unjwt 0.5.39 → 0.6.0

package/dist/_chunks/jwk.d.mts

@@ -1,4 +1,58 @@
 //#region src/core/types/jwk.d.ts
+/**
+* The decoded JOSE protected header received by a {@link JWKLookupFunction}.
+*
+* The most commonly inspected fields are explicitly typed; additional
+* algorithm-specific parameters (`epk`, `p2s`, `p2c`, `apu`, `apv`, …) are
+* accessible through the index signature.
+*
+* `alg` is always present on both JWS and JWE tokens. `enc` is only present
+* on JWE tokens.
+*/
+type JWKLookupFunctionHeader = {
+  kid?: string;
+  alg?: string;
+  enc?: string;
+  typ?: string;
+  crit?: string[];
+  [propName: string]: unknown;
+};
+/**
+* A callback that resolves the decryption or verification key from a token's
+* decoded protected header and the raw compact token string.
+*
+* Accepted by both {@link verify} (JWS) and {@link decrypt} (JWE). When a
+* {@link JWKSet} is returned, the library tries each key whose `kid` and `alg`
+* are compatible with the header in order, stopping at the first that succeeds
+* — see {@link getJWKsFromSet} for the selection logic.
+*
+* Returning a `string` is meaningful for JWE only (PBES2 password); for JWS
+* a string return is encoded to bytes and used as a raw symmetric key.
+*/
+type JWKLookupFunction = (header: JWKLookupFunctionHeader, token: string) => CryptoKey | JWK | JWKSet | string | Uint8Array<ArrayBuffer> | Promise<CryptoKey | JWK | JWKSet | string | Uint8Array<ArrayBuffer>>;
+/**
+* Interface for custom JWK import cache implementations.
+*
+* The adapter receives the full JWK object so each implementation can choose
+* its own keying strategy:
+* - {@link WeakMapJWKCache} uses the object reference (GC-friendly, no string hashing needed)
+* - A `kid`-keyed cache extracts `jwk.kid` and uses it as a string key
+* - A content-hash cache hashes `jwk.k` or `jwk.n`+`jwk.e`
+*
+* @example Use a custom kid-keyed cache:
+* ```ts
+* import { configureJWKCache } from 'unjwt/jwk';
+* const map = new Map<string, CryptoKey>();
+* configureJWKCache({
+*   get: (jwk, alg) => map.get(`${jwk.kid}:${alg}`),
+*   set: (jwk, alg, key) => map.set(`${jwk.kid}:${alg}`, key),
+* });
+* ```
+*/
+interface JWKCacheAdapter {
+  get(jwk: JWK, alg: string): CryptoKey | undefined;
+  set(jwk: JWK, alg: string, key: CryptoKey): void;
+}
 /** Structure returned for composite AES-CBC + HMAC keys. */
 type CompositeKey = {
   /** The AES-CBC encryption/decryption key. */encryptionKey: CryptoKey; /** The HMAC key for integrity/authentication. */
@@ -17,8 +71,12 @@ interface GenerateKeyOptions {
   publicExponent?: Uint8Array<ArrayBuffer>;
   /** Named curve for EC or OKP keys. Defaults to "P-256" for EC and "Ed25519" for OKP. */
   namedCurve?: "P-256" | "P-384" | "P-521" | "X25519" | "Ed25519" | "Ed448";
-  /** Export the generated key(s) as JWK. If true, the key(s) will be returned in JWK format. */
-  toJWK?: undefined | boolean | Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">;
+  /**
+  * Export the generated key(s) as JWK. When `true`, keys are returned in JWK
+  * format with a generated `kid`. To include additional JWK parameters
+  * (e.g. a custom `kid`), use {@link generateJWK} instead.
