unjwt 0.5.38 → 0.5.40

package/dist/_chunks/jwk.d.mts

@@ -0,0 +1,611 @@
+//#region src/core/types/jwk.d.ts
+/** Structure returned for composite AES-CBC + HMAC keys. */
+type CompositeKey = {
+  /** The AES-CBC encryption/decryption key. */encryptionKey: CryptoKey; /** The HMAC key for integrity/authentication. */
+  macKey: CryptoKey;
+};
+type GenerateKeyAlgorithm = Exclude<JWKAlgorithm, "none" | "dir" | JWK_PBES2>;
+/** Options for the generateKey function. */
+interface GenerateKeyOptions {
+  /** Key usages for the generated key(s). Note: For composite keys (CBC), default usages are applied separately. */
+  keyUsage?: KeyUsage[];
+  /** Mark the key(s) as extractable. Defaults to true. */
+  extractable?: boolean;
+  /** RSA modulus length. Defaults to 2048. */
+  modulusLength?: number;
+  /** RSA public exponent. Defaults to 65537 (0x010001). */
+  publicExponent?: Uint8Array<ArrayBuffer>;
+  /** Named curve for EC or OKP keys. Defaults to "P-256" for EC and "Ed25519" for OKP. */
+  namedCurve?: "P-256" | "P-384" | "P-521" | "X25519" | "Ed25519" | "Ed448";
+  /** Export the generated key(s) as JWK. If true, the key(s) will be returned in JWK format. */
+  toJWK?: undefined | boolean | Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">;
+}
+type GenerateKeyReturnJWK<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_Asymmetric_Algorithm ? TAlg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC ? {
+  privateKey: JWK_RSA_Private;
+  publicKey: JWK_RSA_Public;
+} : TAlg extends JWK_ECDSA | JWK_ECDH_ES ? {
+  privateKey: JWK_EC_Private;
+  publicKey: JWK_EC_Public;
+} : TAlg extends JWK_OKP_SIGN ? {
+  privateKey: JWK_OKP_Private;
+  publicKey: JWK_OKP_Public;
+} : never : TAlg extends JWK_AES_CBC_HMAC | JWK_Symmetric_Algorithm ? JWK_oct : never;
+type GenerateKeyReturnCrypto<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_AES_CBC_HMAC ? Uint8Array<ArrayBuffer> : TAlg extends JWK_Asymmetric_Algorithm ? CryptoKeyPair : CryptoKey;
+type GenerateKeyReturn<TAlg extends GenerateKeyAlgorithm, TOptions extends GenerateKeyOptions> = TOptions["toJWK"] extends true ? GenerateKeyReturnJWK<TAlg> : TOptions["toJWK"] extends object ? GenerateKeyReturnJWK<TAlg> : GenerateKeyReturnCrypto<TAlg>;
+type GenerateJWKOptions = Omit<GenerateKeyOptions, "toJWK">;
+type GenerateJWKReturn<TAlg extends GenerateKeyAlgorithm> = GenerateKeyReturnJWK<TAlg>;
+/** Options for the deriveKeyFromPassword function. */
+interface DeriveKeyOptions {
+  /** Salt value (p2s). Must be at least 8 bytes. */
+  salt: Uint8Array<ArrayBuffer>;
+  /** Iteration count (p2c). Must be a positive integer. */
+  iterations: number;
+  /** Key usages for the derived key. Defaults to ["wrapKey", "unwrapKey"]. */
+  keyUsage?: KeyUsage[];
+  /** Mark the derived key as extractable. Defaults to false. */
+  extractable?: boolean;
+  /** Export the derived key as JWK. If true, the key will be returned in JWK_oct format. */
+  toJWK?: undefined | boolean | Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">;
+}
+type DeriveKeyReturn<TOptions extends DeriveKeyOptions> = TOptions["toJWK"] extends true ? JWK_oct : TOptions["toJWK"] extends object ? JWK_oct : CryptoKey;
