unjwt 0.5.0 → 0.5.2

package/README.md

@@ -1,9 +1,10 @@
 # unjwt
 
-<!-- automd:badges color=yellow -->
+<!-- automd:badges bundlephobia style="flat" color="FFDC3B" -->
 
-[![npm version](https://img.shields.io/npm/v/unjwt?color=yellow)](https://npmjs.com/package/unjwt)
-[![npm downloads](https://img.shields.io/npm/dm/unjwt?color=yellow)](https://npm.chart.dev/unjwt)
+[![npm version](https://img.shields.io/npm/v/unjwt?color=FFDC3B)](https://npmjs.com/package/unjwt)
+[![npm downloads](https://img.shields.io/npm/dm/unjwt?color=FFDC3B)](https://npm.chart.dev/unjwt)
+[![bundle size](https://img.shields.io/bundlephobia/minzip/unjwt?color=FFDC3B)](https://bundlephobia.com/package/unjwt)
 
 <!-- /automd -->
 
@@ -13,6 +14,14 @@ A collection of low-level JWT ([RFC 7519](https://datatracker.ietf.org/doc/html/
 - **JWE (JSON Web Encryption, [RFC 7516](https://datatracker.ietf.org/doc/html/rfc7516))**: encrypt and decrypt data using various key management algorithms (AES Key Wrap, AES-GCM Key Wrap, RSA-OAEP, PBES2, ECDH-ES) and content encryption algorithms (AES-GCM, AES-CBC HMAC-SHA2).
 - **JWK (JSON Web Key, [RFC 7517](https://datatracker.ietf.org/doc/html/rfc7517))**: generate, import, export, wrap, and unwrap keys in JWK format or as `CryptoKey` objects.
 
+> [!WARNING]
+> Please do note that some algorithms are not fully working out-of-the-box yet, such as:
+>
+> - ECDH-ES algorithms with AES Key Wrap (e.g., ECDH-ES+A128KW)
+> - RSA algorithms in combination with some bigger CBC encodings (for example RSA-OAEP-256 with A256CBC-HS512)
+>
+> For these algorithms, you should be able to provide your own keys. Although I do plan to study and simplify this.
+
 ## Usage
 
 Install the package:
@@ -48,8 +57,8 @@ import { base64UrlEncode, base64UrlDecode, randomBytes } from "unjwt/utils";
 **CDN** (Deno, Bun and Browsers)
 
 ```js
-// JWS functions
 import { jws, jwe, jwk } from "https://esm.sh/unjwt";
+// JWS functions
 import { sign, verify } from "https://esm.sh/unjwt/jws";
 // JWE functions
 import { encrypt, decrypt } from "https://esm.sh/unjwt/jwe";
@@ -488,6 +497,82 @@ async function unwrapMyKey(encryptedKey: Uint8Array, kdk: CryptoKey) {
 }
 ```
 
+#### `importJWKFromPEM(pem, pemType, alg, importOptions?, jwkExtras?)`
+
+Imports a key from a PEM-encoded string and converts it to a JWK.
+
+- `pem`: The PEM-encoded string (including `-----BEGIN ...-----` and `-----END ...-----` markers).
+- `pemType`: The type of PEM encoding:
+  - `"pkcs8"`: For private keys in PKCS#8 format.
+  - `"spki"`: For public keys in SPKI format.
+  - `"x509"`: For X.509 certificates (extracts the public key).
+- `alg`: The JWA algorithm identifier (e.g., `"RS256"`, `"ES256"`). This is crucial for `crypto.subtle.importKey` to understand the key's intended algorithm and for setting the `'alg'` field in the resulting JWK.
+- `importOptions` (optional): Options for the underlying `crypto.subtle.importKey` call:
+  - `extractable`: Boolean, whether the imported `CryptoKey` should be extractable. Defaults to `true`.
+  - `keyUsage`: Array of `KeyUsage` strings for the imported `CryptoKey`.
+- `jwkExtras` (optional): An object containing additional properties to merge into the resulting JWK (e.g., `"kid"`, `"use"`).
+
+Returns a `Promise<JWK>` resolving to the imported key as a JWK.
+
+**Example:**
+
+```ts
+import { importJWKFromPEM } from "unjwt/jwk";
+
+const rsaPublicJwk = await importJWKFromPEM(
+  provess.env.RSA_PEM_SPKI, // PEM string
+  "spki",
+  "RS256",
+  { extractable: false },
+  { kid: "my-rsa-key" }, // Additional properties to add to the JWK
+);
+console.log(rsaPublicJwk);
+// {
+//   kty: 'RSA',
+//   alg: 'RS256',
+//   kid: 'my-rsa-key',
+//   n: '...',
+//   e: 'AQAB',
+//   ext: false,
+//   key_ops: [ 'verify' ]
+// }
+```
+
+#### exportJWKToPEM(jwk, pemFormat, algForCryptoKeyImport?)
+
+Exports a JWK to a PEM-encoded string.
+
+- jwk: The JWK to export.
+- pemFormat: The desired PEM format:
+  - "pkcs8": For private keys in PKCS#8 format.
+  - "spki": For public keys in SPKI format.
+- algForCryptoKeyImport (optional): If the JWK does not have an 'alg' property, this algorithm hint is required to correctly convert it to a CryptoKey first. This is only needed if the JWK lacks an alg property.
+
+Returns a `Promise<string>` resolving to the PEM-encoded key string.
+
+Example:
+
+```ts
+import { exportJWKToPEM } from "unjwt/jwk";
+import { rsaJWK } from "./keys"; // Assuming you have JWKs in keys.ts
+
+const rsaPrivatePem = await exportJWKToPEM(rsaJWK.private, "pkcs8");
+console.log(rsaPrivatePem);
+// -----BEGIN PRIVATE KEY-----
+// MII...
+// -----END PRIVATE KEY-----
+
+const rsaPublicSpki = await exportJWKToPEM(
+  rsaJWK.public,
+  "spki",
+  "RS256", // this is required if `rsaJWK.public.alg` is undefined
+);
+console.log(rsaPublicSpki);
+// -----BEGIN PUBLIC KEY-----
+// MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQE...
+// -----END PUBLIC KEY-----
+```
+
 ### Utility Functions
 
