unjwt 0.8.3 → 0.8.5

package/dist/dpop/index.mjs

@@ -0,0 +1,296 @@
+import { JWTError, isJWTError } from "../error.mjs";
+import { assertPlainObject, base64UrlParse, base64UrlStringify, isCryptoKey, isPlainObject, isPrivateJWK } from "../_chunks/jwt.mjs";
+import { JWS_ALG_CTX, asJWTError, assertCompactToken, checkAlgAllowed, decodeProtectedHeader, jwkTokey, thumbprint } from "../_chunks/algorithms.mjs";
+import { digestUrl, inferJWSAllowedAlgorithms, isJWSAlgorithm } from "../_chunks/digest.mjs";
+import { sign, verify } from "../_chunks/jws.mjs";
+import { exportJWK } from "../_chunks/export.mjs";
+function assertDPoPAlgorithm(value, code) {
+	if (typeof value !== "string" || !isJWSAlgorithm(value) || value.startsWith("HS")) throw new JWTError("DPoP requires a supported asymmetric signing algorithm.", code);
+}
+function assertNonce(value, code) {
+	if (typeof value !== "string" || !/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(value)) throw new JWTError("DPoP nonce must contain printable ASCII excluding space, quotes and backslash.", code);
+}
+function assertMethod(value, code) {
+	if (typeof value !== "string" || !/^[!#$%&'*+.^_`|~\da-z-]+$/i.test(value)) throw new JWTError("DPoP method must be a non-empty HTTP method token.", code);
+}
+function assertIdentifier(value, code) {
+	if (typeof value !== "string" || value.length === 0) throw new JWTError("DPoP jti must be a non-empty string unique to this proof.", code);
+}
+function assertNumericDate(value, options) {
+	if (typeof value !== "number" || !Number.isFinite(value) || value < 0) throw new JWTError(`DPoP ${options.claim} must be a finite, non-negative NumericDate.`, options.code);
+}
+function assertAccessToken(value) {
+	if (typeof value !== "string" || !/^[\x00-\x7F]+$/.test(value)) throw new JWTError("DPoP accessToken.token must be a non-empty ASCII string.", "ERR_INVALID_OPTION");
+}
+function isSHA256Digest(value) {
+	return typeof value === "string" && /^[\w-]{42}[AEIMQUYcgkosw048]$/.test(value);
+}
+async function accessTokenHash(token) {
+	assertAccessToken(token);
+	try {
+		return await digestUrl(token);
+	} catch (cause) {
+		throw new JWTError("DPoP access token hashing failed.", "ERR_DPOP_INVALID", cause);
+	}
+}
+const PRIVATE_MEMBERS = [
+	"d",
+	"p",
+	"q",
+	"dp",
+	"dq",
+	"qi",
+	"oth",
+	"k"
+];
+function resolveProofAlgorithm(pair, options) {
+	let algorithm = options.algorithm;
+	if (algorithm === void 0) {
+		if (!isPlainObject(pair) || !isPrivateJWK(pair.privateKey) || !isPlainObject(pair.publicKey)) throw new JWTError("DPoP algorithm inference requires an asymmetric JWK pair; provide algorithm for CryptoKey pairs.", "ERR_INVALID_OPTION");
+		algorithm = pair.privateKey.alg === void 0 ? pair.publicKey.alg : pair.privateKey.alg;
+		if (algorithm === void 0) {
+			const candidates = inferJWSAllowedAlgorithms(pair.privateKey);
+			if (candidates?.length !== 1) throw new JWTError("DPoP signing algorithm is ambiguous; provide algorithm or JWK alg metadata.", "ERR_INVALID_OPTION");
+			algorithm = candidates[0];
+		}
+	}
+	assertDPoPAlgorithm(algorithm, "ERR_INVALID_OPTION");
+	return algorithm;
+}
+async function publicKeyForProof(pair, algorithm) {
+	if (!isPlainObject(pair)) throw new JWTError("DPoP keyPair must supply privateKey and publicKey.", "ERR_INVALID_OPTION");
+	const { privateKey, publicKey } = pair;
+	if (isCryptoKey(privateKey) && isCryptoKey(publicKey)) {
+		if (privateKey.type !== "private" || publicKey.type !== "public" || !publicKey.extractable) throw new JWTError("DPoP requires a private signing key and an extractable public key.", "ERR_INVALID_OPTION");
+		if (!inferJWSAllowedAlgorithms(publicKey)?.includes(algorithm)) throw new JWTError("DPoP public key is incompatible with the signing algorithm.", "ERR_INVALID_OPTION");
+		return projectPublicKey(await exportJWK(publicKey), {
+			algorithm,
+			code: "ERR_INVALID_OPTION"
+		});
+	}
+	if (!isPrivateJWK(privateKey) || isCryptoKey(publicKey)) throw new JWTError("DPoP keyPair must be a CryptoKey pair or an asymmetric JWK pair.", "ERR_INVALID_OPTION");
+	const jwk = projectPublicKey(publicKey, {
+		algorithm,
+		code: "ERR_INVALID_OPTION"
+	});
+	if (isPlainObject(publicKey) && publicKey.alg !== void 0) {
+		assertDPoPAlgorithm(publicKey.alg, "ERR_INVALID_OPTION");
+		if (!inferJWSAllowedAlgorithms(publicKey)?.includes(algorithm)) throw new JWTError("DPoP public JWK alg does not match the signing algorithm.", "ERR_INVALID_OPTION");
+	}
+	return jwk;
+}
+function projectPublicKey(value, options) {
+	if (!isPlainObject(value) || PRIVATE_MEMBERS.some((member) => Object.hasOwn(value, member))) throw new JWTError("DPoP jwk must be a public asymmetric JWK without private members.", options.code);
+	const members = value.kty === "RSA" ? ["n", "e"] : value.kty === "EC" ? [
+		"crv",
+		"x",
+		"y"
+	] : value.kty === "OKP" ? ["crv", "x"] : void 0;
