unjwt 0.6.1 → 0.7.0

package/dist/core/jws.d.mts

@@ -1,31 +1,3 @@
-import { L as JWKSet, N as JWKLookupFunction, d as JWSHeaderParameters, f as JWSProtectedHeader, g as JOSEPayload, h as JWSVerifyResult, m as JWSVerifyOptions, nt as JWK_Private, p as JWSSignOptions, rt as JWK_Public, u as JWSAlgorithm, ut as JWK_Symmetric } from "../_chunks/index.mjs";
-import { i as isJWTError, n as JWTErrorCauseMap, r as JWTErrorCode, t as JWTError } from "../_chunks/error.mjs";
-
-//#region src/core/jws.d.ts
-/**
-* Creates a JWS (JSON Web Signature) in Compact Serialization format.
-*
-* @param payload The payload to sign. Can be a string, Uint8Array, or an object (which will be JSON stringified).
-* @param key The signing key (CryptoKey, JWK, or raw symmetric key as Uint8Array).
-* @param options Signing options, including the algorithm (`alg`) and protected header parameters.
-* @returns A Promise resolving to the JWS Compact Serialization string.
-*/
-declare function sign(payload: JOSEPayload, key: JWK_Symmetric | JWK_Private, options?: JWSSignOptions): Promise<string>;
-declare function sign(payload: JOSEPayload, key: CryptoKey | Uint8Array<ArrayBuffer>, options: JWSSignOptions & {
-  alg: JWSAlgorithm;
-}): Promise<string>;
-/**
-* Verifies a JWS (JSON Web Signature) in Compact Serialization format.
-*
-* @param jws The JWS Compact Serialization string.
-* @param key The verification key (CryptoKey, JWK, JWKSet, raw symmetric key as Uint8Array, or a function resolving the key or set).
-* @param options Verification options, such as allowed algorithms.
-* @returns A Promise resolving to an object containing the verified payload and protected header.
-* @throws If the JWS is invalid, signature verification fails, or options are not met.
-*/
-declare function verify<T extends JOSEPayload>(jws: string, key: CryptoKey | JWKSet | JWK_Public | JWK_Symmetric | Uint8Array<ArrayBuffer> | JWKLookupFunction, options?: JWSVerifyOptions): Promise<JWSVerifyResult<T>>;
-declare function verify(jws: string, key: CryptoKey | JWKSet | JWK_Public | JWK_Symmetric | Uint8Array<ArrayBuffer> | JWKLookupFunction, options: JWSVerifyOptions & {
-  forceUint8Array: true;
-}): Promise<JWSVerifyResult<Uint8Array<ArrayBuffer>>>;
-//#endregion
-export { JWSAlgorithm, JWSHeaderParameters, JWSProtectedHeader, JWSSignOptions, JWSVerifyOptions, JWSVerifyResult, JWTError, type JWTErrorCauseMap, type JWTErrorCode, isJWTError, sign, verify };
+import { A as JWSSignOptions, C as JWSMultiSignOptions, D as JWSMultiVerifyOutcome, E as JWSMultiVerifyOptions, F as JWTErrorCauseMap, I as JWTErrorCode, L as isJWTError, M as JWSVerifyResult, O as JWSMultiVerifyResult, P as JWTError, S as JWSHeaderParameters, T as JWSMultiVerifyAllOptions, b as JWSGeneralSerialization, j as JWSVerifyOptions, k as JWSProtectedHeader, v as JWSAlgorithm, w as JWSMultiSigner, x as JWSGeneralSignature, y as JWSFlattenedSerialization } from "../_chunks/index.mjs";
+import { a as verifyMulti, i as signMulti, n as verify, o as verifyMultiAll, r as generalToFlattenedJWS, t as sign } from "../_chunks/jws.mjs";
+export { JWSAlgorithm, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHeaderParameters, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignOptions, JWSVerifyOptions, JWSVerifyResult, JWTError, JWTErrorCauseMap, JWTErrorCode, generalToFlattenedJWS, isJWTError, sign, signMulti, verify, verifyMulti, verifyMultiAll };

package/dist/core/jws.mjs

@@ -1,104 +1,3 @@
-import { A as validateCriticalHeadersJWS, M as JWTError, N as isJWTError, S as computeJwtTimeClaims, T as decodePayloadFromB64UrlSegment, _ as textDecoder, a as base64UrlEncode, b as applyTypCtyDefaults, d as isJWKSet, i as base64UrlDecode, j as validateJwtClaims, u as isJWK, v as textEncoder, y as sanitizeObject } from "../_chunks/utils.mjs";
-import { D as verify$1, E as sign$1 } from "../_chunks/_crypto.mjs";
-import { getJWKsFromSet, importKey } from "./jwk.mjs";
-//#region src/core/jws.ts
-async function sign(payload, key, options = {}) {
-	const { protectedHeader: userHeader } = options;
-	let { alg } = options;
-	if (!alg) if (isJWK(key) && key.alg) alg = key.alg;
-	else throw new TypeError("JWS \"alg\" (Algorithm) must be provided in options");
-	if (alg === "none") throw new JWTError("\"none\" is not a valid signing algorithm", "ERR_JWS_ALG_NOT_ALLOWED");
-	const signingKey = await _resolveSigningKey(alg, await importKey(key, alg), "sign");
-	const protectedHeader = _buildJWSHeader(alg, key, userHeader, payload);
-	const computedPayload = computeJwtTimeClaims(payload, protectedHeader.typ, options.expiresIn, options.currentDate);
-	const protectedHeaderEncoded = base64UrlEncode(JSON.stringify(protectedHeader));
-	let payloadBytes;
-	if (payload instanceof Uint8Array) payloadBytes = payload;
-	else if (typeof payload === "string") payloadBytes = textEncoder.encode(payload);