 `unjwt/utils` exports several helpful functions:

package/dist/index.d.mts

@@ -1,6 +1,6 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, A as JWKAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, z as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, y as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.C0bBN0AC.mjs';
-export { b as JWT, a as JWTClaims, J as JoseHeaderParameters } from './shared/unjwt.D90BbcE1.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.DYFIh1YE.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.Dz5Oe9BG.mjs';
-export { i as utils } from './shared/unjwt.CJ_ohCFC.mjs';
-export { j as jwk } from './shared/unjwt.B9uGngq-.mjs';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, B as JWKAlgorithm, E as JWKPEMAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, A as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, y as JWK_ED, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, z as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CxhGjEAX.mjs';
+export { b as JWT, a as JWTClaims, J as JoseHeaderParameters } from './shared/unjwt.Cd9nTEWg.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.kiNPBQh0.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.DQIYSlHj.mjs';
+export { i as utils } from './shared/unjwt.BJEchXrM.mjs';
+export { j as jwk } from './shared/unjwt.D1J1DelP.mjs';

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, A as JWKAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, z as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, y as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.C0bBN0AC.js';
-export { b as JWT, a as JWTClaims, J as JoseHeaderParameters } from './shared/unjwt.DoVzOnty.js';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.ppm5Y0k7.js';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.BKG_8Y9G.js';
-export { i as utils } from './shared/unjwt.mc4AEAT7.js';
-export { j as jwk } from './shared/unjwt.BOEZHxi_.js';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, B as JWKAlgorithm, E as JWKPEMAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, A as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, y as JWK_ED, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, z as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CxhGjEAX.js';
+export { b as JWT, a as JWTClaims, J as JoseHeaderParameters } from './shared/unjwt.BISJ5yt1.js';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, j as jws } from './shared/unjwt.TbszLNOP.js';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, j as jwe } from './shared/unjwt.B0XDPf8a.js';
+export { i as utils } from './shared/unjwt.B5N3dPN9.js';
+export { j as jwk } from './shared/unjwt.WvWb2zNM.js';

package/dist/index.mjs

@@ -1,5 +1,5 @@
-export { i as utils } from './shared/unjwt.CjHZv3F3.mjs';
-export { j as jwe } from './shared/unjwt.B4e_rwol.mjs';
-export { j as jwk } from './shared/unjwt.DKq5VF7t.mjs';
-export { j as jws } from './shared/unjwt.Bzcov22m.mjs';
-import './shared/unjwt.sux3_Z19.mjs';
+export { i as utils } from './shared/unjwt.DOI5UE8K.mjs';
+export { j as jwe } from './shared/unjwt.ByclPbtq.mjs';
+export { j as jwk } from './shared/unjwt.ZsOShfhX.mjs';
+export { j as jws } from './shared/unjwt.COPr8ebc.mjs';
+import './shared/unjwt.z_U3fRJ-.mjs';

package/dist/jwe.d.mts

@@ -1,3 +1,3 @@
-import './shared/unjwt.C0bBN0AC.mjs';
-import './shared/unjwt.D90BbcE1.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.Dz5Oe9BG.mjs';
+import './shared/unjwt.CxhGjEAX.mjs';
+import './shared/unjwt.Cd9nTEWg.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.DQIYSlHj.mjs';

package/dist/jwe.d.ts

@@ -1,3 +1,3 @@
-import './shared/unjwt.C0bBN0AC.js';
-import './shared/unjwt.DoVzOnty.js';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.BKG_8Y9G.js';
+import './shared/unjwt.CxhGjEAX.js';
+import './shared/unjwt.BISJ5yt1.js';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters, g as decrypt, f as encrypt } from './shared/unjwt.B0XDPf8a.js';

package/dist/jwe.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.DKq5VF7t.mjs';
-import './shared/unjwt.CjHZv3F3.mjs';
-export { d as decrypt, e as encrypt } from './shared/unjwt.B4e_rwol.mjs';
-import './shared/unjwt.sux3_Z19.mjs';
+import './shared/unjwt.ZsOShfhX.mjs';
+import './shared/unjwt.DOI5UE8K.mjs';
+export { d as decrypt, e as encrypt } from './shared/unjwt.ByclPbtq.mjs';
+import './shared/unjwt.z_U3fRJ-.mjs';

