetric JWKs.
  * @returns A Promise resolving to the imported key as CryptoKey or Uint8Array.
  */
-declare function importKey(key: string): Promise<Uint8Array>;
-declare function importKey(key: Uint8Array): Promise<Uint8Array>;
+declare function importKey(key: string): Promise<Uint8Array<ArrayBuffer>>;
+declare function importKey(key: Uint8Array<ArrayBuffer>): Promise<Uint8Array<ArrayBuffer>>;
 declare function importKey(key: CryptoKey): Promise<CryptoKey>;
-declare function importKey(key: JWK_oct): Promise<Uint8Array>;
-declare function importKey(key: CryptoKey | JWK | Uint8Array | string, alg?: string): Promise<CryptoKey | Uint8Array>;
+declare function importKey(key: JWK_oct): Promise<Uint8Array<ArrayBuffer>>;
+declare function importKey(key: CryptoKey | JWK | Uint8Array<ArrayBuffer> | string, alg?: string): Promise<CryptoKey | Uint8Array<ArrayBuffer>>;
 /**
  * Exports a CryptoKey to a JWK (JSON Web Key) format.
  *
@@ -56,7 +55,7 @@ declare function importKey(key: CryptoKey | JWK | Uint8Array | string, alg?: str
  * @param jwk Optional partial JWK to merge with the exported key, allowing overrides.
  * @returns A Promise resolving to the exported JWK.
  */
-declare function exportKey(key: CryptoKey, jwk?: Partial<JWK>): Promise<JWK>;
+declare function exportKey<T extends JWK>(key: CryptoKey, jwk?: Partial<JWK>): Promise<T>;
 /**
  * Wraps a Content Encryption Key (CEK) using the specified algorithm and wrapping key.
  *
@@ -66,7 +65,7 @@ declare function exportKey(key: CryptoKey, jwk?: Partial<JWK>): Promise<JWK>;
  * @param options Additional options required by certain algorithms (e.g., p2s, p2c for PBES2).
  * @returns A Promise resolving to an object containing the wrapped key and any necessary parameters (iv, tag, epk, etc.).
  */
-declare function wrapKey(alg: KeyManagementAlgorithm, keyToWrap: CryptoKey | Uint8Array, wrappingKey: CryptoKey | JWK | string | Uint8Array, options?: WrapKeyOptions): Promise<WrapKeyResult>;
+declare function wrapKey(alg: KeyManagementAlgorithm, keyToWrap: CryptoKey | Uint8Array<ArrayBuffer>, wrappingKey: CryptoKey | JWK | string | Uint8Array<ArrayBuffer>, options?: WrapKeyOptions): Promise<WrapKeyResult>;
 /**
  * Unwraps a Content Encryption Key (CEK) using the specified algorithm and unwrapping key.
  *
@@ -76,9 +75,9 @@ declare function wrapKey(alg: KeyManagementAlgorithm, keyToWrap: CryptoKey | Uin
  * @param options Additional options required by certain algorithms (e.g., iv, tag, p2s, p2c, epk).
  * @returns A Promise resolving to the unwrapped key (CEK) as a CryptoKey or Uint8Array.
  */
-declare function unwrapKey<T extends boolean | undefined = undefined>(alg: KeyManagementAlgorithm, wrappedKey: Uint8Array, unwrappingKey: CryptoKey | JWK | string | Uint8Array, options?: UnwrapKeyOptions & {
+declare function unwrapKey<T extends boolean | undefined = undefined>(alg: KeyManagementAlgorithm, wrappedKey: Uint8Array<ArrayBuffer>, unwrappingKey: CryptoKey | JWK | string | Uint8Array<ArrayBuffer>, options?: UnwrapKeyOptions & {
     returnAs?: T;
-}): Promise<T extends false ? Uint8Array : CryptoKey>;
+}): Promise<T extends false ? Uint8Array<ArrayBuffer> : CryptoKey>;
 /**
  * Imports a key from a PEM-encoded string and converts it to a JWK.
