unjwt 0.5.29 → 0.5.31

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2025 Sandro Circi
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2025 Sandro Circi
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/adapters/h3.d.mts

@@ -1,19 +1,23 @@
-import { b as JWEEncryptOptions } from '../shared/unjwt.9mL1vSFP.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from '../shared/unjwt.9mL1vSFP.mjs';
+import { b as JWEEncryptOptions } from '../shared/unjwt.BU3IrsCv.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from '../shared/unjwt.BU3IrsCv.mjs';
 import { X as JWTClaims, E as ExpiresIn, r as JWK_Symmetric, u as JWK_Private, t as JWK_Public, Z as JWTClaimValidationOptions, w as JWKSet } from '../shared/unjwt.CtHrClHc.mjs';
 export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from '../shared/unjwt.CtHrClHc.mjs';
+import { S as StrictOmit } from '../shared/unjwt.JdKqVANs.mjs';
 import { CookieSerializeOptions } from 'cookie-es';
 import { H3Event } from 'h3';
 import { c as JWSSignOptions } from '../shared/unjwt.BsLgL0DQ.mjs';
 export { d as deriveJWKFromPassword, e as exportJWKToPEM, g as generateJWK, i as importJWKFromPEM } from '../shared/unjwt.BjP_dGnX.mjs';
 
-type SessionData<T extends JWTClaims = JWTClaims> = Omit<T, "jti" | "iat" | "exp">;
-type SessionUpdate<T extends JWTClaims = JWTClaims> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
-interface SessionManager<T extends JWTClaims = JWTClaims, ConfigMaxAge extends ExpiresIn | undefined = number | undefined> {
+interface SessionClaims extends Required<Pick<JWTClaims, "jti" | "iat">>, Pick<JWTClaims, "exp"> {
+}
+type SessionData<T extends Record<string, any> = SessionClaims> = StrictOmit<T, "jti" | "iat" | "exp">;
+type SessionUpdate<T extends Record<string, any> = SessionClaims> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
+interface SessionManager<T extends Record<string, any> = SessionClaims, ConfigMaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     readonly id: string | undefined;
     readonly createdAt: number;
-    readonly expiresAt: ConfigMaxAge extends ExpiresIn ? number : T["exp"];
+    readonly expiresAt: ConfigMaxAge extends ExpiresIn ? number : "exp" extends keyof T ? T["exp"] : number | undefined;
     readonly data: SessionData<T>;
+    readonly token: string | undefined;
     update: (update: SessionUpdate<T>) => Promise<SessionManager<T>>;
     clear: () => Promise<SessionManager<T>>;
 }
@@ -25,14 +29,14 @@ interface SessionManager<T extends JWTClaims = JWTClaims, ConfigMaxAge extends E
  */
 
 declare const kGetSessionPromise$1: unique symbol;
-interface SessionJWE<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+interface SessionJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     id: string;
     createdAt: number;
     expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
     data: SessionData<T>;
     [kGetSessionPromise$1]?: Promise<SessionJWE<T, MaxAge>>;
 }
-interface SessionHooksJWE<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+interface SessionHooksJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     onRead?: (args: {
         session: SessionJWE<T, MaxAge>;
         event: H3Event;
@@ -58,7 +62,7 @@ interface SessionHooksJWE<T extends JWTClaims = JWTClaims, MaxAge extends Expire
         config: SessionConfigJWE<T, MaxAge>;
     }) => void | Promise<void>;
 }
-interface SessionConfigJWE<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+interface SessionConfigJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     /** @deprecated use `key` instead */
     secret?: string | JWK_Symmetric | {
         privateKey: JWK_Private | JWK_Symmetric;
@@ -102,15 +106,16 @@ type CompatEvent$1 = {
 /**
  * Create a session manager for the current request.
  */
-declare function useJWESession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
+declare function useJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
 /**
  * Get (and lazily initialize) the session for the current request.
  */
-declare function getJWESession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<SessionJWE<T, MaxAge>>;
+declare function getJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<SessionJWE<T, MaxAge>>;
+declare function getJWESessionToken<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): string | undefined;
 /**
  * Update the session (optionally mutating the session data) and re-issue the JWE token.
  */
-declare function updateJWESession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: SessionConfigJWE<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWE<T, MaxAge>>;
+declare function updateJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: SessionConfigJWE<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWE<T, MaxAge>>;
 /**
  * Produce a JWE for the current session.
  * Payload structure:
@@ -121,15 +126,15 @@ declare function updateJWESession<T extends JWTClaims = JWTClaims, MaxAge extend
  *   data: Record<string, any>;
  * }
  */
-declare function sealJWESession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<string>;
+declare function sealJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<string>;
 /**
  * Decrypt the JWE and return a Session-compatible object.
  */
-declare function unsealJWESession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(_event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>, sealed: string): Promise<Partial<SessionJWE<T, MaxAge>>>;
+declare function unsealJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(_event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>, sealed: string): Promise<Partial<SessionJWE<T, MaxAge>>>;
 /**
  * Clear the session (delete from context and drop cookie).
  */
-declare function clearJWESession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: Partial<SessionConfigJWE<T, MaxAge>>): Promise<void>;
+declare function clearJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: Partial<SessionConfigJWE<T, MaxAge>>): Promise<void>;
 
