unjwt 0.6.1 → 0.7.0

package/dist/_chunks/jws.mjs

@@ -1,2028 +1,283 @@
-//#region src/core/error.ts
-/**
-* Base error class for all unjwt errors. Every error thrown by the library is
-* an instance of `JWTError`, so a single `instanceof` check is sufficient to
-* distinguish library errors from other thrown values. Use the `code` property
-* (or the `isJWTError` type guard) to narrow to a specific error condition.
-*
-* @example
-* import { JWTError, isJWTError } from "unjwt/jws";
-*
-* try {
-*   await verify(token, key);
-* } catch (err) {
-*   if (isJWTError(err, "ERR_JWT_EXPIRED")) {
-*     console.log(err.cause.jti); // string | undefined
-*   }
-* }
-*/
-var JWTError = class extends Error {
-	code;
-	cause;
-	constructor(message, code, cause) {
-		super(message);
-		this.name = "JWTError";
-		this.code = code;
-		this.cause = cause;
-	}
-};
-function isJWTError(error, code) {
-	if (!(error instanceof JWTError)) return false;
-	return code === void 0 || error.code === code;
-}
-//#endregion
-//#region src/core/utils/jwt.ts
-/**
-* Apply default typ/cty semantics shared by JWS & JWE.
-* - If typ is undefined and payload is a non-Uint8Array object, set typ="JWT".
-* - If typ is "JWT" and payload is a non-Uint8Array object, ensure cty defaults to "application/json".
-*/
-function applyTypCtyDefaults(header, payload) {
-	const isObjectPayload = typeof payload === "object" && payload !== null && !(payload instanceof Uint8Array);
-	if (header.typ === void 0 && isObjectPayload) header.typ = "JWT";
-	if (header.typ?.toLowerCase().includes("jwt") && isObjectPayload) header.cty ||= "application/json";
-	return header;
-}
-/** Returns true when headers indicate JSON content. */
-function isJWTContent(header) {
-	if (!header) return false;
-	if (header.typ?.toLowerCase().includes("jwt")) return true;
-	const cty = header.cty?.toLowerCase();
-	return cty === "json" || cty === "application/json" || !!cty && cty.endsWith("+json");
-}
-/**
-* Given a decoded string and JOSE headers, return an object if JSON, otherwise the string.
-*/
-function decodeMaybeJWTString(decodedString, header) {
-	if (isJWTContent(header)) {
-		if (decodedString.startsWith("{") && decodedString.endsWith("}") || decodedString.startsWith("[") && decodedString.endsWith("]")) try {
-			return sanitizeObject(JSON.parse(decodedString));
-		} catch {}
-	}
-	return decodedString;
-}
-/**
-* Decode a payload that is represented as raw bytes into T | string, honoring forceUint8Array and headers.
-*/
-function decodePayloadFromBytes(bytes, header, forceUint8Array) {
-	if (forceUint8Array) return bytes;
-	return decodeMaybeJWTString(textDecoder.decode(bytes), header);
-}
-/**
-* Decode a payload that is a Base64URL segment into T | string | Uint8Array based on flags and headers.
-*/
-function decodePayloadFromB64UrlSegment(payloadEncoded, header, forceUint8Array) {
-	if (forceUint8Array) return base64UrlDecode(payloadEncoded, false);
-	return decodeMaybeJWTString(base64UrlDecode(payloadEncoded), header);
-}
-/** Convert plaintext input to bytes, shared by JWS & JWE when preparing payload. */
-function getPlaintextBytes(payload) {
-	if (payload instanceof Uint8Array) return payload;
-	if (typeof payload === "string") return textEncoder.encode(payload);
-	if (typeof payload === "object" && payload !== null) return textEncoder.encode(JSON.stringify(payload));
-	throw new TypeError("Plaintext must be a string, Uint8Array, or a JSON-serializable object.");
-}
-const TIME_CONSTANTS = Object.freeze({
-	s: 1,
-	second: 1,
-	seconds: 1,
-	m: 60,
-	minute: 60,
-	minutes: 60,
-	h: 3600,
-	hour: 3600,
-	hours: 3600,
-	D: 86400,
-	day: 86400,
-	days: 86400,
-	W: 604800,
-	week: 604800,
-	weeks: 604800,
-	M: 2592e3,
-	month: 2592e3,
-	months: 2592e3,
-	Y: 31536e3,
-	year: 31536e3,
-	years: 31536e3
-});
-const EXPIRES_IN_REGEX = /^(\d+)(s|second|seconds|m|minute|minutes|h|hour|hours|D|day|days|W|week|weeks|M|month|months|Y|year|years)?$/;
-function computeExpiresInSeconds(expiresIn) {
-	if (typeof expiresIn === "number") {
-		if (!Number.isInteger(expiresIn) || expiresIn <= 0) throw new TypeError("If 'expiresIn' is a number, it must be a positive integer representing seconds.");
-		return expiresIn;
-	}
-	if (typeof expiresIn === "string") {
-		const match = expiresIn.match(EXPIRES_IN_REGEX);
-		if (!match || !match[1]) throw new TypeError("Invalid 'expiresIn' format. Must be a positive integer or a string like '10m', '2h', '7D', etc.");
-		return Number.parseInt(match[1], 10) * TIME_CONSTANTS[match[2] || "s"];
-	}
-	throw new TypeError("'expiresIn' must be a number or a string representing time duration.");
-}
-const computeMaxTokenAgeSeconds = computeExpiresInSeconds;
-/** Optionally compute iat/exp when signing JWTs. */
-function computeJwtTimeClaims(payload, headerTyp, expiresIn, currentDate = /* @__PURE__ */ new Date()) {
-	if (expiresIn === void 0 || !headerTyp?.toLowerCase().includes("jwt") || !(payload && typeof payload === "object") || payload instanceof Uint8Array || payload.exp) return;
-	const now = Math.round(currentDate.getTime() / 1e3);
-	const claims = { ...payload };
-	claims.iat ||= now;
-	claims.exp = claims.iat + computeExpiresInSeconds(expiresIn);
-	return claims;
-}
-/** Validate JWT claims under JWS verification rules (or custom JWE implementations). */
-function validateJwtClaims(jwtClaims, options = {}) {
-	const clockTolerance = options.clockTolerance ?? 0;
-	const currentTime = Math.round((options.currentDate ?? /* @__PURE__ */ new Date()).getTime() / 1e3);
-	const allRequiredClaims = new Set(options.requiredClaims || []);
-	const missingClaims = /* @__PURE__ */ new Set();
-	if (options.issuer) allRequiredClaims.add("iss");
-	if (options.audience) allRequiredClaims.add("aud");
-	if (options.subject) allRequiredClaims.add("sub");
-	if (options.maxTokenAge) allRequiredClaims.add("iat");
-	for (const claimName of allRequiredClaims) if (!(claimName in jwtClaims)) missingClaims.add(claimName);
-	if (missingClaims.size > 0) throw new JWTError(`Missing required JWT Claims: ${[...missingClaims].join(", ")}`, "ERR_JWT_CLAIM_MISSING");
-	if (options.issuer) {
-		const expectedIssuers = maybeArray(options.issuer);
-		if (!jwtClaims.iss || !expectedIssuers.includes(jwtClaims.iss)) throw new JWTError(`Invalid JWT "iss" (Issuer) Claim: Expected ${expectedIssuers.join(" or ")}, got ${jwtClaims.iss}`, "ERR_JWT_CLAIM_INVALID");
-	}
-	if (options.subject && jwtClaims.sub !== options.subject) throw new JWTError(`Invalid JWT "sub" (Subject) Claim: Expected ${options.subject}, got ${jwtClaims.sub}`, "ERR_JWT_CLAIM_INVALID");
-	if (options.audience) {
-		const expectedAudiences = maybeArray(options.audience);
-		const claimAudience = maybeArray(jwtClaims.aud || []);
-		if (!claimAudience.some((aud) => expectedAudiences.includes(aud))) throw new JWTError(`Invalid JWT "aud" (Audience) Claim: Expected ${expectedAudiences.join(" or ")}, got ${claimAudience.join(", ")}`, "ERR_JWT_CLAIM_INVALID");
-	}
-	if (typeof jwtClaims.nbf === "number" && jwtClaims.nbf > currentTime + clockTolerance) throw new JWTError(`JWT "nbf" (Not Before) Claim validation failed: Token is not yet valid (nbf: ${(/* @__PURE__ */ new Date(jwtClaims.nbf * 1e3)).toISOString()})`, "ERR_JWT_NBF");
-	if (typeof jwtClaims.exp === "number" && jwtClaims.exp <= currentTime - clockTolerance) throw new JWTError(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(jwtClaims.exp * 1e3)).toISOString()})`, "ERR_JWT_EXPIRED", {
-		jti: jwtClaims.jti,
-		iat: jwtClaims.iat,
-		exp: jwtClaims.exp
-	});
-	if (options.maxTokenAge) {
-		if (typeof jwtClaims.iat !== "number") throw new JWTError("JWT \"iat\" (Issued At) Claim must be a number when maxTokenAge is set.", "ERR_JWT_CLAIM_INVALID");
-		if (jwtClaims.iat > currentTime + clockTolerance) throw new JWTError(`JWT "iat" (Issued At) Claim validation failed: Token was issued in the future (iat: ${(/* @__PURE__ */ new Date(jwtClaims.iat * 1e3)).toISOString()})`, "ERR_JWT_CLAIM_INVALID");
-		if (jwtClaims.iat < currentTime - computeMaxTokenAgeSeconds(options.maxTokenAge) - clockTolerance) throw new JWTError(`JWT "iat" (Issued At) Claim validation failed: Token is too old (maxTokenAge: ${options.maxTokenAge}s, iat: ${(/* @__PURE__ */ new Date(jwtClaims.iat * 1e3)).toISOString()})`, "ERR_JWT_EXPIRED", {
-			jti: jwtClaims.jti,
-			iat: jwtClaims.iat,
-			exp: jwtClaims.exp
-		});
-	}
-}
-const BASE_HEADER_PARAMS = [
-	"alg",
-	"typ",
-	"cty",
-	"kid",
-	"jwk",
-	"jku",
-	"x5c",
-	"x5t",
-	"x5u"
-];
-/** Validate critical headers in JWS semantics. */
-function validateCriticalHeadersJWS(protectedHeader, recognizedHeaders = []) {
-	if (!protectedHeader.crit) return;
-	const missingHeaderParams = /* @__PURE__ */ new Set();
-	const recognizedParams = new Set([
-		...recognizedHeaders,
-		...BASE_HEADER_PARAMS,
-		"b64"
-	]);
-	for (const param of protectedHeader.crit) {
-		if (recognizedParams.has(param) && (param in protectedHeader || param === "b64")) continue;
-		missingHeaderParams.add(param);
-	}
-	if (missingHeaderParams.size > 0) throw new JWTError(`Missing critical header parameters: ${[...missingHeaderParams].join(", ")}`, "ERR_JWS_INVALID");
-}
-/** Validate critical headers in JWE semantics. */
-function validateCriticalHeadersJWE(protectedHeader, recognizedHeaders) {
-	if (protectedHeader.crit && !recognizedHeaders) throw new JWTError(`Unprocessed critical header parameters: ${protectedHeader.crit.join(", ")}`, "ERR_JWE_INVALID");
-	if (!protectedHeader.crit) return;
-	const understoodParams = new Set([
-		...recognizedHeaders || [],
-		...BASE_HEADER_PARAMS,
-		"enc",
-		"iv",
-		"tag",
-		"p2s",
-		"p2c",
-		"epk",
-		"apu",
-		"apv"
-	]);
-	for (const critParam of protectedHeader.crit) {
-		if (!Object.prototype.hasOwnProperty.call(protectedHeader, critParam)) throw new JWTError(`Critical header parameter "${critParam}" listed in "crit" but not present in the protected header.`, "ERR_JWE_INVALID");
-		if (!understoodParams.has(critParam)) throw new JWTError(`Unprocessed critical header parameters: ${critParam}`, "ERR_JWE_INVALID");
-	}
-}
-//#endregion
-//#region src/core/utils/sanitize.ts
-/**
-* Originally derived from unsecure@0.0.4
-* Licensed under the MIT License.
-*
-* Source: https://github.com/sandros94/unsecure/blob/913ed5580c551153a19154b4916c67a8efb2be85/src/sanitize.ts
-*/
-/**
-* Returns a deep structural copy of `obj` with prototype-pollution vectors
-* stripped at every level (`__proto__`, `prototype`, `constructor`).
-*
-* The input is never modified. Arrays are copied element-by-element;
-* nested objects are recursed with a WeakSet cycle guard.
