unjwt 0.5.9 → 0.5.11

package/README.md

@@ -111,7 +111,7 @@ Creates a JWS token.
 - `key`: The signing key (`CryptoKey`, `JWK`, or `Uint8Array` for symmetric keys).
 - `options`:
   - `alg`: (Required) The JWS algorithm (e.g., `"HS256"`, `"RS256"`, `"ES256"`, `"PS256"`).
-  - `protectedHeader`: An object for additional JWS Protected Header parameters (e.g., `kid`, `typ`, `cty`, `crit`, `b64`). If `payload` is an object and `typ` is not set, it defaults to `"JWT"`. The `b64` parameter ([RFC7797 section-3](https://datatracker.ietf.org/doc/html/rfc7797#section-3)) controls payload encoding (defaults to `true`, meaning Base64URL encoded).
+  - `protectedHeader`: An object for additional JWS Protected Header parameters (e.g., `kid`, `typ`, `cty`, `crit`, `b64`). If `payload` is an object and `typ` is not set, it defaults to `"at+jwt"`. The `b64` parameter ([RFC7797 section-3](https://datatracker.ietf.org/doc/html/rfc7797#section-3)) controls payload encoding (defaults to `true`, meaning Base64URL encoded).
   - `expiresIn`: Sets an expiration time in seconds (e.g., `3600` for 1 hour). If `iat` is missing it will be set to the current time. If `exp` is missing it will be set to `iat + expiresIn`. This is only applied if `payload` is a JWT.
   - `currentDate`: The current date for computing `expiresIn` option. Defaults to `new Date()`.
 
@@ -170,7 +170,7 @@ const secret = "supersecretkey";
 
 const { payload, protectedHeader } = await verify(token, secret);
 console.log(payload); // { message: "My important data" }
-console.log(protectedHeader); // { alg: "HS256", typ: "JWT" }
+console.log(protectedHeader); // { alg: "HS256", typ: "at+jwt" }
 ```
 
 **Example (RS256 with key lookup):**
@@ -210,7 +210,7 @@ Encrypts data to produce a JWE token.
 - `options`:
   - `alg`: (Required) The JWE Key Management algorithm (e.g., `"A128KW"`, `"RSA-OAEP-256"`, `"PBES2-HS256+A128KW"`, `"ECDH-ES+A128KW"`), defaults depends on the key provided.
   - `enc`: (Required) The JWE Content Encryption algorithm (e.g., `"A128GCM"`, `"A256CBC-HS512"`), defaults depends on the key provided.
-  - `protectedHeader`: An object for JWE Protected Header parameters (e.g., `kid`, `typ`, `cty`, `crit`, `apu`, `apv`, `p2s`, `p2c`). If `payload` is an object and `typ` is not set, it defaults to `"JWT"`.
+  - `protectedHeader`: An object for JWE Protected Header parameters (e.g., `kid`, `typ`, `cty`, `crit`, `apu`, `apv`, `p2s`, `p2c`). If `payload` is an object and `typ` is not set, it defaults to `"at+jwt"`.
   - `cek`: (Optional) Provide your own Content Encryption Key (`CryptoKey` or `Uint8Array`).
   - `contentEncryptionIV`: (Optional) Provide your own Initialization Vector for content encryption (`Uint8Array`).
   - Other algorithm-specific options like `p2s`, `p2c` (for PBES2), `keyManagementIV`, `ecdhPartyUInfo`, `ecdhPartyVInfo`.

