unjwt 0.5.39 → 0.6.0

package/dist/_chunks/jws.mjs

@@ -1,3 +1,36 @@
+//#region src/core/error.ts
+/**
+* Base error class for all unjwt errors. Every error thrown by the library is
+* an instance of `JWTError`, so a single `instanceof` check is sufficient to
+* distinguish library errors from other thrown values. Use the `code` property
+* (or the `isJWTError` type guard) to narrow to a specific error condition.
+*
+* @example
+* import { JWTError, isJWTError } from "unjwt/jws";
+*
+* try {
+*   await verify(token, key);
+* } catch (err) {
+*   if (isJWTError(err, "ERR_JWT_EXPIRED")) {
+*     console.log(err.cause.jti); // string | undefined
+*   }
+* }
+*/
+var JWTError = class extends Error {
+	code;
+	cause;
+	constructor(message, code, cause) {
+		super(message);
+		this.name = "JWTError";
+		this.code = code;
+		this.cause = cause;
+	}
+};
+function isJWTError(error, code) {
+	if (!(error instanceof JWTError)) return false;
+	return code === void 0 || error.code === code;
+}
+//#endregion
 //#region src/core/utils/jwt.ts
 /**
 * Apply default typ/cty semantics shared by JWS & JWE.
@@ -106,23 +139,31 @@ function validateJwtClaims(jwtClaims, options = {}) {
 	if (options.subject) allRequiredClaims.add("sub");
 	if (options.maxTokenAge) allRequiredClaims.add("iat");
 	for (const claimName of allRequiredClaims) if (!(claimName in jwtClaims)) missingClaims.add(claimName);
-	if (missingClaims.size > 0) throw new Error(`Missing required JWT Claims: ${[...missingClaims].join(", ")}`);
+	if (missingClaims.size > 0) throw new JWTError(`Missing required JWT Claims: ${[...missingClaims].join(", ")}`, "ERR_JWT_CLAIM_MISSING");
 	if (options.issuer) {
 		const expectedIssuers = maybeArray(options.issuer);
-		if (!jwtClaims.iss || !expectedIssuers.includes(jwtClaims.iss)) throw new Error(`Invalid JWT "iss" (Issuer) Claim: Expected ${expectedIssuers.join(" or ")}, got ${jwtClaims.iss}`);
+		if (!jwtClaims.iss || !expectedIssuers.includes(jwtClaims.iss)) throw new JWTError(`Invalid JWT "iss" (Issuer) Claim: Expected ${expectedIssuers.join(" or ")}, got ${jwtClaims.iss}`, "ERR_JWT_CLAIM_INVALID");
 	}
-	if (options.subject && jwtClaims.sub !== options.subject) throw new Error(`Invalid JWT "sub" (Subject) Claim: Expected ${options.subject}, got ${jwtClaims.sub}`);
+	if (options.subject && jwtClaims.sub !== options.subject) throw new JWTError(`Invalid JWT "sub" (Subject) Claim: Expected ${options.subject}, got ${jwtClaims.sub}`, "ERR_JWT_CLAIM_INVALID");
 	if (options.audience) {
 		const expectedAudiences = maybeArray(options.audience);
 		const claimAudience = maybeArray(jwtClaims.aud || []);
-		if (!claimAudience.some((aud) => expectedAudiences.includes(aud))) throw new Error(`Invalid JWT "aud" (Audience) Claim: Expected ${expectedAudiences.join(" or ")}, got ${claimAudience.join(", ")}`);
+		if (!claimAudience.some((aud) => expectedAudiences.includes(aud))) throw new JWTError(`Invalid JWT "aud" (Audience) Claim: Expected ${expectedAudiences.join(" or ")}, got ${claimAudience.join(", ")}`, "ERR_JWT_CLAIM_INVALID");
 	}
-	if (typeof jwtClaims.nbf === "number" && jwtClaims.nbf > currentTime + clockTolerance) throw new Error(`JWT "nbf" (Not Before) Claim validation failed: Token is not yet valid (nbf: ${(/* @__PURE__ */ new Date(jwtClaims.nbf * 1e3)).toISOString()})`);
-	if (typeof jwtClaims.exp === "number" && jwtClaims.exp <= currentTime - clockTolerance) throw new Error(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(jwtClaims.exp * 1e3)).toISOString()})`);
+	if (typeof jwtClaims.nbf === "number" && jwtClaims.nbf > currentTime + clockTolerance) throw new JWTError(`JWT "nbf" (Not Before) Claim validation failed: Token is not yet valid (nbf: ${(/* @__PURE__ */ new Date(jwtClaims.nbf * 1e3)).toISOString()})`, "ERR_JWT_NBF");
+	if (typeof jwtClaims.exp === "number" && jwtClaims.exp <= currentTime - clockTolerance) throw new JWTError(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(jwtClaims.exp * 1e3)).toISOString()})`, "ERR_JWT_EXPIRED", {
+		jti: jwtClaims.jti,
+		iat: jwtClaims.iat,
+		exp: jwtClaims.exp
+	});
 	if (options.maxTokenAge) {
-		if (typeof jwtClaims.iat !== "number") throw new TypeError("JWT \"iat\" (Issued At) Claim must be a number when maxTokenAge is set.");
-		if (jwtClaims.iat > currentTime + clockTolerance) throw new Error(`JWT "iat" (Issued At) Claim validation failed: Token was issued in the future (iat: ${(/* @__PURE__ */ new Date(jwtClaims.iat * 1e3)).toISOString()})`);
-		if (jwtClaims.iat < currentTime - computeMaxTokenAgeSeconds(options.maxTokenAge) - clockTolerance) throw new Error(`JWT "iat" (Issued At) Claim validation failed: Token is too old (maxTokenAge: ${options.maxTokenAge}s, iat: ${(/* @__PURE__ */ new Date(jwtClaims.iat * 1e3)).toISOString()})`);
+		if (typeof jwtClaims.iat !== "number") throw new JWTError("JWT \"iat\" (Issued At) Claim must be a number when maxTokenAge is set.", "ERR_JWT_CLAIM_INVALID");
+		if (jwtClaims.iat > currentTime + clockTolerance) throw new JWTError(`JWT "iat" (Issued At) Claim validation failed: Token was issued in the future (iat: ${(/* @__PURE__ */ new Date(jwtClaims.iat * 1e3)).toISOString()})`, "ERR_JWT_CLAIM_INVALID");
+		if (jwtClaims.iat < currentTime - computeMaxTokenAgeSeconds(options.maxTokenAge) - clockTolerance) throw new JWTError(`JWT "iat" (Issued At) Claim validation failed: Token is too old (maxTokenAge: ${options.maxTokenAge}s, iat: ${(/* @__PURE__ */ new Date(jwtClaims.iat * 1e3)).toISOString()})`, "ERR_JWT_EXPIRED", {
+			jti: jwtClaims.jti,
+			iat: jwtClaims.iat,
+			exp: jwtClaims.exp
+		});
 	}
 }
 const BASE_HEADER_PARAMS = [
@@ -137,11 +178,11 @@ const BASE_HEADER_PARAMS = [
 	"x5u"
 ];
 /** Validate critical headers in JWS semantics. */
-function validateCriticalHeadersJWS(protectedHeader, requiredHeaders = []) {
+function validateCriticalHeadersJWS(protectedHeader, recognizedHeaders = []) {
 	if (!protectedHeader.crit) return;
 	const missingHeaderParams = /* @__PURE__ */ new Set();
 	const recognizedParams = new Set([
-		...requiredHeaders,
+		...recognizedHeaders,
 		...BASE_HEADER_PARAMS,
 		"b64"
 	]);
@@ -149,14 +190,14 @@ function validateCriticalHeadersJWS(protectedHeader, requiredHeaders = []) {
 		if (recognizedParams.has(param) && (param in protectedHeader || param === "b64")) continue;
 		missingHeaderParams.add(param);
 	}
-	if (missingHeaderParams.size > 0) throw new Error(`Missing critical header parameters: ${[...missingHeaderParams].join(", ")}`);
+	if (missingHeaderParams.size > 0) throw new JWTError(`Missing critical header parameters: ${[...missingHeaderParams].join(", ")}`, "ERR_JWS_INVALID");
 }
 /** Validate critical headers in JWE semantics. */
-function validateCriticalHeadersJWE(protectedHeader, understoodFromOptions) {
-	if (protectedHeader.crit && !understoodFromOptions) throw new Error(`Unprocessed critical header parameters: ${protectedHeader.crit.join(", ")}`);
+function validateCriticalHeadersJWE(protectedHeader, recognizedHeaders) {
+	if (protectedHeader.crit && !recognizedHeaders) throw new JWTError(`Unprocessed critical header parameters: ${protectedHeader.crit.join(", ")}`, "ERR_JWE_INVALID");
 	if (!protectedHeader.crit) return;
 	const understoodParams = new Set([
-		...understoodFromOptions || [],
+		...recognizedHeaders || [],
 		...BASE_HEADER_PARAMS,
 		"enc",
 		"iv",
@@ -168,40 +209,38 @@ function validateCriticalHeadersJWE(protectedHeader, understoodFromOptions) {
 		"apv"
 	]);
 	for (const critParam of protectedHeader.crit) {
-		if (!Object.prototype.hasOwnProperty.call(protectedHeader, critParam)) throw new Error(`Critical header parameter "${critParam}" listed in "crit" but not present in the protected header.`);
-		if (!understoodParams.has(critParam)) throw new Error(`Unprocessed critical header parameters: ${critParam}`);
+		if (!Object.prototype.hasOwnProperty.call(protectedHeader, critParam)) throw new JWTError(`Critical header parameter "${critParam}" listed in "crit" but not present in the protected header.`, "ERR_JWE_INVALID");
+		if (!understoodParams.has(critParam)) throw new JWTError(`Unprocessed critical header parameters: ${critParam}`, "ERR_JWE_INVALID");
 	}
 }
 //#endregion
 //#region src/core/utils/sanitize.ts
 /**
-* Forked from unsecure@0.0.4
+* Originally derived from unsecure@0.0.4
 * Licensed under the MIT License.
 *
 * Source: https://github.com/sandros94/unsecure/blob/913ed5580c551153a19154b4916c67a8efb2be85/src/sanitize.ts
 */
 /**
-* Remove prototype-pollution vectors from a plain record in-place.
-* This strips __proto__, prototype, and constructor own properties.
-* Returns the same reference for convenience.
+* Returns a deep structural copy of `obj` with prototype-pollution vectors
+* stripped at every level (`__proto__`, `prototype`, `constructor`).
+*
+* The input is never modified. Arrays are copied element-by-element;
+* nested objects are recursed with a WeakSet cycle guard.
 */
 function sanitizeObject(obj) {
 	if (!obj || typeof obj !== "object") return obj;
-	sanitizeKeys(obj);
-	return obj;
-}
-function sanitizeKeys(current, seen) {
-	if (Object.prototype.hasOwnProperty.call(current, "__proto__")) delete current["__proto__"];
-	if (Object.prototype.hasOwnProperty.call(current, "prototype")) delete current["prototype"];
-	if (Object.prototype.hasOwnProperty.call(current, "constructor")) delete current["constructor"];
-	const items = Array.isArray(current) ? current : Object.values(current);
-	for (const v of items) if (v && typeof v === "object") {
-		seen ??= /* @__PURE__ */ new WeakSet();
-		if (!seen.has(v)) {
-			seen.add(v);
-			sanitizeKeys(v, seen);
-		}
+	return _sanitizeCopy(obj, /* @__PURE__ */ new WeakSet());
+}
+function _sanitizeCopy(current, seen) {
+	seen.add(current);
+	if (Array.isArray(current)) return current.map((item) => item && typeof item === "object" && !seen.has(item) ? _sanitizeCopy(item, seen) : item);
+	const result = {};
+	for (const [key, value] of Object.entries(current)) {
+		if (key === "__proto__" || key === "prototype" || key === "constructor") continue;
+		result[key] = value && typeof value === "object" && !seen.has(value) ? _sanitizeCopy(value, seen) : value;
 	}
+	return result;
 }
 //#endregion
 //#region src/core/utils/index.ts
@@ -337,157 +376,61 @@ function isPublicJWK(key) {
 	return false;
 }
 //#endregion
-//#region src/core/jose/crypto_key.ts
-/**
-* This is a fork of Jose library's utility functions.
