unjwt 0.7.2 → 0.7.3

package/dist/_chunks/index.d.mts

@@ -241,35 +241,35 @@ interface UnwrapKeyOptions {
 */
 interface JWKParameters<Alg extends string = string> {
   /** JWK "kty" (Key Type) Parameter */
-  kty: string;
+  "kty": string;
   /**
   * JWK "alg" (Algorithm) Parameter
   *
   * @see {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}
   */
-  alg?: Alg;
+  "alg"?: Alg;
   /** JWK "key_ops" (Key Operations) Parameter */
-  key_ops?: KeyUsage[];
+  "key_ops"?: KeyUsage[];
   /** JWK "ext" (Extractable) Parameter */
-  ext?: boolean;
+  "ext"?: boolean;
   /** JWK "use" (Public Key Use) Parameter */
-  use?: string;
+  "use"?: string;
   /** JWK "x5c" (X.509 Certificate Chain) Parameter */
-  x5c?: string[];
+  "x5c"?: string[];
   /** JWK "x5t" (X.509 Certificate SHA-1 Thumbprint) Parameter */
-  x5t?: string;
+  "x5t"?: string;
   /** JWK "x5t#S256" (X.509 Certificate SHA-256 Thumbprint) Parameter */
   "x5t#S256"?: string;
   /** JWK "x5u" (X.509 URL) Parameter */
-  x5u?: string;
+  "x5u"?: string;
   /** JWK "kid" (Key ID) Parameter */
-  kid?: string;
+  "kid"?: string;
   /**
   * Non-standard JWK content encryption algorithm hint.
   * When `alg` is `"dir"`, the library reads this field to infer the
   * content encryption algorithm (`enc`) when it is not provided in options.
   */
-  enc?: ContentEncryptionAlgorithm;
+  "enc"?: ContentEncryptionAlgorithm;
 }
 /** Public EC JSON Web Keys */
 interface JWK_EC_Public<Alg extends JWK_ECDSA | JWK_ECDH_ES | (string & {}) = string> extends JWKParameters<Alg> {
@@ -334,6 +334,8 @@ interface JWK_OKP_Private<Alg extends JWK_OKP_SIGN | JWK_ECDH_ES | (string & {})
 type JWK_OKP<Alg extends JWK_OKP_SIGN | JWK_ECDH_ES | (string & {}) = string> = JWK_OKP_Public<Alg> | JWK_OKP_Private<Alg>;
 /** oct JSON Web Keys */
 interface JWK_oct<Alg extends JWK_HMAC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_AES_CBC_HMAC | JWK_PBES2 | "dir" | (string & {}) = string> extends JWKParameters<Alg> {
+  /** Oct JWK "kty" (Key Type) Parameter */
+  kty: "oct";
   /** Oct JWK "k" (Key Value) Parameter */
   k: string;
 }

