unjwt 0.8.5 → 0.9.1

package/dist/_chunks/jwt2.mjs

@@ -0,0 +1,162 @@
+import { safeJsonParse, textEncoder } from "./libs/unsecure.mjs";
+import { JWTError } from "../error.mjs";
+import { base64UrlParse, computeDurationInSeconds, isPlainObject, parseDurationSeconds } from "./jwt.mjs";
+const MAX_QUOTED_VALUE = 64;
+function quoteTokenValue(value) {
+	const text = String(value);
+	return JSON.stringify(text.length > MAX_QUOTED_VALUE ? `${text.slice(0, MAX_QUOTED_VALUE)}…` : text);
+}
+function applyTypDefault(header, payload) {
+	const declared = header.typ;
+	if (declared !== void 0 && typeof declared !== "string") throw new JWTError("\"typ\" must be a string.", "ERR_INVALID_OPTION");
+	if (declared === void 0 && typeof payload === "object" && payload !== null && !(payload instanceof Uint8Array)) header.typ = "JWT";
+	return header;
+}
+function parsePayloadBytes(bytes, options) {
+	const mode = options?.payload ?? "json";
+	if (mode === "bytes") return bytes;
+	const family = options?.family ?? "JWS";
+	const text = parsePayloadText(bytes, { family });
+	if (mode === "string") return text;
+	return _parsePayloadObject(text, family);
+}
+function parsePayloadText(bytes, options) {
+	const family = options?.family ?? "JWS";
+	try {
+		return _utf8Decoder.decode(bytes);
+	} catch (error) {
+		throw new JWTError(`Invalid ${family}: Payload is not valid UTF-8.`, `ERR_${family}_INVALID`, error);
+	}
+}
+function parsePayloadSegment(payloadEncoded, options) {
+	return parsePayloadBytes(base64UrlParse(payloadEncoded, { returnAs: "uint8array" }), options);
+}
+function getPlaintextBytes(payload) {
+	if (payload instanceof Uint8Array) return payload;
+	if (typeof payload === "string") return textEncoder.encode(payload);
+	if (typeof payload === "object" && payload !== null) {
+		let json;
+		try {
+			json = JSON.stringify(payload);
+		} catch (error) {
+			throw new JWTError("Payload is not JSON-serializable.", "ERR_INVALID_OPTION", error);
+		}
+		return textEncoder.encode(json);
+	}
+	throw new JWTError("Plaintext must be a string, Uint8Array, or a JSON-serializable object.", "ERR_INVALID_OPTION");
+}
+function computeJwtTimeClaims(payload, options) {
+	const { currentDate, issuedAt, expiresIn, expiresAt, notBeforeIn, notBeforeAt } = options ?? {};
+	if (issuedAt !== void 0 && typeof issuedAt !== "boolean" && !(issuedAt instanceof Date)) throw new JWTError("\"issuedAt\" must be a boolean or a Date.", "ERR_INVALID_OPTION");
+	if (expiresIn !== void 0 && expiresAt !== void 0) throw new JWTError("\"expiresIn\" and \"expiresAt\" are mutually exclusive.", "ERR_JWT_CLAIM_INVALID");
+	if (notBeforeIn !== void 0 && notBeforeAt !== void 0) throw new JWTError("\"notBeforeIn\" and \"notBeforeAt\" are mutually exclusive.", "ERR_JWT_CLAIM_INVALID");
+	const hasExpHint = expiresIn !== void 0 || expiresAt !== void 0;
+	const hasNbfHint = notBeforeIn !== void 0 || notBeforeAt !== void 0;
+	const hasIatHint = issuedAt === true || issuedAt instanceof Date;
+	if (!hasExpHint && !hasNbfHint && !hasIatHint) return void 0;
+	if (!payload || typeof payload !== "object" || payload instanceof Uint8Array) {
+		const option = Object.entries({
+			expiresIn,
+			expiresAt,
+			notBeforeIn,
+			notBeforeAt
+		}).find(([, value]) => value !== void 0)?.[0] ?? "issuedAt";
+		throw new JWTError(`"${option}" needs a JSON payload: pass an object payload or drop the option.`, "ERR_INVALID_OPTION");
+	}
+	const wantsExp = hasExpHint && (!("exp" in payload) || payload.exp === void 0);
+	const wantsNbf = hasNbfHint && (!("nbf" in payload) || payload.nbf === void 0);
+	const wantsIat = hasIatHint && (!("iat" in payload) || payload.iat === void 0);
+	if (!wantsExp && !wantsNbf && !wantsIat) return void 0;
+	const now = Math.floor((currentDate ?? /* @__PURE__ */ new Date()).getTime() / 1e3);
+	const claims = { ...payload };
+	claims.iat ??= issuedAt instanceof Date ? Math.floor(_instantOf(issuedAt, "issuedAt") / 1e3) : now;
+	if (wantsExp) {
+		if (expiresAt !== void 0) claims.exp = Math.floor(_instantOf(expiresAt, "expiresAt") / 1e3);
+		else if (expiresIn !== void 0) claims.exp = now + computeDurationInSeconds(expiresIn);
+	}
+	if (wantsNbf) {
+		if (notBeforeAt !== void 0) claims.nbf = Math.floor(_instantOf(notBeforeAt, "notBeforeAt") / 1e3);
+		else if (notBeforeIn !== void 0) {
+			const offset = parseDurationSeconds(notBeforeIn);
+			if (offset < 0) throw new JWTError("\"notBeforeIn\" must be zero or a positive duration.", "ERR_JWT_CLAIM_INVALID");
+			claims.nbf = now + offset;
+		}
+	}
+	return claims;
+}
+const BASE_PROCESSED = /* @__PURE__ */ Object.freeze({
+	JWS: ["b64"],
+	JWE: []
+});
+function validateCriticalHeadersJWS(protectedHeader, recognizedHeaders) {
+	validateCriticalHeaders(protectedHeader, {
+		family: "JWS",
+		recognizedHeaders
+	});
+}
+function validateCriticalHeadersJWE(protectedHeader, recognizedHeaders) {
+	validateCriticalHeaders(protectedHeader, {
+		family: "JWE",
+		recognizedHeaders
+	});
+}
+const REGISTERED_HEADER_PARAMS = /* @__PURE__ */ new Set([
+	"alg",
+	"enc",
+	"zip",
+	"jku",
+	"jwk",
+	"kid",
+	"x5u",
+	"x5c",
+	"x5t",
+	"x5t#S256",
+	"typ",
+	"cty",
+	"crit",
+	"epk",
+	"apu",
+	"apv",
+	"iv",
+	"tag",
+	"p2s",
+	"p2c"
+]);
+function assertCritShape(crit, options) {
+	const { family } = options;
+	const code = options.code ?? `ERR_${family}_INVALID`;
+	if (!Array.isArray(crit) || crit.length === 0 || crit.some((param) => typeof param !== "string")) throw new JWTError(`Invalid ${family}: "crit" must be a non-empty array of strings.`, code);
+	for (const param of crit) if (REGISTERED_HEADER_PARAMS.has(param)) throw new JWTError(`Invalid ${family}: "crit" must not list registered header parameters.`, code);
+}
+function _instantOf(value, name) {
+	const ms = value instanceof Date ? value.getTime() : NaN;
+	if (!Number.isFinite(ms)) throw new JWTError(`"${name}" must be a valid Date.`, "ERR_INVALID_OPTION");
+	return ms;
+}
+const _utf8Decoder = /* @__PURE__ */ new TextDecoder("utf-8", {
+	fatal: true,
+	ignoreBOM: true
+});
+function _parsePayloadObject(text, family) {
+	const code = `ERR_${family}_INVALID`;
+	const message = `Invalid ${family}: Payload is not a JSON object.`;
+	let parsed;
+	try {
+		parsed = safeJsonParse(text);
+	} catch (error) {
+		throw new JWTError(message, code, error);
+	}
+	if (!isPlainObject(parsed)) throw new JWTError(message, code);
+	return parsed;
+}
+function validateCriticalHeaders(protectedHeader, options) {
+	const { crit } = protectedHeader;
+	if (crit === void 0) return;
+	const { family, recognizedHeaders = [] } = options;
+	assertCritShape(crit, { family });
+	for (const param of crit) {
+		if (!Object.hasOwn(protectedHeader, param)) throw new JWTError(`Critical header parameter ${quoteTokenValue(param)} is missing from the protected header.`, `ERR_${family}_INVALID`);
+		if (!recognizedHeaders.includes(param) && !BASE_PROCESSED[family].includes(param)) throw new JWTError(`Unprocessed critical header parameters: ${quoteTokenValue(param)}`, `ERR_${family}_INVALID`);
+	}
+}
+export { applyTypDefault, assertCritShape, computeJwtTimeClaims, getPlaintextBytes, parsePayloadBytes, parsePayloadSegment, parsePayloadText, quoteTokenValue, validateCriticalHeadersJWE, validateCriticalHeadersJWS };

