@suveren/gateway 0.4.0 → 0.5.0

package/node_modules/jose/dist/types/jwe/general/encrypt.d.ts

@@ -1,8 +1,3 @@
-/**
- * Encrypting JSON Web Encryption (JWE) in General JSON Serialization
- *
- * @module
- */
 import type * as types from '../../types.d.ts';
 /** Used to build General JWE object's individual recipients. */
 export interface Recipient {
@@ -13,28 +8,32 @@ export interface Recipient {
      */
     setUnprotectedHeader(unprotectedHeader: types.JWEHeaderParameters): Recipient;
     /**
-     * Sets the JWE Key Management parameters to be used when encrypting.
-     *
-     * (ECDH-ES) Use of this method is needed for ECDH based algorithms to set the "apu" (Agreement
-     * PartyUInfo) or "apv" (Agreement PartyVInfo) parameters.
+     * Sets the JWE Key Management parameters to be used when encrypting. For ECDH based algorithms,
+     * use this method to set the "apu" (Agreement PartyUInfo) or "apv" (Agreement PartyVInfo)
+     * parameters.
      *
      * @param parameters JWE Key Management parameters.
      */
     setKeyManagementParameters(parameters: types.JWEKeyManagementHeaderParameters): Recipient;
-    /** A shorthand for calling addRecipient() on the enclosing {@link GeneralEncrypt} instance */
-    addRecipient(...args: Parameters<GeneralEncrypt['addRecipient']>): Recipient;
-    /** A shorthand for calling encrypt() on the enclosing {@link GeneralEncrypt} instance */
-    encrypt(...args: Parameters<GeneralEncrypt['encrypt']>): Promise<types.GeneralJWE>;
+    /**
+     * A shorthand for calling {@link GeneralEncrypt.addRecipient addRecipient()} on the enclosing
+     * {@link GeneralEncrypt} instance.
+     *
+     * @param key Public Key or Secret to encrypt the Content Encryption Key for the recipient with.
+     *   See {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
+     * @param options JWE Encryption options.
+     */
+    addRecipient(key: types.KeyInput, options?: types.CritOption): Recipient;
+    /**
+     * A shorthand for calling {@link GeneralEncrypt.encrypt encrypt()} on the enclosing
+     * {@link GeneralEncrypt} instance. Takes no arguments — each recipient's key is supplied to
+     * {@link addRecipient}.
+     */
+    encrypt(): Promise<types.GeneralJWE>;
     /** Returns the enclosing {@link GeneralEncrypt} instance */
     done(): GeneralEncrypt;
 }
-/**
- * The GeneralEncrypt class is used to build and encrypt General JWE objects.
- *
- * This class is exported (as a named export) from the main `'jose'` module entry point as well as
- * from its subpath export `'jose/jwe/general/encrypt'`.
- *
- */
+/** The GeneralEncrypt class is used to build and encrypt General JWE objects. */
 export declare class GeneralEncrypt {
     #private;
     /**
@@ -50,7 +49,7 @@ export declare class GeneralEncrypt {
      *   See {@link https://github.com/panva/jose/issues/210#jwe-alg Algorithm Key Requirements}.
      * @param options JWE Encryption options.
      */
-    addRecipient(key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array, options?: types.CritOption): Recipient;
+    addRecipient(key: types.KeyInput, options?: types.CritOption): Recipient;
     /**
      * Sets the JWE Protected Header on the GeneralEncrypt object.
      *

package/node_modules/jose/dist/types/jwk/embedded.d.ts

@@ -1,17 +1,13 @@
-/**
- * Verification using a JWK Embedded in a JWS Header
- *
- * @module
- */
 import type * as types from '../types.d.ts';
 /**
- * EmbeddedJWK is an implementation of a GetKeyFunction intended to be used with the JWS/JWT verify
- * operations whenever you need to opt-in to verify signatures with a public key embedded in the
- * token's "jwk" (JSON Web Key) Header Parameter. It is recommended to combine this with the verify
- * function's `algorithms` option to define accepted JWS "alg" (Algorithm) Header Parameter values.
- *
- * This function is exported (as a named export) from the main `'jose'` module entry point as well
- * as from its subpath export `'jose/jwk/embedded'`.
+ * EmbeddedJWK is an implementation of a {@link types.GetKeyFunction GetKeyFunction} intended to be
+ * used with the JWS/JWT verify operations whenever you need to opt-in to verify signatures with a
+ * public key embedded in the token's "jwk" (JSON Web Key) Header Parameter. It is recommended to
+ * combine this with the verify function's `algorithms` option to define accepted JWS "alg"
+ * (Algorithm) Header Parameter values.
  *
+ * @param protectedHeader JWS Protected Header.
+ * @param token The consumed JWS token.
+ * @returns The public key from the JWS "jwk" (JSON Web Key) Header Parameter.
  */
 export declare function EmbeddedJWK(protectedHeader?: types.JWSHeaderParameters, token?: types.FlattenedJWSInput): Promise<types.CryptoKey>;

