unjwt 0.6.1 → 0.7.1

package/dist/_chunks/jwk.d.mts

@@ -1,708 +0,0 @@
-//#region src/core/types/jwk.d.ts
-/**
-* The decoded JOSE protected header received by a {@link JWKLookupFunction}.
-*
-* The most commonly inspected fields are explicitly typed; additional
-* algorithm-specific parameters (`epk`, `p2s`, `p2c`, `apu`, `apv`, …) are
-* accessible through the index signature.
-*
-* `alg` is always present on both JWS and JWE tokens. `enc` is only present
-* on JWE tokens.
-*/
-type JWKLookupFunctionHeader = {
-  kid?: string;
-  alg?: string;
-  enc?: string;
-  typ?: string;
-  crit?: string[];
-  [propName: string]: unknown;
-};
-/**
-* A callback that resolves the decryption or verification key from a token's
-* decoded protected header and the raw compact token string.
-*
-* Accepted by both {@link verify} (JWS) and {@link decrypt} (JWE). When a
-* {@link JWKSet} is returned, the library tries each key whose `kid` and `alg`
-* are compatible with the header in order, stopping at the first that succeeds
-* — see {@link getJWKsFromSet} for the selection logic.
-*
-* Returning a `string` is meaningful for JWE only (PBES2 password); for JWS
-* a string return is encoded to bytes and used as a raw symmetric key.
-*/
-type JWKLookupFunction = (header: JWKLookupFunctionHeader, token: string) => CryptoKey | JWK | JWKSet | string | Uint8Array<ArrayBuffer> | Promise<CryptoKey | JWK | JWKSet | string | Uint8Array<ArrayBuffer>>;
-/**
-* Interface for custom JWK import cache implementations.
-*
-* The adapter receives the full JWK object so each implementation can choose
-* its own keying strategy:
-* - {@link WeakMapJWKCache} uses the object reference (GC-friendly, no string hashing needed)
-* - A `kid`-keyed cache extracts `jwk.kid` and uses it as a string key
-* - A content-hash cache hashes `jwk.k` or `jwk.n`+`jwk.e`
-*
-* @example Use a custom kid-keyed cache:
-* ```ts
-* import { configureJWKCache } from 'unjwt/jwk';
-* const map = new Map<string, CryptoKey>();
-* configureJWKCache({
-*   get: (jwk, alg) => map.get(`${jwk.kid}:${alg}`),
-*   set: (jwk, alg, key) => map.set(`${jwk.kid}:${alg}`, key),
-* });
-* ```
-*/
-interface JWKCacheAdapter {
-  get(jwk: JWK, alg: string): CryptoKey | undefined;
-  set(jwk: JWK, alg: string, key: CryptoKey): void;
-}
-/** Structure returned for composite AES-CBC + HMAC keys. */
-type CompositeKey = {
-  /** The AES-CBC encryption/decryption key. */encryptionKey: CryptoKey; /** The HMAC key for integrity/authentication. */
-  macKey: CryptoKey;
-};
-type GenerateKeyAlgorithm = Exclude<JWKAlgorithm, "none" | "dir" | JWK_PBES2>;
-/** Options for the generateKey function. */
-interface GenerateKeyOptions {
-  /** Key usages for the generated key(s). Note: For composite keys (CBC), default usages are applied separately. */
-  keyUsage?: KeyUsage[];
-  /** Mark the key(s) as extractable. Defaults to true. */
-  extractable?: boolean;
-  /** RSA modulus length. Defaults to 2048. */
-  modulusLength?: number;
-  /** RSA public exponent. Defaults to 65537 (0x010001). */
-  publicExponent?: Uint8Array<ArrayBuffer>;
-  /** Named curve for EC or OKP keys. Defaults to "P-256" for EC and "Ed25519" for OKP. */
-  namedCurve?: "P-256" | "P-384" | "P-521" | "X25519" | "Ed25519" | "Ed448";
-  /**
-  * Export the generated key(s) as JWK. When `true`, keys are returned in JWK
-  * format with a generated `kid`. To include additional JWK parameters
-  * (e.g. a custom `kid`), use {@link generateJWK} instead.
