unjwt 0.5.22 → 0.5.24

package/dist/{h3.mjs → adapters/h3.mjs}

@@ -1,13 +1,13 @@
-export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from './shared/unjwt.Vg02PZWw.mjs';
+export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from '../shared/unjwt.epPK1KFr.mjs';
 import { isEvent, setCookie } from 'h3';
 import { parse } from 'cookie-es';
-import { e as encrypt, d as decrypt } from './shared/unjwt.CXl9FD-V.mjs';
-import { p as isSymmetricJWK, q as isPrivateJWK, u as isAsymmetricJWK } from './shared/unjwt.DCiTNyCM.mjs';
-import { s as sign, v as verify } from './shared/unjwt.DmRAjMp8.mjs';
+import { e as encrypt, d as decrypt } from '../shared/unjwt.CiBEuvtQ.mjs';
+import { p as isSymmetricJWK, q as isPrivateJWK, u as isPublicJWK } from '../shared/unjwt.C86hA0o-.mjs';
+import { s as sign, v as verify } from '../shared/unjwt.D-FATaw1.mjs';
 
 /**
  * This is a fork of h3 library's session utility functions.
- * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/test/session.test.ts
+ * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/src/utils/session.ts
  * @license MIT https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/LICENSE
  */
 const kGetSessionPromise$1 = Symbol("h3_jwe_getSession");
@@ -57,22 +57,15 @@ async function getJWESession(event, config) {
   }
   const existingSession = event.context.sessions[sessionName];
   if (existingSession) {
-    if (existingSession.expiresAt === void 0) {
-      const session2 = existingSession[kGetSessionPromise$1] || existingSession;
-      await config.hooks?.onRead?.(await session2, event);
-      return session2;
-    } else {
-      if (existingSession.expiresAt < Date.now() && isEvent(event)) {
-        await config.hooks?.onExpire?.(event, void 0);
-        return clearJWESession(event, config).then(
-          () => getJWESession(event, config)
-        );
-      } else {
-        const session2 = existingSession[kGetSessionPromise$1] || existingSession;
-        await config.hooks?.onRead?.(await session2, event);
-        return session2;
-      }
+    const session2 = existingSession[kGetSessionPromise$1] ? await existingSession[kGetSessionPromise$1] : existingSession;
+    if (session2.expiresAt !== void 0 && session2.expiresAt < Date.now() && isEvent(event)) {
+      await config.hooks?.onExpire?.(event, void 0, config);
+      return clearJWESession(event, config).then(
+        () => getJWESession(event, config)
+      );
     }
+    await config.hooks?.onRead?.(session2, event, config);
+    return session2;
   }
   const session = {
     id: "",
@@ -97,14 +90,11 @@ async function getJWESession(event, config) {
   }
   if (jweToken) {
     const promise = unsealJWESession(event, config, jweToken).catch(async (error_) => {
-      if (error_ instanceof Error) {
-        const message = error_.message;
-        if (message.includes("Token has expired") || message.includes("Token is too old")) {
-          await config.hooks?.onExpire?.(event, error_);
-          return void 0;
-        }
+      if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
+        await config.hooks?.onExpire?.(event, error_, config);
+        return void 0;
       }
-      await config.hooks?.onError?.(event, error_);
+      await config.hooks?.onError?.(event, error_, config);
       return void 0;
     }).then((unsealed) => {
       if (unsealed) {
@@ -122,13 +112,12 @@ async function getJWESession(event, config) {
         "Cannot initialize a new session. Use `useSession(event)` within the main handler."
