unjwt 0.5.21 → 0.5.23

package/README.md

@@ -20,11 +20,12 @@ A collection of low-level JWT ([RFC 7519](https://datatracker.ietf.org/doc/html/
 ## Table of Contents
 
 - [Usage](#usage)
-  - [Adapters](#adapters)
   - [JWS](#jws-json-web-signature-rfc-7515)
   - [JWE](#jwe-json-web-encryption-rfc-7516)
   - [JWK](#jwk-json-web-key-rfc-7517)
   - [Utility Functions](#utility-functions)
+  - [Adapters](#adapters)
+    - [H3 (Nuxt, Nitro)](#h3-nuxt-nitro)
 - [Development](#development)
 - [Credits](#credits)
 - [License](#license)

package/dist/h3.d.mts

@@ -9,7 +9,7 @@ export { d as deriveJWKFromPassword, e as exportJWKToPEM, g as generateJWK, i as
 
 /**
  * This is a fork of h3 library's session utility functions.
- * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/test/session.test.ts
+ * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/src/utils/session.ts
  * @license MIT https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/LICENSE
  */
 
@@ -23,6 +23,13 @@ interface SessionJWE<T extends SessionDataT$1 = SessionDataT$1> {
     data: SessionData<T>;
     [kGetSessionPromise$1]?: Promise<SessionJWE<T>>;
 }
+interface SessionHooksJWE {
+    onRead?: (session: SessionJWE, event: H3Event, config: SessionConfigJWE) => void | Promise<void>;
+    onUpdate?: (session: SessionJWE, event: H3Event, config: SessionConfigJWE) => void | Promise<void>;
+    onClear?: (event: H3Event, config: Partial<SessionConfigJWE>) => void | Promise<void>;
+    onExpire?: (event: H3Event, error: any | undefined, config: SessionConfigJWE) => void | Promise<void>;
+    onError?: (event: H3Event, error: any, config: SessionConfigJWE) => void | Promise<void>;
+}
 interface SessionManager<T extends SessionDataT$1 = SessionDataT$1> {
     readonly id: string | undefined;
     readonly createdAt: number;
@@ -31,9 +38,14 @@ interface SessionManager<T extends SessionDataT$1 = SessionDataT$1> {
     update: (update: SessionUpdate$1<T>) => Promise<SessionManager<T>>;
     clear: () => Promise<SessionManager<T>>;
 }
-interface SessionJWEConfig {
-    /** Shared secret used, string for PBES2 or Json Web Key (JWK) */
-    secret: string | JWK_Symmetric | {
+interface SessionConfigJWE {
+    /** @deprecated use `key` instead */
+    secret?: string | JWK_Symmetric | {
+        privateKey: JWK_Private | JWK_Symmetric;
+        publicKey?: JWK_Public;
+    };
+    /** Shared key used, string for PBES2 or Json Web Key (JWK) */
+    key: string | JWK_Symmetric | JWK_Private | {
         privateKey: JWK_Private | JWK_Symmetric;
         publicKey?: JWK_Public;
     };
@@ -45,8 +57,6 @@ interface SessionJWEConfig {
     cookie?: false | CookieSerializeOptions;
     /** Default is x-h3-session / x-{name}-session */
     sessionHeader?: false | string;
-    /** Optional WebCrypto implementation override */
-    crypto?: Crypto;
     /** Default is crypto.randomUUID */
     generateId?: () => string;
     /** JWE configuration overrides */
@@ -54,7 +64,12 @@ interface SessionJWEConfig {
         encryptOptions?: Omit<JWEEncryptOptions, "expiresIn">;
         decryptOptions?: JWTClaimValidationOptions;
     };
+    hooks?: SessionHooksJWE;
 }
+/**
+ * @deprecated use `SessionConfigJWE` instead
+ */
+type SessionJWEConfig = SessionConfigJWE;
 type CompatEvent$1 = {
     request: {
         headers: Headers;
@@ -68,15 +83,15 @@ type SessionUpdate$1<T extends SessionDataT$1 = SessionDataT$1> = Partial<Sessio
 /**
  * Create a session manager for the current request.
  */
-declare function useJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: H3Event | CompatEvent$1, config: SessionJWEConfig): Promise<SessionManager<T>>;
+declare function useJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: H3Event | CompatEvent$1, config: SessionConfigJWE): Promise<SessionManager<T>>;
 /**
  * Get (and lazily initialize) the session for the current request.
  */
-declare function getJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: H3Event | CompatEvent$1, config: SessionJWEConfig): Promise<SessionJWE<T>>;
+declare function getJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: H3Event | CompatEvent$1, config: SessionConfigJWE): Promise<SessionJWE<T>>;
 /**
  * Update the session (optionally mutating the session data) and re-issue the JWE token.
  */
-declare function updateJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: H3Event, config: SessionJWEConfig, update?: SessionUpdate$1<T>): Promise<SessionJWE<T>>;
+declare function updateJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: H3Event, config: SessionConfigJWE, update?: SessionUpdate$1<T>): Promise<SessionJWE<T>>;
 /**
  * Produce a JWE for the current session.
  * Payload structure:
@@ -87,19 +102,19 @@ declare function updateJWESession<T extends SessionDataT$1 = SessionDataT$1>(eve
  *   data: Record<string, any>;
  * }
  */
-declare function sealJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: H3Event | CompatEvent$1, config: SessionJWEConfig): Promise<string>;
+declare function sealJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: H3Event | CompatEvent$1, config: SessionConfigJWE): Promise<string>;
 /**
  * Decrypt the JWE and return a Session-compatible object.
  */
-declare function unsealJWESession(_event: H3Event | CompatEvent$1, config: SessionJWEConfig, sealed: string): Promise<Partial<SessionJWE>>;
+declare function unsealJWESession(_event: H3Event | CompatEvent$1, config: SessionConfigJWE, sealed: string): Promise<Partial<SessionJWE>>;
 /**
  * Clear the session (delete from context and drop cookie).
  */
-declare function clearJWESession(event: H3Event, config: Partial<SessionJWEConfig>): Promise<void>;
+declare function clearJWESession(event: H3Event, config: Partial<SessionConfigJWE>): Promise<void>;
 
