unjwt 0.5.32 → 0.5.34

package/dist/adapters/h3.d.mts

@@ -1,12 +1,12 @@
-import { b as JWEEncryptOptions } from '../shared/unjwt.BU3IrsCv.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from '../shared/unjwt.BU3IrsCv.mjs';
-import { X as JWTClaims, E as ExpiresIn, r as JWK_Symmetric, u as JWK_Private, t as JWK_Public, Z as JWTClaimValidationOptions, w as JWKSet } from '../shared/unjwt.CtHrClHc.mjs';
-export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from '../shared/unjwt.CtHrClHc.mjs';
+import { b as JWEEncryptOptions, J as JWEHeaderParameters } from '../shared/unjwt.CMNtw8ek.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from '../shared/unjwt.CMNtw8ek.mjs';
+import { X as JWTClaims, E as ExpiresIn, r as JWK_Symmetric, u as JWK_Private, t as JWK_Public, Z as JWTClaimValidationOptions, w as JWKSet } from '../shared/unjwt.BCi3FEWr.mjs';
+export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, H as JWK_AES_CBC_HMAC, I as JWK_AES_GCM, L as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from '../shared/unjwt.BCi3FEWr.mjs';
 import { S as StrictOmit } from '../shared/unjwt.JdKqVANs.mjs';
 import { CookieSerializeOptions } from 'cookie-es';
 import { H3Event } from 'h3';
-import { c as JWSSignOptions } from '../shared/unjwt.BsLgL0DQ.mjs';
-export { d as deriveJWKFromPassword, e as exportJWKToPEM, g as generateJWK, i as importJWKFromPEM } from '../shared/unjwt.BjP_dGnX.mjs';
+import { c as JWSSignOptions, b as JWSProtectedHeader } from '../shared/unjwt.BqdNUKDr.mjs';
+export { d as deriveJWKFromPassword, e as exportJWKToPEM, g as generateJWK, i as importJWKFromPEM } from '../shared/unjwt.BYDTEWa-.mjs';
 
 interface SessionClaims extends Required<Pick<JWTClaims, "jti" | "iat">>, StrictOmit<JWTClaims, "jti" | "iat"> {
 }
@@ -48,6 +48,7 @@ interface SessionHooksJWE<T extends Record<string, any> = SessionClaims, MaxAge
         config: SessionConfigJWE<T, MaxAge>;
     }) => void | Promise<void>;
     onClear?: (args: {
+        session: SessionJWE<T, MaxAge> | undefined;
         event: H3Event;
         config: Partial<SessionConfigJWE<T, MaxAge>>;
     }) => void | Promise<void>;
@@ -61,6 +62,11 @@ interface SessionHooksJWE<T extends Record<string, any> = SessionClaims, MaxAge
         error: any;
         config: SessionConfigJWE<T, MaxAge>;
     }) => void | Promise<void>;
+    onUnsealKeyLookup?: (args: {
+        header: JWEHeaderParameters;
+        event: H3Event;
+        config: SessionConfigJWE<T, MaxAge>;
+    }) => JWK_Symmetric | JWK_Private | Promise<JWK_Symmetric | JWK_Private>;
 }
 interface SessionConfigJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     /** @deprecated use `key` instead */
@@ -130,7 +136,7 @@ declare function sealJWESession<T extends Record<string, any> = SessionClaims, M
 /**
  * Decrypt the JWE and return a Session-compatible object.
  */
-declare function unsealJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(_event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>, sealed: string): Promise<Partial<SessionJWE<T, MaxAge>>>;
+declare function unsealJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>, sealed: string): Promise<Partial<SessionJWE<T, MaxAge>>>;
 /**
  * Clear the session (delete from context and drop cookie).
  */
@@ -162,6 +168,7 @@ interface SessionHooksJWS<T extends Record<string, any> = SessionClaims, MaxAge
         config: SessionConfigJWS<T, MaxAge>;
     }) => void | Promise<void>;
     onClear?: (args: {
+        session: SessionJWS<T, MaxAge> | undefined;
         event: H3Event;
         config: Partial<SessionConfigJWS<T, MaxAge>>;
     }) => void | Promise<void>;
@@ -175,6 +182,11 @@ interface SessionHooksJWS<T extends Record<string, any> = SessionClaims, MaxAge
         error: any;
         config: SessionConfigJWS<T, MaxAge>;
     }) => void | Promise<void>;
+    onVerifyKeyLookup?: (args: {
+        header: JWSProtectedHeader;
+        event: H3Event;
+        config: SessionConfigJWS<T, MaxAge>;
+    }) => JWKSet | JWK_Symmetric | JWK_Public | Promise<JWKSet | JWK_Symmetric | JWK_Public>;
 }
 interface SessionConfigJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     /**
@@ -241,11 +253,11 @@ declare function signJWSSession<T extends Record<string, any> = SessionClaims, M
  *  - ensures jti & iat presence
  *  - enforces maxAge if provided
  */
-declare function verifyJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(_event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>, token: string): Promise<Partial<SessionJWS<T, MaxAge>>>;
+declare function verifyJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>, token: string): Promise<Partial<SessionJWS<T, MaxAge>>>;
 /**
  * Destroy the session (context + cookie).
  */
 declare function clearJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: Partial<SessionConfigJWS<T, MaxAge>>): Promise<void>;
 
-export { JWEEncryptOptions, JWKSet, JWK_Private, JWK_Public, JWK_Symmetric, JWTClaimValidationOptions, JWTClaims, clearJWESession, clearJWSSession, getJWESession, getJWESessionToken, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+export { JWEEncryptOptions, JWEHeaderParameters, JWKSet, JWK_Private, JWK_Public, JWK_Symmetric, JWTClaimValidationOptions, JWTClaims, clearJWESession, clearJWSSession, getJWESession, getJWESessionToken, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
 export type { SessionClaims, SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWEConfig, SessionJWS, SessionJWSConfig, SessionManager, SessionUpdate };

package/dist/adapters/h3.mjs

@@ -1,9 +1,9 @@
-export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from '../shared/unjwt.DyouTtLD.mjs';
+export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from '../shared/unjwt.Dpl__ZAR.mjs';
 import { isEvent, setCookie } from 'h3';
 import { parse } from 'cookie-es';
-import { e as encrypt, d as decrypt } from '../shared/unjwt.KqQq9jpF.mjs';
+import { e as encrypt, d as decrypt } from '../shared/unjwt.B-v62plj.mjs';
 import { p as computeExpiresInSeconds, q as isSymmetricJWK, u as isPrivateJWK, w as isPublicJWK } from '../shared/unjwt.Be8NxwFK.mjs';
-import { s as sign, v as verify } from '../shared/unjwt.DQVUT7FU.mjs';
+import { s as sign, v as verify } from '../shared/unjwt.DdLN9vwI.mjs';
 
