unjwt 0.8.0 → 0.8.1

package/dist/_chunks/_codec-jws.mjs

@@ -318,7 +318,7 @@ function getEncryptKey(config, prefix) {
 	if (isCryptoKey(key) || isSymmetricJWK(key)) resolved = key;
 	else if (isKeyPair(key)) {
 		assertJWEKeyPair(key, prefix);
-		resolved = key.publicKey ?? key.privateKey;
+		resolved = key.publicKey;
 	}
 	if (!resolved) throw invalidKeyError(`${prefix} Invalid JWE key. It must be a JWK or a CryptoKey.`, key);
 	assertPinnedAlgEnc(resolved, config, prefix);
@@ -341,7 +341,7 @@ function assertJWEKeyPair(key, prefix) {
 	assertKeyPair(key, {
 		prefix,
 		family: "JWE",
-		isPublic: (half) => half === void 0 || isCryptoKey(half) || isPublicJWK(half),
+		isPublic: (half) => isCryptoKey(half) || isPublicJWK(half),
 		publicHalf: "a public JWK or a CryptoKey"
 	});
 }

package/dist/_chunks/_jwt-internal.mjs

@@ -68,7 +68,7 @@ function isSymmetricJWK(key) {
 	return isJWK(key) && key.kty === "oct" && typeof key.k === "string";
 }
 function isAsymmetricJWK(key) {
-	return !isSymmetricJWK(key);
+	return isJWK(key) && key.kty !== "oct";
 }
 function isPrivateJWK(key) {
 	if (!isJWK(key) || key.kty === "oct") return false;

package/dist/_chunks/index.d.mts

@@ -451,7 +451,7 @@ export interface JoseHeaderParameters {
   [propName: string]: unknown;
 }
 /** Payload accepted by `sign` and `encrypt`: a string, raw bytes, or a JSON object. */
-export type JOSEPayload = string | Uint8Array<ArrayBuffer> | Record<string, unknown>;
+export type JOSEPayload = string | Uint8Array<ArrayBuffer> | object;
 /** How a verified or decrypted payload is decoded: `"json"` object, UTF-8 `"string"`, or raw `"bytes"`. */
 export type JOSEPayloadMode = keyof JOSEPayloadTypeMap;
 /** The payload type each `JOSEPayloadMode` resolves to. */

package/dist/_chunks/index3.d.mts

@@ -57,19 +57,19 @@ export declare function isCryptoKey(key: unknown): key is CryptoKey;
 /** Whether `key` is a `CryptoKeyPair` of two CryptoKeys. */
 export declare const isCryptoKeyPair: (key: unknown) => key is CryptoKeyPair;
 /** Whether the JWK is symmetric (`oct`); its `k` is always secret. */
-export declare function isSymmetricJWK<T>(key: T): key is Extract<T, JWK_oct>;
+export declare function isSymmetricJWK<T extends JWK>(key: T): key is Extract<T, JWK_oct>;
 export declare function isSymmetricJWK(key: unknown): key is JWK_oct;
 /** Whether the JWK is asymmetric (RSA, EC, OKP). */
-export declare function isAsymmetricJWK<T>(key: T): key is Exclude<T, JWK_oct>;
+export declare function isAsymmetricJWK<T extends JWK>(key: T): key is Exclude<T, JWK_oct>;
 export declare function isAsymmetricJWK(key: unknown): key is Exclude<JWK, JWK_oct>;
 /**
  * Whether the JWK holds asymmetric private material (`d`). It is `false` for `oct` keys,
  * so `!isPrivateJWK(key)` is not a "safe to publish" check; use `isPublicJWK`.
  */
-export declare function isPrivateJWK<T>(key: T): key is Extract<T, JWK_EC_Private | JWK_OKP_Private | JWK_RSA_Private>;
+export declare function isPrivateJWK<T extends JWK>(key: T): key is Extract<T, JWK_EC_Private | JWK_OKP_Private | JWK_RSA_Private>;
 export declare function isPrivateJWK(key: unknown): key is JWK_Private;
 /** Whether the JWK is an asymmetric public key without `d`: the "safe to publish" check. */
-export declare function isPublicJWK<T>(key: T): key is Exclude<Extract<T, JWK_EC_Public | JWK_OKP_Public | JWK_RSA_Public>, JWK_Private>;
+export declare function isPublicJWK<T extends JWK>(key: T): key is Exclude<Extract<T, JWK_EC_Public | JWK_OKP_Public | JWK_RSA_Public>, JWK_Private>;
 export declare function isPublicJWK(key: unknown): key is JWK_Public;
 /** How a JWK Set's entries are read during algorithm inference. */
 export interface InferAlgorithmsOptions {

