unjwt 0.5.39 → 0.6.0

package/dist/_chunks/index.d.mts

@@ -1,250 +1,662 @@
-import { M as JWKSet, X as JWK_Private, Z as JWK_Public, _ as JWSProtectedHeader, c as JWEHeaderParameters, d as StrictOmit, g as ExpiresIn, it as JWK_Symmetric, m as JWTClaims, p as JWTClaimValidationOptions, s as JWEEncryptOptions, v as JWSSignOptions } from "./jwk.mjs";
-import { H3Event } from "h3";
-import { CookieSerializeOptions } from "cookie-es";
-
-//#region src/adapters/h3v1/session/types.d.ts
-interface SessionClaims extends Required<Pick<JWTClaims, "jti" | "iat">>, StrictOmit<JWTClaims, "jti" | "iat"> {}
-type SessionData<T extends Record<string, any> = SessionClaims> = StrictOmit<T, "jti" | "iat" | "exp">;
-type SessionUpdate<T extends Record<string, any> = SessionClaims> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
-interface SessionManager<T extends Record<string, any> = SessionClaims, ConfigMaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
-  readonly id: string | undefined;
-  readonly createdAt: number;
-  readonly expiresAt: ConfigMaxAge extends ExpiresIn ? number : "exp" extends keyof T ? T["exp"] : number | undefined;
-  readonly data: SessionData<T>;
-  readonly token: string | undefined;
-  update: (update: SessionUpdate<T>) => Promise<SessionManager<T, ConfigMaxAge> & {
-    readonly id: string;
-  }>;
-  clear: () => Promise<SessionManager<T, ConfigMaxAge>>;
-}
-//#endregion
-//#region src/adapters/h3v1/session/jwe.d.ts
-declare const kGetSessionPromise$1: unique symbol;
-interface SessionJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
-  id: string | undefined;
-  createdAt: number;
-  expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
-  data: SessionData<T>;
-  [kGetSessionPromise$1]?: Promise<SessionJWE<T, MaxAge>>;
-}
-interface SessionHooksJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
-  onRead?: (args: {
-    session: SessionJWE<T, MaxAge>;
-    event: H3Event;
-    config: SessionConfigJWE<T, MaxAge>;
-  }) => void | Promise<void>;
-  onUpdate?: (args: {
-    session: SessionJWE<T, MaxAge>;
-    oldSession: SessionJWE<T, MaxAge>;
-    event: H3Event;
-    config: SessionConfigJWE<T, MaxAge>;
-  }) => void | Promise<void>;
-  onClear?: (args: {
-    session: SessionJWE<T, MaxAge> | undefined;
-    event: H3Event;
-    config: Partial<SessionConfigJWE<T, MaxAge>>;
-  }) => void | Promise<void>;
-  onExpire?: (args: {
-    event: H3Event;
-    error: Error;
-    config: SessionConfigJWE<T, MaxAge>;
-  }) => void | Promise<void>;
-  onError?: (args: {
-    event: H3Event;
-    error: any;
-    config: SessionConfigJWE<T, MaxAge>;
-  }) => void | Promise<void>;
-  onUnsealKeyLookup?: (args: {
-    header: JWEHeaderParameters;
-    event: H3Event;
-    config: SessionConfigJWE<T, MaxAge>;
-  }) => JWK_Symmetric | JWK_Private | Promise<JWK_Symmetric | JWK_Private>;
-}
-interface SessionConfigJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
-  /** @deprecated use `key` instead */
-  secret?: string | JWK_Symmetric | {
-    privateKey: JWK_Private | JWK_Symmetric;
-    publicKey?: JWK_Public;
-  };
-  /** Shared key used, string for PBES2 or Json Web Key (JWK) */
-  key: string | JWK_Symmetric | JWK_Private | {
-    privateKey: JWK_Private | JWK_Symmetric;
-    publicKey?: JWK_Public;
-  };
-  /** Session lifetime in seconds (used to derive exp from iat) */
-  maxAge?: MaxAge;
-  /** Default is "h3" */
-  name?: string;
-  /** Default is secure, httpOnly, path="/" */
-  cookie?: false | CookieSerializeOptions;
-  /** Default is x-h3-session / x-{name}-session */
-  sessionHeader?: false | string;
-  /** Default is crypto.randomUUID */
-  generateId?: () => string;
-  /** JWE configuration overrides */
-  jwe?: {
-    encryptOptions?: Omit<JWEEncryptOptions, "expiresIn">;
-    decryptOptions?: JWTClaimValidationOptions;
-  };
-  hooks?: SessionHooksJWE<T, MaxAge>;
-}
+//#region src/core/types/jwk.d.ts
 /**
-* @deprecated use `SessionConfigJWE` instead
+* The decoded JOSE protected header received by a {@link JWKLookupFunction}.
+*
+* The most commonly inspected fields are explicitly typed; additional
+* algorithm-specific parameters (`epk`, `p2s`, `p2c`, `apu`, `apv`, …) are
+* accessible through the index signature.
+*
+* `alg` is always present on both JWS and JWE tokens. `enc` is only present
+* on JWE tokens.
 */
-type SessionJWEConfig = SessionConfigJWE;
-type CompatEvent$1 = {
-  request: {
-    headers: Headers;
-  };
-  context: any;
-} | {
-  headers: Headers;
-  context: any;
+type JWKLookupFunctionHeader = {
+  kid?: string;
+  alg?: string;
+  enc?: string;
+  typ?: string;
+  crit?: string[];
+  [propName: string]: unknown;
 };
 /**
-* Create a session manager for the current request.
+* A callback that resolves the decryption or verification key from a token's
+* decoded protected header and the raw compact token string.