package/dist/jwk.d.mts

@@ -1,2 +1,2 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, A as JWKAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, z as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, y as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.C0bBN0AC.mjs';
-export { d as deriveKeyFromPassword, e as exportKey, g as generateKey, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.B9uGngq-.mjs';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, B as JWKAlgorithm, E as JWKPEMAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, A as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, y as JWK_ED, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, z as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CxhGjEAX.mjs';
+export { d as deriveKeyFromPassword, b as exportJWKToPEM, e as exportKey, g as generateKey, a as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.D1J1DelP.mjs';

package/dist/jwk.d.ts

@@ -1,2 +1,2 @@
-export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, A as JWKAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, z as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, y as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.C0bBN0AC.js';
-export { d as deriveKeyFromPassword, e as exportKey, g as generateKey, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.BOEZHxi_.js';
+export { C as CompositeKey, d as ContentEncryptionAlgorithm, D as DeriveKeyOptions, c as DeriveKeyReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, m as JWK, B as JWKAlgorithm, E as JWKPEMAlgorithm, J as JWKParameters, u as JWK_AES_CBC_HMAC, v as JWK_AES_GCM, t as JWK_AES_GCM_KW, s as JWK_AES_KW, A as JWK_Asymmetric_Algorithm, h as JWK_EC, x as JWK_ECDH_ES, q as JWK_ECDSA, g as JWK_EC_Private, f as JWK_EC_Public, y as JWK_ED, n as JWK_HMAC, w as JWK_PBES2, k as JWK_RSA, r as JWK_RSA_ENC, p as JWK_RSA_PSS, j as JWK_RSA_Private, i as JWK_RSA_Public, o as JWK_RSA_SIGN, z as JWK_Symmetric_Algorithm, l as JWK_oct, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, e as WrapKeyResult } from './shared/unjwt.CxhGjEAX.js';
+export { d as deriveKeyFromPassword, b as exportJWKToPEM, e as exportKey, g as generateKey, a as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.WvWb2zNM.js';

package/dist/jwk.mjs

@@ -1,2 +1,2 @@
-import './shared/unjwt.CjHZv3F3.mjs';
-export { o as deriveKeyFromPassword, p as exportKey, n as generateKey, i as importKey, l as unwrapKey, q as wrapKey } from './shared/unjwt.DKq5VF7t.mjs';
+import './shared/unjwt.DOI5UE8K.mjs';
+export { o as deriveKeyFromPassword, s as exportJWKToPEM, p as exportKey, n as generateKey, r as importJWKFromPEM, i as importKey, l as unwrapKey, q as wrapKey } from './shared/unjwt.ZsOShfhX.mjs';

package/dist/jws.d.mts

@@ -1,3 +1,3 @@
-import './shared/unjwt.C0bBN0AC.mjs';
-import './shared/unjwt.D90BbcE1.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.DYFIh1YE.mjs';
+import './shared/unjwt.CxhGjEAX.mjs';
+import './shared/unjwt.Cd9nTEWg.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.kiNPBQh0.mjs';

package/dist/jws.d.ts

@@ -1,3 +1,3 @@
-import './shared/unjwt.C0bBN0AC.js';
-import './shared/unjwt.DoVzOnty.js';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.ppm5Y0k7.js';
+import './shared/unjwt.CxhGjEAX.js';
+import './shared/unjwt.BISJ5yt1.js';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult, s as sign, v as verify } from './shared/unjwt.TbszLNOP.js';

package/dist/jws.mjs

@@ -1,4 +1,4 @@
-import './shared/unjwt.DKq5VF7t.mjs';
-import './shared/unjwt.CjHZv3F3.mjs';
-import './shared/unjwt.sux3_Z19.mjs';
-export { s as sign, v as verify } from './shared/unjwt.Bzcov22m.mjs';
+import './shared/unjwt.ZsOShfhX.mjs';
+import './shared/unjwt.DOI5UE8K.mjs';
+import './shared/unjwt.z_U3fRJ-.mjs';
+export { s as sign, v as verify } from './shared/unjwt.COPr8ebc.mjs';

package/dist/shared/{unjwt.BKG_8Y9G.d.ts → unjwt.B0XDPf8a.d.ts}

@@ -1,5 +1,5 @@
-import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, f as JWK_EC_Public, m as JWK } from './unjwt.C0bBN0AC.js';
-import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.DoVzOnty.js';
+import { K as KeyManagementAlgorithm, d as ContentEncryptionAlgorithm, f as JWK_EC_Public, m as JWK } from './unjwt.CxhGjEAX.js';
+import { J as JoseHeaderParameters, a as JWTClaims } from './unjwt.BISJ5yt1.js';
 
