unjwt 0.7.0 → 0.7.1

package/dist/_chunks/index.d.mts

@@ -27,8 +27,12 @@ type JWKLookupFunctionHeader = {
 *
 * Returning a `string` is meaningful for JWE only (PBES2 password); for JWS
 * a string return is encoded to bytes and used as a raw symmetric key.
+*
+* The optional `TReturn` generic lets callers who always hand back a specific
+* key shape (e.g. a `JWK_EC_Public<"ES256">`) preserve that narrowing all the
+* way into the `verify` / `decrypt` key resolution path.
 */
-type JWKLookupFunction = (header: JWKLookupFunctionHeader, token: string) => CryptoKey | JWK | JWKSet | string | Uint8Array<ArrayBuffer> | Promise<CryptoKey | JWK | JWKSet | string | Uint8Array<ArrayBuffer>>;
+type JWKLookupFunction<TReturn = CryptoKey | JWK | JWKSet | string | Uint8Array<ArrayBuffer>> = (header: JWKLookupFunctionHeader, token: string) => TReturn | Promise<TReturn>;
 /**
 * Interface for custom JWK import cache implementations.
 *
@@ -77,22 +81,7 @@ interface GenerateKeyOptions {
   */
   toJWK?: boolean;
 }
-type GenerateKeyReturnJWK<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_Asymmetric_Algorithm ? TAlg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC ? {
-  privateKey: JWK_RSA_Private;
-  publicKey: JWK_RSA_Public;
-} : TAlg extends JWK_ECDSA ? {
-  privateKey: JWK_EC_Private;
-  publicKey: JWK_EC_Public;
-} : TAlg extends JWK_ECDH_ES ? {
-  privateKey: JWK_EC_Private;
-  publicKey: JWK_EC_Public;
-} | {
-  privateKey: JWK_OKP_Private;
-  publicKey: JWK_OKP_Public;
-} : TAlg extends JWK_OKP_SIGN ? {
-  privateKey: JWK_OKP_Private;
-  publicKey: JWK_OKP_Public;
-} : never : TAlg extends JWK_AES_CBC_HMAC | JWK_Symmetric_Algorithm ? JWK_oct : never;
+type GenerateKeyReturnJWK<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_Asymmetric_Algorithm ? JWK_Pair<TAlg> : TAlg extends JWK_AES_CBC_HMAC | JWK_Symmetric_Algorithm ? JWK_oct<TAlg> : never;
 type GenerateKeyReturnCrypto<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_AES_CBC_HMAC ? Uint8Array<ArrayBuffer> : TAlg extends JWK_Asymmetric_Algorithm ? CryptoKeyPair : CryptoKey;
 type GenerateKeyReturn<TAlg extends GenerateKeyAlgorithm, TOptions extends GenerateKeyOptions> = TOptions["toJWK"] extends true ? GenerateKeyReturnJWK<TAlg> : GenerateKeyReturnCrypto<TAlg>;
 type GenerateJWKOptions = Omit<GenerateKeyOptions, "toJWK">;
@@ -114,9 +103,27 @@ interface DeriveKeyOptions {
   */
   toJWK?: boolean;
 }
-type DeriveKeyReturn<TOptions extends DeriveKeyOptions> = TOptions["toJWK"] extends true ? JWK_oct : TOptions["toJWK"] extends object ? JWK_oct : CryptoKey;
+/** PBES2 → AES-KW alg that ends up stamped on the derived JWK's `alg`. */
+type DerivedJWKAlg<TAlg extends JWK_PBES2> = TAlg extends "PBES2-HS256+A128KW" ? "A128KW" : TAlg extends "PBES2-HS384+A192KW" ? "A192KW" : TAlg extends "PBES2-HS512+A256KW" ? "A256KW" : JWK_AES_KW;
+type DeriveKeyReturn<TOptions extends DeriveKeyOptions, TAlg extends JWK_PBES2 = JWK_PBES2> = TOptions["toJWK"] extends true ? JWK_oct<DerivedJWKAlg<TAlg>> : TOptions["toJWK"] extends object ? JWK_oct<DerivedJWKAlg<TAlg>> : CryptoKey;
 type KeyManagementAlgorithm = JWK_RSA_ENC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_PBES2 | JWK_ECDH_ES | "dir";
 type ContentEncryptionAlgorithm = JWK_AES_GCM | JWK_AES_CBC_HMAC;
+/**
+* Keys admissible as the `wrappingKey` argument of {@link wrapKey}, narrowed
+* by the key management algorithm. Mirrors the runtime branches in
+* `jwk.wrapKey` and the inference in `inferJWEAllowedAlgorithms`.
+*
+* - `dir` accepts any symmetric JWK (the key _is_ the CEK).
+* - AES-GCMKW tolerates a JWK whose `alg` is the bare `A*GCM` counterpart —
+*   matches the `jweAlgsFromOctJWK` aliasing rule.
+*/
+type WrappingKeyFor<A extends KeyManagementAlgorithm> = A extends JWK_RSA_ENC ? CryptoKey | JWK_RSA_Public<A> : A extends JWK_ECDH_ES ? CryptoKey | JWK_EC_Public<A> | JWK_OKP_Public<A> : A extends JWK_PBES2 ? string | Uint8Array<ArrayBuffer> | JWK_oct<A> : A extends JWK_AES_KW ? CryptoKey | JWK_oct<A> : A extends JWK_AES_GCM_KW ? CryptoKey | JWK_oct<A | `A${"128" | "192" | "256"}GCM`> : A extends "dir" ? CryptoKey | JWK_oct | Uint8Array<ArrayBuffer> : never;
+/**
+* Keys admissible as the `unwrappingKey` argument of {@link unwrapKey}.
+* The private-side counterpart of {@link WrappingKeyFor} — symmetric branches
+* are identical; asymmetric branches use the `_Private` variants.
+*/
+type UnwrappingKeyFor<A extends KeyManagementAlgorithm> = A extends JWK_RSA_ENC ? CryptoKey | JWK_RSA_Private<A> : A extends JWK_ECDH_ES ? CryptoKey | JWK_EC_Private<A> | JWK_OKP_Private<A> : A extends JWK_PBES2 ? string | Uint8Array<ArrayBuffer> | JWK_oct<A> : A extends JWK_AES_KW ? CryptoKey | JWK_oct<A> : A extends JWK_AES_GCM_KW ? CryptoKey | JWK_oct<A | `A${"128" | "192" | "256"}GCM`> : A extends "dir" ? CryptoKey | JWK_oct | Uint8Array<ArrayBuffer> : never;
 /** Options for the wrapKey function. */
 interface WrapKeyOptions {
   /** Initialization Vector for AES-GCMKW. Generated if not provided. */
@@ -211,8 +218,15 @@ interface UnwrapKeyOptions {
 * Copyright (c) 2018 Filip Skokan.
 * LICENSE: https://github.com/panva/jose/blob/v6.0.10/LICENSE.md
 */
-/** Generic JSON Web Key Parameters. */
-interface JWKParameters {
+/**
+* Generic JSON Web Key Parameters.
