unjwt 0.5.0 → 0.5.1

package/README.md

@@ -1,9 +1,10 @@
 # unjwt
 
-<!-- automd:badges color=yellow -->
+<!-- automd:badges bundlephobia style="flat" color="FFDC3B" -->
 
-[![npm version](https://img.shields.io/npm/v/unjwt?color=yellow)](https://npmjs.com/package/unjwt)
-[![npm downloads](https://img.shields.io/npm/dm/unjwt?color=yellow)](https://npm.chart.dev/unjwt)
+[![npm version](https://img.shields.io/npm/v/unjwt?color=FFDC3B)](https://npmjs.com/package/unjwt)
+[![npm downloads](https://img.shields.io/npm/dm/unjwt?color=FFDC3B)](https://npm.chart.dev/unjwt)
+[![bundle size](https://img.shields.io/bundlephobia/minzip/unjwt?color=FFDC3B)](https://bundlephobia.com/package/unjwt)
 
 <!-- /automd -->
 
@@ -13,6 +14,14 @@ A collection of low-level JWT ([RFC 7519](https://datatracker.ietf.org/doc/html/
 - **JWE (JSON Web Encryption, [RFC 7516](https://datatracker.ietf.org/doc/html/rfc7516))**: encrypt and decrypt data using various key management algorithms (AES Key Wrap, AES-GCM Key Wrap, RSA-OAEP, PBES2, ECDH-ES) and content encryption algorithms (AES-GCM, AES-CBC HMAC-SHA2).
 - **JWK (JSON Web Key, [RFC 7517](https://datatracker.ietf.org/doc/html/rfc7517))**: generate, import, export, wrap, and unwrap keys in JWK format or as `CryptoKey` objects.
 
+> [!WARNING]
+> Please do note that some algorithms are not fully working out-of-the-box yet, such as:
+>
+> - ECDH-ES algorithms with AES Key Wrap (e.g., ECDH-ES+A128KW)
+> - RSA algorithms in combination with some bigger CBC encodings (for example RSA-OAEP-256 with A256CBC-HS512)
+>
+> For these algorithms, you should be able to provide your own keys. Although I do plan to study and simplify this.
+
 ## Usage
 
 Install the package:
@@ -48,8 +57,8 @@ import { base64UrlEncode, base64UrlDecode, randomBytes } from "unjwt/utils";
 **CDN** (Deno, Bun and Browsers)
 
 ```js
-// JWS functions
 import { jws, jwe, jwk } from "https://esm.sh/unjwt";
+// JWS functions
 import { sign, verify } from "https://esm.sh/unjwt/jws";
 // JWE functions
 import { encrypt, decrypt } from "https://esm.sh/unjwt/jwe";
@@ -488,6 +497,82 @@ async function unwrapMyKey(encryptedKey: Uint8Array, kdk: CryptoKey) {
 }
 ```
 
+#### `importJWKFromPEM(pem, pemType, alg, importOptions?, jwkExtras?)`
+
+Imports a key from a PEM-encoded string and converts it to a JWK.
+
+- `pem`: The PEM-encoded string (including `-----BEGIN ...-----` and `-----END ...-----` markers).
+- `pemType`: The type of PEM encoding:
+  - `"pkcs8"`: For private keys in PKCS#8 format.
+  - `"spki"`: For public keys in SPKI format.
+  - `"x509"`: For X.509 certificates (extracts the public key).
+- `alg`: The JWA algorithm identifier (e.g., `"RS256"`, `"ES256"`). This is crucial for `crypto.subtle.importKey` to understand the key's intended algorithm and for setting the `'alg'` field in the resulting JWK.
+- `importOptions` (optional): Options for the underlying `crypto.subtle.importKey` call:
+  - `extractable`: Boolean, whether the imported `CryptoKey` should be extractable. Defaults to `true`.
+  - `keyUsage`: Array of `KeyUsage` strings for the imported `CryptoKey`.
+- `jwkExtras` (optional): An object containing additional properties to merge into the resulting JWK (e.g., `"kid"`, `"use"`).
+
+Returns a `Promise<JWK>` resolving to the imported key as a JWK.
+
+**Example:**
+
+```ts
+import { importJWKFromPEM } from "unjwt/jwk";
+
+const rsaPublicJwk = await importJWKFromPEM(
+  provess.env.RSA_PEM_SPKI, // PEM string
+  "spki",
+  "RS256",
+  { extractable: false },
+  { kid: "my-rsa-key" }, // Additional properties to add to the JWK
+);
+console.log(rsaPublicJwk);
+// {
+//   kty: 'RSA',
+//   alg: 'RS256',
+//   kid: 'my-rsa-key',
+//   n: '...',
+//   e: 'AQAB',
+//   ext: false,
+//   key_ops: [ 'verify' ]
+// }
+```
+
+#### exportJWKToPEM(jwk, pemFormat, algForCryptoKeyImport?)
+
+Exports a JWK to a PEM-encoded string.
+
+- jwk: The JWK to export.
+- pemFormat: The desired PEM format:
+  - "pkcs8": For private keys in PKCS#8 format.
+  - "spki": For public keys in SPKI format.
+- algForCryptoKeyImport (optional): If the JWK does not have an 'alg' property, this algorithm hint is required to correctly convert it to a CryptoKey first. This is only needed if the JWK lacks an alg property.
+
+Returns a `Promise<string>` resolving to the PEM-encoded key string.
+
+Example:
+
+```ts
+import { exportJWKToPEM } from "unjwt/jwk";
+import { rsaJWK } from "./keys"; // Assuming you have JWKs in keys.ts
+
+const rsaPrivatePem = await exportJWKToPEM(rsaJWK.private, "pkcs8");
+console.log(rsaPrivatePem);
+// -----BEGIN PRIVATE KEY-----
+// MII...
+// -----END PRIVATE KEY-----
+
+const rsaPublicSpki = await exportJWKToPEM(
+  rsaJWK.public,
+  "spki",
+  "RS256", // this is required if `rsaJWK.public.alg` is undefined
+);
+console.log(rsaPublicSpki);
+// -----BEGIN PUBLIC KEY-----
+// MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQE...
+// -----END PUBLIC KEY-----
+```
+
 ### Utility Functions
 
 `unjwt/utils` exports several helpful functions:

package/dist/index.d.mts

@@ -1,6 +1,6 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, A as JWKAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, z as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, y as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.C0bBN0AC.mjs';
-export { b as JWT, a as JWTClaims, J as JoseHeaderParameters } from './shared/unjwt.D90BbcE1.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.DYFIh1YE.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.Dz5Oe9BG.mjs';
-export { i as utils } from './shared/unjwt.CJ_ohCFC.mjs';
-export { j as jwk } from './shared/unjwt.B9uGngq-.mjs';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, B as JWKAlgorithm, E as JWKPEMAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, A as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, y as JWK_ED, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, z as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CxhGjEAX.mjs';
+export { b as JWT, a as JWTClaims, J as JoseHeaderParameters } from './shared/unjwt.Cd9nTEWg.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.BG_R52ey.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.DQIYSlHj.mjs';
+export { i as utils } from './shared/unjwt.B4fFiy1c.mjs';
+export { j as jwk } from './shared/unjwt.D1J1DelP.mjs';

