Read JsonWebKey from webcrypto, where @types/node 26 exports it

src/auth/gen-jwks.test.ts

@@ -4,8 +4,9 @@
 import { test } from "node:test";
 import assert from "node:assert/strict";
 import { readFileSync } from "node:fs";
-import { createPrivateKey, sign, type JsonWebKey } from "node:crypto";
+import { createPrivateKey, sign } from "node:crypto";
 import { generateJwks, rotateJwks } from "./gen-jwks.ts";
+import type { JsonWebKey } from "./jwks.ts";
 import { verifyJws } from "./jwt.ts";
 
 const b64url = (s: string) => Buffer.from(s).toString("base64url");

src/auth/jwks.test.ts

@@ -1,9 +1,9 @@
 import assert from "node:assert/strict";
-import { generateKeyPairSync, type JsonWebKey } from "node:crypto";
+import { generateKeyPairSync } from "node:crypto";
 import { dirname, join } from "node:path";
 import { test } from "node:test";
 import { fileURLToPath, pathToFileURL } from "node:url";
-import { cachingJwks, createJwksProvider, loadJwks, staticJwks } from "./jwks.ts";
+import { cachingJwks, createJwksProvider, loadJwks, staticJwks, type JsonWebKey } from "./jwks.ts";
 
 const jwk = (kid: string): JsonWebKey => ({ ...(generateKeyPairSync("ec", { namedCurve: "P-256" }).publicKey.export({ format: "jwk" }) as JsonWebKey), alg: "ES256", kid });
 const committed = join(dirname(fileURLToPath(import.meta.url)), "..", "..", "ory/kratos/tokenizer/jwks.json");

src/auth/jwks.ts

@@ -1,4 +1,4 @@
-import type { JsonWebKey } from "node:crypto";
+import type { webcrypto } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { currentLog } from "../logger.ts";
@@ -8,6 +8,9 @@ import { currentLog } from "../logger.ts";
 // (or re-reads a mounted file), caches for a TTL, and reloads once on a `kid` miss so a rotated-
 // in key is picked up without a restart (README: zero-downtime rotation). `createJwksProvider`
 // picks the right one from the configured URL scheme and primes it at boot (fail loud).
+// node:crypto exports the JWK type only under webcrypto since @types/node 26.
+export type JsonWebKey = webcrypto.JsonWebKey;
+
 export interface JwksProvider {
   getKey(kid: string | undefined): Promise<JsonWebKey | null>;
 }

src/auth/jwt-middleware.test.ts

@@ -1,7 +1,7 @@
 import assert from "node:assert/strict";
-import { generateKeyPairSync, sign, type JsonWebKey, type KeyObject } from "node:crypto";
+import { generateKeyPairSync, sign, type KeyObject } from "node:crypto";
 import { test } from "node:test";
-import { staticJwks } from "./jwks.ts";
+import { staticJwks, type JsonWebKey } from "./jwks.ts";
 import { authenticate, claimsToUser, resolveSession, verifyToken } from "./jwt-middleware.ts";
 import { SESSION_COOKIE } from "./login.ts";
 

src/auth/jwt.test.ts

@@ -1,6 +1,7 @@
 import assert from "node:assert/strict";
 import { generateKeyPairSync, sign } from "node:crypto";
-import type { JsonWebKey, KeyObject } from "node:crypto";
+import type { KeyObject } from "node:crypto";
+import type { JsonWebKey } from "./jwks.ts";
 import { test } from "node:test";
 import { decodeJws, verifyJws } from "./jwt.ts";
 

src/auth/jwt.ts

@@ -1,5 +1,6 @@
 import { createPublicKey, verify } from "node:crypto";
-import type { JsonWebKey, KeyObject } from "node:crypto";
+import type { KeyObject } from "node:crypto";
+import type { JsonWebKey } from "./jwks.ts";
 
 // JWS signature verification with the Node stdlib — no `jose`/JWT dep:
 // `createPublicKey({format:"jwk"})` imports a JWK and verifies the RS*/ES* signatures

src/test-tooling/app-harness.ts

@@ -1,4 +1,5 @@
-import { generateKeyPairSync, sign, type JsonWebKey } from "node:crypto";
+import { generateKeyPairSync, sign } from "node:crypto";
+import type { JsonWebKey } from "../auth/jwks.ts";
 import type { AddressInfo } from "node:net";
 import type { TestContext } from "node:test";
 import type { HydraAdmin } from "../auth/hydra-admin.ts";