package/dist/_chunks/jwk.mjs

@@ -110,20 +110,20 @@ function checkUsage$4(key, usage) {
 	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
 }
 const IV_BIT_LENGTHS = {
-	A128GCM: 96,
-	A128GCMKW: 96,
-	A192GCM: 96,
-	A192GCMKW: 96,
-	A256GCM: 96,
-	A256GCMKW: 96,
+	"A128GCM": 96,
+	"A128GCMKW": 96,
+	"A192GCM": 96,
+	"A192GCMKW": 96,
+	"A256GCM": 96,
+	"A256GCMKW": 96,
 	"A128CBC-HS256": 128,
 	"A192CBC-HS384": 128,
 	"A256CBC-HS512": 128
 };
 const CEK_BIT_LENGTHS = {
-	A128GCM: 128,
-	A192GCM: 192,
-	A256GCM: 256,
+	"A128GCM": 128,
+	"A192GCM": 192,
+	"A256GCM": 256,
 	"A128CBC-HS256": 256,
 	"A192CBC-HS384": 384,
 	"A256CBC-HS512": 512
@@ -202,7 +202,7 @@ async function aesKwUnwrap(alg, key, encryptedKey) {
 	return new Uint8Array(await crypto.subtle.exportKey("raw", cryptoKeyCek));
 }
 async function gcmkwEncrypt(alg, key, plaintext, iv) {
-	const wrapped = await encrypt(alg.slice(0, 7), plaintext, key, iv, new Uint8Array(0));
+	const wrapped = await encrypt(alg.slice(0, 7), plaintext, key, iv, /* @__PURE__ */ new Uint8Array(0));
 	return {
 		encryptedKey: wrapped.ciphertext,
 		iv: base64UrlEncode(wrapped.iv),
@@ -210,7 +210,7 @@ async function gcmkwEncrypt(alg, key, plaintext, iv) {
 	};
 }
 async function gcmkwDecrypt(alg, key, ciphertext, iv, tag) {
-	return decrypt(alg.slice(0, 7), key, ciphertext, iv, tag, new Uint8Array(0));
+	return decrypt(alg.slice(0, 7), key, ciphertext, iv, tag, /* @__PURE__ */ new Uint8Array(0));
 }
 async function encrypt(enc, plaintext, cek, iv, aad) {
 	if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) throw new TypeError("Key must be one of type: CryptoKey or Uint8Array");
@@ -389,7 +389,7 @@ function writeUInt32BE$1(buf, value, offset) {
 function uint64be(value) {
 	const high = Math.floor(value / 2 ** 32);
 	const low = value % 2 ** 32;
-	const buf = new Uint8Array(8);
+	const buf = /* @__PURE__ */ new Uint8Array(8);
 	writeUInt32BE$1(buf, high, 0);
 	writeUInt32BE$1(buf, low, 4);
 	return buf;
@@ -539,7 +539,7 @@ function getHashLength(hash) {
 function checkUsage$2(key, usage) {
 	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
 }
-async function deriveECDHESKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) {
+async function deriveECDHESKey(publicKey, privateKey, algorithm, keyLength, apu = /* @__PURE__ */ new Uint8Array(0), apv = /* @__PURE__ */ new Uint8Array(0)) {
 	checkECDHCryptoKey(publicKey, "ECDH");
 	checkECDHCryptoKey(privateKey, "ECDH", "deriveBits");
 	const value = concatUint8Arrays(lengthAndInput(textEncoder.encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength));
@@ -599,7 +599,7 @@ function writeUInt32BE(buf, value, offset) {
 	], offset);
 }
 function uint32be(value) {
-	const buf = new Uint8Array(4);
+	const buf = /* @__PURE__ */ new Uint8Array(4);
 	writeUInt32BE(buf, value, 0);
 	return buf;
 }
@@ -652,7 +652,7 @@ async function getPBKDF2CryptoKey(key, alg, options = {}) {
 	checkPBES2CryptoKey(key, alg, usage);
 	return key;
 }
-const PUBLIC_EPK_FIELDS = new Set([
+const PUBLIC_EPK_FIELDS = /* @__PURE__ */ new Set([
 	"kty",
 	"crv",
 	"x",
@@ -823,7 +823,7 @@ const assertPEMLabel = (pem, descriptor) => {
 	}
 };
 const genericExport = async (keyType, keyFormat, key) => {