 /**
  * This is a fork of h3 library's session utility functions.
@@ -138,14 +143,14 @@ declare function clearJWESession<T extends JWTClaims = JWTClaims, MaxAge extends
  */
 
 declare const kGetSessionPromise: unique symbol;
-interface SessionJWS<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+interface SessionJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     id: string;
     createdAt: number;
     expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
     data: SessionData<T>;
     [kGetSessionPromise]?: Promise<SessionJWS<T, MaxAge>>;
 }
-interface SessionHooksJWS<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+interface SessionHooksJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     onRead?: (args: {
         session: SessionJWS<T, MaxAge>;
         event: H3Event;
@@ -171,7 +176,7 @@ interface SessionHooksJWS<T extends JWTClaims = JWTClaims, MaxAge extends Expire
         config: SessionConfigJWS<T, MaxAge>;
     }) => void | Promise<void>;
 }
-interface SessionConfigJWS<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+interface SessionConfigJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     /**
      * JWK (private for signing with RS/ES/PS, or symmetric oct) used for signing.
      */
@@ -213,21 +218,21 @@ type CompatEvent = {
  * Create a session manager for the current request using JWS (signed only, not encrypted).
  * NOTE: Contents are visible to clients (Base64URL-decoded JSON). Do not store secrets in session data.
  */
-declare function useJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
+declare function useJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
 /**
  * Retrieve (and lazily initialize) the session.
  */
-declare function getJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionJWS<T, MaxAge>>;
+declare function getJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionJWS<T, MaxAge>>;
 /**
  * Update session data (if provided) and reissue JWS.
  */
-declare function updateJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: SessionConfigJWS<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWS<T, MaxAge>>;
+declare function updateJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: SessionConfigJWS<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWS<T, MaxAge>>;
 /**
  * Sign current session as a compact JWS.
  * Payload claims:
  *  jti, iat, exp?, data, plus optional extraClaims (cannot override reserved)
  */
-declare function signJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<string>;
+declare function signJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<string>;
 /**
  * Verify and parse a compact JWS into a Session structure.
  * Performs:
@@ -236,11 +241,11 @@ declare function signJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends
  *  - ensures jti & iat presence
  *  - enforces maxAge if provided
  */
-declare function verifyJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(_event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>, token: string): Promise<Partial<SessionJWS<T, MaxAge>>>;
+declare function verifyJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(_event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>, token: string): Promise<Partial<SessionJWS<T, MaxAge>>>;
 /**
  * Destroy the session (context + cookie).
  */
-declare function clearJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: Partial<SessionConfigJWS<T, MaxAge>>): Promise<void>;
+declare function clearJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: Partial<SessionConfigJWS<T, MaxAge>>): Promise<void>;
 
-export { JWEEncryptOptions, JWKSet, JWK_Private, JWK_Public, JWK_Symmetric, JWTClaimValidationOptions, JWTClaims, clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
-export type { SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWEConfig, SessionJWS, SessionJWSConfig, SessionManager, SessionUpdate };
+export { JWEEncryptOptions, JWKSet, JWK_Private, JWK_Public, JWK_Symmetric, JWTClaimValidationOptions, JWTClaims, clearJWESession, clearJWSSession, getJWESession, getJWESessionToken, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+export type { SessionClaims, SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWEConfig, SessionJWS, SessionJWSConfig, SessionManager, SessionUpdate };