package/node_modules/jose/dist/types/jwk/thumbprint.d.ts

@@ -1,32 +1,17 @@
-/**
- * JSON Web Key Thumbprint and JSON Web Key Thumbprint URI
- *
- * @module
- */
 import type * as types from '../types.d.ts';
 /**
  * Calculates a base64url-encoded JSON Web Key (JWK) Thumbprint
  *
- * This function is exported (as a named export) from the main `'jose'` module entry point as well
- * as from its subpath export `'jose/jwk/thumbprint'`.
- *
  * @param key Key to calculate the thumbprint for.
  * @param digestAlgorithm Digest Algorithm to use for calculating the thumbprint. Default is
  *   "sha256".
- *
- * @see {@link https://www.rfc-editor.org/rfc/rfc7638 RFC7638}
  */
 export declare function calculateJwkThumbprint(key: types.JWK | types.CryptoKey | types.KeyObject, digestAlgorithm?: 'sha256' | 'sha384' | 'sha512'): Promise<string>;
 /**
  * Calculates a JSON Web Key (JWK) Thumbprint URI
  *
- * This function is exported (as a named export) from the main `'jose'` module entry point as well
- * as from its subpath export `'jose/jwk/thumbprint'`.
- *
  * @param key Key to calculate the thumbprint for.
  * @param digestAlgorithm Digest Algorithm to use for calculating the thumbprint. Default is
  *   "sha256".
- *
- * @see {@link https://www.rfc-editor.org/rfc/rfc9278 RFC9278}
  */
 export declare function calculateJwkThumbprintUri(key: types.CryptoKey | types.KeyObject | types.JWK, digestAlgorithm?: 'sha256' | 'sha384' | 'sha512'): Promise<string>;

package/node_modules/jose/dist/types/jwks/local.d.ts

@@ -1,29 +1,20 @@
-/**
- * Verification using a JSON Web Key Set (JWKS) available locally
- *
- * @module
- */
 import type * as types from '../types.d.ts';
+/** The key resolution function returned by {@link createLocalJWKSet}. */
+export interface LocalJWKSet {
+    (protectedHeader?: types.JWSHeaderParameters, token?: types.FlattenedJWSInput): Promise<types.CryptoKey>;
+    /** Returns a structured clone of the JSON Web Key Set this resolver was created with. */
+    jwks: () => types.JSONWebKeySet;
+}
 /**
  * Returns a function that resolves a JWS JOSE Header to a public key object from a locally stored,
- * or otherwise available, JSON Web Key Set.
+ * or otherwise available, JSON Web Key Set. Selection respects the header's "alg" (Algorithm) and
+ * "kid" (Key ID) as well as the JWK's "use" (Public Key Use) and "key_ops" (Key Operations).
+ * Exactly one key must match; if multiple keys match, the thrown `JWKSMultipleMatchingKeys` can be
+ * iterated.
  *
- * It uses the "alg" (JWS Algorithm) Header Parameter to determine the right JWK "kty" (Key Type),
- * then proceeds to match the JWK "kid" (Key ID) with one found in the JWS Header Parameters (if
- * there is one) while also respecting the JWK "use" (Public Key Use) and JWK "key_ops" (Key
- * Operations) Parameters (if they are present on the JWK).
- *
- * Only a single public key must match the selection process. As shown in the example below when
- * multiple keys get matched it is possible to opt-in to iterate over the matched keys and attempt
- * verification in an iterative manner.
- *
- * > [!NOTE]\
- * > The function's purpose is to resolve public keys used for verifying signatures and will not work
+ * > Note: The function's purpose is to resolve public keys used for verifying signatures and will not work
  * > for public encryption keys.
  *
- * This function is exported (as a named export) from the main `'jose'` module entry point as well
- * as from its subpath export `'jose/jwks/local'`.
- *
  * @param jwks JSON Web Key Set formatted object.
  */
-export declare function createLocalJWKSet(jwks: types.JSONWebKeySet): (protectedHeader?: types.JWSHeaderParameters, token?: types.FlattenedJWSInput) => Promise<types.CryptoKey>;
+export declare function createLocalJWKSet(jwks: types.JSONWebKeySet): LocalJWKSet;

