unjwt 0.5.20 → 0.5.22

package/dist/shared/unjwt.VUfJDcCJ.d.mts

@@ -0,0 +1,161 @@
+import { X as JWTClaims, v as JWK, K as KeyManagementAlgorithm, f as ContentEncryptionAlgorithm, r as JWK_Symmetric, u as JWK_Private, C as CompositeKey, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, w as JWKSet, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, t as JWK_Public, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, Z as JWTClaimValidationOptions, V as JoseHeaderParameters, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './unjwt.CtHrClHc.mjs';
+import { b as JWEEncryptOptions, c as JWEKeyLookupFunction, d as JWEDecryptOptions, e as JWEDecryptResult, J as JWEHeaderParameters, a as JWEKeyManagementHeaderParameters } from './unjwt.9mL1vSFP.mjs';
+
+/**
+ * Encrypts a payload to produce a JWE Compact Serialization string.
+ *
+ * @param payload The payload to encrypt. Can be a string, Uint8Array, or a JSON-serializable object.
+ * @param key The key encryption key (KEK). Can be a CryptoKey, JWK, or for PBES2, a password string/Uint8Array.
+ * @param options JWE encryption options, including `alg` (key management algorithm) and `enc` (content encryption algorithm).
+ * @returns A Promise resolving to the JWE Compact Serialization string.
+ */
+declare function encrypt(payload: JWTClaims, key: JWK | string | Uint8Array<ArrayBuffer>, options?: JWEEncryptOptions): Promise<string>;
+declare function encrypt(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: JWK | string | Uint8Array<ArrayBuffer>, options?: JWEEncryptOptions): Promise<string>;
+declare function encrypt(payload: JWTClaims, key: CryptoKey, options: JWEEncryptOptions & {
+    alg: KeyManagementAlgorithm;
+    enc: ContentEncryptionAlgorithm;
+}): Promise<string>;
+declare function encrypt(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: CryptoKey, options: JWEEncryptOptions & {
+    alg: KeyManagementAlgorithm;
+    enc: ContentEncryptionAlgorithm;
+}): Promise<string>;
+declare function encrypt(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: CryptoKey | JWK | string | Uint8Array<ArrayBuffer>, options: JWEEncryptOptions & {
+    alg: KeyManagementAlgorithm;
+    enc: ContentEncryptionAlgorithm;
+}): Promise<string>;
+/**
+ * Decrypts a JWE Compact Serialization string.
+ *
+ * @param jwe The JWE Compact Serialization string.
+ * @param key The key decryption key (KEK) or a function to look up the key.
+ * @param options JWE decryption options.
+ * @returns A Promise resolving to an object containing the decrypted plaintext, protected header, CEK, and AAD.
+ * @throws If JWE is invalid, decryption fails, or options are not met.
+ */
+declare function decrypt<T extends JWTClaims | Uint8Array<ArrayBuffer> | string>(jwe: string, key: CryptoKey | JWK_Symmetric | JWK_Private | string | Uint8Array<ArrayBuffer> | JWEKeyLookupFunction, options?: JWEDecryptOptions): Promise<JWEDecryptResult<T>>;
+declare function decrypt(jwe: string, key: CryptoKey | JWK_Symmetric | JWK_Private | string | Uint8Array<ArrayBuffer> | JWEKeyLookupFunction, options: JWEDecryptOptions & {
+    forceUint8Array: true;
+}): Promise<JWEDecryptResult<Uint8Array<ArrayBuffer>>>;
+
+declare const jwe_CompositeKey: typeof CompositeKey;
+declare const jwe_ContentEncryptionAlgorithm: typeof ContentEncryptionAlgorithm;
+declare const jwe_DeriveKeyOptions: typeof DeriveKeyOptions;
+declare const jwe_DeriveKeyReturn: typeof DeriveKeyReturn;
+declare const jwe_GenerateJWKOptions: typeof GenerateJWKOptions;
+declare const jwe_GenerateJWKReturn: typeof GenerateJWKReturn;
+declare const jwe_GenerateKeyAlgorithm: typeof GenerateKeyAlgorithm;
+declare const jwe_GenerateKeyOptions: typeof GenerateKeyOptions;
+declare const jwe_GenerateKeyReturn: typeof GenerateKeyReturn;
+declare const jwe_JWEDecryptOptions: typeof JWEDecryptOptions;
+declare const jwe_JWEDecryptResult: typeof JWEDecryptResult;
+declare const jwe_JWEEncryptOptions: typeof JWEEncryptOptions;
+declare const jwe_JWEHeaderParameters: typeof JWEHeaderParameters;
+declare const jwe_JWEKeyLookupFunction: typeof JWEKeyLookupFunction;
+declare const jwe_JWEKeyManagementHeaderParameters: typeof JWEKeyManagementHeaderParameters;
