@psnext/slingcli 3.1.20260904-1 → 3.3.20260911-1

package/node_modules/jose/dist/types/jwk/thumbprint.d.ts

@@ -1,17 +1,15 @@
 import type * as t from '../types.d.ts';
 /**
- * Calculates a base64url-encoded JSON Web Key (JWK) Thumbprint.
+ * Calculates a base64url-encoded JWK Thumbprint. CryptoKey inputs must be extractable.
  *
  * @param key Key to calculate the thumbprint for.
- * @param digestAlgorithm Digest Algorithm to use for calculating the thumbprint. Default is
- *   "sha256".
+ * @param digestAlgorithm Digest algorithm. Defaults to "sha256".
  */
 export declare function calculateJwkThumbprint(key: t.JWK | t.CryptoKey | t.KeyObject, digestAlgorithm?: 'sha256' | 'sha384' | 'sha512'): Promise<string>;
 /**
- * Calculates a JSON Web Key (JWK) Thumbprint URI.
+ * Calculates a JWK Thumbprint URI. CryptoKey inputs must be extractable.
  *
  * @param key Key to calculate the thumbprint for.
- * @param digestAlgorithm Digest Algorithm to use for calculating the thumbprint. Default is
- *   "sha256".
+ * @param digestAlgorithm Digest algorithm. Defaults to "sha256".
  */
 export declare function calculateJwkThumbprintUri(key: t.CryptoKey | t.KeyObject | t.JWK, digestAlgorithm?: 'sha256' | 'sha384' | 'sha512'): Promise<string>;

package/node_modules/jose/dist/types/jwks/local.d.ts

@@ -2,14 +2,15 @@ import type * as t from '../types.d.ts';
 /** A key resolver created by {@link createLocalJWKSet}. */
 export interface LocalJWKSet {
     (protectedHeader?: t.JWSHeaderParameters, token?: t.FlattenedJWSInput): Promise<t.CryptoKey>;
-    /** Returns a structured clone of the JSON Web Key Set this resolver was created with. */
+    /** Returns a structured clone of the original JSON Web Key Set. */
     jwks: () => t.JSONWebKeySet;
 }
 /**
- * Creates a resolver for a locally available JSON Web Key Set.
+ * Creates a resolver for a locally available JSON Web Key Set. Selection uses the header's "alg"
+ * (Algorithm) and "kid" (Key ID), and respects the JWK's "use" (Public Key Use) and "key_ops" (Key
+ * Operations). Exactly one key must match.
  *
- * > Note: The function's purpose is to resolve public keys used for verifying signatures and will not work
- * > for public encryption keys.
+ * > Note: Only public signature verification keys are supported, not public encryption keys.
  *
  * @param jwks JSON Web Key Set formatted object.
  */