-  */
-  toJWK?: boolean;
-}
-type GenerateKeyReturnJWK<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_Asymmetric_Algorithm ? TAlg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC ? {
-  privateKey: JWK_RSA_Private;
-  publicKey: JWK_RSA_Public;
-} : TAlg extends JWK_ECDSA | JWK_ECDH_ES ? {
-  privateKey: JWK_EC_Private;
-  publicKey: JWK_EC_Public;
-} : TAlg extends JWK_OKP_SIGN ? {
-  privateKey: JWK_OKP_Private;
-  publicKey: JWK_OKP_Public;
-} : never : TAlg extends JWK_AES_CBC_HMAC | JWK_Symmetric_Algorithm ? JWK_oct : never;
-type GenerateKeyReturnCrypto<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_AES_CBC_HMAC ? Uint8Array<ArrayBuffer> : TAlg extends JWK_Asymmetric_Algorithm ? CryptoKeyPair : CryptoKey;
-type GenerateKeyReturn<TAlg extends GenerateKeyAlgorithm, TOptions extends GenerateKeyOptions> = TOptions["toJWK"] extends true ? GenerateKeyReturnJWK<TAlg> : GenerateKeyReturnCrypto<TAlg>;
-type GenerateJWKOptions = Omit<GenerateKeyOptions, "toJWK">;
-type GenerateJWKReturn<TAlg extends GenerateKeyAlgorithm> = GenerateKeyReturnJWK<TAlg>;
-/** Options for the deriveKeyFromPassword function. */
-interface DeriveKeyOptions {
-  /** Salt value (p2s). Must be at least 8 bytes. */
-  salt: Uint8Array<ArrayBuffer>;
-  /** Iteration count (p2c). Must be a positive integer. */
-  iterations: number;
-  /** Key usages for the derived key. Defaults to ["wrapKey", "unwrapKey"]. */
-  keyUsage?: KeyUsage[];
-  /** Mark the derived key as extractable. Defaults to false. */
-  extractable?: boolean;
-  /**
-  * Export the derived key as JWK_oct. When `true`, returns the derived key in
-  * JWK format. To include additional JWK parameters (e.g. a custom `kid`),
-  * use {@link deriveJWKFromPassword} instead.
-  */
-  toJWK?: boolean;
-}
-type DeriveKeyReturn<TOptions extends DeriveKeyOptions> = TOptions["toJWK"] extends true ? JWK_oct : TOptions["toJWK"] extends object ? JWK_oct : CryptoKey;
-type KeyManagementAlgorithm = JWK_RSA_ENC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_PBES2 | JWK_ECDH_ES | "dir";
-type ContentEncryptionAlgorithm = JWK_AES_GCM | JWK_AES_CBC_HMAC;
-/** Options for the wrapKey function. */
-interface WrapKeyOptions {
-  /** Initialization Vector for AES-GCMKW. Generated if not provided. */
-  iv?: Uint8Array<ArrayBuffer>;
-  /** PBES2 Salt value (p2s). Required for PBES2 algorithms. */
-  p2s?: Uint8Array<ArrayBuffer>;
-  /** PBES2 Iteration count (p2c). Required for PBES2 algorithms. */
-  p2c?: number;
-  /** ECDH-ES specific options. */
-  ecdh?: {
-    /**
-    * ECDH-ES ephemeral key material. A fresh ephemeral key pair is generated
-    * automatically when this is not provided.
-    */
-    ephemeralKey?: CryptoKey | JWK_EC_Private | CryptoKeyPair | {
-      publicKey: CryptoKey | JWK_EC_Public;
-      privateKey: CryptoKey | JWK_EC_Private;
-    }; /** Agreement PartyUInfo (apu). */
-    partyUInfo?: Uint8Array<ArrayBuffer>; /** Agreement PartyVInfo (apv). */
-    partyVInfo?: Uint8Array<ArrayBuffer>;
-    /**
-    * Content encryption algorithm used for key-length derivation.
-    * Required only when `alg` is `"ECDH-ES"` (direct key agreement).
-    * Not needed for `ECDH-ES+A128KW`, `+A192KW`, or `+A256KW`.
-    */
-    enc?: ContentEncryptionAlgorithm;
-  };
-}
-/** Result of the wrapKey function. */
-interface WrapKeyResult {
-  /** The wrapped key (Ciphertext). */
-  encryptedKey: Uint8Array<ArrayBuffer>;
-  /** Initialization Vector used (only for AES-GCMKW). Base64URL encoded. */
-  iv?: string;
-  /** Authentication Tag generated (only for AES-GCMKW). Base64URL encoded. */
-  tag?: string;
-  /** PBES2 Salt value used (only for PBES2). Base64URL encoded. */
-  p2s?: string;
-  /** PBES2 Iteration count used (only for PBES2). */
-  p2c?: number;
-  /** ECDH-ES Ephemeral Public Key used (only for ECDH-ES). */
-  epk?: JWK_EC_Public;
-  /** ECDH-ES Agreement PartyUInfo used (only for ECDH-ES). Base64URL encoded. */
-  apu?: string;
-  /** ECDH-ES Agreement PartyVInfo used (only for ECDH-ES). Base64URL encoded. */
-  apv?: string;
-}
-/** Options for the unwrapKey function. */
-interface UnwrapKeyOptions {
-  /**
-  * Output format of the unwrapped key.
-  * - `"cryptokey"` (default) — returns a `CryptoKey` ready for use with WebCrypto.
-  * - `"raw"` — returns the raw key bytes as `Uint8Array` (useful for
-  *   interoperability or when the algorithm is not directly importable).