-* @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/crypto_key.ts
-* @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
-*/
-function unusable(name, prop = "algorithm.name") {
-	return /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-}
-function isAlgorithm(algorithm, name) {
-	return algorithm.name === name;
-}
-function getHashLength(hash) {
-	return Number.parseInt(hash.name.slice(4), 10);
+//#region src/core/_crypto/_sign-verify.ts
+async function sign$1(alg, key, data) {
+	checkSigCryptoKey(key, alg, "sign");
+	const signature = await crypto.subtle.sign(subtleAlgorithm(alg, key.algorithm), key, data);
+	return new Uint8Array(signature);
 }
-function getNamedCurve$1(alg) {
-	switch (alg) {
-		case "ES256": return "P-256";
-		case "ES384": return "P-384";
-		case "ES512": return "P-521";
-		default: throw new Error("unreachable");
+async function verify$1(alg, key, signature, data) {
+	checkSigCryptoKey(key, alg, "verify");
+	try {
+		return await crypto.subtle.verify(subtleAlgorithm(alg, key.algorithm), key, signature, data);
+	} catch {
+		return false;
 	}
 }
-function checkUsage(key, usage) {
-	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
-}
 function checkSigCryptoKey(key, alg, usage) {
 	switch (alg) {
 		case "HS256":
 		case "HS384":
 		case "HS512": {
-			if (!isAlgorithm(key.algorithm, "HMAC")) throw unusable("HMAC");
+			if (!isAlgorithm$3(key.algorithm, "HMAC")) throw unusable$4("HMAC");
 			const expected = Number.parseInt(alg.slice(2), 10);
-			if (getHashLength(key.algorithm.hash) !== expected) throw unusable(`SHA-${expected}`, "algorithm.hash");
+			if (getHashLength$1(key.algorithm.hash) !== expected) throw unusable$4(`SHA-${expected}`, "algorithm.hash");
 			break;
 		}
 		case "RS256":
 		case "RS384":
 		case "RS512": {
-			if (!isAlgorithm(key.algorithm, "RSASSA-PKCS1-v1_5")) throw unusable("RSASSA-PKCS1-v1_5");
+			if (!isAlgorithm$3(key.algorithm, "RSASSA-PKCS1-v1_5")) throw unusable$4("RSASSA-PKCS1-v1_5");
 			const expected = Number.parseInt(alg.slice(2), 10);
-			if (getHashLength(key.algorithm.hash) !== expected) throw unusable(`SHA-${expected}`, "algorithm.hash");
+			if (getHashLength$1(key.algorithm.hash) !== expected) throw unusable$4(`SHA-${expected}`, "algorithm.hash");
 			break;
 		}
 		case "PS256":
 		case "PS384":
 		case "PS512": {
-			if (!isAlgorithm(key.algorithm, "RSA-PSS")) throw unusable("RSA-PSS");
+			if (!isAlgorithm$3(key.algorithm, "RSA-PSS")) throw unusable$4("RSA-PSS");
 			const expected = Number.parseInt(alg.slice(2), 10);
-			if (getHashLength(key.algorithm.hash) !== expected) throw unusable(`SHA-${expected}`, "algorithm.hash");
+			if (getHashLength$1(key.algorithm.hash) !== expected) throw unusable$4(`SHA-${expected}`, "algorithm.hash");
 			break;
 		}
 		case "Ed25519":
 		case "EdDSA":
-			if (!isAlgorithm(key.algorithm, "Ed25519")) throw unusable("Ed25519");
+			if (!isAlgorithm$3(key.algorithm, "Ed25519")) throw unusable$4("Ed25519");
 			break;
 		case "ES256":
 		case "ES384":
 		case "ES512": {
-			if (!isAlgorithm(key.algorithm, "ECDSA")) throw unusable("ECDSA");
+			if (!isAlgorithm$3(key.algorithm, "ECDSA")) throw unusable$4("ECDSA");
 			const expected = getNamedCurve$1(alg);
-			if (key.algorithm.namedCurve !== expected) throw unusable(expected, "algorithm.namedCurve");
-			break;
-		}
-		default: throw new TypeError("CryptoKey does not support this operation");
-	}
-	checkUsage(key, usage);
-}
-function checkEncCryptoKey(key, alg, usage) {
-	switch (alg) {
-		case "A128GCM":
-		case "A192GCM":
-		case "A256GCM": {
-			if (!isAlgorithm(key.algorithm, "AES-GCM")) throw unusable("AES-GCM");
-			const expected = Number.parseInt(alg.slice(1, 4), 10);
-			if (key.algorithm.length !== expected) throw unusable(expected, "algorithm.length");
-			break;
-		}
-		case "A128KW":
-		case "A192KW":
-		case "A256KW": {
-			if (!isAlgorithm(key.algorithm, "AES-KW")) throw unusable("AES-KW");
-			const expected = Number.parseInt(alg.slice(1, 4), 10);
-			if (key.algorithm.length !== expected) throw unusable(expected, "algorithm.length");
-			break;
-		}
-		case "ECDH":
-			switch (key.algorithm.name) {
-				case "ECDH":
-				case "X25519": break;
-				default: throw unusable("ECDH or X25519");
-			}
-			break;
-		case "PBES2-HS256+A128KW":
-		case "PBES2-HS384+A192KW":
-		case "PBES2-HS512+A256KW":
-			if (!isAlgorithm(key.algorithm, "PBKDF2")) throw unusable("PBKDF2");
-			break;
-		case "RSA-OAEP":
-		case "RSA-OAEP-256":
-		case "RSA-OAEP-384":
-		case "RSA-OAEP-512": {
-			if (!isAlgorithm(key.algorithm, "RSA-OAEP")) throw unusable("RSA-OAEP");
-			const expected = Number.parseInt(alg.slice(9), 10) || 1;
-			if (getHashLength(key.algorithm.hash) !== expected) throw unusable(`SHA-${expected}`, "algorithm.hash");
+			if (key.algorithm.namedCurve !== expected) throw unusable$4(expected, "algorithm.namedCurve");
 			break;
 		}
 		default: throw new TypeError("CryptoKey does not support this operation");
 	}
-	checkUsage(key, usage);
-}
-//#endregion
-//#region src/core/jose/sign-verify.ts
-/**
-* This is a fork of Jose library's utility functions.
-* @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/sign.ts
-* @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/verify.ts
-* @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
-*/
-async function sign$1(alg, key, data) {
-	const cryptoKey = await getSignVerifyKey(alg, key, "sign");
-	checkKeyLength(alg, cryptoKey);
-	const signature = await crypto.subtle.sign(subtleAlgorithm(alg, cryptoKey.algorithm), cryptoKey, data);
-	return new Uint8Array(signature);
-}
-async function verify$1(alg, key, signature, data) {
-	const cryptoKey = await getSignVerifyKey(alg, key, "verify");
-	checkKeyLength(alg, cryptoKey);
-	const algorithm = subtleAlgorithm(alg, cryptoKey.algorithm);
-	try {
-		return await crypto.subtle.verify(algorithm, cryptoKey, signature, data);
-	} catch {
-		return false;
-	}
-}
-function checkKeyLength(alg, key) {
-	if (alg.startsWith("RS") || alg.startsWith("PS")) {
-		const { modulusLength } = key.algorithm;
-		if (typeof modulusLength !== "number" || modulusLength < 2048) throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
-	}
-}
-async function getSignVerifyKey(alg, key, usage) {
-	if (key instanceof Uint8Array) {
-		if (!alg.startsWith("HS")) throw new TypeError("Key must be of type CryptoKey or JSON Web Key for non-HMAC algorithms");
-		return crypto.subtle.importKey("raw", key, {
-			hash: `SHA-${alg.slice(-3)}`,
-			name: "HMAC"
-		}, false, [usage]);
-	}
-	checkSigCryptoKey(key, alg, usage);
-	return key;
+	checkUsage$4(key, usage);
 }
 function subtleAlgorithm(alg, algorithm) {
 	const hash = `SHA-${alg.slice(-3)}`;
@@ -523,44 +466,28 @@ function subtleAlgorithm(alg, algorithm) {
 		default: throw new Error(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
 	}
 }
-//#endregion
-//#region src/core/jose/buffer_utils.ts
-/**
-* This is a fork of Jose library's utility functions.
-* @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/buffer_utils.ts
-* @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
-*/
-const MAX_INT32 = 2 ** 32;
-function writeUInt32BE(buf, value, offset) {
-	if (value < 0 || value >= MAX_INT32) throw new RangeError(`value must be >= 0 and <= ${MAX_INT32 - 1}. Received ${value}`);
-	buf.set([
-		value >>> 24,
-		value >>> 16,
-		value >>> 8,
-		value & 255
-	], offset);
+function unusable$4(name, prop = "algorithm.name") {
+	return /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
 }
-function uint64be(value) {
-	const high = Math.floor(value / MAX_INT32);
-	const low = value % MAX_INT32;
-	const buf = new Uint8Array(8);
-	writeUInt32BE(buf, high, 0);
-	writeUInt32BE(buf, low, 4);
-	return buf;
+function isAlgorithm$3(algorithm, name) {
+	return algorithm.name === name;
 }
-function uint32be(value) {
-	const buf = new Uint8Array(4);
-	writeUInt32BE(buf, value);
-	return buf;
+function getHashLength$1(hash) {
+	return Number.parseInt(hash.name.slice(4), 10);
+}
+function getNamedCurve$1(alg) {
+	switch (alg) {
+		case "ES256": return "P-256";
+		case "ES384": return "P-384";
+		case "ES512": return "P-521";
+		default: throw new Error("unreachable");
+	}
+}
+function checkUsage$4(key, usage) {
+	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
 }
 //#endregion
-//#region src/core/jose/cek-iv.ts
-/**
-* This is a fork of Jose library's utility functions.
-* @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/cek.ts
-* @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/iv.ts
-* @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
-*/
+//#region src/core/_crypto/_aes.ts
 const IV_BIT_LENGTHS = {
 	A128GCM: 96,
 	A128GCMKW: 96,
@@ -603,14 +530,112 @@ function checkCEKLength(cek, expected) {
 	const actual = cek.byteLength << 3;
 	if (actual !== expected) throw new Error(`Invalid Content Encryption Key length. Expected ${expected} bits, got ${actual} bits`);
 }
-//#endregion
-//#region src/core/jose/encrypt-decrypt.ts
-/**
-* This is a fork of Jose library's utility functions.