+	if (!members || members.some((name) => typeof value[name] !== "string" || value[name].length === 0)) throw new JWTError("DPoP jwk is missing required asymmetric public key members.", options.code);
+	if (members.some((name) => name !== "crv" && !isCanonicalBase64Url(value[name]))) throw new JWTError("DPoP jwk members must be canonical unpadded base64url.", options.code);
+	const key = Object.fromEntries([["kty", value.kty], ...members.map((name) => [name, value[name]])]);
+	if (!(value.kty === "RSA" ? /^(?:RS|PS)(?:256|384|512)$/.test(options.algorithm) : inferJWSAllowedAlgorithms(key)?.includes(options.algorithm))) throw new JWTError("DPoP jwk is incompatible with the signing algorithm.", options.code);
+	return key;
+}
+function isCanonicalBase64Url(value) {
+	if (typeof value !== "string") return false;
+	try {
+		return base64UrlStringify(base64UrlParse(value, { returnAs: "bytes" })) === value;
+	} catch {
+		return false;
+	}
+}
+function normalizeTargetURI(value, options) {
+	const uri = typeof value === "string" ? value.split(/[?#]/, 1)[0] : value;
+	const authority = typeof uri === "string" ? /^https?:\/\/([^/]+)/i.exec(uri)?.[1] : void 0;
+	if (typeof uri !== "string" || authority === void 0 || /[@%]/.test(authority) || /[\x00-\x20\x7F\\]/.test(uri) || /%(?![\da-f]{2})/i.test(uri)) throw new JWTError("DPoP htu must be an absolute HTTP(S) URI without credentials or escapes in its authority.", options.code);
+	const origin = uri.slice(0, uri.indexOf("://") + 3 + authority.length);
+	const path = uri.slice(origin.length).replace(/%[\da-f]{2}/gi, (escape) => {
+		const character = String.fromCharCode(Number.parseInt(escape.slice(1), 16));
+		return /^[\w.~-]$/.test(character) ? character : escape.toUpperCase();
+	});
+	try {
+		return new URL(origin + path).href;
+	} catch (cause) {
+		throw new JWTError("DPoP htu must be a valid absolute HTTP(S) URI.", options.code, cause);
+	}
+}
+function validateVerifyOptions(target, options) {
+	assertPlainObject(options, "options");
+	if (typeof target !== "object" || target === null) throw new JWTError("DPoP target requires method and url.", "ERR_INVALID_OPTION");
+	const { method, url } = target;
+	assertMethod(method, "ERR_INVALID_OPTION");
+	const uri = normalizeTargetURI(url, { code: "ERR_INVALID_OPTION" });
+	const { algorithms: allowed, maxTokenAge, clockTolerance, currentDate, nonce, accessToken, consumeProof } = options;
+	const algorithms = [];
+	for (const algorithm of Array.isArray(allowed) ? allowed : []) {
+		assertDPoPAlgorithm(algorithm, "ERR_INVALID_OPTION");
+		algorithms.push(algorithm);
+	}
+	if (algorithms.length === 0) throw new JWTError("DPoP algorithms must be a non-empty asymmetric algorithm allowlist.", "ERR_INVALID_OPTION");
+	const tolerance = clockTolerance === void 0 ? 0 : clockTolerance;
+	if (typeof tolerance !== "number" || !Number.isFinite(tolerance) || tolerance < 0 || typeof maxTokenAge !== "number" || !Number.isFinite(maxTokenAge) || maxTokenAge <= 0) throw new JWTError("DPoP maxTokenAge must be positive finite seconds and clockTolerance non-negative finite seconds.", "ERR_INVALID_OPTION");
+	const date = currentDate === void 0 ? /* @__PURE__ */ new Date() : currentDate;
+	const time = date instanceof Date ? date.getTime() : NaN;
+	if (!Number.isFinite(time)) throw new JWTError("DPoP currentDate must be a valid Date.", "ERR_INVALID_OPTION");
+	if (nonce !== void 0) assertNonce(nonce, "ERR_INVALID_OPTION");
+	let binding;
+	if (accessToken !== void 0) {
+		assertPlainObject(accessToken, "accessToken");
+		const { token, thumbprint } = accessToken;
+		assertAccessToken(token);
+		if (!isSHA256Digest(thumbprint)) throw new JWTError("DPoP accessToken.thumbprint must be a SHA-256 JWK thumbprint.", "ERR_INVALID_OPTION");
+		binding = {
+			token,
+			thumbprint
+		};
+	}
+	if (consumeProof !== void 0 && typeof consumeProof !== "function") throw new JWTError("DPoP consumeProof must be a function.", "ERR_INVALID_OPTION");
+	return {
+		now: time / 1e3,
+		tolerance,
+		maxTokenAge,
+		method,
+		uri,
+		algorithms,
+		nonce,
+		accessToken: binding,
+		consumeProof
+	};
+}
+function validateProofClaims(payload, context) {
+	const code = "ERR_DPOP_CLAIM_INVALID";
+	assertIdentifier(payload.jti, code);
+	assertNumericDate(payload.iat, {
+		claim: "iat",
+		code
+	});
+	assertMethod(payload.htm, code);
+	if (payload.htm !== context.method || normalizeTargetURI(payload.htu, { code }) !== context.uri) throw new JWTError("DPoP proof does not match the request method and URI.", code);
+	if (payload.nonce !== void 0) assertNonce(payload.nonce, code);
+	if (payload.ath !== void 0 && !isSHA256Digest(payload.ath)) throw new JWTError("DPoP ath must be a base64url SHA-256 access token hash.", code);
