unjwt 0.5.23 → 0.5.25

package/README.md

@@ -603,18 +603,18 @@ console.log(rsaPublicSpki);
 
 ### Adapters
 
-#### H3 (Nuxt, Nitro)
+#### H3 v1 (Nuxt v4, Nitro v2)
 
-The `h3` adapter bundles session helpers that store data inside signed or encrypted JWTs.
+The `h3v1` adapter bundles session helpers that store data inside signed or encrypted JWTs.
 
 - `useJWESession(event, config)` encrypts the session payload with the provided `secret` (password string or private/symmetric JWK). Use this when session data must remain confidential. (cookie's `httpOnly: true` by default)
 - `useJWSSession(event, config)` signs, but does not encrypt, the session payload with `config.key`. Use this when clients may read the session content but you still need tamper protection. (cookie's `httpOnly: false` by default)
 
-Both helpers expose the same API: read `session.id` / `session.data`, call `session.update()` to patch values, and `session.clear()` to invalidate the cookie. When setting `maxAge`, `exp` claim is automatically managed and validated.
+Both helpers expose the same API: read `session.id` / `session.data`, call `session.update()` to patch values, and `session.clear()` to invalidate the cookie. When setting `maxAge`, `exp` claim is automatically managed and validated. They also support a number of `hooks` in the config for custom logic (e.g. logging, refreshing, etc).
 
 ```ts
 import { defineEventHandler } from "h3";
-import { useJWESession, useJWSSession, generateJWK } from "unjwt/adapters/h3";
+import { useJWESession, useJWSSession, generateJWK } from "unjwt/adapters/h3v1";
 
 const keys = await generateJWK("RS256");
 
@@ -641,6 +641,121 @@ export default defineEventHandler(async (event) => {
 });
 ```
 
+#### H3 v2 (Nuxt v5, Nitro v3)
+
+The `h3v2` adapter bundles session helpers that store data inside signed or encrypted JWTs.
+
+- `useJWESession(event, config)` encrypts the session payload with the provided `secret` (password string or private/symmetric JWK). Use this when session data must remain confidential. (cookie's `httpOnly: true` by default)
+- `useJWSSession(event, config)` signs, but does not encrypt, the session payload with `config.key`. Use this when clients may read the session content but you still need tamper protection. (cookie's `httpOnly: false` by default)
+
+Both helpers expose the same API: read `session.id` / `session.data`, call `session.update()` to patch values, and `session.clear()` to invalidate the cookie. When setting `maxAge`, `exp` claim is automatically managed and validated. They also support a number of `hooks` in the config for custom logic (e.g. logging, refreshing, etc).
+
+```ts
+import { H3, HTTPError, serve } from "h3v2";
+
+import {
+  type SessionConfigJWE,
+  type SessionConfigJWS,
+  useJWESession,
+  useJWSSession,
+  getJWESession,
+  updateJWSSession,
+  generateJWK,
+} from "unjwt/adapters/h3v2";
+
+const atJwk = await generateJWK("RS256");
+
+const jweOptions = {
+  key: "refresh_token_secret",
+  name: "refresh_token",
+} satisfies SessionConfigJWE;
+
+const jwsOptions = {
+  key: atJwk,
+  name: "access_token",
+  maxAge: 15 * 60, // 15 minutes
+  hooks: {
+    async onExpire(event, _error, config) {
+      const refreshSession = await getJWESession(event, jweOptions);
+      if (!refreshSession.data.sub) {
+        // no valid refresh session, nothing to do
+        return;
+      }
+
+      console.log("Access token expired, refreshing...");
+
+      // refresh the access token
+      await updateJWSSession(event, config, {
+        sub: refreshSession.data.sub,
+        scope: refreshSession.data.scope,
+      });
+    },
+  },
+} satisfies SessionConfigJWS;
+
+const app = new H3();
+
+app.post("/login", async (event) => {
+  const refreshSession = await useJWESession(event, jweOptions);
+  const accessSession = await useJWSSession(event, jwsOptions);
+
+  if (accessSession.data.sub) {
+    // user already logged in, return existing info
+    return {
+      accessToken: {
+        id: accessSession.id,
+        createdAt: accessSession.createdAt,
+        expiresAt: accessSession.expiresAt,
+        data: accessSession.data,
+      },
+      refreshSession: {
+        id: refreshSession.id,
+        createdAt: refreshSession.createdAt,
+        expiresAt: refreshSession.expiresAt,
+        data: refreshSession.data,
+      },
+    };
+  }
+
+  const data = (await event.req.json()) as {
+    username?: string;
+    password?: string;
+  };
+
+  if (!data.username || !data.password) {
+    throw new HTTPError("Username and password are required", { status: 400 });
+  }
+
+  // validate user credentials here
+
+  const claims = {
+    sub: data.username,
+    scope: ["read:profile"],
+  };
+
+  await accessSession.update(claims);
+
+  await refreshSession.update(claims);
+
+  return {
+    accessToken: {
+      id: accessSession.id,
+      createdAt: accessSession.createdAt,
+      expiresAt: accessSession.expiresAt,
+      data: accessSession.data,
+    },
+    refreshSession: {
+      id: refreshSession.id,
+      createdAt: refreshSession.createdAt,
+      expiresAt: refreshSession.expiresAt,
+      data: refreshSession.data,
+    },
+  };
+});
+
+serve(app);
+```
+
 ---
 
