unjwt 0.6.1 → 0.7.1

package/dist/_chunks/index.d.mts

@@ -1,4 +1,3 @@
-//#region src/core/types/jwk.d.ts
 /**
 * The decoded JOSE protected header received by a {@link JWKLookupFunction}.
 *
@@ -28,8 +27,12 @@ type JWKLookupFunctionHeader = {
 *
 * Returning a `string` is meaningful for JWE only (PBES2 password); for JWS
 * a string return is encoded to bytes and used as a raw symmetric key.
+*
+* The optional `TReturn` generic lets callers who always hand back a specific
+* key shape (e.g. a `JWK_EC_Public<"ES256">`) preserve that narrowing all the
+* way into the `verify` / `decrypt` key resolution path.
 */
-type JWKLookupFunction = (header: JWKLookupFunctionHeader, token: string) => CryptoKey | JWK | JWKSet | string | Uint8Array<ArrayBuffer> | Promise<CryptoKey | JWK | JWKSet | string | Uint8Array<ArrayBuffer>>;
+type JWKLookupFunction<TReturn = CryptoKey | JWK | JWKSet | string | Uint8Array<ArrayBuffer>> = (header: JWKLookupFunctionHeader, token: string) => TReturn | Promise<TReturn>;
 /**
 * Interface for custom JWK import cache implementations.
 *
@@ -78,16 +81,7 @@ interface GenerateKeyOptions {
   */
   toJWK?: boolean;
 }
-type GenerateKeyReturnJWK<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_Asymmetric_Algorithm ? TAlg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC ? {
-  privateKey: JWK_RSA_Private;
-  publicKey: JWK_RSA_Public;
-} : TAlg extends JWK_ECDSA | JWK_ECDH_ES ? {
-  privateKey: JWK_EC_Private;
-  publicKey: JWK_EC_Public;
-} : TAlg extends JWK_OKP_SIGN ? {
-  privateKey: JWK_OKP_Private;
-  publicKey: JWK_OKP_Public;
-} : never : TAlg extends JWK_AES_CBC_HMAC | JWK_Symmetric_Algorithm ? JWK_oct : never;
+type GenerateKeyReturnJWK<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_Asymmetric_Algorithm ? JWK_Pair<TAlg> : TAlg extends JWK_AES_CBC_HMAC | JWK_Symmetric_Algorithm ? JWK_oct<TAlg> : never;
 type GenerateKeyReturnCrypto<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_AES_CBC_HMAC ? Uint8Array<ArrayBuffer> : TAlg extends JWK_Asymmetric_Algorithm ? CryptoKeyPair : CryptoKey;
 type GenerateKeyReturn<TAlg extends GenerateKeyAlgorithm, TOptions extends GenerateKeyOptions> = TOptions["toJWK"] extends true ? GenerateKeyReturnJWK<TAlg> : GenerateKeyReturnCrypto<TAlg>;
 type GenerateJWKOptions = Omit<GenerateKeyOptions, "toJWK">;
@@ -109,9 +103,27 @@ interface DeriveKeyOptions {
   */
   toJWK?: boolean;
 }
-type DeriveKeyReturn<TOptions extends DeriveKeyOptions> = TOptions["toJWK"] extends true ? JWK_oct : TOptions["toJWK"] extends object ? JWK_oct : CryptoKey;
+/** PBES2 → AES-KW alg that ends up stamped on the derived JWK's `alg`. */
+type DerivedJWKAlg<TAlg extends JWK_PBES2> = TAlg extends "PBES2-HS256+A128KW" ? "A128KW" : TAlg extends "PBES2-HS384+A192KW" ? "A192KW" : TAlg extends "PBES2-HS512+A256KW" ? "A256KW" : JWK_AES_KW;
+type DeriveKeyReturn<TOptions extends DeriveKeyOptions, TAlg extends JWK_PBES2 = JWK_PBES2> = TOptions["toJWK"] extends true ? JWK_oct<DerivedJWKAlg<TAlg>> : TOptions["toJWK"] extends object ? JWK_oct<DerivedJWKAlg<TAlg>> : CryptoKey;
 type KeyManagementAlgorithm = JWK_RSA_ENC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_PBES2 | JWK_ECDH_ES | "dir";
 type ContentEncryptionAlgorithm = JWK_AES_GCM | JWK_AES_CBC_HMAC;
+/**
+* Keys admissible as the `wrappingKey` argument of {@link wrapKey}, narrowed
+* by the key management algorithm. Mirrors the runtime branches in
+* `jwk.wrapKey` and the inference in `inferJWEAllowedAlgorithms`.
+*
+* - `dir` accepts any symmetric JWK (the key _is_ the CEK).
+* - AES-GCMKW tolerates a JWK whose `alg` is the bare `A*GCM` counterpart —
+*   matches the `jweAlgsFromOctJWK` aliasing rule.
+*/
+type WrappingKeyFor<A extends KeyManagementAlgorithm> = A extends JWK_RSA_ENC ? CryptoKey | JWK_RSA_Public<A> : A extends JWK_ECDH_ES ? CryptoKey | JWK_EC_Public<A> | JWK_OKP_Public<A> : A extends JWK_PBES2 ? string | Uint8Array<ArrayBuffer> | JWK_oct<A> : A extends JWK_AES_KW ? CryptoKey | JWK_oct<A> : A extends JWK_AES_GCM_KW ? CryptoKey | JWK_oct<A | `A${"128" | "192" | "256"}GCM`> : A extends "dir" ? CryptoKey | JWK_oct | Uint8Array<ArrayBuffer> : never;
+/**
+* Keys admissible as the `unwrappingKey` argument of {@link unwrapKey}.
+* The private-side counterpart of {@link WrappingKeyFor} — symmetric branches
+* are identical; asymmetric branches use the `_Private` variants.