package/dist/index.d.mts

@@ -1,6 +1,5 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.D9da8HQF.mjs';
-export { b as JWT, a as JWTClaims, J as JoseHeaderParameters } from './shared/unjwt.BvIkEGGz.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.D_Mabhgz.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.8w7jp2aw.mjs';
-export { i as utils } from './shared/unjwt.CbvzYE-m.mjs';
-export { j as jwk } from './shared/unjwt.DH1p_WL8.mjs';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, L as JWT, M as JWTClaimValidationOptions, I as JWTClaims, H as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CN1C8TlR.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.QRureeXk.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.BvhKNVNR.mjs';
+export { i as utils } from './shared/unjwt.df8yQ5_5.mjs';
+export { j as jwk } from './shared/unjwt.Cz90HQhy.mjs';

package/dist/index.mjs

@@ -1,5 +1,5 @@
-export { i as utils } from './shared/unjwt.BHpknTpg.mjs';
-export { j as jwe } from './shared/unjwt.B2olxeGL.mjs';
-export { j as jwk } from './shared/unjwt.DRUXIabl.mjs';
-export { j as jws } from './shared/unjwt.wHjOCapq.mjs';
-import './shared/unjwt.Ca03jPX3.mjs';
+export { i as utils } from './shared/unjwt.Ce8yMcp_.mjs';
+export { j as jwe } from './shared/unjwt.DVMpKj8x.mjs';
+export { j as jwk } from './shared/unjwt.DuBBF25X.mjs';
+export { j as jws } from './shared/unjwt.D_JFPtpW.mjs';
+import './shared/unjwt.C_D0RMCp.mjs';

package/dist/jwe.d.mts

@@ -1,3 +1,2 @@
-import './shared/unjwt.D9da8HQF.mjs';
-import './shared/unjwt.BvIkEGGz.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.8w7jp2aw.mjs';
+import './shared/unjwt.CN1C8TlR.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.BvhKNVNR.mjs';

package/dist/jwe.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.DRUXIabl.mjs';
-import './shared/unjwt.BHpknTpg.mjs';
-export { d as decrypt, e as encrypt } from './shared/unjwt.B2olxeGL.mjs';
-import './shared/unjwt.Ca03jPX3.mjs';
+import './shared/unjwt.DuBBF25X.mjs';
+import './shared/unjwt.Ce8yMcp_.mjs';
+export { d as decrypt, e as encrypt } from './shared/unjwt.DVMpKj8x.mjs';
+import './shared/unjwt.C_D0RMCp.mjs';

package/dist/jwk.d.mts

@@ -1,3 +1,2 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.D9da8HQF.mjs';
-import './shared/unjwt.BvIkEGGz.mjs';
-export { d as deriveKeyFromPassword, b as exportJWKToPEM, e as exportKey, g as generateKey, c as getJWKFromSet, a as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.DH1p_WL8.mjs';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, E as JWKAlgorithm, F as JWKPEMAlgorithm, J as JWKParameters, n as JWKSet, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, x as JWK_PBES2, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CN1C8TlR.mjs';
+export { d as deriveKeyFromPassword, b as exportJWKToPEM, e as exportKey, g as generateKey, c as getJWKFromSet, a as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.Cz90HQhy.mjs';

package/dist/jwk.mjs

@@ -1,2 +1,2 @@
-import './shared/unjwt.BHpknTpg.mjs';
-export { p as deriveKeyFromPassword, t as exportJWKToPEM, q as exportKey, o as generateKey, g as getJWKFromSet, s as importJWKFromPEM, i as importKey, m as unwrapKey, r as wrapKey } from './shared/unjwt.DRUXIabl.mjs';
+import './shared/unjwt.Ce8yMcp_.mjs';
+export { p as deriveKeyFromPassword, t as exportJWKToPEM, q as exportKey, o as generateKey, g as getJWKFromSet, s as importJWKFromPEM, i as importKey, m as unwrapKey, r as wrapKey } from './shared/unjwt.DuBBF25X.mjs';

package/dist/jws.d.mts

@@ -1,3 +1,2 @@
-import './shared/unjwt.D9da8HQF.mjs';
-import './shared/unjwt.BvIkEGGz.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.D_Mabhgz.mjs';
+import './shared/unjwt.CN1C8TlR.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.QRureeXk.mjs';

package/dist/jws.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.DRUXIabl.mjs';
-import './shared/unjwt.BHpknTpg.mjs';
-import './shared/unjwt.Ca03jPX3.mjs';
-export { s as sign, v as verify } from './shared/unjwt.wHjOCapq.mjs';
+import './shared/unjwt.DuBBF25X.mjs';
+import './shared/unjwt.Ce8yMcp_.mjs';
+import './shared/unjwt.C_D0RMCp.mjs';