 ### Utility Functions

package/dist/{h3.d.mts → adapters/h3.d.mts}

@@ -1,11 +1,11 @@
-import { b as JWEEncryptOptions } from './shared/unjwt.9mL1vSFP.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from './shared/unjwt.9mL1vSFP.mjs';
-import { X as JWTClaims, r as JWK_Symmetric, u as JWK_Private, t as JWK_Public, Z as JWTClaimValidationOptions, w as JWKSet } from './shared/unjwt.CtHrClHc.mjs';
-export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './shared/unjwt.CtHrClHc.mjs';
+import { b as JWEEncryptOptions } from '../shared/unjwt.9mL1vSFP.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from '../shared/unjwt.9mL1vSFP.mjs';
+import { X as JWTClaims, r as JWK_Symmetric, u as JWK_Private, t as JWK_Public, Z as JWTClaimValidationOptions, w as JWKSet } from '../shared/unjwt.CtHrClHc.mjs';
+export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from '../shared/unjwt.CtHrClHc.mjs';
 import { CookieSerializeOptions } from 'cookie-es';
 import { H3Event } from 'h3';
-import { c as JWSSignOptions } from './shared/unjwt.BsLgL0DQ.mjs';
-export { d as deriveJWKFromPassword, e as exportJWKToPEM, g as generateJWK, i as importJWKFromPEM } from './shared/unjwt.BjP_dGnX.mjs';
+import { c as JWSSignOptions } from '../shared/unjwt.BsLgL0DQ.mjs';
+export { d as deriveJWKFromPassword, e as exportJWKToPEM, g as generateJWK, i as importJWKFromPEM } from '../shared/unjwt.BjP_dGnX.mjs';
 
 /**
  * This is a fork of h3 library's session utility functions.

package/dist/{h3.mjs → adapters/h3.mjs}

@@ -1,9 +1,9 @@
-export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from './shared/unjwt.epPK1KFr.mjs';
+export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from '../shared/unjwt.epPK1KFr.mjs';
 import { isEvent, setCookie } from 'h3';
 import { parse } from 'cookie-es';
-import { e as encrypt, d as decrypt } from './shared/unjwt.CiBEuvtQ.mjs';
-import { p as isSymmetricJWK, q as isPrivateJWK, u as isPublicJWK } from './shared/unjwt.C86hA0o-.mjs';
-import { s as sign, v as verify } from './shared/unjwt.D-FATaw1.mjs';
+import { e as encrypt, d as decrypt } from '../shared/unjwt.CiBEuvtQ.mjs';
+import { p as isSymmetricJWK, q as isPrivateJWK, u as isPublicJWK } from '../shared/unjwt.C86hA0o-.mjs';
+import { s as sign, v as verify } from '../shared/unjwt.D-FATaw1.mjs';
 
 /**
  * This is a fork of h3 library's session utility functions.
@@ -215,12 +215,12 @@ async function unsealJWESession(_event, config, sealed) {
     }
     throw new Error(error_);
   });
-  const { jti, iat, ...data } = payload;
+  const { jti, iat, exp, ...data } = payload;
   return {
     id: jti,
     createdAt: iat * 1e3,
     // Convert back to ms
-    expiresAt: payload.exp ? payload.exp * 1e3 : void 0,
+    expiresAt: exp ? exp * 1e3 : void 0,
     data: data && typeof data === "object" ? data : /* @__PURE__ */ Object.create(null)
   };
 }
@@ -481,12 +481,12 @@ async function verifyJWSSession(_event, config, token) {
     const message = error_ instanceof Error ? error_.message : String(error_);
     throw new Error(`Invalid session token: ${message}`);
   });
-  const { jti, iat, ...data } = payload;
+  const { jti, iat, exp, ...data } = payload;
   return {
     id: jti,
     createdAt: iat * 1e3,
     // Convert back to ms
-    expiresAt: payload.exp ? payload.exp * 1e3 : void 0,
+    expiresAt: exp ? exp * 1e3 : void 0,
     data: data && typeof data === "object" ? data : /* @__PURE__ */ Object.create(null)
   };
 }

package/dist/adapters/h3v1.d.mts

@@ -0,0 +1,7 @@
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from '../shared/unjwt.9mL1vSFP.mjs';
+export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, w as JWKSet, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, u as JWK_Private, t as JWK_Public, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, r as JWK_Symmetric, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, Z as JWTClaimValidationOptions, X as JWTClaims, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from '../shared/unjwt.CtHrClHc.mjs';
+export { SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWEConfig, SessionJWS, SessionJWSConfig, SessionManager, clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession } from './h3.mjs';
+export { d as deriveJWKFromPassword, e as exportJWKToPEM, g as generateJWK, i as importJWKFromPEM } from '../shared/unjwt.BjP_dGnX.mjs';
+import 'cookie-es';
+import 'h3';
+import '../shared/unjwt.BsLgL0DQ.mjs';