+*/
+type UnwrappingKeyFor<A extends KeyManagementAlgorithm> = A extends JWK_RSA_ENC ? CryptoKey | JWK_RSA_Private<A> : A extends JWK_ECDH_ES ? CryptoKey | JWK_EC_Private<A> | JWK_OKP_Private<A> : A extends JWK_PBES2 ? string | Uint8Array<ArrayBuffer> | JWK_oct<A> : A extends JWK_AES_KW ? CryptoKey | JWK_oct<A> : A extends JWK_AES_GCM_KW ? CryptoKey | JWK_oct<A | `A${"128" | "192" | "256"}GCM`> : A extends "dir" ? CryptoKey | JWK_oct | Uint8Array<ArrayBuffer> : never;
 /** Options for the wrapKey function. */
 interface WrapKeyOptions {
   /** Initialization Vector for AES-GCMKW. Generated if not provided. */
@@ -140,25 +152,31 @@ interface WrapKeyOptions {
     enc?: ContentEncryptionAlgorithm;
   };
 }
-/** Result of the wrapKey function. */
-interface WrapKeyResult {
-  /** The wrapped key (Ciphertext). */
-  encryptedKey: Uint8Array<ArrayBuffer>;
-  /** Initialization Vector used (only for AES-GCMKW). Base64URL encoded. */
-  iv?: string;
-  /** Authentication Tag generated (only for AES-GCMKW). Base64URL encoded. */
-  tag?: string;
-  /** PBES2 Salt value used (only for PBES2). Base64URL encoded. */
-  p2s?: string;
-  /** PBES2 Iteration count used (only for PBES2). */
-  p2c?: number;
-  /** ECDH-ES Ephemeral Public Key used (only for ECDH-ES). */
-  epk?: JWK_EC_Public;
-  /** ECDH-ES Agreement PartyUInfo used (only for ECDH-ES). Base64URL encoded. */
-  apu?: string;
-  /** ECDH-ES Agreement PartyVInfo used (only for ECDH-ES). Base64URL encoded. */
+/**
+* Result of {@link wrapKey}, discriminated by key management algorithm family.
+*
+* Narrow the shape by passing a literal `alg` to `wrapKey`:
+* - PBES2 → `{ encryptedKey, p2s, p2c }`
+* - AES-GCMKW → `{ encryptedKey, iv, tag }`
+* - ECDH-ES / ECDH-ES+A*KW → `{ encryptedKey, epk, apu?, apv? }`
+* - dir / AES-KW / RSA-OAEP → `{ encryptedKey }`
+*/
+type WrapKeyResult<TAlg extends KeyManagementAlgorithm = KeyManagementAlgorithm> = TAlg extends JWK_PBES2 ? {
+  encryptedKey: Uint8Array<ArrayBuffer>; /** PBES2 Salt value (p2s). Base64URL encoded. */
+  p2s: string; /** PBES2 Iteration count (p2c). */
+  p2c: number;
+} : TAlg extends JWK_AES_GCM_KW ? {
+  encryptedKey: Uint8Array<ArrayBuffer>; /** AES-GCMKW Initialization Vector. Base64URL encoded. */
+  iv: string; /** AES-GCMKW Authentication Tag. Base64URL encoded. */
+  tag: string;
+} : TAlg extends JWK_ECDH_ES ? {
+  encryptedKey: Uint8Array<ArrayBuffer>; /** Ephemeral Public Key. */
+  epk: JWK_EC_Public; /** Agreement PartyUInfo. Base64URL encoded. Present only when supplied. */
+  apu?: string; /** Agreement PartyVInfo. Base64URL encoded. Present only when supplied. */
   apv?: string;
-}
+} : {
+  encryptedKey: Uint8Array<ArrayBuffer>;
+};
 /** Options for the unwrapKey function. */
 interface UnwrapKeyOptions {
   /**
@@ -176,6 +194,10 @@ interface UnwrapKeyOptions {
   p2s?: Uint8Array<ArrayBuffer> | string;
   /** PBES2 Iteration count (required for PBES2). */
   p2c?: number;
+  /** Minimum accepted PBES2 `p2c` on unwrap. Defaults to 1000 (RFC 7518 §4.8.1.2). */
+  minIterations?: number;
+  /** Maximum accepted PBES2 `p2c` on unwrap. Defaults to 1_000_000 to cap PBKDF2 DoS potential. */
+  maxIterations?: number;
   /** ECDH-ES Ephemeral Public Key (required for ECDH-ES). */
   epk?: JWK_EC_Public | CryptoKey;
   /** ECDH-ES Agreement PartyUInfo. Base64URL encoded or Uint8Array. */
@@ -196,8 +218,15 @@ interface UnwrapKeyOptions {
 * Copyright (c) 2018 Filip Skokan.
 * LICENSE: https://github.com/panva/jose/blob/v6.0.10/LICENSE.md
 */
-/** Generic JSON Web Key Parameters. */
-interface JWKParameters {
+/**
+* Generic JSON Web Key Parameters.
+*
+* The `Alg` type parameter constrains the JWK's `alg` field. Each concrete JWK
+* interface below tightens `Alg` to the algorithm family admissible for that key
+* type — e.g. a `JWK_oct<JWK_HMAC>` can only hold `"HS256" | "HS384" | "HS512"`
+* in `alg`.
+*/
+interface JWKParameters<Alg extends string = string> {
   /** JWK "kty" (Key Type) Parameter */
   kty: string;
   /**
@@ -205,7 +234,7 @@ interface JWKParameters {
   *
   * @see {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}
   */
-  alg?: string;
+  alg?: Alg;
   /** JWK "key_ops" (Key Operations) Parameter */
   key_ops?: KeyUsage[];
   /** JWK "ext" (Extractable) Parameter */
@@ -230,7 +259,7 @@ interface JWKParameters {
   enc?: ContentEncryptionAlgorithm;
 }
 /** Public EC JSON Web Keys */
-interface JWK_EC_Public extends JWKParameters {
+interface JWK_EC_Public<Alg extends JWK_ECDSA | JWK_ECDH_ES | (string & {}) = string> extends JWKParameters<Alg> {
   /** EC JWK "kty" (Key Type) Parameter */
   kty: "EC";
   /** EC JWK "crv" (Curve) Parameter */
@@ -241,14 +270,14 @@ interface JWK_EC_Public extends JWKParameters {
   y: string;
 }
 /** Private EC JSON Web Keys */
-interface JWK_EC_Private extends JWK_EC_Public {
+interface JWK_EC_Private<Alg extends JWK_ECDSA | JWK_ECDH_ES | (string & {}) = string> extends JWK_EC_Public<Alg> {
   /** EC JWK "d" (ECC Private Key) Parameter */
   d: string;
 }
 /** EC JSON Web Keys */
-type JWK_EC = JWK_EC_Public | JWK_EC_Private;
+type JWK_EC<Alg extends JWK_ECDSA | JWK_ECDH_ES | (string & {}) = string> = JWK_EC_Public<Alg> | JWK_EC_Private<Alg>;
 /** Public RSA JSON Web Keys */
-interface JWK_RSA_Public extends JWKParameters {
