[{"data":1,"prerenderedAt":1901},["ShallowReactive",2],{"navigation":3,"-utilities":167,"-utilities-surround":1898},[4,22,78,106,141,148],{"title":5,"path":6,"stem":7,"children":8},"Introduction","\u002Fgetting-started","0.Getting-Started\u002F0.index",[9,10,14,18],{"title":5,"path":6,"stem":7},{"title":11,"path":12,"stem":13},"Installation","\u002Fgetting-started\u002Finstallation","0.Getting-Started\u002F1.installation",{"title":15,"path":16,"stem":17},"Quickstart","\u002Fgetting-started\u002Fquickstart","0.Getting-Started\u002F2.quickstart",{"title":19,"path":20,"stem":21},"Core concepts","\u002Fgetting-started\u002Fcore-concepts","0.Getting-Started\u002F3.core-concepts",{"title":23,"path":24,"stem":25,"children":26,"icon":28},"JWT","\u002Fjwt","1.JWT\u002F0.index",[27,29,52],{"title":23,"path":24,"stem":25,"icon":28},"i-carbon-certificate",{"title":30,"path":31,"stem":32,"children":33,"icon":35},"JWS","\u002Fjwt\u002Fjws","1.JWT\u002F1.JWS\u002F0.index",[34,36,40,44,48],{"title":30,"path":31,"stem":32,"icon":35},"i-carbon-document-signed",{"title":37,"path":38,"stem":39},"Signing","\u002Fjwt\u002Fjws\u002Fsigning","1.JWT\u002F1.JWS\u002F1.signing",{"title":41,"path":42,"stem":43},"Verifying","\u002Fjwt\u002Fjws\u002Fverifying","1.JWT\u002F1.JWS\u002F2.verifying",{"title":45,"path":46,"stem":47},"Multi-signature","\u002Fjwt\u002Fjws\u002Fmulti-signature","1.JWT\u002F1.JWS\u002F3.multi-signature",{"title":49,"path":50,"stem":51},"Algorithms","\u002Fjwt\u002Fjws\u002Falgorithms","1.JWT\u002F1.JWS\u002F4.algorithms",{"title":53,"path":54,"stem":55,"children":56,"icon":58},"JWE","\u002Fjwt\u002Fjwe","1.JWT\u002F2.JWE\u002F0.index",[57,59,63,67,71,75],{"title":53,"path":54,"stem":55,"icon":58},"i-carbon-locked",{"title":60,"path":61,"stem":62},"Encrypting","\u002Fjwt\u002Fjwe\u002Fencrypting","1.JWT\u002F2.JWE\u002F1.encrypting",{"title":64,"path":65,"stem":66},"Decrypting","\u002Fjwt\u002Fjwe\u002Fdecrypting","1.JWT\u002F2.JWE\u002F2.decrypting",{"title":68,"path":69,"stem":70},"Multi-recipient","\u002Fjwt\u002Fjwe\u002Fmulti-recipient","1.JWT\u002F2.JWE\u002F3.multi-recipient",{"title":72,"path":73,"stem":74},"ECDH-ES and end-to-end encryption","\u002Fjwt\u002Fjwe\u002Fecdh-es","1.JWT\u002F2.JWE\u002F4.ecdh-es",{"title":49,"path":76,"stem":77},"\u002Fjwt\u002Fjwe\u002Falgorithms","1.JWT\u002F2.JWE\u002F5.algorithms",{"title":79,"path":80,"stem":81,"children":82,"icon":84},"Examples","\u002Fexamples","10.Examples\u002F0.index",[83,85,90,94,98,102],{"title":79,"path":80,"stem":81,"icon":84},"i-carbon-code-reference",{"title":86,"path":87,"stem":88,"icon":89},"Authentication basics","\u002Fexamples\u002Fauthentication-basics","10.Examples\u002F1.authentication-basics","i-lucide-code",{"title":91,"path":92,"stem":93,"icon":89},"Consuming a JWKS endpoint","\u002Fexamples\u002Fjwks-endpoint","10.Examples\u002F2.jwks-endpoint",{"title":95,"path":96,"stem":97,"icon":89},"Refresh token pattern","\u002Fexamples\u002Frefresh-token-pattern","10.Examples\u002F3.refresh-token-pattern",{"title":99,"path":100,"stem":101,"icon":89},"End-to-end encryption","\u002Fexamples\u002Fend-to-end-encryption","10.Examples\u002F4.end-to-end-encryption",{"title":103,"path":104,"stem":105,"icon":89},"Signed receipts","\u002Fexamples\u002Fsigned-receipts","10.Examples\u002F5.signed-receipts",{"title":107,"path":108,"stem":109,"children":110,"icon":112},"JWK","\u002Fjwk","2.JWK\u002F0.index",[111,113,117,121,125,129,133,137],{"title":107,"path":108,"stem":109,"icon":112},"i-carbon-two-factor-authentication",{"title":114,"path":115,"stem":116},"Generating keys","\u002Fjwk\u002Fgenerating","2.JWK\u002F1.generating",{"title":118,"path":119,"stem":120},"Importing and exporting","\u002Fjwk\u002Fimport-export","2.JWK\u002F2.import-export",{"title":122,"path":123,"stem":124},"PEM conversion","\u002Fjwk\u002Fpem","2.JWK\u002F3.pem",{"title":126,"path":127,"stem":128},"Key wrapping","\u002Fjwk\u002Fwrapping","2.JWK\u002F4.wrapping",{"title":130,"path":131,"stem":132},"Password derivation","\u002Fjwk\u002Fpassword-derivation","2.JWK\u002F5.password-derivation",{"title":134,"path":135,"stem":136},"JWK Sets","\u002Fjwk\u002Fjwk-sets","2.JWK\u002F6.jwk-sets",{"title":138,"path":139,"stem":140},"JWK cache","\u002Fjwk\u002Fcache","2.JWK\u002F7.cache",{"title":142,"path":143,"stem":144,"children":145,"icon":147},"Utilities","\u002Futilities","3.Utilities\u002F0.index",[146],{"title":142,"path":143,"stem":144,"icon":147},"i-carbon-tool-box",{"title":149,"path":150,"stem":151,"children":152,"icon":154},"Adapters","\u002Fadapters","99.Adapters\u002F0.index",[153,155,159,163],{"title":149,"path":150,"stem":151,"icon":154},"i-carbon-plug",{"title":156,"path":157,"stem":158},"H3 sessions","\u002Fadapters\u002Fh3-sessions","99.Adapters\u002F1.h3-sessions",{"title":160,"path":161,"stem":162},"Lifecycle