unjwt 0.5.38 → 0.5.40

package/dist/shared/unjwt.B-v62plj.mjs

@@ -1,249 +0,0 @@
-import { i as importKey, e as encryptKey, g as generateIV, a as encrypt$1, u as unwrapKey, d as decrypt$1 } from './unjwt.Dpl__ZAR.mjs';
-import { r as randomBytes, a as isJWK, s as sanitizeObject, b as applyTypCtyDefaults, c as computeJwtTimeClaims, g as getPlaintextBytes, d as base64UrlEncode, t as textEncoder, e as base64UrlDecode, f as decodePayloadFromBytes, v as validateCriticalHeadersJWE, h as validateJwtClaims, j as isCryptoKeyPair, k as isCryptoKey } from './unjwt.Be8NxwFK.mjs';
-
-async function encrypt(payload, key, options = {}) {
-  const {
-    protectedHeader: additionalProtectedHeader,
-    cek: providedCek,
-    contentEncryptionIV: providedContentIV,
-    keyManagementIV,
-    p2s = randomBytes(16),
-    p2c = 2048,
-    ecdh
-  } = options;
-  let { alg, enc } = options;
-  if (!alg) {
-    if (typeof key === "string" || key instanceof Uint8Array) {
-      alg = "PBES2-HS256+A128KW";
-    } else if (isJWK(key)) {
-      alg = key.alg === "A128GCM" || key.alg === "A192GCM" || key.alg === "A256GCM" ? `${key.alg}KW` : key.alg;
-    }
-  }
-  if (!alg) {
-    throw new TypeError(
-      'JWE "alg" (Key Management Algorithm) must be provided in options or inferable from the key'
-    );
-  }
-  if (!enc) {
-    enc = isJWK(key) && "enc" in key ? key.enc : "A128GCM";
-  }
-  const jweKeyManagementParams = {};
-  if (keyManagementIV) jweKeyManagementParams.iv = keyManagementIV;
-  if (p2s) jweKeyManagementParams.p2s = p2s;
-  if (p2c) jweKeyManagementParams.p2c = p2c;
-  if (ecdh?.partyUInfo) jweKeyManagementParams.apu = ecdh.partyUInfo;
-  if (ecdh?.partyVInfo) jweKeyManagementParams.apv = ecdh.partyVInfo;
-  if (ecdh?.ephemeralKey) {
-    const { epk, epkPrivateKey } = parseEphemeralKey(ecdh.ephemeralKey);
-    jweKeyManagementParams.epk = epk;
-    jweKeyManagementParams.epkPrivateKey = epkPrivateKey;
-  }
-  const wrappingKeyMaterial = await importKey(key, alg);
-  const {
-    cek: finalCek,
-    // This is the CEK (CryptoKey | Uint8Array) to be used for content encryption
-    encryptedKey: jweEncryptedKey,
-    // This is the JWE Encrypted Key (Uint8Array | undefined)
-    parameters: keyManagementHeaderParams
-    // JWE header params from key encryption (e.g., epk, p2s, iv, tag)
-  } = await encryptKey(
-    alg,
-    enc,
-    wrappingKeyMaterial,
-    providedCek,
-    jweKeyManagementParams
-  );
-  const baseProtectedHeader = { ...additionalProtectedHeader };
-  delete baseProtectedHeader.alg;
-  delete baseProtectedHeader.enc;
-  const jweProtectedHeader = sanitizeObject({
-    ...baseProtectedHeader,
-    ...keyManagementHeaderParams,
-    ...isJWK(key) && key.kid ? { kid: key.kid } : {},
-    // Include kid if available
-    alg,
-    enc
-  });
-  const protectedHeader = applyTypCtyDefaults(jweProtectedHeader, payload);
-  const computedPayload = computeJwtTimeClaims(
-    payload,
-    protectedHeader.typ,
-    options.expiresIn,
-    options.currentDate
-  );
-  const plaintextBytes = getPlaintextBytes(computedPayload || payload);
-  const protectedHeaderSerialized = JSON.stringify(protectedHeader);
-  const protectedHeaderEncoded = base64UrlEncode(protectedHeaderSerialized);
-  const aadBytes = textEncoder.encode(protectedHeaderEncoded);
-  const contentIVBytes = providedContentIV ?? generateIV(enc);
-  const {
-    ciphertext: contentCiphertext,
-    tag: contentAuthTag,
-    iv: actualContentIV
-  } = await encrypt$1(
-    enc,
-    plaintextBytes,
-    finalCek,
-    contentIVBytes,
-    aadBytes
-  );
-  if (!actualContentIV) {
-    throw new Error("Content encryption IV was not generated or returned.");
-  }
-  if (!contentAuthTag) {
-    throw new Error(
-      "Content encryption auth tag was not generated or returned."
