unjwt 0.7.3 → 0.8.1

package/dist/core/jws.d.mts

@@ -1,3 +1,5 @@
-import { JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHeaderParameters, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWTError, JWTErrorCauseMap, JWTErrorCode, isJWTError } from "../_chunks/index.mjs";
+import { UnsecureError, UnsecureErrorCode } from "../_chunks/libs/unsecure.mjs";
+import { JOSEPayloadMode, JOSEPayloadTypeMap, JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHeaderParameters, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWTError, JWTErrorCauseMap, JWTErrorCode, KnownJWTErrorCode, PayloadOf, isJWTError, isUnsecureError } from "../_chunks/index.mjs";
+import { DEFAULT_JOSE_LIMITS } from "../_chunks/_internal.mjs";
 import { generalToFlattenedJWS, sign, signMulti, verify, verifyMulti, verifyMultiAll } from "../_chunks/jws.mjs";
-export { type JWSAlgorithm, type JWSAsymmetricPrivateJWK, type JWSAsymmetricPublicJWK, type JWSFlattenedSerialization, type JWSGeneralSerialization, type JWSGeneralSignature, type JWSHeaderParameters, type JWSMultiSignOptions, type JWSMultiSigner, type JWSMultiVerifyAllOptions, type JWSMultiVerifyOptions, type JWSMultiVerifyOutcome, type JWSMultiVerifyResult, type JWSProtectedHeader, type JWSSignJWK, type JWSSignOptions, type JWSVerifyJWK, type JWSVerifyOptions, type JWSVerifyResult, JWTError, type JWTErrorCauseMap, type JWTErrorCode, generalToFlattenedJWS, isJWTError, sign, signMulti, verify, verifyMulti, verifyMultiAll };
+export { DEFAULT_JOSE_LIMITS, type JOSEPayloadMode, type JOSEPayloadTypeMap, type JWSAlgorithm, type JWSAsymmetricPrivateJWK, type JWSAsymmetricPublicJWK, type JWSFlattenedSerialization, type JWSGeneralSerialization, type JWSGeneralSignature, type JWSHeaderParameters, type JWSMultiSignOptions, type JWSMultiSigner, type JWSMultiVerifyAllOptions, type JWSMultiVerifyOptions, type JWSMultiVerifyOutcome, type JWSMultiVerifyResult, type JWSProtectedHeader, type JWSSignJWK, type JWSSignOptions, type JWSVerifyJWK, type JWSVerifyOptions, type JWSVerifyResult, JWTError, type JWTErrorCauseMap, type JWTErrorCode, type KnownJWTErrorCode, type PayloadOf, UnsecureError, type UnsecureErrorCode, generalToFlattenedJWS, isJWTError, isUnsecureError, sign, signMulti, verify, verifyMulti, verifyMultiAll };

package/dist/core/jws.mjs

@@ -1,3 +1,5 @@
-import { JWTError, isJWTError } from "../_chunks/utils.mjs";
+import { UnsecureError } from "../_chunks/libs/unsecure.mjs";
+import { JWTError, isJWTError, isUnsecureError } from "../_chunks/_jwt-internal.mjs";
+import { DEFAULT_JOSE_LIMITS } from "../_chunks/jwk.mjs";
 import { generalToFlattenedJWS, sign, signMulti, verify, verifyMulti, verifyMultiAll } from "../_chunks/jws.mjs";
-export { JWTError, generalToFlattenedJWS, isJWTError, sign, signMulti, verify, verifyMulti, verifyMultiAll };
+export { DEFAULT_JOSE_LIMITS, JWTError, UnsecureError, generalToFlattenedJWS, isJWTError, isUnsecureError, sign, signMulti, verify, verifyMulti, verifyMultiAll };