-*/
-function sanitizeObject(obj) {
-	if (!obj || typeof obj !== "object") return obj;
-	return _sanitizeCopy(obj, /* @__PURE__ */ new WeakSet());
-}
-function _sanitizeCopy(current, seen) {
-	seen.add(current);
-	if (Array.isArray(current)) return current.map((item) => item && typeof item === "object" && !seen.has(item) ? _sanitizeCopy(item, seen) : item);
-	const result = {};
-	for (const [key, value] of Object.entries(current)) {
-		if (key === "__proto__" || key === "prototype" || key === "constructor") continue;
-		result[key] = value && typeof value === "object" && !seen.has(value) ? _sanitizeCopy(value, seen) : value;
-	}
-	return result;
-}
-//#endregion
-//#region src/core/utils/index.ts
-const textEncoder = /* @__PURE__ */ new TextEncoder();
-const textDecoder = /* @__PURE__ */ new TextDecoder();
-const _Buffer = /* @__PURE__ */ (() => {
-	try {
-		return globalThis.Buffer;
-	} catch {
-		return;
-	}
-})();
-const _hasBuffer = typeof _Buffer?.from === "function";
-const _hasToBase64 = !_hasBuffer && typeof Uint8Array.prototype.toBase64 === "function";
-const _hasFromBase64 = !_hasBuffer && typeof Uint8Array.fromBase64 === "function";
-const _b64UrlEncOpts = /* @__PURE__ */ Object.freeze({
-	alphabet: "base64url",
-	omitPadding: true
-});
-const _b64UrlDecOpts = /* @__PURE__ */ Object.freeze({ alphabet: "base64url" });
-function _toBuffer(data) {
-	return data instanceof Uint8Array ? _Buffer.from(data.buffer, data.byteOffset, data.byteLength) : _Buffer.from(data);
-}
-function base64Encode(data) {
-	if (_hasBuffer) return _toBuffer(data).toString("base64");
-	const encodedData = data instanceof Uint8Array ? data : textEncoder.encode(data);
-	if (_hasToBase64) return encodedData.toBase64();
-	return btoa(String.fromCodePoint(...encodedData));
-}
-function base64UrlEncode(data) {
-	if (_hasBuffer) return _toBuffer(data).toString("base64url");
-	const encodedData = data instanceof Uint8Array ? data : textEncoder.encode(data);
-	if (_hasToBase64) return encodedData.toBase64(_b64UrlEncOpts);
-	return btoa(String.fromCodePoint(...encodedData)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
-}
-function base64Decode(str, toString) {
-	const decodeToString = toString !== false;
-	if (!str) return decodeToString ? "" : new Uint8Array(0);
-	if (_hasBuffer) {
-		const buf = _Buffer.from(str, "base64");
-		return decodeToString ? buf.toString("utf8") : new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
-	}
-	const data = _hasFromBase64 ? Uint8Array.fromBase64(str) : Uint8Array.from(atob(str), (b) => b.codePointAt(0));
-	return decodeToString ? textDecoder.decode(data) : data;
-}
-function base64UrlDecode(str, toString) {
-	const decodeToString = toString !== false;
-	if (!str) return decodeToString ? "" : new Uint8Array(0);
-	if (_hasBuffer) {
-		const buf = _Buffer.from(str, "base64url");
-		return decodeToString ? buf.toString("utf8") : new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
-	}
-	let data;
-	if (_hasFromBase64) data = Uint8Array.fromBase64(str, _b64UrlDecOpts);
-	else {
-		str = str.replace(/-/g, "+").replace(/_/g, "/");
-		while (str.length % 4) str += "=";
-		data = Uint8Array.from(atob(str), (b) => b.codePointAt(0));
-	}
-	return decodeToString ? textDecoder.decode(data) : data;
-}
-function randomBytes(length) {
-	return crypto.getRandomValues(new Uint8Array(length));
-}
-/**
-* Concatenates multiple Uint8Arrays
-* @param arrays Arrays to concatenate
-* @returns Concatenated array
-*/
-function concatUint8Arrays(...arrays) {
-	const totalLength = arrays.reduce((length, arr) => length + arr.length, 0);
-	const result = new Uint8Array(totalLength);
-	let offset = 0;
-	for (const arr of arrays) {
-		result.set(arr, offset);
-		offset += arr.length;
-	}
-	return result;
-}
-function maybeArray(item) {
-	return Array.isArray(item) ? item : [item];
-}
-function isJWK(key) {
-	return typeof key === "object" && key !== null && "kty" in key && typeof key.kty === "string";
-}
-function isJWKSet(key) {
-	return key && typeof key === "object" && "keys" in key && Array.isArray(key.keys);
-}
-function assertCryptoKey(key) {
-	if (!isCryptoKey(key)) throw new Error("CryptoKey instance expected");
-}
-function isCryptoKey(key) {
-	return key?.[Symbol.toStringTag] === "CryptoKey";
-}
-const isCryptoKeyPair = (key) => key && typeof key === "object" && isCryptoKey(key.publicKey) && isCryptoKey(key.privateKey);
-/** Returns true if the JWK is a symmetric (oct) key. */
-function isSymmetricJWK(key) {
-	return isJWK(key) && key.kty === "oct" && typeof key.k === "string";
-}
-/** Returns true if the JWK is an asymmetric (RSA, EC, OKP) key. */
-function isAsymmetricJWK(key) {
-	return !isSymmetricJWK(key);
-}
-/**
-* Type guard that checks if the provided JWK contains private key material.
-* It relies purely on the presence of private components (e.g. "d"), not on the alg value.
-*/
-function isPrivateJWK(key) {
-	if (!isJWK(key)) return false;
-	if (key.kty === "EC") return typeof key.d === "string";
-	if (key.kty === "OKP") return typeof key.d === "string";
-	if (key.kty === "RSA") return typeof key.d === "string";
-	return false;
-}
-/**
-* Type guard that checks if the provided JWK is a public (asymmetric) key.
-* This checks for the presence of public components and absence of private material.
-*/
-function isPublicJWK(key) {
-	if (!isJWK(key)) return false;
-	if (key.kty === "EC") {
-		const ec = key;
-		return typeof ec.x === "string" && typeof ec.y === "string" && typeof ec.d !== "string";
-	}
-	if (key.kty === "OKP") {
-		const okp = key;
-		return typeof okp.x === "string" && typeof okp.d !== "string";
-	}
-	if (key.kty === "RSA") {
-		const rsa = key;
-		return typeof rsa.n === "string" && typeof rsa.e === "string" && typeof rsa.d !== "string";
-	}
-	return false;
-}
-//#endregion
-//#region src/core/_crypto/_sign-verify.ts
-async function sign$1(alg, key, data) {
-	checkSigCryptoKey(key, alg, "sign");
-	const signature = await crypto.subtle.sign(subtleAlgorithm(alg, key.algorithm), key, data);
-	return new Uint8Array(signature);
-}
-async function verify$1(alg, key, signature, data) {
-	checkSigCryptoKey(key, alg, "verify");
-	try {
-		return await crypto.subtle.verify(subtleAlgorithm(alg, key.algorithm), key, signature, data);
-	} catch {
-		return false;
+import { C as validateCriticalHeadersJWS, D as JWTError, b as getPlaintextBytes, f as applyTypCtyDefaults, h as computeJwtTimeClaims, o as isJWK, s as isJWKSet } from "./utils.mjs";
+import { a as base64UrlEncode, i as base64UrlDecode, o as textDecoder, s as textEncoder, u as sanitizeObjectCopy } from "./libs/unsecure.mjs";
+import { T as verify$1, h as importKey, p as getJWKsFromSet, w as sign$1 } from "./jwk.mjs";
+import { a as decodeJWSPayload, c as resolveSigningKey, i as checkAlgAllowed, l as validateJwtClaimsIfJsonPayload, n as JWS_ALG_CTX, o as decodeProtectedHeader, r as buildJWKSetFilter } from "./_internal.mjs";
+async function signMulti(payload, signers, options = {}) {
+	if (!Array.isArray(signers) || signers.length === 0) throw new JWTError("signMulti requires at least one signer.", "ERR_JWS_INVALID");
+	const resolvedAlgs = signers.map((s, i) => _resolveSignerAlg(s.key, i));
+	const b64 = _resolveB64(signers);
+	const payloadBytes = getPlaintextBytes(computeJwtTimeClaims(payload, options) || payload);
+	const payloadEncoded = b64 ? base64UrlEncode(payloadBytes) : textDecoder.decode(payloadBytes);
+	const wireSignatures = [];
+	for (let i = 0; i < signers.length; i++) {
+		const signer = signers[i];
+		const alg = resolvedAlgs[i];
+		const protectedHeader = _buildSignerProtectedHeader(signer, alg, payload, b64);
+		const unprotectedHeader = sanitizeObjectCopy(signer.unprotectedHeader);
+		_assertDisjointHeaders(protectedHeader, unprotectedHeader);
+		const protectedHeaderEncoded = base64UrlEncode(JSON.stringify(protectedHeader));
+		const signingInputBytes = textEncoder.encode(`${protectedHeaderEncoded}.${payloadEncoded}`);
+		const wireSig = {
+			protected: protectedHeaderEncoded,
+			signature: base64UrlEncode(await sign$1(alg, await resolveSigningKey(alg, await importKey(signer.key, {
+				alg,
+				expect: "private"
+			}), "sign"), signingInputBytes))
+		};
+		if (unprotectedHeader && Object.keys(unprotectedHeader).length > 0) wireSig.header = unprotectedHeader;
+		wireSignatures.push(wireSig);
 	}
+	return {
+		payload: payloadEncoded,
+		signatures: wireSignatures
+	};
 }
-function checkSigCryptoKey(key, alg, usage) {
-	switch (alg) {
-		case "HS256":
-		case "HS384":
-		case "HS512": {
-			if (!isAlgorithm$3(key.algorithm, "HMAC")) throw unusable$4("HMAC");
-			const expected = Number.parseInt(alg.slice(2), 10);
-			if (getHashLength$1(key.algorithm.hash) !== expected) throw unusable$4(`SHA-${expected}`, "algorithm.hash");
-			break;
+async function verifyMulti(jws, keyOrLookup, options = {}) {
+	const general = _normalizeSerialization(jws);
+	if (typeof general.payload !== "string" || !Array.isArray(general.signatures) || general.signatures.length === 0) throw new JWTError("Invalid JWS JSON Serialization: missing payload or signatures.", "ERR_JWS_INVALID_SERIALIZATION");
+	let lastError;
+	let cryptoAttempted = false;
+	for (let i = 0; i < general.signatures.length; i++) {
+		const wireSig = general.signatures[i];
+		if (typeof wireSig.signature !== "string") {
+			lastError = new JWTError(`Signature[${i}] is missing the "signature" field.`, "ERR_JWS_INVALID");
+			continue;
 		}
-		case "RS256":
-		case "RS384":
-		case "RS512": {
-			if (!isAlgorithm$3(key.algorithm, "RSASSA-PKCS1-v1_5")) throw unusable$4("RSASSA-PKCS1-v1_5");
-			const expected = Number.parseInt(alg.slice(2), 10);
-			if (getHashLength$1(key.algorithm.hash) !== expected) throw unusable$4(`SHA-${expected}`, "algorithm.hash");
-			break;
+		let protectedHeader;
+		try {
+			protectedHeader = decodeProtectedHeader(wireSig.protected, "JWS");
+		} catch (err) {
+			lastError = err instanceof JWTError ? err : void 0;
+			continue;
 		}
-		case "PS256":
-		case "PS384":
-		case "PS512": {
-			if (!isAlgorithm$3(key.algorithm, "RSA-PSS")) throw unusable$4("RSA-PSS");
-			const expected = Number.parseInt(alg.slice(2), 10);
-			if (getHashLength$1(key.algorithm.hash) !== expected) throw unusable$4(`SHA-${expected}`, "algorithm.hash");
-			break;
+		if (!protectedHeader.alg) {
+			lastError = new JWTError(`Invalid JWS: Signature[${i}] protected header must have an "alg" property.`, "ERR_JWS_INVALID");
+			continue;
 		}
-		case "Ed25519":
-		case "EdDSA":
-			if (!isAlgorithm$3(key.algorithm, "Ed25519")) throw unusable$4("Ed25519");
-			break;
-		case "ES256":
-		case "ES384":
-		case "ES512": {
-			if (!isAlgorithm$3(key.algorithm, "ECDSA")) throw unusable$4("ECDSA");
-			const expected = getNamedCurve$1(alg);
-			if (key.algorithm.namedCurve !== expected) throw unusable$4(expected, "algorithm.namedCurve");
-			break;
+		const unprotectedHeader = sanitizeObjectCopy(wireSig.header);
+		_assertDisjointHeaders(protectedHeader, unprotectedHeader);
+		const effective = _mergeHeaders(protectedHeader, unprotectedHeader);
+		const alg = protectedHeader.alg;
+		if (options.typ && protectedHeader.typ !== options.typ) {
+			lastError = new JWTError(`Invalid JWS: "typ" Header Parameter mismatch on signature[${i}]. Expected "${options.typ}", got "${protectedHeader.typ}".`, "ERR_JWS_INVALID");
+			continue;
 		}
-		default: throw new TypeError("CryptoKey does not support this operation");
-	}
-	checkUsage$4(key, usage);
-}
-function subtleAlgorithm(alg, algorithm) {
-	const hash = `SHA-${alg.slice(-3)}`;
-	switch (alg) {
-		case "HS256":
-		case "HS384":
-		case "HS512": return {
-			hash,
-			name: "HMAC"
-		};
-		case "PS256":
-		case "PS384":
-		case "PS512": return {
-			hash,
-			name: "RSA-PSS",
-			saltLength: Number.parseInt(alg.slice(-3), 10) >> 3
-		};
-		case "RS256":
-		case "RS384":
-		case "RS512": return {
-			hash,
-			name: "RSASSA-PKCS1-v1_5"
-		};
-		case "ES256":
-		case "ES384":
-		case "ES512": return {
-			hash,
-			name: "ECDSA",
-			namedCurve: algorithm.namedCurve
-		};
-		case "Ed25519":
-		case "EdDSA": return { name: "Ed25519" };
-		default: throw new Error(`alg ${alg} is not supported either by JOSE or your javascript runtime`);
-	}
-}
-function unusable$4(name, prop = "algorithm.name") {
-	return /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-}
-function isAlgorithm$3(algorithm, name) {
-	return algorithm.name === name;
-}
-function getHashLength$1(hash) {
-	return Number.parseInt(hash.name.slice(4), 10);
-}
-function getNamedCurve$1(alg) {
-	switch (alg) {
-		case "ES256": return "P-256";
-		case "ES384": return "P-384";
-		case "ES512": return "P-521";
-		default: throw new Error("unreachable");
-	}
-}
-function checkUsage$4(key, usage) {
-	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
-}
-//#endregion
-//#region src/core/_crypto/_aes.ts
-const IV_BIT_LENGTHS = {
-	A128GCM: 96,
