@openclaw/msteams 2026.5.27 → 2026.5.28-beta.2

package/node_modules/jose/dist/types/types.d.ts

@@ -1,193 +1,105 @@
-/** Generic JSON Web Key Parameters. */
-export interface JWKParameters {
-  /** JWK "kty" (Key Type) Parameter */
-  kty?: string
-  /**
-   * JWK "alg" (Algorithm) Parameter
-   *
-   * @see {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}
-   */
-  alg?: string
-  /** JWK "key_ops" (Key Operations) Parameter */
-  key_ops?: string[]
-  /** JWK "ext" (Extractable) Parameter */
-  ext?: boolean
-  /** JWK "use" (Public Key Use) Parameter */
-  use?: string
-  /** JWK "x5c" (X.509 Certificate Chain) Parameter */
-  x5c?: string[]
-  /** JWK "x5t" (X.509 Certificate SHA-1 Thumbprint) Parameter */
-  x5t?: string
-  /** JWK "x5t#S256" (X.509 Certificate SHA-256 Thumbprint) Parameter */
-  'x5t#S256'?: string
-  /** JWK "x5u" (X.509 URL) Parameter */
-  x5u?: string
-  /** JWK "kid" (Key ID) Parameter */
-  kid?: string
-}
-
-/** Convenience interface for Public OKP JSON Web Keys */
-export interface JWK_OKP_Public extends JWKParameters {
-  /** OKP JWK "crv" (The Subtype of Key Pair) Parameter */
-  crv: string
-  /** OKP JWK "x" (The public key) Parameter */
-  x: string
-}
-
-/** Convenience interface for Private OKP JSON Web Keys */
-export interface JWK_OKP_Private extends JWK_OKP_Public {
-  /** OKP JWK "d" (The Private Key) Parameter */
-  d: string
-}
-
-/** Convenience interface for Public AKP JSON Web Keys */
-export interface JWK_AKP_Public extends JWKParameters {
-  /** JWK "alg" (Algorithm) Parameter */
-  alg: string
-  /** AKP JWK "pub" (The Public key) Parameter */
-  pub: string
-}
-
-/** Convenience interface for Private AKP JSON Web Keys */
-export interface JWK_AKP_Private extends JWK_AKP_Public {
-  /** AKP JWK "priv" (The Private Key) Parameter */
-  priv: string
-}
-
-/** Convenience interface for Public EC JSON Web Keys */
-export interface JWK_EC_Public extends JWKParameters {
-  /** EC JWK "crv" (Curve) Parameter */
-  crv: string
-  /** EC JWK "x" (X Coordinate) Parameter */
-  x: string
-  /** EC JWK "y" (Y Coordinate) Parameter */
-  y: string
-}
-
-/** Convenience interface for Private EC JSON Web Keys */
-export interface JWK_EC_Private extends JWK_EC_Public {
-  /** EC JWK "d" (ECC Private Key) Parameter */
-  d: string
-}
-
-/** Convenience interface for Public RSA JSON Web Keys */
-export interface JWK_RSA_Public extends JWKParameters {
-  /** RSA JWK "e" (Exponent) Parameter */
-  e: string
-  /** RSA JWK "n" (Modulus) Parameter */
-  n: string
-}
-
-/** Convenience interface for Private RSA JSON Web Keys */
-export interface JWK_RSA_Private extends JWK_RSA_Public {
-  /** RSA JWK "d" (Private Exponent) Parameter */
-  d: string
-  /** RSA JWK "dp" (First Factor CRT Exponent) Parameter */
-  dp: string
-  /** RSA JWK "dq" (Second Factor CRT Exponent) Parameter */
-  dq: string
-  /** RSA JWK "p" (First Prime Factor) Parameter */
-  p: string
-  /** RSA JWK "q" (Second Prime Factor) Parameter */
-  q: string
-  /** RSA JWK "qi" (First CRT Coefficient) Parameter */
-  qi: string
-}
-
-/** Convenience interface for oct JSON Web Keys */
-export interface JWK_oct extends JWKParameters {
-  /** Oct JWK "k" (Key Value) Parameter */
-  k: string
-}
-
 /**
- * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC", "OKP", "AKP", and
- * "oct" key types are supported.
+ * KeyLike are runtime-specific classes representing asymmetric keys or symmetric secrets. These are
+ * instances of {@link https://developer.mozilla.org/en-US/docs/Web/API/CryptoKey CryptoKey} and
+ * additionally {@link https://nodejs.org/api/crypto.html#class-keyobject KeyObject} in Node.js
+ * runtime.
+ * {@link https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Uint8Array Uint8Array}
+ * instances are also accepted as symmetric secret representation only.
+ *
