unjwt 0.6.1 → 0.7.1

package/dist/_chunks/utils.mjs

@@ -1,21 +1,4 @@
-//#region src/core/error.ts
-/**
-* Base error class for all unjwt errors. Every error thrown by the library is
-* an instance of `JWTError`, so a single `instanceof` check is sufficient to
-* distinguish library errors from other thrown values. Use the `code` property
-* (or the `isJWTError` type guard) to narrow to a specific error condition.
-*
-* @example
-* import { JWTError, isJWTError } from "unjwt/jws";
-*
-* try {
-*   await verify(token, key);
-* } catch (err) {
-*   if (isJWTError(err, "ERR_JWT_EXPIRED")) {
-*     console.log(err.cause.jti); // string | undefined
-*   }
-* }
-*/
+import { c as safeJsonParse, i as base64UrlDecode, o as textDecoder, s as textEncoder } from "./libs/unsecure.mjs";
 var JWTError = class extends Error {
 	code;
 	cause;
@@ -30,52 +13,164 @@ function isJWTError(error, code) {
 	if (!(error instanceof JWTError)) return false;
 	return code === void 0 || error.code === code;
 }
-//#endregion
-//#region src/core/utils/jwt.ts
-/**
-* Apply default typ/cty semantics shared by JWS & JWE.
-* - If typ is undefined and payload is a non-Uint8Array object, set typ="JWT".
-* - If typ is "JWT" and payload is a non-Uint8Array object, ensure cty defaults to "application/json".
-*/
+function inferJWSAllowedAlgorithms(key) {
+	if (!key || typeof key === "function") return void 0;
+	if (typeof key === "string" || key instanceof Uint8Array) return void 0;
+	if (typeof key !== "object") return void 0;
+	if (isCryptoKeyPair(key)) return inferJWSAllowedAlgorithms(key.publicKey);
+	if (isJWKSet(key)) return unionFromJWKSet(key.keys, jwsAlgsFromJWK);
+	if (isCryptoKey(key)) return jwsAlgsFromCryptoKey(key);
+	if (isJWK(key)) return jwsAlgsFromJWK(key);
+}
+function inferJWEAllowedAlgorithms(key) {
+	if (!key || typeof key === "function") return void 0;
+	if (typeof key === "string" || key instanceof Uint8Array) return [
+		"PBES2-HS256+A128KW",
+		"PBES2-HS384+A192KW",
+		"PBES2-HS512+A256KW",
+		"dir"
+	];
+	if (typeof key !== "object") return void 0;
+	if (isCryptoKeyPair(key)) return inferJWEAllowedAlgorithms(key.privateKey);
+	if (isJWKSet(key)) return unionFromJWKSet(key.keys, jweAlgsFromJWK);
+	if (isCryptoKey(key)) return jweAlgsFromCryptoKey(key);
+	if (isJWK(key)) return jweAlgsFromJWK(key);
+}
+function unionFromJWKSet(keys, mapper) {
+	const algs = /* @__PURE__ */ new Set();
+	for (const k of keys) {
+		const mapped = mapper(k);
+		if (!mapped) return void 0;
+		for (const a of mapped) algs.add(a);
+	}
+	return algs.size > 0 ? [...algs] : void 0;
+}
+function jwsAlgsFromJWK(jwk) {
+	if (jwk.alg) return [jwk.alg];
+	if (jwk.kty === "EC") {
+		const crv = jwk.crv;
+		if (crv === "P-256") return ["ES256"];
+		if (crv === "P-384") return ["ES384"];
+		if (crv === "P-521") return ["ES512"];
+	}
+	if (jwk.kty === "OKP") {
+		const crv = jwk.crv;
+		if (crv === "Ed25519") return ["Ed25519", "EdDSA"];
+		if (crv === "Ed448") return ["EdDSA"];
+	}
+}
+function jweAlgsFromJWK(jwk) {
+	if (jwk.kty === "oct") return jweAlgsFromOctJWK(jwk);
+	if (jwk.alg) return [jwk.alg];
+	if (jwk.kty === "EC") {
+		const crv = jwk.crv;
+		if (crv === "P-256" || crv === "P-384" || crv === "P-521") return [
+			"ECDH-ES",
+			"ECDH-ES+A128KW",
+			"ECDH-ES+A192KW",
+			"ECDH-ES+A256KW"
+		];
+	}
+	if (jwk.kty === "OKP") {
+		const crv = jwk.crv;
+		if (crv === "X25519" || crv === "X448") return [
+			"ECDH-ES",
+			"ECDH-ES+A128KW",
+			"ECDH-ES+A192KW",
+			"ECDH-ES+A256KW"
+		];
+	}
+}
+function jweAlgsFromOctJWK(jwk) {
+	const alg = jwk.alg;
+	if (!alg) return void 0;
+	if (alg === "A128GCM") return ["A128GCMKW", "dir"];
+	if (alg === "A192GCM") return ["A192GCMKW", "dir"];
+	if (alg === "A256GCM") return ["A256GCMKW", "dir"];
+	if (alg === "A128KW" || alg === "A192KW" || alg === "A256KW") return [alg, "dir"];
+	if (alg === "A128GCMKW" || alg === "A192GCMKW" || alg === "A256GCMKW") return [alg, "dir"];