-	else if (typeof payload === "object" && payload !== null) payloadBytes = textEncoder.encode(JSON.stringify(computedPayload || payload));
-	else throw new TypeError("Payload must be a string, Uint8Array, or a JSON-serializable object.");
-	const signingInputString = `${protectedHeaderEncoded}.${protectedHeader.b64 !== false ? base64UrlEncode(payloadBytes) : textDecoder.decode(payloadBytes)}`;
-	const signingInputBytes = textEncoder.encode(signingInputString);
-	return `${signingInputString}.${base64UrlEncode(await sign$1(alg, signingKey, signingInputBytes))}`;
-}
-async function verify(jws, key, options = {}) {
-	const parts = jws.split(".");
-	if (parts.length !== 3) throw new JWTError("Invalid JWS: Must contain three parts separated by dots.", "ERR_JWS_INVALID");
-	const [protectedHeaderEncoded, payloadEncoded, signatureEncoded] = parts;
-	let protectedHeader;
-	try {
-		const protectedHeaderString = base64UrlDecode(protectedHeaderEncoded);
-		protectedHeader = sanitizeObject(JSON.parse(protectedHeaderString));
-	} catch {
-		throw new JWTError("Invalid JWS: Protected header could not be decoded.", "ERR_JWS_INVALID");
-	}
-	if (!protectedHeader || typeof protectedHeader !== "object" || !protectedHeader.alg) throw new JWTError("Invalid JWS: Protected header must be an object with an \"alg\" property.", "ERR_JWS_INVALID");
-	const alg = protectedHeader.alg;
-	if (options.algorithms && !options.algorithms.includes(alg)) throw new JWTError(`Algorithm not allowed: ${alg}`, "ERR_JWS_ALG_NOT_ALLOWED");
-	if (options.typ && protectedHeader.typ !== options.typ) throw new JWTError(`Invalid JWS: "typ" (Type) Header Parameter mismatch. Expected "${options.typ}", got "${protectedHeader.typ}".`, "ERR_JWS_INVALID");
-	let signatureBytes;
-	try {
-		signatureBytes = base64UrlDecode(signatureEncoded, false);
-	} catch {
-		throw new JWTError("Invalid JWS: Signature could not be decoded.", "ERR_JWS_INVALID");
-	}
-	const keyInput = typeof key === "function" ? await key(protectedHeader, jws) : key;
-	const signingInputBytes = textEncoder.encode(`${protectedHeaderEncoded}.${payloadEncoded}`);
-	if (isJWKSet(keyInput)) {
-		const candidates = getJWKsFromSet(keyInput, _buildJWSSetFilter(protectedHeader));
-		if (candidates.length === 0) throw new JWTError(`No key found in JWK Set${protectedHeader.kid ? ` with kid "${protectedHeader.kid}"` : ""}.`, "ERR_JWK_KEY_NOT_FOUND");
-		let verified = false;
-		for (const candidate of candidates) try {
-			if (await verify$1(alg, await _resolveSigningKey(alg, await importKey(candidate, alg), "verify"), signatureBytes, signingInputBytes)) {
-				verified = true;
-				break;
-			}
-		} catch {}
-		if (!verified) throw new JWTError("JWS signature verification failed.", "ERR_JWS_SIGNATURE_INVALID");
-	} else if (!await verify$1(alg, await _resolveSigningKey(alg, await importKey(keyInput, alg), "verify"), signatureBytes, signingInputBytes)) throw new JWTError("JWS signature verification failed.", "ERR_JWS_SIGNATURE_INVALID");
-	const useB64 = protectedHeader.b64 !== false;
-	let payload;
-	try {
-		payload = useB64 ? decodePayloadFromB64UrlSegment(payloadEncoded, protectedHeader, options.forceUint8Array) : options.forceUint8Array ? textEncoder.encode(payloadEncoded) : payloadEncoded;
-	} catch (error_) {
-		throw new JWTError(`Invalid JWS: Payload decoding failed (${error_ instanceof Error ? error_.message : error_})`, "ERR_JWS_INVALID");
-	}
-	validateCriticalHeadersJWS(protectedHeader, options.recognizedHeaders);
-	if (payload && typeof payload === "object" && options.validateClaims !== false && (options.validateClaims === true || protectedHeader.typ?.toLowerCase().includes("jwt")) && !options.forceUint8Array && !(payload instanceof Uint8Array)) validateJwtClaims(payload, options);
-	return {
-		payload,
-		protectedHeader
-	};
-}
-async function _resolveSigningKey(alg, key, usage) {
-	if (key instanceof Uint8Array) {
-		const minBytes = Number.parseInt(alg.slice(2), 10) / 8;
-		if (key.length < minBytes) throw new JWTError(`${alg} requires a key of at least ${minBytes} bytes`, "ERR_JWK_INVALID");
-		return crypto.subtle.importKey("raw", key, {
-			name: "HMAC",
-			hash: `SHA-${alg.slice(-3)}`
-		}, false, [usage]);
-	}
-	if (alg.startsWith("RS") || alg.startsWith("PS")) {
-		const { modulusLength } = key.algorithm;
-		if (typeof modulusLength !== "number" || modulusLength < 2048) throw new JWTError(`${alg} requires a key modulusLength of at least 2048 bits`, "ERR_JWK_INVALID");
-	}
-	return key;
-}
-function _buildJWSSetFilter(header) {
-	const { kid, alg } = header;
-	return (k) => (!kid || k.kid === kid) && (!k.alg || k.alg === alg);
-}
-function _buildJWSHeader(alg, key, userHeader, payload) {
-	const safeHeader = sanitizeObject(userHeader);
-	const header = {
-		...isJWK(key) && key.kid ? { kid: key.kid } : {},
-		...safeHeader,
-		alg
-	};
-	applyTypCtyDefaults(header, payload);