  *
@@ -90,7 +89,7 @@ declare function unwrapKey<T extends boolean | undefined = undefined>(alg: KeyMa
  * @param jwkExtras Additional properties to merge into the resulting JWK.
  * @returns A Promise resolving to the imported key as a JWK.
  */
-declare function importJWKFromPEM(pem: string, pemType: "pkcs8" | "spki" | "x509", alg: JWKPEMAlgorithm, importOptions?: KeyImportOptions, jwkExtras?: Partial<JWK>): Promise<JWK>;
+declare function importJWKFromPEM<T extends JWK>(pem: string, pemType: "pkcs8" | "spki" | "x509", alg: JWKPEMAlgorithm, importOptions?: KeyImportOptions, jwkExtras?: Partial<JWK>): Promise<T>;
 /**
  * Exports a JWK to a PEM-encoded string.
  *

package/dist/shared/{unjwt.B2olxeGL.mjs → unjwt.D0WA_yog.mjs}

@@ -1,6 +1,6 @@
-import { a as checkEncCryptoKey, u as uint32be, b as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, d as bitLengthCEK, f as jwkTokey, i as importKey, h as generateIV, l as encrypt$1, m as unwrapKey, n as decrypt$1 } from './unjwt.DRUXIabl.mjs';
-import { f as concatUint8Arrays, t as textEncoder, g as assertCryptoKey, b as base64UrlEncode, h as isCryptoKey, a as isJWK, d as base64UrlDecode, r as randomBytes, c as textDecoder } from './unjwt.BHpknTpg.mjs';
-import { c as checkKeyLength } from './unjwt.Ca03jPX3.mjs';
+import { a as checkEncCryptoKey, u as uint32be, b as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, d as bitLengthCEK, f as jwkTokey, i as importKey, h as generateIV, l as encrypt$1, m as unwrapKey, n as decrypt$1 } from './unjwt.BrOta13J.mjs';
+import { k as concatUint8Arrays, t as textEncoder, l as assertCryptoKey, d as base64UrlEncode, m as isCryptoKey, a as isJWK, f as base64UrlDecode, r as randomBytes, b as applyTypCtyDefaults, c as computeJwtTimeClaims, n as getPlaintextBytes, o as decodePayloadFromBytes, p as validateCriticalHeadersJWE } from './unjwt.odifuYKu.mjs';
+import { c as checkKeyLength } from './unjwt.CEjyBwhK.mjs';
 
 function lengthAndInput(input) {
   return concatUint8Arrays(uint32be(input.length), input);
@@ -218,7 +218,6 @@ async function encrypt(payload, key, options = {}) {
   if (!enc) {
     enc = isJWK(key) && "enc" in key ? key.enc : "A128GCM";
   }
-  const plaintextBytes = getPlaintextBytes(payload);
   const jweKeyManagementParams = {};
   if (keyManagementIV) jweKeyManagementParams.iv = keyManagementIV;
   if (p2s) jweKeyManagementParams.p2s = p2s;
@@ -252,13 +251,15 @@ async function encrypt(payload, key, options = {}) {
     alg,
     enc
   };
-  if (jweProtectedHeader.typ === void 0 && typeof payload === "object" && !(payload instanceof Uint8Array)) {
-    jweProtectedHeader.typ = "JWT";
-  }
-  if (jweProtectedHeader.typ === "JWT" && typeof payload === "object" && !(payload instanceof Uint8Array)) {
-    jweProtectedHeader.cty ||= "json";
-  }
-  const protectedHeaderSerialized = JSON.stringify(jweProtectedHeader);
+  const protectedHeader = applyTypCtyDefaults(jweProtectedHeader, payload);
+  const computedPayload = computeJwtTimeClaims(
+    payload,
+    protectedHeader.typ,
+    options.expiresIn,
+    options.currentDate
+  );
+  const plaintextBytes = getPlaintextBytes(computedPayload || payload);
+  const protectedHeaderSerialized = JSON.stringify(protectedHeader);