-  */
-  format?: "cryptokey" | "raw";
-  /** Initialization Vector (required for AES-GCMKW). Base64URL encoded or Uint8Array. */
-  iv?: Uint8Array<ArrayBuffer> | string;
-  /** Authentication Tag (required for AES-GCMKW). Base64URL encoded or Uint8Array. */
-  tag?: Uint8Array<ArrayBuffer> | string;
-  /** PBES2 Salt value (required for PBES2). Base64URL encoded or Uint8Array. */
-  p2s?: Uint8Array<ArrayBuffer> | string;
-  /** PBES2 Iteration count (required for PBES2). */
-  p2c?: number;
-  /** ECDH-ES Ephemeral Public Key (required for ECDH-ES). */
-  epk?: JWK_EC_Public | CryptoKey;
-  /** ECDH-ES Agreement PartyUInfo. Base64URL encoded or Uint8Array. */
-  apu?: Uint8Array<ArrayBuffer> | string;
-  /** ECDH-ES Agreement PartyVInfo. Base64URL encoded or Uint8Array. */
-  apv?: Uint8Array<ArrayBuffer> | string;
-  /** Content Encryption Algorithm used with ECDH-ES (required for direct key agreement). */
-  enc?: ContentEncryptionAlgorithm;
-  /** Expected unwrapped key algorithm (e.g., 'AES-GCM', 'AES-CBC'). Used by crypto.subtle.unwrapKey. */
-  unwrappedKeyAlgorithm?: string | Algorithm | RsaOaepParams | AesCtrParams | AesCbcParams | AesGcmParams;
-  /** Expected key usages for the unwrapped key. */
-  keyUsage?: KeyUsage[];
-  /** Mark the unwrapped key as extractable. Defaults to true. */
-  extractable?: boolean;
-}
-/**
-* Forked from https://github.com/panva/jose/tree/v6.0.10
-* Copyright (c) 2018 Filip Skokan.
-* LICENSE: https://github.com/panva/jose/blob/v6.0.10/LICENSE.md
-*/
-/** Generic JSON Web Key Parameters. */
-interface JWKParameters {
-  /** JWK "kty" (Key Type) Parameter */
-  kty: string;
-  /**
-  * JWK "alg" (Algorithm) Parameter
-  *
-  * @see {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}
-  */
-  alg?: string;
-  /** JWK "key_ops" (Key Operations) Parameter */
-  key_ops?: KeyUsage[];
-  /** JWK "ext" (Extractable) Parameter */
-  ext?: boolean;
-  /** JWK "use" (Public Key Use) Parameter */
-  use?: string;
-  /** JWK "x5c" (X.509 Certificate Chain) Parameter */
-  x5c?: string[];
-  /** JWK "x5t" (X.509 Certificate SHA-1 Thumbprint) Parameter */
-  x5t?: string;
-  /** JWK "x5t#S256" (X.509 Certificate SHA-256 Thumbprint) Parameter */
-  "x5t#S256"?: string;
-  /** JWK "x5u" (X.509 URL) Parameter */
-  x5u?: string;
-  /** JWK "kid" (Key ID) Parameter */
-  kid?: string;
-  /**
-  * Non-standard JWK content encryption algorithm hint.
-  * When `alg` is `"dir"`, the library reads this field to infer the
-  * content encryption algorithm (`enc`) when it is not provided in options.
-  */
-  enc?: ContentEncryptionAlgorithm;
-}
-/** Public EC JSON Web Keys */
-interface JWK_EC_Public extends JWKParameters {
-  /** EC JWK "kty" (Key Type) Parameter */
-  kty: "EC";
-  /** EC JWK "crv" (Curve) Parameter */
-  crv: string;
-  /** EC JWK "x" (X Coordinate) Parameter */
-  x: string;
-  /** EC JWK "y" (Y Coordinate) Parameter */
-  y: string;
-}
-/** Private EC JSON Web Keys */
-interface JWK_EC_Private extends JWK_EC_Public {
-  /** EC JWK "d" (ECC Private Key) Parameter */
-  d: string;
-}
-/** EC JSON Web Keys */
-type JWK_EC = JWK_EC_Public | JWK_EC_Private;
-/** Public RSA JSON Web Keys */
-interface JWK_RSA_Public extends JWKParameters {
-  /** RSA JWK "kty" (Key Type) Parameter */
-  kty: "RSA";
-  /** RSA JWK "e" (Exponent) Parameter */
-  e: string;
-  /** RSA JWK "n" (Modulus) Parameter */
-  n: string;
-  oth?: RsaOtherPrimesInfo[];
-}
-/** Private RSA JSON Web Keys */
-interface JWK_RSA_Private extends JWK_RSA_Public {
-  /** RSA JWK "d" (Private Exponent) Parameter */
-  d: string;
-  /** RSA JWK "dp" (First Factor CRT Exponent) Parameter */
-  dp: string;
-  /** RSA JWK "dq" (Second Factor CRT Exponent) Parameter */
-  dq: string;
-  /** RSA JWK "p" (First Prime Factor) Parameter */
-  p: string;
-  /** RSA JWK "q" (Second Prime Factor) Parameter */
-  q: string;
