@suveren/gateway 0.7.4 → 0.8.0

package/node_modules/jose/dist/types/types.d.ts

@@ -92,7 +92,7 @@ export type JWKParameters = {
   kid?: string
 }
 
-/** Convenience interface for Public OKP JSON Web Keys */
+/** Convenience interface for public OKP JSON Web Keys. */
 export interface JWK_OKP_Public extends JWKParameters {
   /** OKP JWK "crv" (The Subtype of Key Pair) Parameter */
   crv: string
@@ -100,13 +100,13 @@ export interface JWK_OKP_Public extends JWKParameters {
   x: string
 }
 
-/** Convenience interface for Private OKP JSON Web Keys */
+/** Convenience interface for private OKP JSON Web Keys. */
 export interface JWK_OKP_Private extends JWK_OKP_Public {
   /** OKP JWK "d" (The Private Key) Parameter */
   d: string
 }
 
-/** Convenience interface for Public AKP JSON Web Keys */
+/** Convenience interface for public AKP JSON Web Keys. */
 export interface JWK_AKP_Public extends JWKParameters {
   /** JWK "alg" (Algorithm) Parameter */
   alg: string
@@ -114,13 +114,13 @@ export interface JWK_AKP_Public extends JWKParameters {
   pub: string
 }
 
-/** Convenience interface for Private AKP JSON Web Keys */
+/** Convenience interface for private AKP JSON Web Keys. */
 export interface JWK_AKP_Private extends JWK_AKP_Public {
   /** AKP JWK "priv" (The Private Key) Parameter */
   priv: string
 }
 
-/** Convenience interface for Public EC JSON Web Keys */
+/** Convenience interface for public EC JSON Web Keys. */
 export interface JWK_EC_Public extends JWKParameters {
   /** EC JWK "crv" (Curve) Parameter */
   crv: string
@@ -130,13 +130,13 @@ export interface JWK_EC_Public extends JWKParameters {
   y: string
 }
 
-/** Convenience interface for Private EC JSON Web Keys */
+/** Convenience interface for private EC JSON Web Keys. */
 export interface JWK_EC_Private extends JWK_EC_Public {
   /** EC JWK "d" (ECC Private Key) Parameter */
   d: string
 }
 
-/** Convenience interface for Public RSA JSON Web Keys */
+/** Convenience interface for public RSA JSON Web Keys. */
 export interface JWK_RSA_Public extends JWKParameters {
   /** RSA JWK "e" (Exponent) Parameter */
   e: string
@@ -144,7 +144,7 @@ export interface JWK_RSA_Public extends JWKParameters {
   n: string
 }
 
-/** Convenience interface for Private RSA JSON Web Keys */
+/** Convenience interface for private RSA JSON Web Keys. */
 export interface JWK_RSA_Private extends JWK_RSA_Public {
   /** RSA JWK "d" (Private Exponent) Parameter */
   d: string
@@ -160,7 +160,7 @@ export interface JWK_RSA_Private extends JWK_RSA_Public {
   qi: string
 }
 
-/** Convenience interface for oct JSON Web Keys */
+/** Convenience interface for "oct" JSON Web Keys. */
 export interface JWK_oct extends JWKParameters {
   /** Oct JWK "k" (Key Value) Parameter */
   k: string
@@ -234,11 +234,7 @@ export type JWK = {
   pub?: string
   /** AKP JWK "priv" (Private key) Parameter */
   priv?: string
-  /**
-   * RSA JWK "oth" (Other Primes Info) Parameter
-   *
-   * > Note: Multi-prime RSA keys are not supported; importing a JWK with this parameter present throws.
-   */
+  /** RSA JWK "oth" (Other Primes Info) Parameter */
   oth?: Array<{
     /** The Factor CRT Exponent */
     d?: string
@@ -249,11 +245,7 @@ export type JWK = {
   }>
 }
 
-/**
- * Discriminated union of the JSON Web Key shapes supported by this module. Unlike {@link JWK}, each
- * member requires and fixes the "kty" (Key Type) Parameter to its key type so that the union can be
- * narrowed on it.
- */
+/** Discriminated union of the supported JSON Web Key shapes. */
 // The "kty" is intersected into each arm one at a time rather than distributed over a parenthesised
 // union - `X & (A | B)` means the same thing, but typedoc renders it without the parentheses, which
 // reads as though the second arm carried no "kty" at all.
@@ -271,28 +263,18 @@ export type AnyJWK =
 /** Key or secret input accepted by all sign, verify, encrypt, and decrypt operations. */
 export type KeyInput = CryptoKey | KeyObject | JWK | Uint8Array
 
