unjwt 0.8.1 → 0.8.3

package/dist/_chunks/index.d.mts

@@ -100,21 +100,271 @@ export declare function isUnsecureError<T extends UnsecureErrorCode>(error: unkn
   code: T;
 };
 export declare function isUnsecureError(error: unknown): error is UnsecureError;
-/** Decoded protected header passed to a `JWKLookupFunction`; `enc` is present on JWE only. */
+/** Header Parameters common to JWE and JWS. */
+export interface JoseHeaderParameters {
+  /** "kid" (Key ID) Header Parameter */
+  kid?: string;
+  /** "x5t" (X.509 Certificate SHA-1 Thumbprint) Header Parameter */
+  x5t?: string;
+  /** "x5c" (X.509 Certificate Chain) Header Parameter */
+  x5c?: string[];
+  /** "x5u" (X.509 URL) Header Parameter */
+  x5u?: string;
+  /** "jku" (JWK Set URL) Header Parameter */
+  jku?: string;
+  /** "jwk" (JSON Web Key) Header Parameter */
+  jwk?: JWK_Public;
+  /** "typ" (Type) Header Parameter */
+  typ?: string;
+  /** "cty" (Content Type) Header Parameter */
+  cty?: string;
+  /** "crit" (Critical) Header Parameter */
+  crit?: string[];
+  [propName: string]: unknown;
+}
+/** Payload accepted by `sign` and `encrypt`: a string, raw bytes, or a JSON object. */
+export type JOSEPayload = string | Uint8Array<ArrayBuffer> | object;
+/** How a verified or decrypted payload is decoded: `"json"` object, UTF-8 `"string"`, or raw `"bytes"`. */
+export type JOSEPayloadMode = keyof JOSEPayloadTypeMap;
+/** The payload type each `JOSEPayloadMode` resolves to. */
+export interface JOSEPayloadTypeMap<T = JWTClaims> {
+  json: T;
+  string: string;
+  bytes: Uint8Array<ArrayBuffer>;
+}
+/** The payload type returned under `Mode`; a union of modes yields the union of payloads. */
+export type PayloadOf<Mode extends JOSEPayloadMode, T = JWTClaims> = JOSEPayloadTypeMap<T>[Mode];
+/** "cnf" (Confirmation) Claim members (RFC 7800 §3.1), with `jkt` (RFC 9449 §6.1) and `x5t#S256` (RFC 8705 §3.1). */
+export interface JWTConfirmation {
+  /** The proof-of-possession key as a public JWK */
+  "jwk"?: JWK_Public;
+  /** The proof-of-possession key as an encrypted JWK, a JWE in compact serialization */
+  "jwe"?: string;
+  /** A Key ID the recipient resolves out of band */
+  "kid"?: string;
+  /** A JWK Set URL holding the key, selected by `kid` */
+  "jku"?: string;
+  /** The RFC 7638 SHA-256 thumbprint of the DPoP public key */
+  "jkt"?: string;
+  /** The SHA-256 thumbprint of the client certificate, base64url */
+  "x5t#S256"?: string;
+  [member: string]: unknown;
+}
+export interface JWTClaims {
+  /** "iss" (Issuer) Claim */
+  iss?: string;
+  /** "sub" (Subject) Claim */
+  sub?: string;
+  /** "aud" (Audience) Claim */
+  aud?: string | string[];
+  /** "exp" (Expiration Time) Claim */
+  exp?: number;
+  /** "nbf" (Not Before) Claim */
+  nbf?: number;
+  /** "iat" (Issued At) Claim */
+  iat?: number;
+  /** "jti" (JWT ID) Claim */
+  jti?: string;
+  /** "cnf" (Confirmation) Claim, the proof-of-possession key; never validated, read by the application */
+  cnf?: JWTConfirmation;
+  [propName: string]: unknown;
+}
+export interface JWT<T = JWTClaims> {
+  header: JoseHeaderParameters & {
+    /** "alg" (Algorithm) Header Parameter */
+    alg: JWSAlgorithm | KeyManagementAlgorithm;
+  };
+  claims: T;
+}
+/** Per-call work bounds; each entry must be a positive integer, else `ERR_INVALID_OPTION`. */
+export interface JOSELimits {
+  /** Max `signatures[]` entries in a JWS JSON serialization. @default 16 */
+  signatures?: number;
+  /** Max `recipients[]` entries in a JWE JSON serialization. @default 16 */
+  recipients?: number;
+  /** Max JWK Set candidates tried per token after `kid`/`alg`/`use` filtering. @default 8 */
+  keyCandidates?: number;
+  /** Total PBKDF2 iterations one call may spend across PBES2 attempts. @default 2_400_000 */
+  pbes2Iterations?: number;
+}
+/** Claim expectations, each checked when set; an empty or malformed value is `ERR_INVALID_OPTION`. */
+export interface JWTClaimValidationOptions {
+  /** Expected "aud" value(s); `aud` is checked only when this is set (RFC 7519 §4.1.3). */
+  audience?: string | string[];
+  /** Expected "iss" value(s); implies presence. */
+  issuer?: string | string[];
+  /** Expected "sub" value; implies presence. */
+  subject?: string;
+  /** Maximum token age from "iat"; implies presence. */
+  maxTokenAge?: MaxTokenAge;
+  /** Clock skew tolerance for nbf/exp/iat, in seconds or a `Duration`. @default 0 */
+  clockTolerance?: number | Duration;
+  /** Expected "typ" header, compared as a media type (RFC 7515 §4.1.9); implies presence. */
+  typ?: string;
+  /** Date used for NumericDate comparisons. @default new Date() */
+  currentDate?: Date;
+  /** Additional required claim names. */
+  requiredClaims?: string[];
+  /** `crit` header parameters the caller understands (RFC 7515 §4.1.11, RFC 7516 §4.1.13). */
+  recognizedHeaders?: string[];
+}
+/** Time claims a producer computes; a claim already in the payload is kept as given. */
+export interface JWTTimeClaimOptions {
+  /** The clock: `iat` when written, and the base of `expiresIn` / `notBeforeIn`. @default new Date() */
+  currentDate?: Date;
+  /** Writes `iat` on its own: `true` as `currentDate`, a `Date` as that instant; `false` is unset. `exp`/`nbf` options write it either way. */
+  issuedAt?: boolean | Date;
+  /** Duration from `currentDate` until `exp`; exclusive with `expiresAt`. */
+  expiresIn?: ExpiresIn;
+  /** Absolute `exp`; exclusive with `expiresIn`. */
+  expiresAt?: Date;
+  /** Duration from `currentDate` until `nbf` (`0` sets `nbf` to it); exclusive with `notBeforeAt`. */
+  notBeforeIn?: ExpiresIn;
+  /** Absolute `nbf` (RFC 7519 §4.1.5); exclusive with `notBeforeIn`. */
+  notBeforeAt?: Date;
+}
+/** Options shared by `verify` and `decrypt` (compact and multi). */
+export interface JOSEConsumerOptions<Mode extends JOSEPayloadMode = JOSEPayloadMode> extends JWTClaimValidationOptions {
+  /** Admit `oct` entries of a JWK Set as key material; only for application-controlled sets. @default false */
+  allowSymmetricJWKSet?: boolean;
+  /** Payload decoding mode; a mismatch is `ERR_JWS_INVALID` / `ERR_JWE_INVALID`. @default "json" */
+  payload?: Mode;
+  /**
+   * If true, forces the payload to be returned as a `Uint8Array`.