-    );
-  }
-  const encryptedKeyEncoded = jweEncryptedKey ? base64UrlEncode(jweEncryptedKey) : "";
-  const jweParts = [
-    protectedHeaderEncoded,
-    encryptedKeyEncoded,
-    base64UrlEncode(actualContentIV),
-    base64UrlEncode(contentCiphertext),
-    base64UrlEncode(contentAuthTag)
-  ];
-  return jweParts.join(".");
-}
-async function decrypt(jwe, key, options = {}) {
-  const parts = jwe.split(".");
-  if (parts.length !== 5) {
-    throw new Error(
-      "Invalid JWE: Must contain five sections (RFC7516, section-3)."
-    );
-  }
-  const [
-    protectedHeaderEncoded,
-    encryptedKeyEncoded,
-    ivEncoded,
-    ciphertextEncoded,
-    authTagEncoded
-  ] = parts;
-  let protectedHeader;
-  try {
-    const protectedHeaderJson = base64UrlDecode(protectedHeaderEncoded);
-    protectedHeader = sanitizeObject(
-      JSON.parse(protectedHeaderJson)
-    );
-  } catch (error_) {
-    throw new Error(
-      `Invalid JWE: Protected header is not valid Base64URL or JSON (${error_ instanceof Error ? error_.message : error_})`
-    );
-  }
-  if (!protectedHeader || typeof protectedHeader !== "object" || !protectedHeader.alg || !protectedHeader.enc) {
-    throw new Error(
-      'Invalid JWE: Protected header must be an object with "alg" and "enc" properties.'
-    );
-  }
-  const alg = protectedHeader.alg;
-  const enc = protectedHeader.enc;
-  if (options?.algorithms && !options.algorithms.includes(alg)) {
-    throw new Error(`Key management algorithm not allowed: ${alg}`);
-  }
-  if (options?.encryptionAlgorithms && !options.encryptionAlgorithms.includes(enc)) {
-    throw new Error(`Content encryption algorithm not allowed: ${enc}`);
-  }
-  const resolvedKeyMaterial = typeof key === "function" ? await key(protectedHeader, jwe) : key;
-  const unwrappingKey = await importKey(resolvedKeyMaterial, alg);
-  const encryptedKeyBytes = base64UrlDecode(encryptedKeyEncoded, false);
-  const contentIVBytes = base64UrlDecode(ivEncoded, false);
-  const contentAuthTagBytes = base64UrlDecode(authTagEncoded, false);
-  const ciphertextBytes = base64UrlDecode(ciphertextEncoded, false);
-  const unwrapKeyOpts = {
-    iv: protectedHeader.iv,
-    tag: protectedHeader.tag,
-    p2s: protectedHeader.p2s,
-    p2c: protectedHeader.p2c,
-    epk: protectedHeader.epk,
-    apu: protectedHeader.apu,
-    apv: protectedHeader.apv,
-    enc,
-    unwrappedKeyAlgorithm: options?.unwrappedKeyAlgorithm,
