unjwt 0.8.3 → 0.8.5

package/dist/_chunks/jws.mjs

@@ -1,9 +1,94 @@
-import { sanitizeObjectCopy, textEncoder } from "./libs/unsecure.mjs";
-import { JWTError, applyTypDefault, base64UrlStringify, computeJwtTimeClaims, getPlaintextBytes, isJWK, isJWKSet, parsePayloadText, validateCriticalHeadersJWS } from "./_jwt-internal.mjs";
-import { inferJWSAllowedAlgorithms } from "./digest.mjs";
-import { JWS_ALG_CTX, applyB64Header, asJWTError, asKeyLookupError, asKeyUsageError, assertB64Option, assertCompactToken, assertConsumerOptions, assertEntryLimit, assertJWKSetCandidates, assertJWSAlgSupported, assertNotStringKey, assertOptionEntry, assertProducerConfirmation, assertProducerCrit, assertProducerKeyHeaders, assertProtectedOnlyOption, assertSerializationObject, buildJWKSetFilter, checkAlgAllowed, checkJWSAlgSupported, checkJWSB64, checkProtectedTyp, checkSerializationEntry, decodeJWSPayload, decodeProtectedHeader, decodeSegment, getJWKsFromSet, importKey, keyMatchesHeader, resolveKeyInput, resolveLimit, resolvePayloadMode, resolveSigningKey, serializeProtectedHeader, sign as sign$1, stringKeyError, validateClaimsIfJson, verify as verify$1 } from "./jwk.mjs";
+import { textEncoder } from "./libs/unsecure.mjs";
+import { JWTError } from "../error.mjs";
+import { applyTypDefault, base64UrlStringify, computeJwtTimeClaims, getPlaintextBytes, isJWK, isJWKSet, parsePayloadBytes, parsePayloadSegment, parsePayloadText, validateCriticalHeadersJWS } from "./jwt.mjs";
+import { JWS_ALG_CTX, asJWTError, asKeyLookupError, assertCompactToken, assertConsumerOptions, assertEntryLimit, assertJWKSetCandidates, assertOctKeyLength, assertOptionEntry, assertProducerConfirmation, assertProducerCrit, assertProducerKeyHeaders, assertProtectedOnlyOption, assertSerializationObject, buildJWKSetFilter, checkAlgAllowed, checkAlgSupported, checkProtectedTyp, checkSerializationEntry, copyJsonObject, decodeProtectedHeader, decodeSegment, getJWKsFromSet, importKey, keyMatchesHeader, resolveKeyInput, resolveLimit, serializeProtectedHeader, sign as sign$1, stringKeyError, verify as verify$1 } from "./algorithms.mjs";
+import { inferJWSAllowedAlgorithms, isJWSAlgorithm, jwsHashOf, modulusLengthOf } from "./digest.mjs";
+import { resolvePayloadMode, validateClaimsIfJson } from "./payload.mjs";
+async function resolveSigningKey(alg, key, usage) {
+	if (key instanceof Uint8Array) {
+		if (alg !== "HS256" && alg !== "HS384" && alg !== "HS512") throw new JWTError(`${alg} needs an asymmetric key, not raw bytes.`, "ERR_JWK_INVALID");
+		assertOctKeyLength(key, alg);
+		return crypto.subtle.importKey("raw", key, {
+			name: "HMAC",
+			hash: jwsHashOf(alg)
+		}, false, [usage]);
+	}
+	if (RSA_SIGNATURE_ALGORITHMS.has(alg)) {
+		const modulusLength = modulusLengthOf(key.algorithm);
+		if (typeof modulusLength !== "number" || modulusLength < 2048) throw new JWTError(`${alg} requires a key modulusLength of at least 2048 bits`, "ERR_JWK_INVALID");
+	}
+	return key;
+}
+function assertNotStringKey(key) {
+	if (typeof key === "string") throw stringKeyError();
+}
+function asKeyUsageError(error, alg) {
+	return asJWTError(error, {
+		code: "ERR_JWK_INVALID",