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, A as JWKAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, z as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, y as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.C0bBN0AC.js';
-export { b as JWT, a as JWTClaims, J as JoseHeaderParameters } from './shared/unjwt.DoVzOnty.js';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.ppm5Y0k7.js';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.BKG_8Y9G.js';
-export { i as utils } from './shared/unjwt.mc4AEAT7.js';
-export { j as jwk } from './shared/unjwt.BOEZHxi_.js';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, B as JWKAlgorithm, E as JWKPEMAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, A as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, y as JWK_ED, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, z as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CxhGjEAX.js';
+export { b as JWT, a as JWTClaims, J as JoseHeaderParameters } from './shared/unjwt.BISJ5yt1.js';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.CVKbKOFy.js';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.B0XDPf8a.js';
+export { i as utils } from './shared/unjwt.DqmNvXMd.js';
+export { j as jwk } from './shared/unjwt.WvWb2zNM.js';

package/dist/index.mjs

@@ -1,5 +1,5 @@
-export { i as utils } from './shared/unjwt.CjHZv3F3.mjs';
-export { j as jwe } from './shared/unjwt.B4e_rwol.mjs';
-export { j as jwk } from './shared/unjwt.DKq5VF7t.mjs';
-export { j as jws } from './shared/unjwt.Bzcov22m.mjs';
-import './shared/unjwt.sux3_Z19.mjs';
+export { i as utils } from './shared/unjwt.DHdDAH0L.mjs';
+export { j as jwe } from './shared/unjwt.Ce72NmIz.mjs';
+export { j as jwk } from './shared/unjwt.1gbuWbc6.mjs';
+export { j as jws } from './shared/unjwt.BxqF-n1S.mjs';
+import './shared/unjwt.C9Xhi7hE.mjs';

package/dist/jwe.d.mts

@@ -1,3 +1,3 @@
-import './shared/unjwt.C0bBN0AC.mjs';
-import './shared/unjwt.D90BbcE1.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.Dz5Oe9BG.mjs';
+import './shared/unjwt.CxhGjEAX.mjs';
+import './shared/unjwt.Cd9nTEWg.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.DQIYSlHj.mjs';

package/dist/jwe.d.ts

@@ -1,3 +1,3 @@
-import './shared/unjwt.C0bBN0AC.js';
-import './shared/unjwt.DoVzOnty.js';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.BKG_8Y9G.js';
+import './shared/unjwt.CxhGjEAX.js';
+import './shared/unjwt.BISJ5yt1.js';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.B0XDPf8a.js';

package/dist/jwe.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.DKq5VF7t.mjs';
-import './shared/unjwt.CjHZv3F3.mjs';
-export { d as decrypt, e as encrypt } from './shared/unjwt.B4e_rwol.mjs';
-import './shared/unjwt.sux3_Z19.mjs';
+import './shared/unjwt.1gbuWbc6.mjs';
+import './shared/unjwt.DHdDAH0L.mjs';
+export { d as decrypt, e as encrypt } from './shared/unjwt.Ce72NmIz.mjs';
+import './shared/unjwt.C9Xhi7hE.mjs';

package/dist/jwk.d.mts

@@ -1,2 +1,2 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, A as JWKAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, z as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, y as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.C0bBN0AC.mjs';
-export { d as deriveKeyFromPassword, e as exportKey, g as generateKey, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.B9uGngq-.mjs';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, B as JWKAlgorithm, E as JWKPEMAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, A as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, y as JWK_ED, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, z as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CxhGjEAX.mjs';
+export { d as deriveKeyFromPassword, b as exportJWKToPEM, e as exportKey, g as generateKey, a as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.D1J1DelP.mjs';

package/dist/jwk.d.ts

@@ -1,2 +1,2 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, A as JWKAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, z as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, y as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.C0bBN0AC.js';
-export { d as deriveKeyFromPassword, e as exportKey, g as generateKey, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.BOEZHxi_.js';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, B as JWKAlgorithm, E as JWKPEMAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, A as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, y as JWK_ED, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, z as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CxhGjEAX.js';
+export { d as deriveKeyFromPassword, b as exportJWKToPEM, e as exportKey, g as generateKey, a as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.WvWb2zNM.js';

package/dist/jwk.mjs

@@ -1,2 +1,2 @@
-import './shared/unjwt.CjHZv3F3.mjs';
-export { o as deriveKeyFromPassword, p as exportKey, n as generateKey, i as importKey, l as unwrapKey, q as wrapKey } from './shared/unjwt.DKq5VF7t.mjs';
+import './shared/unjwt.DHdDAH0L.mjs';
+export { o as deriveKeyFromPassword, s as exportJWKToPEM, p as exportKey, n as generateKey, r as importJWKFromPEM, i as importKey, l as unwrapKey, q as wrapKey } from './shared/unjwt.1gbuWbc6.mjs';

package/dist/jws.d.mts

@@ -1,3 +1,3 @@
-import './shared/unjwt.C0bBN0AC.mjs';
-import './shared/unjwt.D90BbcE1.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.DYFIh1YE.mjs';
+import './shared/unjwt.CxhGjEAX.mjs';
+import './shared/unjwt.Cd9nTEWg.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.BG_R52ey.mjs';

package/dist/jws.d.ts

@@ -1,3 +1,3 @@
-import './shared/unjwt.C0bBN0AC.js';
-import './shared/unjwt.DoVzOnty.js';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.ppm5Y0k7.js';
+import './shared/unjwt.CxhGjEAX.js';
+import './shared/unjwt.BISJ5yt1.js';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.CVKbKOFy.js';

package/dist/jws.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.DKq5VF7t.mjs';
-import './shared/unjwt.CjHZv3F3.mjs';
-import './shared/unjwt.sux3_Z19.mjs';
-export { s as sign, v as verify } from './shared/unjwt.Bzcov22m.mjs';
+import './shared/unjwt.1gbuWbc6.mjs';
+import './shared/unjwt.DHdDAH0L.mjs';
+import './shared/unjwt.C9Xhi7hE.mjs';
+export { s as sign, v as verify } from './shared/unjwt.BxqF-n1S.mjs';

package/dist/shared/{unjwt.DKq5VF7t.mjs → unjwt.1gbuWbc6.mjs}

@@ -1,4 +1,4 @@
-import { g as isCryptoKey, e as concatUint8Arrays, b as base64UrlEncode, t as textEncoder, r as randomBytes, a as isJWK, d as base64UrlDecode } from './unjwt.CjHZv3F3.mjs';
+import { g as isCryptoKey, e as concatUint8Arrays, b as base64UrlEncode, h as base64Decode, j as base64Encode, t as textEncoder, r as randomBytes, a as isJWK, d as base64UrlDecode } from './unjwt.DHdDAH0L.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -113,7 +113,7 @@ function isAlgorithm(algorithm, name) {
 function getHashLength(hash) {
   return Number.parseInt(hash.name.slice(4), 10);
 }
-function getNamedCurve(alg) {
+function getNamedCurve$1(alg) {
   switch (alg) {
     case "ES256": {
       return "P-256";
@@ -182,7 +182,7 @@ function checkSigCryptoKey(key, alg, usage) {
     case "ES512": {
       if (!isAlgorithm(key.algorithm, "ECDSA"))
         throw unusable("ECDSA");
-      const expected = getNamedCurve(alg);
+      const expected = getNamedCurve$1(alg);
       const actual = key.algorithm.namedCurve;
       if (actual !== expected) throw unusable(expected, "algorithm.namedCurve");
       break;
@@ -511,6 +511,251 @@ async function decryptIV(alg, key, encryptedKey, iv, tag) {
   return decrypt(jweAlgorithm, key, encryptedKey, iv, tag, new Uint8Array(0));
 }
 
