@sdxc/jwt 2026.9.11 → 2026.9.28

package/dist/jwk.d.ts

@@ -24,11 +24,11 @@ export declare namespace JWK {
      * providers; EdDSA derives its nonce from the key and message, keeping the
      * ECDSA nonce-reuse leak that exposes a private key out of reach.
      */
-    const Algorithm: typeof SignatureAlgorithm;
+    export const Algorithm: typeof SignatureAlgorithm;
     /** One of the supported signature algorithms. */
-    type Algorithm = (typeof SignatureAlgorithm)[keyof typeof SignatureAlgorithm];
+    export type Algorithm = (typeof SignatureAlgorithm)[keyof typeof SignatureAlgorithm];
     /** A key pair imported into a usable form, with the public half in JWK format. */
-    interface KeyPair {
+    export interface KeyPair {
         /** Identifier published as the `kid`, and written into every token header. */
         id: string;
         /** Algorithm the pair was generated for. */
@@ -50,7 +50,7 @@ export declare namespace JWK {
      * PEM strings and a millisecond timestamp, so the whole pair survives
      * `JSON.stringify` into a bucket or a text column with nothing lost.
      */
-    interface SerializedKeyPair {
+    export interface SerializedKeyPair {
         /** Identifier that becomes the `kid`. */
         id: `${string}-${string}-${string}-${string}-${string}`;
         /** Algorithm the pair was generated for. */
@@ -70,7 +70,7 @@ export declare namespace JWK {
      * A structural subset of `KeyPair`, so a full pair is accepted wherever this is
      * expected, and a caller holding only a private key already has enough to sign.
      */
-    interface SigningKey {
+    export interface SigningKey {
         /** Identifier written into the token header as `kid`. */
         id: string;
         /** Algorithm the key was generated for, matched against the requested one. */
@@ -84,7 +84,7 @@ export declare namespace JWK {
      * A single `jwk` field carries both the key material and the `kid` a token's
      * header is matched against — everything selecting a key from a set takes.
      */
-    interface VerificationKey {
+    export interface VerificationKey {
         jwk: jose.JWK;
     }
     /**
@@ -93,11 +93,11 @@ export declare namespace JWK {
      * What `importLocal` and `importRemote` hand back: the key set is only consulted
      * once there is a token to consult it about.
      */
-    type KeyResolver = jose.JWTVerifyGetKey;
+    export type KeyResolver = jose.JWTVerifyGetKey;
     /** Where `JWT.verify` can find a token's key: the keys themselves, or a resolver. */
-    type VerificationKeys = KeyResolver | VerificationKey[];
+    export type VerificationKeys = KeyResolver | VerificationKey[];
     /** Request headers, timeouts, and cache windows a remote key set can be given. */
-    type RemoteOptions = jose.RemoteJWKSetOptions;
+    export type RemoteOptions = jose.RemoteJWKSetOptions;
     /**
      * Generates a new key pair in serialized form.
      *
@@ -110,7 +110,7 @@ export declare namespace JWK {
      * let serialized = await JWK.generateKeyPair(JWK.Algorithm.ES256);
      * await db.create(table, { id: serialized.id, private_key: serialized.privateKey });
      */
-    function generateKeyPair(alg: Algorithm): Promise<SerializedKeyPair>;
+    export function generateKeyPair(alg: Algorithm): Promise<SerializedKeyPair>;
     /**
      * Imports a stored key pair back into usable `CryptoKey` objects.
      *
@@ -122,7 +122,7 @@ export declare namespace JWK {
      * @example
      * let keyPair = await JWK.importKeyPair({ id, alg, publicKey, privateKey, created });
      */
-    function importKeyPair(value: SerializedKeyPair): Promise<KeyPair>;
+    export function importKeyPair(value: SerializedKeyPair): Promise<KeyPair>;
     /**
      * Loads the signing keys out of storage, generating one on first use.
      *
@@ -135,7 +135,7 @@ export declare namespace JWK {
      * let keys = await JWK.signingKeys(storage);
      * let jwks = JWK.toJSON(keys);
      */
-    function signingKeys(storage: KeyStorage): Promise<KeyPair[]>;
+    export function signingKeys(storage: KeyStorage): Promise<KeyPair[]>;
     /**
      * Resolves a token's key by matching its header's `kid`, key type, curve,
      * algorithm, and use against the set; anything but exactly one match is an
@@ -147,7 +147,7 @@ export declare namespace JWK {
      * let keys = await JWK.importLocal(jwks);
      * let token = await IdToken.verify(raw, keys, { issuer, audience, algorithms });
      */
-    function importLocal(jwks: jose.JSONWebKeySet): Promise<KeyResolver>;
+    export function importLocal(jwks: jose.JSONWebKeySet): Promise<KeyResolver>;
     /**
      * Points a resolver at a JWKS endpoint, fetched on first use and re-fetched
      * at most once per cooldown window when a token names an unseen `kid` —
@@ -159,7 +159,7 @@ export declare namespace JWK {
      * @example
      * let keys = JWK.importRemote(new URL(jwksUrl));
      */
-    function importRemote(url: URL, options?: RemoteOptions): Promise<KeyResolver>;
+    export function importRemote(url: URL, options?: RemoteOptions): Promise<KeyResolver>;
     /**
      * Renders key pairs as the JSON a `/.well-known/jwks.json` endpoint serves.
      *
@@ -167,10 +167,21 @@ export declare namespace JWK {
      * plus `kid` and `alg`, keeping unvetted private material out of the set.
      *
      * @param keys - The key pairs to publish.
-     * @returns The JWKS document.
+     * @returns The JWKS document, every entry carrying the `kty` RFC 7517 requires.
      * @throws When a pair's key type has no published shape on record.
      * @example
      * return Response.json(JWK.toJSON(await JWK.signingKeys(storage)));
      */
-    function toJSON(keys: KeyPair[]): jose.JSONWebKeySet;
+    export function toJSON(keys: KeyPair[]): PublishedKeySet;
+    /** The members jose allows on a key inside a JWKS document. */
+    type PublishedKeyMembers = jose.JSONWebKeySet["keys"][number];
+    /** A published key: RFC 7517 makes `kty` the one member every JWK carries. */
+    export interface PublishedKey extends PublishedKeyMembers {
+        kty: string;
+    }
+    /** The JWKS document {@link toJSON} writes, accepted anywhere a JWKS is read. */
+    export interface PublishedKeySet {
+        keys: PublishedKey[];
+    }
+    export {};
 }

