unjwt 0.5.16 → 0.5.18

package/dist/shared/{unjwt.D1MC63Yb.mjs → unjwt.BEyYvaE4.mjs}

@@ -1,4 +1,4 @@
-import { m as isCryptoKey, k as concatUint8Arrays, d as base64UrlEncode, q as base64Decode, u as base64Encode, s as sanitizeObject, t as textEncoder, r as randomBytes, a as isJWK, f as base64UrlDecode, g as isJWKSet } from './unjwt.CRHfsi7v.mjs';
+import { k as isCryptoKey, p as concatUint8Arrays, d as base64UrlEncode, q as base64Decode, u as base64Encode, t as textEncoder, s as sanitizeObject, w as assertCryptoKey, a as isJWK, e as base64UrlDecode, x as isAsymmetricJWK, r as randomBytes, m as isJWKSet } from './unjwt.tM5bsBSH.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -762,6 +762,65 @@ const fromX509 = (pem, alg, options) => {
   return fromSPKI(spki, alg, options);
 };
 
+function lengthAndInput(input) {
+  return concatUint8Arrays(uint32be(input.length), input);
+}
+async function concatKdf(secret, bits, value) {
+  const iterations = Math.ceil((bits >> 3) / 32);
+  const res = new Uint8Array(iterations * 32);
+  for (let iter = 0; iter < iterations; iter++) {
+    const buf = new Uint8Array(4 + secret.length + value.length);
+    buf.set(uint32be(iter + 1));
+    buf.set(secret, 4);
+    buf.set(value, 4 + secret.length);
+    res.set(await digest("sha256", buf), iter * 32);
+  }
+  return res.slice(0, bits >> 3);
+}
+async function deriveECDHESKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) {
+  checkEncCryptoKey(publicKey, "ECDH");
+  checkEncCryptoKey(privateKey, "ECDH", "deriveBits");
+  const value = concatUint8Arrays(
+    lengthAndInput(textEncoder.encode(algorithm)),
+    lengthAndInput(apu),
+    lengthAndInput(apv),
+    uint32be(keyLength)
+  );
+  const length = publicKey.algorithm.name === "X25519" ? 256 : Math.ceil(
+    Number.parseInt(
+      publicKey.algorithm.namedCurve.slice(-3),
+      10
+    ) / 8
+  ) << 3;
+  const sharedSecret = new Uint8Array(
+    await crypto.subtle.deriveBits(
+      {
+        name: publicKey.algorithm.name,
+        public: publicKey
+      },
+      privateKey,
+      length
+    )
+  );
+  return concatKdf(sharedSecret, keyLength, value);
+}
+function allowed(key) {
+  switch (key.algorithm.namedCurve) {
+    case "P-256":
+    case "P-384":
+    case "P-521": {
+      return true;
+    }
+    default: {
+      return key.algorithm.name === "X25519";
+    }
+  }
+}
+async function digest(algorithm, data) {
+  const subtleDigest = `SHA-${algorithm.slice(-3)}`;
+  return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));
+}
+
 /**
  * This is a fork of Jose library's utility functions.
  * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/jwt_to_key.ts
@@ -923,6 +982,134 @@ async function keyToJWK(key) {
   return jwk;
 }
 
+/**
+ * This is a fork of Jose library's utility functions.
+ * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/sign.ts
+ * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/verify.ts
+ * @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
+ */
+async function sign(alg, key, data) {
+  const cryptoKey = await getSignVerifyKey(alg, key, "sign");
+  checkKeyLength(alg, cryptoKey);
+  const signature = await crypto.subtle.sign(
+    subtleAlgorithm$1(alg, cryptoKey.algorithm),
+    cryptoKey,
+    data
+  );
+  return new Uint8Array(signature);
+}
+async function verify(alg, key, signature, data) {
+  const cryptoKey = await getSignVerifyKey(alg, key, "verify");
+  checkKeyLength(alg, cryptoKey);
+  const algorithm = subtleAlgorithm$1(alg, cryptoKey.algorithm);
+  try {
+    return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);
+  } catch {
+    return false;
+  }
+}
+function checkKeyLength(alg, key) {
+  if (alg.startsWith("RS") || alg.startsWith("PS")) {
+    const { modulusLength } = key.algorithm;
+    if (typeof modulusLength !== "number" || modulusLength < 2048) {
+      throw new TypeError(
+        `${alg} requires key modulusLength to be 2048 bits or larger`
+      );
+    }
+  }
+}
+async function getSignVerifyKey(alg, key, usage) {
+  if (key instanceof Uint8Array) {
+    if (!alg.startsWith("HS")) {
+      throw new TypeError(
+        `Key must be ${key} of type: CryptoKey or JSON Web Key`
+      );
+    }
+    return crypto.subtle.importKey(
+      "raw",
+      key,
+      { hash: `SHA-${alg.slice(-3)}`, name: "HMAC" },
+      false,
+      [usage]
+    );
+  }
+  checkSigCryptoKey(key, alg, usage);
+  return key;
+}
+function subtleAlgorithm$1(alg, algorithm) {
+  const hash = `SHA-${alg.slice(-3)}`;
+  switch (alg) {
+    case "HS256":
+    case "HS384":
+    case "HS512": {
+      return { hash, name: "HMAC" };
+    }
+    case "PS256":
+    case "PS384":
+    case "PS512": {
+      return {
+        hash,
+        name: "RSA-PSS",
+        saltLength: Number.parseInt(alg.slice(-3), 10) >> 3
+      };
+    }
+    case "RS256":
+    case "RS384":
+    case "RS512": {
+      return { hash, name: "RSASSA-PKCS1-v1_5" };
+    }
+    case "ES256":
+    case "ES384":
+    case "ES512": {
+      return {
+        hash,
+        name: "ECDSA",
+        namedCurve: algorithm.namedCurve
+      };
+    }
+    case "Ed25519":
+    // Fall through
+    case "EdDSA": {
+      return { name: "Ed25519" };
+    }
+    default: {
+      throw new Error(
+        `alg ${alg} is not supported either by JOSE or your javascript runtime`
+      );
+    }
+  }
+}
+
+const subtleAlgorithm = (alg) => {
+  switch (alg) {
+    case "RSA-OAEP":
+    case "RSA-OAEP-256":
+    case "RSA-OAEP-384":
+    case "RSA-OAEP-512": {
+      return "RSA-OAEP";
+    }
+    default: {
+      throw new Error(
+        `alg ${alg} is not supported either by JOSE or your javascript runtime`
+      );
+    }
+  }
+};
+async function encryptRSAES(alg, key, cek) {
+  checkEncCryptoKey(key, alg, "encrypt");
+  checkKeyLength(alg, key);
+  return new Uint8Array(
+    await crypto.subtle.encrypt(subtleAlgorithm(alg), key, cek)
+  );
+}
+async function decryptRSAES(alg, key, encryptedKey) {
+  checkEncCryptoKey(key, alg, "decrypt");
+  checkKeyLength(alg, key);
+  return new Uint8Array(
+    await crypto.subtle.decrypt(subtleAlgorithm(alg), key, encryptedKey)
+  );
+}
+
 /**
  * This is a fork of Jose library's utility functions.
  * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/pbes2kw.ts
@@ -1026,6 +1213,224 @@ async function _unwrap(alg, key, encryptedKey) {
   return new Uint8Array(await crypto.subtle.exportKey("raw", cryptoKeyCek));
 }
 
+/**
+ * This is a fork of Jose library's utility functions.
+ * @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/encrypt_key_management.ts
+ * @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
+ */
+const PUBLIC_EPK_FIELDS = /* @__PURE__ */ new Set([
+  "kty",
+  "crv",
+  "x",
+  "y",
+  "kid",
+  "use",
+  "key_ops",
+  "alg",
+  "x5c",
+  "x5t",
+  "x5t#S256",
+  "x5u"
+]);
+function toPublicEpkJwk(jwk) {
+  const filtered = {};
+  for (const [key, value] of Object.entries(jwk)) {
+    if (value !== void 0 && PUBLIC_EPK_FIELDS.has(key)) {
+      filtered[key] = value;
+    }
+  }
+  const { kty, crv, x, y } = filtered;
+  if (typeof kty !== "string") {
+    throw new TypeError(
+      'ECDH-ES ephemeral key JWK must include the "kty" parameter.'
