unjwt 0.5.9 → 0.5.11

package/dist/shared/unjwt.Ce8yMcp_.mjs

@@ -0,0 +1,298 @@
+function applyTypCtyDefaults(header, payload) {
+  const isObjectPayload = typeof payload === "object" && payload !== null && !(payload instanceof Uint8Array);
+  if (header.typ === void 0 && isObjectPayload) {
+    header.typ = "at+jwt";
+  }
+  if ((header.typ === "at+jwt" || header.typ === "JWT") && isObjectPayload) {
+    header.cty ||= "application/json";
+  }
+  return header;
+}
+function isJsonContent(header) {
+  if (!header) return false;
+  if (header.typ === "at+jwt") return true;
+  if (header.typ === "JWT") return true;
+  const cty = header.cty?.toLowerCase();
+  return cty === "json" || cty === "application/json" || !!cty && cty.endsWith("+json");
+}
+function decodeMaybeJsonString(decodedString, header) {
+  if (isJsonContent(header)) {
+    const looksLikeJson = decodedString.startsWith("{") && decodedString.endsWith("}") || decodedString.startsWith("[") && decodedString.endsWith("]");
+    if (looksLikeJson) {
+      try {
+        return JSON.parse(decodedString);
+      } catch {
+      }
+    }
+  }
+  return decodedString;
+}
+function decodePayloadFromBytes(bytes, header, forceUint8Array) {
+  if (forceUint8Array) return bytes;
+  const decodedString = textDecoder.decode(bytes);
+  return decodeMaybeJsonString(decodedString, header);
+}
+function decodePayloadFromB64UrlSegment(payloadEncoded, header, forceUint8Array) {
+  if (forceUint8Array) return base64UrlDecode(payloadEncoded, false);
+  const decodedString = base64UrlDecode(payloadEncoded);
+  return decodeMaybeJsonString(decodedString, header);
+}
+function getPlaintextBytes(payload) {
+  if (payload instanceof Uint8Array) return payload;
+  if (typeof payload === "string") return textEncoder.encode(payload);
+  if (typeof payload === "object" && payload !== null)
+    return textEncoder.encode(JSON.stringify(payload));
+  throw new TypeError(
+    "Plaintext must be a string, Uint8Array, or a JSON-serializable object."
+  );
+}
+function computeJwtTimeClaims(payload, headerTyp, expiresIn, currentDate = /* @__PURE__ */ new Date()) {
+  if (expiresIn === void 0 || headerTyp !== "at+jwt" && headerTyp !== "JWT" || !(payload && typeof payload === "object") || payload instanceof Uint8Array || payload.exp) {
+    return void 0;
+  }
+  const now = Math.round(currentDate.getTime() / 1e3);
+  const claims = { ...payload };
+  claims.iat ||= now;
+  claims.exp = now + expiresIn;
+  return claims;
+}
+function validateJwtClaims(jwtClaims, options = {}) {
+  const clockTolerance = options.clockTolerance ?? 0;
+  const currentTime = Math.round(
+    (options.currentDate ?? /* @__PURE__ */ new Date()).getTime() / 1e3
+  );
+  const allRequiredClaims = new Set(options.requiredClaims || []);
+  const missingClaims = /* @__PURE__ */ new Set();
+  if (options.issuer) allRequiredClaims.add("iss");
+  if (options.audience) allRequiredClaims.add("aud");
+  if (options.subject) allRequiredClaims.add("sub");
+  if (options.maxTokenAge) allRequiredClaims.add("iat");
+  for (const claimName of allRequiredClaims) {
+    if (!(claimName in jwtClaims)) missingClaims.add(claimName);
+  }
+  if (missingClaims.size > 0) {
+    throw new Error(
+      `Missing required JWT Claims: ${[...missingClaims].join(", ")}`
+    );
+  }
+  if (options.issuer) {
+    const expectedIssuers = maybeArray(options.issuer);
+    if (!jwtClaims.iss || !expectedIssuers.includes(jwtClaims.iss)) {
+      throw new Error(
+        `Invalid JWT "iss" (Issuer) Claim: Expected ${expectedIssuers.join(" or ")}, got ${jwtClaims.iss}`
+      );
+    }
+  }
+  if (options.subject && jwtClaims.sub !== options.subject) {
+    throw new Error(