+ * [Key Import Functions](../modules/key_import.md) can be used to import PEM, or JWK formatted
+ * asymmetric keys and certificates to these runtime-specific representations.
+ *
+ * In Node.js the {@link https://nodejs.org/api/buffer.html#buffer Buffer} class is a subclass of
+ * Uint8Array and so Buffer can be provided for symmetric secrets as well.
+ *
+ * {@link https://nodejs.org/api/crypto.html#class-keyobject KeyObject} is a representation of a
+ * key/secret available in the Node.js runtime. In addition to the import functions of this library
+ * you may use the runtime APIs
+ * {@link https://nodejs.org/api/crypto.html#cryptocreatepublickeykey crypto.createPublicKey},
+ * {@link https://nodejs.org/api/crypto.html#cryptocreateprivatekeykey crypto.createPrivateKey}, and
+ * {@link https://nodejs.org/api/crypto.html#cryptocreatesecretkeykey-encoding crypto.createSecretKey}
+ * to obtain a `KeyObject` from your existing key material.
+ *
+ * {@link https://developer.mozilla.org/en-US/docs/Web/API/CryptoKey CryptoKey} is a representation
+ * of a key/secret available in the Browser and Web-interoperable runtimes. In addition to the
+ * import functions of this library you may use the
+ * {@link https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto/importKey SubtleCrypto.importKey}
+ * API to obtain a CryptoKey from your existing key material.
  *
- * @see {@link JWK_AKP_Public}
- * @see {@link JWK_AKP_Private}
- * @see {@link JWK_OKP_Public}
- * @see {@link JWK_OKP_Private}
- * @see {@link JWK_EC_Public}
- * @see {@link JWK_EC_Private}
- * @see {@link JWK_RSA_Public}
- * @see {@link JWK_RSA_Private}
- * @see {@link JWK_oct}
  */
-export interface JWK extends JWKParameters {
-  /**
-   * - EC JWK "crv" (Curve) Parameter
-   * - OKP JWK "crv" (The Subtype of Key Pair) Parameter
-   */
+export type KeyLike = { type: string }
+
+/**
+ * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC", "OKP", and "oct"
+ * key types are supported.
+ */
+export interface JWK {
+  /** JWK "alg" (Algorithm) Parameter. */
+  alg?: string
   crv?: string
-  /**
-   * - Private RSA JWK "d" (Private Exponent) Parameter
-   * - Private EC JWK "d" (ECC Private Key) Parameter
-   * - Private OKP JWK "d" (The Private Key) Parameter
-   */
   d?: string
-  /** Private RSA JWK "dp" (First Factor CRT Exponent) Parameter */
   dp?: string
-  /** Private RSA JWK "dq" (Second Factor CRT Exponent) Parameter */
   dq?: string
-  /** RSA JWK "e" (Exponent) Parameter */
   e?: string
-  /** Oct JWK "k" (Key Value) Parameter */
+  /** JWK "ext" (Extractable) Parameter. */
+  ext?: boolean
   k?: string
-  /** RSA JWK "n" (Modulus) Parameter */
+  /** JWK "key_ops" (Key Operations) Parameter. */
+  key_ops?: string[]
+  /** JWK "kid" (Key ID) Parameter. */
+  kid?: string
+  /** JWK "kty" (Key Type) Parameter. */
+  kty?: string
   n?: string
-  /** Private RSA JWK "p" (First Prime Factor) Parameter */
+  oth?: Array<{
+    d?: string
+    r?: string
+    t?: string
+  }>
   p?: string
-  /** Private RSA JWK "q" (Second Prime Factor) Parameter */
   q?: string
-  /** Private RSA JWK "qi" (First CRT Coefficient) Parameter */
   qi?: string
-  /**
-   * - EC JWK "x" (X Coordinate) Parameter
-   * - OKP JWK "x" (The public key) Parameter
-   */
+  /** JWK "use" (Public Key Use) Parameter. */
+  use?: string
   x?: string
-  /** EC JWK "y" (Y Coordinate) Parameter */
   y?: string
-  /** AKP JWK "pub" (Public Key) Parameter */
-  pub?: string
-  /** AKP JWK "priv" (Private key) Parameter */
-  priv?: string
+  /** JWK "x5c" (X.509 Certificate Chain) Parameter. */
+  x5c?: string[]
+  /** JWK "x5t" (X.509 Certificate SHA-1 Thumbprint) Parameter. */
+  x5t?: string
+  /** "x5t#S256" (X.509 Certificate SHA-256 Thumbprint) Parameter. */
+  'x5t#S256'?: string
+  /** JWK "x5u" (X.509 URL) Parameter. */
+  x5u?: string
+
+  [propName: string]: unknown
 }
 