-* @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/encrypt.ts
-* @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/decrypt.ts
-* @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
-*/
+function checkAESCryptoKey(key, alg, usage) {
+	switch (alg) {
+		case "A128GCM":
+		case "A192GCM":
+		case "A256GCM": {
+			if (!isAlgorithm$2(key.algorithm, "AES-GCM")) throw unusable$3("AES-GCM");
+			const expected = Number.parseInt(alg.slice(1, 4), 10);
+			if (key.algorithm.length !== expected) throw unusable$3(expected, "algorithm.length");
+			break;
+		}
+		case "A128KW":
+		case "A192KW":
+		case "A256KW": {
+			if (!isAlgorithm$2(key.algorithm, "AES-KW")) throw unusable$3("AES-KW");
+			const expected = Number.parseInt(alg.slice(1, 4), 10);
+			if (key.algorithm.length !== expected) throw unusable$3(expected, "algorithm.length");
+			break;
+		}
+		default: throw new TypeError("CryptoKey does not support this operation");
+	}
+	checkUsage$3(key, usage);
+}
+async function aesKwWrap(alg, key, cek) {
+	const cryptoKey = await getAESKWCryptoKey(key, alg, { usage: "wrapKey" });
+	checkAESKWKeySize(cryptoKey, alg);
+	const cryptoKeyCek = await crypto.subtle.importKey("raw", cek, {
+		hash: "SHA-256",
+		name: "HMAC"
+	}, true, ["sign"]);
+	return new Uint8Array(await crypto.subtle.wrapKey("raw", cryptoKeyCek, cryptoKey, "AES-KW"));
+}
+async function aesKwUnwrap(alg, key, encryptedKey) {
+	const cryptoKey = await getAESKWCryptoKey(key, alg, { usage: "unwrapKey" });
+	checkAESKWKeySize(cryptoKey, alg);
+	const cryptoKeyCek = await crypto.subtle.unwrapKey("raw", encryptedKey, cryptoKey, "AES-KW", {
+		hash: "SHA-256",
+		name: "HMAC"
+	}, true, ["sign"]);
+	return new Uint8Array(await crypto.subtle.exportKey("raw", cryptoKeyCek));
+}
+async function gcmkwEncrypt(alg, key, plaintext, iv) {
+	const wrapped = await encrypt$1(alg.slice(0, 7), plaintext, key, iv, new Uint8Array(0));
+	return {
+		encryptedKey: wrapped.ciphertext,
+		iv: base64UrlEncode(wrapped.iv),
+		tag: base64UrlEncode(wrapped.tag)
+	};
+}
+async function gcmkwDecrypt(alg, key, ciphertext, iv, tag) {
+	return decrypt$1(alg.slice(0, 7), key, ciphertext, iv, tag, new Uint8Array(0));
+}
+async function encrypt$1(enc, plaintext, cek, iv, aad) {
+	if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) throw new TypeError("Key must be one of type: CryptoKey or Uint8Array");
+	if (iv) checkIvLength(enc, iv);
+	else iv = generateIV(enc);
+	switch (enc) {
+		case "A128CBC-HS256":
+		case "A192CBC-HS384":
+		case "A256CBC-HS512":
+			if (cek instanceof Uint8Array) checkCEKLength(cek, Number.parseInt(enc.slice(-3), 10));
+			return cbcEncrypt(enc, plaintext, cek, iv, aad);
+		case "A128GCM":
+		case "A192GCM":
+		case "A256GCM":
+			if (cek instanceof Uint8Array) checkCEKLength(cek, Number.parseInt(enc.slice(1, 4), 10));
+			return gcmEncrypt(enc, plaintext, cek, iv, aad);
+		default: throw new Error("Unsupported JWE Content Encryption Algorithm");
+	}
+}
+async function decrypt$1(enc, cek, ciphertext, iv, tag, aad) {
+	if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) throw new TypeError("Key must be one of type: CryptoKey or Uint8Array");
+	if (!iv) throw new Error("JWE Initialization Vector missing");
+	if (!tag) throw new Error("JWE Authentication Tag missing");
+	checkIvLength(enc, iv);
+	switch (enc) {
+		case "A128CBC-HS256":
+		case "A192CBC-HS384":
+		case "A256CBC-HS512":
+			if (cek instanceof Uint8Array) checkCEKLength(cek, Number.parseInt(enc.slice(-3), 10));
+			return cbcDecrypt(enc, cek, ciphertext, iv, tag, aad);
+		case "A128GCM":
+		case "A192GCM":
+		case "A256GCM":
+			if (cek instanceof Uint8Array) checkCEKLength(cek, Number.parseInt(enc.slice(1, 4), 10));
+			return gcmDecrypt(enc, cek, ciphertext, iv, tag, aad);
+		default: throw new Error("Unsupported JWE Content Encryption Algorithm");
+	}
+}
+function unusable$3(name, prop = "algorithm.name") {
+	return /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+}
+function isAlgorithm$2(algorithm, name) {
+	return algorithm.name === name;
+}
+function checkUsage$3(key, usage) {
+	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+}
+async function getAESKWCryptoKey(key, alg, options = {}) {
+	const { extractable = true, usage } = options;
+	if (key instanceof Uint8Array) return crypto.subtle.importKey("raw", key, "AES-KW", extractable, [usage ?? "wrapKey"]);
+	checkAESCryptoKey(key, alg, usage);
+	return key;
+}
+function checkAESKWKeySize(key, alg) {
+	if (key.algorithm.length !== Number.parseInt(alg.slice(1, 4), 10)) throw new TypeError(`Invalid key size for alg: ${alg}`);
+}
 async function importCBCKeys(enc, cek, usage) {
 	const keySize = Number.parseInt(enc.slice(1, 4), 10);
 	const [encKey, macKey] = await Promise.all([crypto.subtle.importKey("raw", cek.subarray(keySize >> 3), "AES-CBC", false, [usage]), crypto.subtle.importKey("raw", cek.subarray(0, keySize >> 3), {
@@ -644,7 +669,7 @@ async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
 	let encKey;
 	if (cek instanceof Uint8Array) encKey = await crypto.subtle.importKey("raw", cek, "AES-GCM", false, ["encrypt"]);
 	else {
-		checkEncCryptoKey(cek, enc, "encrypt");
+		checkAESCryptoKey(cek, enc, "encrypt");
 		encKey = cek;
 	}
 	const encrypted = new Uint8Array(await crypto.subtle.encrypt({
@@ -660,50 +685,6 @@ async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
 		iv
 	};
 }
-async function encrypt$1(enc, plaintext, cek, iv, aad) {
-	if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) throw new TypeError("Key must be one of type: CryptoKey or Uint8Array");
-	if (iv) checkIvLength(enc, iv);
-	else iv = generateIV(enc);
-	switch (enc) {
-		case "A128CBC-HS256":
-		case "A192CBC-HS384":
-		case "A256CBC-HS512":
-			if (cek instanceof Uint8Array) checkCEKLength(cek, Number.parseInt(enc.slice(-3), 10));
-			return cbcEncrypt(enc, plaintext, cek, iv, aad);
-		case "A128GCM":
-		case "A192GCM":
-		case "A256GCM":
-			if (cek instanceof Uint8Array) checkCEKLength(cek, Number.parseInt(enc.slice(1, 4), 10));
-			return gcmEncrypt(enc, plaintext, cek, iv, aad);
-		default: throw new Error("Unsupported JWE Content Encryption Algorithm");
-	}
-}
-/**
-* Decrypt fork
-*/
-let _timingSafeKey;
-function getTimingSafeKey() {
-	if (!_timingSafeKey) _timingSafeKey = crypto.subtle.generateKey({
-		name: "HMAC",
-		hash: "SHA-256"
-	}, false, ["sign"]);
-	return _timingSafeKey;
-}
-async function timingSafeEqual(a, b) {
-	if (!(a instanceof Uint8Array)) throw new TypeError("First argument must be a buffer");
-	if (!(b instanceof Uint8Array)) throw new TypeError("Second argument must be a buffer");
-	const algorithm = {
-		name: "HMAC",
-		hash: "SHA-256"
-	};
-	const key = await getTimingSafeKey();
-	const aHmac = new Uint8Array(await crypto.subtle.sign(algorithm, key, a));
-	const bHmac = new Uint8Array(await crypto.subtle.sign(algorithm, key, b));
-	let out = 0;
-	let i = -1;
-	while (++i < 32) out |= aHmac[i] ^ bHmac[i];
-	return out === 0;
-}
 async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
 	if (!(cek instanceof Uint8Array)) throw new TypeError("CBC key must be of type Uint8Array");
 	const { encKey, macKey, keySize } = await importCBCKeys(enc, cek, "decrypt");
@@ -728,7 +709,7 @@ async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
 	let encKey;
 	if (cek instanceof Uint8Array) encKey = await crypto.subtle.importKey("raw", cek, "AES-GCM", false, ["decrypt"]);
 	else {
-		checkEncCryptoKey(cek, enc, "decrypt");
+		checkAESCryptoKey(cek, enc, "decrypt");
 		encKey = cek;
 	}
 	try {
@@ -742,27 +723,62 @@ async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
 		throw new Error("JWE Decryption Failed");
 	}
 }
-async function decrypt$1(enc, cek, ciphertext, iv, tag, aad) {
-	if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) throw new TypeError("Key must be one of type: CryptoKey or Uint8Array");
-	if (!iv) throw new Error("JWE Initialization Vector missing");
-	if (!tag) throw new Error("JWE Authentication Tag missing");
-	checkIvLength(enc, iv);
-	switch (enc) {
-		case "A128CBC-HS256":
-		case "A192CBC-HS384":
-		case "A256CBC-HS512":
-			if (cek instanceof Uint8Array) checkCEKLength(cek, Number.parseInt(enc.slice(-3), 10));
-			return cbcDecrypt(enc, cek, ciphertext, iv, tag, aad);
-		case "A128GCM":
-		case "A192GCM":
-		case "A256GCM":
-			if (cek instanceof Uint8Array) checkCEKLength(cek, Number.parseInt(enc.slice(1, 4), 10));
-			return gcmDecrypt(enc, cek, ciphertext, iv, tag, aad);
-		default: throw new Error("Unsupported JWE Content Encryption Algorithm");
-	}
+let _timingSafeKey;
+function getTimingSafeKey() {
+	if (!_timingSafeKey) _timingSafeKey = crypto.subtle.generateKey({
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, ["sign"]);
+	return _timingSafeKey;
+}
+async function timingSafeEqual(a, b) {
+	if (!(a instanceof Uint8Array)) throw new TypeError("First argument must be a buffer");
+	if (!(b instanceof Uint8Array)) throw new TypeError("Second argument must be a buffer");
+	const algorithm = {
+		name: "HMAC",
+		hash: "SHA-256"
+	};
+	const key = await getTimingSafeKey();
+	const aHmac = new Uint8Array(await crypto.subtle.sign(algorithm, key, a));
+	const bHmac = new Uint8Array(await crypto.subtle.sign(algorithm, key, b));
+	let out = 0;
+	let i = -1;
+	while (++i < 32) out |= aHmac[i] ^ bHmac[i];
+	return out === 0;
+}
+function writeUInt32BE$1(buf, value, offset) {
+	if (value < 0 || value >= 2 ** 32) throw new RangeError(`value must be >= 0 and <= ${2 ** 32 - 1}. Received ${value}`);
+	buf.set([
+		value >>> 24,
+		value >>> 16,
+		value >>> 8,
+		value & 255
+	], offset);
+}
+function uint64be(value) {
+	const high = Math.floor(value / 2 ** 32);
+	const low = value % 2 ** 32;
+	const buf = new Uint8Array(8);
+	writeUInt32BE$1(buf, high, 0);
+	writeUInt32BE$1(buf, low, 4);
+	return buf;
 }
 //#endregion
-//#region src/core/jose/jwk_to_key.ts
+//#region src/core/_crypto/_key-codec.ts
+async function jwkTokey(jwk) {
+	if (!jwk.alg) throw new TypeError("\"alg\" argument is required when \"jwk.alg\" is not present");
+	const { algorithm, keyUsages } = subtleMapping(jwk);
+	return crypto.subtle.importKey("jwk", jwk, algorithm, jwk.ext ?? (jwk.d ? false : true), jwk.key_ops ?? keyUsages);
+}
+async function keyToJWK(key) {
+	if (key instanceof Uint8Array) return {
+		kty: "oct",
+		k: base64UrlEncode(key)
+	};
+	if (!isCryptoKey(key)) throw new TypeError("Key must be one of type: CryptoKey or Uint8Array");
+	if (!key.extractable) throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");
+	return await crypto.subtle.exportKey("jwk", key);
+}
 function subtleMapping(jwk) {
 	let algorithm;
 	let keyUsages;
@@ -860,72 +876,47 @@ function subtleMapping(jwk) {
 		keyUsages
 	};
 }
-async function jwkTokey(jwk) {
-	if (!jwk.alg) throw new TypeError("\"alg\" argument is required when \"jwk.alg\" is not present");
-	const { algorithm, keyUsages } = subtleMapping(jwk);
-	return crypto.subtle.importKey("jwk", jwk, algorithm, jwk.ext ?? (jwk.d ? false : true), jwk.key_ops ?? keyUsages);
-}
-//#endregion
-//#region src/core/jose/key_to_jwk.ts
-async function keyToJWK(key) {
-	if (key instanceof Uint8Array) return {
-		kty: "oct",
-		k: base64UrlEncode(key)
-	};
-	if (!isCryptoKey(key)) throw new TypeError("Key must be one of type: CryptoKey or Uint8Array");
-	if (!key.extractable) throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");
-	return await crypto.subtle.exportKey("jwk", key);
-}
 //#endregion
-//#region src/core/jose/rsaes.ts
+//#region src/core/_crypto/_rsa.ts
 async function encryptRSAES(alg, key, cek) {
-	checkEncCryptoKey(key, alg, "encrypt");
-	checkKeyLength(alg, key);
+	checkRSACryptoKey(key, alg, "encrypt");
+	checkRSAModulusLength(alg, key);
 	return new Uint8Array(await crypto.subtle.encrypt("RSA-OAEP", key, cek));
 }
 async function decryptRSAES(alg, key, encryptedKey) {
-	checkEncCryptoKey(key, alg, "decrypt");
-	checkKeyLength(alg, key);
+	checkRSACryptoKey(key, alg, "decrypt");
+	checkRSAModulusLength(alg, key);
 	return new Uint8Array(await crypto.subtle.decrypt("RSA-OAEP", key, encryptedKey));
 }
-//#endregion
-//#region src/core/jose/aesgcmkw.ts
-/**
-* This is a fork of Jose library's utility functions.
