unjwt 0.3.0 → 0.5.0

package/dist/shared/unjwt.B4e_rwol.mjs

@@ -0,0 +1,453 @@
+import { a as checkEncCryptoKey, u as uint32be, g as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, b as bitLengthCEK, d as jwkTokey, i as importKey, f as generateIV, h as encrypt$1, l as unwrapKey, m as decrypt$1 } from './unjwt.DKq5VF7t.mjs';
+import { e as concatUint8Arrays, t as textEncoder, f as assertCryptoKey, b as base64UrlEncode, g as isCryptoKey, a as isJWK, d as base64UrlDecode, r as randomBytes, c as textDecoder } from './unjwt.CjHZv3F3.mjs';
+import { c as checkKeyLength } from './unjwt.sux3_Z19.mjs';
+
+function lengthAndInput(input) {
+  return concatUint8Arrays(uint32be(input.length), input);
+}
+async function concatKdf(secret, bits, value) {
+  const iterations = Math.ceil((bits >> 3) / 32);
+  const res = new Uint8Array(iterations * 32);
+  for (let iter = 0; iter < iterations; iter++) {
+    const buf = new Uint8Array(4 + secret.length + value.length);
+    buf.set(uint32be(iter + 1));
+    buf.set(secret, 4);
+    buf.set(value, 4 + secret.length);
+    res.set(await digest("sha256", buf), iter * 32);
+  }
+  return res.slice(0, bits >> 3);
+}
+async function deriveECDHESKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) {
+  checkEncCryptoKey(publicKey, "ECDH");
+  checkEncCryptoKey(privateKey, "ECDH", "deriveBits");
+  const value = concatUint8Arrays(
+    lengthAndInput(textEncoder.encode(algorithm)),
+    lengthAndInput(apu),
+    lengthAndInput(apv),
+    uint32be(keyLength)
+  );
+  const length = publicKey.algorithm.name === "X25519" ? 256 : Math.ceil(
+    Number.parseInt(
+      publicKey.algorithm.namedCurve.slice(-3),
+      10
+    ) / 8
+  ) << 3;
+  const sharedSecret = new Uint8Array(
+    await crypto.subtle.deriveBits(
+      {
+        name: publicKey.algorithm.name,
+        public: publicKey
+      },
+      privateKey,
+      length
+    )
+  );
+  return concatKdf(sharedSecret, keyLength, value);
+}
+function allowed(key) {
+  switch (key.algorithm.namedCurve) {
+    case "P-256":
+    case "P-384":
+    case "P-521": {
+      return true;
+    }
+    default: {
+      return key.algorithm.name === "X25519";
+    }
+  }
+}
+async function digest(algorithm, data) {
+  const subtleDigest = `SHA-${algorithm.slice(-3)}`;
+  return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));
+}
+
+const subtleAlgorithm = (alg) => {
+  switch (alg) {
+    case "RSA-OAEP":
+    case "RSA-OAEP-256":
+    case "RSA-OAEP-384":
+    case "RSA-OAEP-512": {
+      return "RSA-OAEP";
+    }
+    default: {
+      throw new Error(
+        `alg ${alg} is not supported either by JOSE or your javascript runtime`
+      );
+    }
+  }
+};
+async function encryptRSAES(alg, key, cek) {
+  checkEncCryptoKey(key, alg, "encrypt");
+  checkKeyLength(alg, key);
+  return new Uint8Array(
+    await crypto.subtle.encrypt(subtleAlgorithm(alg), key, cek)
+  );
+}
+
+/**
+ * This is a fork of Jose library's utility functions.
+ * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/encrypt_key_management.ts
+ * @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
+ */
+async function encryptKey(alg, enc, key, providedCek, providedParameters = {}) {
+  let encryptedKey;
+  let parameters = {};
+  let cek;
+  switch (alg) {
+    case "dir": {
+      cek = key;
+      break;
+    }
+    case "ECDH-ES":
+    case "ECDH-ES+A128KW":
+    case "ECDH-ES+A192KW":
+    case "ECDH-ES+A256KW": {
+      assertCryptoKey(key);
+      if (!allowed(key)) {
+        throw new Error(
+          "ECDH with the provided key is not allowed or not supported by your javascript runtime"
+        );
+      }
+      const { apu, apv } = providedParameters;
+      const ephemeralKey = providedParameters.epk ? await normalizeKey(providedParameters.epk, alg) : (await crypto.subtle.generateKey(
+        key.algorithm,
+        true,
+        ["deriveBits"]
+      )).privateKey;
+      const { x, y, crv, kty } = await keyToJWK(ephemeralKey);
+      const sharedSecret = await deriveECDHESKey(
+        key,
+        ephemeralKey,
+        alg === "ECDH-ES" ? enc : alg,
+        alg === "ECDH-ES" ? bitLengthCEK(enc) : Number.parseInt(alg.slice(-5, -2), 10),
+        apu,
+        apv
+      );
+      parameters = { epk: { x, y, crv, kty } };
+      if (apu) parameters.apu = base64UrlEncode(apu);
+      if (apv) parameters.apv = base64UrlEncode(apv);
+      if (alg === "ECDH-ES") {
+        cek = sharedSecret;
+        break;
+      }
+      cek = providedCek || generateCEK(enc);
+      const kwAlg = alg.slice(-6);
+      encryptedKey = (await wrap(kwAlg, sharedSecret, cek)).encryptedKey;
+      break;
+    }
+    case "RSA-OAEP":
+    case "RSA-OAEP-256":
+    case "RSA-OAEP-384":
+    case "RSA-OAEP-512": {
+      cek = providedCek || generateCEK(enc);
+      assertCryptoKey(key);
+      encryptedKey = await encryptRSAES(alg, key, cek);
+      break;
+    }
+    case "PBES2-HS256+A128KW":
+    case "PBES2-HS384+A192KW":
+    case "PBES2-HS512+A256KW": {
+      cek = providedCek || generateCEK(enc);
+      const { p2c, p2s } = providedParameters;
+      ({ encryptedKey, ...parameters } = await wrap(alg, key, cek, p2c, p2s));
+      break;
+    }
+    case "A128KW":
+    case "A192KW":
+    case "A256KW": {
+      cek = providedCek || generateCEK(enc);
+      encryptedKey = (await wrap(alg, key, cek)).encryptedKey;
+      break;
+    }
+    case "A128GCMKW":
+    case "A192GCMKW":
+    case "A256GCMKW": {
+      cek = providedCek || generateCEK(enc);
+      const { iv } = providedParameters;
+      ({ encryptedKey, ...parameters } = await encryptIV(alg, key, cek, iv));
+      break;
+    }
+    default: {
+      throw new Error(
+        'Invalid or unsupported "alg" (JWE Algorithm) header value'
+      );
+    }
+  }
+  return { cek, encryptedKey, parameters };
+}
+async function normalizeKey(key, alg) {
+  if (key instanceof Uint8Array) {
+    return key;
+  }
+  if (isCryptoKey(key)) {
+    return key;
+  }
+  if (isJWK(key)) {
+    if ("k" in key && key.k) {
+      return base64UrlDecode(key.k, false);
+    }
+    return jwkTokey({ ...key, alg });
+  }
+  throw new Error("unreachable");
+}
+
+async function encrypt(payload, key, options = {}) {
+  const {
+    protectedHeader: additionalProtectedHeader,
+    cek: providedCek,
+    contentEncryptionIV: providedContentIV,
+    keyManagementIV,
+    p2s = randomBytes(16),
+    p2c = 2048,
+    ecdhPartyUInfo,
+    ecdhPartyVInfo
+  } = options;
+  let { alg, enc } = options;
+  if (!alg) {
+    if (typeof key === "string" || key instanceof Uint8Array) {
+      alg = "PBES2-HS256+A128KW";
+    } else if (isJWK(key)) {
+      alg = key.alg;
+    }
+  }
+  if (!alg) {
+    throw new TypeError(