+declare const jwe_JWK: typeof JWK;
+declare const jwe_JWKAlgorithm: typeof JWKAlgorithm;
+declare const jwe_JWKPEMAlgorithm: typeof JWKPEMAlgorithm;
+declare const jwe_JWKParameters: typeof JWKParameters;
+declare const jwe_JWKSet: typeof JWKSet;
+declare const jwe_JWK_AES_CBC_HMAC: typeof JWK_AES_CBC_HMAC;
+declare const jwe_JWK_AES_GCM: typeof JWK_AES_GCM;
+declare const jwe_JWK_AES_GCM_KW: typeof JWK_AES_GCM_KW;
+declare const jwe_JWK_AES_KW: typeof JWK_AES_KW;
+declare const jwe_JWK_Asymmetric: typeof JWK_Asymmetric;
+declare const jwe_JWK_Asymmetric_Algorithm: typeof JWK_Asymmetric_Algorithm;
+declare const jwe_JWK_EC: typeof JWK_EC;
+declare const jwe_JWK_ECDH_ES: typeof JWK_ECDH_ES;
+declare const jwe_JWK_ECDSA: typeof JWK_ECDSA;
+declare const jwe_JWK_EC_Private: typeof JWK_EC_Private;
+declare const jwe_JWK_EC_Public: typeof JWK_EC_Public;
+declare const jwe_JWK_HMAC: typeof JWK_HMAC;
+declare const jwe_JWK_OKP: typeof JWK_OKP;
+declare const jwe_JWK_OKP_Private: typeof JWK_OKP_Private;
+declare const jwe_JWK_OKP_Public: typeof JWK_OKP_Public;
+declare const jwe_JWK_OKP_SIGN: typeof JWK_OKP_SIGN;
+declare const jwe_JWK_PBES2: typeof JWK_PBES2;
+declare const jwe_JWK_Private: typeof JWK_Private;
+declare const jwe_JWK_Public: typeof JWK_Public;
+declare const jwe_JWK_RSA: typeof JWK_RSA;
+declare const jwe_JWK_RSA_ENC: typeof JWK_RSA_ENC;
+declare const jwe_JWK_RSA_PSS: typeof JWK_RSA_PSS;
+declare const jwe_JWK_RSA_Private: typeof JWK_RSA_Private;
+declare const jwe_JWK_RSA_Public: typeof JWK_RSA_Public;
+declare const jwe_JWK_RSA_SIGN: typeof JWK_RSA_SIGN;
+declare const jwe_JWK_Symmetric: typeof JWK_Symmetric;
+declare const jwe_JWK_Symmetric_Algorithm: typeof JWK_Symmetric_Algorithm;
+declare const jwe_JWK_oct: typeof JWK_oct;
+declare const jwe_JWT: typeof JWT;
+declare const jwe_JWTClaimValidationOptions: typeof JWTClaimValidationOptions;
+declare const jwe_JWTClaims: typeof JWTClaims;
+declare const jwe_JoseHeaderParameters: typeof JoseHeaderParameters;
+declare const jwe_KeyManagementAlgorithm: typeof KeyManagementAlgorithm;
+declare const jwe_UnwrapKeyOptions: typeof UnwrapKeyOptions;
+declare const jwe_WrapKeyOptions: typeof WrapKeyOptions;
+declare const jwe_WrapKeyResult: typeof WrapKeyResult;
+declare const jwe_decrypt: typeof decrypt;
+declare const jwe_encrypt: typeof encrypt;
+declare namespace jwe {
+  export {
+    jwe_CompositeKey as CompositeKey,
+    jwe_ContentEncryptionAlgorithm as ContentEncryptionAlgorithm,
+    jwe_DeriveKeyOptions as DeriveKeyOptions,
+    jwe_DeriveKeyReturn as DeriveKeyReturn,
+    jwe_GenerateJWKOptions as GenerateJWKOptions,
+    jwe_GenerateJWKReturn as GenerateJWKReturn,
+    jwe_GenerateKeyAlgorithm as GenerateKeyAlgorithm,
+    jwe_GenerateKeyOptions as GenerateKeyOptions,
+    jwe_GenerateKeyReturn as GenerateKeyReturn,
+    jwe_JWEDecryptOptions as JWEDecryptOptions,
+    jwe_JWEDecryptResult as JWEDecryptResult,
+    jwe_JWEEncryptOptions as JWEEncryptOptions,
+    jwe_JWEHeaderParameters as JWEHeaderParameters,
+    jwe_JWEKeyLookupFunction as JWEKeyLookupFunction,
+    jwe_JWEKeyManagementHeaderParameters as JWEKeyManagementHeaderParameters,
+    jwe_JWK as JWK,
+    jwe_JWKAlgorithm as JWKAlgorithm,
+    jwe_JWKPEMAlgorithm as JWKPEMAlgorithm,
+    jwe_JWKParameters as JWKParameters,
+    jwe_JWKSet as JWKSet,
+    jwe_JWK_AES_CBC_HMAC as JWK_AES_CBC_HMAC,
+    jwe_JWK_AES_GCM as JWK_AES_GCM,
+    jwe_JWK_AES_GCM_KW as JWK_AES_GCM_KW,
+    jwe_JWK_AES_KW as JWK_AES_KW,
+    jwe_JWK_Asymmetric as JWK_Asymmetric,
+    jwe_JWK_Asymmetric_Algorithm as JWK_Asymmetric_Algorithm,
+    jwe_JWK_EC as JWK_EC,
+    jwe_JWK_ECDH_ES as JWK_ECDH_ES,
+    jwe_JWK_ECDSA as JWK_ECDSA,
+    jwe_JWK_EC_Private as JWK_EC_Private,
+    jwe_JWK_EC_Public as JWK_EC_Public,
+    jwe_JWK_HMAC as JWK_HMAC,
+    jwe_JWK_OKP as JWK_OKP,
+    jwe_JWK_OKP_Private as JWK_OKP_Private,
+    jwe_JWK_OKP_Public as JWK_OKP_Public,
+    jwe_JWK_OKP_SIGN as JWK_OKP_SIGN,
+    jwe_JWK_PBES2 as JWK_PBES2,
+    jwe_JWK_Private as JWK_Private,
+    jwe_JWK_Public as JWK_Public,
+    jwe_JWK_RSA as JWK_RSA,