+      `Invalid JWT "sub" (Subject) Claim: Expected ${options.subject}, got ${jwtClaims.sub}`
+    );
+  }
+  if (options.audience) {
+    const expectedAudiences = maybeArray(options.audience);
+    const claimAudience = maybeArray(jwtClaims.aud || []);
+    if (!claimAudience.some((aud) => expectedAudiences.includes(aud))) {
+      throw new Error(
+        `Invalid JWT "aud" (Audience) Claim: Expected ${expectedAudiences.join(" or ")}, got ${claimAudience.join(", ")}`
+      );
+    }
+  }
+  if (typeof jwtClaims.nbf === "number" && jwtClaims.nbf > currentTime + clockTolerance) {
+    throw new Error(
+      `JWT "nbf" (Not Before) Claim validation failed: Token is not yet valid (nbf: ${new Date(jwtClaims.nbf * 1e3).toISOString()})`
+    );
+  }
+  if (typeof jwtClaims.exp === "number" && jwtClaims.exp <= currentTime - clockTolerance) {
+    throw new Error(
+      `JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${new Date(jwtClaims.exp * 1e3).toISOString()})`
+    );
+  }
+  if (options.maxTokenAge) {
+    if (typeof jwtClaims.iat !== "number") {
+      throw new TypeError(
+        'JWT "iat" (Issued At) Claim must be a number when maxTokenAge is set.'
+      );
+    }
+    if (jwtClaims.iat > currentTime + clockTolerance) {
+      throw new Error(
+        `JWT "iat" (Issued At) Claim validation failed: Token was issued in the future (iat: ${new Date(jwtClaims.iat * 1e3).toISOString()})`
+      );
+    }
+    if (jwtClaims.iat < currentTime - options.maxTokenAge - clockTolerance) {
+      throw new Error(
+        `JWT "iat" (Issued At) Claim validation failed: Token is too old (maxTokenAge: ${options.maxTokenAge}s, iat: ${new Date(jwtClaims.iat * 1e3).toISOString()})`
+      );
+    }
+  }
+}
+function validateCriticalHeadersJWS(protectedHeader, requiredHeaders = []) {
+  if (!protectedHeader.crit) return;
+  const missingHeaderParams = /* @__PURE__ */ new Set();
+  const recognizedParams = /* @__PURE__ */ new Set([
+    ...requiredHeaders,
+    "alg",
+    "typ",
+    "cty",
+    "kid",
+    "jwk",
+    "jku",
+    "x5c",
+    "x5t",
+    "x5u",
+    "b64"
+  ]);
+  for (const param of protectedHeader.crit) {
+    if (recognizedParams.has(param) && (param in protectedHeader || param === "b64")) {
+      continue;
+    }
+    missingHeaderParams.add(param);
+  }
+  if (missingHeaderParams.size > 0) {
+    throw new Error(
+      `Missing critical header parameters: ${[...missingHeaderParams].join(", ")}`
+    );
+  }
+}
+function validateCriticalHeadersJWE(protectedHeader, understoodFromOptions) {
+  if (protectedHeader.crit && !understoodFromOptions) {
+    throw new Error(
+      `Unprocessed critical header parameters: ${protectedHeader.crit.join(", ")}`
+    );
+  }
+  if (!protectedHeader.crit) return;
+  const understoodParams = /* @__PURE__ */ new Set([
+    ...understoodFromOptions || [],
+    // JWE specific standard headers:
+    "alg",
+    "enc",
+    "typ",
+    "cty",
+    "kid",
+    "jwk",
+    "jku",
+    "x5c",
+    "x5t",
+    "x5u",
+    "iv",
+    "tag",
+    "p2s",
+    "p2c",
+    "epk",
+    "apu",
+    "apv"
+  ]);
+  for (const critParam of protectedHeader.crit) {
+    if (!Object.prototype.hasOwnProperty.call(protectedHeader, critParam)) {
+      throw new Error(
+        `Critical header parameter "${critParam}" listed in "crit" but not present in the protected header.`
+      );
+    }
+    if (!understoodParams.has(critParam)) {
+      throw new Error(`Unprocessed critical header parameters: ${critParam}`);
+    }
+  }
+}
+
+const textEncoder = /* @__PURE__ */ new TextEncoder();
+const textDecoder = /* @__PURE__ */ new TextDecoder();
+function base64Encode(data) {