+      'JWE "alg" (Key Management Algorithm) must be provided in options or inferable from the key'
+    );
+  }
+  if (!enc) {
+    enc = isJWK(key) && "enc" in key ? key.enc : "A128GCM";
+  }
+  const plaintextBytes = getPlaintextBytes(payload);
+  const jweKeyManagementParams = {};
+  if (keyManagementIV) jweKeyManagementParams.iv = keyManagementIV;
+  if (p2s) jweKeyManagementParams.p2s = p2s;
+  if (p2c) jweKeyManagementParams.p2c = p2c;
+  if (ecdhPartyUInfo) jweKeyManagementParams.apu = ecdhPartyUInfo;
+  if (ecdhPartyVInfo) jweKeyManagementParams.apv = ecdhPartyVInfo;
+  if (additionalProtectedHeader?.epk instanceof CryptoKey) {
+    jweKeyManagementParams.epk = additionalProtectedHeader.epk;
+  }
+  const wrappingKeyMaterial = await importKey(key, alg);
+  const {
+    cek: finalCek,
+    // This is the CEK (CryptoKey | Uint8Array) to be used for content encryption
+    encryptedKey: jweEncryptedKey,
+    // This is the JWE Encrypted Key (Uint8Array | undefined)
+    parameters: keyManagementHeaderParams
+    // JWE header params from key encryption (e.g., epk, p2s, iv, tag)
+  } = await encryptKey(
+    alg,
+    enc,
+    wrappingKeyMaterial,
+    providedCek,
+    jweKeyManagementParams
+  );
+  const baseProtectedHeader = { ...additionalProtectedHeader };
+  delete baseProtectedHeader.alg;
+  delete baseProtectedHeader.enc;
+  const jweProtectedHeader = {
+    ...baseProtectedHeader,
+    ...keyManagementHeaderParams,
+    alg,
+    enc
+  };
+  if (jweProtectedHeader.typ === void 0 && typeof payload === "object" && !(payload instanceof Uint8Array)) {
+    jweProtectedHeader.typ = "JWT";
+  }
+  if (jweProtectedHeader.typ === "JWT" && typeof payload === "object" && !(payload instanceof Uint8Array)) {
+    jweProtectedHeader.cty ||= "json";
+  }
+  const protectedHeaderSerialized = JSON.stringify(jweProtectedHeader);
+  const protectedHeaderEncoded = base64UrlEncode(protectedHeaderSerialized);
+  const aadBytes = textEncoder.encode(protectedHeaderEncoded);
+  const contentIVBytes = providedContentIV ?? generateIV(enc);
+  const {
+    ciphertext: contentCiphertext,
+    tag: contentAuthTag,
+    iv: actualContentIV
+  } = await encrypt$1(
+    enc,
+    plaintextBytes,
+    finalCek,
+    contentIVBytes,
+    aadBytes
+  );
+  if (!actualContentIV) {
+    throw new Error("Content encryption IV was not generated or returned.");
+  }
+  if (!contentAuthTag) {
+    throw new Error(
+      "Content encryption auth tag was not generated or returned."
+    );
+  }
+  const encryptedKeyEncoded = jweEncryptedKey ? base64UrlEncode(jweEncryptedKey) : "";
+  const jweParts = [
+    protectedHeaderEncoded,
+    encryptedKeyEncoded,
+    base64UrlEncode(actualContentIV),
+    base64UrlEncode(contentCiphertext),
+    base64UrlEncode(contentAuthTag)
+  ];
+  return jweParts.join(".");
+}
+async function decrypt(jwe, key, options) {
+  const parts = jwe.split(".");
+  if (parts.length !== 5) {
+    throw new Error(
+      "Invalid JWE: Must contain five sections (RFC7516, section-3)."
+    );
+  }
+  const [
+    protectedHeaderEncoded,
+    encryptedKeyEncoded,
+    ivEncoded,
+    ciphertextEncoded,
+    authTagEncoded
+  ] = parts;
+  let protectedHeader;
+  try {
+    const protectedHeaderJson = base64UrlDecode(protectedHeaderEncoded);
+    protectedHeader = JSON.parse(protectedHeaderJson);
+  } catch (error_) {
+    throw new Error(
+      `Invalid JWE: Protected header is not valid Base64URL or JSON (${error_ instanceof Error ? error_.message : error_})`
+    );
+  }
+  if (!protectedHeader || typeof protectedHeader !== "object" || !protectedHeader.alg || !protectedHeader.enc) {
+    throw new Error(
+      'Invalid JWE: Protected header must be an object with "alg" and "enc" properties.'