-	if (!isCryptoKey(key)) throw new TypeError(`Key must be ${key} of type CryptoKey`);
+	if (!isCryptoKey(key)) throw new TypeError(`Key must be of type CryptoKey, got ${typeof key}`);
 	if (!key.extractable) throw new TypeError("CryptoKey is not extractable");
 	if (key.type !== keyType) throw new TypeError(`key is not a ${keyType} key`);
 	return formatPEM(base64Encode(new Uint8Array(await crypto.subtle.exportKey(keyFormat, key))), `${keyType.toUpperCase()} KEY`);
@@ -1017,7 +1017,8 @@ const getSPKI = (x509) => {
 			type: "spki"
 		});
 	} catch {}
-	return formatPEM(spkiFromX509(base64Decode(x509.replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g, ""), { returnAs: "uint8array" })), "PUBLIC KEY");
+	const raw = base64Decode(x509.replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g, ""), { returnAs: "uint8array" });
+	return formatPEM(spkiFromX509(raw), "PUBLIC KEY");
 };
 async function generateKey(alg, options = {}) {
 	const exportToJWK = options.toJWK !== void 0 && options.toJWK !== false;
@@ -1201,7 +1202,7 @@ async function wrapKey(alg, keyToWrap, wrappingKey, options = {}) {
 	const cekBytes = keyToWrap instanceof Uint8Array ? keyToWrap : new Uint8Array(await crypto.subtle.exportKey("raw", keyToWrap));
 	const importedWrappingKey = await resolveWrappingKey(alg, wrappingKey, "public");
 	switch (alg) {
-		case "dir": return { encryptedKey: new Uint8Array(0) };
+		case "dir": return { encryptedKey: /* @__PURE__ */ new Uint8Array(0) };
 		case "A128KW":
 		case "A192KW":
 		case "A256KW": return { encryptedKey: await aesKwWrap(alg, importedWrappingKey, cekBytes) };
@@ -1232,8 +1233,8 @@ async function wrapKey(alg, keyToWrap, wrappingKey, options = {}) {
 		case "ECDH-ES+A256KW": {
 			if (!(importedWrappingKey instanceof CryptoKey)) throw new TypeError("ECDH-ES requires the wrapping key to be a CryptoKey (recipient's public key)");
 			if (!isECDHKeyAllowed(importedWrappingKey)) throw new JWTError("ECDH with the provided key is not allowed or not supported", "ERR_JWK_INVALID");
-			const apu = options.ecdh?.partyUInfo ?? new Uint8Array(0);
-			const apv = options.ecdh?.partyVInfo ?? new Uint8Array(0);
+			const apu = options.ecdh?.partyUInfo ?? /* @__PURE__ */ new Uint8Array(0);
+			const apv = options.ecdh?.partyVInfo ?? /* @__PURE__ */ new Uint8Array(0);
 			const { ephemeralPrivateKey, epkJwk } = await resolveECDHEphemeralPair(importedWrappingKey, options.ecdh?.ephemeralKey);
 			const infoAlg = alg === "ECDH-ES" ? (() => {
 				if (!options.ecdh?.enc) throw new JWTError("ECDH-ES direct key agreement requires options.ecdh.enc (the target content encryption algorithm)", "ERR_JWK_INVALID");
@@ -1241,7 +1242,7 @@ async function wrapKey(alg, keyToWrap, wrappingKey, options = {}) {
 			})() : alg;
 			const sharedSecret = await deriveECDHESKey(importedWrappingKey, ephemeralPrivateKey, infoAlg, alg === "ECDH-ES" ? bitLengthCEK(infoAlg) : Number.parseInt(alg.slice(-5, -2), 10), apu, apv);
 			const wrapResult = {
-				encryptedKey: new Uint8Array(0),
+				encryptedKey: /* @__PURE__ */ new Uint8Array(0),
 				epk: epkJwk
 			};
 			if (apu.length > 0) wrapResult.apu = base64UrlEncode(apu);
@@ -1306,8 +1307,8 @@ async function unwrapKey(alg, wrappedKey, unwrappingKey, options = {}) {