+		message: `Key is not usable for ${alg}.`
+	});
+}
+const RSA_SIGNATURE_ALGORITHMS = /* @__PURE__ */ new Set([
+	"RS256",
+	"RS384",
+	"RS512",
+	"PS256",
+	"PS384",
+	"PS512"
+]);
+function assertJWSAlgSupported(alg) {
+	const error = checkJWSAlgSupported(alg);
+	if (error) throw error;
+}
+function checkJWSAlgSupported(alg) {
+	return checkAlgSupported(alg, {
+		supported: isJWSAlgorithm,
+		code: "ERR_JWS_ALG_NOT_ALLOWED",
+		label: "Algorithm",
+		role: "signing algorithm"
+	});
+}
+function checkJWSB64(header) {
+	if (Object.hasOwn(header, "b64") && typeof header.b64 !== "boolean") return new JWTError("Invalid JWS: \"b64\" must be a boolean.", "ERR_JWS_INVALID");
+	if (header.b64 !== false) return void 0;
+	if (Array.isArray(header.crit) && header.crit.includes("b64")) return void 0;
+	return new JWTError("Invalid JWS: \"b64\" must be listed in \"crit\".", "ERR_JWS_INVALID");
+}
+function assertB64Option(header) {
+	if (!header || !Object.hasOwn(header, "b64") || typeof header.b64 === "boolean") return;
+	throw new JWTError("\"b64\" must be a boolean.", "ERR_INVALID_OPTION");
+}
+function applyB64Header(header) {
+	assertB64Option(header);
+	if (header.b64 === true) {
+		if (!(Array.isArray(header.crit) && header.crit.includes("b64"))) delete header.b64;
+		return;
+	}
+	if (header.b64 !== false) return;
+	const crit = header.crit;
+	if (crit === void 0) header.crit = ["b64"];
+	else if (Array.isArray(crit) && !crit.includes("b64")) header.crit = [...crit, "b64"];
+}
+function decodeJWSPayload(payloadSegment, useB64, mode) {
+	if (!useB64) return mode === "string" ? payloadSegment : parsePayloadBytes(textEncoder.encode(payloadSegment), {
+		payload: mode,
+		family: "JWS"
+	});
+	try {
+		return parsePayloadSegment(payloadSegment, {
+			payload: mode,
+			family: "JWS"
+		});
+	} catch (error) {
+		if (error instanceof JWTError) throw error;
+		throw new JWTError("Invalid JWS: Payload could not be decoded.", "ERR_JWS_INVALID", error);
+	}
+}
 function buildJWSProtectedHeader(alg, key, userHeader, options) {
-	const safeHeader = sanitizeObjectCopy(userHeader);
+	const safeHeader = copyJsonObject(userHeader, {
+		code: "ERR_INVALID_OPTION",
+		message: "\"protectedHeader\" must hold only JSON values."
+	});
 	const header = {};
 	if (isJWK(key) && key.kid) header.kid = key.kid;
 	if (safeHeader) Object.assign(header, safeHeader);
@@ -54,189 +139,6 @@ async function verifyWithKeyMaterial(alg, rawKeyMaterial, options) {
 	}), "verify");
 	return verify$1(alg, verificationKey, signature, signingInput);
 }
-async function signMulti(payload, signers, options = {}) {
-	if (!Array.isArray(signers) || signers.length === 0) throw new JWTError("signMulti requires at least one signer.", "ERR_JWS_INVALID");
-	for (const [index, signer] of signers.entries()) {
-		assertOptionEntry(signer, {
-			label: `signers[${index}]`,
-			objects: ["protectedHeader", "unprotectedHeader"]
-		});
-		assertNotStringKey(signer.key);
-		assertProtectedOnlyOption(signer.unprotectedHeader, {
-			tier: "unprotected",
-			family: "JWS"
-		});
-		assertProducerKeyHeaders(signer.protectedHeader, {
-			tier: "protected",
-			family: "JWS"
-		});