+/**
+ * This is a fork of Jose library's utility functions.
+ * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/asn1.ts
+ * @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
+ */
+const formatPEM = (b64, descriptor) => {
+  const newlined = (b64.match(/.{1,64}/g) || []).join("\n");
+  return `-----BEGIN ${descriptor}-----
+${newlined}
+-----END ${descriptor}-----`;
+};
+const genericExport = async (keyType, keyFormat, key) => {
+  if (!isCryptoKey(key)) {
+    throw new TypeError(`Key must be ${key} of type CryptoKey`);
+  }
+  if (!key.extractable) {
+    throw new TypeError("CryptoKey is not extractable");
+  }
+  if (key.type !== keyType) {
+    throw new TypeError(`key is not a ${keyType} key`);
+  }
+  return formatPEM(
+    base64Encode(new Uint8Array(await crypto.subtle.exportKey(keyFormat, key))),
+    `${keyType.toUpperCase()} KEY`
+  );
+};
+const toSPKI = (key) => {
+  return genericExport("public", "spki", key);
+};
+const toPKCS8 = (key) => {
+  return genericExport("private", "pkcs8", key);
+};
+const findOid = (keyData, oid, from = 0) => {
+  if (from === 0) {
+    oid.unshift(oid.length);
+    oid.unshift(6);
+  }
+  const i = keyData.indexOf(oid[0], from);
+  if (i === -1) return false;
+  const sub = keyData.subarray(i, i + oid.length);
+  if (sub.length !== oid.length) return false;
+  return sub.every((value, index) => value === oid[index]) || findOid(keyData, oid, i + 1);
+};
+const getNamedCurve = (keyData) => {
+  switch (true) {
+    case findOid(keyData, [42, 134, 72, 206, 61, 3, 1, 7]): {
+      return "P-256";
+    }
+    case findOid(keyData, [43, 129, 4, 0, 34]): {
+      return "P-384";
+    }
+    case findOid(keyData, [43, 129, 4, 0, 35]): {
+      return "P-521";
+    }
+    default: {
+      return void 0;
+    }
+  }
+};
+const genericImport = async (replace, keyFormat, pem, alg, options) => {
+  let algorithm;
+  let keyUsages;
+  const cleanedPem = pem.replace(replace, "");
+  const keyData = base64Decode(cleanedPem, false);
+  const isPublic = keyFormat === "spki";
+  switch (alg) {
+    case "PS256":
+    case "PS384":
+    case "PS512": {
+      algorithm = { name: "RSA-PSS", hash: `SHA-${alg.slice(-3)}` };
+      keyUsages = isPublic ? ["verify"] : ["sign"];
+      break;
+    }
+    case "RS256":
+    case "RS384":
+    case "RS512": {
+      algorithm = { name: "RSASSA-PKCS1-v1_5", hash: `SHA-${alg.slice(-3)}` };
+      keyUsages = isPublic ? ["verify"] : ["sign"];
+      break;
+    }
+    case "RSA-OAEP":
+    case "RSA-OAEP-256":
+    case "RSA-OAEP-384":
+    case "RSA-OAEP-512": {
+      algorithm = {
+        name: "RSA-OAEP",
+        hash: `SHA-${Number.parseInt(alg.slice(-3), 10) || 1}`
+      };
+      keyUsages = isPublic ? ["encrypt", "wrapKey"] : ["decrypt", "unwrapKey"];
+      break;
+    }
+    case "ES256": {
+      algorithm = { name: "ECDSA", namedCurve: "P-256" };
+      keyUsages = isPublic ? ["verify"] : ["sign"];
+      break;
+    }
+    case "ES384": {
+      algorithm = { name: "ECDSA", namedCurve: "P-384" };
+      keyUsages = isPublic ? ["verify"] : ["sign"];
+      break;
+    }
+    case "ES512": {
+      algorithm = { name: "ECDSA", namedCurve: "P-521" };
+      keyUsages = isPublic ? ["verify"] : ["sign"];
+      break;
+    }
+    case "ECDH-ES":
+    case "ECDH-ES+A128KW":
+    case "ECDH-ES+A192KW":
+    case "ECDH-ES+A256KW": {
+      const namedCurve = getNamedCurve(keyData);
+      algorithm = namedCurve?.startsWith("P-") ? { name: "ECDH", namedCurve } : { name: "X25519" };
+      keyUsages = isPublic ? [] : ["deriveBits"];
+      break;
+    }
+    case "Ed25519":
+    case "EdDSA": {
+      algorithm = { name: "Ed25519" };
+      keyUsages = isPublic ? ["verify"] : ["sign"];
+      break;
+    }
+    default: {
+      throw new Error('Invalid or unsupported "alg" (Algorithm) value');
+    }
+  }
+  return crypto.subtle.importKey(
+    keyFormat,
+    keyData,
+    algorithm,
+    options?.extractable ?? (isPublic ? true : false),
+    keyUsages
+  );
+};
+const fromPKCS8 = (pem, alg, options) => {
+  return genericImport(
+    /(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g,
+    "pkcs8",
+    pem,
+    alg,
+    options
+  );
+};
+const fromSPKI = (pem, alg, options) => {
+  return genericImport(
+    /(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g,
+    "spki",
+    pem,
+    alg,
+    options
+  );
+};
+function getElement(seq) {
+  const result = [];
+  let next = 0;
+  while (next < seq.length) {
+    const nextPart = parseElement(seq.subarray(next));
+    result.push(nextPart);
+    next += nextPart.byteLength;
+  }
+  return result;
+}
+function parseElement(bytes) {
+  let position = 0;
+  let tag = bytes[0] & 31;
+  position++;
+  if (tag === 31) {
+    tag = 0;
+    while (bytes[position] >= 128) {
+      tag = tag * 128 + bytes[position] - 128;
+      position++;
+    }
+    tag = tag * 128 + bytes[position] - 128;
+    position++;
+  }
+  let length = 0;
+  if (bytes[position] < 128) {
+    length = bytes[position];
+    position++;
+  } else if (length === 128) {
+    length = 0;
+    while (bytes[position + length] !== 0 || bytes[position + length + 1] !== 0) {
+      if (length > bytes.byteLength) {
+        throw new TypeError("invalid indefinite form length");
+      }
+      length++;
+    }
+    const byteLength2 = position + length + 2;
+    return {
+      byteLength: byteLength2,
+      contents: bytes.subarray(position, position + length),
+      raw: bytes.subarray(0, byteLength2)
+    };
+  } else {
+    const numberOfDigits = bytes[position] & 127;
+    position++;
+    length = 0;
+    for (let i = 0; i < numberOfDigits; i++) {
+      length = length * 256 + bytes[position];
+      position++;
+    }
+  }
+  const byteLength = position + length;
+  return {
+    byteLength,
+    contents: bytes.subarray(position, byteLength),
+    raw: bytes.subarray(0, byteLength)
+  };
+}
+function spkiFromX509(buf) {
+  const tbsCertificate = getElement(
+    getElement(parseElement(buf).contents)[0].contents
+  );
+  return base64Encode(
+    tbsCertificate[tbsCertificate[0].raw[0] === 160 ? 6 : 5].raw
+  );
+}
+let createPublicKey;
+function getSPKI(x509) {
+  try {
+    createPublicKey ??= globalThis.process?.getBuiltinModule?.("node:crypto")?.createPublicKey;
+  } catch {
+    createPublicKey = 0;
+  }
+  if (createPublicKey) {
+    try {
+      return new createPublicKey(x509).export({ format: "pem", type: "spki" });
+    } catch {
+    }
+  }
+  const pem = x509.replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g, "");
+  const raw = base64Decode(pem, false);
+  return formatPEM(spkiFromX509(raw), "PUBLIC KEY");
+}
+const fromX509 = (pem, alg, options) => {
+  let spki;
+  try {
+    spki = getSPKI(pem);
+  } catch (error_) {
+    throw new TypeError("Failed to parse the X.509 certificate", {
+      cause: error_
+    });
+  }
+  return fromSPKI(spki, alg, options);
+};
+
 /**
  * This is a fork of Jose library's utility functions.
  * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/jwt_to_key.ts
@@ -1064,6 +1309,80 @@ async function unwrapKey(alg, wrappedKey, unwrappingKey, options = {}) {
   );
   return finalKey;
 }
+async function importJWKFromPEM(pem, pemType, alg, importOptions, jwkExtras) {
+  let cryptoKey;
+  const defaultExtractable = importOptions?.extractable !== false;
+  switch (pemType) {
+    case "pkcs8": {
+      cryptoKey = await fromPKCS8(pem, alg, {
+        ...importOptions,
+        extractable: defaultExtractable
+      });
+      break;
+    }
+    case "spki": {
+      cryptoKey = await fromSPKI(pem, alg, {
+        ...importOptions,
+        extractable: defaultExtractable
+      });
+      break;
+    }
+    case "x509": {
+      cryptoKey = await fromX509(pem, alg, {
+        ...importOptions,
+        extractable: defaultExtractable
+      });
+      break;
+    }
+    default: {
+      throw new TypeError(`Unsupported PEM type: ${pemType}`);
+    }
+  }
+  const finalJWKExtras = { alg, ...jwkExtras };
+  return exportKey(cryptoKey, finalJWKExtras);
+}
+async function exportJWKToPEM(jwk, pemFormat, algForCryptoKeyImport) {
+  if (jwk.kty === "oct") {
+    throw new TypeError(
+      "Octet (symmetric) JWKs (kty: 'oct') cannot be exported to PKCS8 or SPKI PEM formats."
+    );
+  }
+  const effectiveAlg = jwk.alg || algForCryptoKeyImport;
+  if (!effectiveAlg && (jwk.kty === "RSA" || jwk.kty === "EC" || jwk.kty === "OKP")) {
+    throw new TypeError(
+      "Algorithm (alg) must be provided in the JWK or as a parameter for converting this JWK type to a CryptoKey."
+    );
+  }
+  const jwkForImport = { ...jwk, ext: true };
+  const cryptoKeyCandidate = await importKey(jwkForImport, effectiveAlg);
+  if (!isCryptoKey(cryptoKeyCandidate)) {
+    throw new Error(
+      "Failed to convert JWK to a CryptoKey instance suitable for PEM export."
+    );
+  }
+  const cryptoKey = cryptoKeyCandidate;
+  switch (pemFormat) {
+    case "pkcs8": {
+      if (cryptoKey.type !== "private") {
+        throw new TypeError(
+          `Only 'private' type CryptoKeys can be exported to PKCS8 PEM format. Key type is '${cryptoKey.type}'.`
+        );
+      }
+      return toPKCS8(cryptoKey);
+    }
+    case "spki": {
+      if (cryptoKey.type !== "public") {
+        throw new TypeError(
+          `Only 'public' type CryptoKeys can be exported to SPKI PEM format. Key type is '${cryptoKey.type}'.`
+        );
+      }
+      return toSPKI(cryptoKey);
+    }
+    default: {
+      throw new TypeError(`Unsupported PEM format: ${pemFormat}`);
+    }
+  }
+}
 function getGenerateKeyParams(alg, options) {
   let algorithm;
   let keyUsages;
@@ -1176,11 +1495,13 @@ function getGenerateKeyParams(alg, options) {
 const jwk = {
   __proto__: null,
   deriveKeyFromPassword: deriveKeyFromPassword,
+  exportJWKToPEM: exportJWKToPEM,
   exportKey: exportKey,
   generateKey: generateKey,
+  importJWKFromPEM: importJWKFromPEM,
   importKey: importKey,
   unwrapKey: unwrapKey,
   wrapKey: wrapKey
 };
 