+*
+* Accepted by both {@link verify} (JWS) and {@link decrypt} (JWE). When a
+* {@link JWKSet} is returned, the library tries each key whose `kid` and `alg`
+* are compatible with the header in order, stopping at the first that succeeds
+* — see {@link getJWKsFromSet} for the selection logic.
+*
+* Returning a `string` is meaningful for JWE only (PBES2 password); for JWS
+* a string return is encoded to bytes and used as a raw symmetric key.
 */
-declare function useJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
+type JWKLookupFunction = (header: JWKLookupFunctionHeader, token: string) => CryptoKey | JWK | JWKSet | string | Uint8Array<ArrayBuffer> | Promise<CryptoKey | JWK | JWKSet | string | Uint8Array<ArrayBuffer>>;
 /**
-* Get (and lazily initialize) the session for the current request.
+* Interface for custom JWK import cache implementations.
+*
+* The adapter receives the full JWK object so each implementation can choose
+* its own keying strategy:
+* - {@link WeakMapJWKCache} uses the object reference (GC-friendly, no string hashing needed)
+* - A `kid`-keyed cache extracts `jwk.kid` and uses it as a string key
+* - A content-hash cache hashes `jwk.k` or `jwk.n`+`jwk.e`
+*
+* @example Use a custom kid-keyed cache:
+* ```ts
+* import { configureJWKCache } from 'unjwt/jwk';
+* const map = new Map<string, CryptoKey>();
+* configureJWKCache({
+*   get: (jwk, alg) => map.get(`${jwk.kid}:${alg}`),
+*   set: (jwk, alg, key) => map.set(`${jwk.kid}:${alg}`, key),
+* });
+* ```
 */
-declare function getJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<SessionJWE<T, MaxAge>>;
-declare function getJWESessionToken<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): string | undefined;
+interface JWKCacheAdapter {
+  get(jwk: JWK, alg: string): CryptoKey | undefined;
+  set(jwk: JWK, alg: string, key: CryptoKey): void;
+}
+/** Structure returned for composite AES-CBC + HMAC keys. */
+type CompositeKey = {
+  /** The AES-CBC encryption/decryption key. */encryptionKey: CryptoKey; /** The HMAC key for integrity/authentication. */
+  macKey: CryptoKey;
+};
+type GenerateKeyAlgorithm = Exclude<JWKAlgorithm, "none" | "dir" | JWK_PBES2>;
+/** Options for the generateKey function. */
+interface GenerateKeyOptions {
+  /** Key usages for the generated key(s). Note: For composite keys (CBC), default usages are applied separately. */
+  keyUsage?: KeyUsage[];
+  /** Mark the key(s) as extractable. Defaults to true. */
+  extractable?: boolean;
+  /** RSA modulus length. Defaults to 2048. */
+  modulusLength?: number;
+  /** RSA public exponent. Defaults to 65537 (0x010001). */
+  publicExponent?: Uint8Array<ArrayBuffer>;
+  /** Named curve for EC or OKP keys. Defaults to "P-256" for EC and "Ed25519" for OKP. */
+  namedCurve?: "P-256" | "P-384" | "P-521" | "X25519" | "Ed25519" | "Ed448";
+  /**
+  * Export the generated key(s) as JWK. When `true`, keys are returned in JWK
+  * format with a generated `kid`. To include additional JWK parameters
+  * (e.g. a custom `kid`), use {@link generateJWK} instead.
+  */
+  toJWK?: boolean;
+}
+type GenerateKeyReturnJWK<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_Asymmetric_Algorithm ? TAlg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC ? {
+  privateKey: JWK_RSA_Private;
+  publicKey: JWK_RSA_Public;
+} : TAlg extends JWK_ECDSA | JWK_ECDH_ES ? {
+  privateKey: JWK_EC_Private;
+  publicKey: JWK_EC_Public;
+} : TAlg extends JWK_OKP_SIGN ? {
+  privateKey: JWK_OKP_Private;
+  publicKey: JWK_OKP_Public;
+} : never : TAlg extends JWK_AES_CBC_HMAC | JWK_Symmetric_Algorithm ? JWK_oct : never;
+type GenerateKeyReturnCrypto<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_AES_CBC_HMAC ? Uint8Array<ArrayBuffer> : TAlg extends JWK_Asymmetric_Algorithm ? CryptoKeyPair : CryptoKey;
+type GenerateKeyReturn<TAlg extends GenerateKeyAlgorithm, TOptions extends GenerateKeyOptions> = TOptions["toJWK"] extends true ? GenerateKeyReturnJWK<TAlg> : GenerateKeyReturnCrypto<TAlg>;
+type GenerateJWKOptions = Omit<GenerateKeyOptions, "toJWK">;
+type GenerateJWKReturn<TAlg extends GenerateKeyAlgorithm> = GenerateKeyReturnJWK<TAlg>;
+/** Options for the deriveKeyFromPassword function. */
+interface DeriveKeyOptions {
+  /** Salt value (p2s). Must be at least 8 bytes. */
+  salt: Uint8Array<ArrayBuffer>;
+  /** Iteration count (p2c). Must be a positive integer. */
+  iterations: number;
+  /** Key usages for the derived key. Defaults to ["wrapKey", "unwrapKey"]. */
+  keyUsage?: KeyUsage[];
+  /** Mark the derived key as extractable. Defaults to false. */
+  extractable?: boolean;
+  /**
+  * Export the derived key as JWK_oct. When `true`, returns the derived key in
+  * JWK format. To include additional JWK parameters (e.g. a custom `kid`),
+  * use {@link deriveJWKFromPassword} instead.