package/dist/_chunks/libs/unsecure.d.mts

@@ -168,12 +168,6 @@ export declare function sanitizeObjectCopy<T>(obj: T, options?: SanitizeCopyOpti
  * single instance serves every caller.
  */
 export declare const textEncoder: TextEncoder;
-/**
- * Any byte container the library accepts: an `ArrayBuffer` — shared or not —
- * or a view over one. Wider than the DOM `BufferSource`, which excludes
- * `SharedArrayBuffer`-backed views.
- */
-export type BytesSource = ArrayBufferLike | ArrayBufferView<ArrayBufferLike>;
 /**
  * Shared UTF-8 `TextDecoder` instance. `ignoreBOM` keeps a leading U+FEFF in
  * the output: what the codecs decode is a byte string, and a BOM inside it is

package/dist/_chunks/limits.d.mts

@@ -1,7 +1,8 @@
+import "./error.mjs";
 import { JOSELimits } from "./index.mjs";
 import "./index3.mjs";
 /**
- * Default per-call work limits: 16 signatures, 16 recipients, 8 JWK Set candidates,
- * and PBKDF2 iterations for four default-cost PBES2 attempts in total.
+ * Default per-call work limits: 16 signatures, 16 recipients, 8 JWK Set candidates and
+ * 16 key attempts per multi call. The PBKDF2 iteration budget equals four default-cost PBES2 attempts.
  */
 export declare const DEFAULT_JOSE_LIMITS: Readonly<Required<JOSELimits>>;

package/dist/_chunks/payload.mjs

@@ -9,15 +9,21 @@ const PAYLOAD_MODES = /* @__PURE__ */ new Set([
 	"string",
 	"bytes"
 ]);
+const CLAIM_OPTIONS = [
+	"audience",
+	"issuer",
+	"subject",
+	"maxTokenAge",
+	"requiredClaims"
+];
 function resolvePayloadMode(options) {
-	const { payload, forceUint8Array, validateClaims } = options;
+	const { payload, validateClaims } = options;
 	if (payload !== void 0 && !PAYLOAD_MODES.has(payload)) throw new JWTError("\"payload\" must be \"json\", \"string\" or \"bytes\".", "ERR_INVALID_OPTION");
-	let mode = payload ?? "json";
-	if (forceUint8Array !== void 0) {
-		if (payload === void 0) mode = forceUint8Array ? "bytes" : "json";
-		else if (forceUint8Array !== (payload === "bytes")) throw new JWTError("\"forceUint8Array\" contradicts \"payload\", pass \"payload\" alone.", "ERR_INVALID_OPTION");
-	}
+	const mode = payload ?? "json";
 	if (validateClaims === true && mode !== "json") throw new JWTError("\"validateClaims\" requires payload: \"json\".", "ERR_INVALID_OPTION");
-	return mode;
+	if (mode === "json" && validateClaims !== false) return mode;
+	const option = CLAIM_OPTIONS.find((name) => options[name] !== void 0);
+	if (option === void 0) return mode;
+	throw new JWTError(mode === "json" ? `"${option}" needs claim validation: drop validateClaims: false or the option.` : `"${option}" needs a JSON payload: pass payload: "json" or drop the option.`, "ERR_INVALID_OPTION");
 }
 export { resolvePayloadMode, validateClaimsIfJson };

package/dist/_chunks/wrap.mjs

@@ -204,6 +204,8 @@ async function unwrapKey(wrappedKey, unwrappingKey, options) {
 		default: throw new JWTError(`Unsupported key unwrapping algorithm: ${alg}`, "ERR_JWK_UNSUPPORTED");
 	}
 	if (returnRaw) return unwrappedCekBytes;
-	return await crypto.subtle.importKey("raw", unwrappedCekBytes, options.unwrappedKeyAlgorithm || { name: "AES-GCM" }, defaultExtractable, options.keyUsage || ["encrypt", "decrypt"]);
+	const importAlgorithm = options.unwrappedKeyAlgorithm || inferAesImportAlgorithm(options.enc, unwrappedCekBytes.length);
+	if (!importAlgorithm) throw new JWTError("Cannot infer the unwrapped key algorithm, pass \"unwrappedKeyAlgorithm\" or unwrap to raw bytes.", "ERR_JWE_INVALID");
+	return crypto.subtle.importKey("raw", unwrappedCekBytes, importAlgorithm, defaultExtractable, options.keyUsage || ["encrypt", "decrypt"]);
 }
 export { unwrapKey, wrapKey };

