unjwt 0.5.25 → 0.5.27

package/README.md

@@ -15,7 +15,8 @@ A collection of low-level JWT ([RFC 7519](https://datatracker.ietf.org/doc/html/
 - **JWK (JSON Web Key, [RFC 7517](https://datatracker.ietf.org/doc/html/rfc7517))**: generate, import, export, wrap, and unwrap keys in JWK format or as `CryptoKey` objects.
 
 - **Adapters** for popular frameworks (PRs welcome for more!):
-  - [H3 (Nuxt, Nitro)](./src/adapters/h3.ts): `useJWSSession()`, `useJWESession()`
+  - [H3 v1 (Nuxt v4, Nitro v2)](./src/adapters/h3v1/): `useJWSSession()`, `useJWESession()`
+  - [H3 v2 (Nuxt v5, Nitro v3)](./src/adapters/h3v2/): `useJWSSession()`, `useJWESession()`
 
 ## Table of Contents
 
@@ -25,7 +26,8 @@ A collection of low-level JWT ([RFC 7519](https://datatracker.ietf.org/doc/html/
   - [JWK](#jwk-json-web-key-rfc-7517)
   - [Utility Functions](#utility-functions)
   - [Adapters](#adapters)
-    - [H3 (Nuxt, Nitro)](#h3-nuxt-nitro)
+    - [H3 v1 (Nuxt up to v4, Nitro up to v2)](#h3-v1-nuxt-v4-nitro-v2)
+    - [H3 v2 (Nuxt v5, Nitro v3)](#h3-v2-nuxt-v5-nitro-v3)
 - [Development](#development)
 - [Credits](#credits)
 - [License](#license)
@@ -616,7 +618,7 @@ Both helpers expose the same API: read `session.id` / `session.data`, call `sess
 import { defineEventHandler } from "h3";
 import { useJWESession, useJWSSession, generateJWK } from "unjwt/adapters/h3v1";
 
-const keys = await generateJWK("RS256");
+const keys = await generateJWK("RS256"); // Make sure to persist these keys somewhere!
 
 export default defineEventHandler(async (event) => {
   const privateSession = await useJWESession(event, {
@@ -663,7 +665,7 @@ import {
   generateJWK,
 } from "unjwt/adapters/h3v2";
 
-const atJwk = await generateJWK("RS256");
+const atJwk = await generateJWK("RS256"); // Make sure to persist these keys somewhere!
 
 const jweOptions = {
   key: "refresh_token_secret",
@@ -675,7 +677,7 @@ const jwsOptions = {
   name: "access_token",
   maxAge: 15 * 60, // 15 minutes
   hooks: {
-    async onExpire(event, _error, config) {
+    async onExpire({ event, config }) {
       const refreshSession = await getJWESession(event, jweOptions);
       if (!refreshSession.data.sub) {
         // no valid refresh session, nothing to do

package/dist/adapters/h3.d.mts

@@ -7,38 +7,62 @@ import { H3Event } from 'h3';
 import { c as JWSSignOptions } from '../shared/unjwt.BsLgL0DQ.mjs';
 export { d as deriveJWKFromPassword, e as exportJWKToPEM, g as generateJWK, i as importJWKFromPEM } from '../shared/unjwt.BjP_dGnX.mjs';
 
+type SessionData<T extends JWTClaims = JWTClaims> = Omit<T, "jti" | "iat" | "exp">;
+type SessionUpdate<T extends JWTClaims = JWTClaims> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
+interface SessionManager<T extends JWTClaims = JWTClaims, ConfigMaxAge extends number | undefined = number | undefined> {
+    readonly id: string | undefined;
+    readonly createdAt: number;
+    readonly expiresAt: T extends {
+        exp: number;
+    } ? number : ConfigMaxAge;
+    readonly data: SessionData<T>;
+    update: (update: SessionUpdate<T>) => Promise<SessionManager<T>>;
+    clear: () => Promise<SessionManager<T>>;
+}
+
 /**
  * This is a fork of h3 library's session utility functions.
  * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/src/utils/session.ts
  * @license MIT https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/LICENSE
  */
 