+export { s as sign, v as verify } from './shared/unjwt.D_JFPtpW.mjs';

package/dist/shared/{unjwt.8w7jp2aw.d.mts → unjwt.BvhKNVNR.d.mts}

@@ -1,5 +1,4 @@
-import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, f as JWK_EC_Public, m as JWK } from './unjwt.D9da8HQF.mjs';
-import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.BvIkEGGz.mjs';
+import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, H as JoseHeaderParameters, f as JWK_EC_Public, m as JWK, M as JWTClaimValidationOptions, I as JWTClaims } from './unjwt.CN1C8TlR.mjs';
 
 /** Recognized JWE Header Parameters, any other Header Members may also be present. */
 interface JWEHeaderParameters extends JoseHeaderParameters {
@@ -44,8 +43,8 @@ interface JWEHeaderParameters extends JoseHeaderParameters {
 }
 /** Recognized JWE Key Management-related Header Parameters. */
 interface JWEKeyManagementHeaderParameters {
-    apu?: Uint8Array;
-    apv?: Uint8Array;
+    apu?: Uint8Array<ArrayBuffer>;
+    apv?: Uint8Array<ArrayBuffer>;
     /**
      * For Internal use only
      */
@@ -53,11 +52,11 @@ interface JWEKeyManagementHeaderParameters {
     /**
      * For Internal use only
      */
-    p2s?: Uint8Array;
+    p2s?: Uint8Array<ArrayBuffer>;
     /**
      * For Internal use only
      */
-    iv?: Uint8Array;
+    iv?: Uint8Array<ArrayBuffer>;
     /**
      * For Internal use only
      */
@@ -71,48 +70,47 @@ interface JWEEncryptOptions {
     alg?: KeyManagementAlgorithm;
     /** JWE "enc" (Encryption Algorithm) Header Parameter. Content Encryption Algorithm. */
     enc?: ContentEncryptionAlgorithm;
+    /** Date to use when computing NumericDate claims, defaults to `new Date()`. */
+    currentDate?: Date;
+    /** Time at which the JWT should expire, if no `exp` was already provided (only when typ is "at+jwt"). */
+    expiresIn?: number;
     /** Additional JWE Protected Header parameters. */
     protectedHeader?: Omit<JWEHeaderParameters, "alg" | "enc" | "iv" | "tag" | "p2s" | "p2c" | "apu" | "apv">;
     /** Initialization Vector for AES-GCMKW key wrapping. Generated if not provided. */
-    keyManagementIV?: Uint8Array;
+    keyManagementIV?: Uint8Array<ArrayBuffer>;
     /** PBES2 Salt value (p2s). Required for PBES2 algorithms. */
-    p2s?: Uint8Array;
+    p2s?: Uint8Array<ArrayBuffer>;
     /** PBES2 Iteration count (p2c). Required for PBES2 algorithms. */
     p2c?: number;
     /** ECDH-ES Agreement PartyUInfo. */
-    ecdhPartyUInfo?: Uint8Array;
+    ecdhPartyUInfo?: Uint8Array<ArrayBuffer>;
     /** ECDH-ES Agreement PartyVInfo. */
-    ecdhPartyVInfo?: Uint8Array;
+    ecdhPartyVInfo?: Uint8Array<ArrayBuffer>;
     /**
      * Content Encryption Key (CEK) to use.
      * If provided, it will be used directly. Otherwise, a CEK will be generated.
      */
-    cek?: Uint8Array;
+    cek?: Uint8Array<ArrayBuffer>;
     /**
      * Initialization Vector for content encryption.
      * If provided, it will be used. Otherwise, one will be generated.
      */
-    contentEncryptionIV?: Uint8Array;
+    contentEncryptionIV?: Uint8Array<ArrayBuffer>;
 }
 /**
  * Key lookup function for JWE decryption.
  * @param header The JWE Protected Header.
  * @returns The key material (CryptoKey, JWK, password string, or raw Uint8Array) or a Promise resolving to it.
  */
-type JWEKeyLookupFunction = (header: JWEHeaderParameters, token: string) => CryptoKey | JWK | string | Uint8Array | Promise<CryptoKey | JWK | string | Uint8Array>;
+type JWEKeyLookupFunction = (header: JWEHeaderParameters, token: string) => CryptoKey | JWK | string | Uint8Array<ArrayBuffer> | Promise<CryptoKey | JWK | string | Uint8Array<ArrayBuffer>>;
 /**
  * JWE (JSON Web Encryption) decryption options
  */
-interface JWEDecryptOptions {
+interface JWEDecryptOptions extends JWTClaimValidationOptions {
     /** A list of allowed JWE "alg" (Algorithm) Header Parameter values for key management. */
     algorithms?: KeyManagementAlgorithm[];
     /** A list of allowed JWE "enc" (Encryption Algorithm) Header Parameter values for content encryption. */
     encryptionAlgorithms?: ContentEncryptionAlgorithm[];
-    /**
-     * Critical Header Parameters to be understood and processed.
