unjwt 0.7.0 → 0.7.1

package/dist/adapters/h3v2/index.d.mts

@@ -1,4 +1,4 @@
-import { $ as JWKAlgorithm, A as JWSSignOptions, At as JWK_RSA_Public, B as JWTClaimValidationOptions, C as JWSMultiSignOptions, Ct as JWK_Pair, D as JWSMultiVerifyOutcome, Dt as JWK_RSA_ENC, E as JWSMultiVerifyOptions, Et as JWK_RSA, Ft as KeyManagementAlgorithm, G as DeriveKeyOptions, H as JoseHeaderParameters, It as UnwrapKeyOptions, J as GenerateJWKReturn, K as DeriveKeyReturn, Lt as WrapKeyOptions, M as JWSVerifyResult, Mt as JWK_Symmetric, N as StrictOmit, Nt as JWK_Symmetric_Algorithm, O as JWSMultiVerifyResult, Ot as JWK_RSA_PSS, Pt as JWK_oct, Q as JWK, R as JOSEPayload, Rt as WrapKeyResult, S as JWSHeaderParameters, St as JWK_PBES2, T as JWSMultiVerifyAllOptions, Tt as JWK_Public, U as CompositeKey, V as JWTClaims, W as ContentEncryptionAlgorithm, X as GenerateKeyOptions, Y as GenerateKeyAlgorithm, Z as GenerateKeyReturn, _ as JWEProtectedHeader, _t as JWK_HMAC, a as JWEDecryptOptions, at as JWKSet, b as JWSGeneralSerialization, bt as JWK_OKP_Public, c as JWEFlattenedSerialization, ct as JWK_AES_GCM_KW, d as JWEHeaderParameters, dt as JWK_Asymmetric_Algorithm, et as JWKCacheAdapter, f as JWEKeyManagementHeaderParameters, ft as JWK_EC, g as JWEMultiRecipient, gt as JWK_EC_Public, h as JWEMultiEncryptOptions, ht as JWK_EC_Private, i as NotBeforeIn, it as JWKParameters, j as JWSVerifyOptions, jt as JWK_RSA_SIGN, k as JWSProtectedHeader, kt as JWK_RSA_Private, l as JWEGeneralRecipient, lt as JWK_AES_KW, m as JWEMultiDecryptResult, mt as JWK_ECDSA, n as ExpiresIn, nt as JWKLookupFunctionHeader, o as JWEDecryptResult, ot as JWK_AES_CBC_HMAC, p as JWEMultiDecryptOptions, pt as JWK_ECDH_ES, q as GenerateJWKOptions, r as MaxTokenAge, rt as JWKPEMAlgorithm, s as JWEEncryptOptions, st as JWK_AES_GCM, t as Duration, tt as JWKLookupFunction, u as JWEGeneralSerialization, ut as JWK_Asymmetric, v as JWSAlgorithm, vt as JWK_OKP, w as JWSMultiSigner, wt as JWK_Private, x as JWSGeneralSignature, xt as JWK_OKP_SIGN, y as JWSFlattenedSerialization, yt as JWK_OKP_Private, z as JWT } from "../../_chunks/index.mjs";
+import { $ as DeriveKeyOptions, A as JWSMultiSigner, At as JWK_PBES2, B as JWSVerifyResult, Bt as JWK_Symmetric, C as JWSAsymmetricPrivateJWK, Ct as JWK_EC_Private, D as JWSGeneralSignature, Dt as JWK_OKP_Private, E as JWSGeneralSerialization, Et as JWK_OKP, F as JWSProtectedHeader, Ft as JWK_RSA_ENC, Gt as UnwrappingKeyFor, Ht as JWK_oct, I as JWSSignJWK, It as JWK_RSA_PSS, J as JWTClaimValidationOptions, Jt as WrappingKeyFor, K as JOSEPayload, Kt as WrapKeyOptions, L as JWSSignOptions, Lt as JWK_RSA_Private, M as JWSMultiVerifyOptions, Mt as JWK_Private, N as JWSMultiVerifyOutcome, Nt as JWK_Public, O as JWSHeaderParameters, Ot as JWK_OKP_Public, P as JWSMultiVerifyResult, Pt as JWK_RSA, Q as ContentEncryptionAlgorithm, R as JWSVerifyJWK, Rt as JWK_RSA_Public, S as JWSAlgorithm, St as JWK_ECDSA, T as JWSFlattenedSerialization, Tt as JWK_HMAC, Ut as KeyManagementAlgorithm, V as StrictOmit, Vt as JWK_Symmetric_Algorithm, Wt as UnwrapKeyOptions, X as JoseHeaderParameters, Y as JWTClaims, Z as CompositeKey, _ as JWEMultiDecryptOptions, _t as JWK_AES_KW, a as JWEAsymmetricPrivateJWK, at as GenerateKeyReturn, b as JWEMultiRecipient, bt as JWK_EC, c as JWEDecryptOptions, ct as JWKCacheAdapter, d as JWEEncryptOptions, dt as JWKPEMAlgorithm, et as DeriveKeyReturn, f as JWEFlattenedSerialization, ft as JWKParameters, g as JWEKeyManagementHeaderParameters, gt as JWK_AES_GCM_KW, h as JWEHeaderParameters, ht as JWK_AES_GCM, i as NotBeforeIn, it as GenerateKeyOptions, j as JWSMultiVerifyAllOptions, jt as JWK_Pair, k as JWSMultiSignOptions, kt as JWK_OKP_SIGN, l as JWEDecryptResult, lt as JWKLookupFunction, m as JWEGeneralSerialization, mt as JWK_AES_CBC_HMAC, n as ExpiresIn, nt as GenerateJWKReturn, o as JWEAsymmetricPublicJWK, ot as JWK, p as JWEGeneralRecipient, pt as JWKSet, q as JWT, qt as WrapKeyResult, r as MaxTokenAge, rt as GenerateKeyAlgorithm, s as JWEDecryptJWK, st as JWKAlgorithm, t as Duration, tt as GenerateJWKOptions, u as JWEEncryptJWK, ut as JWKLookupFunctionHeader, v as JWEMultiDecryptResult, vt as JWK_Asymmetric, w as JWSAsymmetricPublicJWK, wt as JWK_EC_Public, x as JWEProtectedHeader, xt as JWK_ECDH_ES, y as JWEMultiEncryptOptions, yt as JWK_Asymmetric_Algorithm, z as JWSVerifyOptions, zt as JWK_RSA_SIGN } from "../../_chunks/index.mjs";
 import { deriveJWKFromPassword, exportPEM, exportToPEM, generateJWK, importFromPEM, importPEM } from "../../core/jwk.mjs";
 import { H3Event, HTTPEvent } from "h3";
 import { CookieSerializeOptions } from "cookie-es";
@@ -73,13 +73,13 @@ interface SessionHooksJWE<T extends Record<string, any> = SessionClaims, MaxAge
     header: JWEHeaderParameters;
     event: TEvent;
     config: SessionConfigJWE<T, MaxAge, TEvent>;
-  }) => JWK_Symmetric | JWK_Private | Promise<JWK_Symmetric | JWK_Private>;
+  }) => JWEDecryptJWK | Promise<JWEDecryptJWK>;
 }
 interface SessionConfigJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent | H3Event = HTTPEvent | H3Event> {
   /** Shared secret used, string for PBES2 or Json Web Key (JWK) */
-  key: string | JWK_Symmetric | {
-    privateKey: JWK_Private | JWK_Symmetric;
-    publicKey?: JWK_Public;
+  key: string | JWEEncryptJWK | {
+    privateKey: JWEAsymmetricPrivateJWK;
+    publicKey?: JWEAsymmetricPublicJWK;
   };
   /** Session lifetime in seconds (used to derive exp from iat) */
   maxAge?: MaxAge;
@@ -184,12 +184,12 @@ interface SessionHooksJWS<T extends Record<string, any> = SessionClaims, MaxAge
     header: JWKLookupFunctionHeader;
     event: TEvent;
     config: SessionConfigJWS<T, MaxAge, TEvent>;
-  }) => JWKSet | JWK_Symmetric | JWK_Public | Promise<JWKSet | JWK_Symmetric | JWK_Public>;
+  }) => JWKSet | JWSVerifyJWK | Promise<JWKSet | JWSVerifyJWK>;
 }
 interface SessionConfigJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent> {
-  key: JWK_Symmetric | {
-    privateKey: JWK_Private;
-    publicKey: JWK_Public | JWK_Public[] | JWKSet;
+  key: JWK_oct<JWK_HMAC> | {
+    privateKey: JWSAsymmetricPrivateJWK;
+    publicKey: JWSAsymmetricPublicJWK | JWSAsymmetricPublicJWK[] | JWKSet;
   };
   maxAge?: MaxAge;
   name?: string;
@@ -210,4 +210,4 @@ declare function updateJWSSession<T extends Record<string, any> = SessionClaims,
 declare function signJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>): Promise<string>;
 declare function verifyJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>, token: string): Promise<Partial<SessionJWS<T, MaxAge>>>;
 declare function clearJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>): Promise<void>;
-export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, Duration, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JOSEPayload, JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHeaderParameters, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignOptions, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JoseHeaderParameters, KeyManagementAlgorithm, MaxTokenAge, NotBeforeIn, type SessionClaims, type SessionConfigJWE, type SessionConfigJWS, type SessionData, type SessionHooksJWE, type SessionHooksJWS, type SessionJWE, type SessionJWS, type SessionManager, type SessionUpdate, UnwrapKeyOptions, WrapKeyOptions, WrapKeyResult, clearJWESession, clearJWSSession, deriveJWKFromPassword, exportPEM, exportToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importFromPEM, importPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, Duration, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JOSEPayload, JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHeaderParameters, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JoseHeaderParameters, KeyManagementAlgorithm, MaxTokenAge, NotBeforeIn, type SessionClaims, type SessionConfigJWE, type SessionConfigJWS, type SessionData, type SessionHooksJWE, type SessionHooksJWS, type SessionJWE, type SessionJWS, type SessionManager, type SessionUpdate, UnwrapKeyOptions, UnwrappingKeyFor, WrapKeyOptions, WrapKeyResult, WrappingKeyFor, clearJWESession, clearJWSSession, deriveJWKFromPassword, exportPEM, exportToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importFromPEM, importPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };

package/dist/adapters/h3v2/index.mjs

@@ -2,8 +2,8 @@ import { D as JWTError, O as isJWTError, c as isPrivateJWK, l as isPublicJWK, p
 import { c as exportPEM, g as importPEM, i as deriveJWKFromPassword, l as exportToPEM, m as importFromPEM, u as generateJWK } from "../../_chunks/jwk.mjs";
 import { n as verify, t as sign } from "../../_chunks/jws.mjs";
 import { n as encrypt, t as decrypt } from "../../_chunks/jwe.mjs";
-import { t as NullProtoObj } from "../../_chunks/libs/rou3.mjs";
 import { getChunkedCookie, getEventContext, setChunkedCookie } from "h3";
+import { NullProtoObj } from "rou3";
 const kGetSessionPromise$1 = Symbol("h3_jwe_getSession");
 const DEFAULT_NAME$1 = "h3-jwe";
 const DEFAULT_COOKIE$1 = {
@@ -298,8 +298,8 @@ function getEncryptKey(key) {
 	if (!key) throw new Error("Session: JWE key is required.");
 	let _key;
 	if (typeof key === "string") _key = key;
-	else if (isSymmetricJWK(key) || isPrivateJWK(key)) _key = key;
-	else if ("publicKey" in key && isPublicJWK(key.publicKey)) _key = key.publicKey;
+	else if (isSymmetricJWK(key)) _key = key;
+	else if ("publicKey" in key && key.publicKey && isPublicJWK(key.publicKey)) _key = key.publicKey;
 	else if ("privateKey" in key && isPrivateJWK(key.privateKey)) _key = key.privateKey;
 	if (!_key) throw new Error("Session: Invalid JWE key. It must be a password string or valid JWK.", { cause: key });
 	return _key;

package/dist/core/jwe.d.mts

@@ -1,3 +1,3 @@
-import { F as JWTErrorCauseMap, I as JWTErrorCode, L as isJWTError, P as JWTError, _ as JWEProtectedHeader, a as JWEDecryptOptions, c as JWEFlattenedSerialization, d as JWEHeaderParameters, f as JWEKeyManagementHeaderParameters, g as JWEMultiRecipient, h as JWEMultiEncryptOptions, l as JWEGeneralRecipient, m as JWEMultiDecryptResult, o as JWEDecryptResult, p as JWEMultiDecryptOptions, s as JWEEncryptOptions, u as JWEGeneralSerialization } from "../_chunks/index.mjs";
+import { G as isJWTError, H as JWTError, U as JWTErrorCauseMap, W as JWTErrorCode, _ as JWEMultiDecryptOptions, a as JWEAsymmetricPrivateJWK, b as JWEMultiRecipient, c as JWEDecryptOptions, d as JWEEncryptOptions, f as JWEFlattenedSerialization, g as JWEKeyManagementHeaderParameters, h as JWEHeaderParameters, l as JWEDecryptResult, m as JWEGeneralSerialization, o as JWEAsymmetricPublicJWK, p as JWEGeneralRecipient, s as JWEDecryptJWK, u as JWEEncryptJWK, v as JWEMultiDecryptResult, x as JWEProtectedHeader, y as JWEMultiEncryptOptions } from "../_chunks/index.mjs";
 import { a as generalToFlattened, i as encryptMulti, n as encrypt, r as decryptMulti, t as decrypt } from "../_chunks/jwe.mjs";
-export { JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWTError, JWTErrorCauseMap, JWTErrorCode, decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened, isJWTError };
+export { JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWTError, JWTErrorCauseMap, JWTErrorCode, decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened, isJWTError };