+	if (alg === "A128CBC-HS256" || alg === "A192CBC-HS384" || alg === "A256CBC-HS512") return ["dir"];
+	if (alg === "dir") return ["dir"];
+	return [alg];
+}
+function jwsAlgsFromCryptoKey(key) {
+	const name = key.algorithm.name;
+	const hashName = key.algorithm.hash?.name;
+	const hashBits = hashName?.startsWith("SHA-") ? hashName.slice(4) : void 0;
+	switch (name) {
+		case "HMAC": return hashBits ? [`HS${hashBits}`] : void 0;
+		case "RSASSA-PKCS1-v1_5": return hashBits ? [`RS${hashBits}`] : void 0;
+		case "RSA-PSS": return hashBits ? [`PS${hashBits}`] : void 0;
+		case "ECDSA": {
+			const curve = key.algorithm.namedCurve;
+			if (curve === "P-256") return ["ES256"];
+			if (curve === "P-384") return ["ES384"];
+			if (curve === "P-521") return ["ES512"];
+			return;
+		}
+		case "Ed25519": return ["Ed25519", "EdDSA"];
+		default: return;
+	}
+}
+function jweAlgsFromCryptoKey(key) {
+	const name = key.algorithm.name;
+	const hashName = key.algorithm.hash?.name;
+	const length = key.algorithm.length;
+	switch (name) {
+		case "AES-KW":
+			if (length === 128) return ["A128KW", "dir"];
+			if (length === 192) return ["A192KW", "dir"];
+			if (length === 256) return ["A256KW", "dir"];
+			return;
+		case "AES-GCM":
+			if (length === 128) return ["A128GCMKW", "dir"];
+			if (length === 192) return ["A192GCMKW", "dir"];
+			if (length === 256) return ["A256GCMKW", "dir"];
+			return;
+		case "RSA-OAEP":
+			if (hashName === "SHA-1") return ["RSA-OAEP"];
+			if (hashName === "SHA-256") return ["RSA-OAEP-256"];
+			if (hashName === "SHA-384") return ["RSA-OAEP-384"];
+			if (hashName === "SHA-512") return ["RSA-OAEP-512"];
+			return;
+		case "ECDH":
+		case "X25519":
+		case "X448": return [
+			"ECDH-ES",
+			"ECDH-ES+A128KW",
+			"ECDH-ES+A192KW",
+			"ECDH-ES+A256KW"
+		];
+		default: return;
+	}
+}
 function applyTypCtyDefaults(header, payload) {
-	const isObjectPayload = typeof payload === "object" && payload !== null && !(payload instanceof Uint8Array);
-	if (header.typ === void 0 && isObjectPayload) header.typ = "JWT";
-	if (header.typ?.toLowerCase().includes("jwt") && isObjectPayload) header.cty ||= "application/json";
+	if (!(typeof payload === "object" && payload !== null && !(payload instanceof Uint8Array))) return header;
+	let typ = header.typ;
+	if (typ === void 0) header.typ = typ = "JWT";
+	if (typ === "JWT" || typ === "jwt" || typ.toLowerCase().includes("jwt")) header.cty ||= "application/json";
 	return header;
 }
-/** Returns true when headers indicate JSON content. */
 function isJWTContent(header) {
 	if (!header) return false;
 	if (header.typ?.toLowerCase().includes("jwt")) return true;
 	const cty = header.cty?.toLowerCase();
 	return cty === "json" || cty === "application/json" || !!cty && cty.endsWith("+json");
 }
-/**
-* Given a decoded string and JOSE headers, return an object if JSON, otherwise the string.
-*/
-function decodeMaybeJWTString(decodedString, header) {
-	if (isJWTContent(header)) {
-		if (decodedString.startsWith("{") && decodedString.endsWith("}") || decodedString.startsWith("[") && decodedString.endsWith("]")) try {
-			return sanitizeObject(JSON.parse(decodedString));
-		} catch {}
-	}
+function decodeMaybeJWTString(decodedString) {
+	if (decodedString.startsWith("{") && decodedString.endsWith("}") || decodedString.startsWith("[") && decodedString.endsWith("]")) try {
+		return safeJsonParse(decodedString);
+	} catch {}
 	return decodedString;
 }
-/**
-* Decode a payload that is represented as raw bytes into T | string, honoring forceUint8Array and headers.
-*/
-function decodePayloadFromBytes(bytes, header, forceUint8Array) {
+function decodePayloadFromBytes(bytes, forceUint8Array) {
 	if (forceUint8Array) return bytes;
-	return decodeMaybeJWTString(textDecoder.decode(bytes), header);
+	return decodeMaybeJWTString(textDecoder.decode(bytes));
 }
-/**
-* Decode a payload that is a Base64URL segment into T | string | Uint8Array based on flags and headers.