 /**
- * @private
+ * Generic Interface for consuming operations dynamic key resolution.
  *
- * @internal
+ * @param IProtectedHeader Type definition of the JWE or JWS Protected Header.
+ * @param IToken Type definition of the consumed JWE or JWS token.
  */
-export interface GenericGetKeyFunction<IProtectedHeader, IToken, ReturnKeyTypes> {
+export interface GetKeyFunction<IProtectedHeader, IToken> {
   /**
    * Dynamic key resolution function. No token components have been verified at the time of this
    * function call.
    *
-   * If a suitable key for the token cannot be matched, throw an error instead.
+   * If you cannot match a key suitable for the token, throw an error instead.
    *
    * @param protectedHeader JWE or JWS Protected Header.
    * @param token The consumed JWE or JWS token.
    */
-  (protectedHeader: IProtectedHeader, token: IToken): Promise<ReturnKeyTypes> | ReturnKeyTypes
+  (
+    protectedHeader: IProtectedHeader,
+    token: IToken,
+  ): Promise<KeyLike | Uint8Array> | KeyLike | Uint8Array
 }
 
 /**
- * Generic Interface for consuming operations dynamic key resolution.
- *
- * @param IProtectedHeader Type definition of the JWE or JWS Protected Header.
- * @param IToken Type definition of the consumed JWE or JWS token.
- */
-export interface GetKeyFunction<IProtectedHeader, IToken> extends GenericGetKeyFunction<
-  IProtectedHeader,
-  IToken,
-  CryptoKey | KeyObject | JWK | Uint8Array
-> {}
-
-/**
- * Flattened JWS definition for verify function inputs, allows payload as {@link !Uint8Array} for
- * detached signature validation.
+ * Flattened JWS definition for verify function inputs, allows payload as Uint8Array for detached
+ * signature validation.
  */
 export interface FlattenedJWSInput {
   /**
@@ -200,7 +112,7 @@ export interface FlattenedJWSInput {
 
   /**
    * The "payload" member MUST be present and contain the value BASE64URL(JWS Payload). When RFC7797
-   * "b64": false is used the value passed may also be a {@link !Uint8Array}.
+   * "b64": false is used the value passed may also be a Uint8Array.
    */
   payload: string | Uint8Array
 
@@ -216,14 +128,14 @@ export interface FlattenedJWSInput {
 }
 
 /**
- * General JWS definition for verify function inputs, allows payload as {@link !Uint8Array} for
- * detached signature validation.
+ * General JWS definition for verify function inputs, allows payload as Uint8Array for detached
+ * signature validation.
  */
 export interface GeneralJWSInput {
   /**
    * The "payload" member MUST be present and contain the value BASE64URL(JWS Payload). When when
    * JWS Unencoded Payload ({@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}) "b64": false is
-   * used the value passed may also be a {@link !Uint8Array}.
+   * used the value passed may also be a Uint8Array.
    */
   payload: string | Uint8Array
 
@@ -235,8 +147,8 @@ export interface GeneralJWSInput {
 }
 
 /**
- * Flattened JWS JSON Serialization Syntax token. Payload is returned as an empty string when JWS
- * Unencoded Payload ({@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}) is used.
+ * Flattened JWS definition. Payload is returned as an empty string when JWS Unencoded Payload
+ * ({@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}) is used.
  */
 export interface FlattenedJWS extends Partial<FlattenedJWSInput> {
   payload: string
@@ -244,48 +156,43 @@ export interface FlattenedJWS extends Partial<FlattenedJWSInput> {
 }
 
 /**
- * General JWS JSON Serialization Syntax token. Payload is returned as an empty string when JWS
- * Unencoded Payload ({@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}) is used.
+ * General JWS definition. Payload is returned as an empty string when JWS Unencoded Payload
+ * ({@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}) is used.
  */
 export interface GeneralJWS {
   payload: string
   signatures: Omit<FlattenedJWSInput, 'payload'>[]
 }
 
-/** Header Parameters common to JWE and JWS */
 export interface JoseHeaderParameters {
-  /** "kid" (Key ID) Header Parameter */
+  /** "kid" (Key ID) Header Parameter. */
   kid?: string
 