-		assertProducerKeyHeaders(signer.unprotectedHeader, {
-			tier: "unprotected",
-			family: "JWS"
-		});
-		assertB64Option(signer.protectedHeader);
-	}
-	assertProducerConfirmation(payload);
-	const resolvedAlgs = signers.map((s, i) => _resolveSignerAlg(s, i));
-	const b64 = _resolveB64(signers);
-	const computedPayload = computeJwtTimeClaims(payload, options);
-	const payloadBytes = getPlaintextBytes(computedPayload || payload);
-	const payloadEncoded = b64 ? base64UrlStringify(payloadBytes) : parsePayloadText(payloadBytes);
-	const wireSignatures = [];
-	for (let i = 0; i < signers.length; i++) {
-		const signer = signers[i];
-		const alg = resolvedAlgs[i];
-		const protectedHeader = buildJWSProtectedHeader(alg, signer.key, signer.protectedHeader, {
-			payload,
-			b64
-		});
-		const unprotectedHeader = sanitizeObjectCopy(signer.unprotectedHeader);
-		_assertDisjointHeaders(protectedHeader, unprotectedHeader);
-		const protectedHeaderEncoded = base64UrlStringify(serializeProtectedHeader(protectedHeader));
-		const signingInputBytes = textEncoder.encode(`${protectedHeaderEncoded}.${payloadEncoded}`);
-		let signatureBytes;
-		try {
-			const signingKey = await resolveSigningKey(alg, await importKey(signer.key, {
-				alg,
-				expect: "private"
-			}), "sign");
-			signatureBytes = await sign$1(alg, signingKey, signingInputBytes);
-		} catch (error) {
-			throw asKeyUsageError(error, alg);
-		}
-		const wireSig = {
-			protected: protectedHeaderEncoded,
-			signature: base64UrlStringify(signatureBytes)
-		};
-		if (unprotectedHeader && Object.keys(unprotectedHeader).length > 0) wireSig.header = unprotectedHeader;
-		wireSignatures.push(wireSig);
-	}
-	return {
-		payload: payloadEncoded,
-		signatures: wireSignatures
-	};
-}
-async function verifyMulti(jws, keyOrLookup, options = {}) {
-	assertConsumerOptions(options);
-	const payloadMode = resolvePayloadMode(options);
-	const signatureLimit = resolveLimit(options.limits, "signatures");
-	const keyCandidates = resolveLimit(options.limits, "keyCandidates");
-	const general = _readGeneralSerialization(jws, signatureLimit);
-	let lastError;
-	let cryptoAttempted = false;
-	for (let i = 0; i < general.signatures.length; i++) {
-		const read = _readSignatureHeaders(general.signatures[i], i);
-		if (read.error) {
-			lastError = read.error;
-			continue;
-		}
-		const { wireSig, protectedHeader, unprotectedHeader, effective, alg } = read;
-		const typError = checkProtectedTyp(options.typ, protectedHeader, {
-			family: "JWS",
-			label: `signature[${i}]`
-		});
-		if (typError) {
-			lastError = typError;
-			continue;
-		}
-		let rawKeyMaterial;
-		try {
-			rawKeyMaterial = await resolveKeyInput(keyOrLookup, {
-				header: effective,
-				token: wireSig.protected ?? "",
-				what: `signature[${i}]`
-			});
-		} catch (err) {
-			lastError = asKeyLookupError(err, `signature[${i}]`);
-			continue;
-		}
-		if (typeof rawKeyMaterial === "string") {
-			lastError = stringKeyError();
-			continue;
-		}
-		const algError = checkAlgAllowed(alg, rawKeyMaterial, {
-			ctx: JWS_ALG_CTX,
-			algorithms: options.algorithms,
-			allowSymmetric: options.allowSymmetricJWKSet
-		});
-		if (algError) {