-	if (header.b64 === true) delete header.b64;
-	return header;
-}
-//#endregion
-export { JWTError, isJWTError, sign, verify };
+import { D as JWTError, O as isJWTError } from "../_chunks/utils.mjs";
+import { a as verifyMulti, i as signMulti, n as verify, o as verifyMultiAll, r as generalToFlattenedJWS, t as sign } from "../_chunks/jws.mjs";
+export { JWTError, generalToFlattenedJWS, isJWTError, sign, signMulti, verify, verifyMulti, verifyMultiAll };

package/dist/core/utils/index.d.mts

@@ -1,6 +1,19 @@
-import { A as JWK, L as JWKSet, ft as JWK_oct, l as StrictOmit, nt as JWK_Private, rt as JWK_Public, t as ExpiresIn, v as JWTClaimValidationOptions, y as JWTClaims } from "../../_chunks/index.mjs";
-
-//#region src/core/utils/jwt.d.ts
+import { B as JWTClaimValidationOptions, Ft as KeyManagementAlgorithm, N as StrictOmit, Pt as JWK_oct, Q as JWK, Tt as JWK_Public, V as JWTClaims, at as JWKSet, n as ExpiresIn, t as Duration, v as JWSAlgorithm, wt as JWK_Private } from "../../_chunks/index.mjs";
+import { a as textDecoder, c as sanitizeObject, i as base64UrlEncode, l as sanitizeObjectCopy, n as base64Encode, o as textEncoder, r as base64UrlDecode, s as safeJsonParse, t as base64Decode, u as secureRandomBytes } from "../../_chunks/libs/unsecure.mjs";
+/**
+* Infer the set of JWS signing algorithms a key unambiguously supports.
+* Returns `undefined` when inference is not possible — callers must pass
+* `options.algorithms` explicitly (raw bytes, ambiguous JWK, lookup functions, ...).
+*/
+declare function inferJWSAllowedAlgorithms(key: unknown): JWSAlgorithm[] | undefined;
+/**
+* Infer the set of JWE key-management algorithms a key unambiguously supports.
+* Returns `undefined` when inference is not possible — callers must pass
+* `options.algorithms` explicitly.
+*
+* Passwords (`string` / `Uint8Array`) infer to the three PBES2 variants.
+*/
+declare function inferJWEAllowedAlgorithms(key: unknown): KeyManagementAlgorithm[] | undefined;
 /**
 * Apply default typ/cty semantics shared by JWS & JWE.
 * - If typ is undefined and payload is a non-Uint8Array object, set typ="JWT".
@@ -15,33 +28,57 @@ declare function isJWTContent(header: {
   typ?: string;
   cty?: string;
 } | undefined): boolean;
+/** Parse a decoded string as JSON when it looks like a JSON object or array, otherwise return the string verbatim. */
+declare function decodeMaybeJWTString<T = unknown>(decodedString: string): T | string;
+/** Decode raw payload bytes honoring `forceUint8Array`. */
+declare function decodePayloadFromBytes<T = unknown>(bytes: Uint8Array<ArrayBuffer>, forceUint8Array?: boolean): T | Uint8Array<ArrayBuffer> | string;
+/** Decode a Base64URL-encoded payload segment honoring `forceUint8Array`. */
+declare function decodePayloadFromB64UrlSegment<T = unknown>(payloadEncoded: string, forceUint8Array?: boolean): T | Uint8Array<ArrayBuffer> | string;
+/** Convert plaintext input to bytes, shared by JWS & JWE when preparing payload. */
+declare function getPlaintextBytes(payload: string | Uint8Array<ArrayBuffer> | Record<string, unknown>): Uint8Array<ArrayBuffer>;
 /**
-* Given a decoded string and JOSE headers, return an object if JSON, otherwise the string.
-*/
-declare function decodeMaybeJWTString<T = unknown>(decodedString: string, header: {
-  typ?: string;
-  cty?: string;
-} | undefined): T | string;
-/**
-* Decode a payload that is represented as raw bytes into T | string, honoring forceUint8Array and headers.
+* Parse a {@link Duration} (integer seconds or shorthand string like `"10m"`)
+* into a positive integer number of seconds. Used for `expiresIn`-style inputs
+* where `0` / negatives are invalid.
+*
+* For inputs that legitimately permit `0` (e.g. `notBeforeIn: 0`), compute the
+* bounds at the call site instead.
 */
-declare function decodePayloadFromBytes<T = unknown>(bytes: Uint8Array<ArrayBuffer>, header: {
-  typ?: string;
-  cty?: string;
-} | undefined, forceUint8Array?: boolean): T | Uint8Array<ArrayBuffer> | string;
+declare function computeDurationInSeconds(duration: Duration): number;
+/** @deprecated Renamed to {@link computeDurationInSeconds} in v0.7.0. */
+declare const computeExpiresInSeconds: (expiresIn: ExpiresIn) => number;
+/** @deprecated Renamed to {@link computeDurationInSeconds} in v0.7.0. */
+declare const computeMaxTokenAgeSeconds: (expiresIn: ExpiresIn) => number;
+/** Options for {@link computeJwtTimeClaims}. */
+interface ComputeJwtTimeClaimsOptions {
+  /** Reference moment for `iat` (and for `expiresIn` / `notBeforeIn` math). Defaults to `new Date()`. */
+  currentDate?: Date;
+  /** Duration until `exp`, relative to `currentDate`. Mutually exclusive with `expiresAt`. */
+  expiresIn?: ExpiresIn;
+  /** Absolute moment for `exp`. Mutually exclusive with `expiresIn`. */
+  expiresAt?: Date;
+  /**
+  * Duration from `iat` before which the JWT must not be accepted.