 /**
  * This is a fork of h3 library's session utility functions.
@@ -142,13 +142,7 @@ function getJWESessionToken(event, config) {
       token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
     }
   }
-  if (!token) {
-    const cookieHeader = _getReqHeader$1(event, "cookie");
-    if (cookieHeader) {
-      token = parse(String(cookieHeader))[sessionName];
-    }
-  }
-  if (!token) {
+  if (config.cookie !== false) {
     const setCookie2 = _getResHeader$1(event, "set-cookie");
     if (typeof setCookie2 === "string") {
       token = findSetCookie$1(setCookie2, sessionName);
@@ -161,6 +155,12 @@ function getJWESessionToken(event, config) {
       }
     }
   }
+  if (!token) {
+    const cookieHeader = _getReqHeader$1(event, "cookie");
+    if (cookieHeader) {
+      token = parse(String(cookieHeader))[sessionName];
+    }
+  }
   return token;
 }
 function _getReqHeader$1(event, name) {
@@ -240,8 +240,12 @@ async function sealJWESession(event, config) {
   });
   return token;
 }
-async function unsealJWESession(_event, config, sealed) {
-  const key = getDecryptKey(config.key || config.secret);
+async function unsealJWESession(event, config, sealed) {
+  const key = config.hooks?.onUnsealKeyLookup ? (header) => config.hooks.onUnsealKeyLookup({
+    header,
+    event,
+    config
+  }) : getDecryptKey(config.key || config.secret);
   const alg = config.jwe?.encryptOptions?.alg;
   const enc = config.jwe?.encryptOptions?.enc;
   if (config.jwe?.encryptOptions?.protectedHeader?.typ && typeof config.jwe.encryptOptions.protectedHeader.typ === "string" && config.jwe.encryptOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
@@ -281,6 +285,10 @@ async function unsealJWESession(_event, config, sealed) {
 }
 async function clearJWESession(event, config) {
   const sessionName = config.name || DEFAULT_NAME$1;
+  let session = event.context.sessions?.[sessionName];
+  if (session && session[kGetSessionPromise$1]) {
+    session = await session[kGetSessionPromise$1];
+  }
   if (event.context.sessions?.[sessionName]) {
     delete event.context.sessions[sessionName];
   }
@@ -291,6 +299,7 @@ async function clearJWESession(event, config) {
     maxAge: void 0
   });
   await config.hooks?.onClear?.({
+    session,
     event,
     config
   });
@@ -480,13 +489,7 @@ function getJWSSessionToken(event, config) {
       token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
     }
   }
-  if (!token) {
-    const cookieHeader = _getReqHeader(event, "cookie");
-    if (cookieHeader) {
-      token = parse(String(cookieHeader))[sessionName];
-    }
-  }
-  if (!token) {
+  if (config.cookie !== false) {
     const setCookie2 = _getResHeader(event, "set-cookie");
     if (typeof setCookie2 === "string") {
       token = findSetCookie(setCookie2, sessionName);
@@ -499,6 +502,12 @@ function getJWSSessionToken(event, config) {
       }
     }
   }
+  if (!token) {
+    const cookieHeader = _getReqHeader(event, "cookie");
+    if (cookieHeader) {
+      token = parse(String(cookieHeader))[sessionName];
+    }
+  }
   return token;
 }
 function _getReqHeader(event, name) {
@@ -577,9 +586,13 @@ async function signJWSSession(event, config) {
   });
   return token;
 }
-async function verifyJWSSession(_event, config, token) {
+async function verifyJWSSession(event, config, token) {
   const alg = config.jws?.signOptions?.alg;
-  const jwk = getVerifyKey(config.key);
+  const jwk = config.hooks?.onVerifyKeyLookup ? (header) => config.hooks.onVerifyKeyLookup({
+    header,
+    event,
+    config
+  }) : getVerifyKey(config.key);
   let typ = void 0;
   if (config.jws?.signOptions?.protectedHeader?.typ && typeof config.jws.signOptions.protectedHeader.typ === "string" && config.jws.signOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
     typ = config.jws.signOptions.protectedHeader.typ;
@@ -612,6 +625,10 @@ async function verifyJWSSession(_event, config, token) {
 }
 async function clearJWSSession(event, config) {
   const sessionName = config.name || DEFAULT_NAME;
+  let session = event.context.sessions?.[sessionName];
+  if (session && session[kGetSessionPromise]) {
+    session = await session[kGetSessionPromise];
+  }
   if (event.context.sessions?.[sessionName]) {
     delete event.context.sessions[sessionName];
   }
@@ -622,6 +639,7 @@ async function clearJWSSession(event, config) {
     maxAge: void 0
   });
   await config.hooks?.onClear?.({
+    session,
     event,
     config
   });

package/dist/adapters/h3v1.d.mts

@@ -1,8 +1,8 @@
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from '../shared/unjwt.BU3IrsCv.mjs';
-export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, w as JWKSet, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, u as JWK_Private, t as JWK_Public, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, r as JWK_Symmetric, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, Z as JWTClaimValidationOptions, X as JWTClaims, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from '../shared/unjwt.CtHrClHc.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from '../shared/unjwt.CMNtw8ek.mjs';
+export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, w as JWKSet, H as JWK_AES_CBC_HMAC, I as JWK_AES_GCM, L as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, u as JWK_Private, t as JWK_Public, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, r as JWK_Symmetric, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, Z as JWTClaimValidationOptions, X as JWTClaims, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from '../shared/unjwt.BCi3FEWr.mjs';
 export { SessionClaims, SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWEConfig, SessionJWS, SessionJWSConfig, SessionManager, SessionUpdate, clearJWESession, clearJWSSession, getJWESession, getJWESessionToken, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession } from './h3.mjs';
-export { d as deriveJWKFromPassword, e as exportJWKToPEM, g as generateJWK, i as importJWKFromPEM } from '../shared/unjwt.BjP_dGnX.mjs';
+export { d as deriveJWKFromPassword, e as exportJWKToPEM, g as generateJWK, i as importJWKFromPEM } from '../shared/unjwt.BYDTEWa-.mjs';
 import '../shared/unjwt.JdKqVANs.mjs';
 import 'cookie-es';
 import 'h3';
-import '../shared/unjwt.BsLgL0DQ.mjs';
+import '../shared/unjwt.BqdNUKDr.mjs';

package/dist/adapters/h3v1.mjs

@@ -1,7 +1,7 @@
-export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from '../shared/unjwt.DyouTtLD.mjs';
+export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from '../shared/unjwt.Dpl__ZAR.mjs';
 export { clearJWESession, clearJWSSession, getJWESession, getJWESessionToken, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession } from './h3.mjs';
 import '../shared/unjwt.Be8NxwFK.mjs';
 import 'h3';
 import 'cookie-es';
-import '../shared/unjwt.KqQq9jpF.mjs';
-import '../shared/unjwt.DQVUT7FU.mjs';
+import '../shared/unjwt.B-v62plj.mjs';
+import '../shared/unjwt.DdLN9vwI.mjs';

package/dist/adapters/h3v2.d.mts

@@ -1,12 +1,12 @@
-import { b as JWEEncryptOptions } from '../shared/unjwt.BU3IrsCv.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from '../shared/unjwt.BU3IrsCv.mjs';
-import { X as JWTClaims, E as ExpiresIn, r as JWK_Symmetric, u as JWK_Private, t as JWK_Public, Z as JWTClaimValidationOptions, w as JWKSet } from '../shared/unjwt.CtHrClHc.mjs';
-export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from '../shared/unjwt.CtHrClHc.mjs';
+import { b as JWEEncryptOptions, J as JWEHeaderParameters } from '../shared/unjwt.CMNtw8ek.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from '../shared/unjwt.CMNtw8ek.mjs';
+import { X as JWTClaims, E as ExpiresIn, r as JWK_Symmetric, u as JWK_Private, t as JWK_Public, Z as JWTClaimValidationOptions, w as JWKSet } from '../shared/unjwt.BCi3FEWr.mjs';
+export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, H as JWK_AES_CBC_HMAC, I as JWK_AES_GCM, L as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from '../shared/unjwt.BCi3FEWr.mjs';
 import { S as StrictOmit } from '../shared/unjwt.JdKqVANs.mjs';
 import { HTTPEvent } from 'h3';
 import { CookieSerializeOptions } from 'cookie-es';
-import { c as JWSSignOptions } from '../shared/unjwt.BsLgL0DQ.mjs';
-export { d as deriveJWKFromPassword, e as exportJWKToPEM, g as generateJWK, i as importJWKFromPEM } from '../shared/unjwt.BjP_dGnX.mjs';
+import { c as JWSSignOptions, b as JWSProtectedHeader } from '../shared/unjwt.BqdNUKDr.mjs';
+export { d as deriveJWKFromPassword, e as exportJWKToPEM, g as generateJWK, i as importJWKFromPEM } from '../shared/unjwt.BYDTEWa-.mjs';
 
 interface SessionClaims extends Required<Pick<JWTClaims, "jti" | "iat">>, StrictOmit<JWTClaims, "jti" | "iat"> {
 }
@@ -42,6 +42,7 @@ interface SessionHooksJWE<T extends Record<string, any> = SessionClaims, MaxAge
         config: SessionConfigJWE<T, MaxAge>;
     }) => void | Promise<void>;
     onClear?: (args: {
+        session: SessionJWE<T, MaxAge> | undefined;
         event: HTTPEvent;
         config: Partial<SessionConfigJWE<T, MaxAge>>;
     }) => void | Promise<void>;
@@ -55,6 +56,11 @@ interface SessionHooksJWE<T extends Record<string, any> = SessionClaims, MaxAge
         error: any;
         config: SessionConfigJWE<T, MaxAge>;
     }) => void | Promise<void>;
+    onUnsealKeyLookup?: (args: {
+        header: JWEHeaderParameters;
+        event: HTTPEvent;
+        config: SessionConfigJWE<T, MaxAge>;
+    }) => JWK_Symmetric | JWK_Private | Promise<JWK_Symmetric | JWK_Private>;
 }
 interface SessionConfigJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     /** Shared secret used, string for PBES2 or Json Web Key (JWK) */
@@ -101,7 +107,7 @@ declare function sealJWESession<T extends Record<string, any> = SessionClaims, M
 /**
  * Decrypt the JWE and return a Session-compatible object.
  */
-declare function unsealJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(_event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>, sealed: string): Promise<Partial<SessionJWE<T, MaxAge>>>;
+declare function unsealJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWE<T, MaxAge>, sealed: string): Promise<Partial<SessionJWE<T, MaxAge>>>;
 /**
  * Clear the session (delete from context and drop cookie).
  */
@@ -127,6 +133,7 @@ interface SessionHooksJWS<T extends Record<string, any> = SessionClaims, MaxAge
         config: SessionConfigJWS<T, MaxAge>;
     }) => void | Promise<void>;
     onClear?: (args: {
+        session: SessionJWS<T, MaxAge> | undefined;
         event: HTTPEvent;
         config: Partial<SessionConfigJWS<T, MaxAge>>;
     }) => void | Promise<void>;
@@ -140,6 +147,11 @@ interface SessionHooksJWS<T extends Record<string, any> = SessionClaims, MaxAge
         error: any;
         config: SessionConfigJWS<T, MaxAge>;
     }) => void | Promise<void>;
+    onVerifyKeyLookup?: (args: {
+        header: JWSProtectedHeader;
+        event: HTTPEvent;
+        config: SessionConfigJWS<T, MaxAge>;
+    }) => JWKSet | JWK_Symmetric | JWK_Public | Promise<JWKSet | JWK_Symmetric | JWK_Public>;
 }
 interface SessionConfigJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
     key: JWK_Symmetric | {
@@ -164,8 +176,8 @@ declare function getJWSSession<T extends Record<string, any> = SessionClaims, Ma
 declare function getJWSSessionToken<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>): string | undefined;
 declare function updateJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWS<T, MaxAge>>;
 declare function signJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>): Promise<string>;
-declare function verifyJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(_event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>, token: string): Promise<Partial<SessionJWS<T, MaxAge>>>;
+declare function verifyJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: SessionConfigJWS<T, MaxAge>, token: string): Promise<Partial<SessionJWS<T, MaxAge>>>;
 declare function clearJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: HTTPEvent, config: Partial<SessionConfigJWS<T, MaxAge>>): Promise<void>;
 
-export { JWEEncryptOptions, JWKSet, JWK_Private, JWK_Public, JWK_Symmetric, JWTClaimValidationOptions, JWTClaims, clearJWESession, clearJWSSession, getJWESession, getJWESessionToken, getJWSSession, getJWSSessionToken, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+export { JWEEncryptOptions, JWEHeaderParameters, JWKSet, JWK_Private, JWK_Public, JWK_Symmetric, JWTClaimValidationOptions, JWTClaims, clearJWESession, clearJWSSession, getJWESession, getJWESessionToken, getJWSSession, getJWSSessionToken, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
 export type { SessionClaims, SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWS, SessionManager, SessionUpdate };

package/dist/adapters/h3v2.mjs

@@ -1,9 +1,9 @@
-export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from '../shared/unjwt.DyouTtLD.mjs';
+export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from '../shared/unjwt.Dpl__ZAR.mjs';
 import { getEventContext, getChunkedCookie, setChunkedCookie } from 'h3';
 import { NullProtoObj } from 'rou3';
-import { e as encrypt, d as decrypt } from '../shared/unjwt.KqQq9jpF.mjs';
+import { e as encrypt, d as decrypt } from '../shared/unjwt.B-v62plj.mjs';
 import { p as computeExpiresInSeconds, q as isSymmetricJWK, u as isPrivateJWK, w as isPublicJWK } from '../shared/unjwt.Be8NxwFK.mjs';
-import { s as sign, v as verify } from '../shared/unjwt.DQVUT7FU.mjs';
+import { s as sign, v as verify } from '../shared/unjwt.DdLN9vwI.mjs';
 
 const kGetSessionPromise$1 = Symbol("h3_jwe_getSession");
 const DEFAULT_NAME$1 = "h3-jwe";
@@ -130,15 +130,15 @@ function getJWESessionToken(event, config) {
       token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
     }
   }
-  if (!token) {
-    token = getChunkedCookie(event, sessionName);
-  }
-  if (!token && hasWritableResponse$1(event)) {
+  if (config.cookie !== false && hasWritableResponse$1(event)) {
     const setCookie = event.res.headers.get("set-cookie");
     if (typeof setCookie === "string") {
       token = findSetCookie$1(setCookie, sessionName);
     }
   }
+  if (!token) {
+    token = getChunkedCookie(event, sessionName);
+  }
   return token;
 }
 async function updateJWESession(event, config, update) {
@@ -199,8 +199,12 @@ async function sealJWESession(event, config) {
   });
   return token;
 }
-async function unsealJWESession(_event, config, sealed) {
-  const key = getDecryptKey(config.key);
+async function unsealJWESession(event, config, sealed) {
+  const key = config.hooks?.onUnsealKeyLookup ? (header) => config.hooks.onUnsealKeyLookup({
+    header,
+    event,
+    config
+  }) : getDecryptKey(config.key);
   const alg = config.jwe?.encryptOptions?.alg;
   const enc = config.jwe?.encryptOptions?.enc;
   if (config.jwe?.encryptOptions?.protectedHeader?.typ && typeof config.jwe.encryptOptions.protectedHeader.typ === "string" && config.jwe.encryptOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
@@ -239,6 +243,10 @@ async function unsealJWESession(_event, config, sealed) {
 async function clearJWESession(event, config) {
   const context = getEventContext(event);
   const sessionName = config.name || DEFAULT_NAME$1;
+  let session = context.sessions?.[sessionName];
+  if (session && session[kGetSessionPromise$1]) {
+    session = await session[kGetSessionPromise$1];
+  }
   if (context.sessions?.[sessionName]) {
     delete context.sessions[sessionName];
   }
@@ -250,6 +258,7 @@ async function clearJWESession(event, config) {
       maxAge: void 0
     });
     await config.hooks?.onClear?.({
+      session,
       event,
       config
     });
@@ -432,15 +441,15 @@ function getJWSSessionToken(event, config) {
       token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
     }
   }
-  if (!token) {
-    token = getChunkedCookie(event, sessionName);
-  }
-  if (!token && hasWritableResponse(event)) {
+  if (config.cookie !== false && hasWritableResponse(event)) {
     const setCookie = event.res.headers.get("set-cookie");
     if (typeof setCookie === "string") {
       token = findSetCookie(setCookie, sessionName);
     }
   }
+  if (!token) {
+    token = getChunkedCookie(event, sessionName);
+  }
   return token;
 }
 async function updateJWSSession(event, config, update) {
@@ -502,9 +511,13 @@ async function signJWSSession(event, config) {
   });
   return token;
 }
-async function verifyJWSSession(_event, config, token) {
-  const jwk = getVerifyKey(config.key);
+async function verifyJWSSession(event, config, token) {
   const alg = config.jws?.signOptions?.alg;
+  const jwk = config.hooks?.onVerifyKeyLookup ? (header) => config.hooks.onVerifyKeyLookup({
+    header,
+    event,
+    config
+  }) : getVerifyKey(config.key);
   let typ;
   if (config.jws?.signOptions?.protectedHeader?.typ && typeof config.jws.signOptions.protectedHeader.typ === "string" && config.jws.signOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
     typ = config.jws.signOptions.protectedHeader.typ;
@@ -537,6 +550,10 @@ async function verifyJWSSession(_event, config, token) {
 async function clearJWSSession(event, config) {
   const context = getEventContext(event);
   const sessionName = config.name || DEFAULT_NAME;
+  let session = context.sessions?.[sessionName];
+  if (session && session[kGetSessionPromise]) {
+    session = await session[kGetSessionPromise];
+  }
   if (context.sessions?.[sessionName]) {
     delete context.sessions[sessionName];
   }
@@ -548,6 +565,7 @@ async function clearJWSSession(event, config) {
       maxAge: void 0
     });
     await config.hooks?.onClear?.({
+      session,
       event,
       config
     });

package/dist/index.d.mts

@@ -1,8 +1,8 @@
-export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, E as ExpiresIn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, w as JWKSet, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, u as JWK_Private, t as JWK_Public, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, r as JWK_Symmetric, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, Z as JWTClaimValidationOptions, X as JWTClaims, V as JoseHeaderParameters, K as KeyManagementAlgorithm, M as MaxTokenAge, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './shared/unjwt.CtHrClHc.mjs';
-export { i as utils } from './shared/unjwt.CkkdXjZD.mjs';
-export { j as jwe } from './shared/unjwt.B9nv94SS.mjs';
-export { j as jwk } from './shared/unjwt.BjP_dGnX.mjs';
-export { j as jws } from './shared/unjwt.C5jNR_1K.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult } from './shared/unjwt.BsLgL0DQ.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from './shared/unjwt.BU3IrsCv.mjs';
+export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, E as ExpiresIn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, w as JWKSet, H as JWK_AES_CBC_HMAC, I as JWK_AES_GCM, L as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, u as JWK_Private, t as JWK_Public, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, r as JWK_Symmetric, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, Z as JWTClaimValidationOptions, X as JWTClaims, V as JoseHeaderParameters, K as KeyManagementAlgorithm, M as MaxTokenAge, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './shared/unjwt.BCi3FEWr.mjs';
+export { i as utils } from './shared/unjwt.Cy2MlkUe.mjs';
+export { j as jwe } from './shared/unjwt.4JQCoID_.mjs';
+export { j as jwk } from './shared/unjwt.BYDTEWa-.mjs';
+export { j as jws } from './shared/unjwt.D0_ccT7g.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult } from './shared/unjwt.BqdNUKDr.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from './shared/unjwt.CMNtw8ek.mjs';
 import './shared/unjwt.JdKqVANs.mjs';

package/dist/index.mjs

@@ -1,4 +1,4 @@
 export { i as utils } from './shared/unjwt.Be8NxwFK.mjs';
-export { j as jwe } from './shared/unjwt.KqQq9jpF.mjs';
-export { j as jwk } from './shared/unjwt.DyouTtLD.mjs';
-export { j as jws } from './shared/unjwt.DQVUT7FU.mjs';
+export { j as jwe } from './shared/unjwt.B-v62plj.mjs';
+export { j as jwk } from './shared/unjwt.Dpl__ZAR.mjs';
+export { j as jws } from './shared/unjwt.DdLN9vwI.mjs';

package/dist/jwe.d.mts

@@ -1,4 +1,4 @@
-export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, w as JWKSet, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, u as JWK_Private, t as JWK_Public, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, r as JWK_Symmetric, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, Z as JWTClaimValidationOptions, X as JWTClaims, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './shared/unjwt.CtHrClHc.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from './shared/unjwt.BU3IrsCv.mjs';
-export { d as decrypt, e as encrypt } from './shared/unjwt.B9nv94SS.mjs';
+export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, w as JWKSet, H as JWK_AES_CBC_HMAC, I as JWK_AES_GCM, L as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, u as JWK_Private, t as JWK_Public, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, r as JWK_Symmetric, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, Z as JWTClaimValidationOptions, X as JWTClaims, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './shared/unjwt.BCi3FEWr.mjs';
+export { d as JWEDecryptOptions, e as JWEDecryptResult, b as JWEEncryptOptions, J as JWEHeaderParameters, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from './shared/unjwt.CMNtw8ek.mjs';
+export { d as decrypt, e as encrypt } from './shared/unjwt.4JQCoID_.mjs';
 import './shared/unjwt.JdKqVANs.mjs';

package/dist/jwe.mjs

@@ -1,3 +1,3 @@
-import './shared/unjwt.DyouTtLD.mjs';
+import './shared/unjwt.Dpl__ZAR.mjs';
 import './shared/unjwt.Be8NxwFK.mjs';
-export { d as decrypt, e as encrypt } from './shared/unjwt.KqQq9jpF.mjs';
+export { d as decrypt, e as encrypt } from './shared/unjwt.B-v62plj.mjs';

package/dist/jwk.d.mts

@@ -1,2 +1,2 @@
-export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, w as JWKSet, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, u as JWK_Private, t as JWK_Public, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, r as JWK_Symmetric, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, Z as JWTClaimValidationOptions, X as JWTClaims, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './shared/unjwt.CtHrClHc.mjs';
-export { d as deriveJWKFromPassword, b as deriveKeyFromPassword, e as exportJWKToPEM, f as exportKey, g as generateJWK, a as generateKey, h as getJWKFromSet, i as importJWKFromPEM, c as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.BjP_dGnX.mjs';
+export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, w as JWKSet, H as JWK_AES_CBC_HMAC, I as JWK_AES_GCM, L as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, u as JWK_Private, t as JWK_Public, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, r as JWK_Symmetric, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, Z as JWTClaimValidationOptions, X as JWTClaims, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './shared/unjwt.BCi3FEWr.mjs';
+export { d as deriveJWKFromPassword, b as deriveKeyFromPassword, e as exportJWKToPEM, f as exportKey, g as generateJWK, a as generateKey, h as getJWKFromSet, i as importJWKFromPEM, c as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.BYDTEWa-.mjs';

package/dist/jwk.mjs

@@ -1,2 +1,2 @@
 import './shared/unjwt.Be8NxwFK.mjs';
-export { k as deriveJWKFromPassword, m as deriveKeyFromPassword, h as exportJWKToPEM, n as exportKey, c as generateJWK, l as generateKey, b as getJWKFromSet, f as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.DyouTtLD.mjs';
+export { k as deriveJWKFromPassword, m as deriveKeyFromPassword, h as exportJWKToPEM, n as exportKey, c as generateJWK, l as generateKey, b as getJWKFromSet, f as importJWKFromPEM, i as importKey, u as unwrapKey, w as wrapKey } from './shared/unjwt.Dpl__ZAR.mjs';

package/dist/jws.d.mts

@@ -1,3 +1,3 @@
-export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, w as JWKSet, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, u as JWK_Private, t as JWK_Public, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, r as JWK_Symmetric, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, Z as JWTClaimValidationOptions, X as JWTClaims, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './shared/unjwt.CtHrClHc.mjs';
-export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult } from './shared/unjwt.BsLgL0DQ.mjs';
-export { s as sign, v as verify } from './shared/unjwt.C5jNR_1K.mjs';
+export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, w as JWKSet, H as JWK_AES_CBC_HMAC, I as JWK_AES_GCM, L as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, u as JWK_Private, t as JWK_Public, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, r as JWK_Symmetric, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, Z as JWTClaimValidationOptions, X as JWTClaims, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './shared/unjwt.BCi3FEWr.mjs';
+export { J as JWSAlgorithm, a as JWSHeaderParameters, f as JWSKeyLookupFunction, b as JWSProtectedHeader, c as JWSSignOptions, e as JWSVerifyOptions, d as JWSVerifyResult } from './shared/unjwt.BqdNUKDr.mjs';
+export { s as sign, v as verify } from './shared/unjwt.D0_ccT7g.mjs';

package/dist/jws.mjs

@@ -1,3 +1,3 @@
-import './shared/unjwt.DyouTtLD.mjs';
+import './shared/unjwt.Dpl__ZAR.mjs';
 import './shared/unjwt.Be8NxwFK.mjs';
-export { s as sign, v as verify } from './shared/unjwt.DQVUT7FU.mjs';
+export { s as sign, v as verify } from './shared/unjwt.DdLN9vwI.mjs';

package/dist/shared/{unjwt.B9nv94SS.d.mts → unjwt.4JQCoID_.d.mts}

@@ -1,5 +1,5 @@
-import { X as JWTClaims, v as JWK, K as KeyManagementAlgorithm, f as ContentEncryptionAlgorithm, r as JWK_Symmetric, u as JWK_Private, C as CompositeKey, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, w as JWKSet, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, t as JWK_Public, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, Z as JWTClaimValidationOptions, V as JoseHeaderParameters, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './unjwt.CtHrClHc.mjs';
-import { b as JWEEncryptOptions, c as JWEKeyLookupFunction, d as JWEDecryptOptions, e as JWEDecryptResult, J as JWEHeaderParameters, a as JWEKeyManagementHeaderParameters } from './unjwt.BU3IrsCv.mjs';
+import { X as JWTClaims, v as JWK, K as KeyManagementAlgorithm, f as ContentEncryptionAlgorithm, r as JWK_Symmetric, u as JWK_Private, C as CompositeKey, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, w as JWKSet, H as JWK_AES_CBC_HMAC, I as JWK_AES_GCM, L as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, t as JWK_Public, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, Z as JWTClaimValidationOptions, V as JoseHeaderParameters, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './unjwt.BCi3FEWr.mjs';
+import { b as JWEEncryptOptions, c as JWEKeyLookupFunction, d as JWEDecryptOptions, e as JWEDecryptResult, J as JWEHeaderParameters, a as JWEKeyManagementHeaderParameters } from './unjwt.CMNtw8ek.mjs';
 
 /**
  * Encrypts a payload to produce a JWE Compact Serialization string.

package/dist/shared/{unjwt.KqQq9jpF.mjs → unjwt.B-v62plj.mjs}

@@ -1,4 +1,4 @@
-import { i as importKey, e as encryptKey, g as generateIV, a as encrypt$1, u as unwrapKey, d as decrypt$1 } from './unjwt.DyouTtLD.mjs';
+import { i as importKey, e as encryptKey, g as generateIV, a as encrypt$1, u as unwrapKey, d as decrypt$1 } from './unjwt.Dpl__ZAR.mjs';
 import { r as randomBytes, a as isJWK, s as sanitizeObject, b as applyTypCtyDefaults, c as computeJwtTimeClaims, g as getPlaintextBytes, d as base64UrlEncode, t as textEncoder, e as base64UrlDecode, f as decodePayloadFromBytes, v as validateCriticalHeadersJWE, h as validateJwtClaims, j as isCryptoKeyPair, k as isCryptoKey } from './unjwt.Be8NxwFK.mjs';
 
 async function encrypt(payload, key, options = {}) {
@@ -16,7 +16,7 @@ async function encrypt(payload, key, options = {}) {
     if (typeof key === "string" || key instanceof Uint8Array) {
       alg = "PBES2-HS256+A128KW";
     } else if (isJWK(key)) {
-      alg = key.alg;
+      alg = key.alg === "A128GCM" || key.alg === "A192GCM" || key.alg === "A256GCM" ? `${key.alg}KW` : key.alg;
     }
   }
   if (!alg) {
@@ -59,6 +59,8 @@ async function encrypt(payload, key, options = {}) {
   const jweProtectedHeader = sanitizeObject({
     ...baseProtectedHeader,
     ...keyManagementHeaderParams,
+    ...isJWK(key) && key.kid ? { kid: key.kid } : {},
+    // Include kid if available
     alg,
     enc
   });

package/dist/shared/{unjwt.CtHrClHc.d.mts → unjwt.BCi3FEWr.d.mts}

@@ -236,13 +236,13 @@ type JWK_RSA_PSS = "PS256" | "PS384" | "PS512";
 type JWK_ECDSA = "ES256" | "ES384" | "ES512";
 type JWK_RSA_ENC = "RSA-OAEP" | "RSA-OAEP-256" | "RSA-OAEP-384" | "RSA-OAEP-512";
 type JWK_AES_KW = "A128KW" | "A192KW" | "A256KW";
-type JWK_AES_GCM_KW = "A128GCMKW" | "A192GCMKW" | "A256GCMKW";
 type JWK_AES_CBC_HMAC = "A128CBC-HS256" | "A192CBC-HS384" | "A256CBC-HS512";
 type JWK_AES_GCM = "A128GCM" | "A192GCM" | "A256GCM";
+type JWK_AES_GCM_KW = "A128GCMKW" | "A192GCMKW" | "A256GCMKW";
 type JWK_PBES2 = "PBES2-HS256+A128KW" | "PBES2-HS384+A192KW" | "PBES2-HS512+A256KW";
 type JWK_ECDH_ES = "ECDH-ES" | "ECDH-ES+A128KW" | "ECDH-ES+A192KW" | "ECDH-ES+A256KW";
 type JWK_OKP_SIGN = "Ed25519" | "EdDSA";
-type JWK_Symmetric_Algorithm = JWK_HMAC | JWK_AES_KW | JWK_AES_GCM;
+type JWK_Symmetric_Algorithm = JWK_HMAC | JWK_AES_KW | JWK_AES_GCM | JWK_AES_GCM_KW;
 type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA_ENC | JWK_OKP_SIGN | JWK_ECDH_ES;
 type JWKAlgorithm = JWK_Symmetric_Algorithm | JWK_Asymmetric_Algorithm | JWK_AES_CBC_HMAC | JWK_PBES2 | JWK_ECDH_ES | ("none" | "dir");
 type JWKPEMAlgorithm = JWK_RSA_PSS | JWK_RSA_SIGN | JWK_RSA_ENC | JWK_ECDSA | JWK_ECDH_ES | JWK_OKP_SIGN;
@@ -325,4 +325,4 @@ interface JWTClaimValidationOptions {
 type ExpiresIn = number | `${number}` | `${number}${"s" | "second" | "seconds" | "m" | "minute" | "minutes" | "h" | "hour" | "hours" | "D" | "day" | "days" | "W" | "week" | "weeks" | "M" | "month" | "months" | "Y" | "year" | "years"}`;
 type MaxTokenAge = ExpiresIn;
 
-export type { JWK_ECDSA as A, JWK_RSA_ENC as B, CompositeKey as C, DeriveKeyOptions as D, ExpiresIn as E, JWK_AES_KW as F, GenerateKeyAlgorithm as G, JWK_AES_GCM_KW as H, JWK_AES_CBC_HMAC as I, JWKParameters as J, KeyManagementAlgorithm as K, JWK_AES_GCM as L, MaxTokenAge as M, JWK_PBES2 as N, JWK_ECDH_ES as O, JWK_OKP_SIGN as P, JWK_Symmetric_Algorithm as Q, JWK_Asymmetric_Algorithm as R, JWKAlgorithm as S, JWKPEMAlgorithm as T, UnwrapKeyOptions as U, JoseHeaderParameters as V, WrapKeyOptions as W, JWTClaims as X, JWT as Y, JWTClaimValidationOptions as Z, GenerateKeyOptions as a, GenerateKeyReturn as b, GenerateJWKOptions as c, GenerateJWKReturn as d, DeriveKeyReturn as e, ContentEncryptionAlgorithm as f, WrapKeyResult as g, JWK_EC_Public as h, JWK_EC_Private as i, JWK_EC as j, JWK_RSA_Public as k, JWK_RSA_Private as l, JWK_RSA as m, JWK_OKP_Public as n, JWK_OKP_Private as o, JWK_OKP as p, JWK_oct as q, JWK_Symmetric as r, JWK_Asymmetric as s, JWK_Public as t, JWK_Private as u, JWK as v, JWKSet as w, JWK_HMAC as x, JWK_RSA_SIGN as y, JWK_RSA_PSS as z };
+export type { JWK_ECDSA as A, JWK_RSA_ENC as B, CompositeKey as C, DeriveKeyOptions as D, ExpiresIn as E, JWK_AES_KW as F, GenerateKeyAlgorithm as G, JWK_AES_CBC_HMAC as H, JWK_AES_GCM as I, JWKParameters as J, KeyManagementAlgorithm as K, JWK_AES_GCM_KW as L, MaxTokenAge as M, JWK_PBES2 as N, JWK_ECDH_ES as O, JWK_OKP_SIGN as P, JWK_Symmetric_Algorithm as Q, JWK_Asymmetric_Algorithm as R, JWKAlgorithm as S, JWKPEMAlgorithm as T, UnwrapKeyOptions as U, JoseHeaderParameters as V, WrapKeyOptions as W, JWTClaims as X, JWT as Y, JWTClaimValidationOptions as Z, GenerateKeyOptions as a, GenerateKeyReturn as b, GenerateJWKOptions as c, GenerateJWKReturn as d, DeriveKeyReturn as e, ContentEncryptionAlgorithm as f, WrapKeyResult as g, JWK_EC_Public as h, JWK_EC_Private as i, JWK_EC as j, JWK_RSA_Public as k, JWK_RSA_Private as l, JWK_RSA as m, JWK_OKP_Public as n, JWK_OKP_Private as o, JWK_OKP as p, JWK_oct as q, JWK_Symmetric as r, JWK_Asymmetric as s, JWK_Public as t, JWK_Private as u, JWK as v, JWKSet as w, JWK_HMAC as x, JWK_RSA_SIGN as y, JWK_RSA_PSS as z };

package/dist/shared/{unjwt.BjP_dGnX.d.mts → unjwt.BYDTEWa-.d.mts}

@@ -1,4 +1,4 @@
-import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, J as JWKParameters, c as GenerateJWKOptions, d as GenerateJWKReturn, N as JWK_PBES2, D as DeriveKeyOptions, e as DeriveKeyReturn, q as JWK_oct, v as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, g as WrapKeyResult, U as UnwrapKeyOptions, T as JWKPEMAlgorithm, w as JWKSet, V as JoseHeaderParameters, C as CompositeKey, f as ContentEncryptionAlgorithm, S as JWKAlgorithm, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, u as JWK_Private, t as JWK_Public, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, r as JWK_Symmetric, Q as JWK_Symmetric_Algorithm, Y as JWT, Z as JWTClaimValidationOptions, X as JWTClaims } from './unjwt.CtHrClHc.mjs';
+import { G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, J as JWKParameters, c as GenerateJWKOptions, d as GenerateJWKReturn, N as JWK_PBES2, D as DeriveKeyOptions, e as DeriveKeyReturn, q as JWK_oct, v as JWK, K as KeyManagementAlgorithm, W as WrapKeyOptions, g as WrapKeyResult, U as UnwrapKeyOptions, T as JWKPEMAlgorithm, w as JWKSet, V as JoseHeaderParameters, C as CompositeKey, f as ContentEncryptionAlgorithm, S as JWKAlgorithm, H as JWK_AES_CBC_HMAC, I as JWK_AES_GCM, L as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, u as JWK_Private, t as JWK_Public, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, r as JWK_Symmetric, Q as JWK_Symmetric_Algorithm, Y as JWT, Z as JWTClaimValidationOptions, X as JWTClaims } from './unjwt.BCi3FEWr.mjs';
 
 /**
  * This is a fork of Jose library's utility functions.

package/dist/shared/{unjwt.BsLgL0DQ.d.mts → unjwt.BqdNUKDr.d.mts}

@@ -1,4 +1,4 @@
-import { x as JWK_HMAC, y as JWK_RSA_SIGN, z as JWK_RSA_PSS, A as JWK_ECDSA, V as JoseHeaderParameters, E as ExpiresIn, v as JWK, w as JWKSet, Z as JWTClaimValidationOptions, X as JWTClaims } from './unjwt.CtHrClHc.mjs';
+import { x as JWK_HMAC, y as JWK_RSA_SIGN, z as JWK_RSA_PSS, A as JWK_ECDSA, V as JoseHeaderParameters, E as ExpiresIn, v as JWK, w as JWKSet, Z as JWTClaimValidationOptions, X as JWTClaims } from './unjwt.BCi3FEWr.mjs';
 
 type JWS_SIGN_EXTRA = "Ed25519" | "EdDSA";
 /** JWS Signing Algorithm Identifier. */

package/dist/shared/{unjwt.BU3IrsCv.d.mts → unjwt.CMNtw8ek.d.mts}

@@ -1,4 +1,4 @@
-import { K as KeyManagementAlgorithm, f as ContentEncryptionAlgorithm, E as ExpiresIn, V as JoseHeaderParameters, h as JWK_EC_Public, i as JWK_EC_Private, v as JWK, Z as JWTClaimValidationOptions, X as JWTClaims } from './unjwt.CtHrClHc.mjs';
+import { K as KeyManagementAlgorithm, f as ContentEncryptionAlgorithm, E as ExpiresIn, V as JoseHeaderParameters, h as JWK_EC_Public, i as JWK_EC_Private, v as JWK, Z as JWTClaimValidationOptions, X as JWTClaims } from './unjwt.BCi3FEWr.mjs';
 import { S as StrictOmit } from './unjwt.JdKqVANs.mjs';
 
 /** Recognized JWE Header Parameters, any other Header Members may also be present. */

package/dist/shared/{unjwt.CkkdXjZD.d.mts → unjwt.Cy2MlkUe.d.mts}

@@ -1,4 +1,4 @@
-import { E as ExpiresIn, X as JWTClaims, Z as JWTClaimValidationOptions, v as JWK, w as JWKSet, q as JWK_oct, u as JWK_Private, t as JWK_Public } from './unjwt.CtHrClHc.mjs';
+import { E as ExpiresIn, X as JWTClaims, Z as JWTClaimValidationOptions, v as JWK, w as JWKSet, q as JWK_oct, u as JWK_Private, t as JWK_Public } from './unjwt.BCi3FEWr.mjs';
 import { S as StrictOmit } from './unjwt.JdKqVANs.mjs';
 
 /**

package/dist/shared/{unjwt.C5jNR_1K.d.mts → unjwt.D0_ccT7g.d.mts}

@@ -1,5 +1,5 @@
-import { X as JWTClaims, r as JWK_Symmetric, u as JWK_Private, t as JWK_Public, w as JWKSet, C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, I as JWK_AES_CBC_HMAC, L as JWK_AES_GCM, H as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, Z as JWTClaimValidationOptions, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './unjwt.CtHrClHc.mjs';
-import { c as JWSSignOptions, J as JWSAlgorithm, f as JWSKeyLookupFunction, e as JWSVerifyOptions, d as JWSVerifyResult, a as JWSHeaderParameters, b as JWSProtectedHeader } from './unjwt.BsLgL0DQ.mjs';
+import { X as JWTClaims, r as JWK_Symmetric, u as JWK_Private, t as JWK_Public, w as JWKSet, C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, H as JWK_AES_CBC_HMAC, I as JWK_AES_GCM, L as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, Z as JWTClaimValidationOptions, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from './unjwt.BCi3FEWr.mjs';
+import { c as JWSSignOptions, J as JWSAlgorithm, f as JWSKeyLookupFunction, e as JWSVerifyOptions, d as JWSVerifyResult, a as JWSHeaderParameters, b as JWSProtectedHeader } from './unjwt.BqdNUKDr.mjs';
 
 /**
  * Creates a JWS (JSON Web Signature) in Compact Serialization format.

package/dist/shared/{unjwt.DQVUT7FU.mjs → unjwt.DdLN9vwI.mjs}

@@ -1,4 +1,4 @@
-import { i as importKey, s as sign$1, b as getJWKFromSet, v as verify$1 } from './unjwt.DyouTtLD.mjs';
+import { i as importKey, s as sign$1, b as getJWKFromSet, v as verify$1 } from './unjwt.Dpl__ZAR.mjs';
 import { s as sanitizeObject, a as isJWK, b as applyTypCtyDefaults, c as computeJwtTimeClaims, d as base64UrlEncode, t as textEncoder, l as textDecoder, e as base64UrlDecode, m as isJWKSet, n as decodePayloadFromB64UrlSegment, o as validateCriticalHeadersJWS, h as validateJwtClaims } from './unjwt.Be8NxwFK.mjs';
 
 async function sign(payload, key, options = {}) {
@@ -18,7 +18,7 @@ async function sign(payload, key, options = {}) {
   const signingKey = await importKey(key, alg);
   const protectedHeader = {
     ...safeAdditionalHeader,
-    ...isJWK(key) && key.kid ? { kid: safeAdditionalHeader?.kid || key.kid } : {},
+    ...isJWK(key) && key.kid ? { kid: key.kid } : {},
     // Include kid if available
     alg,
     typ: safeAdditionalHeader?.typ

package/dist/shared/{unjwt.DyouTtLD.mjs → unjwt.Dpl__ZAR.mjs}

@@ -2010,10 +2010,14 @@ function getGenerateKeyParams(alg, options) {
     // AES GCM Encryption
     case "A128GCM":
     case "A192GCM":
-    case "A256GCM": {
-      const length = Number.parseInt(alg.slice(1, 4), 10);
+    case "A256GCM":
+    case "A128GCMKW":
+    case "A192GCMKW":
+    case "A256GCMKW": {
+      const baseAlg = alg.replace("KW", "");
+      const length = Number.parseInt(baseAlg.slice(1, 4), 10);
       algorithm = { name: "AES-GCM", length };
-      keyUsages = defaultKeyUsage ?? ["encrypt", "decrypt"];
+      keyUsages = defaultKeyUsage ?? (alg.endsWith("KW") ? ["wrapKey", "unwrapKey"] : ["encrypt", "decrypt"]);
       break;
     }
     // ECDSA Signatures

package/dist/utils.d.mts

@@ -1,3 +1,3 @@
-import './shared/unjwt.CtHrClHc.mjs';
+import './shared/unjwt.BCi3FEWr.mjs';
 export { S as StrictOmit } from './shared/unjwt.JdKqVANs.mjs';
-export { s as applyTypCtyDefaults, j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, z as computeExpiresInSeconds, B as computeJwtTimeClaims, A as computeMaxTokenAgeSeconds, f as concatUint8Arrays, v as decodeMaybeJWTString, x as decodePayloadFromB64UrlSegment, w as decodePayloadFromBytes, y as getPlaintextBytes, o as isAsymmetricJWK, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, u as isJWTContent, p as isPrivateJWK, q as isPublicJWK, n as isSymmetricJWK, m as maybeArray, r as randomBytes, F as sanitizeObject, a as textDecoder, t as textEncoder, E as validateCriticalHeadersJWE, D as validateCriticalHeadersJWS, C as validateJwtClaims } from './shared/unjwt.CkkdXjZD.mjs';
+export { s as applyTypCtyDefaults, j as assertCryptoKey, d as base64Decode, b as base64Encode, e as base64UrlDecode, c as base64UrlEncode, z as computeExpiresInSeconds, B as computeJwtTimeClaims, A as computeMaxTokenAgeSeconds, f as concatUint8Arrays, v as decodeMaybeJWTString, x as decodePayloadFromB64UrlSegment, w as decodePayloadFromBytes, y as getPlaintextBytes, o as isAsymmetricJWK, k as isCryptoKey, l as isCryptoKeyPair, g as isJWK, h as isJWKSet, u as isJWTContent, p as isPrivateJWK, q as isPublicJWK, n as isSymmetricJWK, m as maybeArray, r as randomBytes, F as sanitizeObject, a as textDecoder, t as textEncoder, E as validateCriticalHeadersJWE, D as validateCriticalHeadersJWS, C as validateJwtClaims } from './shared/unjwt.Cy2MlkUe.mjs';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.5.32",
+  "version": "0.5.34",
   "description": "Low-level JWT utilities",
   "repository": "sandros94/unjwt",
   "license": "MIT",
@@ -65,7 +65,7 @@
   "devDependencies": {
     "@types/node": "^22",
     "@types/supertest": "^6.0.3",
-    "@vitest/coverage-v8": "^3.2.4",
+    "@vitest/coverage-v8": "^4.0.14",
     "automd": "^0.4.2",
     "changelogen": "^0.6.2",
     "cookie-esv1": "npm:cookie-es@^1.2.2",
@@ -79,7 +79,7 @@
     "supertest": "^7.1.4",
     "typescript": "^5.9.2",
     "unbuild": "^3.6.1",
-    "vitest": "^3.2.4"
+    "vitest": "^4.0.14"
   },
   "peerDependencies": {
     "cookie-es": "^1.2.2 || ^2.0.0",