+  */
+  toJWK?: boolean;
 }
 type GenerateKeyReturnJWK<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_Asymmetric_Algorithm ? TAlg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC ? {
   privateKey: JWK_RSA_Private;
@@ -31,7 +89,7 @@ type GenerateKeyReturnJWK<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_
   publicKey: JWK_OKP_Public;
 } : never : TAlg extends JWK_AES_CBC_HMAC | JWK_Symmetric_Algorithm ? JWK_oct : never;
 type GenerateKeyReturnCrypto<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_AES_CBC_HMAC ? Uint8Array<ArrayBuffer> : TAlg extends JWK_Asymmetric_Algorithm ? CryptoKeyPair : CryptoKey;
-type GenerateKeyReturn<TAlg extends GenerateKeyAlgorithm, TOptions extends GenerateKeyOptions> = TOptions["toJWK"] extends true ? GenerateKeyReturnJWK<TAlg> : TOptions["toJWK"] extends object ? GenerateKeyReturnJWK<TAlg> : GenerateKeyReturnCrypto<TAlg>;
+type GenerateKeyReturn<TAlg extends GenerateKeyAlgorithm, TOptions extends GenerateKeyOptions> = TOptions["toJWK"] extends true ? GenerateKeyReturnJWK<TAlg> : GenerateKeyReturnCrypto<TAlg>;
 type GenerateJWKOptions = Omit<GenerateKeyOptions, "toJWK">;
 type GenerateJWKReturn<TAlg extends GenerateKeyAlgorithm> = GenerateKeyReturnJWK<TAlg>;
 /** Options for the deriveKeyFromPassword function. */
@@ -44,11 +102,15 @@ interface DeriveKeyOptions {
   keyUsage?: KeyUsage[];
   /** Mark the derived key as extractable. Defaults to false. */
   extractable?: boolean;
-  /** Export the derived key as JWK. If true, the key will be returned in JWK_oct format. */
-  toJWK?: undefined | boolean | Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">;
+  /**
+  * Export the derived key as JWK_oct. When `true`, returns the derived key in
+  * JWK format. To include additional JWK parameters (e.g. a custom `kid`),
+  * use {@link deriveJWKFromPassword} instead.
+  */
+  toJWK?: boolean;
 }
 type DeriveKeyReturn<TOptions extends DeriveKeyOptions> = TOptions["toJWK"] extends true ? JWK_oct : TOptions["toJWK"] extends object ? JWK_oct : CryptoKey;
-type KeyManagementAlgorithm = JWK_RSA_ENC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_PBES2 | JWK_ECDH_ES;
+type KeyManagementAlgorithm = JWK_RSA_ENC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_PBES2 | JWK_ECDH_ES | "dir";
 type ContentEncryptionAlgorithm = JWK_AES_GCM | JWK_AES_CBC_HMAC;
 /** Options for the wrapKey function. */
 interface WrapKeyOptions {
@@ -58,12 +120,25 @@ interface WrapKeyOptions {
   p2s?: Uint8Array<ArrayBuffer>;
   /** PBES2 Iteration count (p2c). Required for PBES2 algorithms. */
   p2c?: number;
-  /** ECDH-ES Ephemeral Public Key. Generated if not provided for ECDH-ES. */
-  epk?: JWK_EC_Public;
-  /** ECDH-ES Agreement PartyUInfo. */
-  apu?: Uint8Array<ArrayBuffer>;
-  /** ECDH-ES Agreement PartyVInfo. */
-  apv?: Uint8Array<ArrayBuffer>;
+  /** ECDH-ES specific options. */
+  ecdh?: {
+    /**
+    * ECDH-ES ephemeral key material. A fresh ephemeral key pair is generated
+    * automatically when this is not provided.
+    */
+    ephemeralKey?: CryptoKey | JWK_EC_Private | CryptoKeyPair | {
+      publicKey: CryptoKey | JWK_EC_Public;
+      privateKey: CryptoKey | JWK_EC_Private;
+    }; /** Agreement PartyUInfo (apu). */
+    partyUInfo?: Uint8Array<ArrayBuffer>; /** Agreement PartyVInfo (apv). */
+    partyVInfo?: Uint8Array<ArrayBuffer>;
+    /**
+    * Content encryption algorithm used for key-length derivation.
+    * Required only when `alg` is `"ECDH-ES"` (direct key agreement).