-type SessionDataT$1 = Omit<JWTClaims, "jti" | "iat" | "exp">;
-type SessionData<T extends SessionDataT$1 = SessionDataT$1> = T;
 declare const kGetSessionPromise$1: unique symbol;
-interface SessionJWE<T extends SessionDataT$1 = SessionDataT$1> {
+interface SessionJWE<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined> {
     id: string;
     createdAt: number;
-    expiresAt?: number;
+    expiresAt: T extends {
+        exp: number;
+    } ? number : MaxAge;
     data: SessionData<T>;
-    [kGetSessionPromise$1]?: Promise<SessionJWE<T>>;
+    [kGetSessionPromise$1]?: Promise<SessionJWE<T, MaxAge>>;
 }
-interface SessionHooksJWE {
-    onRead?: (session: SessionJWE, event: H3Event, config: SessionConfigJWE) => void | Promise<void>;
-    onUpdate?: (session: SessionJWE, event: H3Event, config: SessionConfigJWE) => void | Promise<void>;
-    onClear?: (event: H3Event, config: Partial<SessionConfigJWE>) => void | Promise<void>;
-    onExpire?: (event: H3Event, error: any | undefined, config: SessionConfigJWE) => void | Promise<void>;
-    onError?: (event: H3Event, error: any, config: SessionConfigJWE) => void | Promise<void>;
-}
-interface SessionManager<T extends SessionDataT$1 = SessionDataT$1> {
-    readonly id: string | undefined;
-    readonly createdAt: number;
-    readonly expiresAt: number | undefined;
-    readonly data: SessionData<T>;
-    update: (update: SessionUpdate$1<T>) => Promise<SessionManager<T>>;
-    clear: () => Promise<SessionManager<T>>;
+interface SessionHooksJWE<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined> {
+    onRead?: (args: {
+        session: SessionJWE<T, MaxAge>;
+        event: H3Event;
+        config: SessionConfigJWE<T, MaxAge>;
+    }) => void | Promise<void>;
+    onUpdate?: (args: {
+        session: SessionJWE<T, MaxAge>;
+        event: H3Event;
+        config: SessionConfigJWE<T, MaxAge>;
+    }) => void | Promise<void>;
+    onClear?: (args: {
+        event: H3Event;
+        config: Partial<SessionConfigJWE<T, MaxAge>>;
+    }) => void | Promise<void>;
+    onExpire?: (args: {
+        event: H3Event;
+        error: Error;
+        config: SessionConfigJWE<T, MaxAge>;
+    }) => void | Promise<void>;
+    onError?: (args: {
+        event: H3Event;
+        error: any;
+        config: SessionConfigJWE<T, MaxAge>;
+    }) => void | Promise<void>;
 }
-interface SessionConfigJWE {
+interface SessionConfigJWE<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined> {
     /** @deprecated use `key` instead */
     secret?: string | JWK_Symmetric | {
         privateKey: JWK_Private | JWK_Symmetric;
@@ -50,7 +74,7 @@ interface SessionConfigJWE {
         publicKey?: JWK_Public;
     };
     /** Session lifetime in seconds (used to derive exp from iat) */
-    maxAge?: number;
+    maxAge?: MaxAge;
     /** Default is "h3" */
     name?: string;
     /** Default is secure, httpOnly, path="/" */
@@ -64,7 +88,7 @@ interface SessionConfigJWE {
         encryptOptions?: Omit<JWEEncryptOptions, "expiresIn">;
         decryptOptions?: JWTClaimValidationOptions;
     };
-    hooks?: SessionHooksJWE;
+    hooks?: SessionHooksJWE<T, MaxAge>;
 }
 /**
  * @deprecated use `SessionConfigJWE` instead
@@ -79,19 +103,18 @@ type CompatEvent$1 = {
     headers: Headers;
     context: any;
 };
-type SessionUpdate$1<T extends SessionDataT$1 = SessionDataT$1> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
 /**
  * Create a session manager for the current request.
  */
-declare function useJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: H3Event | CompatEvent$1, config: SessionConfigJWE): Promise<SessionManager<T>>;
+declare function useJWESession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
 /**
  * Get (and lazily initialize) the session for the current request.
  */
-declare function getJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: H3Event | CompatEvent$1, config: SessionConfigJWE): Promise<SessionJWE<T>>;
+declare function getJWESession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<SessionJWE<T, MaxAge>>;
 /**
  * Update the session (optionally mutating the session data) and re-issue the JWE token.
  */
-declare function updateJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: H3Event, config: SessionConfigJWE, update?: SessionUpdate$1<T>): Promise<SessionJWE<T>>;
+declare function updateJWESession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: H3Event, config: SessionConfigJWE<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWE<T, MaxAge>>;
 /**
  * Produce a JWE for the current session.
  * Payload structure:
@@ -102,15 +125,15 @@ declare function updateJWESession<T extends SessionDataT$1 = SessionDataT$1>(eve
  *   data: Record<string, any>;
  * }
  */
-declare function sealJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: H3Event | CompatEvent$1, config: SessionConfigJWE): Promise<string>;
+declare function sealJWESession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<string>;
 /**
  * Decrypt the JWE and return a Session-compatible object.
  */
-declare function unsealJWESession(_event: H3Event | CompatEvent$1, config: SessionConfigJWE, sealed: string): Promise<Partial<SessionJWE>>;
+declare function unsealJWESession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(_event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>, sealed: string): Promise<Partial<SessionJWE<T, MaxAge>>>;
 /**
  * Clear the session (delete from context and drop cookie).
  */
-declare function clearJWESession(event: H3Event, config: Partial<SessionConfigJWE>): Promise<void>;
+declare function clearJWESession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: H3Event, config: Partial<SessionConfigJWE<T, MaxAge>>): Promise<void>;
 
 /**
  * This is a fork of h3 library's session utility functions.
@@ -118,23 +141,43 @@ declare function clearJWESession(event: H3Event, config: Partial<SessionConfigJW
  * @license MIT https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/LICENSE
  */
 