+  * `0` is allowed and means `nbf = iat` (explicit temporal floor at sign time).
+  * Mutually exclusive with `notBeforeAt`.
+  */
+  notBeforeIn?: ExpiresIn;
+  /** Absolute moment for `nbf` (RFC 7519 §4.1.5). Mutually exclusive with `notBeforeIn`. */
+  notBeforeAt?: Date;
+}
 /**
-* Decode a payload that is a Base64URL segment into T | string | Uint8Array based on flags and headers.
+* Compute `iat` + optional `exp` / `nbf` for any JSON-object payload.
+*
+* Returns a shallow-cloned payload with the time claims added, or `undefined`
+* when no hint applies (no expiry/nbf provided, non-object payload, or the
+* payload already carries the corresponding claim).
+*
+* `expiresIn` / `expiresAt` and `notBeforeIn` / `notBeforeAt` are each mutually
+* exclusive pairs — passing both within a pair throws `ERR_JWT_CLAIM_INVALID`.
+* Invalid `Date` inputs (NaN `.getTime()`) and negative `notBeforeIn` durations
+* also throw.
 */
-declare function decodePayloadFromB64UrlSegment<T = unknown>(payloadEncoded: string, header: {
-  typ?: string;
-  cty?: string;
-} | undefined, forceUint8Array?: boolean): T | Uint8Array<ArrayBuffer> | string;
-/** Convert plaintext input to bytes, shared by JWS & JWE when preparing payload. */
-declare function getPlaintextBytes(payload: string | Uint8Array<ArrayBuffer> | Record<string, unknown>): Uint8Array<ArrayBuffer>;
-declare function computeExpiresInSeconds(expiresIn: ExpiresIn): number;
-declare const computeMaxTokenAgeSeconds: (expiresIn: ExpiresIn) => number;
-/** Optionally compute iat/exp when signing JWTs. */
-declare function computeJwtTimeClaims(payload: unknown, headerTyp: string | undefined, expiresIn?: ExpiresIn, currentDate?: Date): JWTClaims | undefined;
+declare function computeJwtTimeClaims(payload: unknown, options?: ComputeJwtTimeClaimsOptions): JWTClaims | undefined;
 /** Validate JWT claims under JWS verification rules (or custom JWE implementations). */
 declare function validateJwtClaims(jwtClaims: JWTClaims, options?: JWTClaimValidationOptions): void;
 /** Validate critical headers in JWS semantics. */
@@ -52,44 +89,22 @@ declare function validateCriticalHeadersJWS(protectedHeader: {
 declare function validateCriticalHeadersJWE(protectedHeader: {
   crit?: string[];
 } & Record<string, any>, recognizedHeaders?: string[]): void;
-//#endregion
-//#region src/core/utils/sanitize.d.ts
-/**
-* Originally derived from unsecure@0.0.4
-* Licensed under the MIT License.
-*
-* Source: https://github.com/sandros94/unsecure/blob/913ed5580c551153a19154b4916c67a8efb2be85/src/sanitize.ts
-*/
-/**
-* Returns a deep structural copy of `obj` with prototype-pollution vectors
-* stripped at every level (`__proto__`, `prototype`, `constructor`).
-*
-* The input is never modified. Arrays are copied element-by-element;
-* nested objects are recursed with a WeakSet cycle guard.
-*/
-declare function sanitizeObject<T extends Record<string, unknown> | undefined>(obj: T): T;
-//#endregion
-//#region src/core/utils/index.d.ts
-declare const textEncoder: TextEncoder;
-declare const textDecoder: TextDecoder;
-declare function base64Encode(data: Uint8Array<ArrayBuffer> | string): string;
-declare function base64UrlEncode(data: Uint8Array<ArrayBuffer> | string): string;
-declare function base64Decode(str: string | undefined): string;
-declare function base64Decode<T extends boolean | undefined>(str?: string | undefined, toString?: T): T extends false ? Uint8Array<ArrayBuffer> : string;
-declare function base64UrlDecode(str: string | undefined): string;
-declare function base64UrlDecode<T extends boolean | undefined>(str?: string | undefined, toString?: T): T extends false ? Uint8Array<ArrayBuffer> : string;
-declare function randomBytes(length: Readonly<number>): Uint8Array<ArrayBuffer>;
-/**
-* Concatenates multiple Uint8Arrays
-* @param arrays Arrays to concatenate
-* @returns Concatenated array
-*/
+/** Concatenate multiple `Uint8Array`s into a single contiguous buffer. */
 declare function concatUint8Arrays(...arrays: Readonly<Uint8Array<ArrayBuffer>[]>): Uint8Array<ArrayBuffer>;
+/** Wrap a value in an array; returns the array unchanged if already an array. */
 declare function maybeArray<T>(item: T | T[]): T[];
+/** Type guard for {@link JWK} — checks for an object with a string `kty`. */
 declare function isJWK(key: any): key is JWK;
+/** Type guard for {@link JWKSet} — checks for an object with a `keys` array. */
 declare function isJWKSet(key: any): key is JWKSet;
+/** Asserts that `key` is a `CryptoKey`; throws `TypeError` otherwise. */
 declare function assertCryptoKey(key: unknown): asserts key is CryptoKey;
+/**
+* Type guard for `CryptoKey`. Uses `Symbol.toStringTag` instead of `instanceof`
+* so it works across worker / realm boundaries where `CryptoKey` identities differ.
+*/
 declare function isCryptoKey(key: unknown): key is CryptoKey;
+/** Type guard for `CryptoKeyPair` — both `publicKey` and `privateKey` must be CryptoKeys. */
 declare const isCryptoKeyPair: (key: any) => key is CryptoKeyPair;
 /** Returns true if the JWK is a symmetric (oct) key. */
 declare function isSymmetricJWK(key: unknown): key is Extract<JWK, JWK_oct>;
@@ -105,5 +120,4 @@ declare function isPrivateJWK(key: unknown): key is JWK_Private;
 * This checks for the presence of public components and absence of private material.