+    * Not needed for `ECDH-ES+A128KW`, `+A192KW`, or `+A256KW`.
+    */
+    enc?: ContentEncryptionAlgorithm;
+  };
 }
 /** Result of the wrapKey function. */
 interface WrapKeyResult {
@@ -86,6 +161,13 @@ interface WrapKeyResult {
 }
 /** Options for the unwrapKey function. */
 interface UnwrapKeyOptions {
+  /**
+  * Output format of the unwrapped key.
+  * - `"cryptokey"` (default) — returns a `CryptoKey` ready for use with WebCrypto.
+  * - `"raw"` — returns the raw key bytes as `Uint8Array` (useful for
+  *   interoperability or when the algorithm is not directly importable).
+  */
+  format?: "cryptokey" | "raw";
   /** Initialization Vector (required for AES-GCMKW). Base64URL encoded or Uint8Array. */
   iv?: Uint8Array<ArrayBuffer> | string;
   /** Authentication Tag (required for AES-GCMKW). Base64URL encoded or Uint8Array. */
@@ -108,7 +190,6 @@ interface UnwrapKeyOptions {
   keyUsage?: KeyUsage[];
   /** Mark the unwrapped key as extractable. Defaults to true. */
   extractable?: boolean;
-  returnAs?: boolean | undefined;
 }
 /**
 * Forked from https://github.com/panva/jose/tree/v6.0.10
@@ -141,6 +222,12 @@ interface JWKParameters {
   x5u?: string;
   /** JWK "kid" (Key ID) Parameter */
   kid?: string;
+  /**
+  * Non-standard JWK content encryption algorithm hint.
+  * When `alg` is `"dir"`, the library reads this field to infer the
+  * content encryption algorithm (`enc`) when it is not provided in options.
+  */
+  enc?: ContentEncryptionAlgorithm;
 }
 /** Public EC JSON Web Keys */
 interface JWK_EC_Public extends JWKParameters {
@@ -221,6 +308,19 @@ type JWK_Private = JWK_RSA_Private | JWK_EC_Private | JWK_OKP_Private;
 */
 type JWK = JWK_oct | JWK_RSA | JWK_EC | JWK_OKP;
 /**
+* A pair of public and private JSON Web Keys.
+*/
+type JWK_Pair = {
+  publicKey: JWK_RSA_Public;
+  privateKey: JWK_RSA_Private;
+} | {
+  publicKey: JWK_EC_Public;
+  privateKey: JWK_EC_Private;
+} | {
+  publicKey: JWK_OKP_Public;
+  privateKey: JWK_OKP_Private;
+};
+/**
 * JSON Web Key Set ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK Set}). "RSA", "EC" and "oct" key types are supported.
 */
 interface JWKSet {
@@ -243,52 +343,9 @@ type JWK_ECDH_ES = "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A192KW" | "ECDH-ES+A2
 type JWK_OKP_SIGN = "Ed25519" | "EdDSA";
 type JWK_Symmetric_Algorithm = JWK_HMAC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW;
 type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA_ENC | JWK_OKP_SIGN | JWK_ECDH_ES;
-type JWKAlgorithm = JWK_Symmetric_Algorithm | JWK_Asymmetric_Algorithm | JWK_AES_CBC_HMAC | JWK_PBES2 | JWK_ECDH_ES | ("none" | "dir");
+type JWKAlgorithm = JWK_Symmetric_Algorithm | JWK_Asymmetric_Algorithm | JWK_AES_CBC_HMAC | JWK_PBES2 | JWK_ECDH_ES | "dir";
 type JWKPEMAlgorithm = JWK_RSA_PSS | JWK_RSA_SIGN | JWK_RSA_ENC | JWK_ECDSA | JWK_ECDH_ES | JWK_OKP_SIGN;
 //#endregion
-//#region src/core/types/jws.d.ts
-type JWS_SIGN_EXTRA = "Ed25519" | "EdDSA";
-/** JWS Signing Algorithm Identifier. */
-type JWSAlgorithm = JWK_HMAC | JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWS_SIGN_EXTRA;
-/** Recognized JWS Header Parameters, any other Header Members may also be present. */
-interface JWSHeaderParameters extends JoseHeaderParameters {
-  /** JWS "alg" (Algorithm) Header Parameter */
-  alg?: JWSAlgorithm;
-  /**
-  * This JWS Extension Header Parameter modifies the JWS Payload representation and the JWS Signing
-  * Input computation as per {@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}.