+  const encodedData = data instanceof Uint8Array ? data : textEncoder.encode(data);
+  if (Uint8Array.prototype.toBase64) {
+    return encodedData.toBase64();
+  }
+  return btoa(String.fromCodePoint(...encodedData));
+}
+function base64UrlEncode(data) {
+  const encodedData = data instanceof Uint8Array ? data : textEncoder.encode(data);
+  if (Uint8Array.prototype.toBase64) {
+    return encodedData.toBase64({ alphabet: "base64url", omitPadding: true });
+  }
+  return btoa(String.fromCodePoint(...encodedData)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function base64Decode(str, toString) {
+  const decodeToString = toString !== false;
+  if (!str) {
+    return decodeToString ? "" : new Uint8Array(0);
+  }
+  const data = Uint8Array.fromBase64 ? (
+    // @ts-expect-error
+    Uint8Array.fromBase64(str)
+  ) : Uint8Array.from(atob(str), (b) => b.codePointAt(0));
+  return decodeToString ? textDecoder.decode(data) : data;
+}
+function base64UrlDecode(str, toString) {
+  const decodeToString = toString !== false;
+  if (!str) {
+    return decodeToString ? "" : new Uint8Array(0);
+  }
+  let data;
+  if (Uint8Array.fromBase64) {
+    data = Uint8Array.fromBase64(str, { alphabet: "base64url" });
+  } else {
+    str = str.replace(/-/g, "+").replace(/_/g, "/");
+    while (str.length % 4) str += "=";
+    data = Uint8Array.from(atob(str), (b) => b.codePointAt(0));
+  }
+  return decodeToString ? textDecoder.decode(data) : data;
+}
+function randomBytes(length) {
+  return crypto.getRandomValues(new Uint8Array(length));
+}
+function concatUint8Arrays(...arrays) {
+  const totalLength = arrays.reduce((length, arr) => length + arr.length, 0);
+  const result = new Uint8Array(totalLength);
+  let offset = 0;
+  for (const arr of arrays) {
+    result.set(arr, offset);
+    offset += arr.length;
+  }
+  return result;
+}
+function maybeArray(item) {
+  return Array.isArray(item) ? item : [item];
+}
+function isJWK(key) {
+  return typeof key === "object" && key !== null && "kty" in key && typeof key.kty === "string";
+}
+function isJWKSet(key) {
+  return key && typeof key === "object" && "keys" in key && Array.isArray(key.keys);
+}
+function assertCryptoKey(key) {
+  if (!isCryptoKey(key)) {
+    throw new Error("CryptoKey instance expected");
+  }
+}
+function isCryptoKey(key) {
+  return key?.[Symbol.toStringTag] === "CryptoKey";
+}
+const isCryptoKeyPair = (key) => key && typeof key === "object" && isCryptoKey(key.publicKey) && isCryptoKey(key.privateKey);
+
+const index = {
+  __proto__: null,
+  applyTypCtyDefaults: applyTypCtyDefaults,
+  assertCryptoKey: assertCryptoKey,
+  base64Decode: base64Decode,
+  base64Encode: base64Encode,
+  base64UrlDecode: base64UrlDecode,
+  base64UrlEncode: base64UrlEncode,
+  computeJwtTimeClaims: computeJwtTimeClaims,
+  concatUint8Arrays: concatUint8Arrays,
+  decodeMaybeJsonString: decodeMaybeJsonString,
+  decodePayloadFromB64UrlSegment: decodePayloadFromB64UrlSegment,
+  decodePayloadFromBytes: decodePayloadFromBytes,
+  getPlaintextBytes: getPlaintextBytes,
+  isCryptoKey: isCryptoKey,
+  isCryptoKeyPair: isCryptoKeyPair,
+  isJWK: isJWK,
+  isJWKSet: isJWKSet,
+  isJsonContent: isJsonContent,
+  maybeArray: maybeArray,
+  randomBytes: randomBytes,
+  textDecoder: textDecoder,
+  textEncoder: textEncoder,
+  validateCriticalHeadersJWE: validateCriticalHeadersJWE,
+  validateCriticalHeadersJWS: validateCriticalHeadersJWS,
+  validateJwtClaims: validateJwtClaims
+};
+
