From 1304cdae56308aa420d3b03a60d85edd8d60051f Mon Sep 17 00:00:00 2001
From: Lilleman auf Larv <lilleman@larvit.se>
Date: Sun, 8 Nov 2026 23:13:58 +0100
Subject: [PATCH] Read JsonWebKey from webcrypto, where @types/node 26 exports
 it

---
 src/auth/gen-jwks.test.ts       | 3 ++-
 src/auth/jwks.test.ts           | 4 ++--
 src/auth/jwks.ts                | 5 ++++-
 src/auth/jwt-middleware.test.ts | 4 ++--
 src/auth/jwt.test.ts            | 3 ++-
 src/auth/jwt.ts                 | 3 ++-
 src/test-tooling/app-harness.ts | 3 ++-
 7 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/src/auth/gen-jwks.test.ts b/src/auth/gen-jwks.test.ts
index b129805..06c2e90 100644
--- a/src/auth/gen-jwks.test.ts
+++ b/src/auth/gen-jwks.test.ts
@@ -4,8 +4,9 @@
 import { test } from "node:test";
 import assert from "node:assert/strict";
 import { readFileSync } from "node:fs";
-import { createPrivateKey, sign, type JsonWebKey } from "node:crypto";
+import { createPrivateKey, sign } from "node:crypto";
 import { generateJwks, rotateJwks } from "./gen-jwks.ts";
+import type { JsonWebKey } from "./jwks.ts";
 import { verifyJws } from "./jwt.ts";
 
 const b64url = (s: string) => Buffer.from(s).toString("base64url");
diff --git a/src/auth/jwks.test.ts b/src/auth/jwks.test.ts
index e6330e3..b74b778 100644
--- a/src/auth/jwks.test.ts
+++ b/src/auth/jwks.test.ts
@@ -1,9 +1,9 @@
 import assert from "node:assert/strict";
-import { generateKeyPairSync, type JsonWebKey } from "node:crypto";
+import { generateKeyPairSync } from "node:crypto";
 import { dirname, join } from "node:path";
 import { test } from "node:test";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { cachingJwks, createJwksProvider, loadJwks, staticJwks } from "./jwks.ts";
+import { cachingJwks, createJwksProvider, loadJwks, staticJwks, type JsonWebKey } from "./jwks.ts";
 
 const jwk = (kid: string): JsonWebKey => ({ ...(generateKeyPairSync("ec", { namedCurve: "P-256" }).publicKey.export({ format: "jwk" }) as JsonWebKey), alg: "ES256", kid });
 const committed = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "ory/kratos/tokenizer/jwks.json");
diff --git a/src/auth/jwks.ts b/src/auth/jwks.ts
index 2cf5487..8a282fc 100644
--- a/src/auth/jwks.ts
+++ b/src/auth/jwks.ts
@@ -1,4 +1,4 @@
-import type { JsonWebKey } from "node:crypto";
+import type { webcrypto } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { currentLog } from "../logger.ts";
@@ -8,6 +8,9 @@ import { currentLog } from "../logger.ts";
 // (or re-reads a mounted file), caches for a TTL, and reloads once on a `kid` miss so a rotated-
 // in key is picked up without a restart (README: zero-downtime rotation). `createJwksProvider`
 // picks the right one from the configured URL scheme and primes it at boot (fail loud).
+// node:crypto exports the JWK type only under webcrypto since @types/node 26.
+export type JsonWebKey = webcrypto.JsonWebKey;
+
 export interface JwksProvider {
   getKey(kid: string | undefined): Promise<JsonWebKey | null>;
 }
diff --git a/src/auth/jwt-middleware.test.ts b/src/auth/jwt-middleware.test.ts
index 61cb9f0..3eec5ee 100644
--- a/src/auth/jwt-middleware.test.ts
+++ b/src/auth/jwt-middleware.test.ts
@@ -1,7 +1,7 @@
 import assert from "node:assert/strict";
-import { generateKeyPairSync, sign, type JsonWebKey, type KeyObject } from "node:crypto";
+import { generateKeyPairSync, sign, type KeyObject } from "node:crypto";
 import { test } from "node:test";
-import { staticJwks } from "./jwks.ts";
+import { staticJwks, type JsonWebKey } from "./jwks.ts";
 import { authenticate, claimsToUser, resolveSession, verifyToken } from "./jwt-middleware.ts";
 import { SESSION_COOKIE } from "./login.ts";
 
diff --git a/src/auth/jwt.test.ts b/src/auth/jwt.test.ts
index 83d8f64..04da47d 100644
--- a/src/auth/jwt.test.ts
+++ b/src/auth/jwt.test.ts
@@ -1,6 +1,7 @@
 import assert from "node:assert/strict";
 import { generateKeyPairSync, sign } from "node:crypto";
-import type { JsonWebKey, KeyObject } from "node:crypto";
+import type { KeyObject } from "node:crypto";
+import type { JsonWebKey } from "./jwks.ts";
 import { test } from "node:test";
 import { decodeJws, verifyJws } from "./jwt.ts";
 
diff --git a/src/auth/jwt.ts b/src/auth/jwt.ts
index d3017d2..ca211ed 100644
--- a/src/auth/jwt.ts
+++ b/src/auth/jwt.ts
@@ -1,5 +1,6 @@
 import { createPublicKey, verify } from "node:crypto";
-import type { JsonWebKey, KeyObject } from "node:crypto";
+import type { KeyObject } from "node:crypto";
+import type { JsonWebKey } from "./jwks.ts";
 
 // JWS signature verification with the Node stdlib — no `jose`/JWT dep:
 // `createPublicKey({format:"jwk"})` imports a JWK and verifies the RS*/ES* signatures
diff --git a/src/test-tooling/app-harness.ts b/src/test-tooling/app-harness.ts
index 23f7ca9..827e08a 100644
--- a/src/test-tooling/app-harness.ts
+++ b/src/test-tooling/app-harness.ts
@@ -1,4 +1,5 @@
-import { generateKeyPairSync, sign, type JsonWebKey } from "node:crypto";
+import { generateKeyPairSync, sign } from "node:crypto";
+import type { JsonWebKey } from "../auth/jwks.ts";
 import type { AddressInfo } from "node:net";
 import type { TestContext } from "node:test";
 import type { HydraAdmin } from "../auth/hydra-admin.ts";