package/dist/core/internal.d.mts

@@ -1,2 +1,50 @@
-import { ComputeJwtTimeClaimsOptions, ParsePayloadOptions, applyTypDefault, assertCritShape, computeJwtTimeClaims, expiredClaimMessage, getPlaintextBytes, parsePayloadBytes, parsePayloadSegment, parsePayloadText, validateCriticalHeadersJWE, validateCriticalHeadersJWS } from "../_chunks/jwt.mjs";
-export { type ComputeJwtTimeClaimsOptions, type ParsePayloadOptions, applyTypDefault, assertCritShape, computeJwtTimeClaims, expiredClaimMessage, getPlaintextBytes, parsePayloadBytes, parsePayloadSegment, parsePayloadText, validateCriticalHeadersJWE, validateCriticalHeadersJWS };
+import { JWTErrorCode } from "../_chunks/error.mjs";
+import { JOSEPayload, JOSEPayloadMode, JWTClaims, JWTTimeClaimOptions, PayloadOf } from "../_chunks/index.mjs";
+import { expiredClaimMessage } from "../_chunks/jwt.mjs";
+/** Sets `typ: "JWT"` on a header without `typ` when the payload is an object other than a `Uint8Array`. @throws `ERR_INVALID_OPTION` if `header.typ` is set and is not a string. */
+export declare function applyTypDefault<T extends {
+  typ?: string;
+}>(header: T, payload: unknown): T;
+/** Options for {@link parsePayloadBytes} and {@link parsePayloadSegment}. */
+interface ParsePayloadOptions<Mode extends JOSEPayloadMode = JOSEPayloadMode> {
+  /** How the payload bytes are read. The return type follows it. @default "json" */
+  payload?: Mode;
+  /** The family a failure is reported under: `ERR_JWS_INVALID` or `ERR_JWE_INVALID`. @default "JWS" */
+  family?: "JWS" | "JWE";
+}
+/** Reads payload bytes as a UTF-8 JSON object (`"json"`), UTF-8 text (`"string"`) or as is (`"bytes"`). @throws `ERR_JWS_INVALID` if the bytes do not fit the mode (`ERR_JWE_INVALID` under `family: "JWE"`). */
+export declare function parsePayloadBytes<T = JWTClaims>(bytes: Uint8Array<ArrayBuffer>, options?: ParsePayloadOptions<"json">): T;
+export declare function parsePayloadBytes<Mode extends JOSEPayloadMode = JOSEPayloadMode>(bytes: Uint8Array<ArrayBuffer>, options?: ParsePayloadOptions<Mode>): PayloadOf<Mode>;
+/** Decodes payload bytes as strict UTF-8. @throws `ERR_JWS_INVALID` if they are not (`ERR_JWE_INVALID` under `family: "JWE"`). */
+export declare function parsePayloadText(bytes: Uint8Array<ArrayBuffer>, options?: Pick<ParsePayloadOptions, "family">): string;
+/** {@link parsePayloadBytes} over a base64url payload segment. @throws `UnsecureError` if the segment is not base64url. */
+export declare function parsePayloadSegment<T = JWTClaims>(payloadEncoded: string, options?: ParsePayloadOptions<"json">): T;
+export declare function parsePayloadSegment<Mode extends JOSEPayloadMode = JOSEPayloadMode>(payloadEncoded: string, options?: ParsePayloadOptions<Mode>): PayloadOf<Mode>;
+/** Encodes a payload as bytes: a `Uint8Array` as is, a string as UTF-8, an object as UTF-8 JSON. @throws `ERR_INVALID_OPTION` if the payload is none of these or `JSON.stringify` rejects it. */
+export declare function getPlaintextBytes(payload: JOSEPayload): Uint8Array<ArrayBuffer>;
+/** Options for {@link computeJwtTimeClaims}. */
+type ComputeJwtTimeClaimsOptions = JWTTimeClaimOptions;
+/**
+ * Returns a copy of an object payload with the requested `exp` and `nbf`, plus `iat`.
+ * Claims the payload already holds are kept, `iat: 0` included.
+ * Returns `undefined` when no option applies or every requested claim is present.
+ * `currentDate` is the default `iat` and the base of `expiresIn` and `notBeforeIn`.
+ * `issuedAt: true` requests `iat` with no other claim. A `Date` sets `iat` to that instant.
+ * @throws `ERR_JWT_CLAIM_INVALID` if both `expiresIn` and `expiresAt`, or both `notBeforeIn` and `notBeforeAt`, are set, or `notBeforeIn` is negative.
+ * @throws `ERR_INVALID_OPTION` if a time option is set for a non-object payload, or an option value is malformed.
+ */
+export declare function computeJwtTimeClaims(payload: unknown, options?: ComputeJwtTimeClaimsOptions): JWTClaims | undefined;
+/** Checks a JWS `crit` (RFC 7515 §4.1.11): each entry is in the header and is `b64` or in `recognizedHeaders`. @throws `ERR_JWS_INVALID` if `crit` is malformed or an entry is absent or not understood. */
+export declare function validateCriticalHeadersJWS(protectedHeader: {
+  crit?: string[];
+} & Record<string, unknown>, recognizedHeaders?: string[]): void;
+/** Checks a JWE `crit` (RFC 7516 §4.1.13): each entry is in the header and in `recognizedHeaders`. @throws `ERR_JWE_INVALID` if `crit` is malformed or an entry is absent or not understood. */
+export declare function validateCriticalHeadersJWE(protectedHeader: {
+  crit?: string[];
+} & Record<string, unknown>, recognizedHeaders?: string[]): void;
+/** Asserts `crit` is a non-empty string array with no registered header name (RFC 7515 §4.1.11, RFC 7516 §4.1.13). @throws `ERR_JWS_INVALID` or `ERR_JWE_INVALID` by `family`, or `code` when given. */
+export declare function assertCritShape(crit: unknown, options: {
+  family: "JWS" | "JWE";
+  code?: JWTErrorCode;
+}): asserts crit is string[];
+export { type ComputeJwtTimeClaimsOptions, type ParsePayloadOptions, expiredClaimMessage };