+	if (payload.iat > context.now + context.tolerance || payload.iat < context.now - context.maxTokenAge - context.tolerance) throw new JWTError("DPoP iat is outside the accepted proof age window.", code);
+}
+function assertExpectedNonce(payload, expected) {
+	if (expected !== void 0 && payload.nonce !== expected) throw new JWTError("DPoP nonce is missing or does not match the expected nonce.", "ERR_DPOP_NONCE_INVALID");
+}
+async function consumeValidatedProof(result, consumeProof) {
+	let accepted;
+	try {
+		accepted = await consumeProof({
+			payload: structuredClone(result.payload),
+			thumbprint: result.thumbprint
+		});
+	} catch (cause) {
+		throw new JWTError("DPoP replay consumption failed.", "ERR_DPOP_REPLAY", cause);
+	}
+	if (accepted !== true) throw new JWTError("DPoP proof was rejected by replay consumption.", "ERR_DPOP_REPLAY");
+}
+function asProofError(error) {
+	if (!(error instanceof JWTError)) return new JWTError("DPoP proof verification failed.", "ERR_DPOP_INVALID", error);
+	if (error.code.startsWith("ERR_DPOP_")) return error;
+	const code = error.code.startsWith("ERR_JWT_") ? "ERR_DPOP_CLAIM_INVALID" : "ERR_DPOP_INVALID";
+	return new JWTError(error.message, code, error);
+}
+async function createDPoPProof(target, options) {
+	try {
+		assertPlainObject(options, "options");
+		if (typeof target !== "object" || target === null) throw new JWTError("DPoP target requires method and url.", "ERR_INVALID_OPTION");
+		assertMethod(target.method, "ERR_INVALID_OPTION");
+		const jti = options.jti === void 0 ? crypto.randomUUID() : options.jti;
+		const iat = options.iat === void 0 ? Math.floor(Date.now() / 1e3) : options.iat;
+		assertIdentifier(jti, "ERR_INVALID_OPTION");
+		assertNumericDate(iat, {
+			claim: "iat",
+			code: "ERR_INVALID_OPTION"
+		});
+		const algorithm = resolveProofAlgorithm(options.keyPair, { algorithm: options.algorithm });
+		const payload = {
+			jti,
+			iat,
+			htm: target.method,
+			htu: normalizeTargetURI(target.url, { code: "ERR_INVALID_OPTION" })
+		};
+		for (const claim of ["exp", "nbf"]) {
+			const value = options[claim];
+			if (value !== void 0) {
+				assertNumericDate(value, {
+					claim,
+					code: "ERR_INVALID_OPTION"
+				});
+				payload[claim] = value;
+			}
+		}
+		if (options.nonce !== void 0) {
+			assertNonce(options.nonce, "ERR_INVALID_OPTION");
+			payload.nonce = options.nonce;
+		}
+		if (options.accessToken !== void 0) {
+			assertPlainObject(options.accessToken, "accessToken");
+			payload.ath = await accessTokenHash(options.accessToken.token);
+		}
+		const signingOptions = {
+			alg: algorithm,
+			protectedHeader: {
+				typ: "dpop+jwt",
+				jwk: await publicKeyForProof(options.keyPair, algorithm)
+			}
+		};
+		const privateKey = options.keyPair.privateKey;
+		return await (isCryptoKey(privateKey) ? sign(payload, privateKey, signingOptions) : sign(payload, privateKey, signingOptions));
+	} catch (cause) {
+		if (cause instanceof JWTError) throw cause;
+		throw new JWTError("DPoP proof creation failed.", "ERR_DPOP_INVALID", cause);
+	}
+}
+async function verifyDPoPProof(proof, target, options) {
+	let context;
+	try {
+		context = validateVerifyOptions(target, options);
+	} catch (cause) {
+		throw asJWTError(cause, {
+			code: "ERR_INVALID_OPTION",
+			message: "DPoP verification options are invalid."
+		});
+	}
+	let result;
+	try {
+		result = await authenticateProof(proof, context);
+	} catch (cause) {
+		throw asProofError(cause);
+	}
+	if (context.consumeProof) await consumeValidatedProof(result, context.consumeProof);
+	return result;
+}
+async function authenticateProof(proof, context) {
+	assertCompactToken(proof, "JWS");
+	const header = decodeProtectedHeader(proof.split(".")[0], "JWS");
+	assertDPoPAlgorithm(header.alg, "ERR_DPOP_INVALID");
+	if (header.b64 === false) throw new JWTError("DPoP JWT payloads must use base64url encoding.", "ERR_DPOP_INVALID");
+	const jwk = projectPublicKey(header.jwk, {
+		algorithm: header.alg,
+		code: "ERR_DPOP_INVALID"
+	});
+	const algError = checkAlgAllowed(header.alg, jwk, {
+		ctx: JWS_ALG_CTX,
+		algorithms: context.algorithms
+	});
+	if (algError) throw algError;
+	const key = await jwkTokey(jwk, { alg: header.alg });
+	const { payload } = await verify(proof, key, {
+		algorithms: context.algorithms,
+		typ: "dpop+jwt",
+		currentDate: /* @__PURE__ */ new Date(context.now * 1e3),
+		clockTolerance: context.tolerance
+	});
+	validateProofClaims(payload, context);
+	const keyThumbprint = await thumbprint(jwk);
+	const { accessToken } = context;
+	if (accessToken && (keyThumbprint !== accessToken.thumbprint || payload.ath !== await accessTokenHash(accessToken.token))) throw new JWTError("DPoP access token hash or public key binding does not match.", "ERR_DPOP_CLAIM_INVALID");
+	assertExpectedNonce(payload, context.nonce);
+	return {
+		payload,
+		thumbprint: keyThumbprint
+	};
+}
+export { JWTError, createDPoPProof, isJWTError, verifyDPoPProof };