-* @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/aesgcmkw.ts
-* @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
-*/
-async function encryptIV(alg, key, plaintext, iv) {
-	const wrapped = await encrypt$1(alg.slice(0, 7), plaintext, key, iv, new Uint8Array(0));
-	return {
-		encryptedKey: wrapped.ciphertext,
-		iv: base64UrlEncode(wrapped.iv),
-		tag: base64UrlEncode(wrapped.tag)
-	};
+function checkRSACryptoKey(key, alg, usage) {
+	if (!isAlgorithm$1(key.algorithm, "RSA-OAEP")) throw unusable$2("RSA-OAEP");
+	const expected = Number.parseInt(alg.slice(9), 10) || 1;
+	if (getHashLength(key.algorithm.hash) !== expected) throw unusable$2(`SHA-${expected}`, "algorithm.hash");
+	checkUsage$2(key, usage);
 }
-async function decryptIV(alg, key, ciphertext, iv, tag) {
-	return decrypt$1(alg.slice(0, 7), key, ciphertext, iv, tag, new Uint8Array(0));
+function checkRSAModulusLength(alg, key) {
+	if (alg.startsWith("RS") || alg.startsWith("PS") || alg.startsWith("RSA")) {
+		const { modulusLength } = key.algorithm;
+		if (typeof modulusLength !== "number" || modulusLength < 2048) throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
+	}
 }
-//#endregion
-//#region src/core/jose/ecdhes.ts
-function lengthAndInput(input) {
-	return concatUint8Arrays(uint32be(input.length), input);
+function unusable$2(name, prop = "algorithm.name") {
+	return /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
 }
-async function concatKdf(secret, bits, value) {
-	const iterations = Math.ceil((bits >> 3) / 32);
-	const res = new Uint8Array(iterations * 32);
-	for (let iter = 0; iter < iterations; iter++) {
-		const buf = new Uint8Array(4 + secret.length + value.length);
-		buf.set(uint32be(iter + 1));
-		buf.set(secret, 4);
-		buf.set(value, 4 + secret.length);
-		res.set(await digest("sha256", buf), iter * 32);
-	}
-	return res.slice(0, bits >> 3);
+function isAlgorithm$1(algorithm, name) {
+	return algorithm.name === name;
+}
+function getHashLength(hash) {
+	return Number.parseInt(hash.name.slice(4), 10);
+}
+function checkUsage$2(key, usage) {
+	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
 }
+//#endregion
+//#region src/core/_crypto/_ecdh.ts
 async function deriveECDHESKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) {
-	checkEncCryptoKey(publicKey, "ECDH");
-	checkEncCryptoKey(privateKey, "ECDH", "deriveBits");
+	checkECDHCryptoKey(publicKey, "ECDH");
+	checkECDHCryptoKey(privateKey, "ECDH", "deriveBits");
 	const value = concatUint8Arrays(lengthAndInput(textEncoder.encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength));
 	const length = publicKey.algorithm.name === "X25519" ? 256 : Math.ceil(Number.parseInt(publicKey.algorithm.namedCurve.slice(-3), 10) / 8) << 3;
 	return concatKdf(new Uint8Array(await crypto.subtle.deriveBits({
@@ -933,7 +924,7 @@ async function deriveECDHESKey(publicKey, privateKey, algorithm, keyLength, apu
 		public: publicKey
 	}, privateKey, length)), keyLength, value);
 }
-function allowed(key) {
+function isECDHKeyAllowed(key) {
 	switch (key.algorithm.namedCurve) {
 		case "P-256":
 		case "P-384":
@@ -941,38 +932,65 @@ function allowed(key) {
 		default: return key.algorithm.name === "X25519";
 	}
 }
+function checkECDHCryptoKey(key, alg, usage) {
+	switch (key.algorithm.name) {
+		case "ECDH":
+		case "X25519": break;
+		default: throw unusable$1("ECDH or X25519");
+	}
+	checkUsage$1(key, usage);
+}
+function unusable$1(name, prop = "algorithm.name") {
+	return /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
+}
+function checkUsage$1(key, usage) {
+	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+}
+async function concatKdf(secret, bits, value) {
+	const iterations = Math.ceil((bits >> 3) / 32);
+	const res = new Uint8Array(iterations * 32);
+	for (let iter = 0; iter < iterations; iter++) {
+		const buf = new Uint8Array(4 + secret.length + value.length);
+		buf.set(uint32be(iter + 1));
+		buf.set(secret, 4);
+		buf.set(value, 4 + secret.length);
+		res.set(await digest("sha256", buf), iter * 32);
+	}
+	return res.slice(0, bits >> 3);
+}
+function lengthAndInput(input) {
+	return concatUint8Arrays(uint32be(input.length), input);
+}
 async function digest(algorithm, data) {
-	const subtleDigest = `SHA-${algorithm.slice(-3)}`;
-	return new Uint8Array(await crypto.subtle.digest(subtleDigest, data));
+	return new Uint8Array(await crypto.subtle.digest(`SHA-${algorithm.slice(-3)}`, data));
+}
+function writeUInt32BE(buf, value, offset) {
+	if (value < 0 || value >= 2 ** 32) throw new RangeError(`value must be >= 0 and <= ${2 ** 32 - 1}. Received ${value}`);
+	buf.set([
+		value >>> 24,
+		value >>> 16,
+		value >>> 8,
+		value & 255
+	], offset);
+}
+function uint32be(value) {
+	const buf = new Uint8Array(4);
+	writeUInt32BE(buf, value, 0);
+	return buf;
 }
 //#endregion
-//#region src/core/jose/pbes2kw.ts
-/**
-* This is a fork of Jose library's utility functions.
-* @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/pbes2kw.ts
-* @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
-*/
-async function wrap(alg, key, cek, p2c, p2s) {
-	if (p2c && p2s) {
-		const derived = await deriveKey(p2s, alg, p2c, key);
-		return {
-			encryptedKey: await _wrap(alg.slice(-6), derived, cek),
-			p2c,
-			p2s: base64UrlEncode(p2s)
-		};
-	} else return { encryptedKey: await _wrap(alg, key, cek) };
-}
-async function unwrap(alg, key, encryptedKey, p2c, p2s) {
-	if (p2c && p2s) {
-		const derived = await deriveKey(p2s, alg, p2c, key);
-		return _unwrap(alg.slice(-6), derived, encryptedKey);
-	} else return _unwrap(alg, key, encryptedKey);
-}
-function getCryptoKey(key, alg, options = {}) {
-	const { importAlg = "PBKDF2", extractable = false, usage = "deriveBits" } = options;
-	if (key instanceof Uint8Array) return crypto.subtle.importKey("raw", key, importAlg, extractable, [usage]);
-	checkEncCryptoKey(key, alg, usage);
-	return key;
+//#region src/core/_crypto/_pbes2.ts
+async function pbes2Wrap(alg, key, cek, p2c, p2s) {
+	const derived = await deriveKey(p2s, alg, p2c, key);
+	return {
+		encryptedKey: await aesKwWrap(alg.slice(-6), derived, cek),
+		p2c,
+		p2s: base64UrlEncode(p2s)
+	};
+}
+async function pbes2Unwrap(alg, key, encryptedKey, p2c, p2s) {
+	const derived = await deriveKey(p2s, alg, p2c, key);
+	return aesKwUnwrap(alg.slice(-6), derived, encryptedKey);
 }
 async function deriveKey(p2s, alg, p2c, key) {
 	if (!(p2s instanceof Uint8Array) || p2s.length < 8) throw new Error("PBES2 Salt Input must be 8 or more octets");
@@ -985,92 +1003,44 @@ async function deriveKey(p2s, alg, p2c, key) {
 		name: "PBKDF2",
 		salt
 	};
-	const cryptoKey = await getCryptoKey(key, alg);
+	const cryptoKey = await getPBKDF2CryptoKey(key, alg);
 	return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
 }
-/**
-* Fork from: https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/aeskw.ts
-*/
-function checkKeySize(key, alg) {
-	if (key.algorithm.length !== Number.parseInt(alg.slice(1, 4), 10)) throw new TypeError(`Invalid key size for alg: ${alg}`);
-}
-async function _wrap(alg, key, cek) {
-	const cryptoKey = await getCryptoKey(key, alg, {
-		importAlg: "AES-KW",
-		extractable: true,
-		usage: "wrapKey"
-	});
-	checkKeySize(cryptoKey, alg);
-	const cryptoKeyCek = await crypto.subtle.importKey("raw", cek, {
-		hash: "SHA-256",
-		name: "HMAC"
-	}, true, ["sign"]);
-	return new Uint8Array(await crypto.subtle.wrapKey("raw", cryptoKeyCek, cryptoKey, "AES-KW"));
-}
-async function _unwrap(alg, key, encryptedKey) {
-	const cryptoKey = await getCryptoKey(key, alg, {
-		importAlg: "AES-KW",
-		extractable: true,
-		usage: "unwrapKey"
-	});
-	checkKeySize(cryptoKey, alg);
-	const cryptoKeyCek = await crypto.subtle.unwrapKey("raw", encryptedKey, cryptoKey, "AES-KW", {
-		hash: "SHA-256",
-		name: "HMAC"
-	}, true, ["sign"]);
-	return new Uint8Array(await crypto.subtle.exportKey("raw", cryptoKeyCek));
+function checkPBES2CryptoKey(key, alg, usage) {
+	if (!isAlgorithm(key.algorithm, "PBKDF2")) throw unusable("PBKDF2");
+	checkUsage(key, usage);
 }
-//#endregion
-//#region src/core/jose/encrypt_key.ts
-const PUBLIC_EPK_FIELDS = new Set([
-	"kty",
-	"crv",
-	"x",
-	"y",
-	"kid",
-	"use",
-	"key_ops",
-	"alg",
-	"x5c",
-	"x5t",
-	"x5t#S256",
-	"x5u"
-]);
-function toPublicEpkJwk(jwk) {
-	const filtered = {};
-	for (const [key, value] of Object.entries(jwk)) if (value !== void 0 && PUBLIC_EPK_FIELDS.has(key)) filtered[key] = value;
-	const { kty, crv, x, y } = filtered;
-	if (typeof kty !== "string") throw new TypeError("ECDH-ES ephemeral key JWK must include the \"kty\" parameter.");
-	if (typeof crv !== "string") throw new TypeError("ECDH-ES ephemeral key JWK must include the \"crv\" parameter.");
-	if (typeof x !== "string") throw new TypeError("ECDH-ES ephemeral key JWK must include the \"x\" coordinate.");
-	if (kty === "EC" && typeof y !== "string") throw new TypeError("ECDH-ES EC ephemeral key JWK must include both \"x\" and \"y\" coordinates.");
-	const publicJwk = {
-		...filtered,
-		kty,
-		crv,
-		x
-	};
-	if (typeof y === "string") publicJwk.y = y;
-	else delete publicJwk.y;
-	return sanitizeObject(publicJwk);
+function unusable(name, prop = "algorithm.name") {
+	return /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
 }
-async function ensurePrivateKey(alg, value) {
-	const normalized = await normalizeKey(value, alg);
-	if (!(normalized instanceof CryptoKey)) throw new TypeError("ECDH-ES ephemeral private key must be a CryptoKey or convertible JWK.");
-	if (normalized.type !== "private") throw new TypeError("ECDH-ES ephemeral private key must have type \"private\".");
-	return normalized;
+function isAlgorithm(algorithm, name) {
+	return algorithm.name === name;
 }
-async function exportPublicJwkFrom(alg, value) {
-	if (isCryptoKey(value)) try {
-		return toPublicEpkJwk(await keyToJWK(value));
-	} catch (error_) {
-		throw new TypeError("ECDH-ES ephemeral CryptoKey must be extractable to export as JWK.", { cause: error_ instanceof Error ? error_ : void 0 });
-	}
-	if (isJWK(value) && isAsymmetricJWK(value) && value.kty === "EC") return toPublicEpkJwk(value);
-	const normalized = await normalizeKey(value, alg);
-	if (!(normalized instanceof CryptoKey)) throw new TypeError("ECDH-ES ephemeral public key must be a CryptoKey or convertible JWK.");
-	return exportPublicJwkFrom(alg, normalized);
+function checkUsage(key, usage) {
+	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
+}
+async function getPBKDF2CryptoKey(key, alg, options = {}) {
+	const { extractable = false, usage = "deriveBits" } = options;
+	if (key instanceof Uint8Array) return crypto.subtle.importKey("raw", key, "PBKDF2", extractable, [usage]);
+	checkPBES2CryptoKey(key, alg, usage);
+	return key;
 }
+//#endregion
+//#region src/core/_crypto/_key-encryption.ts
+const PUBLIC_EPK_FIELDS = new Set([
+	"kty",
+	"crv",
+	"x",
+	"y",
+	"kid",
+	"use",
+	"key_ops",
+	"alg",
+	"x5c",
+	"x5t",
+	"x5t#S256",
+	"x5u"
+]);
 async function encryptKey(alg, enc, key, providedCek, providedParameters = {}) {
 	let encryptedKey;
 	let parameters = {};