 /** Recognized JWE Header Parameters, any other Header Members may also be present. */
 interface JWEHeaderParameters extends JoseHeaderParameters {

package/dist/shared/{unjwt.CJ_ohCFC.d.mts → unjwt.B5N3dPN9.d.ts}

@@ -1,10 +1,12 @@
-import { m as JWK } from './unjwt.C0bBN0AC.mjs';
+import { m as JWK } from './unjwt.CxhGjEAX.js';
 
 declare const textEncoder: TextEncoder;
 declare const textDecoder: TextDecoder;
+declare function base64Encode(data: Uint8Array | string): string;
 declare function base64UrlEncode(data: Uint8Array | string): string;
-declare function base64UrlDecode(): string;
-declare function base64UrlDecode(str?: string | undefined): string;
+declare function base64Decode(str: string | undefined): string;
+declare function base64Decode<T extends boolean | undefined>(str?: string | undefined, toString?: T): T extends false ? Uint8Array : string;
+declare function base64UrlDecode(str: string | undefined): string;
 declare function base64UrlDecode<T extends boolean | undefined>(str?: string | undefined, toString?: T): T extends false ? Uint8Array : string;
 declare function randomBytes(length: Readonly<number>): Uint8Array;
 /**
@@ -13,34 +15,41 @@ declare function randomBytes(length: Readonly<number>): Uint8Array;
  * @returns Concatenated array
  */
 declare function concatUint8Arrays(...arrays: Readonly<Uint8Array[]>): Uint8Array;
+declare function maybeArray<T>(item: T | T[]): T[];
 declare function isJWK(key: any): key is JWK;
 declare function assertCryptoKey(key: unknown): asserts key is CryptoKey;
 declare function isCryptoKey(key: unknown): key is CryptoKey;
 declare const isCryptoKeyPair: (key: any) => key is CryptoKeyPair;
 
 declare const index_assertCryptoKey: typeof assertCryptoKey;
+declare const index_base64Decode: typeof base64Decode;
+declare const index_base64Encode: typeof base64Encode;
 declare const index_base64UrlDecode: typeof base64UrlDecode;
 declare const index_base64UrlEncode: typeof base64UrlEncode;
 declare const index_concatUint8Arrays: typeof concatUint8Arrays;
 declare const index_isCryptoKey: typeof isCryptoKey;
 declare const index_isCryptoKeyPair: typeof isCryptoKeyPair;
 declare const index_isJWK: typeof isJWK;
+declare const index_maybeArray: typeof maybeArray;
 declare const index_randomBytes: typeof randomBytes;
 declare const index_textDecoder: typeof textDecoder;
 declare const index_textEncoder: typeof textEncoder;
 declare namespace index {
   export {
     index_assertCryptoKey as assertCryptoKey,
+    index_base64Decode as base64Decode,
+    index_base64Encode as base64Encode,
     index_base64UrlDecode as base64UrlDecode,
     index_base64UrlEncode as base64UrlEncode,
     index_concatUint8Arrays as concatUint8Arrays,
     index_isCryptoKey as isCryptoKey,
     index_isCryptoKeyPair as isCryptoKeyPair,
     index_isJWK as isJWK,
+    index_maybeArray as maybeArray,
     index_randomBytes as randomBytes,
     index_textDecoder as textDecoder,
     index_textEncoder as textEncoder,
   };
 }
 
-export { textDecoder as a, base64UrlEncode as b, base64UrlDecode as c, concatUint8Arrays as d, isJWK as e, assertCryptoKey as f, isCryptoKey as g, isCryptoKeyPair as h, index as i, randomBytes as r, textEncoder as t };
+export { textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, assertCryptoKey as h, index as i, isCryptoKey as j, isCryptoKeyPair as k, maybeArray as m, randomBytes as r, textEncoder as t };

package/dist/shared/{unjwt.DoVzOnty.d.ts → unjwt.BISJ5yt1.d.ts}

@@ -1,4 +1,4 @@
-import { i as JWK_RSA_Public } from './unjwt.C0bBN0AC.js';
+import { i as JWK_RSA_Public } from './unjwt.CxhGjEAX.js';
 
 /** Header Parameters common to JWE and JWS */
 interface JoseHeaderParameters {

package/dist/shared/{unjwt.mc4AEAT7.d.ts → unjwt.BJEchXrM.d.mts}

@@ -1,10 +1,12 @@
-import { m as JWK } from './unjwt.C0bBN0AC.js';
+import { m as JWK } from './unjwt.CxhGjEAX.mjs';
 
 declare const textEncoder: TextEncoder;
 declare const textDecoder: TextDecoder;
+declare function base64Encode(data: Uint8Array | string): string;
 declare function base64UrlEncode(data: Uint8Array | string): string;
-declare function base64UrlDecode(): string;
-declare function base64UrlDecode(str?: string | undefined): string;
+declare function base64Decode(str: string | undefined): string;
+declare function base64Decode<T extends boolean | undefined>(str?: string | undefined, toString?: T): T extends false ? Uint8Array : string;
+declare function base64UrlDecode(str: string | undefined): string;
 declare function base64UrlDecode<T extends boolean | undefined>(str?: string | undefined, toString?: T): T extends false ? Uint8Array : string;
 declare function randomBytes(length: Readonly<number>): Uint8Array;
 /**
@@ -13,34 +15,41 @@ declare function randomBytes(length: Readonly<number>): Uint8Array;
  * @returns Concatenated array
  */
 declare function concatUint8Arrays(...arrays: Readonly<Uint8Array[]>): Uint8Array;
+declare function maybeArray<T>(item: T | T[]): T[];
 declare function isJWK(key: any): key is JWK;
 declare function assertCryptoKey(key: unknown): asserts key is CryptoKey;
 declare function isCryptoKey(key: unknown): key is CryptoKey;
 declare const isCryptoKeyPair: (key: any) => key is CryptoKeyPair;
 