+    jwe_JWK_RSA_ENC as JWK_RSA_ENC,
+    jwe_JWK_RSA_PSS as JWK_RSA_PSS,
+    jwe_JWK_RSA_Private as JWK_RSA_Private,
+    jwe_JWK_RSA_Public as JWK_RSA_Public,
+    jwe_JWK_RSA_SIGN as JWK_RSA_SIGN,
+    jwe_JWK_Symmetric as JWK_Symmetric,
+    jwe_JWK_Symmetric_Algorithm as JWK_Symmetric_Algorithm,
+    jwe_JWK_oct as JWK_oct,
+    jwe_JWT as JWT,
+    jwe_JWTClaimValidationOptions as JWTClaimValidationOptions,
+    jwe_JWTClaims as JWTClaims,
+    jwe_JoseHeaderParameters as JoseHeaderParameters,
+    jwe_KeyManagementAlgorithm as KeyManagementAlgorithm,
+    jwe_UnwrapKeyOptions as UnwrapKeyOptions,
+    jwe_WrapKeyOptions as WrapKeyOptions,
+    jwe_WrapKeyResult as WrapKeyResult,
+    jwe_decrypt as decrypt,
+    jwe_encrypt as encrypt,
+  };
+}
+
+export { decrypt as d, encrypt as e, jwe as j };

package/dist/shared/{unjwt.D7ya3PwS.mjs → unjwt.Vg02PZWw.mjs}

@@ -1,4 +1,4 @@
-import { k as isCryptoKey, p as concatUint8Arrays, d as base64UrlEncode, q as base64Decode, u as base64Encode, t as textEncoder, s as sanitizeObject, w as assertCryptoKey, a as isJWK, e as base64UrlDecode, x as isAsymmetricJWK, r as randomBytes, m as isJWKSet } from './unjwt.K_6rgVTy.mjs';
+import { k as isCryptoKey, w as concatUint8Arrays, d as base64UrlEncode, x as base64Decode, y as base64Encode, t as textEncoder, s as sanitizeObject, z as assertCryptoKey, a as isJWK, e as base64UrlDecode, u as isAsymmetricJWK, r as randomBytes, m as isJWKSet } from './unjwt.DCiTNyCM.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -1459,7 +1459,6 @@ async function generateKey(alg, options = {}) {
     if (key instanceof CryptoKey) {
       return exportKey(key, {
         ...additionalKeyParams,
-        key_ops: keyUsages,
         alg
       });
     } else {
@@ -1467,7 +1466,6 @@ async function generateKey(alg, options = {}) {
         exportKey(key.publicKey, { ...additionalKeyParams, alg }),
         exportKey(key.privateKey, {
           ...additionalKeyParams,
-          key_ops: keyUsages,
           alg
         })
       ]);
@@ -1551,18 +1549,17 @@ async function importKey(key, alg) {
     return key;
   }
   if (isJWK(key)) {
-    const safeJwk = sanitizeObject(key);
-    if ("k" in safeJwk && typeof safeJwk.k === "string") {
-      return base64UrlDecode(safeJwk.k, false);
+    if ("k" in key && typeof key.k === "string") {
+      return base64UrlDecode(key.k, false);
     } else {
-      if (!safeJwk.alg && !alg) {
+      if (!key.alg && !alg) {
         throw new TypeError(
           "Algorithm must be provided when importing non-oct JWK"
         );
       }
       return jwkTokey({
-        ...safeJwk,
-        alg: safeJwk.alg || alg
+        ...key,
+        alg: key.alg || alg
       });
     }
   }
@@ -2017,18 +2014,10 @@ function getGenerateKeyParams(alg, options) {
       break;
     }
     // ECDSA Signatures
-    case "ES256": {
-      algorithm = { name: "ECDSA", namedCurve: "P-256" };
-      keyUsages = defaultKeyUsage ?? ["sign", "verify"];
-      break;
-    }
-    case "ES384": {
-      algorithm = { name: "ECDSA", namedCurve: "P-384" };
-      keyUsages = defaultKeyUsage ?? ["sign", "verify"];
-      break;
-    }
+    case "ES256":
+    case "ES384":
     case "ES512": {
-      algorithm = { name: "ECDSA", namedCurve: "P-521" };
+      algorithm = { name: "ECDSA", namedCurve: `P-${alg.slice(2)}` };
       keyUsages = defaultKeyUsage ?? ["sign", "verify"];
       break;
     }
@@ -2122,4 +2111,4 @@ const jwk = {
   wrapKey: wrapKey
 };
 
-export { encrypt as a, getJWKFromSet as b, generateKey as c, decrypt as d, encryptKey as e, generateJWK as f, generateIV as g, deriveKeyFromPassword as h, importKey as i, jwk as j, deriveJWKFromPassword as k, exportKey as l, importJWKFromPEM as m, exportJWKToPEM as n, sign as s, unwrapKey as u, verify as v, wrapKey as w };
+export { encrypt as a, getJWKFromSet as b, generateJWK as c, decrypt as d, encryptKey as e, importJWKFromPEM as f, generateIV as g, exportJWKToPEM as h, importKey as i, jwk as j, deriveJWKFromPassword as k, generateKey as l, deriveKeyFromPassword as m, exportKey as n, sign as s, unwrapKey as u, verify as v, wrapKey as w };