-  /** "x5t" (X.509 Certificate SHA-1 Thumbprint) Header Parameter */
+  /** "x5t" (X.509 Certificate SHA-1 Thumbprint) Header Parameter. */
   x5t?: string
 
-  /** "x5c" (X.509 Certificate Chain) Header Parameter */
+  /** "x5c" (X.509 Certificate Chain) Header Parameter. */
   x5c?: string[]
 
-  /** "x5u" (X.509 URL) Header Parameter */
+  /** "x5u" (X.509 URL) Header Parameter. */
   x5u?: string
 
-  /** "jku" (JWK Set URL) Header Parameter */
+  /** "jku" (JWK Set URL) Header Parameter. */
   jku?: string
 
-  /** "jwk" (JSON Web Key) Header Parameter */
-  jwk?: Pick<JWK, 'kty' | 'crv' | 'x' | 'y' | 'e' | 'n' | 'alg' | 'pub'>
+  /** "jwk" (JSON Web Key) Header Parameter. */
+  jwk?: Pick<JWK, 'kty' | 'crv' | 'x' | 'y' | 'e' | 'n'>
 
-  /** "typ" (Type) Header Parameter */
+  /** "typ" (Type) Header Parameter. */
   typ?: string
 
-  /** "cty" (Content Type) Header Parameter */
+  /** "cty" (Content Type) Header Parameter. */
   cty?: string
 }
 
 /** Recognized JWS Header Parameters, any other Header Members may also be present. */
 export interface JWSHeaderParameters extends JoseHeaderParameters {
-  /**
-   * JWS "alg" (Algorithm) Header Parameter
-   *
-   * @see {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}
-   */
+  /** JWS "alg" (Algorithm) Header Parameter. */
   alg?: string
 
   /**
@@ -294,7 +201,7 @@ export interface JWSHeaderParameters extends JoseHeaderParameters {
    */
   b64?: boolean
 
-  /** JWS "crit" (Critical) Header Parameter */
+  /** JWS "crit" (Critical) Header Parameter. */
   crit?: string[]
 
   /** Any other JWS Header member. */
@@ -303,40 +210,31 @@ export interface JWSHeaderParameters extends JoseHeaderParameters {
 
 /** Recognized JWE Key Management-related Header Parameters. */
 export interface JWEKeyManagementHeaderParameters {
-  /**
-   * ECDH-ES "apu" (Agreement PartyUInfo). This will be used as a JOSE Header Parameter and will be
-   * used in ECDH's ConcatKDF.
-   */
   apu?: Uint8Array
-
-  /**
-   * ECDH-ES "apv" (Agreement PartyVInfo). This will be used as a JOSE Header Parameter and will be
-   * used in ECDH's ConcatKDF.
-   */
   apv?: Uint8Array
   /**
-   * @deprecated You should not use this parameter. It is only intended for testing and vector
+   * @deprecated You should not use this parameter. It is only really intended for test and vector
    *   validation purposes.
    */
   p2c?: number
   /**
-   * @deprecated You should not use this parameter. It is only intended for testing and vector
+   * @deprecated You should not use this parameter. It is only really intended for test and vector
    *   validation purposes.
    */
   p2s?: Uint8Array
   /**
-   * @deprecated You should not use this parameter. It is only intended for testing and vector
+   * @deprecated You should not use this parameter. It is only really intended for test and vector
    *   validation purposes.
    */
   iv?: Uint8Array
   /**
-   * @deprecated You should not use this parameter. It is only intended for testing and vector
+   * @deprecated You should not use this parameter. It is only really intended for test and vector
    *   validation purposes.
    */
-  epk?: CryptoKey | KeyObject
+  epk?: KeyLike
 }
 
-/** Flattened JWE JSON Serialization Syntax token. */
+/** Flattened JWE definition. */
 export interface FlattenedJWE {
   /**
    * The "aad" member MUST be present and contain the value BASE64URL(JWE AAD)) when the JWE AAD
@@ -366,7 +264,7 @@ export interface FlattenedJWE {
    * The "iv" member MUST be present and contain the value BASE64URL(JWE Initialization Vector) when
    * the JWE Initialization Vector value is non-empty; otherwise, it MUST be absent.
    */
-  iv?: string
+  iv: string
 
   /**
    * The "protected" member MUST be present and contain the value BASE64URL(UTF8(JWE Protected
@@ -379,7 +277,7 @@ export interface FlattenedJWE {
    * The "tag" member MUST be present and contain the value BASE64URL(JWE Authentication Tag) when
    * the JWE Authentication Tag value is non-empty; otherwise, it MUST be absent.
    */
-  tag?: string
+  tag: string
 