package/dist/adapters/h3.mjs

@@ -33,6 +33,9 @@ async function useJWESession(event, config) {
     get data() {
       return event.context.sessions?.[sessionName]?.data || {};
     },
+    get token() {
+      return getJWESessionToken(event, config);
+    },
     update: async (update) => {
       if (!isEvent(event)) {
         throw new Error("[h3] Cannot update read-only session.");
@@ -84,20 +87,7 @@ async function getJWESession(event, config) {
     data: /* @__PURE__ */ Object.create(null)
   };
   event.context.sessions[sessionName] = session;
-  let token;
-  if (config.sessionHeader !== false) {
-    const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
-    const headerValue = _getReqHeader$1(event, headerName);
-    if (typeof headerValue === "string") {
-      token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
-    }
-  }
-  if (!token) {
-    const cookieHeader = _getReqHeader$1(event, "cookie");
-    if (cookieHeader) {
-      token = parse(String(cookieHeader))[sessionName];
-    }
-  }
+  const token = getJWESessionToken(event, config);
   if (token) {
     const promise = unsealJWESession(event, config, token).catch(async (error_) => {
       if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
@@ -142,6 +132,37 @@ async function getJWESession(event, config) {
   });
   return session;
 }
+function getJWESessionToken(event, config) {
+  const sessionName = config.name || DEFAULT_NAME$1;
+  let token;
+  if (config.sessionHeader !== false) {
+    const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
+    const headerValue = _getReqHeader$1(event, headerName);
+    if (typeof headerValue === "string") {
+      token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
+    }
+  }
+  if (!token) {
+    const cookieHeader = _getReqHeader$1(event, "cookie");
+    if (cookieHeader) {
+      token = parse(String(cookieHeader))[sessionName];
+    }
+  }
+  if (!token) {
+    const setCookie2 = _getResHeader$1(event, "set-cookie");
+    if (typeof setCookie2 === "string") {
+      token = findSetCookie$1(setCookie2, sessionName);
+    } else if (Array.isArray(setCookie2)) {
+      for (const sc of setCookie2) {
+        token = findSetCookie$1(sc, sessionName);
+        if (token) {
+          break;
+        }
+      }
+    }
+  }
+  return token;
+}
 function _getReqHeader$1(event, name) {
   if (event.node) {
     return event.node?.req.headers[name];
@@ -153,6 +174,14 @@ function _getReqHeader$1(event, name) {
     return event.headers.get(name);
   }
 }
+function _getResHeader$1(event, name) {
+  if (event.node) {
+    return event.node?.res.getHeader(name);
+  }
+  if (event.response) {
+    return event.response.headers?.get(name);
+  }
+}
 async function updateJWESession(event, config, update) {
   const sessionName = config.name || DEFAULT_NAME$1;
   const session = event.context.sessions?.[sessionName] || await getJWESession(event, config);
@@ -308,6 +337,11 @@ function getDecryptKey(key) {
   }
   return _key;
 }
+function findSetCookie$1(setCookie2, name) {
+  const regex = new RegExp(`(?:^|,\\s*)${name}=([^;]+)`);
+  const match = setCookie2.match(regex);
+  return match ? match[1] : void 0;
+}
 
 /**
  * This is a fork of h3 library's session utility functions.
@@ -337,6 +371,9 @@ async function useJWSSession(event, config) {
     get data() {
       return event.context.sessions?.[sessionName]?.data || {};
     },
+    get token() {
+      return getJWSSessionToken(event, config);
+    },
     update: async (update) => {
       if (!isEvent(event)) {
         throw new Error("[h3] Cannot update read-only session.");
@@ -388,20 +425,7 @@ async function getJWSSession(event, config) {
     data: /* @__PURE__ */ Object.create(null)
   };
   event.context.sessions[sessionName] = session;
-  let token;
-  if (config.sessionHeader !== false) {
-    const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
-    const headerValue = _getReqHeader(event, headerName);
-    if (typeof headerValue === "string") {
-      token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
-    }
-  }
-  if (!token) {
-    const cookieHeader = _getReqHeader(event, "cookie");
-    if (cookieHeader) {
-      token = parse(String(cookieHeader))[sessionName];
-    }
-  }
+  const token = getJWSSessionToken(event, config);
   if (token) {
     const promise = verifyJWSSession(event, config, token).catch(async (error_) => {
       if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
@@ -446,6 +470,37 @@ async function getJWSSession(event, config) {
   });
   return session;
 }
+function getJWSSessionToken(event, config) {
+  const sessionName = config.name || DEFAULT_NAME;
+  let token;
+  if (config.sessionHeader !== false) {
+    const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
+    const headerValue = _getReqHeader(event, headerName);
+    if (typeof headerValue === "string") {
+      token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
+    }
+  }
+  if (!token) {
+    const cookieHeader = _getReqHeader(event, "cookie");
+    if (cookieHeader) {
+      token = parse(String(cookieHeader))[sessionName];
+    }
+  }
+  if (!token) {
+    const setCookie2 = _getResHeader(event, "set-cookie");
+    if (typeof setCookie2 === "string") {
+      token = findSetCookie(setCookie2, sessionName);
+    } else if (Array.isArray(setCookie2)) {
+      for (const sc of setCookie2) {
+        token = findSetCookie(sc, sessionName);
+        if (token) {
+          break;
+        }
+      }
+    }
+  }
+  return token;
+}
 function _getReqHeader(event, name) {
   if (event.node) {
     return event.node.req.headers[name];
@@ -457,6 +512,14 @@ function _getReqHeader(event, name) {
     return event.headers.get(name);
   }
 }
+function _getResHeader(event, name) {
+  if (event.node) {
+    return event.node?.res.getHeader(name);
+  }
+  if (event.response) {
+    return event.response.headers?.get(name);
+  }
+}
 async function updateJWSSession(event, config, update) {
   const sessionName = config.name || DEFAULT_NAME;
   const session = event.context.sessions?.[sessionName] || await getJWSSession(event, config);
@@ -604,5 +667,10 @@ function getVerifyKey(key) {
   }
   return _key;
 }
+function findSetCookie(setCookie2, name) {
+  const regex = new RegExp(`(?:^|,\\s*)${name}=([^;]+)`);
+  const match = setCookie2.match(regex);
+  return match ? match[1] : void 0;
+}
 
-export { clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+export { clearJWESession, clearJWSSession, getJWESession, getJWESessionToken, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };

package/dist/adapters/h3v1.d.mts

@@ -1,7 +1,8 @@
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from '../shared/unjwt.9mL1vSFP.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from '../shared/unjwt.BU3IrsCv.mjs';
 export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, w as JWKSet, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, u as JWK_Private, t as JWK_Public, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, r as JWK_Symmetric, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, Z as JWTClaimValidationOptions, X as JWTClaims, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from '../shared/unjwt.CtHrClHc.mjs';
-export { SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWEConfig, SessionJWS, SessionJWSConfig, SessionManager, SessionUpdate, clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession } from './h3.mjs';
+export { SessionClaims, SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWEConfig, SessionJWS, SessionJWSConfig, SessionManager, SessionUpdate, clearJWESession, clearJWSSession, getJWESession, getJWESessionToken, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession } from './h3.mjs';
 export { d as deriveJWKFromPassword, e as exportJWKToPEM, g as generateJWK, i as importJWKFromPEM } from '../shared/unjwt.BjP_dGnX.mjs';
+import '../shared/unjwt.JdKqVANs.mjs';
 import 'cookie-es';
 import 'h3';
 import '../shared/unjwt.BsLgL0DQ.mjs';

package/dist/adapters/h3v1.mjs

@@ -1,5 +1,5 @@
 export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from '../shared/unjwt.DyouTtLD.mjs';
-export { clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession } from './h3.mjs';
+export { clearJWESession, clearJWSSession, getJWESession, getJWESessionToken, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession } from './h3.mjs';
 import '../shared/unjwt.Be8NxwFK.mjs';
 import 'h3';
 import 'cookie-es';

package/dist/adapters/h3v2.d.mts

@@ -1,32 +1,36 @@
-import { b as JWEEncryptOptions } from '../shared/unjwt.9mL1vSFP.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from '../shared/unjwt.9mL1vSFP.mjs';
+import { b as JWEEncryptOptions } from '../shared/unjwt.BU3IrsCv.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from '../shared/unjwt.BU3IrsCv.mjs';
 import { X as JWTClaims, E as ExpiresIn, r as JWK_Symmetric, u as JWK_Private, t as JWK_Public, Z as JWTClaimValidationOptions, w as JWKSet } from '../shared/unjwt.CtHrClHc.mjs';
 export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from '../shared/unjwt.CtHrClHc.mjs';
+import { S as StrictOmit } from '../shared/unjwt.JdKqVANs.mjs';
 import { HTTPEvent } from 'h3';
 import { CookieSerializeOptions } from 'cookie-es';
 import { c as JWSSignOptions } from '../shared/unjwt.BsLgL0DQ.mjs';
 export { d as deriveJWKFromPassword, e as exportJWKToPEM, g as generateJWK, i as importJWKFromPEM } from '../shared/unjwt.BjP_dGnX.mjs';
 
-type SessionData<T extends JWTClaims = JWTClaims> = Omit<T, "jti" | "iat" | "exp">;
-type SessionUpdate<T extends JWTClaims = JWTClaims> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
-interface SessionManager<T extends JWTClaims = JWTClaims, ConfigMaxAge extends ExpiresIn | undefined = number | undefined> {
+interface SessionClaims extends Required<Pick<JWTClaims, "jti" | "iat">>, Pick<JWTClaims, "exp"> {
+}
+type SessionData<T extends Record<string, any> = SessionClaims> = StrictOmit<T, "jti" | "iat" | "exp">;
+type SessionUpdate<T extends Record<string, any> = SessionClaims> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
+interface SessionManager<T extends Record<string, any> = SessionClaims, ConfigMaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     readonly id: string | undefined;
     readonly createdAt: number;
-    readonly expiresAt: ConfigMaxAge extends ExpiresIn ? number : T["exp"];
+    readonly expiresAt: ConfigMaxAge extends ExpiresIn ? number : "exp" extends keyof T ? T["exp"] : number | undefined;
     readonly data: SessionData<T>;
+    readonly token: string | undefined;
     update: (update: SessionUpdate<T>) => Promise<SessionManager<T>>;
     clear: () => Promise<SessionManager<T>>;
 }
 
 declare const kGetSessionPromise$1: unique symbol;
-interface SessionJWE<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+interface SessionJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     id: string;
     createdAt: number;
     expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
     data: SessionData<T>;
     [kGetSessionPromise$1]?: Promise<SessionJWE<T, MaxAge>>;
 }
-interface SessionHooksJWE<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+interface SessionHooksJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     onRead?: (args: {
         session: SessionJWE<T, MaxAge>;
         event: HTTPEvent;
@@ -52,7 +56,7 @@ interface SessionHooksJWE<T extends JWTClaims = JWTClaims, MaxAge extends Expire
         config: SessionConfigJWE<T, MaxAge>;
     }) => void | Promise<void>;
 }
-interface SessionConfigJWE<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+interface SessionConfigJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     /** Shared secret used, string for PBES2 or Json Web Key (JWK) */
     key: string | JWK_Symmetric | {
         privateKey: JWK_Private | JWK_Symmetric;
@@ -80,37 +84,38 @@ interface SessionConfigJWE<T extends JWTClaims = JWTClaims, MaxAge extends Expir
 /**
  * Create a session manager for the current request.
  */
-declare function useJWESession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
+declare function useJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
 /**
  * Get the session for the current request.
  */
-declare function getJWESession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>): Promise<SessionJWE<T, MaxAge>>;
+declare function getJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>): Promise<SessionJWE<T, MaxAge>>;
+declare function getJWESessionToken<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>): string | undefined;
 /**
  * Update the session data for the current request.
  */
-declare function updateJWESession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWE<T, MaxAge>>;
+declare function updateJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWE<T, MaxAge>>;
 /**
  * Produce a JWE for the current session.
  */
-declare function sealJWESession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>): Promise<string>;
+declare function sealJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>): Promise<string>;
 /**
  * Decrypt the JWE and return a Session-compatible object.
  */
-declare function unsealJWESession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(_event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>, sealed: string): Promise<Partial<SessionJWE<T, MaxAge>>>;
+declare function unsealJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(_event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>, sealed: string): Promise<Partial<SessionJWE<T, MaxAge>>>;
 /**
  * Clear the session (delete from context and drop cookie).
  */
-declare function clearJWESession<T extends JWTClaims, MaxAge extends ExpiresIn | undefined>(event: HTTPEvent, config: Partial<SessionConfigJWE<T, MaxAge>>): Promise<void>;
+declare function clearJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: Partial<SessionConfigJWE<T, MaxAge>>): Promise<void>;
 
 declare const kGetSessionPromise: unique symbol;
-interface SessionJWS<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+interface SessionJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     id: string;
     createdAt: number;
     expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
     data: SessionData<T>;
     [kGetSessionPromise]?: Promise<SessionJWS<T, MaxAge>>;
 }
-interface SessionHooksJWS<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+interface SessionHooksJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     onRead?: (args: {
         session: SessionJWS<T, MaxAge>;
         event: HTTPEvent;
@@ -136,7 +141,7 @@ interface SessionHooksJWS<T extends JWTClaims = JWTClaims, MaxAge extends Expire
         config: SessionConfigJWS<T, MaxAge>;
     }) => void | Promise<void>;
 }
-interface SessionConfigJWS<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+interface SessionConfigJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     key: JWK_Symmetric | {
         privateKey: JWK_Private;
         publicKey: JWK_Public | JWK_Public[] | JWKSet;
@@ -154,12 +159,13 @@ interface SessionConfigJWS<T extends JWTClaims = JWTClaims, MaxAge extends Expir
     };
     hooks?: SessionHooksJWS<T, MaxAge>;
 }
-declare function useJWSSession<T extends JWTClaims, MaxAge extends ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
-declare function getJWSSession<T extends JWTClaims, MaxAge extends ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionJWS<T, MaxAge>>;
-declare function updateJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWS<T, MaxAge>>;
-declare function signJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>): Promise<string>;
-declare function verifyJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(_event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>, token: string): Promise<Partial<SessionJWS<T, MaxAge>>>;
-declare function clearJWSSession<T extends JWTClaims = JWTClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: Partial<SessionConfigJWS<T, MaxAge>>): Promise<void>;
+declare function useJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
+declare function getJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionJWS<T, MaxAge>>;
+declare function getJWSSessionToken<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>): string | undefined;
+declare function updateJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWS<T, MaxAge>>;
+declare function signJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>): Promise<string>;
+declare function verifyJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(_event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>, token: string): Promise<Partial<SessionJWS<T, MaxAge>>>;
+declare function clearJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: Partial<SessionConfigJWS<T, MaxAge>>): Promise<void>;
 
-export { JWEEncryptOptions, JWKSet, JWK_Private, JWK_Public, JWK_Symmetric, JWTClaimValidationOptions, JWTClaims, clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
-export type { SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWS, SessionManager, SessionUpdate };
+export { JWEEncryptOptions, JWKSet, JWK_Private, JWK_Public, JWK_Symmetric, JWTClaimValidationOptions, JWTClaims, clearJWESession, clearJWSSession, getJWESession, getJWESessionToken, getJWSSession, getJWSSessionToken, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+export type { SessionClaims, SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWS, SessionManager, SessionUpdate };

package/dist/adapters/h3v2.mjs

@@ -28,6 +28,9 @@ async function useJWESession(event, config) {
     get data() {
       return getSessionFromContext$1(event, sessionName)?.data || {};
     },
+    get token() {
+      return getJWESessionToken(event, config);
+    },
     update: async (update) => {
       await updateJWESession(event, config, update);
       return sessionManager;
@@ -74,17 +77,7 @@ async function getJWESession(event, config) {
     data: new NullProtoObj()
   };
   context.sessions[sessionName] = session;
-  let token;
-  if (config.sessionHeader !== false) {
-    const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
-    const headerValue = event.req.headers.get(headerName);
-    if (typeof headerValue === "string") {
-      token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
-    }
-  }
-  if (!token) {
-    token = getChunkedCookie(event, sessionName);
-  }
+  const token = getJWESessionToken(event, config);
   if (token) {
     const promise = unsealJWESession(event, config, token).catch(async (error_) => {
       if (error_ instanceof Error) {
@@ -127,6 +120,27 @@ async function getJWESession(event, config) {
   });
   return session;
 }
+function getJWESessionToken(event, config) {
+  const sessionName = config.name || DEFAULT_NAME$1;
+  let token;
+  if (config.sessionHeader !== false) {
+    const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
+    const headerValue = event.req.headers.get(headerName);
+    if (typeof headerValue === "string") {
+      token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
+    }
+  }
+  if (!token) {
+    token = getChunkedCookie(event, sessionName);
+  }
+  if (!token && hasWritableResponse$1(event)) {
+    const setCookie = event.res.headers.get("set-cookie");
+    if (typeof setCookie === "string") {
+      token = findSetCookie$1(setCookie, sessionName);
+    }
+  }
+  return token;
+}
 async function updateJWESession(event, config, update) {
   const sessionName = config.name || DEFAULT_NAME$1;
   const context = getEventContext(event);
@@ -290,6 +304,11 @@ function getDecryptKey(key) {
   }
   return _key;
 }
+function findSetCookie$1(setCookie, name) {
+  const regex = new RegExp(`(?:^|,\\s*)${name}=([^;]+)`);
+  const match = setCookie.match(regex);
+  return match ? match[1] : void 0;
+}
 
 const kGetSessionPromise = Symbol("h3_jws_getSession");
 const DEFAULT_NAME = "h3-jws";
@@ -314,6 +333,9 @@ async function useJWSSession(event, config) {
     get data() {
       return getSessionFromContext(event, sessionName)?.data || {};
     },
+    get token() {
+      return getJWSSessionToken(event, config);
+    },
     update: async (update) => {
       await updateJWSSession(event, config, update);
       return sessionManager;
@@ -360,17 +382,7 @@ async function getJWSSession(event, config) {
     data: new NullProtoObj()
   };
   context.sessions[sessionName] = session;
-  let token;
-  if (config.sessionHeader !== false) {
-    const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
-    const headerValue = event.req.headers.get(headerName);
-    if (typeof headerValue === "string") {
-      token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
-    }
-  }
-  if (!token) {
-    token = getChunkedCookie(event, sessionName);
-  }
+  const token = getJWSSessionToken(event, config);
   if (token) {
     const promise = verifyJWSSession(event, config, token).catch(async (error_) => {
       if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
@@ -410,6 +422,27 @@ async function getJWSSession(event, config) {
   });
   return session;
 }
+function getJWSSessionToken(event, config) {
+  const sessionName = config.name || DEFAULT_NAME;
+  let token;
+  if (config.sessionHeader !== false) {
+    const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
+    const headerValue = event.req.headers.get(headerName);
+    if (typeof headerValue === "string") {
+      token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
+    }
+  }
+  if (!token) {
+    token = getChunkedCookie(event, sessionName);
+  }
+  if (!token && hasWritableResponse(event)) {
+    const setCookie = event.res.headers.get("set-cookie");
+    if (typeof setCookie === "string") {
+      token = findSetCookie(setCookie, sessionName);
+    }
+  }
+  return token;
+}
 async function updateJWSSession(event, config, update) {
   const sessionName = config.name || DEFAULT_NAME;
   const context = getEventContext(event);
@@ -580,5 +613,10 @@ function getVerifyKey(key) {
   }
   return _key;
 }
+function findSetCookie(setCookie, name) {
+  const regex = new RegExp(`(?:^|,\\s*)${name}=([^;]+)`);
+  const match = setCookie.match(regex);
+  return match ? match[1] : void 0;
+}
 
-export { clearJWESession, clearJWSSession, getJWESession, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+export { clearJWESession, clearJWSSession, getJWESession, getJWESessionToken, getJWSSession, getJWSSessionToken, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };

package/dist/index.d.mts

@@ -1,7 +1,8 @@
 export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, E as ExpiresIn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, w as JWKSet, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, u as JWK_Private, t as JWK_Public, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, r as JWK_Symmetric, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, Z as JWTClaimValidationOptions, X as JWTClaims, V as JoseHeaderParameters, K as KeyManagementAlgorithm, M as MaxTokenAge, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './shared/unjwt.CtHrClHc.mjs';
-export { i as utils } from './shared/unjwt.BrNGm4On.mjs';
-export { j as jwe } from './shared/unjwt.VUfJDcCJ.mjs';
+export { i as utils } from './shared/unjwt.CkkdXjZD.mjs';
+export { j as jwe } from './shared/unjwt.B9nv94SS.mjs';
 export { j as jwk } from './shared/unjwt.BjP_dGnX.mjs';
 export { j as jws } from './shared/unjwt.C5jNR_1K.mjs';
 export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult } from './shared/unjwt.BsLgL0DQ.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from './shared/unjwt.9mL1vSFP.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from './shared/unjwt.BU3IrsCv.mjs';
+import './shared/unjwt.JdKqVANs.mjs';

package/dist/jwe.d.mts

@@ -1,3 +1,4 @@
 export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, w as JWKSet, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, u as JWK_Private, t as JWK_Public, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, r as JWK_Symmetric, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, Z as JWTClaimValidationOptions, X as JWTClaims, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './shared/unjwt.CtHrClHc.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from './shared/unjwt.9mL1vSFP.mjs';
-export { d as decrypt, e as encrypt } from './shared/unjwt.VUfJDcCJ.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from './shared/unjwt.BU3IrsCv.mjs';
+export { d as decrypt, e as encrypt } from './shared/unjwt.B9nv94SS.mjs';
+import './shared/unjwt.JdKqVANs.mjs';

package/dist/shared/{unjwt.VUfJDcCJ.d.mts → unjwt.B9nv94SS.d.mts}

@@ -1,5 +1,5 @@
 import { X as JWTClaims, v as JWK, K as KeyManagementAlgorithm, f as ContentEncryptionAlgorithm, r as JWK_Symmetric, u as JWK_Private, C as CompositeKey, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, w as JWKSet, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, t as JWK_Public, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, Z as JWTClaimValidationOptions, V as JoseHeaderParameters, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './unjwt.CtHrClHc.mjs';
-import { b as JWEEncryptOptions, c as JWEKeyLookupFunction, d as JWEDecryptOptions, e as JWEDecryptResult, J as JWEHeaderParameters, a as JWEKeyManagementHeaderParameters } from './unjwt.9mL1vSFP.mjs';
+import { b as JWEEncryptOptions, c as JWEKeyLookupFunction, d as JWEDecryptOptions, e as JWEDecryptResult, J as JWEHeaderParameters, a as JWEKeyManagementHeaderParameters } from './unjwt.BU3IrsCv.mjs';
 
 /**
  * Encrypts a payload to produce a JWE Compact Serialization string.

package/dist/shared/{unjwt.9mL1vSFP.d.mts → unjwt.BU3IrsCv.d.mts}

@@ -1,4 +1,5 @@
 import { K as KeyManagementAlgorithm, f as ContentEncryptionAlgorithm, E as ExpiresIn, V as JoseHeaderParameters, h as JWK_EC_Public, i as JWK_EC_Private, v as JWK, Z as JWTClaimValidationOptions, X as JWTClaims } from './unjwt.CtHrClHc.mjs';
+import { S as StrictOmit } from './unjwt.JdKqVANs.mjs';
 
 /** Recognized JWE Header Parameters, any other Header Members may also be present. */
 interface JWEHeaderParameters extends JoseHeaderParameters {
@@ -79,7 +80,7 @@ interface JWEEncryptOptions {
     /** Time at which the JWT should expire, if no `exp` was already provided (only when typ is "JWT" or explicitly parsing JWT). */
     expiresIn?: ExpiresIn;
     /** Additional JWE Protected Header parameters. */
-    protectedHeader?: Omit<JWEHeaderParameters, "alg" | "enc" | "iv" | "tag" | "p2s" | "p2c" | "epk" | "apu" | "apv">;
+    protectedHeader?: StrictOmit<JWEHeaderParameters, "alg" | "enc" | "iv" | "tag" | "p2s" | "p2c" | "epk" | "apu" | "apv">;
     /** Initialization Vector for AES-GCMKW key wrapping. Generated if not provided. */
     keyManagementIV?: Uint8Array<ArrayBuffer>;
     /** PBES2 Salt value (p2s). Required for PBES2 algorithms. */

package/dist/shared/{unjwt.BrNGm4On.d.mts → unjwt.CkkdXjZD.d.mts}

@@ -1,4 +1,5 @@
 import { E as ExpiresIn, X as JWTClaims, Z as JWTClaimValidationOptions, v as JWK, w as JWKSet, q as JWK_oct, u as JWK_Private, t as JWK_Public } from './unjwt.CtHrClHc.mjs';
+import { S as StrictOmit } from './unjwt.JdKqVANs.mjs';
 
 /**
  * Apply default typ/cty semantics shared by JWS & JWE.
@@ -101,6 +102,7 @@ declare function isPrivateJWK(key: unknown): key is JWK_Private;
  */
 declare function isPublicJWK(key: unknown): key is JWK_Public;
 
+declare const index_StrictOmit: typeof StrictOmit;
 declare const index_applyTypCtyDefaults: typeof applyTypCtyDefaults;
 declare const index_assertCryptoKey: typeof assertCryptoKey;
 declare const index_base64Decode: typeof base64Decode;
@@ -134,6 +136,7 @@ declare const index_validateCriticalHeadersJWS: typeof validateCriticalHeadersJW
 declare const index_validateJwtClaims: typeof validateJwtClaims;
 declare namespace index {
   export {
+    index_StrictOmit as StrictOmit,
     index_applyTypCtyDefaults as applyTypCtyDefaults,
     index_assertCryptoKey as assertCryptoKey,
     index_base64Decode as base64Decode,

package/dist/shared/unjwt.JdKqVANs.d.mts

@@ -0,0 +1,5 @@
+type StrictOmit<T, K extends keyof T | (string & {}) | (number & {}) | (symbol & {})> = {
+    [P in keyof T as P extends K ? never : P]: T[P];
+};
+
+export type { StrictOmit as S };

package/dist/utils.d.mts

@@ -1,2 +1,3 @@
 import './shared/unjwt.CtHrClHc.mjs';
-export { s as applyTypCtyDefaults, j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, z as computeExpiresInSeconds, B as computeJwtTimeClaims, A as computeMaxTokenAgeSeconds, f as concatUint8Arrays, v as decodeMaybeJWTString, x as decodePayloadFromB64UrlSegment, w as decodePayloadFromBytes, y as getPlaintextBytes, o as isAsymmetricJWK, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, u as isJWTContent, p as isPrivateJWK, q as isPublicJWK, n as isSymmetricJWK, m as maybeArray, r as randomBytes, F as sanitizeObject, a as textDecoder, t as textEncoder, E as validateCriticalHeadersJWE, D as validateCriticalHeadersJWS, C as validateJwtClaims } from './shared/unjwt.BrNGm4On.mjs';
+export { S as StrictOmit } from './shared/unjwt.JdKqVANs.mjs';
+export { s as applyTypCtyDefaults, j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, z as computeExpiresInSeconds, B as computeJwtTimeClaims, A as computeMaxTokenAgeSeconds, f as concatUint8Arrays, v as decodeMaybeJWTString, x as decodePayloadFromB64UrlSegment, w as decodePayloadFromBytes, y as getPlaintextBytes, o as isAsymmetricJWK, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, u as isJWTContent, p as isPrivateJWK, q as isPublicJWK, n as isSymmetricJWK, m as maybeArray, r as randomBytes, F as sanitizeObject, a as textDecoder, t as textEncoder, E as validateCriticalHeadersJWE, D as validateCriticalHeadersJWS, C as validateJwtClaims } from './shared/unjwt.CkkdXjZD.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.29",
+  "version": "0.5.31",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",
@@ -56,7 +56,7 @@
     "lint": "eslint . && prettier -c .",
     "lint:fix": "automd && eslint . --fix && prettier -w .",
     "prepack": "pnpm build",
-    "release": "pnpm test && pnpm prepack && changelogen --release --push --publish",
+    "release": "pnpm test && pnpm prepack && changelogen --release --push",
     "test": "pnpm lint && pnpm test:types && vitest run --slowTestThreshold=1000",
     "test:coverage": "pnpm lint && pnpm test:types && vitest run --coverage --slowTestThreshold=1000",
     "test:types": "tsc --noEmit --skipLibCheck",