package/node_modules/jose/dist/types/jwks/remote.d.ts

@@ -1,101 +1,10 @@
-/**
- * Verification using a JSON Web Key Set (JWKS) available on an HTTP(S) URL
- *
- * @module
- */
 import type * as types from '../types.d.ts';
 /**
  * When passed to {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} this allows the resolver
  * to make use of advanced fetch configurations, HTTP Proxies, retry on network errors, etc.
  *
- * > [!NOTE]\
- * > Known caveat: Expect Type-related issues when passing the inputs through to fetch-like modules,
+ * > Note: Known caveat: Expect Type-related issues when passing the inputs through to fetch-like modules,
  * > they hardly ever get their typings inline with actual fetch, you should `@ts-expect-error` them.
- *
- * import ky from 'ky'
- *
- * let logRequest!: (request: Request) => void
- * let logResponse!: (request: Request, response: Response) => void
- * let logRetry!: (request: Request, error: Error, retryCount: number) => void
- *
- * const JWKS = jose.createRemoteJWKSet(url, {
- *   [jose.customFetch]: (...args) =>
- *     ky(args[0], {
- *       ...args[1],
- *       hooks: {
- *         beforeRequest: [
- *           (request) => {
- *             logRequest(request)
- *           },
- *         ],
- *         beforeRetry: [
- *           ({ request, error, retryCount }) => {
- *             logRetry(request, error, retryCount)
- *           },
- *         ],
- *         afterResponse: [
- *           (request, _, response) => {
- *             logResponse(request, response)
- *           },
- *         ],
- *       },
- *     }),
- * })
- * ```
- *
- * import * as undici from 'undici'
- *
- * // see https://undici.nodejs.org/api/EnvHttpProxyAgent
- * let envHttpProxyAgent = new undici.EnvHttpProxyAgent()
- *
- * // @ts-ignore
- * const JWKS = jose.createRemoteJWKSet(url, {
- *   [jose.customFetch]: (...args) => {
- *     // @ts-ignore
- *     return undici.fetch(args[0], { ...args[1], dispatcher: envHttpProxyAgent }) // prettier-ignore
- *   },
- * })
- * ```
- *
- * import * as undici from 'undici'
- *
- * // see https://undici.nodejs.org/api/RetryAgent
- * let retryAgent = new undici.RetryAgent(new undici.Agent(), {
- *   statusCodes: [],
- *   errorCodes: [
- *     'ECONNRESET',
- *     'ECONNREFUSED',
- *     'ENOTFOUND',
- *     'ENETDOWN',
- *     'ENETUNREACH',
- *     'EHOSTDOWN',
- *     'UND_ERR_SOCKET',
- *   ],
- * })
- *
- * // @ts-ignore
- * const JWKS = jose.createRemoteJWKSet(url, {
- *   [jose.customFetch]: (...args) => {
- *     // @ts-ignore
- *     return undici.fetch(args[0], { ...args[1], dispatcher: retryAgent }) // prettier-ignore
- *   },
- * })
- * ```
- *
- * import * as undici from 'undici'
- *
- * // see https://undici.nodejs.org/api/MockAgent
- * let mockAgent = new undici.MockAgent()
- * mockAgent.disableNetConnect()
- *
- * // @ts-ignore
- * const JWKS = jose.createRemoteJWKSet(url, {
- *   [jose.customFetch]: (...args) => {
- *     // @ts-ignore
- *     return undici.fetch(args[0], { ...args[1], dispatcher: mockAgent }) // prettier-ignore
- *   },
- * })
- * ```
  */
 export declare const customFetch: unique symbol;
 /** See {@link customFetch}. */
@@ -113,55 +22,14 @@ options: {
     signal: AbortSignal;
 }) => Promise<Response>;
 /**
- * > [!WARNING]\
- * > This option has security implications that must be understood, assessed for applicability, and
+ * > Warning: This option has security implications that must be understood, assessed for applicability, and
  * > accepted before use. It is critical that the JSON Web Key Set cache only be writable by your own
  * > code.
  *
  * This option is intended for cloud computing runtimes that cannot keep an in memory cache between
- * their code's invocations. Use in runtimes where an in memory cache between requests is available
- * is not desirable.
- *
- * When passed to {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} this allows the passed in
- * object to:
- *
- * - Serve as an initial value for the JSON Web Key Set that the module would otherwise need to
- *   trigger an HTTP request for
- * - Have the JSON Web Key Set the function optionally ended up triggering an HTTP request for
- *   assigned to it as properties
- *
- * The intended use pattern is:
- *
- * - Before verifying with {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} you pull the
- *   previously cached object from a low-latency key-value store offered by the cloud computing
- *   runtime it is executed on;
- * - Default to an empty object `{}` instead when there's no previously cached value;
- * - Pass it in as {@link RemoteJWKSetOptions[jwksCache]};
- * - Afterwards, update the key-value storage if the {@link ExportedJWKSCache.uat `uat`} property of