-			lastError = algError;
-			continue;
-		}
-		if (options.strictSignerMatch && !keyMatchesHeader(effective, rawKeyMaterial, {
-			ctx: JWS_ALG_CTX,
-			allowSymmetric: options.allowSymmetricJWKSet
-		})) continue;
-		let signatureBytes;
-		try {
-			signatureBytes = decodeSegment(wireSig.signature, {
-				family: "JWS",
-				what: "Signature"
-			});
-		} catch (err) {
-			lastError = asJWTError(err, INVALID_JWS);
-			continue;
-		}
-		const signingInputBytes = textEncoder.encode(`${wireSig.protected ?? ""}.${general.payload}`);
-		cryptoAttempted = true;
-		try {
-			if (!await verifyWithKey(alg, rawKeyMaterial, {
-				signature: signatureBytes,
-				signingInput: signingInputBytes,
-				kid: effective.kid,
-				allowSymmetric: options.allowSymmetricJWKSet,
-				keyCandidates
-			})) {
-				lastError = new JWTError("JWS signature verification failed.", "ERR_JWS_SIGNATURE_INVALID");
-				continue;
-			}
-			validateCriticalHeadersJWS(protectedHeader, options.recognizedHeaders);
-			const useB64 = protectedHeader.b64 !== false;
-			const payload = decodeJWSPayload(general.payload, useB64, payloadMode);
-			validateClaimsIfJson(payload, payloadMode, options);
-			const result = {
-				payload,
-				protectedHeader,
-				signerIndex: i
-			};
-			if (unprotectedHeader) result.signerHeader = unprotectedHeader;
-			return result;
-		} catch (err) {
-			const error = asJWTError(err, INVALID_SIGNATURE);
-			if (!PER_SIGNATURE_ERROR_CODES.has(error.code)) throw error;
-			lastError = error;
-		}
-	}
-	if (options.strictSignerMatch && !cryptoAttempted) throw new JWTError("No signature matched the provided key under strictSignerMatch.", "ERR_JWS_NO_MATCHING_SIGNER");
-	throw lastError ?? new JWTError("JWS signature verification failed.", "ERR_JWS_SIGNATURE_INVALID");
-}
-async function verifyMultiAll(jws, keyResolver, options = {}) {
-	assertConsumerOptions(options);
-	const payloadMode = resolvePayloadMode(options);
-	const signatureLimit = resolveLimit(options.limits, "signatures");
-	const keyCandidates = resolveLimit(options.limits, "keyCandidates");
-	const general = _readGeneralSerialization(jws, signatureLimit);
-	const outcomes = [];
-	for (let i = 0; i < general.signatures.length; i++) outcomes.push(await _verifyOneSignature(general.payload, general.signatures[i], i, keyResolver, {
-		options,
-		payloadMode,
-		keyCandidates
-	}));
-	return outcomes;
-}
-function generalToFlattenedJWS(jws) {
-	assertSerializationObject(jws, "JWS");
-	if (!Array.isArray(jws.signatures)) throw new JWTError("Invalid JWS JSON Serialization: missing \"signatures\".", "ERR_JWS_INVALID_SERIALIZATION");
-	if (jws.signatures.length !== 1) throw new JWTError(`Flattened JWS Serialization requires exactly one signature, got ${jws.signatures.length}.`, "ERR_JWS_INVALID_SERIALIZATION");
-	const [signature] = jws.signatures;
-	const flattened = {
-		payload: jws.payload,
-		signature: signature.signature
-	};
-	if (signature.protected !== void 0) flattened.protected = signature.protected;
-	if (signature.header !== void 0) flattened.header = signature.header;
-	return flattened;
-}
 const INVALID_JWS = {
 	code: "ERR_JWS_INVALID",
 	message: "Invalid JWS."