 declare const index_assertCryptoKey: typeof assertCryptoKey;
+declare const index_base64Decode: typeof base64Decode;
+declare const index_base64Encode: typeof base64Encode;
 declare const index_base64UrlDecode: typeof base64UrlDecode;
 declare const index_base64UrlEncode: typeof base64UrlEncode;
 declare const index_concatUint8Arrays: typeof concatUint8Arrays;
 declare const index_isCryptoKey: typeof isCryptoKey;
 declare const index_isCryptoKeyPair: typeof isCryptoKeyPair;
 declare const index_isJWK: typeof isJWK;
+declare const index_maybeArray: typeof maybeArray;
 declare const index_randomBytes: typeof randomBytes;
 declare const index_textDecoder: typeof textDecoder;
 declare const index_textEncoder: typeof textEncoder;
 declare namespace index {
   export {
     index_assertCryptoKey as assertCryptoKey,
+    index_base64Decode as base64Decode,
+    index_base64Encode as base64Encode,
     index_base64UrlDecode as base64UrlDecode,
     index_base64UrlEncode as base64UrlEncode,
     index_concatUint8Arrays as concatUint8Arrays,
     index_isCryptoKey as isCryptoKey,
     index_isCryptoKeyPair as isCryptoKeyPair,
     index_isJWK as isJWK,
+    index_maybeArray as maybeArray,
     index_randomBytes as randomBytes,
     index_textDecoder as textDecoder,
     index_textEncoder as textEncoder,
   };
 }
 
-export { textDecoder as a, base64UrlEncode as b, base64UrlDecode as c, concatUint8Arrays as d, isJWK as e, assertCryptoKey as f, isCryptoKey as g, isCryptoKeyPair as h, index as i, randomBytes as r, textEncoder as t };
+export { textDecoder as a, base64Encode as b, base64UrlEncode as c, base64Decode as d, base64UrlDecode as e, concatUint8Arrays as f, isJWK as g, assertCryptoKey as h, index as i, isCryptoKey as j, isCryptoKeyPair as k, maybeArray as m, randomBytes as r, textEncoder as t };

package/dist/shared/{unjwt.B4e_rwol.mjs → unjwt.ByclPbtq.mjs}

@@ -1,6 +1,6 @@
-import { a as checkEncCryptoKey, u as uint32be, g as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, b as bitLengthCEK, d as jwkTokey, i as importKey, f as generateIV, h as encrypt$1, l as unwrapKey, m as decrypt$1 } from './unjwt.DKq5VF7t.mjs';
-import { e as concatUint8Arrays, t as textEncoder, f as assertCryptoKey, b as base64UrlEncode, g as isCryptoKey, a as isJWK, d as base64UrlDecode, r as randomBytes, c as textDecoder } from './unjwt.CjHZv3F3.mjs';
-import { c as checkKeyLength } from './unjwt.sux3_Z19.mjs';
+import { a as checkEncCryptoKey, u as uint32be, g as generateCEK, e as encryptIV, w as wrap, k as keyToJWK, b as bitLengthCEK, d as jwkTokey, i as importKey, f as generateIV, h as encrypt$1, l as unwrapKey, m as decrypt$1 } from './unjwt.ZsOShfhX.mjs';
+import { e as concatUint8Arrays, t as textEncoder, f as assertCryptoKey, b as base64UrlEncode, g as isCryptoKey, a as isJWK, d as base64UrlDecode, r as randomBytes, c as textDecoder } from './unjwt.DOI5UE8K.mjs';
+import { c as checkKeyLength } from './unjwt.z_U3fRJ-.mjs';
 
 function lengthAndInput(input) {
   return concatUint8Arrays(uint32be(input.length), input);

package/dist/shared/{unjwt.Bzcov22m.mjs → unjwt.COPr8ebc.mjs}

@@ -1,6 +1,6 @@
-import { i as importKey } from './unjwt.DKq5VF7t.mjs';
-import { a as isJWK, b as base64UrlEncode, t as textEncoder, c as textDecoder, d as base64UrlDecode } from './unjwt.CjHZv3F3.mjs';
-import { s as sign$1, v as verify$1 } from './unjwt.sux3_Z19.mjs';
+import { i as importKey } from './unjwt.ZsOShfhX.mjs';
+import { a as isJWK, b as base64UrlEncode, t as textEncoder, c as textDecoder, d as base64UrlDecode, m as maybeArray } from './unjwt.DOI5UE8K.mjs';
+import { s as sign$1, v as verify$1 } from './unjwt.z_U3fRJ-.mjs';
 