-export { checkEncCryptoKey as a, bitLengthCEK as b, checkSigCryptoKey as c, jwkTokey as d, encryptIV as e, generateIV as f, generateCEK as g, encrypt as h, importKey as i, jwk as j, keyToJWK as k, unwrapKey as l, decrypt as m, generateKey as n, deriveKeyFromPassword as o, exportKey as p, wrapKey as q, uint32be as u, wrap as w };
+export { checkEncCryptoKey as a, bitLengthCEK as b, checkSigCryptoKey as c, jwkTokey as d, encryptIV as e, generateIV as f, generateCEK as g, encrypt as h, importKey as i, jwk as j, keyToJWK as k, unwrapKey as l, decrypt as m, generateKey as n, deriveKeyFromPassword as o, exportKey as p, wrapKey as q, importJWKFromPEM as r, exportJWKToPEM as s, uint32be as u, wrap as w };

package/dist/shared/{unjwt.BKG_8Y9G.d.ts → unjwt.B0XDPf8a.d.ts}

@@ -1,5 +1,5 @@
-import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, f as JWK_EC_Public, m as JWK } from './unjwt.C0bBN0AC.js';
-import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.DoVzOnty.js';
+import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, f as JWK_EC_Public, m as JWK } from './unjwt.CxhGjEAX.js';
+import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.BISJ5yt1.js';
 
 /** Recognized JWE Header Parameters, any other Header Members may also be present. */
 interface JWEHeaderParameters extends JoseHeaderParameters {

package/dist/shared/{unjwt.mc4AEAT7.d.ts → unjwt.B4fFiy1c.d.mts}

@@ -1,10 +1,12 @@
-import { m as JWK } from './unjwt.C0bBN0AC.js';
+import { m as JWK } from './unjwt.CxhGjEAX.mjs';
 
 declare const textEncoder: TextEncoder;
 declare const textDecoder: TextDecoder;
+declare function base64Encode(data: Uint8Array | string): string;
 declare function base64UrlEncode(data: Uint8Array | string): string;
-declare function base64UrlDecode(): string;
-declare function base64UrlDecode(str?: string | undefined): string;
+declare function base64Decode(str: string | undefined): string;
+declare function base64Decode<T extends boolean | undefined>(str?: string | undefined, toString?: T): T extends false ? Uint8Array : string;
+declare function base64UrlDecode(str: string | undefined): string;
 declare function base64UrlDecode<T extends boolean | undefined>(str?: string | undefined, toString?: T): T extends false ? Uint8Array : string;
 declare function randomBytes(length: Readonly<number>): Uint8Array;
 /**
@@ -19,6 +21,8 @@ declare function isCryptoKey(key: unknown): key is CryptoKey;
 declare const isCryptoKeyPair: (key: any) => key is CryptoKeyPair;
 
 declare const index_assertCryptoKey: typeof assertCryptoKey;
+declare const index_base64Decode: typeof base64Decode;
+declare const index_base64Encode: typeof base64Encode;
 declare const index_base64UrlDecode: typeof base64UrlDecode;
 declare const index_base64UrlEncode: typeof base64UrlEncode;
 declare const index_concatUint8Arrays: typeof concatUint8Arrays;
@@ -31,6 +35,8 @@ declare const index_textEncoder: typeof textEncoder;
 declare namespace index {
   export {
     index_assertCryptoKey as assertCryptoKey,
+    index_base64Decode as base64Decode,
+    index_base64Encode as base64Encode,
     index_base64UrlDecode as base64UrlDecode,
     index_base64UrlEncode as base64UrlEncode,
     index_concatUint8Arrays as concatUint8Arrays,
@@ -43,4 +49,4 @@ declare namespace index {
   };
 }
 
-export { textDecoder as a, base64UrlEncode as b, base64UrlDecode as c, concatUint8Arrays as d, isJWK as e, assertCryptoKey as f, isCryptoKey as g, isCryptoKeyPair as h, index as i, randomBytes as r, textEncoder as t };
+export { textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, assertCryptoKey as h, index as i, isCryptoKey as j, isCryptoKeyPair as k, randomBytes as r, textEncoder as t };

package/dist/shared/{unjwt.DYFIh1YE.d.mts → unjwt.BG_R52ey.d.mts}

@@ -1,5 +1,5 @@
-import { n as JWK_HMAC, o as JWK_RSA_SIGN, p as JWK_RSA_PSS, q as JWK_ECDSA, m as JWK } from './unjwt.C0bBN0AC.mjs';
-import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.D90BbcE1.mjs';
+import { n as JWK_HMAC, o as JWK_RSA_SIGN, p as JWK_RSA_PSS, q as JWK_ECDSA, m as JWK } from './unjwt.CxhGjEAX.mjs';
+import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.Cd9nTEWg.mjs';
 
 type JWS_SIGN_EXTRA = "Ed25519" | "EdDSA";
 /** JWS Signing Algorithm Identifier. */

package/dist/shared/{unjwt.DoVzOnty.d.ts → unjwt.BISJ5yt1.d.ts}

@@ -1,4 +1,4 @@
-import { i as JWK_RSA_Public } from './unjwt.C0bBN0AC.js';
+import { i as JWK_RSA_Public } from './unjwt.CxhGjEAX.js';
 
 /** Header Parameters common to JWE and JWS */
 interface JoseHeaderParameters {

package/dist/shared/{unjwt.Bzcov22m.mjs → unjwt.BxqF-n1S.mjs}

@@ -1,6 +1,6 @@
-import { i as importKey } from './unjwt.DKq5VF7t.mjs';
-import { a as isJWK, b as base64UrlEncode, t as textEncoder, c as textDecoder, d as base64UrlDecode } from './unjwt.CjHZv3F3.mjs';
-import { s as sign$1, v as verify$1 } from './unjwt.sux3_Z19.mjs';
+import { i as importKey } from './unjwt.1gbuWbc6.mjs';
+import { a as isJWK, b as base64UrlEncode, t as textEncoder, c as textDecoder, d as base64UrlDecode } from './unjwt.DHdDAH0L.mjs';
+import { s as sign$1, v as verify$1 } from './unjwt.C9Xhi7hE.mjs';
 
 async function sign(payload, key, options = {}) {
   const { protectedHeader: additionalProtectedHeader } = options;
@@ -56,8 +56,8 @@ async function verify(jws, key, options) {
   const [protectedHeaderEncoded, payloadEncoded, signatureEncoded] = parts;
   let protectedHeader;
   try {
-    const protectedHeaderJson = base64UrlDecode(protectedHeaderEncoded);
-    protectedHeader = JSON.parse(protectedHeaderJson);
+    const protectedHeaderString = base64UrlDecode(protectedHeaderEncoded);
+    protectedHeader = JSON.parse(protectedHeaderString);
   } catch (error_) {
     throw new Error(
       `Invalid JWS: Protected header is not valid Base64URL or JSON (${error_ instanceof Error ? error_.message : error_})`

package/dist/shared/{unjwt.sux3_Z19.mjs → unjwt.C9Xhi7hE.mjs}

@@ -1,4 +1,4 @@
-import { c as checkSigCryptoKey } from './unjwt.DKq5VF7t.mjs';
+import { c as checkSigCryptoKey } from './unjwt.1gbuWbc6.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.