package/dist/error.d.mts

@@ -0,0 +1,3 @@
+import { UnsecureError, UnsecureErrorCode } from "./_chunks/libs/unsecure.mjs";
+import { JWTError, JWTErrorCauseMap, JWTErrorCode, KnownJWTErrorCode, isJWTError, isUnsecureError } from "./_chunks/error.mjs";
+export { JWTError, JWTErrorCauseMap, JWTErrorCode, KnownJWTErrorCode, UnsecureError, type UnsecureErrorCode, isJWTError, isUnsecureError };

package/dist/error.mjs

@@ -0,0 +1,20 @@
+import { UnsecureError } from "./_chunks/libs/unsecure.mjs";
+var JWTError = class extends Error {
+	code;
+	cause;
+	constructor(message, code, cause) {
+		super(message);
+		this.name = "JWTError";
+		this.code = code;
+		this.cause = cause;
+	}
+};
+function isJWTError(error, code) {
+	if (!(error instanceof JWTError)) return false;
+	return code === void 0 || error.code === code;
+}
+function isUnsecureError(error, code) {
+	if (!(error instanceof UnsecureError)) return false;
+	return code === void 0 || error.code === code;
+}
+export { JWTError, UnsecureError, isJWTError, isUnsecureError };

package/dist/index.d.mts

@@ -1,11 +1,12 @@
-import { BytesSource, DecodeOptions, DecodeReturnAs, UnsecureError, UnsecureErrorCode, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder } from "./_chunks/libs/unsecure.mjs";
-import { CompositeKey, ContentEncryptionAlgorithm, DeriveJWKOptions, DeriveJWKReturn, DeriveKeyOptions, DeriveKeyReturn, Duration, ECDHEphemeralKeyInput, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, GeneratedJWKMap, GeneratedKeyMap, ImportedKey, ImportedKeyMap, ImportedPEMJWK, JOSEConsumerOptions, JOSELimits, JOSEPayload, JOSEPayloadMode, JOSEPayloadTypeMap, JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyLookup, JWEKeyManagementHeaderParameters, JWELibraryHeaderName, JWEMultiDecryptKey, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKMetadata, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_Algorithm, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHashedAlgorithm, JWSHeaderParameters, JWSKeyLookup, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JWTConfirmation, JWTError, JWTErrorCauseMap, JWTErrorCode, JWTTimeClaimOptions, JoseHeaderParameters, KeyManagementAlgorithm, KeyWrapAlgorithmOf, KeyWrappingAlgorithm, KnownJWTErrorCode, MaxTokenAge, NotBeforeIn, PEMType, PayloadOf, StrictOmit, ToPublicJWKReturn, UnwrapKeyOptions, UnwrapKeyResult, UnwrappingKeyFor, WrapKeyOptions, WrapKeyResult, WrappingKeyFor, isJWTError, isUnsecureError } from "./_chunks/index.mjs";
-import { thumbprint } from "./_chunks/index2.mjs";
+import { BytesSource, UnsecureError, UnsecureErrorCode, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder } from "./_chunks/libs/unsecure.mjs";
+import { JWTError, JWTErrorCauseMap, JWTErrorCode, KnownJWTErrorCode, isJWTError, isUnsecureError } from "./_chunks/error.mjs";
+import { CompositeKey, ContentEncryptionAlgorithm, DeriveJWKOptions, DeriveJWKReturn, DeriveKeyOptions, DeriveKeyReturn, Duration, ECDHEphemeralKeyInput, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, GeneratedJWKMap, GeneratedKeyMap, ImportedKey, ImportedKeyMap, ImportedPEMJWK, JOSEConsumerOptions, JOSELimits, JOSEPayload, JOSEPayloadMode, JOSEPayloadTypeMap, JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyLookup, JWEKeyManagementHeaderParameters, JWELibraryHeaderName, JWEMultiDecryptKey, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKMetadata, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_Algorithm, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHashedAlgorithm, JWSHeaderParameters, JWSKeyLookup, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JWTConfirmation, JWTTimeClaimOptions, JoseHeaderParameters, KeyManagementAlgorithm, KeyWrapAlgorithmOf, KeyWrappingAlgorithm, MaxTokenAge, NotBeforeIn, PEMType, PayloadOf, StrictOmit, ToPublicJWKReturn, UnwrapKeyOptions, UnwrapKeyResult, UnwrappingKeyFor, WrapKeyOptions, WrapKeyResult, WrappingKeyFor } from "./_chunks/index.mjs";
+import { WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportJWK, exportKey, exportPEM, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, toPublicJWK, unwrapKey, wrapKey } from "./_chunks/index2.mjs";
+import { thumbprint } from "./_chunks/index3.mjs";
 import { DigestHash, digestUrl } from "./_chunks/digest.mjs";
-import { WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportJWK, exportKey, exportPEM, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, toPublicJWK, unwrapKey, wrapKey } from "./core/jwk.mjs";
 import { computeDurationInSeconds, isJWTContent, validateJwtClaims } from "./_chunks/jwt.mjs";
-import { decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened } from "./_chunks/jwe.mjs";
-import { DEFAULT_JOSE_LIMITS } from "./_chunks/_internal.mjs";
-import { generalToFlattenedJWS, sign, signMulti, verify, verifyMulti, verifyMultiAll } from "./_chunks/jws.mjs";
-import { ComputeJwtTimeClaimsOptions, DecodePayloadOptions, InferAlgorithmsOptions, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeJwtTimeClaims, concatUint8Arrays, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, validateCriticalHeadersJWE, validateCriticalHeadersJWS } from "./_chunks/index3.mjs";
-export { type BytesSource, type CompositeKey, ComputeJwtTimeClaimsOptions, type ContentEncryptionAlgorithm, DEFAULT_JOSE_LIMITS, type DecodeOptions, DecodePayloadOptions, type DecodeReturnAs, type DeriveJWKOptions, type DeriveJWKReturn, type DeriveKeyOptions, type DeriveKeyReturn, type DigestHash, type Duration, type ECDHEphemeralKeyInput, type ExpiresIn, type GenerateJWKOptions, type GenerateJWKReturn, type GenerateKeyAlgorithm, type GenerateKeyOptions, type GenerateKeyReturn, type GeneratedJWKMap, type GeneratedKeyMap, type ImportedKey, type ImportedKeyMap, type ImportedPEMJWK, type InferAlgorithmsOptions, type JOSEConsumerOptions, type JOSELimits, type JOSEPayload, type JOSEPayloadMode, type JOSEPayloadTypeMap, type JWEAsymmetricPrivateJWK, type JWEAsymmetricPublicJWK, type JWEDecryptJWK, type JWEDecryptOptions, type JWEDecryptResult, type JWEEncryptJWK, type JWEEncryptOptions, type JWEFlattenedSerialization, type JWEGeneralRecipient, type JWEGeneralSerialization, type JWEHeaderParameters, type JWEKeyLookup, type JWEKeyManagementHeaderParameters, type JWELibraryHeaderName, type JWEMultiDecryptKey, type JWEMultiDecryptOptions, type JWEMultiDecryptResult, type JWEMultiEncryptOptions, type JWEMultiRecipient, type JWEProtectedHeader, type JWK, type JWKAlgorithm, type JWKCacheAdapter, type JWKLookupFunction, type JWKLookupFunctionHeader, type JWKMetadata, type JWKPEMAlgorithm, type JWKParameters, type JWKSet, type JWK_AES_Algorithm, type JWK_AES_CBC_HMAC, type JWK_AES_GCM, type JWK_AES_GCM_KW, type JWK_AES_KW, type JWK_Asymmetric, type JWK_Asymmetric_Algorithm, type