       );
     }
-    session.id = config.generateId?.() ?? (config.crypto || crypto).randomUUID();
-    session.createdAt = config.jwe?.encryptOptions?.currentDate === void 0 ? Date.now() : config.jwe.encryptOptions.currentDate.getTime();
+    session.id = config.generateId?.() ?? crypto.randomUUID();
+    session.createdAt = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
     session.expiresAt = config.maxAge ? session.createdAt + config.maxAge * 1e3 : void 0;
-    session.data = /* @__PURE__ */ Object.create(null);
     await updateJWESession(event, config);
   }
-  await config.hooks?.onRead?.(session, event);
+  await config.hooks?.onRead?.(session, event, config);
   return session;
 }
 function _getReqHeader$1(event, name) {
@@ -150,7 +139,7 @@ async function updateJWESession(event, config, update) {
   }
   if (update) {
     Object.assign(session.data, update);
-    await config.hooks?.onUpdate?.(session, event);
+    await config.hooks?.onUpdate?.(session, event, config);
   }
   if (config.cookie !== false) {
     const sealed = await sealJWESession(event, config);
@@ -166,12 +155,7 @@ async function updateJWESession(event, config, update) {
   return session;
 }
 async function sealJWESession(event, config) {
-  const key = getEncryptKey(config.secret);
-  if (typeof key !== "string" && !isSymmetricJWK(key) && !isPrivateJWK(key)) {
-    throw new Error(
-      "Session: JWE secret must be a password string or a private JWK."
-    );
-  }
+  const key = getEncryptKey(config.key || config.secret);
   const sessionName = config.name || DEFAULT_NAME$1;
   const session = event.context.sessions?.[sessionName] || await getJWESession(event, config);
   const iatSeconds = Math.floor(session.createdAt / 1e3);
@@ -184,25 +168,30 @@ async function sealJWESession(event, config) {
   if (expSeconds) {
     payload.exp = expSeconds;
   }
+  let typ = void 0;
+  if (config.jwe?.encryptOptions?.protectedHeader?.typ && typeof config.jwe.encryptOptions.protectedHeader.typ === "string" && config.jwe.encryptOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
+    typ = config.jwe.encryptOptions.protectedHeader.typ;
+  }
   const token = await encrypt(payload, key, {
     ...config.jwe?.encryptOptions,
+    expiresIn: void 0,
+    // controlled via 'exp' claim
     protectedHeader: {
       ...config.jwe?.encryptOptions?.protectedHeader,
-      typ: "JWT",
+      kid: typeof key === "string" ? void 0 : key.kid,
+      typ: typ || "JWT",
       cty: "application/json"
     }
   });
   return token;
 }
 async function unsealJWESession(_event, config, sealed) {
-  const key = getDecryptKey(config.secret);
-  if (typeof key !== "string" && !isSymmetricJWK(key) && !isPrivateJWK(key)) {
-    throw new Error(
-      "Session: JWE secret must be a password string or a private JWK."
-    );
-  }
+  const key = getDecryptKey(config.key || config.secret);
   const alg = config.jwe?.encryptOptions?.alg;
   const enc = config.jwe?.encryptOptions?.enc;
+  if (config.jwe?.encryptOptions?.protectedHeader?.typ && typeof config.jwe.encryptOptions.protectedHeader.typ === "string" && config.jwe.encryptOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
+    config.jwe.encryptOptions.protectedHeader.typ;
+  }
   const { payload } = await decrypt(sealed, key, {
     ...config.jwe?.decryptOptions,
     requiredClaims: [
@@ -226,12 +215,12 @@ async function unsealJWESession(_event, config, sealed) {
     }
     throw new Error(error_);
   });
-  const { jti, iat, ...data } = payload;
+  const { jti, iat, exp, ...data } = payload;
   return {
     id: jti,
     createdAt: iat * 1e3,
     // Convert back to ms
-    expiresAt: payload.exp ? payload.exp * 1e3 : void 0,
+    expiresAt: exp ? exp * 1e3 : void 0,
     data: data && typeof data === "object" ? data : /* @__PURE__ */ Object.create(null)
   };
 }
@@ -243,32 +232,57 @@ async function clearJWESession(event, config) {
   setCookie(event, sessionName, "", {
     ...DEFAULT_COOKIE$1,
     ...config.cookie,
-    // Optionally set expires in the past
     expires: /* @__PURE__ */ new Date(0),
     maxAge: void 0
   });
-  await config.hooks?.onClear?.(event);