package/dist/shared/{unjwt.ppm5Y0k7.d.ts → unjwt.CVKbKOFy.d.ts}

@@ -1,5 +1,5 @@
-import { n as JWK_HMAC, o as JWK_RSA_SIGN, p as JWK_RSA_PSS, q as JWK_ECDSA, m as JWK } from './unjwt.C0bBN0AC.js';
-import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.DoVzOnty.js';
+import { n as JWK_HMAC, o as JWK_RSA_SIGN, p as JWK_RSA_PSS, q as JWK_ECDSA, m as JWK } from './unjwt.CxhGjEAX.js';
+import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.BISJ5yt1.js';
 
 type JWS_SIGN_EXTRA = "Ed25519" | "EdDSA";
 /** JWS Signing Algorithm Identifier. */

package/dist/shared/{unjwt.D90BbcE1.d.mts → unjwt.Cd9nTEWg.d.mts}

@@ -1,4 +1,4 @@
-import { i as JWK_RSA_Public } from './unjwt.C0bBN0AC.mjs';
+import { i as JWK_RSA_Public } from './unjwt.CxhGjEAX.mjs';
 
 /** Header Parameters common to JWE and JWS */
 interface JoseHeaderParameters {

package/dist/shared/{unjwt.B4e_rwol.mjs → unjwt.Ce72NmIz.mjs}

@@ -1,6 +1,6 @@
-import { a as checkEncCryptoKey, u as uint32be, g as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, b as bitLengthCEK, d as jwkTokey, i as importKey, f as generateIV, h as encrypt$1, l as unwrapKey, m as decrypt$1 } from './unjwt.DKq5VF7t.mjs';
-import { e as concatUint8Arrays, t as textEncoder, f as assertCryptoKey, b as base64UrlEncode, g as isCryptoKey, a as isJWK, d as base64UrlDecode, r as randomBytes, c as textDecoder } from './unjwt.CjHZv3F3.mjs';
-import { c as checkKeyLength } from './unjwt.sux3_Z19.mjs';
+import { a as checkEncCryptoKey, u as uint32be, g as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, b as bitLengthCEK, d as jwkTokey, i as importKey, f as generateIV, h as encrypt$1, l as unwrapKey, m as decrypt$1 } from './unjwt.1gbuWbc6.mjs';
+import { e as concatUint8Arrays, t as textEncoder, f as assertCryptoKey, b as base64UrlEncode, g as isCryptoKey, a as isJWK, d as base64UrlDecode, r as randomBytes, c as textDecoder } from './unjwt.DHdDAH0L.mjs';
+import { c as checkKeyLength } from './unjwt.C9Xhi7hE.mjs';
 
 function lengthAndInput(input) {
   return concatUint8Arrays(uint32be(input.length), input);

package/dist/shared/{unjwt.C0bBN0AC.d.mts → unjwt.CxhGjEAX.d.mts}

@@ -193,8 +193,10 @@ type JWK_AES_CBC_HMAC = "A128CBC-HS256" | "A192CBC-HS384" | "A256CBC-HS512";
 type JWK_AES_GCM = "A128GCM" | "A192GCM" | "A256GCM";
 type JWK_PBES2 = "PBES2-HS256+A128KW" | "PBES2-HS384+A192KW" | "PBES2-HS512+A256KW";
 type JWK_ECDH_ES = "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A192KW" | "ECDH-ES+A256KW";
+type JWK_ED = "Ed25519" | "EdDSA";
 type JWK_Symmetric_Algorithm = JWK_HMAC | JWK_AES_KW | JWK_AES_GCM;
 type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA_ENC;
 type JWKAlgorithm = JWK_Symmetric_Algorithm | JWK_Asymmetric_Algorithm | JWK_AES_CBC_HMAC | JWK_PBES2 | JWK_ECDH_ES | ("none" | "dir");
+type JWKPEMAlgorithm = JWK_RSA_PSS | JWK_RSA_SIGN | JWK_RSA_ENC | JWK_ECDSA | JWK_ECDH_ES | JWK_ED;
 
-export type { JWKAlgorithm as A, CompositeKey as C, DeriveKeyOptions as D, GenerateKeyAlgorithm as G, JWKParameters as J, KeyManagementAlgorithm as K, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, DeriveKeyReturn as c, ContentEncryptionAlgorithm as d, WrapKeyResult as e, JWK_EC_Public as f, JWK_EC_Private as g, JWK_EC as h, JWK_RSA_Public as i, JWK_RSA_Private as j, JWK_RSA as k, JWK_oct as l, JWK as m, JWK_HMAC as n, JWK_RSA_SIGN as o, JWK_RSA_PSS as p, JWK_ECDSA as q, JWK_RSA_ENC as r, JWK_AES_KW as s, JWK_AES_GCM_KW as t, JWK_AES_CBC_HMAC as u, JWK_AES_GCM as v, JWK_PBES2 as w, JWK_ECDH_ES as x, JWK_Symmetric_Algorithm as y, JWK_Asymmetric_Algorithm as z };
+export type { JWK_Asymmetric_Algorithm as A, JWKAlgorithm as B, CompositeKey as C, DeriveKeyOptions as D, JWKPEMAlgorithm as E, GenerateKeyAlgorithm as G, JWKParameters as J, KeyManagementAlgorithm as K, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, DeriveKeyReturn as c, ContentEncryptionAlgorithm as d, WrapKeyResult as e, JWK_EC_Public as f, JWK_EC_Private as g, JWK_EC as h, JWK_RSA_Public as i, JWK_RSA_Private as j, JWK_RSA as k, JWK_oct as l, JWK as m, JWK_HMAC as n, JWK_RSA_SIGN as o, JWK_RSA_PSS as p, JWK_ECDSA as q, JWK_RSA_ENC as r, JWK_AES_KW as s, JWK_AES_GCM_KW as t, JWK_AES_CBC_HMAC as u, JWK_AES_GCM as v, JWK_PBES2 as w, JWK_ECDH_ES as x, JWK_ED as y, JWK_Symmetric_Algorithm as z };

package/dist/shared/{unjwt.C0bBN0AC.d.ts → unjwt.CxhGjEAX.d.ts}

@@ -193,8 +193,10 @@ type JWK_AES_CBC_HMAC = "A128CBC-HS256" | "A192CBC-HS384" | "A256CBC-HS512";
 type JWK_AES_GCM = "A128GCM" | "A192GCM" | "A256GCM";
 type JWK_PBES2 = "PBES2-HS256+A128KW" | "PBES2-HS384+A192KW" | "PBES2-HS512+A256KW";
 type JWK_ECDH_ES = "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A192KW" | "ECDH-ES+A256KW";
+type JWK_ED = "Ed25519" | "EdDSA";
 type JWK_Symmetric_Algorithm = JWK_HMAC | JWK_AES_KW | JWK_AES_GCM;
 type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA_ENC;
 type JWKAlgorithm = JWK_Symmetric_Algorithm | JWK_Asymmetric_Algorithm | JWK_AES_CBC_HMAC | JWK_PBES2 | JWK_ECDH_ES | ("none" | "dir");
+type JWKPEMAlgorithm = JWK_RSA_PSS | JWK_RSA_SIGN | JWK_RSA_ENC | JWK_ECDSA | JWK_ECDH_ES | JWK_ED;
 