 			if (!isECDHKeyAllowed(importedUnwrappingKey)) throw new JWTError("ECDH with the provided key is not allowed or not supported", "ERR_JWK_INVALID");
 			const epkCandidate = options.epk instanceof CryptoKey ? options.epk : await normalizeKey(options.epk, alg);
 			if (!(epkCandidate instanceof CryptoKey)) throw new JWTError("Failed to normalize ECDH ephemeral public key", "ERR_JWK_INVALID");
-			const apuBytes = typeof options.apu === "string" ? base64UrlDecode(options.apu, { returnAs: "uint8array" }) : options.apu ?? new Uint8Array(0);
-			const apvBytes = typeof options.apv === "string" ? base64UrlDecode(options.apv, { returnAs: "uint8array" }) : options.apv ?? new Uint8Array(0);
+			const apuBytes = typeof options.apu === "string" ? base64UrlDecode(options.apu, { returnAs: "uint8array" }) : options.apu ?? /* @__PURE__ */ new Uint8Array(0);
+			const apvBytes = typeof options.apv === "string" ? base64UrlDecode(options.apv, { returnAs: "uint8array" }) : options.apv ?? /* @__PURE__ */ new Uint8Array(0);
 			const infoAlg = alg === "ECDH-ES" ? options.enc : alg;
 			if (!infoAlg) throw new JWTError("ECDH-ES requires content encryption algorithm ('enc') to derive the shared secret", "ERR_JWE_INVALID");
 			const sharedSecret = await deriveECDHESKey(epkCandidate, importedUnwrappingKey, infoAlg, alg === "ECDH-ES" ? bitLengthCEK(infoAlg) : Number.parseInt(alg.slice(-5, -2), 10), apuBytes, apvBytes);
@@ -1339,7 +1340,7 @@ async function importPEM(pem, alg, options) {
 		case "x509":
 			cryptoKey = await fromX509(pem, alg, { extractable });
 			break;
-		default: throw new JWTError(`Unsupported PEM type: ${pemType}`, "ERR_JWK_UNSUPPORTED");
+		default: throw new JWTError(`Unsupported PEM type: ${String(pemType)}`, "ERR_JWK_UNSUPPORTED");
 	}
 	return {
 		...await exportKey(cryptoKey, options?.jwkParams),
@@ -1373,7 +1374,7 @@ async function exportPEM(jwk, options) {
 		case "spki":
 			if (cryptoKey.type !== "public") throw new JWTError(`Only 'public' type CryptoKeys can be exported to SPKI PEM format. Key type is '${cryptoKey.type}'.`, "ERR_JWK_INVALID");
 			return toSPKI(cryptoKey);
-		default: throw new JWTError(`Unsupported PEM format: ${pemFormat}`, "ERR_JWK_UNSUPPORTED");
+		default: throw new JWTError(`Unsupported PEM format: ${String(pemFormat)}`, "ERR_JWK_UNSUPPORTED");
 	}
 }
 async function exportToPEM(jwk, pemFormat, algForCryptoKeyImport) {
@@ -1401,7 +1402,7 @@ async function deriveSharedSecret(publicKey, privateKey, alg, options) {
 	else if (alg === "ECDH-ES") throw new JWTError("deriveSharedSecret with alg \"ECDH-ES\" requires an explicit keyLength in options", "ERR_JWK_INVALID");
 	else if (alg.startsWith("ECDH-ES+")) keyLength = Number.parseInt(alg.slice(-5, -2), 10);
 	else keyLength = bitLengthCEK(alg);
-	return deriveECDHESKey(pubCryptoKey, privCryptoKey, alg, keyLength, options?.partyUInfo ?? new Uint8Array(0), options?.partyVInfo ?? new Uint8Array(0));
+	return deriveECDHESKey(pubCryptoKey, privCryptoKey, alg, keyLength, options?.partyUInfo ?? /* @__PURE__ */ new Uint8Array(0), options?.partyVInfo ?? /* @__PURE__ */ new Uint8Array(0));
 }
 function getJWKFromSet(jwkSet, kidOrProtectedHeader) {
 	if (!jwkSet || !isJWKSet(jwkSet)) throw new JWTError("Invalid JWK Set provided", "ERR_JWK_INVALID");