+  await config.hooks?.onClear?.(event, config);
 }
-function getEncryptKey(secret) {
-  if (typeof secret === "string") {
-    return secret;
-  } else if (isSymmetricJWK(secret)) {
-    return secret;
+function getEncryptKey(key) {
+  if (!key) {
+    throw new Error("Session: JWE key is required.");
+  }
+  let _key;
+  if (typeof key === "string") {
+    _key = key;
+  } else if (isSymmetricJWK(key) || isPrivateJWK(key)) {
+    _key = key;
+  } else if ("publicKey" in key && isPublicJWK(key.publicKey)) {
+    _key = key.publicKey;
+  } else if ("privateKey" in key && isPrivateJWK(key.privateKey)) {
+    _key = key.privateKey;
+  }
+  if (!_key) {
+    throw new Error(
+      "Session: Invalid JWE key. It must be a password string or valid JWK.",
+      { cause: key }
+    );
   }
-  return secret.publicKey || secret.privateKey;
+  return _key;
 }
-function getDecryptKey(secret) {
-  if (typeof secret === "string") {
-    return secret;
-  } else if ("privateKey" in secret) {
-    return secret.privateKey;
+function getDecryptKey(key) {
+  if (!key) {
+    throw new Error("Session: JWE key is required.");
+  }
+  let _key = void 0;
+  if (typeof key === "string") {
+    _key = key;
+  } else if (isSymmetricJWK(key)) {
+    _key = key;
+  } else if ("privateKey" in key) {
+    _key = key.privateKey;
+  }
+  if (!_key) {
+    throw new Error(
+      "Session: Invalid JWE key. It must be a password string or a valid private JWK.",
+      { cause: key }
+    );
   }
-  return secret;
+  return _key;
 }
 
 /**
  * This is a fork of h3 library's session utility functions.
- * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/test/session.test.ts
+ * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/src/utils/session.ts
  * @license MIT https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/LICENSE
  */
 const kGetSessionPromise = Symbol("h3_jws_getSession");
@@ -318,22 +332,15 @@ async function getJWSSession(event, config) {
   }
   const existingSession = event.context.sessions[sessionName];
   if (existingSession) {
-    if (existingSession.expiresAt === void 0) {
-      const session2 = existingSession[kGetSessionPromise] || existingSession;
-      await config.hooks?.onRead?.(await session2, event);
-      return session2;
-    } else {
-      if (existingSession.expiresAt < Date.now() && isEvent(event)) {
-        await config.hooks?.onExpire?.(event, void 0);
-        return clearJWSSession(event, config).then(
-          () => getJWSSession(event, config)
-        );
-      } else {
-        const session2 = existingSession[kGetSessionPromise] || existingSession;
-        await config.hooks?.onRead?.(await session2, event);
-        return session2;
-      }
+    const session2 = existingSession[kGetSessionPromise] ? await existingSession[kGetSessionPromise] : existingSession;
+    if (session2.expiresAt !== void 0 && session2.expiresAt < Date.now() && isEvent(event)) {
+      await config.hooks?.onExpire?.(event, void 0, config);
+      return clearJWSSession(event, config).then(
+        () => getJWSSession(event, config)
+      );
     }
+    await config.hooks?.onRead?.(session2, event, config);
+    return session2;
   }
   const session = {
     id: "",
@@ -358,14 +365,11 @@ async function getJWSSession(event, config) {
   }
   if (token) {
     const promise = verifyJWSSession(event, config, token).catch(async (error_) => {
-      if (error_ instanceof Error) {
-        const message = error_.message;
-        if (message.includes("Token has expired") || message.includes("Token is too old")) {
-          await config.hooks?.onExpire?.(event, error_);
-          return void 0;
-        }
+      if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
+        await config.hooks?.onExpire?.(event, error_, config);
+        return void 0;
       }
-      await config.hooks?.onError?.(event, error_);
+      await config.hooks?.onError?.(event, error_, config);
       return void 0;
     }).then((unsealed) => {
       if (unsealed) {
@@ -383,13 +387,12 @@ async function getJWSSession(event, config) {
         "Cannot initialize a new session outside main handler. Use `useJWSSession(event)` properly."