@@ -256,8 +158,8 @@ const PER_SIGNATURE_ERROR_CODES = /* @__PURE__ */ new Set([
 ]);
 function _checkUnprotectedHeader(header) {
 	if (!header) return void 0;
-	if (Object.hasOwn(header, "crit")) return new JWTError("Invalid JWS: \"crit\" must be integrity protected (RFC 7515 §4.1.11).", "ERR_JWS_INVALID");
-	if (Object.hasOwn(header, "b64")) return new JWTError("Invalid JWS: \"b64\" must occur only within the protected header (RFC 7797 §3).", "ERR_JWS_INVALID");
+	if (Object.hasOwn(header, "crit")) return new JWTError("Invalid JWS: \"crit\" must be integrity protected.", "ERR_JWS_INVALID");
+	if (Object.hasOwn(header, "b64")) return new JWTError("Invalid JWS: \"b64\" must be in the protected header.", "ERR_JWS_INVALID");
 }
 function _readSignatureHeaders(entry, index) {
 	const shapeError = checkSerializationEntry(entry, {
@@ -270,12 +172,13 @@ function _readSignatureHeaders(entry, index) {
 	const wireSig = entry;
 	if (typeof wireSig.signature !== "string") return { error: new JWTError(`Signature[${index}] is missing the "signature" field.`, "ERR_JWS_INVALID") };
 	let protectedHeader;
+	let unprotectedHeader;
 	try {
 		protectedHeader = decodeProtectedHeader(wireSig.protected, "JWS");
+		unprotectedHeader = copyJsonObject(wireSig.header, INVALID_JWS);
 	} catch (err) {
 		return { error: asJWTError(err, INVALID_JWS) };
 	}
-	const unprotectedHeader = sanitizeObjectCopy(wireSig.header);
 	const failed = (error) => ({
 		error,
 		protectedHeader,
@@ -290,7 +193,7 @@ function _readSignatureHeaders(entry, index) {
 	}
 	const effective = _mergeHeaders(protectedHeader, unprotectedHeader);
 	const alg = effective.alg;
-	if (!alg) return failed(new JWTError(`Invalid JWS: Signature[${index}] has no "alg" in its protected or unprotected header.`, "ERR_JWS_INVALID"));
+	if (!alg) return failed(new JWTError(`Invalid JWS: Signature[${index}] has no "alg" in its headers.`, "ERR_JWS_INVALID"));
 	const algError = checkJWSAlgSupported(alg) ?? checkJWSB64(protectedHeader);
 	if (algError) return failed(algError);
 	return {
@@ -323,13 +226,13 @@ function _resolveB64(signers) {
 		const raw = signers[i].protectedHeader?.b64;
 		if (raw === void 0) continue;
 		if (decided === void 0) decided = raw;
-		else if (decided !== raw) throw new JWTError(`Inconsistent "b64" across signers (RFC 7797 §3 requires all signers use the same b64 value).`, "ERR_JWS_B64_INCONSISTENT");
+		else if (decided !== raw) throw new JWTError("Inconsistent \"b64\" across signers.", "ERR_JWS_B64_INCONSISTENT");
 	}
 	return decided ?? true;
 }
 function _assertDisjointHeaders(protectedHeader, unprotectedHeader) {
 	if (!protectedHeader || !unprotectedHeader) return;
-	for (const k of Object.keys(unprotectedHeader)) if (k in protectedHeader) throw new JWTError(`JWS header parameter "${k}" appears in both protected and unprotected headers of a signature; they must be disjoint (RFC 7515 §7.2.1).`, "ERR_JWS_HEADER_PARAMS_NOT_DISJOINT");
+	for (const k of Object.keys(unprotectedHeader)) if (k in protectedHeader) throw new JWTError(`Invalid JWS: header parameter "${k}" is set in more than one header.`, "ERR_JWS_HEADER_PARAMS_NOT_DISJOINT");
 }
 function _mergeHeaders(protectedHeader, unprotectedHeader) {
 	if (!unprotectedHeader) return protectedHeader;
@@ -350,7 +253,7 @@ function _readGeneralSerialization(input, signatureLimit) {