JWK_EC, type JWK_ECDH_ES, type JWK_ECDSA, type JWK_EC_Private, type JWK_EC_Public, type JWK_HMAC, type JWK_OKP, type JWK_OKP_Private, type JWK_OKP_Public, type JWK_OKP_SIGN, type JWK_PBES2, type JWK_Pair, type JWK_Private, type JWK_Public, type JWK_RSA, type JWK_RSA_ENC, type JWK_RSA_PSS, type JWK_RSA_Private, type JWK_RSA_Public, type JWK_RSA_SIGN, type JWK_Symmetric, type JWK_Symmetric_Algorithm, type JWK_oct, type JWSAlgorithm, type JWSAsymmetricPrivateJWK, type JWSAsymmetricPublicJWK, type JWSFlattenedSerialization, type JWSGeneralSerialization, type JWSGeneralSignature, type JWSHashedAlgorithm, type JWSHeaderParameters, type JWSKeyLookup, type JWSMultiSignOptions, type JWSMultiSigner, type JWSMultiVerifyAllOptions, type JWSMultiVerifyOptions, type JWSMultiVerifyOutcome, type JWSMultiVerifyResult, type JWSProtectedHeader, type JWSSignJWK, type JWSSignOptions, type JWSVerifyJWK, type JWSVerifyOptions, type JWSVerifyResult, type JWT, type JWTClaimValidationOptions, type JWTClaims, type JWTConfirmation, JWTError, type JWTErrorCauseMap, type JWTErrorCode, type JWTTimeClaimOptions, type JoseHeaderParameters, type KeyManagementAlgorithm, type KeyWrapAlgorithmOf, type KeyWrappingAlgorithm, type KnownJWTErrorCode, type MaxTokenAge, type NotBeforeIn, type PEMType, type PayloadOf, type StrictOmit, type ToPublicJWKReturn, UnsecureError, type UnsecureErrorCode, type UnwrapKeyOptions, type UnwrapKeyResult, type UnwrappingKeyFor, WeakMapJWKCache, type WrapKeyOptions, type WrapKeyResult, type WrappingKeyFor, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, clearJWKCache, computeDurationInSeconds, computeJwtTimeClaims, concatUint8Arrays, configureJWKCache, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, decrypt, decryptMulti, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, digestUrl, encrypt, encryptMulti, exportJWK, exportKey, exportPEM, generalToFlattened, generalToFlattenedJWS, generateJWK, generateKey, getJWKsFromSet, getPlaintextBytes, importKey, importPEM, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, sign, signMulti, textDecoder, textEncoder, thumbprint, toPublicJWK, unwrapKey, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims, verify, verifyMulti, verifyMultiAll, wrapKey };
+import { decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened } from "./_chunks/index4.mjs";
+import { DEFAULT_JOSE_LIMITS } from "./_chunks/limits.mjs";
+import { generalToFlattenedJWS, sign, signMulti, verify, verifyMulti, verifyMultiAll } from "./_chunks/index5.mjs";
+import { Base64ParseOptions, ComputeJwtTimeClaimsOptions, DecodeOptions, DecodePayloadOptions, DecodeReturnAs, InferAlgorithmsOptions, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeJwtTimeClaims, concatUint8Arrays, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, validateCriticalHeadersJWE, validateCriticalHeadersJWS } from "./_chunks/index6.mjs";
+export { type Base64ParseOptions, type BytesSource, type CompositeKey, ComputeJwtTimeClaimsOptions, type ContentEncryptionAlgorithm, DEFAULT_JOSE_LIMITS, DecodeOptions, DecodePayloadOptions, type DecodeReturnAs, type DeriveJWKOptions, type DeriveJWKReturn, type DeriveKeyOptions, type DeriveKeyReturn, type DigestHash, type Duration, type ECDHEphemeralKeyInput, type ExpiresIn, type GenerateJWKOptions, type GenerateJWKReturn, type GenerateKeyAlgorithm, type GenerateKeyOptions, type GenerateKeyReturn, type GeneratedJWKMap, type GeneratedKeyMap, type ImportedKey, type ImportedKeyMap, type ImportedPEMJWK, type InferAlgorithmsOptions, type JOSEConsumerOptions, type JOSELimits, type JOSEPayload, type JOSEPayloadMode, type JOSEPayloadTypeMap, type JWEAsymmetricPrivateJWK, type JWEAsymmetricPublicJWK, type JWEDecryptJWK, type JWEDecryptOptions, type JWEDecryptResult, type JWEEncryptJWK, type JWEEncryptOptions, type JWEFlattenedSerialization, type JWEGeneralRecipient, type JWEGeneralSerialization, type JWEHeaderParameters, type JWEKeyLookup, type JWEKeyManagementHeaderParameters, type JWELibraryHeaderName, type JWEMultiDecryptKey, type JWEMultiDecryptOptions, type JWEMultiDecryptResult, type JWEMultiEncryptOptions, type JWEMultiRecipient, type JWEProtectedHeader, type JWK, type JWKAlgorithm, type JWKCacheAdapter, type JWKLookupFunction, type JWKLookupFunctionHeader, type JWKMetadata, type JWKPEMAlgorithm, type JWKParameters, type JWKSet, type JWK_AES_Algorithm, type JWK_AES_CBC_HMAC, type JWK_AES_GCM, type JWK_AES_GCM_KW, type JWK_AES_KW, type JWK_Asymmetric, type JWK_Asymmetric_Algorithm, type JWK_EC, type JWK_ECDH_ES, type JWK_ECDSA, type JWK_EC_Private, type JWK_EC_Public, type JWK_HMAC, type JWK_OKP, type JWK_OKP_Private, type JWK_OKP_Public, type JWK_OKP_SIGN, type JWK_PBES2, type JWK_Pair, type JWK_Private, type JWK_Public, type JWK_RSA, type JWK_RSA_ENC, type JWK_RSA_PSS, type JWK_RSA_Private, type JWK_RSA_Public, type JWK_RSA_SIGN, type JWK_Symmetric, type JWK_Symmetric_Algorithm, type JWK_oct, type JWSAlgorithm, type JWSAsymmetricPrivateJWK, type JWSAsymmetricPublicJWK, type JWSFlattenedSerialization, type JWSGeneralSerialization, type JWSGeneralSignature, type JWSHashedAlgorithm, type JWSHeaderParameters, type JWSKeyLookup, type JWSMultiSignOptions, type JWSMultiSigner, type JWSMultiVerifyAllOptions, type JWSMultiVerifyOptions, type JWSMultiVerifyOutcome, type JWSMultiVerifyResult, type JWSProtectedHeader, type JWSSignJWK, type JWSSignOptions, type JWSVerifyJWK, type JWSVerifyOptions, type JWSVerifyResult, type JWT, type JWTClaimValidationOptions, type JWTClaims, type JWTConfirmation, JWTError, type JWTErrorCauseMap, type JWTErrorCode, type JWTTimeClaimOptions, type JoseHeaderParameters, type KeyManagementAlgorithm, type KeyWrapAlgorithmOf, type KeyWrappingAlgorithm, type KnownJWTErrorCode, type MaxTokenAge, type NotBeforeIn, type PEMType, type PayloadOf, type StrictOmit, type ToPublicJWKReturn, UnsecureError, type UnsecureErrorCode, type UnwrapKeyOptions, type UnwrapKeyResult, type UnwrappingKeyFor, WeakMapJWKCache, type WrapKeyOptions, type WrapKeyResult, type WrappingKeyFor, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, clearJWKCache, computeDurationInSeconds, computeJwtTimeClaims, concatUint8Arrays, configureJWKCache, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, decrypt, decryptMulti, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, digestUrl, encrypt, encryptMulti, exportJWK, exportKey, exportPEM, generalToFlattened, generalToFlattenedJWS, generateJWK, generateKey, getJWKsFromSet, getPlaintextBytes, importKey, importPEM, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, sign, signMulti, textDecoder, textEncoder, thumbprint, toPublicJWK, unwrapKey, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims, verify, verifyMulti, verifyMultiAll, wrapKey };