package/dist/core/utils/index.d.mts

@@ -1,158 +1,5 @@
-import { Duration, ExpiresIn, JWK, JWKSet, JWK_EC_Private, JWK_EC_Public, JWK_OKP_Private, JWK_OKP_Public, JWK_Private, JWK_Public, JWK_RSA_Private, JWK_RSA_Public, JWK_oct, JWSAlgorithm, JWTClaimValidationOptions, JWTClaims, KeyManagementAlgorithm, StrictOmit } from "../../_chunks/index.mjs";
-import { base64Decode, base64Encode, base64UrlDecode, base64UrlEncode, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder } from "../../_chunks/libs/unsecure.mjs";
-/**
-* Infer the set of JWS signing algorithms a key unambiguously supports.
-* Returns `undefined` when inference is not possible — callers must pass
-* `options.algorithms` explicitly (raw bytes, ambiguous JWK, lookup functions, ...).
-*/
-declare function inferJWSAllowedAlgorithms(key: unknown): JWSAlgorithm[] | undefined;
-/**
-* Infer the set of JWE key-management algorithms a key unambiguously supports.
-* Returns `undefined` when inference is not possible — callers must pass
-* `options.algorithms` explicitly.
-*
-* Passwords (`string` / `Uint8Array`) infer to the three PBES2 variants.
-*/
-declare function inferJWEAllowedAlgorithms(key: unknown): KeyManagementAlgorithm[] | undefined;
-/**
-* Apply default typ/cty semantics shared by JWS & JWE.
-* - If typ is undefined and payload is a non-Uint8Array object, set typ="JWT".
-* - If typ is "JWT" and payload is a non-Uint8Array object, ensure cty defaults to "application/json".
-*/
-declare function applyTypCtyDefaults<T extends {
-  typ?: string;
-  cty?: string;
-}>(header: T, payload: unknown): T;
-/** Returns true when headers indicate JSON content. */
-declare function isJWTContent(header: {
-  typ?: string;
-  cty?: string;
-} | undefined): boolean;
-/** Parse a decoded string as JSON when it looks like a JSON object or array, otherwise return the string verbatim. */
-declare function decodeMaybeJWTString<T = unknown>(decodedString: string): T | string;
-/** Decode raw payload bytes honoring `forceUint8Array`. */
-declare function decodePayloadFromBytes<T = unknown>(bytes: Uint8Array<ArrayBuffer>, forceUint8Array?: boolean): T | Uint8Array<ArrayBuffer> | string;
-/** Decode a Base64URL-encoded payload segment honoring `forceUint8Array`. */
-declare function decodePayloadFromB64UrlSegment<T = unknown>(payloadEncoded: string, forceUint8Array?: boolean): T | Uint8Array<ArrayBuffer> | string;
-/** Convert plaintext input to bytes, shared by JWS & JWE when preparing payload. */
-declare function getPlaintextBytes(payload: string | Uint8Array<ArrayBuffer> | Record<string, unknown>): Uint8Array<ArrayBuffer>;
-/**
-* Parse a {@link Duration} (integer seconds or shorthand string like `"10m"`)
-* into a positive integer number of seconds. Used for `expiresIn`-style inputs
-* where `0` / negatives are invalid.
-*
-* For inputs that legitimately permit `0` (e.g. `notBeforeIn: 0`), compute the
-* bounds at the call site instead.
-*/
-declare function computeDurationInSeconds(duration: Duration): number;
-/** @deprecated Renamed to {@link computeDurationInSeconds} in v0.7.0. */
-declare const computeExpiresInSeconds: (expiresIn: ExpiresIn) => number;
-/** @deprecated Renamed to {@link computeDurationInSeconds} in v0.7.0. */
-declare const computeMaxTokenAgeSeconds: (expiresIn: ExpiresIn) => number;
-/** Options for {@link computeJwtTimeClaims}. */
-interface ComputeJwtTimeClaimsOptions {
-  /** Reference moment for `iat` (and for `expiresIn` / `notBeforeIn` math). Defaults to `new Date()`. */
-  currentDate?: Date;
-  /** Duration until `exp`, relative to `currentDate`. Mutually exclusive with `expiresAt`. */
-  expiresIn?: ExpiresIn;
-  /** Absolute moment for `exp`. Mutually exclusive with `expiresIn`. */
-  expiresAt?: Date;
-  /**
-  * Duration from `iat` before which the JWT must not be accepted.
-  * `0` is allowed and means `nbf = iat` (explicit temporal floor at sign time).
-  * Mutually exclusive with `notBeforeAt`.
-  */
-  notBeforeIn?: ExpiresIn;
-  /** Absolute moment for `nbf` (RFC 7519 §4.1.5). Mutually exclusive with `notBeforeIn`. */
-  notBeforeAt?: Date;
-}
-/**
-* Compute `iat` + optional `exp` / `nbf` for any JSON-object payload.
-*
-* Returns a shallow-cloned payload with the time claims added, or `undefined`
-* when no hint applies (no expiry/nbf provided, non-object payload, or the
-* payload already carries the corresponding claim).
-*
-* `expiresIn` / `expiresAt` and `notBeforeIn` / `notBeforeAt` are each mutually
-* exclusive pairs — passing both within a pair throws `ERR_JWT_CLAIM_INVALID`.
-* Invalid `Date` inputs (NaN `.getTime()`) and negative `notBeforeIn` durations
-* also throw.
-*/
-declare function computeJwtTimeClaims(payload: unknown, options?: ComputeJwtTimeClaimsOptions): JWTClaims | undefined;
-/** Validate JWT claims under JWS verification rules (or custom JWE implementations). */
-declare function validateJwtClaims(jwtClaims: JWTClaims, options?: JWTClaimValidationOptions): void;
-/** Validate critical headers in JWS semantics. */
-declare function validateCriticalHeadersJWS(protectedHeader: {
-  crit?: string[];
-} & Record<string, any>, recognizedHeaders?: string[]): void;