+   *
+   * @deprecated Use `payload: "bytes"`. Deprecated in v0.8.0, removed in v0.9.0
+   */
+  forceUint8Array?: boolean;
+  /** `false` skips claim validation; `true` with a non-`"json"` payload is `ERR_INVALID_OPTION`. */
+  validateClaims?: boolean;
+}
+export type StrictOmit<T, K extends keyof T | (string & {}) | (number & {}) | (symbol & {})> = { [P in keyof T as P extends K ? never : P]: T[P]; };
+/** JWS Signing Algorithm Identifier. */
+export type JWSAlgorithm = JWK_HMAC | JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_OKP_SIGN;
+/** A key lookup for `verify`: it receives the validated JWS header. */
+export type JWSKeyLookup<TReturn = CryptoKey | JWK | JWKSet | string | Uint8Array<ArrayBuffer>> = JWKLookupFunction<TReturn, JWSHeaderParameters>;
+/** JWS algorithms that name their digest (`*256`/`*384`/`*512`); EdDSA does not. */
+export type JWSHashedAlgorithm = Exclude<JWSAlgorithm, JWK_OKP_SIGN>;
+/** Asymmetric private JWKs admissible as a signing key. */
+export type JWSAsymmetricPrivateJWK = JWK_RSA_Private<JWK_RSA_SIGN | JWK_RSA_PSS> | JWK_EC_Private<JWK_ECDSA> | JWK_OKP_Private<JWK_OKP_SIGN>;
+/** Asymmetric public JWKs admissible as a verification key. */
+export type JWSAsymmetricPublicJWK = JWK_RSA_Public<JWK_RSA_SIGN | JWK_RSA_PSS> | JWK_EC_Public<JWK_ECDSA> | JWK_OKP_Public<JWK_OKP_SIGN>;
+/** JWKs admissible as a `sign` key; a non-signing `alg` is a type error. */
+export type JWSSignJWK = JWK_oct<JWK_HMAC> | JWSAsymmetricPrivateJWK;
+/** JWKs admissible as a `verify` key; a non-signing `alg` is a type error. */
+export type JWSVerifyJWK = JWK_oct<JWK_HMAC> | JWSAsymmetricPublicJWK;
+/** Recognized JWS Header Parameters; other members may be present. */
+export interface JWSHeaderParameters extends JoseHeaderParameters {
+  /** JWS "alg" (Algorithm) Header Parameter */
+  alg?: JWSAlgorithm;
+  /** `false` signs the payload unencoded (RFC 7797). @default true */
+  b64?: boolean;
+}
+/** JWS Protected Header */
+export interface JWSProtectedHeader extends JWSHeaderParameters {
+  alg: JWSAlgorithm;
+}
+/** Options for `sign`. */
+export interface JWSSignOptions extends JWTTimeClaimOptions {
+  /** JWS algorithm; inferred from the key when omitted. */
+  alg?: JWSAlgorithm;
+  /** Extra protected header parameters; `alg` cannot be set, `typ` defaults to `"JWT"` for an object payload. */
+  protectedHeader?: StrictOmit<JWSHeaderParameters, "alg"> & {
+    alg?: never;
+  };
+}
+/** Result of JWS verification. */
+export interface JWSVerifyResult<T extends JOSEPayload = JOSEPayload> {
+  payload: T;
+  protectedHeader: JWSProtectedHeader;
+}
+/** Options for `verify`; `Mode` is the `payload` option's literal. */
+export interface JWSVerifyOptions<Mode extends JOSEPayloadMode = JOSEPayloadMode> extends JOSEConsumerOptions<Mode> {
+  /** Allowed `alg` values; inferred from the key when omitted, required for raw secrets, alg-less JWKs and resolvers. */
+  algorithms?: JWSAlgorithm[];
+  /** Max JWK Set candidates per token; more is `ERR_JWK_KEY_NOT_FOUND`. @default { keyCandidates: 8 } */
+  limits?: Pick<JOSELimits, "keyCandidates">;
+}
+/** JWS Flattened JSON Serialization (RFC 7515 §7.2.2). */
+export interface JWSFlattenedSerialization {
+  /** The JWS Payload; base64url-encoded unless `b64: false`. */
+  payload: string;
+  /** Base64url-encoded JWS Protected Header. */
+  protected?: string;
+  /** JWS Unprotected Header (not signed). */
+  header?: JWSHeaderParameters;
+  /** Base64url-encoded signature. */
+  signature: string;
+}
+/** JWS General JSON Serialization (RFC 7515 §7.2.1). */
+export interface JWSGeneralSerialization extends Omit<JWSFlattenedSerialization, "protected" | "header" | "signature"> {
+  /** One entry per signer. */
+  signatures: JWSGeneralSignature[];
+}
+/** A single entry of `JWSGeneralSerialization.signatures`. */
+export type JWSGeneralSignature = Pick<JWSFlattenedSerialization, "protected" | "header" | "signature">;
+/** One signer passed to `signMulti`. */
+export interface JWSMultiSigner {
+  /** Signing key; `kid` is taken from a JWK, a `CryptoKey` must set it in `protectedHeader`. */
+  key: JWSSignJWK | CryptoKey;
+  /** JWS algorithm; inferred from the key when possible, else `ERR_JWS_SIGNER_ALG_INFERENCE`. */
+  alg?: JWSAlgorithm;
+  /** Per-signer protected header; `b64` must match across signers (RFC 7797 §3), `typ` defaults to `"JWT"`. */
+  protectedHeader?: StrictOmit<JWSHeaderParameters, "alg"> & {
+    alg?: never;
+  };
+  /** Per-signer JWS Unprotected Header (not signed). */
+  unprotectedHeader?: JWSHeaderParameters;
+}
+/** Options for `signMulti`; `alg` and `protectedHeader` are set per signer. */
+export interface JWSMultiSignOptions extends StrictOmit<JWSSignOptions, "alg" | "protectedHeader"> {}
+/** Options for `verifyMulti`. */
+export interface JWSMultiVerifyOptions<Mode extends JOSEPayloadMode = JOSEPayloadMode> extends JWSVerifyOptions<Mode> {
+  /** Max `signatures[]` (more is `ERR_JWS_INVALID`) and JWK Set candidates per signature. @default { signatures: 16, keyCandidates: 8 } */
+  limits?: Pick<JOSELimits, "signatures" | "keyCandidates">;