 async function sign(payload, key, options = {}) {
   const { protectedHeader: additionalProtectedHeader } = options;
@@ -48,7 +48,7 @@ async function sign(payload, key, options = {}) {
   const signatureEncoded = base64UrlEncode(signatureBytes);
   return `${signingInputString}.${signatureEncoded}`;
 }
-async function verify(jws, key, options) {
+async function verify(jws, key, options = {}) {
   const parts = jws.split(".");
   if (parts.length !== 3) {
     throw new Error("Invalid JWS: Must contain three parts separated by dots.");
@@ -56,8 +56,8 @@ async function verify(jws, key, options) {
   const [protectedHeaderEncoded, payloadEncoded, signatureEncoded] = parts;
   let protectedHeader;
   try {
-    const protectedHeaderJson = base64UrlDecode(protectedHeaderEncoded);
-    protectedHeader = JSON.parse(protectedHeaderJson);
+    const protectedHeaderString = base64UrlDecode(protectedHeaderEncoded);
+    protectedHeader = JSON.parse(protectedHeaderString);
   } catch (error_) {
     throw new Error(
       `Invalid JWS: Protected header is not valid Base64URL or JSON (${error_ instanceof Error ? error_.message : error_})`
@@ -69,9 +69,14 @@ async function verify(jws, key, options) {
     );
   }
   const alg = protectedHeader.alg;
-  if (options?.algorithms && !options.algorithms.includes(alg)) {
+  if (options.algorithms && !options.algorithms.includes(alg)) {
     throw new Error(`Algorithm not allowed: ${alg}`);
   }
+  if (options.typ && protectedHeader.typ !== options.typ) {
+    throw new Error(
+      `Invalid JWS: "typ" (Type) Header Parameter mismatch. Expected "${options.typ}", got "${protectedHeader.typ}".`
+    );
+  }
   let signatureBytes;
   try {
     signatureBytes = base64UrlDecode(signatureEncoded, false);
@@ -97,13 +102,13 @@ async function verify(jws, key, options) {
   let payload;
   try {
     if (useB64) {
-      if (options?.forceUint8Array) {
+      if (options.forceUint8Array) {
         payload = base64UrlDecode(payloadEncoded, false);
       } else {
         const cty = protectedHeader.cty?.toLowerCase();
         const isJsonOutput = protectedHeader.typ === "JWT" || cty === "json" || cty === "application/json" || cty && cty.endsWith("+json");
+        const decodedString = base64UrlDecode(payloadEncoded);
         if (isJsonOutput) {
-          const decodedString = base64UrlDecode(payloadEncoded, true);
           if (decodedString.startsWith("{") && decodedString.endsWith("}") || decodedString.startsWith("[") && decodedString.endsWith("]")) {
             try {
               payload = JSON.parse(decodedString);
@@ -114,21 +119,23 @@ async function verify(jws, key, options) {
             payload = decodedString;
           }
         } else {
-          payload = base64UrlDecode(payloadEncoded);
+          payload = decodedString;
         }
       }
     } else {
-      payload = textEncoder.encode(payloadEncoded);
+      payload = options.forceUint8Array ? textEncoder.encode(payloadEncoded) : payloadEncoded;
     }
   } catch (error_) {
     throw new Error(
       `Invalid JWS: Payload decoding failed (${error_ instanceof Error ? error_.message : error_})`
     );
   }
-  if (options?.critical && protectedHeader.crit) {
+  if (protectedHeader.crit) {
+    const missingHeaderParams = /* @__PURE__ */ new Set();
     const recognizedParams = /* @__PURE__ */ new Set([
-      ...Object.keys(protectedHeader),
       ...options.critical || [],
+      // TODO: remove deprecated option
+      ...options.requiredHeaders || [],
       "alg",
       "typ",
       "cty",
@@ -140,17 +147,88 @@ async function verify(jws, key, options) {
       "x5u",
       "b64"
     ]);
-    for (const critParam of protectedHeader.crit) {
-      if (!recognizedParams.has(critParam)) {
+    for (const param of protectedHeader.crit) {
+      if (recognizedParams.has(param) && (param in protectedHeader || param === "b64")) {
+        continue;
+      }
+      missingHeaderParams.add(param);
+    }
+    if (missingHeaderParams.size > 0) {
+      throw new Error(
+        `Missing critical header parameters: ${[...missingHeaderParams].join(", ")}`
+      );
+    }
+  }
+  if (payload && typeof payload === "object" && !options.forceUint8Array) {
+    const jwtClaims = payload;
+    const clockTolerance = (options.clockTolerance ?? 0) * 1e3;
+    const currentDate = options.currentDate ?? /* @__PURE__ */ new Date();
+    const currentTime = currentDate.getTime();
+    const allRequiredClaims = new Set(options.requiredClaims || []);
+    const missingClaims = /* @__PURE__ */ new Set();
+    if (options.issuer) allRequiredClaims.add("iss");
+    if (options.audience) allRequiredClaims.add("aud");
+    if (options.subject) allRequiredClaims.add("sub");
+    if (options.maxTokenAge) allRequiredClaims.add("iat");
+    for (const claimName of allRequiredClaims) {
+      if (!(claimName in jwtClaims)) {
+        missingClaims.add(claimName);
+      }
+    }
+    if (missingClaims.size > 0) {
+      throw new Error(
+        `Missing required JWT Claims: ${[...missingClaims].join(", ")}`
+      );
+    }
+    if (options.issuer) {
+      const expectedIssuers = maybeArray(options.issuer);
+      if (!jwtClaims.iss || !expectedIssuers.includes(jwtClaims.iss)) {
         throw new Error(
-          `Critical header parameter not understood: ${critParam}`
+          `Invalid JWT "iss" (Issuer) Claim: Expected ${expectedIssuers.join(" or ")}, got ${jwtClaims.iss}`
+        );
+      }
+    }
+    if (options.subject && jwtClaims.sub !== options.subject) {
+      throw new Error(
+        `Invalid JWT "sub" (Subject) Claim: Expected ${options.subject}, got ${jwtClaims.sub}`
+      );
+    }
+    if (options.audience) {
+      const expectedAudiences = maybeArray(options.audience);
+      const claimAudience = maybeArray(jwtClaims.aud || []);
+      if (!claimAudience.some((aud) => expectedAudiences.includes(aud))) {
+        throw new Error(
+          `Invalid JWT "aud" (Audience) Claim: Expected ${expectedAudiences.join(" or ")}, got ${claimAudience.join(", ")}`
+        );
+      }
+    }
+    if (typeof jwtClaims.nbf === "number" && jwtClaims.nbf * 1e3 > currentTime + clockTolerance) {
+      throw new Error(
+        `JWT "nbf" (Not Before) Claim validation failed: Token is not yet valid (nbf: ${new Date(jwtClaims.nbf * 1e3).toISOString()})`
+      );
+    }
+    if (typeof jwtClaims.exp === "number" && jwtClaims.exp * 1e3 <= currentTime - clockTolerance) {
+      throw new Error(
+        `JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${new Date(jwtClaims.exp * 1e3).toISOString()})`
+      );
+    }
+    if (options.maxTokenAge) {
+      if (typeof jwtClaims.iat !== "number") {
+        throw new TypeError(
+          'JWT "iat" (Issued At) Claim must be a number when maxTokenAge is set.'
+        );
+      }
+      if (jwtClaims.iat * 1e3 > currentTime + clockTolerance) {
+        throw new Error(
+          `JWT "iat" (Issued At) Claim validation failed: Token was issued in the future (iat: ${new Date(jwtClaims.iat * 1e3).toISOString()})`
+        );
+      }
+      if (jwtClaims.iat * 1e3 < currentTime - options.maxTokenAge * 1e3 - clockTolerance) {
+        throw new Error(
+          `JWT "iat" (Issued At) Claim validation failed: Token is too old (maxTokenAge: ${options.maxTokenAge}s, iat: ${new Date(jwtClaims.iat * 1e3).toISOString()})`
         );
       }
     }
-  } else if (!options?.critical && protectedHeader.crit) {
-    throw new Error(
-      `Unprocessed critical header parameters: ${protectedHeader.crit.join(", ")}`
-    );
   }
   return {
     payload,