package/dist/utils.d.mts

@@ -1,2 +1,2 @@
-import './shared/unjwt.Dy68jE0N.mjs';
-export { s as applyTypCtyDefaults, j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, z as computeExpiresInSeconds, B as computeJwtTimeClaims, A as computeMaxTokenAgeSeconds, f as concatUint8Arrays, v as decodeMaybeJWTString, x as decodePayloadFromB64UrlSegment, w as decodePayloadFromBytes, y as getPlaintextBytes, o as isAsymmetricJWK, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, u as isJWTContent, p as isPrivateJWK, q as isPublicJWK, n as isSymmetricJWK, m as maybeArray, r as randomBytes, F as sanitizeObject, a as textDecoder, t as textEncoder, E as validateCriticalHeadersJWE, D as validateCriticalHeadersJWS, C as validateJwtClaims } from './shared/unjwt.BuQdWrN5.mjs';
+import './shared/unjwt.CtHrClHc.mjs';
+export { s as applyTypCtyDefaults, j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, z as computeExpiresInSeconds, B as computeJwtTimeClaims, A as computeMaxTokenAgeSeconds, f as concatUint8Arrays, v as decodeMaybeJWTString, x as decodePayloadFromB64UrlSegment, w as decodePayloadFromBytes, y as getPlaintextBytes, o as isAsymmetricJWK, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, u as isJWTContent, p as isPrivateJWK, q as isPublicJWK, n as isSymmetricJWK, m as maybeArray, r as randomBytes, F as sanitizeObject, a as textDecoder, t as textEncoder, E as validateCriticalHeadersJWE, D as validateCriticalHeadersJWS, C as validateJwtClaims } from './shared/unjwt.BrNGm4On.mjs';

package/dist/utils.mjs

@@ -1 +1 @@
-export { b as applyTypCtyDefaults, w as assertCryptoKey, q as base64Decode, u as base64Encode, e as base64UrlDecode, d as base64UrlEncode, E as computeExpiresInSeconds, c as computeJwtTimeClaims, F as computeMaxTokenAgeSeconds, p as concatUint8Arrays, D as decodeMaybeJWTString, n as decodePayloadFromB64UrlSegment, f as decodePayloadFromBytes, g as getPlaintextBytes, x as isAsymmetricJWK, k as isCryptoKey, j as isCryptoKeyPair, a as isJWK, m as isJWKSet, C as isJWTContent, A as isPrivateJWK, B as isPublicJWK, z as isSymmetricJWK, y as maybeArray, r as randomBytes, s as sanitizeObject, l as textDecoder, t as textEncoder, v as validateCriticalHeadersJWE, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './shared/unjwt.K_6rgVTy.mjs';
+export { b as applyTypCtyDefaults, z as assertCryptoKey, x as base64Decode, y as base64Encode, e as base64UrlDecode, d as base64UrlEncode, E as computeExpiresInSeconds, c as computeJwtTimeClaims, F as computeMaxTokenAgeSeconds, w as concatUint8Arrays, D as decodeMaybeJWTString, n as decodePayloadFromB64UrlSegment, f as decodePayloadFromBytes, g as getPlaintextBytes, u as isAsymmetricJWK, k as isCryptoKey, j as isCryptoKeyPair, a as isJWK, m as isJWKSet, C as isJWTContent, q as isPrivateJWK, B as isPublicJWK, p as isSymmetricJWK, A as maybeArray, r as randomBytes, s as sanitizeObject, l as textDecoder, t as textEncoder, v as validateCriticalHeadersJWE, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './shared/unjwt.DCiTNyCM.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.20",
+  "version": "0.5.22",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",
@@ -30,6 +30,10 @@
     "./utils": {
       "types": "./dist/utils.d.mts",
       "default": "./dist/utils.mjs"
+    },
+    "./h3": {
+      "types": "./dist/h3.d.mts",
+      "default": "./dist/h3.mjs"
     }
   },
   "main": "./dist/index.mjs",
@@ -52,6 +56,7 @@
   },
   "devDependencies": {
     "@types/node": "^22",
+    "@types/supertest": "^6.0.3",
     "@vitest/coverage-v8": "^3.2.4",
     "automd": "^0.4.2",
     "changelogen": "^0.6.2",
@@ -59,9 +64,22 @@
     "eslint-config-unjs": "^0.5.0",
     "jose": "^6.1.0",
     "prettier": "^3.6.2",
+    "supertest": "^7.1.4",
     "typescript": "^5.9.2",
     "unbuild": "^3.6.1",
     "vitest": "^3.2.4"
   },
+  "peerDependencies": {
+    "cookie-es": "^1.2.2 || ^2.0.0",
+    "h3": "^1.15.4 || ^2.0.0-rc.0 || ^2.0.0"
+  },
+  "peerDependenciesMeta": {
+    "cookie-es": {
+      "optional": true
+    },
+    "h3": {
+      "optional": true
+    }
+  },
   "packageManager": "pnpm@10.17.1"
 }