- *   the object has changed.
- *
- * // Prerequisites
- * let url!: URL
- * let jwt!: string
- * let getPreviouslyCachedJWKS!: () => Promise<jose.ExportedJWKSCache>
- * let storeNewJWKScache!: (cache: jose.ExportedJWKSCache) => Promise<void>
- *
- * // Load JSON Web Key Set cache
- * const jwksCache: jose.JWKSCacheInput = (await getPreviouslyCachedJWKS()) || {}
- * const { uat } = jwksCache
- *
- * const JWKS = jose.createRemoteJWKSet(url, {
- *   [jose.jwksCache]: jwksCache,
- * })
- *
- * // Use JSON Web Key Set cache
- * await jose.jwtVerify(jwt, JWKS)
- *
- * if (uat !== jwksCache.uat) {
- *   // Update JSON Web Key Set cache
- *   await storeNewJWKScache(jwksCache)
- * }
- * ```
+ * their code's invocations. The supplied writable object seeds the resolver's cache and is updated
+ * with `jwks` and `uat` after a successful fetch; persist it whenever `uat` changes. Using this in
+ * runtimes that can keep an in-memory cache between requests is not desirable.
  */
 export declare const jwksCache: unique symbol;
 /** Options for the remote JSON Web Key Set. */
@@ -197,41 +65,42 @@ export interface ExportedJWKSCache {
 }
 /** See {@link jwksCache}. */
 export type JWKSCacheInput = ExportedJWKSCache | Record<string, never>;
+/** The key resolution function returned by {@link createRemoteJWKSet}. */
+export interface RemoteJWKSet {
+    (protectedHeader?: types.JWSHeaderParameters, token?: types.FlattenedJWSInput): Promise<types.CryptoKey>;
+    /** Whether the cooldown window following the last successful fetch is still in effect. */
+    readonly coolingDown: boolean;
+    /**
+     * Whether the currently cached JSON Web Key Set is within its
+     * {@link RemoteJWKSetOptions.cacheMaxAge}.
+     */
+    readonly fresh: boolean;
+    /** Whether a JSON Web Key Set fetch is currently in flight. */
+    readonly reloading: boolean;
+    /**
+     * Triggers a JSON Web Key Set fetch, bypassing
+     * {@link RemoteJWKSetOptions.cooldownDuration the cooldown}.
+     */
+    reload: () => Promise<void>;
+    /**
+     * The currently cached JSON Web Key Set, or `undefined` when none has been fetched or seeded via
+     * {@link jwksCache} yet.
+     */
+    jwks: () => types.JSONWebKeySet | undefined;
+}
 /**
  * Returns a function that resolves a JWS JOSE Header to a public key object downloaded from a
  * remote endpoint returning a JSON Web Key Set, that is, for example, an OAuth 2.0 or OIDC
  * jwks_uri. The JSON Web Key Set is fetched when no key matches the selection process but only as
- * frequently as the `cooldownDuration` option allows to prevent abuse.
- *
- * It uses the "alg" (JWS Algorithm) Header Parameter to determine the right JWK "kty" (Key Type),
- * then proceeds to match the JWK "kid" (Key ID) with one found in the JWS Header Parameters (if
- * there is one) while also respecting the JWK "use" (Public Key Use) and JWK "key_ops" (Key
- * Operations) Parameters (if they are present on the JWK).
+ * frequently as the `cooldownDuration` option allows to prevent abuse. Selection respects the
+ * header's "alg" (Algorithm) and "kid" (Key ID) as well as the JWK's "use" (Public Key Use) and
+ * "key_ops" (Key Operations). Exactly one key must match; if multiple keys match, the thrown
+ * `JWKSMultipleMatchingKeys` can be iterated.
  *
- * Only a single public key must match the selection process. As shown in the example below when
- * multiple keys get matched it is possible to opt-in to iterate over the matched keys and attempt
- * verification in an iterative manner.
- *
- * > [!NOTE]\
- * > The function's purpose is to resolve public keys used for verifying signatures and will not work
+ * > Note: The function's purpose is to resolve public keys used for verifying signatures and will not work
  * > for public encryption keys.
  *
- * This function is exported (as a named export) from the main `'jose'` module entry point as well
- * as from its subpath export `'jose/jwks/remote'`.
- *
  * @param url URL to fetch the JSON Web Key Set from.
  * @param options Options for the remote JSON Web Key Set.
  */
-export declare function createRemoteJWKSet(url: URL, options?: RemoteJWKSetOptions): {
-    (protectedHeader?: types.JWSHeaderParameters, token?: types.FlattenedJWSInput): Promise<types.CryptoKey>;
-    /** @ignore */
-    coolingDown: boolean;
-    /** @ignore */
-    fresh: boolean;
-    /** @ignore */
-    reloading: boolean;
-    /** @ignore */
-    reload: () => Promise<void>;
-    /** @ignore */
-    jwks: () => types.JSONWebKeySet | undefined;
-};
+export declare function createRemoteJWKSet(url: URL, options?: RemoteJWKSetOptions): RemoteJWKSet;