   /**
    * The "unprotected" member MUST be present and contain the value JWE Shared Unprotected Header
@@ -390,37 +288,28 @@ export interface FlattenedJWE {
   unprotected?: JWEHeaderParameters
 }
 
-/** General JWE JSON Serialization Syntax token. */
 export interface GeneralJWE extends Omit<FlattenedJWE, 'encrypted_key' | 'header'> {
   recipients: Pick<FlattenedJWE, 'encrypted_key' | 'header'>[]
 }
 
 /** Recognized JWE Header Parameters, any other Header members may also be present. */
 export interface JWEHeaderParameters extends JoseHeaderParameters {
-  /**
-   * JWE "alg" (Algorithm) Header Parameter
-   *
-   * @see {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}
-   */
+  /** JWE "alg" (Algorithm) Header Parameter. */
   alg?: string
 
-  /**
-   * JWE "enc" (Encryption Algorithm) Header Parameter
-   *
-   * @see {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}
-   */
+  /** JWE "enc" (Encryption Algorithm) Header Parameter. */
   enc?: string
 
-  /** JWE "crit" (Critical) Header Parameter */
+  /** JWE "crit" (Critical) Header Parameter. */
   crit?: string[]
 
   /**
    * JWE "zip" (Compression Algorithm) Header Parameter.
    *
-   * The only supported value is `"DEF"` (DEFLATE). Requires the `CompressionStream` /
-   * `DecompressionStream` APIs to be available in the runtime.
+   * @deprecated Compression of data SHOULD NOT be done before encryption, because such compressed
+   *   data often reveals information about the plaintext.
    *
-   * @see {@link https://www.rfc-editor.org/rfc/rfc7516#section-4.1.3 JWE "zip" Header Parameter}
+   * @see {@link https://www.rfc-editor.org/rfc/rfc8725#name-avoid-compression-of-encryp Avoid Compression of Encryption Inputs}
    */
   zip?: string
 
@@ -455,11 +344,7 @@ export interface CritOption {
 
 /** JWE Decryption options. */
 export interface DecryptOptions extends CritOption {
-  /**
-   * A list of accepted JWE "alg" (Algorithm) Header Parameter values. By default all "alg"
-   * (Algorithm) Header Parameter values applicable for the used key/secret are allowed except for
-   * all PBES2 Key Management Algorithms, these need to be explicitly allowed using this option.
-   */
+  /** A list of accepted JWE "alg" (Algorithm) Header Parameter values. */
   keyManagementAlgorithms?: string[]
 
   /**
@@ -468,77 +353,60 @@ export interface DecryptOptions extends CritOption {
    */
   contentEncryptionAlgorithms?: string[]
 
+  /**
+   * In a browser runtime you have to provide an implementation for Inflate Raw when you expect JWEs
+   * with compressed plaintext.
+   */
+  inflateRaw?: InflateFunction
+
   /**
    * (PBES2 Key Management Algorithms only) Maximum allowed "p2c" (PBES2 Count) Header Parameter
    * value. The PBKDF2 iteration count defines the algorithm's computational expense. By default
    * this value is set to 10000.
    */
   maxPBES2Count?: number
+}
 
+/** JWE Deflate option. */
+export interface DeflateOption {
   /**
-   * Maximum allowed size (in bytes) of the decompressed plaintext when the JWE `"zip"` (Compression
-   * Algorithm) Header Parameter is present. By default this value is set to 250000 (250 KB). The
-   * value must be `0`, a positive safe integer, or `Infinity`.
-   *
-   * Set to `0` to reject all compressed JWEs during decryption.
-   *
-   * Set to `Infinity` to disable the decompressed size limit.
+   * In a browser runtime you have to provide an implementation for Deflate Raw when you will be
+   * producing JWEs with compressed plaintext.
    */
-  maxDecompressedLength?: number
+  deflateRaw?: DeflateFunction
 }
 
 /** JWE Encryption options. */
-export interface EncryptOptions extends CritOption {}
+export interface EncryptOptions extends CritOption, DeflateOption {}
 
 /** JWT Claims Set verification options. */
 export interface JWTClaimVerificationOptions {
-  /**
-   * Expected JWT "aud" (Audience) Claim value(s).
-   *
-   * This option makes the JWT "aud" (Audience) Claim presence required.
-   */
+  /** Expected JWT "aud" (Audience) Claim value(s). */
   audience?: string | string[]
 