+    );
+  }
+  if (typeof crv !== "string") {
+    throw new TypeError(
+      'ECDH-ES ephemeral key JWK must include the "crv" parameter.'
+    );
+  }
+  if (typeof x !== "string") {
+    throw new TypeError(
+      'ECDH-ES ephemeral key JWK must include the "x" coordinate.'
+    );
+  }
+  if (kty === "EC" && typeof y !== "string") {
+    throw new TypeError(
+      'ECDH-ES EC ephemeral key JWK must include both "x" and "y" coordinates.'
+    );
+  }
+  const publicJwk = {
+    ...filtered,
+    kty,
+    crv,
+    x
+  };
+  if (typeof y === "string") {
+    publicJwk.y = y;
+  } else {
+    delete publicJwk.y;
+  }
+  return sanitizeObject(publicJwk);
+}
+async function ensurePrivateKey(alg, value) {
+  const normalized = await normalizeKey(value, alg);
+  if (!(normalized instanceof CryptoKey)) {
+    throw new TypeError(
+      "ECDH-ES ephemeral private key must be a CryptoKey or convertible JWK."
+    );
+  }
+  if (normalized.type !== "private") {
+    throw new TypeError(
+      'ECDH-ES ephemeral private key must have type "private".'
+    );
+  }
+  return normalized;
+}
+async function exportPublicJwkFrom(alg, value) {
+  if (isCryptoKey(value)) {
+    try {
+      return toPublicEpkJwk(await keyToJWK(value));
+    } catch (error_) {
+      throw new TypeError(
+        "ECDH-ES ephemeral CryptoKey must be extractable to export as JWK.",
+        { cause: error_ instanceof Error ? error_ : void 0 }
+      );
+    }
+  }
+  if (isJWK(value) && isAsymmetricJWK(value) && value.kty === "EC") {
+    return toPublicEpkJwk(value);
+  }
+  const normalized = await normalizeKey(value, alg);
+  if (!(normalized instanceof CryptoKey)) {
+    throw new TypeError(
+      "ECDH-ES ephemeral public key must be a CryptoKey or convertible JWK."
+    );
+  }
+  return exportPublicJwkFrom(alg, normalized);
+}
+async function encryptKey(alg, enc, key, providedCek, providedParameters = {}) {
+  let encryptedKey;
+  let parameters = {};
+  let cek;
+  switch (alg) {
+    case "dir": {
+      cek = key;
+      break;
+    }
+    case "ECDH-ES":
+    case "ECDH-ES+A128KW":
+    case "ECDH-ES+A192KW":
+    case "ECDH-ES+A256KW": {
+      assertCryptoKey(key);
+      if (!allowed(key)) {
+        throw new Error(
+          "ECDH with the provided key is not allowed or not supported by your javascript runtime"
+        );
+      }
+      const { apu, apv, epk: providedEpk, epkPrivateKey } = providedParameters;
+      if (providedEpk && !epkPrivateKey) {
+        throw new TypeError(
+          "ECDH-ES custom ephemeral key material must include the matching private key."
+        );
+      }
+      let ephemeralPrivateKey;
+      let epkHeader;
+      if (epkPrivateKey) {
+        ephemeralPrivateKey = await ensurePrivateKey(alg, epkPrivateKey);
+        const publicSource = providedEpk ?? epkPrivateKey;
+        epkHeader = await exportPublicJwkFrom(alg, publicSource);
+      } else {
+        if (providedEpk) {
+          throw new TypeError(
+            "ECDH-ES custom ephemeral public key requires a matching private key."
