jwt

type Error struct {
	// Kind names the gem exception class (e.g. "JWT::ExpiredSignature").
	Kind string
	// Message is the human-readable text, byte-for-byte the gem's message.
	Message string
	// contains filtered or unexported fields
}

type JWK struct {
	// Kty is "RSA" or "EC".
	Kty string
	// Crv is the EC curve name ("P-256"/"P-384"/"P-521"), empty for RSA.
	Crv string
	// N, E are the base64url RSA modulus and exponent (RSA only).
	N, E string
	// X, Y are the base64url EC coordinates (EC only).
	X, Y string
	// Kid is the key id. For a JWK built locally with NewJWK it is the gem's
	// default key_digest (see below); for a JWK read from JSON with ParseJWK /
	// ParseJWKS it is the provider-assigned "kid" carried on the wire, used to
	// select the key by JWKS.Find / JWKS.Select.
	Kid string
	// Alg is the intended JWS algorithm ("RS256", "ES256", …) when the JWK
	// declares one, or "" otherwise. Only populated by ParseJWK / ParseJWKS.
	Alg string
	// Use is the intended public-key use ("sig"/"enc") when declared, or "".
	// Only populated by ParseJWK / ParseJWKS.
	Use string
	// contains filtered or unexported fields
}

type JWKS struct {
	// contains filtered or unexported fields
}

type Options struct {
	// Algorithms is the allow-list of acceptable "alg" header values (the gem's
	// algorithm:/algorithms: options). A token whose alg is not listed is rejected
	// with IncorrectAlgorithm — the alg-confusion guard. Empty (with verify=true)
	// is an error, matching the gem's "An algorithm must be specified".
	Algorithms []string

	// Leeway is the clock-skew allowance (seconds) applied to exp, nbf and iat.
	Leeway int64
	// ExpLeeway / NbfLeeway override Leeway for the respective claim when non-nil.
	ExpLeeway *int64
	NbfLeeway *int64

	// VerifyExpiration toggles the exp check; the gem defaults it on, so this
	// package treats it as on unless explicitly disabled via VerifyExpirationSet.
	VerifyExpiration    bool
	VerifyExpirationSet bool // distinguishes "false" from "unset (=> true)"

	// VerifyNotBefore toggles the nbf check (gem default on; same set-flag rule).
	VerifyNotBefore    bool
	VerifyNotBeforeSet bool

	// VerifyIat, when true, rejects a payload whose iat is malformed or in the
	// future (the gem's verify_iat:).
	VerifyIat bool

	// Issuer + VerifyIss check the iss claim. Issuer may be a single string or a
	// []string of acceptable issuers.
	Issuer    any
	VerifyIss bool

	// Audience + VerifyAud check the aud claim. Either side may be a string or a
	// []string; the check passes when they intersect.
	Audience  any
	VerifyAud bool

	// Subject + VerifySub check the sub claim against an expected string.
	Subject   string
	VerifySub bool

	// VerifyJti, when true, requires the jti claim to be present and non-empty.
	// A JtiValidator, when set, replaces that default with a custom predicate.
	VerifyJti    bool
	JtiValidator func(jti any) bool

	// RequiredClaims lists claim names that must be present in the payload
	// (the gem's required_claims:).
	RequiredClaims []string
}

type OrderedMap struct {
	// contains filtered or unexported fields
}