package/node_modules/jose/dist/types/jwks/remote.d.ts

@@ -1,20 +1,18 @@
 import type * as t from '../types.d.ts';
 /**
- * Symbol used to configure a custom fetch implementation for remote JWKS retrieval.
+ * Configures a custom fetch implementation for remote JWKS retrieval.
  *
- * > Note: Known caveat: Expect Type-related issues when passing the inputs through to fetch-like modules,
- * > they hardly ever get their typings inline with actual fetch, you should `@ts-expect-error` them.
+ * > Note: Fetch-like libraries may have incompatible TypeScript signatures even when they accept the
+ * > supplied arguments at runtime.
  */
 export declare const customFetch: unique symbol;
-/** Function signature accepted by {@link customFetch}. */
+/** Custom fetch function. Must return HTTP 200 with a JSON JWKS. See {@link customFetch}. */
 export type FetchImplementation = (
-/** URL the request is being made sent to {@link !fetch} as the `resource` argument */
+/** JWKS URL, passed as the fetch resource. */
 url: string, 
-/** Options otherwise sent to {@link !fetch} as the `options` argument */
+/** Options passed to fetch. */
 options: {
-    /** HTTP Headers */
     headers: Headers;
-    /** The {@link https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods request method} */
     method: 'GET';
     /** See {@link !Request.redirect} */
     redirect: 'manual';
@@ -23,9 +21,8 @@ options: {
 /**
  * Symbol used to configure an externally persisted remote JWKS cache.
  *
- * > Warning: This option has security implications that must be understood, assessed for applicability, and
- * > accepted before use. It is critical that the JSON Web Key Set cache only be writable by your own
- * > code.
+ * > Warning: Only trusted application code must be allowed to write this cache; its keys are trusted for
+ * > signature verification.
  */
 export declare const jwksCache: unique symbol;
 /** Remote JWKS resolver options. */
@@ -36,13 +33,13 @@ export interface RemoteJWKSetOptions {
      */
     timeoutDuration?: number;
     /**
-     * Duration (in milliseconds) for which no more HTTP requests will be triggered after a previous
-     * successful fetch. Must not be `NaN`. Default is 30000 (30 seconds).
+     * Time in milliseconds after a successful fetch before a missing key can trigger another fetch.
+     * Must not be `NaN`. Defaults to 30000 (30 seconds).
      */
     cooldownDuration?: number;
     /**
-     * Maximum time (in milliseconds) between successful HTTP requests. Default is 600000 (10
-     * minutes). Must not be `NaN`.
+     * Maximum age of cached keys in milliseconds. Defaults to 600000 (10 minutes); `Infinity`
+     * disables expiry. Must not be `NaN`.
      */
     cacheMaxAge?: number | typeof Infinity;
     /** Headers to be sent with the HTTP request. */
@@ -56,7 +53,7 @@ export interface RemoteJWKSetOptions {
 export interface ExportedJWKSCache {
     /** Current cached JSON Web Key Set */
     jwks: t.JSONWebKeySet;
-    /** Last updated at timestamp (milliseconds since epoch) */
+    /** Last successful fetch, in milliseconds since Unix epoch. */
     uat: number;
 }
 /** Values accepted by the {@link jwksCache} option. */
@@ -79,16 +76,18 @@ export interface RemoteJWKSet {
      */
     reload: () => Promise<void>;
     /**
-     * The currently cached JSON Web Key Set, or `undefined` when none has been fetched or seeded via
-     * {@link jwksCache} yet.
+     * Returns a structured clone of the cached JSON Web Key Set, or `undefined` before keys have been
+     * fetched or seeded via {@link jwksCache}.
      */
     jwks: () => t.JSONWebKeySet | undefined;
 }
 /**
- * Creates a resolver for a JSON Web Key Set available at an HTTP(S) URL.
+ * Creates a resolver for a JSON Web Key Set available at an HTTP(S) URL. Fetches the JSON Web Key
+ * Set when the cache is missing or stale. An unmatched key triggers another fetch only when
+ * `cooldownDuration` has elapsed since the last successful fetch. Selection uses the header's "alg"
+ * and "kid" and respects the JWK's "use" and "key_ops". Exactly one key must match.
  *
- * > Note: The function's purpose is to resolve public keys used for verifying signatures and will not work
- * > for public encryption keys.
+ * > Note: Only public signature verification keys are supported, not public encryption keys.
  *
  * @param url URL to fetch the JSON Web Key Set from.
  */

package/node_modules/jose/dist/types/jws/compact/sign.d.ts

@@ -3,17 +3,17 @@ import type * as t from '../../types.d.ts';
 export declare class CompactSign {
     #private;
     /**
-     * {@link CompactSign} constructor
+     * Creates a Compact JWS signer.
      *
      * @param payload Binary representation of the payload to sign.
      */
     constructor(payload: Uint8Array);
-    /** Sets the JWS Protected Header on the CompactSign object. */
+    /** Sets the JWS Protected Header. May only be called once. */
     setProtectedHeader(protectedHeader: t.CompactJWSHeaderParameters): this;
     /**
-     * Signs and resolves the value of the Compact JWS string.
+     * Signs the payload as a Compact JWS.
      *
-     * @param key Private Key or Secret to sign the JWS with. See
+     * @param key Private key or shared secret. See
      *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
      */
     sign(key: t.KeyInput, options?: t.SignOptions): Promise<string>;