+          );
+        }
+        const generated = await crypto.subtle.generateKey(
+          key.algorithm,
+          true,
+          ["deriveBits"]
+        );
+        ephemeralPrivateKey = generated.privateKey;
+        epkHeader = await exportPublicJwkFrom(alg, generated.publicKey);
+      }
+      const sharedSecret = await deriveECDHESKey(
+        key,
+        ephemeralPrivateKey,
+        alg === "ECDH-ES" ? enc : alg,
+        alg === "ECDH-ES" ? bitLengthCEK(enc) : Number.parseInt(alg.slice(-5, -2), 10),
+        apu,
+        apv
+      );
+      parameters = { epk: epkHeader };
+      if (apu) parameters.apu = base64UrlEncode(apu);
+      if (apv) parameters.apv = base64UrlEncode(apv);
+      if (alg === "ECDH-ES") {
+        cek = sharedSecret;
+        break;
+      }
+      cek = providedCek || generateCEK(enc);
+      const kwAlg = alg.slice(-6);
+      encryptedKey = (await wrap(kwAlg, sharedSecret, cek)).encryptedKey;
+      break;
+    }
+    case "RSA-OAEP":
+    case "RSA-OAEP-256":
+    case "RSA-OAEP-384":
+    case "RSA-OAEP-512": {
+      cek = providedCek || generateCEK(enc);
+      assertCryptoKey(key);
+      encryptedKey = await encryptRSAES(alg, key, cek);
+      break;
+    }
+    case "PBES2-HS256+A128KW":
+    case "PBES2-HS384+A192KW":
+    case "PBES2-HS512+A256KW": {
+      cek = providedCek || generateCEK(enc);
+      const { p2c, p2s } = providedParameters;
+      ({ encryptedKey, ...parameters } = await wrap(alg, key, cek, p2c, p2s));
+      break;
+    }
+    case "A128KW":
+    case "A192KW":
+    case "A256KW": {
+      cek = providedCek || generateCEK(enc);
+      encryptedKey = (await wrap(alg, key, cek)).encryptedKey;
+      break;
+    }
+    case "A128GCMKW":
+    case "A192GCMKW":
+    case "A256GCMKW": {
+      cek = providedCek || generateCEK(enc);
+      const { iv } = providedParameters;
+      ({ encryptedKey, ...parameters } = await encryptIV(alg, key, cek, iv));
+      break;
+    }
+    default: {
+      throw new Error(
+        'Invalid or unsupported "alg" (JWE Algorithm) header value'
+      );
+    }
+  }
+  return { cek, encryptedKey, parameters };
+}
+async function normalizeKey(key, alg) {
+  if (key instanceof Uint8Array) {
+    return key;
+  }
+  if (isCryptoKey(key)) {
+    return key;
+  }
+  if (isJWK(key)) {
+    const safeJwk = sanitizeObject(key);
+    if ("k" in safeJwk && safeJwk.k) {
+      return base64UrlDecode(safeJwk.k, false);
+    }
+    return jwkTokey({ ...safeJwk, alg });
+  }
+  throw new Error("unreachable");
+}
+
 async function generateKey(alg, options = {}) {
   const exportToJWK = options.toJWK !== void 0 && options.toJWK !== false;
   const defaultExtractable = options.extractable !== false;
@@ -1052,19 +1457,39 @@ async function generateKey(alg, options = {}) {
       ...additionalKeyParams
     } = typeof options.toJWK === "object" ? options.toJWK : {};
     if (key instanceof CryptoKey) {
-      return exportKey(key, { ...additionalKeyParams, alg });
+      return exportKey(key, {
+        ...additionalKeyParams,
+        key_ops: keyUsages,
+        alg
+      });
     } else {
       const [publicKey, privateKey] = await Promise.all([
         exportKey(key.publicKey, { ...additionalKeyParams, alg }),
-        exportKey(key.privateKey, { ...additionalKeyParams, alg })
+        exportKey(key.privateKey, {
+          ...additionalKeyParams,
+          key_ops: keyUsages,
+          alg
+        })
       ]);