-type SessionDataT = Omit<JWTClaims, "jti" | "iat" | "exp">;
 declare const kGetSessionPromise: unique symbol;
-interface SessionJWS<T extends SessionDataT = SessionDataT> {
+interface SessionJWS<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined> {
     id: string;
     createdAt: number;
-    expiresAt?: number;
+    expiresAt: T extends {
+        exp: number;
+    } ? number : MaxAge;
     data: SessionData<T>;
-    [kGetSessionPromise]?: Promise<SessionJWS<T>>;
+    [kGetSessionPromise]?: Promise<SessionJWS<T, MaxAge>>;
 }
-interface SessionHooksJWS {
-    onRead?: (session: SessionJWS, event: H3Event, config: SessionConfigJWS) => void | Promise<void>;
-    onUpdate?: (session: SessionJWS, event: H3Event, config: SessionConfigJWS) => void | Promise<void>;
-    onClear?: (event: H3Event, config: Partial<SessionConfigJWS>) => void | Promise<void>;
-    onExpire?: (event: H3Event, error: any | undefined, config: SessionConfigJWS) => void | Promise<void>;
-    onError?: (event: H3Event, error: any, config: SessionConfigJWS) => void | Promise<void>;
+interface SessionHooksJWS<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined> {
+    onRead?: (args: {
+        session: SessionJWS<T, MaxAge>;
+        event: H3Event;
+        config: SessionConfigJWS<T, MaxAge>;
+    }) => void | Promise<void>;
+    onUpdate?: (args: {
+        session: SessionJWS<T, MaxAge>;
+        event: H3Event;
+        config: SessionConfigJWS<T, MaxAge>;
+    }) => void | Promise<void>;
+    onClear?: (args: {
+        event: H3Event;
+        config: Partial<SessionConfigJWS<T, MaxAge>>;
+    }) => void | Promise<void>;
+    onExpire?: (args: {
+        event: H3Event;
+        error: Error;
+        config: SessionConfigJWS<T, MaxAge>;
+    }) => void | Promise<void>;
+    onError?: (args: {
+        event: H3Event;
+        error: any;
+        config: SessionConfigJWS<T, MaxAge>;
+    }) => void | Promise<void>;
 }
-interface SessionConfigJWS {
+interface SessionConfigJWS<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined> {
     /**
      * JWK (private for signing with RS/ES/PS, or symmetric oct) used for signing.
      */
@@ -143,7 +186,7 @@ interface SessionConfigJWS {
         publicKey: JWK_Public | JWK_Public[] | JWKSet;
     };
     /** Session lifetime in seconds (sets exp = iat + maxAge) */
-    maxAge?: number;
+    maxAge?: MaxAge;
     /** Default cookie / header name base */
     name?: string;
     /** Cookie options (false to disable cookies) */
@@ -157,7 +200,7 @@ interface SessionConfigJWS {
         signOptions?: Omit<JWSSignOptions, "expiresIn">;
         verifyOptions?: JWTClaimValidationOptions;
     };
-    hooks?: SessionHooksJWS;
+    hooks?: SessionHooksJWS<T, MaxAge>;
 }
 /**
  * @deprecated use `SessionConfigJWS` instead
@@ -172,26 +215,25 @@ type CompatEvent = {
     headers: Headers;
     context: any;
 };
-type SessionUpdate<T extends SessionDataT = SessionDataT> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
 /**
  * Create a session manager for the current request using JWS (signed only, not encrypted).
  * NOTE: Contents are visible to clients (Base64URL-decoded JSON). Do not store secrets in session data.
  */
-declare function useJWSSession<T extends SessionDataT = SessionDataT>(event: H3Event | CompatEvent, config: SessionConfigJWS): Promise<SessionManager<T>>;
+declare function useJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
 /**
  * Retrieve (and lazily initialize) the session.
  */
-declare function getJWSSession<T extends SessionDataT = SessionDataT>(event: H3Event | CompatEvent, config: SessionConfigJWS): Promise<SessionJWS<T>>;
+declare function getJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionJWS<T, MaxAge>>;
 /**
  * Update session data (if provided) and reissue JWS.
  */
-declare function updateJWSSession<T extends SessionDataT = SessionDataT>(event: H3Event, config: SessionConfigJWS, update?: SessionUpdate<T>): Promise<SessionJWS<T>>;
+declare function updateJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: H3Event, config: SessionConfigJWS<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWS<T, MaxAge>>;
 /**
  * Sign current session as a compact JWS.
  * Payload claims:
  *  jti, iat, exp?, data, plus optional extraClaims (cannot override reserved)
  */
-declare function signJWSSession<T extends SessionDataT = SessionDataT>(event: H3Event | CompatEvent, config: SessionConfigJWS): Promise<string>;
+declare function signJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<string>;
 /**
  * Verify and parse a compact JWS into a Session structure.
  * Performs:
@@ -200,11 +242,11 @@ declare function signJWSSession<T extends SessionDataT = SessionDataT>(event: H3
  *  - ensures jti & iat presence
  *  - enforces maxAge if provided
  */
-declare function verifyJWSSession(_event: H3Event | CompatEvent, config: SessionConfigJWS, token: string): Promise<Partial<SessionJWS>>;
+declare function verifyJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(_event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>, token: string): Promise<Partial<SessionJWS<T, MaxAge>>>;
 /**
  * Destroy the session (context + cookie).
  */
-declare function clearJWSSession(event: H3Event, config: Partial<SessionConfigJWS>): Promise<void>;
+declare function clearJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: H3Event, config: Partial<SessionConfigJWS<T, MaxAge>>): Promise<void>;
 
 export { JWEEncryptOptions, JWKSet, JWK_Private, JWK_Public, JWK_Symmetric, JWTClaimValidationOptions, JWTClaims, clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
-export type { SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWEConfig, SessionJWS, SessionJWSConfig, SessionManager };
+export type { SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWEConfig, SessionJWS, SessionJWSConfig, SessionManager, SessionUpdate };