 /**
  * This is a fork of h3 library's session utility functions.
- * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/test/session.test.ts
+ * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/src/utils/session.ts
  * @license MIT https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/LICENSE
  */
 
@@ -112,7 +127,14 @@ interface SessionJWS<T extends SessionDataT = SessionDataT> {
     data: SessionData<T>;
     [kGetSessionPromise]?: Promise<SessionJWS<T>>;
 }
-interface SessionJWSConfig {
+interface SessionHooksJWS {
+    onRead?: (session: SessionJWS, event: H3Event, config: SessionConfigJWS) => void | Promise<void>;
+    onUpdate?: (session: SessionJWS, event: H3Event, config: SessionConfigJWS) => void | Promise<void>;
+    onClear?: (event: H3Event, config: Partial<SessionConfigJWS>) => void | Promise<void>;
+    onExpire?: (event: H3Event, error: any | undefined, config: SessionConfigJWS) => void | Promise<void>;
+    onError?: (event: H3Event, error: any, config: SessionConfigJWS) => void | Promise<void>;
+}
+interface SessionConfigJWS {
     /**
      * JWK (private for signing with RS/ES/PS, or symmetric oct) used for signing.
      */
@@ -128,8 +150,6 @@ interface SessionJWSConfig {
     cookie?: false | CookieSerializeOptions;
     /** Custom header (false to disable header lookup) */
     sessionHeader?: false | string;
-    /** Provide a custom WebCrypto (if needed for algorithm operations) */
-    crypto?: Crypto;
     /** Custom ID generator (defaults to crypto.randomUUID) */
     generateId?: () => string;
     /** JWS customization */
@@ -137,7 +157,12 @@ interface SessionJWSConfig {
         signOptions?: Omit<JWSSignOptions, "expiresIn">;
         verifyOptions?: JWTClaimValidationOptions;
     };
+    hooks?: SessionHooksJWS;
 }
+/**
+ * @deprecated use `SessionConfigJWS` instead
+ */
+type SessionJWSConfig = SessionConfigJWS;
 type CompatEvent = {
     request: {
         headers: Headers;
@@ -152,21 +177,21 @@ type SessionUpdate<T extends SessionDataT = SessionDataT> = Partial<SessionData<
  * Create a session manager for the current request using JWS (signed only, not encrypted).
  * NOTE: Contents are visible to clients (Base64URL-decoded JSON). Do not store secrets in session data.
  */
-declare function useJWSSession<T extends SessionDataT = SessionDataT>(event: H3Event | CompatEvent, config: SessionJWSConfig): Promise<SessionManager<T>>;
+declare function useJWSSession<T extends SessionDataT = SessionDataT>(event: H3Event | CompatEvent, config: SessionConfigJWS): Promise<SessionManager<T>>;
 /**
  * Retrieve (and lazily initialize) the session.
  */
-declare function getJWSSession<T extends SessionDataT = SessionDataT>(event: H3Event | CompatEvent, config: SessionJWSConfig): Promise<SessionJWS<T>>;
+declare function getJWSSession<T extends SessionDataT = SessionDataT>(event: H3Event | CompatEvent, config: SessionConfigJWS): Promise<SessionJWS<T>>;
 /**
  * Update session data (if provided) and reissue JWS.
  */
-declare function updateJWSSession<T extends SessionDataT = SessionDataT>(event: H3Event, config: SessionJWSConfig, update?: SessionUpdate<T>): Promise<SessionJWS<T>>;
+declare function updateJWSSession<T extends SessionDataT = SessionDataT>(event: H3Event, config: SessionConfigJWS, update?: SessionUpdate<T>): Promise<SessionJWS<T>>;
 /**
  * Sign current session as a compact JWS.
  * Payload claims:
  *  jti, iat, exp?, data, plus optional extraClaims (cannot override reserved)
  */
-declare function signJWSSession<T extends SessionDataT = SessionDataT>(event: H3Event | CompatEvent, config: SessionJWSConfig): Promise<string>;
+declare function signJWSSession<T extends SessionDataT = SessionDataT>(event: H3Event | CompatEvent, config: SessionConfigJWS): Promise<string>;
 /**
  * Verify and parse a compact JWS into a Session structure.
  * Performs:
@@ -175,11 +200,11 @@ declare function signJWSSession<T extends SessionDataT = SessionDataT>(event: H3
  *  - ensures jti & iat presence
  *  - enforces maxAge if provided
  */
-declare function verifyJWSSession(_event: H3Event | CompatEvent, config: SessionJWSConfig, token: string): Promise<Partial<SessionJWS>>;
+declare function verifyJWSSession(_event: H3Event | CompatEvent, config: SessionConfigJWS, token: string): Promise<Partial<SessionJWS>>;
 /**
  * Destroy the session (context + cookie).
  */
-declare function clearJWSSession(event: H3Event, config: Partial<SessionJWSConfig>): Promise<void>;
+declare function clearJWSSession(event: H3Event, config: Partial<SessionConfigJWS>): Promise<void>;
 