   const protectedHeaderEncoded = base64UrlEncode(protectedHeaderSerialized);
   const aadBytes = textEncoder.encode(protectedHeaderEncoded);
   const contentIVBytes = providedContentIV ?? generateIV(enc);
@@ -345,7 +346,7 @@ async function decrypt(jwe, key, options) {
     keyUsage: options?.keyUsage,
     extractable: options?.extractable,
     returnAs: false
-    // Returning CEK as Uint8Array
+    // Returning CEK as Uint8Array<ArrayBuffer>
   };
   const cekBytes = await unwrapKey(
     alg,
@@ -362,66 +363,15 @@ async function decrypt(jwe, key, options) {
     contentAuthTagBytes,
     aadBytes
   );
-  let payload;
-  if (options?.forceUint8Array) {
-    payload = plaintextBytes;
-  } else {
-    const decodedString = textDecoder.decode(plaintextBytes);
-    const cty = protectedHeader.cty?.toLowerCase();
-    const isJsonOutput = protectedHeader.typ === "JWT" || cty === "json" || cty === "application/json" || cty && cty.endsWith("+json");
-    if (isJsonOutput) {
-      if (decodedString.startsWith("{") && decodedString.endsWith("}") || decodedString.startsWith("[") && decodedString.endsWith("]")) {
-        try {
-          payload = JSON.parse(decodedString);
-        } catch {
-          payload = decodedString;
-        }
-      } else {
-        payload = decodedString;
-      }
-    } else {
-      payload = decodedString;
-    }
-  }
-  if (options?.critical && protectedHeader.crit) {
-    const understoodParams = /* @__PURE__ */ new Set([
-      ...options.critical || [],
-      // JWE specific standard headers:
-      "alg",
-      "enc",
-      "typ",
-      "cty",
-      "kid",
-      "jwk",
-      "jku",
-      "x5c",
-      "x5t",
-      "x5u",
-      "iv",
-      "tag",
-      "p2s",
-      "p2c",
-      "epk",
-      "apu",
-      "apv"
-    ]);
-    for (const critParam of protectedHeader.crit) {
-      if (!Object.prototype.hasOwnProperty.call(protectedHeader, critParam)) {
-        throw new Error(
-          `Critical header parameter "${critParam}" listed in "crit" but not present in the protected header.`
-        );
-      }
-      if (!understoodParams.has(critParam)) {
-        throw new Error(
-          `Critical header parameter not understood: ${critParam}`
-        );
-      }
-    }
-  } else if (!options?.critical && protectedHeader.crit) {
-    throw new Error(
-      `Unprocessed critical header parameters: ${protectedHeader.crit.join(", ")}`
-    );
-  }
+  const payload = decodePayloadFromBytes(
+    plaintextBytes,
+    protectedHeader,
+    options?.forceUint8Array
+  );
+  validateCriticalHeadersJWE(protectedHeader, [
+    ...options?.critical || [],
+    ...options?.requiredHeaders || []
+  ]);
   return {
     payload,
     protectedHeader,
@@ -429,20 +379,6 @@ async function decrypt(jwe, key, options) {
     aad: aadBytes
   };
 }
-function getPlaintextBytes(payload) {
-  if (payload instanceof Uint8Array) {
-    return payload;
-  }
-  if (typeof payload === "string") {
-    return textEncoder.encode(payload);
-  }
-  if (typeof payload === "object" && payload !== null) {
-    return textEncoder.encode(JSON.stringify(payload));
-  }
-  throw new TypeError(
-    "Plaintext must be a string, Uint8Array, or a JSON-serializable object."