package/dist/adapters/h3.mjs

@@ -59,12 +59,22 @@ async function getJWESession(event, config) {
   if (existingSession) {
     const session2 = existingSession[kGetSessionPromise$1] ? await existingSession[kGetSessionPromise$1] : existingSession;
     if (session2.expiresAt !== void 0 && session2.expiresAt < Date.now() && isEvent(event)) {
-      await config.hooks?.onExpire?.(event, void 0, config);
+      await config.hooks?.onExpire?.({
+        event,
+        error: new Error(
+          `JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${new Date(session2.expiresAt * 1e3).toISOString()})`
+        ),
+        config
+      });
       return clearJWESession(event, config).then(
         () => getJWESession(event, config)
       );
     }
-    await config.hooks?.onRead?.(session2, event, config);
+    await config.hooks?.onRead?.({
+      event,
+      session: session2,
+      config
+    });
     return session2;
   }
   const session = {
@@ -74,27 +84,35 @@ async function getJWESession(event, config) {
     data: /* @__PURE__ */ Object.create(null)
   };
   event.context.sessions[sessionName] = session;
-  let jweToken;
+  let token;
   if (config.sessionHeader !== false) {
     const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
     const headerValue = _getReqHeader$1(event, headerName);
     if (typeof headerValue === "string") {
-      jweToken = headerValue;
+      token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
     }
   }
-  if (!jweToken) {
+  if (!token) {
     const cookieHeader = _getReqHeader$1(event, "cookie");
     if (cookieHeader) {
-      jweToken = parse(String(cookieHeader))[sessionName];
+      token = parse(String(cookieHeader))[sessionName];
     }
   }
-  if (jweToken) {
-    const promise = unsealJWESession(event, config, jweToken).catch(async (error_) => {
+  if (token) {
+    const promise = unsealJWESession(event, config, token).catch(async (error_) => {
       if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
-        await config.hooks?.onExpire?.(event, error_, config);
+        await config.hooks?.onExpire?.({
+          event,
+          error: error_,
+          config
+        });
         return void 0;
       }
-      await config.hooks?.onError?.(event, error_, config);
+      await config.hooks?.onError?.({
+        event,
+        error: error_,
+        config
+      });
       return void 0;
     }).then((unsealed) => {
       if (unsealed) {
@@ -117,7 +135,11 @@ async function getJWESession(event, config) {
     session.expiresAt = config.maxAge ? session.createdAt + config.maxAge * 1e3 : void 0;
     await updateJWESession(event, config);
   }
-  await config.hooks?.onRead?.(session, event, config);
+  await config.hooks?.onRead?.({
+    event,
+    session,
+    config
+  });
   return session;
 }
 function _getReqHeader$1(event, name) {
@@ -139,7 +161,11 @@ async function updateJWESession(event, config, update) {
   }
   if (update) {
     Object.assign(session.data, update);
-    await config.hooks?.onUpdate?.(session, event, config);
+    await config.hooks?.onUpdate?.({
+      event,
+      session,
+      config
+    });
   }
   if (config.cookie !== false) {
     const sealed = await sealJWESession(event, config);
@@ -195,11 +221,11 @@ async function unsealJWESession(_event, config, sealed) {
   const { payload } = await decrypt(sealed, key, {
     ...config.jwe?.decryptOptions,
     requiredClaims: [
-      ...config.jwe?.decryptOptions?.requiredClaims?.filter(
-        (claim) => claim !== "jti" && claim !== "iat"
-      ) || [],
-      "jti",
-      "iat"
+      .../* @__PURE__ */ new Set([
+        ...config.jwe?.decryptOptions?.requiredClaims || [],
+        "jti",
+        "iat"
+      ])
     ],
     maxTokenAge: config.maxAge,
     algorithms: alg ? [alg] : void 0,
@@ -235,7 +261,10 @@ async function clearJWESession(event, config) {
     expires: /* @__PURE__ */ new Date(0),
     maxAge: void 0
   });
-  await config.hooks?.onClear?.(event, config);
+  await config.hooks?.onClear?.({
+    event,
+    config
+  });
 }
 function getEncryptKey(key) {
   if (!key) {
@@ -334,12 +363,22 @@ async function getJWSSession(event, config) {
   if (existingSession) {
     const session2 = existingSession[kGetSessionPromise] ? await existingSession[kGetSessionPromise] : existingSession;
     if (session2.expiresAt !== void 0 && session2.expiresAt < Date.now() && isEvent(event)) {
-      await config.hooks?.onExpire?.(event, void 0, config);
+      await config.hooks?.onExpire?.({
+        event,
+        error: new Error(
+          `JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${new Date(session2.expiresAt * 1e3).toISOString()})`
+        ),
+        config
+      });
       return clearJWSSession(event, config).then(
         () => getJWSSession(event, config)
       );
     }
-    await config.hooks?.onRead?.(session2, event, config);
+    await config.hooks?.onRead?.({
+      event,
+      session: session2,
+      config
+    });
     return session2;
   }
   const session = {
@@ -354,7 +393,7 @@ async function getJWSSession(event, config) {
     const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
     const headerValue = _getReqHeader(event, headerName);
     if (typeof headerValue === "string") {
-      token = headerValue;
+      token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
     }
   }
   if (!token) {
@@ -366,10 +405,18 @@ async function getJWSSession(event, config) {
   if (token) {
     const promise = verifyJWSSession(event, config, token).catch(async (error_) => {
       if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
-        await config.hooks?.onExpire?.(event, error_, config);
+        await config.hooks?.onExpire?.({
+          event,
+          error: error_,
+          config
+        });
         return void 0;
       }
-      await config.hooks?.onError?.(event, error_, config);
+      await config.hooks?.onError?.({
+        event,
+        error: error_,
+        config
+      });
       return void 0;
     }).then((unsealed) => {
       if (unsealed) {
@@ -392,7 +439,11 @@ async function getJWSSession(event, config) {
     session.expiresAt = config.maxAge ? session.createdAt + config.maxAge * 1e3 : void 0;
     await updateJWSSession(event, config);
   }
-  await config.hooks?.onRead?.(session, event, config);
+  await config.hooks?.onRead?.({
+    event,
+    session,
+    config
+  });
   return session;
 }
 function _getReqHeader(event, name) {
@@ -414,7 +465,11 @@ async function updateJWSSession(event, config, update) {
   }
   if (update) {
     Object.assign(session.data, update);
-    await config.hooks?.onUpdate?.(session, event, config);
+    await config.hooks?.onUpdate?.({
+      event,
+      session,
+      config
+    });
   }
   if (config.cookie !== false) {
     const token = await signJWSSession(event, config);
@@ -467,11 +522,11 @@ async function verifyJWSSession(_event, config, token) {
   const { payload } = await verify(token, jwk, {
     ...config.jws?.verifyOptions,
     requiredClaims: [
-      ...config.jws?.verifyOptions?.requiredClaims?.filter(
-        (claim) => claim !== "jti" && claim !== "iat"
-      ) || [],
-      "jti",
-      "iat"
+      .../* @__PURE__ */ new Set([
+        ...config.jws?.verifyOptions?.requiredClaims || [],
+        "jti",
+        "iat"
+      ])
     ],
     typ: typ || "JWT",
     algorithms: alg ? [alg] : void 0,
@@ -501,7 +556,10 @@ async function clearJWSSession(event, config) {
     expires: /* @__PURE__ */ new Date(0),
     maxAge: void 0
   });
-  await config.hooks?.onClear?.(event, config);
+  await config.hooks?.onClear?.({
+    event,
+    config
+  });
 }
 function getSignKey(key) {
   if (!key) {