 */
 declare function isPublicJWK(key: unknown): key is JWK_Public;
-//#endregion
-export { StrictOmit, applyTypCtyDefaults, assertCryptoKey, base64Decode, base64Encode, base64UrlDecode, base64UrlEncode, computeExpiresInSeconds, computeJwtTimeClaims, computeMaxTokenAgeSeconds, concatUint8Arrays, decodeMaybeJWTString, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, randomBytes, sanitizeObject, textDecoder, textEncoder, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims };
+export { ComputeJwtTimeClaimsOptions, StrictOmit, applyTypCtyDefaults, assertCryptoKey, base64Decode, base64Encode, base64UrlDecode, base64UrlEncode, computeDurationInSeconds, computeExpiresInSeconds, computeJwtTimeClaims, computeMaxTokenAgeSeconds, concatUint8Arrays, decodeMaybeJWTString, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims };

package/dist/core/utils/index.mjs

@@ -1,2 +1,3 @@
-import { A as validateCriticalHeadersJWS, C as computeMaxTokenAgeSeconds, D as getPlaintextBytes, E as decodePayloadFromBytes, O as isJWTContent, S as computeJwtTimeClaims, T as decodePayloadFromB64UrlSegment, _ as textDecoder, a as base64UrlEncode, b as applyTypCtyDefaults, c as isCryptoKey, d as isJWKSet, f as isPrivateJWK, g as randomBytes, h as maybeArray, i as base64UrlDecode, j as validateJwtClaims, k as validateCriticalHeadersJWE, l as isCryptoKeyPair, m as isSymmetricJWK, n as base64Decode, o as concatUint8Arrays, p as isPublicJWK, r as base64Encode, s as isAsymmetricJWK, t as assertCryptoKey, u as isJWK, v as textEncoder, w as decodeMaybeJWTString, x as computeExpiresInSeconds, y as sanitizeObject } from "../../_chunks/utils.mjs";
-export { applyTypCtyDefaults, assertCryptoKey, base64Decode, base64Encode, base64UrlDecode, base64UrlEncode, computeExpiresInSeconds, computeJwtTimeClaims, computeMaxTokenAgeSeconds, concatUint8Arrays, decodeMaybeJWTString, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, randomBytes, sanitizeObject, textDecoder, textEncoder, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims };
+import { C as validateCriticalHeadersJWS, E as inferJWSAllowedAlgorithms, S as validateCriticalHeadersJWE, T as inferJWEAllowedAlgorithms, _ as decodeMaybeJWTString, a as isCryptoKeyPair, b as getPlaintextBytes, c as isPrivateJWK, d as maybeArray, f as applyTypCtyDefaults, g as computeMaxTokenAgeSeconds, h as computeJwtTimeClaims, i as isCryptoKey, l as isPublicJWK, m as computeExpiresInSeconds, n as concatUint8Arrays, o as isJWK, p as computeDurationInSeconds, r as isAsymmetricJWK, s as isJWKSet, t as assertCryptoKey, u as isSymmetricJWK, v as decodePayloadFromB64UrlSegment, w as validateJwtClaims, x as isJWTContent, y as decodePayloadFromBytes } from "../../_chunks/utils.mjs";
+import { a as base64UrlEncode, c as safeJsonParse, i as base64UrlDecode, l as sanitizeObject, n as base64Decode, o as textDecoder, r as base64Encode, s as textEncoder, t as secureRandomBytes, u as sanitizeObjectCopy } from "../../_chunks/libs/unsecure.mjs";
+export { applyTypCtyDefaults, assertCryptoKey, base64Decode, base64Encode, base64UrlDecode, base64UrlEncode, computeDurationInSeconds, computeExpiresInSeconds, computeJwtTimeClaims, computeMaxTokenAgeSeconds, concatUint8Arrays, decodeMaybeJWTString, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims };

package/dist/index.d.mts

@@ -1,7 +1,6 @@
-import { $ as JWK_OKP_SIGN, A as JWK, B as JWK_AES_GCM_KW, C as DeriveKeyOptions, D as GenerateKeyAlgorithm, E as GenerateJWKReturn, F as JWKPEMAlgorithm, G as JWK_ECDH_ES, H as JWK_Asymmetric, I as JWKParameters, J as JWK_EC_Public, K as JWK_ECDSA, L as JWKSet, M as JWKCacheAdapter, N as JWKLookupFunction, O as GenerateKeyOptions, P as JWKLookupFunctionHeader, Q as JWK_OKP_Public, R as JWK_AES_CBC_HMAC, S as ContentEncryptionAlgorithm, T as GenerateJWKOptions, U as JWK_Asymmetric_Algorithm, V as JWK_AES_KW, W as JWK_EC, X as JWK_OKP, Y as JWK_HMAC, Z as JWK_OKP_Private, _ as JWT, a as JWEEncryptOptions, at as JWK_RSA_ENC, b as JoseHeaderParameters, c as JWEProtectedHeader, ct as JWK_RSA_Public, d as JWSHeaderParameters, dt as JWK_Symmetric_Algorithm, et as JWK_PBES2, f as JWSProtectedHeader, ft as JWK_oct, g as JOSEPayload, gt as WrapKeyResult, h as JWSVerifyResult, ht as WrapKeyOptions, i as JWEDecryptResult, it as JWK_RSA, j as JWKAlgorithm, k as GenerateKeyReturn, lt as JWK_RSA_SIGN, m as JWSVerifyOptions, mt as UnwrapKeyOptions, n as MaxTokenAge, nt as JWK_Private, o as JWEHeaderParameters, ot as JWK_RSA_PSS, p as JWSSignOptions, pt as KeyManagementAlgorithm, q as JWK_EC_Private, r as JWEDecryptOptions, rt as JWK_Public, s as JWEKeyManagementHeaderParameters, st as JWK_RSA_Private, t as ExpiresIn, tt as JWK_Pair, u as JWSAlgorithm, ut as JWK_Symmetric, v as JWTClaimValidationOptions, w as DeriveKeyReturn, x as CompositeKey, y as JWTClaims, z as JWK_AES_GCM } from "./_chunks/index.mjs";
-import { i as isJWTError, n as JWTErrorCauseMap, r as JWTErrorCode, t as JWTError } from "./_chunks/error.mjs";
-import { decrypt, encrypt } from "./core/jwe.mjs";