+  /** Try only signatures the key could have produced (by `kid`, `kty`, curve, length), else `ERR_JWS_NO_MATCHING_SIGNER`. @default false */
+  strictSignerMatch?: boolean;
+}
+/** Result of `verifyMulti`. */
+export interface JWSMultiVerifyResult<T extends JOSEPayload = JOSEPayload> extends Omit<JWSVerifyResult<T>, "protectedHeader"> {
+  /** Protected header of the verified signature as signed; `alg` may sit in `signerHeader` (RFC 7515 §7.2.1). */
+  protectedHeader: JWSHeaderParameters;
+  /** Unprotected header of the verified signature. */
+  signerHeader?: JWSHeaderParameters;
+  /** Index into `signatures` of the verified signature. */
+  signerIndex: number;
+}
+/** Options for `verifyMultiAll`. */
+export interface JWSMultiVerifyAllOptions<Mode extends JOSEPayloadMode = JOSEPayloadMode> extends StrictOmit<JWSMultiVerifyOptions<Mode>, "strictSignerMatch"> {}
+/** Per-signature outcome of `verifyMultiAll`, discriminated by `verified`; failures carry `error`. */
+export type JWSMultiVerifyOutcome<T extends JOSEPayload = JOSEPayload> = {
+  signerIndex: number;
+  verified: true;
+  payload: T;
+  protectedHeader: JWSHeaderParameters;
+  signerHeader?: JWSHeaderParameters;
+} | {
+  signerIndex: number;
+  verified: false;
+  error: JWTError;
+  protectedHeader?: JWSHeaderParameters;
+  signerHeader?: JWSHeaderParameters;
+};
+/** Decoded protected header a `JWKLookupFunction` receives, its algorithms already checked against the ones this version implements; `enc` is present on JWE only. */
 export type JWKLookupFunctionHeader = {
   kid?: string;
-  alg?: string;
-  enc?: string;
+  alg?: JWSAlgorithm | KeyManagementAlgorithm;
+  enc?: ContentEncryptionAlgorithm;
   typ?: string;
   crit?: string[];
   [propName: string]: unknown;
 };
-/** Resolves the verify/decrypt key from the protected header and compact token; a string is a PBES2 password (JWE) or raw key bytes (JWS); `undefined`, `null` or a throw is `ERR_JWK_KEY_NOT_FOUND`. */
-export type JWKLookupFunction<TReturn = CryptoKey | JWK | JWKSet | string | Uint8Array<ArrayBuffer>> = (header: JWKLookupFunctionHeader, token: string) => TReturn | undefined | null | Promise<TReturn | undefined | null>;
+/** Resolves the verify/decrypt key from the protected header (`THeader`: the family's, else the generic one) and compact token; a string is a PBES2 password (JWE) or raw key bytes (JWS); `undefined`, `null` or a throw is `ERR_JWK_KEY_NOT_FOUND`. */
+export type JWKLookupFunction<TReturn = CryptoKey | JWK | JWKSet | string | Uint8Array<ArrayBuffer>, THeader = JWKLookupFunctionHeader> = (header: THeader, token: string) => TReturn | undefined | null | Promise<TReturn | undefined | null>;
 /** Custom JWK import cache; key on the JWK `thumbprint` plus private/public half and `alg`, never on `kid`. Both methods may return a promise. */
 export interface JWKCacheAdapter {
-  get(jwk: JWK, alg: string): CryptoKey | undefined | Promise<CryptoKey | undefined>;
-  set(jwk: JWK, alg: string, key: CryptoKey): void | Promise<void>;
+  get(jwk: JWK, alg: JWKAlgorithm): CryptoKey | undefined | Promise<CryptoKey | undefined>;
+  set(jwk: JWK, alg: JWKAlgorithm, key: CryptoKey): void | Promise<void>;
 }
 /** Structure returned for composite AES-CBC + HMAC keys. */
 export type CompositeKey = {
@@ -147,7 +397,7 @@ export interface GenerateKeyOptions<ToJWK extends boolean = boolean, Kid extends
 /** `generateKey` result per algorithm without `toJWK`: `CryptoKey` (symmetric), raw bytes (`A*CBC-HS*`), `CryptoKeyPair` (asymmetric). */
 export type GeneratedKeyMap = { [A in GenerateKeyAlgorithm]: A extends JWK_AES_CBC_HMAC ? Uint8Array<ArrayBuffer> : A extends JWK_Asymmetric_Algorithm ? CryptoKeyPair : CryptoKey; };
 /** `generateJWK` result per algorithm: an `oct` JWK or a JWK pair, each carrying `alg`, and `kid` unless `Kid` is `false`. */
-export type GeneratedJWKMap<Kid extends string | false = string> = { [A in GenerateKeyAlgorithm]: A extends JWK_Asymmetric_Algorithm ? GeneratedJWKPair<JWK_Pair<A>, A, Kid> : JWK_oct<A> & GeneratedJWKMembers<A, Kid>; };
+export type GeneratedJWKMap<Kid extends string | false = string> = { [A in GenerateKeyAlgorithm]: A extends JWK_Asymmetric_Algorithm ? GeneratedJWKPair<JWK_Pair<A>, A, Kid> : JWK_oct<Exclude<A, JWK_Asymmetric_Algorithm>> & GeneratedJWKMembers<A, Kid>; };
 /** `generateKey` return type for `TAlg` under `TOptions`; JWKs when `toJWK` is `true`. */
 export type GenerateKeyReturn<TAlg extends GenerateKeyAlgorithm, TOptions extends GenerateKeyOptions> = GeneratedKeyShape<TAlg, Exclude<TOptions["toJWK"], undefined>, GeneratedKid<TOptions>>;
 /** `generateJWK` return type for `TAlg` under the `kid` option `Kid`. */
@@ -175,9 +425,24 @@ export interface DeriveKeyOptions {
   /** Return the derived key as a `JWK_oct`. */
   toJWK?: boolean;
 }
+/** The AES-KW algorithm a `PBES2-*` or `ECDH-ES+*` algorithm wraps the CEK with: its last six characters. */
+export type KeyWrapAlgorithmOf<A extends KeyWrappingAlgorithm> = A extends `${string}A128KW` ? "A128KW" : A extends `${string}A192KW` ? "A192KW" : A extends `${string}A256KW` ? "A256KW" : never;
+/** Key management algorithms that wrap the CEK with an inner AES-KW step. */