-    keyUsage: options?.keyUsage,
-    extractable: options?.extractable,
-    returnAs: false
-    // Returning CEK as Uint8Array<ArrayBuffer>
-  };
-  const cekBytes = await unwrapKey(
-    alg,
-    encryptedKeyBytes,
-    unwrappingKey,
-    unwrapKeyOpts
-  );
-  const aadBytes = textEncoder.encode(protectedHeaderEncoded);
-  const plaintextBytes = await decrypt$1(
-    enc,
-    cekBytes,
-    ciphertextBytes,
-    contentIVBytes,
-    contentAuthTagBytes,
-    aadBytes
-  );
-  const payload = decodePayloadFromBytes(
-    plaintextBytes,
-    protectedHeader,
-    options?.forceUint8Array
-  );
-  validateCriticalHeadersJWE(protectedHeader, [
-    ...options?.critical || [],
-    ...options?.requiredHeaders || []
-  ]);
-  if (payload && typeof payload === "object" && options.validateJWT !== false && (options.validateJWT === true || protectedHeader.typ?.toLowerCase().includes("jwt")) && !options.forceUint8Array && !(payload instanceof Uint8Array)) {
-    validateJwtClaims(payload, options);
-  }
-  return {
-    payload,
-    protectedHeader,
-    cek: cekBytes,
-    aad: aadBytes
-  };
-}
-function parseEphemeralKey(ephemeralKey) {
-  let epk;
-  let epkPrivateKey;
-  if (isCryptoKeyPair(ephemeralKey)) {
-    epk = ephemeralKey.publicKey;
-    epkPrivateKey = ephemeralKey.privateKey;
-  } else if (typeof ephemeralKey === "object" && ephemeralKey !== null && "publicKey" in ephemeralKey && "privateKey" in ephemeralKey) {
-    const candidate = ephemeralKey;
-    if (!candidate.publicKey || !candidate.privateKey) {
-      throw new TypeError(
-        "ECDH-ES custom ephemeral key must include both publicKey and privateKey."
-      );
-    }
-    epk = candidate.publicKey;
-    epkPrivateKey = candidate.privateKey;
-  } else if (isCryptoKey(ephemeralKey)) {
-    if (ephemeralKey.type !== "private") {
-      throw new TypeError(
-        "ECDH-ES custom ephemeral CryptoKey must include private key material."
-      );
-    }
-    epk = ephemeralKey;
-    epkPrivateKey = ephemeralKey;
-  } else if (isJWK(ephemeralKey)) {
-    if (!("d" in ephemeralKey) || typeof ephemeralKey.d !== "string") {
-      throw new TypeError(
-        'ECDH-ES custom ephemeral JWK must include private parameter "d".'
-      );
-    }
-    epk = ephemeralKey;
-    epkPrivateKey = ephemeralKey;
-  } else {
-    throw new TypeError(
-      "Unsupported ECDH-ES ephemeral key material provided in options."