package/dist/core/internal.mjs

@@ -1 +1,3 @@
-export { applyTypDefault, assertCritShape, computeJwtTimeClaims, expiredClaimMessage, getPlaintextBytes, parsePayloadBytes, parsePayloadSegment, parsePayloadText, validateCriticalHeadersJWE, validateCriticalHeadersJWS } from "../_chunks/jwt.mjs";
+import { expiredClaimMessage } from "../_chunks/jwt.mjs";
+import { applyTypDefault, assertCritShape, computeJwtTimeClaims, getPlaintextBytes, parsePayloadBytes, parsePayloadSegment, parsePayloadText, validateCriticalHeadersJWE, validateCriticalHeadersJWS } from "../_chunks/jwt2.mjs";
+export { applyTypDefault, assertCritShape, computeJwtTimeClaims, expiredClaimMessage, getPlaintextBytes, parsePayloadBytes, parsePayloadSegment, parsePayloadText, validateCriticalHeadersJWE, validateCriticalHeadersJWS };

package/dist/core/jwe/index.d.mts

@@ -1,6 +1,6 @@
 import { UnsecureError, UnsecureErrorCode } from "../../_chunks/libs/unsecure.mjs";
 import { JWTError, JWTErrorCauseMap, JWTErrorCode, KnownJWTErrorCode, isJWTError, isUnsecureError } from "../../_chunks/error.mjs";
 import { JOSEPayloadMode, JOSEPayloadTypeMap, JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyLookup, JWEKeyManagementHeaderParameters, JWELibraryHeaderName, JWEMultiDecryptKey, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, PayloadOf } from "../../_chunks/index.mjs";
-import { decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened } from "../../_chunks/index4.mjs";
+import { decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened } from "../../_chunks/index2.mjs";
 import { DEFAULT_JOSE_LIMITS } from "../../_chunks/limits.mjs";
 export { DEFAULT_JOSE_LIMITS, type JOSEPayloadMode, type JOSEPayloadTypeMap, type JWEAsymmetricPrivateJWK, type JWEAsymmetricPublicJWK, type JWEDecryptJWK, type JWEDecryptOptions, type JWEDecryptResult, type JWEEncryptJWK, type JWEEncryptOptions, type JWEFlattenedSerialization, type JWEGeneralRecipient, type JWEGeneralSerialization, type JWEHeaderParameters, type JWEKeyLookup, type JWEKeyManagementHeaderParameters, type JWELibraryHeaderName, type JWEMultiDecryptKey, type JWEMultiDecryptOptions, type JWEMultiDecryptResult, type JWEMultiEncryptOptions, type JWEMultiRecipient, type JWEProtectedHeader, JWTError, type JWTErrorCauseMap, type JWTErrorCode, type KnownJWTErrorCode, type PayloadOf, UnsecureError, type UnsecureErrorCode, decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened, isJWTError, isUnsecureError };

package/dist/core/jwk/index.d.mts

@@ -1,6 +1,6 @@
 import { UnsecureError, UnsecureErrorCode } from "../../_chunks/libs/unsecure.mjs";
 import { JWTError, JWTErrorCauseMap, JWTErrorCode, KnownJWTErrorCode, isJWTError, isUnsecureError } from "../../_chunks/error.mjs";
 import { CompositeKey, ContentEncryptionAlgorithm, DeriveJWKOptions, DeriveJWKReturn, DeriveKeyOptions, DeriveKeyReturn, ECDHEphemeralKeyInput, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, GeneratedJWKMap, GeneratedKeyMap, ImportedKey, ImportedKeyMap, ImportedPEMJWK, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKMetadata, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_Algorithm, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, KeyManagementAlgorithm, KeyWrapAlgorithmOf, KeyWrappingAlgorithm, PEMType, ToPublicJWKReturn, UnwrapKeyOptions, UnwrapKeyResult, UnwrappingKeyFor, WrapKeyOptions, WrapKeyResult, WrappingKeyFor } from "../../_chunks/index.mjs";
-import { WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportJWK, exportKey, exportPEM, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, toPublicJWK, unwrapKey, wrapKey } from "../../_chunks/index2.mjs";
 import { ThumbprintHash, thumbprint } from "../../_chunks/index3.mjs";
-export { type CompositeKey, type ContentEncryptionAlgorithm, type DeriveJWKOptions, type DeriveJWKReturn, type DeriveKeyOptions, type DeriveKeyReturn, type ECDHEphemeralKeyInput, type GenerateJWKOptions, type GenerateJWKReturn, type GenerateKeyAlgorithm, type GenerateKeyOptions, type GenerateKeyReturn, type GeneratedJWKMap, type GeneratedKeyMap, type ImportedKey, type ImportedKeyMap, type ImportedPEMJWK, type JWK, type JWKAlgorithm, type JWKCacheAdapter, type JWKLookupFunction, type JWKLookupFunctionHeader, type JWKMetadata, type JWKPEMAlgorithm, type JWKParameters, type JWKSet, type JWK_AES_Algorithm, type JWK_AES_CBC_HMAC, type JWK_AES_GCM, type JWK_AES_GCM_KW, type JWK_AES_KW, type JWK_Asymmetric, type JWK_Asymmetric_Algorithm, type JWK_EC, type JWK_ECDH_ES, type JWK_ECDSA, type JWK_EC_Private, type JWK_EC_Public, type JWK_HMAC, type JWK_OKP, type JWK_OKP_Private, type JWK_OKP_Public, type JWK_OKP_SIGN, type JWK_PBES2, type JWK_Pair, type JWK_Private, type JWK_Public, type JWK_RSA, type JWK_RSA_ENC, type JWK_RSA_PSS, type JWK_RSA_Private, type JWK_RSA_Public, type JWK_RSA_SIGN, type JWK_Symmetric, type JWK_Symmetric_Algorithm, type JWK_oct, JWTError, type JWTErrorCauseMap, type JWTErrorCode, type KeyManagementAlgorithm, type KeyWrapAlgorithmOf, type KeyWrappingAlgorithm, type KnownJWTErrorCode, type PEMType, type ThumbprintHash, type ToPublicJWKReturn, UnsecureError, type UnsecureErrorCode, type UnwrapKeyOptions, type UnwrapKeyResult, type UnwrappingKeyFor, WeakMapJWKCache, type WrapKeyOptions, type WrapKeyResult, type WrappingKeyFor, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportJWK, exportKey, exportPEM, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, isJWTError, isUnsecureError, thumbprint, toPublicJWK, unwrapKey, wrapKey };
+import { WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportJWK, exportPEM, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, toPublicJWK, unwrapKey, wrapKey } from "../../_chunks/index4.mjs";
+export { type CompositeKey, type ContentEncryptionAlgorithm, type DeriveJWKOptions, type DeriveJWKReturn, type DeriveKeyOptions, type DeriveKeyReturn, type ECDHEphemeralKeyInput, type GenerateJWKOptions, type GenerateJWKReturn, type GenerateKeyAlgorithm, type GenerateKeyOptions, type GenerateKeyReturn, type GeneratedJWKMap, type GeneratedKeyMap, type ImportedKey, type ImportedKeyMap, type ImportedPEMJWK, type JWK, type JWKAlgorithm, type JWKCacheAdapter, type JWKLookupFunction, type JWKLookupFunctionHeader, type JWKMetadata, type JWKPEMAlgorithm, type JWKParameters, type JWKSet, type JWK_AES_Algorithm, type JWK_AES_CBC_HMAC, type JWK_AES_GCM, type JWK_AES_GCM_KW, type JWK_AES_KW, type JWK_Asymmetric, type JWK_Asymmetric_Algorithm, type JWK_EC, type JWK_ECDH_ES, type JWK_ECDSA, type JWK_EC_Private, type JWK_EC_Public, type JWK_HMAC, type JWK_OKP, type JWK_OKP_Private, type JWK_OKP_Public, type JWK_OKP_SIGN, type JWK_PBES2, type JWK_Pair, type JWK_Private, type JWK_Public, type JWK_RSA, type JWK_RSA_ENC, type JWK_RSA_PSS, type JWK_RSA_Private, type JWK_RSA_Public, type JWK_RSA_SIGN, type JWK_Symmetric, type JWK_Symmetric_Algorithm, type JWK_oct, JWTError, type JWTErrorCauseMap, type JWTErrorCode, type KeyManagementAlgorithm, type KeyWrapAlgorithmOf, type KeyWrappingAlgorithm, type KnownJWTErrorCode, type PEMType, type ThumbprintHash, type ToPublicJWKReturn, UnsecureError, type UnsecureErrorCode, type UnwrapKeyOptions, type UnwrapKeyResult, type UnwrappingKeyFor, WeakMapJWKCache, type WrapKeyOptions, type WrapKeyResult, type WrappingKeyFor, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportJWK, exportPEM, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, isJWTError, isUnsecureError, thumbprint, toPublicJWK, unwrapKey, wrapKey };