hooks","\u002Fadapters\u002Fhooks","99.Adapters\u002F2.hooks",{"title":164,"path":165,"stem":166},"Lower-level functions","\u002Fadapters\u002Flower-level","99.Adapters\u002F3.lower-level",{"id":168,"title":142,"body":169,"description":198,"extension":1893,"meta":1894,"navigation":1895,"path":143,"seo":1896,"stem":144,"__hash__":1897},"content\u002F3.Utilities\u002F0.index.md",{"type":170,"value":171,"toc":1860,"icon":147},"minimark",[172,192,356,363,368,375,390,444,450,481,579,588,606,610,616,628,644,694,701,713,717,723,733,804,808,817,828,863,867,1059,1130,1134,1140,1158,1172,1221,1242,1258,1264,1429,1443,1450,1459,1522,1537,1540,1577,1580,1635,1641,1650,1696,1714,1718,1725,1731,1743,1750,1756,1767,1780,1793,1799,1811,1829,1832,1836,1856],[173,174,175,176,180,181,184,185,184,188,191],"p",{},"Small but pervasive helpers — base64url encoding, cryptographic randomness, type guards, JWT claim validation, and the ",[177,178,179],"code",{},"Duration"," format that powers ",[177,182,183],{},"expiresIn"," \u002F ",[177,186,187],{},"maxTokenAge",[177,189,190],{},"notBeforeIn"," everywhere in unjwt.",[193,194,199],"pre",{"className":195,"code":196,"language":197,"meta":198,"style":198},"language-ts shiki shiki-themes github-light github-dark github-dark","import {\n  base64UrlEncode,\n  base64UrlDecode,\n  base64Encode,\n  base64Decode,\n  secureRandomBytes,\n  concatUint8Arrays,\n  textEncoder,\n  textDecoder,\n  isJWK,\n  isJWKSet,\n  isSymmetricJWK,\n  isAsymmetricJWK,\n  isPrivateJWK,\n  isPublicJWK,\n  isCryptoKey,\n  isCryptoKeyPair,\n  validateJwtClaims,\n  computeDurationInSeconds,\n  inferJWSAllowedAlgorithms,\n  inferJWEAllowedAlgorithms,\n  sanitizeObject,\n} from \"unjwt\u002Futils\";\n","ts","",[177,200,201,214,220,226,232,238,244,250,256,262,268,274,280,286,292,298,304,310,316,322,328,334,340],{"__ignoreMap":198},[202,203,206,210],"span",{"class":204,"line":205},"line",1,[202,207,209],{"class":208},"so5gQ","import",[202,211,213],{"class":212},"slsVL"," {\n",[202,215,217],{"class":204,"line":216},2,[202,218,219],{"class":212},"  base64UrlEncode,\n",[202,221,223],{"class":204,"line":222},3,[202,224,225],{"class":212},"  base64UrlDecode,\n",[202,227,229],{"class":204,"line":228},4,[202,230,231],{"class":212},"  base64Encode,\n",[202,233,235],{"class":204,"line":234},5,[202,236,237],{"class":212},"  base64Decode,\n",[202,239,241],{"class":204,"line":240},6,[202,242,243],{"class":212},"  secureRandomBytes,\n",[202,245,247],{"class":204,"line":246},7,[202,248,249],{"class":212},"  concatUint8Arrays,\n",[202,251,253],{"class":204,"line":252},8,[202,254,255],{"class":212},"  textEncoder,\n",[202,257,259],{"class":204,"line":258},9,[202,260,261],{"class":212},"  textDecoder,\n",[202,263,265],{"class":204,"line":264},10,[202,266,267],{"class":212},"  isJWK,\n",[202,269,271],{"class":204,"line":270},11,[202,272,273],{"class":212},"  isJWKSet,\n",[202,275,277],{"class":204,"line":276},12,[202,278,279],{"class":212},"  isSymmetricJWK,\n",[202,281,283],{"class":204,"line":282},13,[202,284,285],{"class":212},"  isAsymmetricJWK,\n",[202,287,289],{"class":204,"line":288},14,[202,290,291],{"class":212},"  isPrivateJWK,\n",[202,293,295],{"class":204,"line":294},15,[202,296,297],{"class":212},"  isPublicJWK,\n",[202,299,301],{"class":204,"line":300},16,[202,302,303],{"class":212},"  isCryptoKey,\n",[202,305,307],{"class":204,"line":306},17,[202,308,309],{"class":212},"  isCryptoKeyPair,\n",[202,311,313],{"class":204,"line":312},18,[202,314,315],{"class":212},"  validateJwtClaims,\n",[202,317,319],{"class":204,"line":318},19,[202,320,321],{"class":212},"  computeDurationInSeconds,\n",[202,323,325],{"class":204,"line":324},20,[202,326,327],{"class":212},"  inferJWSAllowedAlgorithms,\n",[202,329,331],{"class":204,"line":330},21,[202,332,333],{"class":212},"  inferJWEAllowedAlgorithms,\n",[202,335,337],{"class":204,"line":336},22,[202,338,339],{"class":212},"  sanitizeObject,\n",[202,341,343,346,349,353],{"class":204,"line":342},23,[202,344,345],{"class":212},"} ",[202,347,348],{"class":208},"from",[202,350,352],{"class":351},"sfrk1"," \"unjwt\u002Futils\"",[202,354,355],{"class":212},";\n",[173,357,358,359,362],{},"All of these are also available from the flat barrel ",[177,360,361],{},"unjwt",".",[364,365,367],"h2",{"id":366},"encoding","Encoding",[369,370,372],"h3",{"id":371},"base64urlencodedata",[177,373,374],{},"base64UrlEncode(data)",[173,376,377,378,381,382,386,387,362],{},"Encodes ",[177,379,380],{},"Uint8Array | string"," to ",[383,384,385],"strong",{},"Base64URL"," (no padding, URL-safe alphabet). Returns a ",[177,388,389],{},"string",[193,391,393],{"className":195,"code":392,"language":197,"meta":198,"style":198},"base64UrlEncode(new Uint8Array([255, 255])); \u002F\u002F \"__8\"\nbase64UrlEncode(\"hello\"); \u002F\u002F \"aGVsbG8\"\n",[177,394,395,429],{"__ignoreMap":198},[202,396,397,401,404,407,410,413,417,420,422,425],{"class":204,"line":205},[202,398,400],{"class":399},"shcOC","base64UrlEncode",[202,402,403],{"class":212},"(",[202,405,406],{"class":208},"new",[202,408,409],{"class":399}," Uint8Array",[202,411,412],{"class":212},"([",[202,414,416],{"class":415},"suiK_","255",[202,418,419],{"class":212},", ",[202,421,416],{"class":415},[202,423,424],{"class":212},"])); ",[202,426,428],{"class":427},"sCsY4","\u002F\u002F \"__8\"\n",[202,430,431,433,435,438,441],{"class":204,"line":216},[202,432,400],{"class":399},[202,434,403],{"class":212},[202,436,437],{"class":351},"\"hello\"",[202,439,440],{"class":212},"); ",[202,442,443],{"class":427},"\u002F\u002F \"aGVsbG8\"\n",[369,445,447],{"id":446},"base64urldecodedata-options",[177,448,449],{},"base64UrlDecode(data, options?)",[173,451,452,453,456,457,459,460,462,463,465,466,468,469,472,473,476,477,480],{},"Decodes a Base64URL string or ",[177,454,455],{},"Uint8Array",". Without an options object the return type follows the input: a ",[177,458,389],{}," input returns a decoded ",[177,461,389],{},", a ",[177,464,455],{}," input returns a ",[177,467,455],{},". Pass ",[177,470,471],{},"{ returnAs: \"string\" }"," or ",[177,474,475],{},"{ returnAs: \"uint8array\" }"," (alias ",[177,478,479],{},"\"bytes\"",") to force the return type.",[193,482,484],{"className":195,"code":483,"language":197,"meta":198,"style":198},"base64UrlDecode(\"aGVsbG8\"); \u002F\u002F \"hello\"\nbase64UrlDecode(\"aGVsbG8\", { returnAs: \"uint8array\" });\n\u002F\u002F Uint8Array([104, 101, 108, 108, 111])\nbase64UrlDecode(new Uint8Array([97, 71, 86, 115, 98, 71, 56]), { returnAs: \"string\" });\n\u002F\u002F \"hello\"\n",[177,485,486,501,518,523,575],{"__ignoreMap":198},[202,487,488,491,493,496,498],{"class":204,"line":205},[202,489,490],{"class":399},"base64UrlDecode",[202,492,403],{"class":212},[202,494,495],{"class":351},"\"aGVsbG8\"",[202,497,440],{"class":212},[202,499,500],{"class":427},"\u002F\u002F \"hello\"\n",[202,502,503,505,507,509,512,515],{"class":204,"line":216},[202,504,490],{"class":399},[202,506,403],{"class":212},[202,508,495],{"class":351},[202,510,511],{"class":212},", { returnAs: ",[202,513,514],{"class":351},"\"uint8array\"",[202,516,517],{"class":212}," });\n",[202,519,520],{"class":204,"line":222},[202,521,522],{"class":427},"\u002F\u002F Uint8Array([104, 101, 108, 108, 111])\n",[202,524,525,527,529,531,533,535,538,540,543,545,548,550,553,555,558,560,562,564,567,570,573],{"class":204,"line":228},[202,526,490],{"class":399},[202,528,403],{"class":212},[202,530,406],{"class":208},[202,532,409],{"class":399},[202,534,412],{"class":212},[202,536,537],{"class":415},"97",[202,539,419],{"class":212},[202,541,542],{"class":415},"71",[202,544,419],{"class":212},[202,546,547],{"class":415},"86",[202,549,419],{"class":212},[202,551,552],{"class":415},"115",[202,554,419],{"class":212},[202,556,557],{"class":415},"98",[202,559,419],{"class":212},[202,561,542],{"class":415},[202,563,419],{"class":212},[202,565,566],{"class":415},"56",[202,568,569],{"class":212},"]), { returnAs: ",[202,571,572],{"class":351},"\"string\"",[202,574,517],{"class":212},[202,576,577],{"class":204,"line":234},[202,578,500],{"class":427},[369,580,582,184,585],{"id":581},"base64encodedata-base64decodedata-options",[177,583,584],{},"base64Encode(data)",[177,586,587],{},"base64Decode(data, options?)",[173,589,590,591,594,595,598,599,602,603,605],{},"Standard Base64 (with ",[177,592,593],{},"="," padding). Same signatures as the URL-safe variants — ",[177,596,597],{},"base64Decode"," accepts the same ",[177,600,601],{},"{ returnAs }"," options object as ",[177,604,490],{},". Use when interoperating with systems that expect classical Base64.",[364,607,609],{"id":608},"randomness","Randomness",[369,611,613],{"id":612},"securerandombytes",[177,614,615],{},"secureRandomBytes",[193,617,619],{"className":195,"code":618,"language":197,"meta":198,"style":198},"secureRandomBytes(length);\n",[177,620,621],{"__ignoreMap":198},[202,622,623,625],{"class":204,"line":205},[202,624,615],{"class":399},[202,626,627],{"class":212},"(length);\n",[173,629,630,631,633,634,643],{},"Returns a cryptographically secure ",[177,632,455],{}," of the specified length, via ",[635,636,640],"a",{"href":637,"rel":638},"https:\u002F\u002Fdeveloper.mozilla.org\u002Fen-US\u002Fdocs\u002FWeb\u002FAPI\u002FCrypto\u002FgetRandomValues",[639],"nofollow",[177,641,642],{},"crypto.getRandomValues",":",[193,645,647],{"className":195,"code":646,"language":197,"meta":198,"style":198},"const salt = secureRandomBytes(16); \u002F\u002F 128-bit random salt\nconst cek = secureRandomBytes(32); \u002F\u002F 256-bit CEK\n",[177,648,649,673],{"__ignoreMap":198},[202,650,651,654,657,660,663,665,668,670],{"class":204,"line":205},[202,652,653],{"class":208},"const",[202,655,656],{"class":415}," salt",[202,658,659],{"class":208}," =",[202,661,662],{"class":399}," secureRandomBytes",[202,664,403],{"class":212},[202,666,667],{"class":415},"16",[202,669,440],{"class":212},[202,671,672],{"class":427},"\u002F\u002F 