+export { isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, textDecoder as e, base64UrlDecode as f, isJWKSet as g, decodePayloadFromB64UrlSegment as h, index as i, validateJwtClaims as j, concatUint8Arrays as k, assertCryptoKey as l, isCryptoKey as m, getPlaintextBytes as n, decodePayloadFromBytes as o, validateCriticalHeadersJWE as p, base64Decode as q, randomBytes as r, base64Encode as s, textEncoder as t, maybeArray as u, validateCriticalHeadersJWS as v, isCryptoKeyPair as w, isJsonContent as x, decodeMaybeJsonString as y };

package/dist/shared/{unjwt.DH1p_WL8.d.mts → unjwt.Cz90HQhy.d.mts}

@@ -1,5 +1,4 @@
-import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, x as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, l as JWK_oct, m as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, F as JWKPEMAlgorithm, n as JWKSet, C as CompositeKey, d as ContentEncryptionAlgorithm, E as JWKAlgorithm, J as JWKParameters, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm } from './unjwt.D9da8HQF.mjs';
-import { J as JoseHeaderParameters } from './unjwt.BvIkEGGz.mjs';
+import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, x as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, l as JWK_oct, m as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, F as JWKPEMAlgorithm, n as JWKSet, H as JoseHeaderParameters, C as CompositeKey, d as ContentEncryptionAlgorithm, E as JWKAlgorithm, J as JWKParameters, v as JWK_AES_CBC_HMAC, w as JWK_AES_GCM, u as JWK_AES_GCM_KW, t as JWK_AES_KW, B as JWK_Asymmetric_Algorithm, h as JWK_EC, y as JWK_ECDH_ES, r as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, z as JWK_ED, o as JWK_HMAC, k as JWK_RSA, s as JWK_RSA_ENC, q as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, p as JWK_RSA_SIGN, A as JWK_Symmetric_Algorithm } from './unjwt.CN1C8TlR.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -31,7 +30,7 @@ declare function generateKey<TAlg extends GenerateKeyAlgorithm, TOptions extends
  * @param options Configuration options including salt and iterations.
  * @returns A Promise resolving to the derived key (CryptoKey) or its JWK_oct representation.
  */
-declare function deriveKeyFromPassword<TAlg extends JWK_PBES2, TOptions extends DeriveKeyOptions>(password: string | Uint8Array, alg: TAlg, options: TOptions): Promise<DeriveKeyReturn<TOptions>>;
+declare function deriveKeyFromPassword<TAlg extends JWK_PBES2, TOptions extends DeriveKeyOptions>(password: string | Uint8Array<ArrayBuffer>, alg: TAlg, options: TOptions): Promise<DeriveKeyReturn<TOptions>>;
 /**
  * Imports a key from various formats (CryptoKey, JWK, Uint8Array).
  *
@@ -44,11 +43,11 @@ declare function deriveKeyFromPassword<TAlg extends JWK_PBES2, TOptions extends
  * @param alg The algorithm hint, required when importing asymmetric JWKs.
  * @returns A Promise resolving to the imported key as CryptoKey or Uint8Array.
  */
-declare function importKey(key: string): Promise<Uint8Array>;
-declare function importKey(key: Uint8Array): Promise<Uint8Array>;
+declare function importKey(key: string): Promise<Uint8Array<ArrayBuffer>>;
+declare function importKey(key: Uint8Array<ArrayBuffer>): Promise<Uint8Array<ArrayBuffer>>;
 declare function importKey(key: CryptoKey): Promise<CryptoKey>;
-declare function importKey(key: JWK_oct): Promise<Uint8Array>;
-declare function importKey(key: CryptoKey | JWK | Uint8Array | string, alg?: string): Promise<CryptoKey | Uint8Array>;
+declare function importKey(key: JWK_oct): Promise<Uint8Array<ArrayBuffer>>;
+declare function importKey(key: CryptoKey | JWK | Uint8Array<ArrayBuffer> | string, alg?: string): Promise<CryptoKey | Uint8Array<ArrayBuffer>>;
 /**
  * Exports a CryptoKey to a JWK (JSON Web Key) format.
  *
@@ -56,7 +55,7 @@ declare function importKey(key: CryptoKey | JWK | Uint8Array | string, alg?: str
  * @param jwk Optional partial JWK to merge with the exported key, allowing overrides.
  * @returns A Promise resolving to the exported JWK.