 export { JWEEncryptOptions, JWKSet, JWK_Private, JWK_Public, JWK_Symmetric, JWTClaimValidationOptions, JWTClaims, clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
-export type { SessionData, SessionJWE, SessionJWEConfig, SessionJWS, SessionJWSConfig, SessionManager };
+export type { SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWEConfig, SessionJWS, SessionJWSConfig, SessionManager };

package/dist/h3.mjs

@@ -1,13 +1,13 @@
-export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from './shared/unjwt.Vg02PZWw.mjs';
+export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from './shared/unjwt.epPK1KFr.mjs';
 import { isEvent, setCookie } from 'h3';
 import { parse } from 'cookie-es';
-import { e as encrypt, d as decrypt } from './shared/unjwt.CXl9FD-V.mjs';
-import { p as isSymmetricJWK, q as isPrivateJWK, u as isAsymmetricJWK } from './shared/unjwt.DCiTNyCM.mjs';
-import { s as sign, v as verify } from './shared/unjwt.DmRAjMp8.mjs';
+import { e as encrypt, d as decrypt } from './shared/unjwt.CiBEuvtQ.mjs';
+import { p as isSymmetricJWK, q as isPrivateJWK, u as isPublicJWK } from './shared/unjwt.C86hA0o-.mjs';
+import { s as sign, v as verify } from './shared/unjwt.D-FATaw1.mjs';
 