+    );
+  }
+  const alg = protectedHeader.alg;
+  const enc = protectedHeader.enc;
+  if (options?.algorithms && !options.algorithms.includes(alg)) {
+    throw new Error(`Key management algorithm not allowed: ${alg}`);
+  }
+  if (options?.encryptionAlgorithms && !options.encryptionAlgorithms.includes(enc)) {
+    throw new Error(`Content encryption algorithm not allowed: ${enc}`);
+  }
+  const resolvedKeyMaterial = typeof key === "function" ? await key(protectedHeader) : key;
+  const unwrappingKey = await importKey(resolvedKeyMaterial, alg);
+  const encryptedKeyBytes = base64UrlDecode(encryptedKeyEncoded, false);
+  const contentIVBytes = base64UrlDecode(ivEncoded, false);
+  const contentAuthTagBytes = base64UrlDecode(authTagEncoded, false);
+  const ciphertextBytes = base64UrlDecode(ciphertextEncoded, false);
+  const unwrapKeyOpts = {
+    iv: protectedHeader.iv,
+    tag: protectedHeader.tag,
+    p2s: protectedHeader.p2s,
+    p2c: protectedHeader.p2c,
+    epk: protectedHeader.epk,
+    apu: protectedHeader.apu,
+    apv: protectedHeader.apv,
+    unwrappedKeyAlgorithm: options?.unwrappedKeyAlgorithm,
+    keyUsage: options?.keyUsage,
+    extractable: options?.extractable,
+    returnAs: false
+    // Returning CEK as Uint8Array
+  };
+  const cekBytes = await unwrapKey(
+    alg,
+    encryptedKeyBytes,
+    unwrappingKey,
+    unwrapKeyOpts
+  );
+  const aadBytes = textEncoder.encode(protectedHeaderEncoded);
+  const plaintextBytes = await decrypt$1(
+    enc,
+    cekBytes,
+    ciphertextBytes,
+    contentIVBytes,
+    contentAuthTagBytes,
+    aadBytes
+  );
+  let payload;
+  if (options?.forceUint8Array) {
+    payload = plaintextBytes;
+  } else {
+    const decodedString = textDecoder.decode(plaintextBytes);
+    const cty = protectedHeader.cty?.toLowerCase();
+    const isJsonOutput = protectedHeader.typ === "JWT" || cty === "json" || cty === "application/json" || cty && cty.endsWith("+json");
+    if (isJsonOutput) {
+      if (decodedString.startsWith("{") && decodedString.endsWith("}") || decodedString.startsWith("[") && decodedString.endsWith("]")) {
+        try {
+          payload = JSON.parse(decodedString);
+        } catch {
+          payload = decodedString;
+        }
+      } else {
+        payload = decodedString;
+      }
+    } else {
+      payload = decodedString;
+    }
+  }
+  if (options?.critical && protectedHeader.crit) {
+    const understoodParams = /* @__PURE__ */ new Set([
+      ...options.critical || [],
+      // JWE specific standard headers:
+      "alg",
+      "enc",
+      "typ",
+      "cty",
+      "kid",
+      "jwk",
+      "jku",
+      "x5c",
+      "x5t",
+      "x5u",
+      "iv",
+      "tag",
+      "p2s",
+      "p2c",
+      "epk",
+      "apu",
+      "apv"
+    ]);
+    for (const critParam of protectedHeader.crit) {
+      if (!Object.prototype.hasOwnProperty.call(protectedHeader, critParam)) {
+        throw new Error(
+          `Critical header parameter "${critParam}" listed in "crit" but not present in the protected header.`
+        );
+      }
+      if (!understoodParams.has(critParam)) {
+        throw new Error(
+          `Critical header parameter not understood: ${critParam}`
+        );
+      }
+    }
+  } else if (!options?.critical && protectedHeader.crit) {
+    throw new Error(
+      `Unprocessed critical header parameters: ${protectedHeader.crit.join(", ")}`
+    );
+  }
+  return {
+    payload,
+    protectedHeader,
+    cek: cekBytes,
+    aad: aadBytes
+  };
+}
+function getPlaintextBytes(payload) {
+  if (payload instanceof Uint8Array) {
+    return payload;
+  }
+  if (typeof payload === "string") {
+    return textEncoder.encode(payload);
+  }
+  if (typeof payload === "object" && payload !== null) {
+    return textEncoder.encode(JSON.stringify(payload));
+  }
+  throw new TypeError(
+    "Plaintext must be a string, Uint8Array, or a JSON-serializable object."