-  * If `false`, the payload is used directly without Base64URL encoding.
-  * Defaults to `true`.
-  */
-  b64?: boolean;
-}
-/** JWS Protected Header */
-interface JWSProtectedHeader extends JWSHeaderParameters {
-  alg: JWSAlgorithm;
-}
-/**
-* JWS (JSON Web Signature) options for signing
-*/
-interface JWSSignOptions {
-  /** The JWS Algorithm to use. Must be provided. */
-  alg?: JWSAlgorithm;
-  /**
-  * Additional protected header parameters. `alg` is automatically included.
-  * `typ` defaults to "JWT" if not provided and payload is an object.
-  */
-  protectedHeader?: JWSHeaderParameters;
-  /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
-  currentDate?: Date;
-  /**
-  * Time at which the JWS should expire, if no `exp` was already provided.
-  */
-  expiresIn?: ExpiresIn;
-}
-//#endregion
-//#region src/core/types/index.d.ts
-type ExpiresIn = number | `${number}` | `${number}${"s" | "second" | "seconds" | "m" | "minute" | "minutes" | "h" | "hour" | "hours" | "D" | "day" | "days" | "W" | "week" | "weeks" | "M" | "month" | "months" | "Y" | "year" | "years"}`;
-type MaxTokenAge = ExpiresIn;
-//#endregion
 //#region src/core/types/jwt.d.ts
 /** Header Parameters common to JWE and JWS */
 interface JoseHeaderParameters {
@@ -313,6 +370,15 @@ interface JoseHeaderParameters {
   /** Any other JWS/JWE Header member. */
   [propName: string]: unknown;
 }
+/**
+* Payload accepted by {@link sign} and {@link encrypt}.
+*
+* Covers raw strings and bytes for non-JWT use, plus any JSON-serializable
+* object for JWT and generic structured payloads. JWT-specific claim names
+* are not enforced at this level — use {@link JWTClaims} when you want typed
+* claim names and spec-compliant field types.
+*/
+type JOSEPayload = string | Uint8Array<ArrayBuffer> | Record<string, unknown>;
 interface JWTClaims {
   /** "iss" (Issuer) Claim */
   iss?: string;
@@ -354,14 +420,73 @@ interface JWTClaimValidationOptions {
   currentDate?: Date;
   /** Additional required claim names. */
   requiredClaims?: string[];
-  /** List of critical header parameters that must be understood and processed. */
-  requiredHeaders?: string[];
   /**
-  * Critical Header Parameters to be understood and processed.
-  * If the JWT contains critical headers not in this list (and not inherently understood by the library), decryption will fail.
-  * @deprecated use {@link requiredHeaders `recognizedHeaders` option} instead.
+  * Critical header parameters that this caller understands and has processed.
+  * If the token's `crit` header lists a parameter not present in this list
+  * (and not natively understood by the library), verification will fail per
+  * RFC 7515 §4.1.11 / RFC 7516 §4.1.13.
+  */
+  recognizedHeaders?: string[];
+}
+//#endregion
+//#region src/core/types/jws.d.ts
+/** JWS Signing Algorithm Identifier. */
+type JWSAlgorithm = JWK_HMAC | JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_OKP_SIGN;
+/** Recognized JWS Header Parameters, any other Header Members may also be present. */
+interface JWSHeaderParameters extends JoseHeaderParameters {
+  /** JWS "alg" (Algorithm) Header Parameter */
+  alg?: JWSAlgorithm;
+  /**
+  * This JWS Extension Header Parameter modifies the JWS Payload representation and the JWS Signing
+  * Input computation as per {@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}.
+  * If `false`, the payload is used directly without Base64URL encoding.
+  * Defaults to `true`.
+  */
+  b64?: boolean;
+}
+/** JWS Protected Header */
+interface JWSProtectedHeader extends JWSHeaderParameters {
+  alg: JWSAlgorithm;
+}
+/**
+* JWS (JSON Web Signature) options for signing
+*/
+interface JWSSignOptions {
+  /** The JWS Algorithm to use. Must be provided. */
+  alg?: JWSAlgorithm;
+  /**
+  * Additional protected header parameters. `alg` is automatically included.
+  * `typ` defaults to "JWT" if not provided and payload is an object.
+  */
+  protectedHeader?: JWSHeaderParameters;
+  /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
+  currentDate?: Date;
+  /**
+  * Time at which the JWS should expire, if no `exp` was already provided.
   */
-  critical?: string[];
+  expiresIn?: ExpiresIn;
+}
+/** Result of JWS verification */
+interface JWSVerifyResult<T extends JOSEPayload = JOSEPayload> {
+  /** The decoded and verified payload. */
+  payload: T;
+  /** The JWS Protected Header. */
+  protectedHeader: JWSProtectedHeader;
+}
+/** Options for JWS verification */
+interface JWSVerifyOptions extends JWTClaimValidationOptions {
+  /** List of allowed algorithms. If provided, the JWS `alg` must be in this list. */
+  algorithms?: JWSAlgorithm[];
+  /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred. */
+  forceUint8Array?: boolean;
+  /**
+  * Controls JWT claim validation after a successful verification.
+  *
+  * - `true` — always validate claims regardless of the `typ` header
+  * - `false` — skip claim validation entirely
+  * - `undefined` (default) — validate when `typ` is `"JWT"` or contains `"jwt"`
+  */
+  validateClaims?: boolean;
 }
 //#endregion
 //#region src/core/utils/types.d.ts
@@ -373,11 +498,11 @@ interface JWEHeaderParameters extends JoseHeaderParameters {
   /**
   * `alg` (Algorithm): Header Parameter - Key Management Algorithm
   */
-  alg?: string;
+  alg?: KeyManagementAlgorithm | (string & {});
   /**
   * `enc` (Encryption Algorithm): Header Parameter - Content Encryption Algorithm
   */
-  enc?: string;
+  enc?: ContentEncryptionAlgorithm | (string & {});
   /**
   * `p2c` (PBES2 Count): Header Parameter
   */
@@ -479,12 +604,6 @@ interface JWEEncryptOptions {
   contentEncryptionIV?: Uint8Array<ArrayBuffer>;
 }
 /**
-* Key lookup function for JWE decryption.
-* @param header The JWE Protected Header.
-* @returns The key material (CryptoKey, JWK, password string, or raw Uint8Array) or a Promise resolving to it.
-*/
-type JWEKeyLookupFunction = (header: JWEHeaderParameters, token: string) => CryptoKey | JWK | string | Uint8Array<ArrayBuffer> | Promise<CryptoKey | JWK | string | Uint8Array<ArrayBuffer>>;
-/**
 * JWE (JSON Web Encryption) decryption options
 */
 interface JWEDecryptOptions extends JWTClaimValidationOptions {
@@ -500,34 +619,45 @@ interface JWEDecryptOptions extends JWTClaimValidationOptions {
   extractable?: boolean;
   /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred based on JWE headers. */
   forceUint8Array?: boolean;
-  /** Unless false, will parse payload as JWT and validate claims if applicable (typ "JWT"). */
-  validateJWT?: boolean;
+  /**
+  * Controls JWT claim validation after a successful decryption.
+  *
+  * - `true` — always validate claims regardless of the `typ` header
+  * - `false` — skip claim validation entirely
+  * - `undefined` (default) — validate when `typ` is `"JWT"` or contains `"jwt"`
+  */
+  validateClaims?: boolean;
   /** If true, include the Content Encryption Key (CEK) and Additional Authenticated Data (AAD) in the result. */
   returnCek?: boolean;
 }
 /**
+* JWE Protected Header — the parsed and validated protected header returned
+* after a successful {@link decrypt} call. Both `alg` and `enc` are present
+* and strongly typed because decryption could not have succeeded without them.
+*/
+interface JWEProtectedHeader extends JWEHeaderParameters {
+  /** Key management algorithm. */
+  alg: KeyManagementAlgorithm;
+  /** Content encryption algorithm. */
+  enc: ContentEncryptionAlgorithm;
+}
+/**
 * Result of a JWE decryption operation.
 */
-interface JWEDecryptResult<T extends JWTClaims | Uint8Array<ArrayBuffer> | string = JWTClaims | Uint8Array<ArrayBuffer> | string> {
+interface JWEDecryptResult<T extends JOSEPayload = JOSEPayload> {
   /** The decrypted payload. */
   payload: T;
   /** The JWE Protected Header. */
-  protectedHeader: JWEHeaderParameters;
+  protectedHeader: JWEProtectedHeader;
   /** The Content Encryption Key (CEK) used for decryption, as Uint8Array. Only present when `returnCek` is true. */
   cek?: Uint8Array<ArrayBuffer>;
   /** The Additional Authenticated Data (AAD) used, as Uint8Array. Only present when `returnCek` is true. */
   aad?: Uint8Array<ArrayBuffer>;
 }
 //#endregion
-//#region src/core/jose/asn1.d.ts
-/** Key Import Function options. */
-interface KeyImportOptions {
-  /**
-  * The value to use as {@link !SubtleCrypto.importKey} `extractable` argument. Default is false for
-  * private keys, true otherwise.
-  */
-  extractable?: boolean;
-}
+//#region src/core/types/index.d.ts
+type ExpiresIn = number | `${number}` | `${number}${"s" | "second" | "seconds" | "m" | "minute" | "minutes" | "h" | "hour" | "hours" | "D" | "day" | "days" | "W" | "week" | "weeks" | "M" | "month" | "months" | "Y" | "year" | "years"}`;
+type MaxTokenAge = ExpiresIn;
 //#endregion
 //#region src/core/jwk.d.ts
 /**
@@ -560,7 +690,10 @@ declare function deriveJWKFromPassword(password: string | Uint8Array<ArrayBuffer
 * @param jwkExtras Additional properties to merge into the resulting JWK.
 * @returns A Promise resolving to the imported key as a JWK.
 */
-declare function importJWKFromPEM<T extends JWK>(pem: string, pemType: "pkcs8" | "spki" | "x509", alg: JWKPEMAlgorithm, importOptions?: KeyImportOptions, jwkExtras?: Partial<JWK>): Promise<T>;
+declare function importFromPEM<T extends JWK>(pem: string, pemType: "pkcs8" | "spki" | "x509", alg: JWKPEMAlgorithm, options?: {
+  /** Passed to `crypto.subtle.importKey`. Defaults to `false` for private keys, `true` otherwise. */extractable?: boolean; /** Additional JWK properties merged into the exported key (e.g. `kid`). */
+  jwkParams?: Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">;
+}): Promise<T>;
 /**
 * Exports a JWK to a PEM-encoded string.
 *
@@ -570,6 +703,6 @@ declare function importJWKFromPEM<T extends JWK>(pem: string, pemType: "pkcs8" |
 *                              required to correctly convert it to a CryptoKey first.
 * @returns A Promise resolving to the PEM-encoded key string.
 */
-declare function exportJWKToPEM(jwk: JWK, pemFormat: "pkcs8" | "spki", algForCryptoKeyImport?: JWKPEMAlgorithm): Promise<string>;
+declare function exportToPEM(jwk: JWK, pemFormat: "pkcs8" | "spki", algForCryptoKeyImport?: JWKPEMAlgorithm): Promise<string>;
 //#endregion
-export { JWK_RSA_ENC as $, JWKPEMAlgorithm as A, JWK_ECDH_ES as B, GenerateJWKOptions as C, GenerateKeyReturn as D, GenerateKeyOptions as E, JWK_AES_GCM_KW as F, JWK_OKP as G, JWK_EC_Private as H, JWK_AES_KW as I, JWK_OKP_SIGN as J, JWK_OKP_Private as K, JWK_Asymmetric as L, JWKSet as M, JWK_AES_CBC_HMAC as N, JWK as O, JWK_AES_GCM as P, JWK_RSA as Q, JWK_Asymmetric_Algorithm as R, DeriveKeyReturn as S, GenerateKeyAlgorithm as T, JWK_EC_Public as U, JWK_ECDSA as V, JWK_HMAC as W, JWK_Private as X, JWK_PBES2 as Y, JWK_Public as Z, JWSProtectedHeader as _, JWEDecryptOptions as a, JWK_Symmetric_Algorithm as at, ContentEncryptionAlgorithm as b, JWEHeaderParameters as c, UnwrapKeyOptions as ct, StrictOmit as d, JWK_RSA_PSS as et, JWT as f, ExpiresIn as g, JoseHeaderParameters as h, importJWKFromPEM as i, JWK_Symmetric as it, JWKParameters as j, JWKAlgorithm as k, JWEKeyLookupFunction as l, WrapKeyOptions as lt, JWTClaims as m, exportJWKToPEM as n, JWK_RSA_Public as nt, JWEDecryptResult as o, JWK_oct as ot, JWTClaimValidationOptions as p, JWK_OKP_Public as q, generateJWK as r, JWK_RSA_SIGN as rt, JWEEncryptOptions as s, KeyManagementAlgorithm as st, deriveJWKFromPassword as t, JWK_RSA_Private as tt, JWEKeyManagementHeaderParameters as u, WrapKeyResult as ut, JWSSignOptions as v, GenerateJWKReturn as w, DeriveKeyOptions as x, CompositeKey as y, JWK_EC as z };
+export { JWK_HMAC as $, GenerateJWKReturn as A, JWKParameters as B, JWTClaims as C, DeriveKeyOptions as D, ContentEncryptionAlgorithm as E, JWKAlgorithm as F, JWK_AES_KW as G, JWK_AES_CBC_HMAC as H, JWKCacheAdapter as I, JWK_EC as J, JWK_Asymmetric as K, JWKLookupFunction as L, GenerateKeyOptions as M, GenerateKeyReturn as N, DeriveKeyReturn as O, JWK as P, JWK_EC_Public as Q, JWKLookupFunctionHeader as R, JWTClaimValidationOptions as S, CompositeKey as T, JWK_AES_GCM as U, JWKSet as V, JWK_AES_GCM_KW as W, JWK_ECDSA as X, JWK_ECDH_ES as Y, JWK_EC_Private as Z, JWSSignOptions as _, KeyManagementAlgorithm as _t, ExpiresIn as a, JWK_Pair as at, JOSEPayload as b, WrapKeyResult as bt, JWEDecryptResult as c, JWK_RSA as ct, JWEKeyManagementHeaderParameters as d, JWK_RSA_Private as dt, JWK_OKP as et, JWEProtectedHeader as f, JWK_RSA_Public as ft, JWSProtectedHeader as g, JWK_oct as gt, JWSHeaderParameters as h, JWK_Symmetric_Algorithm as ht, importFromPEM as i, JWK_PBES2 as it, GenerateKeyAlgorithm as j, GenerateJWKOptions as k, JWEEncryptOptions as l, JWK_RSA_ENC as lt, JWSAlgorithm as m, JWK_Symmetric as mt, exportToPEM as n, JWK_OKP_Public as nt, MaxTokenAge as o, JWK_Private as ot, StrictOmit as p, JWK_RSA_SIGN as pt, JWK_Asymmetric_Algorithm as q, generateJWK as r, JWK_OKP_SIGN as rt, JWEDecryptOptions as s, JWK_Public as st, deriveJWKFromPassword as t, JWK_OKP_Private as tt, JWEHeaderParameters as u, JWK_RSA_PSS as ut, JWSVerifyOptions as v, UnwrapKeyOptions as vt, JoseHeaderParameters as w, JWT as x, JWSVerifyResult as y, WrapKeyOptions as yt, JWKPEMAlgorithm as z };