package/node_modules/jose/dist/types/jws/compact/sign.d.ts

@@ -1,16 +1,5 @@
-/**
- * Signing JSON Web Signature (JWS) in Compact Serialization
- *
- * @module
- */
 import type * as types from '../../types.d.ts';
-/**
- * The CompactSign class is used to build and sign Compact JWS strings.
- *
- * This class is exported (as a named export) from the main `'jose'` module entry point as well as
- * from its subpath export `'jose/jws/compact/sign'`.
- *
- */
+/** The CompactSign class is used to build and sign Compact JWS strings. */
 export declare class CompactSign {
     #private;
     /**
@@ -32,5 +21,5 @@ export declare class CompactSign {
      *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
      * @param options JWS Sign options.
      */
-    sign(key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array, options?: types.SignOptions): Promise<string>;
+    sign(key: types.KeyInput, options?: types.SignOptions): Promise<string>;
 }

package/node_modules/jose/dist/types/jws/compact/verify.d.ts

@@ -1,33 +1,37 @@
-/**
- * Verifying JSON Web Signature (JWS) in Compact Serialization
- *
- * @module
- */
 import type * as types from '../../types.d.ts';
 /**
  * Interface for Compact JWS Verification dynamic key resolution. No token components have been
  * verified at the time of this function call.
- *
- * @see {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} to verify using a remote JSON Web Key Set.
  */
-export interface CompactVerifyGetKey extends types.GenericGetKeyFunction<types.CompactJWSHeaderParameters, types.FlattenedJWSInput, types.CryptoKey | types.KeyObject | types.JWK | Uint8Array> {
+export interface CompactVerifyGetKey<KeyType extends types.CryptoKey | Uint8Array = types.CryptoKey | Uint8Array> extends types.GetKeyFunction<types.CompactJWSHeaderParameters, types.FlattenedJWSInput, KeyType | types.KeyObject | types.JWK> {
 }
 /**
  * Verifies the signature and format of and afterwards decodes the Compact JWS.
  *
- * This function is exported (as a named export) from the main `'jose'` module entry point as well
- * as from its subpath export `'jose/jws/compact/verify'`.
- *
  * @param jws Compact JWS.
  * @param key Key to verify the JWS with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  * @param options JWS Verify options.
  */
-export declare function compactVerify(jws: string | Uint8Array, key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array, options?: types.VerifyOptions): Promise<types.CompactVerifyResult>;
+export declare function compactVerify(jws: string | Uint8Array, key: types.KeyInput, options?: types.VerifyOptions): Promise<types.CompactVerifyResult>;
 /**
+ * Verifies the signature and format of and afterwards decodes the Compact JWS, resolving the key
+ * dynamically. The result additionally carries the {@link types.ResolvedKey.key resolved key}.
+ *
  * @param jws Compact JWS.
  * @param getKey Function resolving a key to verify the JWS with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  * @param options JWS Verify options.
  */
-export declare function compactVerify(jws: string | Uint8Array, getKey: CompactVerifyGetKey, options?: types.VerifyOptions): Promise<types.CompactVerifyResult & types.ResolvedKey>;
+export declare function compactVerify<KeyType extends types.CryptoKey | Uint8Array = types.CryptoKey | Uint8Array>(jws: string | Uint8Array, getKey: CompactVerifyGetKey<KeyType>, options?: types.VerifyOptions): Promise<types.CompactVerifyResult & types.ResolvedKey<KeyType>>;
+/**
+ * Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
+ * either a key or a key resolution function; `key` is present on the result only when a resolution
+ * function was used.
+ *
+ * @param jws Compact JWS.
+ * @param key Key, or function resolving a key, to verify the JWS with. See
+ *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ * @param options JWS Verify options.
+ */
+export declare function compactVerify(jws: string | Uint8Array, key: types.KeyInput | CompactVerifyGetKey, options?: types.VerifyOptions): Promise<types.CompactVerifyResult & Partial<types.ResolvedKey>>;

package/node_modules/jose/dist/types/jws/flattened/sign.d.ts

@@ -1,16 +1,5 @@
-/**
- * Signing JSON Web Signature (JWS) in Flattened JSON Serialization
- *
- * @module
- */
 import type * as types from '../../types.d.ts';
-/**
- * The FlattenedSign class is used to build and sign Flattened JWS objects.
- *
- * This class is exported (as a named export) from the main `'jose'` module entry point as well as
- * from its subpath export `'jose/jws/flattened/sign'`.
- *
- */
+/** The FlattenedSign class is used to build and sign Flattened JWS objects. */
 export declare class FlattenedSign {
     #private;
     /**
@@ -38,5 +27,5 @@ export declare class FlattenedSign {
      *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
      * @param options JWS Sign options.
      */
-    sign(key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array, options?: types.SignOptions): Promise<types.FlattenedJWS>;
+    sign(key: types.KeyInput, options?: types.SignOptions): Promise<types.FlattenedJWS>;
 }