+  );
+}
+
+const jwe = {
+  __proto__: null,
+  decrypt: decrypt,
+  encrypt: encrypt
+};
+
+export { decrypt as d, encrypt as e, jwe as j };

package/dist/shared/unjwt.B9uGngq-.d.mts

@@ -0,0 +1,154 @@
+import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, w as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, l as JWK_oct, m as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, C as CompositeKey, d as ContentEncryptionAlgorithm, A as JWKAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, z as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, n as JWK_HMAC, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, y as JWK_Symmetric_Algorithm } from './unjwt.C0bBN0AC.mjs';
+
+/**
+ * Generates a cryptographic key for the specified algorithm.
+ *
+ * @param alg The JWA algorithm identifier (e.g., "HS256", "RS256", "A128GCM").
+ * @param options Configuration options for key generation.
+ * @returns A Promise resolving to the generated key (CryptoKey, CryptoKeyPair, or Uint8Array) or its JWK representation.
+ */
+declare function generateKey<TAlg extends GenerateKeyAlgorithm, TOptions extends GenerateKeyOptions>(alg: TAlg, options?: TOptions): Promise<GenerateKeyReturn<TAlg, TOptions>>;
+/**
+ * Derives a key from a password using PBKDF2 as specified by PBES2 algorithms.
+ *
+ * @param password The password to derive the key from (string or Uint8Array).
+ * @param alg The PBES2 algorithm identifier (e.g., "PBES2-HS256+A128KW").
+ * @param options Configuration options including salt and iterations.
+ * @returns A Promise resolving to the derived key (CryptoKey) or its JWK_oct representation.
+ */
+declare function deriveKeyFromPassword<TAlg extends JWK_PBES2, TOptions extends DeriveKeyOptions>(password: string | Uint8Array, alg: TAlg, options: TOptions): Promise<DeriveKeyReturn<TOptions>>;
+/**
+ * Imports a key from various formats (CryptoKey, JWK, Uint8Array).
+ *
+ * - If `key` is a CryptoKey, it's returned directly.
+ * - If `key` is a Uint8Array, it's returned directly.
+ * - If `key` is a JWK_oct (symmetric key with 'k'), the raw key bytes are returned as Uint8Array.
+ * - If `key` is any other JWK type (asymmetric), the `alg` parameter is required, and a CryptoKey is returned.
+ *
+ * @param key The key to import.
+ * @param alg The algorithm hint, required when importing asymmetric JWKs.
+ * @returns A Promise resolving to the imported key as CryptoKey or Uint8Array.
+ */
+declare function importKey(key: string): Promise<Uint8Array>;
+declare function importKey(key: Uint8Array): Promise<Uint8Array>;
+declare function importKey(key: CryptoKey): Promise<CryptoKey>;
+declare function importKey(key: JWK_oct): Promise<Uint8Array>;
+declare function importKey(key: Exclude<JWK, JWK_oct>, alg: string): Promise<CryptoKey>;
+declare function importKey(key: CryptoKey | JWK | Uint8Array | string, alg?: string): Promise<CryptoKey | Uint8Array>;
+/**
+ * Exports a CryptoKey to a JWK (JSON Web Key) format.
+ *
+ * @param key The CryptoKey to export.
+ * @param jwk Optional partial JWK to merge with the exported key, allowing overrides.
+ * @returns A Promise resolving to the exported JWK.
+ */
+declare function exportKey(key: CryptoKey, jwk?: Partial<JWK>): Promise<JWK>;
+/**
+ * Wraps a Content Encryption Key (CEK) using the specified algorithm and wrapping key.