package/dist/core/jwk.d.mts

@@ -1,4 +1,4 @@
-import { $ as JWKAlgorithm, At as JWK_RSA_Public, Ct as JWK_Pair, Dt as JWK_RSA_ENC, Et as JWK_RSA, F as JWTErrorCauseMap, Ft as KeyManagementAlgorithm, G as DeriveKeyOptions, H as JoseHeaderParameters, I as JWTErrorCode, It as UnwrapKeyOptions, J as GenerateJWKReturn, K as DeriveKeyReturn, L as isJWTError, Lt as WrapKeyOptions, Mt as JWK_Symmetric, Nt as JWK_Symmetric_Algorithm, Ot as JWK_RSA_PSS, P as JWTError, Pt as JWK_oct, Q as JWK, Rt as WrapKeyResult, St as JWK_PBES2, Tt as JWK_Public, U as CompositeKey, W as ContentEncryptionAlgorithm, X as GenerateKeyOptions, Y as GenerateKeyAlgorithm, Z as GenerateKeyReturn, _t as JWK_HMAC, at as JWKSet, bt as JWK_OKP_Public, ct as JWK_AES_GCM_KW, dt as JWK_Asymmetric_Algorithm, et as JWKCacheAdapter, ft as JWK_EC, gt as JWK_EC_Public, ht as JWK_EC_Private, it as JWKParameters, jt as JWK_RSA_SIGN, kt as JWK_RSA_Private, lt as JWK_AES_KW, mt as JWK_ECDSA, nt as JWKLookupFunctionHeader, ot as JWK_AES_CBC_HMAC, pt as JWK_ECDH_ES, q as GenerateJWKOptions, rt as JWKPEMAlgorithm, st as JWK_AES_GCM, tt as JWKLookupFunction, ut as JWK_Asymmetric, vt as JWK_OKP, wt as JWK_Private, xt as JWK_OKP_SIGN, yt as JWK_OKP_Private } from "../_chunks/index.mjs";
+import { $ as DeriveKeyOptions, At as JWK_PBES2, Bt as JWK_Symmetric, Ct as JWK_EC_Private, Dt as JWK_OKP_Private, Et as JWK_OKP, Ft as JWK_RSA_ENC, G as isJWTError, Gt as UnwrappingKeyFor, H as JWTError, Ht as JWK_oct, It as JWK_RSA_PSS, Jt as WrappingKeyFor, Kt as WrapKeyOptions, Lt as JWK_RSA_Private, Mt as JWK_Private, Nt as JWK_Public, Ot as JWK_OKP_Public, Pt as JWK_RSA, Q as ContentEncryptionAlgorithm, Rt as JWK_RSA_Public, St as JWK_ECDSA, Tt as JWK_HMAC, U as JWTErrorCauseMap, Ut as KeyManagementAlgorithm, Vt as JWK_Symmetric_Algorithm, W as JWTErrorCode, Wt as UnwrapKeyOptions, X as JoseHeaderParameters, Z as CompositeKey, _t as JWK_AES_KW, at as GenerateKeyReturn, bt as JWK_EC, ct as JWKCacheAdapter, dt as JWKPEMAlgorithm, et as DeriveKeyReturn, ft as JWKParameters, gt as JWK_AES_GCM_KW, ht as JWK_AES_GCM, it as GenerateKeyOptions, jt as JWK_Pair, kt as JWK_OKP_SIGN, lt as JWKLookupFunction, mt as JWK_AES_CBC_HMAC, nt as GenerateJWKReturn, ot as JWK, pt as JWKSet, qt as WrapKeyResult, rt as GenerateKeyAlgorithm, st as JWKAlgorithm, tt as GenerateJWKOptions, ut as JWKLookupFunctionHeader, vt as JWK_Asymmetric, wt as JWK_EC_Public, xt as JWK_ECDH_ES, yt as JWK_Asymmetric_Algorithm, zt as JWK_RSA_SIGN } from "../_chunks/index.mjs";
 /**
 * Generates a cryptographic key for the specified JWA algorithm.
 *
@@ -213,7 +213,7 @@ declare function exportKey<T extends JWK>(key: CryptoKey, jwkParams?: Omit<JWKPa
 * @param options Additional options required by certain algorithms (e.g., p2s, p2c for PBES2).
 * @returns A Promise resolving to an alg-specific {@link WrapKeyResult}.
 */
-declare function wrapKey<TAlg extends KeyManagementAlgorithm>(alg: TAlg, keyToWrap: CryptoKey | Uint8Array<ArrayBuffer>, wrappingKey: CryptoKey | JWK | string | Uint8Array<ArrayBuffer>, options?: WrapKeyOptions): Promise<WrapKeyResult<TAlg>>;
+declare function wrapKey<TAlg extends KeyManagementAlgorithm>(alg: TAlg, keyToWrap: CryptoKey | Uint8Array<ArrayBuffer>, wrappingKey: WrappingKeyFor<TAlg>, options?: WrapKeyOptions): Promise<WrapKeyResult<TAlg>>;
 /**
 * Unwraps a Content Encryption Key (CEK) using the specified algorithm and unwrapping key.
 *
@@ -223,13 +223,13 @@ declare function wrapKey<TAlg extends KeyManagementAlgorithm>(alg: TAlg, keyToWr
 * @param options Additional options required by certain algorithms (e.g., iv, tag, p2s, p2c, epk).
 * @returns A Promise resolving to the unwrapped key (CEK) as a CryptoKey or Uint8Array.
 */
-declare function unwrapKey(alg: KeyManagementAlgorithm, wrappedKey: Uint8Array<ArrayBuffer>, unwrappingKey: CryptoKey | JWK | string | Uint8Array<ArrayBuffer>, options: UnwrapKeyOptions & {
+declare function unwrapKey<TAlg extends KeyManagementAlgorithm>(alg: TAlg, wrappedKey: Uint8Array<ArrayBuffer>, unwrappingKey: UnwrappingKeyFor<TAlg>, options: UnwrapKeyOptions & {
   format: "raw";
 }): Promise<Uint8Array<ArrayBuffer>>;
-declare function unwrapKey(alg: KeyManagementAlgorithm, wrappedKey: Uint8Array<ArrayBuffer>, unwrappingKey: CryptoKey | JWK | string | Uint8Array<ArrayBuffer>, options?: UnwrapKeyOptions & {
+declare function unwrapKey<TAlg extends KeyManagementAlgorithm>(alg: TAlg, wrappedKey: Uint8Array<ArrayBuffer>, unwrappingKey: UnwrappingKeyFor<TAlg>, options?: UnwrapKeyOptions & {
   format?: "cryptokey";
 }): Promise<CryptoKey>;
-declare function unwrapKey(alg: KeyManagementAlgorithm, wrappedKey: Uint8Array<ArrayBuffer>, unwrappingKey: CryptoKey | JWK | string | Uint8Array<ArrayBuffer>, options: UnwrapKeyOptions): Promise<CryptoKey | Uint8Array<ArrayBuffer>>;
+declare function unwrapKey<TAlg extends KeyManagementAlgorithm>(alg: TAlg, wrappedKey: Uint8Array<ArrayBuffer>, unwrappingKey: UnwrappingKeyFor<TAlg>, options: UnwrapKeyOptions): Promise<CryptoKey | Uint8Array<ArrayBuffer>>;
 /**
 * Imports a PEM-encoded key and returns it as a JWK.
 *
@@ -384,4 +384,4 @@ declare function getJWKFromSet(jwkSet: JWKSet, kidOrProtectedHeader: string | (J
 * @returns An array of matching JWKs.
 */
 declare function getJWKsFromSet(jwkSet: JWKSet, filter?: (jwk: JWK) => boolean): JWK[];
-export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWTError, type JWTErrorCauseMap, type JWTErrorCode, KeyManagementAlgorithm, UnwrapKeyOptions, WeakMapJWKCache, WrapKeyOptions, WrapKeyResult, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportKey, exportPEM, exportToPEM, generateJWK, generateKey, getJWKFromSet, getJWKsFromSet, importFromPEM, importKey, importPEM, isJWTError, unwrapKey, wrapKey };
+export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWTError, type JWTErrorCauseMap, type JWTErrorCode, KeyManagementAlgorithm, UnwrapKeyOptions, UnwrappingKeyFor, WeakMapJWKCache, WrapKeyOptions, WrapKeyResult, WrappingKeyFor, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportKey, exportPEM, exportToPEM, generateJWK, generateKey, getJWKFromSet, getJWKsFromSet, importFromPEM, importKey, importPEM, isJWTError, unwrapKey, wrapKey };