@@ -1084,7 +1054,7 @@ async function encryptKey(alg, enc, key, providedCek, providedParameters = {}) {
 		case "ECDH-ES+A192KW":
 		case "ECDH-ES+A256KW": {
 			assertCryptoKey(key);
-			if (!allowed(key)) throw new Error("ECDH with the provided key is not allowed or not supported by your javascript runtime");
+			if (!isECDHKeyAllowed(key)) throw new Error("ECDH with the provided key is not allowed or not supported by your javascript runtime");
 			const { apu, apv, epk: providedEpk, epkPrivateKey } = providedParameters;
 			if (providedEpk && !epkPrivateKey) throw new TypeError("ECDH-ES custom ephemeral key material must include the matching private key.");
 			let ephemeralPrivateKey;
@@ -1107,7 +1077,7 @@ async function encryptKey(alg, enc, key, providedCek, providedParameters = {}) {
 				break;
 			}
 			cek = providedCek || generateCEK(enc);
-			encryptedKey = (await wrap(alg.slice(-6), sharedSecret, cek)).encryptedKey;
+			encryptedKey = await aesKwWrap(alg.slice(-6), sharedSecret, cek);
 			break;
 		}
 		case "RSA-OAEP":
@@ -1123,21 +1093,21 @@ async function encryptKey(alg, enc, key, providedCek, providedParameters = {}) {
 		case "PBES2-HS512+A256KW": {
 			cek = providedCek || generateCEK(enc);
 			const { p2c, p2s } = providedParameters;
-			({encryptedKey, ...parameters} = await wrap(alg, key, cek, p2c, p2s));
+			({encryptedKey, ...parameters} = await pbes2Wrap(alg, key, cek, p2c, p2s));
 			break;
 		}
 		case "A128KW":
 		case "A192KW":
 		case "A256KW":
 			cek = providedCek || generateCEK(enc);
-			encryptedKey = (await wrap(alg, key, cek)).encryptedKey;
+			encryptedKey = await aesKwWrap(alg, key, cek);
 			break;
 		case "A128GCMKW":
 		case "A192GCMKW":
 		case "A256GCMKW": {
 			cek = providedCek || generateCEK(enc);
 			const { iv } = providedParameters;
-			({encryptedKey, ...parameters} = await encryptIV(alg, key, cek, iv));
+			({encryptedKey, ...parameters} = await gcmkwEncrypt(alg, key, cek, iv));
 			break;
 		}
 		default: throw new Error("Invalid or unsupported \"alg\" (JWE Algorithm) header value");
@@ -1160,67 +1130,72 @@ async function normalizeKey(key, alg) {
 	}
 	throw new Error("unreachable");
 }
+function toPublicEpkJwk(jwk) {
+	const filtered = {};
+	for (const [key, value] of Object.entries(jwk)) if (value !== void 0 && PUBLIC_EPK_FIELDS.has(key)) filtered[key] = value;
+	const { kty, crv, x, y } = filtered;
+	if (typeof kty !== "string") throw new TypeError("ECDH-ES ephemeral key JWK must include the \"kty\" parameter.");
+	if (typeof crv !== "string") throw new TypeError("ECDH-ES ephemeral key JWK must include the \"crv\" parameter.");
+	if (typeof x !== "string") throw new TypeError("ECDH-ES ephemeral key JWK must include the \"x\" coordinate.");
+	if (kty === "EC" && typeof y !== "string") throw new TypeError("ECDH-ES EC ephemeral key JWK must include both \"x\" and \"y\" coordinates.");
+	const publicJwk = {
+		...filtered,
+		kty,
+		crv,
+		x
+	};
+	if (typeof y === "string") publicJwk.y = y;
+	else delete publicJwk.y;
+	return sanitizeObject(publicJwk);
+}
+async function ensurePrivateKey(alg, value) {
+	const normalized = await normalizeKey(value, alg);
+	if (!(normalized instanceof CryptoKey)) throw new TypeError("ECDH-ES ephemeral private key must be a CryptoKey or convertible JWK.");
+	if (normalized.type !== "private") throw new TypeError("ECDH-ES ephemeral private key must have type \"private\".");
+	return normalized;
+}
+async function exportPublicJwkFrom(alg, value) {
+	if (isCryptoKey(value)) try {
+		return toPublicEpkJwk(await keyToJWK(value));
+	} catch (error_) {
+		throw new TypeError("ECDH-ES ephemeral CryptoKey must be extractable to export as JWK.", { cause: error_ instanceof Error ? error_ : void 0 });
+	}
+	if (isJWK(value) && isAsymmetricJWK(value) && value.kty === "EC") return toPublicEpkJwk(value);
+	const normalized = await normalizeKey(value, alg);
+	if (!(normalized instanceof CryptoKey)) throw new TypeError("ECDH-ES ephemeral public key must be a CryptoKey or convertible JWK.");
+	return exportPublicJwkFrom(alg, normalized);
+}
 //#endregion
-//#region src/core/jose/asn1.ts
-/**
-* This is a fork of Jose library's utility functions.
-* @source https://github.com/panva/jose/tree/69b7960c67e05be55fa2ec31c74b987696c20c60/src/lib/asn1.ts
-* @license MIT https://github.com/panva/jose/blob/69b7960c67e05be55fa2ec31c74b987696c20c60/LICENSE.md
-*/
-const formatPEM = (b64, descriptor) => {
-	return `-----BEGIN ${descriptor}-----\n${(b64.match(/.{1,64}/g) || []).join("\n")}\n-----END ${descriptor}-----`;
-};
-const genericExport = async (keyType, keyFormat, key) => {
-	if (!isCryptoKey(key)) throw new TypeError(`Key must be ${key} of type CryptoKey`);
-	if (!key.extractable) throw new TypeError("CryptoKey is not extractable");
-	if (key.type !== keyType) throw new TypeError(`key is not a ${keyType} key`);
-	return formatPEM(base64Encode(new Uint8Array(await crypto.subtle.exportKey(keyFormat, key))), `${keyType.toUpperCase()} KEY`);
-};
+//#region src/core/_crypto/_pem.ts
 const toSPKI = (key) => {
 	return genericExport("public", "spki", key);
 };
 const toPKCS8 = (key) => {
 	return genericExport("private", "pkcs8", key);
 };
-const findOid = (keyData, oid, from = 0) => {
-	if (from === 0) {
-		oid.unshift(oid.length);
-		oid.unshift(6);
-	}
-	const i = keyData.indexOf(oid[0], from);
-	if (i === -1) return false;
-	const sub = keyData.subarray(i, i + oid.length);
-	if (sub.length !== oid.length) return false;
-	return sub.every((value, index) => value === oid[index]) || findOid(keyData, oid, i + 1);
+const fromPKCS8 = (pem, alg, options) => {
+	return genericImport(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, "pkcs8", pem, alg, options);
 };
-const getNamedCurve = (keyData) => {
-	switch (true) {
-		case findOid(keyData, [
-			42,
-			134,
-			72,
-			206,
-			61,
-			3,
-			1,
-			7
-		]): return "P-256";
-		case findOid(keyData, [
-			43,
-			129,
-			4,
-			0,
-			34
-		]): return "P-384";
-		case findOid(keyData, [
-			43,
-			129,
-			4,
-			0,
-			35
-		]): return "P-521";
-		default: return;
+const fromSPKI = (pem, alg, options) => {
+	return genericImport(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g, "spki", pem, alg, options);
+};
+const fromX509 = (pem, alg, options) => {
+	let spki;
+	try {
+		spki = getSPKI(pem);
+	} catch (error_) {
+		throw new TypeError("Failed to parse the X.509 certificate", { cause: error_ });
 	}
+	return fromSPKI(spki, alg, options);
+};
+const formatPEM = (b64, descriptor) => {
+	return `-----BEGIN ${descriptor}-----\n${(b64.match(/.{1,64}/g) || []).join("\n")}\n-----END ${descriptor}-----`;
+};
+const genericExport = async (keyType, keyFormat, key) => {
+	if (!isCryptoKey(key)) throw new TypeError(`Key must be ${key} of type CryptoKey`);
+	if (!key.extractable) throw new TypeError("CryptoKey is not extractable");
+	if (key.type !== keyType) throw new TypeError(`key is not a ${keyType} key`);
+	return formatPEM(base64Encode(new Uint8Array(await crypto.subtle.exportKey(keyFormat, key))), `${keyType.toUpperCase()} KEY`);
 };
 const genericImport = async (replace, keyFormat, pem, alg, options) => {
 	let algorithm;
@@ -1298,13 +1273,47 @@ const genericImport = async (replace, keyFormat, pem, alg, options) => {
 	}
 	return crypto.subtle.importKey(keyFormat, keyData, algorithm, options?.extractable ?? (isPublic ? true : false), keyUsages);
 };
-const fromPKCS8 = (pem, alg, options) => {
-	return genericImport(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, "pkcs8", pem, alg, options);
+const findOid = (keyData, oid, from = 0) => {
+	if (from === 0) {
+		oid.unshift(oid.length);
+		oid.unshift(6);
+	}
+	const i = keyData.indexOf(oid[0], from);
+	if (i === -1) return false;
+	const sub = keyData.subarray(i, i + oid.length);
+	if (sub.length !== oid.length) return false;
+	return sub.every((value, index) => value === oid[index]) || findOid(keyData, oid, i + 1);
 };
-const fromSPKI = (pem, alg, options) => {
-	return genericImport(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g, "spki", pem, alg, options);
+const getNamedCurve = (keyData) => {
+	switch (true) {
+		case findOid(keyData, [
+			42,
+			134,
+			72,
+			206,
+			61,
+			3,
+			1,
+			7
+		]): return "P-256";
+		case findOid(keyData, [
+			43,
+			129,
+			4,
+			0,
+			34
+		]): return "P-384";
+		case findOid(keyData, [
+			43,
+			129,
+			4,
+			0,
+			35
+		]): return "P-521";
+		default: return;
+	}
 };
-function getElement(seq) {
+const getElement = (seq) => {
 	const result = [];
 	let next = 0;
 	while (next < seq.length) {
@@ -1313,8 +1322,8 @@ function getElement(seq) {
 		next += nextPart.byteLength;
 	}
 	return result;
-}
-function parseElement(bytes) {
+};
+const parseElement = (bytes) => {
 	let position = 0;
 	let tag = bytes[0] & 31;
 	position++;
@@ -1358,13 +1367,13 @@ function parseElement(bytes) {
 		contents: bytes.subarray(position, byteLength),
 		raw: bytes.subarray(0, byteLength)
 	};
-}
-function spkiFromX509(buf) {
+};
+const spkiFromX509 = (buf) => {
 	const tbsCertificate = getElement(getElement(parseElement(buf).contents)[0].contents);
 	return base64Encode(tbsCertificate[tbsCertificate[0].raw[0] === 160 ? 6 : 5].raw);
-}
+};
 let createPublicKey;
-function getSPKI(x509) {
+const getSPKI = (x509) => {
 	try {
 		createPublicKey ??= globalThis.process?.getBuiltinModule?.("node:crypto")?.createPublicKey;
 	} catch {
@@ -1377,15 +1386,6 @@ function getSPKI(x509) {
 		});
 	} catch {}
 	return formatPEM(spkiFromX509(base64Decode(x509.replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g, ""), false)), "PUBLIC KEY");
-}
-const fromX509 = (pem, alg, options) => {
-	let spki;
-	try {
-		spki = getSPKI(pem);
-	} catch (error_) {
-		throw new TypeError("Failed to parse the X.509 certificate", { cause: error_ });
-	}
-	return fromSPKI(spki, alg, options);
 };
 //#endregion
 //#region src/core/jwk.ts
@@ -1399,25 +1399,13 @@ async function generateKey(alg, options = {}) {
 	}
 	const { algorithm, keyUsages } = getGenerateKeyParams(alg, options);
 	const key = await crypto.subtle.generateKey(algorithm, defaultExtractable, keyUsages);
-	if (exportToJWK) {
-		const { alg: _a, kty: _k, key_ops: _ko, ext: _e, ...additionalKeyParams } = typeof options.toJWK === "object" ? options.toJWK : {};
-		if (key instanceof CryptoKey) return exportKey(key, {
-			...additionalKeyParams,
-			alg
-		});
-		else {
-			const [publicKey, privateKey] = await Promise.all([exportKey(key.publicKey, {
-				...additionalKeyParams,
-				alg
-			}), exportKey(key.privateKey, {
-				...additionalKeyParams,
-				alg
-			})]);
-			return {
-				privateKey,
-				publicKey
-			};
-		}
+	if (exportToJWK) if (key instanceof CryptoKey) return exportKey(key, { alg });
+	else {
+		const [publicKey, privateKey] = await Promise.all([exportKey(key.publicKey, { alg }), exportKey(key.privateKey, { alg })]);
+		return {
+			privateKey,
+			publicKey
+		};
 	}
 	return key;
 }
@@ -1430,14 +1418,31 @@ async function generateKey(alg, options = {}) {
 * @returns A Promise resolving to the generated JWK or JWK pair representation.