+interface JWK_RSA_Public<Alg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC | (string & {}) = string> extends JWKParameters<Alg> {
   /** RSA JWK "kty" (Key Type) Parameter */
   kty: "RSA";
   /** RSA JWK "e" (Exponent) Parameter */
@@ -258,7 +287,7 @@ interface JWK_RSA_Public extends JWKParameters {
   oth?: RsaOtherPrimesInfo[];
 }
 /** Private RSA JSON Web Keys */
-interface JWK_RSA_Private extends JWK_RSA_Public {
+interface JWK_RSA_Private<Alg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC | (string & {}) = string> extends JWK_RSA_Public<Alg> {
   /** RSA JWK "d" (Private Exponent) Parameter */
   d: string;
   /** RSA JWK "dp" (First Factor CRT Exponent) Parameter */
@@ -273,9 +302,9 @@ interface JWK_RSA_Private extends JWK_RSA_Public {
   qi: string;
 }
 /** RSA JSON Web Keys */
-type JWK_RSA = JWK_RSA_Public | JWK_RSA_Private;
+type JWK_RSA<Alg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC | (string & {}) = string> = JWK_RSA_Public<Alg> | JWK_RSA_Private<Alg>;
 /** Public ED JSON Web Keys */
-interface JWK_OKP_Public extends JWKParameters {
+interface JWK_OKP_Public<Alg extends JWK_OKP_SIGN | JWK_ECDH_ES | (string & {}) = string> extends JWKParameters<Alg> {
   /** ED JWK "kty" (Key Type) Parameter */
   kty: "OKP";
   /** ED JWK "crv" (Curve) Parameter */
@@ -284,48 +313,78 @@ interface JWK_OKP_Public extends JWKParameters {
   x: string;
 }
 /** Private ED JSON Web Keys */
-interface JWK_OKP_Private extends JWK_OKP_Public {
+interface JWK_OKP_Private<Alg extends JWK_OKP_SIGN | JWK_ECDH_ES | (string & {}) = string> extends JWK_OKP_Public<Alg> {
   /** ED JWK "d" (Private Key) Parameter */
   d: string;
 }
 /** OKP JSON Web Keys */
-type JWK_OKP = JWK_OKP_Public | JWK_OKP_Private;
+type JWK_OKP<Alg extends JWK_OKP_SIGN | JWK_ECDH_ES | (string & {}) = string> = JWK_OKP_Public<Alg> | JWK_OKP_Private<Alg>;
 /** oct JSON Web Keys */
-interface JWK_oct extends JWKParameters {
+interface JWK_oct<Alg extends JWK_HMAC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_AES_CBC_HMAC | JWK_PBES2 | "dir" | (string & {}) = string> extends JWKParameters<Alg> {
   /** Oct JWK "k" (Key Value) Parameter */
   k: string;
 }
 /** Symmetric JSON Web Keys */
-type JWK_Symmetric = JWK_oct;
+type JWK_Symmetric<Alg extends JWK_HMAC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_AES_CBC_HMAC | JWK_PBES2 | "dir" | (string & {}) = string> = JWK_oct<Alg>;
 /** Asymmetric JSON Web Keys */
-type JWK_Asymmetric = JWK_RSA | JWK_EC | JWK_OKP;
+type JWK_Asymmetric<Alg extends string = string> = JWK_RSA<Alg> | JWK_EC<Alg> | JWK_OKP<Alg>;
 /** Public JSON Web Keys */
-type JWK_Public = JWK_RSA_Public | JWK_EC_Public | JWK_OKP_Public;
+type JWK_Public<Alg extends string = string> = JWK_RSA_Public<Alg> | JWK_EC_Public<Alg> | JWK_OKP_Public<Alg>;
 /** Private JSON Web Keys */
-type JWK_Private = JWK_RSA_Private | JWK_EC_Private | JWK_OKP_Private;
+type JWK_Private<Alg extends string = string> = JWK_RSA_Private<Alg> | JWK_EC_Private<Alg> | JWK_OKP_Private<Alg>;
 /**
 * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC", "OKP" and "oct" key types are supported.
 */
-type JWK = JWK_oct | JWK_RSA | JWK_EC | JWK_OKP;
+type JWK<Alg extends string = string> = JWK_oct<Alg> | JWK_RSA<Alg> | JWK_EC<Alg> | JWK_OKP<Alg>;
 /**
-* A pair of public and private JSON Web Keys.
+* A pair of public and private JSON Web Keys, narrowed by `Alg` when that
+* uniquely identifies the key family:
+*
+* - `JWK_Pair<"RS256">` → RSA pair only
+* - `JWK_Pair<"ES256">` → EC pair only
+* - `JWK_Pair<"ECDH-ES+A256KW">` → EC pair **or** OKP pair (curve decides at runtime)
+* - `JWK_Pair<"Ed25519">` / `JWK_Pair<"EdDSA">` → OKP pair only
+*
+* The final branch is a generic fallback (`Alg = string`, or any custom /
+* forward-compat algorithm that doesn't match a known family) — it yields
+* the permissive three-branch union.
 */
-type JWK_Pair = {
-  publicKey: JWK_RSA_Public;
-  privateKey: JWK_RSA_Private;
+type JWK_Pair<Alg extends string = string> = Alg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC ? {
+  publicKey: JWK_RSA_Public<Alg>;
+  privateKey: JWK_RSA_Private<Alg>;
+} : Alg extends JWK_ECDSA ? {
+  publicKey: JWK_EC_Public<Alg>;
+  privateKey: JWK_EC_Private<Alg>;
+} : Alg extends JWK_ECDH_ES ? {
+  publicKey: JWK_EC_Public<Alg>;
+  privateKey: JWK_EC_Private<Alg>;
 } | {
-  publicKey: JWK_EC_Public;
-  privateKey: JWK_EC_Private;
+  publicKey: JWK_OKP_Public<Alg>;
+  privateKey: JWK_OKP_Private<Alg>;
+} : Alg extends JWK_OKP_SIGN ? {
+  publicKey: JWK_OKP_Public<Alg>;
+  privateKey: JWK_OKP_Private<Alg>;
+} : {
+  publicKey: JWK_RSA_Public<Alg>;
+  privateKey: JWK_RSA_Private<Alg>;
 } | {
-  publicKey: JWK_OKP_Public;
-  privateKey: JWK_OKP_Private;
+  publicKey: JWK_EC_Public<Alg>;
+  privateKey: JWK_EC_Private<Alg>;
+} | {
+  publicKey: JWK_OKP_Public<Alg>;
+  privateKey: JWK_OKP_Private<Alg>;
 };
 /**
 * JSON Web Key Set ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK Set}). "RSA", "EC" and "oct" key types are supported.
+*
+* The optional `T` generic preserves the precise key tuple when constructed
+* in TS — e.g. `JWKSet<[JWK_oct<"HS256">, JWK_EC_Public<"ES256">]>` — while the
+* default `JWK[]` keeps the permissive behavior expected for JWKS fetched from
+* external sources (runtime trials each candidate).
 */
-interface JWKSet {
+interface JWKSet<T extends readonly JWK[] = JWK[]> {
   /** JWK Set "keys" Parameter */
-  keys: JWK[];
+  keys: T;
   [parameter: string]: unknown;
 }
 /** JWK Key Algorithms */
@@ -345,8 +404,6 @@ type JWK_Symmetric_Algorithm = JWK_HMAC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM
 type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA_ENC | JWK_OKP_SIGN | JWK_ECDH_ES;
 type JWKAlgorithm = JWK_Symmetric_Algorithm | JWK_Asymmetric_Algorithm | JWK_AES_CBC_HMAC | JWK_PBES2 | JWK_ECDH_ES | "dir";
 type JWKPEMAlgorithm = JWK_RSA_PSS | JWK_RSA_SIGN | JWK_RSA_ENC | JWK_ECDSA | JWK_ECDH_ES | JWK_OKP_SIGN;
-//#endregion
-//#region src/core/types/jwt.d.ts
 /** Header Parameters common to JWE and JWS */
 interface JoseHeaderParameters {
   /** "kid" (Key ID) Header Parameter */
@@ -412,7 +469,11 @@ interface JWTClaimValidationOptions {
   subject?: string;
   /** Maximum token age, from the JWT "iat" (Issued At) Claim value. Implies presence requirement. */
   maxTokenAge?: MaxTokenAge;
-  /** Clock skew tolerance (in seconds) for validating time-based claims (nbf/exp/iat). */
+  /**
+  * Clock skew tolerance (in seconds) for validating time-based claims (nbf/exp/iat).
+  *
+  * @default 0
+  */
   clockTolerance?: number;
   /** Expected JWT "typ" (Type) Header Parameter value. Implies presence requirement. */
   typ?: string;
@@ -428,10 +489,99 @@ interface JWTClaimValidationOptions {
   */
   recognizedHeaders?: string[];
 }
-//#endregion
-//#region src/core/types/jws.d.ts
+/**
+* All known error codes thrown by unjwt.
+*
+* Code naming follows the JOSE spec hierarchy:
+*   ERR_JWT_*  — RFC 7519 JSON Web Token claim validation
+*   ERR_JWS_*  — RFC 7515 JSON Web Signature
+*   ERR_JWE_*  — RFC 7516 JSON Web Encryption
+*   ERR_JWK_*  — RFC 7517 JSON Web Key
+*/
+type JWTErrorCode = "ERR_JWT_EXPIRED" | "ERR_JWT_NBF" | "ERR_JWT_CLAIM_INVALID" | "ERR_JWT_CLAIM_MISSING" | "ERR_JWS_INVALID" | "ERR_JWS_INVALID_SERIALIZATION" | "ERR_JWS_SIGNATURE_INVALID" | "ERR_JWS_ALG_NOT_ALLOWED" | "ERR_JWS_ALG_MISSING" | "ERR_JWS_SIGNER_ALG_INFERENCE" | "ERR_JWS_NO_MATCHING_SIGNER" | "ERR_JWS_HEADER_PARAMS_NOT_DISJOINT" | "ERR_JWS_B64_INCONSISTENT" | "ERR_JWE_INVALID" | "ERR_JWE_INVALID_SERIALIZATION" | "ERR_JWE_DECRYPTION_FAILED" | "ERR_JWE_ALG_NOT_ALLOWED" | "ERR_JWE_ALG_MISSING" | "ERR_JWE_ALG_FORBIDDEN_IN_MULTI" | "ERR_JWE_ENC_MISSING" | "ERR_JWE_RECIPIENT_ALG_INFERENCE" | "ERR_JWE_NO_MATCHING_RECIPIENT" | "ERR_JWE_HEADER_PARAMS_NOT_DISJOINT" | "ERR_JWK_INVALID" | "ERR_JWK_KEY_NOT_FOUND" | "ERR_JWK_UNSUPPORTED" | (string & {});
+/**
+* Maps known error codes to their structured `cause` shapes.
+* Only codes that carry decoded context beyond the message appear here.
+* Extend this interface when new structured causes are introduced.
+*/
+interface JWTErrorCauseMap {
+  /** Decoded claims available at the point the lifetime check failed. */
+  ERR_JWT_EXPIRED: {
+    jti?: string;
+    iat?: number;
+    exp?: number;
+  };
+}
+/**
+* Base error class for all unjwt errors. Every error thrown by the library is
+* an instance of `JWTError`, so a single `instanceof` check is sufficient to
+* distinguish library errors from other thrown values. Use the `code` property
+* (or the `isJWTError` type guard) to narrow to a specific error condition.
+*
+* @example
+* import { JWTError, isJWTError } from "unjwt/jws";
+*
+* try {
+*   await verify(token, key);
+* } catch (err) {
+*   if (isJWTError(err, "ERR_JWT_EXPIRED")) {
+*     console.log(err.cause.jti); // string | undefined
+*   }
+* }
+*/
+declare class JWTError<TCode extends JWTErrorCode = JWTErrorCode> extends Error {
+  readonly code: TCode;
+  override readonly cause?: unknown;
+  constructor(message: string, code: TCode, cause?: unknown);
+}
+/**
+* Type guard that narrows `error` to `JWTError`.
+*
+* When called with a code that is a key of `JWTErrorCauseMap`, the return
+* type is additionally narrowed to include the structured `cause` shape for
+* that code. When called with any other `JWTErrorCode`, `code` is narrowed
+* but `cause` remains `unknown`. When called without a code, narrows only to
+* `JWTError`.
+*
+* @example
+* if (isJWTError(err, "ERR_JWT_EXPIRED")) {
+*   err.cause.jti // string | undefined  ✓
+* }
+*/
+declare function isJWTError<T extends keyof JWTErrorCauseMap>(error: unknown, code: T): error is JWTError<T> & {
+  cause: JWTErrorCauseMap[T];
+};
+declare function isJWTError<T extends JWTErrorCode>(error: unknown, code: T): error is JWTError<T>;
+declare function isJWTError(error: unknown): error is JWTError;
+type StrictOmit<T, K extends keyof T | (string & {}) | (number & {}) | (symbol & {})> = { [P in keyof T as P extends K ? never : P]: T[P] };
 /** JWS Signing Algorithm Identifier. */
 type JWSAlgorithm = JWK_HMAC | JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_OKP_SIGN;
+/**
+* Asymmetric private JWKs admissible as a signing key. RSA keys carry a
+* signing `alg` (RS* or PS*); EC keys carry an ECDSA alg; OKP keys carry an Ed
+* signing alg.
+*/
+type JWSAsymmetricPrivateJWK = JWK_RSA_Private<JWK_RSA_SIGN | JWK_RSA_PSS> | JWK_EC_Private<JWK_ECDSA> | JWK_OKP_Private<JWK_OKP_SIGN>;
+/**
+* Asymmetric public JWKs admissible as a verification key. RSA keys carry a
+* signing `alg` (RS* or PS*); EC keys carry an ECDSA alg; OKP keys carry an Ed
+* signing alg.
+*/
+type JWSAsymmetricPublicJWK = JWK_RSA_Public<JWK_RSA_SIGN | JWK_RSA_PSS> | JWK_EC_Public<JWK_ECDSA> | JWK_OKP_Public<JWK_OKP_SIGN>;
+/**
+* JWKs admissible as the `key` argument of {@link sign}. HMAC oct keys carry a
+* {@link JWK_HMAC} alg; asymmetric private keys carry their family's signing alg.
+* A JWK whose `alg` points at a non-signing family (e.g. `"RSA-OAEP"`) is
+* rejected at the type level.
+*/
+type JWSSignJWK = JWK_oct<JWK_HMAC> | JWSAsymmetricPrivateJWK;
+/**
+* JWKs admissible as a `key` for {@link verify}. HMAC oct keys carry a
+* {@link JWK_HMAC} alg; asymmetric public keys carry their family's signing alg.
+* A JWK whose `alg` points at a non-signing family (e.g. `"RSA-OAEP"`) is
+* rejected at the type level.
+*/
+type JWSVerifyJWK = JWK_oct<JWK_HMAC> | JWSAsymmetricPublicJWK;
 /** Recognized JWS Header Parameters, any other Header Members may also be present. */
 interface JWSHeaderParameters extends JoseHeaderParameters {
   /** JWS "alg" (Algorithm) Header Parameter */
@@ -455,16 +605,45 @@ interface JWSSignOptions {
   /** The JWS Algorithm to use. Must be provided. */
   alg?: JWSAlgorithm;
   /**
-  * Additional protected header parameters. `alg` is automatically included.
-  * `typ` defaults to "JWT" if not provided and payload is an object.
+  * Additional protected header parameters. `alg` is always derived from the top-level `alg`
+  * option (or inferred from the key) and cannot be overridden. `typ` defaults to `"JWT"`
+  * when the payload is a JSON object.
   */
-  protectedHeader?: JWSHeaderParameters;
+  protectedHeader?: StrictOmit<JWSHeaderParameters, "alg"> & {
+    alg?: never;
+  };
   /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
   currentDate?: Date;
   /**
-  * Time at which the JWS should expire, if no `exp` was already provided.
+  * Duration until the JWS should expire, relative to `currentDate` (or `new Date()`).
+  * Skipped when the payload already carries an `exp` claim.
+  *
+  * Mutually exclusive with {@link expiresAt}.
   */
   expiresIn?: ExpiresIn;
+  /**
+  * Absolute moment at which the JWS should expire (sets the `exp` claim directly).
+  * Skipped when the payload already carries an `exp` claim.
+  *
+  * Mutually exclusive with {@link expiresIn}.
+  */
+  expiresAt?: Date;
+  /**
+  * Duration from `iat` before which the JWS must not be accepted.
+  * `0` is allowed and sets `nbf = iat` (explicit temporal floor at sign time).
+  * Skipped when the payload already carries an `nbf` claim.
+  *
+  * Mutually exclusive with {@link notBeforeAt}.
+  */
+  notBeforeIn?: ExpiresIn;
+  /**
+  * Absolute moment before which the JWS must not be accepted (sets the `nbf`
+  * claim directly per RFC 7519 §4.1.5). Skipped when the payload already
+  * carries an `nbf` claim.
+  *
+  * Mutually exclusive with {@link notBeforeIn}.
+  */
+  notBeforeAt?: Date;
 }
 /** Result of JWS verification */
 interface JWSVerifyResult<T extends JOSEPayload = JOSEPayload> {
@@ -488,11 +667,146 @@ interface JWSVerifyOptions extends JWTClaimValidationOptions {
   */
   validateClaims?: boolean;
 }
-//#endregion
-//#region src/core/utils/types.d.ts
-type StrictOmit<T, K extends keyof T | (string & {}) | (number & {}) | (symbol & {})> = { [P in keyof T as P extends K ? never : P]: T[P] };
-//#endregion
-//#region src/core/types/jwe.d.ts
+/**
+* JWS Flattened JSON Serialization, RFC 7515 §7.2.2. Accepted as input by
+* {@link verifyMulti} and normalized to {@link JWSGeneralSerialization}
+* internally. Emitted by {@link generalToFlattenedJWS} on a single-signature
+* General serialization.
+*/
+interface JWSFlattenedSerialization {
+  /** The JWS Payload. base64url-encoded when `b64 !== false`. */
+  payload: string;
+  /** Base64URL-encoded JWS Protected Header (part of the signing input). */
+  protected?: string;
+  /** JWS Unprotected Header (not part of the signing input). */
+  header?: JWSHeaderParameters;
+  /** Base64URL-encoded signature bytes. */
+  signature: string;
+}
+/**
+* JWS General JSON Serialization, RFC 7515 §7.2.1. Canonical multi-signature
+* output shape of {@link signMulti}.
+*
+* `payload` is shared across all signatures and carries base64url-encoded
+* bytes by default. When the consistent `b64: false` signing mode is used
+* (RFC 7797), `payload` holds the raw UTF-8 payload string instead.
+*/
+interface JWSGeneralSerialization extends Omit<JWSFlattenedSerialization, "protected" | "header" | "signature"> {
+  /** One entry per signer. */
+  signatures: JWSGeneralSignature[];
+}
+/** A single signature entry within {@link JWSGeneralSerialization.signatures}. */
+type JWSGeneralSignature = Pick<JWSFlattenedSerialization, "protected" | "header" | "signature">;
+/**
+* Input shape for a single signer passed to {@link signMulti}.
+*
+* `alg` is inferred from `key.alg`; throws `ERR_JWS_SIGNER_ALG_INFERENCE`
+* when absent. `kid` is pulled from `key.kid` when present.
+*/
+interface JWSMultiSigner {
+  /** Signing key (JWK-first; `alg` inferred from `key.alg`). */
+  key: JWSSignJWK;
+  /**
+  * Extra per-signer JWS Protected Header parameters (RFC 7515 §7.2.1).
+  * `alg` is always derived from the JWK and cannot be set here. `b64`
+  * MUST be consistent across every signer (RFC 7797 §3) — if set on one
+  * signer it must match on all.
+  */
+  protectedHeader?: StrictOmit<JWSHeaderParameters, "alg"> & {
+    alg?: never;
+  };
+  /** Per-signer JWS Unprotected Header (not part of signing input). */
+  unprotectedHeader?: JWSHeaderParameters;
+}
+/**
+* Options for {@link signMulti}. Mirrors {@link JWSSignOptions} minus the
+* per-signer fields (`alg`, `protectedHeader` — set those on each
+* {@link JWSMultiSigner} instead).
+*/
+interface JWSMultiSignOptions extends StrictOmit<JWSSignOptions, "alg" | "protectedHeader"> {}
+/** Options for {@link verifyMulti}. Extends {@link JWSVerifyOptions}. */
+interface JWSMultiVerifyOptions extends JWSVerifyOptions {
+  /**
+  * When `false` (default), verification trials signatures in order — mirrors
+  * the multi-key retry behaviour of {@link verify} against a JWK Set. When
+  * `true`, only signatures whose header unambiguously matches the provided
+  * key (by `kid`, then by `kty`/`crv`/length) are attempted, and any
+  * mismatch throws `ERR_JWS_NO_MATCHING_SIGNER` before any crypto work.
+  */
+  strictSignerMatch?: boolean;
+}
+/**
+* Result of a {@link verifyMulti} operation. Extends {@link JWSVerifyResult}
+* with the per-signer header and matched signature index.
+*/
+interface JWSMultiVerifyResult<T extends JOSEPayload = JOSEPayload> extends JWSVerifyResult<T> {
+  /** Parsed per-signer unprotected header of the signature that verified. */
+  signerHeader?: JWSHeaderParameters;
+  /** Index into `jws.signatures` of the signature that successfully verified. */
+  signerIndex: number;
+}
+/**
+* Options for {@link verifyMultiAll}. Inherits the same validation knobs as
+* {@link JWSMultiVerifyOptions} minus `strictSignerMatch` (not meaningful when
+* every signature is independently reported).
+*/
+interface JWSMultiVerifyAllOptions extends StrictOmit<JWSMultiVerifyOptions, "strictSignerMatch"> {}
+/**
+* Per-signature outcome collected by {@link verifyMultiAll}. Discriminated by
+* `verified`:
+*
+*   - `verified: true` — the signature cryptographically verified and any
+*     claim/`crit` validation the caller asked for also passed. `payload` is
+*     provided.
+*   - `verified: false` — verification could not be completed for this
+*     signature. `error` carries the {@link JWTError} reason (signature
+*     invalid, disallowed alg, `typ` mismatch, key-resolver failure, malformed
+*     protected header, expired claim, etc.). `protectedHeader` / `signerHeader`
+*     are populated when they were successfully parsed before failure.
+*
+* Callers apply their own policy over the returned array — e.g. "all must
+* verify", "quorum of N", "signed by these specific kids".
+*/
+type JWSMultiVerifyOutcome<T extends JOSEPayload = JOSEPayload> = {
+  signerIndex: number;
+  verified: true;
+  payload: T;
+  protectedHeader: JWSProtectedHeader;
+  signerHeader?: JWSHeaderParameters;
+} | {
+  signerIndex: number;
+  verified: false;
+  error: JWTError;
+  protectedHeader?: JWSProtectedHeader;
+  signerHeader?: JWSHeaderParameters;
+};
+/**
+* Algorithms admissible on an `oct` JWK used for JWE key management. Mirrors
+* the runtime aliasing table in `jweAlgsFromOctJWK` — HMAC algs intentionally
+* excluded (they don't resolve to any JWE `alg`).
+*/
+type _JWEOctAlg = JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_AES_CBC_HMAC | JWK_PBES2 | "dir";
+/**
+* Asymmetric public JWKs admissible for JWE encryption. RSA keys carry an
+* RSA-OAEP alg; EC/OKP keys carry an ECDH-ES alg.
+*/
+type JWEAsymmetricPublicJWK = JWK_RSA_Public<JWK_RSA_ENC> | JWK_EC_Public<JWK_ECDH_ES> | JWK_OKP_Public<JWK_ECDH_ES>;
+/**
+* Asymmetric private JWKs admissible for JWE decryption. RSA keys carry an
+* RSA-OAEP alg; EC/OKP keys carry an ECDH-ES alg.
+*/
+type JWEAsymmetricPrivateJWK = JWK_RSA_Private<JWK_RSA_ENC> | JWK_EC_Private<JWK_ECDH_ES> | JWK_OKP_Private<JWK_ECDH_ES>;
+/**
+* JWKs admissible as the `key` argument of {@link encrypt}. A JWK whose `alg`
+* points at a non-JWE family (e.g. `"HS256"`, `"RS256"`) is rejected at the
+* type level.
+*/
+type JWEEncryptJWK = JWK_oct<_JWEOctAlg> | JWEAsymmetricPublicJWK;
+/**
+* JWKs admissible as a `key` for {@link decrypt}. A JWK whose `alg` points at
+* a non-JWE family (e.g. `"HS256"`, `"RS256"`) is rejected at the type level.
+*/
+type JWEDecryptJWK = JWK_oct<_JWEOctAlg> | JWEAsymmetricPrivateJWK;
 /** Recognized JWE Header Parameters, any other Header Members may also be present. */
 interface JWEHeaderParameters extends JoseHeaderParameters {
   /**
@@ -569,8 +883,36 @@ interface JWEEncryptOptions {
   enc?: ContentEncryptionAlgorithm;
   /** Date to use when computing NumericDate claims, defaults to `new Date()`. */
   currentDate?: Date;
-  /** Time at which the JWT should expire, if no `exp` was already provided (only when typ is "JWT" or explicitly parsing JWT). */
+  /**
+  * Duration until the JWT should expire, relative to `currentDate` (or `new Date()`).
+  * Skipped when the payload already carries an `exp` claim.
+  *
+  * Mutually exclusive with {@link expiresAt}.
+  */
   expiresIn?: ExpiresIn;
+  /**
+  * Absolute moment at which the JWT should expire (sets the `exp` claim directly).
+  * Skipped when the payload already carries an `exp` claim.
+  *
+  * Mutually exclusive with {@link expiresIn}.
+  */
+  expiresAt?: Date;
+  /**
+  * Duration from `iat` before which the JWT must not be accepted.
+  * `0` is allowed and sets `nbf = iat` (explicit temporal floor at sign time).
+  * Skipped when the payload already carries an `nbf` claim.
+  *
+  * Mutually exclusive with {@link notBeforeAt}.
+  */
+  notBeforeIn?: ExpiresIn;
+  /**
+  * Absolute moment before which the JWT must not be accepted (sets the `nbf`
+  * claim directly per RFC 7519 §4.1.5). Skipped when the payload already
+  * carries an `nbf` claim.
+  *
+  * Mutually exclusive with {@link notBeforeIn}.
+  */
+  notBeforeAt?: Date;
   /** Additional JWE Protected Header parameters. */
   protectedHeader?: StrictOmit<JWEHeaderParameters, "alg" | "enc" | "iv" | "tag" | "p2s" | "p2c" | "epk" | "apu" | "apv">;
   /** Initialization Vector for AES-GCMKW key wrapping. Generated if not provided. */
@@ -629,6 +971,10 @@ interface JWEDecryptOptions extends JWTClaimValidationOptions {
   validateClaims?: boolean;
   /** If true, include the Content Encryption Key (CEK) and Additional Authenticated Data (AAD) in the result. */
   returnCek?: boolean;
+  /** Minimum accepted PBES2 `p2c` on unwrap. Defaults to 1000 (RFC 7518 §4.8.1.2). */
+  minIterations?: number;
+  /** Maximum accepted PBES2 `p2c` on unwrap. Defaults to 1_000_000 to cap PBKDF2 DoS potential. */
+  maxIterations?: number;
 }
 /**
 * JWE Protected Header — the parsed and validated protected header returned
@@ -654,9 +1000,120 @@ interface JWEDecryptResult<T extends JOSEPayload = JOSEPayload> {
   /** The Additional Authenticated Data (AAD) used, as Uint8Array. Only present when `returnCek` is true. */
   aad?: Uint8Array<ArrayBuffer>;
 }
-//#endregion
-//#region src/core/types/index.d.ts
-type ExpiresIn = number | `${number}` | `${number}${"s" | "second" | "seconds" | "m" | "minute" | "minutes" | "h" | "hour" | "hours" | "D" | "day" | "days" | "W" | "week" | "weeks" | "M" | "month" | "months" | "Y" | "year" | "years"}`;
-type MaxTokenAge = ExpiresIn;
-//#endregion
-export { JWK_OKP_SIGN as $, JWK as A, JWK_AES_GCM_KW as B, DeriveKeyOptions as C, GenerateKeyAlgorithm as D, GenerateJWKReturn as E, JWKPEMAlgorithm as F, JWK_ECDH_ES as G, JWK_Asymmetric as H, JWKParameters as I, JWK_EC_Public as J, JWK_ECDSA as K, JWKSet as L, JWKCacheAdapter as M, JWKLookupFunction as N, GenerateKeyOptions as O, JWKLookupFunctionHeader as P, JWK_OKP_Public as Q, JWK_AES_CBC_HMAC as R, ContentEncryptionAlgorithm as S, GenerateJWKOptions as T, JWK_Asymmetric_Algorithm as U, JWK_AES_KW as V, JWK_EC as W, JWK_OKP as X, JWK_HMAC as Y, JWK_OKP_Private as Z, JWT as _, JWEEncryptOptions as a, JWK_RSA_ENC as at, JoseHeaderParameters as b, JWEProtectedHeader as c, JWK_RSA_Public as ct, JWSHeaderParameters as d, JWK_Symmetric_Algorithm as dt, JWK_PBES2 as et, JWSProtectedHeader as f, JWK_oct as ft, JOSEPayload as g, WrapKeyResult as gt, JWSVerifyResult as h, WrapKeyOptions as ht, JWEDecryptResult as i, JWK_RSA as it, JWKAlgorithm as j, GenerateKeyReturn as k, StrictOmit as l, JWK_RSA_SIGN as lt, JWSVerifyOptions as m, UnwrapKeyOptions as mt, MaxTokenAge as n, JWK_Private as nt, JWEHeaderParameters as o, JWK_RSA_PSS as ot, JWSSignOptions as p, KeyManagementAlgorithm as pt, JWK_EC_Private as q, JWEDecryptOptions as r, JWK_Public as rt, JWEKeyManagementHeaderParameters as s, JWK_RSA_Private as st, ExpiresIn as t, JWK_Pair as tt, JWSAlgorithm as u, JWK_Symmetric as ut, JWTClaimValidationOptions as v, DeriveKeyReturn as w, CompositeKey as x, JWTClaims as y, JWK_AES_GCM as z };
+/**
+* JWE Flattened JSON Serialization, RFC 7516 §7.2.2.
+*/
+interface JWEFlattenedSerialization {
+  header?: JWEHeaderParameters;
+  encrypted_key?: string;
+  /** Base64URL-encoded JWE Protected Header (part of AAD). */
+  protected?: string;
+  /** Shared JWE Unprotected Header (JSON, not part of AAD). */
+  unprotected?: JWEHeaderParameters;
+  /** Base64URL-encoded external Additional Authenticated Data. */
+  aad?: string;
+  /** Base64URL-encoded IV (Initialization Vector). */
+  iv?: string;
+  /** Base64URL-encoded ciphertext. */
+  ciphertext: string;
+  /** Base64URL-encoded authentication tag. */
+  tag?: string;
+}
+/**
+* JWE General JSON Serialization, RFC 7516 §7.2.1. The canonical
+* multi-recipient output shape of {@link encryptMulti}.
+*/
+interface JWEGeneralSerialization extends Omit<JWEFlattenedSerialization, "encrypted_key" | "header"> {
+  /** One entry per recipient. */
+  recipients: JWEGeneralRecipient[];
+}
+/** A single recipient entry within {@link JWEGeneralSerialization.recipients}. */
+interface JWEGeneralRecipient {
+  /** Per-recipient JWE Unprotected Header (JSON, not part of AAD). */
+  header?: JWEHeaderParameters;
+  /** Base64URL-encoded encrypted CEK for this recipient. */
+  encrypted_key?: string;
+}
+/**
+* Input shape for a single recipient passed to {@link encryptMulti}.
+*
+* `alg` is inferred from `key.alg` or from the JWK's kty/curve/length using
+* the same rules as {@link encrypt}. `kid` is pulled from `key.kid` when
+* present. To override either, spread or set via {@link JWEMultiRecipient.header}.
+*/
+interface JWEMultiRecipient {
+  /** Recipient key (JWK-first; `alg` inferred if absent from JWK). */
+  key: JWEEncryptJWK;
+  /**
+  * Extra per-recipient JWE Unprotected Header parameters (RFC 7516 §7.2.1).
+  * Excludes fields the library writes automatically: `alg`, `enc`, `iv`,
+  * `tag`, `p2s`, `p2c`, `epk`, `apu`, `apv`.
+  *
+  * Typical use: `x5c`, `x5t`, custom routing metadata.
+  */
+  header?: StrictOmit<JWEHeaderParameters, "alg" | "enc" | "iv" | "tag" | "p2s" | "p2c" | "epk" | "apu" | "apv">;
+  /** ECDH-ES ephemeral key / party info for this recipient. */
+  ecdh?: JWEEncryptOptions["ecdh"];
+  /** PBES2 salt for this recipient. Randomized (16 bytes) when omitted. */
+  p2s?: Uint8Array<ArrayBuffer>;
+  /** PBES2 iteration count for this recipient. Defaults to 600_000. */
+  p2c?: number;
+  /** Initialization vector for AES-GCMKW key wrapping for this recipient. */
+  keyManagementIV?: Uint8Array<ArrayBuffer>;
+}
+/**
+* Options for {@link encryptMulti}. Extends {@link JWEEncryptOptions} and drops
+* the fields that are per-recipient in multi-recipient mode (`alg`, `ecdh`,
+* `p2s`, `p2c`, `keyManagementIV` — set those on each {@link JWEMultiRecipient}
+* instead).
+*/
+interface JWEMultiEncryptOptions extends StrictOmit<JWEEncryptOptions, "alg" | "ecdh" | "p2s" | "p2c" | "keyManagementIV"> {
+  /** Shared JWE Unprotected Header (surfaces as `unprotected` in the output). */
+  sharedUnprotectedHeader?: Record<string, unknown>;
+  /**
+  * External Additional Authenticated Data (RFC 7516 §5.1). Encoded as
+  * base64url and written to the `aad` field; the content cipher AAD becomes
+  * `BASE64URL(protected) || '.' || BASE64URL(aad)`.
+  */
+  aad?: Uint8Array<ArrayBuffer> | string;
+}
+/**
+* Options for {@link decryptMulti}. Extends {@link JWEDecryptOptions}.
+*/
+interface JWEMultiDecryptOptions extends JWEDecryptOptions {
+  /**
+  * When `false` (default) decryption trials recipients in order — mirrors the
+  * multi-key retry behaviour of {@link decrypt} against a JWK Set. When
+  * `true`, only recipients whose header unambiguously matches the provided
+  * key (by `kid`, then by `kty`/`crv`/length) are attempted, and any mismatch
+  * throws `ERR_JWE_NO_MATCHING_RECIPIENT` before any crypto work.
+  */
+  strictRecipientMatch?: boolean;
+}
+/**
+* Result of a {@link decryptMulti} operation. Extends {@link JWEDecryptResult}
+* with the per-recipient header tier surfaced on the matching recipient.
+*/
+interface JWEMultiDecryptResult<T extends JOSEPayload = JOSEPayload> extends JWEDecryptResult<T> {
+  /** Parsed shared unprotected header, when present on the serialization. */
+  sharedUnprotectedHeader?: JWEHeaderParameters;
+  /** Parsed per-recipient unprotected header of the recipient that decrypted. */
+  recipientHeader?: JWEHeaderParameters;
+  /** Index into `jwe.recipients` of the recipient that successfully decrypted. */
+  recipientIndex: number;
+}
+/**
+* A time duration, expressed as an integer number of seconds or a human-readable
+* shorthand like `"10m"`, `"2h"`, `"7D"`.
+*
+* Shared base type for every duration-valued option in the library:
+* {@link ExpiresIn}, {@link NotBeforeIn}, {@link MaxTokenAge}.
+*/
+type Duration = number | `${number}` | `${number}${"s" | "second" | "seconds" | "m" | "minute" | "minutes" | "h" | "hour" | "hours" | "D" | "day" | "days" | "W" | "week" | "weeks" | "M" | "month" | "months" | "Y" | "year" | "years"}`;
+/** Duration until `exp` — the `expiresIn` option on {@link sign} / {@link encrypt}. */
+type ExpiresIn = Duration;
+/** Duration from `iat` for `nbf` — the `notBeforeIn` option on {@link sign} / {@link encrypt}. */
+type NotBeforeIn = Duration;
+/** Duration for `maxTokenAge` validation on {@link verify} / {@link decrypt}. */
+type MaxTokenAge = Duration;
+export { DeriveKeyOptions as $, JWSMultiSigner as A, JWK_PBES2 as At, JWSVerifyResult as B, JWK_Symmetric as Bt, JWSAsymmetricPrivateJWK as C, JWK_EC_Private as Ct, JWSGeneralSignature as D, JWK_OKP_Private as Dt, JWSGeneralSerialization as E, JWK_OKP as Et, JWSProtectedHeader as F, JWK_RSA_ENC as Ft, isJWTError as G, UnwrappingKeyFor as Gt, JWTError as H, JWK_oct as Ht, JWSSignJWK as I, JWK_RSA_PSS as It, JWTClaimValidationOptions as J, WrappingKeyFor as Jt, JOSEPayload as K, WrapKeyOptions as Kt, JWSSignOptions as L, JWK_RSA_Private as Lt, JWSMultiVerifyOptions as M, JWK_Private as Mt, JWSMultiVerifyOutcome as N, JWK_Public as Nt, JWSHeaderParameters as O, JWK_OKP_Public as Ot, JWSMultiVerifyResult as P, JWK_RSA as Pt, ContentEncryptionAlgorithm as Q, JWSVerifyJWK as R, JWK_RSA_Public as Rt, JWSAlgorithm as S, JWK_ECDSA as St, JWSFlattenedSerialization as T, JWK_HMAC as Tt, JWTErrorCauseMap as U, KeyManagementAlgorithm as Ut, StrictOmit as V, JWK_Symmetric_Algorithm as Vt, JWTErrorCode as W, UnwrapKeyOptions as Wt, JoseHeaderParameters as X, JWTClaims as Y, CompositeKey as Z, JWEMultiDecryptOptions as _, JWK_AES_KW as _t, JWEAsymmetricPrivateJWK as a, GenerateKeyReturn as at, JWEMultiRecipient as b, JWK_EC as bt, JWEDecryptOptions as c, JWKCacheAdapter as ct, JWEEncryptOptions as d, JWKPEMAlgorithm as dt, DeriveKeyReturn as et, JWEFlattenedSerialization as f, JWKParameters as ft, JWEKeyManagementHeaderParameters as g, JWK_AES_GCM_KW as gt, JWEHeaderParameters as h, JWK_AES_GCM as ht, NotBeforeIn as i, GenerateKeyOptions as it, JWSMultiVerifyAllOptions as j, JWK_Pair as jt, JWSMultiSignOptions as k, JWK_OKP_SIGN as kt, JWEDecryptResult as l, JWKLookupFunction as lt, JWEGeneralSerialization as m, JWK_AES_CBC_HMAC as mt, ExpiresIn as n, GenerateJWKReturn as nt, JWEAsymmetricPublicJWK as o, JWK as ot, JWEGeneralRecipient as p, JWKSet as pt, JWT as q, WrapKeyResult as qt, MaxTokenAge as r, GenerateKeyAlgorithm as rt, JWEDecryptJWK as s, JWKAlgorithm as st, Duration as t, GenerateJWKOptions as tt, JWEEncryptJWK as u, JWKLookupFunctionHeader as ut, JWEMultiDecryptResult as v, JWK_Asymmetric as vt, JWSAsymmetricPublicJWK as w, JWK_EC_Public as wt, JWEProtectedHeader as x, JWK_ECDH_ES as xt, JWEMultiEncryptOptions as y, JWK_Asymmetric_Algorithm as yt, JWSVerifyOptions as z, JWK_RSA_SIGN as zt };