 /**
  * This is a fork of h3 library's session utility functions.
- * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/test/session.test.ts
+ * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/src/utils/session.ts
  * @license MIT https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/LICENSE
  */
 const kGetSessionPromise$1 = Symbol("h3_jwe_getSession");
@@ -57,9 +57,15 @@ async function getJWESession(event, config) {
   }
   const existingSession = event.context.sessions[sessionName];
   if (existingSession) {
-    return existingSession.expiresAt === void 0 ? existingSession[kGetSessionPromise$1] || existingSession : existingSession.expiresAt < Date.now() && isEvent(event) ? clearJWESession(event, config).then(
-      () => getJWESession(event, config)
-    ) : existingSession[kGetSessionPromise$1] || existingSession;
+    const session2 = existingSession[kGetSessionPromise$1] ? await existingSession[kGetSessionPromise$1] : existingSession;
+    if (session2.expiresAt !== void 0 && session2.expiresAt < Date.now() && isEvent(event)) {
+      await config.hooks?.onExpire?.(event, void 0, config);
+      return clearJWESession(event, config).then(
+        () => getJWESession(event, config)
+      );
+    }
+    await config.hooks?.onRead?.(session2, event, config);
+    return session2;
   }
   const session = {
     id: "",
@@ -83,7 +89,13 @@ async function getJWESession(event, config) {
     }
   }
   if (jweToken) {
-    const promise = unsealJWESession(event, config, jweToken).catch(() => {
+    const promise = unsealJWESession(event, config, jweToken).catch(async (error_) => {
+      if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
+        await config.hooks?.onExpire?.(event, error_, config);
+        return void 0;
+      }
+      await config.hooks?.onError?.(event, error_, config);
+      return void 0;
     }).then((unsealed) => {
       if (unsealed) {
         Object.assign(session, unsealed);
@@ -100,12 +112,12 @@ async function getJWESession(event, config) {
         "Cannot initialize a new session. Use `useSession(event)` within the main handler."
       );
     }
-    session.id = config.generateId?.() ?? (config.crypto || crypto).randomUUID();
-    session.createdAt = config.jwe?.encryptOptions?.currentDate === void 0 ? Date.now() : config.jwe.encryptOptions.currentDate.getTime();
+    session.id = config.generateId?.() ?? crypto.randomUUID();
+    session.createdAt = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
     session.expiresAt = config.maxAge ? session.createdAt + config.maxAge * 1e3 : void 0;
-    session.data = /* @__PURE__ */ Object.create(null);
     await updateJWESession(event, config);
   }
+  await config.hooks?.onRead?.(session, event, config);
   return session;
 }
 function _getReqHeader$1(event, name) {
@@ -127,6 +139,7 @@ async function updateJWESession(event, config, update) {
   }
   if (update) {
     Object.assign(session.data, update);
+    await config.hooks?.onUpdate?.(session, event, config);
   }
   if (config.cookie !== false) {
     const sealed = await sealJWESession(event, config);
@@ -142,12 +155,7 @@ async function updateJWESession(event, config, update) {
   return session;
 }
 async function sealJWESession(event, config) {
-  const key = getEncryptKey(config.secret);
-  if (typeof key !== "string" && !isSymmetricJWK(key) && !isPrivateJWK(key)) {
-    throw new Error(
-      "Session: JWE secret must be a password string or a private JWK."
-    );
-  }
+  const key = getEncryptKey(config.key || config.secret);
   const sessionName = config.name || DEFAULT_NAME$1;
   const session = event.context.sessions?.[sessionName] || await getJWESession(event, config);
   const iatSeconds = Math.floor(session.createdAt / 1e3);
@@ -160,25 +168,30 @@ async function sealJWESession(event, config) {