package/dist/core/jwk/index.mjs

@@ -2,6 +2,6 @@ import { UnsecureError } from "../../_chunks/libs/unsecure.mjs";
 import { JWTError, isJWTError, isUnsecureError } from "../../error.mjs";
 import { WeakMapJWKCache, clearJWKCache, configureJWKCache, getJWKsFromSet, importKey, thumbprint } from "../../_chunks/algorithms.mjs";
 import { unwrapKey, wrapKey } from "../../_chunks/wrap.mjs";
-import { exportJWK, exportKey, toPublicJWK } from "../../_chunks/export.mjs";
+import { exportJWK, toPublicJWK } from "../../_chunks/export.mjs";
 import { deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportPEM, generateJWK, generateKey, importPEM } from "../../_chunks/jwk.mjs";
-export { JWTError, UnsecureError, WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportJWK, exportKey, exportPEM, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, isJWTError, isUnsecureError, thumbprint, toPublicJWK, unwrapKey, wrapKey };
+export { JWTError, UnsecureError, WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportJWK, exportPEM, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, isJWTError, isUnsecureError, thumbprint, toPublicJWK, unwrapKey, wrapKey };

package/dist/dpop/index.d.mts

@@ -1,73 +1,132 @@
 import { JWTError, JWTErrorCode, KnownJWTErrorCode, isJWTError } from "../_chunks/error.mjs";
 import { JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK } from "../_chunks/index.mjs";
-/** Closed set of supported asymmetric JWS algorithms. */
+/** The JWS algorithms a DPoP proof can use: every supported `alg` except `HS*`. */
 type DPoPAlgorithm = Exclude<JWSAlgorithm, `HS${string}`>;
-/** The request method and absolute HTTP(S) URL; a Web Request satisfies this shape. */
+/** The request a proof is bound to. A Web `Request` matches this shape. */
 interface DPoPTarget {
+  /** HTTP method, compared case-sensitively with the proof's `htm`. */
   method: string;
+  /** Absolute `http:` or `https:` URL without credentials. Its query and fragment are ignored. */
   url: string;
 }
-/** Explicit signing pair; the private CryptoKey need not be extractable. */
+/**
+ * The signing key pair: two `CryptoKey`s or two asymmetric JWKs.
+ * The private `CryptoKey` can be non-extractable. The public `CryptoKey` must be extractable.
+ */
 type DPoPKeyPair = CryptoKeyPair | {
   privateKey: JWSAsymmetricPrivateJWK;
   publicKey: JWSAsymmetricPublicJWK;
 };
+/** The claims of a DPoP proof (RFC 9449 §4.2). */
 interface DPoPPayload {
+  /** Unique proof identifier. */
   jti: string;
+  /** Creation time in NumericDate seconds. */
   iat: number;
+  /** Expiration time in NumericDate seconds. */
   exp?: number;
+  /** Earliest acceptance time in NumericDate seconds. */
   nbf?: number;
+  /** HTTP method of the request. */
   htm: string;
+  /** Target URI of the request, without query and fragment. */
   htu: string;
+  /** Nonce the server supplied. */
   nonce?: string;
+  /** Base64url SHA-256 hash of the access token. */
   ath?: string;
   [claim: string]: unknown;
 }
 interface DPoPCreateOptions {
+  /** The key pair that signs the proof. Its public key is written to the `jwk` header. */
   keyPair: DPoPKeyPair;
-  /** Inferred from JWK alg metadata or an unambiguous key shape. Required for CryptoKey pairs. */
+  /**
+   * Signing algorithm. Inferred from the JWK pair's `alg`, or from a key that serves one algorithm.
+   * Required for a `CryptoKey` pair.
+   */
   algorithm?: DPoPAlgorithm;
-  /** Unique proof identifier. Defaults to a fresh UUID v4 for each proof. */
+  /**
+   * Unique proof identifier. Must be a non-empty string.
+   * @default crypto.randomUUID()
+   */
   jti?: string;
-  /** Creation time in NumericDate seconds. Defaults to the current Unix second. */
+  /**
+   * Creation time in NumericDate seconds.
+   * @default the current Unix second
+   */
   iat?: number;
-  /** Expiration time in NumericDate seconds. Omitted by default. */
+  /** Expiration time in NumericDate seconds. The proof has no `exp` when omitted. */
   exp?: number;
-  /** Earliest acceptance time in NumericDate seconds. Omitted by default. */
+  /** Earliest acceptance time in NumericDate seconds. The proof has no `nbf` when omitted. */
   nbf?: number;
+  /** Nonce the server supplied: printable ASCII without space, `"` or `\`. */
   nonce?: string;
-  /** Raw ASCII access token whose SHA-256 digest becomes `ath`. */
+  /** The non-empty ASCII access token the proof is bound to. Its SHA-256 hash is written to `ath`. */
   accessToken?: {
     token: string;
   };
 }
 interface DPoPVerifyResult {
+  /** The verified proof claims. */
   payload: DPoPPayload;
-  /** SHA-256 RFC 7638 thumbprint of the authenticated public key. */
+  /** RFC 7638 SHA-256 thumbprint of the proof's public key, the value a `cnf.jkt` binds. */
   thumbprint: string;
 }
 interface DPoPVerifyOptions {
+  /** Accepted signing algorithms. Must be non-empty. */
   algorithms: DPoPAlgorithm[];
-  /** Positive finite maximum proof age, in seconds. */
+  /** Maximum proof age in seconds, measured from `iat`. Must be positive and finite. */
   maxTokenAge: number;
+  /**
+   * Time the proof is verified against.
+   * @default new Date()
+   */
   currentDate?: Date;
-  /** Finite, non-negative clock tolerance, in seconds. Default: 0. */
+  /**
+   * Clock skew in seconds accepted on `iat`, `exp` and `nbf`. Must be finite and non-negative.
+   * @default 0
+   */
   clockTolerance?: number;
+  /** Expected nonce. A proof without it, or with another one, fails with `ERR_DPOP_NONCE_INVALID`. */
   nonce?: string;
-  /** The raw access token and its authenticated `cnf.jkt` binding, supplied together. */
+  /**
+   * The access token and the `cnf.jkt` thumbprint it is bound to. The proof's `ath` must match
+   * `token` and its key must match `thumbprint`.
+   */
   accessToken?: {
     token: string;
     thumbprint: string;
   };
-  /** Atomically consume a validated proof; false rejects replay. No replay storage is provided. */
+  /**
+   * Replay check, called with a copy of the result once every other check passes.
+   * Return `true` to accept the proof. Any other value, or a throw, fails with `ERR_DPOP_REPLAY`.
+   * No replay storage is included: record the `jti` atomically.
+   */
   consumeProof?: (result: DPoPVerifyResult) => boolean | Promise<boolean>;
 }
-/** Create a proof with matching private/public signing keys and optional identifier/time overrides. */
+/**
+ * Creates a DPoP proof (RFC 9449 §4.2) for `target`, signed with `options.keyPair`.
+ * The proof has `typ: "dpop+jwt"` and the public key in its `jwk` header.
+ * `htu` is `target.url` without query and fragment.
+ *
+ * @returns The proof as a compact JWS.
+ * @throws `ERR_INVALID_OPTION` if the target, the key pair or another option is invalid.
+ * @throws `ERR_DPOP_INVALID` if signing fails with an error that is not a `JWTError`.
+ */
 export declare function createDPoPProof(target: DPoPTarget, options: DPoPCreateOptions): Promise<string>;
 /**
- * Authenticate and bind a proof; replay storage and access-token validation belong to the caller.
- * A proof failure is `ERR_DPOP_INVALID` or `ERR_DPOP_CLAIM_INVALID` (a core error kept as `cause`);
- * a missing or different expected nonce, checked last, is `ERR_DPOP_NONCE_INVALID`.
+ * Verifies a DPoP proof against `target` and `options`.
+ * Returns its claims and the thumbprint of its key.
+ * Validate the access token yourself. Pass `consumeProof` to reject a replayed proof.
+ * A core error behind a proof failure is kept as `cause`.
+ *
+ * @throws `ERR_INVALID_OPTION` if the target or an option is invalid.
+ * @throws `ERR_DPOP_INVALID` if the proof's structure, header, key, algorithm or signature is invalid.
+ * @throws `ERR_DPOP_CLAIM_INVALID` if a claim is invalid, `iat` is outside the age window,
+ * or the proof does not match the request or the access token.
+ * @throws `ERR_DPOP_NONCE_INVALID` if the proof's `nonce` differs from `options.nonce`.
+ * This check runs after every other proof check.
+ * @throws `ERR_DPOP_REPLAY` if `consumeProof` does not return `true` or throws.
  */
 export declare function verifyDPoPProof(proof: string, target: DPoPTarget, options: DPoPVerifyOptions): Promise<DPoPVerifyResult>;
 export { type DPoPAlgorithm, type DPoPCreateOptions, type DPoPKeyPair, type DPoPPayload, type DPoPTarget, type DPoPVerifyOptions, type DPoPVerifyResult, JWTError, type JWTErrorCode, type KnownJWTErrorCode, isJWTError };