       );
     }
-    session.id = config.generateId?.() ?? (config.crypto || globalThis.crypto).randomUUID();
-    session.createdAt = config.jws?.signOptions?.currentDate === void 0 ? Date.now() : config.jws.signOptions.currentDate.getTime();
+    session.id = config.generateId?.() ?? crypto.randomUUID();
+    session.createdAt = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
     session.expiresAt = config.maxAge ? session.createdAt + config.maxAge * 1e3 : void 0;
-    session.data = /* @__PURE__ */ Object.create(null);
     await updateJWSSession(event, config);
   }
-  await config.hooks?.onRead?.(session, event);
+  await config.hooks?.onRead?.(session, event, config);
   return session;
 }
 function _getReqHeader(event, name) {
@@ -411,7 +414,7 @@ async function updateJWSSession(event, config, update) {
   }
   if (update) {
     Object.assign(session.data, update);
-    await config.hooks?.onUpdate?.(session, event);
+    await config.hooks?.onUpdate?.(session, event, config);
   }
   if (config.cookie !== false) {
     const token = await signJWSSession(event, config);
@@ -425,9 +428,6 @@ async function updateJWSSession(event, config, update) {
 }
 async function signJWSSession(event, config) {
   const key = getSignKey(config.key);
-  if (isAsymmetricJWK(key) && !isPrivateJWK(key)) {
-    throw new Error("Session: JWS key cannot be a public asymmetric JWK.");
-  }
   const sessionName = config.name || DEFAULT_NAME;
   const session = event.context.sessions?.[sessionName] || await getJWSSession(event, config);
   const iatSeconds = Math.floor(session.createdAt / 1e3);
@@ -440,11 +440,19 @@ async function signJWSSession(event, config) {
   if (expSeconds) {
     payload.exp = expSeconds;
   }
+  let typ = void 0;
+  if (config.jws?.signOptions?.protectedHeader?.typ && typeof config.jws.signOptions.protectedHeader.typ === "string" && config.jws.signOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
+    typ = config.jws.signOptions.protectedHeader.typ;
+  }
   const token = await sign(payload, key, {
     ...config.jws?.signOptions,
+    expiresIn: void 0,
+    // controlled via 'exp' claim
     protectedHeader: {
       ...config.jws?.signOptions?.protectedHeader,
-      typ: "JWT"
+      kid: key.kid,
+      typ: typ || "JWT",
+      cty: "application/json"
     }
   });
   return token;
@@ -452,8 +460,9 @@ async function signJWSSession(event, config) {
 async function verifyJWSSession(_event, config, token) {
   const alg = config.jws?.signOptions?.alg;
   const jwk = getVerifyKey(config.key);
-  if (isAsymmetricJWK(jwk) && isPrivateJWK(jwk)) {
-    throw new Error("Session: JWS key cannot be a private asymmetric JWK.");
+  let typ = void 0;
+  if (config.jws?.signOptions?.protectedHeader?.typ && typeof config.jws.signOptions.protectedHeader.typ === "string" && config.jws.signOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
+    typ = config.jws.signOptions.protectedHeader.typ;
   }
   const { payload } = await verify(token, jwk, {
     ...config.jws?.verifyOptions,
@@ -464,7 +473,7 @@ async function verifyJWSSession(_event, config, token) {
       "jti",
       "iat"
     ],
-    typ: "JWT",
+    typ: typ || "JWT",
     algorithms: alg ? [alg] : void 0,
     forceUint8Array: false,
     validateJWT: true
@@ -472,12 +481,12 @@ async function verifyJWSSession(_event, config, token) {