-  );
-}
 
 const jwe = {
   __proto__: null,

package/dist/shared/{unjwt.8w7jp2aw.d.mts → unjwt.Dof5OLMV.d.mts}

@@ -1,5 +1,4 @@
-import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, f as JWK_EC_Public, m as JWK } from './unjwt.D9da8HQF.mjs';
-import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.BvIkEGGz.mjs';
+import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, H as JoseHeaderParameters, f as JWK_EC_Public, m as JWK, M as JWTClaimValidationOptions, I as JWTClaims } from './unjwt.CN1C8TlR.mjs';
 
 /** Recognized JWE Header Parameters, any other Header Members may also be present. */
 interface JWEHeaderParameters extends JoseHeaderParameters {
@@ -44,8 +43,8 @@ interface JWEHeaderParameters extends JoseHeaderParameters {
 }
 /** Recognized JWE Key Management-related Header Parameters. */
 interface JWEKeyManagementHeaderParameters {
-    apu?: Uint8Array;
-    apv?: Uint8Array;
+    apu?: Uint8Array<ArrayBuffer>;
+    apv?: Uint8Array<ArrayBuffer>;
     /**
      * For Internal use only
      */
@@ -53,11 +52,11 @@ interface JWEKeyManagementHeaderParameters {
     /**
      * For Internal use only
      */
-    p2s?: Uint8Array;
+    p2s?: Uint8Array<ArrayBuffer>;
     /**
      * For Internal use only
      */
-    iv?: Uint8Array;
+    iv?: Uint8Array<ArrayBuffer>;
     /**
      * For Internal use only
      */
@@ -71,48 +70,47 @@ interface JWEEncryptOptions {
     alg?: KeyManagementAlgorithm;
     /** JWE "enc" (Encryption Algorithm) Header Parameter. Content Encryption Algorithm. */
     enc?: ContentEncryptionAlgorithm;
+    /** Date to use when computing NumericDate claims, defaults to `new Date()`. */
+    currentDate?: Date;
+    /** Time at which the JWT should expire, if no `exp` was already provided (only when typ is JWT). */
+    expiresIn?: number;
     /** Additional JWE Protected Header parameters. */
     protectedHeader?: Omit<JWEHeaderParameters, "alg" | "enc" | "iv" | "tag" | "p2s" | "p2c" | "apu" | "apv">;
     /** Initialization Vector for AES-GCMKW key wrapping. Generated if not provided. */
-    keyManagementIV?: Uint8Array;
+    keyManagementIV?: Uint8Array<ArrayBuffer>;
     /** PBES2 Salt value (p2s). Required for PBES2 algorithms. */
-    p2s?: Uint8Array;
+    p2s?: Uint8Array<ArrayBuffer>;
     /** PBES2 Iteration count (p2c). Required for PBES2 algorithms. */
     p2c?: number;
     /** ECDH-ES Agreement PartyUInfo. */
-    ecdhPartyUInfo?: Uint8Array;
+    ecdhPartyUInfo?: Uint8Array<ArrayBuffer>;
     /** ECDH-ES Agreement PartyVInfo. */
-    ecdhPartyVInfo?: Uint8Array;
+    ecdhPartyVInfo?: Uint8Array<ArrayBuffer>;
     /**
      * Content Encryption Key (CEK) to use.
      * If provided, it will be used directly. Otherwise, a CEK will be generated.
      */
-    cek?: Uint8Array;
+    cek?: Uint8Array<ArrayBuffer>;
     /**
      * Initialization Vector for content encryption.
      * If provided, it will be used. Otherwise, one will be generated.
      */
-    contentEncryptionIV?: Uint8Array;
+    contentEncryptionIV?: Uint8Array<ArrayBuffer>;
 }
 /**
  * Key lookup function for JWE decryption.
  * @param header The JWE Protected Header.
  * @returns The key material (CryptoKey, JWK, password string, or raw Uint8Array) or a Promise resolving to it.
