unjwt 0.5.37 → 0.5.39

package/dist/shared/unjwt.Be8NxwFK.mjs

@@ -1,438 +0,0 @@
-function applyTypCtyDefaults(header, payload) {
-  const isObjectPayload = typeof payload === "object" && payload !== null && !(payload instanceof Uint8Array);
-  if (header.typ === void 0 && isObjectPayload) {
-    header.typ = "JWT";
-  }
-  if (header.typ?.toLowerCase().includes("jwt") && isObjectPayload) {
-    header.cty ||= "application/json";
-  }
-  return header;
-}
-function isJWTContent(header) {
-  if (!header) return false;
-  if (header.typ?.toLowerCase().includes("jwt")) return true;
-  const cty = header.cty?.toLowerCase();
-  return cty === "json" || cty === "application/json" || !!cty && cty.endsWith("+json");
-}
-function decodeMaybeJWTString(decodedString, header) {
-  if (isJWTContent(header)) {
-    const looksLikeJson = decodedString.startsWith("{") && decodedString.endsWith("}") || decodedString.startsWith("[") && decodedString.endsWith("]");
-    if (looksLikeJson) {
-      try {
-        const obj = JSON.parse(decodedString);
-        return sanitizeObject(obj);
-      } catch {
-      }
-    }
-  }
-  return decodedString;
-}
-function decodePayloadFromBytes(bytes, header, forceUint8Array) {
-  if (forceUint8Array) return bytes;
-  const decodedString = textDecoder.decode(bytes);
-  return decodeMaybeJWTString(decodedString, header);
-}
-function decodePayloadFromB64UrlSegment(payloadEncoded, header, forceUint8Array) {
-  if (forceUint8Array) return base64UrlDecode(payloadEncoded, false);
-  const decodedString = base64UrlDecode(payloadEncoded);
-  return decodeMaybeJWTString(decodedString, header);
-}
-function getPlaintextBytes(payload) {
-  if (payload instanceof Uint8Array) return payload;
-  if (typeof payload === "string") return textEncoder.encode(payload);
-  if (typeof payload === "object" && payload !== null)
-    return textEncoder.encode(JSON.stringify(payload));
-  throw new TypeError(
-    "Plaintext must be a string, Uint8Array, or a JSON-serializable object."
-  );
-}
-const TIME_CONSTANTS = Object.freeze({
-  s: 1,
-  second: 1,
-  seconds: 1,
-  m: 60,
-  minute: 60,
-  minutes: 60,
-  h: 3600,
-  hour: 3600,
-  hours: 3600,
-  D: 86400,
-  day: 86400,
-  days: 86400,
-  W: 604800,
-  week: 604800,
-  weeks: 604800,
-  M: 2592e3,
-  month: 2592e3,
-  months: 2592e3,
-  Y: 31536e3,
-  year: 31536e3,
-  years: 31536e3
-});
-const EXPIRES_IN_REGEX = /^(\d+)(s|second|seconds|m|minute|minutes|h|hour|hours|D|day|days|W|week|weeks|M|month|months|Y|year|years)?$/;
-function computeExpiresInSeconds(expiresIn) {
-  if (typeof expiresIn === "number") {
-    if (!Number.isInteger(expiresIn) || expiresIn <= 0) {
-      throw new TypeError(
-        "If 'expiresIn' is a number, it must be a positive integer representing seconds."
-      );
-    }
-    return expiresIn;
-  }
-  if (typeof expiresIn === "string") {
-    const match = expiresIn.match(EXPIRES_IN_REGEX);
-    if (!match || !match[1]) {
-      throw new TypeError(
-        "Invalid 'expiresIn' format. Must be a positive integer or a string like '10m', '2h', '7D', etc."
-      );
-    }
-    const value = Number.parseInt(match[1], 10);
-    const unit = match[2] || "s";
-    return value * TIME_CONSTANTS[unit];
-  }
-  throw new TypeError(
-    "'expiresIn' must be a number or a string representing time duration."