 function _normalizeSerialization(input) {
 	assertSerializationObject(input, "JWS");
 	if ("signatures" in input && Array.isArray(input.signatures)) {
-		if ("signature" in input || "protected" in input) throw new JWTError("Invalid JWS JSON Serialization: \"signatures\" must not be combined with a top-level \"signature\" or \"protected\".", "ERR_JWS_INVALID_SERIALIZATION");
+		if ("signature" in input || "protected" in input) throw new JWTError("Invalid JWS JSON Serialization: \"signatures\" excludes top-level \"signature\" and \"protected\".", "ERR_JWS_INVALID_SERIALIZATION");
 		return input;
 	}
 	if ("signature" in input) {
@@ -363,7 +266,7 @@ function _normalizeSerialization(input) {
 			signatures: [signature]
 		};
 	}
-	throw new JWTError("Invalid JWS JSON Serialization: missing both signatures[] and flattened signature.", "ERR_JWS_INVALID_SERIALIZATION");
+	throw new JWTError("Invalid JWS JSON Serialization: missing \"signatures\" or \"signature\".", "ERR_JWS_INVALID_SERIALIZATION");
 }
 async function _verifyOneSignature(payload, entry, index, keyResolver, context) {
 	const { options, payloadMode, keyCandidates } = context;
@@ -432,8 +335,7 @@ async function _verifyOneSignature(payload, entry, index, keyResolver, context)
 	}
 	let decodedPayload;
 	try {
-		const useB64 = protectedHeader.b64 !== false;
-		decodedPayload = decodeJWSPayload(payload, useB64, payloadMode);
+		decodedPayload = decodeJWSPayload(payload, protectedHeader.b64 !== false, payloadMode);
 	} catch (err) {
 		return fail(asJWTError(err, INVALID_JWS), protectedHeader, unprotectedHeader);
 	}
@@ -451,6 +353,192 @@ async function _verifyOneSignature(payload, entry, index, keyResolver, context)
 	if (unprotectedHeader) outcome.signerHeader = unprotectedHeader;
 	return outcome;
 }
+async function signMulti(payload, signers, options = {}) {
+	if (!Array.isArray(signers) || signers.length === 0) throw new JWTError("signMulti requires at least one signer.", "ERR_JWS_INVALID");
+	for (const [index, signer] of signers.entries()) {
+		assertOptionEntry(signer, {
+			label: `signers[${index}]`,
+			objects: ["protectedHeader", "unprotectedHeader"]
+		});
+		assertNotStringKey(signer.key);
+		assertProtectedOnlyOption(signer.unprotectedHeader, {
+			tier: "unprotected",
+			family: "JWS"
+		});
+		assertProducerKeyHeaders(signer.protectedHeader, {
+			tier: "protected",
+			family: "JWS"
+		});
+		assertProducerKeyHeaders(signer.unprotectedHeader, {
+			tier: "unprotected",
+			family: "JWS"
+		});
+		assertB64Option(signer.protectedHeader);
+	}
+	assertProducerConfirmation(payload);
+	const resolvedAlgs = signers.map((s, i) => _resolveSignerAlg(s, i));
+	const b64 = _resolveB64(signers);
+	const computedPayload = computeJwtTimeClaims(payload, options);
+	const payloadBytes = getPlaintextBytes(computedPayload || payload);
+	const payloadEncoded = b64 ? base64UrlStringify(payloadBytes) : parsePayloadText(payloadBytes);
+	const wireSignatures = [];
+	for (let i = 0; i < signers.length; i++) {
+		const signer = signers[i];
+		const alg = resolvedAlgs[i];
+		const protectedHeader = buildJWSProtectedHeader(alg, signer.key, signer.protectedHeader, {
+			payload,
+			b64
+		});
+		const unprotectedHeader = copyJsonObject(signer.unprotectedHeader, {
+			code: "ERR_INVALID_OPTION",
+			message: "\"unprotectedHeader\" must hold only JSON values."