package/dist/index.mjs

@@ -1,8 +1,12 @@
 import { UnsecureError, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder } from "./_chunks/libs/unsecure.mjs";
-import { JWTError, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeDurationInSeconds, concatUint8Arrays, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, validateJwtClaims } from "./_chunks/_jwt-internal.mjs";
+import { JWTError, isJWTError, isUnsecureError } from "./error.mjs";
+import { assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeDurationInSeconds, concatUint8Arrays, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, validateJwtClaims } from "./_chunks/jwt.mjs";
+import { DEFAULT_JOSE_LIMITS, WeakMapJWKCache, clearJWKCache, configureJWKCache, getJWKsFromSet, importKey, thumbprint } from "./_chunks/algorithms.mjs";
 import { digestUrl, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms } from "./_chunks/digest.mjs";
-import { DEFAULT_JOSE_LIMITS, WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportJWK, exportKey, exportPEM, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, thumbprint, toPublicJWK, unwrapKey, wrapKey } from "./_chunks/jwk.mjs";
 import { generalToFlattenedJWS, sign, signMulti, verify, verifyMulti, verifyMultiAll } from "./_chunks/jws.mjs";
 import { decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened } from "./_chunks/jwe.mjs";
-import { applyTypCtyDefaults, assertCritShape, computeJwtTimeClaims, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, validateCriticalHeadersJWE, validateCriticalHeadersJWS } from "./core/utils/index.mjs";
+import { unwrapKey, wrapKey } from "./_chunks/wrap.mjs";
+import { exportJWK, exportKey, toPublicJWK } from "./_chunks/export.mjs";
+import { deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportPEM, generateJWK, generateKey, importPEM } from "./_chunks/jwk.mjs";
+import { applyTypCtyDefaults, assertCritShape, computeJwtTimeClaims, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, validateCriticalHeadersJWE, validateCriticalHeadersJWS } from "./utils/index.mjs";
 export { DEFAULT_JOSE_LIMITS, JWTError, UnsecureError, WeakMapJWKCache, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, clearJWKCache, computeDurationInSeconds, computeJwtTimeClaims, concatUint8Arrays, configureJWKCache, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, decrypt, decryptMulti, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, digestUrl, encrypt, encryptMulti, exportJWK, exportKey, exportPEM, generalToFlattened, generalToFlattenedJWS, generateJWK, generateKey, getJWKsFromSet, getPlaintextBytes, importKey, importPEM, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, sign, signMulti, textDecoder, textEncoder, thumbprint, toPublicJWK, unwrapKey, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims, verify, verifyMulti, verifyMultiAll, wrapKey };