package/dist/adapters/h3v1.mjs

@@ -0,0 +1,7 @@
+export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from '../shared/unjwt.epPK1KFr.mjs';
+export { clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession } from './h3.mjs';
+import '../shared/unjwt.C86hA0o-.mjs';
+import 'h3';
+import 'cookie-es';
+import '../shared/unjwt.CiBEuvtQ.mjs';
+import '../shared/unjwt.D-FATaw1.mjs';

package/dist/adapters/h3v2.d.mts

@@ -0,0 +1,129 @@
+import { b as JWEEncryptOptions } from '../shared/unjwt.9mL1vSFP.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from '../shared/unjwt.9mL1vSFP.mjs';
+import { X as JWTClaims, r as JWK_Symmetric, u as JWK_Private, t as JWK_Public, Z as JWTClaimValidationOptions, w as JWKSet } from '../shared/unjwt.CtHrClHc.mjs';
+export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from '../shared/unjwt.CtHrClHc.mjs';
+import { HTTPEvent } from 'h3';
+import { CookieSerializeOptions } from 'cookie-es';
+import { c as JWSSignOptions } from '../shared/unjwt.BsLgL0DQ.mjs';
+export { d as deriveJWKFromPassword, e as exportJWKToPEM, g as generateJWK, i as importJWKFromPEM } from '../shared/unjwt.BjP_dGnX.mjs';
+
+type SessionDataT$1 = Omit<JWTClaims, "jti" | "iat" | "exp">;
+type SessionData<T extends SessionDataT$1 = SessionDataT$1> = T;
+declare const kGetSessionPromise$1: unique symbol;
+interface SessionJWE<T extends SessionDataT$1 = SessionDataT$1> {
+    id: string;
+    createdAt: number;
+    expiresAt?: number;
+    data: SessionData<T>;
+    [kGetSessionPromise$1]?: Promise<SessionJWE<T>>;
+}
+interface SessionHooksJWE {
+    onRead?: (session: SessionJWE, event: HTTPEvent, config: SessionConfigJWE) => void | Promise<void>;
+    onUpdate?: (session: SessionJWE, event: HTTPEvent, config: SessionConfigJWE) => void | Promise<void>;
+    onClear?: (event: HTTPEvent, config: Partial<SessionConfigJWE>) => void | Promise<void>;
+    onExpire?: (event: HTTPEvent, error: any | undefined, config: SessionConfigJWE) => void | Promise<void>;
+    onError?: (event: HTTPEvent, error: any, config: SessionConfigJWE) => void | Promise<void>;
+}
+interface SessionManager<T extends SessionDataT$1 = SessionDataT$1> {
+    readonly id: string | undefined;
+    readonly createdAt: number;
+    readonly expiresAt: number | undefined;
+    readonly data: SessionData<T>;
+    update: (update: SessionUpdate$1<T>) => Promise<SessionManager<T>>;
+    clear: () => Promise<SessionManager<T>>;
+}
+interface SessionConfigJWE {
+    /** Shared secret used, string for PBES2 or Json Web Key (JWK) */
+    key: string | JWK_Symmetric | {
+        privateKey: JWK_Private | JWK_Symmetric;
+        publicKey?: JWK_Public;
+    };
+    /** Session lifetime in seconds (used to derive exp from iat) */
+    maxAge?: number;
+    /** Default is "h3" */
+    name?: string;
+    /** Default is secure, httpOnly, path="/" */
+    cookie?: false | (CookieSerializeOptions & {
+        chunkMaxLength?: number;
+    });
+    /** Default is x-h3-session / x-{name}-session */
+    sessionHeader?: false | string;
+    /** Default is crypto.randomUUID */
+    generateId?: () => string;
+    /** JWE configuration overrides */
+    jwe?: {
+        encryptOptions?: Omit<JWEEncryptOptions, "expiresIn">;
+        decryptOptions?: JWTClaimValidationOptions;
+    };
+    hooks?: SessionHooksJWE;
+}
+type SessionUpdate$1<T extends SessionDataT$1 = SessionDataT$1> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
+/**
+ * Create a session manager for the current request.
+ */
+declare function useJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: HTTPEvent, config: SessionConfigJWE): Promise<SessionManager<T>>;