128-bit random salt\n",[202,674,675,677,680,682,684,686,689,691],{"class":204,"line":216},[202,676,653],{"class":208},[202,678,679],{"class":415}," cek",[202,681,659],{"class":208},[202,683,662],{"class":399},[202,685,403],{"class":212},[202,687,688],{"class":415},"32",[202,690,440],{"class":212},[202,692,693],{"class":427},"\u002F\u002F 256-bit CEK\n",[173,695,696,697,700],{},"Use this — not ",[177,698,699],{},"Math.random()",", not a Node-specific API — for any security-sensitive randomness. It works everywhere unjwt runs.",[702,703,704],"note",{},[173,705,706,707,710,711,362],{},"There is no ",[177,708,709],{},"randomBytes"," alias — use ",[177,712,615],{},[364,714,716],{"id":715},"concatenation","Concatenation",[369,718,720],{"id":719},"concatuint8arraysarrays",[177,721,722],{},"concatUint8Arrays(...arrays)",[173,724,725,726,728,729,732],{},"Concatenates multiple ",[177,727,455],{}," instances into one. Useful when building custom envelopes or AAD strings without intermediate ",[177,730,731],{},"Buffer"," allocations:",[193,734,736],{"className":195,"code":735,"language":197,"meta":198,"style":198},"const aad = concatUint8Arrays(\n  textEncoder.encode(base64UrlEncode(protectedHeader)),\n  new Uint8Array([0x2e]), \u002F\u002F \".\"\n  textEncoder.encode(base64UrlEncode(externalAad)),\n);\n",[177,737,738,753,768,786,799],{"__ignoreMap":198},[202,739,740,742,745,747,750],{"class":204,"line":205},[202,741,653],{"class":208},[202,743,744],{"class":415}," aad",[202,746,659],{"class":208},[202,748,749],{"class":399}," concatUint8Arrays",[202,751,752],{"class":212},"(\n",[202,754,755,758,761,763,765],{"class":204,"line":216},[202,756,757],{"class":212},"  textEncoder.",[202,759,760],{"class":399},"encode",[202,762,403],{"class":212},[202,764,400],{"class":399},[202,766,767],{"class":212},"(protectedHeader)),\n",[202,769,770,773,775,777,780,783],{"class":204,"line":222},[202,771,772],{"class":208},"  new",[202,774,409],{"class":399},[202,776,412],{"class":212},[202,778,779],{"class":415},"0x2e",[202,781,782],{"class":212},"]), ",[202,784,785],{"class":427},"\u002F\u002F \".\"\n",[202,787,788,790,792,794,796],{"class":204,"line":228},[202,789,757],{"class":212},[202,791,760],{"class":399},[202,793,403],{"class":212},[202,795,400],{"class":399},[202,797,798],{"class":212},"(externalAad)),\n",[202,800,801],{"class":204,"line":234},[202,802,803],{"class":212},");\n",[364,805,807],{"id":806},"singletons","Singletons",[369,809,811,184,814],{"id":810},"textencoder-textdecoder",[177,812,813],{},"textEncoder",[177,815,816],{},"textDecoder",[173,818,819,820,823,824,827],{},"Singleton ",[177,821,822],{},"TextEncoder"," and ",[177,825,826],{},"TextDecoder"," instances — reuse them instead of allocating new ones per call:",[193,829,831],{"className":195,"code":830,"language":197,"meta":198,"style":198},"textEncoder.encode(\"hello\"); \u002F\u002F Uint8Array\ntextDecoder.decode(uint8ArrayBytes); \u002F\u002F string\n",[177,832,833,849],{"__ignoreMap":198},[202,834,835,838,840,842,844,846],{"class":204,"line":205},[202,836,837],{"class":212},"textEncoder.",[202,839,760],{"class":399},[202,841,403],{"class":212},[202,843,437],{"class":351},[202,845,440],{"class":212},[202,847,848],{"class":427},"\u002F\u002F Uint8Array\n",[202,850,851,854,857,860],{"class":204,"line":216},[202,852,853],{"class":212},"textDecoder.",[202,855,856],{"class":399},"decode",[202,858,859],{"class":212},"(uint8ArrayBytes); ",[202,861,862],{"class":427},"\u002F\u002F string\n",[364,864,866],{"id":865},"type-guards","Type guards",[868,869,870,886],"table",{},[871,872,873],"thead",{},[874,875,876,880,883],"tr",{},[877,878,879],"th",{},"Function",[877,881,882],{},"Returns",[877,884,885],{},"Checks",[887,888,889,908,925,943,968,990,1008,1027,1044],"tbody",{},[874,890,891,897,902],{},[892,893,894],"td",{},[177,895,896],{},"isJWK(key)",[892,898,899],{},[177,900,901],{},"key is JWK",[892,903,904,905],{},"Object with ",[177,906,907],{},"kty",[874,909,910,915,920],{},[892,911,912],{},[177,913,914],{},"isJWKSet(key)",[892,916,917],{},[177,918,919],{},"key is JWKSet",[892,921,904,922],{},[177,923,924],{},"keys: JWK[]",[874,926,927,932,937],{},[892,928,929],{},[177,930,931],{},"isCryptoKey(key)",[892,933,934],{},[177,935,936],{},"key is CryptoKey",[892,938,939,942],{},[177,940,941],{},"CryptoKey"," instance",[874,944,945,950,955],{},[892,946,947],{},[177,948,949],{},"isCryptoKeyPair(key)",[892,951,952],{},[177,953,954],{},"key is CryptoKeyPair",[892,956,904,957,960,961,964,965,967],{},[177,958,959],{},"publicKey"," + ",[177,962,963],{},"privateKey"," as ",[177,966,941],{},"s",[874,969,970,975,980],{},[892,971,972],{},[177,973,974],{},"isSymmetricJWK(key)",[892,976,977],{},[177,978,979],{},"key is JWK_oct",[892,981,982,983,823,986,989],{},"JWK with ",[177,984,985],{},"kty: \"oct\"",[177,987,988],{},"k"," property",[874,991,992,997,1002],{},[892,993,994],{},[177,995,996],{},"isAsymmetricJWK(key)",[892,998,999],{},[177,1000,1001],{},"key is JWK_Asymmetric",[892,1003,1004,1005],{},"JWK that isn't ",[177,1006,1007],{},"oct",[874,1009,1010,1015,1020],{},[892,1011,1012],{},[177,1013,1014],{},"isPrivateJWK(key)",[892,1016,1017],{},[177,1018,1019],{},"key is JWK_Private",[892,1021,1022,1023,1026],{},"Asymmetric JWK with a ",[177,1024,1025],{},"d"," (private component)",[874,1028,1029,1034,1039],{},[892,1030,1031],{},[177,1032,1033],{},"isPublicJWK(key)",[892,1035,1036],{},[177,1037,1038],{},"key is JWK_Public",[892,1040,1041,1042],{},"Asymmetric JWK without ",[177,1043,1025],{},[874,1045,1046,1051,1054],{},[892,1047,1048],{},[177,1049,1050],{},"assertCryptoKey(key)",[892,1052,1053],{},"assertion",[892,1055,1056,1057],{},"Throws if not a ",[177,1058,941],{},[193,1060,1063],{"className":195,"code":1061,"filename":1062,"language":197,"meta":198,"style":198},"import { isPrivateJWK, isSymmetricJWK } from \"unjwt\u002Futils\";\n\nfunction canSign(k: unknown) {\n  return isSymmetricJWK(k) || isPrivateJWK(k);\n}\n","guards.ts",[177,1064,1065,1078,1084,1105,1125],{"__ignoreMap":198},[202,1066,1067,1069,1072,1074,1076],{"class":204,"line":205},[202,1068,209],{"class":208},[202,1070,1071],{"class":212}," { isPrivateJWK, isSymmetricJWK } ",[202,1073,348],{"class":208},[202,1075,352],{"class":351},[202,1077,355],{"class":212},[202,1079,1080],{"class":204,"line":216},[202,1081,1083],{"emptyLinePlaceholder":1082},true,"\n",[202,1085,1086,1089,1092,1094,1097,1099,1102],{"class":204,"line":222},[202,1087,1088],{"class":208},"function",[202,1090,1091],{"class":399}," canSign",[202,1093,403],{"class":212},[202,1095,988],{"class":1096},"sQHwn",[202,1098,643],{"class":208},[202,1100,1101],{"class":415}," unknown",[202,1103,1104],{"class":212},") {\n",[202,1106,1107,1110,1113,1116,1119,1122],{"class":204,"line":228},[202,1108,1109],{"class":208},"  return",[202,1111,1112],{"class":399}," isSymmetricJWK",[202,1114,1115],{"class":212},"(k) ",[202,1117,1118],{"class":208},"||",[202,1120,1121],{"class":399}," isPrivateJWK",[202,1123,1124],{"class":212},"(k);\n",[202,1126,1127],{"class":204,"line":234},[202,1128,1129],{"class":212},"}\n",[364,1131,1133],{"id":1132},"jwt-claim-validation","JWT claim validation",[369,1135,1137],{"id":1136},"validatejwtclaims",[177,1138,1139],{},"validateJwtClaims",[193,1141,1143],{"className":195,"code":1142,"language":197,"meta":198,"style":198},"validateJwtClaims(claims, options?)\n",[177,1144,1145],{"__ignoreMap":198},[202,1146,1147,1149,1152,1155],{"class":204,"line":205},[202,1148,1139],{"class":399},[202,1150,1151],{"class":212},"(claims, options",[202,1153,1154],{"class":208},"?",[202,1156,1157],{"class":212},")\n",[173,1159,1160,1161,823,1164,1167,1168,1171],{},"The low-level claim validator used inside ",[177,1162,1163],{},"verify()",[177,1165,1166],{},"decrypt()",". Throws ",[177,1169,1170],{},"JWTError"," on failure. Checks:",[1173,1174,1175,1182,1188,1197,1203,1209,1215],"ul",{},[1176,1177,1178,1181],"li",{},[177,1179,1180],{},"exp"," — expiration",[1176,1183,1184,1187],{},[177,1185,1186],{},"nbf"," — not-before",[1176,1189,1190,1193,1194,1196],{},[177,1191,1192],{},"iat"," — issued-at type check and (with ",[177,1195,187],{},") age bound",[1176,1198,1199,1202],{},[177,1200,1201],{},"iss"," — issuer",[1176,1204,1205,1208],{},[177,1206,1207],{},"sub"," — subject",[1176,1210,1211,1214],{},[177,1212,1213],{},"aud"," — audience",[1176,1216,1217,1220],{},[177,1218,1219],{},"requiredClaims"," — presence of a named set",[173,1222,1223,1224,419,1226,419,1228,1230,1231,1234,1235,419,1238,1241],{},"Timestamps (",[177,1225,1180],{},[177,1227,1186],{},[177,1229,1192],{},") are validated ",[383,1232,1233],{},"strictly",": if present but not a finite number (string, ",[177,1236,1237],{},"NaN",[177,1239,1240],{},"null","), the check throws rather than silently skipping.",[702,1243,1244],{},[173,1245,1246,1249,1250,184,1252,1254,1255,1257],{},[177,1247,1248],{},"typ"," is part of {@link JWTClaimValidationOptions} but is validated at the ",[177,1251,1163],{},[177,1253,1166],{}," layer (against the protected header), not inside ",[177,1256,1139],{}," itself.",[369,1259,1261],{"id":1260},"jwtclaimvalidationoptions",[177,1262,1263],{},"JWTClaimValidationOptions",[193,1265,1267],{"className":195,"code":1266,"language":197,"meta":198,"style":198},"interface JWTClaimValidationOptions {\n  audience?: string | string[];\n  issuer?: string | string[];\n  subject?: string;\n  maxTokenAge?: MaxTokenAge; \u002F\u002F alias of Duration\n  clockTolerance?: number; \u002F\u002F seconds; defaults to 0\n  typ?: string;\n  currentDate?: Date;\n  requiredClaims?: string[];\n  \u002F**\n   * Critical header parameters this caller understands.