package/dist/session/index.d.mts

@@ -1,8 +1,8 @@
-import { CookieJar, JWESessionConfig, JWESessionHooks, JWSSessionConfig, JWSSessionHooks, OpenedSessionState, SessionClaims, SessionData, SessionDecryptOptions, SessionDefinition, SessionDriver, SessionEncryptOptions, SessionHandedToken, SessionIssueOptions, SessionManager, SessionRecord, SessionRequestEvent, SessionSignOptions, SessionState, SessionUpdate, SessionUpdateTrigger, SessionVerifyOptions, WebSessionEvent } from "../_chunks/_codec-jwe.mjs";
-import { CookieAttributes } from "../_chunks/_cookie-attributes.mjs";
+import { CookieJar, JWESessionConfig, JWESessionHooks, JWSSessionConfig, JWSSessionHooks, OpenedSessionState, SessionClaims, SessionData, SessionDecryptOptions, SessionDefinition, SessionDriver, SessionEncryptOptions, SessionHandedToken, SessionIssueOptions, SessionManager, SessionRecord, SessionRequestEvent, SessionSignOptions, SessionState, SessionUpdate, SessionUpdateTrigger, SessionVerifyOptions, WebSessionEvent } from "../_chunks/codec-jwe.mjs";
+import { CookieAttributes } from "../_chunks/cookie-attributes.mjs";
 import { CompositeKey, ContentEncryptionAlgorithm, DeriveJWKOptions, DeriveJWKReturn, DeriveKeyOptions, DeriveKeyReturn, Duration, ECDHEphemeralKeyInput, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, GeneratedJWKMap, GeneratedKeyMap, ImportedKey, ImportedKeyMap, ImportedPEMJWK, JOSEConsumerOptions, JOSELimits, JOSEPayload, JOSEPayloadMode, JOSEPayloadTypeMap, JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyLookup, JWEKeyManagementHeaderParameters, JWELibraryHeaderName, JWEMultiDecryptKey, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKMetadata, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_Algorithm, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHashedAlgorithm, JWSHeaderParameters, JWSKeyLookup, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JWTConfirmation, JWTTimeClaimOptions, JoseHeaderParameters, KeyManagementAlgorithm, KeyWrapAlgorithmOf, KeyWrappingAlgorithm, MaxTokenAge, NotBeforeIn, PEMType, PayloadOf, ToPublicJWKReturn, UnwrapKeyOptions, UnwrapKeyResult, UnwrappingKeyFor, WrapKeyOptions, WrapKeyResult, WrappingKeyFor } from "../_chunks/index.mjs";
-import { thumbprint } from "../_chunks/index2.mjs";
-import { deriveJWKFromPassword, exportPEM, generateJWK, importPEM, toPublicJWK } from "../core/jwk.mjs";
+import { deriveJWKFromPassword, exportPEM, generateJWK, importPEM, toPublicJWK } from "../_chunks/index2.mjs";
+import { thumbprint } from "../_chunks/index3.mjs";
 /** Session state for the current request, mirroring the claims of its JWS token. */
 interface SessionJWS<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> extends SessionState<T, MaxAge> {}
 /** JWS session hooks; `onRead`, `onExpire` and `onError` are mutually exclusive per token. */

package/dist/session/index.mjs

@@ -1,48 +1,8 @@
-import { deriveJWKFromPassword, exportPEM, generateJWK, importPEM, thumbprint, toPublicJWK } from "../_chunks/jwk.mjs";
-import { createJWECodec, createJWSCodec, defineSession, invalidConfigError, setCookieName, setCookieValues } from "../_chunks/_codec-jws.mjs";
-import { parse, parseSetCookie, serialize } from "../_chunks/libs/cookie-es.mjs";
-function webCookieJar(request, headers) {
-	let cookies;
-	const jar = { read: (name) => (cookies ||= requestCookies(request))[name] };
-	if (headers) {
-		jar.written = (name) => setCookieValues(headers.getSetCookie())[name];
-		jar.write = (name, value, attrs) => {
-			setCookie(headers, {
-				name,
-				value,
-				...attrs
-			});
-		};
-	}
-	return jar;
-}
-function requestCookies(request) {
-	const header = request.get("cookie");
-	return header ? parse(header) : Object.create(null);
-}
-function setCookie(headers, cookie) {
-	const line = serialize({
-		path: "/",
-		...cookie
-	});
-	const key = cookieKey(cookie);
-	const kept = headers.getSetCookie().filter((existing) => {
-		const parsed = parseSetCookie(existing);
-		return parsed ? cookieKey(parsed) !== key : setCookieName(existing) !== cookie.name;
-	});
-	headers.delete("set-cookie");
-	for (const existing of kept) headers.append("set-cookie", existing);
-	headers.append("set-cookie", line);
-}
-function cookieKey(cookie) {
-	const domain = (cookie.domain || "").replace(/^\./, "").toLowerCase();
-	return [
-		cookie.name,
-		domain,
-		cookie.path || "/",
-		cookie.partitioned ? "1" : "0"
-	].join(";");
-}
+import { thumbprint } from "../_chunks/algorithms.mjs";
+import { toPublicJWK } from "../_chunks/export.mjs";
+import { deriveJWKFromPassword, exportPEM, generateJWK, importPEM } from "../_chunks/jwk.mjs";
+import { createJWECodec, createJWSCodec, defineSession, invalidConfigError } from "../_chunks/codec-jws.mjs";
+import { webCookieJar } from "../_chunks/cookie.mjs";
 const PREFIX = "[unjwt/session]";
 const SESSIONS = /* @__PURE__ */ new WeakMap();
 const webSessionDriver = {
@@ -53,7 +13,7 @@ const webSessionDriver = {
 		return sessionsOf(event.req ? webRequest(event.req) : event);
 	},
 	header: (event, name) => isHanded(event) ? void 0 : requestHeaders(event).get(name),
-	cookies: (event) => isHanded(event) ? { read: () => void 0 } : webCookieJar(requestHeaders(event), event.res?.headers),
+	cookies: (event) => isHanded(event) ? { read: () => void 0 } : webCookieJar(requestHeaders(event), event.res),
 	handed: (event) => isHanded(event) ? { token: event.token } : void 0
 };
 function isHanded(event) {