-export type { JWKAlgorithm as A, CompositeKey as C, DeriveKeyOptions as D, GenerateKeyAlgorithm as G, JWKParameters as J, KeyManagementAlgorithm as K, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, DeriveKeyReturn as c, ContentEncryptionAlgorithm as d, WrapKeyResult as e, JWK_EC_Public as f, JWK_EC_Private as g, JWK_EC as h, JWK_RSA_Public as i, JWK_RSA_Private as j, JWK_RSA as k, JWK_oct as l, JWK as m, JWK_HMAC as n, JWK_RSA_SIGN as o, JWK_RSA_PSS as p, JWK_ECDSA as q, JWK_RSA_ENC as r, JWK_AES_KW as s, JWK_AES_GCM_KW as t, JWK_AES_CBC_HMAC as u, JWK_AES_GCM as v, JWK_PBES2 as w, JWK_ECDH_ES as x, JWK_Symmetric_Algorithm as y, JWK_Asymmetric_Algorithm as z };
+export type { JWK_Asymmetric_Algorithm as A, JWKAlgorithm as B, CompositeKey as C, DeriveKeyOptions as D, JWKPEMAlgorithm as E, GenerateKeyAlgorithm as G, JWKParameters as J, KeyManagementAlgorithm as K, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, DeriveKeyReturn as c, ContentEncryptionAlgorithm as d, WrapKeyResult as e, JWK_EC_Public as f, JWK_EC_Private as g, JWK_EC as h, JWK_RSA_Public as i, JWK_RSA_Private as j, JWK_RSA as k, JWK_oct as l, JWK as m, JWK_HMAC as n, JWK_RSA_SIGN as o, JWK_RSA_PSS as p, JWK_ECDSA as q, JWK_RSA_ENC as r, JWK_AES_KW as s, JWK_AES_GCM_KW as t, JWK_AES_CBC_HMAC as u, JWK_AES_GCM as v, JWK_PBES2 as w, JWK_ECDH_ES as x, JWK_ED as y, JWK_Symmetric_Algorithm as z };

package/dist/shared/{unjwt.BOEZHxi_.d.ts → unjwt.D1J1DelP.d.mts}

@@ -1,4 +1,18 @@
-import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, w as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, l as JWK_oct, m as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, C as CompositeKey, d as ContentEncryptionAlgorithm, A as JWKAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, z as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, n as JWK_HMAC, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, y as JWK_Symmetric_Algorithm } from './unjwt.C0bBN0AC.js';
+import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, w as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, l as JWK_oct, m as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, E as JWKPEMAlgorithm, C as CompositeKey, d as ContentEncryptionAlgorithm, B as JWKAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, A as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, y as JWK_ED, n as JWK_HMAC, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, z as JWK_Symmetric_Algorithm } from './unjwt.CxhGjEAX.mjs';
+
+/**
+ * This is a fork of Jose library's utility functions.
+ * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/asn1.ts
+ * @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
+ */
+/** Key Import Function options. */
+interface KeyImportOptions {
+    /**
+     * The value to use as {@link !SubtleCrypto.importKey} `extractable` argument. Default is false for
+     * private keys, true otherwise.
+     */
+    extractable?: boolean;
+}
 
 /**
  * Generates a cryptographic key for the specified algorithm.
@@ -65,6 +79,28 @@ declare function wrapKey(alg: KeyManagementAlgorithm, keyToWrap: CryptoKey | Uin
 declare function unwrapKey<T extends boolean | undefined = undefined>(alg: KeyManagementAlgorithm, wrappedKey: Uint8Array, unwrappingKey: CryptoKey | JWK | string | Uint8Array, options?: UnwrapKeyOptions & {
     returnAs?: T;
 }): Promise<T extends false ? Uint8Array : CryptoKey>;
+/**
+ * Imports a key from a PEM-encoded string and converts it to a JWK.
+ *
+ * @param pem The PEM-encoded string.
+ * @param pemType The type of PEM encoding ('pkcs8' for private keys, 'spki' for public keys, 'x509' for certificates).
+ * @param alg The JWA algorithm identifier. This is crucial for `crypto.subtle.importKey`
+ *            to understand the key's intended algorithm and for setting the 'alg' field in the resulting JWK.
+ * @param importOptions Options for the PEM import process (e.g., extractable for the CryptoKey).
+ * @param jwkExtras Additional properties to merge into the resulting JWK.
+ * @returns A Promise resolving to the imported key as a JWK.
+ */
+declare function importJWKFromPEM(pem: string, pemType: "pkcs8" | "spki" | "x509", alg: JWKPEMAlgorithm, importOptions?: KeyImportOptions, jwkExtras?: Partial<JWK>): Promise<JWK>;
+/**
+ * Exports a JWK to a PEM-encoded string.
+ *
+ * @param jwk The JWK to export.
+ * @param pemFormat The desired PEM format ('pkcs8' for private keys, 'spki' for public keys).
+ * @param algForCryptoKeyImport If the JWK does not have an 'alg' property, this algorithm hint is
+ *                              required to correctly convert it to a CryptoKey first.
+ * @returns A Promise resolving to the PEM-encoded key string.
+ */
+declare function exportJWKToPEM(jwk: JWK, pemFormat: "pkcs8" | "spki", algForCryptoKeyImport?: JWKPEMAlgorithm): Promise<string>;
 
 declare const jwk_CompositeKey: typeof CompositeKey;
 declare const jwk_ContentEncryptionAlgorithm: typeof ContentEncryptionAlgorithm;
@@ -75,6 +111,7 @@ declare const jwk_GenerateKeyOptions: typeof GenerateKeyOptions;
 declare const jwk_GenerateKeyReturn: typeof GenerateKeyReturn;
 declare const jwk_JWK: typeof JWK;
 declare const jwk_JWKAlgorithm: typeof JWKAlgorithm;
+declare const jwk_JWKPEMAlgorithm: typeof JWKPEMAlgorithm;
 declare const jwk_JWKParameters: typeof JWKParameters;
 declare const jwk_JWK_AES_CBC_HMAC: typeof JWK_AES_CBC_HMAC;
 declare const jwk_JWK_AES_GCM: typeof JWK_AES_GCM;
@@ -86,6 +123,7 @@ declare const jwk_JWK_ECDH_ES: typeof JWK_ECDH_ES;
 declare const jwk_JWK_ECDSA: typeof JWK_ECDSA;
 declare const jwk_JWK_EC_Private: typeof JWK_EC_Private;
 declare const jwk_JWK_EC_Public: typeof JWK_EC_Public;
+declare const jwk_JWK_ED: typeof JWK_ED;
 declare const jwk_JWK_HMAC: typeof JWK_HMAC;
 declare const jwk_JWK_PBES2: typeof JWK_PBES2;
 declare const jwk_JWK_RSA: typeof JWK_RSA;
@@ -101,8 +139,10 @@ declare const jwk_UnwrapKeyOptions: typeof UnwrapKeyOptions;
 declare const jwk_WrapKeyOptions: typeof WrapKeyOptions;
 declare const jwk_WrapKeyResult: typeof WrapKeyResult;
 declare const jwk_deriveKeyFromPassword: typeof deriveKeyFromPassword;
+declare const jwk_exportJWKToPEM: typeof exportJWKToPEM;
 declare const jwk_exportKey: typeof exportKey;
 declare const jwk_generateKey: typeof generateKey;
+declare const jwk_importJWKFromPEM: typeof importJWKFromPEM;
 declare const jwk_importKey: typeof importKey;
 declare const jwk_unwrapKey: typeof unwrapKey;
 declare const jwk_wrapKey: typeof wrapKey;
@@ -117,6 +157,7 @@ declare namespace jwk {
     jwk_GenerateKeyReturn as GenerateKeyReturn,
     jwk_JWK as JWK,
     jwk_JWKAlgorithm as JWKAlgorithm,
+    jwk_JWKPEMAlgorithm as JWKPEMAlgorithm,
     jwk_JWKParameters as JWKParameters,
     jwk_JWK_AES_CBC_HMAC as JWK_AES_CBC_HMAC,
     jwk_JWK_AES_GCM as JWK_AES_GCM,
@@ -128,6 +169,7 @@ declare namespace jwk {
     jwk_JWK_ECDSA as JWK_ECDSA,
     jwk_JWK_EC_Private as JWK_EC_Private,
     jwk_JWK_EC_Public as JWK_EC_Public,
+    jwk_JWK_ED as JWK_ED,
     jwk_JWK_HMAC as JWK_HMAC,
     jwk_JWK_PBES2 as JWK_PBES2,
     jwk_JWK_RSA as JWK_RSA,
@@ -143,12 +185,14 @@ declare namespace jwk {
     jwk_WrapKeyOptions as WrapKeyOptions,
     jwk_WrapKeyResult as WrapKeyResult,
     jwk_deriveKeyFromPassword as deriveKeyFromPassword,
+    jwk_exportJWKToPEM as exportJWKToPEM,
     jwk_exportKey as exportKey,
     jwk_generateKey as generateKey,
+    jwk_importJWKFromPEM as importJWKFromPEM,
     jwk_importKey as importKey,
     jwk_unwrapKey as unwrapKey,
     jwk_wrapKey as wrapKey,
   };
 }
 