-*/
-function decodePayloadFromB64UrlSegment(payloadEncoded, header, forceUint8Array) {
-	if (forceUint8Array) return base64UrlDecode(payloadEncoded, false);
-	return decodeMaybeJWTString(base64UrlDecode(payloadEncoded), header);
+function decodePayloadFromB64UrlSegment(payloadEncoded, forceUint8Array) {
+	if (forceUint8Array) return base64UrlDecode(payloadEncoded, { returnAs: "uint8array" });
+	return decodeMaybeJWTString(base64UrlDecode(payloadEncoded));
 }
-/** Convert plaintext input to bytes, shared by JWS & JWE when preparing payload. */
 function getPlaintextBytes(payload) {
 	if (payload instanceof Uint8Array) return payload;
 	if (typeof payload === "string") return textEncoder.encode(payload);
@@ -105,41 +200,73 @@ const TIME_CONSTANTS = Object.freeze({
 	year: 31536e3,
 	years: 31536e3
 });
-const EXPIRES_IN_REGEX = /^(\d+)(s|second|seconds|m|minute|minutes|h|hour|hours|D|day|days|W|week|weeks|M|month|months|Y|year|years)?$/;
-function computeExpiresInSeconds(expiresIn) {
-	if (typeof expiresIn === "number") {
-		if (!Number.isInteger(expiresIn) || expiresIn <= 0) throw new TypeError("If 'expiresIn' is a number, it must be a positive integer representing seconds.");
-		return expiresIn;
+const DURATION_REGEX = /^(\d+)(s|second|seconds|m|minute|minutes|h|hour|hours|D|day|days|W|week|weeks|M|month|months|Y|year|years)?$/;
+function _parseDurationSeconds(value) {
+	if (typeof value === "number") {
+		if (!Number.isInteger(value)) throw new TypeError("Duration must be an integer number of seconds.");
+		return value;
 	}
-	if (typeof expiresIn === "string") {
-		const match = expiresIn.match(EXPIRES_IN_REGEX);
-		if (!match || !match[1]) throw new TypeError("Invalid 'expiresIn' format. Must be a positive integer or a string like '10m', '2h', '7D', etc.");
+	if (typeof value === "string") {
+		const match = value.match(DURATION_REGEX);
+		if (!match || !match[1]) throw new TypeError("Invalid duration format. Must be an integer or a string like '10m', '2h', '7D', etc.");
 		return Number.parseInt(match[1], 10) * TIME_CONSTANTS[match[2] || "s"];
 	}
-	throw new TypeError("'expiresIn' must be a number or a string representing time duration.");
+	throw new TypeError("Duration must be a number or a string representing time.");
+}
+function computeDurationInSeconds(duration) {
+	const seconds = _parseDurationSeconds(duration);
+	if (seconds <= 0) throw new TypeError("Duration must be a positive integer number of seconds.");
+	return seconds;
 }
-const computeMaxTokenAgeSeconds = computeExpiresInSeconds;
-/** Optionally compute iat/exp when signing JWTs. */
-function computeJwtTimeClaims(payload, headerTyp, expiresIn, currentDate = /* @__PURE__ */ new Date()) {
-	if (expiresIn === void 0 || !headerTyp?.toLowerCase().includes("jwt") || !(payload && typeof payload === "object") || payload instanceof Uint8Array || payload.exp) return;
-	const now = Math.round(currentDate.getTime() / 1e3);
-	const claims = { ...payload };
+const computeExpiresInSeconds = computeDurationInSeconds;
+const computeMaxTokenAgeSeconds = computeDurationInSeconds;
+function computeJwtTimeClaims(payload, options) {
+	const { currentDate, expiresIn, expiresAt, notBeforeIn, notBeforeAt } = options ?? {};
+	if (expiresIn !== void 0 && expiresAt !== void 0) throw new JWTError("\"expiresIn\" and \"expiresAt\" are mutually exclusive; pass only one.", "ERR_JWT_CLAIM_INVALID");
+	if (notBeforeIn !== void 0 && notBeforeAt !== void 0) throw new JWTError("\"notBeforeIn\" and \"notBeforeAt\" are mutually exclusive; pass only one.", "ERR_JWT_CLAIM_INVALID");
+	const hasExpHint = expiresIn !== void 0 || expiresAt !== void 0;
+	const hasNbfHint = notBeforeIn !== void 0 || notBeforeAt !== void 0;
+	if (!hasExpHint && !hasNbfHint) return void 0;
+	if (!payload || typeof payload !== "object" || payload instanceof Uint8Array) return void 0;
+	const typedPayload = payload;
+	const wantsExp = hasExpHint && typedPayload.exp === void 0;
+	const wantsNbf = hasNbfHint && typedPayload.nbf === void 0;
+	if (!wantsExp && !wantsNbf) return void 0;
+	const now = Math.round((currentDate ?? /* @__PURE__ */ new Date()).getTime() / 1e3);
+	const claims = { ...typedPayload };
 	claims.iat ||= now;
-	claims.exp = claims.iat + computeExpiresInSeconds(expiresIn);
+	if (wantsExp) if (expiresAt !== void 0) {
+		const expMs = expiresAt.getTime();
+		if (!Number.isFinite(expMs)) throw new JWTError("\"expiresAt\" must be a valid Date.", "ERR_JWT_CLAIM_INVALID");
+		claims.exp = Math.floor(expMs / 1e3);
+	} else claims.exp = claims.iat + computeDurationInSeconds(expiresIn);