   /**
-   * Clock skew tolerance
+   * Expected clock tolerance
    *
    * - In seconds when number (e.g. 5)
-   * - Resolved into a number of seconds when a string (e.g. "5 seconds", "10 minutes", "2 hours").
-   *
-   * Used when validating the JWT "nbf" (Not Before) and "exp" (Expiration Time) claims, and when
-   * validating the "iat" (Issued At) claim if the {@link maxTokenAge `maxTokenAge` option} is set.
+   * - Parsed as seconds when a string (e.g. "5 seconds", "10 minutes", "2 hours").
    */
   clockTolerance?: string | number
 
-  /**
-   * Expected JWT "iss" (Issuer) Claim value(s).
-   *
-   * This option makes the JWT "iss" (Issuer) Claim presence required.
-   */
+  /** Expected JWT "iss" (Issuer) Claim value(s). */
   issuer?: string | string[]
 
   /**
    * Maximum time elapsed (in seconds) from the JWT "iat" (Issued At) Claim value.
    *
    * - In seconds when number (e.g. 5)
-   * - Resolved into a number of seconds when a string (e.g. "5 seconds", "10 minutes", "2 hours").
-   *
-   * This option makes the JWT "iat" (Issued At) Claim presence required.
+   * - Parsed as seconds when a string (e.g. "5 seconds", "10 minutes", "2 hours").
    */
   maxTokenAge?: string | number
 
-  /**
-   * Expected JWT "sub" (Subject) Claim value.
-   *
-   * This option makes the JWT "sub" (Subject) Claim presence required.
-   */
+  /** Expected JWT "sub" (Subject) Claim value. */
   subject?: string
 
-  /**
-   * Expected JWT "typ" (Type) Header Parameter value.
-   *
-   * This option makes the JWT "typ" (Type) Header Parameter presence required.
-   */
+  /** Expected JWT "typ" (Type) Header Parameter value. */
   typ?: string
 
   /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
@@ -546,11 +414,11 @@ export interface JWTClaimVerificationOptions {
 
   /**
    * Array of required Claim Names that must be present in the JWT Claims Set. Default is that: if
-   * the {@link issuer `issuer` option} is set, then JWT "iss" (Issuer) Claim must be present; if the
-   * {@link audience `audience` option} is set, then JWT "aud" (Audience) Claim must be present; if
-   * the {@link subject `subject` option} is set, then JWT "sub" (Subject) Claim must be present; if
-   * the {@link maxTokenAge `maxTokenAge` option} is set, then JWT "iat" (Issued At) Claim must be
-   * present.
+   * the {@link JWTClaimVerificationOptions.issuer issuer option} is set, then "iss" must be present;
+   * if the {@link JWTClaimVerificationOptions.audience audience option} is set, then "aud" must be
+   * present; if the {@link JWTClaimVerificationOptions.subject subject option} is set, then "sub"
+   * must be present; if the {@link JWTClaimVerificationOptions.maxTokenAge maxTokenAge option} is
+   * set, then "iat" must be present.
    */
   requiredClaims?: string[]
 }
@@ -559,10 +427,8 @@ export interface JWTClaimVerificationOptions {
 export interface VerifyOptions extends CritOption {
   /**
    * A list of accepted JWS "alg" (Algorithm) Header Parameter values. By default all "alg"
-   * (Algorithm) values applicable for the used key/secret are allowed.
-   *
-   * > [!NOTE]\
-   * > Unsecured JWTs (`{ "alg": "none" }`) are never accepted by this API.
+   * (Algorithm) values applicable for the used key/secret are allowed. Note: "none" is never
+   * accepted.
    */
   algorithms?: string[]
 }
@@ -625,7 +491,32 @@ export interface JWTPayload {
   [propName: string]: unknown
 }
 