package/dist/shared/{unjwt.D90BbcE1.d.mts → unjwt.Cd9nTEWg.d.mts}

@@ -1,4 +1,4 @@
-import { i as JWK_RSA_Public } from './unjwt.C0bBN0AC.mjs';
+import { i as JWK_RSA_Public } from './unjwt.CxhGjEAX.mjs';
 
 /** Header Parameters common to JWE and JWS */
 interface JoseHeaderParameters {

package/dist/shared/{unjwt.C0bBN0AC.d.mts → unjwt.CxhGjEAX.d.mts}

@@ -193,8 +193,10 @@ type JWK_AES_CBC_HMAC = "A128CBC-HS256" | "A192CBC-HS384" | "A256CBC-HS512";
 type JWK_AES_GCM = "A128GCM" | "A192GCM" | "A256GCM";
 type JWK_PBES2 = "PBES2-HS256+A128KW" | "PBES2-HS384+A192KW" | "PBES2-HS512+A256KW";
 type JWK_ECDH_ES = "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A192KW" | "ECDH-ES+A256KW";
+type JWK_ED = "Ed25519" | "EdDSA";
 type JWK_Symmetric_Algorithm = JWK_HMAC | JWK_AES_KW | JWK_AES_GCM;
 type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA_ENC;
 type JWKAlgorithm = JWK_Symmetric_Algorithm | JWK_Asymmetric_Algorithm | JWK_AES_CBC_HMAC | JWK_PBES2 | JWK_ECDH_ES | ("none" | "dir");
+type JWKPEMAlgorithm = JWK_RSA_PSS | JWK_RSA_SIGN | JWK_RSA_ENC | JWK_ECDSA | JWK_ECDH_ES | JWK_ED;
 