package/dist/_chunks/jws.mjs

@@ -327,7 +327,7 @@ async function verify(jws, key, options = {}) {
 	try {
 		payload = decodeJWSPayload(payloadEncoded, useB64, options.forceUint8Array);
 	} catch (error_) {
-		throw new JWTError(`Invalid JWS: Payload decoding failed (${error_ instanceof Error ? error_.message : error_})`, "ERR_JWS_INVALID");
+		throw new JWTError(`Invalid JWS: Payload decoding failed (${error_ instanceof Error ? error_.message : String(error_)})`, "ERR_JWS_INVALID");
 	}
 	validateCriticalHeadersJWS(protectedHeader, options.recognizedHeaders);
 	validateJwtClaimsIfJsonPayload(payload, options);

package/dist/_chunks/libs/unsecure.mjs

@@ -106,7 +106,7 @@ function base64Decode(data, options) {
 	const isBufferInput = data instanceof Uint8Array;
 	const str = isBufferInput ? textDecoder.decode(data) : data;
 	const decodeToString = (options?.returnAs ?? (isBufferInput ? "uint8array" : "string")) === "string";
-	if (!str) return decodeToString ? "" : new Uint8Array(0);
+	if (!str) return decodeToString ? "" : /* @__PURE__ */ new Uint8Array(0);
 	if (_hasBuffer) {
 		const buf = _Buffer.from(str, "base64");
 		return decodeToString ? buf.toString("utf8") : new Uint8Array(buf);
@@ -119,7 +119,7 @@ function base64UrlDecode(data, options) {
 	const isBufferInput = data instanceof Uint8Array;
 	let str = isBufferInput ? textDecoder.decode(data) : data;
 	const decodeToString = (options?.returnAs ?? (isBufferInput ? "uint8array" : "string")) === "string";
-	if (!str) return decodeToString ? "" : new Uint8Array(0);
+	if (!str) return decodeToString ? "" : /* @__PURE__ */ new Uint8Array(0);
 	if (_hasBuffer) {
 		const buf = _Buffer.from(str, "base64url");
 		return decodeToString ? buf.toString("utf8") : new Uint8Array(buf);

package/dist/_chunks/utils.mjs

@@ -209,7 +209,9 @@ function _parseDurationSeconds(value) {
 	if (typeof value === "string") {
 		const match = value.match(DURATION_REGEX);
 		if (!match || !match[1]) throw new TypeError("Invalid duration format. Must be an integer or a string like '10m', '2h', '7D', etc.");
-		return Number.parseInt(match[1], 10) * TIME_CONSTANTS[match[2] || "s"];
+		const n = Number.parseInt(match[1], 10);
+		const unit = match[2] || "s";
+		return n * TIME_CONSTANTS[unit];
 	}
 	throw new TypeError("Duration must be a number or a string representing time.");
 }
@@ -317,7 +319,7 @@ const BASE_PROCESSED_JWE = [
 function validateCriticalHeadersJWS(protectedHeader, recognizedHeaders = []) {
 	if (!protectedHeader.crit) return;
 	const missingHeaderParams = /* @__PURE__ */ new Set();
-	const recognizedParams = new Set([...recognizedHeaders, ...BASE_PROCESSED_JWS]);
+	const recognizedParams = /* @__PURE__ */ new Set([...recognizedHeaders, ...BASE_PROCESSED_JWS]);
 	for (const param of protectedHeader.crit) {
 		if (recognizedParams.has(param) && (param in protectedHeader || param === "b64")) continue;
 		missingHeaderParams.add(param);
@@ -326,7 +328,7 @@ function validateCriticalHeadersJWS(protectedHeader, recognizedHeaders = []) {
 }
 function validateCriticalHeadersJWE(protectedHeader, recognizedHeaders) {
 	if (!protectedHeader.crit) return;
-	const understoodParams = new Set([...recognizedHeaders || [], ...BASE_PROCESSED_JWE]);
+	const understoodParams = /* @__PURE__ */ new Set([...recognizedHeaders || [], ...BASE_PROCESSED_JWE]);
 	for (const critParam of protectedHeader.crit) {
 		if (!Object.prototype.hasOwnProperty.call(protectedHeader, critParam)) throw new JWTError(`Critical header parameter "${critParam}" listed in "crit" but not present in the protected header.`, "ERR_JWE_INVALID");
 		if (!understoodParams.has(critParam)) throw new JWTError(`Unprocessed critical header parameters: ${critParam}`, "ERR_JWE_INVALID");
@@ -346,7 +348,7 @@ function maybeArray(item) {
 	return Array.isArray(item) ? item : [item];
 }
 function isJWK(key) {
-	return typeof key === "object" && key !== null && "kty" in key && typeof key.kty === "string";
+	return typeof key === "object" && key !== null && (key.kty === "oct" || key.kty === "RSA" || key.kty === "EC" || key.kty === "OKP");
 }
 function isJWKSet(key) {
 	return key && typeof key === "object" && "keys" in key && Array.isArray(key.keys);