package/dist/core/jws.d.mts

@@ -1,3 +1,3 @@
-import { A as JWSSignOptions, C as JWSMultiSignOptions, D as JWSMultiVerifyOutcome, E as JWSMultiVerifyOptions, F as JWTErrorCauseMap, I as JWTErrorCode, L as isJWTError, M as JWSVerifyResult, O as JWSMultiVerifyResult, P as JWTError, S as JWSHeaderParameters, T as JWSMultiVerifyAllOptions, b as JWSGeneralSerialization, j as JWSVerifyOptions, k as JWSProtectedHeader, v as JWSAlgorithm, w as JWSMultiSigner, x as JWSGeneralSignature, y as JWSFlattenedSerialization } from "../_chunks/index.mjs";
+import { A as JWSMultiSigner, B as JWSVerifyResult, C as JWSAsymmetricPrivateJWK, D as JWSGeneralSignature, E as JWSGeneralSerialization, F as JWSProtectedHeader, G as isJWTError, H as JWTError, I as JWSSignJWK, L as JWSSignOptions, M as JWSMultiVerifyOptions, N as JWSMultiVerifyOutcome, O as JWSHeaderParameters, P as JWSMultiVerifyResult, R as JWSVerifyJWK, S as JWSAlgorithm, T as JWSFlattenedSerialization, U as JWTErrorCauseMap, W as JWTErrorCode, j as JWSMultiVerifyAllOptions, k as JWSMultiSignOptions, w as JWSAsymmetricPublicJWK, z as JWSVerifyOptions } from "../_chunks/index.mjs";
 import { a as verifyMulti, i as signMulti, n as verify, o as verifyMultiAll, r as generalToFlattenedJWS, t as sign } from "../_chunks/jws.mjs";
-export { JWSAlgorithm, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHeaderParameters, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignOptions, JWSVerifyOptions, JWSVerifyResult, JWTError, JWTErrorCauseMap, JWTErrorCode, generalToFlattenedJWS, isJWTError, sign, signMulti, verify, verifyMulti, verifyMultiAll };
+export { JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHeaderParameters, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWTError, JWTErrorCauseMap, JWTErrorCode, generalToFlattenedJWS, isJWTError, sign, signMulti, verify, verifyMulti, verifyMultiAll };