package/dist/index.d.mts

@@ -1,12 +1,12 @@
-import { BytesSource, UnsecureError, UnsecureErrorCode, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder } from "./_chunks/libs/unsecure.mjs";
+import { UnsecureError, UnsecureErrorCode, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder } from "./_chunks/libs/unsecure.mjs";
 import { JWTError, JWTErrorCauseMap, JWTErrorCode, KnownJWTErrorCode, isJWTError, isUnsecureError } from "./_chunks/error.mjs";
 import { CompositeKey, ContentEncryptionAlgorithm, DeriveJWKOptions, DeriveJWKReturn, DeriveKeyOptions, DeriveKeyReturn, Duration, ECDHEphemeralKeyInput, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, GeneratedJWKMap, GeneratedKeyMap, ImportedKey, ImportedKeyMap, ImportedPEMJWK, JOSEConsumerOptions, JOSELimits, JOSEPayload, JOSEPayloadMode, JOSEPayloadTypeMap, JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyLookup, JWEKeyManagementHeaderParameters, JWELibraryHeaderName, JWEMultiDecryptKey, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKMetadata, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_Algorithm, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHashedAlgorithm, JWSHeaderParameters, JWSKeyLookup, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JWTConfirmation, JWTTimeClaimOptions, JoseHeaderParameters, KeyManagementAlgorithm, KeyWrapAlgorithmOf, KeyWrappingAlgorithm, MaxTokenAge, NotBeforeIn, PEMType, PayloadOf, StrictOmit, ToPublicJWKReturn, UnwrapKeyOptions, UnwrapKeyResult, UnwrappingKeyFor, WrapKeyOptions, WrapKeyResult, WrappingKeyFor } from "./_chunks/index.mjs";
-import { WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportJWK, exportKey, exportPEM, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, toPublicJWK, unwrapKey, wrapKey } from "./_chunks/index2.mjs";
+import { computeDurationInSeconds, isJWTContent, validateJwtClaims } from "./_chunks/jwt.mjs";
+import { decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened } from "./_chunks/index2.mjs";
 import { thumbprint } from "./_chunks/index3.mjs";
 import { DigestHash, digestUrl } from "./_chunks/digest.mjs";
-import { computeDurationInSeconds, isJWTContent, validateJwtClaims } from "./_chunks/jwt.mjs";
-import { decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened } from "./_chunks/index4.mjs";
 import { DEFAULT_JOSE_LIMITS } from "./_chunks/limits.mjs";
+import { WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportJWK, exportPEM, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, toPublicJWK, unwrapKey, wrapKey } from "./_chunks/index4.mjs";
 import { generalToFlattenedJWS, sign, signMulti, verify, verifyMulti, verifyMultiAll } from "./_chunks/index5.mjs";
-import { Base64ParseOptions, ComputeJwtTimeClaimsOptions, DecodeOptions, DecodePayloadOptions, DecodeReturnAs, InferAlgorithmsOptions, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeJwtTimeClaims, concatUint8Arrays, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, validateCriticalHeadersJWE, validateCriticalHeadersJWS } from "./_chunks/index6.mjs";
-export { type Base64ParseOptions, type BytesSource, type CompositeKey, ComputeJwtTimeClaimsOptions, type ContentEncryptionAlgorithm, DEFAULT_JOSE_LIMITS, DecodeOptions, DecodePayloadOptions, type DecodeReturnAs, type DeriveJWKOptions, type DeriveJWKReturn, type DeriveKeyOptions, type DeriveKeyReturn, type DigestHash, type Duration, type ECDHEphemeralKeyInput, type ExpiresIn, type GenerateJWKOptions, type GenerateJWKReturn, type GenerateKeyAlgorithm, type GenerateKeyOptions, type GenerateKeyReturn, type GeneratedJWKMap, type GeneratedKeyMap, type ImportedKey, type ImportedKeyMap, type ImportedPEMJWK, type InferAlgorithmsOptions, type JOSEConsumerOptions, type JOSELimits, type JOSEPayload, type JOSEPayloadMode, type JOSEPayloadTypeMap, type JWEAsymmetricPrivateJWK, type JWEAsymmetricPublicJWK, type JWEDecryptJWK, type JWEDecryptOptions, type JWEDecryptResult, type JWEEncryptJWK, type JWEEncryptOptions, type JWEFlattenedSerialization, type JWEGeneralRecipient, type JWEGeneralSerialization, type JWEHeaderParameters, type JWEKeyLookup, type JWEKeyManagementHeaderParameters, type JWELibraryHeaderName, type JWEMultiDecryptKey, type JWEMultiDecryptOptions, type JWEMultiDecryptResult, type JWEMultiEncryptOptions, type JWEMultiRecipient, type JWEProtectedHeader, type JWK, type JWKAlgorithm, type JWKCacheAdapter, type JWKLookupFunction, type JWKLookupFunctionHeader, type JWKMetadata, type JWKPEMAlgorithm, type JWKParameters, type JWKSet, type JWK_AES_Algorithm, type JWK_AES_CBC_HMAC, type JWK_AES_GCM, type JWK_AES_GCM_KW, type JWK_AES_KW, type JWK_Asymmetric, type JWK_Asymmetric_Algorithm, type JWK_EC, type JWK_ECDH_ES, type JWK_ECDSA, type JWK_EC_Private, type JWK_EC_Public, type JWK_HMAC, type JWK_OKP, type JWK_OKP_Private, type JWK_OKP_Public, type JWK_OKP_SIGN, type JWK_PBES2, type JWK_Pair, type JWK_Private, type JWK_Public, type JWK_RSA, type JWK_RSA_ENC, type JWK_RSA_PSS, type JWK_RSA_Private, type JWK_RSA_Public, type JWK_RSA_SIGN, type JWK_Symmetric, type JWK_Symmetric_Algorithm, type JWK_oct, type JWSAlgorithm, type JWSAsymmetricPrivateJWK, type JWSAsymmetricPublicJWK, type JWSFlattenedSerialization, type JWSGeneralSerialization, type JWSGeneralSignature, type JWSHashedAlgorithm, type JWSHeaderParameters, type JWSKeyLookup, type JWSMultiSignOptions, type