\n   * Verification fails if the token's `crit` header lists a parameter\n   * not in this list (RFC 7515 §4.1.11 \u002F RFC 7516 §4.1.13).\n   *\u002F\n  recognizedHeaders?: string[];\n}\n",[177,1268,1269,1279,1298,1313,1324,1340,1355,1366,1378,1389,1394,1399,1404,1409,1414,1425],{"__ignoreMap":198},[202,1270,1271,1274,1277],{"class":204,"line":205},[202,1272,1273],{"class":208},"interface",[202,1275,1276],{"class":399}," JWTClaimValidationOptions",[202,1278,213],{"class":212},[202,1280,1281,1284,1287,1290,1293,1295],{"class":204,"line":216},[202,1282,1283],{"class":1096},"  audience",[202,1285,1286],{"class":208},"?:",[202,1288,1289],{"class":415}," string",[202,1291,1292],{"class":208}," |",[202,1294,1289],{"class":415},[202,1296,1297],{"class":212},"[];\n",[202,1299,1300,1303,1305,1307,1309,1311],{"class":204,"line":222},[202,1301,1302],{"class":1096},"  issuer",[202,1304,1286],{"class":208},[202,1306,1289],{"class":415},[202,1308,1292],{"class":208},[202,1310,1289],{"class":415},[202,1312,1297],{"class":212},[202,1314,1315,1318,1320,1322],{"class":204,"line":228},[202,1316,1317],{"class":1096},"  subject",[202,1319,1286],{"class":208},[202,1321,1289],{"class":415},[202,1323,355],{"class":212},[202,1325,1326,1329,1331,1334,1337],{"class":204,"line":234},[202,1327,1328],{"class":1096},"  maxTokenAge",[202,1330,1286],{"class":208},[202,1332,1333],{"class":399}," MaxTokenAge",[202,1335,1336],{"class":212},"; ",[202,1338,1339],{"class":427},"\u002F\u002F alias of Duration\n",[202,1341,1342,1345,1347,1350,1352],{"class":204,"line":240},[202,1343,1344],{"class":1096},"  clockTolerance",[202,1346,1286],{"class":208},[202,1348,1349],{"class":415}," number",[202,1351,1336],{"class":212},[202,1353,1354],{"class":427},"\u002F\u002F seconds; defaults to 0\n",[202,1356,1357,1360,1362,1364],{"class":204,"line":246},[202,1358,1359],{"class":1096},"  typ",[202,1361,1286],{"class":208},[202,1363,1289],{"class":415},[202,1365,355],{"class":212},[202,1367,1368,1371,1373,1376],{"class":204,"line":252},[202,1369,1370],{"class":1096},"  currentDate",[202,1372,1286],{"class":208},[202,1374,1375],{"class":399}," Date",[202,1377,355],{"class":212},[202,1379,1380,1383,1385,1387],{"class":204,"line":258},[202,1381,1382],{"class":1096},"  requiredClaims",[202,1384,1286],{"class":208},[202,1386,1289],{"class":415},[202,1388,1297],{"class":212},[202,1390,1391],{"class":204,"line":264},[202,1392,1393],{"class":427},"  \u002F**\n",[202,1395,1396],{"class":204,"line":270},[202,1397,1398],{"class":427},"   * Critical header parameters this caller understands.\n",[202,1400,1401],{"class":204,"line":276},[202,1402,1403],{"class":427},"   * Verification fails if the token's `crit` header lists a parameter\n",[202,1405,1406],{"class":204,"line":282},[202,1407,1408],{"class":427},"   * not in this list (RFC 7515 §4.1.11 \u002F RFC 7516 §4.1.13).\n",[202,1410,1411],{"class":204,"line":288},[202,1412,1413],{"class":427},"   *\u002F\n",[202,1415,1416,1419,1421,1423],{"class":204,"line":294},[202,1417,1418],{"class":1096},"  recognizedHeaders",[202,1420,1286],{"class":208},[202,1422,1289],{"class":415},[202,1424,1297],{"class":212},[202,1426,1427],{"class":204,"line":300},[202,1428,1129],{"class":212},[173,1430,1431,1432,823,1437,1442],{},"This same interface is extended by ",[635,1433,1434],{"href":42},[177,1435,1436],{},"JWSVerifyOptions",[635,1438,1439],{"href":65},[177,1440,1441],{},"JWEDecryptOptions"," — so the options below work identically everywhere.",[364,1444,1446,1447,1449],{"id":1445},"the-duration-format","The ",[177,1448,179],{}," format",[173,1451,1452,419,1454,419,1456,1458],{},[177,1453,183],{},[177,1455,190],{},[177,1457,187],{},", and friends all accept a single type:",[193,1460,1462],{"className":195,"code":1461,"language":197,"meta":198,"style":198},"type Duration = number | `${number}` | `${number}${Unit}`;\n\n\u002F\u002F Unit short forms: s m h D W M Y\n\u002F\u002F Unit long forms: seconds minutes hours days weeks months years\n\u002F\u002F (both singular and plural accepted for long forms)\n",[177,1463,1464,1503,1507,1512,1517],{"__ignoreMap":198},[202,1465,1466,1469,1472,1474,1476,1478,1481,1484,1487,1489,1491,1493,1496,1499,1501],{"class":204,"line":205},[202,1467,1468],{"class":208},"type",[202,1470,1471],{"class":399}," Duration",[202,1473,659],{"class":208},[202,1475,1349],{"class":415},[202,1477,1292],{"class":208},[202,1479,1480],{"class":351}," `${",[202,1482,1483],{"class":415},"number",[202,1485,1486],{"class":351},"}`",[202,1488,1292],{"class":208},[202,1490,1480],{"class":351},[202,1492,1483],{"class":415},[202,1494,1495],{"class":351},"}${",[202,1497,1498],{"class":399},"Unit",[202,1500,1486],{"class":351},[202,1502,355],{"class":212},[202,1504,1505],{"class":204,"line":216},[202,1506,1083],{"emptyLinePlaceholder":1082},[202,1508,1509],{"class":204,"line":222},[202,1510,1511],{"class":427},"\u002F\u002F Unit short forms: s m h