package/dist/shared/unjwt.BFtNZVqt.d.mts

@@ -1,252 +0,0 @@
-import { K as KeyManagementAlgorithm, f as ContentEncryptionAlgorithm, E as ExpiresIn, S as JoseHeaderParameters, h as JWK_EC_Public, i as JWK_EC_Private, t as JWK, X as JWTClaimValidationOptions, T as JWTClaims, C as CompositeKey, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, Q as JWKAlgorithm, R as JWKPEMAlgorithm, J as JWKParameters, u as JWKSet, F as JWK_AES_CBC_HMAC, H as JWK_AES_GCM, B as JWK_AES_GCM_KW, A as JWK_AES_KW, P as JWK_Asymmetric_Algorithm, j as JWK_EC, L as JWK_ECDH_ES, y as JWK_ECDSA, v as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, N as JWK_OKP_SIGN, I as JWK_PBES2, s as JWK_Private, r as JWK_Public, m as JWK_RSA, z as JWK_RSA_ENC, x as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, w as JWK_RSA_SIGN, O as JWK_Symmetric_Algorithm, q as JWK_oct, V as JWT, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './unjwt.Dy68jE0N.mjs';
-
-/** Recognized JWE Header Parameters, any other Header Members may also be present. */
-interface JWEHeaderParameters extends JoseHeaderParameters {
-    /**
-     * `alg` (Algorithm): Header Parameter - Key Management Algorithm
-     */
-    alg?: string;
-    /**
-     * `enc` (Encryption Algorithm): Header Parameter - Content Encryption Algorithm
-     */
-    enc?: string;
-    /**
-     * `p2c` (PBES2 Count): Header Parameter
-     */
-    p2c?: number;
-    /**
-     * `p2s` (PBES2 Salt): Header Parameter. Base64URL encoded.
-     */
-    p2s?: string;
-    /**
-     * "iv" (Initialization Vector) Header Parameter for AES GCM Key Wrapping. Base64URL encoded.
-     */
-    iv?: string;
-    /**
-     * "tag" (Authentication Tag) Header Parameter for AES GCM Key Wrapping. Base64URL encoded.
-     */
-    tag?: string;
-    /**
-     * "epk" (Ephemeral Public Key) Header Parameter for ECDH-ES.
-     */
-    epk?: JWK_EC_Public;
-    /**
-     * "apu" (Agreement PartyUInfo) Header Parameter for ECDH-ES. Base64URL encoded.
-     */
-    apu?: string;
-    /**
-     * "apv" (Agreement PartyVInfo) Header Parameter for ECDH-ES. Base64URL encoded.
-     */
-    apv?: string;
-    /** Any other JWE Header member. */
-    [propName: string]: unknown;
-}
-/** Recognized JWE Key Management-related Header Parameters. */
-interface JWEKeyManagementHeaderParameters {
-    apu?: Uint8Array<ArrayBuffer>;
-    apv?: Uint8Array<ArrayBuffer>;
-    /**
-     * For Internal use only
-     */
-    p2c?: number;
-    /**
-     * For Internal use only
-     */
-    p2s?: Uint8Array<ArrayBuffer>;
-    /**
-     * For Internal use only
-     */
-    iv?: Uint8Array<ArrayBuffer>;
-    /**
-     * For Internal use only
-     */
-    epk?: CryptoKey | JWK_EC_Public;
-    /**
-     * For Internal use only
-     */
-    epkPrivateKey?: CryptoKey | JWK_EC_Private;
-}
-/**
- * JWE (JSON Web Encryption) encryption options
- */
-interface JWEEncryptOptions {
-    /** JWE "alg" (Algorithm) Header Parameter. Key Management Algorithm. */
-    alg?: KeyManagementAlgorithm;
-    /** JWE "enc" (Encryption Algorithm) Header Parameter. Content Encryption Algorithm. */
-    enc?: ContentEncryptionAlgorithm;
-    /** Date to use when computing NumericDate claims, defaults to `new Date()`. */
-    currentDate?: Date;
-    /** Time at which the JWT should expire, if no `exp` was already provided (only when typ is "JWT" or explicitly parsing JWT). */
-    expiresIn?: ExpiresIn;
-    /** Additional JWE Protected Header parameters. */
-    protectedHeader?: Omit<JWEHeaderParameters, "alg" | "enc" | "iv" | "tag" | "p2s" | "p2c" | "epk" | "apu" | "apv">;
-    /** Initialization Vector for AES-GCMKW key wrapping. Generated if not provided. */
-    keyManagementIV?: Uint8Array<ArrayBuffer>;
-    /** PBES2 Salt value (p2s). Required for PBES2 algorithms. */
-    p2s?: Uint8Array<ArrayBuffer>;
-    /** PBES2 Iteration count (p2c). Required for PBES2 algorithms. */
-    p2c?: number;
-    /** ECDH-ES specific options. */
-    ecdh?: {
-        /**
-         * ECDH-ES Ephemeral key material. Provide a private key (CryptoKey or JWK),
-         * a CryptoKeyPair, or an object exposing both public and private parts.