+	if (wantsNbf) if (notBeforeAt !== void 0) {
+		const nbfMs = notBeforeAt.getTime();
+		if (!Number.isFinite(nbfMs)) throw new JWTError("\"notBeforeAt\" must be a valid Date.", "ERR_JWT_CLAIM_INVALID");
+		claims.nbf = Math.floor(nbfMs / 1e3);
+	} else {
+		const offset = _parseDurationSeconds(notBeforeIn);
+		if (offset < 0) throw new JWTError("\"notBeforeIn\" must be zero or a positive duration.", "ERR_JWT_CLAIM_INVALID");
+		claims.nbf = claims.iat + offset;
+	}
 	return claims;
 }
-/** Validate JWT claims under JWS verification rules (or custom JWE implementations). */
 function validateJwtClaims(jwtClaims, options = {}) {
 	const clockTolerance = options.clockTolerance ?? 0;
 	const currentTime = Math.round((options.currentDate ?? /* @__PURE__ */ new Date()).getTime() / 1e3);
-	const allRequiredClaims = new Set(options.requiredClaims || []);
-	const missingClaims = /* @__PURE__ */ new Set();
-	if (options.issuer) allRequiredClaims.add("iss");
-	if (options.audience) allRequiredClaims.add("aud");
-	if (options.subject) allRequiredClaims.add("sub");
-	if (options.maxTokenAge) allRequiredClaims.add("iat");
-	for (const claimName of allRequiredClaims) if (!(claimName in jwtClaims)) missingClaims.add(claimName);
-	if (missingClaims.size > 0) throw new JWTError(`Missing required JWT Claims: ${[...missingClaims].join(", ")}`, "ERR_JWT_CLAIM_MISSING");
+	if (options.requiredClaims || options.issuer || options.audience || options.subject || options.maxTokenAge) {
+		const allRequiredClaims = new Set(options.requiredClaims || []);
+		if (options.issuer) allRequiredClaims.add("iss");
+		if (options.audience) allRequiredClaims.add("aud");
+		if (options.subject) allRequiredClaims.add("sub");
+		if (options.maxTokenAge) allRequiredClaims.add("iat");
+		const missingClaims = [];
+		for (const claimName of allRequiredClaims) if (!(claimName in jwtClaims)) missingClaims.push(claimName);
+		if (missingClaims.length > 0) throw new JWTError(`Missing required JWT Claims: ${missingClaims.join(", ")}`, "ERR_JWT_CLAIM_MISSING");
+	}
+	if (jwtClaims.exp !== void 0 && !Number.isFinite(jwtClaims.exp)) throw new JWTError("JWT \"exp\" (Expiration Time) Claim must be a number.", "ERR_JWT_CLAIM_INVALID");
+	if (jwtClaims.nbf !== void 0 && !Number.isFinite(jwtClaims.nbf)) throw new JWTError("JWT \"nbf\" (Not Before) Claim must be a number.", "ERR_JWT_CLAIM_INVALID");
+	if (jwtClaims.iat !== void 0 && !Number.isFinite(jwtClaims.iat)) throw new JWTError("JWT \"iat\" (Issued At) Claim must be a number.", "ERR_JWT_CLAIM_INVALID");
 	if (options.issuer) {
 		const expectedIssuers = maybeArray(options.issuer);
 		if (!jwtClaims.iss || !expectedIssuers.includes(jwtClaims.iss)) throw new JWTError(`Invalid JWT "iss" (Issuer) Claim: Expected ${expectedIssuers.join(" or ")}, got ${jwtClaims.iss}`, "ERR_JWT_CLAIM_INVALID");
@@ -159,157 +286,52 @@ function validateJwtClaims(jwtClaims, options = {}) {
 	if (options.maxTokenAge) {
 		if (typeof jwtClaims.iat !== "number") throw new JWTError("JWT \"iat\" (Issued At) Claim must be a number when maxTokenAge is set.", "ERR_JWT_CLAIM_INVALID");
 		if (jwtClaims.iat > currentTime + clockTolerance) throw new JWTError(`JWT "iat" (Issued At) Claim validation failed: Token was issued in the future (iat: ${(/* @__PURE__ */ new Date(jwtClaims.iat * 1e3)).toISOString()})`, "ERR_JWT_CLAIM_INVALID");
-		if (jwtClaims.iat < currentTime - computeMaxTokenAgeSeconds(options.maxTokenAge) - clockTolerance) throw new JWTError(`JWT "iat" (Issued At) Claim validation failed: Token is too old (maxTokenAge: ${options.maxTokenAge}s, iat: ${(/* @__PURE__ */ new Date(jwtClaims.iat * 1e3)).toISOString()})`, "ERR_JWT_EXPIRED", {
+		if (jwtClaims.iat < currentTime - computeDurationInSeconds(options.maxTokenAge) - clockTolerance) throw new JWTError(`JWT "iat" (Issued At) Claim validation failed: Token is too old (maxTokenAge: ${options.maxTokenAge}s, iat: ${(/* @__PURE__ */ new Date(jwtClaims.iat * 1e3)).toISOString()})`, "ERR_JWT_EXPIRED", {
 			jti: jwtClaims.jti,
 			iat: jwtClaims.iat,
 			exp: jwtClaims.exp
 		});
 	}
 }
-const BASE_HEADER_PARAMS = [
+const BASE_PROCESSED_JWS = [
 	"alg",
 	"typ",
 	"cty",
 	"kid",
-	"jwk",
-	"jku",
-	"x5c",
-	"x5t",
-	"x5u"
+	"b64"
+];
+const BASE_PROCESSED_JWE = [
+	"alg",
+	"enc",
+	"typ",
+	"cty",
+	"kid",
+	"iv",
+	"tag",
+	"p2s",
+	"p2c",
+	"epk",
+	"apu",
+	"apv"
 ];
-/** Validate critical headers in JWS semantics. */
 function validateCriticalHeadersJWS(protectedHeader, recognizedHeaders = []) {
 	if (!protectedHeader.crit) return;
 	const missingHeaderParams = /* @__PURE__ */ new Set();