+export type KeyWrappingAlgorithm = JWK_PBES2 | Exclude<JWK_ECDH_ES, "ECDH-ES">;
 /** PBES2 → AES-KW `alg` stamped on the derived JWK. */
-type DerivedJWKAlg<TAlg extends JWK_PBES2> = TAlg extends "PBES2-HS256+A128KW" ? "A128KW" : TAlg extends "PBES2-HS384+A192KW" ? "A192KW" : TAlg extends "PBES2-HS512+A256KW" ? "A256KW" : JWK_AES_KW;
+type DerivedJWKAlg<TAlg extends JWK_PBES2> = KeyWrapAlgorithmOf<TAlg>;
 export type DeriveKeyReturn<TOptions extends DeriveKeyOptions, TAlg extends JWK_PBES2 = JWK_PBES2> = TOptions["toJWK"] extends true ? JWK_oct<DerivedJWKAlg<TAlg>> : TOptions["toJWK"] extends object ? JWK_oct<DerivedJWKAlg<TAlg>> : CryptoKey;
+/** Options of `deriveJWKFromPassword`: PBES2 derivation without `toJWK`/`extractable`, plus `kid` (`false` for none). */
+export type DeriveJWKOptions<TAlg extends JWK_PBES2 = JWK_PBES2, Kid extends string | false = string> = Omit<DeriveKeyOptions, "alg" | "toJWK" | "extractable"> & {
+  alg: TAlg;
+  kid?: Kid;
+};
+/** `deriveJWKFromPassword` return type: the AES-KW `oct` JWK for `TAlg`, with `kid` unless `Kid` is `false`. */
+export type DeriveJWKReturn<TAlg extends JWK_PBES2, Kid extends string | false = string> = JWK_oct<DerivedJWKAlg<TAlg>> & GeneratedJWKMembers<DerivedJWKAlg<TAlg>, Kid>;
+/** PEM label families `importPEM` reads. */
+export type PEMType = "pkcs8" | "spki" | "x509";
+/** `importPEM` result for `Alg`: the private JWK of a PKCS#8 PEM, the public one of SPKI/X.509, both when the label is inferred. */
+export type ImportedPEMJWK<Alg extends JWKPEMAlgorithm, Type extends PEMType | undefined = undefined> = Type extends "pkcs8" ? JWK_Pair<Alg>["privateKey"] : Type extends "spki" | "x509" ? JWK_Pair<Alg>["publicKey"] : JWK_Pair<Alg>["privateKey"] | JWK_Pair<Alg>["publicKey"];
 export type KeyManagementAlgorithm = JWK_RSA_ENC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_PBES2 | JWK_ECDH_ES | "dir";
 export type ContentEncryptionAlgorithm = JWK_AES_GCM | JWK_AES_CBC_HMAC;
 /** Keys admissible as the `wrappingKey` of `wrapKey` for algorithm `A`; `dir` takes any symmetric key. */
@@ -256,7 +521,7 @@ export type UnwrapKeyResult<TOptions extends {
 }> = "format" extends keyof TOptions ? [TOptions["format"]] extends ["raw"] ? Uint8Array<ArrayBuffer> : [TOptions["format"]] extends ["cryptokey" | undefined] ? CryptoKey : CryptoKey | Uint8Array<ArrayBuffer> : CryptoKey;
 /** Forked from https://github.com/panva/jose/tree/v6.0.10, Copyright (c) 2018 Filip Skokan, LICENSE: https://github.com/panva/jose/blob/v6.0.10/LICENSE.md */
 /** Generic JWK parameters; `Alg` constrains the `alg` member. */
-export interface JWKParameters<Alg extends string = string> {
+export interface JWKParameters<Alg extends JWKAlgorithm = JWKAlgorithm> {
   /** JWK "kty" (Key Type) Parameter */
   "kty": string;
   /** JWK "alg" (Algorithm) Parameter */
@@ -288,7 +553,7 @@ export type ECDHEphemeralKeyInput = CryptoKey | JWK_EC_Private | JWK_OKP_Private
   privateKey: CryptoKey | JWK_EC_Private | JWK_OKP_Private;
 };
 /** Public EC JSON Web Keys */
-export interface JWK_EC_Public<Alg extends JWK_ECDSA | JWK_ECDH_ES | (string & {}) = string> extends JWKParameters<Alg> {
+export interface JWK_EC_Public<Alg extends JWK_ECDSA | JWK_ECDH_ES = JWK_ECDSA | JWK_ECDH_ES> extends JWKParameters<Alg> {
   kty: "EC";
   /** EC JWK "crv" (Curve) Parameter */
   crv: string;
@@ -298,14 +563,14 @@ export interface JWK_EC_Public<Alg extends JWK_ECDSA | JWK_ECDH_ES | (string & {
   y: string;
 }
 /** Private EC JSON Web Keys */
-export interface JWK_EC_Private<Alg extends JWK_ECDSA | JWK_ECDH_ES | (string & {}) = string> extends JWK_EC_Public<Alg> {
+export interface JWK_EC_Private<Alg extends JWK_ECDSA | JWK_ECDH_ES = JWK_ECDSA | JWK_ECDH_ES> extends JWK_EC_Public<Alg> {
   /** EC JWK "d" (ECC Private Key) Parameter */
   d: string;
 }
 /** EC JSON Web Keys */
-export type JWK_EC<Alg extends JWK_ECDSA | JWK_ECDH_ES | (string & {}) = string> = JWK_EC_Public<Alg> | JWK_EC_Private<Alg>;
+export type JWK_EC<Alg extends JWK_ECDSA | JWK_ECDH_ES = JWK_ECDSA | JWK_ECDH_ES> = JWK_EC_Public<Alg> | JWK_EC_Private<Alg>;
 /** Public RSA JSON Web Keys */
-export interface JWK_RSA_Public<Alg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC | (string & {}) = string> extends JWKParameters<Alg> {
+export interface JWK_RSA_Public<Alg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC> extends JWKParameters<Alg> {
   kty: "RSA";
   /** RSA JWK "e" (Exponent) Parameter */
   e: string;
@@ -314,7 +579,7 @@ export interface JWK_RSA_Public<Alg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA
   oth?: RsaOtherPrimesInfo[];
 }
 /** Private RSA JSON Web Keys */
-export interface JWK_RSA_Private<Alg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC | (string & {}) = string> extends JWK_RSA_Public<Alg> {
+export interface JWK_RSA_Private<Alg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC> extends JWK_RSA_Public<Alg> {
   /** RSA JWK "d" (Private Exponent) Parameter */
   d: string;
   /** RSA JWK "dp" (First Factor CRT Exponent) Parameter */
@@ -329,9 +594,9 @@ export interface JWK_RSA_Private<Alg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RS
   qi: string;
 }
 /** RSA JSON Web Keys */