  */
-type JWEKeyLookupFunction = (header: JWEHeaderParameters, token: string) => CryptoKey | JWK | string | Uint8Array | Promise<CryptoKey | JWK | string | Uint8Array>;
+type JWEKeyLookupFunction = (header: JWEHeaderParameters, token: string) => CryptoKey | JWK | string | Uint8Array<ArrayBuffer> | Promise<CryptoKey | JWK | string | Uint8Array<ArrayBuffer>>;
 /**
  * JWE (JSON Web Encryption) decryption options
  */
-interface JWEDecryptOptions {
+interface JWEDecryptOptions extends JWTClaimValidationOptions {
     /** A list of allowed JWE "alg" (Algorithm) Header Parameter values for key management. */
     algorithms?: KeyManagementAlgorithm[];
     /** A list of allowed JWE "enc" (Encryption Algorithm) Header Parameter values for content encryption. */
     encryptionAlgorithms?: ContentEncryptionAlgorithm[];
-    /**
-     * Critical Header Parameters to be understood and processed.
-     * If the JWE contains critical headers not in this list (and not inherently understood by the library), decryption will fail.
-     */
-    critical?: string[];
     /** Algorithm to import the unwrapped CEK as (e.g., { name: 'AES-GCM' }). Defaults based on 'enc'. */
     unwrappedKeyAlgorithm?: Parameters<typeof crypto.subtle.importKey>[2];
     /** Key usages for the unwrapped CEK. Defaults based on 'enc' (typically ['encrypt', 'decrypt']). */
@@ -125,15 +123,15 @@ interface JWEDecryptOptions {
 /**
  * Result of a JWE decryption operation.
  */
-interface JWEDecryptResult<T extends JWTClaims | Uint8Array | string = JWTClaims | Uint8Array | string> {
+interface JWEDecryptResult<T extends JWTClaims | Uint8Array<ArrayBuffer> | string = JWTClaims | Uint8Array<ArrayBuffer> | string> {
     /** The decrypted payload. */
     payload: T;
     /** The JWE Protected Header. */
     protectedHeader: JWEHeaderParameters;
     /** The Content Encryption Key (CEK) used for decryption, as Uint8Array. */
-    cek: Uint8Array;
+    cek: Uint8Array<ArrayBuffer>;
     /** The Additional Authenticated Data (AAD) used, as Uint8Array. */
-    aad: Uint8Array;
+    aad: Uint8Array<ArrayBuffer>;
 }
 
 /**
@@ -144,17 +142,17 @@ interface JWEDecryptResult<T extends JWTClaims | Uint8Array | string = JWTClaims
  * @param options JWE encryption options, including `alg` (key management algorithm) and `enc` (content encryption algorithm).
  * @returns A Promise resolving to the JWE Compact Serialization string.
  */
-declare function encrypt(payload: JWTClaims, key: JWK | string | Uint8Array, options?: JWEEncryptOptions): Promise<string>;
-declare function encrypt(payload: string | Uint8Array | Record<string, any>, key: JWK | string | Uint8Array, options?: JWEEncryptOptions): Promise<string>;
+declare function encrypt(payload: JWTClaims, key: JWK | string | Uint8Array<ArrayBuffer>, options?: JWEEncryptOptions): Promise<string>;
+declare function encrypt(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: JWK | string | Uint8Array<ArrayBuffer>, options?: JWEEncryptOptions): Promise<string>;
 declare function encrypt(payload: JWTClaims, key: CryptoKey, options: JWEEncryptOptions & {
     alg: KeyManagementAlgorithm;
     enc: ContentEncryptionAlgorithm;
 }): Promise<string>;
-declare function encrypt(payload: string | Uint8Array | Record<string, any>, key: CryptoKey, options: JWEEncryptOptions & {
+declare function encrypt(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: CryptoKey, options: JWEEncryptOptions & {
     alg: KeyManagementAlgorithm;
     enc: ContentEncryptionAlgorithm;
 }): Promise<string>;
-declare function encrypt(payload: string | Uint8Array | Record<string, any>, key: CryptoKey | JWK | string | Uint8Array, options: JWEEncryptOptions & {
+declare function encrypt(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: CryptoKey | JWK | string | Uint8Array<ArrayBuffer>, options: JWEEncryptOptions & {
     alg: KeyManagementAlgorithm;
     enc: ContentEncryptionAlgorithm;
 }): Promise<string>;
@@ -167,13 +165,13 @@ declare function encrypt(payload: string | Uint8Array | Record<string, any>, key
  * @returns A Promise resolving to an object containing the decrypted plaintext, protected header, CEK, and AAD.