-	A128GCMKW: 96,
-	A192GCM: 96,
-	A192GCMKW: 96,
-	A256GCM: 96,
-	A256GCMKW: 96,
-	"A128CBC-HS256": 128,
-	"A192CBC-HS384": 128,
-	"A256CBC-HS512": 128
-};
-const CEK_BIT_LENGTHS = {
-	A128GCM: 128,
-	A192GCM: 192,
-	A256GCM: 256,
-	"A128CBC-HS256": 256,
-	"A192CBC-HS384": 384,
-	"A256CBC-HS512": 512
-};
-function bitLengthIV(alg) {
-	const length = IV_BIT_LENGTHS[alg];
-	if (length === void 0) throw new Error(`Unsupported JWE Algorithm: ${alg}`);
-	return length;
-}
-function generateIV(alg) {
-	return crypto.getRandomValues(new Uint8Array(bitLengthIV(alg) >> 3));
-}
-function checkIvLength(enc, iv) {
-	if (iv.length << 3 !== bitLengthIV(enc)) throw new Error("Invalid Initialization Vector length");
-}
-function bitLengthCEK(alg) {
-	const length = CEK_BIT_LENGTHS[alg];
-	if (length === void 0) throw new Error(`Unsupported JWE Algorithm: ${alg}`);
-	return length;
-}
-function generateCEK(alg) {
-	return crypto.getRandomValues(new Uint8Array(bitLengthCEK(alg) >> 3));
-}
-function checkCEKLength(cek, expected) {
-	const actual = cek.byteLength << 3;
-	if (actual !== expected) throw new Error(`Invalid Content Encryption Key length. Expected ${expected} bits, got ${actual} bits`);
-}
-function checkAESCryptoKey(key, alg, usage) {
-	switch (alg) {
-		case "A128GCM":
-		case "A192GCM":
-		case "A256GCM": {
-			if (!isAlgorithm$2(key.algorithm, "AES-GCM")) throw unusable$3("AES-GCM");
-			const expected = Number.parseInt(alg.slice(1, 4), 10);
-			if (key.algorithm.length !== expected) throw unusable$3(expected, "algorithm.length");
-			break;
+		const rawKeyMaterial = typeof keyOrLookup === "function" ? await keyOrLookup(effective, wireSig.protected ?? "") : keyOrLookup;
+		const algError = checkAlgAllowed(alg, rawKeyMaterial, options.algorithms, JWS_ALG_CTX);
+		if (algError) {
+			lastError = algError;
+			continue;
 		}
-		case "A128KW":
-		case "A192KW":
-		case "A256KW": {
-			if (!isAlgorithm$2(key.algorithm, "AES-KW")) throw unusable$3("AES-KW");
-			const expected = Number.parseInt(alg.slice(1, 4), 10);
-			if (key.algorithm.length !== expected) throw unusable$3(expected, "algorithm.length");
-			break;
-		}
-		default: throw new TypeError("CryptoKey does not support this operation");
-	}
-	checkUsage$3(key, usage);
-}
-async function aesKwWrap(alg, key, cek) {
-	const cryptoKey = await getAESKWCryptoKey(key, alg, { usage: "wrapKey" });
-	checkAESKWKeySize(cryptoKey, alg);
-	const cryptoKeyCek = await crypto.subtle.importKey("raw", cek, {
-		hash: "SHA-256",
-		name: "HMAC"
-	}, true, ["sign"]);
-	return new Uint8Array(await crypto.subtle.wrapKey("raw", cryptoKeyCek, cryptoKey, "AES-KW"));
-}
-async function aesKwUnwrap(alg, key, encryptedKey) {
-	const cryptoKey = await getAESKWCryptoKey(key, alg, { usage: "unwrapKey" });
-	checkAESKWKeySize(cryptoKey, alg);
-	const cryptoKeyCek = await crypto.subtle.unwrapKey("raw", encryptedKey, cryptoKey, "AES-KW", {
-		hash: "SHA-256",
-		name: "HMAC"
-	}, true, ["sign"]);
-	return new Uint8Array(await crypto.subtle.exportKey("raw", cryptoKeyCek));
-}
-async function gcmkwEncrypt(alg, key, plaintext, iv) {
-	const wrapped = await encrypt$1(alg.slice(0, 7), plaintext, key, iv, new Uint8Array(0));
-	return {
-		encryptedKey: wrapped.ciphertext,
-		iv: base64UrlEncode(wrapped.iv),
-		tag: base64UrlEncode(wrapped.tag)
-	};
-}
-async function gcmkwDecrypt(alg, key, ciphertext, iv, tag) {
-	return decrypt$1(alg.slice(0, 7), key, ciphertext, iv, tag, new Uint8Array(0));
-}
-async function encrypt$1(enc, plaintext, cek, iv, aad) {
-	if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) throw new TypeError("Key must be one of type: CryptoKey or Uint8Array");
-	if (iv) checkIvLength(enc, iv);
-	else iv = generateIV(enc);
-	switch (enc) {
-		case "A128CBC-HS256":
-		case "A192CBC-HS384":
-		case "A256CBC-HS512":
-			if (cek instanceof Uint8Array) checkCEKLength(cek, Number.parseInt(enc.slice(-3), 10));
-			return cbcEncrypt(enc, plaintext, cek, iv, aad);
-		case "A128GCM":
-		case "A192GCM":
-		case "A256GCM":
-			if (cek instanceof Uint8Array) checkCEKLength(cek, Number.parseInt(enc.slice(1, 4), 10));
-			return gcmEncrypt(enc, plaintext, cek, iv, aad);
-		default: throw new Error("Unsupported JWE Content Encryption Algorithm");
-	}
-}
-async function decrypt$1(enc, cek, ciphertext, iv, tag, aad) {
-	if (!isCryptoKey(cek) && !(cek instanceof Uint8Array)) throw new TypeError("Key must be one of type: CryptoKey or Uint8Array");
-	if (!iv) throw new Error("JWE Initialization Vector missing");
-	if (!tag) throw new Error("JWE Authentication Tag missing");
-	checkIvLength(enc, iv);
-	switch (enc) {
-		case "A128CBC-HS256":
-		case "A192CBC-HS384":
-		case "A256CBC-HS512":
-			if (cek instanceof Uint8Array) checkCEKLength(cek, Number.parseInt(enc.slice(-3), 10));
-			return cbcDecrypt(enc, cek, ciphertext, iv, tag, aad);
-		case "A128GCM":
-		case "A192GCM":
-		case "A256GCM":
-			if (cek instanceof Uint8Array) checkCEKLength(cek, Number.parseInt(enc.slice(1, 4), 10));
-			return gcmDecrypt(enc, cek, ciphertext, iv, tag, aad);
-		default: throw new Error("Unsupported JWE Content Encryption Algorithm");
-	}
-}
-function unusable$3(name, prop = "algorithm.name") {
-	return /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-}
-function isAlgorithm$2(algorithm, name) {
-	return algorithm.name === name;
-}
-function checkUsage$3(key, usage) {
-	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
-}
-async function getAESKWCryptoKey(key, alg, options = {}) {
-	const { extractable = true, usage } = options;
-	if (key instanceof Uint8Array) return crypto.subtle.importKey("raw", key, "AES-KW", extractable, [usage ?? "wrapKey"]);
-	checkAESCryptoKey(key, alg, usage);
-	return key;
-}
-function checkAESKWKeySize(key, alg) {
-	if (key.algorithm.length !== Number.parseInt(alg.slice(1, 4), 10)) throw new TypeError(`Invalid key size for alg: ${alg}`);
-}
-async function importCBCKeys(enc, cek, usage) {
-	const keySize = Number.parseInt(enc.slice(1, 4), 10);
-	const [encKey, macKey] = await Promise.all([crypto.subtle.importKey("raw", cek.subarray(keySize >> 3), "AES-CBC", false, [usage]), crypto.subtle.importKey("raw", cek.subarray(0, keySize >> 3), {
-		hash: `SHA-${keySize << 1}`,
-		name: "HMAC"
-	}, false, ["sign"])]);
-	return {
-		encKey,
-		macKey,
-		keySize
-	};
-}
-function cbcMacData(aad, iv, ciphertext) {
-	return concatUint8Arrays(aad, iv, ciphertext, uint64be(aad.length << 3));
-}
-async function cbcEncrypt(enc, plaintext, cek, iv, aad) {
-	if (!(cek instanceof Uint8Array)) throw new TypeError("CBC key must be of type Uint8Array");
-	const { encKey, macKey, keySize } = await importCBCKeys(enc, cek, "encrypt");
-	const ciphertext = new Uint8Array(await crypto.subtle.encrypt({
-		iv,
-		name: "AES-CBC"
-	}, encKey, plaintext));
-	const macData = cbcMacData(aad, iv, ciphertext);
-	return {
-		ciphertext,
-		tag: new Uint8Array((await crypto.subtle.sign("HMAC", macKey, macData)).slice(0, keySize >> 3)),
-		iv
-	};
-}
-async function gcmEncrypt(enc, plaintext, cek, iv, aad) {
-	let encKey;
-	if (cek instanceof Uint8Array) encKey = await crypto.subtle.importKey("raw", cek, "AES-GCM", false, ["encrypt"]);
-	else {
-		checkAESCryptoKey(cek, enc, "encrypt");
-		encKey = cek;
-	}
-	const encrypted = new Uint8Array(await crypto.subtle.encrypt({
-		additionalData: aad,
-		iv,
-		name: "AES-GCM",
-		tagLength: 128
-	}, encKey, plaintext));
-	const tag = encrypted.subarray(-16);
-	return {
-		ciphertext: encrypted.subarray(0, -16),
-		tag,
-		iv
-	};
-}
-async function cbcDecrypt(enc, cek, ciphertext, iv, tag, aad) {
-	if (!(cek instanceof Uint8Array)) throw new TypeError("CBC key must be of type Uint8Array");
-	const { encKey, macKey, keySize } = await importCBCKeys(enc, cek, "decrypt");
-	const macData = cbcMacData(aad, iv, ciphertext);
-	const expectedTag = new Uint8Array((await crypto.subtle.sign("HMAC", macKey, macData)).slice(0, keySize >> 3));
-	let macCheckPassed;
-	try {
-		macCheckPassed = await timingSafeEqual(tag, expectedTag);
-	} catch {}
-	if (!macCheckPassed) throw new Error("JWE Decryption Failed");
-	let plaintext;
-	try {
-		plaintext = new Uint8Array(await crypto.subtle.decrypt({
-			iv,
-			name: "AES-CBC"
-		}, encKey, ciphertext));
-	} catch {}
-	if (!plaintext) throw new Error("JWE Decryption Failed");
-	return plaintext;
-}
-async function gcmDecrypt(enc, cek, ciphertext, iv, tag, aad) {
-	let encKey;
-	if (cek instanceof Uint8Array) encKey = await crypto.subtle.importKey("raw", cek, "AES-GCM", false, ["decrypt"]);
-	else {
-		checkAESCryptoKey(cek, enc, "decrypt");
-		encKey = cek;
-	}
-	try {
-		return new Uint8Array(await crypto.subtle.decrypt({
-			additionalData: aad,
-			iv,
-			name: "AES-GCM",
-			tagLength: 128
-		}, encKey, concatUint8Arrays(ciphertext, tag)));
-	} catch {
-		throw new Error("JWE Decryption Failed");
-	}
-}
-let _timingSafeKey;
-function getTimingSafeKey() {
-	if (!_timingSafeKey) _timingSafeKey = crypto.subtle.generateKey({
-		name: "HMAC",
-		hash: "SHA-256"
-	}, false, ["sign"]);
-	return _timingSafeKey;
-}
-async function timingSafeEqual(a, b) {
-	if (!(a instanceof Uint8Array)) throw new TypeError("First argument must be a buffer");
-	if (!(b instanceof Uint8Array)) throw new TypeError("Second argument must be a buffer");
-	const algorithm = {
-		name: "HMAC",
-		hash: "SHA-256"
-	};
-	const key = await getTimingSafeKey();
-	const aHmac = new Uint8Array(await crypto.subtle.sign(algorithm, key, a));
-	const bHmac = new Uint8Array(await crypto.subtle.sign(algorithm, key, b));
-	let out = 0;
-	let i = -1;
-	while (++i < 32) out |= aHmac[i] ^ bHmac[i];
-	return out === 0;
-}
-function writeUInt32BE$1(buf, value, offset) {
-	if (value < 0 || value >= 2 ** 32) throw new RangeError(`value must be >= 0 and <= ${2 ** 32 - 1}. Received ${value}`);
-	buf.set([
-		value >>> 24,
-		value >>> 16,
-		value >>> 8,
-		value & 255
-	], offset);
-}
-function uint64be(value) {
-	const high = Math.floor(value / 2 ** 32);
-	const low = value % 2 ** 32;
-	const buf = new Uint8Array(8);
-	writeUInt32BE$1(buf, high, 0);
-	writeUInt32BE$1(buf, low, 4);
-	return buf;
-}
-//#endregion
-//#region src/core/_crypto/_key-codec.ts
-async function jwkTokey(jwk) {
-	if (!jwk.alg) throw new TypeError("\"alg\" argument is required when \"jwk.alg\" is not present");
-	const { algorithm, keyUsages } = subtleMapping(jwk);
-	return crypto.subtle.importKey("jwk", jwk, algorithm, jwk.ext ?? (jwk.d ? false : true), jwk.key_ops ?? keyUsages);
-}
-async function keyToJWK(key) {
-	if (key instanceof Uint8Array) return {
-		kty: "oct",
-		k: base64UrlEncode(key)
-	};
-	if (!isCryptoKey(key)) throw new TypeError("Key must be one of type: CryptoKey or Uint8Array");
-	if (!key.extractable) throw new TypeError("non-extractable CryptoKey cannot be exported as a JWK");
-	return await crypto.subtle.exportKey("jwk", key);
-}
-function subtleMapping(jwk) {
-	let algorithm;
-	let keyUsages;
-	switch (jwk.kty) {
-		case "RSA":
-			switch (jwk.alg) {
-				case "PS256":
-				case "PS384":
-				case "PS512":
-					algorithm = {
-						name: "RSA-PSS",
-						hash: `SHA-${jwk.alg.slice(-3)}`
-					};
-					keyUsages = jwk.d ? ["sign"] : ["verify"];
-					break;
-				case "RS256":
-				case "RS384":
-				case "RS512":
-					algorithm = {
-						name: "RSASSA-PKCS1-v1_5",
-						hash: `SHA-${jwk.alg.slice(-3)}`
-					};
-					keyUsages = jwk.d ? ["sign"] : ["verify"];
-					break;
-				case "RSA-OAEP":
-				case "RSA-OAEP-256":
-				case "RSA-OAEP-384":
-				case "RSA-OAEP-512":
-					algorithm = {
-						name: "RSA-OAEP",
-						hash: `SHA-${Number.parseInt(jwk.alg.slice(-3), 10) || 1}`
-					};
-					keyUsages = jwk.d ? ["decrypt", "unwrapKey"] : ["encrypt", "wrapKey"];
-					break;
-				default: throw new Error("Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value");
-			}
-			break;
-		case "EC":
-			switch (jwk.alg) {
-				case "ES256":
-					algorithm = {
-						name: "ECDSA",
-						namedCurve: "P-256"
-					};
-					keyUsages = jwk.d ? ["sign"] : ["verify"];
-					break;
-				case "ES384":
-					algorithm = {
-						name: "ECDSA",
-						namedCurve: "P-384"
-					};
-					keyUsages = jwk.d ? ["sign"] : ["verify"];
-					break;
-				case "ES512":
-					algorithm = {
-						name: "ECDSA",
-						namedCurve: "P-521"
-					};
-					keyUsages = jwk.d ? ["sign"] : ["verify"];
-					break;
-				case "ECDH-ES":
-				case "ECDH-ES+A128KW":
-				case "ECDH-ES+A192KW":
-				case "ECDH-ES+A256KW":
-					algorithm = {
-						name: "ECDH",
-						namedCurve: jwk.crv
-					};
-					keyUsages = jwk.d ? ["deriveBits"] : [];
-					break;
-				default: throw new Error("Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value");
-			}
-			break;
-		case "OKP":
-			switch (jwk.alg) {
-				case "Ed25519":
-				case "EdDSA":
-					algorithm = { name: "Ed25519" };
-					keyUsages = jwk.d ? ["sign"] : ["verify"];
-					break;
-				case "ECDH-ES":
-				case "ECDH-ES+A128KW":