-/** Validate critical headers in JWE semantics. */
-declare function validateCriticalHeadersJWE(protectedHeader: {
-  crit?: string[];
-} & Record<string, any>, recognizedHeaders?: string[]): void;
-/** Concatenate multiple `Uint8Array`s into a single contiguous buffer. */
-declare function concatUint8Arrays(...arrays: Readonly<Uint8Array<ArrayBuffer>[]>): Uint8Array<ArrayBuffer>;
-/** Wrap a value in an array; returns the array unchanged if already an array. */
-declare function maybeArray<T>(item: T | T[]): T[];
-/**
-* Type guard for {@link JWK} — an object whose `kty` this library models
-* (`"oct"`/`"RSA"`/`"EC"`/`"OKP"`).
-*/
-declare function isJWK(key: any): key is JWK;
-/** Type guard for {@link JWKSet} — checks for an object with a `keys` array. */
-declare function isJWKSet(key: any): key is JWKSet;
-/** Asserts that `key` is a `CryptoKey`; throws `TypeError` otherwise. */
-declare function assertCryptoKey(key: unknown): asserts key is CryptoKey;
-/**
-* Type guard for `CryptoKey`. Uses `Symbol.toStringTag` instead of `instanceof`
-* so it works across worker / realm boundaries where `CryptoKey` identities differ.
-*/
-declare function isCryptoKey(key: unknown): key is CryptoKey;
-/** Type guard for `CryptoKeyPair` — both `publicKey` and `privateKey` must be CryptoKeys. */
-declare const isCryptoKeyPair: (key: any) => key is CryptoKeyPair;
-/**
-* Returns true if the JWK is a symmetric (oct) key.
-*
-* NOTE: a symmetric JWK's `k` is always secret key material. {@link isPrivateJWK}
-* returns `false` for `oct` keys (it only detects asymmetric `d`), so use this
-* guard — not `!isPrivateJWK(key)` — when deciding whether a JWK is safe to
-* publish.
-*
-* The `T` inference preserves the caller's narrowed alg type — passing a
-* `JWK_oct<"HS256">` refines to `JWK_oct<"HS256">`, not `JWK_oct<string>`.
-*/
-declare function isSymmetricJWK<T>(key: T): key is Extract<T, JWK_oct>;
-declare function isSymmetricJWK(key: unknown): key is JWK_oct;
-/**
-* Returns true if the JWK is an asymmetric (RSA, EC, OKP) key.
-*
-* The `T` inference preserves the caller's narrowed alg type — passing a
-* `JWK_EC<"ES256">` refines to `JWK_EC<"ES256">`, not `JWK_EC<string>`,
-* and so on for RSA and OKP.
-*/
-declare function isAsymmetricJWK<T>(key: T): key is Exclude<T, JWK_oct>;
-declare function isAsymmetricJWK(key: unknown): key is Exclude<JWK, JWK_oct>;
-/**
-* Type guard that checks if the provided JWK contains *asymmetric* private key
-* material. It relies purely on the presence of private components (e.g. "d"),
-* not on the alg value.
-*
-* WARNING: this returns `false` for symmetric (`oct`) keys — their `k` is secret
-* material too, but it is not a `d` component. `!isPrivateJWK(key)` is therefore
-* NOT a "safe to share" check: it passes every `oct` key. To filter keys that
-* are safe to publish, use {@link isPublicJWK} (true only for asymmetric public
-* keys); to detect any secret material, combine with {@link isSymmetricJWK}.
-*
-* Preserves narrow alg types from the caller.
-*/
-declare function isPrivateJWK<T>(key: T): key is Extract<T, JWK_EC_Private | JWK_OKP_Private | JWK_RSA_Private>;
-declare function isPrivateJWK(key: unknown): key is JWK_Private;
-/**
-* Type guard that checks if the provided JWK is a public (asymmetric) key:
-* public components present, no private `d`. Returns `false` for `oct` keys
-* (which are always secret), making it the correct "safe to publish" predicate.
-*
-* Preserves narrow alg types from the caller.
-*/
-declare function isPublicJWK<T>(key: T): key is Exclude<Extract<T, JWK_EC_Public | JWK_OKP_Public | JWK_RSA_Public>, JWK_Private>;
-declare function isPublicJWK(key: unknown): key is JWK_Public;
-export { ComputeJwtTimeClaimsOptions, type StrictOmit, applyTypCtyDefaults, assertCryptoKey, base64Decode, base64Encode, base64UrlDecode, base64UrlEncode, computeDurationInSeconds, computeExpiresInSeconds, computeJwtTimeClaims, computeMaxTokenAgeSeconds, concatUint8Arrays, decodeMaybeJWTString, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims };
+import { BytesSource, DecodeOptions, DecodeReturnAs, UnsecureError, UnsecureErrorCode, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder } from "../../_chunks/libs/unsecure.mjs";
+import { StrictOmit, isUnsecureError } from "../../_chunks/index.mjs";
+import { computeDurationInSeconds, isJWTContent, validateJwtClaims } from "../../_chunks/jwt.mjs";
+import { ComputeJwtTimeClaimsOptions, DecodePayloadOptions, InferAlgorithmsOptions, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeJwtTimeClaims, concatUint8Arrays, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, validateCriticalHeadersJWE, validateCriticalHeadersJWS } from "../../_chunks/index3.mjs";
+export { type BytesSource, ComputeJwtTimeClaimsOptions, type DecodeOptions, DecodePayloadOptions, type DecodeReturnAs, type InferAlgorithmsOptions, type StrictOmit, UnsecureError, type UnsecureErrorCode, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeDurationInSeconds, computeJwtTimeClaims, concatUint8Arrays, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims };

package/dist/core/utils/index.mjs

@@ -1,3 +1,12 @@
-import { applyTypCtyDefaults, assertCryptoKey, computeDurationInSeconds, computeExpiresInSeconds, computeJwtTimeClaims, computeMaxTokenAgeSeconds, concatUint8Arrays, decodeMaybeJWTString, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims } from "../../_chunks/utils.mjs";
-import { base64Decode, base64Encode, base64UrlDecode, base64UrlEncode, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder } from "../../_chunks/libs/unsecure.mjs";
-export { applyTypCtyDefaults, assertCryptoKey, base64Decode, base64Encode, base64UrlDecode, base64UrlEncode, computeDurationInSeconds, computeExpiresInSeconds, computeJwtTimeClaims, computeMaxTokenAgeSeconds, concatUint8Arrays, decodeMaybeJWTString, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims };
+import { UnsecureError, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder } from "../../_chunks/libs/unsecure.mjs";
+import { applyTypDefault, assertCritShape as assertCritShape$1, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeDurationInSeconds, computeJwtTimeClaims as computeJwtTimeClaims$1, concatUint8Arrays, getPlaintextBytes as getPlaintextBytes$1, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, parsePayloadBytes, parsePayloadSegment, validateCriticalHeadersJWE as validateCriticalHeadersJWE$1, validateCriticalHeadersJWS as validateCriticalHeadersJWS$1, validateJwtClaims } from "../../_chunks/_jwt-internal.mjs";
+import { inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms } from "../../_chunks/algorithms.mjs";
+const applyTypCtyDefaults = applyTypDefault;
+const decodePayloadFromBytes = parsePayloadBytes;
+const decodePayloadFromB64UrlSegment = parsePayloadSegment;
+const getPlaintextBytes = getPlaintextBytes$1;
+const computeJwtTimeClaims = computeJwtTimeClaims$1;
+const validateCriticalHeadersJWS = validateCriticalHeadersJWS$1;
+const validateCriticalHeadersJWE = validateCriticalHeadersJWE$1;
+const assertCritShape = assertCritShape$1;
+export { UnsecureError, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeDurationInSeconds, computeJwtTimeClaims, concatUint8Arrays, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims };

package/dist/index.d.mts

@@ -1,6 +1,10 @@
-import { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, Duration, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JOSEPayload, JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHeaderParameters, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JWTError, JWTErrorCauseMap, JWTErrorCode, JoseHeaderParameters, KeyManagementAlgorithm, MaxTokenAge, NotBeforeIn, UnwrapKeyOptions, UnwrappingKeyFor, WrapKeyOptions, WrapKeyResult, WrappingKeyFor, isJWTError } from "./_chunks/index.mjs";
-import { WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportKey, exportPEM, exportToPEM, generateJWK, generateKey, getJWKFromSet, getJWKsFromSet, importFromPEM, importKey, importPEM, unwrapKey, wrapKey } from "./core/jwk.mjs";
+import { BytesSource, DecodeOptions, DecodeReturnAs, UnsecureError, UnsecureErrorCode, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder } from "./_chunks/libs/unsecure.mjs";
+import { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, Duration, ECDHEphemeralKeyInput, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, GeneratedJWKMap, GeneratedKeyMap, ImportedKey, ImportedKeyMap, JOSEConsumerOptions, JOSELimits, JOSEPayload, JOSEPayloadMode, JOSEPayloadTypeMap, JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWELibraryHeaderName, JWEMultiDecryptKey, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKMetadata, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHeaderParameters, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JWTError, JWTErrorCauseMap, JWTErrorCode, JWTTimeClaimOptions, JoseHeaderParameters, KeyManagementAlgorithm, KnownJWTErrorCode, MaxTokenAge, NotBeforeIn, PayloadOf, StrictOmit, UnwrapKeyOptions, UnwrapKeyResult, UnwrappingKeyFor, WrapKeyOptions, WrapKeyResult, WrappingKeyFor, isJWTError, isUnsecureError } from "./_chunks/index.mjs";
+import { thumbprint } from "./_chunks/index2.mjs";
+import { WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportKey, exportPEM, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, unwrapKey, wrapKey } from "./core/jwk.mjs";
+import { computeDurationInSeconds, isJWTContent, validateJwtClaims } from "./_chunks/jwt.mjs";
 import { decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened } from "./_chunks/jwe.mjs";
+import { DEFAULT_JOSE_LIMITS } from "./_chunks/_internal.mjs";
 import { generalToFlattenedJWS, sign, signMulti, verify, verifyMulti, verifyMultiAll } from "./_chunks/jws.mjs";
-import { assertCryptoKey, computeDurationInSeconds, computeExpiresInSeconds, computeMaxTokenAgeSeconds, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isPrivateJWK, isPublicJWK, isSymmetricJWK, validateJwtClaims } from "./core/utils/index.mjs";
-export { type CompositeKey, type ContentEncryptionAlgorithm, type DeriveKeyOptions, type DeriveKeyReturn, type Duration, type ExpiresIn, type GenerateJWKOptions, type GenerateJWKReturn, type GenerateKeyAlgorithm, type GenerateKeyOptions, type GenerateKeyReturn, type JOSEPayload, type JWEAsymmetricPrivateJWK, type JWEAsymmetricPublicJWK, type JWEDecryptJWK, type JWEDecryptOptions, type JWEDecryptResult, type JWEEncryptJWK, type JWEEncryptOptions, type JWEFlattenedSerialization, type JWEGeneralRecipient, type JWEGeneralSerialization, type JWEHeaderParameters, type JWEKeyManagementHeaderParameters, type JWEMultiDecryptOptions, type JWEMultiDecryptResult, type JWEMultiEncryptOptions, type JWEMultiRecipient, type JWEProtectedHeader, type JWK, type JWKAlgorithm, type JWKCacheAdapter, type JWKLookupFunction, type JWKLookupFunctionHeader, type JWKPEMAlgorithm, type JWKParameters, type JWKSet, type JWK_AES_CBC_HMAC, type JWK_AES_GCM, type JWK_AES_GCM_KW, type JWK_AES_KW, type JWK_Asymmetric, type JWK_Asymmetric_Algorithm, type JWK_EC, type JWK_ECDH_ES, type JWK_ECDSA, type JWK_EC_Private, type JWK_EC_Public, type JWK_HMAC, type JWK_OKP, type JWK_OKP_Private, type JWK_OKP_Public, type JWK_OKP_SIGN, type JWK_PBES2, type JWK_Pair, type JWK_Private, type JWK_Public, type JWK_RSA, type JWK_RSA_ENC, type JWK_RSA_PSS, type JWK_RSA_Private, type JWK_RSA_Public, type JWK_RSA_SIGN, type JWK_Symmetric, type JWK_Symmetric_Algorithm, type JWK_oct, type JWSAlgorithm, type JWSAsymmetricPrivateJWK, type JWSAsymmetricPublicJWK, type JWSFlattenedSerialization, type JWSGeneralSerialization, type JWSGeneralSignature, type JWSHeaderParameters, type JWSMultiSignOptions, type JWSMultiSigner, type JWSMultiVerifyAllOptions, type JWSMultiVerifyOptions, type JWSMultiVerifyOutcome, type JWSMultiVerifyResult, type JWSProtectedHeader, type JWSSignJWK, type JWSSignOptions, type JWSVerifyJWK, type JWSVerifyOptions, type JWSVerifyResult, type JWT, type JWTClaimValidationOptions, type JWTClaims, JWTError, type JWTErrorCauseMap, type JWTErrorCode, type JoseHeaderParameters, type KeyManagementAlgorithm, type MaxTokenAge, type NotBeforeIn, type UnwrapKeyOptions, type UnwrappingKeyFor, WeakMapJWKCache, type WrapKeyOptions, type WrapKeyResult, type WrappingKeyFor, assertCryptoKey, clearJWKCache, computeDurationInSeconds, computeExpiresInSeconds, computeMaxTokenAgeSeconds, configureJWKCache, decrypt, decryptMulti, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, encrypt, encryptMulti, exportKey, exportPEM, exportToPEM, generalToFlattened, generalToFlattenedJWS, generateJWK, generateKey, getJWKFromSet, getJWKsFromSet, importFromPEM, importKey, importPEM, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, sign, signMulti, unwrapKey, validateJwtClaims, verify, verifyMulti, verifyMultiAll, wrapKey };
+import { ComputeJwtTimeClaimsOptions, DecodePayloadOptions, InferAlgorithmsOptions, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeJwtTimeClaims, concatUint8Arrays, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, validateCriticalHeadersJWE, validateCriticalHeadersJWS } from "./_chunks/index3.mjs";
+export { type BytesSource, type CompositeKey, ComputeJwtTimeClaimsOptions, type ContentEncryptionAlgorithm, DEFAULT_JOSE_LIMITS, type DecodeOptions, DecodePayloadOptions, type DecodeReturnAs, type DeriveKeyOptions, type DeriveKeyReturn, type Duration, type ECDHEphemeralKeyInput, type ExpiresIn, type GenerateJWKOptions, type GenerateJWKReturn, type GenerateKeyAlgorithm, type GenerateKeyOptions, type GenerateKeyReturn, type GeneratedJWKMap, type GeneratedKeyMap, type ImportedKey, type ImportedKeyMap, type InferAlgorithmsOptions, type JOSEConsumerOptions, type JOSELimits, type JOSEPayload, type JOSEPayloadMode, type JOSEPayloadTypeMap, type JWEAsymmetricPrivateJWK, type JWEAsymmetricPublicJWK, type JWEDecryptJWK, type JWEDecryptOptions, type JWEDecryptResult, type JWEEncryptJWK, type JWEEncryptOptions, type JWEFlattenedSerialization, type JWEGeneralRecipient, type JWEGeneralSerialization, type JWEHeaderParameters, type JWEKeyManagementHeaderParameters, type JWELibraryHeaderName, type JWEMultiDecryptKey, type JWEMultiDecryptOptions, type JWEMultiDecryptResult, type JWEMultiEncryptOptions, type JWEMultiRecipient, type JWEProtectedHeader, type JWK, type JWKAlgorithm, type JWKCacheAdapter, type JWKLookupFunction, type JWKLookupFunctionHeader, type JWKMetadata, type JWKPEMAlgorithm, type JWKParameters, type JWKSet, type JWK_AES_CBC_HMAC, type JWK_AES_GCM, type JWK_AES_GCM_KW, type JWK_AES_KW, type JWK_Asymmetric, type JWK_Asymmetric_Algorithm, type JWK_EC, type JWK_ECDH_ES, type JWK_ECDSA, type JWK_EC_Private, type JWK_EC_Public, type JWK_HMAC, type JWK_OKP, type JWK_OKP_Private, type JWK_OKP_Public, type JWK_OKP_SIGN, type JWK_PBES2, type JWK_Pair, type JWK_Private, type JWK_Public, type JWK_RSA, type JWK_RSA_ENC, type JWK_RSA_PSS, type JWK_RSA_Private, type JWK_RSA_Public, type JWK_RSA_SIGN, type JWK_Symmetric, type JWK_Symmetric_Algorithm, type JWK_oct, type JWSAlgorithm, type JWSAsymmetricPrivateJWK, type JWSAsymmetricPublicJWK, type JWSFlattenedSerialization, type JWSGeneralSerialization, type JWSGeneralSignature, type JWSHeaderParameters, type JWSMultiSignOptions, type JWSMultiSigner, type JWSMultiVerifyAllOptions, type JWSMultiVerifyOptions, type JWSMultiVerifyOutcome, type JWSMultiVerifyResult, type JWSProtectedHeader, type JWSSignJWK, type JWSSignOptions, type JWSVerifyJWK, type JWSVerifyOptions, type JWSVerifyResult, type JWT, type JWTClaimValidationOptions, type JWTClaims, JWTError, type JWTErrorCauseMap, type JWTErrorCode, type JWTTimeClaimOptions, type JoseHeaderParameters, type KeyManagementAlgorithm, type KnownJWTErrorCode, type MaxTokenAge, type NotBeforeIn, type PayloadOf, type StrictOmit, UnsecureError, type UnsecureErrorCode, type UnwrapKeyOptions, type UnwrapKeyResult, type UnwrappingKeyFor, WeakMapJWKCache, type WrapKeyOptions, type WrapKeyResult, type WrappingKeyFor, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, clearJWKCache, computeDurationInSeconds, computeJwtTimeClaims, concatUint8Arrays, configureJWKCache, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, decrypt, decryptMulti, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, encrypt, encryptMulti, exportKey, exportPEM, generalToFlattened, generalToFlattenedJWS, generateJWK, generateKey, getJWKsFromSet, getPlaintextBytes, importKey, importPEM, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, sign, signMulti, textDecoder, textEncoder, thumbprint, unwrapKey, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims, verify, verifyMulti, verifyMultiAll, wrapKey };