+  */
+  toJWK?: boolean;
+}
+type DeriveKeyReturn<TOptions extends DeriveKeyOptions> = TOptions["toJWK"] extends true ? JWK_oct : TOptions["toJWK"] extends object ? JWK_oct : CryptoKey;
+type KeyManagementAlgorithm = JWK_RSA_ENC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_PBES2 | JWK_ECDH_ES | "dir";
+type ContentEncryptionAlgorithm = JWK_AES_GCM | JWK_AES_CBC_HMAC;
+/** Options for the wrapKey function. */
+interface WrapKeyOptions {
+  /** Initialization Vector for AES-GCMKW. Generated if not provided. */
+  iv?: Uint8Array<ArrayBuffer>;
+  /** PBES2 Salt value (p2s). Required for PBES2 algorithms. */
+  p2s?: Uint8Array<ArrayBuffer>;
+  /** PBES2 Iteration count (p2c). Required for PBES2 algorithms. */
+  p2c?: number;
+  /** ECDH-ES specific options. */
+  ecdh?: {
+    /**
+    * ECDH-ES ephemeral key material. A fresh ephemeral key pair is generated
+    * automatically when this is not provided.
+    */
+    ephemeralKey?: CryptoKey | JWK_EC_Private | CryptoKeyPair | {
+      publicKey: CryptoKey | JWK_EC_Public;
+      privateKey: CryptoKey | JWK_EC_Private;
+    }; /** Agreement PartyUInfo (apu). */
+    partyUInfo?: Uint8Array<ArrayBuffer>; /** Agreement PartyVInfo (apv). */
+    partyVInfo?: Uint8Array<ArrayBuffer>;
+    /**
+    * Content encryption algorithm used for key-length derivation.
+    * Required only when `alg` is `"ECDH-ES"` (direct key agreement).
+    * Not needed for `ECDH-ES+A128KW`, `+A192KW`, or `+A256KW`.
+    */
+    enc?: ContentEncryptionAlgorithm;
+  };
+}
+/** Result of the wrapKey function. */
+interface WrapKeyResult {
+  /** The wrapped key (Ciphertext). */
+  encryptedKey: Uint8Array<ArrayBuffer>;
+  /** Initialization Vector used (only for AES-GCMKW). Base64URL encoded. */
+  iv?: string;
+  /** Authentication Tag generated (only for AES-GCMKW). Base64URL encoded. */
+  tag?: string;
+  /** PBES2 Salt value used (only for PBES2). Base64URL encoded. */
+  p2s?: string;
+  /** PBES2 Iteration count used (only for PBES2). */
+  p2c?: number;
+  /** ECDH-ES Ephemeral Public Key used (only for ECDH-ES). */
+  epk?: JWK_EC_Public;
+  /** ECDH-ES Agreement PartyUInfo used (only for ECDH-ES). Base64URL encoded. */
+  apu?: string;
+  /** ECDH-ES Agreement PartyVInfo used (only for ECDH-ES). Base64URL encoded. */
+  apv?: string;
+}
+/** Options for the unwrapKey function. */
+interface UnwrapKeyOptions {
+  /**
+  * Output format of the unwrapped key.
+  * - `"cryptokey"` (default) — returns a `CryptoKey` ready for use with WebCrypto.
+  * - `"raw"` — returns the raw key bytes as `Uint8Array` (useful for
+  *   interoperability or when the algorithm is not directly importable).
+  */
+  format?: "cryptokey" | "raw";
+  /** Initialization Vector (required for AES-GCMKW). Base64URL encoded or Uint8Array. */
+  iv?: Uint8Array<ArrayBuffer> | string;
+  /** Authentication Tag (required for AES-GCMKW). Base64URL encoded or Uint8Array. */
+  tag?: Uint8Array<ArrayBuffer> | string;
+  /** PBES2 Salt value (required for PBES2). Base64URL encoded or Uint8Array. */
+  p2s?: Uint8Array<ArrayBuffer> | string;
+  /** PBES2 Iteration count (required for PBES2). */
+  p2c?: number;
+  /** ECDH-ES Ephemeral Public Key (required for ECDH-ES). */
+  epk?: JWK_EC_Public | CryptoKey;
+  /** ECDH-ES Agreement PartyUInfo. Base64URL encoded or Uint8Array. */
+  apu?: Uint8Array<ArrayBuffer> | string;
+  /** ECDH-ES Agreement PartyVInfo. Base64URL encoded or Uint8Array. */
+  apv?: Uint8Array<ArrayBuffer> | string;
+  /** Content Encryption Algorithm used with ECDH-ES (required for direct key agreement). */
+  enc?: ContentEncryptionAlgorithm;
+  /** Expected unwrapped key algorithm (e.g., 'AES-GCM', 'AES-CBC'). Used by crypto.subtle.unwrapKey. */
+  unwrappedKeyAlgorithm?: string | Algorithm | RsaOaepParams | AesCtrParams | AesCbcParams | AesGcmParams;
+  /** Expected key usages for the unwrapped key. */
+  keyUsage?: KeyUsage[];
+  /** Mark the unwrapped key as extractable. Defaults to true. */
+  extractable?: boolean;
+}
 /**
-* Update the session (optionally mutating the session data) and re-issue the JWE token.
+* Forked from https://github.com/panva/jose/tree/v6.0.10
+* Copyright (c) 2018 Filip Skokan.