-import { WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportKey, exportToPEM, generateJWK, generateKey, getJWKFromSet, getJWKsFromSet, importFromPEM, importKey, unwrapKey, wrapKey } from "./core/jwk.mjs";
-import { sign, verify } from "./core/jws.mjs";
-import { assertCryptoKey, base64Decode, base64Encode, base64UrlDecode, base64UrlEncode, computeExpiresInSeconds, computeMaxTokenAgeSeconds, concatUint8Arrays, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, randomBytes, sanitizeObject, textDecoder, textEncoder, validateJwtClaims } from "./core/utils/index.mjs";
-export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JOSEPayload, JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSHeaderParameters, JWSProtectedHeader, JWSSignOptions, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JWTError, type JWTErrorCauseMap, type JWTErrorCode, JoseHeaderParameters, KeyManagementAlgorithm, MaxTokenAge, UnwrapKeyOptions, WeakMapJWKCache, WrapKeyOptions, WrapKeyResult, assertCryptoKey, base64Decode, base64Encode, base64UrlDecode, base64UrlEncode, clearJWKCache, computeExpiresInSeconds, computeMaxTokenAgeSeconds, concatUint8Arrays, configureJWKCache, decrypt, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, encrypt, exportKey, exportToPEM, generateJWK, generateKey, getJWKFromSet, getJWKsFromSet, importFromPEM, importKey, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, randomBytes, sanitizeObject, sign, textDecoder, textEncoder, unwrapKey, validateJwtClaims, verify, wrapKey };
+import { $ as JWKAlgorithm, A as JWSSignOptions, At as JWK_RSA_Public, B as JWTClaimValidationOptions, C as JWSMultiSignOptions, Ct as JWK_Pair, D as JWSMultiVerifyOutcome, Dt as JWK_RSA_ENC, E as JWSMultiVerifyOptions, Et as JWK_RSA, F as JWTErrorCauseMap, Ft as KeyManagementAlgorithm, G as DeriveKeyOptions, H as JoseHeaderParameters, I as JWTErrorCode, It as UnwrapKeyOptions, J as GenerateJWKReturn, K as DeriveKeyReturn, L as isJWTError, Lt as WrapKeyOptions, M as JWSVerifyResult, Mt as JWK_Symmetric, Nt as JWK_Symmetric_Algorithm, O as JWSMultiVerifyResult, Ot as JWK_RSA_PSS, P as JWTError, Pt as JWK_oct, Q as JWK, R as JOSEPayload, Rt as WrapKeyResult, S as JWSHeaderParameters, St as JWK_PBES2, T as JWSMultiVerifyAllOptions, Tt as JWK_Public, U as CompositeKey, V as JWTClaims, W as ContentEncryptionAlgorithm, X as GenerateKeyOptions, Y as GenerateKeyAlgorithm, Z as GenerateKeyReturn, _ as JWEProtectedHeader, _t as JWK_HMAC, a as JWEDecryptOptions, at as JWKSet, b as JWSGeneralSerialization, bt as JWK_OKP_Public, c as JWEFlattenedSerialization, ct as JWK_AES_GCM_KW, d as JWEHeaderParameters, dt as JWK_Asymmetric_Algorithm, et as JWKCacheAdapter, f as JWEKeyManagementHeaderParameters, ft as JWK_EC, g as JWEMultiRecipient, gt as JWK_EC_Public, h as JWEMultiEncryptOptions, ht as JWK_EC_Private, i as NotBeforeIn, it as JWKParameters, j as JWSVerifyOptions, jt as JWK_RSA_SIGN, k as JWSProtectedHeader, kt as JWK_RSA_Private, l as JWEGeneralRecipient, lt as JWK_AES_KW, m as JWEMultiDecryptResult, mt as JWK_ECDSA, n as ExpiresIn, nt as JWKLookupFunctionHeader, o as JWEDecryptResult, ot as JWK_AES_CBC_HMAC, p as JWEMultiDecryptOptions, pt as JWK_ECDH_ES, q as GenerateJWKOptions, r as MaxTokenAge, rt as JWKPEMAlgorithm, s as JWEEncryptOptions, st as JWK_AES_GCM, t as Duration, tt as JWKLookupFunction, u as JWEGeneralSerialization, ut as JWK_Asymmetric, v as JWSAlgorithm, vt as JWK_OKP, w as JWSMultiSigner, wt as JWK_Private, x as JWSGeneralSignature, xt as JWK_OKP_SIGN, y as JWSFlattenedSerialization, yt as JWK_OKP_Private, z as JWT } from "./_chunks/index.mjs";
+import { WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportKey, exportPEM, exportToPEM, generateJWK, generateKey, getJWKFromSet, getJWKsFromSet, importFromPEM, importKey, importPEM, unwrapKey, wrapKey } from "./core/jwk.mjs";
+import { a as generalToFlattened, i as encryptMulti, n as encrypt, r as decryptMulti, t as decrypt } from "./_chunks/jwe.mjs";
+import { a as verifyMulti, i as signMulti, n as verify, o as verifyMultiAll, r as generalToFlattenedJWS, t as sign } from "./_chunks/jws.mjs";
+import { assertCryptoKey, computeDurationInSeconds, computeExpiresInSeconds, computeMaxTokenAgeSeconds, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isPrivateJWK, isPublicJWK, isSymmetricJWK, validateJwtClaims } from "./core/utils/index.mjs";
+export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, Duration, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JOSEPayload, JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHeaderParameters, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignOptions, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JWTError, type JWTErrorCauseMap, type JWTErrorCode, JoseHeaderParameters, KeyManagementAlgorithm, MaxTokenAge, NotBeforeIn, UnwrapKeyOptions, WeakMapJWKCache, WrapKeyOptions, WrapKeyResult, assertCryptoKey, clearJWKCache, computeDurationInSeconds, computeExpiresInSeconds, computeMaxTokenAgeSeconds, configureJWKCache, decrypt, decryptMulti, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, encrypt, encryptMulti, exportKey, exportPEM, exportToPEM, generalToFlattened, generalToFlattenedJWS, generateJWK, generateKey, getJWKFromSet, getJWKsFromSet, importFromPEM, importKey, importPEM, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, sign, signMulti, unwrapKey, validateJwtClaims, verify, verifyMulti, verifyMultiAll, wrapKey };