+ *
+ * @param alg The JWA key management algorithm (e.g., "A128KW", "RSA-OAEP", "PBES2-HS256+A128KW").
+ * @param keyToWrap The key to be wrapped (CEK), typically a symmetric key as Uint8Array or CryptoKey.
+ * @param wrappingKey The key used to wrap the CEK (CryptoKey, JWK, or password string/Uint8Array for PBES2).
+ * @param options Additional options required by certain algorithms (e.g., p2s, p2c for PBES2).
+ * @returns A Promise resolving to an object containing the wrapped key and any necessary parameters (iv, tag, epk, etc.).
+ */
+declare function wrapKey(alg: KeyManagementAlgorithm, keyToWrap: CryptoKey | Uint8Array, wrappingKey: CryptoKey | JWK | string | Uint8Array, options?: WrapKeyOptions): Promise<WrapKeyResult>;
+/**
+ * Unwraps a Content Encryption Key (CEK) using the specified algorithm and unwrapping key.
+ *
+ * @param alg The JWA key management algorithm (e.g., "A128KW", "RSA-OAEP", "PBES2-HS256+A128KW").
+ * @param wrappedKey The wrapped key (ciphertext) as Uint8Array.
+ * @param unwrappingKey The key used to unwrap the CEK (CryptoKey, JWK, or password string/Uint8Array for PBES2).
+ * @param options Additional options required by certain algorithms (e.g., iv, tag, p2s, p2c, epk).
+ * @returns A Promise resolving to the unwrapped key (CEK) as a CryptoKey or Uint8Array.
+ */
+declare function unwrapKey<T extends boolean | undefined = undefined>(alg: KeyManagementAlgorithm, wrappedKey: Uint8Array, unwrappingKey: CryptoKey | JWK | string | Uint8Array, options?: UnwrapKeyOptions & {
+    returnAs?: T;
+}): Promise<T extends false ? Uint8Array : CryptoKey>;
+
+declare const jwk_CompositeKey: typeof CompositeKey;
+declare const jwk_ContentEncryptionAlgorithm: typeof ContentEncryptionAlgorithm;
+declare const jwk_DeriveKeyOptions: typeof DeriveKeyOptions;
+declare const jwk_DeriveKeyReturn: typeof DeriveKeyReturn;
+declare const jwk_GenerateKeyAlgorithm: typeof GenerateKeyAlgorithm;
+declare const jwk_GenerateKeyOptions: typeof GenerateKeyOptions;
+declare const jwk_GenerateKeyReturn: typeof GenerateKeyReturn;
+declare const jwk_JWK: typeof JWK;
+declare const jwk_JWKAlgorithm: typeof JWKAlgorithm;
+declare const jwk_JWKParameters: typeof JWKParameters;
+declare const jwk_JWK_AES_CBC_HMAC: typeof JWK_AES_CBC_HMAC;
+declare const jwk_JWK_AES_GCM: typeof JWK_AES_GCM;
+declare const jwk_JWK_AES_GCM_KW: typeof JWK_AES_GCM_KW;
+declare const jwk_JWK_AES_KW: typeof JWK_AES_KW;
+declare const jwk_JWK_Asymmetric_Algorithm: typeof JWK_Asymmetric_Algorithm;
+declare const jwk_JWK_EC: typeof JWK_EC;
+declare const jwk_JWK_ECDH_ES: typeof JWK_ECDH_ES;
+declare const jwk_JWK_ECDSA: typeof JWK_ECDSA;
+declare const jwk_JWK_EC_Private: typeof JWK_EC_Private;
+declare const jwk_JWK_EC_Public: typeof JWK_EC_Public;
+declare const jwk_JWK_HMAC: typeof JWK_HMAC;
+declare const jwk_JWK_PBES2: typeof JWK_PBES2;