  * @throws If JWE is invalid, decryption fails, or options are not met.
  */
-declare function decrypt<T extends JWTClaims | Uint8Array | string>(jwe: string, key: CryptoKey | JWK | string | Uint8Array | JWEKeyLookupFunction, options?: JWEDecryptOptions): Promise<JWEDecryptResult<T>>;
-declare function decrypt(jwe: string, key: CryptoKey | JWK | string | Uint8Array | JWEKeyLookupFunction, options: JWEDecryptOptions & {
+declare function decrypt<T extends JWTClaims | Uint8Array<ArrayBuffer> | string>(jwe: string, key: CryptoKey | JWK | string | Uint8Array<ArrayBuffer> | JWEKeyLookupFunction, options?: JWEDecryptOptions): Promise<JWEDecryptResult<T>>;
+declare function decrypt(jwe: string, key: CryptoKey | JWK | string | Uint8Array<ArrayBuffer> | JWEKeyLookupFunction, options: JWEDecryptOptions & {
     forceUint8Array: true;
-}): Promise<JWEDecryptResult<Uint8Array>>;
+}): Promise<JWEDecryptResult<Uint8Array<ArrayBuffer>>>;
 
 type jwe_JWEDecryptOptions = JWEDecryptOptions;
-type jwe_JWEDecryptResult<T extends JWTClaims | Uint8Array | string = JWTClaims | Uint8Array | string> = JWEDecryptResult<T>;
+type jwe_JWEDecryptResult<T extends JWTClaims | Uint8Array<ArrayBuffer> | string = JWTClaims | Uint8Array<ArrayBuffer> | string> = JWEDecryptResult<T>;
 type jwe_JWEEncryptOptions = JWEEncryptOptions;
 type jwe_JWEHeaderParameters = JWEHeaderParameters;
 type jwe_JWEKeyLookupFunction = JWEKeyLookupFunction;

package/dist/shared/{unjwt.w-IAnI15.d.ts → unjwt.igKyF5q2.d.mts}

@@ -1,5 +1,4 @@
-import { o as JWK_HMAC, p as JWK_RSA_SIGN, q as JWK_RSA_PSS, r as JWK_ECDSA, m as JWK, n as JWKSet } from './unjwt.D9da8HQF.js';
-import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.c10n3uM8.js';
+import { o as JWK_HMAC, p as JWK_RSA_SIGN, q as JWK_RSA_PSS, r as JWK_ECDSA, H as JoseHeaderParameters, m as JWK, n as JWKSet, M as JWTClaimValidationOptions, I as JWTClaims } from './unjwt.CN1C8TlR.mjs';
 
 type JWS_SIGN_EXTRA = "Ed25519" | "EdDSA";
 /** JWS Signing Algorithm Identifier. */
@@ -39,73 +38,18 @@ interface JWSSignOptions {
     expiresIn?: number;
 }
 /** Result of JWS verification */
-interface JWSVerifyResult<T extends JWTClaims | Uint8Array | string = JWTClaims | Uint8Array | string> {
+interface JWSVerifyResult<T extends JWTClaims | Uint8Array<ArrayBuffer> | string = JWTClaims | Uint8Array<ArrayBuffer> | string> {
     /** The decoded and verified payload. */
     payload: T;
     /** The JWS Protected Header. */
     protectedHeader: JWSProtectedHeader;
 }
 /** Options for JWS verification */
-interface JWSVerifyOptions {
+interface JWSVerifyOptions extends JWTClaimValidationOptions {
     /** List of allowed algorithms. If provided, the JWS `alg` must be in this list. */
     algorithms?: JWSAlgorithm[];
     /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred. */
     forceUint8Array?: boolean;
-    /**
-     * Expected JWT "aud" (Audience) Claim value(s).