-         */
-        ephemeralKey?: CryptoKey | JWK_EC_Private | CryptoKeyPair | {
-            publicKey: CryptoKey | JWK_EC_Public;
-            privateKey: CryptoKey | JWK_EC_Private;
-        };
-        /** ECDH-ES Agreement PartyUInfo. */
-        partyUInfo?: Uint8Array<ArrayBuffer>;
-        /** ECDH-ES Agreement PartyVInfo. */
-        partyVInfo?: Uint8Array<ArrayBuffer>;
-    };
-    /**
-     * Content Encryption Key (CEK) to use.
-     * If provided, it will be used directly. Otherwise, a CEK will be generated.
-     */
-    cek?: Uint8Array<ArrayBuffer>;
-    /**
-     * Initialization Vector for content encryption.
-     * If provided, it will be used. Otherwise, one will be generated.
-     */
-    contentEncryptionIV?: Uint8Array<ArrayBuffer>;
-}
-/**
- * Key lookup function for JWE decryption.
- * @param header The JWE Protected Header.
- * @returns The key material (CryptoKey, JWK, password string, or raw Uint8Array) or a Promise resolving to it.
- */
-type JWEKeyLookupFunction = (header: JWEHeaderParameters, token: string) => CryptoKey | JWK | string | Uint8Array<ArrayBuffer> | Promise<CryptoKey | JWK | string | Uint8Array<ArrayBuffer>>;
-/**
- * JWE (JSON Web Encryption) decryption options
- */
-interface JWEDecryptOptions extends JWTClaimValidationOptions {
-    /** A list of allowed JWE "alg" (Algorithm) Header Parameter values for key management. */
-    algorithms?: KeyManagementAlgorithm[];
-    /** A list of allowed JWE "enc" (Encryption Algorithm) Header Parameter values for content encryption. */
-    encryptionAlgorithms?: ContentEncryptionAlgorithm[];
-    /** Algorithm to import the unwrapped CEK as (e.g., { name: 'AES-GCM' }). Defaults based on 'enc'. */
-    unwrappedKeyAlgorithm?: Parameters<typeof crypto.subtle.importKey>[2];
-    /** Key usages for the unwrapped CEK. Defaults based on 'enc' (typically ['encrypt', 'decrypt']). */
-    keyUsage?: KeyUsage[];
-    /** Mark the unwrapped CEK as extractable. Defaults to true. */
-    extractable?: boolean;
-    /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred based on JWE headers. */
-    forceUint8Array?: boolean;
-    /** Unless false, will parse payload as JWT and validate claims if applicable (typ "JWT"). */
-    validateJWT?: boolean;
-}
-/**
- * Result of a JWE decryption operation.
- */
-interface JWEDecryptResult<T extends JWTClaims | Uint8Array<ArrayBuffer> | string = JWTClaims | Uint8Array<ArrayBuffer> | string> {
-    /** The decrypted payload. */
-    payload: T;
-    /** The JWE Protected Header. */
-    protectedHeader: JWEHeaderParameters;
-    /** The Content Encryption Key (CEK) used for decryption, as Uint8Array. */
-    cek: Uint8Array<ArrayBuffer>;
-    /** The Additional Authenticated Data (AAD) used, as Uint8Array. */
-    aad: Uint8Array<ArrayBuffer>;
-}
-
-/**
- * Encrypts a payload to produce a JWE Compact Serialization string.
- *
- * @param payload The payload to encrypt. Can be a string, Uint8Array, or a JSON-serializable object.
- * @param key The key encryption key (KEK). Can be a CryptoKey, JWK, or for PBES2, a password string/Uint8Array.
- * @param options JWE encryption options, including `alg` (key management algorithm) and `enc` (content encryption algorithm).
- * @returns A Promise resolving to the JWE Compact Serialization string.