-  );
-}
-const computeMaxTokenAgeSeconds = computeExpiresInSeconds;
-function computeJwtTimeClaims(payload, headerTyp, expiresIn, currentDate = /* @__PURE__ */ new Date()) {
-  if (expiresIn === void 0 || !headerTyp?.toLowerCase().includes("jwt") || !(payload && typeof payload === "object") || payload instanceof Uint8Array || payload.exp) {
-    return void 0;
-  }
-  const now = Math.round(currentDate.getTime() / 1e3);
-  const claims = { ...payload };
-  claims.iat ||= now;
-  claims.exp = claims.iat + computeExpiresInSeconds(expiresIn);
-  return claims;
-}
-function validateJwtClaims(jwtClaims, options = {}) {
-  const clockTolerance = options.clockTolerance ?? 0;
-  const currentTime = Math.round(
-    (options.currentDate ?? /* @__PURE__ */ new Date()).getTime() / 1e3
-  );
-  const allRequiredClaims = new Set(options.requiredClaims || []);
-  const missingClaims = /* @__PURE__ */ new Set();
-  if (options.issuer) allRequiredClaims.add("iss");
-  if (options.audience) allRequiredClaims.add("aud");
-  if (options.subject) allRequiredClaims.add("sub");
-  if (options.maxTokenAge) allRequiredClaims.add("iat");
-  for (const claimName of allRequiredClaims) {
-    if (!(claimName in jwtClaims)) missingClaims.add(claimName);
-  }
-  if (missingClaims.size > 0) {
-    throw new Error(
-      `Missing required JWT Claims: ${[...missingClaims].join(", ")}`
-    );
-  }
-  if (options.issuer) {
-    const expectedIssuers = maybeArray(options.issuer);
-    if (!jwtClaims.iss || !expectedIssuers.includes(jwtClaims.iss)) {
-      throw new Error(
-        `Invalid JWT "iss" (Issuer) Claim: Expected ${expectedIssuers.join(" or ")}, got ${jwtClaims.iss}`
-      );
-    }
-  }
-  if (options.subject && jwtClaims.sub !== options.subject) {
-    throw new Error(
-      `Invalid JWT "sub" (Subject) Claim: Expected ${options.subject}, got ${jwtClaims.sub}`
-    );
-  }
-  if (options.audience) {
-    const expectedAudiences = maybeArray(options.audience);
-    const claimAudience = maybeArray(jwtClaims.aud || []);
-    if (!claimAudience.some((aud) => expectedAudiences.includes(aud))) {
-      throw new Error(
-        `Invalid JWT "aud" (Audience) Claim: Expected ${expectedAudiences.join(" or ")}, got ${claimAudience.join(", ")}`
-      );
-    }
-  }
-  if (typeof jwtClaims.nbf === "number" && jwtClaims.nbf > currentTime + clockTolerance) {
-    throw new Error(
-      `JWT "nbf" (Not Before) Claim validation failed: Token is not yet valid (nbf: ${new Date(jwtClaims.nbf * 1e3).toISOString()})`
-    );
-  }
-  if (typeof jwtClaims.exp === "number" && jwtClaims.exp <= currentTime - clockTolerance) {
-    throw new Error(
-      `JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${new Date(jwtClaims.exp * 1e3).toISOString()})`
-    );
-  }
-  if (options.maxTokenAge) {
-    if (typeof jwtClaims.iat !== "number") {
-      throw new TypeError(
-        'JWT "iat" (Issued At) Claim must be a number when maxTokenAge is set.'