-     * If the JWE contains critical headers not in this list (and not inherently understood by the library), decryption will fail.
-     */
-    critical?: string[];
     /** Algorithm to import the unwrapped CEK as (e.g., { name: 'AES-GCM' }). Defaults based on 'enc'. */
     unwrappedKeyAlgorithm?: Parameters<typeof crypto.subtle.importKey>[2];
     /** Key usages for the unwrapped CEK. Defaults based on 'enc' (typically ['encrypt', 'decrypt']). */
@@ -125,15 +123,15 @@ interface JWEDecryptOptions {
 /**
  * Result of a JWE decryption operation.
  */
-interface JWEDecryptResult<T extends JWTClaims | Uint8Array | string = JWTClaims | Uint8Array | string> {
+interface JWEDecryptResult<T extends JWTClaims | Uint8Array<ArrayBuffer> | string = JWTClaims | Uint8Array<ArrayBuffer> | string> {
     /** The decrypted payload. */
     payload: T;
     /** The JWE Protected Header. */
     protectedHeader: JWEHeaderParameters;
     /** The Content Encryption Key (CEK) used for decryption, as Uint8Array. */
-    cek: Uint8Array;
+    cek: Uint8Array<ArrayBuffer>;
     /** The Additional Authenticated Data (AAD) used, as Uint8Array. */
-    aad: Uint8Array;
+    aad: Uint8Array<ArrayBuffer>;
 }
 
 /**
@@ -144,17 +142,17 @@ interface JWEDecryptResult<T extends JWTClaims | Uint8Array | string = JWTClaims
  * @param options JWE encryption options, including `alg` (key management algorithm) and `enc` (content encryption algorithm).
  * @returns A Promise resolving to the JWE Compact Serialization string.
  */
-declare function encrypt(payload: JWTClaims, key: JWK | string | Uint8Array, options?: JWEEncryptOptions): Promise<string>;
-declare function encrypt(payload: string | Uint8Array | Record<string, any>, key: JWK | string | Uint8Array, options?: JWEEncryptOptions): Promise<string>;
+declare function encrypt(payload: JWTClaims, key: JWK | string | Uint8Array<ArrayBuffer>, options?: JWEEncryptOptions): Promise<string>;
+declare function encrypt(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: JWK | string | Uint8Array<ArrayBuffer>, options?: JWEEncryptOptions): Promise<string>;
 declare function encrypt(payload: JWTClaims, key: CryptoKey, options: JWEEncryptOptions & {
     alg: KeyManagementAlgorithm;
     enc: ContentEncryptionAlgorithm;
 }): Promise<string>;
-declare function encrypt(payload: string | Uint8Array | Record<string, any>, key: CryptoKey, options: JWEEncryptOptions & {
+declare function encrypt(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: CryptoKey, options: JWEEncryptOptions & {
     alg: KeyManagementAlgorithm;
     enc: ContentEncryptionAlgorithm;
 }): Promise<string>;
-declare function encrypt(payload: string | Uint8Array | Record<string, any>, key: CryptoKey | JWK | string | Uint8Array, options: JWEEncryptOptions & {
+declare function encrypt(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: CryptoKey | JWK | string | Uint8Array<ArrayBuffer>, options: JWEEncryptOptions & {
     alg: KeyManagementAlgorithm;
     enc: ContentEncryptionAlgorithm;
 }): Promise<string>;
@@ -167,13 +165,13 @@ declare function encrypt(payload: string | Uint8Array | Record<string, any>, key
  * @returns A Promise resolving to an object containing the decrypted plaintext, protected header, CEK, and AAD.
  * @throws If JWE is invalid, decryption fails, or options are not met.
  */
-declare function decrypt<T extends JWTClaims | Uint8Array | string>(jwe: string, key: CryptoKey | JWK | string | Uint8Array | JWEKeyLookupFunction, options?: JWEDecryptOptions): Promise<JWEDecryptResult<T>>;
-declare function decrypt(jwe: string, key: CryptoKey | JWK | string | Uint8Array | JWEKeyLookupFunction, options: JWEDecryptOptions & {
+declare function decrypt<T extends JWTClaims | Uint8Array<ArrayBuffer> | string>(jwe: string, key: CryptoKey | JWK | string | Uint8Array<ArrayBuffer> | JWEKeyLookupFunction, options?: JWEDecryptOptions): Promise<JWEDecryptResult<T>>;
+declare function decrypt(jwe: string, key: CryptoKey | JWK | string | Uint8Array<ArrayBuffer> | JWEKeyLookupFunction, options: JWEDecryptOptions & {
     forceUint8Array: true;
-}): Promise<JWEDecryptResult<Uint8Array>>;
+}): Promise<JWEDecryptResult<Uint8Array<ArrayBuffer>>>;
 
 type jwe_JWEDecryptOptions = JWEDecryptOptions;
-type jwe_JWEDecryptResult<T extends JWTClaims | Uint8Array | string = JWTClaims | Uint8Array | string> = JWEDecryptResult<T>;
+type jwe_JWEDecryptResult<T extends JWTClaims | Uint8Array<ArrayBuffer> | string = JWTClaims | Uint8Array<ArrayBuffer> | string> = JWEDecryptResult<T>;
 type jwe_JWEEncryptOptions = JWEEncryptOptions;
 type jwe_JWEHeaderParameters = JWEHeaderParameters;
 type jwe_JWEKeyLookupFunction = JWEKeyLookupFunction;

package/dist/shared/{unjwt.D9da8HQF.d.mts → unjwt.CN1C8TlR.d.mts}

@@ -15,7 +15,7 @@ interface GenerateKeyOptions {
     /** RSA modulus length. Defaults to 2048. */
     modulusLength?: number;
     /** RSA public exponent. Defaults to 65537 (0x010001). */
-    publicExponent?: Uint8Array;
+    publicExponent?: Uint8Array<ArrayBuffer>;
     /** Export the generated key(s) as JWK. If true, the key(s) will be returned in JWK format. */
     toJWK?: boolean | undefined;
 }
@@ -23,12 +23,12 @@ type GenerateKeyReturnJWK<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_
     privateKey: JWK;
     publicKey: JWK;
 } : JWK;
-type GenerateKeyReturnCrypto<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_AES_CBC_HMAC ? Uint8Array : TAlg extends JWK_Asymmetric_Algorithm ? CryptoKeyPair : CryptoKey;
+type GenerateKeyReturnCrypto<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_AES_CBC_HMAC ? Uint8Array<ArrayBuffer> : TAlg extends JWK_Asymmetric_Algorithm ? CryptoKeyPair : CryptoKey;
 type GenerateKeyReturn<TAlg extends GenerateKeyAlgorithm, TOptions extends GenerateKeyOptions> = TOptions["toJWK"] extends true ? GenerateKeyReturnJWK<TAlg> : GenerateKeyReturnCrypto<TAlg>;
 /** Options for the deriveKeyFromPassword function. */
 interface DeriveKeyOptions {
     /** Salt value (p2s). Must be at least 8 bytes. */
-    salt: Uint8Array;
+    salt: Uint8Array<ArrayBuffer>;
     /** Iteration count (p2c). Must be a positive integer. */
     iterations: number;
     /** Key usages for the derived key. Defaults to ["wrapKey", "unwrapKey"]. */
@@ -44,22 +44,22 @@ type ContentEncryptionAlgorithm = JWK_AES_GCM | JWK_AES_CBC_HMAC;
 /** Options for the wrapKey function. */
 interface WrapKeyOptions {
     /** Initialization Vector for AES-GCMKW. Generated if not provided. */
-    iv?: Uint8Array;
+    iv?: Uint8Array<ArrayBuffer>;
     /** PBES2 Salt value (p2s). Required for PBES2 algorithms. */
-    p2s?: Uint8Array;
+    p2s?: Uint8Array<ArrayBuffer>;
     /** PBES2 Iteration count (p2c). Required for PBES2 algorithms. */
     p2c?: number;
     /** ECDH-ES Ephemeral Public Key. Generated if not provided for ECDH-ES. */
     epk?: JWK_EC_Public;
     /** ECDH-ES Agreement PartyUInfo. */
-    apu?: Uint8Array;
+    apu?: Uint8Array<ArrayBuffer>;
     /** ECDH-ES Agreement PartyVInfo. */
-    apv?: Uint8Array;
+    apv?: Uint8Array<ArrayBuffer>;
 }
 /** Result of the wrapKey function. */
 interface WrapKeyResult {
     /** The wrapped key (Ciphertext). */
-    encryptedKey: Uint8Array;
+    encryptedKey: Uint8Array<ArrayBuffer>;
     /** Initialization Vector used (only for AES-GCMKW). Base64URL encoded. */
     iv?: string;
     /** Authentication Tag generated (only for AES-GCMKW). Base64URL encoded. */
@@ -78,19 +78,19 @@ interface WrapKeyResult {
 /** Options for the unwrapKey function. */
 interface UnwrapKeyOptions {
     /** Initialization Vector (required for AES-GCMKW). Base64URL encoded or Uint8Array. */
-    iv?: Uint8Array | string;
+    iv?: Uint8Array<ArrayBuffer> | string;
     /** Authentication Tag (required for AES-GCMKW). Base64URL encoded or Uint8Array. */
-    tag?: Uint8Array | string;
+    tag?: Uint8Array<ArrayBuffer> | string;
     /** PBES2 Salt value (required for PBES2). Base64URL encoded or Uint8Array. */
-    p2s?: Uint8Array | string;
+    p2s?: Uint8Array<ArrayBuffer> | string;
     /** PBES2 Iteration count (required for PBES2). */
     p2c?: number;
     /** ECDH-ES Ephemeral Public Key (required for ECDH-ES). */
     epk?: JWK_EC_Public;
     /** ECDH-ES Agreement PartyUInfo. Base64URL encoded or Uint8Array. */
-    apu?: Uint8Array | string;
+    apu?: Uint8Array<ArrayBuffer> | string;
     /** ECDH-ES Agreement PartyVInfo. Base64URL encoded or Uint8Array. */
-    apv?: Uint8Array | string;
+    apv?: Uint8Array<ArrayBuffer> | string;
     /** Expected unwrapped key algorithm (e.g., 'AES-GCM', 'AES-CBC'). Used by crypto.subtle.unwrapKey. */
     unwrappedKeyAlgorithm?: string | Algorithm | RsaOaepParams | AesCtrParams | AesCbcParams | AesGcmParams;
     /** Expected key usages for the unwrapped key. */
@@ -203,8 +203,83 @@ type JWK_PBES2 = "PBES2-HS256+A128KW" | "PBES2-HS384+A192KW" | "PBES2-HS512+A256
 type JWK_ECDH_ES = "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A192KW" | "ECDH-ES+A256KW";
 type JWK_ED = "Ed25519" | "EdDSA";
 type JWK_Symmetric_Algorithm = JWK_HMAC | JWK_AES_KW | JWK_AES_GCM;
-type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA_ENC;
+type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA_ENC | JWK_ED;
 type JWKAlgorithm = JWK_Symmetric_Algorithm | JWK_Asymmetric_Algorithm | JWK_AES_CBC_HMAC | JWK_PBES2 | JWK_ECDH_ES | ("none" | "dir");
 type JWKPEMAlgorithm = JWK_RSA_PSS | JWK_RSA_SIGN | JWK_RSA_ENC | JWK_ECDSA | JWK_ECDH_ES | JWK_ED;
 
-export type { JWK_Symmetric_Algorithm as A, JWK_Asymmetric_Algorithm as B, CompositeKey as C, DeriveKeyOptions as D, JWKAlgorithm as E, JWKPEMAlgorithm as F, GenerateKeyAlgorithm as G, JWKParameters as J, KeyManagementAlgorithm as K, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, DeriveKeyReturn as c, ContentEncryptionAlgorithm as d, WrapKeyResult as e, JWK_EC_Public as f, JWK_EC_Private as g, JWK_EC as h, JWK_RSA_Public as i, JWK_RSA_Private as j, JWK_RSA as k, JWK_oct as l, JWK as m, JWKSet as n, JWK_HMAC as o, JWK_RSA_SIGN as p, JWK_RSA_PSS as q, JWK_ECDSA as r, JWK_RSA_ENC as s, JWK_AES_KW as t, JWK_AES_GCM_KW as u, JWK_AES_CBC_HMAC as v, JWK_AES_GCM as w, JWK_PBES2 as x, JWK_ECDH_ES as y, JWK_ED as z };
+/** Header Parameters common to JWE and JWS */
+interface JoseHeaderParameters {
+    /** "kid" (Key ID) Header Parameter */
+    kid?: string;
+    /** "x5t" (X.509 Certificate SHA-1 Thumbprint) Header Parameter */
+    x5t?: string;
+    /** "x5c" (X.509 Certificate Chain) Header Parameter */
+    x5c?: string[];