package/dist/adapters/h3v1.d.mts

@@ -1,6 +1,6 @@
 export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from '../shared/unjwt.9mL1vSFP.mjs';
 export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, w as JWKSet, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, u as JWK_Private, t as JWK_Public, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, r as JWK_Symmetric, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, Z as JWTClaimValidationOptions, X as JWTClaims, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from '../shared/unjwt.CtHrClHc.mjs';
-export { SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWEConfig, SessionJWS, SessionJWSConfig, SessionManager, clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession } from './h3.mjs';
+export { SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWEConfig, SessionJWS, SessionJWSConfig, SessionManager, SessionUpdate, clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession } from './h3.mjs';
 export { d as deriveJWKFromPassword, e as exportJWKToPEM, g as generateJWK, i as importJWKFromPEM } from '../shared/unjwt.BjP_dGnX.mjs';
 import 'cookie-es';
 import 'h3';

package/dist/adapters/h3v2.d.mts

@@ -7,39 +7,63 @@ import { CookieSerializeOptions } from 'cookie-es';
 import { c as JWSSignOptions } from '../shared/unjwt.BsLgL0DQ.mjs';
 export { d as deriveJWKFromPassword, e as exportJWKToPEM, g as generateJWK, i as importJWKFromPEM } from '../shared/unjwt.BjP_dGnX.mjs';
 
-type SessionDataT$1 = Omit<JWTClaims, "jti" | "iat" | "exp">;
-type SessionData<T extends SessionDataT$1 = SessionDataT$1> = T;
+type SessionData<T extends JWTClaims = JWTClaims> = Omit<T, "jti" | "iat" | "exp">;
+type SessionUpdate<T extends JWTClaims = JWTClaims> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
+interface SessionManager<T extends JWTClaims = JWTClaims, ConfigMaxAge extends number | undefined = number | undefined> {
+    readonly id: string | undefined;
+    readonly createdAt: number;
+    readonly expiresAt: T extends {
+        exp: number;
+    } ? number : ConfigMaxAge;
+    readonly data: SessionData<T>;
+    update: (update: SessionUpdate<T>) => Promise<SessionManager<T>>;
+    clear: () => Promise<SessionManager<T>>;
+}
+
 declare const kGetSessionPromise$1: unique symbol;
-interface SessionJWE<T extends SessionDataT$1 = SessionDataT$1> {
+interface SessionJWE<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined> {
     id: string;
     createdAt: number;
-    expiresAt?: number;
+    expiresAt: T extends {
+        exp: number;
+    } ? number : MaxAge;
     data: SessionData<T>;
-    [kGetSessionPromise$1]?: Promise<SessionJWE<T>>;
+    [kGetSessionPromise$1]?: Promise<SessionJWE<T, MaxAge>>;
 }
-interface SessionHooksJWE {
-    onRead?: (session: SessionJWE, event: HTTPEvent, config: SessionConfigJWE) => void | Promise<void>;
-    onUpdate?: (session: SessionJWE, event: HTTPEvent, config: SessionConfigJWE) => void | Promise<void>;
-    onClear?: (event: HTTPEvent, config: Partial<SessionConfigJWE>) => void | Promise<void>;
-    onExpire?: (event: HTTPEvent, error: any | undefined, config: SessionConfigJWE) => void | Promise<void>;
-    onError?: (event: HTTPEvent, error: any, config: SessionConfigJWE) => void | Promise<void>;
-}
-interface SessionManager<T extends SessionDataT$1 = SessionDataT$1> {
-    readonly id: string | undefined;
-    readonly createdAt: number;
-    readonly expiresAt: number | undefined;
-    readonly data: SessionData<T>;
-    update: (update: SessionUpdate$1<T>) => Promise<SessionManager<T>>;
-    clear: () => Promise<SessionManager<T>>;
+interface SessionHooksJWE<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined> {
+    onRead?: (args: {
+        session: SessionJWE<T, MaxAge>;
+        event: HTTPEvent;
+        config: SessionConfigJWE<T, MaxAge>;
+    }) => void | Promise<void>;
+    onUpdate?: (args: {
+        session: SessionJWE<T, MaxAge>;
+        event: HTTPEvent;
+        config: SessionConfigJWE<T, MaxAge>;
+    }) => void | Promise<void>;
+    onClear?: (args: {
+        event: HTTPEvent;
+        config: Partial<SessionConfigJWE<T, MaxAge>>;
+    }) => void | Promise<void>;
+    onExpire?: (args: {
+        event: HTTPEvent;
+        error: Error;
+        config: SessionConfigJWE<T, MaxAge>;
+    }) => void | Promise<void>;
+    onError?: (args: {
+        event: HTTPEvent;
+        error: any;
+        config: SessionConfigJWE<T, MaxAge>;
+    }) => void | Promise<void>;
 }
-interface SessionConfigJWE {
+interface SessionConfigJWE<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined> {
     /** Shared secret used, string for PBES2 or Json Web Key (JWK) */
     key: string | JWK_Symmetric | {
         privateKey: JWK_Private | JWK_Symmetric;
         publicKey?: JWK_Public;
     };
     /** Session lifetime in seconds (used to derive exp from iat) */
-    maxAge?: number;
+    maxAge?: MaxAge;
     /** Default is "h3" */
     name?: string;
     /** Default is secure, httpOnly, path="/" */
@@ -55,56 +79,75 @@ interface SessionConfigJWE {
         encryptOptions?: Omit<JWEEncryptOptions, "expiresIn">;
         decryptOptions?: JWTClaimValidationOptions;
     };
-    hooks?: SessionHooksJWE;
+    hooks?: SessionHooksJWE<T, MaxAge>;
 }
-type SessionUpdate$1<T extends SessionDataT$1 = SessionDataT$1> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
 /**
  * Create a session manager for the current request.
  */
-declare function useJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: HTTPEvent, config: SessionConfigJWE): Promise<SessionManager<T>>;
+declare function useJWESession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
 /**
  * Get the session for the current request.
  */
-declare function getJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: HTTPEvent, config: SessionConfigJWE): Promise<SessionJWE<T>>;
+declare function getJWESession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>): Promise<SessionJWE<T, MaxAge>>;
 /**
  * Update the session data for the current request.
  */
-declare function updateJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: HTTPEvent, config: SessionConfigJWE, update?: SessionUpdate$1<T>): Promise<SessionJWE<T>>;
+declare function updateJWESession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWE<T, MaxAge>>;
 /**
  * Produce a JWE for the current session.
  */
-declare function sealJWESession<T extends SessionDataT$1 = SessionDataT$1>(event: HTTPEvent, config: SessionConfigJWE): Promise<string>;
+declare function sealJWESession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>): Promise<string>;
 /**
  * Decrypt the JWE and return a Session-compatible object.
  */
-declare function unsealJWESession(_event: HTTPEvent, config: SessionConfigJWE, sealed: string): Promise<Partial<SessionJWE>>;
+declare function unsealJWESession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(_event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>, sealed: string): Promise<Partial<SessionJWE<T, MaxAge>>>;
 /**
  * Clear the session (delete from context and drop cookie).
  */
-declare function clearJWESession(event: HTTPEvent, config: Partial<SessionConfigJWE>): Promise<void>;
+declare function clearJWESession<T extends JWTClaims, MaxAge extends number | undefined>(event: HTTPEvent, config: Partial<SessionConfigJWE<T, MaxAge>>): Promise<void>;
 