-      );
-    }
-    if (jwtClaims.iat > currentTime + clockTolerance) {
-      throw new Error(
-        `JWT "iat" (Issued At) Claim validation failed: Token was issued in the future (iat: ${new Date(jwtClaims.iat * 1e3).toISOString()})`
-      );
-    }
-    if (jwtClaims.iat < currentTime - computeMaxTokenAgeSeconds(options.maxTokenAge) - clockTolerance) {
-      throw new Error(
-        `JWT "iat" (Issued At) Claim validation failed: Token is too old (maxTokenAge: ${options.maxTokenAge}s, iat: ${new Date(jwtClaims.iat * 1e3).toISOString()})`
-      );
-    }
-  }
-}
-function validateCriticalHeadersJWS(protectedHeader, requiredHeaders = []) {
-  if (!protectedHeader.crit) return;
-  const missingHeaderParams = /* @__PURE__ */ new Set();
-  const recognizedParams = /* @__PURE__ */ new Set([
-    ...requiredHeaders,
-    "alg",
-    "typ",
-    "cty",
-    "kid",
-    "jwk",
-    "jku",
-    "x5c",
-    "x5t",
-    "x5u",
-    "b64"
-  ]);
-  for (const param of protectedHeader.crit) {
-    if (recognizedParams.has(param) && (param in protectedHeader || param === "b64")) {
-      continue;
-    }
-    missingHeaderParams.add(param);
-  }
-  if (missingHeaderParams.size > 0) {
-    throw new Error(
-      `Missing critical header parameters: ${[...missingHeaderParams].join(", ")}`
-    );
-  }
-}
-function validateCriticalHeadersJWE(protectedHeader, understoodFromOptions) {
-  if (protectedHeader.crit && !understoodFromOptions) {
-    throw new Error(
-      `Unprocessed critical header parameters: ${protectedHeader.crit.join(", ")}`
-    );
-  }
-  if (!protectedHeader.crit) return;
-  const understoodParams = /* @__PURE__ */ new Set([
-    ...understoodFromOptions || [],
-    // JWE specific standard headers:
-    "alg",
-    "enc",
-    "typ",
-    "cty",
-    "kid",
-    "jwk",
-    "jku",
-    "x5c",
-    "x5t",
-    "x5u",
-    "iv",
-    "tag",
-    "p2s",
-    "p2c",
-    "epk",
-    "apu",
-    "apv"
-  ]);
-  for (const critParam of protectedHeader.crit) {
-    if (!Object.prototype.hasOwnProperty.call(protectedHeader, critParam)) {
-      throw new Error(
-        `Critical header parameter "${critParam}" listed in "crit" but not present in the protected header.`
-      );
-    }
-    if (!understoodParams.has(critParam)) {
-      throw new Error(`Unprocessed critical header parameters: ${critParam}`);
-    }
-  }
-}
-
-const DANGEROUS_KEYS = ["__proto__", "prototype", "constructor"];
-function sanitizeObject(obj) {
-  if (!obj || typeof obj !== "object") return obj;
-  const seen = /* @__PURE__ */ new WeakSet();
-  visit(obj, seen);
-  return obj;
-}
-function visit(current, seen) {
-  if (!current || typeof current !== "object") return;
-  if (seen.has(current)) return;
-  seen.add(current);
-  for (const key of DANGEROUS_KEYS) {
-    if (Object.prototype.hasOwnProperty.call(current, key)) {
-      try {
-        delete current[key];
-      } catch {
-      }
-      if (Object.prototype.hasOwnProperty.call(current, key)) {
-        try {
-          current[key] = void 0;
-          delete current[key];
-        } catch {
-        }
-      }
-      if (Object.prototype.hasOwnProperty.call(current, key)) {
-        try {
-          Object.defineProperty(current, key, {
-            value: void 0,
-            configurable: true,
-            enumerable: false,
-            writable: true
-          });
-          delete current[key];
-        } catch {
-        }
-      }
-    }
-  }
-  delete current["__proto__"];
-  delete current["prototype"];
-  delete current["constructor"];
-  if (Array.isArray(current)) {
-    for (const value of current) visit(value, seen);
-    return;
-  }
-  for (const k of Object.keys(current))
-    visit(current[k], seen);
-}
-
-const textEncoder = /* @__PURE__ */ new TextEncoder();
-const textDecoder = /* @__PURE__ */ new TextDecoder();
-function base64Encode(data) {
-  const encodedData = data instanceof Uint8Array ? data : textEncoder.encode(data);