-export { deriveKeyFromPassword as d, exportKey as e, generateKey as g, importKey as i, jwk as j, unwrapKey as u, wrapKey as w };
+export { importJWKFromPEM as a, exportJWKToPEM as b, deriveKeyFromPassword as d, exportKey as e, generateKey as g, importKey as i, jwk as j, unwrapKey as u, wrapKey as w };

package/dist/shared/{unjwt.CjHZv3F3.mjs → unjwt.DHdDAH0L.mjs}

@@ -1,14 +1,38 @@
 const textEncoder = /* @__PURE__ */ new TextEncoder();
 const textDecoder = /* @__PURE__ */ new TextDecoder();
+function base64Encode(data) {
+  const encodedData = data instanceof Uint8Array ? data : textEncoder.encode(data);
+  if (Uint8Array.prototype.toBase64) {
+    return encodedData.toBase64();
+  }
+  return btoa(String.fromCodePoint(...encodedData));
+}
 function base64UrlEncode(data) {
   const encodedData = data instanceof Uint8Array ? data : textEncoder.encode(data);
-  return btoa(String.fromCodePoint(...encodedData)).replace(/=/g, "").replace(/\+/g, "-").replace(/\//g, "_");
+  if (Uint8Array.prototype.toBase64) {
+    return encodedData.toBase64({ alphabet: "base64url", omitPadding: true });
+  }
+  return btoa(String.fromCodePoint(...encodedData)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function base64Decode(str, toString) {
+  const decodeToString = toString !== false;
+  if (!str) {
+    return decodeToString ? "" : new Uint8Array(0);
+  }
+  if (Uint8Array.fromBase64) {
+    return Uint8Array.fromBase64(str);
+  }
+  const data = Uint8Array.from(atob(str), (b) => b.codePointAt(0));
+  return decodeToString ? textDecoder.decode(data) : data;
 }
 function base64UrlDecode(str, toString) {
   const decodeToString = toString !== false;
   if (!str) {
     return decodeToString ? "" : new Uint8Array(0);
   }
+  if (Uint8Array.fromBase64) {
+    return Uint8Array.fromBase64(str, { alphabet: "base64url" });
+  }
   str = str.replace(/-/g, "+").replace(/_/g, "/");
   while (str.length % 4) str += "=";
   const data = Uint8Array.from(atob(str), (b) => b.codePointAt(0));
@@ -43,6 +67,8 @@ const isCryptoKeyPair = (key) => key && typeof key === "object" && isCryptoKey(k
 const index = {
   __proto__: null,
   assertCryptoKey: assertCryptoKey,
+  base64Decode: base64Decode,
+  base64Encode: base64Encode,
   base64UrlDecode: base64UrlDecode,
   base64UrlEncode: base64UrlEncode,
   concatUint8Arrays: concatUint8Arrays,
@@ -54,4 +80,4 @@ const index = {
   textEncoder: textEncoder
 };
 
-export { isJWK as a, base64UrlEncode as b, textDecoder as c, base64UrlDecode as d, concatUint8Arrays as e, assertCryptoKey as f, isCryptoKey as g, isCryptoKeyPair as h, index as i, randomBytes as r, textEncoder as t };
+export { isJWK as a, base64UrlEncode as b, textDecoder as c, base64UrlDecode as d, concatUint8Arrays as e, assertCryptoKey as f, isCryptoKey as g, base64Decode as h, index as i, base64Encode as j, isCryptoKeyPair as k, randomBytes as r, textEncoder as t };

package/dist/shared/{unjwt.Dz5Oe9BG.d.mts → unjwt.DQIYSlHj.d.mts}

@@ -1,5 +1,5 @@
-import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, f as JWK_EC_Public, m as JWK } from './unjwt.C0bBN0AC.mjs';
-import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.D90BbcE1.mjs';
+import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, f as JWK_EC_Public, m as JWK } from './unjwt.CxhGjEAX.mjs';
+import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.Cd9nTEWg.mjs';
 
 /** Recognized JWE Header Parameters, any other Header Members may also be present. */
 interface JWEHeaderParameters extends JoseHeaderParameters {

package/dist/shared/{unjwt.CJ_ohCFC.d.mts → unjwt.DqmNvXMd.d.ts}

@@ -1,10 +1,12 @@
-import { m as JWK } from './unjwt.C0bBN0AC.mjs';
+import { m as JWK } from './unjwt.CxhGjEAX.js';
 
 declare const textEncoder: TextEncoder;
 declare const textDecoder: TextDecoder;
+declare function base64Encode(data: Uint8Array | string): string;
 declare function base64UrlEncode(data: Uint8Array | string): string;
-declare function base64UrlDecode(): string;
-declare function base64UrlDecode(str?: string | undefined): string;
+declare function base64Decode(str: string | undefined): string;
+declare function base64Decode<T extends boolean | undefined>(str?: string | undefined, toString?: T): T extends false ? Uint8Array : string;
+declare function base64UrlDecode(str: string | undefined): string;
 declare function base64UrlDecode<T extends boolean | undefined>(str?: string | undefined, toString?: T): T extends false ? Uint8Array : string;
 declare function randomBytes(length: Readonly<number>): Uint8Array;
 /**
@@ -19,6 +21,8 @@ declare function isCryptoKey(key: unknown): key is CryptoKey;
 declare const isCryptoKeyPair: (key: any) => key is CryptoKeyPair;
 
 declare const index_assertCryptoKey: typeof assertCryptoKey;
+declare const index_base64Decode: typeof base64Decode;
+declare const index_base64Encode: typeof base64Encode;
 declare const index_base64UrlDecode: typeof base64UrlDecode;
 declare const index_base64UrlEncode: typeof base64UrlEncode;
 declare const index_concatUint8Arrays: typeof concatUint8Arrays;
@@ -31,6 +35,8 @@ declare const index_textEncoder: typeof textEncoder;
 declare namespace index {
   export {
     index_assertCryptoKey as assertCryptoKey,
+    index_base64Decode as base64Decode,
+    index_base64Encode as base64Encode,
     index_base64UrlDecode as base64UrlDecode,
     index_base64UrlEncode as base64UrlEncode,
     index_concatUint8Arrays as concatUint8Arrays,
@@ -43,4 +49,4 @@ declare namespace index {
   };
 }
 
-export { textDecoder as a, base64UrlEncode as b, base64UrlDecode as c, concatUint8Arrays as d, isJWK as e, assertCryptoKey as f, isCryptoKey as g, isCryptoKeyPair as h, index as i, randomBytes as r, textEncoder as t };
+export { textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, assertCryptoKey as h, index as i, isCryptoKey as j, isCryptoKeyPair as k, randomBytes as r, textEncoder as t };

package/dist/shared/{unjwt.B9uGngq-.d.mts → unjwt.WvWb2zNM.d.ts}

@@ -1,4 +1,18 @@
-import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, w as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, l as JWK_oct, m as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, C as CompositeKey, d as ContentEncryptionAlgorithm, A as JWKAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, z as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, n as JWK_HMAC, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, y as JWK_Symmetric_Algorithm } from './unjwt.C0bBN0AC.mjs';
+import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, w as JWK_PBES2, D as DeriveKeyOptions, c as DeriveKeyReturn, l as JWK_oct, m as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, e as WrapKeyResult, U as UnwrapKeyOptions, E as JWKPEMAlgorithm, C as CompositeKey, d as ContentEncryptionAlgorithm, B as JWKAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, A as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, y as JWK_ED, n as JWK_HMAC, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, z as JWK_Symmetric_Algorithm } from './unjwt.CxhGjEAX.js';
+
+/**
+ * This is a fork of Jose library's utility functions.
+ * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/asn1.ts
+ * @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
+ */
+/** Key Import Function options. */
+interface KeyImportOptions {
+    /**
+     * The value to use as {@link !SubtleCrypto.importKey} `extractable` argument. Default is false for
+     * private keys, true otherwise.
+     */
+    extractable?: boolean;
+}
 