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { C as computeMaxTokenAgeSeconds, M as JWTError, N as isJWTError, _ as textDecoder, a as base64UrlEncode, c as isCryptoKey, d as isJWKSet, f as isPrivateJWK, g as randomBytes, h as maybeArray, i as base64UrlDecode, j as validateJwtClaims, l as isCryptoKeyPair, m as isSymmetricJWK, n as base64Decode, o as concatUint8Arrays, p as isPublicJWK, r as base64Encode, s as isAsymmetricJWK, t as assertCryptoKey, u as isJWK, v as textEncoder, x as computeExpiresInSeconds, y as sanitizeObject } from "./_chunks/utils.mjs";
-import { WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportKey, exportToPEM, generateJWK, generateKey, getJWKFromSet, getJWKsFromSet, importFromPEM, importKey, unwrapKey, wrapKey } from "./core/jwk.mjs";
-import { sign, verify } from "./core/jws.mjs";
-import { decrypt, encrypt } from "./core/jwe.mjs";
-export { JWTError, WeakMapJWKCache, assertCryptoKey, base64Decode, base64Encode, base64UrlDecode, base64UrlEncode, clearJWKCache, computeExpiresInSeconds, computeMaxTokenAgeSeconds, concatUint8Arrays, configureJWKCache, decrypt, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, encrypt, exportKey, exportToPEM, generateJWK, generateKey, getJWKFromSet, getJWKsFromSet, importFromPEM, importKey, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, randomBytes, sanitizeObject, sign, textDecoder, textEncoder, unwrapKey, validateJwtClaims, verify, wrapKey };
+import { D as JWTError, O as isJWTError, a as isCryptoKeyPair, c as isPrivateJWK, g as computeMaxTokenAgeSeconds, i as isCryptoKey, l as isPublicJWK, m as computeExpiresInSeconds, o as isJWK, p as computeDurationInSeconds, r as isAsymmetricJWK, s as isJWKSet, t as assertCryptoKey, u as isSymmetricJWK, w as validateJwtClaims } from "./_chunks/utils.mjs";
+import { _ as unwrapKey, a as deriveKeyFromPassword, c as exportPEM, d as generateKey, f as getJWKFromSet, g as importPEM, h as importKey, i as deriveJWKFromPassword, l as exportToPEM, m as importFromPEM, n as clearJWKCache, o as deriveSharedSecret, p as getJWKsFromSet, r as configureJWKCache, s as exportKey, t as WeakMapJWKCache, u as generateJWK, v as wrapKey } from "./_chunks/jwk.mjs";
+import { a as verifyMulti, i as signMulti, n as verify, o as verifyMultiAll, r as generalToFlattenedJWS, t as sign } from "./_chunks/jws.mjs";
+import { a as generalToFlattened, i as encryptMulti, n as encrypt, r as decryptMulti, t as decrypt } from "./_chunks/jwe.mjs";
+export { JWTError, WeakMapJWKCache, assertCryptoKey, clearJWKCache, computeDurationInSeconds, computeExpiresInSeconds, computeMaxTokenAgeSeconds, configureJWKCache, decrypt, decryptMulti, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, encrypt, encryptMulti, exportKey, exportPEM, exportToPEM, generalToFlattened, generalToFlattenedJWS, generateJWK, generateKey, getJWKFromSet, getJWKsFromSet, importFromPEM, importKey, importPEM, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, sign, signMulti, unwrapKey, validateJwtClaims, verify, verifyMulti, verifyMultiAll, wrapKey };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "description": "Low-level JWT utilities",
   "license": "MIT",
   "author": {
@@ -55,30 +55,31 @@
   },
   "devDependencies": {
     "@types/node": "^24",
-    "@types/supertest": "^6.0.3",
-    "@typescript/native-preview": "7.0.0-dev.20260306.1",
-    "@vitest/coverage-v8": "^4.0.15",
+    "@types/supertest": "^7.2.0",
+    "@typescript/native-preview": "7.0.0-dev.20260419.1",
+    "@vitest/coverage-v8": "^4.1.4",
     "automd": "^0.4.3",
     "changelogen": "^0.6.2",
-    "cookie-esv1": "npm:cookie-es@^1.2.2",
-    "cookie-esv2": "npm:cookie-es@^2.0.0",
-    "h3v1": "npm:h3@^1.15.10",
-    "h3v2": "npm:h3@^2.0.1-rc.19",
-    "jose": "^6.2.0",
-    "nano-staged": "^0.9.0",
-    "obuild": "^0.4.32",
-    "oxfmt": "^0.43.0",
-    "oxlint": "^1.51.0",
-    "rolldown": "1.0.0-rc.12",
+    "cookie-esv1": "npm:cookie-es@^1.2.3",
+    "cookie-esv3": "npm:cookie-es@^3.1.1",
+    "h3v1": "npm:h3@^1.15.11",
+    "h3v2": "npm:h3@^2.0.1-rc.20",
+    "jose": "^6.2.2",
+    "nano-staged": "^1.0.2",
+    "obuild": "^0.4.33",
+    "oxfmt": "^0.45.0",
+    "oxlint": "^1.60.0",
+    "rolldown": "1.0.0-rc.16",
+    "rou3": "^0.8.1",
     "simple-git-hooks": "^2.13.1",
     "supertest": "^7.2.2",
-    "typescript": "^5.9.3",
-    "vitest": "^4.0.18"
+    "typescript": "^6.0.3",
+    "unsecure": "^0.2.1",
+    "vitest": "^4.1.4"
   },
   "peerDependencies": {
-    "cookie-es": "^1.2.2 || ^2.0.0",
-    "h3": "^1.15.4 || >=2.0.1-rc.18 || ^2.0.1",
-    "rou3": "^0.7.10"
+    "cookie-es": "^1.2.3 || ^3.1.1",
+    "h3": "^1.15.4 || >=2.0.1-rc.20 || ^2.0.1"
   },
   "peerDependenciesMeta": {
     "cookie-es": {
@@ -86,11 +87,11 @@
     },
     "h3": {
       "optional": true
-    },
-    "rou3": {
-      "optional": true
     }
   },
+  "resolutions": {
+    "unjwt": "link:."