+    /** "x5u" (X.509 URL) Header Parameter */
+    x5u?: string;
+    /** "jku" (JWK Set URL) Header Parameter */
+    jku?: string;
+    /** "jwk" (JSON Web Key) Header Parameter */
+    jwk?: JWK_RSA_Public;
+    /** "typ" (Type) Header Parameter */
+    typ?: string;
+    /** "cty" (Content Type) Header Parameter */
+    cty?: string;
+    /** "crit" (Critical) Header Parameter */
+    crit?: string[];
+    /** Any other JWS/JWE Header member. */
+    [propName: string]: unknown;
+}
+interface JWTClaims {
+    /** "iss" (Issuer) Claim */
+    iss?: string;
+    /** "sub" (Subject) Claim */
+    sub?: string;
+    /** "aud" (Audience) Claim */
+    aud?: string | string[];
+    /** "exp" (Expiration Time) Claim */
+    exp?: number;
+    /** "nbf" (Not Before) Claim */
+    nbf?: number;
+    /** "iat" (Issued At) Claim */
+    iat?: number;
+    /** "jti" (JWT ID) Claim */
+    jti?: string;
+    /** Any other JWT member. */
+    [propName: string]: unknown;
+}
+interface JWT<T = JWTClaims> {
+    header: JoseHeaderParameters & {
+        /** "alg" (Algorithm) Header Parameter */
+        alg: string;
+    };
+    claims: T;
+}
+interface JWTClaimValidationOptions {
+    /** Expected JWT "aud" (Audience) Claim value(s). Implies presence requirement. */
+    audience?: string | string[];
+    /** Expected JWT "iss" (Issuer) Claim value(s). Implies presence requirement. */
+    issuer?: string | string[];
+    /** Expected JWT "sub" (Subject) Claim value. Implies presence requirement. */
+    subject?: string;
+    /** Maximum token age in seconds, from the JWT "iat" (Issued At) Claim value. Implies presence requirement. */
+    maxTokenAge?: number;
+    /** Clock skew tolerance (in seconds) for validating time-based claims (nbf/exp/iat). */
+    clockTolerance?: number;
+    /** Expected JWT "typ" (Type) Header Parameter value. Implies presence requirement. */
+    typ?: string;
+    /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
+    currentDate?: Date;
+    /** Additional required claim names. */
+    requiredClaims?: string[];
+    /** List of critical header parameters that must be understood and processed. */
+    requiredHeaders?: string[];
+    /**
+     * Critical Header Parameters to be understood and processed.
+     * If the JWT contains critical headers not in this list (and not inherently understood by the library), decryption will fail.
+     * @deprecated use {@link requiredHeaders `recognizedHeaders` option} instead.
+     */
+    critical?: string[];
+}
+
+export type { JWK_Symmetric_Algorithm as A, JWK_Asymmetric_Algorithm as B, CompositeKey as C, DeriveKeyOptions as D, JWKAlgorithm as E, JWKPEMAlgorithm as F, GenerateKeyAlgorithm as G, JoseHeaderParameters as H, JWTClaims as I, JWKParameters as J, KeyManagementAlgorithm as K, JWT as L, JWTClaimValidationOptions as M, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, DeriveKeyReturn as c, ContentEncryptionAlgorithm as d, WrapKeyResult as e, JWK_EC_Public as f, JWK_EC_Private as g, JWK_EC as h, JWK_RSA_Public as i, JWK_RSA_Private as j, JWK_RSA as k, JWK_oct as l, JWK as m, JWKSet as n, JWK_HMAC as o, JWK_RSA_SIGN as p, JWK_RSA_PSS as q, JWK_ECDSA as r, JWK_RSA_ENC as s, JWK_AES_KW as t, JWK_AES_GCM_KW as u, JWK_AES_CBC_HMAC as v, JWK_AES_GCM as w, JWK_PBES2 as x, JWK_ECDH_ES as y, JWK_ED as z };

package/dist/shared/{unjwt.Ca03jPX3.mjs → unjwt.C_D0RMCp.mjs}

@@ -1,4 +1,4 @@
-import { c as checkSigCryptoKey } from './unjwt.DRUXIabl.mjs';
+import { c as checkSigCryptoKey } from './unjwt.DuBBF25X.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.