-export type JWK_RSA<Alg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC | (string & {}) = string> = JWK_RSA_Public<Alg> | JWK_RSA_Private<Alg>;
+export type JWK_RSA<Alg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC> = JWK_RSA_Public<Alg> | JWK_RSA_Private<Alg>;
 /** Public ED JSON Web Keys */
-export interface JWK_OKP_Public<Alg extends JWK_OKP_SIGN | JWK_ECDH_ES | (string & {}) = string> extends JWKParameters<Alg> {
+export interface JWK_OKP_Public<Alg extends JWK_OKP_SIGN | JWK_ECDH_ES = JWK_OKP_SIGN | JWK_ECDH_ES> extends JWKParameters<Alg> {
   kty: "OKP";
   /** ED JWK "crv" (Curve) Parameter */
   crv: string;
@@ -339,30 +604,36 @@ export interface JWK_OKP_Public<Alg extends JWK_OKP_SIGN | JWK_ECDH_ES | (string
   x: string;
 }
 /** Private ED JSON Web Keys */
-export interface JWK_OKP_Private<Alg extends JWK_OKP_SIGN | JWK_ECDH_ES | (string & {}) = string> extends JWK_OKP_Public<Alg> {
+export interface JWK_OKP_Private<Alg extends JWK_OKP_SIGN | JWK_ECDH_ES = JWK_OKP_SIGN | JWK_ECDH_ES> extends JWK_OKP_Public<Alg> {
   /** ED JWK "d" (Private Key) Parameter */
   d: string;
 }
 /** OKP JSON Web Keys */
-export type JWK_OKP<Alg extends JWK_OKP_SIGN | JWK_ECDH_ES | (string & {}) = string> = JWK_OKP_Public<Alg> | JWK_OKP_Private<Alg>;
+export type JWK_OKP<Alg extends JWK_OKP_SIGN | JWK_ECDH_ES = JWK_OKP_SIGN | JWK_ECDH_ES> = JWK_OKP_Public<Alg> | JWK_OKP_Private<Alg>;
 /** oct JSON Web Keys */
-export interface JWK_oct<Alg extends JWK_HMAC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_AES_CBC_HMAC | JWK_PBES2 | "dir" | (string & {}) = string> extends JWKParameters<Alg> {
+export interface JWK_oct<Alg extends JWK_HMAC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_AES_CBC_HMAC | JWK_PBES2 | "dir" = JWK_HMAC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_AES_CBC_HMAC | JWK_PBES2 | "dir"> extends JWKParameters<Alg> {
   kty: "oct";
   /** Oct JWK "k" (Key Value) Parameter */
   k: string;
 }
 /** Symmetric JSON Web Keys */
-export type JWK_Symmetric<Alg extends JWK_HMAC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_AES_CBC_HMAC | JWK_PBES2 | "dir" | (string & {}) = string> = JWK_oct<Alg>;
-/** Asymmetric JSON Web Keys */
-export type JWK_Asymmetric<Alg extends string = string> = JWK_RSA<Alg> | JWK_EC<Alg> | JWK_OKP<Alg>;
-/** Public JSON Web Keys */
-export type JWK_Public<Alg extends string = string> = JWK_RSA_Public<Alg> | JWK_EC_Public<Alg> | JWK_OKP_Public<Alg>;
-/** Private JSON Web Keys */
-export type JWK_Private<Alg extends string = string> = JWK_RSA_Private<Alg> | JWK_EC_Private<Alg> | JWK_OKP_Private<Alg>;
+export type JWK_Symmetric<Alg extends JWK_HMAC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_AES_CBC_HMAC | JWK_PBES2 | "dir" = JWK_HMAC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_AES_CBC_HMAC | JWK_PBES2 | "dir"> = JWK_oct<Alg>;
+/** Asymmetric JSON Web Keys. */
+export type JWK_Asymmetric<Alg extends JWK_Asymmetric_Algorithm = JWK_Asymmetric_Algorithm> = RSAFor<Alg, JWK_RSA<Extract<Alg, JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC>>> | ECFor<Alg, JWK_EC<Extract<Alg, JWK_ECDSA | JWK_ECDH_ES>>> | OKPFor<Alg, JWK_OKP<Extract<Alg, JWK_OKP_SIGN | JWK_ECDH_ES>>>;
+/** Public JSON Web Keys. */
+export type JWK_Public<Alg extends JWK_Asymmetric_Algorithm = JWK_Asymmetric_Algorithm> = RSAFor<Alg, JWK_RSA_Public<Extract<Alg, JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC>>> | ECFor<Alg, JWK_EC_Public<Extract<Alg, JWK_ECDSA | JWK_ECDH_ES>>> | OKPFor<Alg, JWK_OKP_Public<Extract<Alg, JWK_OKP_SIGN | JWK_ECDH_ES>>>;
+/** Private JSON Web Keys. */
+export type JWK_Private<Alg extends JWK_Asymmetric_Algorithm = JWK_Asymmetric_Algorithm> = RSAFor<Alg, JWK_RSA_Private<Extract<Alg, JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC>>> | ECFor<Alg, JWK_EC_Private<Extract<Alg, JWK_ECDSA | JWK_ECDH_ES>>> | OKPFor<Alg, JWK_OKP_Private<Extract<Alg, JWK_OKP_SIGN | JWK_ECDH_ES>>>;
+/** `toPublicJWK` result: the public interface of the input's family and `alg`, keeping a `kid` the input is typed to carry. */
+export type ToPublicJWKReturn<T extends JWK_Asymmetric> = (T extends JWK_RSA<infer Alg> ? JWK_RSA_Public<Alg> : T extends JWK_EC<infer Alg> ? JWK_EC_Public<Alg> : T extends JWK_OKP<infer Alg> ? JWK_OKP_Public<Alg> : never) & (T extends {
+  kid: string;
+} ? {
+  kid: string;
+} : unknown);
 /** JSON Web Key (RFC 7517) of type "RSA", "EC", "OKP" or "oct". */
-export type JWK<Alg extends string = string> = JWK_oct<Alg> | JWK_RSA<Alg> | JWK_EC<Alg> | JWK_OKP<Alg>;
+export type JWK<Alg extends JWKAlgorithm = JWKAlgorithm> = OctFor<Alg, JWK_oct<Extract<Alg, Exclude<JWKAlgorithm, JWK_Asymmetric_Algorithm>>>> | JWK_Asymmetric<Extract<Alg, JWK_Asymmetric_Algorithm>>;
 /** Public/private JWK pair, narrowed to the key family `Alg` identifies (ECDH-ES: EC or OKP). */
-export type JWK_Pair<Alg extends string = string> = Alg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC ? {
+export type JWK_Pair<Alg extends JWK_Asymmetric_Algorithm = JWK_Asymmetric_Algorithm> = Alg extends JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC ? {
   publicKey: JWK_RSA_Public<Alg>;
   privateKey: JWK_RSA_Private<Alg>;
 } : Alg extends JWK_ECDSA ? {