  */
-declare function exportKey(key: CryptoKey, jwk?: Partial<JWK>): Promise<JWK>;
+declare function exportKey<T extends JWK>(key: CryptoKey, jwk?: Partial<JWK>): Promise<T>;
 /**
  * Wraps a Content Encryption Key (CEK) using the specified algorithm and wrapping key.
  *
@@ -66,7 +65,7 @@ declare function exportKey(key: CryptoKey, jwk?: Partial<JWK>): Promise<JWK>;
  * @param options Additional options required by certain algorithms (e.g., p2s, p2c for PBES2).
  * @returns A Promise resolving to an object containing the wrapped key and any necessary parameters (iv, tag, epk, etc.).
  */
-declare function wrapKey(alg: KeyManagementAlgorithm, keyToWrap: CryptoKey | Uint8Array, wrappingKey: CryptoKey | JWK | string | Uint8Array, options?: WrapKeyOptions): Promise<WrapKeyResult>;
+declare function wrapKey(alg: KeyManagementAlgorithm, keyToWrap: CryptoKey | Uint8Array<ArrayBuffer>, wrappingKey: CryptoKey | JWK | string | Uint8Array<ArrayBuffer>, options?: WrapKeyOptions): Promise<WrapKeyResult>;
 /**
  * Unwraps a Content Encryption Key (CEK) using the specified algorithm and unwrapping key.
  *
@@ -76,9 +75,9 @@ declare function wrapKey(alg: KeyManagementAlgorithm, keyToWrap: CryptoKey | Uin
  * @param options Additional options required by certain algorithms (e.g., iv, tag, p2s, p2c, epk).
  * @returns A Promise resolving to the unwrapped key (CEK) as a CryptoKey or Uint8Array.
  */
-declare function unwrapKey<T extends boolean | undefined = undefined>(alg: KeyManagementAlgorithm, wrappedKey: Uint8Array, unwrappingKey: CryptoKey | JWK | string | Uint8Array, options?: UnwrapKeyOptions & {
+declare function unwrapKey<T extends boolean | undefined = undefined>(alg: KeyManagementAlgorithm, wrappedKey: Uint8Array<ArrayBuffer>, unwrappingKey: CryptoKey | JWK | string | Uint8Array<ArrayBuffer>, options?: UnwrapKeyOptions & {
     returnAs?: T;
-}): Promise<T extends false ? Uint8Array : CryptoKey>;
+}): Promise<T extends false ? Uint8Array<ArrayBuffer> : CryptoKey>;
 /**
  * Imports a key from a PEM-encoded string and converts it to a JWK.
  *
@@ -90,7 +89,7 @@ declare function unwrapKey<T extends boolean | undefined = undefined>(alg: KeyMa
  * @param jwkExtras Additional properties to merge into the resulting JWK.
  * @returns A Promise resolving to the imported key as a JWK.
  */
-declare function importJWKFromPEM(pem: string, pemType: "pkcs8" | "spki" | "x509", alg: JWKPEMAlgorithm, importOptions?: KeyImportOptions, jwkExtras?: Partial<JWK>): Promise<JWK>;
+declare function importJWKFromPEM<T extends JWK>(pem: string, pemType: "pkcs8" | "spki" | "x509", alg: JWKPEMAlgorithm, importOptions?: KeyImportOptions, jwkExtras?: Partial<JWK>): Promise<T>;
 /**
  * Exports a JWK to a PEM-encoded string.