-  if (Uint8Array.prototype.toBase64) {
-    return encodedData.toBase64();
-  }
-  return btoa(String.fromCodePoint(...encodedData));
-}
-function base64UrlEncode(data) {
-  const encodedData = data instanceof Uint8Array ? data : textEncoder.encode(data);
-  if (Uint8Array.prototype.toBase64) {
-    return encodedData.toBase64({ alphabet: "base64url", omitPadding: true });
-  }
-  return btoa(String.fromCodePoint(...encodedData)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-}
-function base64Decode(str, toString) {
-  const decodeToString = toString !== false;
-  if (!str) {
-    return decodeToString ? "" : new Uint8Array(0);
-  }
-  const data = Uint8Array.fromBase64 ? (
-    // @ts-expect-error
-    Uint8Array.fromBase64(str)
-  ) : Uint8Array.from(atob(str), (b) => b.codePointAt(0));
-  return decodeToString ? textDecoder.decode(data) : data;
-}
-function base64UrlDecode(str, toString) {
-  const decodeToString = toString !== false;
-  if (!str) {
-    return decodeToString ? "" : new Uint8Array(0);
-  }
-  let data;
-  if (Uint8Array.fromBase64) {
-    data = Uint8Array.fromBase64(str, { alphabet: "base64url" });
-  } else {
-    str = str.replace(/-/g, "+").replace(/_/g, "/");
-    while (str.length % 4) str += "=";
-    data = Uint8Array.from(atob(str), (b) => b.codePointAt(0));
-  }
-  return decodeToString ? textDecoder.decode(data) : data;
-}
-function randomBytes(length) {
-  return crypto.getRandomValues(new Uint8Array(length));
-}
-function concatUint8Arrays(...arrays) {
-  const totalLength = arrays.reduce((length, arr) => length + arr.length, 0);
-  const result = new Uint8Array(totalLength);
-  let offset = 0;
-  for (const arr of arrays) {
-    result.set(arr, offset);
-    offset += arr.length;
-  }
-  return result;
-}
-function maybeArray(item) {
-  return Array.isArray(item) ? item : [item];
-}
-function isJWK(key) {
-  return typeof key === "object" && key !== null && "kty" in key && typeof key.kty === "string";
-}
-function isJWKSet(key) {
-  return key && typeof key === "object" && "keys" in key && Array.isArray(key.keys);
-}
-function assertCryptoKey(key) {
-  if (!isCryptoKey(key)) {
-    throw new Error("CryptoKey instance expected");
-  }
-}
-function isCryptoKey(key) {
-  return key?.[Symbol.toStringTag] === "CryptoKey";
-}
-const isCryptoKeyPair = (key) => key && typeof key === "object" && isCryptoKey(key.publicKey) && isCryptoKey(key.privateKey);
-function isSymmetricJWK(key) {
-  return isJWK(key) && key.kty === "oct" && typeof key.k === "string";
-}
-function isAsymmetricJWK(key) {
-  return !isSymmetricJWK(key);
-}
-function isPrivateJWK(key) {
-  if (!isJWK(key)) return false;
-  if (key.kty === "EC") {
-    return typeof key.d === "string";
-  }
-  if (key.kty === "OKP") {
-    return typeof key.d === "string";
-  }
-  if (key.kty === "RSA") {
-    return typeof key.d === "string";
-  }
-  return false;
-}
-function isPublicJWK(key) {
-  if (!isJWK(key)) return false;
-  if (key.kty === "EC") {
-    const ec = key;
-    return typeof ec.x === "string" && typeof ec.y === "string" && typeof ec.d !== "string";
-  }
-  if (key.kty === "OKP") {
-    const okp = key;
-    return typeof okp.x === "string" && typeof okp.d !== "string";
-  }
-  if (key.kty === "RSA") {
-    const rsa = key;
-    return typeof rsa.n === "string" && typeof rsa.e === "string" && typeof rsa.d !== "string";
-  }
-  return false;
-}
-
-const index = {
-  __proto__: null,
-  applyTypCtyDefaults: applyTypCtyDefaults,
-  assertCryptoKey: assertCryptoKey,
-  base64Decode: base64Decode,
-  base64Encode: base64Encode,
-  base64UrlDecode: base64UrlDecode,
-  base64UrlEncode: base64UrlEncode,
-  computeExpiresInSeconds: computeExpiresInSeconds,
-  computeJwtTimeClaims: computeJwtTimeClaims,
-  computeMaxTokenAgeSeconds: computeMaxTokenAgeSeconds,
-  concatUint8Arrays: concatUint8Arrays,
-  decodeMaybeJWTString: decodeMaybeJWTString,
-  decodePayloadFromB64UrlSegment: decodePayloadFromB64UrlSegment,
-  decodePayloadFromBytes: decodePayloadFromBytes,