-export type { JWKAlgorithm as A, CompositeKey as C, DeriveKeyOptions as D, GenerateKeyAlgorithm as G, JWKParameters as J, KeyManagementAlgorithm as K, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, DeriveKeyReturn as c, ContentEncryptionAlgorithm as d, WrapKeyResult as e, JWK_EC_Public as f, JWK_EC_Private as g, JWK_EC as h, JWK_RSA_Public as i, JWK_RSA_Private as j, JWK_RSA as k, JWK_oct as l, JWK as m, JWK_HMAC as n, JWK_RSA_SIGN as o, JWK_RSA_PSS as p, JWK_ECDSA as q, JWK_RSA_ENC as r, JWK_AES_KW as s, JWK_AES_GCM_KW as t, JWK_AES_CBC_HMAC as u, JWK_AES_GCM as v, JWK_PBES2 as w, JWK_ECDH_ES as x, JWK_Symmetric_Algorithm as y, JWK_Asymmetric_Algorithm as z };
+export type { JWK_Asymmetric_Algorithm as A, JWKAlgorithm as B, CompositeKey as C, DeriveKeyOptions as D, JWKPEMAlgorithm as E, GenerateKeyAlgorithm as G, JWKParameters as J, KeyManagementAlgorithm as K, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, DeriveKeyReturn as c, ContentEncryptionAlgorithm as d, WrapKeyResult as e, JWK_EC_Public as f, JWK_EC_Private as g, JWK_EC as h, JWK_RSA_Public as i, JWK_RSA_Private as j, JWK_RSA as k, JWK_oct as l, JWK as m, JWK_HMAC as n, JWK_RSA_SIGN as o, JWK_RSA_PSS as p, JWK_ECDSA as q, JWK_RSA_ENC as r, JWK_AES_KW as s, JWK_AES_GCM_KW as t, JWK_AES_CBC_HMAC as u, JWK_AES_GCM as v, JWK_PBES2 as w, JWK_ECDH_ES as x, JWK_ED as y, JWK_Symmetric_Algorithm as z };

package/dist/shared/{unjwt.C0bBN0AC.d.ts → unjwt.CxhGjEAX.d.ts}

@@ -193,8 +193,10 @@ type JWK_AES_CBC_HMAC = "A128CBC-HS256" | "A192CBC-HS384" | "A256CBC-HS512";
 type JWK_AES_GCM = "A128GCM" | "A192GCM" | "A256GCM";
 type JWK_PBES2 = "PBES2-HS256+A128KW" | "PBES2-HS384+A192KW" | "PBES2-HS512+A256KW";
 type JWK_ECDH_ES = "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A192KW" | "ECDH-ES+A256KW";
+type JWK_ED = "Ed25519" | "EdDSA";
 type JWK_Symmetric_Algorithm = JWK_HMAC | JWK_AES_KW | JWK_AES_GCM;
 type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA_ENC;
 type JWKAlgorithm = JWK_Symmetric_Algorithm | JWK_Asymmetric_Algorithm | JWK_AES_CBC_HMAC | JWK_PBES2 | JWK_ECDH_ES | ("none" | "dir");
+type JWKPEMAlgorithm = JWK_RSA_PSS | JWK_RSA_SIGN | JWK_RSA_ENC | JWK_ECDSA | JWK_ECDH_ES | JWK_ED;
 
-export type { JWKAlgorithm as A, CompositeKey as C, DeriveKeyOptions as D, GenerateKeyAlgorithm as G, JWKParameters as J, KeyManagementAlgorithm as K, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, DeriveKeyReturn as c, ContentEncryptionAlgorithm as d, WrapKeyResult as e, JWK_EC_Public as f, JWK_EC_Private as g, JWK_EC as h, JWK_RSA_Public as i, JWK_RSA_Private as j, JWK_RSA as k, JWK_oct as l, JWK as m, JWK_HMAC as n, JWK_RSA_SIGN as o, JWK_RSA_PSS as p, JWK_ECDSA as q, JWK_RSA_ENC as r, JWK_AES_KW as s, JWK_AES_GCM_KW as t, JWK_AES_CBC_HMAC as u, JWK_AES_GCM as v, JWK_PBES2 as w, JWK_ECDH_ES as x, JWK_Symmetric_Algorithm as y, JWK_Asymmetric_Algorithm as z };
+export type { JWK_Asymmetric_Algorithm as A, JWKAlgorithm as B, CompositeKey as C, DeriveKeyOptions as D, JWKPEMAlgorithm as E, GenerateKeyAlgorithm as G, JWKParameters as J, KeyManagementAlgorithm as K, UnwrapKeyOptions as U, WrapKeyOptions as W, GenerateKeyOptions as a, GenerateKeyReturn as b, DeriveKeyReturn as c, ContentEncryptionAlgorithm as d, WrapKeyResult as e, JWK_EC_Public as f, JWK_EC_Private as g, JWK_EC as h, JWK_RSA_Public as i, JWK_RSA_Private as j, JWK_RSA as k, JWK_oct as l, JWK as m, JWK_HMAC as n, JWK_RSA_SIGN as o, JWK_RSA_PSS as p, JWK_ECDSA as q, JWK_RSA_ENC as r, JWK_AES_KW as s, JWK_AES_GCM_KW as t, JWK_AES_CBC_HMAC as u, JWK_AES_GCM as v, JWK_PBES2 as w, JWK_ECDH_ES as x, JWK_ED as y, JWK_Symmetric_Algorithm as z };