-/** Flattened JWE JSON Serialization Syntax decryption result */
+/**
+ * Deflate Raw implementation, e.g. promisified
+ * {@link https://nodejs.org/api/zlib.html#zlibdeflaterawbuffer-options-callback zlib.deflateRaw}.
+ *
+ * @deprecated Compression of data SHOULD NOT be done before encryption, because such compressed
+ *   data often reveals information about the plaintext.
+ *
+ * @see {@link https://www.rfc-editor.org/rfc/rfc8725#name-avoid-compression-of-encryp Avoid Compression of Encryption Inputs}
+ */
+export interface DeflateFunction {
+  (input: Uint8Array): Promise<Uint8Array>
+}
+
+/**
+ * Inflate Raw implementation, e.g. promisified
+ * {@link https://nodejs.org/api/zlib.html#zlibinflaterawbuffer-options-callback zlib.inflateRaw}.
+ *
+ * @deprecated Compression of data SHOULD NOT be done before encryption, because such compressed
+ *   data often reveals information about the plaintext.
+ *
+ * @see {@link https://www.rfc-editor.org/rfc/rfc8725#name-avoid-compression-of-encryp Avoid Compression of Encryption Inputs}
+ */
+export interface InflateFunction {
+  (input: Uint8Array): Promise<Uint8Array>
+}
+
 export interface FlattenedDecryptResult {
   /** JWE AAD. */
   additionalAuthenticatedData?: Uint8Array
@@ -643,10 +534,8 @@ export interface FlattenedDecryptResult {
   unprotectedHeader?: JWEHeaderParameters
 }
 
-/** General JWE JSON Serialization Syntax decryption result */
 export interface GeneralDecryptResult extends FlattenedDecryptResult {}
 
-/** Compact JWE decryption result */
 export interface CompactDecryptResult {
   /** Plaintext. */
   plaintext: Uint8Array
@@ -655,7 +544,6 @@ export interface CompactDecryptResult {
   protectedHeader: CompactJWEHeaderParameters
 }
 
-/** Flattened JWS JSON Serialization Syntax verification result */
 export interface FlattenedVerifyResult {
   /** JWS Payload. */
   payload: Uint8Array
@@ -667,10 +555,8 @@ export interface FlattenedVerifyResult {
   unprotectedHeader?: JWSHeaderParameters
 }
 
-/** General JWS JSON Serialization Syntax verification result */
 export interface GeneralVerifyResult extends FlattenedVerifyResult {}
 
-/** Compact JWS verification result */
 export interface CompactVerifyResult {
   /** JWS Payload. */
   payload: Uint8Array
@@ -679,28 +565,25 @@ export interface CompactVerifyResult {
   protectedHeader: CompactJWSHeaderParameters
 }
 
-/** Signed JSON Web Token (JWT) verification result */
-export interface JWTVerifyResult<PayloadType = JWTPayload> {
+export interface JWTVerifyResult {
   /** JWT Claims Set. */
-  payload: PayloadType & JWTPayload
+  payload: JWTPayload
 
   /** JWS Protected Header. */
   protectedHeader: JWTHeaderParameters
 }
 
-/** Encrypted JSON Web Token (JWT) decryption result */
-export interface JWTDecryptResult<PayloadType = JWTPayload> {
+export interface JWTDecryptResult {
   /** JWT Claims Set. */
-  payload: PayloadType & JWTPayload
+  payload: JWTPayload
 
   /** JWE Protected Header. */
   protectedHeader: CompactJWEHeaderParameters
 }
 
-/** When key resolver functions are used this becomes part of successful resolves */
-export interface ResolvedKey {
+export interface ResolvedKey<T extends KeyLike = KeyLike> {
   /** Key resolved from the key resolver function. */
-  key: CryptoKey | Uint8Array
+  key: T | Uint8Array
 }
 
 /** Recognized Compact JWS Header Parameters, any other Header Members may also be present. */
@@ -724,129 +607,4 @@ export interface JSONWebKeySet {
   keys: JWK[]
 }
 