-  getPlaintextBytes: getPlaintextBytes,
-  isAsymmetricJWK: isAsymmetricJWK,
-  isCryptoKey: isCryptoKey,
-  isCryptoKeyPair: isCryptoKeyPair,
-  isJWK: isJWK,
-  isJWKSet: isJWKSet,
-  isJWTContent: isJWTContent,
-  isPrivateJWK: isPrivateJWK,
-  isPublicJWK: isPublicJWK,
-  isSymmetricJWK: isSymmetricJWK,
-  maybeArray: maybeArray,
-  randomBytes: randomBytes,
-  sanitizeObject: sanitizeObject,
-  textDecoder: textDecoder,
-  textEncoder: textEncoder,
-  validateCriticalHeadersJWE: validateCriticalHeadersJWE,
-  validateCriticalHeadersJWS: validateCriticalHeadersJWS,
-  validateJwtClaims: validateJwtClaims
-};
-
-export { assertCryptoKey as A, isAsymmetricJWK as B, maybeArray as C, isJWTContent as D, decodeMaybeJWTString as E, computeMaxTokenAgeSeconds as F, isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, base64UrlDecode as e, decodePayloadFromBytes as f, getPlaintextBytes as g, validateJwtClaims as h, index as i, isCryptoKeyPair as j, isCryptoKey as k, textDecoder as l, isJWKSet as m, decodePayloadFromB64UrlSegment as n, validateCriticalHeadersJWS as o, computeExpiresInSeconds as p, isSymmetricJWK as q, randomBytes as r, sanitizeObject as s, textEncoder as t, isPrivateJWK as u, validateCriticalHeadersJWE as v, isPublicJWK as w, concatUint8Arrays as x, base64Decode as y, base64Encode as z };

package/dist/shared/unjwt.BqdNUKDr.d.mts

@@ -1,64 +0,0 @@
-import { x as JWK_HMAC, y as JWK_RSA_SIGN, z as JWK_RSA_PSS, A as JWK_ECDSA, V as JoseHeaderParameters, E as ExpiresIn, v as JWK, w as JWKSet, Z as JWTClaimValidationOptions, X as JWTClaims } from './unjwt.BCi3FEWr.mjs';
-
-type JWS_SIGN_EXTRA = "Ed25519" | "EdDSA";
-/** JWS Signing Algorithm Identifier. */
-type JWSAlgorithm = JWK_HMAC | JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWS_SIGN_EXTRA;
-/** Recognized JWS Header Parameters, any other Header Members may also be present. */
-interface JWSHeaderParameters extends JoseHeaderParameters {
-    /** JWS "alg" (Algorithm) Header Parameter */
-    alg?: JWSAlgorithm;
-    /**
-     * This JWS Extension Header Parameter modifies the JWS Payload representation and the JWS Signing
-     * Input computation as per {@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}.
-     * If `false`, the payload is used directly without Base64URL encoding.
-     * Defaults to `true`.
-     */
-    b64?: boolean;
-}
-/** JWS Protected Header */
-interface JWSProtectedHeader extends JWSHeaderParameters {
-    alg: JWSAlgorithm;
-}
-/**
- * JWS (JSON Web Signature) options for signing
- */
-interface JWSSignOptions {
-    /** The JWS Algorithm to use. Must be provided. */
-    alg?: JWSAlgorithm;
-    /**
-     * Additional protected header parameters. `alg` is automatically included.
-     * `typ` defaults to "JWT" if not provided and payload is an object.
-     */
-    protectedHeader?: JWSHeaderParameters;
-    /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
-    currentDate?: Date;
-    /**
-     * Time at which the JWS should expire, if no `exp` was already provided.
-     */
-    expiresIn?: ExpiresIn;
-}
-/** Result of JWS verification */
-interface JWSVerifyResult<T extends JWTClaims | Uint8Array<ArrayBuffer> | string = JWTClaims | Uint8Array<ArrayBuffer> | string> {
-    /** The decoded and verified payload. */
-    payload: T;
-    /** The JWS Protected Header. */
-    protectedHeader: JWSProtectedHeader;
-}
-/** Options for JWS verification */
-interface JWSVerifyOptions extends JWTClaimValidationOptions {
-    /** List of allowed algorithms. If provided, the JWS `alg` must be in this list. */
-    algorithms?: JWSAlgorithm[];
-    /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred. */
-    forceUint8Array?: boolean;
-    /** Unless false, will parse payload as JWT and validate claims if applicable (typ "JWT"). */
-    validateJWT?: boolean;
-}
-/**
- * Key lookup function for JWS verification.
- * @param header The JWS Protected Header.
- * @param token The JWS token.