+/**
+ * Get the session for the current request.
+ */
+declare function getJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: HTTPEvent, config: SessionConfigJWE): Promise<SessionJWE<T>>;
+/**
+ * Update the session data for the current request.
+ */
+declare function updateJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: HTTPEvent, config: SessionConfigJWE, update?: SessionUpdate$1<T>): Promise<SessionJWE<T>>;
+/**
+ * Produce a JWE for the current session.
+ */
+declare function sealJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: HTTPEvent, config: SessionConfigJWE): Promise<string>;
+/**
+ * Decrypt the JWE and return a Session-compatible object.
+ */
+declare function unsealJWESession(_event: HTTPEvent, config: SessionConfigJWE, sealed: string): Promise<Partial<SessionJWE>>;
+/**
+ * Clear the session (delete from context and drop cookie).
+ */
+declare function clearJWESession(event: HTTPEvent, config: Partial<SessionConfigJWE>): Promise<void>;
+
+type SessionDataT = Omit<JWTClaims, "jti" | "iat" | "exp">;
+declare const kGetSessionPromise: unique symbol;
+interface SessionJWS<T extends SessionDataT = SessionDataT> {
+    id: string;
+    createdAt: number;
+    expiresAt?: number;
+    data: SessionData<T>;
+    [kGetSessionPromise]?: Promise<SessionJWS<T>>;
+}
+interface SessionHooksJWS {
+    onRead?: (session: SessionJWS, event: HTTPEvent, config: SessionConfigJWS) => void | Promise<void>;
+    onUpdate?: (session: SessionJWS, event: HTTPEvent, config: SessionConfigJWS) => void | Promise<void>;
+    onClear?: (event: HTTPEvent, config: Partial<SessionConfigJWS>) => void | Promise<void>;
+    onExpire?: (event: HTTPEvent, error: any | undefined, config: SessionConfigJWS) => void | Promise<void>;
+    onError?: (event: HTTPEvent, error: any, config: SessionConfigJWS) => void | Promise<void>;
+}
+interface SessionConfigJWS {
+    key: JWK_Symmetric | {
+        privateKey: JWK_Private;
+        publicKey: JWK_Public | JWK_Public[] | JWKSet;
+    };
+    maxAge?: number;
+    name?: string;
+    cookie?: false | (CookieSerializeOptions & {
+        chunkMaxLength?: number;
+    });
+    sessionHeader?: false | string;
+    generateId?: () => string;
+    jws?: {
+        signOptions?: Omit<JWSSignOptions, "expiresIn">;
+        verifyOptions?: JWTClaimValidationOptions;
+    };
+    hooks?: SessionHooksJWS;
+}
+type SessionUpdate<T extends SessionDataT = SessionDataT> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
+declare function useJWSSession<T extends SessionDataT = SessionDataT>(event: HTTPEvent, config: SessionConfigJWS): Promise<SessionManager<T>>;
+declare function getJWSSession<T extends SessionDataT = SessionDataT>(event: HTTPEvent, config: SessionConfigJWS): Promise<SessionJWS<T>>;
+declare function updateJWSSession<T extends SessionDataT = SessionDataT>(event: HTTPEvent, config: SessionConfigJWS, update?: SessionUpdate<T>): Promise<SessionJWS<T>>;
+declare function signJWSSession<T extends SessionDataT = SessionDataT>(event: HTTPEvent, config: SessionConfigJWS): Promise<string>;
+declare function verifyJWSSession(_event: HTTPEvent, config: SessionConfigJWS, token: string): Promise<Partial<SessionJWS>>;
+declare function clearJWSSession(event: HTTPEvent, config: Partial<SessionConfigJWS>): Promise<void>;
+
+export { JWEEncryptOptions, JWKSet, JWK_Private, JWK_Public, JWK_Symmetric, JWTClaimValidationOptions, JWTClaims, clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+export type { SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWS, SessionManager };

package/dist/adapters/h3v2.mjs

@@ -0,0 +1,522 @@
+export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from '../shared/unjwt.epPK1KFr.mjs';
+import { getEventContext, getChunkedCookie, setChunkedCookie } from 'h3';
+import { NullProtoObj } from 'rou3';
+import { e as encrypt, d as decrypt } from '../shared/unjwt.CiBEuvtQ.mjs';
+import { p as isSymmetricJWK, q as isPrivateJWK, u as isPublicJWK } from '../shared/unjwt.C86hA0o-.mjs';
+import { s as sign, v as verify } from '../shared/unjwt.D-FATaw1.mjs';
+
+const kGetSessionPromise$1 = Symbol("h3_jwe_getSession");
+const DEFAULT_NAME$1 = "h3-jwe";
+const DEFAULT_COOKIE$1 = {
+  path: "/",
+  secure: true,
+  httpOnly: true
+};
+async function useJWESession(event, config) {
+  const sessionName = config.name || DEFAULT_NAME$1;
+  await getJWESession(event, config);
+  const sessionManager = {
+    get id() {
+      return getSessionFromContext$1(event, sessionName)?.id;
+    },
+    get createdAt() {
+      return getSessionFromContext$1(event, sessionName)?.createdAt ?? Date.now();
+    },
+    get expiresAt() {
+      return getSessionFromContext$1(event, sessionName)?.expiresAt;
+    },
+    get data() {
+      return getSessionFromContext$1(event, sessionName)?.data || {};
+    },
+    update: async (update) => {
+      await updateJWESession(event, config, update);
+      return sessionManager;
+    },
+    clear: async () => {
+      await clearJWESession(event, config);
+      return sessionManager;
+    }
+  };
+  return sessionManager;
+}
+async function getJWESession(event, config) {
+  const sessionName = config.name || DEFAULT_NAME$1;
+  const context = getEventContext(event);
+  if (!context.sessions) {
+    context.sessions = new NullProtoObj();
+  }
+  const existingSession = context.sessions[sessionName];
+  if (existingSession) {
+    const session2 = existingSession[kGetSessionPromise$1] ? await existingSession[kGetSessionPromise$1] : existingSession;
+    if (session2.expiresAt !== void 0 && session2.expiresAt < Date.now() && hasWritableResponse$1(event)) {
+      await config.hooks?.onExpire?.(event, void 0, config);
+      return clearJWESession(event, config).then(
+        () => getJWESession(event, config)
+      );
+    }
+    await config.hooks?.onRead?.(session2, event, config);
+    return session2;
+  }
+  const session = {
+    id: "",
+    createdAt: 0,
+    expiresAt: void 0,
+    data: new NullProtoObj()
+  };
+  context.sessions[sessionName] = session;
+  let jweToken;
+  if (config.sessionHeader !== false) {
+    const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
+    const headerValue = event.req.headers.get(headerName);
+    if (typeof headerValue === "string") {
+      jweToken = headerValue;
+    }
+  }
+  if (!jweToken) {
+    jweToken = getChunkedCookie(event, sessionName);
+  }
+  if (jweToken) {
+    const promise = unsealJWESession(event, config, jweToken).catch(async (error_) => {
+      if (error_ instanceof Error) {
+        const message = error_.message;
+        if (message.includes("Token has expired") || message.includes("Token is too old")) {
+          await config.hooks?.onExpire?.(event, error_, config);
+          return void 0;
+        }
+      }
+      await config.hooks?.onError?.(event, error_, config);
+      return void 0;
+    }).then((unsealed) => {
+      if (unsealed) {
+        Object.assign(session, unsealed);
+      }
+      delete session[kGetSessionPromise$1];
+      return session;
+    });
+    session[kGetSessionPromise$1] = promise;
+    await promise;
+  }
+  if (!session.id) {
+    session.id = config.generateId?.() ?? crypto.randomUUID();
+    session.createdAt = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
+    session.expiresAt = config.maxAge ? session.createdAt + config.maxAge * 1e3 : void 0;
+    await updateJWESession(event, config);
+  }
+  await config.hooks?.onRead?.(session, event, config);
+  return session;
+}
+async function updateJWESession(event, config, update) {
+  const sessionName = config.name || DEFAULT_NAME$1;
+  const context = getEventContext(event);
+  const session = context.sessions?.[sessionName] || await getJWESession(event, config);
+  if (typeof update === "function") {
+    update = update(session.data);
+  }
+  if (update) {
+    Object.assign(session.data, update);
+    await config.hooks?.onUpdate?.(session, event, config);
+  }
+  if (config.cookie !== false && hasWritableResponse$1(event)) {
+    const sealed = await sealJWESession(event, config);
+    setChunkedCookie(event, sessionName, sealed, {
+      ...DEFAULT_COOKIE$1,
+      expires: config.maxAge ? new Date(session.createdAt + config.maxAge * 1e3) : void 0,
+      ...config.cookie
+    });
+  }
+  return session;
+}
+async function sealJWESession(event, config) {