package/dist/core/utils/index.d.mts

@@ -1,4 +1,4 @@
-import { B as JWTClaimValidationOptions, Ft as KeyManagementAlgorithm, N as StrictOmit, Pt as JWK_oct, Q as JWK, Tt as JWK_Public, V as JWTClaims, at as JWKSet, n as ExpiresIn, t as Duration, v as JWSAlgorithm, wt as JWK_Private } from "../../_chunks/index.mjs";
+import { Ct as JWK_EC_Private, Dt as JWK_OKP_Private, Ht as JWK_oct, J as JWTClaimValidationOptions, Lt as JWK_RSA_Private, Mt as JWK_Private, Nt as JWK_Public, Ot as JWK_OKP_Public, Rt as JWK_RSA_Public, S as JWSAlgorithm, Ut as KeyManagementAlgorithm, V as StrictOmit, Y as JWTClaims, n as ExpiresIn, ot as JWK, pt as JWKSet, t as Duration, wt as JWK_EC_Public } from "../../_chunks/index.mjs";
 import { a as textDecoder, c as sanitizeObject, i as base64UrlEncode, l as sanitizeObjectCopy, n as base64Encode, o as textEncoder, r as base64UrlDecode, s as safeJsonParse, t as base64Decode, u as secureRandomBytes } from "../../_chunks/libs/unsecure.mjs";
 /**
 * Infer the set of JWS signing algorithms a key unambiguously supports.
@@ -106,18 +106,37 @@ declare function assertCryptoKey(key: unknown): asserts key is CryptoKey;
 declare function isCryptoKey(key: unknown): key is CryptoKey;
 /** Type guard for `CryptoKeyPair` — both `publicKey` and `privateKey` must be CryptoKeys. */
 declare const isCryptoKeyPair: (key: any) => key is CryptoKeyPair;
-/** Returns true if the JWK is a symmetric (oct) key. */
-declare function isSymmetricJWK(key: unknown): key is Extract<JWK, JWK_oct>;
-/** Returns true if the JWK is an asymmetric (RSA, EC, OKP) key. */
+/**
+* Returns true if the JWK is a symmetric (oct) key.
+*
+* The `T` inference preserves the caller's narrowed alg type — passing a
+* `JWK_oct<"HS256">` refines to `JWK_oct<"HS256">`, not `JWK_oct<string>`.
+*/
+declare function isSymmetricJWK<T>(key: T): key is Extract<T, JWK_oct>;
+declare function isSymmetricJWK(key: unknown): key is JWK_oct;
+/**
+* Returns true if the JWK is an asymmetric (RSA, EC, OKP) key.
+*
+* The `T` inference preserves the caller's narrowed alg type — passing a
+* `JWK_EC<"ES256">` refines to `JWK_EC<"ES256">`, not `JWK_EC<string>`,
+* and so on for RSA and OKP.
+*/
+declare function isAsymmetricJWK<T>(key: T): key is Exclude<T, JWK_oct>;
 declare function isAsymmetricJWK(key: unknown): key is Exclude<JWK, JWK_oct>;
 /**
 * Type guard that checks if the provided JWK contains private key material.
 * It relies purely on the presence of private components (e.g. "d"), not on the alg value.
+*
+* Preserves narrow alg types from the caller.
 */
+declare function isPrivateJWK<T>(key: T): key is Extract<T, JWK_EC_Private | JWK_OKP_Private | JWK_RSA_Private>;
 declare function isPrivateJWK(key: unknown): key is JWK_Private;
 /**
 * Type guard that checks if the provided JWK is a public (asymmetric) key.
 * This checks for the presence of public components and absence of private material.
+*
+* Preserves narrow alg types from the caller.
 */
+declare function isPublicJWK<T>(key: T): key is Exclude<Extract<T, JWK_EC_Public | JWK_OKP_Public | JWK_RSA_Public>, JWK_Private>;
 declare function isPublicJWK(key: unknown): key is JWK_Public;
 export { ComputeJwtTimeClaimsOptions, StrictOmit, applyTypCtyDefaults, assertCryptoKey, base64Decode, base64Encode, base64UrlDecode, base64UrlEncode, computeDurationInSeconds, computeExpiresInSeconds, computeJwtTimeClaims, computeMaxTokenAgeSeconds, concatUint8Arrays, decodeMaybeJWTString, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims };

package/dist/index.d.mts

@@ -1,6 +1,6 @@
-import { $ as JWKAlgorithm, A as JWSSignOptions, At as JWK_RSA_Public, B as JWTClaimValidationOptions, C as JWSMultiSignOptions, Ct as JWK_Pair, D as JWSMultiVerifyOutcome, Dt as JWK_RSA_ENC, E as JWSMultiVerifyOptions, Et as JWK_RSA, F as JWTErrorCauseMap, Ft as KeyManagementAlgorithm, G as DeriveKeyOptions, H as JoseHeaderParameters, I as JWTErrorCode, It as UnwrapKeyOptions, J as GenerateJWKReturn, K as DeriveKeyReturn, L as isJWTError, Lt as WrapKeyOptions, M as JWSVerifyResult, Mt as JWK_Symmetric, Nt as JWK_Symmetric_Algorithm, O as JWSMultiVerifyResult, Ot as JWK_RSA_PSS, P as JWTError, Pt as JWK_oct, Q as JWK, R as JOSEPayload, Rt as WrapKeyResult, S as JWSHeaderParameters, St as JWK_PBES2, T as JWSMultiVerifyAllOptions, Tt as JWK_Public, U as CompositeKey, V as JWTClaims, W as ContentEncryptionAlgorithm, X as GenerateKeyOptions, Y as GenerateKeyAlgorithm, Z as GenerateKeyReturn, _ as JWEProtectedHeader, _t as JWK_HMAC, a as JWEDecryptOptions, at as JWKSet, b as JWSGeneralSerialization, bt as JWK_OKP_Public, c as JWEFlattenedSerialization, ct as JWK_AES_GCM_KW, d as JWEHeaderParameters, dt as JWK_Asymmetric_Algorithm, et as JWKCacheAdapter, f as JWEKeyManagementHeaderParameters, ft as JWK_EC, g as JWEMultiRecipient, gt as JWK_EC_Public, h as JWEMultiEncryptOptions, ht as JWK_EC_Private, i as NotBeforeIn, it as JWKParameters, j as JWSVerifyOptions, jt as JWK_RSA_SIGN, k as JWSProtectedHeader, kt as JWK_RSA_Private, l as JWEGeneralRecipient, lt as JWK_AES_KW, m as JWEMultiDecryptResult, mt as JWK_ECDSA, n as ExpiresIn, nt as JWKLookupFunctionHeader, o as JWEDecryptResult, ot as JWK_AES_CBC_HMAC, p as JWEMultiDecryptOptions, pt as JWK_ECDH_ES, q as GenerateJWKOptions, r as MaxTokenAge, rt as JWKPEMAlgorithm, s as JWEEncryptOptions, st as JWK_AES_GCM, t as Duration, tt as JWKLookupFunction, u as JWEGeneralSerialization, ut as JWK_Asymmetric, v as JWSAlgorithm, vt as JWK_OKP, w as JWSMultiSigner, wt as JWK_Private, x as JWSGeneralSignature, xt as JWK_OKP_SIGN, y as JWSFlattenedSerialization, yt as JWK_OKP_Private, z as JWT } from "./_chunks/index.mjs";
+import { $ as DeriveKeyOptions, A as JWSMultiSigner, At as JWK_PBES2, B as JWSVerifyResult, Bt as JWK_Symmetric, C as JWSAsymmetricPrivateJWK, Ct as JWK_EC_Private, D as JWSGeneralSignature, Dt as JWK_OKP_Private, E as JWSGeneralSerialization, Et as JWK_OKP, F as JWSProtectedHeader, Ft as JWK_RSA_ENC, G as isJWTError, Gt as UnwrappingKeyFor, H as JWTError, Ht as JWK_oct, I as JWSSignJWK, It as JWK_RSA_PSS, J as JWTClaimValidationOptions, Jt as WrappingKeyFor, K as JOSEPayload, Kt as WrapKeyOptions, L as JWSSignOptions, Lt as JWK_RSA_Private, M as JWSMultiVerifyOptions, Mt as JWK_Private, N as JWSMultiVerifyOutcome, Nt as JWK_Public, O as JWSHeaderParameters, Ot as JWK_OKP_Public, P as JWSMultiVerifyResult, Pt as JWK_RSA, Q as ContentEncryptionAlgorithm, R as JWSVerifyJWK, Rt as JWK_RSA_Public, S as JWSAlgorithm, St as JWK_ECDSA, T as JWSFlattenedSerialization, Tt as JWK_HMAC, U as JWTErrorCauseMap, Ut as KeyManagementAlgorithm, Vt as JWK_Symmetric_Algorithm, W as JWTErrorCode, Wt as UnwrapKeyOptions, X as JoseHeaderParameters, Y as JWTClaims, Z as CompositeKey, _ as JWEMultiDecryptOptions, _t as JWK_AES_KW, a as JWEAsymmetricPrivateJWK, at as GenerateKeyReturn, b as JWEMultiRecipient, bt as JWK_EC, c as JWEDecryptOptions, ct as JWKCacheAdapter, d as JWEEncryptOptions, dt as JWKPEMAlgorithm, et as DeriveKeyReturn, f as JWEFlattenedSerialization, ft as JWKParameters, g as JWEKeyManagementHeaderParameters, gt as JWK_AES_GCM_KW, h as JWEHeaderParameters, ht as JWK_AES_GCM, i as NotBeforeIn, it as GenerateKeyOptions, j as JWSMultiVerifyAllOptions, jt as JWK_Pair, k as JWSMultiSignOptions, kt as JWK_OKP_SIGN, l as JWEDecryptResult, lt as JWKLookupFunction, m as JWEGeneralSerialization, mt as JWK_AES_CBC_HMAC, n as ExpiresIn, nt as GenerateJWKReturn, o as JWEAsymmetricPublicJWK, ot as JWK, p as JWEGeneralRecipient, pt as JWKSet, q as JWT, qt as WrapKeyResult, r as MaxTokenAge, rt as GenerateKeyAlgorithm, s as JWEDecryptJWK, st as JWKAlgorithm, t as Duration, tt as GenerateJWKOptions, u as JWEEncryptJWK, ut as JWKLookupFunctionHeader, v as JWEMultiDecryptResult, vt as JWK_Asymmetric, w as JWSAsymmetricPublicJWK, wt as JWK_EC_Public, x as JWEProtectedHeader, xt as JWK_ECDH_ES, y as JWEMultiEncryptOptions, yt as JWK_Asymmetric_Algorithm, z as JWSVerifyOptions, zt as JWK_RSA_SIGN } from "./_chunks/index.mjs";