-				case "ECDH-ES+A192KW":
-				case "ECDH-ES+A256KW":
-					algorithm = { name: jwk.crv };
-					keyUsages = jwk.d ? ["deriveBits"] : [];
-					break;
-				default: throw new Error("Invalid or unsupported JWK \"alg\" (Algorithm) Parameter value");
-			}
-			break;
-		default: throw new Error("Invalid or unsupported JWK \"kty\" (Key Type) Parameter value");
-	}
-	return {
-		algorithm,
-		keyUsages
-	};
-}
-//#endregion
-//#region src/core/_crypto/_rsa.ts
-async function encryptRSAES(alg, key, cek) {
-	checkRSACryptoKey(key, alg, "encrypt");
-	checkRSAModulusLength(alg, key);
-	return new Uint8Array(await crypto.subtle.encrypt("RSA-OAEP", key, cek));
-}
-async function decryptRSAES(alg, key, encryptedKey) {
-	checkRSACryptoKey(key, alg, "decrypt");
-	checkRSAModulusLength(alg, key);
-	return new Uint8Array(await crypto.subtle.decrypt("RSA-OAEP", key, encryptedKey));
-}
-function checkRSACryptoKey(key, alg, usage) {
-	if (!isAlgorithm$1(key.algorithm, "RSA-OAEP")) throw unusable$2("RSA-OAEP");
-	const expected = Number.parseInt(alg.slice(9), 10) || 1;
-	if (getHashLength(key.algorithm.hash) !== expected) throw unusable$2(`SHA-${expected}`, "algorithm.hash");
-	checkUsage$2(key, usage);
-}
-function checkRSAModulusLength(alg, key) {
-	if (alg.startsWith("RS") || alg.startsWith("PS") || alg.startsWith("RSA")) {
-		const { modulusLength } = key.algorithm;
-		if (typeof modulusLength !== "number" || modulusLength < 2048) throw new TypeError(`${alg} requires key modulusLength to be 2048 bits or larger`);
-	}
-}
-function unusable$2(name, prop = "algorithm.name") {
-	return /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-}
-function isAlgorithm$1(algorithm, name) {
-	return algorithm.name === name;
-}
-function getHashLength(hash) {
-	return Number.parseInt(hash.name.slice(4), 10);
-}
-function checkUsage$2(key, usage) {
-	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
-}
-//#endregion
-//#region src/core/_crypto/_ecdh.ts
-async function deriveECDHESKey(publicKey, privateKey, algorithm, keyLength, apu = new Uint8Array(0), apv = new Uint8Array(0)) {
-	checkECDHCryptoKey(publicKey, "ECDH");
-	checkECDHCryptoKey(privateKey, "ECDH", "deriveBits");
-	const value = concatUint8Arrays(lengthAndInput(textEncoder.encode(algorithm)), lengthAndInput(apu), lengthAndInput(apv), uint32be(keyLength));
-	const length = publicKey.algorithm.name === "X25519" ? 256 : Math.ceil(Number.parseInt(publicKey.algorithm.namedCurve.slice(-3), 10) / 8) << 3;
-	return concatKdf(new Uint8Array(await crypto.subtle.deriveBits({
-		name: publicKey.algorithm.name,
-		public: publicKey
-	}, privateKey, length)), keyLength, value);
-}
-function isECDHKeyAllowed(key) {
-	switch (key.algorithm.namedCurve) {
-		case "P-256":
-		case "P-384":
-		case "P-521": return true;
-		default: return key.algorithm.name === "X25519";
-	}
-}
-function checkECDHCryptoKey(key, alg, usage) {
-	switch (key.algorithm.name) {
-		case "ECDH":
-		case "X25519": break;
-		default: throw unusable$1("ECDH or X25519");
-	}
-	checkUsage$1(key, usage);
-}
-function unusable$1(name, prop = "algorithm.name") {
-	return /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-}
-function checkUsage$1(key, usage) {
-	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
-}
-async function concatKdf(secret, bits, value) {
-	const iterations = Math.ceil((bits >> 3) / 32);
-	const res = new Uint8Array(iterations * 32);
-	for (let iter = 0; iter < iterations; iter++) {
-		const buf = new Uint8Array(4 + secret.length + value.length);
-		buf.set(uint32be(iter + 1));
-		buf.set(secret, 4);
-		buf.set(value, 4 + secret.length);
-		res.set(await digest("sha256", buf), iter * 32);
-	}
-	return res.slice(0, bits >> 3);
-}
-function lengthAndInput(input) {
-	return concatUint8Arrays(uint32be(input.length), input);
-}
-async function digest(algorithm, data) {
-	return new Uint8Array(await crypto.subtle.digest(`SHA-${algorithm.slice(-3)}`, data));
-}
-function writeUInt32BE(buf, value, offset) {
-	if (value < 0 || value >= 2 ** 32) throw new RangeError(`value must be >= 0 and <= ${2 ** 32 - 1}. Received ${value}`);
-	buf.set([
-		value >>> 24,
-		value >>> 16,
-		value >>> 8,
-		value & 255
-	], offset);
-}
-function uint32be(value) {
-	const buf = new Uint8Array(4);
-	writeUInt32BE(buf, value, 0);
-	return buf;
-}
-//#endregion
-//#region src/core/_crypto/_pbes2.ts
-async function pbes2Wrap(alg, key, cek, p2c, p2s) {
-	const derived = await deriveKey(p2s, alg, p2c, key);
-	return {
-		encryptedKey: await aesKwWrap(alg.slice(-6), derived, cek),
-		p2c,
-		p2s: base64UrlEncode(p2s)
-	};
-}
-async function pbes2Unwrap(alg, key, encryptedKey, p2c, p2s) {
-	const derived = await deriveKey(p2s, alg, p2c, key);
-	return aesKwUnwrap(alg.slice(-6), derived, encryptedKey);
-}
-async function deriveKey(p2s, alg, p2c, key) {
-	if (!(p2s instanceof Uint8Array) || p2s.length < 8) throw new Error("PBES2 Salt Input must be 8 or more octets");
-	if (p2c === void 0 || p2c < 1) throw new Error("PBES2 Iteration Count Parameter must be a positive integer");
-	const salt = concatUint8Arrays(textEncoder.encode(alg), new Uint8Array([0]), p2s);
-	const keylen = Number.parseInt(alg.slice(13, 16), 10);
-	const subtleAlg = {
-		hash: `SHA-${alg.slice(8, 11)}`,
-		iterations: p2c,
-		name: "PBKDF2",
-		salt
-	};
-	const cryptoKey = await getPBKDF2CryptoKey(key, alg);
-	return new Uint8Array(await crypto.subtle.deriveBits(subtleAlg, cryptoKey, keylen));
-}
-function checkPBES2CryptoKey(key, alg, usage) {
-	if (!isAlgorithm(key.algorithm, "PBKDF2")) throw unusable("PBKDF2");
-	checkUsage(key, usage);
-}
-function unusable(name, prop = "algorithm.name") {
-	return /* @__PURE__ */ new TypeError(`CryptoKey does not support this operation, its ${prop} must be ${name}`);
-}
-function isAlgorithm(algorithm, name) {
-	return algorithm.name === name;
-}
-function checkUsage(key, usage) {
-	if (usage && !key.usages.includes(usage)) throw new TypeError(`CryptoKey does not support this operation, its usages must include ${usage}.`);
-}
-async function getPBKDF2CryptoKey(key, alg, options = {}) {
-	const { extractable = false, usage = "deriveBits" } = options;
-	if (key instanceof Uint8Array) return crypto.subtle.importKey("raw", key, "PBKDF2", extractable, [usage]);
-	checkPBES2CryptoKey(key, alg, usage);
-	return key;
-}
-//#endregion
-//#region src/core/_crypto/_key-encryption.ts
-const PUBLIC_EPK_FIELDS = new Set([
-	"kty",
-	"crv",
-	"x",
-	"y",
-	"kid",
-	"use",
-	"key_ops",
-	"alg",
-	"x5c",
-	"x5t",
-	"x5t#S256",
-	"x5u"
-]);
-async function encryptKey(alg, enc, key, providedCek, providedParameters = {}) {
-	let encryptedKey;
-	let parameters = {};
-	let cek;
-	switch (alg) {
-		case "dir":
-			cek = key;
-			break;
-		case "ECDH-ES":
-		case "ECDH-ES+A128KW":
-		case "ECDH-ES+A192KW":
-		case "ECDH-ES+A256KW": {
-			assertCryptoKey(key);
-			if (!isECDHKeyAllowed(key)) throw new Error("ECDH with the provided key is not allowed or not supported by your javascript runtime");
-			const { apu, apv, epk: providedEpk, epkPrivateKey } = providedParameters;
-			if (providedEpk && !epkPrivateKey) throw new TypeError("ECDH-ES custom ephemeral key material must include the matching private key.");
-			let ephemeralPrivateKey;
-			let epkHeader;
-			if (epkPrivateKey) {
-				ephemeralPrivateKey = await ensurePrivateKey(alg, epkPrivateKey);
-				epkHeader = await exportPublicJwkFrom(alg, providedEpk ?? epkPrivateKey);
-			} else {
-				if (providedEpk) throw new TypeError("ECDH-ES custom ephemeral public key requires a matching private key.");
-				const generated = await crypto.subtle.generateKey(key.algorithm, true, ["deriveBits"]);
-				ephemeralPrivateKey = generated.privateKey;
-				epkHeader = await exportPublicJwkFrom(alg, generated.publicKey);
-			}
-			const sharedSecret = await deriveECDHESKey(key, ephemeralPrivateKey, alg === "ECDH-ES" ? enc : alg, alg === "ECDH-ES" ? bitLengthCEK(enc) : Number.parseInt(alg.slice(-5, -2), 10), apu, apv);
-			parameters = { epk: epkHeader };
-			if (apu) parameters.apu = base64UrlEncode(apu);
-			if (apv) parameters.apv = base64UrlEncode(apv);
-			if (alg === "ECDH-ES") {
-				cek = sharedSecret;
-				break;
+		if (options.strictSignerMatch && !_signerKeyMatches(effective, rawKeyMaterial)) continue;
+		const signatureBytes = base64UrlDecode(wireSig.signature, { returnAs: "uint8array" });
+		const signingInputBytes = textEncoder.encode(`${wireSig.protected ?? ""}.${general.payload}`);
+		cryptoAttempted = true;
+		try {
+			if (!await _verifyWithKey(alg, rawKeyMaterial, signatureBytes, signingInputBytes, effective.kid)) {
+				lastError = new JWTError("JWS signature verification failed.", "ERR_JWS_SIGNATURE_INVALID");
+				continue;
 			}
-			cek = providedCek || generateCEK(enc);
-			encryptedKey = await aesKwWrap(alg.slice(-6), sharedSecret, cek);
-			break;
-		}
-		case "RSA-OAEP":
-		case "RSA-OAEP-256":
-		case "RSA-OAEP-384":
-		case "RSA-OAEP-512":
-			cek = providedCek || generateCEK(enc);
-			assertCryptoKey(key);
-			encryptedKey = await encryptRSAES(alg, key, cek);
-			break;
-		case "PBES2-HS256+A128KW":
-		case "PBES2-HS384+A192KW":
-		case "PBES2-HS512+A256KW": {
-			cek = providedCek || generateCEK(enc);
-			const { p2c, p2s } = providedParameters;
-			({encryptedKey, ...parameters} = await pbes2Wrap(alg, key, cek, p2c, p2s));
-			break;
-		}
-		case "A128KW":
-		case "A192KW":
-		case "A256KW":
-			cek = providedCek || generateCEK(enc);
-			encryptedKey = await aesKwWrap(alg, key, cek);
-			break;
-		case "A128GCMKW":
-		case "A192GCMKW":
-		case "A256GCMKW": {
-			cek = providedCek || generateCEK(enc);
-			const { iv } = providedParameters;
-			({encryptedKey, ...parameters} = await gcmkwEncrypt(alg, key, cek, iv));
-			break;
+			const useB64 = protectedHeader.b64 !== false;
+			const payload = decodeJWSPayload(general.payload, useB64, options.forceUint8Array);
+			validateCriticalHeadersJWS(protectedHeader, options.recognizedHeaders);
+			validateJwtClaimsIfJsonPayload(payload, options);
+			const result = {
+				payload,
+				protectedHeader,
+				signerIndex: i
+			};
+			if (unprotectedHeader) result.signerHeader = unprotectedHeader;
+			return result;
+		} catch (err) {
+			if (err instanceof JWTError && err.code !== "ERR_JWS_SIGNATURE_INVALID" && err.code !== "ERR_JWK_KEY_NOT_FOUND") throw err;
+			lastError = err instanceof JWTError ? err : void 0;
 		}
-		default: throw new Error("Invalid or unsupported \"alg\" (JWE Algorithm) header value");
-	}
-	return {
-		cek,
-		encryptedKey,
-		parameters
-	};
-}
-async function normalizeKey(key, alg) {
-	if (key instanceof Uint8Array) return key;
-	if (isCryptoKey(key)) return key;
-	if (isJWK(key)) {
-		if ("k" in key && key.k) return base64UrlDecode(key.k, false);
-		return jwkTokey(key.alg ? key : {
-			...key,
-			alg
-		});
 	}
-	throw new Error("unreachable");
-}
-function toPublicEpkJwk(jwk) {
-	const filtered = {};
-	for (const [key, value] of Object.entries(jwk)) if (value !== void 0 && PUBLIC_EPK_FIELDS.has(key)) filtered[key] = value;
-	const { kty, crv, x, y } = filtered;
-	if (typeof kty !== "string") throw new TypeError("ECDH-ES ephemeral key JWK must include the \"kty\" parameter.");
-	if (typeof crv !== "string") throw new TypeError("ECDH-ES ephemeral key JWK must include the \"crv\" parameter.");
-	if (typeof x !== "string") throw new TypeError("ECDH-ES ephemeral key JWK must include the \"x\" coordinate.");
-	if (kty === "EC" && typeof y !== "string") throw new TypeError("ECDH-ES EC ephemeral key JWK must include both \"x\" and \"y\" coordinates.");
-	const publicJwk = {
-		...filtered,
-		kty,
-		crv,
-		x
+	if (options.strictSignerMatch && !cryptoAttempted) throw new JWTError("No signature matched the provided key under strictSignerMatch.", "ERR_JWS_NO_MATCHING_SIGNER");
+	throw lastError ?? new JWTError("JWS signature verification failed.", "ERR_JWS_SIGNATURE_INVALID");
+}
+async function verifyMultiAll(jws, keyResolver, options = {}) {
+	const general = _normalizeSerialization(jws);
+	if (typeof general.payload !== "string" || !Array.isArray(general.signatures) || general.signatures.length === 0) throw new JWTError("Invalid JWS JSON Serialization: missing payload or signatures.", "ERR_JWS_INVALID_SERIALIZATION");
+	const outcomes = [];
+	for (let i = 0; i < general.signatures.length; i++) outcomes.push(await _verifyOneSignature(general.payload, general.signatures[i], i, keyResolver, options));
+	return outcomes;
+}
+function generalToFlattenedJWS(jws) {
+	if (jws.signatures.length !== 1) throw new JWTError(`Flattened JWS Serialization requires exactly one signature, got ${jws.signatures.length}.`, "ERR_JWS_INVALID_SERIALIZATION");
+	const [signature] = jws.signatures;
+	const flattened = {
+		payload: jws.payload,
+		signature: signature.signature
 	};
-	if (typeof y === "string") publicJwk.y = y;
-	else delete publicJwk.y;
-	return sanitizeObject(publicJwk);
