unjwt 0.8.4 → 0.8.5

package/dist/_chunks/jwk.d.mts

@@ -1,205 +0,0 @@
-import { ContentEncryptionAlgorithm, DeriveJWKOptions, DeriveJWKReturn, DeriveKeyOptions, DeriveKeyReturn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, ImportedKey, ImportedPEMJWK, JWK, JWKAlgorithm, JWKCacheAdapter, JWKMetadata, JWKPEMAlgorithm, JWKSet, JWK_Asymmetric, JWK_ECDH_ES, JWK_EC_Private, JWK_EC_Public, JWK_PBES2, JWK_oct, KeyManagementAlgorithm, PEMType, ToPublicJWKReturn, UnwrapKeyOptions, UnwrapKeyResult, UnwrappingKeyFor, WrapKeyOptions, WrapKeyResult, WrappingKeyFor } from "./index.mjs";
-import "./index2.mjs";
-/**
- * Default JWK import cache, keyed by JWK object identity: a copied JWK misses it, and a JWK
- * mutated in place keeps serving the old `CryptoKey`. Rotate by replacing the object.
- */
-export declare class WeakMapJWKCache implements JWKCacheAdapter {
-  private readonly _map;
-  get(jwk: JWK, alg: JWKAlgorithm): CryptoKey | undefined;
-  set(jwk: JWK, alg: JWKAlgorithm, key: CryptoKey): void;
-}
-/**
- * Replaces the JWK import cache used by `importKey`, or disables it with `false`.
- *
- * A cache shared across JWK objects keys on the RFC 7638 thumbprint, the pair half (`d` present)
- * and `alg`: the thumbprint covers public members only, and a `kid` may name different keys.
- * `get` and `set` may return promises.
- *
- * @example
- * ```ts
- * const cacheKey = async (jwk: JWK, alg: JWKAlgorithm) =>
- *   `${await thumbprint(jwk)}:${"d" in jwk ? "private" : "public"}:${alg}`;
- * const map = new Map<string, CryptoKey>();
- * configureJWKCache({
- *   get: async (jwk, alg) => map.get(await cacheKey(jwk, alg)),
- *   set: async (jwk, alg, key) => {
- *     map.set(await cacheKey(jwk, alg), key);
- *   },
- * });
- * ```
- */
-export declare function configureJWKCache(cache: JWKCacheAdapter | false): void;
-/** Resets the JWK import cache to a fresh `WeakMapJWKCache`. */
-export declare function clearJWKCache(): void;
-/** Imports the secret of an `oct` JWK as a `CryptoKey` under `algorithm` and `usage`. */
-export declare function importKey(key: JWK_oct, options: {
-  asCryptoKey: true;
-  /** Algorithm to import the key as (e.g. `{ name: "AES-GCM", length: 256 }`). */
-  algorithm: Parameters<typeof crypto.subtle.importKey>[2];
-  usage: KeyUsage[];
-  /** Mark the key as extractable. Defaults to `false`. */
-  extractable?: boolean;
-}): Promise<CryptoKey>;
-/**
- * Imports key material: a `CryptoKey` or `Uint8Array` is returned as is, an `oct` JWK as its raw
- * bytes, an asymmetric JWK as a `CryptoKey` under its own `alg` or the hint. A string throws
- * `ERR_JWK_INVALID`.
- *
- * `expect` and `extractable` apply to asymmetric keys only; `expect` rejects the other pair half
- * with `ERR_JWK_INVALID`. A JWK's `alg` is authoritative (RFC 7517 §4.4): a different requested
- * `alg` throws `ERR_JWK_INVALID`, except an `oct` JWK declaring a content encryption `alg` under
- * `"dir"`.
- */
-export declare function importKey<K extends CryptoKey | JWK | Uint8Array<ArrayBuffer>>(key: K, options?: JWKAlgorithm | {
-  /** Algorithm hint. Required when `key.alg` is absent on an asymmetric JWK. */
-  alg?: JWKAlgorithm;
-  /** Reject on shape mismatch instead of silently importing. */
-  expect?: "public" | "private";
-  /** Defaults to `false` for private, `true` for public material; JWK `ext: false` wins. */
-  extractable?: boolean;
-}): Promise<ImportedKey<K>>;
-/**
- * Returns the JWKs of a JWK Set, dropping non-JWK entries, optionally narrowed by `filter`.
- * An invalid set throws `ERR_JWK_INVALID`.
- */
-export declare function getJWKsFromSet(jwkSet: JWKSet, filter?: (jwk: JWK) => boolean): JWK[];
-/**
- * Generates a key for a JWA algorithm: a `CryptoKey` for symmetric algorithms, raw bytes for
- * the `A*CBC-HS*` composites, a `CryptoKeyPair` for asymmetric ones; with `toJWK: true`, a JWK
- * (or JWK pair) named by the `kid` option or its RFC 7638 thumbprint. PBES2, `"dir"` and `"none"` are refused.
- *
- * @param options
- *   - `extractable?` — defaults to `true`; ignored when `toJWK` is set.
- *   - `kid?` — with `toJWK`, a string set verbatim or `false` for no `kid`, either skipping the
- *     thumbprint digest; anything else throws `ERR_INVALID_OPTION`.