       return { privateKey, publicKey };
     }
   }
   return key;
 }
+async function generateJWK(alg, jwkParams, options = {}) {
+  const {
+    // @ts-expect-error destructuring just to avoid passing it down
+    toJWK: _,
+    ...opts
+  } = options;
+  return generateKey(alg, {
+    ...opts,
+    toJWK: jwkParams || true
+  });
+}
 async function deriveKeyFromPassword(password, alg, options) {
-  const { salt, iterations, toJWK, extractable, keyUsage } = options;
+  const { salt, iterations, extractable, keyUsage } = options;
+  const exportToJWK = options.toJWK !== void 0 && options.toJWK !== false;
   if (!(salt instanceof Uint8Array) || salt.length < 8) {
     throw new Error("PBES2 Salt Input (salt) must be 8 or more octets");
   }
@@ -1083,7 +1508,7 @@ async function deriveKeyFromPassword(password, alg, options) {
   const wrappingAlg = alg.slice(-6);
   const defaultUsages = ["wrapKey", "unwrapKey"];
   const finalUsages = keyUsage ?? defaultUsages;
-  const finalExtractable = toJWK === true ? true : extractable === true;
+  const finalExtractable = exportToJWK ? true : extractable === true;
   const derivedKey = await crypto.subtle.importKey(
     "raw",
     derivedBytes,
@@ -1091,12 +1516,30 @@ async function deriveKeyFromPassword(password, alg, options) {
     finalExtractable,
     finalUsages
   );
-  if (toJWK === true) {
+  if (exportToJWK) {
     const jwk = await keyToJWK(derivedKey);
-    return { ...jwk, alg: wrappingAlg, kty: "oct" };
+    const {
+      alg: _a,
+      kty: _k,
+      key_ops: _ko,
+      ext: _e,
+      ...additionalKeyParams
+    } = typeof options.toJWK === "object" ? options.toJWK : {};
+    return { ...additionalKeyParams, ...jwk, alg: wrappingAlg, kty: "oct" };
   }
   return derivedKey;
 }
+async function deriveJWKFromPassword(password, alg, options, jwkParams) {
+  const {
+    // @ts-expect-error destructuring just to avoid passing it down
+    toJWK: _,
+    ...opts
+  } = options;
+  return deriveKeyFromPassword(password, alg, {
+    ...opts,
+    toJWK: jwkParams || true
+  });
+}
 async function importKey(key, alg) {
   if (typeof key === "string") {
     key = textEncoder.encode(key);
@@ -1287,22 +1730,33 @@ async function unwrapKey(alg, wrappedKey, unwrappingKey, options = {}) {
     case "RSA-OAEP-256":
     case "RSA-OAEP-384":
     case "RSA-OAEP-512": {
-      const unwrappedKey = await crypto.subtle.unwrapKey(
-        "raw",
-        wrappedKey,
+      if (!(importedUnwrappingKey instanceof CryptoKey)) {
+        throw new TypeError(
+          "RSA-OAEP requires the unwrapping key to be provided as a CryptoKey"
+        );
+      }
+      unwrappedCekBytes = await decryptRSAES(
+        alg,
         importedUnwrappingKey,
-        { name: "RSA-OAEP" },
-        options.unwrappedKeyAlgorithm || { name: "AES-GCM" },
-        // Fallback
-        defaultExtractable,
-        options.keyUsage || ["encrypt", "decrypt"]
-        // Default usages
+        wrappedKey
       );
-      if (returnAs) return unwrappedKey;
-      unwrappedCekBytes = new Uint8Array(
-        await crypto.subtle.exportKey("raw", unwrappedKey)
+      if (!returnAs) {
+        break;
+      }
+      const inferredAlgorithm = options.unwrappedKeyAlgorithm || inferAesImportAlgorithm(options.enc, unwrappedCekBytes.length);
+      if (!inferredAlgorithm) {
+        throw new Error(
+          'Unable to infer algorithm for RSA-OAEP unwrapped key. Provide "unwrappedKeyAlgorithm" in options.'