-export interface GenericGetKeyFunction<IProtectedHeader, IToken, ReturnKeyTypes> {
+/** Dynamic key resolver for consuming operations. */
+export interface GetKeyFunction<IProtectedHeader, IToken, KeyTypes extends KeyInput = KeyInput> {
   /**
    * Dynamic key resolution function. No token components have been verified at the time of this
    * function call. If a suitable key for the token cannot be matched, throw an error instead.
    *
-   * @param protectedHeader JWE or JWS Protected Header.
    * @param token The consumed JWE or JWS token.
    */
-  (protectedHeader: IProtectedHeader, token: IToken): Promise<ReturnKeyTypes> | ReturnKeyTypes
+  (protectedHeader: IProtectedHeader, token: IToken): Promise<KeyTypes> | KeyTypes
 }
 
-/** Interface for consuming operations dynamic key resolution. */
-export interface GetKeyFunction<
-  IProtectedHeader,
-  IToken,
-  KeyTypes extends KeyInput = KeyInput,
-> extends GenericGetKeyFunction<IProtectedHeader, IToken, KeyTypes> {}
-
-/**
- * Flattened JWS definition for verify function inputs, allows payload as {@link !Uint8Array} for
- * detached signature validation.
- */
+/** Flattened JWS verification input. */
 export interface FlattenedJWSInput {
   /**
    * The "header" member MUST be present and contain the value JWS Unprotected Header when the JWS
@@ -319,10 +301,7 @@ export interface FlattenedJWSInput {
   signature: string
 }
 
-/**
- * General JWS definition for verify function inputs, allows payload as {@link !Uint8Array} for
- * detached signature validation.
- */
+/** General JWS verification input. */
 export interface GeneralJWSInput {
   /**
    * The "payload" member MUST be present and contain the value BASE64URL(JWS Payload). When when
@@ -338,25 +317,19 @@ export interface GeneralJWSInput {
   signatures: Omit<FlattenedJWSInput, 'payload'>[]
 }
 
-/**
- * Flattened JWS JSON Serialization Syntax token. Payload is returned as an empty string when JWS
- * Unencoded Payload ({@link https://www.rfc-editor.org/info/rfc7797/ RFC7797}) is used.
- */
+/** Flattened JWS JSON Serialization token. */
 export interface FlattenedJWS extends Partial<FlattenedJWSInput> {
   payload: string
   signature: string
 }
 
-/**
- * General JWS JSON Serialization Syntax token. Payload is returned as an empty string when JWS
- * Unencoded Payload ({@link https://www.rfc-editor.org/info/rfc7797/ RFC7797}) is used.
- */
+/** General JWS JSON Serialization token. */
 export interface GeneralJWS {
   payload: string
   signatures: Omit<FlattenedJWSInput, 'payload'>[]
 }
 
-/** Header Parameters common to JWE and JWS */
+/** Header Parameters common to JWE and JWS. */
 export interface JoseHeaderParameters {
   /** "kid" (Key ID) Header Parameter */
   kid?: string
@@ -386,7 +359,7 @@ export interface JoseHeaderParameters {
   cty?: string
 }
 
-/** Recognized JWS Header Parameters, any other Header Members may also be present. */
+/** Recognized JWS Header Parameters; additional members may also be present. */
 export interface JWSHeaderParameters extends JoseHeaderParameters {
   /** JWS "alg" (Algorithm) Header Parameter */
   alg?: JWSAlgorithm
@@ -417,11 +390,13 @@ export interface JWEKeyManagementHeaderParameters {
    * used in ECDH's ConcatKDF.
    */
   apv?: Uint8Array
+
   /**
-   * @deprecated You should not use this parameter. It is only intended for testing and vector
-   *   validation purposes.
+   * PBES2 "p2c" (PBES2 Count). This will be used as a JOSE Header Parameter and as the PBKDF2
+   * iteration count.
    */
   p2c?: number
+
   /**
    * @deprecated You should not use this parameter. It is only intended for testing and vector
    *   validation purposes.
@@ -439,7 +414,7 @@ export interface JWEKeyManagementHeaderParameters {
   epk?: CryptoKey | KeyObject
 }
 