+type KeyManagementAlgorithm = JWK_RSA_ENC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_PBES2 | JWK_ECDH_ES;
+type ContentEncryptionAlgorithm = JWK_AES_GCM | JWK_AES_CBC_HMAC;
+/** Options for the wrapKey function. */
+interface WrapKeyOptions {
+  /** Initialization Vector for AES-GCMKW. Generated if not provided. */
+  iv?: Uint8Array<ArrayBuffer>;
+  /** PBES2 Salt value (p2s). Required for PBES2 algorithms. */
+  p2s?: Uint8Array<ArrayBuffer>;
+  /** PBES2 Iteration count (p2c). Required for PBES2 algorithms. */
+  p2c?: number;
+  /** ECDH-ES Ephemeral Public Key. Generated if not provided for ECDH-ES. */
+  epk?: JWK_EC_Public;
+  /** ECDH-ES Agreement PartyUInfo. */
+  apu?: Uint8Array<ArrayBuffer>;
+  /** ECDH-ES Agreement PartyVInfo. */
+  apv?: Uint8Array<ArrayBuffer>;
+}
+/** Result of the wrapKey function. */
+interface WrapKeyResult {
+  /** The wrapped key (Ciphertext). */
+  encryptedKey: Uint8Array<ArrayBuffer>;
+  /** Initialization Vector used (only for AES-GCMKW). Base64URL encoded. */
+  iv?: string;
+  /** Authentication Tag generated (only for AES-GCMKW). Base64URL encoded. */
+  tag?: string;
+  /** PBES2 Salt value used (only for PBES2). Base64URL encoded. */
+  p2s?: string;
+  /** PBES2 Iteration count used (only for PBES2). */
+  p2c?: number;
+  /** ECDH-ES Ephemeral Public Key used (only for ECDH-ES). */
+  epk?: JWK_EC_Public;
+  /** ECDH-ES Agreement PartyUInfo used (only for ECDH-ES). Base64URL encoded. */
+  apu?: string;
+  /** ECDH-ES Agreement PartyVInfo used (only for ECDH-ES). Base64URL encoded. */
+  apv?: string;
+}
+/** Options for the unwrapKey function. */
+interface UnwrapKeyOptions {
+  /** Initialization Vector (required for AES-GCMKW). Base64URL encoded or Uint8Array. */
+  iv?: Uint8Array<ArrayBuffer> | string;
+  /** Authentication Tag (required for AES-GCMKW). Base64URL encoded or Uint8Array. */
+  tag?: Uint8Array<ArrayBuffer> | string;
+  /** PBES2 Salt value (required for PBES2). Base64URL encoded or Uint8Array. */
+  p2s?: Uint8Array<ArrayBuffer> | string;
+  /** PBES2 Iteration count (required for PBES2). */
+  p2c?: number;
+  /** ECDH-ES Ephemeral Public Key (required for ECDH-ES). */
+  epk?: JWK_EC_Public | CryptoKey;
+  /** ECDH-ES Agreement PartyUInfo. Base64URL encoded or Uint8Array. */
+  apu?: Uint8Array<ArrayBuffer> | string;
+  /** ECDH-ES Agreement PartyVInfo. Base64URL encoded or Uint8Array. */
+  apv?: Uint8Array<ArrayBuffer> | string;
+  /** Content Encryption Algorithm used with ECDH-ES (required for direct key agreement). */
+  enc?: ContentEncryptionAlgorithm;
+  /** Expected unwrapped key algorithm (e.g., 'AES-GCM', 'AES-CBC'). Used by crypto.subtle.unwrapKey. */
+  unwrappedKeyAlgorithm?: string | Algorithm | RsaOaepParams | AesCtrParams | AesCbcParams | AesGcmParams;
+  /** Expected key usages for the unwrapped key. */
+  keyUsage?: KeyUsage[];
+  /** Mark the unwrapped key as extractable. Defaults to true. */
+  extractable?: boolean;
+  returnAs?: boolean | undefined;
+}
+/**
+* Forked from https://github.com/panva/jose/tree/v6.0.10
+* Copyright (c) 2018 Filip Skokan.
+* LICENSE: https://github.com/panva/jose/blob/v6.0.10/LICENSE.md
+*/
+/** Generic JSON Web Key Parameters. */
+interface JWKParameters {
+  /** JWK "kty" (Key Type) Parameter */
+  kty: string;
+  /**
+  * JWK "alg" (Algorithm) Parameter
+  *
+  * @see {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}
+  */
+  alg?: string;
+  /** JWK "key_ops" (Key Operations) Parameter */
+  key_ops?: KeyUsage[];
+  /** JWK "ext" (Extractable) Parameter */
+  ext?: boolean;
+  /** JWK "use" (Public Key Use) Parameter */
+  use?: string;
+  /** JWK "x5c" (X.509 Certificate Chain) Parameter */
+  x5c?: string[];
+  /** JWK "x5t" (X.509 Certificate SHA-1 Thumbprint) Parameter */
+  x5t?: string;
+  /** JWK "x5t#S256" (X.509 Certificate SHA-256 Thumbprint) Parameter */
+  "x5t#S256"?: string;
+  /** JWK "x5u" (X.509 URL) Parameter */
+  x5u?: string;
+  /** JWK "kid" (Key ID) Parameter */
+  kid?: string;
+}
+/** Public EC JSON Web Keys */
+interface JWK_EC_Public extends JWKParameters {
+  /** EC JWK "kty" (Key Type) Parameter */
+  kty: "EC";
+  /** EC JWK "crv" (Curve) Parameter */
+  crv: string;
+  /** EC JWK "x" (X Coordinate) Parameter */
+  x: string;
+  /** EC JWK "y" (Y Coordinate) Parameter */
+  y: string;
+}
+/** Private EC JSON Web Keys */
+interface JWK_EC_Private extends JWK_EC_Public {
+  /** EC JWK "d" (ECC Private Key) Parameter */
+  d: string;
+}
+/** EC JSON Web Keys */
+type JWK_EC = JWK_EC_Public | JWK_EC_Private;
+/** Public RSA JSON Web Keys */
+interface JWK_RSA_Public extends JWKParameters {
+  /** RSA JWK "kty" (Key Type) Parameter */
+  kty: "RSA";
+  /** RSA JWK "e" (Exponent) Parameter */
+  e: string;
+  /** RSA JWK "n" (Modulus) Parameter */
+  n: string;
+  oth?: RsaOtherPrimesInfo[];
+}
+/** Private RSA JSON Web Keys */
+interface JWK_RSA_Private extends JWK_RSA_Public {
+  /** RSA JWK "d" (Private Exponent) Parameter */
+  d: string;
+  /** RSA JWK "dp" (First Factor CRT Exponent) Parameter */
+  dp: string;
+  /** RSA JWK "dq" (Second Factor CRT Exponent) Parameter */
+  dq: string;
+  /** RSA JWK "p" (First Prime Factor) Parameter */
+  p: string;
+  /** RSA JWK "q" (Second Prime Factor) Parameter */
+  q: string;
+  /** RSA JWK "qi" (First CRT Coefficient) Parameter */
+  qi: string;
+}
+/** RSA JSON Web Keys */
+type JWK_RSA = JWK_RSA_Public | JWK_RSA_Private;
+/** Public ED JSON Web Keys */
+interface JWK_OKP_Public extends JWKParameters {
+  /** ED JWK "kty" (Key Type) Parameter */
+  kty: "OKP";
+  /** ED JWK "crv" (Curve) Parameter */
+  crv: string;
+  /** ED JWK "x" (X Coordinate) Parameter */
+  x: string;
+}
+/** Private ED JSON Web Keys */
+interface JWK_OKP_Private extends JWK_OKP_Public {
+  /** ED JWK "d" (Private Key) Parameter */
+  d: string;
+}
+/** OKP JSON Web Keys */
+type JWK_OKP = JWK_OKP_Public | JWK_OKP_Private;
+/** oct JSON Web Keys */
+interface JWK_oct extends JWKParameters {
+  /** Oct JWK "k" (Key Value) Parameter */
+  k: string;
+}
+/** Symmetric JSON Web Keys */
+type JWK_Symmetric = JWK_oct;
+/** Asymmetric JSON Web Keys */
+type JWK_Asymmetric = JWK_RSA | JWK_EC | JWK_OKP;
+/** Public JSON Web Keys */
+type JWK_Public = JWK_RSA_Public | JWK_EC_Public | JWK_OKP_Public;
+/** Private JSON Web Keys */
+type JWK_Private = JWK_RSA_Private | JWK_EC_Private | JWK_OKP_Private;
+/**
+* JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC", "OKP" and "oct" key types are supported.
+*/
+type JWK = JWK_oct | JWK_RSA | JWK_EC | JWK_OKP;
+/**
+* A pair of public and private JSON Web Keys.
+*/
+type JWK_Pair = {
+  publicKey: JWK_RSA_Public;
+  privateKey: JWK_RSA_Private;
+} | {
+  publicKey: JWK_EC_Public;
+  privateKey: JWK_EC_Private;
+} | {
+  publicKey: JWK_OKP_Public;
+  privateKey: JWK_OKP_Private;
+};
+/**
+* JSON Web Key Set ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK Set}). "RSA", "EC" and "oct" key types are supported.
+*/
+interface JWKSet {
+  /** JWK Set "keys" Parameter */
+  keys: JWK[];
+  [parameter: string]: unknown;
+}
+/** JWK Key Algorithms */
+type JWK_HMAC = "HS256" | "HS384" | "HS512";
+type JWK_RSA_SIGN = "RS256" | "RS384" | "RS512";
+type JWK_RSA_PSS = "PS256" | "PS384" | "PS512";
+type JWK_ECDSA = "ES256" | "ES384" | "ES512";
+type JWK_RSA_ENC = "RSA-OAEP" | "RSA-OAEP-256" | "RSA-OAEP-384" | "RSA-OAEP-512";
+type JWK_AES_KW = "A128KW" | "A192KW" | "A256KW";
+type JWK_AES_CBC_HMAC = "A128CBC-HS256" | "A192CBC-HS384" | "A256CBC-HS512";
+type JWK_AES_GCM = "A128GCM" | "A192GCM" | "A256GCM";
+type JWK_AES_GCM_KW = "A128GCMKW" | "A192GCMKW" | "A256GCMKW";
+type JWK_PBES2 = "PBES2-HS256+A128KW" | "PBES2-HS384+A192KW" | "PBES2-HS512+A256KW";
+type JWK_ECDH_ES = "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A192KW" | "ECDH-ES+A256KW";
+type JWK_OKP_SIGN = "Ed25519" | "EdDSA";
+type JWK_Symmetric_Algorithm = JWK_HMAC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW;
+type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA_ENC | JWK_OKP_SIGN | JWK_ECDH_ES;
+type JWKAlgorithm = JWK_Symmetric_Algorithm | JWK_Asymmetric_Algorithm | JWK_AES_CBC_HMAC | JWK_PBES2 | JWK_ECDH_ES | ("none" | "dir");
+type JWKPEMAlgorithm = JWK_RSA_PSS | JWK_RSA_SIGN | JWK_RSA_ENC | JWK_ECDSA | JWK_ECDH_ES | JWK_OKP_SIGN;
+//#endregion
+//#region src/core/types/jwt.d.ts
+/** Header Parameters common to JWE and JWS */
+interface JoseHeaderParameters {
+  /** "kid" (Key ID) Header Parameter */
+  kid?: string;
+  /** "x5t" (X.509 Certificate SHA-1 Thumbprint) Header Parameter */
+  x5t?: string;
+  /** "x5c" (X.509 Certificate Chain) Header Parameter */
+  x5c?: string[];
+  /** "x5u" (X.509 URL) Header Parameter */
+  x5u?: string;
+  /** "jku" (JWK Set URL) Header Parameter */
+  jku?: string;
+  /** "jwk" (JSON Web Key) Header Parameter */
+  jwk?: JWK_Public;
+  /** "typ" (Type) Header Parameter */
+  typ?: string;
+  /** "cty" (Content Type) Header Parameter */
+  cty?: string;
+  /** "crit" (Critical) Header Parameter */
+  crit?: string[];
+  /** Any other JWS/JWE Header member. */
+  [propName: string]: unknown;
+}
+interface JWTClaims {
+  /** "iss" (Issuer) Claim */
+  iss?: string;
+  /** "sub" (Subject) Claim */
+  sub?: string;
+  /** "aud" (Audience) Claim */
+  aud?: string | string[];
+  /** "exp" (Expiration Time) Claim */
+  exp?: number;
+  /** "nbf" (Not Before) Claim */
+  nbf?: number;
+  /** "iat" (Issued At) Claim */
+  iat?: number;
+  /** "jti" (JWT ID) Claim */
+  jti?: string;
+  /** Any other JWT member. */
+  [propName: string]: unknown;
+}
+interface JWT<T = JWTClaims> {
+  header: JoseHeaderParameters & {
+    /** "alg" (Algorithm) Header Parameter */alg: string;
+  };
+  claims: T;
+}
+interface JWTClaimValidationOptions {
+  /** Expected JWT "aud" (Audience) Claim value(s). Implies presence requirement. */
+  audience?: string | string[];
+  /** Expected JWT "iss" (Issuer) Claim value(s). Implies presence requirement. */
+  issuer?: string | string[];
+  /** Expected JWT "sub" (Subject) Claim value. Implies presence requirement. */
+  subject?: string;
+  /** Maximum token age, from the JWT "iat" (Issued At) Claim value. Implies presence requirement. */
+  maxTokenAge?: MaxTokenAge;
+  /** Clock skew tolerance (in seconds) for validating time-based claims (nbf/exp/iat). */
+  clockTolerance?: number;
+  /** Expected JWT "typ" (Type) Header Parameter value. Implies presence requirement. */
+  typ?: string;
+  /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
+  currentDate?: Date;
+  /** Additional required claim names. */
+  requiredClaims?: string[];
+  /** List of critical header parameters that must be understood and processed. */
+  requiredHeaders?: string[];
+  /**
+  * Critical Header Parameters to be understood and processed.
+  * If the JWT contains critical headers not in this list (and not inherently understood by the library), decryption will fail.
+  * @deprecated use {@link requiredHeaders `recognizedHeaders` option} instead.
+  */
+  critical?: string[];
+}
+//#endregion
+//#region src/core/types/jws.d.ts
+type JWS_SIGN_EXTRA = "Ed25519" | "EdDSA";
+/** JWS Signing Algorithm Identifier. */
+type JWSAlgorithm = JWK_HMAC | JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWS_SIGN_EXTRA;
+/** Recognized JWS Header Parameters, any other Header Members may also be present. */
+interface JWSHeaderParameters extends JoseHeaderParameters {
+  /** JWS "alg" (Algorithm) Header Parameter */
+  alg?: JWSAlgorithm;
+  /**
+  * This JWS Extension Header Parameter modifies the JWS Payload representation and the JWS Signing
+  * Input computation as per {@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}.
+  * If `false`, the payload is used directly without Base64URL encoding.
+  * Defaults to `true`.
+  */
+  b64?: boolean;
+}
+/** JWS Protected Header */
+interface JWSProtectedHeader extends JWSHeaderParameters {
+  alg: JWSAlgorithm;
+}
+/**
+* JWS (JSON Web Signature) options for signing
+*/
+interface JWSSignOptions {
+  /** The JWS Algorithm to use. Must be provided. */
+  alg?: JWSAlgorithm;
+  /**
+  * Additional protected header parameters. `alg` is automatically included.
+  * `typ` defaults to "JWT" if not provided and payload is an object.
+  */
+  protectedHeader?: JWSHeaderParameters;
+  /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
+  currentDate?: Date;
+  /**
+  * Time at which the JWS should expire, if no `exp` was already provided.
+  */
+  expiresIn?: ExpiresIn;
+}
+/** Result of JWS verification */
+interface JWSVerifyResult<T extends JWTClaims | Uint8Array<ArrayBuffer> | string = JWTClaims | Uint8Array<ArrayBuffer> | string> {
+  /** The decoded and verified payload. */
+  payload: T;
+  /** The JWS Protected Header. */
+  protectedHeader: JWSProtectedHeader;
+}
+/** Options for JWS verification */
+interface JWSVerifyOptions extends JWTClaimValidationOptions {
+  /** List of allowed algorithms. If provided, the JWS `alg` must be in this list. */
+  algorithms?: JWSAlgorithm[];
+  /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred. */
+  forceUint8Array?: boolean;
+  /** Unless false, will parse payload as JWT and validate claims if applicable (typ "JWT"). */
+  validateJWT?: boolean;
+}
+/**
+* Key lookup function for JWS verification.
+* @param header The JWS Protected Header.
+* @param token The JWS token.
+* @returns The key material (CryptoKey, JWK, or raw Uint8Array) or a Promise resolving to it.
+*/
+type JWSKeyLookupFunction = (header: JWSProtectedHeader, token: string) => CryptoKey | JWK | JWKSet | Uint8Array<ArrayBuffer> | Promise<CryptoKey | JWK | JWKSet | Uint8Array<ArrayBuffer>>;
+//#endregion
+//#region src/core/utils/types.d.ts
+type StrictOmit<T, K extends keyof T | (string & {}) | (number & {}) | (symbol & {})> = { [P in keyof T as P extends K ? never : P]: T[P] };
+//#endregion
+//#region src/core/types/jwe.d.ts
+/** Recognized JWE Header Parameters, any other Header Members may also be present. */
+interface JWEHeaderParameters extends JoseHeaderParameters {
+  /**
+  * `alg` (Algorithm): Header Parameter - Key Management Algorithm
+  */
+  alg?: string;
+  /**
+  * `enc` (Encryption Algorithm): Header Parameter - Content Encryption Algorithm
+  */
+  enc?: string;
+  /**
+  * `p2c` (PBES2 Count): Header Parameter
+  */
+  p2c?: number;
+  /**
+  * `p2s` (PBES2 Salt): Header Parameter. Base64URL encoded.
+  */
+  p2s?: string;
+  /**
+  * "iv" (Initialization Vector) Header Parameter for AES GCM Key Wrapping. Base64URL encoded.
+  */
+  iv?: string;
+  /**
+  * "tag" (Authentication Tag) Header Parameter for AES GCM Key Wrapping. Base64URL encoded.
+  */
+  tag?: string;
+  /**
+  * "epk" (Ephemeral Public Key) Header Parameter for ECDH-ES.
+  */
+  epk?: JWK_EC_Public;
+  /**
+  * "apu" (Agreement PartyUInfo) Header Parameter for ECDH-ES. Base64URL encoded.
+  */
+  apu?: string;
+  /**
+  * "apv" (Agreement PartyVInfo) Header Parameter for ECDH-ES. Base64URL encoded.
+  */
+  apv?: string;
+  /** Any other JWE Header member. */
+  [propName: string]: unknown;
+}
+/** Recognized JWE Key Management-related Header Parameters. */
+interface JWEKeyManagementHeaderParameters {
+  apu?: Uint8Array<ArrayBuffer>;
+  apv?: Uint8Array<ArrayBuffer>;
+  /**
+  * For Internal use only
+  */
+  p2c?: number;
+  /**
+  * For Internal use only
+  */
+  p2s?: Uint8Array<ArrayBuffer>;
+  /**
+  * For Internal use only
+  */
+  iv?: Uint8Array<ArrayBuffer>;
+  /**
+  * For Internal use only
+  */
+  epk?: CryptoKey | JWK_EC_Public;
+  /**
+  * For Internal use only
+  */
+  epkPrivateKey?: CryptoKey | JWK_EC_Private;
+}
+/**
+* JWE (JSON Web Encryption) encryption options
+*/
+interface JWEEncryptOptions {
+  /** JWE "alg" (Algorithm) Header Parameter. Key Management Algorithm. */
+  alg?: KeyManagementAlgorithm;
+  /** JWE "enc" (Encryption Algorithm) Header Parameter. Content Encryption Algorithm. */
+  enc?: ContentEncryptionAlgorithm;
+  /** Date to use when computing NumericDate claims, defaults to `new Date()`. */
+  currentDate?: Date;
+  /** Time at which the JWT should expire, if no `exp` was already provided (only when typ is "JWT" or explicitly parsing JWT). */
+  expiresIn?: ExpiresIn;
+  /** Additional JWE Protected Header parameters. */
+  protectedHeader?: StrictOmit<JWEHeaderParameters, "alg" | "enc" | "iv" | "tag" | "p2s" | "p2c" | "epk" | "apu" | "apv">;
+  /** Initialization Vector for AES-GCMKW key wrapping. Generated if not provided. */
+  keyManagementIV?: Uint8Array<ArrayBuffer>;
+  /** PBES2 Salt value (p2s). Required for PBES2 algorithms. */
+  p2s?: Uint8Array<ArrayBuffer>;
+  /** PBES2 Iteration count (p2c). Required for PBES2 algorithms. */
+  p2c?: number;
+  /** ECDH-ES specific options. */
+  ecdh?: {
+    /**
+    * ECDH-ES Ephemeral key material. Provide a private key (CryptoKey or JWK),
+    * a CryptoKeyPair, or an object exposing both public and private parts.
+    */
+    ephemeralKey?: CryptoKey | JWK_EC_Private | CryptoKeyPair | {
+      publicKey: CryptoKey | JWK_EC_Public;
+      privateKey: CryptoKey | JWK_EC_Private;
+    }; /** ECDH-ES Agreement PartyUInfo. */
+    partyUInfo?: Uint8Array<ArrayBuffer>; /** ECDH-ES Agreement PartyVInfo. */
+    partyVInfo?: Uint8Array<ArrayBuffer>;
+  };
+  /**
+  * Content Encryption Key (CEK) to use.
+  * If provided, it will be used directly. Otherwise, a CEK will be generated.
+  */
+  cek?: Uint8Array<ArrayBuffer>;
+  /**
+  * Initialization Vector for content encryption.
+  * If provided, it will be used. Otherwise, one will be generated.
+  */
+  contentEncryptionIV?: Uint8Array<ArrayBuffer>;
+}
+/**
+* Key lookup function for JWE decryption.
+* @param header The JWE Protected Header.
+* @returns The key material (CryptoKey, JWK, password string, or raw Uint8Array) or a Promise resolving to it.
+*/
+type JWEKeyLookupFunction = (header: JWEHeaderParameters, token: string) => CryptoKey | JWK | string | Uint8Array<ArrayBuffer> | Promise<CryptoKey | JWK | string | Uint8Array<ArrayBuffer>>;
+/**
+* JWE (JSON Web Encryption) decryption options
+*/
+interface JWEDecryptOptions extends JWTClaimValidationOptions {
+  /** A list of allowed JWE "alg" (Algorithm) Header Parameter values for key management. */
+  algorithms?: KeyManagementAlgorithm[];
+  /** A list of allowed JWE "enc" (Encryption Algorithm) Header Parameter values for content encryption. */
+  encryptionAlgorithms?: ContentEncryptionAlgorithm[];
+  /** Algorithm to import the unwrapped CEK as (e.g., { name: 'AES-GCM' }). Defaults based on 'enc'. */
+  unwrappedKeyAlgorithm?: Parameters<typeof crypto.subtle.importKey>[2];
+  /** Key usages for the unwrapped CEK. Defaults based on 'enc' (typically ['encrypt', 'decrypt']). */
+  keyUsage?: KeyUsage[];
+  /** Mark the unwrapped CEK as extractable. Defaults to true. */
+  extractable?: boolean;
+  /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred based on JWE headers. */
+  forceUint8Array?: boolean;
+  /** Unless false, will parse payload as JWT and validate claims if applicable (typ "JWT"). */
+  validateJWT?: boolean;
+  /** If true, include the Content Encryption Key (CEK) and Additional Authenticated Data (AAD) in the result. */
+  returnCek?: boolean;
+}
+/**
+* Result of a JWE decryption operation.
+*/
+interface JWEDecryptResult<T extends JWTClaims | Uint8Array<ArrayBuffer> | string = JWTClaims | Uint8Array<ArrayBuffer> | string> {
+  /** The decrypted payload. */
+  payload: T;
+  /** The JWE Protected Header. */
+  protectedHeader: JWEHeaderParameters;
+  /** The Content Encryption Key (CEK) used for decryption, as Uint8Array. Only present when `returnCek` is true. */
+  cek?: Uint8Array<ArrayBuffer>;
+  /** The Additional Authenticated Data (AAD) used, as Uint8Array. Only present when `returnCek` is true. */
+  aad?: Uint8Array<ArrayBuffer>;
+}
+//#endregion
+//#region src/core/types/index.d.ts
+type ExpiresIn = number | `${number}` | `${number}${"s" | "second" | "seconds" | "m" | "minute" | "minutes" | "h" | "hour" | "hours" | "D" | "day" | "days" | "W" | "week" | "weeks" | "M" | "month" | "months" | "Y" | "year" | "years"}`;
+type MaxTokenAge = ExpiresIn;
+//#endregion
+//#region src/core/jose/asn1.d.ts
+/** Key Import Function options. */
+interface KeyImportOptions {
+  /**
+  * The value to use as {@link !SubtleCrypto.importKey} `extractable` argument. Default is false for
+  * private keys, true otherwise.
+  */
+  extractable?: boolean;
+}
+//#endregion
+//#region src/core/jwk.d.ts
+/**
+* Generates a Json Web Key (JWK) for the specified algorithm.
+*
+* @param alg The JWA algorithm identifier (e.g., "HS256", "RS256", "A128GCM").
+* @param jwkParams Optional partial JWK to merge with the generated key, allowing overrides.
+* @param options Configuration options for key generation.
+* @returns A Promise resolving to the generated JWK or JWK pair representation.
+*/
+declare function generateJWK<TAlg extends GenerateKeyAlgorithm>(alg: TAlg, jwkParams?: Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">, options?: GenerateJWKOptions): Promise<GenerateJWKReturn<TAlg>>;
+/**
+* Derives a Json Web Key (JWK) from a password using PBKDF2 as specified by PBES2 algorithms.
+*
+* @param password The password to derive the key from (string or Uint8Array).