+	if (signature.protected !== void 0) flattened.protected = signature.protected;
+	if (signature.header !== void 0) flattened.header = signature.header;
+	return flattened;
+}
+function _resolveSignerAlg(key, index) {
+	if (!isJWK(key)) throw new JWTError(`Signer[${index}] key is not a JWK.`, "ERR_JWS_SIGNER_ALG_INFERENCE");
+	const alg = key.alg;
+	if (!alg) throw new JWTError(`Cannot infer "alg" for signer[${index}]: the JWK has no "alg" property.`, "ERR_JWS_SIGNER_ALG_INFERENCE");
+	if (alg === "none") throw new JWTError("\"none\" is not a valid signing algorithm", "ERR_JWS_ALG_NOT_ALLOWED");
+	return alg;
+}
+function _resolveB64(signers) {
+	let decided;
+	for (let i = 0; i < signers.length; i++) {
+		const raw = signers[i].protectedHeader?.b64;
+		if (raw === void 0) continue;
+		if (decided === void 0) decided = raw;
+		else if (decided !== raw) throw new JWTError(`Inconsistent "b64" across signers (RFC 7797 §3 requires all signers use the same b64 value).`, "ERR_JWS_B64_INCONSISTENT");
+	}
+	return decided ?? true;
+}
+function _buildSignerProtectedHeader(signer, alg, payload, b64) {
+	const userHeader = sanitizeObjectCopy(signer.protectedHeader);
+	const header = {};
+	if (signer.key.kid) header.kid = signer.key.kid;
+	if (userHeader) Object.assign(header, userHeader);
+	header.alg = alg;
+	applyTypCtyDefaults(header, payload);
+	if (!b64) header.b64 = false;
+	else delete header.b64;
+	return header;
 }
-async function ensurePrivateKey(alg, value) {
-	const normalized = await normalizeKey(value, alg);
-	if (!(normalized instanceof CryptoKey)) throw new TypeError("ECDH-ES ephemeral private key must be a CryptoKey or convertible JWK.");
-	if (normalized.type !== "private") throw new TypeError("ECDH-ES ephemeral private key must have type \"private\".");
-	return normalized;
+function _assertDisjointHeaders(protectedHeader, unprotectedHeader) {
+	if (!protectedHeader || !unprotectedHeader) return;
+	for (const k of Object.keys(unprotectedHeader)) if (k in protectedHeader) throw new JWTError(`JWS header parameter "${k}" appears in both protected and unprotected headers of a signature; they must be disjoint (RFC 7515 §7.2.1).`, "ERR_JWS_HEADER_PARAMS_NOT_DISJOINT");
 }
-async function exportPublicJwkFrom(alg, value) {
-	if (isCryptoKey(value)) try {
-		return toPublicEpkJwk(await keyToJWK(value));
-	} catch (error_) {
-		throw new TypeError("ECDH-ES ephemeral CryptoKey must be extractable to export as JWK.", { cause: error_ instanceof Error ? error_ : void 0 });
-	}
-	if (isJWK(value) && isAsymmetricJWK(value) && value.kty === "EC") return toPublicEpkJwk(value);
-	const normalized = await normalizeKey(value, alg);
-	if (!(normalized instanceof CryptoKey)) throw new TypeError("ECDH-ES ephemeral public key must be a CryptoKey or convertible JWK.");
-	return exportPublicJwkFrom(alg, normalized);
-}
-//#endregion
-//#region src/core/_crypto/_pem.ts
-const toSPKI = (key) => {
-	return genericExport("public", "spki", key);
-};
-const toPKCS8 = (key) => {
-	return genericExport("private", "pkcs8", key);
-};
-const fromPKCS8 = (pem, alg, options) => {
-	return genericImport(/(?:-----(?:BEGIN|END) PRIVATE KEY-----|\s)/g, "pkcs8", pem, alg, options);
-};
-const fromSPKI = (pem, alg, options) => {
-	return genericImport(/(?:-----(?:BEGIN|END) PUBLIC KEY-----|\s)/g, "spki", pem, alg, options);
-};
-const fromX509 = (pem, alg, options) => {
-	let spki;
-	try {
-		spki = getSPKI(pem);
-	} catch (error_) {
-		throw new TypeError("Failed to parse the X.509 certificate", { cause: error_ });
-	}
-	return fromSPKI(spki, alg, options);
-};
-const formatPEM = (b64, descriptor) => {
-	return `-----BEGIN ${descriptor}-----\n${(b64.match(/.{1,64}/g) || []).join("\n")}\n-----END ${descriptor}-----`;
-};
-const genericExport = async (keyType, keyFormat, key) => {
-	if (!isCryptoKey(key)) throw new TypeError(`Key must be ${key} of type CryptoKey`);
-	if (!key.extractable) throw new TypeError("CryptoKey is not extractable");
-	if (key.type !== keyType) throw new TypeError(`key is not a ${keyType} key`);
-	return formatPEM(base64Encode(new Uint8Array(await crypto.subtle.exportKey(keyFormat, key))), `${keyType.toUpperCase()} KEY`);
-};
-const genericImport = async (replace, keyFormat, pem, alg, options) => {
-	let algorithm;
-	let keyUsages;
-	const keyData = base64Decode(pem.replace(replace, ""), false);
-	const isPublic = keyFormat === "spki";
-	switch (alg) {
-		case "PS256":
-		case "PS384":
-		case "PS512":
-			algorithm = {
-				name: "RSA-PSS",
-				hash: `SHA-${alg.slice(-3)}`
-			};
-			keyUsages = isPublic ? ["verify"] : ["sign"];
-			break;
-		case "RS256":
-		case "RS384":
-		case "RS512":
-			algorithm = {
-				name: "RSASSA-PKCS1-v1_5",
-				hash: `SHA-${alg.slice(-3)}`
-			};
-			keyUsages = isPublic ? ["verify"] : ["sign"];
-			break;
-		case "RSA-OAEP":
-		case "RSA-OAEP-256":
-		case "RSA-OAEP-384":
-		case "RSA-OAEP-512":
-			algorithm = {
-				name: "RSA-OAEP",
-				hash: `SHA-${Number.parseInt(alg.slice(-3), 10) || 1}`
-			};
-			keyUsages = isPublic ? ["encrypt", "wrapKey"] : ["decrypt", "unwrapKey"];
-			break;
-		case "ES256":
-			algorithm = {
-				name: "ECDSA",
-				namedCurve: "P-256"
-			};
-			keyUsages = isPublic ? ["verify"] : ["sign"];
-			break;
-		case "ES384":
-			algorithm = {
-				name: "ECDSA",
-				namedCurve: "P-384"
-			};
-			keyUsages = isPublic ? ["verify"] : ["sign"];
-			break;
-		case "ES512":
-			algorithm = {
-				name: "ECDSA",
-				namedCurve: "P-521"
-			};
-			keyUsages = isPublic ? ["verify"] : ["sign"];
-			break;
-		case "ECDH-ES":
-		case "ECDH-ES+A128KW":
-		case "ECDH-ES+A192KW":
-		case "ECDH-ES+A256KW": {
-			const namedCurve = getNamedCurve(keyData);
-			algorithm = namedCurve?.startsWith("P-") ? {
-				name: "ECDH",
-				namedCurve
-			} : { name: "X25519" };
-			keyUsages = isPublic ? [] : ["deriveBits"];
-			break;
-		}
-		case "Ed25519":
-		case "EdDSA":
-			algorithm = { name: "Ed25519" };
-			keyUsages = isPublic ? ["verify"] : ["sign"];
-			break;
-		default: throw new Error("Invalid or unsupported \"alg\" (Algorithm) value");
-	}
-	return crypto.subtle.importKey(keyFormat, keyData, algorithm, options?.extractable ?? (isPublic ? true : false), keyUsages);
-};
-const findOid = (keyData, oid, from = 0) => {
-	if (from === 0) {
-		oid.unshift(oid.length);
-		oid.unshift(6);
-	}
-	const i = keyData.indexOf(oid[0], from);
-	if (i === -1) return false;
-	const sub = keyData.subarray(i, i + oid.length);
-	if (sub.length !== oid.length) return false;
-	return sub.every((value, index) => value === oid[index]) || findOid(keyData, oid, i + 1);
-};
-const getNamedCurve = (keyData) => {
-	switch (true) {
-		case findOid(keyData, [
-			42,
-			134,
-			72,
-			206,
-			61,
-			3,
-			1,
-			7
-		]): return "P-256";
-		case findOid(keyData, [
-			43,
-			129,
-			4,
-			0,
-			34
-		]): return "P-384";
-		case findOid(keyData, [
-			43,
-			129,
-			4,
-			0,
-			35
-		]): return "P-521";
-		default: return;
-	}
-};
-const getElement = (seq) => {
-	const result = [];
-	let next = 0;
-	while (next < seq.length) {
-		const nextPart = parseElement(seq.subarray(next));
-		result.push(nextPart);
-		next += nextPart.byteLength;
-	}
-	return result;
-};
-const parseElement = (bytes) => {
-	let position = 0;
-	let tag = bytes[0] & 31;
-	position++;
-	if (tag === 31) {
-		tag = 0;
-		while (bytes[position] >= 128) {
-			tag = tag * 128 + bytes[position] - 128;
-			position++;
-		}
-		tag = tag * 128 + bytes[position] - 128;
-		position++;
-	}
-	let length = 0;
-	if (bytes[position] < 128) {
-		length = bytes[position];
-		position++;
-	} else if (length === 128) {
-		length = 0;
-		while (bytes[position + length] !== 0 || bytes[position + length + 1] !== 0) {
-			if (length > bytes.byteLength) throw new TypeError("invalid indefinite form length");
-			length++;
-		}
-		const byteLength = position + length + 2;
-		return {
-			byteLength,
-			contents: bytes.subarray(position, position + length),
-			raw: bytes.subarray(0, byteLength)
-		};
-	} else {
-		const numberOfDigits = bytes[position] & 127;
-		position++;
-		length = 0;
-		for (let i = 0; i < numberOfDigits; i++) {
-			length = length * 256 + bytes[position];
-			position++;
-		}
-	}
-	const byteLength = position + length;
+function _mergeHeaders(protectedHeader, unprotectedHeader) {
+	if (!unprotectedHeader) return protectedHeader;
 	return {
-		byteLength,
-		contents: bytes.subarray(position, byteLength),
-		raw: bytes.subarray(0, byteLength)
+		...protectedHeader,
+		...unprotectedHeader
 	};
-};
-const spkiFromX509 = (buf) => {
-	const tbsCertificate = getElement(getElement(parseElement(buf).contents)[0].contents);
-	return base64Encode(tbsCertificate[tbsCertificate[0].raw[0] === 160 ? 6 : 5].raw);
-};
-let createPublicKey;
-const getSPKI = (x509) => {
-	try {
-		createPublicKey ??= globalThis.process?.getBuiltinModule?.("node:crypto")?.createPublicKey;
-	} catch {
-		createPublicKey = 0;
-	}
-	if (createPublicKey) try {
-		return new createPublicKey(x509).export({
-			format: "pem",
-			type: "spki"
-		});
-	} catch {}
-	return formatPEM(spkiFromX509(base64Decode(x509.replace(/(?:-----(?:BEGIN|END) CERTIFICATE-----|\s)/g, ""), false)), "PUBLIC KEY");
-};
-//#endregion
-//#region src/core/jwk.ts
-async function generateKey(alg, options = {}) {
-	const exportToJWK = options.toJWK !== void 0 && options.toJWK !== false;
-	const defaultExtractable = options.extractable !== false;
-	if (alg === "A128CBC-HS256" || alg === "A192CBC-HS384" || alg === "A256CBC-HS512") {
-		const keyBytes = randomBytes(bitLengthCEK(alg) >> 3);
-		if (exportToJWK) return keyToJWK(keyBytes);
-		return keyBytes;
-	}
-	const { algorithm, keyUsages } = getGenerateKeyParams(alg, options);
-	const key = await crypto.subtle.generateKey(algorithm, defaultExtractable, keyUsages);
-	if (exportToJWK) if (key instanceof CryptoKey) return exportKey(key, { alg });
-	else {
-		const [publicKey, privateKey] = await Promise.all([exportKey(key.publicKey, { alg }), exportKey(key.privateKey, { alg })]);
-		return {
-			privateKey,
-			publicKey
-		};
-	}
-	return key;
 }
-/**
-* Generates a Json Web Key (JWK) for the specified algorithm.
-*
-* @param alg The JWA algorithm identifier (e.g., "HS256", "RS256", "A128GCM").
-* @param jwkParams Optional partial JWK to merge with the generated key, allowing overrides.
-* @param options Configuration options for key generation.
-* @returns A Promise resolving to the generated JWK or JWK pair representation.
-*/
-async function generateJWK(alg, jwkParams, options = {}) {
-	const extraParams = {
-		kid: typeof jwkParams?.kid === "string" ? jwkParams.kid : crypto.randomUUID(),
-		...jwkParams
-	};
-	const result = await generateKey(alg, {
-		...options,
-		toJWK: true
-	});
-	if (result && typeof result === "object" && "privateKey" in result && "publicKey" in result) {
-		const pair = result;
+function _normalizeSerialization(input) {
+	if (!input || typeof input !== "object") throw new JWTError("Invalid JWS JSON Serialization: expected an object.", "ERR_JWS_INVALID_SERIALIZATION");
+	const obj = input;
+	if (Array.isArray(obj.signatures)) return obj;
+	if ("signature" in obj) {
+		const flattened = obj;
+		const signature = { signature: flattened.signature };
+		if (flattened.protected !== void 0) signature.protected = flattened.protected;
+		if (flattened.header !== void 0) signature.header = flattened.header;
 		return {
-			privateKey: {
-				...extraParams,
-				...pair.privateKey
-			},
-			publicKey: {
-				...extraParams,
-				...pair.publicKey
-			}
+			payload: flattened.payload,
+			signatures: [signature]
 		};
 	}
-	return {
-		...extraParams,
-		...result
-	};
+	throw new JWTError("Invalid JWS JSON Serialization: missing both signatures[] and flattened signature.", "ERR_JWS_INVALID_SERIALIZATION");
 }
-async function deriveKeyFromPassword(password, alg, options) {
-	const { salt, iterations, extractable, keyUsage } = options;
-	const exportToJWK = options.toJWK !== void 0 && options.toJWK !== false;
-	if (!(salt instanceof Uint8Array) || salt.length < 8) throw new Error("PBES2 Salt Input (salt) must be 8 or more octets");
-	if (typeof iterations !== "number" || iterations < 1) throw new Error("PBES2 Iteration Count (iterations) must be a positive integer");
-	const derivedBytes = await deriveKey(salt, alg, iterations, typeof password === "string" ? textEncoder.encode(password) : password);
-	const wrappingAlg = alg.slice(-6);
-	const finalUsages = keyUsage ?? ["wrapKey", "unwrapKey"];
-	const finalExtractable = exportToJWK ? true : extractable === true;
-	const derivedKey = await crypto.subtle.importKey("raw", derivedBytes, { name: "AES-KW" }, finalExtractable, finalUsages);
-	if (exportToJWK) return {
-		...await keyToJWK(derivedKey),
-		alg: wrappingAlg,
-		kty: "oct"
-	};
-	return derivedKey;
-}
-/**
-* Derives a Json Web Key (JWK) from a password using PBKDF2 as specified by PBES2 algorithms.