package/dist/_chunks/jwe.d.mts

@@ -13,7 +13,7 @@ export declare function encryptMulti(payload: JOSEPayload, recipients: JWEMultiR
  * `ERR_JWE_NO_MATCHING_RECIPIENT` when none qualifies; a JWK Set with no `kid` candidate
  * throws `ERR_JWK_KEY_NOT_FOUND`. The payload type follows `options.payload`.
  */
-export declare function decryptMulti<T extends Record<string, unknown> = JWTClaims>(jwe: JWEGeneralSerialization | JWEFlattenedSerialization, keyOrLookup: JWEMultiDecryptKey, options?: JWEMultiDecryptOptions<"json"> & {
+export declare function decryptMulti<T extends object = JWTClaims>(jwe: JWEGeneralSerialization | JWEFlattenedSerialization, keyOrLookup: JWEMultiDecryptKey, options?: JWEMultiDecryptOptions<"json"> & {
   forceUint8Array?: false;
 }): Promise<JWEMultiDecryptResult<T>>;
 /** @deprecated `forceUint8Array` is replaced by `payload: "bytes"`; removed in v0.9.0. */
@@ -50,7 +50,7 @@ export declare function encrypt(payload: JOSEPayload, key: CryptoKey | JWEEncryp
  * Decrypt a JWE Compact Serialization string; `key` may be a lookup function.
  * The payload type follows `options.payload` (claims `T` by default).
  */
-export declare function decrypt<T extends Record<string, unknown> = JWTClaims>(jwe: string, key: CryptoKey | JWKSet | JWEDecryptJWK | string | Uint8Array<ArrayBuffer> | JWKLookupFunction, options?: JWEDecryptOptions<"json"> & {
+export declare function decrypt<T extends object = JWTClaims>(jwe: string, key: CryptoKey | JWKSet | JWEDecryptJWK | string | Uint8Array<ArrayBuffer> | JWKLookupFunction, options?: JWEDecryptOptions<"json"> & {
   forceUint8Array?: false;
 }): Promise<JWEDecryptResult<T>>;
 /** @deprecated `forceUint8Array` is replaced by `payload: "bytes"`; removed in v0.9.0. */

package/dist/_chunks/jwk.mjs

@@ -1378,10 +1378,7 @@ function keyMatchesHeader(header, keyMaterial, options) {
 		}));
 		return candidates.length === 0 || candidates.some((k) => keyServesHeaderAlg(header, k, ctx));
 	}
-	if (isJWK(keyMaterial)) {
-		if (header.kid && keyMaterial.kid && header.kid !== keyMaterial.kid) return false;
-		return keyServesHeaderAlg(header, keyMaterial, ctx);
-	}
+	if (isJWK(keyMaterial)) return keyServesHeaderAlg(header, keyMaterial, ctx);
 	if (isCryptoKey(keyMaterial)) return keyServesHeaderAlg(header, keyMaterial, ctx);
 	return true;
 }