package/dist/adapters/elysia/index.mjs

@@ -268,7 +268,7 @@ async function verifySession(context, config, token) {
 		config
 	}) : getVerifyKey(config.key), {
 		...config.jws?.verifyOptions,
-		requiredClaims: [...new Set([
+		requiredClaims: [.../* @__PURE__ */ new Set([
 			...config.jws?.verifyOptions?.requiredClaims || [],
 			"jti",
 			"iat"
@@ -534,7 +534,7 @@ async function unsealSession(context, config, sealed) {
 	const enc = config.jwe?.encryptOptions?.enc;
 	const { payload } = await decrypt(sealed, key, {
 		...config.jwe?.decryptOptions,
-		requiredClaims: [...new Set([
+		requiredClaims: [.../* @__PURE__ */ new Set([
 			...config.jwe?.decryptOptions?.requiredClaims || [],
 			"jti",
 			"iat"

package/dist/adapters/h3v1/index.mjs

@@ -256,7 +256,7 @@ async function unsealJWESession(event, config, sealed) {
 	if (config.jwe?.encryptOptions?.protectedHeader?.typ && typeof config.jwe.encryptOptions.protectedHeader.typ === "string" && config.jwe.encryptOptions.protectedHeader.typ.toLowerCase().includes("jwt")) typ = config.jwe.encryptOptions.protectedHeader.typ;
 	const { payload } = await decrypt(sealed, key, {
 		...config.jwe?.decryptOptions,
-		requiredClaims: [...new Set([
+		requiredClaims: [.../* @__PURE__ */ new Set([
 			...config.jwe?.decryptOptions?.requiredClaims || [],
 			"jti",
 			"iat"
@@ -579,7 +579,7 @@ async function verifyJWSSession(event, config, token) {
 	if (config.jws?.signOptions?.protectedHeader?.typ && typeof config.jws.signOptions.protectedHeader.typ === "string" && config.jws.signOptions.protectedHeader.typ.toLowerCase().includes("jwt")) typ = config.jws.signOptions.protectedHeader.typ;
 	const { payload } = await verify(token, jwk, {
 		...config.jws?.verifyOptions,
-		requiredClaims: [...new Set([
+		requiredClaims: [.../* @__PURE__ */ new Set([
 			...config.jws?.verifyOptions?.requiredClaims || [],
 			"jti",
 			"iat"

package/dist/adapters/h3v2/index.mjs

@@ -241,7 +241,7 @@ async function unsealJWESession(event, config, sealed) {
 	if (config.jwe?.encryptOptions?.protectedHeader?.typ && typeof config.jwe.encryptOptions.protectedHeader.typ === "string" && config.jwe.encryptOptions.protectedHeader.typ.toLowerCase().includes("jwt")) typ = config.jwe.encryptOptions.protectedHeader.typ;
 	const { payload } = await decrypt(sealed, key, {
 		...config.jwe?.decryptOptions,
-		requiredClaims: [...new Set([
+		requiredClaims: [.../* @__PURE__ */ new Set([
 			...config.jwe?.decryptOptions?.requiredClaims || [],
 			"jti",
 			"iat"
@@ -556,7 +556,7 @@ async function verifyJWSSession(event, config, token) {
 	if (config.jws?.signOptions?.protectedHeader?.typ && typeof config.jws.signOptions.protectedHeader.typ === "string" && config.jws.signOptions.protectedHeader.typ.toLowerCase().includes("jwt")) typ = config.jws.signOptions.protectedHeader.typ;
 	const { payload } = await verify(token, jwk, {
 		...config.jws?.verifyOptions,
-		requiredClaims: [...new Set([
+		requiredClaims: [.../* @__PURE__ */ new Set([
 			...config.jws?.verifyOptions?.requiredClaims || [],
 			"jti",
 			"iat"