-type SessionDataT = Omit<JWTClaims, "jti" | "iat" | "exp">;
 declare const kGetSessionPromise: unique symbol;
-interface SessionJWS<T extends SessionDataT = SessionDataT> {
+interface SessionJWS<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined> {
     id: string;
     createdAt: number;
-    expiresAt?: number;
+    expiresAt: T extends {
+        exp: number;
+    } ? number : MaxAge;
     data: SessionData<T>;
-    [kGetSessionPromise]?: Promise<SessionJWS<T>>;
+    [kGetSessionPromise]?: Promise<SessionJWS<T, MaxAge>>;
 }
-interface SessionHooksJWS {
-    onRead?: (session: SessionJWS, event: HTTPEvent, config: SessionConfigJWS) => void | Promise<void>;
-    onUpdate?: (session: SessionJWS, event: HTTPEvent, config: SessionConfigJWS) => void | Promise<void>;
-    onClear?: (event: HTTPEvent, config: Partial<SessionConfigJWS>) => void | Promise<void>;
-    onExpire?: (event: HTTPEvent, error: any | undefined, config: SessionConfigJWS) => void | Promise<void>;
-    onError?: (event: HTTPEvent, error: any, config: SessionConfigJWS) => void | Promise<void>;
+interface SessionHooksJWS<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined> {
+    onRead?: (args: {
+        session: SessionJWS<T, MaxAge>;
+        event: HTTPEvent;
+        config: SessionConfigJWS<T, MaxAge>;
+    }) => void | Promise<void>;
+    onUpdate?: (args: {
+        session: SessionJWS<T, MaxAge>;
+        event: HTTPEvent;
+        config: SessionConfigJWS<T, MaxAge>;
+    }) => void | Promise<void>;
+    onClear?: (args: {
+        event: HTTPEvent;
+        config: Partial<SessionConfigJWS<T, MaxAge>>;
+    }) => void | Promise<void>;
+    onExpire?: (args: {
+        event: HTTPEvent;
+        error: Error;
+        config: SessionConfigJWS<T, MaxAge>;
+    }) => void | Promise<void>;
+    onError?: (args: {
+        event: HTTPEvent;
+        error: any;
+        config: SessionConfigJWS<T, MaxAge>;
+    }) => void | Promise<void>;
 }
-interface SessionConfigJWS {
+interface SessionConfigJWS<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined> {
     key: JWK_Symmetric | {
         privateKey: JWK_Private;
         publicKey: JWK_Public | JWK_Public[] | JWKSet;
     };
-    maxAge?: number;
+    maxAge?: MaxAge;
     name?: string;
     cookie?: false | (CookieSerializeOptions & {
         chunkMaxLength?: number;
@@ -115,15 +158,14 @@ interface SessionConfigJWS {
         signOptions?: Omit<JWSSignOptions, "expiresIn">;
         verifyOptions?: JWTClaimValidationOptions;
     };
-    hooks?: SessionHooksJWS;
+    hooks?: SessionHooksJWS<T, MaxAge>;
 }
-type SessionUpdate<T extends SessionDataT = SessionDataT> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
-declare function useJWSSession<T extends SessionDataT = SessionDataT>(event: HTTPEvent, config: SessionConfigJWS): Promise<SessionManager<T>>;
-declare function getJWSSession<T extends SessionDataT = SessionDataT>(event: HTTPEvent, config: SessionConfigJWS): Promise<SessionJWS<T>>;
-declare function updateJWSSession<T extends SessionDataT = SessionDataT>(event: HTTPEvent, config: SessionConfigJWS, update?: SessionUpdate<T>): Promise<SessionJWS<T>>;
-declare function signJWSSession<T extends SessionDataT = SessionDataT>(event: HTTPEvent, config: SessionConfigJWS): Promise<string>;
-declare function verifyJWSSession(_event: HTTPEvent, config: SessionConfigJWS, token: string): Promise<Partial<SessionJWS>>;
-declare function clearJWSSession(event: HTTPEvent, config: Partial<SessionConfigJWS>): Promise<void>;
+declare function useJWSSession<T extends JWTClaims, MaxAge extends number | undefined>(event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
+declare function getJWSSession<T extends JWTClaims, MaxAge extends number | undefined>(event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionJWS<T, MaxAge>>;
+declare function updateJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWS<T, MaxAge>>;
+declare function signJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>): Promise<string>;
+declare function verifyJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(_event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>, token: string): Promise<Partial<SessionJWS<T, MaxAge>>>;
+declare function clearJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: HTTPEvent, config: Partial<SessionConfigJWS<T, MaxAge>>): Promise<void>;
 