+* LICENSE: https://github.com/panva/jose/blob/v6.0.10/LICENSE.md
 */
-declare function updateJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: SessionConfigJWE<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWE<T, MaxAge>>;
+/** Generic JSON Web Key Parameters. */
+interface JWKParameters {
+  /** JWK "kty" (Key Type) Parameter */
+  kty: string;
+  /**
+  * JWK "alg" (Algorithm) Parameter
+  *
+  * @see {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}
+  */
+  alg?: string;
+  /** JWK "key_ops" (Key Operations) Parameter */
+  key_ops?: KeyUsage[];
+  /** JWK "ext" (Extractable) Parameter */
+  ext?: boolean;
+  /** JWK "use" (Public Key Use) Parameter */
+  use?: string;
+  /** JWK "x5c" (X.509 Certificate Chain) Parameter */
+  x5c?: string[];
+  /** JWK "x5t" (X.509 Certificate SHA-1 Thumbprint) Parameter */
+  x5t?: string;
+  /** JWK "x5t#S256" (X.509 Certificate SHA-256 Thumbprint) Parameter */
+  "x5t#S256"?: string;
+  /** JWK "x5u" (X.509 URL) Parameter */
+  x5u?: string;
+  /** JWK "kid" (Key ID) Parameter */
+  kid?: string;
+  /**
+  * Non-standard JWK content encryption algorithm hint.
+  * When `alg` is `"dir"`, the library reads this field to infer the
+  * content encryption algorithm (`enc`) when it is not provided in options.
+  */
+  enc?: ContentEncryptionAlgorithm;
+}
+/** Public EC JSON Web Keys */
+interface JWK_EC_Public extends JWKParameters {
+  /** EC JWK "kty" (Key Type) Parameter */
+  kty: "EC";
+  /** EC JWK "crv" (Curve) Parameter */
+  crv: string;
+  /** EC JWK "x" (X Coordinate) Parameter */
+  x: string;
+  /** EC JWK "y" (Y Coordinate) Parameter */
+  y: string;
+}
+/** Private EC JSON Web Keys */
+interface JWK_EC_Private extends JWK_EC_Public {
+  /** EC JWK "d" (ECC Private Key) Parameter */
+  d: string;
+}
+/** EC JSON Web Keys */
+type JWK_EC = JWK_EC_Public | JWK_EC_Private;
+/** Public RSA JSON Web Keys */
+interface JWK_RSA_Public extends JWKParameters {
+  /** RSA JWK "kty" (Key Type) Parameter */
+  kty: "RSA";
+  /** RSA JWK "e" (Exponent) Parameter */
+  e: string;
+  /** RSA JWK "n" (Modulus) Parameter */
+  n: string;
+  oth?: RsaOtherPrimesInfo[];
+}
+/** Private RSA JSON Web Keys */
+interface JWK_RSA_Private extends JWK_RSA_Public {
+  /** RSA JWK "d" (Private Exponent) Parameter */
+  d: string;
+  /** RSA JWK "dp" (First Factor CRT Exponent) Parameter */
+  dp: string;
+  /** RSA JWK "dq" (Second Factor CRT Exponent) Parameter */
+  dq: string;
+  /** RSA JWK "p" (First Prime Factor) Parameter */
+  p: string;
+  /** RSA JWK "q" (Second Prime Factor) Parameter */
+  q: string;
+  /** RSA JWK "qi" (First CRT Coefficient) Parameter */
+  qi: string;
+}
+/** RSA JSON Web Keys */
+type JWK_RSA = JWK_RSA_Public | JWK_RSA_Private;
+/** Public ED JSON Web Keys */
+interface JWK_OKP_Public extends JWKParameters {
+  /** ED JWK "kty" (Key Type) Parameter */
+  kty: "OKP";
+  /** ED JWK "crv" (Curve) Parameter */
+  crv: string;
+  /** ED JWK "x" (X Coordinate) Parameter */
+  x: string;
+}
+/** Private ED JSON Web Keys */
+interface JWK_OKP_Private extends JWK_OKP_Public {
+  /** ED JWK "d" (Private Key) Parameter */
+  d: string;
+}
+/** OKP JSON Web Keys */
+type JWK_OKP = JWK_OKP_Public | JWK_OKP_Private;
+/** oct JSON Web Keys */
+interface JWK_oct extends JWKParameters {
+  /** Oct JWK "k" (Key Value) Parameter */
+  k: string;
+}
+/** Symmetric JSON Web Keys */
+type JWK_Symmetric = JWK_oct;
+/** Asymmetric JSON Web Keys */
+type JWK_Asymmetric = JWK_RSA | JWK_EC | JWK_OKP;
+/** Public JSON Web Keys */
+type JWK_Public = JWK_RSA_Public | JWK_EC_Public | JWK_OKP_Public;
+/** Private JSON Web Keys */
+type JWK_Private = JWK_RSA_Private | JWK_EC_Private | JWK_OKP_Private;
 /**
-* Produce a JWE for the current session.
-* Payload structure:
-* {
-*   jti: string;
-*   iat: number; (seconds)
-*   exp?: number; (seconds)
-*   data: Record<string, any>;
-* }
+* JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC", "OKP" and "oct" key types are supported.
 */
-declare function sealJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<string>;
+type JWK = JWK_oct | JWK_RSA | JWK_EC | JWK_OKP;
 /**
-* Decrypt the JWE and return a Session-compatible object.
+* A pair of public and private JSON Web Keys.
 */
-declare function unsealJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>, sealed: string): Promise<Partial<SessionJWE<T, MaxAge>>>;
+type JWK_Pair = {
+  publicKey: JWK_RSA_Public;
+  privateKey: JWK_RSA_Private;
+} | {
+  publicKey: JWK_EC_Public;
+  privateKey: JWK_EC_Private;
+} | {
+  publicKey: JWK_OKP_Public;
+  privateKey: JWK_OKP_Private;
+};
 /**
-* Clear the session (delete from context and drop cookie).
+* JSON Web Key Set ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK Set}). "RSA", "EC" and "oct" key types are supported.