+		});
+		_assertDisjointHeaders(protectedHeader, unprotectedHeader);
+		const protectedHeaderEncoded = base64UrlStringify(serializeProtectedHeader(protectedHeader));
+		const signingInputBytes = textEncoder.encode(`${protectedHeaderEncoded}.${payloadEncoded}`);
+		let signatureBytes;
+		try {
+			const signingKey = await resolveSigningKey(alg, await importKey(signer.key, {
+				alg,
+				expect: "private"
+			}), "sign");
+			signatureBytes = await sign$1(alg, signingKey, signingInputBytes);
+		} catch (error) {
+			throw asKeyUsageError(error, alg);
+		}
+		const wireSig = {
+			protected: protectedHeaderEncoded,
+			signature: base64UrlStringify(signatureBytes)
+		};
+		if (unprotectedHeader && Object.keys(unprotectedHeader).length > 0) wireSig.header = unprotectedHeader;
+		wireSignatures.push(wireSig);
+	}
+	return {
+		payload: payloadEncoded,
+		signatures: wireSignatures
+	};
+}
+async function verifyMulti(jws, keyOrLookup, options = {}) {
+	assertConsumerOptions(options);
+	const payloadMode = resolvePayloadMode(options);
+	const signatureLimit = resolveLimit(options.limits, "signatures");
+	const keyCandidates = resolveLimit(options.limits, "keyCandidates");
+	const general = _readGeneralSerialization(jws, signatureLimit);
+	let lastError;
+	let cryptoAttempted = false;
+	for (let i = 0; i < general.signatures.length; i++) {
+		const read = _readSignatureHeaders(general.signatures[i], i);
+		if (read.error) {
+			lastError = read.error;
+			continue;
+		}
+		const { wireSig, protectedHeader, unprotectedHeader, effective, alg } = read;
+		const typError = checkProtectedTyp(options.typ, protectedHeader, {
+			family: "JWS",
+			label: `signature[${i}]`
+		});
+		if (typError) {
+			lastError = typError;
+			continue;
+		}
+		let rawKeyMaterial;
+		try {
+			rawKeyMaterial = await resolveKeyInput(keyOrLookup, {
+				header: effective,
+				token: wireSig.protected ?? "",
+				what: `signature[${i}]`
+			});
+		} catch (err) {
+			lastError = asKeyLookupError(err, `signature[${i}]`);
+			continue;
+		}
+		if (typeof rawKeyMaterial === "string") {
+			lastError = stringKeyError();
+			continue;
+		}
+		const algError = checkAlgAllowed(alg, rawKeyMaterial, {
+			ctx: JWS_ALG_CTX,
+			algorithms: options.algorithms,
+			allowSymmetric: options.allowSymmetricJWKSet
+		});
+		if (algError) {
+			lastError = algError;
+			continue;
+		}
+		if (options.strictSignerMatch && !keyMatchesHeader(effective, rawKeyMaterial, {
+			ctx: JWS_ALG_CTX,
+			allowSymmetric: options.allowSymmetricJWKSet
+		})) continue;
+		let signatureBytes;
+		try {
+			signatureBytes = decodeSegment(wireSig.signature, {
+				family: "JWS",
+				what: "Signature"
+			});
+		} catch (err) {
+			lastError = asJWTError(err, INVALID_JWS);
+			continue;
+		}
+		const signingInputBytes = textEncoder.encode(`${wireSig.protected ?? ""}.${general.payload}`);
+		cryptoAttempted = true;
+		try {
+			if (!await verifyWithKey(alg, rawKeyMaterial, {
+				signature: signatureBytes,
+				signingInput: signingInputBytes,
+				kid: effective.kid,
+				allowSymmetric: options.allowSymmetricJWKSet,
+				keyCandidates
+			})) {
+				lastError = new JWTError("JWS signature verification failed.", "ERR_JWS_SIGNATURE_INVALID");
+				continue;
+			}
+			validateCriticalHeadersJWS(protectedHeader, options.recognizedHeaders);
+			const useB64 = protectedHeader.b64 !== false;
+			const payload = decodeJWSPayload(general.payload, useB64, payloadMode);
+			validateClaimsIfJson(payload, payloadMode, options);
+			const result = {
+				payload,
+				protectedHeader,
+				signerIndex: i
+			};
+			if (unprotectedHeader) result.signerHeader = unprotectedHeader;
+			return result;
+		} catch (err) {
+			const error = asJWTError(err, INVALID_SIGNATURE);
+			if (!PER_SIGNATURE_ERROR_CODES.has(error.code)) throw error;
+			lastError = error;
+		}
+	}