-    );
-  }
-  return {
-    epk,
-    epkPrivateKey
-  };
-}
-
-const jwe = {
-  __proto__: null,
-  decrypt: decrypt,
-  encrypt: encrypt
-};
-
-export { decrypt as d, encrypt as e, jwe as j };

package/dist/shared/unjwt.BCi3FEWr.d.mts

@@ -1,328 +0,0 @@
-/** Structure returned for composite AES-CBC + HMAC keys. */
-type CompositeKey = {
-    /** The AES-CBC encryption/decryption key. */
-    encryptionKey: CryptoKey;
-    /** The HMAC key for integrity/authentication. */
-    macKey: CryptoKey;
-};
-type GenerateKeyAlgorithm = Exclude<JWKAlgorithm, "none" | "dir" | JWK_PBES2>;
-/** Options for the generateKey function. */
-interface GenerateKeyOptions {
-    /** Key usages for the generated key(s). Note: For composite keys (CBC), default usages are applied separately. */
-    keyUsage?: KeyUsage[];
-    /** Mark the key(s) as extractable. Defaults to true. */
-    extractable?: boolean;
-    /** RSA modulus length. Defaults to 2048. */
-    modulusLength?: number;
-    /** RSA public exponent. Defaults to 65537 (0x010001). */
-    publicExponent?: Uint8Array<ArrayBuffer>;
-    /** Named curve for EC or OKP keys. Defaults to "P-256" for EC and "Ed25519" for OKP. */
-    namedCurve?: "P-256" | "P-384" | "P-521" | "X25519" | "Ed25519" | "Ed448";
-    /** Export the generated key(s) as JWK. If true, the key(s) will be returned in JWK format. */
-    toJWK?: undefined | boolean | Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">;
-}
-type GenerateKeyReturnJWK<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_Asymmetric_Algorithm ? TAlg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC ? {
-    privateKey: JWK_RSA_Private;
-    publicKey: JWK_RSA_Public;
-} : TAlg extends JWK_ECDSA | JWK_ECDH_ES ? {
-    privateKey: JWK_EC_Private;
-    publicKey: JWK_EC_Public;
-} : TAlg extends JWK_OKP_SIGN ? {
-    privateKey: JWK_OKP_Private;
-    publicKey: JWK_OKP_Public;
-} : never : TAlg extends JWK_AES_CBC_HMAC | JWK_Symmetric_Algorithm ? JWK_oct : never;
-type GenerateKeyReturnCrypto<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_AES_CBC_HMAC ? Uint8Array<ArrayBuffer> : TAlg extends JWK_Asymmetric_Algorithm ? CryptoKeyPair : CryptoKey;
-type GenerateKeyReturn<TAlg extends GenerateKeyAlgorithm, TOptions extends GenerateKeyOptions> = TOptions["toJWK"] extends true ? GenerateKeyReturnJWK<TAlg> : TOptions["toJWK"] extends object ? GenerateKeyReturnJWK<TAlg> : GenerateKeyReturnCrypto<TAlg>;
-type GenerateJWKOptions = Omit<GenerateKeyOptions, "toJWK">;
-type GenerateJWKReturn<TAlg extends GenerateKeyAlgorithm> = GenerateKeyReturnJWK<TAlg>;
-/** Options for the deriveKeyFromPassword function. */
-interface DeriveKeyOptions {
-    /** Salt value (p2s). Must be at least 8 bytes. */
-    salt: Uint8Array<ArrayBuffer>;
-    /** Iteration count (p2c). Must be a positive integer. */
-    iterations: number;
-    /** Key usages for the derived key. Defaults to ["wrapKey", "unwrapKey"]. */
-    keyUsage?: KeyUsage[];
-    /** Mark the derived key as extractable. Defaults to false. */
-    extractable?: boolean;
-    /** Export the derived key as JWK. If true, the key will be returned in JWK_oct format. */
-    toJWK?: undefined | boolean | Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">;
-}