D W M Y\n",[202,1513,1514],{"class":204,"line":228},[202,1515,1516],{"class":427},"\u002F\u002F Unit long forms: seconds minutes hours days weeks months years\n",[202,1518,1519],{"class":204,"line":234},[202,1520,1521],{"class":427},"\u002F\u002F (both singular and plural accepted for long forms)\n",[173,1523,1524,1525,419,1528,419,1531,419,1534,362],{},"Number and unit must be adjacent — no space. Case matters for the single-letter day\u002Fweek\u002Fmonth\u002Fyear units: ",[177,1526,1527],{},"D",[177,1529,1530],{},"W",[177,1532,1533],{},"M",[177,1535,1536],{},"Y",[173,1538,1539],{},"Examples that all resolve to 3600 seconds:",[193,1541,1543],{"className":195,"code":1542,"language":197,"meta":198,"style":198},"3600\n\"3600\"    \"3600s\"    \"3600seconds\"\n\"60m\"     \"60minutes\"\n\"1h\"      \"1hour\"\n",[177,1544,1545,1550,1561,1569],{"__ignoreMap":198},[202,1546,1547],{"class":204,"line":205},[202,1548,1549],{"class":415},"3600\n",[202,1551,1552,1555,1558],{"class":204,"line":216},[202,1553,1554],{"class":351},"\"3600\"",[202,1556,1557],{"class":351},"    \"3600s\"",[202,1559,1560],{"class":351},"    \"3600seconds\"\n",[202,1562,1563,1566],{"class":204,"line":222},[202,1564,1565],{"class":351},"\"60m\"",[202,1567,1568],{"class":351},"     \"60minutes\"\n",[202,1570,1571,1574],{"class":204,"line":228},[202,1572,1573],{"class":351},"\"1h\"",[202,1575,1576],{"class":351},"      \"1hour\"\n",[173,1578,1579],{},"And others:",[193,1581,1583],{"className":195,"code":1582,"language":197,"meta":198,"style":198},"\"7D\"; \u002F\u002F 7 days\n\"1W\"; \u002F\u002F 1 week\n\"3M\"; \u002F\u002F 3 months (30-day months)\n\"1Y\"; \u002F\u002F 1 year (365-day years)\n\"30s\"; \u002F\u002F 30 seconds\n",[177,1584,1585,1595,1605,1615,1625],{"__ignoreMap":198},[202,1586,1587,1590,1592],{"class":204,"line":205},[202,1588,1589],{"class":351},"\"7D\"",[202,1591,1336],{"class":212},[202,1593,1594],{"class":427},"\u002F\u002F 7 days\n",[202,1596,1597,1600,1602],{"class":204,"line":216},[202,1598,1599],{"class":351},"\"1W\"",[202,1601,1336],{"class":212},[202,1603,1604],{"class":427},"\u002F\u002F 1 week\n",[202,1606,1607,1610,1612],{"class":204,"line":222},[202,1608,1609],{"class":351},"\"3M\"",[202,1611,1336],{"class":212},[202,1613,1614],{"class":427},"\u002F\u002F 3 months (30-day months)\n",[202,1616,1617,1620,1622],{"class":204,"line":228},[202,1618,1619],{"class":351},"\"1Y\"",[202,1621,1336],{"class":212},[202,1623,1624],{"class":427},"\u002F\u002F 1 year (365-day years)\n",[202,1626,1627,1630,1632],{"class":204,"line":234},[202,1628,1629],{"class":351},"\"30s\"",[202,1631,1336],{"class":212},[202,1633,1634],{"class":427},"\u002F\u002F 30 seconds\n",[369,1636,1638],{"id":1637},"computedurationinsecondsduration",[177,1639,1640],{},"computeDurationInSeconds(duration)",[173,1642,1643,1644,1646,1647,643],{},"Converts a ",[177,1645,179],{}," to a positive integer number of seconds. Throws if the result is ",[177,1648,1649],{},"\u003C= 0",[193,1651,1653],{"className":195,"code":1652,"language":197,"meta":198,"style":198},"computeDurationInSeconds(\"1h\"); \u002F\u002F 3600\ncomputeDurationInSeconds(\"7D\"); \u002F\u002F 604800\ncomputeDurationInSeconds(30); \u002F\u002F 30\n",[177,1654,1655,1669,1682],{"__ignoreMap":198},[202,1656,1657,1660,1662,1664,1666],{"class":204,"line":205},[202,1658,1659],{"class":399},"computeDurationInSeconds",[202,1661,403],{"class":212},[202,1663,1573],{"class":351},[202,1665,440],{"class":212},[202,1667,1668],{"class":427},"\u002F\u002F 3600\n",[202,1670,1671,1673,1675,1677,1679],{"class":204,"line":216},[202,1672,1659],{"class":399},[202,1674,403],{"class":212},[202,1676,1589],{"class":351},[202,1678,440],{"class":212},[202,1680,1681],{"class":427},"\u002F\u002F 604800\n",[202,1683,1684,1686,1688,1691,1693],{"class":204,"line":222},[202,1685,1659],{"class":399},[202,1687,403],{"class":212},[202,1689,1690],{"class":415},"30",[202,1692,440],{"class":212},[202,1694,1695],{"class":427},"\u002F\u002F 30\n",[702,1697,1698],{},[173,1699,1700,823,1703,1706,1707,1710,1711,1713],{},[177,1701,1702],{},"computeMaxTokenAgeSeconds",[177,1704,1705],{},"computeExpiresInSeconds"," are ",[177,1708,1709],{},"@deprecated"," aliases retained for backward compatibility. Prefer ",[177,1712,1659],{}," in new code.",[364,1715,1717],{"id":1716},"algorithm-inference","Algorithm inference",[173,1719,1720,1721,1724],{},"Used internally to derive allowlists from key shapes when ",[177,1722,1723],{},"options.algorithms"," is omitted. Exposed for advanced use — e.g. building a logging layer that reports which algorithms your infrastructure actually exercises.",[369,1726,1728],{"id":1727},"inferjwsallowedalgorithms",[177,1729,1730],{},"inferJWSAllowedAlgorithms",[193,1732,1734],{"className":195,"code":1733,"language":197,"meta":198,"style":198},"inferJWSAllowedAlgorithms(key);\n",[177,1735,1736],{"__ignoreMap":198},[202,1737,1738,1740],{"class":204,"line":205},[202,1739,1730],{"class":399},[202,1741,1742],{"class":212},"(key);\n",[173,1744,1745,1746,1749],{},"Returns