- * @returns The key material (CryptoKey, JWK, or raw Uint8Array) or a Promise resolving to it.
- */
-type JWSKeyLookupFunction = (header: JWSProtectedHeader, token: string) => CryptoKey | JWK | JWKSet | Uint8Array<ArrayBuffer> | Promise<CryptoKey | JWK | JWKSet | Uint8Array<ArrayBuffer>>;
-
-export type { JWSAlgorithm as J, JWSHeaderParameters as a, JWSProtectedHeader as b, JWSSignOptions as c, JWSVerifyResult as d, JWSVerifyOptions as e, JWSKeyLookupFunction as f };

package/dist/shared/unjwt.CMNtw8ek.d.mts

@@ -1,155 +0,0 @@
-import { K as KeyManagementAlgorithm, f as ContentEncryptionAlgorithm, E as ExpiresIn, V as JoseHeaderParameters, h as JWK_EC_Public, i as JWK_EC_Private, v as JWK, Z as JWTClaimValidationOptions, X as JWTClaims } from './unjwt.BCi3FEWr.mjs';
-import { S as StrictOmit } from './unjwt.JdKqVANs.mjs';
-
-/** Recognized JWE Header Parameters, any other Header Members may also be present. */
-interface JWEHeaderParameters extends JoseHeaderParameters {
-    /**
-     * `alg` (Algorithm): Header Parameter - Key Management Algorithm
-     */
-    alg?: string;
-    /**
-     * `enc` (Encryption Algorithm): Header Parameter - Content Encryption Algorithm
-     */
-    enc?: string;
-    /**
-     * `p2c` (PBES2 Count): Header Parameter
-     */
-    p2c?: number;
-    /**
-     * `p2s` (PBES2 Salt): Header Parameter. Base64URL encoded.
-     */
-    p2s?: string;
-    /**
-     * "iv" (Initialization Vector) Header Parameter for AES GCM Key Wrapping. Base64URL encoded.
-     */
-    iv?: string;
-    /**
-     * "tag" (Authentication Tag) Header Parameter for AES GCM Key Wrapping. Base64URL encoded.
-     */
-    tag?: string;
-    /**
-     * "epk" (Ephemeral Public Key) Header Parameter for ECDH-ES.
-     */
-    epk?: JWK_EC_Public;
-    /**
-     * "apu" (Agreement PartyUInfo) Header Parameter for ECDH-ES. Base64URL encoded.
-     */
-    apu?: string;
-    /**
-     * "apv" (Agreement PartyVInfo) Header Parameter for ECDH-ES. Base64URL encoded.
-     */
-    apv?: string;
-    /** Any other JWE Header member. */
-    [propName: string]: unknown;
-}
-/** Recognized JWE Key Management-related Header Parameters. */
-interface JWEKeyManagementHeaderParameters {
-    apu?: Uint8Array<ArrayBuffer>;
-    apv?: Uint8Array<ArrayBuffer>;
-    /**
-     * For Internal use only
-     */
-    p2c?: number;
-    /**
-     * For Internal use only
-     */
-    p2s?: Uint8Array<ArrayBuffer>;
-    /**
-     * For Internal use only
-     */
-    iv?: Uint8Array<ArrayBuffer>;
-    /**
-     * For Internal use only
-     */
-    epk?: CryptoKey | JWK_EC_Public;
-    /**
-     * For Internal use only
-     */
-    epkPrivateKey?: CryptoKey | JWK_EC_Private;
-}
-/**
- * JWE (JSON Web Encryption) encryption options
- */
-interface JWEEncryptOptions {
-    /** JWE "alg" (Algorithm) Header Parameter. Key Management Algorithm. */
-    alg?: KeyManagementAlgorithm;
-    /** JWE "enc" (Encryption Algorithm) Header Parameter. Content Encryption Algorithm. */
-    enc?: ContentEncryptionAlgorithm;
-    /** Date to use when computing NumericDate claims, defaults to `new Date()`. */
-    currentDate?: Date;
-    /** Time at which the JWT should expire, if no `exp` was already provided (only when typ is "JWT" or explicitly parsing JWT). */
-    expiresIn?: ExpiresIn;
-    /** Additional JWE Protected Header parameters. */
-    protectedHeader?: StrictOmit<JWEHeaderParameters, "alg" | "enc" | "iv" | "tag" | "p2s" | "p2c" | "epk" | "apu" | "apv">;
-    /** Initialization Vector for AES-GCMKW key wrapping. Generated if not provided. */
-    keyManagementIV?: Uint8Array<ArrayBuffer>;
-    /** PBES2 Salt value (p2s). Required for PBES2 algorithms. */
-    p2s?: Uint8Array<ArrayBuffer>;
-    /** PBES2 Iteration count (p2c). Required for PBES2 algorithms. */
-    p2c?: number;
-    /** ECDH-ES specific options. */
-    ecdh?: {
-        /**
-         * ECDH-ES Ephemeral key material. Provide a private key (CryptoKey or JWK),
-         * a CryptoKeyPair, or an object exposing both public and private parts.