 /**
  * Generates a cryptographic key for the specified algorithm.
@@ -65,6 +79,28 @@ declare function wrapKey(alg: KeyManagementAlgorithm, keyToWrap: CryptoKey | Uin
 declare function unwrapKey<T extends boolean | undefined = undefined>(alg: KeyManagementAlgorithm, wrappedKey: Uint8Array, unwrappingKey: CryptoKey | JWK | string | Uint8Array, options?: UnwrapKeyOptions & {
     returnAs?: T;
 }): Promise<T extends false ? Uint8Array : CryptoKey>;
+/**
+ * Imports a key from a PEM-encoded string and converts it to a JWK.
+ *
+ * @param pem The PEM-encoded string.
+ * @param pemType The type of PEM encoding ('pkcs8' for private keys, 'spki' for public keys, 'x509' for certificates).
+ * @param alg The JWA algorithm identifier. This is crucial for `crypto.subtle.importKey`
+ *            to understand the key's intended algorithm and for setting the 'alg' field in the resulting JWK.
+ * @param importOptions Options for the PEM import process (e.g., extractable for the CryptoKey).
+ * @param jwkExtras Additional properties to merge into the resulting JWK.
+ * @returns A Promise resolving to the imported key as a JWK.
+ */
+declare function importJWKFromPEM(pem: string, pemType: "pkcs8" | "spki" | "x509", alg: JWKPEMAlgorithm, importOptions?: KeyImportOptions, jwkExtras?: Partial<JWK>): Promise<JWK>;
+/**
+ * Exports a JWK to a PEM-encoded string.
+ *
+ * @param jwk The JWK to export.
+ * @param pemFormat The desired PEM format ('pkcs8' for private keys, 'spki' for public keys).
+ * @param algForCryptoKeyImport If the JWK does not have an 'alg' property, this algorithm hint is
+ *                              required to correctly convert it to a CryptoKey first.
+ * @returns A Promise resolving to the PEM-encoded key string.
+ */
+declare function exportJWKToPEM(jwk: JWK, pemFormat: "pkcs8" | "spki", algForCryptoKeyImport?: JWKPEMAlgorithm): Promise<string>;
 
 declare const jwk_CompositeKey: typeof CompositeKey;
 declare const jwk_ContentEncryptionAlgorithm: typeof ContentEncryptionAlgorithm;
@@ -75,6 +111,7 @@ declare const jwk_GenerateKeyOptions: typeof GenerateKeyOptions;
 declare const jwk_GenerateKeyReturn: typeof GenerateKeyReturn;
 declare const jwk_JWK: typeof JWK;
 declare const jwk_JWKAlgorithm: typeof JWKAlgorithm;
+declare const jwk_JWKPEMAlgorithm: typeof JWKPEMAlgorithm;
 declare const jwk_JWKParameters: typeof JWKParameters;
 declare const jwk_JWK_AES_CBC_HMAC: typeof JWK_AES_CBC_HMAC;
 declare const jwk_JWK_AES_GCM: typeof JWK_AES_GCM;
@@ -86,6 +123,7 @@ declare const jwk_JWK_ECDH_ES: typeof JWK_ECDH_ES;
 declare const jwk_JWK_ECDSA: typeof JWK_ECDSA;
 declare const jwk_JWK_EC_Private: typeof JWK_EC_Private;
 declare const jwk_JWK_EC_Public: typeof JWK_EC_Public;
+declare const jwk_JWK_ED: typeof JWK_ED;
 declare const jwk_JWK_HMAC: typeof JWK_HMAC;
 declare const jwk_JWK_PBES2: typeof JWK_PBES2;
 declare const jwk_JWK_RSA: typeof JWK_RSA;
@@ -101,8 +139,10 @@ declare const jwk_UnwrapKeyOptions: typeof UnwrapKeyOptions;
 declare const jwk_WrapKeyOptions: typeof WrapKeyOptions;
 declare const jwk_WrapKeyResult: typeof WrapKeyResult;
 declare const jwk_deriveKeyFromPassword: typeof deriveKeyFromPassword;
+declare const jwk_exportJWKToPEM: typeof exportJWKToPEM;
 declare const jwk_exportKey: typeof exportKey;
 declare const jwk_generateKey: typeof generateKey;
+declare const jwk_importJWKFromPEM: typeof importJWKFromPEM;
 declare const jwk_importKey: typeof importKey;
 declare const jwk_unwrapKey: typeof unwrapKey;
 declare const jwk_wrapKey: typeof wrapKey;
@@ -117,6 +157,7 @@ declare namespace jwk {
     jwk_GenerateKeyReturn as GenerateKeyReturn,
     jwk_JWK as JWK,
     jwk_JWKAlgorithm as JWKAlgorithm,
+    jwk_JWKPEMAlgorithm as JWKPEMAlgorithm,
     jwk_JWKParameters as JWKParameters,
     jwk_JWK_AES_CBC_HMAC as JWK_AES_CBC_HMAC,
     jwk_JWK_AES_GCM as JWK_AES_GCM,
@@ -128,6 +169,7 @@ declare namespace jwk {
     jwk_JWK_ECDSA as JWK_ECDSA,
     jwk_JWK_EC_Private as JWK_EC_Private,
     jwk_JWK_EC_Public as JWK_EC_Public,
+    jwk_JWK_ED as JWK_ED,
     jwk_JWK_HMAC as JWK_HMAC,
     jwk_JWK_PBES2 as JWK_PBES2,
     jwk_JWK_RSA as JWK_RSA,
@@ -143,12 +185,14 @@ declare namespace jwk {
     jwk_WrapKeyOptions as WrapKeyOptions,
     jwk_WrapKeyResult as WrapKeyResult,
     jwk_deriveKeyFromPassword as deriveKeyFromPassword,
+    jwk_exportJWKToPEM as exportJWKToPEM,
     jwk_exportKey as exportKey,
     jwk_generateKey as generateKey,
+    jwk_importJWKFromPEM as importJWKFromPEM,
     jwk_importKey as importKey,
     jwk_unwrapKey as unwrapKey,
     jwk_wrapKey as wrapKey,
   };
 }
 
-export { deriveKeyFromPassword as d, exportKey as e, generateKey as g, importKey as i, jwk as j, unwrapKey as u, wrapKey as w };
+export { importJWKFromPEM as a, exportJWKToPEM as b, deriveKeyFromPassword as d, exportKey as e, generateKey as g, importKey as i, jwk as j, unwrapKey as u, wrapKey as w };

package/dist/utils.d.mts

@@ -1,2 +1,2 @@
-import './shared/unjwt.C0bBN0AC.mjs';
-export { f as assertCryptoKey, c as base64UrlDecode, b as base64UrlEncode, d as concatUint8Arrays, g as isCryptoKey, h as isCryptoKeyPair, e as isJWK, r as randomBytes, a as textDecoder, t as textEncoder } from './shared/unjwt.CJ_ohCFC.mjs';
+import './shared/unjwt.CxhGjEAX.mjs';
+export { h as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, f as concatUint8Arrays, j as isCryptoKey, k as isCryptoKeyPair, g as isJWK, r as randomBytes, a as textDecoder, t as textEncoder } from './shared/unjwt.B4fFiy1c.mjs';

package/dist/utils.d.ts

@@ -1,2 +1,2 @@
-import './shared/unjwt.C0bBN0AC.js';
-export { f as assertCryptoKey, c as base64UrlDecode, b as base64UrlEncode, d as concatUint8Arrays, g as isCryptoKey, h as isCryptoKeyPair, e as isJWK, r as randomBytes, a as textDecoder, t as textEncoder } from './shared/unjwt.mc4AEAT7.js';
+import './shared/unjwt.CxhGjEAX.js';
+export { h as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, f as concatUint8Arrays, j as isCryptoKey, k as isCryptoKeyPair, g as isJWK, r as randomBytes, a as textDecoder, t as textEncoder } from './shared/unjwt.DqmNvXMd.js';

package/dist/utils.mjs

@@ -1 +1 @@
-export { f as assertCryptoKey, d as base64UrlDecode, b as base64UrlEncode, e as concatUint8Arrays, g as isCryptoKey, h as isCryptoKeyPair, a as isJWK, r as randomBytes, c as textDecoder, t as textEncoder } from './shared/unjwt.CjHZv3F3.mjs';
+export { f as assertCryptoKey, h as base64Decode, j as base64Encode, d as base64UrlDecode, b as base64UrlEncode, e as concatUint8Arrays, g as isCryptoKey, k as isCryptoKeyPair, a as isJWK, r as randomBytes, c as textDecoder, t as textEncoder } from './shared/unjwt.DHdDAH0L.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",