-/** Flattened JWE JSON Serialization Syntax token. */
+/** Flattened JWE JSON Serialization token. */
 export interface FlattenedJWE {
   /**
    * The "aad" member MUST be present and contain the value BASE64URL(JWE AAD)) when the JWE AAD
@@ -493,12 +468,12 @@ export interface FlattenedJWE {
   unprotected?: JWEHeaderParameters
 }
 
-/** General JWE JSON Serialization Syntax token. */
+/** General JWE JSON Serialization token. */
 export interface GeneralJWE extends Omit<FlattenedJWE, 'encrypted_key' | 'header'> {
   recipients: Pick<FlattenedJWE, 'encrypted_key' | 'header'>[]
 }
 
-/** Recognized JWE Header Parameters, any other Header members may also be present. */
+/** Recognized JWE Header Parameters; additional members may also be present. */
 export interface JWEHeaderParameters extends JoseHeaderParameters {
   /** JWE "alg" (Algorithm) Header Parameter */
   alg?: JWEKeyManagementAlgorithm
@@ -520,7 +495,7 @@ export interface JWEHeaderParameters extends JoseHeaderParameters {
   [propName: string]: unknown
 }
 
-/** Shared Interface with a "crit" property for all sign, verify, encrypt and decrypt operations. */
+/** Shared "crit" option for signing, verification, encryption, and decryption. */
 export interface CritOption {
   /**
    * An object with keys representing recognized "crit" (Critical) Header Parameter names. The value
@@ -557,7 +532,8 @@ export interface DecryptOptions extends CritOption {
   /**
    * (PBES2 Key Management Algorithms only) Maximum allowed "p2c" (PBES2 Count) Header Parameter
    * value. The PBKDF2 iteration count defines the algorithm's computational expense. By default
-   * this value is set to 10000.
+   * this value is set to 10000. The value must be a positive safe integer or `Infinity`. Set it to
+   * `Infinity` to disable the limit.
    */
   maxPBES2Count?: number
 
@@ -642,7 +618,7 @@ export interface VerifyOptions extends CritOption {
 /** JWS Signing options. */
 export interface SignOptions extends CritOption {}
 
-/** Recognized JWT Claims Set members, any other members may also be present. */
+/** Recognized JWT Claims Set members; additional members may also be present. */
 export interface JWTPayload {
   /** JWT Issuer */
   iss?: string
@@ -669,7 +645,7 @@ export interface JWTPayload {
   [propName: string]: unknown
 }
 
-/** Flattened JWE JSON Serialization Syntax decryption result */
+/** Flattened JWE JSON Serialization decryption result. */
 export interface FlattenedDecryptResult {
   /** JWE AAD. */
   additionalAuthenticatedData?: Uint8Array
@@ -687,10 +663,10 @@ export interface FlattenedDecryptResult {
   unprotectedHeader?: JWEHeaderParameters
 }
 
-/** General JWE JSON Serialization Syntax decryption result */
+/** General JWE JSON Serialization decryption result. */
 export interface GeneralDecryptResult extends FlattenedDecryptResult {}
 
-/** Compact JWE decryption result */
+/** Compact JWE decryption result. */
 export interface CompactDecryptResult {
   /** Plaintext. */
   plaintext: Uint8Array
@@ -699,7 +675,7 @@ export interface CompactDecryptResult {
   protectedHeader: CompactJWEHeaderParameters
 }
 
-/** Flattened JWS JSON Serialization Syntax verification result */
+/** Flattened JWS JSON Serialization verification result. */
 export interface FlattenedVerifyResult {
   /** JWS Payload. */
   payload: Uint8Array
@@ -711,10 +687,10 @@ export interface FlattenedVerifyResult {
   unprotectedHeader?: JWSHeaderParameters
 }
 
-/** General JWS JSON Serialization Syntax verification result */
+/** General JWS JSON Serialization verification result. */
 export interface GeneralVerifyResult extends FlattenedVerifyResult {}
 
-/** Compact JWS verification result */
+/** Compact JWS verification result. */
 export interface CompactVerifyResult {
   /** JWS Payload. */
   payload: Uint8Array
@@ -723,7 +699,7 @@ export interface CompactVerifyResult {
   protectedHeader: CompactJWSHeaderParameters
 }
 