-*
-* @param password The password to derive the key from (string or Uint8Array).
-* @param alg The PBES2 algorithm identifier (e.g., "PBES2-HS256+A128KW").
-* @param jwkParams Optional partial JWK to merge with the generated key, allowing overrides.
-* @param options Configuration options including salt and iterations.
-* @returns A Promise resolving to the derived JWK (JWK_oct).
-*/
-async function deriveJWKFromPassword(password, alg, options, jwkParams) {
-	const result = await deriveKeyFromPassword(password, alg, {
-		...options,
-		toJWK: true
-	});
-	return jwkParams ? {
-		...jwkParams,
-		...result
-	} : result;
-}
-/**
-* Default JWK import cache backed by a WeakMap.
-*
-* The outer WeakMap is keyed by the JWK object reference — a cache hit only
-* occurs when the exact same object variable is passed to {@link importKey}.
-* Reconstructing a structurally identical JWK (e.g. `{ ...jwk }`) will miss
-* the cache.
-*
-* The inner `Record<string, CryptoKey>` uses a plain object rather than `Map`
-* because typical entries have 1–2 algorithm strings per key. V8 applies
-* hidden-class optimisation to small plain objects, making property access
-* faster than `Map.get()` at this cardinality.
-*/
-var WeakMapJWKCache = class {
-	_map = /* @__PURE__ */ new WeakMap();
-	get(jwk, alg) {
-		return this._map.get(jwk)?.[alg];
-	}
-	set(jwk, alg, key) {
-		let entry = this._map.get(jwk);
-		if (!entry) this._map.set(jwk, { [alg]: key });
-		else entry[alg] = key;
-	}
-};
-let _activeCache = new WeakMapJWKCache();
-async function importKey(key, algOrOptions) {
-	const alg = typeof algOrOptions === "string" ? algOrOptions : void 0;
-	if (typeof key === "string") key = textEncoder.encode(key);
-	if (key instanceof Uint8Array) return key;
-	if (isCryptoKey(key)) return key;
-	if (isJWK(key)) if ("k" in key && typeof key.k === "string") {
-		const rawBytes = base64UrlDecode(key.k, false);
-		if (typeof algOrOptions === "object" && algOrOptions.asCryptoKey) {
-			const { algorithm, usage, extractable = false } = algOrOptions;
-			return crypto.subtle.importKey("raw", rawBytes, algorithm, extractable, usage);
-		}
-		return rawBytes;
-	} else {
-		if (!key.alg && !alg) throw new TypeError("Algorithm must be provided when importing non-oct JWK");
-		const effectiveAlg = key.alg || alg;
-		if (_activeCache) {
-			const cached = _activeCache.get(key, effectiveAlg);
-			if (cached) return cached;
-		}
-		const cryptoKey = await jwkTokey(key.alg ? key : {
-			...key,
-			alg
-		});
-		if (_activeCache) _activeCache.set(key, effectiveAlg, cryptoKey);
-		return cryptoKey;
-	}
-	throw new JWTError("Invalid key type provided to importKey", "ERR_JWK_INVALID");
-}
-/**
-* Exports a CryptoKey to a JWK (JSON Web Key) format.
-*
-* @param key The CryptoKey to export.
-* @param jwk Optional partial JWK to merge with the exported key, allowing overrides.
-* @returns A Promise resolving to the exported JWK.
-*/
-async function exportKey(key, jwk) {
-	const exportedJwk = await keyToJWK(key);
-	if (jwk) return {
-		...sanitizeObject(jwk),
-		...exportedJwk
-	};
-	return exportedJwk;
-}
-async function resolveWrappingKey(alg, key) {
-	if (alg.startsWith("PBES2") && (typeof key === "string" || key instanceof Uint8Array)) return typeof key === "string" ? textEncoder.encode(key) : key;
-	if (typeof key === "string") throw new TypeError(`Key must be CryptoKey, JWK, or Uint8Array for ${alg}`);
-	return importKey(key, alg);
-}
-async function unwrapKey(alg, wrappedKey, unwrappingKey, options = {}) {
-	const returnRaw = options.format === "raw";
-	const defaultExtractable = options.extractable !== false;
-	const importedUnwrappingKey = isCryptoKey(unwrappingKey) ? unwrappingKey : await resolveWrappingKey(alg, unwrappingKey);
-	let unwrappedCekBytes;
-	switch (alg) {
-		case "dir":
-			if (importedUnwrappingKey instanceof Uint8Array) unwrappedCekBytes = importedUnwrappingKey;
-			else {
-				if (!returnRaw) return importedUnwrappingKey;
-				unwrappedCekBytes = new Uint8Array(await crypto.subtle.exportKey("raw", importedUnwrappingKey));
-			}
-			break;
-		case "A128KW":
-		case "A192KW":
-		case "A256KW":
-			unwrappedCekBytes = await aesKwUnwrap(alg, importedUnwrappingKey, wrappedKey);
-			break;
-		case "PBES2-HS256+A128KW":
-		case "PBES2-HS384+A192KW":
-		case "PBES2-HS512+A256KW": {
-			const { p2s, p2c } = options;
-			if (!p2s || typeof p2c !== "number") throw new Error("PBES2 requires 'p2s' (salt) and 'p2c' (count) options");
-			unwrappedCekBytes = await pbes2Unwrap(alg, importedUnwrappingKey, wrappedKey, p2c, typeof p2s === "string" ? base64UrlDecode(p2s, false) : p2s);
-			break;
-		}
-		case "A128GCMKW":
-		case "A192GCMKW":
-		case "A256GCMKW":
-			if (!options.iv || !options.tag) throw new Error("AES-GCMKW requires 'iv' and 'tag' options for unwrapping");
-			unwrappedCekBytes = await gcmkwDecrypt(alg, importedUnwrappingKey, wrappedKey, typeof options.iv === "string" ? base64UrlDecode(options.iv, false) : options.iv, typeof options.tag === "string" ? base64UrlDecode(options.tag, false) : options.tag);
-			break;
-		case "RSA-OAEP":
-		case "RSA-OAEP-256":
-		case "RSA-OAEP-384":
-		case "RSA-OAEP-512": {
-			if (!(importedUnwrappingKey instanceof CryptoKey)) throw new TypeError("RSA-OAEP requires the unwrapping key to be provided as a CryptoKey");
-			unwrappedCekBytes = await decryptRSAES(alg, importedUnwrappingKey, wrappedKey);
-			if (returnRaw) break;
-			const inferredAlgorithm = options.unwrappedKeyAlgorithm || inferAesImportAlgorithm(options.enc, unwrappedCekBytes.length);
-			if (!inferredAlgorithm) throw new Error("Unable to infer algorithm for RSA-OAEP unwrapped key. Provide \"unwrappedKeyAlgorithm\" in options.");
-			const keyUsages = options.keyUsage || ["encrypt", "decrypt"];
-			return await crypto.subtle.importKey("raw", unwrappedCekBytes, inferredAlgorithm, defaultExtractable, keyUsages);
-		}
-		case "ECDH-ES":
-		case "ECDH-ES+A128KW":
-		case "ECDH-ES+A192KW":
-		case "ECDH-ES+A256KW": {
-			if (!options.epk) throw new Error("ECDH-ES requires 'epk' (Ephemeral Public Key) option");
-			if (!(importedUnwrappingKey instanceof CryptoKey)) throw new TypeError("ECDH-ES requires the unwrapping key to be a CryptoKey");
-			if (!isECDHKeyAllowed(importedUnwrappingKey)) throw new Error("ECDH with the provided key is not allowed or not supported");
-			const epkCandidate = options.epk instanceof CryptoKey ? options.epk : await normalizeKey(options.epk, alg);
-			if (!(epkCandidate instanceof CryptoKey)) throw new TypeError("Failed to normalize ECDH ephemeral public key");
-			const apuBytes = typeof options.apu === "string" ? base64UrlDecode(options.apu, false) : options.apu ?? new Uint8Array(0);
-			const apvBytes = typeof options.apv === "string" ? base64UrlDecode(options.apv, false) : options.apv ?? new Uint8Array(0);
-			const infoAlg = alg === "ECDH-ES" ? options.enc : alg;
-			if (!infoAlg) throw new Error("ECDH-ES requires content encryption algorithm ('enc') to derive the shared secret");
-			const sharedSecret = await deriveECDHESKey(epkCandidate, importedUnwrappingKey, infoAlg, alg === "ECDH-ES" ? bitLengthCEK(infoAlg) : Number.parseInt(alg.slice(-5, -2), 10), apuBytes, apvBytes);
-			if (alg === "ECDH-ES") unwrappedCekBytes = sharedSecret;
-			else {
-				const kwAlg = alg.slice(-6);
-				if (!(wrappedKey instanceof Uint8Array) || wrappedKey.length === 0) throw new Error("ECDH-ES key agreement with key wrapping requires an encrypted key");
-				unwrappedCekBytes = await aesKwUnwrap(kwAlg, sharedSecret, wrappedKey);
-			}
-			break;
-		}
-		default: throw new Error(`Unsupported key unwrapping algorithm: ${alg}`);
+function _signerKeyMatches(effectiveHeader, keyMaterial) {
+	const headerKid = effectiveHeader.kid;
+	if (isJWKSet(keyMaterial)) return keyMaterial.keys.some((k) => !headerKid || k.kid === headerKid);
+	if (isJWK(keyMaterial)) {
+		if (headerKid && keyMaterial.kid && headerKid !== keyMaterial.kid) return false;
+		return true;
 	}
-	if (returnRaw) return unwrappedCekBytes;
-	return await crypto.subtle.importKey("raw", unwrappedCekBytes, options.unwrappedKeyAlgorithm || { name: "AES-GCM" }, defaultExtractable, options.keyUsage || ["encrypt", "decrypt"]);
+	return !headerKid;
 }
-/**
-* Imports a key from a PEM-encoded string and converts it to a JWK.
-*
-* @param pem The PEM-encoded string.
-* @param pemType The type of PEM encoding ('pkcs8' for private keys, 'spki' for public keys, 'x509' for certificates).
-* @param alg The JWA algorithm identifier. This is crucial for `crypto.subtle.importKey`
-*            to understand the key's intended algorithm and for setting the 'alg' field in the resulting JWK.
-* @param importOptions Options for the PEM import process (e.g., extractable for the CryptoKey).
-* @param jwkExtras Additional properties to merge into the resulting JWK.
-* @returns A Promise resolving to the imported key as a JWK.
-*/
-async function importFromPEM(pem, pemType, alg, options) {
-	const extractable = options?.extractable !== false;
-	let cryptoKey;
-	switch (pemType) {
-		case "pkcs8":
-			cryptoKey = await fromPKCS8(pem, alg, { extractable });
-			break;
-		case "spki":
-			cryptoKey = await fromSPKI(pem, alg, { extractable });
-			break;
-		case "x509":
-			cryptoKey = await fromX509(pem, alg, { extractable });
-			break;
-		default: throw new TypeError(`Unsupported PEM type: ${pemType}`);
+async function _verifyWithKey(alg, rawKeyMaterial, signatureBytes, signingInputBytes, headerKid) {
+	if (isJWKSet(rawKeyMaterial)) {
+		const candidates = getJWKsFromSet(rawKeyMaterial, buildJWKSetFilter({
+			kid: headerKid,
+			alg
+		}));
+		if (candidates.length === 0) throw new JWTError("No key found in JWK Set.", "ERR_JWK_KEY_NOT_FOUND");
+		for (const candidate of candidates) if (await verify$1(alg, await resolveSigningKey(alg, await importKey(candidate, {
+			alg,
+			expect: "public"
+		}), "verify"), signatureBytes, signingInputBytes)) return true;
+		return false;
 	}
-	return exportKey(cryptoKey, {
+	return verify$1(alg, await resolveSigningKey(alg, await importKey(rawKeyMaterial, {
 		alg,
-		...options?.jwkParams
-	});
-}
-/**
-* Exports a JWK to a PEM-encoded string.
-*
-* @param jwk The JWK to export.
-* @param pemFormat The desired PEM format ('pkcs8' for private keys, 'spki' for public keys).
-* @param algForCryptoKeyImport If the JWK does not have an 'alg' property, this algorithm hint is
-*                              required to correctly convert it to a CryptoKey first.
-* @returns A Promise resolving to the PEM-encoded key string.
-*/
-async function exportToPEM(jwk, pemFormat, algForCryptoKeyImport) {
-	if (jwk.kty === "oct") throw new TypeError("Octet (symmetric) JWKs (kty: 'oct') cannot be exported to PKCS8 or SPKI PEM formats.");
-	const effectiveAlg = jwk.alg || algForCryptoKeyImport;
-	if (!effectiveAlg && (jwk.kty === "RSA" || jwk.kty === "EC" || jwk.kty === "OKP")) throw new TypeError("Algorithm (alg) must be provided in the JWK or as a parameter for converting this JWK type to a CryptoKey.");
-	const cryptoKeyCandidate = await importKey({
-		...jwk,
-		ext: true
-	}, effectiveAlg);
-	if (!isCryptoKey(cryptoKeyCandidate)) throw new Error("Failed to convert JWK to a CryptoKey instance suitable for PEM export.");
-	const cryptoKey = cryptoKeyCandidate;
-	switch (pemFormat) {
-		case "pkcs8":
-			if (cryptoKey.type !== "private") throw new TypeError(`Only 'private' type CryptoKeys can be exported to PKCS8 PEM format. Key type is '${cryptoKey.type}'.`);
-			return toPKCS8(cryptoKey);
-		case "spki":
-			if (cryptoKey.type !== "public") throw new TypeError(`Only 'public' type CryptoKeys can be exported to SPKI PEM format. Key type is '${cryptoKey.type}'.`);
-			return toSPKI(cryptoKey);
-		default: throw new TypeError(`Unsupported PEM format: ${pemFormat}`);
-	}
-}
-/**
-* Returns all JWKs from a JWK Set, optionally narrowed by a predicate.