package/dist/index.mjs

@@ -1,5 +1,8 @@
-import { JWTError, assertCryptoKey, computeDurationInSeconds, computeExpiresInSeconds, computeMaxTokenAgeSeconds, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, validateJwtClaims } from "./_chunks/utils.mjs";
-import { WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportKey, exportPEM, exportToPEM, generateJWK, generateKey, getJWKFromSet, getJWKsFromSet, importFromPEM, importKey, importPEM, unwrapKey, wrapKey } from "./_chunks/jwk.mjs";
+import { UnsecureError, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder } from "./_chunks/libs/unsecure.mjs";
+import { JWTError, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeDurationInSeconds, concatUint8Arrays, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, validateJwtClaims } from "./_chunks/_jwt-internal.mjs";
+import { inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms } from "./_chunks/algorithms.mjs";
+import { DEFAULT_JOSE_LIMITS, WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportKey, exportPEM, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, thumbprint, unwrapKey, wrapKey } from "./_chunks/jwk.mjs";
 import { generalToFlattenedJWS, sign, signMulti, verify, verifyMulti, verifyMultiAll } from "./_chunks/jws.mjs";
 import { decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened } from "./_chunks/jwe.mjs";
-export { JWTError, WeakMapJWKCache, assertCryptoKey, clearJWKCache, computeDurationInSeconds, computeExpiresInSeconds, computeMaxTokenAgeSeconds, configureJWKCache, decrypt, decryptMulti, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, encrypt, encryptMulti, exportKey, exportPEM, exportToPEM, generalToFlattened, generalToFlattenedJWS, generateJWK, generateKey, getJWKFromSet, getJWKsFromSet, importFromPEM, importKey, importPEM, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, sign, signMulti, unwrapKey, validateJwtClaims, verify, verifyMulti, verifyMultiAll, wrapKey };
+import { applyTypCtyDefaults, assertCritShape, computeJwtTimeClaims, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, validateCriticalHeadersJWE, validateCriticalHeadersJWS } from "./core/utils/index.mjs";
+export { DEFAULT_JOSE_LIMITS, JWTError, UnsecureError, WeakMapJWKCache, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, clearJWKCache, computeDurationInSeconds, computeJwtTimeClaims, concatUint8Arrays, configureJWKCache, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, decrypt, decryptMulti, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, encrypt, encryptMulti, exportKey, exportPEM, generalToFlattened, generalToFlattenedJWS, generateJWK, generateKey, getJWKsFromSet, getPlaintextBytes, importKey, importPEM, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, sign, signMulti, textDecoder, textEncoder, thumbprint, unwrapKey, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims, verify, verifyMulti, verifyMultiAll, wrapKey };