 */
-declare function clearJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: Partial<SessionConfigJWE<T, MaxAge>>): Promise<void>;
+interface JWKSet {
+  /** JWK Set "keys" Parameter */
+  keys: JWK[];
+  [parameter: string]: unknown;
+}
+/** JWK Key Algorithms */
+type JWK_HMAC = "HS256" | "HS384" | "HS512";
+type JWK_RSA_SIGN = "RS256" | "RS384" | "RS512";
+type JWK_RSA_PSS = "PS256" | "PS384" | "PS512";
+type JWK_ECDSA = "ES256" | "ES384" | "ES512";
+type JWK_RSA_ENC = "RSA-OAEP" | "RSA-OAEP-256" | "RSA-OAEP-384" | "RSA-OAEP-512";
+type JWK_AES_KW = "A128KW" | "A192KW" | "A256KW";
+type JWK_AES_CBC_HMAC = "A128CBC-HS256" | "A192CBC-HS384" | "A256CBC-HS512";
+type JWK_AES_GCM = "A128GCM" | "A192GCM" | "A256GCM";
+type JWK_AES_GCM_KW = "A128GCMKW" | "A192GCMKW" | "A256GCMKW";
+type JWK_PBES2 = "PBES2-HS256+A128KW" | "PBES2-HS384+A192KW" | "PBES2-HS512+A256KW";
+type JWK_ECDH_ES = "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A192KW" | "ECDH-ES+A256KW";
+type JWK_OKP_SIGN = "Ed25519" | "EdDSA";
+type JWK_Symmetric_Algorithm = JWK_HMAC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW;
+type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA_ENC | JWK_OKP_SIGN | JWK_ECDH_ES;
+type JWKAlgorithm = JWK_Symmetric_Algorithm | JWK_Asymmetric_Algorithm | JWK_AES_CBC_HMAC | JWK_PBES2 | JWK_ECDH_ES | "dir";
+type JWKPEMAlgorithm = JWK_RSA_PSS | JWK_RSA_SIGN | JWK_RSA_ENC | JWK_ECDSA | JWK_ECDH_ES | JWK_OKP_SIGN;
 //#endregion
-//#region src/adapters/h3v1/session/jws.d.ts
-declare const kGetSessionPromise: unique symbol;
-interface SessionJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
-  id: string | undefined;
-  createdAt: number;
-  expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
-  data: SessionData<T>;
-  [kGetSessionPromise]?: Promise<SessionJWS<T, MaxAge>>;
-}
-interface SessionHooksJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
-  onRead?: (args: {
-    session: SessionJWS<T, MaxAge>;
-    event: H3Event;
-    config: SessionConfigJWS<T, MaxAge>;
-  }) => void | Promise<void>;
-  onUpdate?: (args: {
-    session: SessionJWS<T, MaxAge>;
-    oldSession: SessionJWS<T, MaxAge>;
-    event: H3Event;
-    config: SessionConfigJWS<T, MaxAge>;
-  }) => void | Promise<void>;
-  onClear?: (args: {
-    session: SessionJWS<T, MaxAge> | undefined;
-    event: H3Event;
-    config: Partial<SessionConfigJWS<T, MaxAge>>;
-  }) => void | Promise<void>;
-  onExpire?: (args: {
-    event: H3Event;
-    error: Error;
-    config: SessionConfigJWS<T, MaxAge>;
-  }) => void | Promise<void>;
-  onError?: (args: {
-    event: H3Event;
-    error: any;
-    config: SessionConfigJWS<T, MaxAge>;
-  }) => void | Promise<void>;
-  onVerifyKeyLookup?: (args: {
-    header: JWSProtectedHeader;
-    event: H3Event;
-    config: SessionConfigJWS<T, MaxAge>;
-  }) => JWKSet | JWK_Symmetric | JWK_Public | Promise<JWKSet | JWK_Symmetric | JWK_Public>;
-}
-interface SessionConfigJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
-  /**
-  * JWK (private for signing with RS/ES/PS, or symmetric oct) used for signing.
-  */
-  key: JWK_Symmetric | {
-    privateKey: JWK_Private;
-    publicKey: JWK_Public | JWK_Public[] | JWKSet;
-  };
-  /** Session lifetime in seconds (sets exp = iat + maxAge) */
-  maxAge?: MaxAge;
-  /** Default cookie / header name base */
-  name?: string;
-  /** Cookie options (false to disable cookies) */
-  cookie?: false | CookieSerializeOptions;
-  /** Custom header (false to disable header lookup) */
-  sessionHeader?: false | string;
-  /** Custom ID generator (defaults to crypto.randomUUID) */
-  generateId?: () => string;
-  /** JWS customization */
-  jws?: {
-    signOptions?: Omit<JWSSignOptions, "expiresIn">;
-    verifyOptions?: JWTClaimValidationOptions;
-  };
-  hooks?: SessionHooksJWS<T, MaxAge>;
+//#region src/core/types/jwt.d.ts
+/** Header Parameters common to JWE and JWS */
+interface JoseHeaderParameters {
+  /** "kid" (Key ID) Header Parameter */
+  kid?: string;
+  /** "x5t" (X.509 Certificate SHA-1 Thumbprint) Header Parameter */
+  x5t?: string;
+  /** "x5c" (X.509 Certificate Chain) Header Parameter */
+  x5c?: string[];
+  /** "x5u" (X.509 URL) Header Parameter */
+  x5u?: string;
+  /** "jku" (JWK Set URL) Header Parameter */
+  jku?: string;
+  /** "jwk" (JSON Web Key) Header Parameter */
+  jwk?: JWK_Public;
+  /** "typ" (Type) Header Parameter */
+  typ?: string;
+  /** "cty" (Content Type) Header Parameter */
+  cty?: string;
+  /** "crit" (Critical) Header Parameter */
+  crit?: string[];
+  /** Any other JWS/JWE Header member. */
+  [propName: string]: unknown;
 }
 /**
-* @deprecated use `SessionConfigJWS` instead
+* Payload accepted by {@link sign} and {@link encrypt}.