   if (expSeconds) {
     payload.exp = expSeconds;
   }
+  let typ = void 0;
+  if (config.jwe?.encryptOptions?.protectedHeader?.typ && typeof config.jwe.encryptOptions.protectedHeader.typ === "string" && config.jwe.encryptOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
+    typ = config.jwe.encryptOptions.protectedHeader.typ;
+  }
   const token = await encrypt(payload, key, {
     ...config.jwe?.encryptOptions,
+    expiresIn: void 0,
+    // controlled via 'exp' claim
     protectedHeader: {
       ...config.jwe?.encryptOptions?.protectedHeader,
-      typ: "JWT",
+      kid: typeof key === "string" ? void 0 : key.kid,
+      typ: typ || "JWT",
       cty: "application/json"
     }
   });
   return token;
 }
 async function unsealJWESession(_event, config, sealed) {
-  const key = getDecryptKey(config.secret);
-  if (typeof key !== "string" && !isSymmetricJWK(key) && !isPrivateJWK(key)) {
-    throw new Error(
-      "Session: JWE secret must be a password string or a private JWK."
-    );
-  }
+  const key = getDecryptKey(config.key || config.secret);
   const alg = config.jwe?.encryptOptions?.alg;
   const enc = config.jwe?.encryptOptions?.enc;
+  if (config.jwe?.encryptOptions?.protectedHeader?.typ && typeof config.jwe.encryptOptions.protectedHeader.typ === "string" && config.jwe.encryptOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
+    config.jwe.encryptOptions.protectedHeader.typ;
+  }
   const { payload } = await decrypt(sealed, key, {
     ...config.jwe?.decryptOptions,
     requiredClaims: [
@@ -211,7 +224,7 @@ async function unsealJWESession(_event, config, sealed) {
     data: data && typeof data === "object" ? data : /* @__PURE__ */ Object.create(null)
   };
 }
-function clearJWESession(event, config) {
+async function clearJWESession(event, config) {
   const sessionName = config.name || DEFAULT_NAME$1;
   if (event.context.sessions?.[sessionName]) {
     delete event.context.sessions[sessionName];
@@ -219,31 +232,57 @@ function clearJWESession(event, config) {
   setCookie(event, sessionName, "", {
     ...DEFAULT_COOKIE$1,
     ...config.cookie,
-    // Optionally set expires in the past
-    expires: /* @__PURE__ */ new Date(0)
+    expires: /* @__PURE__ */ new Date(0),
+    maxAge: void 0
   });
-  return Promise.resolve();
+  await config.hooks?.onClear?.(event, config);
 }
-function getEncryptKey(secret) {
-  if (typeof secret === "string") {
-    return secret;
-  } else if (isSymmetricJWK(secret)) {
-    return secret;
+function getEncryptKey(key) {
+  if (!key) {
+    throw new Error("Session: JWE key is required.");
+  }
+  let _key;
+  if (typeof key === "string") {
+    _key = key;
+  } else if (isSymmetricJWK(key) || isPrivateJWK(key)) {
+    _key = key;
+  } else if ("publicKey" in key && isPublicJWK(key.publicKey)) {
+    _key = key.publicKey;
+  } else if ("privateKey" in key && isPrivateJWK(key.privateKey)) {
+    _key = key.privateKey;
+  }
+  if (!_key) {
+    throw new Error(
+      "Session: Invalid JWE key. It must be a password string or valid JWK.",
+      { cause: key }
+    );
   }
-  return secret.publicKey || secret.privateKey;
+  return _key;
 }
-function getDecryptKey(secret) {
-  if (typeof secret === "string") {
-    return secret;
-  } else if ("privateKey" in secret) {
-    return secret.privateKey;
+function getDecryptKey(key) {
+  if (!key) {
+    throw new Error("Session: JWE key is required.");
+  }
+  let _key = void 0;
+  if (typeof key === "string") {
+    _key = key;
+  } else if (isSymmetricJWK(key)) {
+    _key = key;
+  } else if ("privateKey" in key) {
+    _key = key.privateKey;
+  }
+  if (!_key) {
+    throw new Error(
+      "Session: Invalid JWE key. It must be a password string or a valid private JWK.",
+      { cause: key }
+    );
   }
-  return secret;
+  return _key;
 }
 