  *

package/dist/shared/{unjwt.B2olxeGL.mjs → unjwt.DVMpKj8x.mjs}

@@ -1,6 +1,6 @@
-import { a as checkEncCryptoKey, u as uint32be, b as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, d as bitLengthCEK, f as jwkTokey, i as importKey, h as generateIV, l as encrypt$1, m as unwrapKey, n as decrypt$1 } from './unjwt.DRUXIabl.mjs';
-import { f as concatUint8Arrays, t as textEncoder, g as assertCryptoKey, b as base64UrlEncode, h as isCryptoKey, a as isJWK, d as base64UrlDecode, r as randomBytes, c as textDecoder } from './unjwt.BHpknTpg.mjs';
-import { c as checkKeyLength } from './unjwt.Ca03jPX3.mjs';
+import { a as checkEncCryptoKey, u as uint32be, b as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, d as bitLengthCEK, f as jwkTokey, i as importKey, h as generateIV, l as encrypt$1, m as unwrapKey, n as decrypt$1 } from './unjwt.DuBBF25X.mjs';
+import { k as concatUint8Arrays, t as textEncoder, l as assertCryptoKey, d as base64UrlEncode, m as isCryptoKey, a as isJWK, f as base64UrlDecode, r as randomBytes, b as applyTypCtyDefaults, c as computeJwtTimeClaims, n as getPlaintextBytes, o as decodePayloadFromBytes, p as validateCriticalHeadersJWE } from './unjwt.Ce8yMcp_.mjs';
+import { c as checkKeyLength } from './unjwt.C_D0RMCp.mjs';
 
 function lengthAndInput(input) {
   return concatUint8Arrays(uint32be(input.length), input);
@@ -218,7 +218,6 @@ async function encrypt(payload, key, options = {}) {
   if (!enc) {
     enc = isJWK(key) && "enc" in key ? key.enc : "A128GCM";
   }
-  const plaintextBytes = getPlaintextBytes(payload);
   const jweKeyManagementParams = {};
   if (keyManagementIV) jweKeyManagementParams.iv = keyManagementIV;
   if (p2s) jweKeyManagementParams.p2s = p2s;
@@ -252,13 +251,15 @@ async function encrypt(payload, key, options = {}) {
     alg,
     enc
   };
-  if (jweProtectedHeader.typ === void 0 && typeof payload === "object" && !(payload instanceof Uint8Array)) {
-    jweProtectedHeader.typ = "JWT";
-  }
-  if (jweProtectedHeader.typ === "JWT" && typeof payload === "object" && !(payload instanceof Uint8Array)) {
-    jweProtectedHeader.cty ||= "json";
-  }
-  const protectedHeaderSerialized = JSON.stringify(jweProtectedHeader);
+  const protectedHeader = applyTypCtyDefaults(jweProtectedHeader, payload);
+  const computedPayload = computeJwtTimeClaims(
+    payload,
+    protectedHeader.typ,
+    options.expiresIn,
+    options.currentDate
+  );
+  const plaintextBytes = getPlaintextBytes(computedPayload || payload);
+  const protectedHeaderSerialized = JSON.stringify(protectedHeader);
   const protectedHeaderEncoded = base64UrlEncode(protectedHeaderSerialized);
   const aadBytes = textEncoder.encode(protectedHeaderEncoded);
   const contentIVBytes = providedContentIV ?? generateIV(enc);
@@ -345,7 +346,7 @@ async function decrypt(jwe, key, options) {
     keyUsage: options?.keyUsage,
     extractable: options?.extractable,
     returnAs: false
-    // Returning CEK as Uint8Array
+    // Returning CEK as Uint8Array<ArrayBuffer>
   };
   const cekBytes = await unwrapKey(
     alg,
@@ -362,66 +363,15 @@ async function decrypt(jwe, key, options) {
     contentAuthTagBytes,
     aadBytes
   );
-  let payload;
-  if (options?.forceUint8Array) {
-    payload = plaintextBytes;
-  } else {
-    const decodedString = textDecoder.decode(plaintextBytes);
-    const cty = protectedHeader.cty?.toLowerCase();
-    const isJsonOutput = protectedHeader.typ === "JWT" || cty === "json" || cty === "application/json" || cty && cty.endsWith("+json");
-    if (isJsonOutput) {
-      if (decodedString.startsWith("{") && decodedString.endsWith("}") || decodedString.startsWith("[") && decodedString.endsWith("]")) {
-        try {
-          payload = JSON.parse(decodedString);
-        } catch {
-          payload = decodedString;
-        }
-      } else {
-        payload = decodedString;
-      }
-    } else {
-      payload = decodedString;