-/** Signed JSON Web Token (JWT) verification result */
+/** Signed JSON Web Token (JWT) verification result. */
 export interface JWTVerifyResult<PayloadType = JWTPayload> {
   /** JWT Claims Set. */
   payload: PayloadType &
@@ -734,7 +710,7 @@ export interface JWTVerifyResult<PayloadType = JWTPayload> {
   protectedHeader: JWTHeaderParameters
 }
 
-/** Encrypted JSON Web Token (JWT) decryption result */
+/** Encrypted JSON Web Token (JWT) decryption result. */
 export interface JWTDecryptResult<PayloadType = JWTPayload> {
   /** JWT Claims Set. */
   payload: PayloadType &
@@ -745,60 +721,46 @@ export interface JWTDecryptResult<PayloadType = JWTPayload> {
   protectedHeader: CompactJWEHeaderParameters
 }
 
-/** When key resolver functions are used this becomes part of successful resolves */
+/** Key resolver result metadata. */
 export interface ResolvedKey<KeyType extends CryptoKey | Uint8Array = CryptoKey | Uint8Array> {
   /** Key resolved from the key resolver function. */
   key: KeyType
 }
 
-/** Recognized Compact JWS Header Parameters, any other Header Members may also be present. */
+/** Recognized Compact JWS Header Parameters; additional members may also be present. */
 export interface CompactJWSHeaderParameters extends JWSHeaderParameters {
   alg: JWSAlgorithm
 }
 
-/** Recognized Signed JWT Header Parameters, any other Header Members may also be present. */
+/** Recognized signed JWT Header Parameters; additional members may also be present. */
 export interface JWTHeaderParameters extends CompactJWSHeaderParameters {
   b64?: boolean
 }
 
-/** Recognized Compact JWE Header Parameters, any other Header Members may also be present. */
+/** Recognized Compact JWE Header Parameters; additional members may also be present. */
 export interface CompactJWEHeaderParameters extends JWEHeaderParameters {
   alg: JWEKeyManagementAlgorithm
   enc: JWEContentEncryptionAlgorithm
 }
 
-/** JSON Web Key Set */
+/** JSON Web Key Set. */
 export interface JSONWebKeySet {
   keys: JWK[]
 }
 
-/**
- * {@link !KeyObject} is a representation of a key/secret available in the Node.js runtime. You may
- * use the Node.js runtime APIs {@link !createPublicKey}, {@link !createPrivateKey}, and
- * {@link !createSecretKey} to obtain a {@link !KeyObject} from your existing key material.
- */
+/** Node.js {@link !KeyObject} representation accepted as key input. */
 export interface KeyObject {
   type: string
 }
 
-/**
- * {@link !CryptoKey} is a representation of a key/secret available in all supported runtimes. In
- * addition to the {@link key/import Key Import Functions} you may use the
- * {@link !SubtleCrypto.importKey} API to obtain a {@link !CryptoKey} from your existing key
- * material.
- */
+/** Web Cryptography API {@link !CryptoKey} representation accepted as key input. */
 export type CryptoKey = typeof globalThis extends {
   crypto: { subtle: { generateKey(...args: any[]): Promise<infer R> } }
 }
   ? Extract<R, { type: string }>
   : CryptoKeyStructuralFallback
 
-/**
- * Used as {@link CryptoKey} when the host runtime's `crypto` global is not exposed on `typeof
- * globalThis`, including when it is absent from ambient types or declared with `const` or `let`. It
- * remains structurally compatible with host {@link !CryptoKey} declarations so values flow freely to
- * and from {@link !SubtleCrypto} APIs.
- */
+/** Structural fallback used when a host {@link !CryptoKey} type cannot be inferred. */
 export interface CryptoKeyStructuralFallback {
   readonly algorithm: { name: string }
   readonly extractable: boolean
@@ -806,7 +768,7 @@ export interface CryptoKeyStructuralFallback {
   readonly usages: string[]
 }
 
-/** Generic interface for JWT producing classes. */
+/** Shared fluent API for JWT-producing classes. */
 export interface ProduceJWT {
   /**
    * Set the "iss" (Issuer) Claim.