+        );
+      }
+      const keyUsages = options.keyUsage || ["encrypt", "decrypt"];
+      return await crypto.subtle.importKey(
+        "raw",
+        unwrappedCekBytes,
+        inferredAlgorithm,
+        defaultExtractable,
+        keyUsages
       );
-      break;
     }
     case "ECDH-ES":
     case "ECDH-ES+A128KW":
@@ -1311,7 +1765,49 @@ async function unwrapKey(alg, wrappedKey, unwrappingKey, options = {}) {
       if (!options.epk) {
         throw new Error("ECDH-ES requires 'epk' (Ephemeral Public Key) option");
       }
-      throw new Error(`Algorithm ${alg} not yet implemented in unwrapKey`);
+      if (!(importedUnwrappingKey instanceof CryptoKey)) {
+        throw new TypeError(
+          "ECDH-ES requires the unwrapping key to be a CryptoKey"
+        );
+      }
+      if (!allowed(importedUnwrappingKey)) {
+        throw new Error(
+          "ECDH with the provided key is not allowed or not supported"
+        );
+      }
+      const epkCandidate = options.epk instanceof CryptoKey ? options.epk : await normalizeKey(options.epk, alg);
+      if (!(epkCandidate instanceof CryptoKey)) {
+        throw new TypeError("Failed to normalize ECDH ephemeral public key");
+      }
+      const apuBytes = typeof options.apu === "string" ? base64UrlDecode(options.apu, false) : options.apu ?? new Uint8Array(0);
+      const apvBytes = typeof options.apv === "string" ? base64UrlDecode(options.apv, false) : options.apv ?? new Uint8Array(0);
+      const infoAlg = alg === "ECDH-ES" ? options.enc : alg;
+      if (!infoAlg) {
+        throw new Error(
+          "ECDH-ES requires content encryption algorithm ('enc') to derive the shared secret"
+        );
+      }
+      const keyLength = alg === "ECDH-ES" ? bitLengthCEK(infoAlg) : Number.parseInt(alg.slice(-5, -2), 10);
+      const sharedSecret = await deriveECDHESKey(
+        epkCandidate,
+        importedUnwrappingKey,
+        infoAlg,
+        keyLength,
+        apuBytes,
+        apvBytes
+      );
+      if (alg === "ECDH-ES") {
+        unwrappedCekBytes = sharedSecret;
+      } else {
+        const kwAlg = alg.slice(-6);
+        if (!(wrappedKey instanceof Uint8Array) || wrappedKey.length === 0) {
+          throw new Error(
+            "ECDH-ES key agreement with key wrapping requires an encrypted key"
+          );
+        }
+        unwrappedCekBytes = await unwrap(kwAlg, sharedSecret, wrappedKey);
+      }
+      break;
     }
     default: {
       throw new Error(`Unsupported key unwrapping algorithm: ${alg}`);
@@ -1483,28 +1979,6 @@ function getGenerateKeyParams(alg, options) {
       keyUsages = defaultKeyUsage ?? ["sign", "verify"];
       break;
     }
-    // ECDSA Signatures
-    case "ES256": {
-      algorithm = { name: "ECDSA", namedCurve: "P-256" };
-      keyUsages = defaultKeyUsage ?? ["sign", "verify"];
-      break;
-    }
-    case "ES384": {
-      algorithm = { name: "ECDSA", namedCurve: "P-384" };
-      keyUsages = defaultKeyUsage ?? ["sign", "verify"];
-      break;
-    }
-    case "ES512": {
-      algorithm = { name: "ECDSA", namedCurve: "P-521" };
-      keyUsages = defaultKeyUsage ?? ["sign", "verify"];
-      break;
-    }
-    case "Ed25519":
-    case "EdDSA": {
-      algorithm = { name: "Ed25519" };
-      keyUsages = defaultKeyUsage ?? ["sign", "verify"];
-      break;
-    }
     // RSA Encryption
     case "RSA-OAEP":
     case "RSA-OAEP-256":
@@ -1542,10 +2016,70 @@ function getGenerateKeyParams(alg, options) {
       keyUsages = defaultKeyUsage ?? ["encrypt", "decrypt"];
       break;
     }
-    // ECDH Key Agreement (requires specific curve in JWK for import, generation is simpler)
-    // For generation, typically generate the EC key pair first (e.g., P-256, P-384, P-521, X25519)
-    // then use deriveBits/deriveKey. Direct generation for "ECDH-ES*" alg isn't standard.
-    // Handle EC key pair generation under ES256/ES384/ES512.