-    }
-  }
-  if (options?.critical && protectedHeader.crit) {
-    const understoodParams = /* @__PURE__ */ new Set([
-      ...options.critical || [],
-      // JWE specific standard headers:
-      "alg",
-      "enc",
-      "typ",
-      "cty",
-      "kid",
-      "jwk",
-      "jku",
-      "x5c",
-      "x5t",
-      "x5u",
-      "iv",
-      "tag",
-      "p2s",
-      "p2c",
-      "epk",
-      "apu",
-      "apv"
-    ]);
-    for (const critParam of protectedHeader.crit) {
-      if (!Object.prototype.hasOwnProperty.call(protectedHeader, critParam)) {
-        throw new Error(
-          `Critical header parameter "${critParam}" listed in "crit" but not present in the protected header.`
-        );
-      }
-      if (!understoodParams.has(critParam)) {
-        throw new Error(
-          `Critical header parameter not understood: ${critParam}`
-        );
-      }
-    }
-  } else if (!options?.critical && protectedHeader.crit) {
-    throw new Error(
-      `Unprocessed critical header parameters: ${protectedHeader.crit.join(", ")}`
-    );
-  }
+  const payload = decodePayloadFromBytes(
+    plaintextBytes,
+    protectedHeader,
+    options?.forceUint8Array
+  );
+  validateCriticalHeadersJWE(protectedHeader, [
+    ...options?.critical || [],
+    ...options?.requiredHeaders || []
+  ]);
   return {
     payload,
     protectedHeader,
@@ -429,20 +379,6 @@ async function decrypt(jwe, key, options) {
     aad: aadBytes
   };
 }
-function getPlaintextBytes(payload) {
-  if (payload instanceof Uint8Array) {
-    return payload;
-  }
-  if (typeof payload === "string") {
-    return textEncoder.encode(payload);
-  }
-  if (typeof payload === "object" && payload !== null) {
-    return textEncoder.encode(JSON.stringify(payload));
-  }
-  throw new TypeError(
-    "Plaintext must be a string, Uint8Array, or a JSON-serializable object."
-  );
-}
 
 const jwe = {
   __proto__: null,

package/dist/shared/unjwt.D_JFPtpW.mjs

@@ -0,0 +1,161 @@
+import { i as importKey, g as getJWKFromSet } from './unjwt.DuBBF25X.mjs';
+import { a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, e as textDecoder, f as base64UrlDecode, g as isJWKSet, h as decodePayloadFromB64UrlSegment, v as validateCriticalHeadersJWS, j as validateJwtClaims } from './unjwt.Ce8yMcp_.mjs';
+import { s as sign$1, v as verify$1 } from './unjwt.C_D0RMCp.mjs';
+
+async function sign(payload, key, options = {}) {
+  const { protectedHeader: additionalProtectedHeader } = options;
+  let { alg } = options;
+  if (!alg) {
+    if (isJWK(key) && key.alg) {
+      alg = key.alg;
+    } else {
+      throw new TypeError('JWS "alg" (Algorithm) must be provided in options');
+    }
+  }
+  validateKeyLength(key, alg);
+  const signingKey = await importKey(key, alg);
+  const protectedHeader = {
+    ...additionalProtectedHeader,
+    ...isJWK(key) && key.kid ? { kid: additionalProtectedHeader?.kid || key.kid } : {},
+    // Include kid if available
+    alg,
+    typ: additionalProtectedHeader?.typ
+  };
+  applyTypCtyDefaults(protectedHeader, payload);
+  if (protectedHeader.b64 === true) {
+    delete protectedHeader.b64;
+  }
+  const computedPayload = computeJwtTimeClaims(
+    payload,
+    protectedHeader.typ,
+    options.expiresIn,
+    options.currentDate
+  );
+  const protectedHeaderString = JSON.stringify(protectedHeader);
+  const protectedHeaderEncoded = base64UrlEncode(protectedHeaderString);
+  let payloadBytes;
+  if (payload instanceof Uint8Array) {
+    payloadBytes = payload;
+  } else if (typeof payload === "string") {
+    payloadBytes = textEncoder.encode(payload);
+  } else if (typeof payload === "object" && payload !== null) {
+    payloadBytes = textEncoder.encode(
+      JSON.stringify(computedPayload || payload)
+    );
+  } else {
+    throw new TypeError(
+      "Payload must be a string, Uint8Array, or a JSON-serializable object."
+    );
+  }
+  const useB64 = protectedHeader.b64 !== false;
+  const payloadEncoded = useB64 ? base64UrlEncode(payloadBytes) : textDecoder.decode(payloadBytes);
+  const signingInputString = `${protectedHeaderEncoded}.${payloadEncoded}`;
+  const signingInputBytes = textEncoder.encode(signingInputString);
+  const signatureBytes = await sign$1(alg, signingKey, signingInputBytes);
+  const signatureEncoded = base64UrlEncode(signatureBytes);
+  return `${signingInputString}.${signatureEncoded}`;
+}
+async function verify(jws, key, options = {}) {
+  const parts = jws.split(".");
+  if (parts.length !== 3) {
+    throw new Error("Invalid JWS: Must contain three parts separated by dots.");
+  }
+  const [protectedHeaderEncoded, payloadEncoded, signatureEncoded] = parts;
+  let protectedHeader;
+  try {
+    const protectedHeaderString = base64UrlDecode(protectedHeaderEncoded);
+    protectedHeader = JSON.parse(protectedHeaderString);
+  } catch (error_) {
+    throw new Error(
+      `Invalid JWS: Protected header is not valid Base64URL or JSON (${error_ instanceof Error ? error_.message : error_})`
+    );
+  }
+  if (!protectedHeader || typeof protectedHeader !== "object" || !protectedHeader.alg) {
+    throw new Error(
+      'Invalid JWS: Protected header must be an object with an "alg" property.'
+    );
+  }
+  const alg = protectedHeader.alg;
+  if (options.algorithms && !options.algorithms.includes(alg)) {
+    throw new Error(`Algorithm not allowed: ${alg}`);
+  }
+  if (options.typ && protectedHeader.typ !== options.typ) {
+    throw new Error(
+      `Invalid JWS: "typ" (Type) Header Parameter mismatch. Expected "${options.typ}", got "${protectedHeader.typ}".`
+    );
+  }
+  let signatureBytes;
+  try {
+    signatureBytes = base64UrlDecode(signatureEncoded, false);
+  } catch (error_) {
+    throw new Error(
+      `Invalid JWS: Signature is not valid Base64URL (${error_ instanceof Error ? error_.message : error_})`
+    );
+  }
+  const keyInput = typeof key === "function" ? await key(protectedHeader, jws) : key;
+  const resolvedKey = isJWKSet(
+    keyInput
+  ) ? getJWKFromSet(keyInput, protectedHeader) : keyInput;
+  const verificationKey = await importKey(resolvedKey, alg);
+  const signingInputString = `${protectedHeaderEncoded}.${payloadEncoded}`;
+  const signingInputBytes = textEncoder.encode(signingInputString);
+  const isValid = await verify$1(
+    alg,
+    verificationKey,
+    signatureBytes,
+    signingInputBytes
+  );
+  if (!isValid) {
+    throw new Error("JWS signature verification failed.");
+  }
+  const useB64 = protectedHeader.b64 !== false;
+  let payload;
+  try {
+    payload = useB64 ? decodePayloadFromB64UrlSegment(
+      payloadEncoded,
+      protectedHeader,
+      options.forceUint8Array
+    ) : options.forceUint8Array ? textEncoder.encode(payloadEncoded) : payloadEncoded;
+  } catch (error_) {
+    throw new Error(
+      `Invalid JWS: Payload decoding failed (${error_ instanceof Error ? error_.message : error_})`
+    );
+  }
+  validateCriticalHeadersJWS(protectedHeader, [
+    ...options.critical || [],
+    ...options.requiredHeaders || []
+  ]);
+  if (payload && typeof payload === "object" && (protectedHeader.typ === "at+jwt" || protectedHeader.typ === "JWT") && !options.forceUint8Array) {
+    validateJwtClaims(payload, options);
+  }
+  return {
+    payload,
+    protectedHeader
+  };
+}
+function validateKeyLength(key, alg) {
+  if (!alg || isJWK(key)) return;
+  if (alg.startsWith("HS") && key instanceof Uint8Array) {
+    const algLength = Number.parseInt(alg.slice(2)) / 8;
+    if (key.length < algLength) {
+      throw new TypeError(
+        `${alg} requires key length to be ${algLength} bytes or larger`
+      );
+    }
+  } else if ((alg.startsWith("RS") || alg.startsWith("PS")) && key instanceof CryptoKey) {
+    const { modulusLength } = key.algorithm;
+    if (typeof modulusLength !== "number" || modulusLength < 2048) {
+      throw new TypeError(
+        `${alg} requires key modulusLength to be 2048 bits or larger`
+      );
+    }
+  }
+}
+
+const jws = {
+  __proto__: null,
+  sign: sign,
+  verify: verify
+};
+
+export { jws as j, sign as s, verify as v };