- *   - `keyUsage?` — narrows the usages derived from `alg`; leaving either half of a pair with
- *     no usage throws `ERR_INVALID_OPTION`.
- *   - `modulusLength?` — RSA only; defaults to `2048`.
- *   - `publicExponent?` — RSA only; big-endian bytes, defaults to `0x010001`.
- *   - `namedCurve?` — EC/OKP only; defaults to `"P-256"` / `"Ed25519"`. One that contradicts
- *     the curve `ES*` or `Ed25519` names throws `ERR_INVALID_OPTION`.
- */
-export declare function generateKey<TAlg extends GenerateKeyAlgorithm, ToJWK extends boolean = false, Kid extends string | false = string>(alg: TAlg, options?: GenerateKeyOptions<ToJWK, Kid>): Promise<GenerateKeyReturn<TAlg, GenerateKeyOptions<ToJWK, Kid>>>;
-/**
- * Generates a JWK (or JWK pair) for a JWA algorithm, its `kid` the caller's, none with
- * `kid: false`, or else its RFC 7638 thumbprint. PBES2, `"dir"` and `"none"` are refused.
- *
- * @param options
- *   - `keyUsage?`, `modulusLength?` (default `2048`), `publicExponent?` (default `0x010001`),
- *     `namedCurve?` (default `"P-256"` / `"Ed25519"`); a narrowing that empties a pair half or
- *     a curve that contradicts `alg` throws `ERR_INVALID_OPTION`.
- *   - `kid?` — a string set verbatim or `false` for no `kid`, either skipping the thumbprint
- *     digest; anything else throws `ERR_INVALID_OPTION`.
- *   - JWK metadata (`use`, `x5c`, `x5t`, `x5t#S256`, `x5u`) is merged onto the result;
- *     `alg`, `kty`, `key_ops`, `ext` and key-material members are reserved (`ERR_INVALID_OPTION`).
- */
-export declare function generateJWK<TAlg extends GenerateKeyAlgorithm, Kid extends string | false = string>(alg: TAlg, options?: GenerateJWKOptions<Kid> & Omit<JWKMetadata, "kid">): Promise<GenerateJWKReturn<TAlg, Kid>>;
-/**
- * Derives an AES-KW key from a password with PBKDF2 per PBES2 (RFC 7518 §4.8).
- *
- * @param options
- *   - `alg` — a PBES2 algorithm; any other throws `ERR_JWK_UNSUPPORTED`.
- *   - `salt` — PBKDF2 salt (`p2s`), at least 8 octets (RFC 7518 §4.8.1.1).
- *   - `iterations` — PBKDF2 count (`p2c`), an integer of at least 1000 (RFC 7518 §4.8.1.2);
- *     anything else throws `ERR_INVALID_OPTION`.
- *   - `keyUsage?` — defaults to `["wrapKey", "unwrapKey"]`.
- *   - `extractable?` — defaults to `false`; ignored when `toJWK` is set.
- *   - `toJWK?` — return a `JWK_oct` carrying the inner AES-KW `alg` instead of a `CryptoKey`.
- */
-export declare function deriveKeyFromPassword<TOptions extends DeriveKeyOptions>(password: string | Uint8Array<ArrayBuffer>, options: TOptions): Promise<DeriveKeyReturn<TOptions, TOptions["alg"]>>;
-/**
- * Derives a `JWK_oct` from a password per PBES2 (RFC 7518 §4.8); its `alg` is the inner AES-KW
- * variant and its `kid` the caller's, none with `kid: false`, or else its RFC 7638 thumbprint.
- *
- * @param options
- *   - `alg` (PBES2 only, else `ERR_JWK_UNSUPPORTED`), `salt` (at least 8 octets), `iterations`
- *     (integer of at least 1000, else `ERR_INVALID_OPTION`), `keyUsage?` (default
- *     `["wrapKey", "unwrapKey"]`).
- *   - `kid?` — a string set verbatim or `false` for no `kid`, either skipping the thumbprint
- *     digest; anything else throws `ERR_INVALID_OPTION`.
- *   - JWK metadata (`use`, `x5c`, `x5t`, `x5t#S256`, `x5u`) is merged onto the result;
- *     `alg`, `kty`, `key_ops`, `ext` and key-material members are reserved (`ERR_INVALID_OPTION`).
- */
-export declare function deriveJWKFromPassword<TAlg extends JWK_PBES2, Kid extends string | false = string>(password: string | Uint8Array<ArrayBuffer>, options: DeriveJWKOptions<TAlg, Kid> & Omit<JWKMetadata, "kid">): Promise<DeriveJWKReturn<TAlg, Kid>>;
-/**
- * Exports an extractable `CryptoKey` as a JWK, merging optional `jwkParams` metadata.
- *
- * The `alg` is WebCrypto's, which knows no JOSE roles: an AES-GCM key minted for `A128GCMKW`
- * exports as `A128GCM`, so key-wrapping keys are minted with `generateJWK` instead.
- *
- * @throws `ERR_INVALID_OPTION` if `key` is not a `CryptoKey` or `jwkParams` sets a reserved member
- *   (`alg`, `kty`, `key_ops`, `ext`, key material); `ERR_JWK_INVALID` for a non-extractable key.
- */
-export declare function exportJWK<T extends JWK = JWK>(key: CryptoKey, jwkParams?: JWKMetadata): Promise<T>;