 /**
  * This is a fork of h3 library's session utility functions.
- * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/test/session.test.ts
+ * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/src/utils/session.ts
  * @license MIT https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/LICENSE
  */
 const kGetSessionPromise = Symbol("h3_jws_getSession");
@@ -293,9 +332,15 @@ async function getJWSSession(event, config) {
   }
   const existingSession = event.context.sessions[sessionName];
   if (existingSession) {
-    return existingSession.expiresAt === void 0 ? existingSession[kGetSessionPromise] || existingSession : existingSession.expiresAt < Date.now() && isEvent(event) ? clearJWSSession(event, config).then(
-      () => getJWSSession(event, config)
-    ) : existingSession[kGetSessionPromise] || existingSession;
+    const session2 = existingSession[kGetSessionPromise] ? await existingSession[kGetSessionPromise] : existingSession;
+    if (session2.expiresAt !== void 0 && session2.expiresAt < Date.now() && isEvent(event)) {
+      await config.hooks?.onExpire?.(event, void 0, config);
+      return clearJWSSession(event, config).then(
+        () => getJWSSession(event, config)
+      );
+    }
+    await config.hooks?.onRead?.(session2, event, config);
+    return session2;
   }
   const session = {
     id: "",
@@ -319,7 +364,13 @@ async function getJWSSession(event, config) {
     }
   }
   if (token) {
-    const promise = verifyJWSSession(event, config, token).catch(() => {
+    const promise = verifyJWSSession(event, config, token).catch(async (error_) => {
+      if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
+        await config.hooks?.onExpire?.(event, error_, config);
+        return void 0;
+      }
+      await config.hooks?.onError?.(event, error_, config);
+      return void 0;
     }).then((unsealed) => {
       if (unsealed) {
         Object.assign(session, unsealed);
@@ -336,12 +387,12 @@ async function getJWSSession(event, config) {
         "Cannot initialize a new session outside main handler. Use `useJWSSession(event)` properly."
       );
     }
-    session.id = config.generateId?.() ?? (config.crypto || globalThis.crypto).randomUUID();
-    session.createdAt = config.jws?.signOptions?.currentDate === void 0 ? Date.now() : config.jws.signOptions.currentDate.getTime();
+    session.id = config.generateId?.() ?? crypto.randomUUID();
+    session.createdAt = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
     session.expiresAt = config.maxAge ? session.createdAt + config.maxAge * 1e3 : void 0;
-    session.data = /* @__PURE__ */ Object.create(null);
     await updateJWSSession(event, config);
   }
+  await config.hooks?.onRead?.(session, event, config);
   return session;
 }
 function _getReqHeader(event, name) {
@@ -363,6 +414,7 @@ async function updateJWSSession(event, config, update) {
   }
   if (update) {
     Object.assign(session.data, update);
+    await config.hooks?.onUpdate?.(session, event, config);
   }
   if (config.cookie !== false) {
     const token = await signJWSSession(event, config);
@@ -376,9 +428,6 @@ async function updateJWSSession(event, config, update) {
 }
 async function signJWSSession(event, config) {
   const key = getSignKey(config.key);
-  if (isAsymmetricJWK(key) && !isPrivateJWK(key)) {
-    throw new Error("Session: JWS key cannot be a public asymmetric JWK.");
-  }
   const sessionName = config.name || DEFAULT_NAME;
   const session = event.context.sessions?.[sessionName] || await getJWSSession(event, config);
   const iatSeconds = Math.floor(session.createdAt / 1e3);
@@ -391,11 +440,19 @@ async function signJWSSession(event, config) {
   if (expSeconds) {
     payload.exp = expSeconds;
   }
+  let typ = void 0;
+  if (config.jws?.signOptions?.protectedHeader?.typ && typeof config.jws.signOptions.protectedHeader.typ === "string" && config.jws.signOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
+    typ = config.jws.signOptions.protectedHeader.typ;
+  }
   const token = await sign(payload, key, {
     ...config.jws?.signOptions,
+    expiresIn: void 0,
+    // controlled via 'exp' claim
     protectedHeader: {
       ...config.jws?.signOptions?.protectedHeader,
-      typ: "JWT"
+      kid: key.kid,
+      typ: typ || "JWT",
+      cty: "application/json"
     }
   });
   return token;
@@ -403,8 +460,9 @@ async function signJWSSession(event, config) {
 async function verifyJWSSession(_event, config, token) {
   const alg = config.jws?.signOptions?.alg;
   const jwk = getVerifyKey(config.key);
-  if (isAsymmetricJWK(jwk) && isPrivateJWK(jwk)) {
-    throw new Error("Session: JWS key cannot be a private asymmetric JWK.");
+  let typ = void 0;
+  if (config.jws?.signOptions?.protectedHeader?.typ && typeof config.jws.signOptions.protectedHeader.typ === "string" && config.jws.signOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
+    typ = config.jws.signOptions.protectedHeader.typ;
   }
   const { payload } = await verify(token, jwk, {
     ...config.jws?.verifyOptions,
@@ -415,7 +473,7 @@ async function verifyJWSSession(_event, config, token) {
       "jti",
       "iat"
     ],
-    typ: "JWT",
+    typ: typ || "JWT",
     algorithms: alg ? [alg] : void 0,
     forceUint8Array: false,
     validateJWT: true
@@ -432,7 +490,7 @@ async function verifyJWSSession(_event, config, token) {
     data: data && typeof data === "object" ? data : /* @__PURE__ */ Object.create(null)
   };
 }
-function clearJWSSession(event, config) {
+async function clearJWSSession(event, config) {
   const sessionName = config.name || DEFAULT_NAME;
   if (event.context.sessions?.[sessionName]) {
     delete event.context.sessions[sessionName];
@@ -440,21 +498,51 @@ function clearJWSSession(event, config) {
   setCookie(event, sessionName, "", {
     ...DEFAULT_COOKIE,
     ...config.cookie,
-    expires: /* @__PURE__ */ new Date(0)
+    expires: /* @__PURE__ */ new Date(0),
+    maxAge: void 0
   });
-  return Promise.resolve();
+  await config.hooks?.onClear?.(event, config);
 }
 function getSignKey(key) {
-  if ("privateKey" in key) {
-    return key.privateKey;
+  if (!key) {
+    throw new Error("Session: JWS key is required.");
+  }
+  let _key = void 0;
+  if (isSymmetricJWK(key)) {
+    _key = key;
+  } else if ("privateKey" in key && isPrivateJWK(key.privateKey)) {
+    _key = key.privateKey;
   }
-  return key;
+  if (!_key) {
+    throw new Error(
+      "Session: Invalid JWS key. It must be a symmetric JWK or a private JWK.",
+      { cause: key }
+    );
+  }
+  return _key;
 }
 function getVerifyKey(key) {
-  if ("publicKey" in key) {
-    return Array.isArray(key.publicKey) ? { keys: key.publicKey } : key.publicKey;
+  if (!key) {
+    throw new Error("Session: JWS key is required.");
+  }
+  let _key = void 0;
+  if (isSymmetricJWK(key)) {
+    _key = key;
+  } else if ("publicKey" in key && isPublicJWK(key.publicKey)) {
+    _key = key.publicKey;
+  } else if ("publicKey" in key && Array.isArray(key.publicKey)) {
+    const keys = key.publicKey.filter((k) => isPublicJWK(k));
+    if (keys && keys.length > 0) {
+      _key = { keys };
+    }
+  }
+  if (!_key) {
+    throw new Error(
+      "Session: Invalid JWS key. It must be a symmetric JWK or a public JWK/set.",
+      { cause: key }
+    );
   }
-  return key;
+  return _key;
 }
 