+  },
   "simple-git-hooks": {
     "pre-commit": "./node_modules/.bin/nano-staged"
   },
@@ -106,6 +107,7 @@
     "lint": "oxlint . && oxfmt --check .",
     "fmt": "automd && oxlint --fix . && oxfmt .",
     "release": "pnpm test && pnpm prepack && changelogen --release --push",
+    "stub": "obuild --stub",
     "test": "vitest run --slowTestThreshold=1000",
     "test:coverage": "vitest run --coverage --slowTestThreshold=1000",
     "typecheck": "tsgo --noEmit",

package/dist/_chunks/error.d.mts

@@ -1,67 +0,0 @@
-//#region src/core/error.d.ts
-/**
-* All known error codes thrown by unjwt.
-*
-* Code naming follows the JOSE spec hierarchy:
-*   ERR_JWT_*  — RFC 7519 JSON Web Token claim validation
-*   ERR_JWS_*  — RFC 7515 JSON Web Signature
-*   ERR_JWE_*  — RFC 7516 JSON Web Encryption
-*   ERR_JWK_*  — RFC 7517 JSON Web Key
-*/
-type JWTErrorCode = "ERR_JWT_EXPIRED" | "ERR_JWT_NBF" | "ERR_JWT_CLAIM_INVALID" | "ERR_JWT_CLAIM_MISSING" | "ERR_JWS_INVALID" | "ERR_JWS_SIGNATURE_INVALID" | "ERR_JWS_ALG_NOT_ALLOWED" | "ERR_JWE_INVALID" | "ERR_JWE_DECRYPTION_FAILED" | "ERR_JWE_ALG_NOT_ALLOWED" | "ERR_JWK_INVALID" | "ERR_JWK_KEY_NOT_FOUND" | (string & {});
-/**
-* Maps known error codes to their structured `cause` shapes.
-* Only codes that carry decoded context beyond the message appear here.
-* Extend this interface when new structured causes are introduced.
-*/
-interface JWTErrorCauseMap {
-  /** Decoded claims available at the point the lifetime check failed. */
-  ERR_JWT_EXPIRED: {
-    jti?: string;
-    iat?: number;
-    exp?: number;
-  };
-}
-/**
-* Base error class for all unjwt errors. Every error thrown by the library is
-* an instance of `JWTError`, so a single `instanceof` check is sufficient to
-* distinguish library errors from other thrown values. Use the `code` property
-* (or the `isJWTError` type guard) to narrow to a specific error condition.
-*
-* @example
-* import { JWTError, isJWTError } from "unjwt/jws";
-*
-* try {
-*   await verify(token, key);
-* } catch (err) {
-*   if (isJWTError(err, "ERR_JWT_EXPIRED")) {
-*     console.log(err.cause.jti); // string | undefined
-*   }
-* }
-*/
-declare class JWTError<TCode extends JWTErrorCode = JWTErrorCode> extends Error {
-  readonly code: TCode;
-  override readonly cause?: unknown;
-  constructor(message: string, code: TCode, cause?: unknown);
-}
-/**
-* Type guard that narrows `error` to `JWTError`.
-*
-* When called with a code that is a key of `JWTErrorCauseMap`, the return
-* type is additionally narrowed to include the structured `cause` shape for
-* that code. When called with any other `JWTErrorCode`, `code` is narrowed
-* but `cause` remains `unknown`. When called without a code, narrows only to
-* `JWTError`.
-*
-* @example
-* if (isJWTError(err, "ERR_JWT_EXPIRED")) {
-*   err.cause.jti // string | undefined  ✓
-* }
-*/
-declare function isJWTError<T extends keyof JWTErrorCauseMap>(error: unknown, code: T): error is JWTError<T> & {
-  cause: JWTErrorCauseMap[T];
-};
-declare function isJWTError<T extends JWTErrorCode>(error: unknown, code: T): error is JWTError<T>;
-declare function isJWTError(error: unknown): error is JWTError;
-//#endregion
-export { isJWTError as i, JWTErrorCauseMap as n, JWTErrorCode as r, JWTError as t };