+*
+* Covers raw strings and bytes for non-JWT use, plus any JSON-serializable
+* object for JWT and generic structured payloads. JWT-specific claim names
+* are not enforced at this level — use {@link JWTClaims} when you want typed
+* claim names and spec-compliant field types.
 */
-type SessionJWSConfig = SessionConfigJWS;
-type CompatEvent = {
-  request: {
-    headers: Headers;
+type JOSEPayload = string | Uint8Array<ArrayBuffer> | Record<string, unknown>;
+interface JWTClaims {
+  /** "iss" (Issuer) Claim */
+  iss?: string;
+  /** "sub" (Subject) Claim */
+  sub?: string;
+  /** "aud" (Audience) Claim */
+  aud?: string | string[];
+  /** "exp" (Expiration Time) Claim */
+  exp?: number;
+  /** "nbf" (Not Before) Claim */
+  nbf?: number;
+  /** "iat" (Issued At) Claim */
+  iat?: number;
+  /** "jti" (JWT ID) Claim */
+  jti?: string;
+  /** Any other JWT member. */
+  [propName: string]: unknown;
+}
+interface JWT<T = JWTClaims> {
+  header: JoseHeaderParameters & {
+    /** "alg" (Algorithm) Header Parameter */alg: string;
   };
-  context: any;
-} | {
-  headers: Headers;
-  context: any;
-};
-/**
-* Create a session manager for the current request using JWS (signed only, not encrypted).
-* NOTE: Contents are visible to clients (Base64URL-decoded JSON). Do not store secrets in session data.
-*/
-declare function useJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
+  claims: T;
+}
+interface JWTClaimValidationOptions {
+  /** Expected JWT "aud" (Audience) Claim value(s). Implies presence requirement. */
+  audience?: string | string[];
+  /** Expected JWT "iss" (Issuer) Claim value(s). Implies presence requirement. */
+  issuer?: string | string[];
+  /** Expected JWT "sub" (Subject) Claim value. Implies presence requirement. */
+  subject?: string;
+  /** Maximum token age, from the JWT "iat" (Issued At) Claim value. Implies presence requirement. */
+  maxTokenAge?: MaxTokenAge;
+  /** Clock skew tolerance (in seconds) for validating time-based claims (nbf/exp/iat). */
+  clockTolerance?: number;
+  /** Expected JWT "typ" (Type) Header Parameter value. Implies presence requirement. */
+  typ?: string;
+  /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
+  currentDate?: Date;
+  /** Additional required claim names. */
+  requiredClaims?: string[];
+  /**
+  * Critical header parameters that this caller understands and has processed.
+  * If the token's `crit` header lists a parameter not present in this list
+  * (and not natively understood by the library), verification will fail per
+  * RFC 7515 §4.1.11 / RFC 7516 §4.1.13.
+  */
+  recognizedHeaders?: string[];
+}
+//#endregion
+//#region src/core/types/jws.d.ts
+/** JWS Signing Algorithm Identifier. */
+type JWSAlgorithm = JWK_HMAC | JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_OKP_SIGN;
+/** Recognized JWS Header Parameters, any other Header Members may also be present. */
+interface JWSHeaderParameters extends JoseHeaderParameters {
+  /** JWS "alg" (Algorithm) Header Parameter */
+  alg?: JWSAlgorithm;
+  /**
+  * This JWS Extension Header Parameter modifies the JWS Payload representation and the JWS Signing
+  * Input computation as per {@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}.
+  * If `false`, the payload is used directly without Base64URL encoding.
+  * Defaults to `true`.
+  */
+  b64?: boolean;
+}
+/** JWS Protected Header */
+interface JWSProtectedHeader extends JWSHeaderParameters {
+  alg: JWSAlgorithm;
+}
 /**
-* Retrieve (and lazily initialize) the session.
+* JWS (JSON Web Signature) options for signing
 */
-declare function getJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionJWS<T, MaxAge>>;
+interface JWSSignOptions {
+  /** The JWS Algorithm to use. Must be provided. */
+  alg?: JWSAlgorithm;
+  /**
+  * Additional protected header parameters. `alg` is automatically included.
+  * `typ` defaults to "JWT" if not provided and payload is an object.
+  */
+  protectedHeader?: JWSHeaderParameters;
+  /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
+  currentDate?: Date;
+  /**
+  * Time at which the JWS should expire, if no `exp` was already provided.
+  */
+  expiresIn?: ExpiresIn;
+}
+/** Result of JWS verification */
+interface JWSVerifyResult<T extends JOSEPayload = JOSEPayload> {
+  /** The decoded and verified payload. */
+  payload: T;
+  /** The JWS Protected Header. */
+  protectedHeader: JWSProtectedHeader;
+}
+/** Options for JWS verification */
+interface JWSVerifyOptions extends JWTClaimValidationOptions {
+  /** List of allowed algorithms. If provided, the JWS `alg` must be in this list. */
+  algorithms?: JWSAlgorithm[];
+  /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred. */
+  forceUint8Array?: boolean;
+  /**
+  * Controls JWT claim validation after a successful verification.
+  *
+  * - `true` — always validate claims regardless of the `typ` header
+  * - `false` — skip claim validation entirely
+  * - `undefined` (default) — validate when `typ` is `"JWT"` or contains `"jwt"`
+  */
+  validateClaims?: boolean;
+}
+//#endregion
+//#region src/core/utils/types.d.ts
+type StrictOmit<T, K extends keyof T | (string & {}) | (number & {}) | (symbol & {})> = { [P in keyof T as P extends K ? never : P]: T[P] };
+//#endregion
+//#region src/core/types/jwe.d.ts
+/** Recognized JWE Header Parameters, any other Header Members may also be present. */
+interface JWEHeaderParameters extends JoseHeaderParameters {
+  /**
+  * `alg` (Algorithm): Header Parameter - Key Management Algorithm
+  */
+  alg?: KeyManagementAlgorithm | (string & {});
+  /**
+  * `enc` (Encryption Algorithm): Header Parameter - Content Encryption Algorithm
+  */
+  enc?: ContentEncryptionAlgorithm | (string & {});
+  /**
+  * `p2c` (PBES2 Count): Header Parameter
+  */
+  p2c?: number;
+  /**
+  * `p2s` (PBES2 Salt): Header Parameter. Base64URL encoded.