+*
+* The `Alg` type parameter constrains the JWK's `alg` field. Each concrete JWK
+* interface below tightens `Alg` to the algorithm family admissible for that key
+* type — e.g. a `JWK_oct<JWK_HMAC>` can only hold `"HS256" | "HS384" | "HS512"`
+* in `alg`.
+*/
+interface JWKParameters<Alg extends string = string> {
   /** JWK "kty" (Key Type) Parameter */
   kty: string;
   /**
@@ -220,7 +234,7 @@ interface JWKParameters {
   *
   * @see {@link https://github.com/panva/jose/issues/210 Algorithm Key Requirements}
   */
-  alg?: string;
+  alg?: Alg;
   /** JWK "key_ops" (Key Operations) Parameter */
   key_ops?: KeyUsage[];
   /** JWK "ext" (Extractable) Parameter */
@@ -245,7 +259,7 @@ interface JWKParameters {
   enc?: ContentEncryptionAlgorithm;
 }
 /** Public EC JSON Web Keys */
-interface JWK_EC_Public extends JWKParameters {
+interface JWK_EC_Public<Alg extends JWK_ECDSA | JWK_ECDH_ES | (string & {}) = string> extends JWKParameters<Alg> {
   /** EC JWK "kty" (Key Type) Parameter */
   kty: "EC";
   /** EC JWK "crv" (Curve) Parameter */
@@ -256,14 +270,14 @@ interface JWK_EC_Public extends JWKParameters {
   y: string;
 }
 /** Private EC JSON Web Keys */
-interface JWK_EC_Private extends JWK_EC_Public {
+interface JWK_EC_Private<Alg extends JWK_ECDSA | JWK_ECDH_ES | (string & {}) = string> extends JWK_EC_Public<Alg> {
   /** EC JWK "d" (ECC Private Key) Parameter */
   d: string;
 }
 /** EC JSON Web Keys */
-type JWK_EC = JWK_EC_Public | JWK_EC_Private;
+type JWK_EC<Alg extends JWK_ECDSA | JWK_ECDH_ES | (string & {}) = string> = JWK_EC_Public<Alg> | JWK_EC_Private<Alg>;
 /** Public RSA JSON Web Keys */
-interface JWK_RSA_Public extends JWKParameters {
+interface JWK_RSA_Public<Alg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC | (string & {}) = string> extends JWKParameters<Alg> {
   /** RSA JWK "kty" (Key Type) Parameter */
   kty: "RSA";
   /** RSA JWK "e" (Exponent) Parameter */
@@ -273,7 +287,7 @@ interface JWK_RSA_Public extends JWKParameters {
   oth?: RsaOtherPrimesInfo[];
 }
 /** Private RSA JSON Web Keys */
-interface JWK_RSA_Private extends JWK_RSA_Public {
+interface JWK_RSA_Private<Alg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC | (string & {}) = string> extends JWK_RSA_Public<Alg> {
   /** RSA JWK "d" (Private Exponent) Parameter */
   d: string;
   /** RSA JWK "dp" (First Factor CRT Exponent) Parameter */
@@ -288,9 +302,9 @@ interface JWK_RSA_Private extends JWK_RSA_Public {
   qi: string;
 }
 /** RSA JSON Web Keys */
-type JWK_RSA = JWK_RSA_Public | JWK_RSA_Private;
+type JWK_RSA<Alg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC | (string & {}) = string> = JWK_RSA_Public<Alg> | JWK_RSA_Private<Alg>;
 /** Public ED JSON Web Keys */
-interface JWK_OKP_Public extends JWKParameters {
+interface JWK_OKP_Public<Alg extends JWK_OKP_SIGN | JWK_ECDH_ES | (string & {}) = string> extends JWKParameters<Alg> {
   /** ED JWK "kty" (Key Type) Parameter */
   kty: "OKP";
   /** ED JWK "crv" (Curve) Parameter */
@@ -299,48 +313,78 @@ interface JWK_OKP_Public extends JWKParameters {
   x: string;
 }
 /** Private ED JSON Web Keys */
-interface JWK_OKP_Private extends JWK_OKP_Public {
+interface JWK_OKP_Private<Alg extends JWK_OKP_SIGN | JWK_ECDH_ES | (string & {}) = string> extends JWK_OKP_Public<Alg> {
   /** ED JWK "d" (Private Key) Parameter */
   d: string;
 }
 /** OKP JSON Web Keys */
-type JWK_OKP = JWK_OKP_Public | JWK_OKP_Private;
+type JWK_OKP<Alg extends JWK_OKP_SIGN | JWK_ECDH_ES | (string & {}) = string> = JWK_OKP_Public<Alg> | JWK_OKP_Private<Alg>;
 /** oct JSON Web Keys */
-interface JWK_oct extends JWKParameters {
+interface JWK_oct<Alg extends JWK_HMAC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_AES_CBC_HMAC | JWK_PBES2 | "dir" | (string & {}) = string> extends JWKParameters<Alg> {
   /** Oct JWK "k" (Key Value) Parameter */
   k: string;
 }
 /** Symmetric JSON Web Keys */
-type JWK_Symmetric = JWK_oct;
+type JWK_Symmetric<Alg extends JWK_HMAC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_AES_CBC_HMAC | JWK_PBES2 | "dir" | (string & {}) = string> = JWK_oct<Alg>;
 /** Asymmetric JSON Web Keys */
-type JWK_Asymmetric = JWK_RSA | JWK_EC | JWK_OKP;
+type JWK_Asymmetric<Alg extends string = string> = JWK_RSA<Alg> | JWK_EC<Alg> | JWK_OKP<Alg>;
 /** Public JSON Web Keys */
-type JWK_Public = JWK_RSA_Public | JWK_EC_Public | JWK_OKP_Public;
+type JWK_Public<Alg extends string = string> = JWK_RSA_Public<Alg> | JWK_EC_Public<Alg> | JWK_OKP_Public<Alg>;
 /** Private JSON Web Keys */
-type JWK_Private = JWK_RSA_Private | JWK_EC_Private | JWK_OKP_Private;
+type JWK_Private<Alg extends string = string> = JWK_RSA_Private<Alg> | JWK_EC_Private<Alg> | JWK_OKP_Private<Alg>;
 /**
 * JSON Web Key ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK}). "RSA", "EC", "OKP" and "oct" key types are supported.
 */
-type JWK = JWK_oct | JWK_RSA | JWK_EC | JWK_OKP;
+type JWK<Alg extends string = string> = JWK_oct<Alg> | JWK_RSA<Alg> | JWK_EC<Alg> | JWK_OKP<Alg>;
 /**
-* A pair of public and private JSON Web Keys.
+* A pair of public and private JSON Web Keys, narrowed by `Alg` when that
+* uniquely identifies the key family:
+*
+* - `JWK_Pair<"RS256">` → RSA pair only
+* - `JWK_Pair<"ES256">` → EC pair only
+* - `JWK_Pair<"ECDH-ES+A256KW">` → EC pair **or** OKP pair (curve decides at runtime)
+* - `JWK_Pair<"Ed25519">` / `JWK_Pair<"EdDSA">` → OKP pair only
+*
+* The final branch is a generic fallback (`Alg = string`, or any custom /
+* forward-compat algorithm that doesn't match a known family) — it yields
+* the permissive three-branch union.
 */
-type JWK_Pair = {
-  publicKey: JWK_RSA_Public;
-  privateKey: JWK_RSA_Private;
+type JWK_Pair<Alg extends string = string> = Alg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC ? {
+  publicKey: JWK_RSA_Public<Alg>;
+  privateKey: JWK_RSA_Private<Alg>;
+} : Alg extends JWK_ECDSA ? {
+  publicKey: JWK_EC_Public<Alg>;
+  privateKey: JWK_EC_Private<Alg>;
+} : Alg extends JWK_ECDH_ES ? {
+  publicKey: JWK_EC_Public<Alg>;
+  privateKey: JWK_EC_Private<Alg>;
 } | {
-  publicKey: JWK_EC_Public;
-  privateKey: JWK_EC_Private;
+  publicKey: JWK_OKP_Public<Alg>;
+  privateKey: JWK_OKP_Private<Alg>;
+} : Alg extends JWK_OKP_SIGN ? {
+  publicKey: JWK_OKP_Public<Alg>;
+  privateKey: JWK_OKP_Private<Alg>;
+} : {
+  publicKey: JWK_RSA_Public<Alg>;
+  privateKey: JWK_RSA_Private<Alg>;
+} | {
+  publicKey: JWK_EC_Public<Alg>;
+  privateKey: JWK_EC_Private<Alg>;
 } | {
-  publicKey: JWK_OKP_Public;
-  privateKey: JWK_OKP_Private;
+  publicKey: JWK_OKP_Public<Alg>;
+  privateKey: JWK_OKP_Private<Alg>;
 };
 /**
 * JSON Web Key Set ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK Set}). "RSA", "EC" and "oct" key types are supported.
+*
+* The optional `T` generic preserves the precise key tuple when constructed
+* in TS — e.g. `JWKSet<[JWK_oct<"HS256">, JWK_EC_Public<"ES256">]>` — while the
+* default `JWK[]` keeps the permissive behavior expected for JWKS fetched from
+* external sources (runtime trials each candidate).
 */
-interface JWKSet {
+interface JWKSet<T extends readonly JWK[] = JWK[]> {
   /** JWK Set "keys" Parameter */
-  keys: JWK[];
+  keys: T;
   [parameter: string]: unknown;
 }
 /** JWK Key Algorithms */
@@ -512,6 +556,32 @@ declare function isJWTError(error: unknown): error is JWTError;
 type StrictOmit<T, K extends keyof T | (string & {}) | (number & {}) | (symbol & {})> = { [P in keyof T as P extends K ? never : P]: T[P] };
 /** JWS Signing Algorithm Identifier. */
 type JWSAlgorithm = JWK_HMAC | JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_OKP_SIGN;
+/**
+* Asymmetric private JWKs admissible as a signing key. RSA keys carry a
+* signing `alg` (RS* or PS*); EC keys carry an ECDSA alg; OKP keys carry an Ed
+* signing alg.
+*/
+type JWSAsymmetricPrivateJWK = JWK_RSA_Private<JWK_RSA_SIGN | JWK_RSA_PSS> | JWK_EC_Private<JWK_ECDSA> | JWK_OKP_Private<JWK_OKP_SIGN>;
+/**
+* Asymmetric public JWKs admissible as a verification key. RSA keys carry a
+* signing `alg` (RS* or PS*); EC keys carry an ECDSA alg; OKP keys carry an Ed
+* signing alg.
+*/
+type JWSAsymmetricPublicJWK = JWK_RSA_Public<JWK_RSA_SIGN | JWK_RSA_PSS> | JWK_EC_Public<JWK_ECDSA> | JWK_OKP_Public<JWK_OKP_SIGN>;
+/**
+* JWKs admissible as the `key` argument of {@link sign}. HMAC oct keys carry a
+* {@link JWK_HMAC} alg; asymmetric private keys carry their family's signing alg.
+* A JWK whose `alg` points at a non-signing family (e.g. `"RSA-OAEP"`) is
+* rejected at the type level.
+*/
+type JWSSignJWK = JWK_oct<JWK_HMAC> | JWSAsymmetricPrivateJWK;
+/**
+* JWKs admissible as a `key` for {@link verify}. HMAC oct keys carry a
+* {@link JWK_HMAC} alg; asymmetric public keys carry their family's signing alg.
+* A JWK whose `alg` points at a non-signing family (e.g. `"RSA-OAEP"`) is
+* rejected at the type level.
+*/
+type JWSVerifyJWK = JWK_oct<JWK_HMAC> | JWSAsymmetricPublicJWK;
 /** Recognized JWS Header Parameters, any other Header Members may also be present. */
 interface JWSHeaderParameters extends JoseHeaderParameters {
   /** JWS "alg" (Algorithm) Header Parameter */
@@ -635,7 +705,7 @@ type JWSGeneralSignature = Pick<JWSFlattenedSerialization, "protected" | "header
 */
 interface JWSMultiSigner {
   /** Signing key (JWK-first; `alg` inferred from `key.alg`). */
-  key: JWK;
+  key: JWSSignJWK;
   /**
   * Extra per-signer JWS Protected Header parameters (RFC 7515 §7.2.1).
   * `alg` is always derived from the JWK and cannot be set here. `b64`
@@ -710,6 +780,33 @@ type JWSMultiVerifyOutcome<T extends JOSEPayload = JOSEPayload> = {
   protectedHeader?: JWSProtectedHeader;
   signerHeader?: JWSHeaderParameters;
 };
+/**
+* Algorithms admissible on an `oct` JWK used for JWE key management. Mirrors
+* the runtime aliasing table in `jweAlgsFromOctJWK` — HMAC algs intentionally
+* excluded (they don't resolve to any JWE `alg`).
+*/
+type _JWEOctAlg = JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_AES_CBC_HMAC | JWK_PBES2 | "dir";
+/**
+* Asymmetric public JWKs admissible for JWE encryption. RSA keys carry an
+* RSA-OAEP alg; EC/OKP keys carry an ECDH-ES alg.
+*/
+type JWEAsymmetricPublicJWK = JWK_RSA_Public<JWK_RSA_ENC> | JWK_EC_Public<JWK_ECDH_ES> | JWK_OKP_Public<JWK_ECDH_ES>;
+/**
+* Asymmetric private JWKs admissible for JWE decryption. RSA keys carry an
+* RSA-OAEP alg; EC/OKP keys carry an ECDH-ES alg.
+*/
+type JWEAsymmetricPrivateJWK = JWK_RSA_Private<JWK_RSA_ENC> | JWK_EC_Private<JWK_ECDH_ES> | JWK_OKP_Private<JWK_ECDH_ES>;
+/**
+* JWKs admissible as the `key` argument of {@link encrypt}. A JWK whose `alg`
+* points at a non-JWE family (e.g. `"HS256"`, `"RS256"`) is rejected at the
+* type level.
+*/
+type JWEEncryptJWK = JWK_oct<_JWEOctAlg> | JWEAsymmetricPublicJWK;
+/**
+* JWKs admissible as a `key` for {@link decrypt}. A JWK whose `alg` points at
+* a non-JWE family (e.g. `"HS256"`, `"RS256"`) is rejected at the type level.
+*/
+type JWEDecryptJWK = JWK_oct<_JWEOctAlg> | JWEAsymmetricPrivateJWK;
 /** Recognized JWE Header Parameters, any other Header Members may also be present. */
 interface JWEHeaderParameters extends JoseHeaderParameters {
   /**
@@ -946,7 +1043,7 @@ interface JWEGeneralRecipient {
 */
 interface JWEMultiRecipient {
   /** Recipient key (JWK-first; `alg` inferred if absent from JWK). */
-  key: JWK;
+  key: JWEEncryptJWK;
   /**
   * Extra per-recipient JWE Unprotected Header parameters (RFC 7516 §7.2.1).
   * Excludes fields the library writes automatically: `alg`, `enc`, `iv`,
@@ -1019,4 +1116,4 @@ type ExpiresIn = Duration;
 type NotBeforeIn = Duration;
 /** Duration for `maxTokenAge` validation on {@link verify} / {@link decrypt}. */
 type MaxTokenAge = Duration;
-export { JWKAlgorithm as $, JWSSignOptions as A, JWK_RSA_Public as At, JWTClaimValidationOptions as B, JWSMultiSignOptions as C, JWK_Pair as Ct, JWSMultiVerifyOutcome as D, JWK_RSA_ENC as Dt, JWSMultiVerifyOptions as E, JWK_RSA as Et, JWTErrorCauseMap as F, KeyManagementAlgorithm as Ft, DeriveKeyOptions as G, JoseHeaderParameters as H, JWTErrorCode as I, UnwrapKeyOptions as It, GenerateJWKReturn as J, DeriveKeyReturn as K, isJWTError as L, WrapKeyOptions as Lt, JWSVerifyResult as M, JWK_Symmetric as Mt, StrictOmit as N, JWK_Symmetric_Algorithm as Nt, JWSMultiVerifyResult as O, JWK_RSA_PSS as Ot, JWTError as P, JWK_oct as Pt, JWK as Q, JOSEPayload as R, WrapKeyResult as Rt, JWSHeaderParameters as S, JWK_PBES2 as St, JWSMultiVerifyAllOptions as T, JWK_Public as Tt, CompositeKey as U, JWTClaims as V, ContentEncryptionAlgorithm as W, GenerateKeyOptions as X, GenerateKeyAlgorithm as Y, GenerateKeyReturn as Z, JWEProtectedHeader as _, JWK_HMAC as _t, JWEDecryptOptions as a, JWKSet as at, JWSGeneralSerialization as b, JWK_OKP_Public as bt, JWEFlattenedSerialization as c, JWK_AES_GCM_KW as ct, JWEHeaderParameters as d, JWK_Asymmetric_Algorithm as dt, JWKCacheAdapter as et, JWEKeyManagementHeaderParameters as f, JWK_EC as ft, JWEMultiRecipient as g, JWK_EC_Public as gt, JWEMultiEncryptOptions as h, JWK_EC_Private as ht, NotBeforeIn as i, JWKParameters as it, JWSVerifyOptions as j, JWK_RSA_SIGN as jt, JWSProtectedHeader as k, JWK_RSA_Private as kt, JWEGeneralRecipient as l, JWK_AES_KW as lt, JWEMultiDecryptResult as m, JWK_ECDSA as mt, ExpiresIn as n, JWKLookupFunctionHeader as nt, JWEDecryptResult as o, JWK_AES_CBC_HMAC as ot, JWEMultiDecryptOptions as p, JWK_ECDH_ES as pt, GenerateJWKOptions as q, MaxTokenAge as r, JWKPEMAlgorithm as rt, JWEEncryptOptions as s, JWK_AES_GCM as st, Duration as t, JWKLookupFunction as tt, JWEGeneralSerialization as u, JWK_Asymmetric as ut, JWSAlgorithm as v, JWK_OKP as vt, JWSMultiSigner as w, JWK_Private as wt, JWSGeneralSignature as x, JWK_OKP_SIGN as xt, JWSFlattenedSerialization as y, JWK_OKP_Private as yt, JWT as z };
+export { DeriveKeyOptions as $, JWSMultiSigner as A, JWK_PBES2 as At, JWSVerifyResult as B, JWK_Symmetric as Bt, JWSAsymmetricPrivateJWK as C, JWK_EC_Private as Ct, JWSGeneralSignature as D, JWK_OKP_Private as Dt, JWSGeneralSerialization as E, JWK_OKP as Et, JWSProtectedHeader as F, JWK_RSA_ENC as Ft, isJWTError as G, UnwrappingKeyFor as Gt, JWTError as H, JWK_oct as Ht, JWSSignJWK as I, JWK_RSA_PSS as It, JWTClaimValidationOptions as J, WrappingKeyFor as Jt, JOSEPayload as K, WrapKeyOptions as Kt, JWSSignOptions as L, JWK_RSA_Private as Lt, JWSMultiVerifyOptions as M, JWK_Private as Mt, JWSMultiVerifyOutcome as N, JWK_Public as Nt, JWSHeaderParameters as O, JWK_OKP_Public as Ot, JWSMultiVerifyResult as P, JWK_RSA as Pt, ContentEncryptionAlgorithm as Q, JWSVerifyJWK as R, JWK_RSA_Public as Rt, JWSAlgorithm as S, JWK_ECDSA as St, JWSFlattenedSerialization as T, JWK_HMAC as Tt, JWTErrorCauseMap as U, KeyManagementAlgorithm as Ut, StrictOmit as V, JWK_Symmetric_Algorithm as Vt, JWTErrorCode as W, UnwrapKeyOptions as Wt, JoseHeaderParameters as X, JWTClaims as Y, CompositeKey as Z, JWEMultiDecryptOptions as _, JWK_AES_KW as _t, JWEAsymmetricPrivateJWK as a, GenerateKeyReturn as at, JWEMultiRecipient as b, JWK_EC as bt, JWEDecryptOptions as c, JWKCacheAdapter as ct, JWEEncryptOptions as d, JWKPEMAlgorithm as dt, DeriveKeyReturn as et, JWEFlattenedSerialization as f, JWKParameters as ft, JWEKeyManagementHeaderParameters as g, JWK_AES_GCM_KW as gt, JWEHeaderParameters as h, JWK_AES_GCM as ht, NotBeforeIn as i, GenerateKeyOptions as it, JWSMultiVerifyAllOptions as j, JWK_Pair as jt, JWSMultiSignOptions as k, JWK_OKP_SIGN as kt, JWEDecryptResult as l, JWKLookupFunction as lt, JWEGeneralSerialization as m, JWK_AES_CBC_HMAC as mt, ExpiresIn as n, GenerateJWKReturn as nt, JWEAsymmetricPublicJWK as o, JWK as ot, JWEGeneralRecipient as p, JWKSet as pt, JWT as q, WrapKeyResult as qt, MaxTokenAge as r, GenerateKeyAlgorithm as rt, JWEDecryptJWK as s, JWKAlgorithm as st, Duration as t, GenerateJWKOptions as tt, JWEEncryptJWK as u, JWKLookupFunctionHeader as ut, JWEMultiDecryptResult as v, JWK_Asymmetric as vt, JWSAsymmetricPublicJWK as w, JWK_EC_Public as wt, JWEProtectedHeader as x, JWK_ECDH_ES as xt, JWEMultiEncryptOptions as y, JWK_Asymmetric_Algorithm as yt, JWSVerifyOptions as z, JWK_RSA_SIGN as zt };

package/dist/_chunks/jwe.d.mts

@@ -1,4 +1,4 @@
-import { Ft as KeyManagementAlgorithm, Mt as JWK_Symmetric, Q as JWK, R as JOSEPayload, W as ContentEncryptionAlgorithm, a as JWEDecryptOptions, at as JWKSet, c as JWEFlattenedSerialization, g as JWEMultiRecipient, h as JWEMultiEncryptOptions, m as JWEMultiDecryptResult, o as JWEDecryptResult, p as JWEMultiDecryptOptions, s as JWEEncryptOptions, tt as JWKLookupFunction, u as JWEGeneralSerialization, wt as JWK_Private } from "./index.mjs";
+import { K as JOSEPayload, Q as ContentEncryptionAlgorithm, Ut as KeyManagementAlgorithm, _ as JWEMultiDecryptOptions, b as JWEMultiRecipient, c as JWEDecryptOptions, d as JWEEncryptOptions, f as JWEFlattenedSerialization, l as JWEDecryptResult, lt as JWKLookupFunction, m as JWEGeneralSerialization, pt as JWKSet, s as JWEDecryptJWK, u as JWEEncryptJWK, v as JWEMultiDecryptResult, y as JWEMultiEncryptOptions } from "./index.mjs";
 /**
 * Encrypt a payload to multiple recipients using JWE General JSON Serialization
 * (RFC 7516 §7.2.1).
@@ -29,7 +29,7 @@ declare function encryptMulti(payload: JOSEPayload, recipients: JWEMultiRecipien
 *
 * For compact (string) tokens, use {@link decrypt}.
 */
-declare function decryptMulti<T extends JOSEPayload = JOSEPayload>(jwe: JWEGeneralSerialization | JWEFlattenedSerialization, keyOrLookup: CryptoKey | JWKSet | JWK_Private | JWK_Symmetric | string | Uint8Array<ArrayBuffer> | JWKLookupFunction, options?: JWEMultiDecryptOptions): Promise<JWEMultiDecryptResult<T>>;
+declare function decryptMulti<T extends JOSEPayload = JOSEPayload>(jwe: JWEGeneralSerialization | JWEFlattenedSerialization, keyOrLookup: CryptoKey | JWKSet | JWEDecryptJWK | string | Uint8Array<ArrayBuffer> | JWKLookupFunction, options?: JWEMultiDecryptOptions): Promise<JWEMultiDecryptResult<T>>;
 /**
 * Convert a {@link JWEGeneralSerialization} with exactly one recipient into
 * the {@link JWEFlattenedSerialization} form (RFC 7516 §7.2.2). Throws
@@ -53,8 +53,10 @@ declare function generalToFlattened(jwe: JWEGeneralSerialization): JWEFlattenedS
 * @param options JWE encryption options, including `alg` (key management algorithm) and `enc` (content encryption algorithm).
 * @returns A Promise resolving to the JWE Compact Serialization string.
 */
-declare function encrypt(payload: JOSEPayload, key: JWK | string | Uint8Array<ArrayBuffer>, options?: JWEEncryptOptions): Promise<string>;
-declare function encrypt(payload: JOSEPayload, key: CryptoKey | JWK_Symmetric | Uint8Array<ArrayBuffer>, options: JWEEncryptOptions & {
+declare function encrypt(payload: JOSEPayload, key: JWEEncryptJWK | string | Uint8Array<ArrayBuffer>, options?: JWEEncryptOptions): Promise<string>;
+declare function encrypt(payload: JOSEPayload, key: CryptoKey | Extract<JWEEncryptJWK, {
+  kty: "oct";
+}> | Uint8Array<ArrayBuffer>, options: JWEEncryptOptions & {
   alg: "dir";
   enc: ContentEncryptionAlgorithm;
 }): Promise<string>;
@@ -62,7 +64,7 @@ declare function encrypt(payload: JOSEPayload, key: CryptoKey, options: JWEEncry
   alg: KeyManagementAlgorithm;
   enc: ContentEncryptionAlgorithm;
 }): Promise<string>;
-declare function encrypt(payload: JOSEPayload, key: CryptoKey | JWK | string | Uint8Array<ArrayBuffer>, options: JWEEncryptOptions & {
+declare function encrypt(payload: JOSEPayload, key: CryptoKey | JWEEncryptJWK | string | Uint8Array<ArrayBuffer>, options: JWEEncryptOptions & {
   alg: KeyManagementAlgorithm;
   enc: ContentEncryptionAlgorithm;
 }): Promise<string>;
@@ -75,8 +77,8 @@ declare function encrypt(payload: JOSEPayload, key: CryptoKey | JWK | string | U
 * @returns A Promise resolving to an object containing the decrypted plaintext, protected header, CEK, and AAD.
 * @throws If JWE is invalid, decryption fails, or options are not met.
 */
-declare function decrypt<T extends JOSEPayload>(jwe: string, key: CryptoKey | JWKSet | JWK_Private | JWK_Symmetric | string | Uint8Array<ArrayBuffer> | JWKLookupFunction, options?: JWEDecryptOptions): Promise<JWEDecryptResult<T>>;
-declare function decrypt(jwe: string, key: CryptoKey | JWKSet | JWK_Private | JWK_Symmetric | string | Uint8Array<ArrayBuffer> | JWKLookupFunction, options: JWEDecryptOptions & {
+declare function decrypt<T extends JOSEPayload>(jwe: string, key: CryptoKey | JWKSet | JWEDecryptJWK | string | Uint8Array<ArrayBuffer> | JWKLookupFunction, options?: JWEDecryptOptions): Promise<JWEDecryptResult<T>>;
+declare function decrypt(jwe: string, key: CryptoKey | JWKSet | JWEDecryptJWK | string | Uint8Array<ArrayBuffer> | JWKLookupFunction, options: JWEDecryptOptions & {
   forceUint8Array: true;
 }): Promise<JWEDecryptResult<Uint8Array<ArrayBuffer>>>;
 export { generalToFlattened as a, encryptMulti as i, encrypt as n, decryptMulti as r, decrypt as t };

package/dist/_chunks/jws.d.mts

@@ -1,4 +1,4 @@
-import { A as JWSSignOptions, C as JWSMultiSignOptions, D as JWSMultiVerifyOutcome, E as JWSMultiVerifyOptions, M as JWSVerifyResult, Mt as JWK_Symmetric, O as JWSMultiVerifyResult, R as JOSEPayload, T as JWSMultiVerifyAllOptions, Tt as JWK_Public, at as JWKSet, b as JWSGeneralSerialization, j as JWSVerifyOptions, tt as JWKLookupFunction, v as JWSAlgorithm, w as JWSMultiSigner, wt as JWK_Private, y as JWSFlattenedSerialization } from "./index.mjs";
+import { A as JWSMultiSigner, B as JWSVerifyResult, E as JWSGeneralSerialization, I as JWSSignJWK, K as JOSEPayload, L as JWSSignOptions, M as JWSMultiVerifyOptions, N as JWSMultiVerifyOutcome, P as JWSMultiVerifyResult, R as JWSVerifyJWK, S as JWSAlgorithm, T as JWSFlattenedSerialization, j as JWSMultiVerifyAllOptions, k as JWSMultiSignOptions, lt as JWKLookupFunction, pt as JWKSet, z as JWSVerifyOptions } from "./index.mjs";
 /**
 * Sign a payload with multiple signers using JWS General JSON Serialization
 * (RFC 7515 §7.2.1).
@@ -30,7 +30,7 @@ declare function signMulti(payload: JOSEPayload, signers: JWSMultiSigner[], opti
 *
 * For compact (string) tokens, use {@link verify}.
 */
-declare function verifyMulti<T extends JOSEPayload = JOSEPayload>(jws: JWSGeneralSerialization | JWSFlattenedSerialization, keyOrLookup: CryptoKey | JWKSet | JWK_Public | JWK_Symmetric | Uint8Array<ArrayBuffer> | JWKLookupFunction, options?: JWSMultiVerifyOptions): Promise<JWSMultiVerifyResult<T>>;
+declare function verifyMulti<T extends JOSEPayload = JOSEPayload>(jws: JWSGeneralSerialization | JWSFlattenedSerialization, keyOrLookup: CryptoKey | JWKSet | JWSVerifyJWK | Uint8Array<ArrayBuffer> | JWKLookupFunction, options?: JWSMultiVerifyOptions): Promise<JWSMultiVerifyResult<T>>;
 /**
 * Verify every signature in a JWS independently and return a per-signature
 * outcome array — the caller applies their own policy (all-must-verify,
@@ -91,7 +91,7 @@ declare function generalToFlattenedJWS(jws: JWSGeneralSerialization): JWSFlatten
 * @param options Signing options, including the algorithm (`alg`) and protected header parameters.
 * @returns A Promise resolving to the JWS Compact Serialization string.
 */
-declare function sign(payload: JOSEPayload, key: JWK_Symmetric | JWK_Private, options?: JWSSignOptions): Promise<string>;
+declare function sign(payload: JOSEPayload, key: JWSSignJWK, options?: JWSSignOptions): Promise<string>;
 declare function sign(payload: JOSEPayload, key: CryptoKey | Uint8Array<ArrayBuffer>, options: JWSSignOptions & {
   alg: JWSAlgorithm;
 }): Promise<string>;
@@ -104,8 +104,8 @@ declare function sign(payload: JOSEPayload, key: CryptoKey | Uint8Array<ArrayBuf
 * @returns A Promise resolving to an object containing the verified payload and protected header.
 * @throws If the JWS is invalid, signature verification fails, or options are not met.
 */
-declare function verify<T extends JOSEPayload>(jws: string, key: CryptoKey | JWKSet | JWK_Public | JWK_Symmetric | Uint8Array<ArrayBuffer> | JWKLookupFunction, options?: JWSVerifyOptions): Promise<JWSVerifyResult<T>>;
-declare function verify(jws: string, key: CryptoKey | JWKSet | JWK_Public | JWK_Symmetric | Uint8Array<ArrayBuffer> | JWKLookupFunction, options: JWSVerifyOptions & {
+declare function verify<T extends JOSEPayload>(jws: string, key: CryptoKey | JWKSet | JWSVerifyJWK | Uint8Array<ArrayBuffer> | JWKLookupFunction, options?: JWSVerifyOptions): Promise<JWSVerifyResult<T>>;
+declare function verify(jws: string, key: CryptoKey | JWKSet | JWSVerifyJWK | Uint8Array<ArrayBuffer> | JWKLookupFunction, options: JWSVerifyOptions & {
   forceUint8Array: true;
 }): Promise<JWSVerifyResult<Uint8Array<ArrayBuffer>>>;
 export { verifyMulti as a, signMulti as i, verify as n, verifyMultiAll as o, generalToFlattenedJWS as r, sign as t };

package/dist/_chunks/libs/unsecure.d.mts

@@ -61,22 +61,22 @@ declare function sanitizeObjectCopy<T extends Record<string, unknown> | undefine
 * Base64 encoding. Accepts `string` or raw bytes; throws `TypeError` on
 * `null`/`undefined`. Empty strings and empty `Uint8Array` return `""`.
 */
-declare function base64Encode(data: Uint8Array<ArrayBuffer> | string): string;
+declare function base64Encode(data: Uint8Array | string): string;
 /**
 * Base64 URL-safe encoding (no padding). Accepts `string` or raw bytes;
 * throws `TypeError` on `null`/`undefined`. Empty inputs return `""`.
 */
-declare function base64UrlEncode(data: Uint8Array<ArrayBuffer> | string): string;
-declare function base64Decode<T extends DecodeReturnAs>(data: string | Uint8Array<ArrayBuffer>, options: {
+declare function base64UrlEncode(data: Uint8Array | string): string;
+declare function base64Decode<T extends DecodeReturnAs>(data: string | Uint8Array, options: {
   returnAs: T;
 }): T extends "string" ? string : Uint8Array<ArrayBuffer>;
 declare function base64Decode(data: string): string;
-declare function base64Decode(data: Uint8Array<ArrayBuffer>): Uint8Array<ArrayBuffer>;
-declare function base64UrlDecode<T extends DecodeReturnAs>(data: string | Uint8Array<ArrayBuffer>, options: {
+declare function base64Decode(data: Uint8Array): Uint8Array<ArrayBuffer>;
+declare function base64UrlDecode<T extends DecodeReturnAs>(data: string | Uint8Array, options: {
   returnAs: T;
 }): T extends "string" ? string : Uint8Array<ArrayBuffer>;
 declare function base64UrlDecode(data: string): string;
-declare function base64UrlDecode(data: Uint8Array<ArrayBuffer>): Uint8Array<ArrayBuffer>;
+declare function base64UrlDecode(data: Uint8Array): Uint8Array<ArrayBuffer>;
 /**
 * Hex encoding. Accepts `string` or raw bytes; throws `TypeError` on
 * `null`/`undefined`. Empty strings and empty `Uint8Array` return `""`.

package/dist/_chunks/libs/unsecure.mjs

@@ -82,19 +82,24 @@ const _b64UrlEncOpts = /* @__PURE__ */ Object.freeze({
 	omitPadding: true
 });
 const _b64UrlDecOpts = /* @__PURE__ */ Object.freeze({ alphabet: "base64url" });
+function _bytesToBase64Fallback(bytes) {
+	let binary = "";
+	for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+	return btoa(binary);
+}
 function base64Encode(data) {
 	if (data == null) throw new TypeError("base64Encode: data must be a string or Uint8Array.");
 	if (_hasBuffer) return _toBuffer(data).toString("base64");
 	const encodedData = data instanceof Uint8Array ? data : textEncoder.encode(data);
 	if (_hasToBase64) return encodedData.toBase64();
-	return btoa(String.fromCodePoint(...encodedData));
+	return _bytesToBase64Fallback(encodedData);
 }
 function base64UrlEncode(data) {
 	if (data == null) throw new TypeError("base64UrlEncode: data must be a string or Uint8Array.");
 	if (_hasBuffer) return _toBuffer(data).toString("base64url");
 	const encodedData = data instanceof Uint8Array ? data : textEncoder.encode(data);
 	if (_hasToBase64) return encodedData.toBase64(_b64UrlEncOpts);
-	return btoa(String.fromCodePoint(...encodedData)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+	return _bytesToBase64Fallback(encodedData).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
 }
 function base64Decode(data, options) {
 	if (data == null) throw new TypeError("base64Decode: data must be a string or Uint8Array.");
@@ -104,7 +109,7 @@ function base64Decode(data, options) {
 	if (!str) return decodeToString ? "" : new Uint8Array(0);
 	if (_hasBuffer) {
 		const buf = _Buffer.from(str, "base64");
-		return decodeToString ? buf.toString("utf8") : new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+		return decodeToString ? buf.toString("utf8") : new Uint8Array(buf);
 	}
 	const decoded = _hasFromBase64 ? Uint8Array.fromBase64(str) : Uint8Array.from(atob(str), (b) => b.codePointAt(0));
 	return decodeToString ? textDecoder.decode(decoded) : decoded;
@@ -117,7 +122,7 @@ function base64UrlDecode(data, options) {
 	if (!str) return decodeToString ? "" : new Uint8Array(0);
 	if (_hasBuffer) {
 		const buf = _Buffer.from(str, "base64url");
-		return decodeToString ? buf.toString("utf8") : new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+		return decodeToString ? buf.toString("utf8") : new Uint8Array(buf);
 	}
 	let decoded;
 	if (_hasFromBase64) decoded = Uint8Array.fromBase64(str, _b64UrlDecOpts);

package/dist/adapters/h3v1/index.d.mts

@@ -1,4 +1,4 @@
-import { $ as JWKAlgorithm, A as JWSSignOptions, At as JWK_RSA_Public, B as JWTClaimValidationOptions, C as JWSMultiSignOptions, Ct as JWK_Pair, D as JWSMultiVerifyOutcome, Dt as JWK_RSA_ENC, E as JWSMultiVerifyOptions, Et as JWK_RSA, Ft as KeyManagementAlgorithm, G as DeriveKeyOptions, H as JoseHeaderParameters, It as UnwrapKeyOptions, J as GenerateJWKReturn, K as DeriveKeyReturn, Lt as WrapKeyOptions, M as JWSVerifyResult, Mt as JWK_Symmetric, N as StrictOmit, Nt as JWK_Symmetric_Algorithm, O as JWSMultiVerifyResult, Ot as JWK_RSA_PSS, Pt as JWK_oct, Q as JWK, R as JOSEPayload, Rt as WrapKeyResult, S as JWSHeaderParameters, St as JWK_PBES2, T as JWSMultiVerifyAllOptions, Tt as JWK_Public, U as CompositeKey, V as JWTClaims, W as ContentEncryptionAlgorithm, X as GenerateKeyOptions, Y as GenerateKeyAlgorithm, Z as GenerateKeyReturn, _ as JWEProtectedHeader, _t as JWK_HMAC, a as JWEDecryptOptions, at as JWKSet, b as JWSGeneralSerialization, bt as JWK_OKP_Public, c as JWEFlattenedSerialization, ct as JWK_AES_GCM_KW, d as JWEHeaderParameters, dt as JWK_Asymmetric_Algorithm, et as JWKCacheAdapter, f as JWEKeyManagementHeaderParameters, ft as JWK_EC, g as JWEMultiRecipient, gt as JWK_EC_Public, h as JWEMultiEncryptOptions, ht as JWK_EC_Private, i as NotBeforeIn, it as JWKParameters, j as JWSVerifyOptions, jt as JWK_RSA_SIGN, k as JWSProtectedHeader, kt as JWK_RSA_Private, l as JWEGeneralRecipient, lt as JWK_AES_KW, m as JWEMultiDecryptResult, mt as JWK_ECDSA, n as ExpiresIn, nt as JWKLookupFunctionHeader, o as JWEDecryptResult, ot as JWK_AES_CBC_HMAC, p as JWEMultiDecryptOptions, pt as JWK_ECDH_ES, q as GenerateJWKOptions, r as MaxTokenAge, rt as JWKPEMAlgorithm, s as JWEEncryptOptions, st as JWK_AES_GCM, t as Duration, tt as JWKLookupFunction, u as JWEGeneralSerialization, ut as JWK_Asymmetric, v as JWSAlgorithm, vt as JWK_OKP, w as JWSMultiSigner, wt as JWK_Private, x as JWSGeneralSignature, xt as JWK_OKP_SIGN, y as JWSFlattenedSerialization, yt as JWK_OKP_Private, z as JWT } from "../../_chunks/index.mjs";
+import { $ as DeriveKeyOptions, A as JWSMultiSigner, At as JWK_PBES2, B as JWSVerifyResult, Bt as JWK_Symmetric, C as JWSAsymmetricPrivateJWK, Ct as JWK_EC_Private, D as JWSGeneralSignature, Dt as JWK_OKP_Private, E as JWSGeneralSerialization, Et as JWK_OKP, F as JWSProtectedHeader, Ft as JWK_RSA_ENC, Gt as UnwrappingKeyFor, Ht as JWK_oct, I as JWSSignJWK, It as JWK_RSA_PSS, J as JWTClaimValidationOptions, Jt as WrappingKeyFor, K as JOSEPayload, Kt as WrapKeyOptions, L as JWSSignOptions, Lt as JWK_RSA_Private, M as JWSMultiVerifyOptions, Mt as JWK_Private, N as JWSMultiVerifyOutcome, Nt as JWK_Public, O as JWSHeaderParameters, Ot as JWK_OKP_Public, P as JWSMultiVerifyResult, Pt as JWK_RSA, Q as ContentEncryptionAlgorithm, R as JWSVerifyJWK, Rt as JWK_RSA_Public, S as JWSAlgorithm, St as JWK_ECDSA, T as JWSFlattenedSerialization, Tt as JWK_HMAC, Ut as KeyManagementAlgorithm, V as StrictOmit, Vt as JWK_Symmetric_Algorithm, Wt as UnwrapKeyOptions, X as JoseHeaderParameters, Y as JWTClaims, Z as CompositeKey, _ as JWEMultiDecryptOptions, _t as JWK_AES_KW, a as JWEAsymmetricPrivateJWK, at as GenerateKeyReturn, b as JWEMultiRecipient, bt as JWK_EC, c as JWEDecryptOptions, ct as JWKCacheAdapter, d as JWEEncryptOptions, dt as JWKPEMAlgorithm, et as DeriveKeyReturn, f as JWEFlattenedSerialization, ft as JWKParameters, g as JWEKeyManagementHeaderParameters, gt as JWK_AES_GCM_KW, h as JWEHeaderParameters, ht as JWK_AES_GCM, i as NotBeforeIn, it as GenerateKeyOptions, j as JWSMultiVerifyAllOptions, jt as JWK_Pair, k as JWSMultiSignOptions, kt as JWK_OKP_SIGN, l as JWEDecryptResult, lt as JWKLookupFunction, m as JWEGeneralSerialization, mt as JWK_AES_CBC_HMAC, n as ExpiresIn, nt as GenerateJWKReturn, o as JWEAsymmetricPublicJWK, ot as JWK, p as JWEGeneralRecipient, pt as JWKSet, q as JWT, qt as WrapKeyResult, r as MaxTokenAge, rt as GenerateKeyAlgorithm, s as JWEDecryptJWK, st as JWKAlgorithm, t as Duration, tt as GenerateJWKOptions, u as JWEEncryptJWK, ut as JWKLookupFunctionHeader, v as JWEMultiDecryptResult, vt as JWK_Asymmetric, w as JWSAsymmetricPublicJWK, wt as JWK_EC_Public, x as JWEProtectedHeader, xt as JWK_ECDH_ES, y as JWEMultiEncryptOptions, yt as JWK_Asymmetric_Algorithm, z as JWSVerifyOptions, zt as JWK_RSA_SIGN } from "../../_chunks/index.mjs";
 import { deriveJWKFromPassword, exportPEM, exportToPEM, generateJWK, importFromPEM, importPEM } from "../../core/jwk.mjs";
 import { H3Event } from "h3";
 import { CookieSerializeOptions } from "cookie-es";
@@ -80,13 +80,13 @@ interface SessionHooksJWE<T extends Record<string, any> = SessionClaims, MaxAge
     header: JWEHeaderParameters;
     event: TEvent;
     config: SessionConfigJWE<T, MaxAge, TEvent>;
-  }) => JWK_Symmetric | JWK_Private | Promise<JWK_Symmetric | JWK_Private>;
+  }) => JWEDecryptJWK | Promise<JWEDecryptJWK>;
 }
 interface SessionConfigJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent$1 | H3Event = CompatEvent$1 | H3Event> {
   /** Shared key used, string for PBES2 or Json Web Key (JWK) */
-  key: string | JWK_Symmetric | JWK_Private | {
-    privateKey: JWK_Private | JWK_Symmetric;
-    publicKey?: JWK_Public;
+  key: string | JWEEncryptJWK | {
+    privateKey: JWEAsymmetricPrivateJWK;
+    publicKey?: JWEAsymmetricPublicJWK;
   };
   /** Session lifetime in seconds (used to derive exp from iat) */
   maxAge?: MaxAge;
@@ -208,15 +208,15 @@ interface SessionHooksJWS<T extends Record<string, any> = SessionClaims, MaxAge
     header: JWKLookupFunctionHeader;
     event: TEvent;
     config: SessionConfigJWS<T, MaxAge, TEvent>;
-  }) => JWKSet | JWK_Symmetric | JWK_Public | Promise<JWKSet | JWK_Symmetric | JWK_Public>;
+  }) => JWKSet | JWSVerifyJWK | Promise<JWKSet | JWSVerifyJWK>;
 }
 interface SessionConfigJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent | H3Event = CompatEvent | H3Event> {
   /**
   * JWK (private for signing with RS/ES/PS, or symmetric oct) used for signing.
   */
-  key: JWK_Symmetric | {
-    privateKey: JWK_Private;
-    publicKey: JWK_Public | JWK_Public[] | JWKSet;
+  key: JWK_oct<JWK_HMAC> | {
+    privateKey: JWSAsymmetricPrivateJWK;
+    publicKey: JWSAsymmetricPublicJWK | JWSAsymmetricPublicJWK[] | JWKSet;
   };
   /** Session lifetime in seconds (sets exp = iat + maxAge) */
   maxAge?: MaxAge;
@@ -279,4 +279,4 @@ declare function verifyJWSSession<T extends Record<string, any> = SessionClaims,
 * Destroy the session (context + cookie).
 */
 declare function clearJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent | H3Event = CompatEvent | H3Event>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>): Promise<void>;
-export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, Duration, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JOSEPayload, JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHeaderParameters, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignOptions, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JoseHeaderParameters, KeyManagementAlgorithm, MaxTokenAge, NotBeforeIn, type SessionClaims, type SessionConfigJWE, type SessionConfigJWS, type SessionData, type SessionHooksJWE, type SessionHooksJWS, type SessionJWE, type SessionJWS, type SessionManager, type SessionUpdate, UnwrapKeyOptions, WrapKeyOptions, WrapKeyResult, clearJWESession, clearJWSSession, deriveJWKFromPassword, exportPEM, exportToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importFromPEM, importPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, Duration, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JOSEPayload, JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHeaderParameters, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JoseHeaderParameters, KeyManagementAlgorithm, MaxTokenAge, NotBeforeIn, type SessionClaims, type SessionConfigJWE, type SessionConfigJWS, type SessionData, type SessionHooksJWE, type SessionHooksJWS, type SessionJWE, type SessionJWS, type SessionManager, type SessionUpdate, UnwrapKeyOptions, UnwrappingKeyFor, WrapKeyOptions, WrapKeyResult, WrappingKeyFor, clearJWESession, clearJWSSession, deriveJWKFromPassword, exportPEM, exportToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importFromPEM, importPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };

package/dist/adapters/h3v1/index.mjs

@@ -307,8 +307,8 @@ function getEncryptKey(key) {
 	if (!key) throw new Error("Session: JWE key is required.");
 	let _key;
 	if (typeof key === "string") _key = key;
-	else if (isSymmetricJWK(key) || isPrivateJWK(key)) _key = key;
-	else if ("publicKey" in key && isPublicJWK(key.publicKey)) _key = key.publicKey;
+	else if (isSymmetricJWK(key)) _key = key;
+	else if ("publicKey" in key && key.publicKey && isPublicJWK(key.publicKey)) _key = key.publicKey;
 	else if ("privateKey" in key && isPrivateJWK(key.privateKey)) _key = key.privateKey;
 	if (!_key) throw new Error("Session: Invalid JWE key. It must be a password string or valid JWK.", { cause: key });
 	return _key;