the set of signing algorithms a key can unambiguously produce, or ",[177,1747,1748],{},"undefined"," if inference isn't possible (raw bytes, alg-less JWK, lookup function).",[369,1751,1753],{"id":1752},"inferjweallowedalgorithms",[177,1754,1755],{},"inferJWEAllowedAlgorithms",[193,1757,1759],{"className":195,"code":1758,"language":197,"meta":198,"style":198},"inferJWEAllowedAlgorithms(key);\n",[177,1760,1761],{"__ignoreMap":198},[202,1762,1763,1765],{"class":204,"line":205},[202,1764,1755],{"class":399},[202,1766,1742],{"class":212},[173,1768,1769,1770,1773,1774,1777,1778,362],{},"Returns the set of key-management algorithms a key can unambiguously handle. Passwords infer to the three ",[177,1771,1772],{},"PBES2-*"," variants plus ",[177,1775,1776],{},"\"dir\"","; symmetric keys infer to their specific wrap alg plus ",[177,1779,1776],{},[173,1781,1782,1783,1785,1786,1789,1790,1792],{},"When these return ",[177,1784,1748],{},", callers ",[383,1787,1788],{},"must"," pass ",[177,1791,1723],{}," explicitly — otherwise verification \u002F decryption has no effective algorithm guard.",[364,1794,1796],{"id":1795},"sanitizeobject",[177,1797,1798],{},"sanitizeObject",[193,1800,1802],{"className":195,"code":1801,"language":197,"meta":198,"style":198},"sanitizeObject(obj);\n",[177,1803,1804],{"__ignoreMap":198},[202,1805,1806,1808],{"class":204,"line":205},[202,1807,1798],{"class":399},[202,1809,1810],{"class":212},"(obj);\n",[173,1812,1813,1814,1817,1818,419,1821,1824,1825,1828],{},"Returns a deep structural copy of ",[177,1815,1816],{},"obj"," with the prototype-pollution vectors ",[177,1819,1820],{},"__proto__",[177,1822,1823],{},"prototype",", and ",[177,1826,1827],{},"constructor"," stripped at every level. Input is never modified.",[173,1830,1831],{},"unjwt applies this internally to all parsed JWT headers and user-supplied options — you rarely need to call it yourself. Exposed for userland code that handles untrusted JSON.",[364,1833,1835],{"id":1834},"see-also","See also",[1173,1837,1838,1844,1850],{},[1176,1839,1840,1843],{},[635,1841,1842],{"href":20},"Getting started: core concepts →"," — a plain-language walkthrough of the claims this module validates.",[1176,1845,1846,1849],{},[635,1847,1848],{"href":42},"JWS verifying →"," — the claim validation options in context.",[1176,1851,1852,1855],{},[635,1853,1854],{"href":65},"JWE decrypting →"," — same options on the encrypted side.",[1857,1858,1859],"style",{},"html pre.shiki code .so5gQ, html code.shiki .so5gQ{--shiki-light:#D73A49;--shiki-default:#F97583;--shiki-dark:#F97583}html pre.shiki code .slsVL, html code.shiki .slsVL{--shiki-light:#24292E;--shiki-default:#E1E4E8;--shiki-dark:#E1E4E8}html pre.shiki code .sfrk1, html code.shiki .sfrk1{--shiki-light:#032F62;--shiki-default:#9ECBFF;--shiki-dark:#9ECBFF}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .shcOC, html code.shiki .shcOC{--shiki-light:#6F42C1;--shiki-default:#B392F0;--shiki-dark:#B392F0}html pre.shiki code .suiK_, html code.shiki .suiK_{--shiki-light:#005CC5;--shiki-default:#79B8FF;--shiki-dark:#79B8FF}html pre.shiki code .sCsY4, html code.shiki .sCsY4{--shiki-light:#6A737D;--shiki-default:#6A737D;--shiki-dark:#6A737D}html pre.shiki code .sQHwn, html code.shiki .sQHwn{--shiki-light:#E36209;--shiki-default:#FFAB70;--shiki-dark:#FFAB70}",{"title":198,"searchDepth":216,"depth":216,"links":1861},[1862,1868,1871,1874,1878,1879,1883,1887,1891,1892],{"id":366,"depth":216,"text":367,"children":1863},[1864,1865,1866],{"id":371,"depth":222,"text":374},{"id":446,"depth":222,"text":449},{"id":581,"depth":222,"text":1867},"base64Encode(data) \u002F base64Decode(data, options?)",{"id":608,"depth":216,"text":609,"children":1869},[1870],{"id":612,"depth":222,"text":615},{"id":715,"depth":216,"text":716,"children":1872},[1873],{"id":719,"depth":222,"text":722},{"id":806,"depth":216,"text":807,"children":1875},[1876],{"id":810,"depth":222,"text":1877},"textEncoder \u002F textDecoder",{"id":865,"depth":216,"text":866},{"id":1132,"depth":216,"text":1133,"children":1880},[1881,1882],{"id":1136,"depth":222,"text":1139},{"id":1260,"depth":222,"text":1263},{"id":1445,"depth":216,"text":1884,"children":1885},"The Duration format",[1886],{"id":1637,"depth":222,"text":1640},{"id":1716,"depth":216,"text":1717,"children":1888},[1889,1890],{"id":1727,"depth":222,"text":1730},{"id":1752,"depth":222,"text":1755},{"id":1795,"depth":216,"text":1798},{"id":1834,"depth":216,"text":1835},"md",{"icon":147},{"icon":147},{"title":142,"description":198},"MLvsZahOe2eVSfhIxVXjyKlH43HaTu6tdAvSPmnxUCw",[1899,1900],{"title":138,"path":139,"stem":140,"description":198,"children":-1},{"title":149,"path":150,"stem":151,"description":198,"icon":154,"children":-1},1776888557912]