package/node_modules/jose/dist/types/util/base64url.d.ts

@@ -1,5 +1,5 @@
 /**
- * Decodes a Base64URL encoded input.
+ * Decodes a base64url-encoded input.
  *
  * @param input Base64URL encoded input, as a string or its UTF-8 bytes.
  * @returns The decoded bytes.
@@ -8,7 +8,7 @@
  */
 export declare function decode(input: Uint8Array | string): Uint8Array;
 /**
- * Encodes an input using Base64URL with no padding.
+ * Encodes input using unpadded base64url.
  *
  * @param input Input to encode, as a string or as bytes. Strings are encoded as UTF-8 first.
  * @returns The Base64URL encoded, unpadded, representation of the input.

package/node_modules/jose/dist/types/util/decode_jwt.d.ts

@@ -1,10 +1,3 @@
-import type * as types from '../types.d.ts';
-/**
- * Decodes a signed JSON Web Token payload. This does not validate the JWT Claims Set types or
- * values. This does not validate the JWS Signature. For a proper Signed JWT Claims Set validation
- * and JWS signature verification use `jose.jwtVerify()`. For an encrypted JWT Claims Set validation
- * and JWE decryption use `jose.jwtDecrypt()`.
- *
- * @param jwt JWT token in compact JWS serialization.
- */
-export declare function decodeJwt<PayloadType = types.JWTPayload>(jwt: string): PayloadType & types.JWTPayload & ([PayloadType] extends [object] ? unknown : unknown extends PayloadType ? unknown : never);
+import type * as t from '../types.d.ts';
+/** Decodes the Claims Set of a JWS-formatted JSON Web Token without verifying the signature. */
+export declare function decodeJwt<PayloadType = t.JWTPayload>(jwt: string): PayloadType & t.JWTPayload & ([PayloadType] extends [object] ? unknown : unknown extends PayloadType ? unknown : never);

package/node_modules/jose/dist/types/util/decode_protected_header.d.ts

@@ -1,8 +1,8 @@
-import type * as types from '../types.d.ts';
-/** JWE and JWS Header Parameters */
-export type ProtectedHeaderParameters = types.JWSHeaderParameters & types.JWEHeaderParameters;
+import type * as t from '../types.d.ts';
+/** JWE and JWS Header Parameters. */
+export type ProtectedHeaderParameters = t.JWSHeaderParameters & t.JWEHeaderParameters;
 /**
- * Decodes the Protected Header of a JWE/JWS/JWT token utilizing any JOSE serialization.
+ * Decodes the Protected Header of a JWE, JWS, or JWT in any JOSE serialization.
  *
  * @param token JWE/JWS/JWT token in any JOSE serialization.
  */