package/node_modules/jose/dist/types/jws/compact/verify.d.ts

@@ -1,28 +1,25 @@
 import type * as t from '../../types.d.ts';
-/** Dynamic key resolver for Compact JWS verification. */
+/** Resolves a key for Compact JWS verification from unverified headers and token data. */
 export interface CompactVerifyGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.CompactJWSHeaderParameters, t.FlattenedJWSInput, KeyType | t.KeyObject | t.JWK> {
 }
 /**
  * Verifies a Compact JWS signature and decodes its payload.
  *
- * @param key Key to verify the JWS with. See
+ * @param key Public key or shared secret. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  */
 export declare function compactVerify(jws: string | Uint8Array, key: t.KeyInput, options?: t.VerifyOptions): Promise<t.CompactVerifyResult>;
 /**
- * Verifies a Compact JWS signature and decodes its payload, resolving the key dynamically. The
- * result additionally carries the {@link t.ResolvedKey.key resolved key}.
+ * Verifies a Compact JWS signature and decodes its payload with a dynamically resolved key,
+ * included in the result.
  *
- * @param getKey Function resolving a key to verify the JWS with. See
- *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ * @param getKey Resolves a public key or shared secret from unverified token data.
  */
 export declare function compactVerify<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jws: string | Uint8Array, getKey: CompactVerifyGetKey<KeyType>, options?: t.VerifyOptions): Promise<t.CompactVerifyResult & t.ResolvedKey<KeyType>>;
 /**
- * Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
- * either a key or a key resolution function; `key` is present on the result only when a resolution
- * function was used.
+ * Verifies a Compact JWS and decodes its payload using a key or key resolver. The result includes
+ * `key` only when a resolver is used.
  *
- * @param key Key, or function resolving a key, to verify the JWS with. See
- *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ * @param key Public key or shared secret, or a function resolving one.
  */
 export declare function compactVerify(jws: string | Uint8Array, key: t.KeyInput | CompactVerifyGetKey, options?: t.VerifyOptions): Promise<t.CompactVerifyResult & Partial<t.ResolvedKey>>;

package/node_modules/jose/dist/types/jws/flattened/sign.d.ts

@@ -3,19 +3,19 @@ import type * as t from '../../types.d.ts';
 export declare class FlattenedSign {
     #private;
     /**
-     * {@link FlattenedSign} constructor
+     * Creates a Flattened JWS signer.
      *
      * @param payload Binary representation of the payload to sign.
      */
     constructor(payload: Uint8Array);
-    /** Sets the JWS Protected Header on the FlattenedSign object. */
+    /** Sets the JWS Protected Header. May only be called once. */
     setProtectedHeader(protectedHeader: t.JWSHeaderParameters): this;
-    /** Sets the JWS Unprotected Header on the FlattenedSign object. */
+    /** Sets the JWS Unprotected Header. May only be called once. */
     setUnprotectedHeader(unprotectedHeader: t.JWSHeaderParameters): this;
     /**
-     * Signs and resolves the value of the Flattened JWS object.
+     * Signs the payload as a Flattened JWS.
      *
-     * @param key Private Key or Secret to sign the JWS with. See
+     * @param key Private key or shared secret. See
      *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
      */
     sign(key: t.KeyInput, options?: t.SignOptions): Promise<t.FlattenedJWS>;