+  */
+  p2s?: string;
+  /**
+  * "iv" (Initialization Vector) Header Parameter for AES GCM Key Wrapping. Base64URL encoded.
+  */
+  iv?: string;
+  /**
+  * "tag" (Authentication Tag) Header Parameter for AES GCM Key Wrapping. Base64URL encoded.
+  */
+  tag?: string;
+  /**
+  * "epk" (Ephemeral Public Key) Header Parameter for ECDH-ES.
+  */
+  epk?: JWK_EC_Public;
+  /**
+  * "apu" (Agreement PartyUInfo) Header Parameter for ECDH-ES. Base64URL encoded.
+  */
+  apu?: string;
+  /**
+  * "apv" (Agreement PartyVInfo) Header Parameter for ECDH-ES. Base64URL encoded.
+  */
+  apv?: string;
+  /** Any other JWE Header member. */
+  [propName: string]: unknown;
+}
+/** Recognized JWE Key Management-related Header Parameters. */
+interface JWEKeyManagementHeaderParameters {
+  apu?: Uint8Array<ArrayBuffer>;
+  apv?: Uint8Array<ArrayBuffer>;
+  /**
+  * For Internal use only
+  */
+  p2c?: number;
+  /**
+  * For Internal use only
+  */
+  p2s?: Uint8Array<ArrayBuffer>;
+  /**
+  * For Internal use only
+  */
+  iv?: Uint8Array<ArrayBuffer>;
+  /**
+  * For Internal use only
+  */
+  epk?: CryptoKey | JWK_EC_Public;
+  /**
+  * For Internal use only
+  */
+  epkPrivateKey?: CryptoKey | JWK_EC_Private;
+}
 /**
-* Update session data (if provided) and reissue JWS.
+* JWE (JSON Web Encryption) encryption options
 */
-declare function updateJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: SessionConfigJWS<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWS<T, MaxAge>>;
+interface JWEEncryptOptions {
+  /** JWE "alg" (Algorithm) Header Parameter. Key Management Algorithm. */
+  alg?: KeyManagementAlgorithm;
+  /** JWE "enc" (Encryption Algorithm) Header Parameter. Content Encryption Algorithm. */
+  enc?: ContentEncryptionAlgorithm;
+  /** Date to use when computing NumericDate claims, defaults to `new Date()`. */
+  currentDate?: Date;
+  /** Time at which the JWT should expire, if no `exp` was already provided (only when typ is "JWT" or explicitly parsing JWT). */
+  expiresIn?: ExpiresIn;
+  /** Additional JWE Protected Header parameters. */
+  protectedHeader?: StrictOmit<JWEHeaderParameters, "alg" | "enc" | "iv" | "tag" | "p2s" | "p2c" | "epk" | "apu" | "apv">;
+  /** Initialization Vector for AES-GCMKW key wrapping. Generated if not provided. */
+  keyManagementIV?: Uint8Array<ArrayBuffer>;
+  /** PBES2 Salt value (p2s). Required for PBES2 algorithms. */
+  p2s?: Uint8Array<ArrayBuffer>;
+  /** PBES2 Iteration count (p2c). Required for PBES2 algorithms. */
+  p2c?: number;
+  /** ECDH-ES specific options. */
+  ecdh?: {
+    /**
+    * ECDH-ES Ephemeral key material. Provide a private key (CryptoKey or JWK),
+    * a CryptoKeyPair, or an object exposing both public and private parts.
+    */
+    ephemeralKey?: CryptoKey | JWK_EC_Private | CryptoKeyPair | {
+      publicKey: CryptoKey | JWK_EC_Public;
+      privateKey: CryptoKey | JWK_EC_Private;
+    }; /** ECDH-ES Agreement PartyUInfo. */
+    partyUInfo?: Uint8Array<ArrayBuffer>; /** ECDH-ES Agreement PartyVInfo. */
+    partyVInfo?: Uint8Array<ArrayBuffer>;
+  };
+  /**
+  * Content Encryption Key (CEK) to use.
+  * If provided, it will be used directly. Otherwise, a CEK will be generated.
+  */
+  cek?: Uint8Array<ArrayBuffer>;
+  /**
+  * Initialization Vector for content encryption.
+  * If provided, it will be used. Otherwise, one will be generated.
+  */
+  contentEncryptionIV?: Uint8Array<ArrayBuffer>;
+}
 /**
-* Sign current session as a compact JWS.
-* Payload claims:
-*  jti, iat, exp?, data, plus optional extraClaims (cannot override reserved)
+* JWE (JSON Web Encryption) decryption options
 */
-declare function signJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<string>;
+interface JWEDecryptOptions extends JWTClaimValidationOptions {
+  /** A list of allowed JWE "alg" (Algorithm) Header Parameter values for key management. */
+  algorithms?: KeyManagementAlgorithm[];
+  /** A list of allowed JWE "enc" (Encryption Algorithm) Header Parameter values for content encryption. */
+  encryptionAlgorithms?: ContentEncryptionAlgorithm[];
+  /** Algorithm to import the unwrapped CEK as (e.g., { name: 'AES-GCM' }). Defaults based on 'enc'. */
+  unwrappedKeyAlgorithm?: Parameters<typeof crypto.subtle.importKey>[2];
+  /** Key usages for the unwrapped CEK. Defaults based on 'enc' (typically ['encrypt', 'decrypt']). */
+  keyUsage?: KeyUsage[];
+  /** Mark the unwrapped CEK as extractable. Defaults to true. */
+  extractable?: boolean;
+  /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred based on JWE headers. */
+  forceUint8Array?: boolean;
+  /**
+  * Controls JWT claim validation after a successful decryption.