-  /** RSA JWK "qi" (First CRT Coefficient) Parameter */
-  qi: string;
-}
-/** RSA JSON Web Keys */
-type JWK_RSA = JWK_RSA_Public | JWK_RSA_Private;
-/** Public ED JSON Web Keys */
-interface JWK_OKP_Public extends JWKParameters {
-  /** ED JWK "kty" (Key Type) Parameter */
-  kty: "OKP";
-  /** ED JWK "crv" (Curve) Parameter */
-  crv: string;
-  /** ED JWK "x" (X Coordinate) Parameter */
-  x: string;
-}
-/** Private ED JSON Web Keys */
-interface JWK_OKP_Private extends JWK_OKP_Public {
-  /** ED JWK "d" (Private Key) Parameter */
-  d: string;
-}
-/** OKP JSON Web Keys */
-type JWK_OKP = JWK_OKP_Public | JWK_OKP_Private;
-/** oct JSON Web Keys */
-interface JWK_oct extends JWKParameters {
-  /** Oct JWK "k" (Key Value) Parameter */
-  k: string;
-}
-/** Symmetric JSON Web Keys */
-type JWK_Symmetric = JWK_oct;
-/** Asymmetric JSON Web Keys */
-type JWK_Asymmetric = JWK_RSA | JWK_EC | JWK_OKP;
-/** Public JSON Web Keys */
-type JWK_Public = JWK_RSA_Public | JWK_EC_Public | JWK_OKP_Public;
-/** Private JSON Web Keys */
-type JWK_Private = JWK_RSA_Private | JWK_EC_Private | JWK_OKP_Private;
-/**
-* JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC", "OKP" and "oct" key types are supported.
-*/
-type JWK = JWK_oct | JWK_RSA | JWK_EC | JWK_OKP;
-/**
-* A pair of public and private JSON Web Keys.
-*/
-type JWK_Pair = {
-  publicKey: JWK_RSA_Public;
-  privateKey: JWK_RSA_Private;
-} | {
-  publicKey: JWK_EC_Public;
-  privateKey: JWK_EC_Private;
-} | {
-  publicKey: JWK_OKP_Public;
-  privateKey: JWK_OKP_Private;
-};
-/**
-* JSON Web Key Set ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK Set}). "RSA", "EC" and "oct" key types are supported.
-*/
-interface JWKSet {
-  /** JWK Set "keys" Parameter */
-  keys: JWK[];
-  [parameter: string]: unknown;
-}
-/** JWK Key Algorithms */
-type JWK_HMAC = "HS256" | "HS384" | "HS512";
-type JWK_RSA_SIGN = "RS256" | "RS384" | "RS512";
-type JWK_RSA_PSS = "PS256" | "PS384" | "PS512";
-type JWK_ECDSA = "ES256" | "ES384" | "ES512";
-type JWK_RSA_ENC = "RSA-OAEP" | "RSA-OAEP-256" | "RSA-OAEP-384" | "RSA-OAEP-512";
-type JWK_AES_KW = "A128KW" | "A192KW" | "A256KW";
-type JWK_AES_CBC_HMAC = "A128CBC-HS256" | "A192CBC-HS384" | "A256CBC-HS512";
-type JWK_AES_GCM = "A128GCM" | "A192GCM" | "A256GCM";
-type JWK_AES_GCM_KW = "A128GCMKW" | "A192GCMKW" | "A256GCMKW";
-type JWK_PBES2 = "PBES2-HS256+A128KW" | "PBES2-HS384+A192KW" | "PBES2-HS512+A256KW";
-type JWK_ECDH_ES = "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A192KW" | "ECDH-ES+A256KW";
-type JWK_OKP_SIGN = "Ed25519" | "EdDSA";
-type JWK_Symmetric_Algorithm = JWK_HMAC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW;
-type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA_ENC | JWK_OKP_SIGN | JWK_ECDH_ES;
-type JWKAlgorithm = JWK_Symmetric_Algorithm | JWK_Asymmetric_Algorithm | JWK_AES_CBC_HMAC | JWK_PBES2 | JWK_ECDH_ES | "dir";
-type JWKPEMAlgorithm = JWK_RSA_PSS | JWK_RSA_SIGN | JWK_RSA_ENC | JWK_ECDSA | JWK_ECDH_ES | JWK_OKP_SIGN;
-//#endregion
-//#region src/core/types/jwt.d.ts
-/** Header Parameters common to JWE and JWS */
-interface JoseHeaderParameters {
-  /** "kid" (Key ID) Header Parameter */
-  kid?: string;
-  /** "x5t" (X.509 Certificate SHA-1 Thumbprint) Header Parameter */
-  x5t?: string;
-  /** "x5c" (X.509 Certificate Chain) Header Parameter */
-  x5c?: string[];
-  /** "x5u" (X.509 URL) Header Parameter */
-  x5u?: string;
-  /** "jku" (JWK Set URL) Header Parameter */
-  jku?: string;
-  /** "jwk" (JSON Web Key) Header Parameter */
-  jwk?: JWK_Public;
-  /** "typ" (Type) Header Parameter */
-  typ?: string;
-  /** "cty" (Content Type) Header Parameter */
-  cty?: string;
-  /** "crit" (Critical) Header Parameter */
-  crit?: string[];
-  /** Any other JWS/JWE Header member. */
-  [propName: string]: unknown;
-}
-/**
-* Payload accepted by {@link sign} and {@link encrypt}.
-*
-* Covers raw strings and bytes for non-JWT use, plus any JSON-serializable
-* object for JWT and generic structured payloads. JWT-specific claim names
-* are not enforced at this level — use {@link JWTClaims} when you want typed
-* claim names and spec-compliant field types.
-*/
-type JOSEPayload = string | Uint8Array<ArrayBuffer> | Record<string, unknown>;
-interface JWTClaims {
-  /** "iss" (Issuer) Claim */
-  iss?: string;
-  /** "sub" (Subject) Claim */
-  sub?: string;
-  /** "aud" (Audience) Claim */
-  aud?: string | string[];
-  /** "exp" (Expiration Time) Claim */
-  exp?: number;
-  /** "nbf" (Not Before) Claim */
-  nbf?: number;
-  /** "iat" (Issued At) Claim */
-  iat?: number;
-  /** "jti" (JWT ID) Claim */
-  jti?: string;
-  /** Any other JWT member. */
-  [propName: string]: unknown;
-}
-interface JWT<T = JWTClaims> {
-  header: JoseHeaderParameters & {
-    /** "alg" (Algorithm) Header Parameter */alg: string;
-  };
-  claims: T;
-}
-interface JWTClaimValidationOptions {
-  /** Expected JWT "aud" (Audience) Claim value(s). Implies presence requirement. */
-  audience?: string | string[];
-  /** Expected JWT "iss" (Issuer) Claim value(s). Implies presence requirement. */
-  issuer?: string | string[];
-  /** Expected JWT "sub" (Subject) Claim value. Implies presence requirement. */
-  subject?: string;
-  /** Maximum token age, from the JWT "iat" (Issued At) Claim value. Implies presence requirement. */
-  maxTokenAge?: MaxTokenAge;
-  /** Clock skew tolerance (in seconds) for validating time-based claims (nbf/exp/iat). */
-  clockTolerance?: number;
-  /** Expected JWT "typ" (Type) Header Parameter value. Implies presence requirement. */
-  typ?: string;
-  /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
-  currentDate?: Date;
-  /** Additional required claim names. */
-  requiredClaims?: string[];
-  /**
-  * Critical header parameters that this caller understands and has processed.
-  * If the token's `crit` header lists a parameter not present in this list
-  * (and not natively understood by the library), verification will fail per
-  * RFC 7515 §4.1.11 / RFC 7516 §4.1.13.
-  */
-  recognizedHeaders?: string[];
-}
-//#endregion
-//#region src/core/types/jws.d.ts
-/** JWS Signing Algorithm Identifier. */
-type JWSAlgorithm = JWK_HMAC | JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_OKP_SIGN;
-/** Recognized JWS Header Parameters, any other Header Members may also be present. */
-interface JWSHeaderParameters extends JoseHeaderParameters {
-  /** JWS "alg" (Algorithm) Header Parameter */
-  alg?: JWSAlgorithm;
-  /**
-  * This JWS Extension Header Parameter modifies the JWS Payload representation and the JWS Signing
-  * Input computation as per {@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}.
-  * If `false`, the payload is used directly without Base64URL encoding.
-  * Defaults to `true`.
-  */
-  b64?: boolean;
-}
-/** JWS Protected Header */
-interface JWSProtectedHeader extends JWSHeaderParameters {
-  alg: JWSAlgorithm;
-}
-/**
-* JWS (JSON Web Signature) options for signing
-*/
-interface JWSSignOptions {
-  /** The JWS Algorithm to use. Must be provided. */
-  alg?: JWSAlgorithm;
-  /**
-  * Additional protected header parameters. `alg` is automatically included.
-  * `typ` defaults to "JWT" if not provided and payload is an object.
-  */
-  protectedHeader?: JWSHeaderParameters;
-  /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
-  currentDate?: Date;
-  /**
-  * Time at which the JWS should expire, if no `exp` was already provided.
-  */
-  expiresIn?: ExpiresIn;
-}
-/** Result of JWS verification */
-interface JWSVerifyResult<T extends JOSEPayload = JOSEPayload> {
-  /** The decoded and verified payload. */
-  payload: T;
-  /** The JWS Protected Header. */
-  protectedHeader: JWSProtectedHeader;
-}
-/** Options for JWS verification */
-interface JWSVerifyOptions extends JWTClaimValidationOptions {
-  /** List of allowed algorithms. If provided, the JWS `alg` must be in this list. */
-  algorithms?: JWSAlgorithm[];
-  /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred. */
-  forceUint8Array?: boolean;
-  /**
-  * Controls JWT claim validation after a successful verification.
-  *
-  * - `true` — always validate claims regardless of the `typ` header
-  * - `false` — skip claim validation entirely
-  * - `undefined` (default) — validate when `typ` is `"JWT"` or contains `"jwt"`
-  */
-  validateClaims?: boolean;
-}
-//#endregion
-//#region src/core/utils/types.d.ts
-type StrictOmit<T, K extends keyof T | (string & {}) | (number & {}) | (symbol & {})> = { [P in keyof T as P extends K ? never : P]: T[P] };
-//#endregion
-//#region src/core/types/jwe.d.ts
-/** Recognized JWE Header Parameters, any other Header Members may also be present. */
-interface JWEHeaderParameters extends JoseHeaderParameters {
-  /**
-  * `alg` (Algorithm): Header Parameter - Key Management Algorithm
-  */
-  alg?: KeyManagementAlgorithm | (string & {});
-  /**
-  * `enc` (Encryption Algorithm): Header Parameter - Content Encryption Algorithm
-  */
-  enc?: ContentEncryptionAlgorithm | (string & {});
-  /**
-  * `p2c` (PBES2 Count): Header Parameter
-  */
-  p2c?: number;
-  /**
-  * `p2s` (PBES2 Salt): Header Parameter. Base64URL encoded.
-  */
-  p2s?: string;
-  /**
-  * "iv" (Initialization Vector) Header Parameter for AES GCM Key Wrapping. Base64URL encoded.
-  */
-  iv?: string;
-  /**
-  * "tag" (Authentication Tag) Header Parameter for AES GCM Key Wrapping. Base64URL encoded.
-  */
-  tag?: string;
-  /**
-  * "epk" (Ephemeral Public Key) Header Parameter for ECDH-ES.
-  */
-  epk?: JWK_EC_Public;
-  /**
-  * "apu" (Agreement PartyUInfo) Header Parameter for ECDH-ES. Base64URL encoded.
-  */
-  apu?: string;
-  /**
-  * "apv" (Agreement PartyVInfo) Header Parameter for ECDH-ES. Base64URL encoded.
-  */
-  apv?: string;
-  /** Any other JWE Header member. */
-  [propName: string]: unknown;
-}
-/** Recognized JWE Key Management-related Header Parameters. */
-interface JWEKeyManagementHeaderParameters {
-  apu?: Uint8Array<ArrayBuffer>;
-  apv?: Uint8Array<ArrayBuffer>;
-  /**
-  * For Internal use only
-  */
-  p2c?: number;
-  /**
-  * For Internal use only
-  */
-  p2s?: Uint8Array<ArrayBuffer>;
-  /**
-  * For Internal use only
-  */
-  iv?: Uint8Array<ArrayBuffer>;
-  /**
-  * For Internal use only
-  */
-  epk?: CryptoKey | JWK_EC_Public;
-  /**
-  * For Internal use only
-  */
-  epkPrivateKey?: CryptoKey | JWK_EC_Private;
-}
-/**
-* JWE (JSON Web Encryption) encryption options
-*/
-interface JWEEncryptOptions {
-  /** JWE "alg" (Algorithm) Header Parameter. Key Management Algorithm. */
-  alg?: KeyManagementAlgorithm;
-  /** JWE "enc" (Encryption Algorithm) Header Parameter. Content Encryption Algorithm. */
-  enc?: ContentEncryptionAlgorithm;
-  /** Date to use when computing NumericDate claims, defaults to `new Date()`. */
-  currentDate?: Date;
-  /** Time at which the JWT should expire, if no `exp` was already provided (only when typ is "JWT" or explicitly parsing JWT). */
-  expiresIn?: ExpiresIn;
-  /** Additional JWE Protected Header parameters. */
-  protectedHeader?: StrictOmit<JWEHeaderParameters, "alg" | "enc" | "iv" | "tag" | "p2s" | "p2c" | "epk" | "apu" | "apv">;
-  /** Initialization Vector for AES-GCMKW key wrapping. Generated if not provided. */
-  keyManagementIV?: Uint8Array<ArrayBuffer>;
-  /** PBES2 Salt value (p2s). Required for PBES2 algorithms. */
-  p2s?: Uint8Array<ArrayBuffer>;
-  /** PBES2 Iteration count (p2c). Required for PBES2 algorithms. */
-  p2c?: number;
-  /** ECDH-ES specific options. */
-  ecdh?: {
-    /**
-    * ECDH-ES Ephemeral key material. Provide a private key (CryptoKey or JWK),
-    * a CryptoKeyPair, or an object exposing both public and private parts.
-    */
-    ephemeralKey?: CryptoKey | JWK_EC_Private | CryptoKeyPair | {
-      publicKey: CryptoKey | JWK_EC_Public;
-      privateKey: CryptoKey | JWK_EC_Private;
-    }; /** ECDH-ES Agreement PartyUInfo. */
-    partyUInfo?: Uint8Array<ArrayBuffer>; /** ECDH-ES Agreement PartyVInfo. */
-    partyVInfo?: Uint8Array<ArrayBuffer>;
-  };
-  /**
-  * Content Encryption Key (CEK) to use.
-  * If provided, it will be used directly. Otherwise, a CEK will be generated.
-  */
-  cek?: Uint8Array<ArrayBuffer>;
-  /**
-  * Initialization Vector for content encryption.
-  * If provided, it will be used. Otherwise, one will be generated.
-  */
-  contentEncryptionIV?: Uint8Array<ArrayBuffer>;
-}
-/**
-* JWE (JSON Web Encryption) decryption options
-*/
-interface JWEDecryptOptions extends JWTClaimValidationOptions {
-  /** A list of allowed JWE "alg" (Algorithm) Header Parameter values for key management. */
-  algorithms?: KeyManagementAlgorithm[];
-  /** A list of allowed JWE "enc" (Encryption Algorithm) Header Parameter values for content encryption. */
-  encryptionAlgorithms?: ContentEncryptionAlgorithm[];
-  /** Algorithm to import the unwrapped CEK as (e.g., { name: 'AES-GCM' }). Defaults based on 'enc'. */
-  unwrappedKeyAlgorithm?: Parameters<typeof crypto.subtle.importKey>[2];
-  /** Key usages for the unwrapped CEK. Defaults based on 'enc' (typically ['encrypt', 'decrypt']). */
-  keyUsage?: KeyUsage[];
-  /** Mark the unwrapped CEK as extractable. Defaults to true. */
-  extractable?: boolean;
-  /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred based on JWE headers. */
-  forceUint8Array?: boolean;
-  /**
-  * Controls JWT claim validation after a successful decryption.
-  *
-  * - `true` — always validate claims regardless of the `typ` header
-  * - `false` — skip claim validation entirely
-  * - `undefined` (default) — validate when `typ` is `"JWT"` or contains `"jwt"`
-  */
-  validateClaims?: boolean;
-  /** If true, include the Content Encryption Key (CEK) and Additional Authenticated Data (AAD) in the result. */
-  returnCek?: boolean;
-}
-/**
-* JWE Protected Header — the parsed and validated protected header returned
-* after a successful {@link decrypt} call. Both `alg` and `enc` are present
-* and strongly typed because decryption could not have succeeded without them.
-*/
-interface JWEProtectedHeader extends JWEHeaderParameters {
-  /** Key management algorithm. */
-  alg: KeyManagementAlgorithm;
-  /** Content encryption algorithm. */
-  enc: ContentEncryptionAlgorithm;
-}
-/**
-* Result of a JWE decryption operation.
-*/
-interface JWEDecryptResult<T extends JOSEPayload = JOSEPayload> {
-  /** The decrypted payload. */
-  payload: T;
-  /** The JWE Protected Header. */
-  protectedHeader: JWEProtectedHeader;
-  /** The Content Encryption Key (CEK) used for decryption, as Uint8Array. Only present when `returnCek` is true. */
-  cek?: Uint8Array<ArrayBuffer>;
-  /** The Additional Authenticated Data (AAD) used, as Uint8Array. Only present when `returnCek` is true. */
-  aad?: Uint8Array<ArrayBuffer>;
-}
-//#endregion
-//#region src/core/types/index.d.ts
-type ExpiresIn = number | `${number}` | `${number}${"s" | "second" | "seconds" | "m" | "minute" | "minutes" | "h" | "hour" | "hours" | "D" | "day" | "days" | "W" | "week" | "weeks" | "M" | "month" | "months" | "Y" | "year" | "years"}`;
-type MaxTokenAge = ExpiresIn;
-//#endregion
-//#region src/core/jwk.d.ts
-/**
-* Generates a Json Web Key (JWK) for the specified algorithm.
-*
-* @param alg The JWA algorithm identifier (e.g., "HS256", "RS256", "A128GCM").
-* @param jwkParams Optional partial JWK to merge with the generated key, allowing overrides.
-* @param options Configuration options for key generation.
-* @returns A Promise resolving to the generated JWK or JWK pair representation.
-*/
-declare function generateJWK<TAlg extends GenerateKeyAlgorithm>(alg: TAlg, jwkParams?: Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">, options?: GenerateJWKOptions): Promise<GenerateJWKReturn<TAlg>>;
-/**
-* Derives a Json Web Key (JWK) from a password using PBKDF2 as specified by PBES2 algorithms.
-*
-* @param password The password to derive the key from (string or Uint8Array).
-* @param alg The PBES2 algorithm identifier (e.g., "PBES2-HS256+A128KW").
-* @param jwkParams Optional partial JWK to merge with the generated key, allowing overrides.
-* @param options Configuration options including salt and iterations.
-* @returns A Promise resolving to the derived JWK (JWK_oct).
-*/
-declare function deriveJWKFromPassword(password: string | Uint8Array<ArrayBuffer>, alg: JWK_PBES2, options: Omit<DeriveKeyOptions, "toJWK">, jwkParams?: Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">): Promise<JWK_oct>;
-/**
-* Imports a key from a PEM-encoded string and converts it to a JWK.
-*
-* @param pem The PEM-encoded string.
-* @param pemType The type of PEM encoding ('pkcs8' for private keys, 'spki' for public keys, 'x509' for certificates).
-* @param alg The JWA algorithm identifier. This is crucial for `crypto.subtle.importKey`
-*            to understand the key's intended algorithm and for setting the 'alg' field in the resulting JWK.
-* @param importOptions Options for the PEM import process (e.g., extractable for the CryptoKey).
-* @param jwkExtras Additional properties to merge into the resulting JWK.
-* @returns A Promise resolving to the imported key as a JWK.
-*/
-declare function importFromPEM<T extends JWK>(pem: string, pemType: "pkcs8" | "spki" | "x509", alg: JWKPEMAlgorithm, options?: {
-  /** Passed to `crypto.subtle.importKey`. Defaults to `false` for private keys, `true` otherwise. */extractable?: boolean; /** Additional JWK properties merged into the exported key (e.g. `kid`). */
-  jwkParams?: Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">;
-}): Promise<T>;
-/**
-* Exports a JWK to a PEM-encoded string.
-*
-* @param jwk The JWK to export.
-* @param pemFormat The desired PEM format ('pkcs8' for private keys, 'spki' for public keys).
-* @param algForCryptoKeyImport If the JWK does not have an 'alg' property, this algorithm hint is
-*                              required to correctly convert it to a CryptoKey first.
-* @returns A Promise resolving to the PEM-encoded key string.
-*/
-declare function exportToPEM(jwk: JWK, pemFormat: "pkcs8" | "spki", algForCryptoKeyImport?: JWKPEMAlgorithm): Promise<string>;
-//#endregion
-export { JWK_HMAC as $, GenerateJWKReturn as A, JWKParameters as B, JWTClaims as C, DeriveKeyOptions as D, ContentEncryptionAlgorithm as E, JWKAlgorithm as F, JWK_AES_KW as G, JWK_AES_CBC_HMAC as H, JWKCacheAdapter as I, JWK_EC as J, JWK_Asymmetric as K, JWKLookupFunction as L, GenerateKeyOptions as M, GenerateKeyReturn as N, DeriveKeyReturn as O, JWK as P, JWK_EC_Public as Q, JWKLookupFunctionHeader as R, JWTClaimValidationOptions as S, CompositeKey as T, JWK_AES_GCM as U, JWKSet as V, JWK_AES_GCM_KW as W, JWK_ECDSA as X, JWK_ECDH_ES as Y, JWK_EC_Private as Z, JWSSignOptions as _, KeyManagementAlgorithm as _t, ExpiresIn as a, JWK_Pair as at, JOSEPayload as b, WrapKeyResult as bt, JWEDecryptResult as c, JWK_RSA as ct, JWEKeyManagementHeaderParameters as d, JWK_RSA_Private as dt, JWK_OKP as et, JWEProtectedHeader as f, JWK_RSA_Public as ft, JWSProtectedHeader as g, JWK_oct as gt, JWSHeaderParameters as h, JWK_Symmetric_Algorithm as ht, importFromPEM as i, JWK_PBES2 as it, GenerateKeyAlgorithm as j, GenerateJWKOptions as k, JWEEncryptOptions as l, JWK_RSA_ENC as lt, JWSAlgorithm as m, JWK_Symmetric as mt, exportToPEM as n, JWK_OKP_Public as nt, MaxTokenAge as o, JWK_Private as ot, StrictOmit as p, JWK_RSA_SIGN as pt, JWK_Asymmetric_Algorithm as q, generateJWK as r, JWK_OKP_SIGN as rt, JWEDecryptOptions as s, JWK_Public as st, deriveJWKFromPassword as t, JWK_OKP_Private as tt, JWEHeaderParameters as u, JWK_RSA_PSS as ut, JWSVerifyOptions as v, UnwrapKeyOptions as vt, JoseHeaderParameters as w, JWT as x, JWSVerifyResult as y, WrapKeyOptions as yt, JWKPEMAlgorithm as z };