package/node_modules/jose/dist/types/jws/flattened/verify.d.ts

@@ -1,28 +1,25 @@
 import type * as t from '../../types.d.ts';
-/** Dynamic key resolver for Flattened JWS verification. */
+/** Resolves a key for Flattened JWS verification from unverified headers and token data. */
 export interface FlattenedVerifyGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.JWSHeaderParameters, t.FlattenedJWSInput, KeyType | t.KeyObject | t.JWK> {
 }
 /**
  * Verifies a Flattened JWS signature and decodes its payload.
  *
- * @param key Key to verify the JWS with. See
+ * @param key Public key or shared secret. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  */
 export declare function flattenedVerify(jws: t.FlattenedJWSInput, key: t.KeyInput, options?: t.VerifyOptions): Promise<t.FlattenedVerifyResult>;
 /**
- * Verifies a Flattened JWS signature and decodes its payload, resolving the key dynamically. The
- * result additionally carries the {@link t.ResolvedKey.key resolved key}.
+ * Verifies a Flattened JWS signature and decodes its payload with a dynamically resolved key,
+ * included in the result.
  *
- * @param getKey Function resolving a key to verify the JWS with. See
- *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ * @param getKey Resolves a public key or shared secret from unverified token data.
  */
 export declare function flattenedVerify<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jws: t.FlattenedJWSInput, getKey: FlattenedVerifyGetKey<KeyType>, options?: t.VerifyOptions): Promise<t.FlattenedVerifyResult & t.ResolvedKey<KeyType>>;
 /**
- * Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
- * either a key or a key resolution function; `key` is present on the result only when a resolution
- * function was used.
+ * Verifies a Flattened JWS and decodes its payload using a key or key resolver. The result includes
+ * `key` only when a resolver is used.
  *
- * @param key Key, or function resolving a key, to verify the JWS with. See
- *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ * @param key Public key or shared secret, or a function resolving one.
  */
 export declare function flattenedVerify(jws: t.FlattenedJWSInput, key: t.KeyInput | FlattenedVerifyGetKey, options?: t.VerifyOptions): Promise<t.FlattenedVerifyResult & Partial<t.ResolvedKey>>;

package/node_modules/jose/dist/types/jws/general/sign.d.ts

@@ -1,42 +1,38 @@
 import type * as t from '../../types.d.ts';
 /** Configures an individual signature in a General JWS. */
 export interface Signature {
-    /** Sets the JWS Protected Header on the Signature object. */
+    /** Sets the JWS Protected Header. May only be called once. */
     setProtectedHeader(protectedHeader: t.JWSHeaderParameters): Signature;
-    /** Sets the JWS Unprotected Header on the Signature object. */
+    /** Sets the JWS Unprotected Header. May only be called once. */
     setUnprotectedHeader(unprotectedHeader: t.JWSHeaderParameters): Signature;
     /**
-     * A shorthand for calling {@link GeneralSign.addSignature addSignature()} on the enclosing
-     * {@link GeneralSign} instance.
+     * Adds another signature to the enclosing {@link GeneralSign} and returns its configuration.
      *
-     * @param key Private Key or Secret to sign the individual JWS signature with. See
+     * @param key Private key or shared secret. See
      *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
      */
     addSignature(key: t.KeyInput, options?: t.SignOptions): Signature;
-    /**
-     * A shorthand for calling {@link GeneralSign.sign sign()} on the enclosing {@link GeneralSign}
-     * instance. Takes no arguments — each signature's key is supplied to {@link addSignature}.
-     */
+    /** Creates all signatures on the enclosing {@link GeneralSign}, using their configured keys. */
     sign(): Promise<t.GeneralJWS>;
-    /** Returns the enclosing {@link GeneralSign} instance */
+    /** Returns the enclosing {@link GeneralSign} instance. */
     done(): GeneralSign;
 }
 /** Builds and signs General JWS objects. */
 export declare class GeneralSign {
     #private;
     /**
-     * {@link GeneralSign} constructor
+     * Creates a General JWS signer.
      *
      * @param payload Binary representation of the payload to sign.
      */
     constructor(payload: Uint8Array);
     /**
-     * Adds an additional signature for the General JWS object.
+     * Adds a signature and returns its configuration.
      *
-     * @param key Private Key or Secret to sign the individual JWS signature with. See
+     * @param key Private key or shared secret. See
      *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
      */
     addSignature(key: t.KeyInput, options?: t.SignOptions): Signature;
-    /** Signs and resolves the value of the General JWS object. */
+    /** Signs the payload as a General JWS. */
     sign(): Promise<t.GeneralJWS>;
 }

