unjwt 0.5.40 → 0.6.0

package/dist/_chunks/error.d.mts

@@ -0,0 +1,67 @@
+//#region src/core/error.d.ts
+/**
+* All known error codes thrown by unjwt.
+*
+* Code naming follows the JOSE spec hierarchy:
+*   ERR_JWT_*  — RFC 7519 JSON Web Token claim validation
+*   ERR_JWS_*  — RFC 7515 JSON Web Signature
+*   ERR_JWE_*  — RFC 7516 JSON Web Encryption
+*   ERR_JWK_*  — RFC 7517 JSON Web Key
+*/
+type JWTErrorCode = "ERR_JWT_EXPIRED" | "ERR_JWT_NBF" | "ERR_JWT_CLAIM_INVALID" | "ERR_JWT_CLAIM_MISSING" | "ERR_JWS_INVALID" | "ERR_JWS_SIGNATURE_INVALID" | "ERR_JWS_ALG_NOT_ALLOWED" | "ERR_JWE_INVALID" | "ERR_JWE_DECRYPTION_FAILED" | "ERR_JWE_ALG_NOT_ALLOWED" | "ERR_JWK_INVALID" | "ERR_JWK_KEY_NOT_FOUND" | (string & {});
+/**
+* Maps known error codes to their structured `cause` shapes.
+* Only codes that carry decoded context beyond the message appear here.
+* Extend this interface when new structured causes are introduced.
+*/
+interface JWTErrorCauseMap {
+  /** Decoded claims available at the point the lifetime check failed. */
+  ERR_JWT_EXPIRED: {
+    jti?: string;
+    iat?: number;
+    exp?: number;
+  };
+}
+/**
+* Base error class for all unjwt errors. Every error thrown by the library is
+* an instance of `JWTError`, so a single `instanceof` check is sufficient to
+* distinguish library errors from other thrown values. Use the `code` property
+* (or the `isJWTError` type guard) to narrow to a specific error condition.
+*
+* @example
+* import { JWTError, isJWTError } from "unjwt/jws";
+*
+* try {
+*   await verify(token, key);
+* } catch (err) {
+*   if (isJWTError(err, "ERR_JWT_EXPIRED")) {
+*     console.log(err.cause.jti); // string | undefined
+*   }
+* }
+*/
+declare class JWTError<TCode extends JWTErrorCode = JWTErrorCode> extends Error {
+  readonly code: TCode;
+  override readonly cause?: unknown;
+  constructor(message: string, code: TCode, cause?: unknown);
+}
+/**
+* Type guard that narrows `error` to `JWTError`.
+*
+* When called with a code that is a key of `JWTErrorCauseMap`, the return
+* type is additionally narrowed to include the structured `cause` shape for
+* that code. When called with any other `JWTErrorCode`, `code` is narrowed
+* but `cause` remains `unknown`. When called without a code, narrows only to
+* `JWTError`.
+*
+* @example
+* if (isJWTError(err, "ERR_JWT_EXPIRED")) {
+*   err.cause.jti // string | undefined  ✓
+* }
+*/
+declare function isJWTError<T extends keyof JWTErrorCauseMap>(error: unknown, code: T): error is JWTError<T> & {
+  cause: JWTErrorCauseMap[T];
+};
+declare function isJWTError<T extends JWTErrorCode>(error: unknown, code: T): error is JWTError<T>;
+declare function isJWTError(error: unknown): error is JWTError;
+//#endregion
+export { isJWTError as i, JWTErrorCauseMap as n, JWTErrorCode as r, JWTError as t };

package/dist/_chunks/index.d.mts

@@ -1,4 +1,58 @@
 //#region src/core/types/jwk.d.ts
+/**
+* The decoded JOSE protected header received by a {@link JWKLookupFunction}.
+*
+* The most commonly inspected fields are explicitly typed; additional
+* algorithm-specific parameters (`epk`, `p2s`, `p2c`, `apu`, `apv`, …) are
+* accessible through the index signature.
+*
+* `alg` is always present on both JWS and JWE tokens. `enc` is only present
+* on JWE tokens.
+*/
+type JWKLookupFunctionHeader = {
+  kid?: string;
+  alg?: string;
+  enc?: string;
+  typ?: string;
+  crit?: string[];
+  [propName: string]: unknown;
+};
+/**
+* A callback that resolves the decryption or verification key from a token's
+* decoded protected header and the raw compact token string.
+*
+* Accepted by both {@link verify} (JWS) and {@link decrypt} (JWE). When a
+* {@link JWKSet} is returned, the library tries each key whose `kid` and `alg`
+* are compatible with the header in order, stopping at the first that succeeds
+* — see {@link getJWKsFromSet} for the selection logic.
+*
+* Returning a `string` is meaningful for JWE only (PBES2 password); for JWS
+* a string return is encoded to bytes and used as a raw symmetric key.
+*/
+type JWKLookupFunction = (header: JWKLookupFunctionHeader, token: string) => CryptoKey | JWK | JWKSet | string | Uint8Array<ArrayBuffer> | Promise<CryptoKey | JWK | JWKSet | string | Uint8Array<ArrayBuffer>>;
+/**
+* Interface for custom JWK import cache implementations.
+*
+* The adapter receives the full JWK object so each implementation can choose
+* its own keying strategy:
+* - {@link WeakMapJWKCache} uses the object reference (GC-friendly, no string hashing needed)
+* - A `kid`-keyed cache extracts `jwk.kid` and uses it as a string key
+* - A content-hash cache hashes `jwk.k` or `jwk.n`+`jwk.e`
+*
+* @example Use a custom kid-keyed cache:
+* ```ts
+* import { configureJWKCache } from 'unjwt/jwk';
+* const map = new Map<string, CryptoKey>();
+* configureJWKCache({
+*   get: (jwk, alg) => map.get(`${jwk.kid}:${alg}`),
+*   set: (jwk, alg, key) => map.set(`${jwk.kid}:${alg}`, key),
+* });
+* ```
+*/
+interface JWKCacheAdapter {
+  get(jwk: JWK, alg: string): CryptoKey | undefined;
+  set(jwk: JWK, alg: string, key: CryptoKey): void;
+}
 /** Structure returned for composite AES-CBC + HMAC keys. */
 type CompositeKey = {
   /** The AES-CBC encryption/decryption key. */encryptionKey: CryptoKey; /** The HMAC key for integrity/authentication. */
@@ -17,8 +71,12 @@ interface GenerateKeyOptions {
   publicExponent?: Uint8Array<ArrayBuffer>;
   /** Named curve for EC or OKP keys. Defaults to "P-256" for EC and "Ed25519" for OKP. */
   namedCurve?: "P-256" | "P-384" | "P-521" | "X25519" | "Ed25519" | "Ed448";
-  /** Export the generated key(s) as JWK. If true, the key(s) will be returned in JWK format. */
-  toJWK?: undefined | boolean | Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">;
+  /**
+  * Export the generated key(s) as JWK. When `true`, keys are returned in JWK
+  * format with a generated `kid`. To include additional JWK parameters
+  * (e.g. a custom `kid`), use {@link generateJWK} instead.
+  */
+  toJWK?: boolean;
 }
 type GenerateKeyReturnJWK<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_Asymmetric_Algorithm ? TAlg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC ? {
   privateKey: JWK_RSA_Private;
@@ -31,7 +89,7 @@ type GenerateKeyReturnJWK<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_
   publicKey: JWK_OKP_Public;
 } : never : TAlg extends JWK_AES_CBC_HMAC | JWK_Symmetric_Algorithm ? JWK_oct : never;
 type GenerateKeyReturnCrypto<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_AES_CBC_HMAC ? Uint8Array<ArrayBuffer> : TAlg extends JWK_Asymmetric_Algorithm ? CryptoKeyPair : CryptoKey;
-type GenerateKeyReturn<TAlg extends GenerateKeyAlgorithm, TOptions extends GenerateKeyOptions> = TOptions["toJWK"] extends true ? GenerateKeyReturnJWK<TAlg> : TOptions["toJWK"] extends object ? GenerateKeyReturnJWK<TAlg> : GenerateKeyReturnCrypto<TAlg>;
+type GenerateKeyReturn<TAlg extends GenerateKeyAlgorithm, TOptions extends GenerateKeyOptions> = TOptions["toJWK"] extends true ? GenerateKeyReturnJWK<TAlg> : GenerateKeyReturnCrypto<TAlg>;
 type GenerateJWKOptions = Omit<GenerateKeyOptions, "toJWK">;
 type GenerateJWKReturn<TAlg extends GenerateKeyAlgorithm> = GenerateKeyReturnJWK<TAlg>;
 /** Options for the deriveKeyFromPassword function. */
@@ -44,11 +102,15 @@ interface DeriveKeyOptions {
   keyUsage?: KeyUsage[];
   /** Mark the derived key as extractable. Defaults to false. */
   extractable?: boolean;
-  /** Export the derived key as JWK. If true, the key will be returned in JWK_oct format. */
-  toJWK?: undefined | boolean | Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">;
+  /**
+  * Export the derived key as JWK_oct. When `true`, returns the derived key in
+  * JWK format. To include additional JWK parameters (e.g. a custom `kid`),
+  * use {@link deriveJWKFromPassword} instead.
+  */
+  toJWK?: boolean;
 }
 type DeriveKeyReturn<TOptions extends DeriveKeyOptions> = TOptions["toJWK"] extends true ? JWK_oct : TOptions["toJWK"] extends object ? JWK_oct : CryptoKey;
-type KeyManagementAlgorithm = JWK_RSA_ENC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_PBES2 | JWK_ECDH_ES;
+type KeyManagementAlgorithm = JWK_RSA_ENC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_PBES2 | JWK_ECDH_ES | "dir";
 type ContentEncryptionAlgorithm = JWK_AES_GCM | JWK_AES_CBC_HMAC;
 /** Options for the wrapKey function. */
 interface WrapKeyOptions {
@@ -58,12 +120,25 @@ interface WrapKeyOptions {
   p2s?: Uint8Array<ArrayBuffer>;
   /** PBES2 Iteration count (p2c). Required for PBES2 algorithms. */
   p2c?: number;
-  /** ECDH-ES Ephemeral Public Key. Generated if not provided for ECDH-ES. */
-  epk?: JWK_EC_Public;
-  /** ECDH-ES Agreement PartyUInfo. */
-  apu?: Uint8Array<ArrayBuffer>;
-  /** ECDH-ES Agreement PartyVInfo. */
-  apv?: Uint8Array<ArrayBuffer>;
+  /** ECDH-ES specific options. */
+  ecdh?: {
+    /**
+    * ECDH-ES ephemeral key material. A fresh ephemeral key pair is generated
+    * automatically when this is not provided.
+    */
+    ephemeralKey?: CryptoKey | JWK_EC_Private | CryptoKeyPair | {
+      publicKey: CryptoKey | JWK_EC_Public;
+      privateKey: CryptoKey | JWK_EC_Private;
+    }; /** Agreement PartyUInfo (apu). */
+    partyUInfo?: Uint8Array<ArrayBuffer>; /** Agreement PartyVInfo (apv). */
+    partyVInfo?: Uint8Array<ArrayBuffer>;
+    /**
+    * Content encryption algorithm used for key-length derivation.
+    * Required only when `alg` is `"ECDH-ES"` (direct key agreement).
+    * Not needed for `ECDH-ES+A128KW`, `+A192KW`, or `+A256KW`.
+    */
+    enc?: ContentEncryptionAlgorithm;
+  };
 }
 /** Result of the wrapKey function. */
 interface WrapKeyResult {
@@ -86,6 +161,13 @@ interface WrapKeyResult {
 }
 /** Options for the unwrapKey function. */
 interface UnwrapKeyOptions {
+  /**
+  * Output format of the unwrapped key.
+  * - `"cryptokey"` (default) — returns a `CryptoKey` ready for use with WebCrypto.
+  * - `"raw"` — returns the raw key bytes as `Uint8Array` (useful for
+  *   interoperability or when the algorithm is not directly importable).
+  */
+  format?: "cryptokey" | "raw";
   /** Initialization Vector (required for AES-GCMKW). Base64URL encoded or Uint8Array. */
   iv?: Uint8Array<ArrayBuffer> | string;
   /** Authentication Tag (required for AES-GCMKW). Base64URL encoded or Uint8Array. */
@@ -108,7 +190,6 @@ interface UnwrapKeyOptions {
   keyUsage?: KeyUsage[];
   /** Mark the unwrapped key as extractable. Defaults to true. */
   extractable?: boolean;
-  returnAs?: boolean | undefined;
 }
 /**
 * Forked from https://github.com/panva/jose/tree/v6.0.10
@@ -141,6 +222,12 @@ interface JWKParameters {
   x5u?: string;
   /** JWK "kid" (Key ID) Parameter */
   kid?: string;
+  /**
+  * Non-standard JWK content encryption algorithm hint.
+  * When `alg` is `"dir"`, the library reads this field to infer the
+  * content encryption algorithm (`enc`) when it is not provided in options.
+  */
+  enc?: ContentEncryptionAlgorithm;
 }
 /** Public EC JSON Web Keys */
 interface JWK_EC_Public extends JWKParameters {
@@ -256,7 +343,7 @@ type JWK_ECDH_ES = "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A192KW" | "ECDH-ES+A2
 type JWK_OKP_SIGN = "Ed25519" | "EdDSA";
 type JWK_Symmetric_Algorithm = JWK_HMAC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW;
 type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA_ENC | JWK_OKP_SIGN | JWK_ECDH_ES;
-type JWKAlgorithm = JWK_Symmetric_Algorithm | JWK_Asymmetric_Algorithm | JWK_AES_CBC_HMAC | JWK_PBES2 | JWK_ECDH_ES | ("none" | "dir");
+type JWKAlgorithm = JWK_Symmetric_Algorithm | JWK_Asymmetric_Algorithm | JWK_AES_CBC_HMAC | JWK_PBES2 | JWK_ECDH_ES | "dir";
 type JWKPEMAlgorithm = JWK_RSA_PSS | JWK_RSA_SIGN | JWK_RSA_ENC | JWK_ECDSA | JWK_ECDH_ES | JWK_OKP_SIGN;
 //#endregion
 //#region src/core/types/jwt.d.ts
@@ -283,6 +370,15 @@ interface JoseHeaderParameters {
   /** Any other JWS/JWE Header member. */
   [propName: string]: unknown;
 }
+/**
+* Payload accepted by {@link sign} and {@link encrypt}.
+*
+* Covers raw strings and bytes for non-JWT use, plus any JSON-serializable
+* object for JWT and generic structured payloads. JWT-specific claim names
+* are not enforced at this level — use {@link JWTClaims} when you want typed
+* claim names and spec-compliant field types.
+*/
+type JOSEPayload = string | Uint8Array<ArrayBuffer> | Record<string, unknown>;
 interface JWTClaims {
   /** "iss" (Issuer) Claim */
   iss?: string;
@@ -324,20 +420,18 @@ interface JWTClaimValidationOptions {
   currentDate?: Date;
   /** Additional required claim names. */
   requiredClaims?: string[];
-  /** List of critical header parameters that must be understood and processed. */
-  requiredHeaders?: string[];
   /**
-  * Critical Header Parameters to be understood and processed.
-  * If the JWT contains critical headers not in this list (and not inherently understood by the library), decryption will fail.
-  * @deprecated use {@link requiredHeaders `recognizedHeaders` option} instead.
+  * Critical header parameters that this caller understands and has processed.
+  * If the token's `crit` header lists a parameter not present in this list
+  * (and not natively understood by the library), verification will fail per
+  * RFC 7515 §4.1.11 / RFC 7516 §4.1.13.
   */
-  critical?: string[];
+  recognizedHeaders?: string[];
 }
 //#endregion
 //#region src/core/types/jws.d.ts
-type JWS_SIGN_EXTRA = "Ed25519" | "EdDSA";
 /** JWS Signing Algorithm Identifier. */
-type JWSAlgorithm = JWK_HMAC | JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWS_SIGN_EXTRA;
+type JWSAlgorithm = JWK_HMAC | JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_OKP_SIGN;
 /** Recognized JWS Header Parameters, any other Header Members may also be present. */
 interface JWSHeaderParameters extends JoseHeaderParameters {
   /** JWS "alg" (Algorithm) Header Parameter */
@@ -373,7 +467,7 @@ interface JWSSignOptions {
   expiresIn?: ExpiresIn;
 }
 /** Result of JWS verification */
-interface JWSVerifyResult<T extends JWTClaims | Uint8Array<ArrayBuffer> | string = JWTClaims | Uint8Array<ArrayBuffer> | string> {
+interface JWSVerifyResult<T extends JOSEPayload = JOSEPayload> {
   /** The decoded and verified payload. */
   payload: T;
   /** The JWS Protected Header. */
@@ -385,16 +479,15 @@ interface JWSVerifyOptions extends JWTClaimValidationOptions {
   algorithms?: JWSAlgorithm[];
   /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred. */
   forceUint8Array?: boolean;
-  /** Unless false, will parse payload as JWT and validate claims if applicable (typ "JWT"). */
-  validateJWT?: boolean;
+  /**
+  * Controls JWT claim validation after a successful verification.
+  *
+  * - `true` — always validate claims regardless of the `typ` header
+  * - `false` — skip claim validation entirely
+  * - `undefined` (default) — validate when `typ` is `"JWT"` or contains `"jwt"`
+  */
+  validateClaims?: boolean;
 }
-/**
-* Key lookup function for JWS verification.
-* @param header The JWS Protected Header.
-* @param token The JWS token.
-* @returns The key material (CryptoKey, JWK, or raw Uint8Array) or a Promise resolving to it.
-*/
-type JWSKeyLookupFunction = (header: JWSProtectedHeader, token: string) => CryptoKey | JWK | JWKSet | Uint8Array<ArrayBuffer> | Promise<CryptoKey | JWK | JWKSet | Uint8Array<ArrayBuffer>>;
 //#endregion
 //#region src/core/utils/types.d.ts
 type StrictOmit<T, K extends keyof T | (string & {}) | (number & {}) | (symbol & {})> = { [P in keyof T as P extends K ? never : P]: T[P] };
@@ -405,11 +498,11 @@ interface JWEHeaderParameters extends JoseHeaderParameters {
   /**
   * `alg` (Algorithm): Header Parameter - Key Management Algorithm
   */
-  alg?: string;
+  alg?: KeyManagementAlgorithm | (string & {});
   /**
   * `enc` (Encryption Algorithm): Header Parameter - Content Encryption Algorithm
   */
-  enc?: string;
+  enc?: ContentEncryptionAlgorithm | (string & {});
   /**
   * `p2c` (PBES2 Count): Header Parameter
   */
@@ -511,12 +604,6 @@ interface JWEEncryptOptions {
   contentEncryptionIV?: Uint8Array<ArrayBuffer>;
 }
 /**
-* Key lookup function for JWE decryption.
-* @param header The JWE Protected Header.
-* @returns The key material (CryptoKey, JWK, password string, or raw Uint8Array) or a Promise resolving to it.
-*/
-type JWEKeyLookupFunction = (header: JWEHeaderParameters, token: string) => CryptoKey | JWK | string | Uint8Array<ArrayBuffer> | Promise<CryptoKey | JWK | string | Uint8Array<ArrayBuffer>>;
-/**
 * JWE (JSON Web Encryption) decryption options
 */
 interface JWEDecryptOptions extends JWTClaimValidationOptions {
@@ -532,19 +619,36 @@ interface JWEDecryptOptions extends JWTClaimValidationOptions {
   extractable?: boolean;
   /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred based on JWE headers. */
   forceUint8Array?: boolean;
-  /** Unless false, will parse payload as JWT and validate claims if applicable (typ "JWT"). */
-  validateJWT?: boolean;
+  /**
+  * Controls JWT claim validation after a successful decryption.
+  *
+  * - `true` — always validate claims regardless of the `typ` header
+  * - `false` — skip claim validation entirely
+  * - `undefined` (default) — validate when `typ` is `"JWT"` or contains `"jwt"`
+  */
+  validateClaims?: boolean;
   /** If true, include the Content Encryption Key (CEK) and Additional Authenticated Data (AAD) in the result. */
   returnCek?: boolean;
 }
 /**
+* JWE Protected Header — the parsed and validated protected header returned
+* after a successful {@link decrypt} call. Both `alg` and `enc` are present
+* and strongly typed because decryption could not have succeeded without them.
+*/
+interface JWEProtectedHeader extends JWEHeaderParameters {
+  /** Key management algorithm. */
+  alg: KeyManagementAlgorithm;
+  /** Content encryption algorithm. */
+  enc: ContentEncryptionAlgorithm;
+}
+/**
 * Result of a JWE decryption operation.
 */
-interface JWEDecryptResult<T extends JWTClaims | Uint8Array<ArrayBuffer> | string = JWTClaims | Uint8Array<ArrayBuffer> | string> {
+interface JWEDecryptResult<T extends JOSEPayload = JOSEPayload> {
   /** The decrypted payload. */
   payload: T;
   /** The JWE Protected Header. */
-  protectedHeader: JWEHeaderParameters;
+  protectedHeader: JWEProtectedHeader;
   /** The Content Encryption Key (CEK) used for decryption, as Uint8Array. Only present when `returnCek` is true. */
   cek?: Uint8Array<ArrayBuffer>;
   /** The Additional Authenticated Data (AAD) used, as Uint8Array. Only present when `returnCek` is true. */
@@ -555,4 +659,4 @@ interface JWEDecryptResult<T extends JWTClaims | Uint8Array<ArrayBuffer> | strin
 type ExpiresIn = number | `${number}` | `${number}${"s" | "second" | "seconds" | "m" | "minute" | "minutes" | "h" | "hour" | "hours" | "D" | "day" | "days" | "W" | "week" | "weeks" | "M" | "month" | "months" | "Y" | "year" | "years"}`;
 type MaxTokenAge = ExpiresIn;
 //#endregion
-export { JWK_Private as $, JWK as A, JWK_Asymmetric_Algorithm as B, DeriveKeyOptions as C, GenerateKeyAlgorithm as D, GenerateJWKReturn as E, JWK_AES_CBC_HMAC as F, JWK_EC_Public as G, JWK_ECDH_ES as H, JWK_AES_GCM as I, JWK_OKP_Private as J, JWK_HMAC as K, JWK_AES_GCM_KW as L, JWKPEMAlgorithm as M, JWKParameters as N, GenerateKeyOptions as O, JWKSet as P, JWK_Pair as Q, JWK_AES_KW as R, ContentEncryptionAlgorithm as S, GenerateJWKOptions as T, JWK_ECDSA as U, JWK_EC as V, JWK_EC_Private as W, JWK_OKP_SIGN as X, JWK_OKP_Public as Y, JWK_PBES2 as Z, JWT as _, JWEEncryptOptions as a, JWK_RSA_Public as at, JoseHeaderParameters as b, JWEKeyManagementHeaderParameters as c, JWK_Symmetric_Algorithm as ct, JWSHeaderParameters as d, UnwrapKeyOptions as dt, JWK_Public as et, JWSKeyLookupFunction as f, WrapKeyOptions as ft, JWSVerifyResult as g, JWSVerifyOptions as h, JWEDecryptResult as i, JWK_RSA_Private as it, JWKAlgorithm as j, GenerateKeyReturn as k, StrictOmit as l, JWK_oct as lt, JWSSignOptions as m, MaxTokenAge as n, JWK_RSA_ENC as nt, JWEHeaderParameters as o, JWK_RSA_SIGN as ot, JWSProtectedHeader as p, WrapKeyResult as pt, JWK_OKP as q, JWEDecryptOptions as r, JWK_RSA_PSS as rt, JWEKeyLookupFunction as s, JWK_Symmetric as st, ExpiresIn as t, JWK_RSA as tt, JWSAlgorithm as u, KeyManagementAlgorithm as ut, JWTClaimValidationOptions as v, DeriveKeyReturn as w, CompositeKey as x, JWTClaims as y, JWK_Asymmetric as z };
+export { JWK_OKP_SIGN as $, JWK as A, JWK_AES_GCM_KW as B, DeriveKeyOptions as C, GenerateKeyAlgorithm as D, GenerateJWKReturn as E, JWKPEMAlgorithm as F, JWK_ECDH_ES as G, JWK_Asymmetric as H, JWKParameters as I, JWK_EC_Public as J, JWK_ECDSA as K, JWKSet as L, JWKCacheAdapter as M, JWKLookupFunction as N, GenerateKeyOptions as O, JWKLookupFunctionHeader as P, JWK_OKP_Public as Q, JWK_AES_CBC_HMAC as R, ContentEncryptionAlgorithm as S, GenerateJWKOptions as T, JWK_Asymmetric_Algorithm as U, JWK_AES_KW as V, JWK_EC as W, JWK_OKP as X, JWK_HMAC as Y, JWK_OKP_Private as Z, JWT as _, JWEEncryptOptions as a, JWK_RSA_ENC as at, JoseHeaderParameters as b, JWEProtectedHeader as c, JWK_RSA_Public as ct, JWSHeaderParameters as d, JWK_Symmetric_Algorithm as dt, JWK_PBES2 as et, JWSProtectedHeader as f, JWK_oct as ft, JOSEPayload as g, WrapKeyResult as gt, JWSVerifyResult as h, WrapKeyOptions as ht, JWEDecryptResult as i, JWK_RSA as it, JWKAlgorithm as j, GenerateKeyReturn as k, StrictOmit as l, JWK_RSA_SIGN as lt, JWSVerifyOptions as m, UnwrapKeyOptions as mt, MaxTokenAge as n, JWK_Private as nt, JWEHeaderParameters as o, JWK_RSA_PSS as ot, JWSSignOptions as p, KeyManagementAlgorithm as pt, JWK_EC_Private as q, JWEDecryptOptions as r, JWK_Public as rt, JWEKeyManagementHeaderParameters as s, JWK_RSA_Private as st, ExpiresIn as t, JWK_Pair as tt, JWSAlgorithm as u, JWK_Symmetric as ut, JWTClaimValidationOptions as v, DeriveKeyReturn as w, CompositeKey as x, JWTClaims as y, JWK_AES_GCM as z };