-	const recognizedParams = new Set([
-		...recognizedHeaders,
-		...BASE_HEADER_PARAMS,
-		"b64"
-	]);
+	const recognizedParams = new Set([...recognizedHeaders, ...BASE_PROCESSED_JWS]);
 	for (const param of protectedHeader.crit) {
 		if (recognizedParams.has(param) && (param in protectedHeader || param === "b64")) continue;
 		missingHeaderParams.add(param);
 	}
 	if (missingHeaderParams.size > 0) throw new JWTError(`Missing critical header parameters: ${[...missingHeaderParams].join(", ")}`, "ERR_JWS_INVALID");
 }
-/** Validate critical headers in JWE semantics. */
 function validateCriticalHeadersJWE(protectedHeader, recognizedHeaders) {
-	if (protectedHeader.crit && !recognizedHeaders) throw new JWTError(`Unprocessed critical header parameters: ${protectedHeader.crit.join(", ")}`, "ERR_JWE_INVALID");
 	if (!protectedHeader.crit) return;
-	const understoodParams = new Set([
-		...recognizedHeaders || [],
-		...BASE_HEADER_PARAMS,
-		"enc",
-		"iv",
-		"tag",
-		"p2s",
-		"p2c",
-		"epk",
-		"apu",
-		"apv"
-	]);
+	const understoodParams = new Set([...recognizedHeaders || [], ...BASE_PROCESSED_JWE]);
 	for (const critParam of protectedHeader.crit) {
 		if (!Object.prototype.hasOwnProperty.call(protectedHeader, critParam)) throw new JWTError(`Critical header parameter "${critParam}" listed in "crit" but not present in the protected header.`, "ERR_JWE_INVALID");
 		if (!understoodParams.has(critParam)) throw new JWTError(`Unprocessed critical header parameters: ${critParam}`, "ERR_JWE_INVALID");
 	}
 }
-//#endregion
-//#region src/core/utils/sanitize.ts
-/**
-* Originally derived from unsecure@0.0.4
-* Licensed under the MIT License.
-*
-* Source: https://github.com/sandros94/unsecure/blob/913ed5580c551153a19154b4916c67a8efb2be85/src/sanitize.ts
-*/
-/**
-* Returns a deep structural copy of `obj` with prototype-pollution vectors
-* stripped at every level (`__proto__`, `prototype`, `constructor`).
-*
-* The input is never modified. Arrays are copied element-by-element;
-* nested objects are recursed with a WeakSet cycle guard.
-*/
-function sanitizeObject(obj) {
-	if (!obj || typeof obj !== "object") return obj;
-	return _sanitizeCopy(obj, /* @__PURE__ */ new WeakSet());
-}
-function _sanitizeCopy(current, seen) {
-	seen.add(current);
-	if (Array.isArray(current)) return current.map((item) => item && typeof item === "object" && !seen.has(item) ? _sanitizeCopy(item, seen) : item);
-	const result = {};
-	for (const [key, value] of Object.entries(current)) {
-		if (key === "__proto__" || key === "prototype" || key === "constructor") continue;
-		result[key] = value && typeof value === "object" && !seen.has(value) ? _sanitizeCopy(value, seen) : value;
-	}
-	return result;
-}
-//#endregion
-//#region src/core/utils/index.ts
-const textEncoder = /* @__PURE__ */ new TextEncoder();
-const textDecoder = /* @__PURE__ */ new TextDecoder();
-const _Buffer = /* @__PURE__ */ (() => {
-	try {
-		return globalThis.Buffer;
-	} catch {
-		return;
-	}
-})();
-const _hasBuffer = typeof _Buffer?.from === "function";
-const _hasToBase64 = !_hasBuffer && typeof Uint8Array.prototype.toBase64 === "function";
-const _hasFromBase64 = !_hasBuffer && typeof Uint8Array.fromBase64 === "function";
-const _b64UrlEncOpts = /* @__PURE__ */ Object.freeze({
-	alphabet: "base64url",
-	omitPadding: true
-});
-const _b64UrlDecOpts = /* @__PURE__ */ Object.freeze({ alphabet: "base64url" });
-function _toBuffer(data) {
-	return data instanceof Uint8Array ? _Buffer.from(data.buffer, data.byteOffset, data.byteLength) : _Buffer.from(data);
-}
-function base64Encode(data) {
-	if (_hasBuffer) return _toBuffer(data).toString("base64");
-	const encodedData = data instanceof Uint8Array ? data : textEncoder.encode(data);
-	if (_hasToBase64) return encodedData.toBase64();
-	return btoa(String.fromCodePoint(...encodedData));
-}
-function base64UrlEncode(data) {
-	if (_hasBuffer) return _toBuffer(data).toString("base64url");
-	const encodedData = data instanceof Uint8Array ? data : textEncoder.encode(data);
-	if (_hasToBase64) return encodedData.toBase64(_b64UrlEncOpts);
-	return btoa(String.fromCodePoint(...encodedData)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-}
-function base64Decode(str, toString) {
-	const decodeToString = toString !== false;
-	if (!str) return decodeToString ? "" : new Uint8Array(0);
-	if (_hasBuffer) {
-		const buf = _Buffer.from(str, "base64");
-		return decodeToString ? buf.toString("utf8") : new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
-	}
-	const data = _hasFromBase64 ? Uint8Array.fromBase64(str) : Uint8Array.from(atob(str), (b) => b.codePointAt(0));