package/node_modules/jose/dist/types/util/errors.d.ts

@@ -1,11 +1,8 @@
-import type * as types from '../types.d.ts';
-/**
- * Every stable error code used by this module. {@link AnyJOSEError} pairs each subclass with the one
- * it is thrown with, making that union a discriminated one.
- */
+import type * as t from '../types.d.ts';
+/** Stable error codes used by this module. */
 export type JOSEErrorCode = 'ERR_JOSE_ALG_NOT_ALLOWED' | 'ERR_JOSE_GENERIC' | 'ERR_JOSE_NOT_SUPPORTED' | 'ERR_JWE_DECRYPTION_FAILED' | 'ERR_JWE_INVALID' | 'ERR_JWK_INVALID' | 'ERR_JWKS_INVALID' | 'ERR_JWKS_MULTIPLE_MATCHING_KEYS' | 'ERR_JWKS_NO_MATCHING_KEY' | 'ERR_JWKS_TIMEOUT' | 'ERR_JWS_INVALID' | 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED' | 'ERR_JWT_CLAIM_VALIDATION_FAILED' | 'ERR_JWT_EXPIRED' | 'ERR_JWT_INVALID';
 /**
- * The shape shared by the two errors thrown during JWT Claims Set validation.
+ * Shared properties of JWT Claims Set validation errors.
  *
  * > Note: {@link JWTExpired} does not extend {@link JWTClaimValidationFailed}, so `instanceof
  * > JWTClaimValidationFailed` is `false` for an expired JWT. Use {@link JWTClaimValidationError} or
@@ -17,11 +14,11 @@ export interface JWTClaimValidationFailure {
     /** Reason code for the validation failure. */
     reason: JWTClaimValidationReason;
     /** The parsed JWT Claims Set (aka payload). */
-    payload: types.JWTPayload;
+    payload: t.JWTPayload;
 }
 /** Reason codes produced by JWT Claims Set validation. */
 export type JWTClaimValidationReason = 'check_failed' | 'invalid' | 'mismatch' | 'missing' | 'unspecified' | (string & {});
-/** A generic Error that all other JOSE specific Error subclasses extend. */
+/** Base class for JOSE errors. */
 export declare class JOSEError extends Error {
     /** A unique error code for the particular error subclass. */
     static code: JOSEErrorCode | (string & {});
@@ -34,10 +31,9 @@ export declare class JOSEError extends Error {
         cause?: unknown;
     });
 }
-/** An error subclass thrown when a JWT Claim Set member validation fails. */
+/** Thrown when JWT Claims Set validation fails. */
 export declare class JWTClaimValidationFailed extends JOSEError implements JWTClaimValidationFailure {
     static code: JOSEErrorCode | (string & {});
-    /** A unique error code for {@link JWTClaimValidationFailed}. */
     code: JOSEErrorCode | (string & {});
     /** The {@link JWTClaimValidationFailure} carried by every instance of this error. */
     cause: JWTClaimValidationFailure;
@@ -51,13 +47,12 @@ export declare class JWTClaimValidationFailed extends JOSEError implements JWTCl
      * has however been verified. Claims Set verification happens after the JWS Signature or JWE
      * Decryption processes.
      */
-    payload: types.JWTPayload;
-    constructor(message: string, payload: types.JWTPayload, claim?: string, reason?: JWTClaimValidationReason);
+    payload: t.JWTPayload;
+    constructor(message: string, payload: t.JWTPayload, claim?: string, reason?: JWTClaimValidationReason);
 }
-/** An error subclass thrown when a JWT is expired. */
+/** Thrown when a JWT is expired. */
 export declare class JWTExpired extends JOSEError implements JWTClaimValidationFailure {
     static code: JOSEErrorCode | (string & {});
-    /** A unique error code for {@link JWTExpired}. */
     code: JOSEErrorCode | (string & {});
     /** The {@link JWTClaimValidationFailure} carried by every instance of this error. */
     cause: JWTClaimValidationFailure;
@@ -71,73 +66,61 @@ export declare class JWTExpired extends JOSEError implements JWTClaimValidationF
      * has however been verified. Claims Set verification happens after the JWS Signature or JWE
      * Decryption processes.
      */
-    payload: types.JWTPayload;
-    constructor(message: string, payload: types.JWTPayload, claim?: string, reason?: JWTClaimValidationReason);
+    payload: t.JWTPayload;
+    constructor(message: string, payload: t.JWTPayload, claim?: string, reason?: JWTClaimValidationReason);
 }
-/** An error subclass thrown when a JOSE Algorithm is not allowed per developer preference. */
+/** Thrown when an algorithm is disallowed by configuration. */
 export declare class JOSEAlgNotAllowed extends JOSEError {
     static code: JOSEErrorCode | (string & {});
-    /** A unique error code for {@link JOSEAlgNotAllowed}. */
     code: JOSEErrorCode | (string & {});
 }
-/**
- * An error subclass thrown when a particular feature or algorithm is not supported by this
- * implementation or JOSE in general.
- */
+/** Thrown when a feature or algorithm is unsupported. */
 export declare class JOSENotSupported extends JOSEError {
     static code: JOSEErrorCode | (string & {});
-    /** A unique error code for {@link JOSENotSupported}. */
     code: JOSEErrorCode | (string & {});
 }
-/** An error subclass thrown when a JWE ciphertext decryption fails. */
+/** Thrown when JWE ciphertext decryption fails. */
 export declare class JWEDecryptionFailed extends JOSEError {
