unjwt

分类: 商业与运营 | 上传者: sandros94 | 下载: 0 | 版本: v1.0（最新）

使用 unjwt 的专业知识 — 一个使用 Web Crypto API 的低级、零深度 JWT 库。每当用户使用 JWS、JWE、JWK 或 JWT 实用程序（包括签名、验证、加密、解密、密钥管理和会话处理）时，请使用此技能。在提及 unjwt 或相关 JWT 操作时触发。

更新日志: Source: GitHub https://github.com/sandros94/unjwt

目录结构

当前层级: tree/main/skills/unjwt/

📁 references/
- 📄 adapters-h3.md 11.6 KB
- 📄 jwe.md 7.2 KB
- 📄 jwk.md 11.7 KB
- 📄 jws.md 5.0 KB
- 📄 utils.md 3.9 KB
📄 SKILL.md 5.2 KB

SKILL.md

---
name: unjwt
description: "Expert knowledge for working with unjwt — a low-level, zero-dep, JWT library using the Web Crypto API. Use this skill whenever the user is working with JWS, JWE, JWK, or JWT utilities, including signing, verifying, encrypting, decrypting, key management, and session handling. Trigger on any mention of unjwt or related JWT operations."
metadata:
  version: 0.1.0
  library: unjwt
  library-version: 0.6.0
  org: sandros94
  documentation: https://github.com/sandros94/unjwt
---

# unjwt Skill

Low-level JWT library using the Web Crypto API. Zero runtime dependencies for core; optional peer deps for framework adapters.

Implements JWS (RFC 7515), JWE (RFC 7516), and JWK (RFC 7517).

## Quick orientation

> **Skill written against `unjwt@0.6.0`.** APIs are stable within v0.6 but check the [changelog](https://github.com/sandros94/unjwt/releases) if behaviour seems off on a newer version.

The following is a list of reference files:

- `references/jws.md`: `sign()`, `verify()`, `JWSSignOptions`, `JWSVerifyOptions`
- `references/jwe.md`: `encrypt()`, `decrypt()`, `JWEEncryptOptions`, `JWEDecryptOptions`
- `references/jwk.md`: `generateKey()`, `generateJWK()`, `importKey()`, `exportKey()`, `wrapKey()`, `unwrapKey()`, `deriveSharedSecret()`, PEM import/export (`importFromPEM`, `exportToPEM`), PBES2 key derivation (`deriveKeyFromPassword`, `deriveJWKFromPassword`), JWK set utilities (`getJWKsFromSet`, `getJWKFromSet` — deprecated), JWK cache (`configureJWKCache`, `clearJWKCache`, `WeakMapJWKCache`), key lookup types (`JWKLookupFunction`, `JWKLookupFunctionHeader`), all JWK type definitions
- `references/utils.md`: `base64UrlEncode`/`base64UrlDecode`, `base64Encode`/`base64Decode`, `randomBytes`, `concatUint8Arrays`, `textEncoder`/`textDecoder`, type guards (`isJWK`, `isJWKSet`, `isSymmetricJWK`, `isPrivateJWK`, `isPublicJWK`, `isCryptoKey`, `isCryptoKeyPair`), `validateJwtClaims`, `computeExpiresInSeconds`, `ExpiresIn` format, `JWTClaimValidationOptions`, `sanitizeObject`
- `references/adapters-h3.md`: H3 session adapters (v1 and v2), `useJWESession`, `useJWSSession`, `SessionManager` interface, `SessionConfigJWE`, `SessionConfigJWS`, lifecycle hooks (`onRead`, `onUpdate`, `onClear`, `onExpire`, `onError`), key lookup hooks (`onUnsealKeyLookup`, `onVerifyKeyLookup`), lower-level functions, cookie chunking (v2), header-based tokens, refresh token pattern

## Export Paths

| Path                  | Purpose                                                                        |
| --------------------- | ------------------------------------------------------------------------------ |
| `unjwt`               | Flat barrel: all public functions and types from `jws`, `jwe`, `jwk`, `utils`  |
| `unjwt/jws`           | `sign()`, `verify()` — JWS Compact Serialization                               |
| `unjwt/jwe`           | `encrypt()`, `decrypt()` — JWE Compact Serialization                           |
| `unjwt/jwk`           | Key generation, import/export, wrap/unwrap, PEM conversion, PBES2, cache utils |
| `unjwt/utils`         | Base64URL encode/decode, type guards, JWT claim validation, `randomBytes`      |
| `unjwt/adapters/h3`   | H3 session adapter (aliases h3v1)                                              |
| `unjwt/adapters/h3v1` | H3 v1 session adapter (Nuxt v4, Nitro v2)                                      |
| `unjwt/adapters/h3v2` | H3 v2 session adapter (Nuxt v5, Nitro v3)                                      |

## Quick Start

```ts
// Sign and verify (JWS)
import { sign, verify } from "unjwt/jws";
import { generateJWK } from "unjwt/jwk";

const key = await generateJWK("HS256");
const token = await sign({ sub: "user123" }, key, { expiresIn: "1h" });
const { payload } = await verify(token, key);

// Encrypt and decrypt (JWE)
import { encrypt, decrypt } from "unjwt/jwe";

const jwe = await encrypt({ secret: "data" }, "password");
const { payload } = await decrypt(jwe, "password");

// H3 session
import { useJWESession } from "unjwt/adapters/h3v2";

const session = await useJWESession(event, { key: "secret", maxAge: "7D" });
await session.update({ userId: "123" });
```

## Key Concepts

- **`JOSEPayload`**: the payload type accepted by `sign`/`encrypt` — `string | Uint8Array | Record<string, unknown>`; covers both JWT and generic serializable objects. `JWTClaims` remains the spec-compliant sub-type for typed claim access
- **JWK-first key model**: functions accept JWK objects directly; `importKey()` normalizes CryptoKey/JWK/Uint8Array/string
- **Algorithm inference**: `sign`/`encrypt` infer `alg`/`enc` from JWK properties when not explicitly provided; password strings default to PBES2
- **`dir` (direct encryption)**: pass a `CryptoKey | JWK_oct | Uint8Array` directly as the CEK; `enc` must always be specified
- **ExpiresIn**: time durations accept numbers (seconds) or strings: `"30s"`, `"10m"`, `"2h"`, `"7D"`, `"1W"`, `"3M"`, `"1Y"` (also long forms: `"minutes"`, `"hours"`, `"days"`, `"weeks"`, `"months"`, `"years"`)
- **H3 Session Adapters**: store JWTs in chunked cookies; sessions are lazy (`id` is `undefined` until `update()` is called)
- **PBES2 security**: default `p2c` (iteration count) is `600_000` per OWASP cookbook; only lower it for legacy interoperability

登录后下载/点赞/收藏 ❤ 30 | ★ 0

unjwt

目录结构

SKILL.md

举报内容

提示