-	return decodeToString ? textDecoder.decode(data) : data;
-}
-function base64UrlDecode(str, toString) {
-	const decodeToString = toString !== false;
-	if (!str) return decodeToString ? "" : new Uint8Array(0);
-	if (_hasBuffer) {
-		const buf = _Buffer.from(str, "base64url");
-		return decodeToString ? buf.toString("utf8") : new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
-	}
-	let data;
-	if (_hasFromBase64) data = Uint8Array.fromBase64(str, _b64UrlDecOpts);
-	else {
-		str = str.replace(/-/g, "+").replace(/_/g, "/");
-		while (str.length % 4) str += "=";
-		data = Uint8Array.from(atob(str), (b) => b.codePointAt(0));
-	}
-	return decodeToString ? textDecoder.decode(data) : data;
-}
-function randomBytes(length) {
-	return crypto.getRandomValues(new Uint8Array(length));
-}
-/**
-* Concatenates multiple Uint8Arrays
-* @param arrays Arrays to concatenate
-* @returns Concatenated array
-*/
 function concatUint8Arrays(...arrays) {
 	const totalLength = arrays.reduce((length, arr) => length + arr.length, 0);
 	const result = new Uint8Array(totalLength);
@@ -336,18 +358,12 @@ function isCryptoKey(key) {
 	return key?.[Symbol.toStringTag] === "CryptoKey";
 }
 const isCryptoKeyPair = (key) => key && typeof key === "object" && isCryptoKey(key.publicKey) && isCryptoKey(key.privateKey);
-/** Returns true if the JWK is a symmetric (oct) key. */
 function isSymmetricJWK(key) {
 	return isJWK(key) && key.kty === "oct" && typeof key.k === "string";
 }
-/** Returns true if the JWK is an asymmetric (RSA, EC, OKP) key. */
 function isAsymmetricJWK(key) {
 	return !isSymmetricJWK(key);
 }
-/**
-* Type guard that checks if the provided JWK contains private key material.
-* It relies purely on the presence of private components (e.g. "d"), not on the alg value.
-*/
 function isPrivateJWK(key) {
 	if (!isJWK(key)) return false;
 	if (key.kty === "EC") return typeof key.d === "string";
@@ -355,10 +371,6 @@ function isPrivateJWK(key) {
 	if (key.kty === "RSA") return typeof key.d === "string";
 	return false;
 }
-/**
-* Type guard that checks if the provided JWK is a public (asymmetric) key.
-* This checks for the presence of public components and absence of private material.
-*/
 function isPublicJWK(key) {
 	if (!isJWK(key)) return false;
 	if (key.kty === "EC") {
@@ -375,5 +387,4 @@ function isPublicJWK(key) {
 	}
 	return false;
 }
-//#endregion
-export { validateCriticalHeadersJWS as A, computeMaxTokenAgeSeconds as C, getPlaintextBytes as D, decodePayloadFromBytes as E, JWTError as M, isJWTError as N, isJWTContent as O, computeJwtTimeClaims as S, decodePayloadFromB64UrlSegment as T, textDecoder as _, base64UrlEncode as a, applyTypCtyDefaults as b, isCryptoKey as c, isJWKSet as d, isPrivateJWK as f, randomBytes as g, maybeArray as h, base64UrlDecode as i, validateJwtClaims as j, validateCriticalHeadersJWE as k, isCryptoKeyPair as l, isSymmetricJWK as m, base64Decode as n, concatUint8Arrays as o, isPublicJWK as p, base64Encode as r, isAsymmetricJWK as s, assertCryptoKey as t, isJWK as u, textEncoder as v, decodeMaybeJWTString as w, computeExpiresInSeconds as x, sanitizeObject as y };
+export { validateCriticalHeadersJWS as C, JWTError as D, inferJWSAllowedAlgorithms as E, isJWTError as O, validateCriticalHeadersJWE as S, inferJWEAllowedAlgorithms as T, decodeMaybeJWTString as _, isCryptoKeyPair as a, getPlaintextBytes as b, isPrivateJWK as c, maybeArray as d, applyTypCtyDefaults as f, computeMaxTokenAgeSeconds as g, computeJwtTimeClaims as h, isCryptoKey as i, isPublicJWK as l, computeExpiresInSeconds as m, concatUint8Arrays as n, isJWK as o, computeDurationInSeconds as p, isAsymmetricJWK as r, isJWKSet as s, assertCryptoKey as t, isSymmetricJWK as u, decodePayloadFromB64UrlSegment as v, validateJwtClaims as w, isJWTContent as x, decodePayloadFromBytes as y };

package/dist/adapters/h3v1/index.d.mts

@@ -1,8 +1,7 @@