-         */
-        ephemeralKey?: CryptoKey | JWK_EC_Private | CryptoKeyPair | {
-            publicKey: CryptoKey | JWK_EC_Public;
-            privateKey: CryptoKey | JWK_EC_Private;
-        };
-        /** ECDH-ES Agreement PartyUInfo. */
-        partyUInfo?: Uint8Array<ArrayBuffer>;
-        /** ECDH-ES Agreement PartyVInfo. */
-        partyVInfo?: Uint8Array<ArrayBuffer>;
-    };
-    /**
-     * Content Encryption Key (CEK) to use.
-     * If provided, it will be used directly. Otherwise, a CEK will be generated.
-     */
-    cek?: Uint8Array<ArrayBuffer>;
-    /**
-     * Initialization Vector for content encryption.
-     * If provided, it will be used. Otherwise, one will be generated.
-     */
-    contentEncryptionIV?: Uint8Array<ArrayBuffer>;
-}
-/**
- * Key lookup function for JWE decryption.
- * @param header The JWE Protected Header.
- * @returns The key material (CryptoKey, JWK, password string, or raw Uint8Array) or a Promise resolving to it.
- */
-type JWEKeyLookupFunction = (header: JWEHeaderParameters, token: string) => CryptoKey | JWK | string | Uint8Array<ArrayBuffer> | Promise<CryptoKey | JWK | string | Uint8Array<ArrayBuffer>>;
-/**
- * JWE (JSON Web Encryption) decryption options
- */
-interface JWEDecryptOptions extends JWTClaimValidationOptions {
-    /** A list of allowed JWE "alg" (Algorithm) Header Parameter values for key management. */
-    algorithms?: KeyManagementAlgorithm[];
-    /** A list of allowed JWE "enc" (Encryption Algorithm) Header Parameter values for content encryption. */
-    encryptionAlgorithms?: ContentEncryptionAlgorithm[];
-    /** Algorithm to import the unwrapped CEK as (e.g., { name: 'AES-GCM' }). Defaults based on 'enc'. */
-    unwrappedKeyAlgorithm?: Parameters<typeof crypto.subtle.importKey>[2];
-    /** Key usages for the unwrapped CEK. Defaults based on 'enc' (typically ['encrypt', 'decrypt']). */
-    keyUsage?: KeyUsage[];
-    /** Mark the unwrapped CEK as extractable. Defaults to true. */
-    extractable?: boolean;
-    /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred based on JWE headers. */
-    forceUint8Array?: boolean;
-    /** Unless false, will parse payload as JWT and validate claims if applicable (typ "JWT"). */
-    validateJWT?: boolean;
-}
-/**
- * Result of a JWE decryption operation.
- */
-interface JWEDecryptResult<T extends JWTClaims | Uint8Array<ArrayBuffer> | string = JWTClaims | Uint8Array<ArrayBuffer> | string> {
-    /** The decrypted payload. */
-    payload: T;
-    /** The JWE Protected Header. */
-    protectedHeader: JWEHeaderParameters;
-    /** The Content Encryption Key (CEK) used for decryption, as Uint8Array. */
-    cek: Uint8Array<ArrayBuffer>;
-    /** The Additional Authenticated Data (AAD) used, as Uint8Array. */
-    aad: Uint8Array<ArrayBuffer>;
-}
-
-export type { JWEHeaderParameters as J, JWEKeyManagementHeaderParameters as a, JWEEncryptOptions as b, JWEKeyLookupFunction as c, JWEDecryptOptions as d, JWEDecryptResult as e };