-*
-* Useful for multi-key verification retry, key rotation tooling, and
-* constructing multi-recipient JWE JSON Serialization structures.
-*
-* @param jwkSet The JWK Set to search.
-* @param filter Optional predicate `(jwk: JWK) => boolean`. Returns all keys when omitted.
-* @returns An array of matching JWKs.
-*/
-function getJWKsFromSet(jwkSet, filter) {
-	if (!jwkSet || !isJWKSet(jwkSet)) throw new TypeError("Invalid JWK Set provided");
-	if (!filter) return [...jwkSet.keys];
-	return jwkSet.keys.filter(filter);
-}
-function getGenerateKeyParams(alg, options) {
-	let algorithm;
-	let keyUsages;
-	const defaultKeyUsage = options?.keyUsage;
-	switch (alg) {
-		case "HS256":
-		case "HS384":
-		case "HS512":
-			algorithm = {
-				name: "HMAC",
-				hash: `SHA-${alg.slice(2)}`
-			};
-			keyUsages = defaultKeyUsage ?? ["sign", "verify"];
-			break;
-		case "RS256":
-		case "RS384":
-		case "RS512":
-			algorithm = {
-				name: "RSASSA-PKCS1-v1_5",
-				modulusLength: options?.modulusLength ?? 2048,
-				publicExponent: options?.publicExponent ?? new Uint8Array([
-					1,
-					0,
-					1
-				]),
-				hash: `SHA-${alg.slice(2)}`
-			};
-			keyUsages = defaultKeyUsage ?? ["sign", "verify"];
-			break;
-		case "PS256":
-		case "PS384":
-		case "PS512":
-			algorithm = {
-				name: "RSA-PSS",
-				modulusLength: options?.modulusLength ?? 2048,
-				publicExponent: options?.publicExponent ?? new Uint8Array([
-					1,
-					0,
-					1
-				]),
-				hash: `SHA-${alg.slice(2)}`
-			};
-			keyUsages = defaultKeyUsage ?? ["sign", "verify"];
-			break;
-		case "RSA-OAEP":
-		case "RSA-OAEP-256":
-		case "RSA-OAEP-384":
-		case "RSA-OAEP-512":
-			algorithm = {
-				name: "RSA-OAEP",
-				modulusLength: options?.modulusLength ?? 2048,
-				publicExponent: options?.publicExponent ?? new Uint8Array([
-					1,
-					0,
-					1
-				]),
-				hash: `SHA-${Number.parseInt(alg.slice(9), 10) || 1}`
-			};
-			keyUsages = defaultKeyUsage ?? [
-				"encrypt",
-				"decrypt",
-				"wrapKey",
-				"unwrapKey"
-			];
-			break;
-		case "A128KW":
-		case "A192KW":
-		case "A256KW":
-			algorithm = {
-				name: "AES-KW",
-				length: Number.parseInt(alg.slice(1, 4), 10)
-			};
-			keyUsages = defaultKeyUsage ?? ["wrapKey", "unwrapKey"];
-			break;
-		case "A128GCM":
-		case "A192GCM":
-		case "A256GCM":
-		case "A128GCMKW":
-		case "A192GCMKW":
-		case "A256GCMKW": {
-			const baseAlg = alg.replace("KW", "");
-			algorithm = {
-				name: "AES-GCM",
-				length: Number.parseInt(baseAlg.slice(1, 4), 10)
-			};
-			keyUsages = defaultKeyUsage ?? (alg.endsWith("KW") ? ["wrapKey", "unwrapKey"] : ["encrypt", "decrypt"]);
-			break;
-		}
-		case "ES256":
-		case "ES384":
-		case "ES512":
-			algorithm = {
-				name: "ECDSA",
-				namedCurve: `P-${alg.slice(2)}`
-			};
-			keyUsages = defaultKeyUsage ?? ["sign", "verify"];
-			break;
-		case "Ed25519":
-			keyUsages = defaultKeyUsage ?? ["sign", "verify"];
-			algorithm = { name: "Ed25519" };
-			break;
-		case "EdDSA": {
-			keyUsages = defaultKeyUsage ?? ["sign", "verify"];
-			const namedCurve = options?.namedCurve ?? "Ed25519";
-			switch (namedCurve) {
-				case "Ed25519":
-				case "Ed448":
-					algorithm = { name: namedCurve };
-					break;
-				default: throw new Error("Unsupported namedCurve provided. Supported values are: Ed25519 and Ed448");
-			}
-			break;
-		}
-		case "ECDH-ES":
-		case "ECDH-ES+A128KW":
-		case "ECDH-ES+A192KW":
-		case "ECDH-ES+A256KW": {
-			keyUsages = ["deriveBits"];
-			const namedCurve = options?.namedCurve ?? "P-256";
-			switch (namedCurve) {
-				case "P-256":
-				case "P-384":
-				case "P-521":
-					algorithm = {
-						name: "ECDH",
-						namedCurve
-					};
-					break;
-				case "X25519":
-					algorithm = { name: "X25519" };
-					break;
-				default: throw new Error("Unsupported namedCurve provided. Supported values are: P-256, P-384, P-521 and X25519");
-			}
-			break;
-		}
-		default: throw new Error(`Unsupported or invalid algorithm for key generation: ${alg}`);
-	}
-	return {
-		algorithm,
-		keyUsages
-	};
-}
-function inferAesImportAlgorithm(enc, cekLengthBytes) {
-	const bitLength = cekLengthBytes << 3;
-	if (enc) {
-		if (enc.includes("GCM")) return {
-			name: "AES-GCM",
-			length: Number.parseInt(enc.slice(1, 4), 10)
+		expect: "public"
+	}), "verify"), signatureBytes, signingInputBytes);
+}
+async function _verifyOneSignature(payload, wireSig, index, keyResolver, options) {
+	const fail = (error, protectedHeader, signerHeader) => {
+		const outcome = {
+			signerIndex: index,
+			verified: false,
+			error
 		};
-		if (enc.includes("CBC-HS")) return;
-	}
-	if (bitLength === 128 || bitLength === 192 || bitLength === 256) return {
-		name: "AES-GCM",
-		length: bitLength
+		if (protectedHeader) outcome.protectedHeader = protectedHeader;
+		if (signerHeader) outcome.signerHeader = signerHeader;
+		return outcome;
 	};
-}
-//#endregion
-//#region src/core/jwe.ts
-async function encrypt(payload, key, options = {}) {
-	const { protectedHeader: userHeader, cek: providedCek, contentEncryptionIV: providedContentIV, keyManagementIV, p2s, p2c, ecdh } = options;
-	let { alg, enc } = options;
-	if (!alg) {
-		if (typeof key === "string" || key instanceof Uint8Array) alg = "PBES2-HS256+A128KW";
-		else if (isJWK(key)) alg = key.alg === "A128GCM" || key.alg === "A192GCM" || key.alg === "A256GCM" ? `${key.alg}KW` : key.alg;
-	}
-	if (!alg) throw new TypeError("JWE \"alg\" (Key Management Algorithm) must be provided in options or inferable from the key");
-	if (!enc) if (alg === "dir") {
-		enc = isJWK(key) && "enc" in key ? key.enc : void 0;
-		if (!enc) throw new TypeError("JWE \"enc\" must be provided when alg is \"dir\"");
-	} else enc = isJWK(key) && "enc" in key ? key.enc : "A128GCM";
-	const jweKeyManagementParams = {};
-	if (keyManagementIV) jweKeyManagementParams.iv = keyManagementIV;
-	if (p2s) jweKeyManagementParams.p2s = p2s;
-	else if (alg?.startsWith("PBES2")) jweKeyManagementParams.p2s = randomBytes(16);
-	if (p2c) jweKeyManagementParams.p2c = p2c;
-	else if (alg?.startsWith("PBES2")) jweKeyManagementParams.p2c = 6e5;
-	if (ecdh?.partyUInfo) jweKeyManagementParams.apu = ecdh.partyUInfo;
-	if (ecdh?.partyVInfo) jweKeyManagementParams.apv = ecdh.partyVInfo;
-	if (ecdh?.ephemeralKey) {
-		const { epk, epkPrivateKey } = parseEphemeralKey(ecdh.ephemeralKey);
-		jweKeyManagementParams.epk = epk;
-		jweKeyManagementParams.epkPrivateKey = epkPrivateKey;
-	}
-	const wrappingKeyMaterial = await importKey(key, alg);
-	const { cek: finalCek, encryptedKey: jweEncryptedKey, parameters: keyManagementHeaderParams } = await encryptKey(alg, enc, wrappingKeyMaterial, providedCek, jweKeyManagementParams);
-	const protectedHeader = _buildJWEHeader(alg, enc, key, userHeader, keyManagementHeaderParams, payload);
-	const plaintextBytes = getPlaintextBytes(computeJwtTimeClaims(payload, protectedHeader.typ, options.expiresIn, options.currentDate) || payload);
-	const protectedHeaderEncoded = base64UrlEncode(JSON.stringify(protectedHeader));
-	const aadBytes = textEncoder.encode(protectedHeaderEncoded);
-	const contentIVBytes = providedContentIV ?? generateIV(enc);
-	const { ciphertext: contentCiphertext, tag: contentAuthTag, iv: actualContentIV } = await encrypt$1(enc, plaintextBytes, finalCek, contentIVBytes, aadBytes);
-	if (!actualContentIV) throw new JWTError("Content encryption IV was not generated or returned.", "ERR_JWE_INVALID");
-	if (!contentAuthTag) throw new JWTError("Content encryption auth tag was not generated or returned.", "ERR_JWE_INVALID");
-	return [
-		protectedHeaderEncoded,
-		jweEncryptedKey ? base64UrlEncode(jweEncryptedKey) : "",
-		base64UrlEncode(actualContentIV),
-		base64UrlEncode(contentCiphertext),
-		base64UrlEncode(contentAuthTag)
-	].join(".");
-}
-async function decrypt(jwe, key, options = {}) {
-	const parts = jwe.split(".");
-	if (parts.length !== 5) throw new JWTError("Invalid JWE: Must contain five sections (RFC7516, section-3).", "ERR_JWE_INVALID");
-	const [protectedHeaderEncoded, encryptedKeyEncoded, ivEncoded, ciphertextEncoded, authTagEncoded] = parts;
+	if (typeof wireSig.signature !== "string") return fail(new JWTError(`Signature[${index}] is missing the "signature" field.`, "ERR_JWS_INVALID"));
 	let protectedHeader;
 	try {
-		const protectedHeaderJson = base64UrlDecode(protectedHeaderEncoded);
-		protectedHeader = sanitizeObject(JSON.parse(protectedHeaderJson));
-	} catch {
-		throw new JWTError("Invalid JWE: Protected header could not be decoded.", "ERR_JWE_INVALID");
+		protectedHeader = decodeProtectedHeader(wireSig.protected, "JWS");
+	} catch (err) {
+		return fail(_asJWTError(err, "ERR_JWS_INVALID"));
 	}
-	if (!protectedHeader || typeof protectedHeader !== "object" || !protectedHeader.alg || !protectedHeader.enc) throw new JWTError("Invalid JWE: Protected header must be an object with \"alg\" and \"enc\" properties.", "ERR_JWE_INVALID");
+	if (!protectedHeader.alg) return fail(new JWTError(`Invalid JWS: Signature[${index}] protected header must have an "alg" property.`, "ERR_JWS_INVALID"), protectedHeader);
+	const unprotectedHeader = sanitizeObjectCopy(wireSig.header);
+	try {
+		_assertDisjointHeaders(protectedHeader, unprotectedHeader);
+	} catch (err) {
+		return fail(_asJWTError(err, "ERR_JWS_INVALID"), protectedHeader, unprotectedHeader);
+	}
+	const effective = _mergeHeaders(protectedHeader, unprotectedHeader);
 	const alg = protectedHeader.alg;
-	const enc = protectedHeader.enc;
-	if (options?.algorithms && !options.algorithms.includes(alg)) throw new JWTError(`Key management algorithm not allowed: ${alg}`, "ERR_JWE_ALG_NOT_ALLOWED");
-	if (options?.encryptionAlgorithms && !options.encryptionAlgorithms.includes(enc)) throw new JWTError(`Content encryption algorithm not allowed: ${enc}`, "ERR_JWE_ALG_NOT_ALLOWED");
-	const rawKeyMaterial = typeof key === "function" ? await key(protectedHeader, jwe) : key;
-	const encryptedKeyBytes = base64UrlDecode(encryptedKeyEncoded, false);
-	const contentIVBytes = base64UrlDecode(ivEncoded, false);
-	const contentAuthTagBytes = base64UrlDecode(authTagEncoded, false);
-	const ciphertextBytes = base64UrlDecode(ciphertextEncoded, false);
-	const unwrapKeyOpts = {
-		enc,
-		format: enc.includes("GCM") ? "cryptokey" : "raw",
-		keyUsage: options?.keyUsage || ["decrypt"]
-	};
-	if (protectedHeader.iv) unwrapKeyOpts.iv = protectedHeader.iv;
-	if (protectedHeader.tag) unwrapKeyOpts.tag = protectedHeader.tag;
-	if (protectedHeader.p2s) unwrapKeyOpts.p2s = protectedHeader.p2s;
-	if (protectedHeader.p2c) unwrapKeyOpts.p2c = protectedHeader.p2c;
-	if (protectedHeader.epk) unwrapKeyOpts.epk = protectedHeader.epk;
-	if (protectedHeader.apu) unwrapKeyOpts.apu = protectedHeader.apu;
-	if (protectedHeader.apv) unwrapKeyOpts.apv = protectedHeader.apv;
-	if (options?.unwrappedKeyAlgorithm) unwrapKeyOpts.unwrappedKeyAlgorithm = options.unwrappedKeyAlgorithm;
-	if (options?.extractable) unwrapKeyOpts.extractable = options.extractable;
-	const aadBytes = textEncoder.encode(protectedHeaderEncoded);
-	let cek;
-	let plaintextBytes;
-	if (isJWKSet(rawKeyMaterial)) {
-		const candidates = getJWKsFromSet(rawKeyMaterial, _buildJWESetFilter(protectedHeader));
-		if (candidates.length === 0) throw new JWTError(`No key found in JWK Set${protectedHeader.kid ? ` with kid "${protectedHeader.kid}"` : ""}.`, "ERR_JWK_KEY_NOT_FOUND");
-		let decrypted = false;
-		for (const candidate of candidates) try {
-			const candidateCek = await unwrapKey(alg, encryptedKeyBytes, await importKey(candidate, alg), unwrapKeyOpts);
-			plaintextBytes = await decrypt$1(enc, candidateCek, ciphertextBytes, contentIVBytes, contentAuthTagBytes, aadBytes);
-			cek = candidateCek;
-			decrypted = true;
-			break;
-		} catch {}
-		if (!decrypted) throw new JWTError("JWE decryption failed.", "ERR_JWE_DECRYPTION_FAILED");
-	} else {
-		const unwrappingKey = await importKey(rawKeyMaterial, alg);
-		try {
-			cek = await unwrapKey(alg, encryptedKeyBytes, unwrappingKey, unwrapKeyOpts);
-			plaintextBytes = await decrypt$1(enc, cek, ciphertextBytes, contentIVBytes, contentAuthTagBytes, aadBytes);