package/node_modules/jose/dist/types/jws/flattened/verify.d.ts

@@ -1,33 +1,37 @@
-/**
- * Verifying JSON Web Signature (JWS) in Flattened JSON Serialization
- *
- * @module
- */
 import type * as types from '../../types.d.ts';
 /**
  * Interface for Flattened JWS Verification dynamic key resolution. No token components have been
  * verified at the time of this function call.
- *
- * @see {@link jwks/remote.createRemoteJWKSet createRemoteJWKSet} to verify using a remote JSON Web Key Set.
  */
-export interface FlattenedVerifyGetKey extends types.GenericGetKeyFunction<types.JWSHeaderParameters | undefined, types.FlattenedJWSInput, types.CryptoKey | types.KeyObject | types.JWK | Uint8Array> {
+export interface FlattenedVerifyGetKey<KeyType extends types.CryptoKey | Uint8Array = types.CryptoKey | Uint8Array> extends types.GetKeyFunction<types.JWSHeaderParameters, types.FlattenedJWSInput, KeyType | types.KeyObject | types.JWK> {
 }
 /**
  * Verifies the signature and format of and afterwards decodes the Flattened JWS.
  *
- * This function is exported (as a named export) from the main `'jose'` module entry point as well
- * as from its subpath export `'jose/jws/flattened/verify'`.
- *
  * @param jws Flattened JWS.
  * @param key Key to verify the JWS with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  * @param options JWS Verify options.
  */
-export declare function flattenedVerify(jws: types.FlattenedJWSInput, key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array, options?: types.VerifyOptions): Promise<types.FlattenedVerifyResult>;
+export declare function flattenedVerify(jws: types.FlattenedJWSInput, key: types.KeyInput, options?: types.VerifyOptions): Promise<types.FlattenedVerifyResult>;
 /**
+ * Verifies the signature and format of and afterwards decodes the Flattened JWS, resolving the key
+ * dynamically. The result additionally carries the {@link types.ResolvedKey.key resolved key}.
+ *
  * @param jws Flattened JWS.
  * @param getKey Function resolving a key to verify the JWS with. See
  *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
  * @param options JWS Verify options.
  */
-export declare function flattenedVerify(jws: types.FlattenedJWSInput, getKey: FlattenedVerifyGetKey, options?: types.VerifyOptions): Promise<types.FlattenedVerifyResult & types.ResolvedKey>;
+export declare function flattenedVerify<KeyType extends types.CryptoKey | Uint8Array = types.CryptoKey | Uint8Array>(jws: types.FlattenedJWSInput, getKey: FlattenedVerifyGetKey<KeyType>, options?: types.VerifyOptions): Promise<types.FlattenedVerifyResult & types.ResolvedKey<KeyType>>;
+/**
+ * Accepts either form of the `key` argument. Use this overload when forwarding a value that may be
+ * either a key or a key resolution function; `key` is present on the result only when a resolution
+ * function was used.
+ *
+ * @param jws Flattened JWS.