-import { $ as JWK_HMAC, A as GenerateJWKReturn, B as JWKParameters, C as JWTClaims, D as DeriveKeyOptions, E as ContentEncryptionAlgorithm, F as JWKAlgorithm, G as JWK_AES_KW, H as JWK_AES_CBC_HMAC, I as JWKCacheAdapter, J as JWK_EC, K as JWK_Asymmetric, L as JWKLookupFunction, M as GenerateKeyOptions, N as GenerateKeyReturn, O as DeriveKeyReturn, P as JWK, Q as JWK_EC_Public, R as JWKLookupFunctionHeader, S as JWTClaimValidationOptions, T as CompositeKey, U as JWK_AES_GCM, V as JWKSet, W as JWK_AES_GCM_KW, X as JWK_ECDSA, Y as JWK_ECDH_ES, Z as JWK_EC_Private, _ as JWSSignOptions, _t as KeyManagementAlgorithm, a as ExpiresIn, at as JWK_Pair, b as JOSEPayload, bt as WrapKeyResult, c as JWEDecryptResult, ct as JWK_RSA, d as JWEKeyManagementHeaderParameters, dt as JWK_RSA_Private, et as JWK_OKP, f as JWEProtectedHeader, ft as JWK_RSA_Public, g as JWSProtectedHeader, gt as JWK_oct, h as JWSHeaderParameters, ht as JWK_Symmetric_Algorithm, i as importFromPEM, it as JWK_PBES2, j as GenerateKeyAlgorithm, k as GenerateJWKOptions, l as JWEEncryptOptions, lt as JWK_RSA_ENC, m as JWSAlgorithm, mt as JWK_Symmetric, n as exportToPEM, nt as JWK_OKP_Public, o as MaxTokenAge, ot as JWK_Private, p as StrictOmit, pt as JWK_RSA_SIGN, q as JWK_Asymmetric_Algorithm, r as generateJWK, rt as JWK_OKP_SIGN, s as JWEDecryptOptions, st as JWK_Public, t as deriveJWKFromPassword, tt as JWK_OKP_Private, u as JWEHeaderParameters, ut as JWK_RSA_PSS, v as JWSVerifyOptions, vt as UnwrapKeyOptions, w as JoseHeaderParameters, x as JWT, y as JWSVerifyResult, yt as WrapKeyOptions, z as JWKPEMAlgorithm } from "../../_chunks/jwk.mjs";
+import { $ as DeriveKeyOptions, A as JWSMultiSigner, At as JWK_PBES2, B as JWSVerifyResult, Bt as JWK_Symmetric, C as JWSAsymmetricPrivateJWK, Ct as JWK_EC_Private, D as JWSGeneralSignature, Dt as JWK_OKP_Private, E as JWSGeneralSerialization, Et as JWK_OKP, F as JWSProtectedHeader, Ft as JWK_RSA_ENC, Gt as UnwrappingKeyFor, Ht as JWK_oct, I as JWSSignJWK, It as JWK_RSA_PSS, J as JWTClaimValidationOptions, Jt as WrappingKeyFor, K as JOSEPayload, Kt as WrapKeyOptions, L as JWSSignOptions, Lt as JWK_RSA_Private, M as JWSMultiVerifyOptions, Mt as JWK_Private, N as JWSMultiVerifyOutcome, Nt as JWK_Public, O as JWSHeaderParameters, Ot as JWK_OKP_Public, P as JWSMultiVerifyResult, Pt as JWK_RSA, Q as ContentEncryptionAlgorithm, R as JWSVerifyJWK, Rt as JWK_RSA_Public, S as JWSAlgorithm, St as JWK_ECDSA, T as JWSFlattenedSerialization, Tt as JWK_HMAC, Ut as KeyManagementAlgorithm, V as StrictOmit, Vt as JWK_Symmetric_Algorithm, Wt as UnwrapKeyOptions, X as JoseHeaderParameters, Y as JWTClaims, Z as CompositeKey, _ as JWEMultiDecryptOptions, _t as JWK_AES_KW, a as JWEAsymmetricPrivateJWK, at as GenerateKeyReturn, b as JWEMultiRecipient, bt as JWK_EC, c as JWEDecryptOptions, ct as JWKCacheAdapter, d as JWEEncryptOptions, dt as JWKPEMAlgorithm, et as DeriveKeyReturn, f as JWEFlattenedSerialization, ft as JWKParameters, g as JWEKeyManagementHeaderParameters, gt as JWK_AES_GCM_KW, h as JWEHeaderParameters, ht as JWK_AES_GCM, i as NotBeforeIn, it as GenerateKeyOptions, j as JWSMultiVerifyAllOptions, jt as JWK_Pair, k as JWSMultiSignOptions, kt as JWK_OKP_SIGN, l as JWEDecryptResult, lt as JWKLookupFunction, m as JWEGeneralSerialization, mt as JWK_AES_CBC_HMAC, n as ExpiresIn, nt as GenerateJWKReturn, o as JWEAsymmetricPublicJWK, ot as JWK, p as JWEGeneralRecipient, pt as JWKSet, q as JWT, qt as WrapKeyResult, r as MaxTokenAge, rt as GenerateKeyAlgorithm, s as JWEDecryptJWK, st as JWKAlgorithm, t as Duration, tt as GenerateJWKOptions, u as JWEEncryptJWK, ut as JWKLookupFunctionHeader, v as JWEMultiDecryptResult, vt as JWK_Asymmetric, w as JWSAsymmetricPublicJWK, wt as JWK_EC_Public, x as JWEProtectedHeader, xt as JWK_ECDH_ES, y as JWEMultiEncryptOptions, yt as JWK_Asymmetric_Algorithm, z as JWSVerifyOptions, zt as JWK_RSA_SIGN } from "../../_chunks/index.mjs";
+import { deriveJWKFromPassword, exportPEM, exportToPEM, generateJWK, importFromPEM, importPEM } from "../../core/jwk.mjs";
 import { H3Event } from "h3";
 import { CookieSerializeOptions } from "cookie-es";
-
-//#region src/adapters/h3v1/session/types.d.ts
 interface SessionClaims extends Required<Pick<JWTClaims, "jti" | "iat">>, StrictOmit<JWTClaims, "jti" | "iat"> {}
 type SessionData<T extends Record<string, any> = SessionClaims> = StrictOmit<T, "jti" | "iat" | "exp">;
 type SessionUpdate<T extends Record<string, any> = SessionClaims> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
@@ -22,12 +21,13 @@ interface SessionManager<T extends Record<string, any> = SessionClaims, ConfigMa
     readonly expiresAt: undefined;
   }>;
 }
-//#endregion
-//#region src/adapters/h3v1/session/jwe.d.ts
 declare const kGetSessionPromise$1: unique symbol;
 interface SessionJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  /** Session ID — mirrors the JWT `jti` claim. `undefined` until the session is persisted. */
   id: string | undefined;
+  /** Session creation time in ms — mirrors the JWT `iat` claim (seconds). */
   createdAt: number;
+  /** Session expiry time in ms — mirrors the JWT `exp` claim (seconds). */
   expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
   data: SessionData<T>;
   token: string | undefined;