package/dist/core/utils/index.d.mts

@@ -93,7 +93,10 @@ declare function validateCriticalHeadersJWE(protectedHeader: {
 declare function concatUint8Arrays(...arrays: Readonly<Uint8Array<ArrayBuffer>[]>): Uint8Array<ArrayBuffer>;
 /** Wrap a value in an array; returns the array unchanged if already an array. */
 declare function maybeArray<T>(item: T | T[]): T[];
-/** Type guard for {@link JWK} — checks for an object with a string `kty`. */
+/**
+* Type guard for {@link JWK} — an object whose `kty` this library models
+* (`"oct"`/`"RSA"`/`"EC"`/`"OKP"`).
+*/
 declare function isJWK(key: any): key is JWK;
 /** Type guard for {@link JWKSet} — checks for an object with a `keys` array. */
 declare function isJWKSet(key: any): key is JWKSet;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "description": "Low-level JWT utilities",
   "license": "MIT",
   "author": {
@@ -61,25 +61,24 @@
     "@types/node": "^25",
     "@types/supertest": "^7.2.0",
     "@typescript/native-preview": "7.0.0-dev.20260611.2",
-    "@vitest/coverage-v8": "^4.1.8",
+    "@vitest/coverage-v8": "^4.1.9",
     "automd": "^0.4.3",
-    "changelogen": "^0.6.2",
     "cookie-esv1": "npm:cookie-es@^1.2.3",
     "cookie-esv3": "npm:cookie-es@^3.1.1",
-    "elysia": "^1.4.9",
+    "elysia": "^1.4.29",
     "h3v1": "npm:h3@^1.15.11",
     "h3v2": "npm:h3@^2.0.1-rc.22",
     "jose": "^6.2.3",
-    "nano-staged": "^1.0.2",
-    "obuild": "^0.4.36",
-    "oxfmt": "^0.54.0",
-    "oxlint": "^1.69.0",
-    "rolldown": "1.1.1",
+    "obuild": "^0.4.37",
+    "oxfmt": "^0.57.0",
+    "oxlint": "^1.72.0",
+    "oxlint-tsgolint": "^0.24.0",
+    "rolldown": "1.1.4",
     "simple-git-hooks": "^2.13.1",
     "supertest": "^7.2.2",
     "typescript": "^6.0.3",
     "unsecure": "^0.2.2",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.9"
   },
   "peerDependencies": {
     "cookie-es": "^1.2.3 || ^3.1.1",
@@ -105,12 +104,19 @@
     "unjwt": "link:."
   },
   "simple-git-hooks": {
-    "pre-commit": "./node_modules/.bin/nano-staged"
+    "pre-commit": "pnpm build --stub && pnpm lint && pnpm typecheck"
   },
-  "nano-staged": {
-    "*.{js,ts,mjs,cjs,json,yml,md}": [
-      "pnpm run fmt"
-    ]
+  "devEngines": {
+    "packageManager": {
+      "name": "pnpm",
+      "version": "11.9.0",
+      "onFail": "download"
+    },
+    "runtime": {
+      "name": "node",
+      "version": ">=24.17",
+      "onFail": "error"
+    }
   },
   "scripts": {
     "build": "obuild",
@@ -118,8 +124,6 @@
     "dev:prepare": "obuild --stub && pnpm simple-git-hooks",
     "lint": "oxlint . && oxfmt --check .",
     "fmt": "automd && oxlint --fix . && oxfmt .",
-    "release": "pnpm test && pnpm prepack && changelogen --release --push",
-    "stub": "obuild --stub",
     "test": "vitest run --slowTestThreshold=1000",
     "test:coverage": "vitest run --coverage --slowTestThreshold=1000",
     "typecheck": "tsgo --noEmit",