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "unjwt",
-  "version": "0.7.3",
+  "version": "0.8.1",
   "description": "Low-level JWT utilities",
+  "homepage": "https://unjwt.s94.dev",
   "license": "MIT",
   "author": {
     "name": "Sandro Circi",
@@ -40,9 +41,13 @@
       "types": "./dist/core/utils/index.d.mts",
       "default": "./dist/core/utils/index.mjs"
     },
+    "./internal": {
+      "types": "./dist/core/internal.d.mts",
+      "default": "./dist/core/internal.mjs"
+    },
     "./adapters/h3": {
-      "types": "./dist/adapters/h3v1/index.d.mts",
-      "default": "./dist/adapters/h3v1/index.mjs"
+      "types": "./dist/adapters/h3v2/index.d.mts",
+      "default": "./dist/adapters/h3v2/index.mjs"
     },
     "./adapters/h3v1": {
       "types": "./dist/adapters/h3v1/index.d.mts",
@@ -58,33 +63,31 @@
     }
   },
   "devDependencies": {
-    "@types/node": "^25",
-    "@types/supertest": "^7.2.0",
-    "@typescript/native-preview": "7.0.0-dev.20260611.2",
-    "@vitest/coverage-v8": "^4.1.9",
+    "@types/node": "^24.19.2",
+    "@types/supertest": "^7.2.1",
+    "@vitest/coverage-v8": "^5.0.4",
     "automd": "^0.4.3",
     "cookie-esv1": "npm:cookie-es@^1.2.3",
     "cookie-esv3": "npm:cookie-es@^3.1.1",
-    "elysia": "^1.4.29",
+    "elysia": "^1.4.30",
     "h3v1": "npm:h3@^1.15.11",
-    "h3v2": "npm:h3@^2.0.1-rc.22",
-    "jose": "^6.2.3",
-    "obuild": "^0.4.37",
-    "oxfmt": "^0.57.0",
-    "oxlint": "^1.72.0",
-    "oxlint-tsgolint": "^0.24.0",
-    "rolldown": "1.1.4",
-    "simple-git-hooks": "^2.13.1",
-    "supertest": "^7.2.2",
-    "typescript": "^6.0.3",
-    "unsecure": "^0.2.2",
-    "vitest": "^4.1.9"
+    "h3v2": "npm:h3@^2.0.2",
+    "jose": "^6.2.12",
+    "obuild": "^0.4.45",
+    "oxfmt": "^0.73.0",
+    "oxlint": "^1.88.0",
+    "oxlint-tsgolint": "^7.0.2004",
+    "rolldown": "1.2.14",
+    "simple-git-hooks": "^2.14.0",
+    "supertest": "^7.3.1",
+    "typescript": "^7.0.2",
+    "unsecure": "^0.3.2",
+    "vitest": "^5.0.4"
   },
   "peerDependencies": {
     "cookie-es": "^1.2.3 || ^3.1.1",
-    "elysia": "^1.4.0",
-    "h3": "^1.15.4 || >=2.0.1-rc.22 || ^2.0.1",
-    "rou3": "^0.8.1"
+    "elysia": "^1.4.29",
+    "h3": "^1.15.4 || ^2.0.1"
   },
   "peerDependenciesMeta": {
     "cookie-es": {
@@ -95,9 +98,6 @@
     },
     "h3": {
       "optional": true
-    },
-    "rou3": {
-      "optional": true
     }
   },
   "resolutions": {
@@ -109,12 +109,12 @@
   "devEngines": {
     "packageManager": {
       "name": "pnpm",
-      "version": "11.9.0",
+      "version": "12.11.2",
       "onFail": "download"
     },
     "runtime": {
       "name": "node",
-      "version": ">=24.17",
+      "version": ">=24.17.0",
       "onFail": "error"
     }
   },
@@ -122,11 +122,11 @@
     "build": "obuild",
     "dev": "bun --watch ./playground/main.ts",
     "dev:prepare": "obuild --stub && pnpm simple-git-hooks",
-    "lint": "oxlint . && oxfmt --check .",
+    "lint": "oxlint --deny-warnings . && oxfmt --check .",
     "fmt": "automd && oxlint --fix . && oxfmt .",
     "test": "vitest run --slowTestThreshold=1000",
     "test:coverage": "vitest run --coverage --slowTestThreshold=1000",
-    "typecheck": "tsgo --noEmit",
+    "typecheck": "tsc --noEmit",
     "bench": "vitest bench --run"
   }
 }