@@ -80,13 +80,13 @@ interface SessionHooksJWE<T extends Record<string, any> = SessionClaims, MaxAge
     header: JWEHeaderParameters;
     event: TEvent;
     config: SessionConfigJWE<T, MaxAge, TEvent>;
-  }) => JWK_Symmetric | JWK_Private | Promise<JWK_Symmetric | JWK_Private>;
+  }) => JWEDecryptJWK | Promise<JWEDecryptJWK>;
 }
 interface SessionConfigJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent$1 | H3Event = CompatEvent$1 | H3Event> {
   /** Shared key used, string for PBES2 or Json Web Key (JWK) */
-  key: string | JWK_Symmetric | JWK_Private | {
-    privateKey: JWK_Private | JWK_Symmetric;
-    publicKey?: JWK_Public;
+  key: string | JWEEncryptJWK | {
+    privateKey: JWEAsymmetricPrivateJWK;
+    publicKey?: JWEAsymmetricPublicJWK;
   };
   /** Session lifetime in seconds (used to derive exp from iat) */
   maxAge?: MaxAge;
@@ -149,12 +149,13 @@ declare function unsealJWESession<T extends Record<string, any> = SessionClaims,
 * Clear the session (delete from context and drop cookie).
 */
 declare function clearJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent$1 | H3Event = CompatEvent$1 | H3Event>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>): Promise<void>;
-//#endregion
-//#region src/adapters/h3v1/session/jws.d.ts
 declare const kGetSessionPromise: unique symbol;
 interface SessionJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  /** Session ID — mirrors the JWT `jti` claim. `undefined` until the session is persisted. */
   id: string | undefined;
+  /** Session creation time in ms — mirrors the JWT `iat` claim (seconds). */
   createdAt: number;
+  /** Session expiry time in ms — mirrors the JWT `exp` claim (seconds). */
   expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
   data: SessionData<T>;
   token: string | undefined;
@@ -207,15 +208,15 @@ interface SessionHooksJWS<T extends Record<string, any> = SessionClaims, MaxAge
     header: JWKLookupFunctionHeader;
     event: TEvent;
     config: SessionConfigJWS<T, MaxAge, TEvent>;
-  }) => JWKSet | JWK_Symmetric | JWK_Public | Promise<JWKSet | JWK_Symmetric | JWK_Public>;
+  }) => JWKSet | JWSVerifyJWK | Promise<JWKSet | JWSVerifyJWK>;
 }
 interface SessionConfigJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent | H3Event = CompatEvent | H3Event> {
   /**
   * JWK (private for signing with RS/ES/PS, or symmetric oct) used for signing.
   */
-  key: JWK_Symmetric | {
-    privateKey: JWK_Private;
-    publicKey: JWK_Public | JWK_Public[] | JWKSet;
+  key: JWK_oct<JWK_HMAC> | {
+    privateKey: JWSAsymmetricPrivateJWK;
+    publicKey: JWSAsymmetricPublicJWK | JWSAsymmetricPublicJWK[] | JWKSet;
   };
   /** Session lifetime in seconds (sets exp = iat + maxAge) */
   maxAge?: MaxAge;
@@ -278,5 +279,4 @@ declare function verifyJWSSession<T extends Record<string, any> = SessionClaims,
 * Destroy the session (context + cookie).
 */
 declare function clearJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent | H3Event = CompatEvent | H3Event>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>): Promise<void>;
-//#endregion
-export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JOSEPayload, JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSHeaderParameters, JWSProtectedHeader, JWSSignOptions, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JoseHeaderParameters, KeyManagementAlgorithm, MaxTokenAge, type SessionClaims, type SessionConfigJWE, type SessionConfigJWS, type SessionData, type SessionHooksJWE, type SessionHooksJWS, type SessionJWE, type SessionJWS, type SessionManager, type SessionUpdate, UnwrapKeyOptions, WrapKeyOptions, WrapKeyResult, clearJWESession, clearJWSSession, deriveJWKFromPassword, exportToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importFromPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, Duration, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JOSEPayload, JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHeaderParameters, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JoseHeaderParameters, KeyManagementAlgorithm, MaxTokenAge, NotBeforeIn, type SessionClaims, type SessionConfigJWE, type SessionConfigJWS, type SessionData, type SessionHooksJWE, type SessionHooksJWS, type SessionJWE, type SessionJWS, type SessionManager, type SessionUpdate, UnwrapKeyOptions, UnwrappingKeyFor, WrapKeyOptions, WrapKeyResult, WrappingKeyFor, clearJWESession, clearJWSSession, deriveJWKFromPassword, exportPEM, exportToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importFromPEM, importPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };