unjwt 0.5.28 → 0.5.30

package/dist/adapters/h3.d.mts

@@ -1,6 +1,6 @@
 import { b as JWEEncryptOptions } from '../shared/unjwt.9mL1vSFP.mjs';
 export { d as JWEDecryptOptions, e as JWEDecryptResult, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from '../shared/unjwt.9mL1vSFP.mjs';
-import { X as JWTClaims, r as JWK_Symmetric, u as JWK_Private, t as JWK_Public, Z as JWTClaimValidationOptions, w as JWKSet } from '../shared/unjwt.CtHrClHc.mjs';
+import { X as JWTClaims, E as ExpiresIn, r as JWK_Symmetric, u as JWK_Private, t as JWK_Public, Z as JWTClaimValidationOptions, w as JWKSet } from '../shared/unjwt.CtHrClHc.mjs';
 export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from '../shared/unjwt.CtHrClHc.mjs';
 import { CookieSerializeOptions } from 'cookie-es';
 import { H3Event } from 'h3';
@@ -9,13 +9,12 @@ export { d as deriveJWKFromPassword, e as exportJWKToPEM, g as generateJWK, i as
 
 type SessionData<T extends JWTClaims = JWTClaims> = Omit<T, "jti" | "iat" | "exp">;
 type SessionUpdate<T extends JWTClaims = JWTClaims> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
-interface SessionManager<T extends JWTClaims = JWTClaims, ConfigMaxAge extends number | undefined = number | undefined> {
+interface SessionManager<T extends JWTClaims = JWTClaims, ConfigMaxAge extends ExpiresIn | undefined = number | undefined> {
     readonly id: string | undefined;
     readonly createdAt: number;
-    readonly expiresAt: T extends {
-        exp: number;
-    } ? number : ConfigMaxAge;
+    readonly expiresAt: ConfigMaxAge extends ExpiresIn ? number : T["exp"];
     readonly data: SessionData<T>;
+    readonly token: string | undefined;
     update: (update: SessionUpdate<T>) => Promise<SessionManager<T>>;
     clear: () => Promise<SessionManager<T>>;
 }
@@ -27,14 +26,14 @@ interface SessionManager<T extends JWTClaims = JWTClaims, ConfigMaxAge extends n
  */
 
 declare const kGetSessionPromise$1: unique symbol;
-interface SessionJWE<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined> {
+interface SessionJWE<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     id: string;
     createdAt: number;
-    expiresAt: MaxAge extends number ? number : T["exp"];
+    expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
     data: SessionData<T>;
     [kGetSessionPromise$1]?: Promise<SessionJWE<T, MaxAge>>;
 }
-interface SessionHooksJWE<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined> {
+interface SessionHooksJWE<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     onRead?: (args: {
         session: SessionJWE<T, MaxAge>;
         event: H3Event;
@@ -60,7 +59,7 @@ interface SessionHooksJWE<T extends JWTClaims = JWTClaims, MaxAge extends number
         config: SessionConfigJWE<T, MaxAge>;
     }) => void | Promise<void>;
 }
-interface SessionConfigJWE<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined> {
+interface SessionConfigJWE<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     /** @deprecated use `key` instead */
     secret?: string | JWK_Symmetric | {
         privateKey: JWK_Private | JWK_Symmetric;
@@ -104,15 +103,16 @@ type CompatEvent$1 = {
 /**
  * Create a session manager for the current request.
  */
-declare function useJWESession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
+declare function useJWESession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
 /**
  * Get (and lazily initialize) the session for the current request.
  */
-declare function getJWESession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<SessionJWE<T, MaxAge>>;
+declare function getJWESession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<SessionJWE<T, MaxAge>>;
+declare function getJWESessionToken<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): string | undefined;
 /**
  * Update the session (optionally mutating the session data) and re-issue the JWE token.
  */
-declare function updateJWESession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: H3Event, config: SessionConfigJWE<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWE<T, MaxAge>>;
+declare function updateJWESession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: SessionConfigJWE<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWE<T, MaxAge>>;
 /**
  * Produce a JWE for the current session.
  * Payload structure:
@@ -123,15 +123,15 @@ declare function updateJWESession<T extends JWTClaims = JWTClaims, MaxAge extend
  *   data: Record<string, any>;
  * }
  */
-declare function sealJWESession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<string>;
+declare function sealJWESession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<string>;
 /**
  * Decrypt the JWE and return a Session-compatible object.
  */
-declare function unsealJWESession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(_event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>, sealed: string): Promise<Partial<SessionJWE<T, MaxAge>>>;
+declare function unsealJWESession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(_event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>, sealed: string): Promise<Partial<SessionJWE<T, MaxAge>>>;
 /**
  * Clear the session (delete from context and drop cookie).
  */
-declare function clearJWESession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: H3Event, config: Partial<SessionConfigJWE<T, MaxAge>>): Promise<void>;
+declare function clearJWESession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: Partial<SessionConfigJWE<T, MaxAge>>): Promise<void>;
 
 /**
  * This is a fork of h3 library's session utility functions.
@@ -140,14 +140,14 @@ declare function clearJWESession<T extends JWTClaims = JWTClaims, MaxAge extends
  */
 
 declare const kGetSessionPromise: unique symbol;
-interface SessionJWS<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined> {
+interface SessionJWS<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     id: string;
     createdAt: number;
-    expiresAt: MaxAge extends number ? number : T["exp"];
+    expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
     data: SessionData<T>;
     [kGetSessionPromise]?: Promise<SessionJWS<T, MaxAge>>;
 }
-interface SessionHooksJWS<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined> {
+interface SessionHooksJWS<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     onRead?: (args: {
         session: SessionJWS<T, MaxAge>;
         event: H3Event;
@@ -173,7 +173,7 @@ interface SessionHooksJWS<T extends JWTClaims = JWTClaims, MaxAge extends number
         config: SessionConfigJWS<T, MaxAge>;
     }) => void | Promise<void>;
 }
-interface SessionConfigJWS<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined> {
+interface SessionConfigJWS<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     /**
      * JWK (private for signing with RS/ES/PS, or symmetric oct) used for signing.
      */
@@ -215,21 +215,21 @@ type CompatEvent = {
  * Create a session manager for the current request using JWS (signed only, not encrypted).
  * NOTE: Contents are visible to clients (Base64URL-decoded JSON). Do not store secrets in session data.
  */
-declare function useJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
+declare function useJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
 /**
  * Retrieve (and lazily initialize) the session.
  */
-declare function getJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionJWS<T, MaxAge>>;
+declare function getJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionJWS<T, MaxAge>>;
 /**
  * Update session data (if provided) and reissue JWS.
  */
-declare function updateJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: H3Event, config: SessionConfigJWS<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWS<T, MaxAge>>;
+declare function updateJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: SessionConfigJWS<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWS<T, MaxAge>>;
 /**
  * Sign current session as a compact JWS.
  * Payload claims:
  *  jti, iat, exp?, data, plus optional extraClaims (cannot override reserved)
  */
-declare function signJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<string>;
+declare function signJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<string>;
 /**
  * Verify and parse a compact JWS into a Session structure.
  * Performs:
@@ -238,11 +238,11 @@ declare function signJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends
  *  - ensures jti & iat presence
  *  - enforces maxAge if provided
  */
-declare function verifyJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(_event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>, token: string): Promise<Partial<SessionJWS<T, MaxAge>>>;
+declare function verifyJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(_event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>, token: string): Promise<Partial<SessionJWS<T, MaxAge>>>;
 /**
  * Destroy the session (context + cookie).
  */
-declare function clearJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: H3Event, config: Partial<SessionConfigJWS<T, MaxAge>>): Promise<void>;
+declare function clearJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: Partial<SessionConfigJWS<T, MaxAge>>): Promise<void>;
 
-export { JWEEncryptOptions, JWKSet, JWK_Private, JWK_Public, JWK_Symmetric, JWTClaimValidationOptions, JWTClaims, clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+export { JWEEncryptOptions, JWKSet, JWK_Private, JWK_Public, JWK_Symmetric, JWTClaimValidationOptions, JWTClaims, clearJWESession, clearJWSSession, getJWESession, getJWESessionToken, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
 export type { SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWEConfig, SessionJWS, SessionJWSConfig, SessionManager, SessionUpdate };

package/dist/adapters/h3.mjs

@@ -1,9 +1,9 @@
-export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from '../shared/unjwt.epPK1KFr.mjs';
+export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from '../shared/unjwt.DyouTtLD.mjs';
 import { isEvent, setCookie } from 'h3';
 import { parse } from 'cookie-es';
-import { e as encrypt, d as decrypt } from '../shared/unjwt.CiBEuvtQ.mjs';
-import { p as isSymmetricJWK, q as isPrivateJWK, u as isPublicJWK } from '../shared/unjwt.C86hA0o-.mjs';
-import { s as sign, v as verify } from '../shared/unjwt.D-FATaw1.mjs';
+import { e as encrypt, d as decrypt } from '../shared/unjwt.KqQq9jpF.mjs';
+import { p as computeExpiresInSeconds, q as isSymmetricJWK, u as isPrivateJWK, w as isPublicJWK } from '../shared/unjwt.Be8NxwFK.mjs';
+import { s as sign, v as verify } from '../shared/unjwt.DQVUT7FU.mjs';
 
 /**
  * This is a fork of h3 library's session utility functions.
@@ -33,6 +33,9 @@ async function useJWESession(event, config) {
     get data() {
       return event.context.sessions?.[sessionName]?.data || {};
     },
+    get token() {
+      return getJWESessionToken(event, config);
+    },
     update: async (update) => {
       if (!isEvent(event)) {
         throw new Error("[h3] Cannot update read-only session.");
@@ -84,20 +87,7 @@ async function getJWESession(event, config) {
     data: /* @__PURE__ */ Object.create(null)
   };
   event.context.sessions[sessionName] = session;
-  let token;
-  if (config.sessionHeader !== false) {
-    const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
-    const headerValue = _getReqHeader$1(event, headerName);
-    if (typeof headerValue === "string") {
-      token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
-    }
-  }
-  if (!token) {
-    const cookieHeader = _getReqHeader$1(event, "cookie");
-    if (cookieHeader) {
-      token = parse(String(cookieHeader))[sessionName];
-    }
-  }
+  const token = getJWESessionToken(event, config);
   if (token) {
     const promise = unsealJWESession(event, config, token).catch(async (error_) => {
       if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
@@ -132,7 +122,7 @@ async function getJWESession(event, config) {
     }
     session.id = config.generateId?.() ?? crypto.randomUUID();
     session.createdAt = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
-    session.expiresAt = config.maxAge ? session.createdAt + config.maxAge * 1e3 : void 0;
+    session.expiresAt = config.maxAge === void 0 ? void 0 : session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3;
     await updateJWESession(event, config);
   }
   await config.hooks?.onRead?.({
@@ -142,6 +132,24 @@ async function getJWESession(event, config) {
   });
   return session;
 }
+function getJWESessionToken(event, config) {
+  const sessionName = config.name || DEFAULT_NAME$1;
+  let token;
+  if (config.sessionHeader !== false) {
+    const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
+    const headerValue = _getReqHeader$1(event, headerName);
+    if (typeof headerValue === "string") {
+      token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
+    }
+  }
+  if (!token) {
+    const cookieHeader = _getReqHeader$1(event, "cookie");
+    if (cookieHeader) {
+      token = parse(String(cookieHeader))[sessionName];
+    }
+  }
+  return token;
+}
 function _getReqHeader$1(event, name) {
   if (event.node) {
     return event.node?.req.headers[name];
@@ -172,10 +180,10 @@ async function updateJWESession(event, config, update) {
     setCookie(event, sessionName, sealed, {
       ...DEFAULT_COOKIE$1,
       ...config.cookie,
-      expires: config.maxAge ? new Date(
+      expires: config.maxAge === void 0 ? void 0 : new Date(
         // createdAt is ms, maxAge is seconds
-        session.createdAt + config.maxAge * 1e3
-      ) : void 0
+        session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3
+      )
     });
   }
   return session;
@@ -185,7 +193,7 @@ async function sealJWESession(event, config) {
   const sessionName = config.name || DEFAULT_NAME$1;
   const session = event.context.sessions?.[sessionName] || await getJWESession(event, config);
   const iatSeconds = Math.floor(session.createdAt / 1e3);
-  const expSeconds = config.maxAge == null ? void 0 : iatSeconds + config.maxAge;
+  const expSeconds = config.maxAge === void 0 ? void 0 : iatSeconds + computeExpiresInSeconds(config.maxAge);
   const payload = {
     ...session.data,
     jti: session.id,
@@ -337,6 +345,9 @@ async function useJWSSession(event, config) {
     get data() {
       return event.context.sessions?.[sessionName]?.data || {};
     },
+    get token() {
+      return getJWSSessionToken(event, config);
+    },
     update: async (update) => {
       if (!isEvent(event)) {
         throw new Error("[h3] Cannot update read-only session.");
@@ -388,20 +399,7 @@ async function getJWSSession(event, config) {
     data: /* @__PURE__ */ Object.create(null)
   };
   event.context.sessions[sessionName] = session;
-  let token;
-  if (config.sessionHeader !== false) {
-    const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
-    const headerValue = _getReqHeader(event, headerName);
-    if (typeof headerValue === "string") {
-      token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
-    }
-  }
-  if (!token) {
-    const cookieHeader = _getReqHeader(event, "cookie");
-    if (cookieHeader) {
-      token = parse(String(cookieHeader))[sessionName];
-    }
-  }
+  const token = getJWSSessionToken(event, config);
   if (token) {
     const promise = verifyJWSSession(event, config, token).catch(async (error_) => {
       if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
@@ -436,7 +434,7 @@ async function getJWSSession(event, config) {
     }
     session.id = config.generateId?.() ?? crypto.randomUUID();
     session.createdAt = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
-    session.expiresAt = config.maxAge ? session.createdAt + config.maxAge * 1e3 : void 0;
+    session.expiresAt = config.maxAge === void 0 ? void 0 : session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3;
     await updateJWSSession(event, config);
   }
   await config.hooks?.onRead?.({
@@ -446,6 +444,24 @@ async function getJWSSession(event, config) {
   });
   return session;
 }
+function getJWSSessionToken(event, config) {
+  const sessionName = config.name || DEFAULT_NAME;
+  let token;
+  if (config.sessionHeader !== false) {
+    const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
+    const headerValue = _getReqHeader(event, headerName);
+    if (typeof headerValue === "string") {
+      token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
+    }
+  }
+  if (!token) {
+    const cookieHeader = _getReqHeader(event, "cookie");
+    if (cookieHeader) {
+      token = parse(String(cookieHeader))[sessionName];
+    }
+  }
+  return token;
+}
 function _getReqHeader(event, name) {
   if (event.node) {
     return event.node.req.headers[name];
@@ -476,7 +492,9 @@ async function updateJWSSession(event, config, update) {
     setCookie(event, sessionName, token, {
       ...DEFAULT_COOKIE,
       ...config.cookie,
-      expires: config.maxAge ? new Date(session.createdAt + config.maxAge * 1e3) : void 0
+      expires: config.maxAge === void 0 ? void 0 : new Date(
+        session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3
+      )
     });
   }
   return session;
@@ -486,7 +504,7 @@ async function signJWSSession(event, config) {
   const sessionName = config.name || DEFAULT_NAME;
   const session = event.context.sessions?.[sessionName] || await getJWSSession(event, config);
   const iatSeconds = Math.floor(session.createdAt / 1e3);
-  const expSeconds = config.maxAge == null ? void 0 : iatSeconds + config.maxAge;
+  const expSeconds = config.maxAge === void 0 ? void 0 : iatSeconds + computeExpiresInSeconds(config.maxAge);
   const payload = {
     ...session.data,
     jti: session.id,
@@ -603,4 +621,4 @@ function getVerifyKey(key) {
   return _key;
 }
 
-export { clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+export { clearJWESession, clearJWSSession, getJWESession, getJWESessionToken, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };

package/dist/adapters/h3v1.d.mts

@@ -1,6 +1,6 @@
 export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from '../shared/unjwt.9mL1vSFP.mjs';
 export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, w as JWKSet, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, u as JWK_Private, t as JWK_Public, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, r as JWK_Symmetric, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, Z as JWTClaimValidationOptions, X as JWTClaims, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from '../shared/unjwt.CtHrClHc.mjs';
-export { SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWEConfig, SessionJWS, SessionJWSConfig, SessionManager, SessionUpdate, clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession } from './h3.mjs';
+export { SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWEConfig, SessionJWS, SessionJWSConfig, SessionManager, SessionUpdate, clearJWESession, clearJWSSession, getJWESession, getJWESessionToken, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession } from './h3.mjs';
 export { d as deriveJWKFromPassword, e as exportJWKToPEM, g as generateJWK, i as importJWKFromPEM } from '../shared/unjwt.BjP_dGnX.mjs';
 import 'cookie-es';
 import 'h3';

package/dist/adapters/h3v1.mjs

@@ -1,7 +1,7 @@
-export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from '../shared/unjwt.epPK1KFr.mjs';
-export { clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession } from './h3.mjs';
-import '../shared/unjwt.C86hA0o-.mjs';
+export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from '../shared/unjwt.DyouTtLD.mjs';
+export { clearJWESession, clearJWSSession, getJWESession, getJWESessionToken, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession } from './h3.mjs';
+import '../shared/unjwt.Be8NxwFK.mjs';
 import 'h3';
 import 'cookie-es';
-import '../shared/unjwt.CiBEuvtQ.mjs';
-import '../shared/unjwt.D-FATaw1.mjs';
+import '../shared/unjwt.KqQq9jpF.mjs';
+import '../shared/unjwt.DQVUT7FU.mjs';

package/dist/adapters/h3v2.d.mts

@@ -1,6 +1,6 @@
 import { b as JWEEncryptOptions } from '../shared/unjwt.9mL1vSFP.mjs';
 export { d as JWEDecryptOptions, e as JWEDecryptResult, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from '../shared/unjwt.9mL1vSFP.mjs';
-import { X as JWTClaims, r as JWK_Symmetric, u as JWK_Private, t as JWK_Public, Z as JWTClaimValidationOptions, w as JWKSet } from '../shared/unjwt.CtHrClHc.mjs';
+import { X as JWTClaims, E as ExpiresIn, r as JWK_Symmetric, u as JWK_Private, t as JWK_Public, Z as JWTClaimValidationOptions, w as JWKSet } from '../shared/unjwt.CtHrClHc.mjs';
 export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from '../shared/unjwt.CtHrClHc.mjs';
 import { HTTPEvent } from 'h3';
 import { CookieSerializeOptions } from 'cookie-es';
@@ -9,26 +9,25 @@ export { d as deriveJWKFromPassword, e as exportJWKToPEM, g as generateJWK, i as
 
 type SessionData<T extends JWTClaims = JWTClaims> = Omit<T, "jti" | "iat" | "exp">;
 type SessionUpdate<T extends JWTClaims = JWTClaims> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
-interface SessionManager<T extends JWTClaims = JWTClaims, ConfigMaxAge extends number | undefined = number | undefined> {
+interface SessionManager<T extends JWTClaims = JWTClaims, ConfigMaxAge extends ExpiresIn | undefined = number | undefined> {
     readonly id: string | undefined;
     readonly createdAt: number;
-    readonly expiresAt: T extends {
-        exp: number;
-    } ? number : ConfigMaxAge;
+    readonly expiresAt: ConfigMaxAge extends ExpiresIn ? number : T["exp"];
     readonly data: SessionData<T>;
+    readonly token: string | undefined;
     update: (update: SessionUpdate<T>) => Promise<SessionManager<T>>;
     clear: () => Promise<SessionManager<T>>;
 }
 
 declare const kGetSessionPromise$1: unique symbol;
-interface SessionJWE<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined> {
+interface SessionJWE<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     id: string;
     createdAt: number;
-    expiresAt: MaxAge extends number ? number : T["exp"];
+    expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
     data: SessionData<T>;
     [kGetSessionPromise$1]?: Promise<SessionJWE<T, MaxAge>>;
 }
-interface SessionHooksJWE<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined> {
+interface SessionHooksJWE<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     onRead?: (args: {
         session: SessionJWE<T, MaxAge>;
         event: HTTPEvent;
@@ -54,7 +53,7 @@ interface SessionHooksJWE<T extends JWTClaims = JWTClaims, MaxAge extends number
         config: SessionConfigJWE<T, MaxAge>;
     }) => void | Promise<void>;
 }
-interface SessionConfigJWE<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined> {
+interface SessionConfigJWE<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     /** Shared secret used, string for PBES2 or Json Web Key (JWK) */
     key: string | JWK_Symmetric | {
         privateKey: JWK_Private | JWK_Symmetric;
@@ -82,37 +81,38 @@ interface SessionConfigJWE<T extends JWTClaims = JWTClaims, MaxAge extends numbe
 /**
  * Create a session manager for the current request.
  */
-declare function useJWESession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
+declare function useJWESession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
 /**
  * Get the session for the current request.
  */
-declare function getJWESession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>): Promise<SessionJWE<T, MaxAge>>;
+declare function getJWESession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>): Promise<SessionJWE<T, MaxAge>>;
+declare function getJWESessionToken<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>): string | undefined;
 /**
  * Update the session data for the current request.
  */
-declare function updateJWESession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWE<T, MaxAge>>;
+declare function updateJWESession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWE<T, MaxAge>>;
 /**
  * Produce a JWE for the current session.
  */
-declare function sealJWESession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>): Promise<string>;
+declare function sealJWESession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>): Promise<string>;
 /**
  * Decrypt the JWE and return a Session-compatible object.
  */
-declare function unsealJWESession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(_event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>, sealed: string): Promise<Partial<SessionJWE<T, MaxAge>>>;
+declare function unsealJWESession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(_event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>, sealed: string): Promise<Partial<SessionJWE<T, MaxAge>>>;
 /**
  * Clear the session (delete from context and drop cookie).
  */
-declare function clearJWESession<T extends JWTClaims, MaxAge extends number | undefined>(event: HTTPEvent, config: Partial<SessionConfigJWE<T, MaxAge>>): Promise<void>;
+declare function clearJWESession<T extends JWTClaims, MaxAge extends ExpiresIn | undefined>(event: HTTPEvent, config: Partial<SessionConfigJWE<T, MaxAge>>): Promise<void>;
 
 declare const kGetSessionPromise: unique symbol;
-interface SessionJWS<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined> {
+interface SessionJWS<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     id: string;
     createdAt: number;
-    expiresAt: MaxAge extends number ? number : T["exp"];
+    expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
     data: SessionData<T>;
     [kGetSessionPromise]?: Promise<SessionJWS<T, MaxAge>>;
 }
-interface SessionHooksJWS<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined> {
+interface SessionHooksJWS<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     onRead?: (args: {
         session: SessionJWS<T, MaxAge>;
         event: HTTPEvent;
@@ -138,7 +138,7 @@ interface SessionHooksJWS<T extends JWTClaims = JWTClaims, MaxAge extends number
         config: SessionConfigJWS<T, MaxAge>;
     }) => void | Promise<void>;
 }
-interface SessionConfigJWS<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined> {
+interface SessionConfigJWS<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     key: JWK_Symmetric | {
         privateKey: JWK_Private;
         publicKey: JWK_Public | JWK_Public[] | JWKSet;
@@ -156,12 +156,13 @@ interface SessionConfigJWS<T extends JWTClaims = JWTClaims, MaxAge extends numbe
     };
     hooks?: SessionHooksJWS<T, MaxAge>;
 }
-declare function useJWSSession<T extends JWTClaims, MaxAge extends number | undefined>(event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
-declare function getJWSSession<T extends JWTClaims, MaxAge extends number | undefined>(event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionJWS<T, MaxAge>>;
-declare function updateJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWS<T, MaxAge>>;
-declare function signJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>): Promise<string>;
-declare function verifyJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(_event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>, token: string): Promise<Partial<SessionJWS<T, MaxAge>>>;
-declare function clearJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends number | undefined = number | undefined>(event: HTTPEvent, config: Partial<SessionConfigJWS<T, MaxAge>>): Promise<void>;
+declare function useJWSSession<T extends JWTClaims, MaxAge extends ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
+declare function getJWSSession<T extends JWTClaims, MaxAge extends ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionJWS<T, MaxAge>>;
+declare function getJWSSessionToken<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>): string | undefined;
+declare function updateJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWS<T, MaxAge>>;
+declare function signJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>): Promise<string>;
+declare function verifyJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(_event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>, token: string): Promise<Partial<SessionJWS<T, MaxAge>>>;
+declare function clearJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: Partial<SessionConfigJWS<T, MaxAge>>): Promise<void>;
 
-export { JWEEncryptOptions, JWKSet, JWK_Private, JWK_Public, JWK_Symmetric, JWTClaimValidationOptions, JWTClaims, clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+export { JWEEncryptOptions, JWKSet, JWK_Private, JWK_Public, JWK_Symmetric, JWTClaimValidationOptions, JWTClaims, clearJWESession, clearJWSSession, getJWESession, getJWESessionToken, getJWSSession, getJWSSessionToken, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
 export type { SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWS, SessionManager, SessionUpdate };

package/dist/adapters/h3v2.mjs

@@ -1,9 +1,9 @@
-export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from '../shared/unjwt.epPK1KFr.mjs';
+export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from '../shared/unjwt.DyouTtLD.mjs';
 import { getEventContext, getChunkedCookie, setChunkedCookie } from 'h3';
 import { NullProtoObj } from 'rou3';
-import { e as encrypt, d as decrypt } from '../shared/unjwt.CiBEuvtQ.mjs';
-import { p as isSymmetricJWK, q as isPrivateJWK, u as isPublicJWK } from '../shared/unjwt.C86hA0o-.mjs';
-import { s as sign, v as verify } from '../shared/unjwt.D-FATaw1.mjs';
+import { e as encrypt, d as decrypt } from '../shared/unjwt.KqQq9jpF.mjs';
+import { p as computeExpiresInSeconds, q as isSymmetricJWK, u as isPrivateJWK, w as isPublicJWK } from '../shared/unjwt.Be8NxwFK.mjs';
+import { s as sign, v as verify } from '../shared/unjwt.DQVUT7FU.mjs';
 
 const kGetSessionPromise$1 = Symbol("h3_jwe_getSession");
 const DEFAULT_NAME$1 = "h3-jwe";
@@ -28,6 +28,9 @@ async function useJWESession(event, config) {
     get data() {
       return getSessionFromContext$1(event, sessionName)?.data || {};
     },
+    get token() {
+      return getJWESessionToken(event, config);
+    },
     update: async (update) => {
       await updateJWESession(event, config, update);
       return sessionManager;
@@ -74,17 +77,7 @@ async function getJWESession(event, config) {
     data: new NullProtoObj()
   };
   context.sessions[sessionName] = session;
-  let token;
-  if (config.sessionHeader !== false) {
-    const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
-    const headerValue = event.req.headers.get(headerName);
-    if (typeof headerValue === "string") {
-      token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
-    }
-  }
-  if (!token) {
-    token = getChunkedCookie(event, sessionName);
-  }
+  const token = getJWESessionToken(event, config);
   if (token) {
     const promise = unsealJWESession(event, config, token).catch(async (error_) => {
       if (error_ instanceof Error) {
@@ -117,7 +110,7 @@ async function getJWESession(event, config) {
   if (!session.id) {
     session.id = config.generateId?.() ?? crypto.randomUUID();
     session.createdAt = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
-    session.expiresAt = config.maxAge ? session.createdAt + config.maxAge * 1e3 : void 0;
+    session.expiresAt = config.maxAge === void 0 ? void 0 : session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3;
     await updateJWESession(event, config);
   }
   await config.hooks?.onRead?.({
@@ -127,6 +120,21 @@ async function getJWESession(event, config) {
   });
   return session;
 }
+function getJWESessionToken(event, config) {
+  const sessionName = config.name || DEFAULT_NAME$1;
+  let token;
+  if (config.sessionHeader !== false) {
+    const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
+    const headerValue = event.req.headers.get(headerName);
+    if (typeof headerValue === "string") {
+      token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
+    }
+  }
+  if (!token) {
+    token = getChunkedCookie(event, sessionName);
+  }
+  return token;
+}
 async function updateJWESession(event, config, update) {
   const sessionName = config.name || DEFAULT_NAME$1;
   const context = getEventContext(event);
@@ -146,7 +154,9 @@ async function updateJWESession(event, config, update) {
     const sealed = await sealJWESession(event, config);
     setChunkedCookie(event, sessionName, sealed, {
       ...DEFAULT_COOKIE$1,
-      expires: config.maxAge ? new Date(session.createdAt + config.maxAge * 1e3) : void 0,
+      expires: config.maxAge === void 0 ? void 0 : new Date(
+        session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3
+      ),
       ...config.cookie
     });
   }
@@ -158,7 +168,7 @@ async function sealJWESession(event, config) {
   const context = getEventContext(event);
   const session = context.sessions?.[sessionName] || await getJWESession(event, config);
   const iatSeconds = Math.floor(session.createdAt / 1e3);
-  const expSeconds = config.maxAge == null ? void 0 : iatSeconds + config.maxAge;
+  const expSeconds = config.maxAge === void 0 ? void 0 : iatSeconds + computeExpiresInSeconds(config.maxAge);
   const payload = {
     ...session.data,
     jti: session.id,
@@ -312,6 +322,9 @@ async function useJWSSession(event, config) {
     get data() {
       return getSessionFromContext(event, sessionName)?.data || {};
     },
+    get token() {
+      return getJWSSessionToken(event, config);
+    },
     update: async (update) => {
       await updateJWSSession(event, config, update);
       return sessionManager;
@@ -358,17 +371,7 @@ async function getJWSSession(event, config) {
     data: new NullProtoObj()
   };
   context.sessions[sessionName] = session;
-  let token;
-  if (config.sessionHeader !== false) {
-    const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
-    const headerValue = event.req.headers.get(headerName);
-    if (typeof headerValue === "string") {
-      token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
-    }
-  }
-  if (!token) {
-    token = getChunkedCookie(event, sessionName);
-  }
+  const token = getJWSSessionToken(event, config);
   if (token) {
     const promise = verifyJWSSession(event, config, token).catch(async (error_) => {
       if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
@@ -398,7 +401,7 @@ async function getJWSSession(event, config) {
   if (!session.id) {
     session.id = config.generateId?.() ?? crypto.randomUUID();
     session.createdAt = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
-    session.expiresAt = config.maxAge ? session.createdAt + config.maxAge * 1e3 : void 0;
+    session.expiresAt = config.maxAge === void 0 ? void 0 : session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3;
     await updateJWSSession(event, config);
   }
   await config.hooks?.onRead?.({
@@ -408,6 +411,21 @@ async function getJWSSession(event, config) {
   });
   return session;
 }
+function getJWSSessionToken(event, config) {
+  const sessionName = config.name || DEFAULT_NAME;
+  let token;
+  if (config.sessionHeader !== false) {
+    const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
+    const headerValue = event.req.headers.get(headerName);
+    if (typeof headerValue === "string") {
+      token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
+    }
+  }
+  if (!token) {
+    token = getChunkedCookie(event, sessionName);
+  }
+  return token;
+}
 async function updateJWSSession(event, config, update) {
   const sessionName = config.name || DEFAULT_NAME;
   const context = getEventContext(event);
@@ -427,7 +445,9 @@ async function updateJWSSession(event, config, update) {
     const token = await signJWSSession(event, config);
     setChunkedCookie(event, sessionName, token, {
       ...DEFAULT_COOKIE,
-      expires: config.maxAge ? new Date(session.createdAt + config.maxAge * 1e3) : void 0,
+      expires: config.maxAge === void 0 ? void 0 : new Date(
+        session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3
+      ),
       ...config.cookie
     });
   }
@@ -439,7 +459,7 @@ async function signJWSSession(event, config) {
   const context = getEventContext(event);
   const session = context.sessions?.[sessionName] || await getJWSSession(event, config);
   const iatSeconds = Math.floor(session.createdAt / 1e3);
-  const expSeconds = config.maxAge == null ? void 0 : iatSeconds + config.maxAge;
+  const expSeconds = config.maxAge === void 0 ? void 0 : iatSeconds + computeExpiresInSeconds(config.maxAge);
   const payload = {
     ...session.data,
     jti: session.id,
@@ -577,4 +597,4 @@ function getVerifyKey(key) {
   return _key;
 }
 
-export { clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+export { clearJWESession, clearJWSSession, getJWESession, getJWESessionToken, getJWSSession, getJWSSessionToken, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };

package/dist/index.mjs

@@ -1,4 +1,4 @@
-export { i as utils } from './shared/unjwt.C86hA0o-.mjs';
-export { j as jwe } from './shared/unjwt.CiBEuvtQ.mjs';
-export { j as jwk } from './shared/unjwt.epPK1KFr.mjs';
-export { j as jws } from './shared/unjwt.D-FATaw1.mjs';
+export { i as utils } from './shared/unjwt.Be8NxwFK.mjs';
+export { j as jwe } from './shared/unjwt.KqQq9jpF.mjs';
+export { j as jwk } from './shared/unjwt.DyouTtLD.mjs';
+export { j as jws } from './shared/unjwt.DQVUT7FU.mjs';

package/dist/jwe.mjs

@@ -1,3 +1,3 @@
-import './shared/unjwt.epPK1KFr.mjs';
-import './shared/unjwt.C86hA0o-.mjs';
-export { d as decrypt, e as encrypt } from './shared/unjwt.CiBEuvtQ.mjs';
+import './shared/unjwt.DyouTtLD.mjs';
+import './shared/unjwt.Be8NxwFK.mjs';
+export { d as decrypt, e as encrypt } from './shared/unjwt.KqQq9jpF.mjs';

package/dist/jwk.mjs

@@ -1,2 +1,2 @@
-import './shared/unjwt.C86hA0o-.mjs';
-export { k as deriveJWKFromPassword, m as deriveKeyFromPassword, h as exportJWKToPEM, n as exportKey, c as generateJWK, l as generateKey, b as getJWKFromSet, f as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.epPK1KFr.mjs';
+import './shared/unjwt.Be8NxwFK.mjs';
+export { k as deriveJWKFromPassword, m as deriveKeyFromPassword, h as exportJWKToPEM, n as exportKey, c as generateJWK, l as generateKey, b as getJWKFromSet, f as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.DyouTtLD.mjs';

package/dist/jws.mjs

@@ -1,3 +1,3 @@
-import './shared/unjwt.epPK1KFr.mjs';
-import './shared/unjwt.C86hA0o-.mjs';
-export { s as sign, v as verify } from './shared/unjwt.D-FATaw1.mjs';
+import './shared/unjwt.DyouTtLD.mjs';
+import './shared/unjwt.Be8NxwFK.mjs';
+export { s as sign, v as verify } from './shared/unjwt.DQVUT7FU.mjs';

package/dist/shared/{unjwt.C86hA0o-.mjs → unjwt.Be8NxwFK.mjs}

@@ -435,4 +435,4 @@ const index = {
   validateJwtClaims: validateJwtClaims
 };
 
-export { isAsymmetricJWK as A, maybeArray as B, isJWTContent as C, decodeMaybeJWTString as D, computeExpiresInSeconds as E, computeMaxTokenAgeSeconds as F, isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, base64UrlDecode as e, decodePayloadFromBytes as f, getPlaintextBytes as g, validateJwtClaims as h, index as i, isCryptoKeyPair as j, isCryptoKey as k, textDecoder as l, isJWKSet as m, decodePayloadFromB64UrlSegment as n, validateCriticalHeadersJWS as o, isSymmetricJWK as p, isPrivateJWK as q, randomBytes as r, sanitizeObject as s, textEncoder as t, isPublicJWK as u, validateCriticalHeadersJWE as v, concatUint8Arrays as w, base64Decode as x, base64Encode as y, assertCryptoKey as z };
+export { assertCryptoKey as A, isAsymmetricJWK as B, maybeArray as C, isJWTContent as D, decodeMaybeJWTString as E, computeMaxTokenAgeSeconds as F, isJWK as a, applyTypCtyDefaults as b, computeJwtTimeClaims as c, base64UrlEncode as d, base64UrlDecode as e, decodePayloadFromBytes as f, getPlaintextBytes as g, validateJwtClaims as h, index as i, isCryptoKeyPair as j, isCryptoKey as k, textDecoder as l, isJWKSet as m, decodePayloadFromB64UrlSegment as n, validateCriticalHeadersJWS as o, computeExpiresInSeconds as p, isSymmetricJWK as q, randomBytes as r, sanitizeObject as s, textEncoder as t, isPrivateJWK as u, validateCriticalHeadersJWE as v, isPublicJWK as w, concatUint8Arrays as x, base64Decode as y, base64Encode as z };

package/dist/shared/{unjwt.D-FATaw1.mjs → unjwt.DQVUT7FU.mjs}

@@ -1,5 +1,5 @@
-import { i as importKey, s as sign$1, b as getJWKFromSet, v as verify$1 } from './unjwt.epPK1KFr.mjs';
-import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, l as textDecoder, e as base64UrlDecode, m as isJWKSet, n as decodePayloadFromB64UrlSegment, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './unjwt.C86hA0o-.mjs';
+import { i as importKey, s as sign$1, b as getJWKFromSet, v as verify$1 } from './unjwt.DyouTtLD.mjs';
+import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, l as textDecoder, e as base64UrlDecode, m as isJWKSet, n as decodePayloadFromB64UrlSegment, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './unjwt.Be8NxwFK.mjs';
 
 async function sign(payload, key, options = {}) {
   const { protectedHeader: additionalProtectedHeader } = options;

package/dist/shared/{unjwt.epPK1KFr.mjs → unjwt.DyouTtLD.mjs}

@@ -1,4 +1,4 @@
-import { k as isCryptoKey, w as concatUint8Arrays, d as base64UrlEncode, x as base64Decode, y as base64Encode, t as textEncoder, s as sanitizeObject, z as assertCryptoKey, a as isJWK, e as base64UrlDecode, A as isAsymmetricJWK, r as randomBytes, m as isJWKSet } from './unjwt.C86hA0o-.mjs';
+import { k as isCryptoKey, x as concatUint8Arrays, d as base64UrlEncode, y as base64Decode, z as base64Encode, t as textEncoder, s as sanitizeObject, A as assertCryptoKey, a as isJWK, e as base64UrlDecode, B as isAsymmetricJWK, r as randomBytes, m as isJWKSet } from './unjwt.Be8NxwFK.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.

package/dist/shared/{unjwt.CiBEuvtQ.mjs → unjwt.KqQq9jpF.mjs}

@@ -1,5 +1,5 @@
-import { i as importKey, e as encryptKey, g as generateIV, a as encrypt$1, u as unwrapKey, d as decrypt$1 } from './unjwt.epPK1KFr.mjs';
-import { r as randomBytes, a as isJWK, s as sanitizeObject, b as applyTypCtyDefaults, c as computeJwtTimeClaims, g as getPlaintextBytes, d as base64UrlEncode, t as textEncoder, e as base64UrlDecode, f as decodePayloadFromBytes, v as validateCriticalHeadersJWE, h as validateJwtClaims, j as isCryptoKeyPair, k as isCryptoKey } from './unjwt.C86hA0o-.mjs';
+import { i as importKey, e as encryptKey, g as generateIV, a as encrypt$1, u as unwrapKey, d as decrypt$1 } from './unjwt.DyouTtLD.mjs';
+import { r as randomBytes, a as isJWK, s as sanitizeObject, b as applyTypCtyDefaults, c as computeJwtTimeClaims, g as getPlaintextBytes, d as base64UrlEncode, t as textEncoder, e as base64UrlDecode, f as decodePayloadFromBytes, v as validateCriticalHeadersJWE, h as validateJwtClaims, j as isCryptoKeyPair, k as isCryptoKey } from './unjwt.Be8NxwFK.mjs';
 
 async function encrypt(payload, key, options = {}) {
   const {

package/dist/utils.mjs

@@ -1 +1 @@
-export { b as applyTypCtyDefaults, z as assertCryptoKey, x as base64Decode, y as base64Encode, e as base64UrlDecode, d as base64UrlEncode, E as computeExpiresInSeconds, c as computeJwtTimeClaims, F as computeMaxTokenAgeSeconds, w as concatUint8Arrays, D as decodeMaybeJWTString, n as decodePayloadFromB64UrlSegment, f as decodePayloadFromBytes, g as getPlaintextBytes, A as isAsymmetricJWK, k as isCryptoKey, j as isCryptoKeyPair, a as isJWK, m as isJWKSet, C as isJWTContent, q as isPrivateJWK, u as isPublicJWK, p as isSymmetricJWK, B as maybeArray, r as randomBytes, s as sanitizeObject, l as textDecoder, t as textEncoder, v as validateCriticalHeadersJWE, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './shared/unjwt.C86hA0o-.mjs';
+export { b as applyTypCtyDefaults, A as assertCryptoKey, y as base64Decode, z as base64Encode, e as base64UrlDecode, d as base64UrlEncode, p as computeExpiresInSeconds, c as computeJwtTimeClaims, F as computeMaxTokenAgeSeconds, x as concatUint8Arrays, E as decodeMaybeJWTString, n as decodePayloadFromB64UrlSegment, f as decodePayloadFromBytes, g as getPlaintextBytes, B as isAsymmetricJWK, k as isCryptoKey, j as isCryptoKeyPair, a as isJWK, m as isJWKSet, D as isJWTContent, u as isPrivateJWK, w as isPublicJWK, q as isSymmetricJWK, C as maybeArray, r as randomBytes, s as sanitizeObject, l as textDecoder, t as textEncoder, v as validateCriticalHeadersJWE, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './shared/unjwt.Be8NxwFK.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.28",
+  "version": "0.5.30",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",