package/dist/_chunks/_internal.mjs

@@ -1,88 +0,0 @@
-import { JWTError, decodePayloadFromB64UrlSegment, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isCryptoKey, isCryptoKeyPair, isJWK, validateJwtClaims } from "./utils.mjs";
-import { base64UrlDecode, safeJsonParse, textEncoder } from "./libs/unsecure.mjs";
-import { assertOctKeyLength } from "./jwk.mjs";
-function buildJWKSetFilter(header) {
-	const kid = header?.kid;
-	const alg = header?.alg;
-	return (k) => (!kid || k.kid === kid) && (!k.alg || k.alg === alg);
-}
-function parseEphemeralKey(ephemeralKey) {
-	if (isCryptoKeyPair(ephemeralKey)) return {
-		epk: ephemeralKey.publicKey,
-		epkPrivateKey: ephemeralKey.privateKey
-	};
-	if (typeof ephemeralKey === "object" && ephemeralKey !== null && "publicKey" in ephemeralKey && "privateKey" in ephemeralKey) {
-		if (!ephemeralKey.publicKey || !ephemeralKey.privateKey) throw new JWTError("ECDH-ES custom ephemeral key must include both publicKey and privateKey.", "ERR_JWK_INVALID");
-		return {
-			epk: ephemeralKey.publicKey,
-			epkPrivateKey: ephemeralKey.privateKey
-		};
-	}
-	if (isCryptoKey(ephemeralKey)) {
-		if (ephemeralKey.type !== "private") throw new JWTError("ECDH-ES custom ephemeral CryptoKey must include private key material.", "ERR_JWK_INVALID");
-		return {
-			epk: ephemeralKey,
-			epkPrivateKey: ephemeralKey
-		};
-	}
-	if (isJWK(ephemeralKey)) {
-		if (!("d" in ephemeralKey) || typeof ephemeralKey.d !== "string") throw new JWTError("ECDH-ES custom ephemeral JWK must include private parameter \"d\".", "ERR_JWK_INVALID");
-		return {
-			epk: ephemeralKey,
-			epkPrivateKey: ephemeralKey
-		};
-	}
-	throw new JWTError("Unsupported ECDH-ES ephemeral key material provided.", "ERR_JWK_INVALID");
-}
-async function resolveSigningKey(alg, key, usage) {
-	if (key instanceof Uint8Array) {
-		assertOctKeyLength(key, alg);
-		return crypto.subtle.importKey("raw", key, {
-			name: "HMAC",
-			hash: `SHA-${alg.slice(-3)}`
-		}, false, [usage]);
-	}
-	if (alg.startsWith("RS") || alg.startsWith("PS")) {
-		const { modulusLength } = key.algorithm;
-		if (typeof modulusLength !== "number" || modulusLength < 2048) throw new JWTError(`${alg} requires a key modulusLength of at least 2048 bits`, "ERR_JWK_INVALID");
-	}
-	return key;
-}
-function validateJwtClaimsIfJsonPayload(payload, options) {
-	if (payload && typeof payload === "object" && !(payload instanceof Uint8Array) && !options.forceUint8Array && options.validateClaims !== false) validateJwtClaims(payload, options);
-}
-const JWS_ALG_CTX = /* @__PURE__ */ Object.freeze({
-	infer: inferJWSAllowedAlgorithms,
-	octAliasing: false,
-	errorCode: "ERR_JWS_ALG_NOT_ALLOWED",
-	label: "Algorithm"
-});
-const JWE_ALG_CTX = /* @__PURE__ */ Object.freeze({
-	infer: inferJWEAllowedAlgorithms,
-	octAliasing: true,
-	errorCode: "ERR_JWE_ALG_NOT_ALLOWED",
-	label: "Key management algorithm"
-});
-function checkAlgAllowed(alg, key, explicit, ctx) {
-	if (explicit) return explicit.includes(alg) ? void 0 : notAllowed(alg, ctx);
-	if (isJWK(key) && typeof key.alg === "string" && (!ctx.octAliasing || key.kty !== "oct")) return key.alg === alg ? void 0 : notAllowed(alg, ctx);
-	const inferred = ctx.infer(key);
-	if (!inferred) return new JWTError(`Cannot infer allowed ${ctx.label.toLowerCase()}s from this key; pass "options.algorithms" explicitly.`, ctx.errorCode);
-	return inferred.includes(alg) ? void 0 : notAllowed(alg, ctx);
-}
-function notAllowed(alg, ctx) {
-	return new JWTError(`${ctx.label} not allowed: ${alg}`, ctx.errorCode);
-}
-function decodeProtectedHeader(encoded, family) {
-	if (!encoded) return {};
-	try {
-		return safeJsonParse(base64UrlDecode(encoded));
-	} catch {
-		throw new JWTError(`Invalid ${family}: Protected header could not be decoded.`, `ERR_${family}_INVALID`);
-	}
-}
-function decodeJWSPayload(payloadSegment, useB64, forceUint8Array) {
-	if (useB64) return decodePayloadFromB64UrlSegment(payloadSegment, forceUint8Array);
-	return forceUint8Array ? textEncoder.encode(payloadSegment) : payloadSegment;
-}
-export { JWE_ALG_CTX, JWS_ALG_CTX, buildJWKSetFilter, checkAlgAllowed, decodeJWSPayload, decodeProtectedHeader, parseEphemeralKey, resolveSigningKey, validateJwtClaimsIfJsonPayload };