+  *
+  * - `true` — always validate claims regardless of the `typ` header
+  * - `false` — skip claim validation entirely
+  * - `undefined` (default) — validate when `typ` is `"JWT"` or contains `"jwt"`
+  */
+  validateClaims?: boolean;
+  /** If true, include the Content Encryption Key (CEK) and Additional Authenticated Data (AAD) in the result. */
+  returnCek?: boolean;
+}
 /**
-* Verify and parse a compact JWS into a Session structure.
-* Performs:
-*  - cryptographic signature verification
-*  - (optional) standard claim checks if validateJWT true
-*  - ensures jti & iat presence
-*  - enforces maxAge if provided
+* JWE Protected Header — the parsed and validated protected header returned
+* after a successful {@link decrypt} call. Both `alg` and `enc` are present
+* and strongly typed because decryption could not have succeeded without them.
 */
-declare function verifyJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>, token: string): Promise<Partial<SessionJWS<T, MaxAge>>>;
+interface JWEProtectedHeader extends JWEHeaderParameters {
+  /** Key management algorithm. */
+  alg: KeyManagementAlgorithm;
+  /** Content encryption algorithm. */
+  enc: ContentEncryptionAlgorithm;
+}
 /**
-* Destroy the session (context + cookie).
+* Result of a JWE decryption operation.
 */
-declare function clearJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: Partial<SessionConfigJWS<T, MaxAge>>): Promise<void>;
+interface JWEDecryptResult<T extends JOSEPayload = JOSEPayload> {
+  /** The decrypted payload. */
+  payload: T;
+  /** The JWE Protected Header. */
+  protectedHeader: JWEProtectedHeader;
+  /** The Content Encryption Key (CEK) used for decryption, as Uint8Array. Only present when `returnCek` is true. */
+  cek?: Uint8Array<ArrayBuffer>;
+  /** The Additional Authenticated Data (AAD) used, as Uint8Array. Only present when `returnCek` is true. */
+  aad?: Uint8Array<ArrayBuffer>;
+}
+//#endregion
+//#region src/core/types/index.d.ts
+type ExpiresIn = number | `${number}` | `${number}${"s" | "second" | "seconds" | "m" | "minute" | "minutes" | "h" | "hour" | "hours" | "D" | "day" | "days" | "W" | "week" | "weeks" | "M" | "month" | "months" | "Y" | "year" | "years"}`;
+type MaxTokenAge = ExpiresIn;
 //#endregion
-export { SessionData as C, SessionClaims as S, SessionUpdate as T, getJWESessionToken as _, clearJWSSession as a, updateJWESession as b, updateJWSSession as c, SessionConfigJWE as d, SessionHooksJWE as f, getJWESession as g, clearJWESession as h, SessionJWSConfig as i, useJWSSession as l, SessionJWEConfig as m, SessionHooksJWS as n, getJWSSession as o, SessionJWE as p, SessionJWS as r, signJWSSession as s, SessionConfigJWS as t, verifyJWSSession as u, sealJWESession as v, SessionManager as w, useJWESession as x, unsealJWESession as y };
+export { JWK_OKP_SIGN as $, JWK as A, JWK_AES_GCM_KW as B, DeriveKeyOptions as C, GenerateKeyAlgorithm as D, GenerateJWKReturn as E, JWKPEMAlgorithm as F, JWK_ECDH_ES as G, JWK_Asymmetric as H, JWKParameters as I, JWK_EC_Public as J, JWK_ECDSA as K, JWKSet as L, JWKCacheAdapter as M, JWKLookupFunction as N, GenerateKeyOptions as O, JWKLookupFunctionHeader as P, JWK_OKP_Public as Q, JWK_AES_CBC_HMAC as R, ContentEncryptionAlgorithm as S, GenerateJWKOptions as T, JWK_Asymmetric_Algorithm as U, JWK_AES_KW as V, JWK_EC as W, JWK_OKP as X, JWK_HMAC as Y, JWK_OKP_Private as Z, JWT as _, JWEEncryptOptions as a, JWK_RSA_ENC as at, JoseHeaderParameters as b, JWEProtectedHeader as c, JWK_RSA_Public as ct, JWSHeaderParameters as d, JWK_Symmetric_Algorithm as dt, JWK_PBES2 as et, JWSProtectedHeader as f, JWK_oct as ft, JOSEPayload as g, WrapKeyResult as gt, JWSVerifyResult as h, WrapKeyOptions as ht, JWEDecryptResult as i, JWK_RSA as it, JWKAlgorithm as j, GenerateKeyReturn as k, StrictOmit as l, JWK_RSA_SIGN as lt, JWSVerifyOptions as m, UnwrapKeyOptions as mt, MaxTokenAge as n, JWK_Private as nt, JWEHeaderParameters as o, JWK_RSA_PSS as ot, JWSSignOptions as p, KeyManagementAlgorithm as pt, JWK_EC_Private as q, JWEDecryptOptions as r, JWK_Public as rt, JWEKeyManagementHeaderParameters as s, JWK_RSA_Private as st, ExpiresIn as t, JWK_Pair as tt, JWSAlgorithm as u, JWK_Symmetric as ut, JWTClaimValidationOptions as v, DeriveKeyReturn as w, CompositeKey as x, JWTClaims as y, JWK_AES_GCM as z };