 */
 async function generateJWK(alg, jwkParams, options = {}) {
-	const { toJWK: _, ...opts } = options;
-	return generateKey(alg, {
-		...opts,
-		toJWK: {
-			kid: typeof jwkParams?.kid === "string" ? jwkParams.kid : crypto.randomUUID(),
-			...jwkParams
-		}
+	const extraParams = {
+		kid: typeof jwkParams?.kid === "string" ? jwkParams.kid : crypto.randomUUID(),
+		...jwkParams
+	};
+	const result = await generateKey(alg, {
+		...options,
+		toJWK: true
 	});
+	if (result && typeof result === "object" && "privateKey" in result && "publicKey" in result) {
+		const pair = result;
+		return {
+			privateKey: {
+				...extraParams,
+				...pair.privateKey
+			},
+			publicKey: {
+				...extraParams,
+				...pair.publicKey
+			}
+		};
+	}
+	return {
+		...extraParams,
+		...result
+	};
 }
 async function deriveKeyFromPassword(password, alg, options) {
 	const { salt, iterations, extractable, keyUsage } = options;
@@ -1449,16 +1454,11 @@ async function deriveKeyFromPassword(password, alg, options) {
 	const finalUsages = keyUsage ?? ["wrapKey", "unwrapKey"];
 	const finalExtractable = exportToJWK ? true : extractable === true;
 	const derivedKey = await crypto.subtle.importKey("raw", derivedBytes, { name: "AES-KW" }, finalExtractable, finalUsages);
-	if (exportToJWK) {
-		const jwk = await keyToJWK(derivedKey);
-		const { alg: _a, kty: _k, key_ops: _ko, ext: _e, ...additionalKeyParams } = typeof options.toJWK === "object" ? options.toJWK : {};
-		return {
-			...additionalKeyParams,
-			...jwk,
-			alg: wrappingAlg,
-			kty: "oct"
-		};
-	}
+	if (exportToJWK) return {
+		...await keyToJWK(derivedKey),
+		alg: wrappingAlg,
+		kty: "oct"
+	};
 	return derivedKey;
 }
 /**
@@ -1471,36 +1471,67 @@ async function deriveKeyFromPassword(password, alg, options) {
 * @returns A Promise resolving to the derived JWK (JWK_oct).
 */
 async function deriveJWKFromPassword(password, alg, options, jwkParams) {
-	const { toJWK: _, ...opts } = options;
-	return deriveKeyFromPassword(password, alg, {
-		...opts,
-		toJWK: jwkParams || true
+	const result = await deriveKeyFromPassword(password, alg, {
+		...options,
+		toJWK: true
 	});
+	return jwkParams ? {
+		...jwkParams,
+		...result
+	} : result;
 }
 /**
-* Cache for imported JWKs to avoid redundant CryptoKey creation.
+* Default JWK import cache backed by a WeakMap.
+*
+* The outer WeakMap is keyed by the JWK object reference — a cache hit only
+* occurs when the exact same object variable is passed to {@link importKey}.
+* Reconstructing a structurally identical JWK (e.g. `{ ...jwk }`) will miss
+* the cache.
+*
+* The inner `Record<string, CryptoKey>` uses a plain object rather than `Map`
+* because typical entries have 1–2 algorithm strings per key. V8 applies
+* hidden-class optimisation to small plain objects, making property access
+* faster than `Map.get()` at this cardinality.
 */
-let _jwkCache;
-async function importKey(key, alg) {
+var WeakMapJWKCache = class {
+	_map = /* @__PURE__ */ new WeakMap();
+	get(jwk, alg) {
+		return this._map.get(jwk)?.[alg];
+	}
+	set(jwk, alg, key) {
+		let entry = this._map.get(jwk);
+		if (!entry) this._map.set(jwk, { [alg]: key });
+		else entry[alg] = key;
+	}
+};
+let _activeCache = new WeakMapJWKCache();
+async function importKey(key, algOrOptions) {
+	const alg = typeof algOrOptions === "string" ? algOrOptions : void 0;
 	if (typeof key === "string") key = textEncoder.encode(key);
 	if (key instanceof Uint8Array) return key;
 	if (isCryptoKey(key)) return key;
-	if (isJWK(key)) if ("k" in key && typeof key.k === "string") return base64UrlDecode(key.k, false);
-	else {
+	if (isJWK(key)) if ("k" in key && typeof key.k === "string") {
+		const rawBytes = base64UrlDecode(key.k, false);
+		if (typeof algOrOptions === "object" && algOrOptions.asCryptoKey) {
+			const { algorithm, usage, extractable = false } = algOrOptions;
+			return crypto.subtle.importKey("raw", rawBytes, algorithm, extractable, usage);
+		}
+		return rawBytes;
+	} else {
 		if (!key.alg && !alg) throw new TypeError("Algorithm must be provided when importing non-oct JWK");
 		const effectiveAlg = key.alg || alg;
-		_jwkCache ||= /* @__PURE__ */ new WeakMap();
-		const cached = _jwkCache.get(key);
-		if (cached?.[effectiveAlg]) return cached[effectiveAlg];
+		if (_activeCache) {
+			const cached = _activeCache.get(key, effectiveAlg);
+			if (cached) return cached;
+		}
 		const cryptoKey = await jwkTokey(key.alg ? key : {
 			...key,
 			alg
 		});
-		if (!cached) _jwkCache.set(key, { [effectiveAlg]: cryptoKey });
-		else cached[effectiveAlg] = cryptoKey;
+		if (_activeCache) _activeCache.set(key, effectiveAlg, cryptoKey);
 		return cryptoKey;
 	}
-	throw new Error("Invalid key type provided to importKey");
+	throw new JWTError("Invalid key type provided to importKey", "ERR_JWK_INVALID");
 }
 /**
 * Exports a CryptoKey to a JWK (JSON Web Key) format.
@@ -1522,41 +1553,37 @@ async function resolveWrappingKey(alg, key) {
 	if (typeof key === "string") throw new TypeError(`Key must be CryptoKey, JWK, or Uint8Array for ${alg}`);
 	return importKey(key, alg);
 }
-/**
-* Unwraps a Content Encryption Key (CEK) using the specified algorithm and unwrapping key.
-*
-* @param alg The JWA key management algorithm (e.g., "A128KW", "RSA-OAEP", "PBES2-HS256+A128KW").
-* @param wrappedKey The wrapped key (ciphertext) as Uint8Array.
-* @param unwrappingKey The key used to unwrap the CEK (CryptoKey, JWK, or password string/Uint8Array for PBES2).
-* @param options Additional options required by certain algorithms (e.g., iv, tag, p2s, p2c, epk).
-* @returns A Promise resolving to the unwrapped key (CEK) as a CryptoKey or Uint8Array.
-*/
 async function unwrapKey(alg, wrappedKey, unwrappingKey, options = {}) {
-	const { returnAs = true } = options;
+	const returnRaw = options.format === "raw";
 	const defaultExtractable = options.extractable !== false;
 	const importedUnwrappingKey = isCryptoKey(unwrappingKey) ? unwrappingKey : await resolveWrappingKey(alg, unwrappingKey);
 	let unwrappedCekBytes;
 	switch (alg) {
+		case "dir":
+			if (importedUnwrappingKey instanceof Uint8Array) unwrappedCekBytes = importedUnwrappingKey;
+			else {
+				if (!returnRaw) return importedUnwrappingKey;
+				unwrappedCekBytes = new Uint8Array(await crypto.subtle.exportKey("raw", importedUnwrappingKey));
+			}
+			break;
 		case "A128KW":
 		case "A192KW":
 		case "A256KW":
+			unwrappedCekBytes = await aesKwUnwrap(alg, importedUnwrappingKey, wrappedKey);
+			break;
 		case "PBES2-HS256+A128KW":
 		case "PBES2-HS384+A192KW":
 		case "PBES2-HS512+A256KW": {
 			const { p2s, p2c } = options;
-			let p2sBytes;
-			if (alg.startsWith("PBES2")) {
-				if (!p2s || typeof p2c !== "number") throw new Error("PBES2 requires 'p2s' (salt) and 'p2c' (count) options");
-				p2sBytes = typeof p2s === "string" ? base64UrlDecode(p2s, false) : p2s;
-			}
-			unwrappedCekBytes = await unwrap(alg, importedUnwrappingKey, wrappedKey, p2c, p2sBytes);
+			if (!p2s || typeof p2c !== "number") throw new Error("PBES2 requires 'p2s' (salt) and 'p2c' (count) options");
+			unwrappedCekBytes = await pbes2Unwrap(alg, importedUnwrappingKey, wrappedKey, p2c, typeof p2s === "string" ? base64UrlDecode(p2s, false) : p2s);
 			break;
 		}
 		case "A128GCMKW":
 		case "A192GCMKW":
 		case "A256GCMKW":
 			if (!options.iv || !options.tag) throw new Error("AES-GCMKW requires 'iv' and 'tag' options for unwrapping");
-			unwrappedCekBytes = await decryptIV(alg, importedUnwrappingKey, wrappedKey, typeof options.iv === "string" ? base64UrlDecode(options.iv, false) : options.iv, typeof options.tag === "string" ? base64UrlDecode(options.tag, false) : options.tag);
+			unwrappedCekBytes = await gcmkwDecrypt(alg, importedUnwrappingKey, wrappedKey, typeof options.iv === "string" ? base64UrlDecode(options.iv, false) : options.iv, typeof options.tag === "string" ? base64UrlDecode(options.tag, false) : options.tag);
 			break;
 		case "RSA-OAEP":
 		case "RSA-OAEP-256":
@@ -1564,7 +1591,7 @@ async function unwrapKey(alg, wrappedKey, unwrappingKey, options = {}) {
 		case "RSA-OAEP-512": {
 			if (!(importedUnwrappingKey instanceof CryptoKey)) throw new TypeError("RSA-OAEP requires the unwrapping key to be provided as a CryptoKey");
 			unwrappedCekBytes = await decryptRSAES(alg, importedUnwrappingKey, wrappedKey);
-			if (!returnAs) break;
+			if (returnRaw) break;
 			const inferredAlgorithm = options.unwrappedKeyAlgorithm || inferAesImportAlgorithm(options.enc, unwrappedCekBytes.length);
 			if (!inferredAlgorithm) throw new Error("Unable to infer algorithm for RSA-OAEP unwrapped key. Provide \"unwrappedKeyAlgorithm\" in options.");
 			const keyUsages = options.keyUsage || ["encrypt", "decrypt"];
@@ -1576,7 +1603,7 @@ async function unwrapKey(alg, wrappedKey, unwrappingKey, options = {}) {
 		case "ECDH-ES+A256KW": {
 			if (!options.epk) throw new Error("ECDH-ES requires 'epk' (Ephemeral Public Key) option");
 			if (!(importedUnwrappingKey instanceof CryptoKey)) throw new TypeError("ECDH-ES requires the unwrapping key to be a CryptoKey");
-			if (!allowed(importedUnwrappingKey)) throw new Error("ECDH with the provided key is not allowed or not supported");
+			if (!isECDHKeyAllowed(importedUnwrappingKey)) throw new Error("ECDH with the provided key is not allowed or not supported");
 			const epkCandidate = options.epk instanceof CryptoKey ? options.epk : await normalizeKey(options.epk, alg);
 			if (!(epkCandidate instanceof CryptoKey)) throw new TypeError("Failed to normalize ECDH ephemeral public key");
 			const apuBytes = typeof options.apu === "string" ? base64UrlDecode(options.apu, false) : options.apu ?? new Uint8Array(0);
@@ -1588,13 +1615,13 @@ async function unwrapKey(alg, wrappedKey, unwrappingKey, options = {}) {
 			else {
 				const kwAlg = alg.slice(-6);
 				if (!(wrappedKey instanceof Uint8Array) || wrappedKey.length === 0) throw new Error("ECDH-ES key agreement with key wrapping requires an encrypted key");
-				unwrappedCekBytes = await unwrap(kwAlg, sharedSecret, wrappedKey);
+				unwrappedCekBytes = await aesKwUnwrap(kwAlg, sharedSecret, wrappedKey);
 			}
 			break;
 		}
 		default: throw new Error(`Unsupported key unwrapping algorithm: ${alg}`);
 	}
-	if (!returnAs) return unwrappedCekBytes;
+	if (returnRaw) return unwrappedCekBytes;
 	return await crypto.subtle.importKey("raw", unwrappedCekBytes, options.unwrappedKeyAlgorithm || { name: "AES-GCM" }, defaultExtractable, options.keyUsage || ["encrypt", "decrypt"]);
 }
 /**
@@ -1608,35 +1635,25 @@ async function unwrapKey(alg, wrappedKey, unwrappingKey, options = {}) {
 * @param jwkExtras Additional properties to merge into the resulting JWK.
 * @returns A Promise resolving to the imported key as a JWK.
 */
-async function importJWKFromPEM(pem, pemType, alg, importOptions, jwkExtras) {
+async function importFromPEM(pem, pemType, alg, options) {
+	const extractable = options?.extractable !== false;
 	let cryptoKey;
-	const defaultExtractable = importOptions?.extractable !== false;
 	switch (pemType) {
 		case "pkcs8":
-			cryptoKey = await fromPKCS8(pem, alg, {
-				...importOptions,
-				extractable: defaultExtractable
-			});
+			cryptoKey = await fromPKCS8(pem, alg, { extractable });
 			break;
 		case "spki":
-			cryptoKey = await fromSPKI(pem, alg, {
-				...importOptions,
-				extractable: defaultExtractable
-			});
+			cryptoKey = await fromSPKI(pem, alg, { extractable });
 			break;
 		case "x509":
-			cryptoKey = await fromX509(pem, alg, {
-				...importOptions,
-				extractable: defaultExtractable
-			});
+			cryptoKey = await fromX509(pem, alg, { extractable });
 			break;
 		default: throw new TypeError(`Unsupported PEM type: ${pemType}`);
 	}
-	const finalJWKExtras = {
+	return exportKey(cryptoKey, {
 		alg,
-		...jwkExtras
-	};
-	return exportKey(cryptoKey, finalJWKExtras);
+		...options?.jwkParams
+	});
 }
 /**
 * Exports a JWK to a PEM-encoded string.