package/dist/_chunks/jws.d.mts

@@ -11,7 +11,7 @@ export declare function signMulti(payload: JOSEPayload, signers: JWSMultiSigner[
  * Per-signature failures are collected and the last one is thrown when none verifies.
  * The payload type follows `options.payload`, as in `verify`.
  */
-export declare function verifyMulti<T extends Record<string, unknown> = JWTClaims>(jws: JWSGeneralSerialization | JWSFlattenedSerialization, keyOrLookup: CryptoKey | JWKSet | JWSVerifyJWK | Uint8Array<ArrayBuffer> | JWKLookupFunction, options?: JWSMultiVerifyOptions<"json"> & {
+export declare function verifyMulti<T extends object = JWTClaims>(jws: JWSGeneralSerialization | JWSFlattenedSerialization, keyOrLookup: CryptoKey | JWKSet | JWSVerifyJWK | Uint8Array<ArrayBuffer> | JWKLookupFunction, options?: JWSMultiVerifyOptions<"json"> & {
   forceUint8Array?: false;
 }): Promise<JWSMultiVerifyResult<T>>;
 /** @deprecated `forceUint8Array` is replaced by `payload: "bytes"`; removed in v0.9.0. */
@@ -27,7 +27,7 @@ export declare function verifyMulti<Mode extends JOSEPayloadMode = JOSEPayloadMo
  * const outcomes = await verifyMultiAll(jws, (header) => jwkSet);
  * if (!outcomes.every((o) => o.verified)) throw new Error("not all signatures verified");
  */
-export declare function verifyMultiAll<T extends Record<string, unknown> = JWTClaims>(jws: JWSGeneralSerialization | JWSFlattenedSerialization, keyResolver: JWKLookupFunction, options?: JWSMultiVerifyAllOptions<"json"> & {
+export declare function verifyMultiAll<T extends object = JWTClaims>(jws: JWSGeneralSerialization | JWSFlattenedSerialization, keyResolver: JWKLookupFunction, options?: JWSMultiVerifyAllOptions<"json"> & {
   forceUint8Array?: false;
 }): Promise<JWSMultiVerifyOutcome<T>[]>;
 /** @deprecated `forceUint8Array` is replaced by `payload: "bytes"`; removed in v0.9.0. */
@@ -46,7 +46,7 @@ export declare function sign(payload: JOSEPayload, key: CryptoKey | Uint8Array<A
  * Verifies a JWS Compact Serialization against a key, JWK Set or key resolver.
  * The payload type follows `options.payload`: claims `T` for `"json"` (default), `string`, or `Uint8Array`.
  */
-export declare function verify<T extends Record<string, unknown> = JWTClaims>(jws: string, key: CryptoKey | JWKSet | JWSVerifyJWK | Uint8Array<ArrayBuffer> | JWKLookupFunction, options?: JWSVerifyOptions<"json"> & {
+export declare function verify<T extends object = JWTClaims>(jws: string, key: CryptoKey | JWKSet | JWSVerifyJWK | Uint8Array<ArrayBuffer> | JWKLookupFunction, options?: JWSVerifyOptions<"json"> & {
   forceUint8Array?: false;
 }): Promise<JWSVerifyResult<T>>;
 /** @deprecated `forceUint8Array` is replaced by `payload: "bytes"`; removed in v0.9.0. */

package/dist/_chunks/jwt.d.mts

@@ -1,4 +1,4 @@
-import { Duration, JOSEPayloadMode, JWTClaimValidationOptions, JWTClaims, JWTErrorCode, JWTTimeClaimOptions, PayloadOf } from "./index.mjs";
+import { Duration, JOSEPayload, JOSEPayloadMode, JWTClaimValidationOptions, JWTClaims, JWTErrorCode, JWTTimeClaimOptions, PayloadOf } from "./index.mjs";
 /** Set `typ: "JWT"` on a header without `typ` when the payload is an object (not a `Uint8Array`). */
 export declare function applyTypDefault<T extends {
   typ?: string;
@@ -19,7 +19,7 @@ export declare function parsePayloadText(bytes: Uint8Array<ArrayBuffer>, options
 export declare function parsePayloadSegment<T = JWTClaims>(payloadEncoded: string, options?: ParsePayloadOptions<"json">): T;
 export declare function parsePayloadSegment<Mode extends JOSEPayloadMode = JOSEPayloadMode>(payloadEncoded: string, options?: ParsePayloadOptions<Mode>): PayloadOf<Mode>;
 /** Encode a payload to bytes; a non-serializable one throws `ERR_INVALID_OPTION`. */
-export declare function getPlaintextBytes(payload: string | Uint8Array<ArrayBuffer> | Record<string, unknown>): Uint8Array<ArrayBuffer>;
+export declare function getPlaintextBytes(payload: JOSEPayload): Uint8Array<ArrayBuffer>;
 /** Options for {@link computeJwtTimeClaims}. */
 export type ComputeJwtTimeClaimsOptions = JWTTimeClaimOptions;
 /**

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "unjwt",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "Low-level JWT utilities",
+  "homepage": "https://unjwt.s94.dev",
   "license": "MIT",
   "author": {
     "name": "Sandro Circi",