 export { JWEEncryptOptions, JWKSet, JWK_Private, JWK_Public, JWK_Symmetric, JWTClaimValidationOptions, JWTClaims, clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
-export type { SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWS, SessionManager };
+export type { SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWS, SessionManager, SessionUpdate };

package/dist/adapters/h3v2.mjs

@@ -49,12 +49,22 @@ async function getJWESession(event, config) {
   if (existingSession) {
     const session2 = existingSession[kGetSessionPromise$1] ? await existingSession[kGetSessionPromise$1] : existingSession;
     if (session2.expiresAt !== void 0 && session2.expiresAt < Date.now() && hasWritableResponse$1(event)) {
-      await config.hooks?.onExpire?.(event, void 0, config);
+      await config.hooks?.onExpire?.({
+        event,
+        error: new Error(
+          `JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${new Date(session2.expiresAt * 1e3).toISOString()})`
+        ),
+        config
+      });
       return clearJWESession(event, config).then(
         () => getJWESession(event, config)
       );
     }
-    await config.hooks?.onRead?.(session2, event, config);
+    await config.hooks?.onRead?.({
+      event,
+      session: session2,
+      config
+    });
     return session2;
   }
   const session = {
@@ -64,27 +74,35 @@ async function getJWESession(event, config) {
     data: new NullProtoObj()
   };
   context.sessions[sessionName] = session;
-  let jweToken;
+  let token;
   if (config.sessionHeader !== false) {
     const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
     const headerValue = event.req.headers.get(headerName);
     if (typeof headerValue === "string") {
-      jweToken = headerValue;
+      token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
     }
   }
-  if (!jweToken) {
-    jweToken = getChunkedCookie(event, sessionName);
+  if (!token) {
+    token = getChunkedCookie(event, sessionName);
   }
-  if (jweToken) {
-    const promise = unsealJWESession(event, config, jweToken).catch(async (error_) => {
+  if (token) {
+    const promise = unsealJWESession(event, config, token).catch(async (error_) => {
       if (error_ instanceof Error) {
         const message = error_.message;
         if (message.includes("Token has expired") || message.includes("Token is too old")) {
-          await config.hooks?.onExpire?.(event, error_, config);
+          await config.hooks?.onExpire?.({
+            event,
+            error: error_,
+            config
+          });
           return void 0;
         }
       }
-      await config.hooks?.onError?.(event, error_, config);
+      await config.hooks?.onError?.({
+        event,
+        error: error_,
+        config
+      });
       return void 0;
     }).then((unsealed) => {
       if (unsealed) {
@@ -102,7 +120,11 @@ async function getJWESession(event, config) {
     session.expiresAt = config.maxAge ? session.createdAt + config.maxAge * 1e3 : void 0;
     await updateJWESession(event, config);
   }
-  await config.hooks?.onRead?.(session, event, config);
+  await config.hooks?.onRead?.({
+    event,
+    session,
+    config
+  });
   return session;
 }
 async function updateJWESession(event, config, update) {
@@ -114,7 +136,11 @@ async function updateJWESession(event, config, update) {
   }
   if (update) {
     Object.assign(session.data, update);
-    await config.hooks?.onUpdate?.(session, event, config);
+    await config.hooks?.onUpdate?.({
+      event,
+      session,
+      config
+    });
   }
   if (config.cookie !== false && hasWritableResponse$1(event)) {
     const sealed = await sealJWESession(event, config);
@@ -167,11 +193,11 @@ async function unsealJWESession(_event, config, sealed) {
   const { payload } = await decrypt(sealed, key, {
     ...config.jwe?.decryptOptions,
     requiredClaims: [
-      ...config.jwe?.decryptOptions?.requiredClaims?.filter(
-        (claim) => claim !== "jti" && claim !== "iat"
-      ) || [],
-      "jti",
-      "iat"
+      .../* @__PURE__ */ new Set([
+        ...config.jwe?.decryptOptions?.requiredClaims || [],
+        "jti",
+        "iat"
+      ])
     ],
     maxTokenAge: config.maxAge,
     algorithms: alg ? [alg] : void 0,
@@ -207,7 +233,10 @@ async function clearJWESession(event, config) {
       expires: /* @__PURE__ */ new Date(0),
       maxAge: void 0
     });
-    await config.hooks?.onClear?.(event, config);
+    await config.hooks?.onClear?.({
+      event,
+      config
+    });
   }
 }
 function getSessionFromContext$1(event, sessionName) {