@@ -377,16 +648,7 @@ export type JWK_Pair<Alg extends string = string> = Alg extends JWK_RSA_SIGN | J
 } : Alg extends JWK_OKP_SIGN ? {
   publicKey: JWK_OKP_Public<Alg>;
   privateKey: JWK_OKP_Private<Alg>;
-} : {
-  publicKey: JWK_RSA_Public<Alg>;
-  privateKey: JWK_RSA_Private<Alg>;
-} | {
-  publicKey: JWK_EC_Public<Alg>;
-  privateKey: JWK_EC_Private<Alg>;
-} | {
-  publicKey: JWK_OKP_Public<Alg>;
-  privateKey: JWK_OKP_Private<Alg>;
-};
+} : never;
 /** JSON Web Key Set (RFC 7517); `T` preserves a precise key tuple. */
 export interface JWKSet<T extends readonly JWK[] = JWK[]> {
   keys: T;
@@ -405,6 +667,8 @@ export type JWK_AES_GCM_KW = "A128GCMKW" | "A192GCMKW" | "A256GCMKW";
 export type JWK_PBES2 = "PBES2-HS256+A128KW" | "PBES2-HS384+A192KW" | "PBES2-HS512+A256KW";
 export type JWK_ECDH_ES = "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A192KW" | "ECDH-ES+A256KW";
 export type JWK_OKP_SIGN = "Ed25519" | "EdDSA";
+/** Every algorithm named after an AES key size: the `A128`/`A192`/`A256` families. */
+export type JWK_AES_Algorithm = JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_AES_CBC_HMAC;
 export type JWK_Symmetric_Algorithm = JWK_HMAC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW;
 export type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA_ENC | JWK_OKP_SIGN | JWK_ECDH_ES;
 export type JWKAlgorithm = JWK_Symmetric_Algorithm | JWK_Asymmetric_Algorithm | JWK_AES_CBC_HMAC | JWK_PBES2 | JWK_ECDH_ES | "dir";
@@ -428,232 +692,11 @@ type GeneratedJWKPair<P, A, Kid> = P extends {
 type GeneratedKid<TOptions> = "kid" extends keyof TOptions ? ThumbprintIfUnset<Extract<TOptions["kid" & keyof TOptions], string | false>> : string;
 type ThumbprintIfUnset<Kid extends string | false> = [Kid] extends [never] ? string : Kid;
 type GeneratedKeyShape<TAlg extends GenerateKeyAlgorithm, ToJWK, Kid extends string | false> = [ToJWK] extends [never] ? GeneratedKeyMap[TAlg] : ToJWK extends true ? GeneratedJWKMap<Kid>[TAlg] : GeneratedKeyMap[TAlg];
-/** Header Parameters common to JWE and JWS. */
-export interface JoseHeaderParameters {
-  /** "kid" (Key ID) Header Parameter */
-  kid?: string;
-  /** "x5t" (X.509 Certificate SHA-1 Thumbprint) Header Parameter */
-  x5t?: string;
-  /** "x5c" (X.509 Certificate Chain) Header Parameter */
-  x5c?: string[];
-  /** "x5u" (X.509 URL) Header Parameter */
-  x5u?: string;
-  /** "jku" (JWK Set URL) Header Parameter */
-  jku?: string;
-  /** "jwk" (JSON Web Key) Header Parameter */
-  jwk?: JWK_Public;
-  /** "typ" (Type) Header Parameter */
-  typ?: string;
-  /** "cty" (Content Type) Header Parameter */
-  cty?: string;
-  /** "crit" (Critical) Header Parameter */
-  crit?: string[];
-  [propName: string]: unknown;
-}
-/** Payload accepted by `sign` and `encrypt`: a string, raw bytes, or a JSON object. */
-export type JOSEPayload = string | Uint8Array<ArrayBuffer> | object;
-/** How a verified or decrypted payload is decoded: `"json"` object, UTF-8 `"string"`, or raw `"bytes"`. */
-export type JOSEPayloadMode = keyof JOSEPayloadTypeMap;
-/** The payload type each `JOSEPayloadMode` resolves to. */
-export interface JOSEPayloadTypeMap<T = JWTClaims> {
-  json: T;
-  string: string;
-  bytes: Uint8Array<ArrayBuffer>;
-}
-/** The payload type returned under `Mode`; a union of modes yields the union of payloads. */
-export type PayloadOf<Mode extends JOSEPayloadMode, T = JWTClaims> = JOSEPayloadTypeMap<T>[Mode];
-export interface JWTClaims {
-  /** "iss" (Issuer) Claim */
-  iss?: string;
-  /** "sub" (Subject) Claim */
-  sub?: string;
-  /** "aud" (Audience) Claim */
-  aud?: string | string[];
-  /** "exp" (Expiration Time) Claim */
-  exp?: number;
-  /** "nbf" (Not Before) Claim */
-  nbf?: number;
-  /** "iat" (Issued At) Claim */
-  iat?: number;
-  /** "jti" (JWT ID) Claim */
-  jti?: string;
-  [propName: string]: unknown;
-}
-export interface JWT<T = JWTClaims> {
-  header: JoseHeaderParameters & {
-    /** "alg" (Algorithm) Header Parameter */
-    alg: string;
-  };
-  claims: T;
-}
-/** Per-call work bounds; each entry must be a positive integer, else `ERR_INVALID_OPTION`. */
-export interface JOSELimits {
-  /** Max `signatures[]` entries in a JWS JSON serialization. @default 16 */
-  signatures?: number;
-  /** Max `recipients[]` entries in a JWE JSON serialization. @default 16 */
-  recipients?: number;
-  /** Max JWK Set candidates tried per token after `kid`/`alg`/`use` filtering. @default 8 */
-  keyCandidates?: number;
-  /** Total PBKDF2 iterations one call may spend across PBES2 attempts. @default 2_400_000 */
-  pbes2Iterations?: number;
-}
-/** Claim expectations, each checked when set; an empty or malformed value is `ERR_INVALID_OPTION`. */
-export interface JWTClaimValidationOptions {
-  /** Expected "aud" value(s); `aud` is checked only when this is set (RFC 7519 §4.1.3). */
-  audience?: string | string[];
-  /** Expected "iss" value(s); implies presence. */
-  issuer?: string | string[];
-  /** Expected "sub" value; implies presence. */
-  subject?: string;
-  /** Maximum token age from "iat"; implies presence. */
-  maxTokenAge?: MaxTokenAge;
-  /** Clock skew tolerance for nbf/exp/iat, in seconds or a `Duration`. @default 0 */