+ * @param key Key, or function resolving a key, to verify the JWS with. See
+ *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+ * @param options JWS Verify options.
+ */
+export declare function flattenedVerify(jws: types.FlattenedJWSInput, key: types.KeyInput | FlattenedVerifyGetKey, options?: types.VerifyOptions): Promise<types.FlattenedVerifyResult & Partial<types.ResolvedKey>>;

package/node_modules/jose/dist/types/jws/general/sign.d.ts

@@ -1,8 +1,3 @@
-/**
- * Signing JSON Web Signature (JWS) in General JSON Serialization
- *
- * @module
- */
 import type * as types from '../../types.d.ts';
 /** Used to build General JWS object's individual signatures. */
 export interface Signature {
@@ -18,20 +13,24 @@ export interface Signature {
      * @param unprotectedHeader JWS Unprotected Header.
      */
     setUnprotectedHeader(unprotectedHeader: types.JWSHeaderParameters): Signature;
-    /** A shorthand for calling addSignature() on the enclosing {@link GeneralSign} instance */
-    addSignature(...args: Parameters<GeneralSign['addSignature']>): Signature;
-    /** A shorthand for calling encrypt() on the enclosing {@link GeneralSign} instance */
-    sign(...args: Parameters<GeneralSign['sign']>): Promise<types.GeneralJWS>;
+    /**
+     * A shorthand for calling {@link GeneralSign.addSignature addSignature()} on the enclosing
+     * {@link GeneralSign} instance.
+     *
+     * @param key Private Key or Secret to sign the individual JWS signature with. See
+     *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
+     * @param options JWS Sign options.
+     */
+    addSignature(key: types.KeyInput, options?: types.SignOptions): Signature;
+    /**
+     * A shorthand for calling {@link GeneralSign.sign sign()} on the enclosing {@link GeneralSign}
+     * instance. Takes no arguments — each signature's key is supplied to {@link addSignature}.
+     */
+    sign(): Promise<types.GeneralJWS>;
     /** Returns the enclosing {@link GeneralSign} instance */
     done(): GeneralSign;
 }
-/**
- * The GeneralSign class is used to build and sign General JWS objects.
- *
- * This class is exported (as a named export) from the main `'jose'` module entry point as well as
- * from its subpath export `'jose/jws/general/sign'`.
- *
- */
+/** The GeneralSign class is used to build and sign General JWS objects. */
 export declare class GeneralSign {
     #private;
     /**
@@ -47,7 +46,7 @@ export declare class GeneralSign {
      *   {@link https://github.com/panva/jose/issues/210#jws-alg Algorithm Key Requirements}.
      * @param options JWS Sign options.
      */
-    addSignature(key: types.CryptoKey | types.KeyObject | types.JWK | Uint8Array, options?: types.SignOptions): Signature;
+    addSignature(key: types.KeyInput, options?: types.SignOptions): Signature;
     /** Signs and resolves the value of the General JWS object. */
     sign(): Promise<types.GeneralJWS>;
 }