/**
 * Derive a public JWK from a private one.
 *
 * Strips the private components for both EC keys (drops `d`) and RSA keys
 * (drops `d`, `p`, `q`, `dp`, `dq`, `qi`, and `oth` — the additional-primes
 * array on multi-prime RSA keys). The result is safe to publish at
 * `<url>/.well-known/jwks.json` so downstream verifiers can validate
 * signatures the server produced.
 */

export function derivePublicJwk(privateKey: JsonWebKey): Record<string, unknown> {
  // oxlint-disable-next-line no-unused-vars
  const { d, p, q, dp, dq, qi, oth, ...publicJwk } = privateKey as unknown as Record<
    string,
    unknown
  >
  return publicJwk
}