package/dist/utils/index.d.mts

@@ -0,0 +1,7 @@
+import { BytesSource, UnsecureError, UnsecureErrorCode, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder } from "../_chunks/libs/unsecure.mjs";
+import { isUnsecureError } from "../_chunks/error.mjs";
+import { StrictOmit } from "../_chunks/index.mjs";
+import { DigestHash, digestUrl } from "../_chunks/digest.mjs";
+import { computeDurationInSeconds, isJWTContent, validateJwtClaims } from "../_chunks/jwt.mjs";
+import { Base64ParseOptions, ComputeJwtTimeClaimsOptions, DecodeOptions, DecodePayloadOptions, DecodeReturnAs, InferAlgorithmsOptions, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeJwtTimeClaims, concatUint8Arrays, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, validateCriticalHeadersJWE, validateCriticalHeadersJWS } from "../_chunks/index6.mjs";
+export { type Base64ParseOptions, type BytesSource, ComputeJwtTimeClaimsOptions, DecodeOptions, DecodePayloadOptions, type DecodeReturnAs, type DigestHash, type InferAlgorithmsOptions, type StrictOmit, UnsecureError, type UnsecureErrorCode, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeDurationInSeconds, computeJwtTimeClaims, concatUint8Arrays, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, digestUrl, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims };

package/dist/{core/utils → utils}/index.mjs

@@ -1,6 +1,7 @@
-import { UnsecureError, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder } from "../../_chunks/libs/unsecure.mjs";
-import { applyTypDefault, assertCritShape as assertCritShape$1, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeDurationInSeconds, computeJwtTimeClaims as computeJwtTimeClaims$1, concatUint8Arrays, getPlaintextBytes as getPlaintextBytes$1, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, parsePayloadBytes, parsePayloadSegment, validateCriticalHeadersJWE as validateCriticalHeadersJWE$1, validateCriticalHeadersJWS as validateCriticalHeadersJWS$1, validateJwtClaims } from "../../_chunks/_jwt-internal.mjs";
-import { digestUrl, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms } from "../../_chunks/digest.mjs";
+import { UnsecureError, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder } from "../_chunks/libs/unsecure.mjs";
+import { isUnsecureError } from "../error.mjs";
+import { applyTypDefault, assertCritShape as assertCritShape$1, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeDurationInSeconds, computeJwtTimeClaims as computeJwtTimeClaims$1, concatUint8Arrays, getPlaintextBytes as getPlaintextBytes$1, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, parsePayloadBytes, parsePayloadSegment, validateCriticalHeadersJWE as validateCriticalHeadersJWE$1, validateCriticalHeadersJWS as validateCriticalHeadersJWS$1, validateJwtClaims } from "../_chunks/jwt.mjs";
+import { digestUrl, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms } from "../_chunks/digest.mjs";
 const applyTypCtyDefaults = applyTypDefault;
 const decodePayloadFromBytes = parsePayloadBytes;
 const decodePayloadFromB64UrlSegment = parsePayloadSegment;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.8.3",
+  "version": "0.8.5",
   "description": "A collection of JWT utilities based on the Web Crypto API.",
   "keywords": [
     "auth",
@@ -40,6 +40,9 @@
   "sideEffects": false,
   "main": "./dist/index.mjs",
   "module": "./dist/index.mjs",
+  "browser": {
+    "buffer": false
+  },
   "types": "./dist/index.d.mts",
   "exports": {
     ".": {
@@ -47,25 +50,33 @@
       "default": "./dist/index.mjs"
     },
     "./jwk": {
-      "types": "./dist/core/jwk.d.mts",
-      "default": "./dist/core/jwk.mjs"
+      "types": "./dist/core/jwk/index.d.mts",
+      "default": "./dist/core/jwk/index.mjs"
     },
     "./jws": {
-      "types": "./dist/core/jws.d.mts",
-      "default": "./dist/core/jws.mjs"
+      "types": "./dist/core/jws/index.d.mts",
+      "default": "./dist/core/jws/index.mjs"
     },
     "./jwe": {
-      "types": "./dist/core/jwe.d.mts",
-      "default": "./dist/core/jwe.mjs"
+      "types": "./dist/core/jwe/index.d.mts",
+      "default": "./dist/core/jwe/index.mjs"
     },
     "./utils": {
-      "types": "./dist/core/utils/index.d.mts",
-      "default": "./dist/core/utils/index.mjs"
+      "types": "./dist/utils/index.d.mts",
+      "default": "./dist/utils/index.mjs"
+    },
+    "./error": {
+      "types": "./dist/error.d.mts",
+      "default": "./dist/error.mjs"
     },
     "./session": {
       "types": "./dist/session/index.d.mts",
       "default": "./dist/session/index.mjs"
     },
+    "./dpop": {
+      "types": "./dist/dpop/index.d.mts",
+      "default": "./dist/dpop/index.mjs"
+    },
     "./internal": {
       "types": "./dist/core/internal.d.mts",
       "default": "./dist/core/internal.mjs"
@@ -105,7 +116,7 @@
     "simple-git-hooks": "^2.14.0",
     "supertest": "^7.3.1",
     "typescript": "^7.0.2",
-    "unsecure": "^0.3.2",
+    "unsecure": "^0.3.4",
     "vitest": "^5.0.4"
   },
   "peerDependencies": {
@@ -142,6 +153,7 @@
     "dev:nitro": "pnpm --dir playgrounds/nitro dev",
     "dev:prepare": "obuild --stub && pnpm --dir playgrounds/nuxt-4 prepare && pnpm simple-git-hooks",
     "lint": "oxlint --deny-warnings . && oxfmt --check .",
+    "size": "vitest run test/bundle.test.ts --reporter=./test/_size-reporter.ts",
     "fmt": "automd && oxlint --fix . && oxfmt .",
     "test": "vitest run --slowTestThreshold=1000",
     "test:coverage": "vitest run --coverage --slowTestThreshold=1000",

package/dist/core/jwe.mjs

@@ -1,5 +0,0 @@
-import { UnsecureError } from "../_chunks/libs/unsecure.mjs";
-import { JWTError, isJWTError, isUnsecureError } from "../_chunks/_jwt-internal.mjs";
-import { DEFAULT_JOSE_LIMITS } from "../_chunks/jwk.mjs";
-import { decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened } from "../_chunks/jwe.mjs";
-export { DEFAULT_JOSE_LIMITS, JWTError, UnsecureError, decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened, isJWTError, isUnsecureError };