package/node_modules/jose/dist/types/jws/general/verify.d.ts

@@ -1,35 +1,29 @@
 import type * as t from '../../types.d.ts';
-/** Dynamic key resolver for General JWS verification. */
+/** Resolves a key for General JWS verification from unverified headers and token data. */
 export interface GeneralVerifyGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.JWSHeaderParameters, t.FlattenedJWSInput, KeyType | t.KeyObject | t.JWK> {
 }
 /**
  * Verifies a General JWS signature and decodes its payload.
  *
- * > Note: The function iterates over the `signatures` array in the General JWS and returns the verification
- * > result of the first signature entry that can be successfully verified. The result only contains
- * > the payload, protected header, and unprotected header of that successfully verified signature
- * > entry. Other signature entries' headers may be inspected solely to reject inconsistent use of the
- * > JWS Unencoded Payload Option, and their headers are not included in the returned result.
- * > Recipients of a General JWS should only rely on the returned (verified) data.
+ * > Note: Returns payload and headers from the first signature that verifies successfully. Other entries'
+ * > headers may be inspected to reject inconsistent use of the JWS Unencoded Payload Option, but are
+ * > not included in the result. Rely only on the returned data.
  *
- * @param key Key to verify the JWS with. See
+ * @param key Public key or shared secret. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  */
 export declare function generalVerify(jws: t.GeneralJWSInput, key: t.KeyInput, options?: t.VerifyOptions): Promise<t.GeneralVerifyResult>;
 /**
- * Verifies a General JWS signature and decodes its payload, resolving the key dynamically. The
- * result additionally carries the {@link t.ResolvedKey.key resolved key}.
+ * Verifies a General JWS signature and decodes its payload with a dynamically resolved key,
+ * included in the result.
  *
- * @param getKey Function resolving a key to verify the JWS with. See
- *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ * @param getKey Resolves a public key or shared secret from unverified token data.
  */
 export declare function generalVerify<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jws: t.GeneralJWSInput, getKey: GeneralVerifyGetKey<KeyType>, options?: t.VerifyOptions): Promise<t.GeneralVerifyResult & t.ResolvedKey<KeyType>>;
 /**
- * Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
- * either a key or a key resolution function; `key` is present on the result only when a resolution
- * function was used.
+ * Verifies a General JWS and decodes its payload using a key or key resolver. The result includes
+ * `key` only when a resolver is used.
  *
- * @param key Key, or function resolving a key, to verify the JWS with. See
- *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ * @param key Public key or shared secret, or a function resolving one.
  */
 export declare function generalVerify(jws: t.GeneralJWSInput, key: t.KeyInput | GeneralVerifyGetKey, options?: t.VerifyOptions): Promise<t.GeneralVerifyResult & Partial<t.ResolvedKey>>;