+* @param alg The PBES2 algorithm identifier (e.g., "PBES2-HS256+A128KW").
+* @param jwkParams Optional partial JWK to merge with the generated key, allowing overrides.
+* @param options Configuration options including salt and iterations.
+* @returns A Promise resolving to the derived JWK (JWK_oct).
+*/
+declare function deriveJWKFromPassword(password: string | Uint8Array<ArrayBuffer>, alg: JWK_PBES2, options: Omit<DeriveKeyOptions, "toJWK">, jwkParams?: Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">): Promise<JWK_oct>;
+/**
+* Imports a key from a PEM-encoded string and converts it to a JWK.
+*
+* @param pem The PEM-encoded string.
+* @param pemType The type of PEM encoding ('pkcs8' for private keys, 'spki' for public keys, 'x509' for certificates).
+* @param alg The JWA algorithm identifier. This is crucial for `crypto.subtle.importKey`
+*            to understand the key's intended algorithm and for setting the 'alg' field in the resulting JWK.
+* @param importOptions Options for the PEM import process (e.g., extractable for the CryptoKey).
+* @param jwkExtras Additional properties to merge into the resulting JWK.
+* @returns A Promise resolving to the imported key as a JWK.
+*/
+declare function importJWKFromPEM<T extends JWK>(pem: string, pemType: "pkcs8" | "spki" | "x509", alg: JWKPEMAlgorithm, importOptions?: KeyImportOptions, jwkExtras?: Partial<JWK>): Promise<T>;
+/**
+* Exports a JWK to a PEM-encoded string.
+*
+* @param jwk The JWK to export.
+* @param pemFormat The desired PEM format ('pkcs8' for private keys, 'spki' for public keys).
+* @param algForCryptoKeyImport If the JWK does not have an 'alg' property, this algorithm hint is
+*                              required to correctly convert it to a CryptoKey first.
+* @returns A Promise resolving to the PEM-encoded key string.
+*/
+declare function exportJWKToPEM(jwk: JWK, pemFormat: "pkcs8" | "spki", algForCryptoKeyImport?: JWKPEMAlgorithm): Promise<string>;
+//#endregion
+export { JWK_OKP_Public as $, GenerateJWKReturn as A, JWK_AES_GCM as B, JWTClaims as C, DeriveKeyOptions as D, ContentEncryptionAlgorithm as E, JWKAlgorithm as F, JWK_EC as G, JWK_AES_KW as H, JWKPEMAlgorithm as I, JWK_EC_Private as J, JWK_ECDH_ES as K, JWKParameters as L, GenerateKeyOptions as M, GenerateKeyReturn as N, DeriveKeyReturn as O, JWK as P, JWK_OKP_Private as Q, JWKSet as R, JWTClaimValidationOptions as S, CompositeKey as T, JWK_Asymmetric as U, JWK_AES_GCM_KW as V, JWK_Asymmetric_Algorithm as W, JWK_HMAC as X, JWK_EC_Public as Y, JWK_OKP as Z, JWSProtectedHeader as _, WrapKeyResult as _t, ExpiresIn as a, JWK_RSA as at, JWSVerifyResult as b, JWEDecryptResult as c, JWK_RSA_Private as ct, JWEKeyLookupFunction as d, JWK_Symmetric as dt, JWK_OKP_SIGN as et, JWEKeyManagementHeaderParameters as f, JWK_Symmetric_Algorithm as ft, JWSKeyLookupFunction as g, WrapKeyOptions as gt, JWSHeaderParameters as h, UnwrapKeyOptions as ht, importJWKFromPEM as i, JWK_Public as it, GenerateKeyAlgorithm as j, GenerateJWKOptions as k, JWEEncryptOptions as l, JWK_RSA_Public as lt, JWSAlgorithm as m, KeyManagementAlgorithm as mt, exportJWKToPEM as n, JWK_Pair as nt, MaxTokenAge as o, JWK_RSA_ENC as ot, StrictOmit as p, JWK_oct as pt, JWK_ECDSA as q, generateJWK as r, JWK_Private as rt, JWEDecryptOptions as s, JWK_RSA_PSS as st, deriveJWKFromPassword as t, JWK_PBES2 as tt, JWEHeaderParameters as u, JWK_RSA_SIGN as ut, JWSSignOptions as v, JoseHeaderParameters as w, JWT as x, JWSVerifyOptions as y, JWK_AES_CBC_HMAC as z };