-     *
-     * This option makes the JWT "aud" (Audience) Claim presence required.
-     */
-    audience?: string | string[];
-    /**
-     * Clock skew tolerance (in seconds) for validating JWT claims.
-     *
-     * Used when validating the JWT "nbf" (Not Before) and "exp" (Expiration Time) claims, and when
-     * validating the "iat" (Issued At) claim if the {@link maxTokenAge `maxTokenAge` option} is set.
-     */
-    clockTolerance?: number;
-    /**
-     * Expected JWT "iss" (Issuer) Claim value(s).
-     *
-     * This option makes the JWT "iss" (Issuer) Claim presence required.
-     */
-    issuer?: string | string[];
-    /**
-     * Maximum time elapsed (in seconds) from the JWT "iat" (Issued At) Claim value.
-     *
-     * This option makes the JWT "iat" (Issued At) Claim presence required.
-     */
-    maxTokenAge?: number;
-    /**
-     * Expected JWT "sub" (Subject) Claim value.
-     *
-     * This option makes the JWT "sub" (Subject) Claim presence required.
-     */
-    subject?: string;
-    /**
-     * Expected JWT "typ" (Type) Header Parameter value.
-     *
-     * This option makes the JWT "typ" (Type) Header Parameter presence required.
-     */
-    typ?: string;
-    /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
-    currentDate?: Date;
-    /** List of critical header parameters that must be understood and processed. */
-    requiredHeaders?: string[];
-    /**
-     * Array of required Claim Names that must be present in the JWT Claims Set. Default is that: if
-     * the {@link issuer `issuer` option} is set, then JWT "iss" (Issuer) Claim must be present; if the
-     * {@link audience `audience` option} is set, then JWT "aud" (Audience) Claim must be present; if
-     * the {@link subject `subject` option} is set, then JWT "sub" (Subject) Claim must be present; if
-     * the {@link maxTokenAge `maxTokenAge` option} is set, then JWT "iat" (Issued At) Claim must be
-     * present.
-     */
-    requiredClaims?: string[];
-    /**
-     * List of critical header parameters that must be understood and processed.
-     * @deprecated use {@link requiredHeaders `recognizedHeaders` option} instead.
-     */
-    critical?: string[];
 }
 /**
  * Key lookup function for JWS verification.
@@ -113,7 +57,7 @@ interface JWSVerifyOptions {
  * @param token The JWS token.
  * @returns The key material (CryptoKey, JWK, or raw Uint8Array) or a Promise resolving to it.
  */
-type JWSKeyLookupFunction = (header: JWSProtectedHeader, token: string) => CryptoKey | JWK | JWKSet | Uint8Array | Promise<CryptoKey | JWK | JWKSet | Uint8Array>;
+type JWSKeyLookupFunction = (header: JWSProtectedHeader, token: string) => CryptoKey | JWK | JWKSet | Uint8Array<ArrayBuffer> | Promise<CryptoKey | JWK | JWKSet | Uint8Array<ArrayBuffer>>;
 
 /**
  * Creates a JWS (JSON Web Signature) in Compact Serialization format.
@@ -124,20 +68,20 @@ type JWSKeyLookupFunction = (header: JWSProtectedHeader, token: string) => Crypt
  * @returns A Promise resolving to the JWS Compact Serialization string.