package/node_modules/jose/dist/types/jwt/decrypt.d.ts

@@ -2,30 +2,33 @@ import type * as t from '../types.d.ts';
 /** JWE decryption and JWT Claims Set validation options. */
 export interface JWTDecryptOptions extends t.DecryptOptions, t.JWTClaimVerificationOptions {
 }
-/** Dynamic key resolver for JWT decryption. */
+/**
+ * Resolves a JWT decryption key. No token components have been authenticated when this function is
+ * called.
+ */
 export interface JWTDecryptGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.CompactJWEHeaderParameters, t.FlattenedJWE, KeyType | t.KeyObject | t.JWK> {
 }
 /**
  * Decrypts a Compact JWE-formatted JWT and validates its Claims Set.
  *
- * @param key Private Key or Secret to decrypt and verify the JWT with. See
+ * @param key Private key or shared secret to decrypt and verify the JWT with. See
  *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  */
 export declare function jwtDecrypt<PayloadType = t.JWTPayload>(jwt: string | Uint8Array, key: t.KeyInput, options?: JWTDecryptOptions): Promise<t.JWTDecryptResult<PayloadType>>;
 /**
- * Decrypts a JWT and validates its JWT Claims Set, resolving the key dynamically. The result
- * additionally carries the {@link t.ResolvedKey.key resolved key}.
+ * Decrypts a JWT and validates its claims, returning the dynamically
+ * {@link t.ResolvedKey.key resolved key}.
  *
- * @param getKey Function resolving Private Key or Secret to decrypt and verify the JWT with. See
- *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+ * @param getKey Function resolving a private key or shared secret to decrypt and verify the JWT
+ *   with. See {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  */
 export declare function jwtDecrypt<PayloadType = t.JWTPayload, KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jwt: string | Uint8Array, getKey: JWTDecryptGetKey<KeyType>, options?: JWTDecryptOptions): Promise<t.JWTDecryptResult<PayloadType> & t.ResolvedKey<KeyType>>;
 /**
- * Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
- * either a key or a key resolution function; `key` is present on the result only when a resolution
- * function was used.
+ * Accepts a key or key resolver. Use this overload when forwarding either form; the result includes
+ * `key` only when a resolver was used.
  *
- * @param key Private Key or Secret, or a function resolving one, to decrypt and verify the JWT
- *   with. See {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+ * @param key Private key or shared secret, or a function resolving one, to decrypt and verify the
+ *   JWT with. See
+ *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
  */
 export declare function jwtDecrypt<PayloadType = t.JWTPayload>(jwt: string | Uint8Array, key: t.KeyInput | JWTDecryptGetKey, options?: JWTDecryptOptions): Promise<t.JWTDecryptResult<PayloadType> & Partial<t.ResolvedKey>>;

package/node_modules/jose/dist/types/jwt/encrypt.d.ts

@@ -1,53 +1,55 @@
 import type * as t from '../types.d.ts';
-/**
- * EncryptJWT constructor
- *
- * @param payload The JWT Claims Set object. Defaults to an empty object.
- */
+/** @param payload Initial JWT Claims Set. Defaults to an empty object. */
 declare const EncryptJWT_base: new (payload?: t.JWTPayload) => t.ProduceJWT;
 /** Builds and encrypts Compact JWE-formatted JSON Web Tokens. */
 export declare class EncryptJWT extends EncryptJWT_base {
     #private;
     /**
-     * Sets the JWE Protected Header on the EncryptJWT object.
+     * Sets the JWE Protected Header. May only be called once.
      *
      * @param protectedHeader JWE Protected Header. Must contain an "alg" (JWE Algorithm) and "enc"
      *   (JWE Encryption Algorithm) properties.
      */
     setProtectedHeader(protectedHeader: t.CompactJWEHeaderParameters): this;
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting. Use this method instead of
-     * the header setters to configure algorithm inputs such as ECDH-ES "apu" (Agreement PartyUInfo)
-     * and "apv" (Agreement PartyVInfo), or PBES2 "p2c" (PBES2 Count). The parameters are added to the
-     * appropriate JOSE Header.
+     * Sets JWE Key Management parameters, such as ECDH-ES "apu" and "apv" or PBES2 "p2c", and adds
+     * them to the appropriate JOSE Header. Use this instead of the header setters for algorithm
+     * inputs. May only be called once.
      */
     setKeyManagementParameters(parameters: t.JWEKeyManagementHeaderParameters): this;
     /**
-     * Sets a content encryption key to use, by default a random suitable one is generated for the JWE
-     * "enc" (Encryption Algorithm) Header Parameter.
+     * Sets the content encryption key. By default, a suitable random key is generated for the JWE
+     * "enc" (Encryption Algorithm). May only be called once.
      *
-     * @deprecated You should not use this method. It is only really intended for test and vector
-     *   validation purposes.
+     * @deprecated For testing and vector validation only; allow random generation in production.
      */
     setContentEncryptionKey(cek: Uint8Array): this;
     /**
-     * Sets the JWE Initialization Vector to use for content encryption, by default a random suitable
-     * one is generated for the JWE "enc" (Encryption Algorithm) Header Parameter.
+     * Sets the Initialization Vector for content encryption. By default, a suitable random IV is
+     * generated for the JWE "enc" (Encryption Algorithm). May only be called once.
      *
-     * @deprecated You should not use this method. It is only really intended for test and vector
-     *   validation purposes.
+     * @deprecated For testing and vector validation only; allow random generation in production.
      */
     setInitializationVector(iv: Uint8Array): this;
-    /** Replicates the "iss" (Issuer) Claim as a JWE Protected Header Parameter. */
+    /**
+     * Replicates the "iss" (Issuer) Claim in the JWE Protected Header, exposing it without
+     * decryption.
+     */
     replicateIssuerAsHeader(): this;
-    /** Replicates the "sub" (Subject) Claim as a JWE Protected Header Parameter. */
+    /**
+     * Replicates the "sub" (Subject) Claim in the JWE Protected Header, exposing it without
+     * decryption.
+     */
     replicateSubjectAsHeader(): this;
-    /** Replicates the "aud" (Audience) Claim as a JWE Protected Header Parameter. */
+    /**
+     * Replicates the "aud" (Audience) Claim in the JWE Protected Header, exposing it without
+     * decryption.
+     */
     replicateAudienceAsHeader(): this;
     /**
      * Encrypts and returns the JWT.
      *
-     * @param key Public Key or Secret to encrypt the JWT with. See
+     * @param key Public key or shared secret to encrypt the JWT with. See
      *   {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
      */
     encrypt(key: t.KeyInput, options?: t.EncryptOptions): Promise<string>;

package/node_modules/jose/dist/types/jwt/sign.d.ts

@@ -1,15 +1,11 @@
 import type * as t from '../types.d.ts';
-/**
- * SignJWT constructor
- *
- * @param payload The JWT Claims Set object. Defaults to an empty object.
- */
+/** @param payload Initial JWT Claims Set. Defaults to an empty object. */
 declare const SignJWT_base: new (payload?: t.JWTPayload) => t.ProduceJWT;
 /** Builds and signs Compact JWS-formatted JSON Web Tokens. */
 export declare class SignJWT extends SignJWT_base {
     #private;
     /**
-     * Sets the JWS Protected Header on the SignJWT object.
+     * Sets the JWS Protected Header. May only be called once.
      *
      * @param protectedHeader JWS Protected Header. Must contain an "alg" (JWS Algorithm) property.
      */
@@ -17,7 +13,7 @@ export declare class SignJWT extends SignJWT_base {
     /**
      * Signs and returns the JWT.
      *
-     * @param key Private Key or Secret to sign the JWT with. See
+     * @param key Private key or shared secret to sign the JWT with. See
      *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
      */
     sign(key: t.KeyInput, options?: t.SignOptions): Promise<string>;

package/node_modules/jose/dist/types/jwt/unsecured.d.ts

@@ -6,18 +6,14 @@ export interface UnsecuredResult<PayloadType = t.JWTPayload> {
     /** The decoded JOSE Header; always `{ "alg": "none" }` for an Unsecured JWT. */
     header: t.JWSHeaderParameters;
 }
-/**
- * UnsecuredJWT constructor
- *
- * @param payload The JWT Claims Set object. Defaults to an empty object.
- */
+/** @param payload Initial JWT Claims Set. Defaults to an empty object. */
 declare const UnsecuredJWT_base: new (payload?: t.JWTPayload) => t.ProduceJWT;
 /** Encodes and decodes `{ "alg": "none" }` Unsecured JWTs. */
 export declare class UnsecuredJWT extends UnsecuredJWT_base {
     private jwt;
     /** Encodes the Unsecured JWT. */
     encode(): string;
-    /** Decodes an unsecured JWT. */
+    /** Decodes an unsecured JWT and validates its claims without authenticating the token. */
     static decode<PayloadType = t.JWTPayload>(jwt: string, options?: t.JWTClaimVerificationOptions): UnsecuredResult<PayloadType>;
 }
 export {};