+  const key = getEncryptKey(config.key);
+  const sessionName = config.name || DEFAULT_NAME$1;
+  const context = getEventContext(event);
+  const session = context.sessions?.[sessionName] || await getJWESession(event, config);
+  const iatSeconds = Math.floor(session.createdAt / 1e3);
+  const expSeconds = config.maxAge == null ? void 0 : iatSeconds + config.maxAge;
+  const payload = {
+    ...session.data,
+    jti: session.id,
+    iat: iatSeconds
+  };
+  if (expSeconds) {
+    payload.exp = expSeconds;
+  }
+  let typ = void 0;
+  if (config.jwe?.encryptOptions?.protectedHeader?.typ && typeof config.jwe.encryptOptions.protectedHeader.typ === "string" && config.jwe.encryptOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
+    typ = config.jwe.encryptOptions.protectedHeader.typ;
+  }
+  const token = await encrypt(payload, key, {
+    ...config.jwe?.encryptOptions,
+    expiresIn: void 0,
+    // controlled via 'exp' claim
+    protectedHeader: {
+      ...config.jwe?.encryptOptions?.protectedHeader,
+      typ: typ || "JWT",
+      cty: "application/json"
+    }
+  });
+  return token;
+}
+async function unsealJWESession(_event, config, sealed) {
+  const key = getDecryptKey(config.key);
+  const alg = config.jwe?.encryptOptions?.alg;
+  const enc = config.jwe?.encryptOptions?.enc;
+  if (config.jwe?.encryptOptions?.protectedHeader?.typ && typeof config.jwe.encryptOptions.protectedHeader.typ === "string" && config.jwe.encryptOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
+    config.jwe.encryptOptions.protectedHeader.typ;
+  }
+  const { payload } = await decrypt(sealed, key, {
+    ...config.jwe?.decryptOptions,
+    requiredClaims: [
+      ...config.jwe?.decryptOptions?.requiredClaims?.filter(
+        (claim) => claim !== "jti" && claim !== "iat"
+      ) || [],
+      "jti",
+      "iat"
+    ],
+    maxTokenAge: config.maxAge,
+    algorithms: alg ? [alg] : void 0,
+    encryptionAlgorithms: enc ? [enc] : void 0,
+    unwrappedKeyAlgorithm: void 0,
+    keyUsage: void 0,
+    forceUint8Array: false,
+    validateJWT: true
+  }).catch((error_) => {
+    if (error_ instanceof Error) {
+      throw error_;
+    }
+    throw new Error(String(error_));
+  });
+  const { jti, iat, exp, ...data } = payload;
+  return {
+    id: jti,
+    createdAt: iat * 1e3,
+    expiresAt: exp ? exp * 1e3 : void 0,
+    data: data && typeof data === "object" ? data : new NullProtoObj()
+  };
+}
+async function clearJWESession(event, config) {
+  const context = getEventContext(event);
+  const sessionName = config.name || DEFAULT_NAME$1;
+  if (context.sessions?.[sessionName]) {
+    delete context.sessions[sessionName];
+  }
+  if (config.cookie !== false && hasWritableResponse$1(event)) {
+    setChunkedCookie(event, sessionName, "", {
+      ...DEFAULT_COOKIE$1,
+      ...config.cookie,
+      expires: /* @__PURE__ */ new Date(0),
+      maxAge: void 0
+    });
+    await config.hooks?.onClear?.(event, config);
+  }
+}
+function getSessionFromContext$1(event, sessionName) {
+  const context = getEventContext(event);
+  return context.sessions?.[sessionName];
+}
+function hasWritableResponse$1(event) {
+  return Boolean(event.res);
+}
+function getEncryptKey(key) {
+  if (!key) {
+    throw new Error("Session: JWE key is required.");
+  }
+  let _key;
+  if (typeof key === "string") {
+    _key = key;
+  } else if (isSymmetricJWK(key) || isPrivateJWK(key)) {
+    _key = key;
+  } else if ("publicKey" in key && isPublicJWK(key.publicKey)) {
+    _key = key.publicKey;
+  } else if ("privateKey" in key && isPrivateJWK(key.privateKey)) {
+    _key = key.privateKey;
+  }
+  if (!_key) {
+    throw new Error(
+      "Session: Invalid JWE key. It must be a password string or valid JWK.",
+      { cause: key }
+    );
+  }
+  return _key;
+}
+function getDecryptKey(key) {
+  if (!key) {
+    throw new Error("Session: JWE key is required.");
+  }
+  let _key = void 0;
+  if (typeof key === "string") {
+    _key = key;
+  } else if (isSymmetricJWK(key)) {
+    _key = key;
+  } else if ("privateKey" in key) {
+    _key = key.privateKey;
+  }
+  if (!_key) {
+    throw new Error(
+      "Session: Invalid JWE key. It must be a password string or a valid private JWK.",
+      { cause: key }
+    );
+  }
+  return _key;
+}
+
+const kGetSessionPromise = Symbol("h3_jws_getSession");
+const DEFAULT_NAME = "h3-jws";
+const DEFAULT_COOKIE = {
+  path: "/",
+  secure: true,
+  httpOnly: false
+};
+async function useJWSSession(event, config) {
+  const sessionName = config.name || DEFAULT_NAME;
+  await getJWSSession(event, config);
+  const sessionManager = {
+    get id() {
+      return getSessionFromContext(event, sessionName)?.id;
+    },
+    get createdAt() {
+      return getSessionFromContext(event, sessionName)?.createdAt ?? Date.now();
+    },
+    get expiresAt() {
+      return getSessionFromContext(event, sessionName)?.expiresAt;
+    },
+    get data() {
+      return getSessionFromContext(event, sessionName)?.data || {};
+    },
+    update: async (update) => {
+      await updateJWSSession(event, config, update);
+      return sessionManager;
+    },
+    clear: async () => {
+      await clearJWSSession(event, config);
+      return sessionManager;
+    }
+  };
+  return sessionManager;
+}
+async function getJWSSession(event, config) {
+  const sessionName = config.name || DEFAULT_NAME;
+  const context = getEventContext(event);
+  if (!context.sessions) {
+    context.sessions = new NullProtoObj();
+  }
+  const existingSession = context.sessions[sessionName];
+  if (existingSession) {
+    const session2 = existingSession[kGetSessionPromise] ? await existingSession[kGetSessionPromise] : existingSession;
+    if (session2.expiresAt !== void 0 && session2.expiresAt < Date.now() && hasWritableResponse(event)) {
+      await config.hooks?.onExpire?.(event, void 0, config);
+      return clearJWSSession(event, config).then(
+        () => getJWSSession(event, config)
+      );
+    }
+    await config.hooks?.onRead?.(session2, event, config);
+    return session2;
+  }
+  const session = {
+    id: "",
+    createdAt: 0,
+    expiresAt: void 0,
+    data: new NullProtoObj()
+  };
+  context.sessions[sessionName] = session;
+  let token;
+  if (config.sessionHeader !== false) {
+    const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
+    const headerValue = event.req.headers.get(headerName);
+    if (typeof headerValue === "string") {
+      token = headerValue;
+    }
+  }
+  if (!token) {
+    token = getChunkedCookie(event, sessionName);
+  }
+  if (token) {
+    const promise = verifyJWSSession(event, config, token).catch(async (error_) => {
+      if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
+        await config.hooks?.onExpire?.(event, error_, config);
+        return void 0;
+      }
+      await config.hooks?.onError?.(event, error_, config);
+      return void 0;
+    }).then((unsealed) => {
+      if (unsealed) {
+        Object.assign(session, unsealed);
+      }
+      delete session[kGetSessionPromise];
+      return session;
+    });
+    session[kGetSessionPromise] = promise;
+    await promise;
+  }
+  if (!session.id) {
+    session.id = config.generateId?.() ?? crypto.randomUUID();
+    session.createdAt = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
+    session.expiresAt = config.maxAge ? session.createdAt + config.maxAge * 1e3 : void 0;
+    await updateJWSSession(event, config);
+  }
+  await config.hooks?.onRead?.(session, event, config);
+  return session;
+}
+async function updateJWSSession(event, config, update) {
+  const sessionName = config.name || DEFAULT_NAME;
+  const context = getEventContext(event);
+  const session = context.sessions?.[sessionName] || await getJWSSession(event, config);
+  if (typeof update === "function") {
+    update = update(session.data);
+  }
+  if (update) {
+    Object.assign(session.data, update);
+    await config.hooks?.onUpdate?.(session, event, config);
+  }
+  if (config.cookie !== false && hasWritableResponse(event)) {
+    const token = await signJWSSession(event, config);
+    setChunkedCookie(event, sessionName, token, {
+      ...DEFAULT_COOKIE,
+      expires: config.maxAge ? new Date(session.createdAt + config.maxAge * 1e3) : void 0,
+      ...config.cookie
+    });
+  }
+  return session;
+}
+async function signJWSSession(event, config) {
+  const key = getSignKey(config.key);
+  const sessionName = config.name || DEFAULT_NAME;
+  const context = getEventContext(event);
+  const session = context.sessions?.[sessionName] || await getJWSSession(event, config);
+  const iatSeconds = Math.floor(session.createdAt / 1e3);
+  const expSeconds = config.maxAge == null ? void 0 : iatSeconds + config.maxAge;
+  const payload = {
+    ...session.data,
+    jti: session.id,
+    iat: iatSeconds
+  };
+  if (expSeconds) {
+    payload.exp = expSeconds;
+  }
+  let typ;
+  if (config.jws?.signOptions?.protectedHeader?.typ && typeof config.jws.signOptions.protectedHeader.typ === "string" && config.jws.signOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
+    typ = config.jws.signOptions.protectedHeader.typ;
+  }
+  const token = await sign(payload, key, {
+    ...config.jws?.signOptions,
+    expiresIn: void 0,
+    // controlled via 'exp' claim
+    protectedHeader: {
+      ...config.jws?.signOptions?.protectedHeader,
+      kid: "kid" in key ? key.kid : void 0,
+      typ: typ || "JWT",
+      cty: "application/json"
+    }
+  });
+  return token;
+}
+async function verifyJWSSession(_event, config, token) {
+  const jwk = getVerifyKey(config.key);
+  const alg = config.jws?.signOptions?.alg;
+  let typ;
+  if (config.jws?.signOptions?.protectedHeader?.typ && typeof config.jws.signOptions.protectedHeader.typ === "string" && config.jws.signOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
+    typ = config.jws.signOptions.protectedHeader.typ;
+  }
+  const { payload } = await verify(token, jwk, {
+    ...config.jws?.verifyOptions,
+    requiredClaims: [
+      ...config.jws?.verifyOptions?.requiredClaims?.filter(
+        (claim) => claim !== "jti" && claim !== "iat"
+      ) || [],
+      "jti",
+      "iat"
+    ],
+    typ: typ || "JWT",
+    algorithms: alg ? [alg] : void 0,
+    forceUint8Array: false,
+    validateJWT: true
+  }).catch((error_) => {
+    const message = error_ instanceof Error ? error_.message : String(error_);
+    throw new Error(`Invalid session token: ${message}`);
+  });
+  const { jti, iat, exp, ...data } = payload;
+  return {
+    id: jti,
+    createdAt: iat * 1e3,
+    expiresAt: exp ? exp * 1e3 : void 0,
+    data: data && typeof data === "object" ? data : new NullProtoObj()
+  };
+}
+async function clearJWSSession(event, config) {
+  const context = getEventContext(event);
+  const sessionName = config.name || DEFAULT_NAME;
+  if (context.sessions?.[sessionName]) {
+    delete context.sessions[sessionName];
+  }
+  if (config.cookie !== false && hasWritableResponse(event)) {
+    setChunkedCookie(event, sessionName, "", {
+      ...DEFAULT_COOKIE,
+      ...config.cookie,
+      expires: /* @__PURE__ */ new Date(0),
+      maxAge: void 0
+    });
+    await config.hooks?.onClear?.(event, config);
+  }
+}
+function getSessionFromContext(event, sessionName) {
+  const context = getEventContext(event);
+  return context.sessions?.[sessionName];
+}
+function hasWritableResponse(event) {
+  return Boolean(event.res);
+}
+function getSignKey(key) {
+  if (!key) {
+    throw new Error("Session: JWS key is required.");
+  }
+  let _key;
+  if (isSymmetricJWK(key)) {
+    _key = key;
+  } else if ("privateKey" in key && isPrivateJWK(key.privateKey)) {
+    _key = key.privateKey;
+  }
+  if (!_key) {
+    throw new Error(
+      "Session: Invalid JWS key. It must be a symmetric JWK or a private JWK.",
+      { cause: key }
+    );
+  }
+  return _key;
+}
+function getVerifyKey(key) {
+  if (!key) {
+    throw new Error("Session: JWS key is required.");
+  }
+  let _key;
+  if (isSymmetricJWK(key)) {
+    _key = key;
+  } else if ("publicKey" in key) {
+    const publicKey = key.publicKey;
+    if (isPublicJWK(publicKey)) {
+      _key = publicKey;
+    } else if (Array.isArray(publicKey)) {
+      const keys = publicKey.filter(
+        (candidate) => isPublicJWK(candidate)
+      );
+      if (keys.length > 0) {
+        _key = { keys };
+      }
+    } else if (publicKey && typeof publicKey === "object" && Array.isArray(publicKey.keys)) {
+      const keys = publicKey.keys.filter(
+        (candidate) => isPublicJWK(candidate)
+      );
+      if (keys.length > 0) {
+        _key = { keys };
+      }
+    }
+  }
+  if (!_key) {
+    throw new Error(
+      "Session: Invalid JWS key. It must be a symmetric JWK or a public JWK/set.",
+      { cause: key }
+    );
+  }
+  return _key;
+}
+
+export { clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.23",
+  "version": "0.5.25",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",
@@ -31,9 +31,17 @@
       "types": "./dist/utils.d.mts",
       "default": "./dist/utils.mjs"
     },
-    "./h3": {
-      "types": "./dist/h3.d.mts",
-      "default": "./dist/h3.mjs"
+    "./adapters/h3": {
+      "types": "./dist/adapters/h3.d.mts",
+      "default": "./dist/adapters/h3.mjs"
+    },
+    "./adapters/h3v1": {
+      "types": "./dist/adapters/h3v1.d.mts",
+      "default": "./dist/adapters/h3v1.mjs"
+    },
+    "./adapters/h3v2": {
+      "types": "./dist/adapters/h3v2.d.mts",
+      "default": "./dist/adapters/h3v2.mjs"
     }
   },
   "main": "./dist/index.mjs",
@@ -60,8 +68,12 @@
     "@vitest/coverage-v8": "^3.2.4",
     "automd": "^0.4.2",
     "changelogen": "^0.6.2",
+    "cookie-esv1": "npm:cookie-es@^1.2.2",
+    "cookie-esv2": "npm:cookie-es@^2.0.0",
     "eslint": "^9.36.0",
     "eslint-config-unjs": "^0.5.0",
+    "h3v1": "npm:h3@^1.15.4",
+    "h3v2": "npm:h3@^2.0.1-rc.2",
     "jose": "^6.1.0",
     "prettier": "^3.6.2",
     "supertest": "^7.1.4",
@@ -71,7 +83,8 @@
   },
   "peerDependencies": {
     "cookie-es": "^1.2.2 || ^2.0.0",
-    "h3": "^1.15.4 || ^2.0.0-rc.0 || ^2.0.0"
+    "h3": "^1.15.4 || >=2.0.1-rc.2 || ^2.0.1",
+    "rou3": "^0.7.7"
   },
   "peerDependenciesMeta": {
     "cookie-es": {
@@ -81,5 +94,5 @@
       "optional": true
     }
   },
-  "packageManager": "pnpm@10.17.1"
+  "packageManager": "pnpm@10.18.3"
 }