-type claims() :: #{binary() => term()}.

-type error() ::
          no_matching_key | invalid_jwt_token |
          {no_matching_key_with_kid, Kid :: binary()} |
          none_alg_used |
          {none_alg_used,
           Jwt :: #jose_jwt{fields :: map()},
           Jws ::
               #jose_jws{alg :: undefined | {module(), any()},
                         b64 :: undefined | boolean(),
                         fields :: map()}} |
          not_encrypted.

-type refresh_jwks_for_unknown_kid_fun() ::
          fun((Jwks :: jose_jwk:key(), Kid :: binary()) -> {ok, jose_jwk:key()} | {error, term()}).