- */
-declare function encrypt(payload: JWTClaims, key: JWK | string | Uint8Array<ArrayBuffer>, options?: JWEEncryptOptions): Promise<string>;
-declare function encrypt(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: JWK | string | Uint8Array<ArrayBuffer>, options?: JWEEncryptOptions): Promise<string>;
-declare function encrypt(payload: JWTClaims, key: CryptoKey, options: JWEEncryptOptions & {
-    alg: KeyManagementAlgorithm;
-    enc: ContentEncryptionAlgorithm;
-}): Promise<string>;
-declare function encrypt(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: CryptoKey, options: JWEEncryptOptions & {
-    alg: KeyManagementAlgorithm;
-    enc: ContentEncryptionAlgorithm;
-}): Promise<string>;
-declare function encrypt(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: CryptoKey | JWK | string | Uint8Array<ArrayBuffer>, options: JWEEncryptOptions & {
-    alg: KeyManagementAlgorithm;
-    enc: ContentEncryptionAlgorithm;
-}): Promise<string>;
-/**
- * Decrypts a JWE Compact Serialization string.
- *
- * @param jwe The JWE Compact Serialization string.
- * @param key The key decryption key (KEK) or a function to look up the key.
- * @param options JWE decryption options.
- * @returns A Promise resolving to an object containing the decrypted plaintext, protected header, CEK, and AAD.
- * @throws If JWE is invalid, decryption fails, or options are not met.
- */
-declare function decrypt<T extends JWTClaims | Uint8Array<ArrayBuffer> | string>(jwe: string, key: CryptoKey | JWK | string | Uint8Array<ArrayBuffer> | JWEKeyLookupFunction, options?: JWEDecryptOptions): Promise<JWEDecryptResult<T>>;
-declare function decrypt(jwe: string, key: CryptoKey | JWK | string | Uint8Array<ArrayBuffer> | JWEKeyLookupFunction, options: JWEDecryptOptions & {
-    forceUint8Array: true;
-}): Promise<JWEDecryptResult<Uint8Array<ArrayBuffer>>>;
-
-declare const jwe_CompositeKey: typeof CompositeKey;
-declare const jwe_ContentEncryptionAlgorithm: typeof ContentEncryptionAlgorithm;
-declare const jwe_DeriveKeyOptions: typeof DeriveKeyOptions;
-declare const jwe_DeriveKeyReturn: typeof DeriveKeyReturn;
-declare const jwe_GenerateJWKOptions: typeof GenerateJWKOptions;
-declare const jwe_GenerateJWKReturn: typeof GenerateJWKReturn;
-declare const jwe_GenerateKeyAlgorithm: typeof GenerateKeyAlgorithm;
-declare const jwe_GenerateKeyOptions: typeof GenerateKeyOptions;
-declare const jwe_GenerateKeyReturn: typeof GenerateKeyReturn;
-type jwe_JWEDecryptOptions = JWEDecryptOptions;
-type jwe_JWEDecryptResult<T extends JWTClaims | Uint8Array<ArrayBuffer> | string = JWTClaims | Uint8Array<ArrayBuffer> | string> = JWEDecryptResult<T>;
-type jwe_JWEEncryptOptions = JWEEncryptOptions;
-type jwe_JWEHeaderParameters = JWEHeaderParameters;
-type jwe_JWEKeyLookupFunction = JWEKeyLookupFunction;
-type jwe_JWEKeyManagementHeaderParameters = JWEKeyManagementHeaderParameters;
-declare const jwe_JWK: typeof JWK;
-declare const jwe_JWKAlgorithm: typeof JWKAlgorithm;
-declare const jwe_JWKPEMAlgorithm: typeof JWKPEMAlgorithm;
-declare const jwe_JWKParameters: typeof JWKParameters;
-declare const jwe_JWKSet: typeof JWKSet;
-declare const jwe_JWK_AES_CBC_HMAC: typeof JWK_AES_CBC_HMAC;
-declare const jwe_JWK_AES_GCM: typeof JWK_AES_GCM;
-declare const jwe_JWK_AES_GCM_KW: typeof JWK_AES_GCM_KW;
-declare const jwe_JWK_AES_KW: typeof JWK_AES_KW;
-declare const jwe_JWK_Asymmetric_Algorithm: typeof JWK_Asymmetric_Algorithm;
-declare const jwe_JWK_EC: typeof JWK_EC;
-declare const jwe_JWK_ECDH_ES: typeof JWK_ECDH_ES;
-declare const jwe_JWK_ECDSA: typeof JWK_ECDSA;
-declare const jwe_JWK_EC_Private: typeof JWK_EC_Private;
-declare const jwe_JWK_EC_Public: typeof JWK_EC_Public;
-declare const jwe_JWK_HMAC: typeof JWK_HMAC;