-type DeriveKeyReturn<TOptions extends DeriveKeyOptions> = TOptions["toJWK"] extends true ? JWK_oct : TOptions["toJWK"] extends object ? JWK_oct : CryptoKey;
-type KeyManagementAlgorithm = JWK_RSA_ENC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_PBES2 | JWK_ECDH_ES;
-type ContentEncryptionAlgorithm = JWK_AES_GCM | JWK_AES_CBC_HMAC;
-/** Options for the wrapKey function. */
-interface WrapKeyOptions {
-    /** Initialization Vector for AES-GCMKW. Generated if not provided. */
-    iv?: Uint8Array<ArrayBuffer>;
-    /** PBES2 Salt value (p2s). Required for PBES2 algorithms. */
-    p2s?: Uint8Array<ArrayBuffer>;
-    /** PBES2 Iteration count (p2c). Required for PBES2 algorithms. */
-    p2c?: number;
-    /** ECDH-ES Ephemeral Public Key. Generated if not provided for ECDH-ES. */
-    epk?: JWK_EC_Public;
-    /** ECDH-ES Agreement PartyUInfo. */
-    apu?: Uint8Array<ArrayBuffer>;
-    /** ECDH-ES Agreement PartyVInfo. */
-    apv?: Uint8Array<ArrayBuffer>;
-}
-/** Result of the wrapKey function. */
-interface WrapKeyResult {
-    /** The wrapped key (Ciphertext). */
-    encryptedKey: Uint8Array<ArrayBuffer>;
-    /** Initialization Vector used (only for AES-GCMKW). Base64URL encoded. */
-    iv?: string;
-    /** Authentication Tag generated (only for AES-GCMKW). Base64URL encoded. */
-    tag?: string;
-    /** PBES2 Salt value used (only for PBES2). Base64URL encoded. */
-    p2s?: string;
-    /** PBES2 Iteration count used (only for PBES2). */
-    p2c?: number;
-    /** ECDH-ES Ephemeral Public Key used (only for ECDH-ES). */
-    epk?: JWK_EC_Public;
-    /** ECDH-ES Agreement PartyUInfo used (only for ECDH-ES). Base64URL encoded. */
-    apu?: string;
-    /** ECDH-ES Agreement PartyVInfo used (only for ECDH-ES). Base64URL encoded. */
-    apv?: string;
-}
-/** Options for the unwrapKey function. */
-interface UnwrapKeyOptions {
-    /** Initialization Vector (required for AES-GCMKW). Base64URL encoded or Uint8Array. */
-    iv?: Uint8Array<ArrayBuffer> | string;
-    /** Authentication Tag (required for AES-GCMKW). Base64URL encoded or Uint8Array. */
-    tag?: Uint8Array<ArrayBuffer> | string;
-    /** PBES2 Salt value (required for PBES2). Base64URL encoded or Uint8Array. */
-    p2s?: Uint8Array<ArrayBuffer> | string;
-    /** PBES2 Iteration count (required for PBES2). */
-    p2c?: number;
-    /** ECDH-ES Ephemeral Public Key (required for ECDH-ES). */
-    epk?: JWK_EC_Public | CryptoKey;
-    /** ECDH-ES Agreement PartyUInfo. Base64URL encoded or Uint8Array. */
-    apu?: Uint8Array<ArrayBuffer> | string;
-    /** ECDH-ES Agreement PartyVInfo. Base64URL encoded or Uint8Array. */
-    apv?: Uint8Array<ArrayBuffer> | string;
-    /** Content Encryption Algorithm used with ECDH-ES (required for direct key agreement). */
-    enc?: ContentEncryptionAlgorithm;
-    /** Expected unwrapped key algorithm (e.g., 'AES-GCM', 'AES-CBC'). Used by crypto.subtle.unwrapKey. */
-    unwrappedKeyAlgorithm?: string | Algorithm | RsaOaepParams | AesCtrParams | AesCbcParams | AesGcmParams;
-    /** Expected key usages for the unwrapped key. */
-    keyUsage?: KeyUsage[];
-    /** Mark the unwrapped key as extractable. Defaults to true. */
-    extractable?: boolean;
-    returnAs?: boolean | undefined;
-}
-/**
- * Forked from https://github.com/panva/jose/tree/v6.0.10
- * Copyright (c) 2018 Filip Skokan.
- * LICENSE: https://github.com/panva/jose/blob/v6.0.10/LICENSE.md
- */
-/** Generic JSON Web Key Parameters. */
-interface JWKParameters {
-    /** JWK "kty" (Key Type) Parameter */
-    kty: string;
-    /**
-     * JWK "alg" (Algorithm) Parameter
-     *
-     * @see {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}
-     */
-    alg?: string;
-    /** JWK "key_ops" (Key Operations) Parameter */
-    key_ops?: KeyUsage[];
-    /** JWK "ext" (Extractable) Parameter */
-    ext?: boolean;
-    /** JWK "use" (Public Key Use) Parameter */
-    use?: string;
-    /** JWK "x5c" (X.509 Certificate Chain) Parameter */
-    x5c?: string[];
-    /** JWK "x5t" (X.509 Certificate SHA-1 Thumbprint) Parameter */
-    x5t?: string;
-    /** JWK "x5t#S256" (X.509 Certificate SHA-256 Thumbprint) Parameter */
-    "x5t#S256"?: string;
-    /** JWK "x5u" (X.509 URL) Parameter */
-    x5u?: string;
-    /** JWK "kid" (Key ID) Parameter */
-    kid?: string;
-}
-/** Public EC JSON Web Keys */
-interface JWK_EC_Public extends JWKParameters {
-    /** EC JWK "kty" (Key Type) Parameter */
-    kty: "EC";
-    /** EC JWK "crv" (Curve) Parameter */
-    crv: string;
-    /** EC JWK "x" (X Coordinate) Parameter */
-    x: string;
-    /** EC JWK "y" (Y Coordinate) Parameter */
-    y: string;
-}
-/** Private EC JSON Web Keys */
-interface JWK_EC_Private extends JWK_EC_Public {
-    /** EC JWK "d" (ECC Private Key) Parameter */
-    d: string;
-}
-/** EC JSON Web Keys */
-type JWK_EC = JWK_EC_Public | JWK_EC_Private;
-/** Public RSA JSON Web Keys */
-interface JWK_RSA_Public extends JWKParameters {
-    /** RSA JWK "kty" (Key Type) Parameter */
-    kty: "RSA";
-    /** RSA JWK "e" (Exponent) Parameter */
-    e: string;
-    /** RSA JWK "n" (Modulus) Parameter */
-    n: string;
-    oth?: RsaOtherPrimesInfo[];
-}
-/** Private RSA JSON Web Keys */
-interface JWK_RSA_Private extends JWK_RSA_Public {
-    /** RSA JWK "d" (Private Exponent) Parameter */
-    d: string;
-    /** RSA JWK "dp" (First Factor CRT Exponent) Parameter */
-    dp: string;
-    /** RSA JWK "dq" (Second Factor CRT Exponent) Parameter */
-    dq: string;
-    /** RSA JWK "p" (First Prime Factor) Parameter */
-    p: string;
-    /** RSA JWK "q" (Second Prime Factor) Parameter */
-    q: string;
-    /** RSA JWK "qi" (First CRT Coefficient) Parameter */
-    qi: string;
-}
-/** RSA JSON Web Keys */
-type JWK_RSA = JWK_RSA_Public | JWK_RSA_Private;
-/** Public ED JSON Web Keys */
-interface JWK_OKP_Public extends JWKParameters {
-    /** ED JWK "kty" (Key Type) Parameter */
-    kty: "OKP";
-    /** ED JWK "crv" (Curve) Parameter */
-    crv: string;
-    /** ED JWK "x" (X Coordinate) Parameter */
-    x: string;
-}
-/** Private ED JSON Web Keys */
-interface JWK_OKP_Private extends JWK_OKP_Public {
-    /** ED JWK "d" (Private Key) Parameter */
-    d: string;
-}
-/** OKP JSON Web Keys */
-type JWK_OKP = JWK_OKP_Public | JWK_OKP_Private;
-/** oct JSON Web Keys */
-interface JWK_oct extends JWKParameters {
-    /** Oct JWK "k" (Key Value) Parameter */
-    k: string;
-}
-/** Symmetric JSON Web Keys */
-type JWK_Symmetric = JWK_oct;
-/** Asymmetric JSON Web Keys */
-type JWK_Asymmetric = JWK_RSA | JWK_EC | JWK_OKP;
-/** Public JSON Web Keys */
-type JWK_Public = JWK_RSA_Public | JWK_EC_Public | JWK_OKP_Public;
-/** Private JSON Web Keys */
-type JWK_Private = JWK_RSA_Private | JWK_EC_Private | JWK_OKP_Private;
-/**
- * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC", "OKP" and "oct" key types are supported.