-/** @deprecated Use `exportJWK`; removed in 0.9.0. */
-export declare function exportKey<T extends JWK = JWK>(key: CryptoKey, jwkParams?: JWKMetadata): Promise<T>;
-/**
- * Utility to derive the public half of an asymmetric JWK, or throw if the input is not asymmetric.
- *
- * @param jwk An asymmetric JWK (EC, OKP, RSA) with a private scalar (`d`).
- * @throws `ERR_JWK_INVALID` if the input is not an asymmetric JWK.
- * @returns A JWK with the same public members, without the private scalar.
- */
-export declare function toPublicJWK<T extends JWK_Asymmetric>(jwk: T): ToPublicJWKReturn<T>;
-/**
- * Wraps a CEK under a JWA key management algorithm; the result shape follows `alg`.
- *
- * @param wrappingKey A `CryptoKey`, a JWK, or for PBES2 a password string or bytes.
- * @param options `alg` plus its parameters (`p2s`/`p2c` for PBES2, `ecdh` for ECDH-ES, …).
- */
-export declare function wrapKey<TAlg extends KeyManagementAlgorithm>(keyToWrap: CryptoKey | Uint8Array<ArrayBuffer>, wrappingKey: WrappingKeyFor<TAlg>, options: WrapKeyOptions<TAlg>): Promise<WrapKeyResult<TAlg>>;
-/**
- * Unwraps a CEK under a JWA key management algorithm.
- *
- * @param unwrappingKey A `CryptoKey`, a JWK, or for PBES2 a password string or bytes.
- * @param options `alg`, `format?` (`"cryptokey"` by default, or `"raw"`), plus the algorithm's
- *   parameters (`iv`/`tag`, `p2s`/`p2c`, `epk`, …).
- * @throws `ERR_JWE_DECRYPTION_FAILED` for any failed unwrap, its cause undisclosed (RFC 7516
- *   §11.5); `ERR_INVALID_OPTION` for a malformed `wrappedKey` or `options`; `ERR_JWE_INVALID` for
- *   missing or malformed algorithm parameters.
- */
-export declare function unwrapKey<TOptions extends UnwrapKeyOptions>(wrappedKey: Uint8Array<ArrayBuffer>, unwrappingKey: UnwrappingKeyFor<TOptions["alg"]>, options: TOptions): Promise<UnwrapKeyResult<TOptions>>;
-/**
- * Imports a PEM key as a JWK carrying `alg`. The type follows the label — `PRIVATE KEY`
- * (PKCS#8), `PUBLIC KEY` (SPKI), `CERTIFICATE` (X.509, only its SPKI kept) — unless
- * `options.pemType` overrides it. The JWK holds the key material in plain JavaScript.
- *
- * @throws `ERR_JWK_INVALID` if the type cannot be inferred or does not match the label;
- *   `ERR_JWK_UNSUPPORTED` for an unknown `pemType`; `ERR_INVALID_OPTION` if `jwkParams` sets
- *   `alg`, `kty`, `key_ops`, `ext` or a key-material member.
- */
-export declare function importPEM<A extends JWKPEMAlgorithm, Type extends PEMType | undefined = undefined>(pem: string, alg: A, options?: {
-  /** PEM type. Inferred from the PEM label when omitted, which leaves the result public or private. */
-  pemType?: Type;
-  /** Additional JWK properties merged into the exported key (e.g. `kid`). */
-  jwkParams?: JWKMetadata;
-}): Promise<ImportedPEMJWK<A, Type>>;
-/**
- * Exports an asymmetric JWK as PEM: PKCS#8 when it carries `d`, SPKI otherwise.
- *
- * @throws `ERR_JWK_UNSUPPORTED` for `oct` JWKs or an unknown format or algorithm;
- *   `ERR_JWK_INVALID` for a missing `alg` or a `pemFormat` that contradicts the JWK's half.
- */
-export declare function exportPEM(jwk: JWK, options?: {
-  /** PEM format. Inferred from the JWK shape when omitted. */
-  pemFormat?: "pkcs8" | "spki";
-  /** Algorithm hint used when `jwk.alg` is absent. */
-  alg?: JWKPEMAlgorithm;
-}): Promise<string>;
-/**
- * Derives ECDH-ES key material (RFC 7518 §4.6): ECDH followed by the Concat KDF.
- *
- * @param publicKey The recipient's static public key (the ephemeral one when decrypting).
- * @param privateKey The ephemeral private key (the recipient's static one when decrypting).
- */
-export declare function deriveSharedSecret(publicKey: CryptoKey | JWK_EC_Public, privateKey: CryptoKey | JWK_EC_Private, options: {
-  /** Algorithm identifier fed to the concat KDF as `AlgorithmID`. */
-  enc: JWK_ECDH_ES | ContentEncryptionAlgorithm;
-  /** Derived length in bits. Defaults to `enc`'s length; required for `"ECDH-ES"`. */
-  keyLength?: number;
-  /** Agreement PartyUInfo (apu). */
-  partyUInfo?: Uint8Array<ArrayBuffer>;
-  /** Agreement PartyVInfo (apv). */
-  partyVInfo?: Uint8Array<ArrayBuffer>;
-}): Promise<Uint8Array<ArrayBuffer>>;