 export { clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-export { i as utils } from './shared/unjwt.DCiTNyCM.mjs';
-export { j as jwe } from './shared/unjwt.CXl9FD-V.mjs';
-export { j as jwk } from './shared/unjwt.Vg02PZWw.mjs';
-export { j as jws } from './shared/unjwt.DmRAjMp8.mjs';
+export { i as utils } from './shared/unjwt.C86hA0o-.mjs';
+export { j as jwe } from './shared/unjwt.CiBEuvtQ.mjs';
+export { j as jwk } from './shared/unjwt.epPK1KFr.mjs';
+export { j as jws } from './shared/unjwt.D-FATaw1.mjs';

package/dist/jwe.mjs

@@ -1,3 +1,3 @@
-import './shared/unjwt.Vg02PZWw.mjs';
-import './shared/unjwt.DCiTNyCM.mjs';
-export { d as decrypt, e as encrypt } from './shared/unjwt.CXl9FD-V.mjs';
+import './shared/unjwt.epPK1KFr.mjs';
+import './shared/unjwt.C86hA0o-.mjs';
+export { d as decrypt, e as encrypt } from './shared/unjwt.CiBEuvtQ.mjs';

package/dist/jwk.mjs

@@ -1,2 +1,2 @@
-import './shared/unjwt.DCiTNyCM.mjs';
-export { k as deriveJWKFromPassword, m as deriveKeyFromPassword, h as exportJWKToPEM, n as exportKey, c as generateJWK, l as generateKey, b as getJWKFromSet, f as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.Vg02PZWw.mjs';
+import './shared/unjwt.C86hA0o-.mjs';
+export { k as deriveJWKFromPassword, m as deriveKeyFromPassword, h as exportJWKToPEM, n as exportKey, c as generateJWK, l as generateKey, b as getJWKFromSet, f as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.epPK1KFr.mjs';

package/dist/jws.mjs

@@ -1,3 +1,3 @@
-import './shared/unjwt.Vg02PZWw.mjs';
-import './shared/unjwt.DCiTNyCM.mjs';
-export { s as sign, v as verify } from './shared/unjwt.DmRAjMp8.mjs';
+import './shared/unjwt.epPK1KFr.mjs';
+import './shared/unjwt.C86hA0o-.mjs';
+export { s as sign, v as verify } from './shared/unjwt.D-FATaw1.mjs';

package/dist/shared/{unjwt.DCiTNyCM.mjs → unjwt.C86hA0o-.mjs}

@@ -435,4 +435,4 @@ const index = {
   validateJwtClaims: validateJwtClaims
 };
 
-export { maybeArray as A, isPublicJWK as B, isJWTContent as C, decodeMaybeJWTString as D, computeExpiresInSeconds as E, computeMaxTokenAgeSeconds as F, isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, base64UrlDecode as e, decodePayloadFromBytes as f, getPlaintextBytes as g, validateJwtClaims as h, index as i, isCryptoKeyPair as j, isCryptoKey as k, textDecoder as l, isJWKSet as m, decodePayloadFromB64UrlSegment as n, validateCriticalHeadersJWS as o, isSymmetricJWK as p, isPrivateJWK as q, randomBytes as r, sanitizeObject as s, textEncoder as t, isAsymmetricJWK as u, validateCriticalHeadersJWE as v, concatUint8Arrays as w, base64Decode as x, base64Encode as y, assertCryptoKey as z };
+export { isAsymmetricJWK as A, maybeArray as B, isJWTContent as C, decodeMaybeJWTString as D, computeExpiresInSeconds as E, computeMaxTokenAgeSeconds as F, isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, base64UrlDecode as e, decodePayloadFromBytes as f, getPlaintextBytes as g, validateJwtClaims as h, index as i, isCryptoKeyPair as j, isCryptoKey as k, textDecoder as l, isJWKSet as m, decodePayloadFromB64UrlSegment as n, validateCriticalHeadersJWS as o, isSymmetricJWK as p, isPrivateJWK as q, randomBytes as r, sanitizeObject as s, textEncoder as t, isPublicJWK as u, validateCriticalHeadersJWE as v, concatUint8Arrays as w, base64Decode as x, base64Encode as y, assertCryptoKey as z };

package/dist/shared/{unjwt.CXl9FD-V.mjs → unjwt.CiBEuvtQ.mjs}

@@ -1,5 +1,5 @@
-import { i as importKey, e as encryptKey, g as generateIV, a as encrypt$1, u as unwrapKey, d as decrypt$1 } from './unjwt.Vg02PZWw.mjs';
-import { r as randomBytes, a as isJWK, s as sanitizeObject, b as applyTypCtyDefaults, c as computeJwtTimeClaims, g as getPlaintextBytes, d as base64UrlEncode, t as textEncoder, e as base64UrlDecode, f as decodePayloadFromBytes, v as validateCriticalHeadersJWE, h as validateJwtClaims, j as isCryptoKeyPair, k as isCryptoKey } from './unjwt.DCiTNyCM.mjs';
+import { i as importKey, e as encryptKey, g as generateIV, a as encrypt$1, u as unwrapKey, d as decrypt$1 } from './unjwt.epPK1KFr.mjs';
+import { r as randomBytes, a as isJWK, s as sanitizeObject, b as applyTypCtyDefaults, c as computeJwtTimeClaims, g as getPlaintextBytes, d as base64UrlEncode, t as textEncoder, e as base64UrlDecode, f as decodePayloadFromBytes, v as validateCriticalHeadersJWE, h as validateJwtClaims, j as isCryptoKeyPair, k as isCryptoKey } from './unjwt.C86hA0o-.mjs';
 