@@ -1647,7 +1664,7 @@ async function importJWKFromPEM(pem, pemType, alg, importOptions, jwkExtras) {
 *                              required to correctly convert it to a CryptoKey first.
 * @returns A Promise resolving to the PEM-encoded key string.
 */
-async function exportJWKToPEM(jwk, pemFormat, algForCryptoKeyImport) {
+async function exportToPEM(jwk, pemFormat, algForCryptoKeyImport) {
 	if (jwk.kty === "oct") throw new TypeError("Octet (symmetric) JWKs (kty: 'oct') cannot be exported to PKCS8 or SPKI PEM formats.");
 	const effectiveAlg = jwk.alg || algForCryptoKeyImport;
 	if (!effectiveAlg && (jwk.kty === "RSA" || jwk.kty === "EC" || jwk.kty === "OKP")) throw new TypeError("Algorithm (alg) must be provided in the JWK or as a parameter for converting this JWK type to a CryptoKey.");
@@ -1668,43 +1685,19 @@ async function exportJWKToPEM(jwk, pemFormat, algForCryptoKeyImport) {
 	}
 }
 /**
-* Retrieves a JWK (JSON Web Key) from a JWKSet based on a key ID (kid) or
-* properties from a JOSE Header.
+* Returns all JWKs from a JWK Set, optionally narrowed by a predicate.
+*
+* Useful for multi-key verification retry, key rotation tooling, and
+* constructing multi-recipient JWE JSON Serialization structures.
 *
-* @param jwkSet The JWKSet to search within.
-* @param kidOrProtectedHeader Either a string representing the 'kid' (Key ID)
-*        or an object representing the JOSE Protected Header. If an object is
-*        provided, it must contain a 'kid' property. It can optionally contain
-*        'alg' (Algorithm) and 'kty' (Key Type) to further refine the search.
-* @returns The matching JWK from the set.
-* @throws TypeError if `jwkSet` is invalid or `kidOrProtectedHeader` is not a
-*         string or a valid header object.
-* @throws Error if no key is found matching the provided criteria, or if the
-*         header object is missing the 'kid' property.
+* @param jwkSet The JWK Set to search.
+* @param filter Optional predicate `(jwk: JWK) => boolean`. Returns all keys when omitted.
+* @returns An array of matching JWKs.
 */
-function getJWKFromSet(jwkSet, kidOrProtectedHeader) {
+function getJWKsFromSet(jwkSet, filter) {
 	if (!jwkSet || !isJWKSet(jwkSet)) throw new TypeError("Invalid JWK Set provided");
-	if (typeof kidOrProtectedHeader === "string") {
-		const kid = kidOrProtectedHeader;
-		const selectedKey = jwkSet.keys.find((k) => k.kid === kid);
-		if (!selectedKey) throw new Error(`No key found in JWK Set with kid "${kid}".`);
-		return selectedKey;
-	} else if (typeof kidOrProtectedHeader === "object") {
-		const { kid, alg, kty } = kidOrProtectedHeader;
-		if (!kid) throw new Error("JWS Protected Header is missing 'kid' (Key ID) and a JWK Set was provided. Cannot select key from JWK Set automatically.");
-		const selectedKey = jwkSet.keys.find((k) => {
-			return k.kid === kid && (!alg || k.alg === alg) && (!kty || k.kty === kty);
-		});
-		if (!selectedKey) {
-			let errorMessage = `No key found in JWK Set with kid "${kid}"`;
-			if (alg) errorMessage += ` and alg "${alg}"`;
-			if (kty) errorMessage += ` and kty "${kty}"`;
-			errorMessage += ".";
-			throw new Error(errorMessage);
-		}
-		return selectedKey;
-	}
-	throw new TypeError("`kidOrProtectedHeader` must be a string (kid) or an object (JOSE Protected Header).");
+	if (!filter) return [...jwkSet.keys];
+	return jwkSet.keys.filter(filter);
 }
 function getGenerateKeyParams(alg, options) {
 	let algorithm;
@@ -1865,20 +1858,23 @@ function inferAesImportAlgorithm(enc, cekLengthBytes) {
 //#endregion
 //#region src/core/jwe.ts
 async function encrypt(payload, key, options = {}) {
-	const { protectedHeader: additionalProtectedHeader, cek: providedCek, contentEncryptionIV: providedContentIV, keyManagementIV, p2s, p2c, ecdh } = options;
+	const { protectedHeader: userHeader, cek: providedCek, contentEncryptionIV: providedContentIV, keyManagementIV, p2s, p2c, ecdh } = options;
 	let { alg, enc } = options;
 	if (!alg) {
 		if (typeof key === "string" || key instanceof Uint8Array) alg = "PBES2-HS256+A128KW";
 		else if (isJWK(key)) alg = key.alg === "A128GCM" || key.alg === "A192GCM" || key.alg === "A256GCM" ? `${key.alg}KW` : key.alg;
 	}
 	if (!alg) throw new TypeError("JWE \"alg\" (Key Management Algorithm) must be provided in options or inferable from the key");
-	if (!enc) enc = isJWK(key) && "enc" in key ? key.enc : "A128GCM";
+	if (!enc) if (alg === "dir") {
+		enc = isJWK(key) && "enc" in key ? key.enc : void 0;
+		if (!enc) throw new TypeError("JWE \"enc\" must be provided when alg is \"dir\"");
+	} else enc = isJWK(key) && "enc" in key ? key.enc : "A128GCM";
 	const jweKeyManagementParams = {};
 	if (keyManagementIV) jweKeyManagementParams.iv = keyManagementIV;
 	if (p2s) jweKeyManagementParams.p2s = p2s;
 	else if (alg?.startsWith("PBES2")) jweKeyManagementParams.p2s = randomBytes(16);
 	if (p2c) jweKeyManagementParams.p2c = p2c;
-	else if (alg?.startsWith("PBES2")) jweKeyManagementParams.p2c = 2048;
+	else if (alg?.startsWith("PBES2")) jweKeyManagementParams.p2c = 6e5;
 	if (ecdh?.partyUInfo) jweKeyManagementParams.apu = ecdh.partyUInfo;
 	if (ecdh?.partyVInfo) jweKeyManagementParams.apv = ecdh.partyVInfo;
 	if (ecdh?.ephemeralKey) {
@@ -1888,21 +1884,14 @@ async function encrypt(payload, key, options = {}) {
 	}
 	const wrappingKeyMaterial = await importKey(key, alg);
 	const { cek: finalCek, encryptedKey: jweEncryptedKey, parameters: keyManagementHeaderParams } = await encryptKey(alg, enc, wrappingKeyMaterial, providedCek, jweKeyManagementParams);
-	const jweProtectedHeader = {
-		...additionalProtectedHeader,
-		...keyManagementHeaderParams,
-		alg,
-		enc
-	};
-	if (isJWK(key) && key.kid) jweProtectedHeader.kid = key.kid;
-	const protectedHeader = applyTypCtyDefaults(jweProtectedHeader, payload);
+	const protectedHeader = _buildJWEHeader(alg, enc, key, userHeader, keyManagementHeaderParams, payload);
 	const plaintextBytes = getPlaintextBytes(computeJwtTimeClaims(payload, protectedHeader.typ, options.expiresIn, options.currentDate) || payload);
 	const protectedHeaderEncoded = base64UrlEncode(JSON.stringify(protectedHeader));
 	const aadBytes = textEncoder.encode(protectedHeaderEncoded);
 	const contentIVBytes = providedContentIV ?? generateIV(enc);
 	const { ciphertext: contentCiphertext, tag: contentAuthTag, iv: actualContentIV } = await encrypt$1(enc, plaintextBytes, finalCek, contentIVBytes, aadBytes);
-	if (!actualContentIV) throw new Error("Content encryption IV was not generated or returned.");
-	if (!contentAuthTag) throw new Error("Content encryption auth tag was not generated or returned.");
+	if (!actualContentIV) throw new JWTError("Content encryption IV was not generated or returned.", "ERR_JWE_INVALID");
+	if (!contentAuthTag) throw new JWTError("Content encryption auth tag was not generated or returned.", "ERR_JWE_INVALID");
 	return [
 		protectedHeaderEncoded,
 		jweEncryptedKey ? base64UrlEncode(jweEncryptedKey) : "",
@@ -1913,28 +1902,28 @@ async function encrypt(payload, key, options = {}) {
 }
 async function decrypt(jwe, key, options = {}) {
 	const parts = jwe.split(".");
-	if (parts.length !== 5) throw new Error("Invalid JWE: Must contain five sections (RFC7516, section-3).");
+	if (parts.length !== 5) throw new JWTError("Invalid JWE: Must contain five sections (RFC7516, section-3).", "ERR_JWE_INVALID");
 	const [protectedHeaderEncoded, encryptedKeyEncoded, ivEncoded, ciphertextEncoded, authTagEncoded] = parts;
 	let protectedHeader;
 	try {
 		const protectedHeaderJson = base64UrlDecode(protectedHeaderEncoded);
 		protectedHeader = sanitizeObject(JSON.parse(protectedHeaderJson));
 	} catch {
-		throw new Error("Invalid JWE: Protected header could not be decoded.");
+		throw new JWTError("Invalid JWE: Protected header could not be decoded.", "ERR_JWE_INVALID");
 	}
-	if (!protectedHeader || typeof protectedHeader !== "object" || !protectedHeader.alg || !protectedHeader.enc) throw new Error("Invalid JWE: Protected header must be an object with \"alg\" and \"enc\" properties.");
+	if (!protectedHeader || typeof protectedHeader !== "object" || !protectedHeader.alg || !protectedHeader.enc) throw new JWTError("Invalid JWE: Protected header must be an object with \"alg\" and \"enc\" properties.", "ERR_JWE_INVALID");
 	const alg = protectedHeader.alg;
 	const enc = protectedHeader.enc;
-	if (options?.algorithms && !options.algorithms.includes(alg)) throw new Error(`Key management algorithm not allowed: ${alg}`);
-	if (options?.encryptionAlgorithms && !options.encryptionAlgorithms.includes(enc)) throw new Error(`Content encryption algorithm not allowed: ${enc}`);
-	const unwrappingKey = await importKey(typeof key === "function" ? await key(protectedHeader, jwe) : key, alg);
+	if (options?.algorithms && !options.algorithms.includes(alg)) throw new JWTError(`Key management algorithm not allowed: ${alg}`, "ERR_JWE_ALG_NOT_ALLOWED");
+	if (options?.encryptionAlgorithms && !options.encryptionAlgorithms.includes(enc)) throw new JWTError(`Content encryption algorithm not allowed: ${enc}`, "ERR_JWE_ALG_NOT_ALLOWED");
+	const rawKeyMaterial = typeof key === "function" ? await key(protectedHeader, jwe) : key;
 	const encryptedKeyBytes = base64UrlDecode(encryptedKeyEncoded, false);
 	const contentIVBytes = base64UrlDecode(ivEncoded, false);
 	const contentAuthTagBytes = base64UrlDecode(authTagEncoded, false);
 	const ciphertextBytes = base64UrlDecode(ciphertextEncoded, false);
 	const unwrapKeyOpts = {
 		enc,
-		returnAs: enc.includes("GCM"),
+		format: enc.includes("GCM") ? "cryptokey" : "raw",
 		keyUsage: options?.keyUsage || ["decrypt"]
 	};
 	if (protectedHeader.iv) unwrapKeyOpts.iv = protectedHeader.iv;
@@ -1946,11 +1935,34 @@ async function decrypt(jwe, key, options = {}) {
 	if (protectedHeader.apv) unwrapKeyOpts.apv = protectedHeader.apv;
 	if (options?.unwrappedKeyAlgorithm) unwrapKeyOpts.unwrappedKeyAlgorithm = options.unwrappedKeyAlgorithm;
 	if (options?.extractable) unwrapKeyOpts.extractable = options.extractable;
-	const cek = await unwrapKey(alg, encryptedKeyBytes, unwrappingKey, unwrapKeyOpts);
 	const aadBytes = textEncoder.encode(protectedHeaderEncoded);
-	const payload = decodePayloadFromBytes(await decrypt$1(enc, cek, ciphertextBytes, contentIVBytes, contentAuthTagBytes, aadBytes), protectedHeader, options?.forceUint8Array);
-	if (protectedHeader.crit || options?.critical?.length || options?.requiredHeaders?.length) validateCriticalHeadersJWE(protectedHeader, [...options?.critical || [], ...options?.requiredHeaders || []]);
-	if (payload && typeof payload === "object" && options.validateJWT !== false && (options.validateJWT === true || protectedHeader.typ?.toLowerCase().includes("jwt")) && !options.forceUint8Array && !(payload instanceof Uint8Array)) validateJwtClaims(payload, options);