package/node_modules/jose/dist/types/jwt/verify.d.ts

@@ -2,27 +2,34 @@ import type * as t from '../types.d.ts';
 /** JWS verification and JWT Claims Set validation options. */
 export interface JWTVerifyOptions extends t.VerifyOptions, t.JWTClaimVerificationOptions {
 }
-/** Dynamic key resolver for JWT verification. */
+/**
+ * Resolves a JWT verification key. No token components have been authenticated when this function
+ * is called.
+ */
 export interface JWTVerifyGetKey<KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array> extends t.GetKeyFunction<t.CompactJWSHeaderParameters, t.FlattenedJWSInput, KeyType | t.KeyObject | t.JWK> {
 }
 /**
  * Verifies a Compact JWS-formatted JWT and validates its Claims Set.
  *
- * @param key Key to verify the JWT with. See
+ * @param key Public key or shared secret to verify the JWT with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ * @param options JWT Verification and JWT Claims Set validation options.
  */
 export declare function jwtVerify<PayloadType = t.JWTPayload>(jwt: string | Uint8Array, key: t.KeyInput, options?: JWTVerifyOptions): Promise<t.JWTVerifyResult<PayloadType>>;
 /**
- * @param getKey Function resolving a key to verify the JWT with. See
+ * Verifies the JWT signature and claims, returning the resolved key.
+ *
+ * @param getKey Function resolving a public key or shared secret to verify the JWT with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ * @param options JWT Verification and JWT Claims Set validation options.
  */
 export declare function jwtVerify<PayloadType = t.JWTPayload, KeyType extends t.CryptoKey | Uint8Array = t.CryptoKey | Uint8Array>(jwt: string | Uint8Array, getKey: JWTVerifyGetKey<KeyType>, options?: JWTVerifyOptions): Promise<t.JWTVerifyResult<PayloadType> & t.ResolvedKey<KeyType>>;
 /**
- * Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
- * either a key or a key resolution function; `key` is present on the result only when a resolution
- * function was used.
+ * Accepts a key or key resolver. Use this overload when forwarding either form; the result includes
+ * `key` only when a resolver was used.
  *
  * @param key Key, or function resolving a key, to verify the JWT with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ * @param options JWT Verification and JWT Claims Set validation options.
  */
 export declare function jwtVerify<PayloadType = t.JWTPayload>(jwt: string | Uint8Array, key: t.KeyInput | JWTVerifyGetKey, options?: JWTVerifyOptions): Promise<t.JWTVerifyResult<PayloadType> & Partial<t.ResolvedKey>>;

package/node_modules/jose/dist/types/key/export.d.ts

@@ -1,19 +1,19 @@
 import type * as t from '../types.d.ts';
 /**
- * Exports a public {@link !CryptoKey} or {@link !KeyObject} to a PEM-encoded SPKI string format.
+ * Exports a public key to PEM-encoded SPKI. CryptoKey inputs must be extractable.
  *
- * @param key Key to export to a PEM-encoded SPKI string format.
+ * @param key Key to export.
  */
 export declare function exportSPKI(key: t.CryptoKey | t.KeyObject): Promise<string>;
 /**
- * Exports a private {@link !CryptoKey} or {@link !KeyObject} to a PEM-encoded PKCS8 string format.
+ * Exports a private key to PEM-encoded PKCS#8. CryptoKey inputs must be extractable.
  *
- * @param key Key to export to a PEM-encoded PKCS8 string format.
+ * @param key Key to export.
  */
 export declare function exportPKCS8(key: t.CryptoKey | t.KeyObject): Promise<string>;
 /**
- * Exports a {@link !CryptoKey}, {@link !KeyObject}, or {@link !Uint8Array} to a JWK.
+ * Exports a key to JWK. CryptoKey inputs must be extractable.
  *
- * @param key Key to export as JWK.
+ * @param key Key to export.
  */
 export declare function exportJWK(key: t.CryptoKey | t.KeyObject | Uint8Array): Promise<t.JWK>;