-/**
- * {@link !KeyObject} is a representation of a key/secret available in the Node.js runtime. You may
- * use the Node.js runtime APIs {@link !createPublicKey}, {@link !createPrivateKey}, and
- * {@link !createSecretKey} to obtain a {@link !KeyObject} from your existing key material.
- */
-export interface KeyObject {
-  type: string
-}
-
-/**
- * {@link !CryptoKey} is a representation of a key/secret available in all supported runtimes. In
- * addition to the {@link key/import Key Import Functions} you may use the
- * {@link !SubtleCrypto.importKey} API to obtain a {@link !CryptoKey} from your existing key
- * material.
- */
-export type CryptoKey = Extract<
-  Awaited<ReturnType<typeof crypto.subtle.generateKey>>,
-  { type: string }
->
-
-/** Generic interface for JWT producing classes. */
-export interface ProduceJWT {
-  /**
-   * Set the "iss" (Issuer) Claim.
-   *
-   * @param issuer "Issuer" Claim value to set on the JWT Claims Set.
-   */
-  setIssuer(issuer: string): this
-
-  /**
-   * Set the "sub" (Subject) Claim.
-   *
-   * @param subject "sub" (Subject) Claim value to set on the JWT Claims Set.
-   */
-  setSubject(subject: string): this
-
-  /**
-   * Set the "aud" (Audience) Claim.
-   *
-   * @param audience "aud" (Audience) Claim value to set on the JWT Claims Set.
-   */
-  setAudience(audience: string | string[]): this
-
-  /**
-   * Set the "jti" (JWT ID) Claim.
-   *
-   * @param jwtId "jti" (JWT ID) Claim value to set on the JWT Claims Set.
-   */
-  setJti(jwtId: string): this
-
-  /**
-   * Set the "nbf" (Not Before) Claim.
-   *
-   * - If a `number` is passed as an argument it is used as the claim directly.
-   * - If a `Date` instance is passed as an argument it is converted to unix timestamp and used as the
-   *   claim.
-   * - If a `string` is passed as an argument it is resolved to a time span, and then added to the
-   *   current unix timestamp and used as the claim.
-   *
-   * Format used for time span should be a number followed by a unit, such as "5 minutes" or "1
-   * day".
-   *
-   * Valid units are: "sec", "secs", "second", "seconds", "s", "minute", "minutes", "min", "mins",
-   * "m", "hour", "hours", "hr", "hrs", "h", "day", "days", "d", "week", "weeks", "w", "year",
-   * "years", "yr", "yrs", and "y". It is not possible to specify months. 365.25 days is used as an
-   * alias for a year.
-   *
-   * If the string is suffixed with "ago", or prefixed with a "-", the resulting time span gets
-   * subtracted from the current unix timestamp. A "from now" suffix can also be used for
-   * readability when adding to the current unix timestamp.
-   *
-   * @param input "nbf" (Not Before) Claim value to set on the JWT Claims Set.
-   */
-  setNotBefore(input: number | string | Date): this
-
-  /**
-   * Set the "exp" (Expiration Time) Claim.
-   *
-   * - If a `number` is passed as an argument it is used as the claim directly.
-   * - If a `Date` instance is passed as an argument it is converted to unix timestamp and used as the
-   *   claim.
-   * - If a `string` is passed as an argument it is resolved to a time span, and then added to the
-   *   current unix timestamp and used as the claim.
-   *
-   * Format used for time span should be a number followed by a unit, such as "5 minutes" or "1
-   * day".
-   *
-   * Valid units are: "sec", "secs", "second", "seconds", "s", "minute", "minutes", "min", "mins",
-   * "m", "hour", "hours", "hr", "hrs", "h", "day", "days", "d", "week", "weeks", "w", "year",
-   * "years", "yr", "yrs", and "y". It is not possible to specify months. 365.25 days is used as an
-   * alias for a year.
-   *
-   * If the string is suffixed with "ago", or prefixed with a "-", the resulting time span gets
-   * subtracted from the current unix timestamp. A "from now" suffix can also be used for
-   * readability when adding to the current unix timestamp.
-   *
-   * @param input "exp" (Expiration Time) Claim value to set on the JWT Claims Set.
-   */
-  setExpirationTime(input: number | string | Date): this
-
-  /**
-   * Set the "iat" (Issued At) Claim.
-   *
-   * - If no argument is used the current unix timestamp is used as the claim.
-   * - If a `number` is passed as an argument it is used as the claim directly.
-   * - If a `Date` instance is passed as an argument it is converted to unix timestamp and used as the
-   *   claim.
-   * - If a `string` is passed as an argument it is resolved to a time span, and then added to the
-   *   current unix timestamp and used as the claim.
-   *
-   * Format used for time span should be a number followed by a unit, such as "5 minutes" or "1
-   * day".
-   *
-   * Valid units are: "sec", "secs", "second", "seconds", "s", "minute", "minutes", "min", "mins",
-   * "m", "hour", "hours", "hr", "hrs", "h", "day", "days", "d", "week", "weeks", "w", "year",
-   * "years", "yr", "yrs", and "y". It is not possible to specify months. 365.25 days is used as an
-   * alias for a year.
-   *
-   * If the string is suffixed with "ago", or prefixed with a "-", the resulting time span gets
-   * subtracted from the current unix timestamp. A "from now" suffix can also be used for
-   * readability when adding to the current unix timestamp.
-   *
-   * @param input "iat" (Expiration Time) Claim value to set on the JWT Claims Set.
-   */
-  setIssuedAt(input?: number | string | Date): this
-}
+export type CryptoRuntime = 'WebCryptoAPI' | 'node:crypto'