@@ -304,12 +333,22 @@ async function getJWSSession(event, config) {
   if (existingSession) {
     const session2 = existingSession[kGetSessionPromise] ? await existingSession[kGetSessionPromise] : existingSession;
     if (session2.expiresAt !== void 0 && session2.expiresAt < Date.now() && hasWritableResponse(event)) {
-      await config.hooks?.onExpire?.(event, void 0, config);
+      await config.hooks?.onExpire?.({
+        event,
+        error: new Error(
+          `JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${new Date(session2.expiresAt * 1e3).toISOString()})`
+        ),
+        config
+      });
       return clearJWSSession(event, config).then(
         () => getJWSSession(event, config)
       );
     }
-    await config.hooks?.onRead?.(session2, event, config);
+    await config.hooks?.onRead?.({
+      event,
+      session: session2,
+      config
+    });
     return session2;
   }
   const session = {
@@ -324,7 +363,7 @@ async function getJWSSession(event, config) {
     const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
     const headerValue = event.req.headers.get(headerName);
     if (typeof headerValue === "string") {
-      token = headerValue;
+      token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
     }
   }
   if (!token) {
@@ -333,10 +372,18 @@ async function getJWSSession(event, config) {
   if (token) {
     const promise = verifyJWSSession(event, config, token).catch(async (error_) => {
       if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
-        await config.hooks?.onExpire?.(event, error_, config);
+        await config.hooks?.onExpire?.({
+          event,
+          error: error_,
+          config
+        });
         return void 0;
       }
-      await config.hooks?.onError?.(event, error_, config);
+      await config.hooks?.onError?.({
+        event,
+        error: error_,
+        config
+      });
       return void 0;
     }).then((unsealed) => {
       if (unsealed) {
@@ -354,7 +401,11 @@ async function getJWSSession(event, config) {
     session.expiresAt = config.maxAge ? session.createdAt + config.maxAge * 1e3 : void 0;
     await updateJWSSession(event, config);
   }
-  await config.hooks?.onRead?.(session, event, config);
+  await config.hooks?.onRead?.({
+    event,
+    session,
+    config
+  });
   return session;
 }
 async function updateJWSSession(event, config, update) {
@@ -366,7 +417,11 @@ async function updateJWSSession(event, config, update) {
   }
   if (update) {
     Object.assign(session.data, update);
-    await config.hooks?.onUpdate?.(session, event, config);
+    await config.hooks?.onUpdate?.({
+      event,
+      session,
+      config
+    });
   }
   if (config.cookie !== false && hasWritableResponse(event)) {
     const token = await signJWSSession(event, config);
@@ -420,11 +475,11 @@ async function verifyJWSSession(_event, config, token) {
   const { payload } = await verify(token, jwk, {
     ...config.jws?.verifyOptions,
     requiredClaims: [
-      ...config.jws?.verifyOptions?.requiredClaims?.filter(
-        (claim) => claim !== "jti" && claim !== "iat"
-      ) || [],
-      "jti",
-      "iat"
+      .../* @__PURE__ */ new Set([
+        ...config.jws?.verifyOptions?.requiredClaims || [],
+        "jti",
+        "iat"
+      ])
     ],
     typ: typ || "JWT",
     algorithms: alg ? [alg] : void 0,
@@ -455,7 +510,10 @@ async function clearJWSSession(event, config) {
       expires: /* @__PURE__ */ new Date(0),
       maxAge: void 0
     });
-    await config.hooks?.onClear?.(event, config);
+    await config.hooks?.onClear?.({
+      event,
+      config
+    });
   }
 }
 function getSessionFromContext(event, sessionName) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.25",
+  "version": "0.5.27",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",
@@ -73,7 +73,7 @@
     "eslint": "^9.36.0",
     "eslint-config-unjs": "^0.5.0",
     "h3v1": "npm:h3@^1.15.4",
-    "h3v2": "npm:h3@^2.0.1-rc.2",
+    "h3v2": "npm:h3@^2.0.1-rc.5",
     "jose": "^6.1.0",
     "prettier": "^3.6.2",
     "supertest": "^7.1.4",
@@ -83,8 +83,8 @@
   },
   "peerDependencies": {
     "cookie-es": "^1.2.2 || ^2.0.0",
-    "h3": "^1.15.4 || >=2.0.1-rc.2 || ^2.0.1",
-    "rou3": "^0.7.7"
+    "h3": "^1.15.4 || >=2.0.1-rc.5 || ^2.0.1",
+    "rou3": "^0.7.10"
   },
   "peerDependenciesMeta": {
     "cookie-es": {
@@ -92,7 +92,13 @@
     },
     "h3": {
       "optional": true
+    },
+    "rou3": {
+      "optional": true
     }
   },
-  "packageManager": "pnpm@10.18.3"
+  "resolutions": {
+    "@eslint/plugin-kit": "^0.3.4"
+  },
+  "packageManager": "pnpm@10.19.0"
 }