-declare const jwe_JWK_OKP: typeof JWK_OKP;
-declare const jwe_JWK_OKP_Private: typeof JWK_OKP_Private;
-declare const jwe_JWK_OKP_Public: typeof JWK_OKP_Public;
-declare const jwe_JWK_OKP_SIGN: typeof JWK_OKP_SIGN;
-declare const jwe_JWK_PBES2: typeof JWK_PBES2;
-declare const jwe_JWK_Private: typeof JWK_Private;
-declare const jwe_JWK_Public: typeof JWK_Public;
-declare const jwe_JWK_RSA: typeof JWK_RSA;
-declare const jwe_JWK_RSA_ENC: typeof JWK_RSA_ENC;
-declare const jwe_JWK_RSA_PSS: typeof JWK_RSA_PSS;
-declare const jwe_JWK_RSA_Private: typeof JWK_RSA_Private;
-declare const jwe_JWK_RSA_Public: typeof JWK_RSA_Public;
-declare const jwe_JWK_RSA_SIGN: typeof JWK_RSA_SIGN;
-declare const jwe_JWK_Symmetric_Algorithm: typeof JWK_Symmetric_Algorithm;
-declare const jwe_JWK_oct: typeof JWK_oct;
-declare const jwe_JWT: typeof JWT;
-declare const jwe_JWTClaimValidationOptions: typeof JWTClaimValidationOptions;
-declare const jwe_JWTClaims: typeof JWTClaims;
-declare const jwe_JoseHeaderParameters: typeof JoseHeaderParameters;
-declare const jwe_KeyManagementAlgorithm: typeof KeyManagementAlgorithm;
-declare const jwe_UnwrapKeyOptions: typeof UnwrapKeyOptions;
-declare const jwe_WrapKeyOptions: typeof WrapKeyOptions;
-declare const jwe_WrapKeyResult: typeof WrapKeyResult;
-declare const jwe_decrypt: typeof decrypt;
-declare const jwe_encrypt: typeof encrypt;
-declare namespace jwe {
-  export { jwe_CompositeKey as CompositeKey, jwe_ContentEncryptionAlgorithm as ContentEncryptionAlgorithm, jwe_DeriveKeyOptions as DeriveKeyOptions, jwe_DeriveKeyReturn as DeriveKeyReturn, jwe_GenerateJWKOptions as GenerateJWKOptions, jwe_GenerateJWKReturn as GenerateJWKReturn, jwe_GenerateKeyAlgorithm as GenerateKeyAlgorithm, jwe_GenerateKeyOptions as GenerateKeyOptions, jwe_GenerateKeyReturn as GenerateKeyReturn, jwe_JWK as JWK, jwe_JWKAlgorithm as JWKAlgorithm, jwe_JWKPEMAlgorithm as JWKPEMAlgorithm, jwe_JWKParameters as JWKParameters, jwe_JWKSet as JWKSet, jwe_JWK_AES_CBC_HMAC as JWK_AES_CBC_HMAC, jwe_JWK_AES_GCM as JWK_AES_GCM, jwe_JWK_AES_GCM_KW as JWK_AES_GCM_KW, jwe_JWK_AES_KW as JWK_AES_KW, jwe_JWK_Asymmetric_Algorithm as JWK_Asymmetric_Algorithm, jwe_JWK_EC as JWK_EC, jwe_JWK_ECDH_ES as JWK_ECDH_ES, jwe_JWK_ECDSA as JWK_ECDSA, jwe_JWK_EC_Private as JWK_EC_Private, jwe_JWK_EC_Public as JWK_EC_Public, jwe_JWK_HMAC as JWK_HMAC, jwe_JWK_OKP as JWK_OKP, jwe_JWK_OKP_Private as JWK_OKP_Private, jwe_JWK_OKP_Public as JWK_OKP_Public, jwe_JWK_OKP_SIGN as JWK_OKP_SIGN, jwe_JWK_PBES2 as JWK_PBES2, jwe_JWK_Private as JWK_Private, jwe_JWK_Public as JWK_Public, jwe_JWK_RSA as JWK_RSA, jwe_JWK_RSA_ENC as JWK_RSA_ENC, jwe_JWK_RSA_PSS as JWK_RSA_PSS, jwe_JWK_RSA_Private as JWK_RSA_Private, jwe_JWK_RSA_Public as JWK_RSA_Public, jwe_JWK_RSA_SIGN as JWK_RSA_SIGN, jwe_JWK_Symmetric_Algorithm as JWK_Symmetric_Algorithm, jwe_JWK_oct as JWK_oct, jwe_JWT as JWT, jwe_JWTClaimValidationOptions as JWTClaimValidationOptions, jwe_JWTClaims as JWTClaims, jwe_JoseHeaderParameters as JoseHeaderParameters, jwe_KeyManagementAlgorithm as KeyManagementAlgorithm, jwe_UnwrapKeyOptions as UnwrapKeyOptions, jwe_WrapKeyOptions as WrapKeyOptions, jwe_WrapKeyResult as WrapKeyResult, jwe_decrypt as decrypt, jwe_encrypt as encrypt };
-  export type { jwe_JWEDecryptOptions as JWEDecryptOptions, jwe_JWEDecryptResult as JWEDecryptResult, jwe_JWEEncryptOptions as JWEEncryptOptions, jwe_JWEHeaderParameters as JWEHeaderParameters, jwe_JWEKeyLookupFunction as JWEKeyLookupFunction, jwe_JWEKeyManagementHeaderParameters as JWEKeyManagementHeaderParameters };
-}
-
-export { encrypt as f, decrypt as g, jwe as j };
-export type { JWEHeaderParameters as J, JWEKeyManagementHeaderParameters as a, JWEEncryptOptions as b, JWEKeyLookupFunction as c, JWEDecryptOptions as d, JWEDecryptResult as e };