     const message = error_ instanceof Error ? error_.message : String(error_);
     throw new Error(`Invalid session token: ${message}`);
   });
-  const { jti, iat, ...data } = payload;
+  const { jti, iat, exp, ...data } = payload;
   return {
     id: jti,
     createdAt: iat * 1e3,
     // Convert back to ms
-    expiresAt: payload.exp ? payload.exp * 1e3 : void 0,
+    expiresAt: exp ? exp * 1e3 : void 0,
     data: data && typeof data === "object" ? data : /* @__PURE__ */ Object.create(null)
   };
 }
@@ -492,19 +501,48 @@ async function clearJWSSession(event, config) {
     expires: /* @__PURE__ */ new Date(0),
     maxAge: void 0
   });
-  await config.hooks?.onClear?.(event);
+  await config.hooks?.onClear?.(event, config);
 }
 function getSignKey(key) {
-  if ("privateKey" in key) {
-    return key.privateKey;
+  if (!key) {
+    throw new Error("Session: JWS key is required.");
+  }
+  let _key = void 0;
+  if (isSymmetricJWK(key)) {
+    _key = key;
+  } else if ("privateKey" in key && isPrivateJWK(key.privateKey)) {
+    _key = key.privateKey;
   }
-  return key;
+  if (!_key) {
+    throw new Error(
+      "Session: Invalid JWS key. It must be a symmetric JWK or a private JWK.",
+      { cause: key }
+    );
+  }
+  return _key;
 }
 function getVerifyKey(key) {
-  if ("publicKey" in key) {
-    return Array.isArray(key.publicKey) ? { keys: key.publicKey } : key.publicKey;
+  if (!key) {
+    throw new Error("Session: JWS key is required.");
+  }
+  let _key = void 0;
+  if (isSymmetricJWK(key)) {
+    _key = key;
+  } else if ("publicKey" in key && isPublicJWK(key.publicKey)) {
+    _key = key.publicKey;
+  } else if ("publicKey" in key && Array.isArray(key.publicKey)) {
+    const keys = key.publicKey.filter((k) => isPublicJWK(k));
+    if (keys && keys.length > 0) {
+      _key = { keys };
+    }
+  }
+  if (!_key) {
+    throw new Error(
+      "Session: Invalid JWS key. It must be a symmetric JWK or a public JWK/set.",
+      { cause: key }
+    );
   }
-  return key;
+  return _key;
 }
 
 export { clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };

package/dist/adapters/h3v1.d.mts

@@ -0,0 +1,7 @@
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from '../shared/unjwt.9mL1vSFP.mjs';
+export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, w as JWKSet, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, u as JWK_Private, t as JWK_Public, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, r as JWK_Symmetric, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, Z as JWTClaimValidationOptions, X as JWTClaims, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from '../shared/unjwt.CtHrClHc.mjs';
+export { SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWEConfig, SessionJWS, SessionJWSConfig, SessionManager, clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession } from './h3.mjs';
+export { d as deriveJWKFromPassword, e as exportJWKToPEM, g as generateJWK, i as importJWKFromPEM } from '../shared/unjwt.BjP_dGnX.mjs';
+import 'cookie-es';
+import 'h3';
+import '../shared/unjwt.BsLgL0DQ.mjs';

package/dist/adapters/h3v1.mjs

@@ -0,0 +1,7 @@
+export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from '../shared/unjwt.epPK1KFr.mjs';
+export { clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession } from './h3.mjs';
+import '../shared/unjwt.C86hA0o-.mjs';
+import 'h3';
+import 'cookie-es';