-  clockTolerance?: number | Duration;
-  /** Expected "typ" header, compared as a media type (RFC 7515 §4.1.9); implies presence. */
-  typ?: string;
-  /** Date used for NumericDate comparisons. @default new Date() */
-  currentDate?: Date;
-  /** Additional required claim names. */
-  requiredClaims?: string[];
-  /** `crit` header parameters the caller understands (RFC 7515 §4.1.11, RFC 7516 §4.1.13). */
-  recognizedHeaders?: string[];
-}
-/** Time claims a producer computes; a claim already in the payload is kept as given. */
-export interface JWTTimeClaimOptions {
-  /** Reference moment for `iat` and relative durations. @default new Date() */
-  currentDate?: Date;
-  /** Duration until `exp`; exclusive with `expiresAt`. */
-  expiresIn?: ExpiresIn;
-  /** Absolute `exp`; exclusive with `expiresIn`. */
-  expiresAt?: Date;
-  /** Duration from `iat` until `nbf` (`0` sets `nbf = iat`); exclusive with `notBeforeAt`. */
-  notBeforeIn?: ExpiresIn;
-  /** Absolute `nbf` (RFC 7519 §4.1.5); exclusive with `notBeforeIn`. */
-  notBeforeAt?: Date;
-}
-/** Options shared by `verify` and `decrypt` (compact and multi). */
-export interface JOSEConsumerOptions<Mode extends JOSEPayloadMode = JOSEPayloadMode> extends JWTClaimValidationOptions {
-  /** Admit `oct` entries of a JWK Set as key material; only for application-controlled sets. @default false */
-  allowSymmetricJWKSet?: boolean;
-  /** Payload decoding mode; a mismatch is `ERR_JWS_INVALID` / `ERR_JWE_INVALID`. @default "json" */
-  payload?: Mode;
-  /**
-   * If true, forces the payload to be returned as a `Uint8Array`.
-   *
-   * @deprecated Use `payload: "bytes"`. Deprecated in v0.8.0, removed in v0.9.0
-   */
-  forceUint8Array?: boolean;
-  /** `false` skips claim validation; `true` with a non-`"json"` payload is `ERR_INVALID_OPTION`. */
-  validateClaims?: boolean;
-}
-export type StrictOmit<T, K extends keyof T | (string & {}) | (number & {}) | (symbol & {})> = { [P in keyof T as P extends K ? never : P]: T[P]; };
-/** JWS Signing Algorithm Identifier. */
-export type JWSAlgorithm = JWK_HMAC | JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_OKP_SIGN;
-/** Asymmetric private JWKs admissible as a signing key. */
-export type JWSAsymmetricPrivateJWK = JWK_RSA_Private<JWK_RSA_SIGN | JWK_RSA_PSS> | JWK_EC_Private<JWK_ECDSA> | JWK_OKP_Private<JWK_OKP_SIGN>;
-/** Asymmetric public JWKs admissible as a verification key. */
-export type JWSAsymmetricPublicJWK = JWK_RSA_Public<JWK_RSA_SIGN | JWK_RSA_PSS> | JWK_EC_Public<JWK_ECDSA> | JWK_OKP_Public<JWK_OKP_SIGN>;
-/** JWKs admissible as a `sign` key; a non-signing `alg` is a type error. */
-export type JWSSignJWK = JWK_oct<JWK_HMAC> | JWSAsymmetricPrivateJWK;
-/** JWKs admissible as a `verify` key; a non-signing `alg` is a type error. */
-export type JWSVerifyJWK = JWK_oct<JWK_HMAC> | JWSAsymmetricPublicJWK;
-/** Recognized JWS Header Parameters; other members may be present. */
-export interface JWSHeaderParameters extends JoseHeaderParameters {
-  /** JWS "alg" (Algorithm) Header Parameter */
-  alg?: JWSAlgorithm;
-  /** `false` signs the payload unencoded (RFC 7797). @default true */
-  b64?: boolean;
-}
-/** JWS Protected Header */
-export interface JWSProtectedHeader extends JWSHeaderParameters {
-  alg: JWSAlgorithm;
-}
-/** Options for `sign`. */
-export interface JWSSignOptions extends JWTTimeClaimOptions {
-  /** JWS algorithm; inferred from the key when omitted. */
-  alg?: JWSAlgorithm;
-  /** Extra protected header parameters; `alg` cannot be set, `typ` defaults to `"JWT"` for an object payload. */
-  protectedHeader?: StrictOmit<JWSHeaderParameters, "alg"> & {
-    alg?: never;
-  };
-}
-/** Result of JWS verification. */
-export interface JWSVerifyResult<T extends JOSEPayload = JOSEPayload> {
-  payload: T;
-  protectedHeader: JWSProtectedHeader;
-}
-/** Options for `verify`; `Mode` is the `payload` option's literal. */
-export interface JWSVerifyOptions<Mode extends JOSEPayloadMode = JOSEPayloadMode> extends JOSEConsumerOptions<Mode> {
-  /** Allowed `alg` values; inferred from the key when omitted, required for raw secrets, alg-less JWKs and resolvers. */
-  algorithms?: JWSAlgorithm[];
-  /** Max JWK Set candidates per token; more is `ERR_JWK_KEY_NOT_FOUND`. @default { keyCandidates: 8 } */
-  limits?: Pick<JOSELimits, "keyCandidates">;
-}
-/** JWS Flattened JSON Serialization (RFC 7515 §7.2.2). */
-export interface JWSFlattenedSerialization {
-  /** The JWS Payload; base64url-encoded unless `b64: false`. */
-  payload: string;
-  /** Base64url-encoded JWS Protected Header. */
-  protected?: string;
-  /** JWS Unprotected Header (not signed). */
-  header?: JWSHeaderParameters;
-  /** Base64url-encoded signature. */
-  signature: string;
-}
-/** JWS General JSON Serialization (RFC 7515 §7.2.1). */
-export interface JWSGeneralSerialization extends Omit<JWSFlattenedSerialization, "protected" | "header" | "signature"> {
-  /** One entry per signer. */
-  signatures: JWSGeneralSignature[];
-}
-/** A single entry of `JWSGeneralSerialization.signatures`. */
-export type JWSGeneralSignature = Pick<JWSFlattenedSerialization, "protected" | "header" | "signature">;