JWSMultiSigner, type JWSMultiVerifyAllOptions, type JWSMultiVerifyOptions, type JWSMultiVerifyOutcome, type JWSMultiVerifyResult, type JWSProtectedHeader, type JWSSignJWK, type JWSSignOptions, type JWSVerifyJWK, type JWSVerifyOptions, type JWSVerifyResult, type JWT, type JWTClaimValidationOptions, type JWTClaims, type JWTConfirmation, JWTError, type JWTErrorCauseMap, type JWTErrorCode, type JWTTimeClaimOptions, type JoseHeaderParameters, type KeyManagementAlgorithm, type KeyWrapAlgorithmOf, type KeyWrappingAlgorithm, type KnownJWTErrorCode, type MaxTokenAge, type NotBeforeIn, type PEMType, type PayloadOf, type StrictOmit, type ToPublicJWKReturn, UnsecureError, type UnsecureErrorCode, type UnwrapKeyOptions, type UnwrapKeyResult, type UnwrappingKeyFor, WeakMapJWKCache, type WrapKeyOptions, type WrapKeyResult, type WrappingKeyFor, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, clearJWKCache, computeDurationInSeconds, computeJwtTimeClaims, concatUint8Arrays, configureJWKCache, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, decrypt, decryptMulti, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, digestUrl, encrypt, encryptMulti, exportJWK, exportKey, exportPEM, generalToFlattened, generalToFlattenedJWS, generateJWK, generateKey, getJWKsFromSet, getPlaintextBytes, importKey, importPEM, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, sign, signMulti, textDecoder, textEncoder, thumbprint, toPublicJWK, unwrapKey, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims, verify, verifyMulti, verifyMultiAll, wrapKey };
+import { Base64ParseOptions, DecodeReturnAs, assertCryptoKey, base64Parse, base64Stringify, base64UrlParse, base64UrlStringify, concatUint8Arrays, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray } from "./_chunks/index6.mjs";
+export { type Base64ParseOptions, type CompositeKey, type ContentEncryptionAlgorithm, DEFAULT_JOSE_LIMITS, type DecodeReturnAs, type DeriveJWKOptions, type DeriveJWKReturn, type DeriveKeyOptions, type DeriveKeyReturn, type DigestHash, type Duration, type ECDHEphemeralKeyInput, type ExpiresIn, type GenerateJWKOptions, type GenerateJWKReturn, type GenerateKeyAlgorithm, type GenerateKeyOptions, type GenerateKeyReturn, type GeneratedJWKMap, type GeneratedKeyMap, type ImportedKey, type ImportedKeyMap, type ImportedPEMJWK, type JOSEConsumerOptions, type JOSELimits, type JOSEPayload, type JOSEPayloadMode, type JOSEPayloadTypeMap, type JWEAsymmetricPrivateJWK, type JWEAsymmetricPublicJWK, type JWEDecryptJWK, type JWEDecryptOptions, type JWEDecryptResult, type JWEEncryptJWK, type JWEEncryptOptions, type JWEFlattenedSerialization, type JWEGeneralRecipient, type JWEGeneralSerialization, type JWEHeaderParameters, type JWEKeyLookup, type JWEKeyManagementHeaderParameters, type JWELibraryHeaderName, type JWEMultiDecryptKey, type JWEMultiDecryptOptions, type JWEMultiDecryptResult, type JWEMultiEncryptOptions, type JWEMultiRecipient, type JWEProtectedHeader, type JWK, type JWKAlgorithm, type JWKCacheAdapter, type JWKLookupFunction, type JWKLookupFunctionHeader, type JWKMetadata, type JWKPEMAlgorithm, type JWKParameters, type JWKSet, type JWK_AES_Algorithm, type JWK_AES_CBC_HMAC, type JWK_AES_GCM, type JWK_AES_GCM_KW, type JWK_AES_KW, type JWK_Asymmetric, type JWK_Asymmetric_Algorithm, type JWK_EC, type JWK_ECDH_ES, type JWK_ECDSA, type JWK_EC_Private, type JWK_EC_Public, type JWK_HMAC, type JWK_OKP, type JWK_OKP_Private, type JWK_OKP_Public, type JWK_OKP_SIGN, type JWK_PBES2, type JWK_Pair, type JWK_Private, type JWK_Public, type JWK_RSA, type JWK_RSA_ENC, type JWK_RSA_PSS, type JWK_RSA_Private, type JWK_RSA_Public, type JWK_RSA_SIGN, type JWK_Symmetric, type JWK_Symmetric_Algorithm, type JWK_oct, type JWSAlgorithm, type JWSAsymmetricPrivateJWK, type JWSAsymmetricPublicJWK, type JWSFlattenedSerialization, type JWSGeneralSerialization, type JWSGeneralSignature, type JWSHashedAlgorithm, type JWSHeaderParameters, type JWSKeyLookup, type JWSMultiSignOptions, type JWSMultiSigner, type JWSMultiVerifyAllOptions, type JWSMultiVerifyOptions, type JWSMultiVerifyOutcome, type JWSMultiVerifyResult, type JWSProtectedHeader, type JWSSignJWK, type JWSSignOptions, type JWSVerifyJWK, type JWSVerifyOptions, type JWSVerifyResult, type JWT, type JWTClaimValidationOptions, type JWTClaims, type JWTConfirmation, JWTError, type JWTErrorCauseMap, type JWTErrorCode, type JWTTimeClaimOptions, type JoseHeaderParameters, type KeyManagementAlgorithm, type KeyWrapAlgorithmOf, type KeyWrappingAlgorithm, type KnownJWTErrorCode, type MaxTokenAge, type NotBeforeIn, type PEMType, type PayloadOf, type StrictOmit, type ToPublicJWKReturn, UnsecureError, type UnsecureErrorCode, type UnwrapKeyOptions, type UnwrapKeyResult, type UnwrappingKeyFor, WeakMapJWKCache, type WrapKeyOptions, type WrapKeyResult, type WrappingKeyFor, assertCryptoKey, base64Parse, base64Stringify, base64UrlParse, base64UrlStringify, clearJWKCache, computeDurationInSeconds, concatUint8Arrays, configureJWKCache, decrypt, decryptMulti, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, digestUrl, encrypt, encryptMulti, exportJWK, exportPEM, generalToFlattened, generalToFlattenedJWS, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, sign, signMulti, textDecoder, textEncoder, thumbprint, toPublicJWK, unwrapKey, validateJwtClaims, verify, verifyMulti, verifyMultiAll, wrapKey };