-		} catch (error_) {
-			if (error_ instanceof JWTError) throw error_;
-			throw new JWTError("JWE decryption failed.", "ERR_JWE_DECRYPTION_FAILED", error_);
-		}
+	if (options.typ && protectedHeader.typ !== options.typ) return fail(new JWTError(`Invalid JWS: "typ" Header Parameter mismatch on signature[${index}]. Expected "${options.typ}", got "${protectedHeader.typ}".`, "ERR_JWS_INVALID"), protectedHeader, unprotectedHeader);
+	let rawKeyMaterial;
+	try {
+		rawKeyMaterial = await keyResolver(effective, wireSig.protected ?? "");
+	} catch (err) {
+		return fail(_asJWTError(err, "ERR_JWK_KEY_NOT_FOUND", `Key resolver failed for signature[${index}]`), protectedHeader, unprotectedHeader);
+	}
+	const algError = checkAlgAllowed(alg, rawKeyMaterial, options.algorithms, JWS_ALG_CTX);
+	if (algError) return fail(algError, protectedHeader, unprotectedHeader);
+	const signatureBytes = base64UrlDecode(wireSig.signature, { returnAs: "uint8array" });
+	const signingInputBytes = textEncoder.encode(`${wireSig.protected ?? ""}.${payload}`);
+	let verified;
+	try {
+		verified = await _verifyWithKey(alg, rawKeyMaterial, signatureBytes, signingInputBytes, effective.kid);
+	} catch (err) {
+		return fail(_asJWTError(err, "ERR_JWS_SIGNATURE_INVALID"), protectedHeader, unprotectedHeader);
 	}
-	const payload = decodePayloadFromBytes(plaintextBytes, protectedHeader, options?.forceUint8Array);
-	if (protectedHeader.crit || options?.recognizedHeaders?.length) validateCriticalHeadersJWE(protectedHeader, options?.recognizedHeaders);
-	if (payload && typeof payload === "object" && options.validateClaims !== false && (options.validateClaims === true || protectedHeader.typ?.toLowerCase().includes("jwt")) && !options.forceUint8Array && !(payload instanceof Uint8Array)) validateJwtClaims(payload, options);
-	const result = {
-		payload,
-		protectedHeader
-	};
-	if (options.returnCek) {
-		result.cek = isCryptoKey(cek) ? new Uint8Array(await crypto.subtle.exportKey("raw", cek)) : cek;
-		result.aad = aadBytes;
+	if (!verified) return fail(new JWTError(`JWS signature[${index}] verification failed.`, "ERR_JWS_SIGNATURE_INVALID"), protectedHeader, unprotectedHeader);
+	let decodedPayload;
+	try {
+		decodedPayload = decodeJWSPayload(payload, protectedHeader.b64 !== false, options.forceUint8Array);
+	} catch (err) {
+		return fail(_asJWTError(err, "ERR_JWS_INVALID"), protectedHeader, unprotectedHeader);
 	}
-	return result;
-}
-function parseEphemeralKey(ephemeralKey) {
-	let epk;
-	let epkPrivateKey;
-	if (isCryptoKeyPair(ephemeralKey)) {
-		epk = ephemeralKey.publicKey;
-		epkPrivateKey = ephemeralKey.privateKey;
-	} else if (typeof ephemeralKey === "object" && ephemeralKey !== null && "publicKey" in ephemeralKey && "privateKey" in ephemeralKey) {
-		const candidate = ephemeralKey;
-		if (!candidate.publicKey || !candidate.privateKey) throw new TypeError("ECDH-ES custom ephemeral key must include both publicKey and privateKey.");
-		epk = candidate.publicKey;
-		epkPrivateKey = candidate.privateKey;
-	} else if (isCryptoKey(ephemeralKey)) {
-		if (ephemeralKey.type !== "private") throw new TypeError("ECDH-ES custom ephemeral CryptoKey must include private key material.");
-		epk = ephemeralKey;
-		epkPrivateKey = ephemeralKey;
-	} else if (isJWK(ephemeralKey)) {
-		if (!("d" in ephemeralKey) || typeof ephemeralKey.d !== "string") throw new TypeError("ECDH-ES custom ephemeral JWK must include private parameter \"d\".");
-		epk = ephemeralKey;
-		epkPrivateKey = ephemeralKey;
-	} else throw new TypeError("Unsupported ECDH-ES ephemeral key material provided in options.");
-	return {
-		epk,
-		epkPrivateKey
+	try {
+		validateCriticalHeadersJWS(protectedHeader, options.recognizedHeaders);
+		validateJwtClaimsIfJsonPayload(decodedPayload, options);
+	} catch (err) {
+		return fail(_asJWTError(err, "ERR_JWT_CLAIM_INVALID"), protectedHeader, unprotectedHeader);
+	}
+	const outcome = {
+		signerIndex: index,
+		verified: true,
+		payload: decodedPayload,
+		protectedHeader
 	};
+	if (unprotectedHeader) outcome.signerHeader = unprotectedHeader;
+	return outcome;
 }
-function _buildJWESetFilter(header) {
-	const { kid, alg } = header;
-	return (k) => (!kid || k.kid === kid) && (!k.alg || k.alg === alg);
+function _asJWTError(err, fallbackCode, fallbackMessage) {
+	if (err instanceof JWTError) return err;
+	return new JWTError(fallbackMessage ?? (err instanceof Error ? err.message : typeof err === "string" ? err : "Unknown error"), fallbackCode, err);
 }
-function _buildJWEHeader(alg, enc, key, userHeader, keyManagementParams, payload) {
-	const safeHeader = sanitizeObject(userHeader);
-	return applyTypCtyDefaults({
-		...isJWK(key) && key.kid ? { kid: key.kid } : {},
-		...safeHeader,
-		...keyManagementParams,
-		alg,
-		enc
-	}, payload);
-}
-//#endregion
-//#region src/core/jws.ts
 async function sign(payload, key, options = {}) {
 	const { protectedHeader: userHeader } = options;
 	let { alg } = options;
 	if (!alg) if (isJWK(key) && key.alg) alg = key.alg;
-	else throw new TypeError("JWS \"alg\" (Algorithm) must be provided in options");
+	else throw new JWTError("JWS \"alg\" (Algorithm) must be provided in options", "ERR_JWS_ALG_MISSING");
 	if (alg === "none") throw new JWTError("\"none\" is not a valid signing algorithm", "ERR_JWS_ALG_NOT_ALLOWED");
-	const signingKey = await _resolveSigningKey(alg, await importKey(key, alg), "sign");
+	const signingKey = await resolveSigningKey(alg, await importKey(key, {
+		alg,
+		expect: "private"
+	}), "sign");
 	const protectedHeader = _buildJWSHeader(alg, key, userHeader, payload);
-	const computedPayload = computeJwtTimeClaims(payload, protectedHeader.typ, options.expiresIn, options.currentDate);
+	const computedPayload = computeJwtTimeClaims(payload, options);
 	const protectedHeaderEncoded = base64UrlEncode(JSON.stringify(protectedHeader));
 	let payloadBytes;
 	if (payload instanceof Uint8Array) payloadBytes = payload;
@@ -2037,80 +292,58 @@ async function verify(jws, key, options = {}) {
 	const parts = jws.split(".");
 	if (parts.length !== 3) throw new JWTError("Invalid JWS: Must contain three parts separated by dots.", "ERR_JWS_INVALID");
 	const [protectedHeaderEncoded, payloadEncoded, signatureEncoded] = parts;
-	let protectedHeader;
-	try {
-		const protectedHeaderString = base64UrlDecode(protectedHeaderEncoded);
-		protectedHeader = sanitizeObject(JSON.parse(protectedHeaderString));
-	} catch {
-		throw new JWTError("Invalid JWS: Protected header could not be decoded.", "ERR_JWS_INVALID");
-	}
-	if (!protectedHeader || typeof protectedHeader !== "object" || !protectedHeader.alg) throw new JWTError("Invalid JWS: Protected header must be an object with an \"alg\" property.", "ERR_JWS_INVALID");
+	const protectedHeader = decodeProtectedHeader(protectedHeaderEncoded, "JWS");
+	if (!protectedHeader.alg) throw new JWTError("Invalid JWS: Protected header must be an object with an \"alg\" property.", "ERR_JWS_INVALID");
 	const alg = protectedHeader.alg;
-	if (options.algorithms && !options.algorithms.includes(alg)) throw new JWTError(`Algorithm not allowed: ${alg}`, "ERR_JWS_ALG_NOT_ALLOWED");
 	if (options.typ && protectedHeader.typ !== options.typ) throw new JWTError(`Invalid JWS: "typ" (Type) Header Parameter mismatch. Expected "${options.typ}", got "${protectedHeader.typ}".`, "ERR_JWS_INVALID");
 	let signatureBytes;
 	try {
-		signatureBytes = base64UrlDecode(signatureEncoded, false);
+		signatureBytes = base64UrlDecode(signatureEncoded, { returnAs: "uint8array" });
 	} catch {
 		throw new JWTError("Invalid JWS: Signature could not be decoded.", "ERR_JWS_INVALID");
 	}
 	const keyInput = typeof key === "function" ? await key(protectedHeader, jws) : key;
+	const algError = checkAlgAllowed(alg, keyInput, options.algorithms, JWS_ALG_CTX);
+	if (algError) throw algError;
 	const signingInputBytes = textEncoder.encode(`${protectedHeaderEncoded}.${payloadEncoded}`);
 	if (isJWKSet(keyInput)) {
-		const candidates = getJWKsFromSet(keyInput, _buildJWSSetFilter(protectedHeader));
+		const candidates = getJWKsFromSet(keyInput, buildJWKSetFilter(protectedHeader));
 		if (candidates.length === 0) throw new JWTError(`No key found in JWK Set${protectedHeader.kid ? ` with kid "${protectedHeader.kid}"` : ""}.`, "ERR_JWK_KEY_NOT_FOUND");
 		let verified = false;
-		for (const candidate of candidates) try {
-			if (await verify$1(alg, await _resolveSigningKey(alg, await importKey(candidate, alg), "verify"), signatureBytes, signingInputBytes)) {
-				verified = true;
-				break;
-			}
-		} catch {}
+		for (const candidate of candidates) if (await verify$1(alg, await resolveSigningKey(alg, await importKey(candidate, {
+			alg,
+			expect: "public"
+		}), "verify"), signatureBytes, signingInputBytes)) {
+			verified = true;
+			break;
+		}
 		if (!verified) throw new JWTError("JWS signature verification failed.", "ERR_JWS_SIGNATURE_INVALID");
-	} else if (!await verify$1(alg, await _resolveSigningKey(alg, await importKey(keyInput, alg), "verify"), signatureBytes, signingInputBytes)) throw new JWTError("JWS signature verification failed.", "ERR_JWS_SIGNATURE_INVALID");
+	} else if (!await verify$1(alg, await resolveSigningKey(alg, await importKey(keyInput, {
+		alg,
+		expect: "public"
+	}), "verify"), signatureBytes, signingInputBytes)) throw new JWTError("JWS signature verification failed.", "ERR_JWS_SIGNATURE_INVALID");
 	const useB64 = protectedHeader.b64 !== false;
 	let payload;
 	try {
-		payload = useB64 ? decodePayloadFromB64UrlSegment(payloadEncoded, protectedHeader, options.forceUint8Array) : options.forceUint8Array ? textEncoder.encode(payloadEncoded) : payloadEncoded;
+		payload = decodeJWSPayload(payloadEncoded, useB64, options.forceUint8Array);
 	} catch (error_) {
 		throw new JWTError(`Invalid JWS: Payload decoding failed (${error_ instanceof Error ? error_.message : error_})`, "ERR_JWS_INVALID");
 	}
 	validateCriticalHeadersJWS(protectedHeader, options.recognizedHeaders);
-	if (payload && typeof payload === "object" && options.validateClaims !== false && (options.validateClaims === true || protectedHeader.typ?.toLowerCase().includes("jwt")) && !options.forceUint8Array && !(payload instanceof Uint8Array)) validateJwtClaims(payload, options);
+	validateJwtClaimsIfJsonPayload(payload, options);
 	return {
 		payload,
 		protectedHeader
 	};
 }
-async function _resolveSigningKey(alg, key, usage) {
-	if (key instanceof Uint8Array) {
-		const minBytes = Number.parseInt(alg.slice(2), 10) / 8;
-		if (key.length < minBytes) throw new JWTError(`${alg} requires a key of at least ${minBytes} bytes`, "ERR_JWK_INVALID");
-		return crypto.subtle.importKey("raw", key, {
-			name: "HMAC",
-			hash: `SHA-${alg.slice(-3)}`
-		}, false, [usage]);
-	}
-	if (alg.startsWith("RS") || alg.startsWith("PS")) {
-		const { modulusLength } = key.algorithm;
-		if (typeof modulusLength !== "number" || modulusLength < 2048) throw new JWTError(`${alg} requires a key modulusLength of at least 2048 bits`, "ERR_JWK_INVALID");
-	}
-	return key;
-}
-function _buildJWSSetFilter(header) {
-	const { kid, alg } = header;
-	return (k) => (!kid || k.kid === kid) && (!k.alg || k.alg === alg);
-}
 function _buildJWSHeader(alg, key, userHeader, payload) {
-	const safeHeader = sanitizeObject(userHeader);
-	const header = {
-		...isJWK(key) && key.kid ? { kid: key.kid } : {},
-		...safeHeader,
-		alg
-	};
+	const safeHeader = sanitizeObjectCopy(userHeader);
+	const header = {};
+	if (isJWK(key) && key.kid) header.kid = key.kid;
+	if (safeHeader) Object.assign(header, safeHeader);
+	header.alg = alg;
 	applyTypCtyDefaults(header, payload);
 	if (header.b64 === true) delete header.b64;
 	return header;
 }
-//#endregion
-export { deriveJWKFromPassword as a, importFromPEM as c, isSymmetricJWK as d, computeExpiresInSeconds as f, encrypt as i, isPrivateJWK as l, isJWTError as m, verify as n, exportToPEM as o, JWTError as p, decrypt as r, generateJWK as s, sign as t, isPublicJWK as u };
+export { verifyMulti as a, signMulti as i, verify as n, verifyMultiAll as o, generalToFlattenedJWS as r, sign as t };