+    // ECDSA Signatures
+    case "ES256": {
+      algorithm = { name: "ECDSA", namedCurve: "P-256" };
+      keyUsages = defaultKeyUsage ?? ["sign", "verify"];
+      break;
+    }
+    case "ES384": {
+      algorithm = { name: "ECDSA", namedCurve: "P-384" };
+      keyUsages = defaultKeyUsage ?? ["sign", "verify"];
+      break;
+    }
+    case "ES512": {
+      algorithm = { name: "ECDSA", namedCurve: "P-521" };
+      keyUsages = defaultKeyUsage ?? ["sign", "verify"];
+      break;
+    }
+    case "Ed25519": {
+      keyUsages = defaultKeyUsage ?? ["sign", "verify"];
+      algorithm = { name: "Ed25519" };
+      break;
+    }
+    case "EdDSA": {
+      keyUsages = defaultKeyUsage ?? ["sign", "verify"];
+      const namedCurve = options?.namedCurve ?? "Ed25519";
+      switch (namedCurve) {
+        case "Ed25519":
+        case "Ed448": {
+          algorithm = { name: namedCurve };
+          break;
+        }
+        default: {
+          throw new Error(
+            "Unsupported namedCurve provided. Supported values are: Ed25519 and Ed448"
+          );
+        }
+      }
+      break;
+    }
+    // ECDSA Signatures
+    case "ECDH-ES":
+    case "ECDH-ES+A128KW":
+    case "ECDH-ES+A192KW":
+    case "ECDH-ES+A256KW": {
+      keyUsages = ["deriveBits"];
+      const namedCurve = options?.namedCurve ?? "P-256";
+      switch (namedCurve) {
+        case "P-256":
+        case "P-384":
+        case "P-521": {
+          algorithm = { name: "ECDH", namedCurve };
+          break;
+        }
+        case "X25519": {
+          algorithm = { name: "X25519" };
+          break;
+        }
+        default: {
+          throw new Error(
+            "Unsupported namedCurve provided. Supported values are: P-256, P-384, P-521 and X25519"
+          );
+        }
+      }
+      break;
+    }
     default: {
       throw new Error(
         `Unsupported or invalid algorithm for key generation: ${alg}`
@@ -1554,12 +2088,32 @@ function getGenerateKeyParams(alg, options) {
   }
   return { algorithm, keyUsages };
 }
+function inferAesImportAlgorithm(enc, cekLengthBytes) {
+  const bitLength = cekLengthBytes << 3;
+  if (enc) {
+    if (enc.includes("GCM")) {
+      return {
+        name: "AES-GCM",
+        length: Number.parseInt(enc.slice(1, 4), 10)
+      };
+    }
+    if (enc.includes("CBC-HS")) {
+      return void 0;
+    }
+  }
+  if (bitLength === 128 || bitLength === 192 || bitLength === 256) {
+    return { name: "AES-GCM", length: bitLength };
+  }
+  return void 0;
+}
 
 const jwk = {
   __proto__: null,
+  deriveJWKFromPassword: deriveJWKFromPassword,
   deriveKeyFromPassword: deriveKeyFromPassword,
   exportJWKToPEM: exportJWKToPEM,
   exportKey: exportKey,
+  generateJWK: generateJWK,
   generateKey: generateKey,
   getJWKFromSet: getJWKFromSet,
   importJWKFromPEM: importJWKFromPEM,
@@ -1568,4 +2122,4 @@ const jwk = {
   wrapKey: wrapKey
 };
 
-export { checkEncCryptoKey as a, generateCEK as b, checkSigCryptoKey as c, bitLengthCEK as d, encryptIV as e, jwkTokey as f, getJWKFromSet as g, generateIV as h, importKey as i, jwk as j, keyToJWK as k, encrypt as l, unwrapKey as m, decrypt as n, generateKey as o, deriveKeyFromPassword as p, exportKey as q, wrapKey as r, importJWKFromPEM as s, exportJWKToPEM as t, uint32be as u, wrap as w };
+export { encrypt as a, getJWKFromSet as b, generateKey as c, decrypt as d, encryptKey as e, generateJWK as f, generateIV as g, deriveKeyFromPassword as h, importKey as i, jwk as j, deriveJWKFromPassword as k, exportKey as l, importJWKFromPEM as m, exportJWKToPEM as n, sign as s, unwrapKey as u, verify as v, wrapKey as w };