package/dist/index.mjs

@@ -1,12 +1,12 @@
 import { UnsecureError, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder } from "./_chunks/libs/unsecure.mjs";
 import { JWTError, isJWTError, isUnsecureError } from "./error.mjs";
-import { assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeDurationInSeconds, concatUint8Arrays, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, validateJwtClaims } from "./_chunks/jwt.mjs";
+import { assertCryptoKey, base64Parse, base64Stringify, base64UrlParse, base64UrlStringify, computeDurationInSeconds, concatUint8Arrays, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, validateJwtClaims } from "./_chunks/jwt.mjs";
 import { DEFAULT_JOSE_LIMITS, WeakMapJWKCache, clearJWKCache, configureJWKCache, getJWKsFromSet, importKey, thumbprint } from "./_chunks/algorithms.mjs";
 import { digestUrl, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms } from "./_chunks/digest.mjs";
 import { generalToFlattenedJWS, sign, signMulti, verify, verifyMulti, verifyMultiAll } from "./_chunks/jws.mjs";
 import { decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened } from "./_chunks/jwe.mjs";
 import { unwrapKey, wrapKey } from "./_chunks/wrap.mjs";
-import { exportJWK, exportKey, toPublicJWK } from "./_chunks/export.mjs";
+import { exportJWK, toPublicJWK } from "./_chunks/export.mjs";
 import { deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportPEM, generateJWK, generateKey, importPEM } from "./_chunks/jwk.mjs";
-import { applyTypCtyDefaults, assertCritShape, computeJwtTimeClaims, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, validateCriticalHeadersJWE, validateCriticalHeadersJWS } from "./utils/index.mjs";
-export { DEFAULT_JOSE_LIMITS, JWTError, UnsecureError, WeakMapJWKCache, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, clearJWKCache, computeDurationInSeconds, computeJwtTimeClaims, concatUint8Arrays, configureJWKCache, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, decrypt, decryptMulti, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, digestUrl, encrypt, encryptMulti, exportJWK, exportKey, exportPEM, generalToFlattened, generalToFlattenedJWS, generateJWK, generateKey, getJWKsFromSet, getPlaintextBytes, importKey, importPEM, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, sign, signMulti, textDecoder, textEncoder, thumbprint, toPublicJWK, unwrapKey, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims, verify, verifyMulti, verifyMultiAll, wrapKey };
+import "./utils/index.mjs";
+export { DEFAULT_JOSE_LIMITS, JWTError, UnsecureError, WeakMapJWKCache, assertCryptoKey, base64Parse, base64Stringify, base64UrlParse, base64UrlStringify, clearJWKCache, computeDurationInSeconds, concatUint8Arrays, configureJWKCache, decrypt, decryptMulti, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, digestUrl, encrypt, encryptMulti, exportJWK, exportPEM, generalToFlattened, generalToFlattenedJWS, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, sign, signMulti, textDecoder, textEncoder, thumbprint, toPublicJWK, unwrapKey, validateJwtClaims, verify, verifyMulti, verifyMultiAll, wrapKey };