+declare const jwk_JWK_RSA: typeof JWK_RSA;
+declare const jwk_JWK_RSA_ENC: typeof JWK_RSA_ENC;
+declare const jwk_JWK_RSA_PSS: typeof JWK_RSA_PSS;
+declare const jwk_JWK_RSA_Private: typeof JWK_RSA_Private;
+declare const jwk_JWK_RSA_Public: typeof JWK_RSA_Public;
+declare const jwk_JWK_RSA_SIGN: typeof JWK_RSA_SIGN;
+declare const jwk_JWK_Symmetric_Algorithm: typeof JWK_Symmetric_Algorithm;
+declare const jwk_JWK_oct: typeof JWK_oct;
+declare const jwk_KeyManagementAlgorithm: typeof KeyManagementAlgorithm;
+declare const jwk_UnwrapKeyOptions: typeof UnwrapKeyOptions;
+declare const jwk_WrapKeyOptions: typeof WrapKeyOptions;
+declare const jwk_WrapKeyResult: typeof WrapKeyResult;
+declare const jwk_deriveKeyFromPassword: typeof deriveKeyFromPassword;
+declare const jwk_exportKey: typeof exportKey;
+declare const jwk_generateKey: typeof generateKey;
+declare const jwk_importKey: typeof importKey;
+declare const jwk_unwrapKey: typeof unwrapKey;
+declare const jwk_wrapKey: typeof wrapKey;
+declare namespace jwk {
+  export {
+    jwk_CompositeKey as CompositeKey,
+    jwk_ContentEncryptionAlgorithm as ContentEncryptionAlgorithm,
+    jwk_DeriveKeyOptions as DeriveKeyOptions,
+    jwk_DeriveKeyReturn as DeriveKeyReturn,
+    jwk_GenerateKeyAlgorithm as GenerateKeyAlgorithm,
+    jwk_GenerateKeyOptions as GenerateKeyOptions,
+    jwk_GenerateKeyReturn as GenerateKeyReturn,
+    jwk_JWK as JWK,
+    jwk_JWKAlgorithm as JWKAlgorithm,
+    jwk_JWKParameters as JWKParameters,
+    jwk_JWK_AES_CBC_HMAC as JWK_AES_CBC_HMAC,
+    jwk_JWK_AES_GCM as JWK_AES_GCM,
+    jwk_JWK_AES_GCM_KW as JWK_AES_GCM_KW,
+    jwk_JWK_AES_KW as JWK_AES_KW,
+    jwk_JWK_Asymmetric_Algorithm as JWK_Asymmetric_Algorithm,
+    jwk_JWK_EC as JWK_EC,
+    jwk_JWK_ECDH_ES as JWK_ECDH_ES,
+    jwk_JWK_ECDSA as JWK_ECDSA,
+    jwk_JWK_EC_Private as JWK_EC_Private,
+    jwk_JWK_EC_Public as JWK_EC_Public,
+    jwk_JWK_HMAC as JWK_HMAC,
+    jwk_JWK_PBES2 as JWK_PBES2,
+    jwk_JWK_RSA as JWK_RSA,
+    jwk_JWK_RSA_ENC as JWK_RSA_ENC,
+    jwk_JWK_RSA_PSS as JWK_RSA_PSS,
+    jwk_JWK_RSA_Private as JWK_RSA_Private,
+    jwk_JWK_RSA_Public as JWK_RSA_Public,
+    jwk_JWK_RSA_SIGN as JWK_RSA_SIGN,
+    jwk_JWK_Symmetric_Algorithm as JWK_Symmetric_Algorithm,
+    jwk_JWK_oct as JWK_oct,
+    jwk_KeyManagementAlgorithm as KeyManagementAlgorithm,
+    jwk_UnwrapKeyOptions as UnwrapKeyOptions,
+    jwk_WrapKeyOptions as WrapKeyOptions,
+    jwk_WrapKeyResult as WrapKeyResult,
+    jwk_deriveKeyFromPassword as deriveKeyFromPassword,
+    jwk_exportKey as exportKey,
+    jwk_generateKey as generateKey,
+    jwk_importKey as importKey,
+    jwk_unwrapKey as unwrapKey,
+    jwk_wrapKey as wrapKey,
+  };
+}
+
+export { deriveKeyFromPassword as d, exportKey as e, generateKey as g, importKey as i, jwk as j, unwrapKey as u, wrapKey as w };