+	if (options.strictSignerMatch && !cryptoAttempted) throw new JWTError("No signature matched the provided key under strictSignerMatch.", "ERR_JWS_NO_MATCHING_SIGNER");
+	throw lastError ?? new JWTError("JWS signature verification failed.", "ERR_JWS_SIGNATURE_INVALID");
+}
+async function verifyMultiAll(jws, keyResolver, options = {}) {
+	assertConsumerOptions(options);
+	const payloadMode = resolvePayloadMode(options);
+	const signatureLimit = resolveLimit(options.limits, "signatures");
+	const keyCandidates = resolveLimit(options.limits, "keyCandidates");
+	const general = _readGeneralSerialization(jws, signatureLimit);
+	const outcomes = [];
+	for (let i = 0; i < general.signatures.length; i++) outcomes.push(await _verifyOneSignature(general.payload, general.signatures[i], i, keyResolver, {
+		options,
+		payloadMode,
+		keyCandidates
+	}));
+	return outcomes;
+}
+function generalToFlattenedJWS(jws) {
+	assertSerializationObject(jws, "JWS");
+	if (!Array.isArray(jws.signatures)) throw new JWTError("Invalid JWS JSON Serialization: missing \"signatures\".", "ERR_JWS_INVALID_SERIALIZATION");
+	if (jws.signatures.length !== 1) throw new JWTError(`Flattened JWS Serialization requires exactly one signature, got ${jws.signatures.length}.`, "ERR_JWS_INVALID_SERIALIZATION");
+	const [signature] = jws.signatures;
+	const flattened = {
+		payload: jws.payload,
+		signature: signature.signature
+	};
+	if (signature.protected !== void 0) flattened.protected = signature.protected;
+	if (signature.header !== void 0) flattened.header = signature.header;
+	return flattened;
+}
 async function sign(payload, key, options = {}) {
 	assertOptionEntry(options, {
 		label: "options",
@@ -466,7 +554,7 @@ async function sign(payload, key, options = {}) {
 	let { alg } = options;
 	if (!alg) {
 		if (isJWK(key) && key.alg) alg = key.alg;
-		else throw new JWTError("JWS \"alg\" (Algorithm) must be provided in options", "ERR_JWS_ALG_MISSING");
+		else throw new JWTError("JWS \"alg\" must be provided in options", "ERR_JWS_ALG_MISSING");
 	}
 	assertJWSAlgSupported(alg);
 	let signingKey;
@@ -488,7 +576,7 @@ async function sign(payload, key, options = {}) {
 	if (useB64) payloadEncoded = base64UrlStringify(payloadBytes);
 	else {
 		payloadEncoded = parsePayloadText(payloadBytes);
-		if (payloadEncoded.includes(".")) throw new JWTError("Invalid JWS: unencoded compact payload must not contain \".\" (RFC 7797 §5.2).", "ERR_JWS_INVALID");
+		if (payloadEncoded.includes(".")) throw new JWTError("Invalid JWS: unencoded compact payload must not contain \".\".", "ERR_JWS_INVALID");
 	}
 	const signingInputString = `${protectedHeaderEncoded}.${payloadEncoded}`;
 	const signingInputBytes = textEncoder.encode(signingInputString);
@@ -538,8 +626,7 @@ async function verify(jws, key, options = {}) {
 		keyCandidates: keyCandidateLimit
 	})) throw new JWTError("JWS signature verification failed.", "ERR_JWS_SIGNATURE_INVALID");
 	validateCriticalHeadersJWS(protectedHeader, options.recognizedHeaders);
-	const useB64 = protectedHeader.b64 !== false;
-	const payload = decodeJWSPayload(payloadEncoded, useB64, payloadMode);
+	const payload = decodeJWSPayload(payloadEncoded, protectedHeader.b64 !== false, payloadMode);
 	validateClaimsIfJson(payload, payloadMode, options);
 	return {
 		payload,

package/dist/_chunks/jwt.d.mts

@@ -1,4 +1,5 @@
-import { Duration, JOSEPayload, JOSEPayloadMode, JWTClaimValidationOptions, JWTClaims, JWTErrorCode, JWTTimeClaimOptions, PayloadOf } from "./index.mjs";
+import { JWTErrorCode } from "./error.mjs";
+import { Duration, JOSEPayload, JOSEPayloadMode, JWTClaimValidationOptions, JWTClaims, JWTTimeClaimOptions, PayloadOf } from "./index.mjs";
 /** Set `typ: "JWT"` on a header without `typ` when the payload is an object (not a `Uint8Array`). */
 export declare function applyTypDefault<T extends {
   typ?: string;