 import { WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportKey, exportPEM, exportToPEM, generateJWK, generateKey, getJWKFromSet, getJWKsFromSet, importFromPEM, importKey, importPEM, unwrapKey, wrapKey } from "./core/jwk.mjs";
 import { a as generalToFlattened, i as encryptMulti, n as encrypt, r as decryptMulti, t as decrypt } from "./_chunks/jwe.mjs";
 import { a as verifyMulti, i as signMulti, n as verify, o as verifyMultiAll, r as generalToFlattenedJWS, t as sign } from "./_chunks/jws.mjs";
 import { assertCryptoKey, computeDurationInSeconds, computeExpiresInSeconds, computeMaxTokenAgeSeconds, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isPrivateJWK, isPublicJWK, isSymmetricJWK, validateJwtClaims } from "./core/utils/index.mjs";
-export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, Duration, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JOSEPayload, JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHeaderParameters, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignOptions, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JWTError, type JWTErrorCauseMap, type JWTErrorCode, JoseHeaderParameters, KeyManagementAlgorithm, MaxTokenAge, NotBeforeIn, UnwrapKeyOptions, WeakMapJWKCache, WrapKeyOptions, WrapKeyResult, assertCryptoKey, clearJWKCache, computeDurationInSeconds, computeExpiresInSeconds, computeMaxTokenAgeSeconds, configureJWKCache, decrypt, decryptMulti, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, encrypt, encryptMulti, exportKey, exportPEM, exportToPEM, generalToFlattened, generalToFlattenedJWS, generateJWK, generateKey, getJWKFromSet, getJWKsFromSet, importFromPEM, importKey, importPEM, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, sign, signMulti, unwrapKey, validateJwtClaims, verify, verifyMulti, verifyMultiAll, wrapKey };
+export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, Duration, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JOSEPayload, JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHeaderParameters, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JWTError, type JWTErrorCauseMap, type JWTErrorCode, JoseHeaderParameters, KeyManagementAlgorithm, MaxTokenAge, NotBeforeIn, UnwrapKeyOptions, UnwrappingKeyFor, WeakMapJWKCache, WrapKeyOptions, WrapKeyResult, WrappingKeyFor, assertCryptoKey, clearJWKCache, computeDurationInSeconds, computeExpiresInSeconds, computeMaxTokenAgeSeconds, configureJWKCache, decrypt, decryptMulti, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, encrypt, encryptMulti, exportKey, exportPEM, exportToPEM, generalToFlattened, generalToFlattenedJWS, generateJWK, generateKey, getJWKFromSet, getJWKsFromSet, importFromPEM, importKey, importPEM, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, sign, signMulti, unwrapKey, validateJwtClaims, verify, verifyMulti, verifyMultiAll, wrapKey };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.7.0",
+  "version": "0.7.1",
   "description": "Low-level JWT utilities",
   "license": "MIT",
   "author": {
@@ -56,8 +56,8 @@
   "devDependencies": {
     "@types/node": "^24",
     "@types/supertest": "^7.2.0",
-    "@typescript/native-preview": "7.0.0-dev.20260419.1",
-    "@vitest/coverage-v8": "^4.1.4",
+    "@typescript/native-preview": "7.0.0-dev.20260421.2",
+    "@vitest/coverage-v8": "^4.1.5",
     "automd": "^0.4.3",
     "changelogen": "^0.6.2",
     "cookie-esv1": "npm:cookie-es@^1.2.3",
@@ -67,19 +67,19 @@
     "jose": "^6.2.2",
     "nano-staged": "^1.0.2",
     "obuild": "^0.4.33",
-    "oxfmt": "^0.45.0",
-    "oxlint": "^1.60.0",
-    "rolldown": "1.0.0-rc.16",
-    "rou3": "^0.8.1",
+    "oxfmt": "^0.46.0",
+    "oxlint": "^1.61.0",
+    "rolldown": "1.0.0-rc.17",
     "simple-git-hooks": "^2.13.1",
     "supertest": "^7.2.2",
     "typescript": "^6.0.3",
-    "unsecure": "^0.2.1",
-    "vitest": "^4.1.4"
+    "unsecure": "^0.2.2",
+    "vitest": "^4.1.5"
   },
   "peerDependencies": {
     "cookie-es": "^1.2.3 || ^3.1.1",
-    "h3": "^1.15.4 || >=2.0.1-rc.20 || ^2.0.1"
+    "h3": "^1.15.4 || >=2.0.1-rc.20 || ^2.0.1",
+    "rou3": "^0.8.1"
   },
   "peerDependenciesMeta": {
     "cookie-es": {
@@ -87,6 +87,9 @@
     },
     "h3": {
       "optional": true
+    },
+    "rou3": {
+      "optional": true
     }
   },
   "resolutions": {

package/dist/THIRD-PARTY-LICENSES.md

@@ -1,63 +0,0 @@
-# Licenses of Bundled Dependencies
-
-The published artifact additionally contains code with the following licenses:
-MIT
-
-# Bundled Dependencies
-
-## rou3
-
-License: MIT
-Repository: https://github.com/h3js/rou3
-
-> MIT License
-> 
-> Copyright (c) Pooya Parsa <pooya@pi0.io>
-> 
-> Permission is hereby granted, free of charge, to any person obtaining a copy
-> of this software and associated documentation files (the "Software"), to deal
-> in the Software without restriction, including without limitation the rights
-> to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-> copies of the Software, and to permit persons to whom the Software is
-> furnished to do so, subject to the following conditions:
-> 
-> The above copyright notice and this permission notice shall be included in all
-> copies or substantial portions of the Software.
-> 
-> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-> IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-> FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-> AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-> LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-> OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-> SOFTWARE.
-
----------------------------------------
-
-## unsecure
-
-License: MIT
-By: Sandro Circi
-Repository: https://github.com/sandros94/unsecure
-
-> MIT License
-> 
-> Copyright (c) 2025 Sandro Circi
-> 
-> Permission is hereby granted, free of charge, to any person obtaining a copy
-> of this software and associated documentation files (the "Software"), to deal
-> in the Software without restriction, including without limitation the rights
-> to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-> copies of the Software, and to permit persons to whom the Software is
-> furnished to do so, subject to the following conditions:
-> 
-> The above copyright notice and this permission notice shall be included in all
-> copies or substantial portions of the Software.
-> 
-> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-> IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-> FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-> AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-> LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-> OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-> SOFTWARE.

package/dist/_chunks/libs/rou3.mjs

@@ -1,5 +0,0 @@
-const NullProtoObj = /* @__PURE__ */ (() => {
-	const e = function() {};
-	return e.prototype = Object.create(null), Object.freeze(e.prototype), e;
-})();
-export { NullProtoObj as t };