package/dist/jwk.js

@@ -164,7 +164,7 @@ export var JWK;
      * plus `kid` and `alg`, keeping unvetted private material out of the set.
      *
      * @param keys - The key pairs to publish.
-     * @returns The JWKS document.
+     * @returns The JWKS document, every entry carrying the `kty` RFC 7517 requires.
      * @throws When a pair's key type has no published shape on record.
      * @example
      * return Response.json(JWK.toJSON(await JWK.signingKeys(storage)));
@@ -172,10 +172,11 @@ export var JWK;
     function toJSON(keys) {
         return {
             keys: keys.map(({ alg, id, jwk }) => {
-                let publish = jwk.kty ? PUBLISHED_JWK_FIELDS[jwk.kty] : undefined;
-                if (!publish)
-                    throw new Error(`Cannot publish a key of type ${String(jwk.kty)}`);
-                return { ...publish(jwk), kty: jwk.kty, kid: id, alg };
+                let kty = jwk.kty;
+                let publish = kty ? PUBLISHED_JWK_FIELDS[kty] : undefined;
+                if (!kty || !publish)
+                    throw new Error(`Cannot publish a key of type ${String(kty)}`);
+                return { ...publish(jwk), kty, kid: id, alg };
             }),
         };
     }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@sdxc/jwt",
-	"version": "2026.9.11",
+	"version": "2026.9.28",
 	"description": "JWT payload classes and the keys that sign them",
 	"license": "MIT",
 	"type": "module",
@@ -9,10 +9,10 @@
 		"./algorithm": "./dist/algorithm.js"
 	},
 	"dependencies": {
-		"@sdxc/duration": "2026.9.11",
+		"@sdxc/duration": "2026.9.15",
 		"jose": "^6.2.10"
 	},
-	"gitHead": "3aedbf2a8ed2251cecac480501941ee4c4614ec3",
+	"gitHead": "00c01e349b11f65b9f47902c5345a817e8afd2b1",
 	"publishConfig": {
 		"access": "public"
 	},