- */
-type JWK = JWK_oct | JWK_RSA | JWK_EC | JWK_OKP;
-/**
- * JSON Web Key Set ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK Set}). "RSA", "EC" and "oct" key types are supported.
- */
-interface JWKSet {
-    /** JWK Set "keys" Parameter */
-    keys: JWK[];
-    [parameter: string]: unknown;
-}
-/** JWK Key Algorithms */
-type JWK_HMAC = "HS256" | "HS384" | "HS512";
-type JWK_RSA_SIGN = "RS256" | "RS384" | "RS512";
-type JWK_RSA_PSS = "PS256" | "PS384" | "PS512";
-type JWK_ECDSA = "ES256" | "ES384" | "ES512";
-type JWK_RSA_ENC = "RSA-OAEP" | "RSA-OAEP-256" | "RSA-OAEP-384" | "RSA-OAEP-512";
-type JWK_AES_KW = "A128KW" | "A192KW" | "A256KW";
-type JWK_AES_CBC_HMAC = "A128CBC-HS256" | "A192CBC-HS384" | "A256CBC-HS512";
-type JWK_AES_GCM = "A128GCM" | "A192GCM" | "A256GCM";
-type JWK_AES_GCM_KW = "A128GCMKW" | "A192GCMKW" | "A256GCMKW";
-type JWK_PBES2 = "PBES2-HS256+A128KW" | "PBES2-HS384+A192KW" | "PBES2-HS512+A256KW";
-type JWK_ECDH_ES = "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A192KW" | "ECDH-ES+A256KW";
-type JWK_OKP_SIGN = "Ed25519" | "EdDSA";
-type JWK_Symmetric_Algorithm = JWK_HMAC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW;
-type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA_ENC | JWK_OKP_SIGN | JWK_ECDH_ES;
-type JWKAlgorithm = JWK_Symmetric_Algorithm | JWK_Asymmetric_Algorithm | JWK_AES_CBC_HMAC | JWK_PBES2 | JWK_ECDH_ES | ("none" | "dir");
-type JWKPEMAlgorithm = JWK_RSA_PSS | JWK_RSA_SIGN | JWK_RSA_ENC | JWK_ECDSA | JWK_ECDH_ES | JWK_OKP_SIGN;
-
-/** Header Parameters common to JWE and JWS */
-interface JoseHeaderParameters {
-    /** "kid" (Key ID) Header Parameter */
-    kid?: string;
-    /** "x5t" (X.509 Certificate SHA-1 Thumbprint) Header Parameter */
-    x5t?: string;
-    /** "x5c" (X.509 Certificate Chain) Header Parameter */
-    x5c?: string[];
-    /** "x5u" (X.509 URL) Header Parameter */
-    x5u?: string;
-    /** "jku" (JWK Set URL) Header Parameter */
-    jku?: string;
-    /** "jwk" (JSON Web Key) Header Parameter */
-    jwk?: JWK_Public;
-    /** "typ" (Type) Header Parameter */
-    typ?: string;
-    /** "cty" (Content Type) Header Parameter */
-    cty?: string;
-    /** "crit" (Critical) Header Parameter */
-    crit?: string[];
-    /** Any other JWS/JWE Header member. */
-    [propName: string]: unknown;
-}
-interface JWTClaims {
-    /** "iss" (Issuer) Claim */
-    iss?: string;
-    /** "sub" (Subject) Claim */
-    sub?: string;
-    /** "aud" (Audience) Claim */
-    aud?: string | string[];
-    /** "exp" (Expiration Time) Claim */
-    exp?: number;
-    /** "nbf" (Not Before) Claim */
-    nbf?: number;
-    /** "iat" (Issued At) Claim */
-    iat?: number;
-    /** "jti" (JWT ID) Claim */
-    jti?: string;
-    /** Any other JWT member. */
-    [propName: string]: unknown;
-}
-interface JWT<T = JWTClaims> {