+import '../shared/unjwt.CiBEuvtQ.mjs';
+import '../shared/unjwt.D-FATaw1.mjs';

package/dist/adapters/h3v2.d.mts

@@ -0,0 +1,129 @@
+import { b as JWEEncryptOptions } from '../shared/unjwt.9mL1vSFP.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from '../shared/unjwt.9mL1vSFP.mjs';
+import { X as JWTClaims, r as JWK_Symmetric, u as JWK_Private, t as JWK_Public, Z as JWTClaimValidationOptions, w as JWKSet } from '../shared/unjwt.CtHrClHc.mjs';
+export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from '../shared/unjwt.CtHrClHc.mjs';
+import { HTTPEvent } from 'h3';
+import { CookieSerializeOptions } from 'cookie-es';
+import { c as JWSSignOptions } from '../shared/unjwt.BsLgL0DQ.mjs';
+export { d as deriveJWKFromPassword, e as exportJWKToPEM, g as generateJWK, i as importJWKFromPEM } from '../shared/unjwt.BjP_dGnX.mjs';
+
+type SessionDataT$1 = Omit<JWTClaims, "jti" | "iat" | "exp">;
+type SessionData<T extends SessionDataT$1 = SessionDataT$1> = T;
+declare const kGetSessionPromise$1: unique symbol;
+interface SessionJWE<T extends SessionDataT$1 = SessionDataT$1> {
+    id: string;
+    createdAt: number;
+    expiresAt?: number;
+    data: SessionData<T>;
+    [kGetSessionPromise$1]?: Promise<SessionJWE<T>>;
+}
+interface SessionHooksJWE {
+    onRead?: (session: SessionJWE, event: HTTPEvent, config: SessionConfigJWE) => void | Promise<void>;
+    onUpdate?: (session: SessionJWE, event: HTTPEvent, config: SessionConfigJWE) => void | Promise<void>;
+    onClear?: (event: HTTPEvent, config: Partial<SessionConfigJWE>) => void | Promise<void>;
+    onExpire?: (event: HTTPEvent, error: any | undefined, config: SessionConfigJWE) => void | Promise<void>;
+    onError?: (event: HTTPEvent, error: any, config: SessionConfigJWE) => void | Promise<void>;
+}
+interface SessionManager<T extends SessionDataT$1 = SessionDataT$1> {
+    readonly id: string | undefined;
+    readonly createdAt: number;
+    readonly expiresAt: number | undefined;
+    readonly data: SessionData<T>;
+    update: (update: SessionUpdate$1<T>) => Promise<SessionManager<T>>;
+    clear: () => Promise<SessionManager<T>>;
+}
+interface SessionConfigJWE {
+    /** Shared secret used, string for PBES2 or Json Web Key (JWK) */
+    key: string | JWK_Symmetric | {
+        privateKey: JWK_Private | JWK_Symmetric;
+        publicKey?: JWK_Public;
+    };
+    /** Session lifetime in seconds (used to derive exp from iat) */
+    maxAge?: number;
+    /** Default is "h3" */
+    name?: string;
+    /** Default is secure, httpOnly, path="/" */
+    cookie?: false | (CookieSerializeOptions & {
+        chunkMaxLength?: number;
+    });
+    /** Default is x-h3-session / x-{name}-session */
+    sessionHeader?: false | string;
+    /** Default is crypto.randomUUID */
+    generateId?: () => string;
+    /** JWE configuration overrides */
+    jwe?: {
+        encryptOptions?: Omit<JWEEncryptOptions, "expiresIn">;
+        decryptOptions?: JWTClaimValidationOptions;
+    };
+    hooks?: SessionHooksJWE;
+}
+type SessionUpdate$1<T extends SessionDataT$1 = SessionDataT$1> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
+/**
+ * Create a session manager for the current request.
+ */
+declare function useJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: HTTPEvent, config: SessionConfigJWE): Promise<SessionManager<T>>;
+/**
+ * Get the session for the current request.