     static code: JOSEErrorCode | (string & {});
-    /** A unique error code for {@link JWEDecryptionFailed}. */
     code: JOSEErrorCode | (string & {});
     constructor(message?: string, options?: {
         cause?: unknown;
     });
 }
-/** An error subclass thrown when a JWE is invalid. */
+/** Thrown when a JWE is invalid. */
 export declare class JWEInvalid extends JOSEError {
     static code: JOSEErrorCode | (string & {});
-    /** A unique error code for {@link JWEInvalid}. */
     code: JOSEErrorCode | (string & {});
 }
-/** An error subclass thrown when a JWS is invalid. */
+/** Thrown when a JWS is invalid. */
 export declare class JWSInvalid extends JOSEError {
     static code: JOSEErrorCode | (string & {});
-    /** A unique error code for {@link JWSInvalid}. */
     code: JOSEErrorCode | (string & {});
 }
-/** An error subclass thrown when a JWT is invalid. */
+/** Thrown when a JWT is invalid. */
 export declare class JWTInvalid extends JOSEError {
     static code: JOSEErrorCode | (string & {});
-    /** A unique error code for {@link JWTInvalid}. */
     code: JOSEErrorCode | (string & {});
 }
-/** An error subclass thrown when a JWK is invalid. */
+/** Thrown when a JWK is invalid. */
 export declare class JWKInvalid extends JOSEError {
     static code: JOSEErrorCode | (string & {});
-    /** A unique error code for {@link JWKInvalid}. */
     code: JOSEErrorCode | (string & {});
 }
-/** An error subclass thrown when a JWKS is invalid. */
+/** Thrown when a JWKS is invalid. */
 export declare class JWKSInvalid extends JOSEError {
     static code: JOSEErrorCode | (string & {});
-    /** A unique error code for {@link JWKSInvalid}. */
     code: JOSEErrorCode | (string & {});
 }
-/** An error subclass thrown when no keys match from a JWKS. */
+/** Thrown when no keys match in a JWKS. */
 export declare class JWKSNoMatchingKey extends JOSEError {
     static code: JOSEErrorCode | (string & {});
-    /** A unique error code for {@link JWKSNoMatchingKey}. */
     code: JOSEErrorCode | (string & {});
     constructor(message?: string, options?: {
         cause?: unknown;
     });
 }
-/** An error subclass thrown when multiple keys match from a JWKS. */
+/** Thrown when multiple keys match in a JWKS. */
 export declare class JWKSMultipleMatchingKeys extends JOSEError {
     /**
      * Iterates the public keys that matched the JWS JOSE Header, so that verification can be
@@ -146,43 +129,33 @@ export declare class JWKSMultipleMatchingKeys extends JOSEError {
      * module always iterate the matched keys; an instance constructed by other code iterates
      * nothing.
      */
-    [Symbol.asyncIterator]: () => AsyncIterableIterator<types.CryptoKey>;
+    [Symbol.asyncIterator]: () => AsyncIterableIterator<t.CryptoKey>;
     static code: JOSEErrorCode | (string & {});
-    /** A unique error code for {@link JWKSMultipleMatchingKeys}. */
     code: JOSEErrorCode | (string & {});
     constructor(message?: string, options?: {
         cause?: unknown;
     });
 }
-/** Timeout was reached when retrieving the JWKS response. */
+/** Thrown when fetching a remote JWKS times out. */
 export declare class JWKSTimeout extends JOSEError {
     static code: JOSEErrorCode | (string & {});
-    /** A unique error code for {@link JWKSTimeout}. */
     code: JOSEErrorCode | (string & {});
     constructor(message?: string, options?: {
         cause?: unknown;
     });
 }
-/** An error subclass thrown when JWS signature verification fails. */
+/** Thrown when JWS signature verification fails. */
 export declare class JWSSignatureVerificationFailed extends JOSEError {
     static code: JOSEErrorCode | (string & {});
-    /** A unique error code for {@link JWSSignatureVerificationFailed}. */
     code: JOSEErrorCode | (string & {});
     constructor(message?: string, options?: {
         cause?: unknown;
     });
 }
-/**
- * Union of the errors thrown during JWT Claims Set validation. {@link JWTExpired} does not extend
- * {@link JWTClaimValidationFailed}, so a single `instanceof` check cannot cover both. Use this type
- * — together with the {@link JOSEError.code code} discriminant — when handling either.
- */
+/** Errors thrown during JWT Claims Set validation. */
 export type JWTClaimValidationError = JWTClaimValidationFailed | JWTExpired;
 /**
- * Union of every {@link JOSEError} subclass this module throws, each paired with the single
- * {@link JOSEErrorCode} it is thrown with. That pairing lives here rather than on the classes, so
- * that `code` stays assignable, writable, and overridable on them exactly as before, while a value
- * of this type can still be switched over as a discriminated union.
+ * Discriminated union of the specific {@link JOSEError} subclasses.
  *
  * > Note: The base {@link JOSEError} is deliberately not a member — its `code` spans every value, which
  * > would defeat the discriminant. A small number of JSON Web Key Set HTTP failures are thrown as the