  */
 declare function sign(payload: JWTClaims, key: JWK, options?: JWSSignOptions): Promise<string>;
-declare function sign(payload: string | Uint8Array | Record<string, any>, key: JWK, options?: JWSSignOptions): Promise<string>;
+declare function sign(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: JWK, options?: JWSSignOptions): Promise<string>;
 declare function sign(payload: JWTClaims, key: CryptoKey, options: JWSSignOptions & {
     alg: JWSAlgorithm;
 }): Promise<string>;
-declare function sign(payload: string | Uint8Array | Record<string, any>, key: CryptoKey, options: JWSSignOptions & {
+declare function sign(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: CryptoKey, options: JWSSignOptions & {
     alg: JWSAlgorithm;
 }): Promise<string>;
-declare function sign(payload: JWTClaims, key: Uint8Array, options: JWSSignOptions & {
+declare function sign(payload: JWTClaims, key: Uint8Array<ArrayBuffer>, options: JWSSignOptions & {
     alg: JWSAlgorithm;
 }): Promise<string>;
-declare function sign(payload: string | Uint8Array | Record<string, any>, key: Uint8Array, options: JWSSignOptions & {
+declare function sign(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: Uint8Array<ArrayBuffer>, options: JWSSignOptions & {
     alg: JWSAlgorithm;
 }): Promise<string>;
-declare function sign(payload: string | Uint8Array | Record<string, any>, key: CryptoKey | JWK | Uint8Array, options: JWSSignOptions & {
+declare function sign(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: CryptoKey | JWK | Uint8Array<ArrayBuffer>, options: JWSSignOptions & {
     alg: JWSAlgorithm;
 }): Promise<string>;
 /**
@@ -149,10 +93,10 @@ declare function sign(payload: string | Uint8Array | Record<string, any>, key: C
  * @returns A Promise resolving to an object containing the verified payload and protected header.
  * @throws If the JWS is invalid, signature verification fails, or options are not met.
  */
-declare function verify<T extends JWTClaims | Uint8Array | string>(jws: string, key: CryptoKey | JWK | JWKSet | Uint8Array | JWSKeyLookupFunction, options?: JWSVerifyOptions): Promise<JWSVerifyResult<T>>;
-declare function verify(jws: string, key: CryptoKey | JWK | JWKSet | Uint8Array | JWSKeyLookupFunction, options: JWSVerifyOptions & {
+declare function verify<T extends JWTClaims | Uint8Array<ArrayBuffer> | string>(jws: string, key: CryptoKey | JWK | JWKSet | Uint8Array<ArrayBuffer> | JWSKeyLookupFunction, options?: JWSVerifyOptions): Promise<JWSVerifyResult<T>>;
+declare function verify(jws: string, key: CryptoKey | JWK | JWKSet | Uint8Array<ArrayBuffer> | JWSKeyLookupFunction, options: JWSVerifyOptions & {
     forceUint8Array: true;
-}): Promise<JWSVerifyResult<Uint8Array>>;
+}): Promise<JWSVerifyResult<Uint8Array<ArrayBuffer>>>;
 
 type jws_JWSAlgorithm = JWSAlgorithm;
 type jws_JWSHeaderParameters = JWSHeaderParameters;
@@ -160,7 +104,7 @@ type jws_JWSKeyLookupFunction = JWSKeyLookupFunction;
 type jws_JWSProtectedHeader = JWSProtectedHeader;
 type jws_JWSSignOptions = JWSSignOptions;
 type jws_JWSVerifyOptions = JWSVerifyOptions;
-type jws_JWSVerifyResult<T extends JWTClaims | Uint8Array | string = JWTClaims | Uint8Array | string> = JWSVerifyResult<T>;
+type jws_JWSVerifyResult<T extends JWTClaims | Uint8Array<ArrayBuffer> | string = JWTClaims | Uint8Array<ArrayBuffer> | string> = JWSVerifyResult<T>;
 declare const jws_sign: typeof sign;
 declare const jws_verify: typeof verify;
 declare namespace jws {