+ */
+declare function getJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: HTTPEvent, config: SessionConfigJWE): Promise<SessionJWE<T>>;
+/**
+ * Update the session data for the current request.
+ */
+declare function updateJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: HTTPEvent, config: SessionConfigJWE, update?: SessionUpdate$1<T>): Promise<SessionJWE<T>>;
+/**
+ * Produce a JWE for the current session.
+ */
+declare function sealJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: HTTPEvent, config: SessionConfigJWE): Promise<string>;
+/**
+ * Decrypt the JWE and return a Session-compatible object.
+ */
+declare function unsealJWESession(_event: HTTPEvent, config: SessionConfigJWE, sealed: string): Promise<Partial<SessionJWE>>;
+/**
+ * Clear the session (delete from context and drop cookie).
+ */
+declare function clearJWESession(event: HTTPEvent, config: Partial<SessionConfigJWE>): Promise<void>;
+
+type SessionDataT = Omit<JWTClaims, "jti" | "iat" | "exp">;
+declare const kGetSessionPromise: unique symbol;
+interface SessionJWS<T extends SessionDataT = SessionDataT> {
+    id: string;
+    createdAt: number;
+    expiresAt?: number;
+    data: SessionData<T>;
+    [kGetSessionPromise]?: Promise<SessionJWS<T>>;
+}
+interface SessionHooksJWS {
+    onRead?: (session: SessionJWS, event: HTTPEvent, config: SessionConfigJWS) => void | Promise<void>;
+    onUpdate?: (session: SessionJWS, event: HTTPEvent, config: SessionConfigJWS) => void | Promise<void>;
+    onClear?: (event: HTTPEvent, config: Partial<SessionConfigJWS>) => void | Promise<void>;
+    onExpire?: (event: HTTPEvent, error: any | undefined, config: SessionConfigJWS) => void | Promise<void>;
+    onError?: (event: HTTPEvent, error: any, config: SessionConfigJWS) => void | Promise<void>;
+}
+interface SessionConfigJWS {
+    key: JWK_Symmetric | {
+        privateKey: JWK_Private;
+        publicKey: JWK_Public | JWK_Public[] | JWKSet;
+    };
+    maxAge?: number;
+    name?: string;
+    cookie?: false | (CookieSerializeOptions & {
+        chunkMaxLength?: number;
+    });
+    sessionHeader?: false | string;
+    generateId?: () => string;
+    jws?: {
+        signOptions?: Omit<JWSSignOptions, "expiresIn">;
+        verifyOptions?: JWTClaimValidationOptions;
+    };
+    hooks?: SessionHooksJWS;
+}
+type SessionUpdate<T extends SessionDataT = SessionDataT> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
+declare function useJWSSession<T extends SessionDataT = SessionDataT>(event: HTTPEvent, config: SessionConfigJWS): Promise<SessionManager<T>>;
+declare function getJWSSession<T extends SessionDataT = SessionDataT>(event: HTTPEvent, config: SessionConfigJWS): Promise<SessionJWS<T>>;
+declare function updateJWSSession<T extends SessionDataT = SessionDataT>(event: HTTPEvent, config: SessionConfigJWS, update?: SessionUpdate<T>): Promise<SessionJWS<T>>;
+declare function signJWSSession<T extends SessionDataT = SessionDataT>(event: HTTPEvent, config: SessionConfigJWS): Promise<string>;
+declare function verifyJWSSession(_event: HTTPEvent, config: SessionConfigJWS, token: string): Promise<Partial<SessionJWS>>;
+declare function clearJWSSession(event: HTTPEvent, config: Partial<SessionConfigJWS>): Promise<void>;
+
+export { JWEEncryptOptions, JWKSet, JWK_Private, JWK_Public, JWK_Symmetric, JWTClaimValidationOptions, JWTClaims, clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+export type { SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWS, SessionManager };