-    header: JoseHeaderParameters & {
-        /** "alg" (Algorithm) Header Parameter */
-        alg: string;
-    };
-    claims: T;
-}
-interface JWTClaimValidationOptions {
-    /** Expected JWT "aud" (Audience) Claim value(s). Implies presence requirement. */
-    audience?: string | string[];
-    /** Expected JWT "iss" (Issuer) Claim value(s). Implies presence requirement. */
-    issuer?: string | string[];
-    /** Expected JWT "sub" (Subject) Claim value. Implies presence requirement. */
-    subject?: string;
-    /** Maximum token age, from the JWT "iat" (Issued At) Claim value. Implies presence requirement. */
-    maxTokenAge?: MaxTokenAge;
-    /** Clock skew tolerance (in seconds) for validating time-based claims (nbf/exp/iat). */
-    clockTolerance?: number;
-    /** Expected JWT "typ" (Type) Header Parameter value. Implies presence requirement. */
-    typ?: string;
-    /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
-    currentDate?: Date;
-    /** Additional required claim names. */
-    requiredClaims?: string[];
-    /** List of critical header parameters that must be understood and processed. */
-    requiredHeaders?: string[];
-    /**
-     * Critical Header Parameters to be understood and processed.
-     * If the JWT contains critical headers not in this list (and not inherently understood by the library), decryption will fail.
-     * @deprecated use {@link requiredHeaders `recognizedHeaders` option} instead.
-     */
-    critical?: string[];
-}
-
-type ExpiresIn = number | `${number}` | `${number}${"s" | "second" | "seconds" | "m" | "minute" | "minutes" | "h" | "hour" | "hours" | "D" | "day" | "days" | "W" | "week" | "weeks" | "M" | "month" | "months" | "Y" | "year" | "years"}`;
-type MaxTokenAge = ExpiresIn;
-
-export type { JWK_ECDSA as A, JWK_RSA_ENC as B, CompositeKey as C, DeriveKeyOptions as D, ExpiresIn as E, JWK_AES_KW as F, GenerateKeyAlgorithm as G, JWK_AES_CBC_HMAC as H, JWK_AES_GCM as I, JWKParameters as J, KeyManagementAlgorithm as K, JWK_AES_GCM_KW as L, MaxTokenAge as M, JWK_PBES2 as N, JWK_ECDH_ES as O, JWK_OKP_SIGN as P, JWK_Symmetric_Algorithm as Q, JWK_Asymmetric_Algorithm as R, JWKAlgorithm as S, JWKPEMAlgorithm as T, UnwrapKeyOptions as U, JoseHeaderParameters as V, WrapKeyOptions as W, JWTClaims as X, JWT as Y, JWTClaimValidationOptions as Z, GenerateKeyOptions as a, GenerateKeyReturn as b, GenerateJWKOptions as c, GenerateJWKReturn as d, DeriveKeyReturn as e, ContentEncryptionAlgorithm as f, WrapKeyResult as g, JWK_EC_Public as h, JWK_EC_Private as i, JWK_EC as j, JWK_RSA_Public as k, JWK_RSA_Private as l, JWK_RSA as m, JWK_OKP_Public as n, JWK_OKP_Private as o, JWK_OKP as p, JWK_oct as q, JWK_Symmetric as r, JWK_Asymmetric as s, JWK_Public as t, JWK_Private as u, JWK as v, JWKSet as w, JWK_HMAC as x, JWK_RSA_SIGN as y, JWK_RSA_PSS as z };