+	let cek;
+	let plaintextBytes;
+	if (isJWKSet(rawKeyMaterial)) {
+		const candidates = getJWKsFromSet(rawKeyMaterial, _buildJWESetFilter(protectedHeader));
+		if (candidates.length === 0) throw new JWTError(`No key found in JWK Set${protectedHeader.kid ? ` with kid "${protectedHeader.kid}"` : ""}.`, "ERR_JWK_KEY_NOT_FOUND");
+		let decrypted = false;
+		for (const candidate of candidates) try {
+			const candidateCek = await unwrapKey(alg, encryptedKeyBytes, await importKey(candidate, alg), unwrapKeyOpts);
+			plaintextBytes = await decrypt$1(enc, candidateCek, ciphertextBytes, contentIVBytes, contentAuthTagBytes, aadBytes);
+			cek = candidateCek;
+			decrypted = true;
+			break;
+		} catch {}
+		if (!decrypted) throw new JWTError("JWE decryption failed.", "ERR_JWE_DECRYPTION_FAILED");
+	} else {
+		const unwrappingKey = await importKey(rawKeyMaterial, alg);
+		try {
+			cek = await unwrapKey(alg, encryptedKeyBytes, unwrappingKey, unwrapKeyOpts);
+			plaintextBytes = await decrypt$1(enc, cek, ciphertextBytes, contentIVBytes, contentAuthTagBytes, aadBytes);
+		} catch (error_) {
+			if (error_ instanceof JWTError) throw error_;
+			throw new JWTError("JWE decryption failed.", "ERR_JWE_DECRYPTION_FAILED", error_);
+		}
+	}
+	const payload = decodePayloadFromBytes(plaintextBytes, protectedHeader, options?.forceUint8Array);
+	if (protectedHeader.crit || options?.recognizedHeaders?.length) validateCriticalHeadersJWE(protectedHeader, options?.recognizedHeaders);
+	if (payload && typeof payload === "object" && options.validateClaims !== false && (options.validateClaims === true || protectedHeader.typ?.toLowerCase().includes("jwt")) && !options.forceUint8Array && !(payload instanceof Uint8Array)) validateJwtClaims(payload, options);
 	const result = {
 		payload,
 		protectedHeader
@@ -1986,24 +1998,30 @@ function parseEphemeralKey(ephemeralKey) {
 		epkPrivateKey
 	};
 }
+function _buildJWESetFilter(header) {
+	const { kid, alg } = header;
+	return (k) => (!kid || k.kid === kid) && (!k.alg || k.alg === alg);
+}
+function _buildJWEHeader(alg, enc, key, userHeader, keyManagementParams, payload) {
+	const safeHeader = sanitizeObject(userHeader);
+	return applyTypCtyDefaults({
+		...isJWK(key) && key.kid ? { kid: key.kid } : {},
+		...safeHeader,
+		...keyManagementParams,
+		alg,
+		enc
+	}, payload);
+}
 //#endregion
 //#region src/core/jws.ts
 async function sign(payload, key, options = {}) {
-	const { protectedHeader: additionalProtectedHeader } = options;
-	const safeAdditionalHeader = sanitizeObject(additionalProtectedHeader);
+	const { protectedHeader: userHeader } = options;
 	let { alg } = options;
 	if (!alg) if (isJWK(key) && key.alg) alg = key.alg;
 	else throw new TypeError("JWS \"alg\" (Algorithm) must be provided in options");
-	validateKeyLength(key, alg);
-	const signingKey = await importKey(key, alg);
-	const protectedHeader = {
-		...safeAdditionalHeader,
-		...isJWK(key) && key.kid ? { kid: key.kid } : {},
-		alg,
-		typ: safeAdditionalHeader?.typ
-	};
-	applyTypCtyDefaults(protectedHeader, payload);
-	if (protectedHeader.b64 === true) delete protectedHeader.b64;
+	if (alg === "none") throw new JWTError("\"none\" is not a valid signing algorithm", "ERR_JWS_ALG_NOT_ALLOWED");
+	const signingKey = await _resolveSigningKey(alg, await importKey(key, alg), "sign");
+	const protectedHeader = _buildJWSHeader(alg, key, userHeader, payload);
 	const computedPayload = computeJwtTimeClaims(payload, protectedHeader.typ, options.expiresIn, options.currentDate);
 	const protectedHeaderEncoded = base64UrlEncode(JSON.stringify(protectedHeader));
 	let payloadBytes;
@@ -2017,53 +2035,82 @@ async function sign(payload, key, options = {}) {
 }
 async function verify(jws, key, options = {}) {
 	const parts = jws.split(".");
-	if (parts.length !== 3) throw new Error("Invalid JWS: Must contain three parts separated by dots.");
+	if (parts.length !== 3) throw new JWTError("Invalid JWS: Must contain three parts separated by dots.", "ERR_JWS_INVALID");
 	const [protectedHeaderEncoded, payloadEncoded, signatureEncoded] = parts;
 	let protectedHeader;
 	try {
 		const protectedHeaderString = base64UrlDecode(protectedHeaderEncoded);
 		protectedHeader = sanitizeObject(JSON.parse(protectedHeaderString));
 	} catch {
-		throw new Error("Invalid JWS: Protected header could not be decoded.");
+		throw new JWTError("Invalid JWS: Protected header could not be decoded.", "ERR_JWS_INVALID");
 	}
-	if (!protectedHeader || typeof protectedHeader !== "object" || !protectedHeader.alg) throw new Error("Invalid JWS: Protected header must be an object with an \"alg\" property.");
+	if (!protectedHeader || typeof protectedHeader !== "object" || !protectedHeader.alg) throw new JWTError("Invalid JWS: Protected header must be an object with an \"alg\" property.", "ERR_JWS_INVALID");
 	const alg = protectedHeader.alg;
-	if (options.algorithms && !options.algorithms.includes(alg)) throw new Error(`Algorithm not allowed: ${alg}`);
-	if (options.typ && protectedHeader.typ !== options.typ) throw new Error(`Invalid JWS: "typ" (Type) Header Parameter mismatch. Expected "${options.typ}", got "${protectedHeader.typ}".`);
+	if (options.algorithms && !options.algorithms.includes(alg)) throw new JWTError(`Algorithm not allowed: ${alg}`, "ERR_JWS_ALG_NOT_ALLOWED");
+	if (options.typ && protectedHeader.typ !== options.typ) throw new JWTError(`Invalid JWS: "typ" (Type) Header Parameter mismatch. Expected "${options.typ}", got "${protectedHeader.typ}".`, "ERR_JWS_INVALID");
 	let signatureBytes;
 	try {
 		signatureBytes = base64UrlDecode(signatureEncoded, false);
 	} catch {
-		throw new Error("Invalid JWS: Signature could not be decoded.");
+		throw new JWTError("Invalid JWS: Signature could not be decoded.", "ERR_JWS_INVALID");
 	}
 	const keyInput = typeof key === "function" ? await key(protectedHeader, jws) : key;
-	const verificationKey = await importKey(isJWKSet(keyInput) ? getJWKFromSet(keyInput, protectedHeader) : keyInput, alg);
-	const signingInputString = `${protectedHeaderEncoded}.${payloadEncoded}`;
-	const signingInputBytes = textEncoder.encode(signingInputString);
-	if (!await verify$1(alg, verificationKey, signatureBytes, signingInputBytes)) throw new Error("JWS signature verification failed.");
+	const signingInputBytes = textEncoder.encode(`${protectedHeaderEncoded}.${payloadEncoded}`);
+	if (isJWKSet(keyInput)) {
+		const candidates = getJWKsFromSet(keyInput, _buildJWSSetFilter(protectedHeader));
+		if (candidates.length === 0) throw new JWTError(`No key found in JWK Set${protectedHeader.kid ? ` with kid "${protectedHeader.kid}"` : ""}.`, "ERR_JWK_KEY_NOT_FOUND");
+		let verified = false;
+		for (const candidate of candidates) try {
+			if (await verify$1(alg, await _resolveSigningKey(alg, await importKey(candidate, alg), "verify"), signatureBytes, signingInputBytes)) {
+				verified = true;
+				break;
+			}
+		} catch {}
+		if (!verified) throw new JWTError("JWS signature verification failed.", "ERR_JWS_SIGNATURE_INVALID");
+	} else if (!await verify$1(alg, await _resolveSigningKey(alg, await importKey(keyInput, alg), "verify"), signatureBytes, signingInputBytes)) throw new JWTError("JWS signature verification failed.", "ERR_JWS_SIGNATURE_INVALID");
 	const useB64 = protectedHeader.b64 !== false;
 	let payload;
 	try {
 		payload = useB64 ? decodePayloadFromB64UrlSegment(payloadEncoded, protectedHeader, options.forceUint8Array) : options.forceUint8Array ? textEncoder.encode(payloadEncoded) : payloadEncoded;
 	} catch (error_) {
-		throw new Error(`Invalid JWS: Payload decoding failed (${error_ instanceof Error ? error_.message : error_})`);
+		throw new JWTError(`Invalid JWS: Payload decoding failed (${error_ instanceof Error ? error_.message : error_})`, "ERR_JWS_INVALID");
 	}
-	validateCriticalHeadersJWS(protectedHeader, [...options.critical || [], ...options.requiredHeaders || []]);
-	if (payload && typeof payload === "object" && options.validateJWT !== false && (options.validateJWT === true || protectedHeader.typ?.toLowerCase().includes("jwt")) && !options.forceUint8Array && !(payload instanceof Uint8Array)) validateJwtClaims(payload, options);
+	validateCriticalHeadersJWS(protectedHeader, options.recognizedHeaders);
+	if (payload && typeof payload === "object" && options.validateClaims !== false && (options.validateClaims === true || protectedHeader.typ?.toLowerCase().includes("jwt")) && !options.forceUint8Array && !(payload instanceof Uint8Array)) validateJwtClaims(payload, options);
 	return {
 		payload,
 		protectedHeader
 	};
 }
-function validateKeyLength(key, alg) {
-	if (!alg || isJWK(key)) return;
-	if (alg.startsWith("HS") && key instanceof Uint8Array) {
-		const algLength = Number.parseInt(alg.slice(2)) / 8;
-		if (key.length < algLength) throw new TypeError(`${alg} requires key length to be ${algLength} bytes or larger`);
-	} else if ((alg.startsWith("RS") || alg.startsWith("PS")) && key instanceof CryptoKey) {
+async function _resolveSigningKey(alg, key, usage) {
+	if (key instanceof Uint8Array) {
+		const minBytes = Number.parseInt(alg.slice(2), 10) / 8;
+		if (key.length < minBytes) throw new JWTError(`${alg} requires a key of at least ${minBytes} bytes`, "ERR_JWK_INVALID");
+		return crypto.subtle.importKey("raw", key, {
+			name: "HMAC",
+			hash: `SHA-${alg.slice(-3)}`
+		}, false, [usage]);
+	}
+	if (alg.startsWith("RS") || alg.startsWith("PS")) {
 		const { modulusLength } = key.algorithm;
-		if (typeof modulusLength !== "number" || modulusLength < 2048) throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
+		if (typeof modulusLength !== "number" || modulusLength < 2048) throw new JWTError(`${alg} requires a key modulusLength of at least 2048 bits`, "ERR_JWK_INVALID");
 	}
+	return key;
+}
+function _buildJWSSetFilter(header) {
+	const { kid, alg } = header;
+	return (k) => (!kid || k.kid === kid) && (!k.alg || k.alg === alg);
+}
+function _buildJWSHeader(alg, key, userHeader, payload) {
+	const safeHeader = sanitizeObject(userHeader);
+	const header = {
+		...isJWK(key) && key.kid ? { kid: key.kid } : {},
+		...safeHeader,
+		alg
+	};
+	applyTypCtyDefaults(header, payload);
+	if (header.b64 === true) delete header.b64;
+	return header;
 }
 //#endregion
-export { deriveJWKFromPassword as a, importJWKFromPEM as c, isSymmetricJWK as d, computeExpiresInSeconds as f, encrypt as i, isPrivateJWK as l, verify as n, exportJWKToPEM as o, decrypt as r, generateJWK as s, sign as t, isPublicJWK as u };
+export { deriveJWKFromPassword as a, importFromPEM as c, isSymmetricJWK as d, computeExpiresInSeconds as f, encrypt as i, isPrivateJWK as l, isJWTError as m, verify as n, exportToPEM as o, JWTError as p, decrypt as r, generateJWK as s, sign as t, isPublicJWK as u };