 async function encrypt(payload, key, options = {}) {
   const {

package/dist/shared/{unjwt.DmRAjMp8.mjs → unjwt.D-FATaw1.mjs}

@@ -1,5 +1,5 @@
-import { i as importKey, s as sign$1, b as getJWKFromSet, v as verify$1 } from './unjwt.Vg02PZWw.mjs';
-import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, l as textDecoder, e as base64UrlDecode, m as isJWKSet, n as decodePayloadFromB64UrlSegment, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './unjwt.DCiTNyCM.mjs';
+import { i as importKey, s as sign$1, b as getJWKFromSet, v as verify$1 } from './unjwt.epPK1KFr.mjs';
+import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, l as textDecoder, e as base64UrlDecode, m as isJWKSet, n as decodePayloadFromB64UrlSegment, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './unjwt.C86hA0o-.mjs';
 
 async function sign(payload, key, options = {}) {
   const { protectedHeader: additionalProtectedHeader } = options;

package/dist/shared/{unjwt.Vg02PZWw.mjs → unjwt.epPK1KFr.mjs}

@@ -1,4 +1,4 @@
-import { k as isCryptoKey, w as concatUint8Arrays, d as base64UrlEncode, x as base64Decode, y as base64Encode, t as textEncoder, s as sanitizeObject, z as assertCryptoKey, a as isJWK, e as base64UrlDecode, u as isAsymmetricJWK, r as randomBytes, m as isJWKSet } from './unjwt.DCiTNyCM.mjs';
+import { k as isCryptoKey, w as concatUint8Arrays, d as base64UrlEncode, x as base64Decode, y as base64Encode, t as textEncoder, s as sanitizeObject, z as assertCryptoKey, a as isJWK, e as base64UrlDecode, A as isAsymmetricJWK, r as randomBytes, m as isJWKSet } from './unjwt.C86hA0o-.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.
@@ -1482,7 +1482,10 @@ async function generateJWK(alg, jwkParams, options = {}) {
   } = options;
   return generateKey(alg, {
     ...opts,
-    toJWK: jwkParams || true
+    toJWK: {
+      kid: typeof jwkParams?.kid === "string" ? jwkParams.kid : crypto.randomUUID(),
+      ...jwkParams
+    }
   });
 }
 async function deriveKeyFromPassword(password, alg, options) {

package/dist/utils.mjs

@@ -1 +1 @@
-export { b as applyTypCtyDefaults, z as assertCryptoKey, x as base64Decode, y as base64Encode, e as base64UrlDecode, d as base64UrlEncode, E as computeExpiresInSeconds, c as computeJwtTimeClaims, F as computeMaxTokenAgeSeconds, w as concatUint8Arrays, D as decodeMaybeJWTString, n as decodePayloadFromB64UrlSegment, f as decodePayloadFromBytes, g as getPlaintextBytes, u as isAsymmetricJWK, k as isCryptoKey, j as isCryptoKeyPair, a as isJWK, m as isJWKSet, C as isJWTContent, q as isPrivateJWK, B as isPublicJWK, p as isSymmetricJWK, A as maybeArray, r as randomBytes, s as sanitizeObject, l as textDecoder, t as textEncoder, v as validateCriticalHeadersJWE, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './shared/unjwt.DCiTNyCM.mjs';
+export { b as applyTypCtyDefaults, z as assertCryptoKey, x as base64Decode, y as base64Encode, e as base64UrlDecode, d as base64UrlEncode, E as computeExpiresInSeconds, c as computeJwtTimeClaims, F as computeMaxTokenAgeSeconds, w as concatUint8Arrays, D as decodeMaybeJWTString, n as decodePayloadFromB64UrlSegment, f as decodePayloadFromBytes, g as getPlaintextBytes, A as isAsymmetricJWK, k as isCryptoKey, j as isCryptoKeyPair, a as isJWK, m as isJWKSet, C as isJWTContent, q as isPrivateJWK, u as isPublicJWK, p as isSymmetricJWK, B as maybeArray, r as randomBytes, s as sanitizeObject, l as textDecoder, t as textEncoder, v as validateCriticalHeadersJWE, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './shared/unjwt.C86hA0o-.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.21",
+  "version": "0.5.23",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",
@@ -44,7 +44,7 @@
   ],
   "scripts": {
     "build": "unbuild",
-    "dev": "vitest dev",
+    "dev": "bun --watch ./playground/main.ts",
     "lint": "eslint . && prettier -c .",
     "lint:fix": "automd && eslint . --fix && prettier -w .",
     "prepack": "pnpm build",