package/dist/core/jwe.mjs

@@ -1,5 +0,0 @@
-import { UnsecureError } from "../_chunks/libs/unsecure.mjs";
-import { JWTError, isJWTError, isUnsecureError } from "../_chunks/_jwt-internal.mjs";
-import { DEFAULT_JOSE_LIMITS } from "../_chunks/_import-key.mjs";
-import { decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened } from "../_chunks/jwe.mjs";
-export { DEFAULT_JOSE_LIMITS, JWTError, UnsecureError, decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened, isJWTError, isUnsecureError };

package/dist/core/jws.mjs

@@ -1,5 +0,0 @@
-import { UnsecureError } from "../_chunks/libs/unsecure.mjs";
-import { JWTError, isJWTError, isUnsecureError } from "../_chunks/_jwt-internal.mjs";
-import { DEFAULT_JOSE_LIMITS } from "../_chunks/_import-key.mjs";
-import { generalToFlattenedJWS, sign, signMulti, verify, verifyMulti, verifyMultiAll } from "../_chunks/jws.mjs";
-export { DEFAULT_JOSE_LIMITS, JWTError, UnsecureError, generalToFlattenedJWS, isJWTError, isUnsecureError, sign, signMulti, verify, verifyMulti, verifyMultiAll };

package/dist/core/utils/index.d.mts

@@ -1,6 +0,0 @@
-import { BytesSource, DecodeOptions, DecodeReturnAs, UnsecureError, UnsecureErrorCode, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder } from "../../_chunks/libs/unsecure.mjs";
-import { StrictOmit, isUnsecureError } from "../../_chunks/index.mjs";
-import { DigestHash, digestUrl } from "../../_chunks/digest.mjs";
-import { computeDurationInSeconds, isJWTContent, validateJwtClaims } from "../../_chunks/jwt.mjs";
-import { ComputeJwtTimeClaimsOptions, DecodePayloadOptions, InferAlgorithmsOptions, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeJwtTimeClaims, concatUint8Arrays, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, validateCriticalHeadersJWE, validateCriticalHeadersJWS } from "../../_chunks/index3.mjs";
-export { type BytesSource, ComputeJwtTimeClaimsOptions, type DecodeOptions, DecodePayloadOptions, type DecodeReturnAs, type DigestHash, type InferAlgorithmsOptions, type StrictOmit, UnsecureError, type UnsecureErrorCode, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeDurationInSeconds, computeJwtTimeClaims, concatUint8Arrays, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, digestUrl, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims };