unjwt 0.7.1 → 0.7.2

package/dist/_chunks/_internal.mjs

@@ -1,5 +1,6 @@
-import { D as JWTError, E as inferJWSAllowedAlgorithms, T as inferJWEAllowedAlgorithms, a as isCryptoKeyPair, i as isCryptoKey, o as isJWK, v as decodePayloadFromB64UrlSegment, w as validateJwtClaims } from "./utils.mjs";
-import { c as safeJsonParse, i as base64UrlDecode, s as textEncoder } from "./libs/unsecure.mjs";
+import { JWTError, decodePayloadFromB64UrlSegment, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isCryptoKey, isCryptoKeyPair, isJWK, validateJwtClaims } from "./utils.mjs";
+import { base64UrlDecode, safeJsonParse, textEncoder } from "./libs/unsecure.mjs";
+import { assertOctKeyLength } from "./jwk.mjs";
 function buildJWKSetFilter(header) {
 	const kid = header?.kid;
 	const alg = header?.alg;
@@ -35,8 +36,7 @@ function parseEphemeralKey(ephemeralKey) {
 }
 async function resolveSigningKey(alg, key, usage) {
 	if (key instanceof Uint8Array) {
-		const minBytes = Number.parseInt(alg.slice(2), 10) / 8;
-		if (key.length < minBytes) throw new JWTError(`${alg} requires a key of at least ${minBytes} bytes`, "ERR_JWK_INVALID");
+		assertOctKeyLength(key, alg);
 		return crypto.subtle.importKey("raw", key, {
 			name: "HMAC",
 			hash: `SHA-${alg.slice(-3)}`
@@ -85,4 +85,4 @@ function decodeJWSPayload(payloadSegment, useB64, forceUint8Array) {
 	if (useB64) return decodePayloadFromB64UrlSegment(payloadSegment, forceUint8Array);
 	return forceUint8Array ? textEncoder.encode(payloadSegment) : payloadSegment;
 }
-export { decodeJWSPayload as a, resolveSigningKey as c, checkAlgAllowed as i, validateJwtClaimsIfJsonPayload as l, JWS_ALG_CTX as n, decodeProtectedHeader as o, buildJWKSetFilter as r, parseEphemeralKey as s, JWE_ALG_CTX as t };
+export { JWE_ALG_CTX, JWS_ALG_CTX, buildJWKSetFilter, checkAlgAllowed, decodeJWSPayload, decodeProtectedHeader, parseEphemeralKey, resolveSigningKey, validateJwtClaimsIfJsonPayload };

package/dist/_chunks/index.d.mts

@@ -66,7 +66,12 @@ type GenerateKeyAlgorithm = Exclude<JWKAlgorithm, "none" | "dir" | JWK_PBES2>;
 interface GenerateKeyOptions {
   /** Key usages for the generated key(s). Note: For composite keys (CBC), default usages are applied separately. */
   keyUsage?: KeyUsage[];
-  /** Mark the key(s) as extractable. Defaults to true. */
+  /**
+  * Mark the key(s) as extractable. Defaults to true. Ignored when `toJWK` is set —
+  * the JWK output requires exporting the intermediate key. For long-lived asymmetric
+  * private keys that should never leave the runtime, prefer `false` (and omit `toJWK`):
+  * the key still signs/decrypts but its material cannot be exported.
+  */
   extractable?: boolean;
   /** RSA modulus length. Defaults to 2048. */
   modulusLength?: number;
@@ -84,7 +89,7 @@ interface GenerateKeyOptions {
 type GenerateKeyReturnJWK<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_Asymmetric_Algorithm ? JWK_Pair<TAlg> : TAlg extends JWK_AES_CBC_HMAC | JWK_Symmetric_Algorithm ? JWK_oct<TAlg> : never;
 type GenerateKeyReturnCrypto<TAlg extends GenerateKeyAlgorithm> = TAlg extends JWK_AES_CBC_HMAC ? Uint8Array<ArrayBuffer> : TAlg extends JWK_Asymmetric_Algorithm ? CryptoKeyPair : CryptoKey;
 type GenerateKeyReturn<TAlg extends GenerateKeyAlgorithm, TOptions extends GenerateKeyOptions> = TOptions["toJWK"] extends true ? GenerateKeyReturnJWK<TAlg> : GenerateKeyReturnCrypto<TAlg>;
-type GenerateJWKOptions = Omit<GenerateKeyOptions, "toJWK">;
+type GenerateJWKOptions = Omit<GenerateKeyOptions, "toJWK" | "extractable">;
 type GenerateJWKReturn<TAlg extends GenerateKeyAlgorithm> = GenerateKeyReturnJWK<TAlg>;
 /** Options for the deriveKeyFromPassword function. */
 interface DeriveKeyOptions {
@@ -94,7 +99,7 @@ interface DeriveKeyOptions {
   iterations: number;
   /** Key usages for the derived key. Defaults to ["wrapKey", "unwrapKey"]. */
   keyUsage?: KeyUsage[];
-  /** Mark the derived key as extractable. Defaults to false. */
+  /** Mark the derived key as extractable. Defaults to false. Ignored when `toJWK` is set — the JWK output requires exporting the derived key. */
   extractable?: boolean;
   /**
   * Export the derived key as JWK_oct. When `true`, returns the derived key in
@@ -126,7 +131,15 @@ type WrappingKeyFor<A extends KeyManagementAlgorithm> = A extends JWK_RSA_ENC ?
 type UnwrappingKeyFor<A extends KeyManagementAlgorithm> = A extends JWK_RSA_ENC ? CryptoKey | JWK_RSA_Private<A> : A extends JWK_ECDH_ES ? CryptoKey | JWK_EC_Private<A> | JWK_OKP_Private<A> : A extends JWK_PBES2 ? string | Uint8Array<ArrayBuffer> | JWK_oct<A> : A extends JWK_AES_KW ? CryptoKey | JWK_oct<A> : A extends JWK_AES_GCM_KW ? CryptoKey | JWK_oct<A | `A${"128" | "192" | "256"}GCM`> : A extends "dir" ? CryptoKey | JWK_oct | Uint8Array<ArrayBuffer> : never;
 /** Options for the wrapKey function. */
 interface WrapKeyOptions {
-  /** Initialization Vector for AES-GCMKW. Generated if not provided. */
+  /**
+  * Initialization Vector for AES-GCMKW. A fresh random IV is generated when
+  * not provided — production code should always omit this option.
+  *
+  * **Never reuse an IV and never derive it from external input.** A single
+  * IV reused under the same wrapping key breaks AES-GCM entirely (plaintext
+  * recovery and forgery). Provided only for tests and reproduction of known
+  * vectors in security research.
+  */
   iv?: Uint8Array<ArrayBuffer>;
   /** PBES2 Salt value (p2s). Required for PBES2 algorithms. */
   p2s?: Uint8Array<ArrayBuffer>;
@@ -654,7 +667,12 @@ interface JWSVerifyResult<T extends JOSEPayload = JOSEPayload> {
 }
 /** Options for JWS verification */
 interface JWSVerifyOptions extends JWTClaimValidationOptions {
-  /** List of allowed algorithms. If provided, the JWS `alg` must be in this list. */
+  /**
+  * List of allowed algorithms. If provided, the JWS `alg` must be in this list.
+  * When omitted, the allowlist is inferred from the key's shape — keys without
+  * usable metadata (raw `Uint8Array`/string, alg-less JWKs, lookup functions)
+  * cannot be inferred and require this option explicitly.
+  */
   algorithms?: JWSAlgorithm[];
   /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred. */
   forceUint8Array?: boolean;
@@ -949,7 +967,12 @@ interface JWEEncryptOptions {
 * JWE (JSON Web Encryption) decryption options
 */
 interface JWEDecryptOptions extends JWTClaimValidationOptions {
-  /** A list of allowed JWE "alg" (Algorithm) Header Parameter values for key management. */
+  /**
+  * A list of allowed JWE "alg" (Algorithm) Header Parameter values for key management.
+  * When omitted, the allowlist is inferred from the key's shape — password strings
+  * and raw `Uint8Array` keys infer the PBES2 family plus `dir`; lookup functions
+  * cannot be inferred and require this option explicitly.
+  */
   algorithms?: KeyManagementAlgorithm[];
   /** A list of allowed JWE "enc" (Encryption Algorithm) Header Parameter values for content encryption. */
   encryptionAlgorithms?: ContentEncryptionAlgorithm[];
@@ -1116,4 +1139,4 @@ type ExpiresIn = Duration;
 type NotBeforeIn = Duration;
 /** Duration for `maxTokenAge` validation on {@link verify} / {@link decrypt}. */
 type MaxTokenAge = Duration;
-export { DeriveKeyOptions as $, JWSMultiSigner as A, JWK_PBES2 as At, JWSVerifyResult as B, JWK_Symmetric as Bt, JWSAsymmetricPrivateJWK as C, JWK_EC_Private as Ct, JWSGeneralSignature as D, JWK_OKP_Private as Dt, JWSGeneralSerialization as E, JWK_OKP as Et, JWSProtectedHeader as F, JWK_RSA_ENC as Ft, isJWTError as G, UnwrappingKeyFor as Gt, JWTError as H, JWK_oct as Ht, JWSSignJWK as I, JWK_RSA_PSS as It, JWTClaimValidationOptions as J, WrappingKeyFor as Jt, JOSEPayload as K, WrapKeyOptions as Kt, JWSSignOptions as L, JWK_RSA_Private as Lt, JWSMultiVerifyOptions as M, JWK_Private as Mt, JWSMultiVerifyOutcome as N, JWK_Public as Nt, JWSHeaderParameters as O, JWK_OKP_Public as Ot, JWSMultiVerifyResult as P, JWK_RSA as Pt, ContentEncryptionAlgorithm as Q, JWSVerifyJWK as R, JWK_RSA_Public as Rt, JWSAlgorithm as S, JWK_ECDSA as St, JWSFlattenedSerialization as T, JWK_HMAC as Tt, JWTErrorCauseMap as U, KeyManagementAlgorithm as Ut, StrictOmit as V, JWK_Symmetric_Algorithm as Vt, JWTErrorCode as W, UnwrapKeyOptions as Wt, JoseHeaderParameters as X, JWTClaims as Y, CompositeKey as Z, JWEMultiDecryptOptions as _, JWK_AES_KW as _t, JWEAsymmetricPrivateJWK as a, GenerateKeyReturn as at, JWEMultiRecipient as b, JWK_EC as bt, JWEDecryptOptions as c, JWKCacheAdapter as ct, JWEEncryptOptions as d, JWKPEMAlgorithm as dt, DeriveKeyReturn as et, JWEFlattenedSerialization as f, JWKParameters as ft, JWEKeyManagementHeaderParameters as g, JWK_AES_GCM_KW as gt, JWEHeaderParameters as h, JWK_AES_GCM as ht, NotBeforeIn as i, GenerateKeyOptions as it, JWSMultiVerifyAllOptions as j, JWK_Pair as jt, JWSMultiSignOptions as k, JWK_OKP_SIGN as kt, JWEDecryptResult as l, JWKLookupFunction as lt, JWEGeneralSerialization as m, JWK_AES_CBC_HMAC as mt, ExpiresIn as n, GenerateJWKReturn as nt, JWEAsymmetricPublicJWK as o, JWK as ot, JWEGeneralRecipient as p, JWKSet as pt, JWT as q, WrapKeyResult as qt, MaxTokenAge as r, GenerateKeyAlgorithm as rt, JWEDecryptJWK as s, JWKAlgorithm as st, Duration as t, GenerateJWKOptions as tt, JWEEncryptJWK as u, JWKLookupFunctionHeader as ut, JWEMultiDecryptResult as v, JWK_Asymmetric as vt, JWSAsymmetricPublicJWK as w, JWK_EC_Public as wt, JWEProtectedHeader as x, JWK_ECDH_ES as xt, JWEMultiEncryptOptions as y, JWK_Asymmetric_Algorithm as yt, JWSVerifyOptions as z, JWK_RSA_SIGN as zt };
+export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, Duration, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JOSEPayload, JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHeaderParameters, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JWTError, JWTErrorCauseMap, JWTErrorCode, JoseHeaderParameters, KeyManagementAlgorithm, MaxTokenAge, NotBeforeIn, StrictOmit, UnwrapKeyOptions, UnwrappingKeyFor, WrapKeyOptions, WrapKeyResult, WrappingKeyFor, isJWTError };

package/dist/_chunks/jwe.d.mts

@@ -1,4 +1,4 @@
-import { K as JOSEPayload, Q as ContentEncryptionAlgorithm, Ut as KeyManagementAlgorithm, _ as JWEMultiDecryptOptions, b as JWEMultiRecipient, c as JWEDecryptOptions, d as JWEEncryptOptions, f as JWEFlattenedSerialization, l as JWEDecryptResult, lt as JWKLookupFunction, m as JWEGeneralSerialization, pt as JWKSet, s as JWEDecryptJWK, u as JWEEncryptJWK, v as JWEMultiDecryptResult, y as JWEMultiEncryptOptions } from "./index.mjs";
+import { ContentEncryptionAlgorithm, JOSEPayload, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralSerialization, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWKLookupFunction, JWKSet, KeyManagementAlgorithm } from "./index.mjs";
 /**
 * Encrypt a payload to multiple recipients using JWE General JSON Serialization
 * (RFC 7516 §7.2.1).
@@ -81,4 +81,4 @@ declare function decrypt<T extends JOSEPayload>(jwe: string, key: CryptoKey | JW
 declare function decrypt(jwe: string, key: CryptoKey | JWKSet | JWEDecryptJWK | string | Uint8Array<ArrayBuffer> | JWKLookupFunction, options: JWEDecryptOptions & {
   forceUint8Array: true;
 }): Promise<JWEDecryptResult<Uint8Array<ArrayBuffer>>>;
-export { generalToFlattened as a, encryptMulti as i, encrypt as n, decryptMulti as r, decrypt as t };
+export { decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened };

package/dist/_chunks/jwe.mjs

@@ -1,7 +1,7 @@
-import { D as JWTError, S as validateCriticalHeadersJWE, b as getPlaintextBytes, f as applyTypCtyDefaults, h as computeJwtTimeClaims, i as isCryptoKey, o as isJWK, s as isJWKSet, y as decodePayloadFromBytes } from "./utils.mjs";
-import { a as base64UrlEncode, i as base64UrlDecode, s as textEncoder, t as secureRandomBytes, u as sanitizeObjectCopy } from "./libs/unsecure.mjs";
-import { C as generateIV, S as generateCEK, _ as unwrapKey, b as decrypt$1, h as importKey, p as getJWKsFromSet, x as encrypt$1, y as encryptKey } from "./jwk.mjs";
-import { i as checkAlgAllowed, l as validateJwtClaimsIfJsonPayload, o as decodeProtectedHeader, r as buildJWKSetFilter, s as parseEphemeralKey, t as JWE_ALG_CTX } from "./_internal.mjs";
+import { JWTError, applyTypCtyDefaults, computeJwtTimeClaims, decodePayloadFromBytes, getPlaintextBytes, isCryptoKey, isJWK, isJWKSet, validateCriticalHeadersJWE } from "./utils.mjs";
+import { base64UrlDecode, base64UrlEncode, sanitizeObjectCopy, secureRandomBytes, textEncoder } from "./libs/unsecure.mjs";
+import { decrypt as decrypt$1, encrypt as encrypt$1, encryptKey, generateCEK, generateIV, getJWKsFromSet, importKey, unwrapKey } from "./jwk.mjs";
+import { JWE_ALG_CTX, buildJWKSetFilter, checkAlgAllowed, decodeProtectedHeader, parseEphemeralKey, validateJwtClaimsIfJsonPayload } from "./_internal.mjs";
 const DIRECT_ALGS = /* @__PURE__ */ new Set(["dir", "ECDH-ES"]);
 async function encryptMulti(payload, recipients, options = {}) {
 	if (!Array.isArray(recipients) || recipients.length === 0) throw new JWTError("encryptMulti requires at least one recipient.", "ERR_JWE_INVALID");
@@ -404,4 +404,4 @@ function _buildJWEHeader(alg, enc, key, userHeader, keyManagementParams, payload
 	header.enc = enc;
 	return applyTypCtyDefaults(header, payload);
 }
-export { generalToFlattened as a, encryptMulti as i, encrypt as n, decryptMulti as r, decrypt as t };
+export { decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened };

package/dist/_chunks/jwk.mjs

@@ -1,5 +1,5 @@
-import { D as JWTError, a as isCryptoKeyPair, i as isCryptoKey, n as concatUint8Arrays, o as isJWK, r as isAsymmetricJWK, s as isJWKSet, t as assertCryptoKey } from "./utils.mjs";
-import { a as base64UrlEncode, i as base64UrlDecode, n as base64Decode, r as base64Encode, s as textEncoder, t as secureRandomBytes, u as sanitizeObjectCopy } from "./libs/unsecure.mjs";
+import { JWTError, assertCryptoKey, concatUint8Arrays, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet } from "./utils.mjs";
+import { base64Decode, base64Encode, base64UrlDecode, base64UrlEncode, sanitizeObjectCopy, secureRandomBytes, textEncoder } from "./libs/unsecure.mjs";
 async function sign(alg, key, data) {
 	checkSigCryptoKey(key, alg, "sign");
 	const signature = await crypto.subtle.sign(subtleAlgorithm(alg, key.algorithm), key, data);
@@ -151,6 +151,16 @@ function checkCEKLength(cek, expected) {
 	const actual = cek.byteLength << 3;
 	if (actual !== expected) throw new Error(`Invalid Content Encryption Key length. Expected ${expected} bits, got ${actual} bits`);
 }
+function assertOctKeyLength(bytes, alg) {
+	if (!alg) return;
+	if (alg === "HS256" || alg === "HS384" || alg === "HS512") {
+		const minBytes = Number.parseInt(alg.slice(2), 10) >> 3;
+		if (bytes.length < minBytes) throw new JWTError(`${alg} requires a key of at least ${minBytes} bytes (got ${bytes.length})`, "ERR_JWK_INVALID");
+		return;
+	}
+	const exactBits = /^A(128|192|256)(GCM)?KW$/.test(alg) ? Number.parseInt(alg.slice(1, 4), 10) : CEK_BIT_LENGTHS[alg];
+	if (exactBits !== void 0 && bytes.length << 3 !== exactBits) throw new JWTError(`${alg} requires a key of exactly ${exactBits >> 3} bytes (got ${bytes.length})`, "ERR_JWK_INVALID");
+}
 function checkAESCryptoKey(key, alg, usage) {
 	switch (alg) {
 		case "A128GCM":
@@ -1011,7 +1021,7 @@ const getSPKI = (x509) => {
 };
 async function generateKey(alg, options = {}) {
 	const exportToJWK = options.toJWK !== void 0 && options.toJWK !== false;
-	const defaultExtractable = options.extractable !== false;
+	const defaultExtractable = exportToJWK || options.extractable !== false;
 	if (alg === "A128CBC-HS256" || alg === "A192CBC-HS384" || alg === "A256CBC-HS512") {
 		const keyBytes = secureRandomBytes(bitLengthCEK(alg) >> 3);
 		if (exportToJWK) return keyToJWK(keyBytes);
@@ -1039,7 +1049,7 @@ async function generateKey(alg, options = {}) {
 	return key;
 }
 async function generateJWK(alg, options) {
-	const { keyUsage, extractable, modulusLength, publicExponent, namedCurve, ...jwkParams } = options ?? {};
+	const { keyUsage, modulusLength, publicExponent, namedCurve, ...jwkParams } = options ?? {};
 	const kid = typeof jwkParams.kid === "string" ? jwkParams.kid : crypto.randomUUID();
 	const extraParams = {
 		...jwkParams,
@@ -1047,7 +1057,6 @@ async function generateJWK(alg, options) {
 	};
 	const result = await generateKey(alg, {
 		keyUsage,
-		extractable,
 		modulusLength,
 		publicExponent,
 		namedCurve,
@@ -1089,12 +1098,11 @@ async function deriveKeyFromPassword(password, alg, options) {
 	return derivedKey;
 }
 async function deriveJWKFromPassword(password, alg, options) {
-	const { salt, iterations, keyUsage, extractable, ...jwkParams } = options;
+	const { salt, iterations, keyUsage, ...jwkParams } = options;
 	const result = await deriveKeyFromPassword(password, alg, {
 		salt,
 		iterations,
 		keyUsage,
-		extractable,
 		toJWK: true
 	});
 	return Object.keys(jwkParams).length > 0 ? {
@@ -1131,9 +1139,16 @@ async function importKey(key, algOrOptions) {
 	}
 	if (isJWK(key)) if ("k" in key && typeof key.k === "string") {
 		const rawBytes = base64UrlDecode(key.k, { returnAs: "uint8array" });
+		assertOctKeyLength(rawBytes, key.alg || alg);
 		if (typeof algOrOptions === "object" && algOrOptions.asCryptoKey) {
 			const { algorithm, usage, extractable = false } = algOrOptions;
 			if (!algorithm || !usage) throw new JWTError("asCryptoKey option requires `algorithm` and `usage` to be provided.", "ERR_JWK_INVALID");
+			if (typeof algorithm === "object" && algorithm.name === "HMAC") {
+				const hash = algorithm.hash;
+				const hashName = typeof hash === "string" ? hash : hash?.name;
+				const minBytes = Number.parseInt(hashName?.slice(-3) ?? "", 10) / 8;
+				if (minBytes && rawBytes.length < minBytes) throw new JWTError(`HMAC with ${hashName} requires a key of at least ${minBytes} bytes (got ${rawBytes.length})`, "ERR_JWK_INVALID");
+			}
 			return crypto.subtle.importKey("raw", rawBytes, algorithm, extractable, usage);
 		}
 		return rawBytes;
@@ -1310,7 +1325,7 @@ async function unwrapKey(alg, wrappedKey, unwrappingKey, options = {}) {
 	return await crypto.subtle.importKey("raw", unwrappedCekBytes, options.unwrappedKeyAlgorithm || { name: "AES-GCM" }, defaultExtractable, options.keyUsage || ["encrypt", "decrypt"]);
 }
 async function importPEM(pem, alg, options) {
-	const extractable = options?.extractable !== false;
+	const extractable = true;
 	const pemType = options?.pemType ?? inferPEMType(pem);
 	if (!pemType) throw new JWTError("Cannot infer PEM type from the input; pass \"options.pemType\" explicitly.", "ERR_JWK_INVALID");
 	let cryptoKey;
@@ -1622,4 +1637,4 @@ function inferAesImportAlgorithm(enc, cekLengthBytes) {
 		length: bitLength
 	};
 }
-export { generateIV as C, generateCEK as S, verify as T, unwrapKey as _, deriveKeyFromPassword as a, decrypt as b, exportPEM as c, generateKey as d, getJWKFromSet as f, importPEM as g, importKey as h, deriveJWKFromPassword as i, exportToPEM as l, importFromPEM as m, clearJWKCache as n, deriveSharedSecret as o, getJWKsFromSet as p, configureJWKCache as r, exportKey as s, WeakMapJWKCache as t, generateJWK as u, wrapKey as v, sign as w, encrypt as x, encryptKey as y };
+export { WeakMapJWKCache, assertOctKeyLength, clearJWKCache, configureJWKCache, decrypt, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, encrypt, encryptKey, exportKey, exportPEM, exportToPEM, generateCEK, generateIV, generateJWK, generateKey, getJWKFromSet, getJWKsFromSet, importFromPEM, importKey, importPEM, sign, unwrapKey, verify, wrapKey };

package/dist/_chunks/jws.d.mts

@@ -1,4 +1,4 @@
-import { A as JWSMultiSigner, B as JWSVerifyResult, E as JWSGeneralSerialization, I as JWSSignJWK, K as JOSEPayload, L as JWSSignOptions, M as JWSMultiVerifyOptions, N as JWSMultiVerifyOutcome, P as JWSMultiVerifyResult, R as JWSVerifyJWK, S as JWSAlgorithm, T as JWSFlattenedSerialization, j as JWSMultiVerifyAllOptions, k as JWSMultiSignOptions, lt as JWKLookupFunction, pt as JWKSet, z as JWSVerifyOptions } from "./index.mjs";
+import { JOSEPayload, JWKLookupFunction, JWKSet, JWSAlgorithm, JWSFlattenedSerialization, JWSGeneralSerialization, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult } from "./index.mjs";
 /**
 * Sign a payload with multiple signers using JWS General JSON Serialization
 * (RFC 7515 §7.2.1).
@@ -108,4 +108,4 @@ declare function verify<T extends JOSEPayload>(jws: string, key: CryptoKey | JWK
 declare function verify(jws: string, key: CryptoKey | JWKSet | JWSVerifyJWK | Uint8Array<ArrayBuffer> | JWKLookupFunction, options: JWSVerifyOptions & {
   forceUint8Array: true;
 }): Promise<JWSVerifyResult<Uint8Array<ArrayBuffer>>>;
-export { verifyMulti as a, signMulti as i, verify as n, verifyMultiAll as o, generalToFlattenedJWS as r, sign as t };
+export { generalToFlattenedJWS, sign, signMulti, verify, verifyMulti, verifyMultiAll };

package/dist/_chunks/jws.mjs

@@ -1,7 +1,7 @@
-import { C as validateCriticalHeadersJWS, D as JWTError, b as getPlaintextBytes, f as applyTypCtyDefaults, h as computeJwtTimeClaims, o as isJWK, s as isJWKSet } from "./utils.mjs";
-import { a as base64UrlEncode, i as base64UrlDecode, o as textDecoder, s as textEncoder, u as sanitizeObjectCopy } from "./libs/unsecure.mjs";
-import { T as verify$1, h as importKey, p as getJWKsFromSet, w as sign$1 } from "./jwk.mjs";
-import { a as decodeJWSPayload, c as resolveSigningKey, i as checkAlgAllowed, l as validateJwtClaimsIfJsonPayload, n as JWS_ALG_CTX, o as decodeProtectedHeader, r as buildJWKSetFilter } from "./_internal.mjs";
+import { JWTError, applyTypCtyDefaults, computeJwtTimeClaims, getPlaintextBytes, isJWK, isJWKSet, validateCriticalHeadersJWS } from "./utils.mjs";
+import { base64UrlDecode, base64UrlEncode, sanitizeObjectCopy, textDecoder, textEncoder } from "./libs/unsecure.mjs";
+import { getJWKsFromSet, importKey, sign as sign$1, verify as verify$1 } from "./jwk.mjs";
+import { JWS_ALG_CTX, buildJWKSetFilter, checkAlgAllowed, decodeJWSPayload, decodeProtectedHeader, resolveSigningKey, validateJwtClaimsIfJsonPayload } from "./_internal.mjs";
 async function signMulti(payload, signers, options = {}) {
 	if (!Array.isArray(signers) || signers.length === 0) throw new JWTError("signMulti requires at least one signer.", "ERR_JWS_INVALID");
 	const resolvedAlgs = signers.map((s, i) => _resolveSignerAlg(s.key, i));
@@ -346,4 +346,4 @@ function _buildJWSHeader(alg, key, userHeader, payload) {
 	if (header.b64 === true) delete header.b64;
 	return header;
 }
-export { verifyMulti as a, signMulti as i, verify as n, verifyMultiAll as o, generalToFlattenedJWS as r, sign as t };
+export { generalToFlattenedJWS, sign, signMulti, verify, verifyMulti, verifyMultiAll };

package/dist/_chunks/libs/unsecure.d.mts

@@ -91,4 +91,4 @@ declare function base64UrlDecode(data: Uint8Array): Uint8Array<ArrayBuffer>;
 type DecodeReturnAs = "string" | "uint8array" | "bytes";
 declare const textEncoder: TextEncoder;
 declare const textDecoder: TextDecoder;
-export { textDecoder as a, sanitizeObject as c, base64UrlEncode as i, sanitizeObjectCopy as l, base64Encode as n, textEncoder as o, base64UrlDecode as r, safeJsonParse as s, base64Decode as t, secureRandomBytes as u };
+export { base64Decode, base64Encode, base64UrlDecode, base64UrlEncode, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder };

package/dist/_chunks/libs/unsecure.mjs

@@ -146,4 +146,4 @@ function secureRandomBytes(length) {
 	}
 	return bytes;
 }
-export { base64UrlEncode as a, safeJsonParse as c, base64UrlDecode as i, sanitizeObject as l, base64Decode as n, textDecoder as o, base64Encode as r, textEncoder as s, secureRandomBytes as t, sanitizeObjectCopy as u };
+export { base64Decode, base64Encode, base64UrlDecode, base64UrlEncode, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder };

package/dist/_chunks/utils.mjs

@@ -1,4 +1,4 @@
-import { c as safeJsonParse, i as base64UrlDecode, o as textDecoder, s as textEncoder } from "./libs/unsecure.mjs";
+import { base64UrlDecode, safeJsonParse, textDecoder, textEncoder } from "./libs/unsecure.mjs";
 var JWTError = class extends Error {
 	code;
 	cause;
@@ -387,4 +387,4 @@ function isPublicJWK(key) {
 	}
 	return false;
 }
-export { validateCriticalHeadersJWS as C, JWTError as D, inferJWSAllowedAlgorithms as E, isJWTError as O, validateCriticalHeadersJWE as S, inferJWEAllowedAlgorithms as T, decodeMaybeJWTString as _, isCryptoKeyPair as a, getPlaintextBytes as b, isPrivateJWK as c, maybeArray as d, applyTypCtyDefaults as f, computeMaxTokenAgeSeconds as g, computeJwtTimeClaims as h, isCryptoKey as i, isPublicJWK as l, computeExpiresInSeconds as m, concatUint8Arrays as n, isJWK as o, computeDurationInSeconds as p, isAsymmetricJWK as r, isJWKSet as s, assertCryptoKey as t, isSymmetricJWK as u, decodePayloadFromB64UrlSegment as v, validateJwtClaims as w, isJWTContent as x, decodePayloadFromBytes as y };
+export { JWTError, applyTypCtyDefaults, assertCryptoKey, computeDurationInSeconds, computeExpiresInSeconds, computeJwtTimeClaims, computeMaxTokenAgeSeconds, concatUint8Arrays, decodeMaybeJWTString, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims };

package/dist/adapters/elysia/index.d.mts

@@ -0,0 +1,244 @@
+import { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, Duration, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JOSEPayload, JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHeaderParameters, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JoseHeaderParameters, KeyManagementAlgorithm, MaxTokenAge, NotBeforeIn, StrictOmit, UnwrapKeyOptions, UnwrappingKeyFor, WrapKeyOptions, WrapKeyResult, WrappingKeyFor } from "../../_chunks/index.mjs";
+import { deriveJWKFromPassword, exportPEM, generateJWK, importPEM } from "../../core/jwk.mjs";
+import { Elysia } from "elysia";
+interface CookieAttributes {
+  domain?: string;
+  expires?: Date;
+  httpOnly?: boolean;
+  maxAge?: number;
+  path?: string;
+  priority?: "low" | "medium" | "high";
+  sameSite?: boolean | "lax" | "strict" | "none";
+  secure?: boolean;
+  partitioned?: boolean;
+}
+interface ChunkableCookie {
+  value: unknown;
+  set(config: CookieAttributes & {
+    value: string;
+  }): unknown;
+}
+type ChunkableCookieJar = Record<string, ChunkableCookie>;
+type WriteChunkedCookieOptions = CookieAttributes & {
+  chunkMaxLength?: number;
+};
+interface SessionContext {
+  cookie: ChunkableCookieJar;
+  request: {
+    headers: {
+      get(name: string): string | null;
+    };
+  };
+}
+interface SessionClaims extends Required<Pick<JWTClaims, "jti" | "iat">>, StrictOmit<JWTClaims, "jti" | "iat"> {}
+type SessionData<T extends Record<string, any> = SessionClaims> = StrictOmit<T, "jti" | "iat" | "exp">;
+type SessionUpdate<T extends Record<string, any> = SessionClaims> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
+interface SessionManager<T extends Record<string, any> = SessionClaims, ConfigMaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  readonly id: string | undefined;
+  readonly createdAt: number;
+  readonly expiresAt: ConfigMaxAge extends ExpiresIn ? number : "exp" extends keyof T ? T["exp"] : number | undefined;
+  readonly data: SessionData<T>;
+  readonly token: string | undefined;
+  update: (update?: SessionUpdate<T>) => Promise<SessionManager<T, ConfigMaxAge>>;
+  clear: () => Promise<SessionManager<T, ConfigMaxAge>>;
+}
+/**
+* Explicit return type for the `jwsSession` / `jweSession` plugin factories.
+*
+* Modelling Elysia's generics by hand is required by `isolatedDeclarations`
+* (the factories return an inferred `new Elysia().resolve().macro()` type that
+* cannot otherwise be emitted). `Resolved` is the scoped `Ephemeral.resolve`
+* augmentation — typically `{ [P in ContextKey]: SessionManager }` — so consumers
+* read a typed `ctx[contextKey]`. `GuardName` is the guard macro key (derived
+* from the context key, e.g. `requireSession`), so multiple session plugins on
+* one app each expose a distinct guard rather than colliding. `macroFn` is left
+* `{}`: consumers only need `Metadata.macro` for the `{ [GuardName]: true }`
+* route option.
+*/
+type SessionPlugin<Resolved extends Record<string, unknown>, GuardName extends string = "requireSession"> = Elysia<"", {
+  decorator: {};
+  store: {};
+  derive: {};
+  resolve: {};
+}, {
+  typebox: {};
+  error: {};
+}, {
+  schema: {};
+  standaloneSchema: {};
+  macro: { [M in GuardName]?: boolean };
+  macroFn: {};
+  parser: {};
+  response: {};
+}, {}, {
+  derive: {};
+  resolve: Resolved;
+  schema: {};
+  standaloneSchema: {};
+  response: {};
+}, {
+  derive: {};
+  resolve: {};
+  schema: {};
+  standaloneSchema: {};
+  response: {};
+}>;
+interface SessionJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  id: string | undefined;
+  createdAt: number;
+  expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
+  data: SessionData<T>;
+  token: string | undefined;
+}
+interface SessionHooksJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TContext extends SessionContext = SessionContext> {
+  onRead?: (args: {
+    session: SessionJWS<T, MaxAge> & {
+      id: string;
+      token: string;
+    };
+    context: TContext;
+    config: SessionConfigJWS<T, MaxAge, TContext>;
+  }) => void | Promise<void>;
+  onUpdate?: (args: {
+    session: SessionJWS<T, MaxAge> & {
+      id: string;
+      token: string;
+    };
+    oldSession: SessionJWS<T, MaxAge>;
+    context: TContext;
+    config: SessionConfigJWS<T, MaxAge, TContext>;
+  }) => void | Promise<void>;
+  onClear?: (args: {
+    oldSession: SessionJWS<T, MaxAge> | undefined;
+    context: TContext;
+    config: SessionConfigJWS<T, MaxAge, TContext>;
+  }) => void | Promise<void>;
+  onExpire?: (args: {
+    session: {
+      id: string | undefined;
+      createdAt: number | undefined;
+      expiresAt: number | undefined;
+      token: string;
+    };
+    context: TContext;
+    error: Error;
+    config: SessionConfigJWS<T, MaxAge, TContext>;
+  }) => void | Promise<void>;
+  onError?: (args: {
+    session: SessionJWS<T, MaxAge>;
+    context: TContext;
+    error: any;
+    config: SessionConfigJWS<T, MaxAge, TContext>;
+  }) => void | Promise<void>;
+  onVerifyKeyLookup?: (args: {
+    header: JWKLookupFunctionHeader;
+    context: TContext;
+    config: SessionConfigJWS<T, MaxAge, TContext>;
+  }) => JWKSet | JWSVerifyJWK | Promise<JWKSet | JWSVerifyJWK>;
+}
+interface SessionConfigJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TContext extends SessionContext = SessionContext> {
+  key: JWK_oct<JWK_HMAC> | {
+    privateKey: JWSAsymmetricPrivateJWK;
+    publicKey: JWSAsymmetricPublicJWK | JWSAsymmetricPublicJWK[] | JWKSet;
+  };
+  maxAge?: MaxAge;
+  name?: string;
+  /** Context property the session is exposed under. Default `"session"`. */
+  contextKey?: string;
+  cookie?: false | (CookieAttributes & {
+    chunkMaxLength?: number;
+  });
+  sessionHeader?: false | string;
+  generateId?: () => string;
+  jws?: {
+    signOptions?: Omit<JWSSignOptions, "expiresIn">;
+    verifyOptions?: JWTClaimValidationOptions;
+  };
+  hooks?: SessionHooksJWS<T, MaxAge, TContext>;
+}
+declare function createJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TContext extends SessionContext = SessionContext>(context: TContext, config: SessionConfigJWS<T, MaxAge, TContext>): Promise<SessionManager<T, MaxAge>>;
+declare function jwsSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, K extends string = "session">(config: SessionConfigJWS<T, MaxAge> & (K extends "session" ? {
+  contextKey?: K;
+} : {
+  contextKey: K;
+})): SessionPlugin<{ [P in K]: SessionManager<T, MaxAge> }, `require${Capitalize<K>}`>;
+interface SessionJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  id: string | undefined;
+  createdAt: number;
+  expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
+  data: SessionData<T>;
+  token: string | undefined;
+}
+interface SessionHooksJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TContext extends SessionContext = SessionContext> {
+  onRead?: (args: {
+    session: SessionJWE<T, MaxAge> & {
+      id: string;
+      token: string;
+    };
+    context: TContext;
+    config: SessionConfigJWE<T, MaxAge, TContext>;
+  }) => void | Promise<void>;
+  onUpdate?: (args: {
+    session: SessionJWE<T, MaxAge> & {
+      id: string;
+      token: string;
+    };
+    oldSession: SessionJWE<T, MaxAge>;
+    context: TContext;
+    config: SessionConfigJWE<T, MaxAge, TContext>;
+  }) => void | Promise<void>;
+  onClear?: (args: {
+    oldSession: SessionJWE<T, MaxAge> | undefined;
+    context: TContext;
+    config: SessionConfigJWE<T, MaxAge, TContext>;
+  }) => void | Promise<void>;
+  onExpire?: (args: {
+    session: {
+      id: string | undefined;
+      createdAt: number | undefined;
+      expiresAt: number | undefined;
+      token: string;
+    };
+    context: TContext;
+    error: Error;
+    config: SessionConfigJWE<T, MaxAge, TContext>;
+  }) => void | Promise<void>;
+  onError?: (args: {
+    session: SessionJWE<T, MaxAge>;
+    context: TContext;
+    error: any;
+    config: SessionConfigJWE<T, MaxAge, TContext>;
+  }) => void | Promise<void>;
+  onUnsealKeyLookup?: (args: {
+    header: JWEHeaderParameters;
+    context: TContext;
+    config: SessionConfigJWE<T, MaxAge, TContext>;
+  }) => JWEDecryptJWK | Promise<JWEDecryptJWK>;
+}
+interface SessionConfigJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TContext extends SessionContext = SessionContext> {
+  key: string | JWEEncryptJWK | {
+    privateKey: JWEAsymmetricPrivateJWK;
+    publicKey?: JWEAsymmetricPublicJWK;
+  };
+  maxAge?: MaxAge;
+  name?: string;
+  /** Context property the session is exposed under. Default `"session"`. */
+  contextKey?: string;
+  cookie?: false | (CookieAttributes & {
+    chunkMaxLength?: number;
+  });
+  sessionHeader?: false | string;
+  generateId?: () => string;
+  jwe?: {
+    encryptOptions?: Omit<JWEEncryptOptions, "expiresIn">;
+    decryptOptions?: JWTClaimValidationOptions;
+  };
+  hooks?: SessionHooksJWE<T, MaxAge, TContext>;
+}
+declare function createJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TContext extends SessionContext = SessionContext>(context: TContext, config: SessionConfigJWE<T, MaxAge, TContext>): Promise<SessionManager<T, MaxAge>>;
+declare function jweSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, K extends string = "session">(config: SessionConfigJWE<T, MaxAge> & (K extends "session" ? {
+  contextKey?: K;
+} : {
+  contextKey: K;
+})): SessionPlugin<{ [P in K]: SessionManager<T, MaxAge> }, `require${Capitalize<K>}`>;
+export { type ChunkableCookie, type ChunkableCookieJar, type CompositeKey, type ContentEncryptionAlgorithm, type CookieAttributes, type DeriveKeyOptions, type DeriveKeyReturn, type Duration, type ExpiresIn, type GenerateJWKOptions, type GenerateJWKReturn, type GenerateKeyAlgorithm, type GenerateKeyOptions, type GenerateKeyReturn, type JOSEPayload, type JWEAsymmetricPrivateJWK, type JWEAsymmetricPublicJWK, type JWEDecryptJWK, type JWEDecryptOptions, type JWEDecryptResult, type JWEEncryptJWK, type JWEEncryptOptions, type JWEFlattenedSerialization, type JWEGeneralRecipient, type JWEGeneralSerialization, type JWEHeaderParameters, type JWEKeyManagementHeaderParameters, type JWEMultiDecryptOptions, type JWEMultiDecryptResult, type JWEMultiEncryptOptions, type JWEMultiRecipient, type JWEProtectedHeader, type JWK, type JWKAlgorithm, type JWKCacheAdapter, type JWKLookupFunction, type JWKLookupFunctionHeader, type JWKPEMAlgorithm, type JWKParameters, type JWKSet, type JWK_AES_CBC_HMAC, type JWK_AES_GCM, type JWK_AES_GCM_KW, type JWK_AES_KW, type JWK_Asymmetric, type JWK_Asymmetric_Algorithm, type JWK_EC, type JWK_ECDH_ES, type JWK_ECDSA, type JWK_EC_Private, type JWK_EC_Public, type JWK_HMAC, type JWK_OKP, type JWK_OKP_Private, type JWK_OKP_Public, type JWK_OKP_SIGN, type JWK_PBES2, type JWK_Pair, type JWK_Private, type JWK_Public, type JWK_RSA, type JWK_RSA_ENC, type JWK_RSA_PSS, type JWK_RSA_Private, type JWK_RSA_Public, type JWK_RSA_SIGN, type JWK_Symmetric, type JWK_Symmetric_Algorithm, type JWK_oct, type JWSAlgorithm, type JWSAsymmetricPrivateJWK, type JWSAsymmetricPublicJWK, type JWSFlattenedSerialization, type JWSGeneralSerialization, type JWSGeneralSignature, type JWSHeaderParameters, type JWSMultiSignOptions, type JWSMultiSigner, type JWSMultiVerifyAllOptions, type JWSMultiVerifyOptions, type JWSMultiVerifyOutcome, type JWSMultiVerifyResult, type JWSProtectedHeader, type JWSSignJWK, type JWSSignOptions, type JWSVerifyJWK, type JWSVerifyOptions, type JWSVerifyResult, type JWT, type JWTClaimValidationOptions, type JWTClaims, type JoseHeaderParameters, type KeyManagementAlgorithm, type MaxTokenAge, type NotBeforeIn, type SessionClaims, type SessionConfigJWE, type SessionConfigJWS, type SessionContext, type SessionData, type SessionHooksJWE, type SessionHooksJWS, type SessionJWE, type SessionJWS, type SessionManager, type SessionPlugin, type SessionUpdate, type UnwrapKeyOptions, type UnwrappingKeyFor, type WrapKeyOptions, type WrapKeyResult, type WrappingKeyFor, type WriteChunkedCookieOptions, createJWESession, createJWSSession, deriveJWKFromPassword, exportPEM, generateJWK, importPEM, jweSession, jwsSession };