-/** One signer passed to `signMulti`. */
-export interface JWSMultiSigner {
-  /** Signing key; `kid` is taken from a JWK, a `CryptoKey` must set it in `protectedHeader`. */
-  key: JWSSignJWK | CryptoKey;
-  /** JWS algorithm; inferred from the key when possible, else `ERR_JWS_SIGNER_ALG_INFERENCE`. */
-  alg?: JWSAlgorithm;
-  /** Per-signer protected header; `b64` must match across signers (RFC 7797 §3), `typ` defaults to `"JWT"`. */
-  protectedHeader?: StrictOmit<JWSHeaderParameters, "alg"> & {
-    alg?: never;
-  };
-  /** Per-signer JWS Unprotected Header (not signed). */
-  unprotectedHeader?: JWSHeaderParameters;
-}
-/** Options for `signMulti`; `alg` and `protectedHeader` are set per signer. */
-export interface JWSMultiSignOptions extends StrictOmit<JWSSignOptions, "alg" | "protectedHeader"> {}
-/** Options for `verifyMulti`. */
-export interface JWSMultiVerifyOptions<Mode extends JOSEPayloadMode = JOSEPayloadMode> extends JWSVerifyOptions<Mode> {
-  /** Max `signatures[]` (more is `ERR_JWS_INVALID`) and JWK Set candidates per signature. @default { signatures: 16, keyCandidates: 8 } */
-  limits?: Pick<JOSELimits, "signatures" | "keyCandidates">;
-  /** Try only signatures the key could have produced (by `kid`, `kty`, curve, length), else `ERR_JWS_NO_MATCHING_SIGNER`. @default false */
-  strictSignerMatch?: boolean;
-}
-/** Result of `verifyMulti`. */
-export interface JWSMultiVerifyResult<T extends JOSEPayload = JOSEPayload> extends Omit<JWSVerifyResult<T>, "protectedHeader"> {
-  /** Protected header of the verified signature as signed; `alg` may sit in `signerHeader` (RFC 7515 §7.2.1). */
-  protectedHeader: JWSHeaderParameters;
-  /** Unprotected header of the verified signature. */
-  signerHeader?: JWSHeaderParameters;
-  /** Index into `signatures` of the verified signature. */
-  signerIndex: number;
-}
-/** Options for `verifyMultiAll`. */
-export interface JWSMultiVerifyAllOptions<Mode extends JOSEPayloadMode = JOSEPayloadMode> extends StrictOmit<JWSMultiVerifyOptions<Mode>, "strictSignerMatch"> {}
-/** Per-signature outcome of `verifyMultiAll`, discriminated by `verified`; failures carry `error`. */
-export type JWSMultiVerifyOutcome<T extends JOSEPayload = JOSEPayload> = {
-  signerIndex: number;
-  verified: true;
-  payload: T;
-  protectedHeader: JWSHeaderParameters;
-  signerHeader?: JWSHeaderParameters;
-} | {
-  signerIndex: number;
-  verified: false;
-  error: JWTError;
-  protectedHeader?: JWSHeaderParameters;
-  signerHeader?: JWSHeaderParameters;
-};
+/** `Shape` when `Alg` has a member of that family, else nothing: a family never appears for an `alg` it cannot carry. */
+type OctFor<Alg, Shape> = [Extract<Alg, Exclude<JWKAlgorithm, JWK_Asymmetric_Algorithm>>] extends [never] ? never : Shape;
+type RSAFor<Alg, Shape> = [Extract<Alg, JWK_RSA_SIGN | JWK_RSA_PSS | JWK_RSA_ENC>] extends [never] ? never : Shape;
+type ECFor<Alg, Shape> = [Extract<Alg, JWK_ECDSA | JWK_ECDH_ES>] extends [never] ? never : Shape;
+type OKPFor<Alg, Shape> = [Extract<Alg, JWK_OKP_SIGN | JWK_ECDH_ES>] extends [never] ? never : Shape;
 /** `oct` JWK algorithms admissible for JWE key management (HMAC excluded). */
 type _JWEOctAlg = JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW | JWK_AES_CBC_HMAC | JWK_PBES2 | "dir";
 /** Asymmetric public JWKs admissible for JWE encryption (RSA-OAEP or ECDH-ES). */
@@ -667,9 +710,9 @@ export type JWEDecryptJWK = JWK_oct<_JWEOctAlg> | JWEAsymmetricPrivateJWK;
 /** Recognized JWE Header Parameters; other members may also be present. */
 export interface JWEHeaderParameters extends JoseHeaderParameters {
   /** Key Management Algorithm. */
-  alg?: KeyManagementAlgorithm | (string & {});
+  alg?: KeyManagementAlgorithm;
   /** Content Encryption Algorithm. */
-  enc?: ContentEncryptionAlgorithm | (string & {});
+  enc?: ContentEncryptionAlgorithm;
   /** PBES2 Count. */
   p2c?: number;
   /** PBES2 Salt, base64url. */
@@ -800,8 +843,10 @@ export interface JWEMultiEncryptOptions extends StrictOmit<JWEEncryptOptions, "a
   /** External AAD (RFC 7516 §5.1); empty means none (RFC 7516 §7.2.1); not a string or bytes is `ERR_INVALID_OPTION`. */
   aad?: Uint8Array<ArrayBuffer> | string;
 }
+/** A key lookup for `decrypt`: it receives the validated JWE header. */
+export type JWEKeyLookup<TReturn = CryptoKey | JWK | JWKSet | string | Uint8Array<ArrayBuffer>> = JWKLookupFunction<TReturn, JWEHeaderParameters>;
 /** Key material `decryptMulti` accepts, or a function resolving it from the recipient's header. */
-export type JWEMultiDecryptKey = CryptoKey | JWKSet | JWEDecryptJWK | string | Uint8Array<ArrayBuffer> | JWKLookupFunction;
+export type JWEMultiDecryptKey = CryptoKey | JWKSet | JWEDecryptJWK | string | Uint8Array<ArrayBuffer> | JWEKeyLookup;
 /** Options for `decryptMulti`. */
 export interface JWEMultiDecryptOptions<Mode extends JOSEPayloadMode = JOSEPayloadMode> extends JWEDecryptOptions<Mode> {
   /** Max recipients (else `ERR_JWE_INVALID`), JWK Set candidates per recipient, and PBKDF2 iterations summed over the call. Default: `{ recipients: 16, keyCandidates: 8, pbes2Iterations: 2_400_000 }`. */