unjwt 0.5.38 → 0.5.39

package/dist/adapters/h3v2.mjs

@@ -1,650 +1,561 @@
-export { k as deriveJWKFromPassword, h as exportJWKToPEM, c as generateJWK, f as importJWKFromPEM } from '../shared/unjwt.Dpl__ZAR.mjs';
-import { getEventContext, getChunkedCookie, setChunkedCookie } from 'h3';
-import { NullProtoObj } from 'rou3';
-import { e as encrypt, d as decrypt } from '../shared/unjwt.B-v62plj.mjs';
-import { p as computeExpiresInSeconds, q as isSymmetricJWK, u as isPrivateJWK, w as isPublicJWK } from '../shared/unjwt.Be8NxwFK.mjs';
-import { s as sign, v as verify } from '../shared/unjwt.DdLN9vwI.mjs';
-
+import { a as deriveJWKFromPassword, c as importJWKFromPEM, d as isSymmetricJWK, f as computeExpiresInSeconds, i as encrypt, l as isPrivateJWK, n as verify, o as exportJWKToPEM, r as decrypt, s as generateJWK, t as sign, u as isPublicJWK } from "../_chunks/jws.mjs";
+import { getChunkedCookie, getEventContext, setChunkedCookie } from "h3";
+import { NullProtoObj } from "rou3";
+//#region src/adapters/h3v2/session/jwe.ts
 const kGetSessionPromise$1 = Symbol("h3_jwe_getSession");
+const kSessionToken$1 = Symbol("h3_jwe_sessionToken");
 const DEFAULT_NAME$1 = "h3-jwe";
 const DEFAULT_COOKIE$1 = {
-  path: "/",
-  secure: true,
-  httpOnly: true
+	path: "/",
+	secure: true,
+	httpOnly: true
 };
+/**
+* Create a session manager for the current request.
+*/
 async function useJWESession(event, config) {
-  const sessionName = config.name || DEFAULT_NAME$1;
-  await getJWESession(event, config);
-  const sessionManager = {
-    get id() {
-      return getSessionFromContext$1(event, sessionName)?.id;
-    },
-    get createdAt() {
-      return getSessionFromContext$1(event, sessionName)?.createdAt ?? Date.now();
-    },
-    get expiresAt() {
-      return getSessionFromContext$1(event, sessionName)?.expiresAt;
-    },
-    get data() {
-      return getSessionFromContext$1(event, sessionName)?.data || {};
-    },
-    get token() {
-      return getJWESessionToken(event, config);
-    },
-    update: async (update) => {
-      await updateJWESession(event, config, update);
-      return sessionManager;
-    },
-    clear: async () => {
-      await clearJWESession(event, config);
-      return sessionManager;
-    }
-  };
-  return sessionManager;
+	const sessionName = config.name || DEFAULT_NAME$1;
+	await getJWESession(event, config);
+	const sessionManager = {
+		get id() {
+			return getSessionFromContext$1(event, sessionName)?.id;
+		},
+		get createdAt() {
+			return getSessionFromContext$1(event, sessionName)?.createdAt ?? Date.now();
+		},
+		get expiresAt() {
+			return getSessionFromContext$1(event, sessionName)?.expiresAt;
+		},
+		get data() {
+			return getSessionFromContext$1(event, sessionName)?.data || {};
+		},
+		get token() {
+			return getSessionFromContext$1(event, sessionName)?.[kSessionToken$1] ?? getJWESessionToken(event, config);
+		},
+		update: async (update) => {
+			await updateJWESession(event, config, update);
+			return sessionManager;
+		},
+		clear: async () => {
+			await clearJWESession(event, config);
+			return sessionManager;
+		}
+	};
+	return sessionManager;
 }
+/**
+* Get the session for the current request.
+*/
 async function getJWESession(event, config) {
-  const sessionName = config.name || DEFAULT_NAME$1;
-  const context = getEventContext(event);
-  if (!context.sessions) {
-    context.sessions = new NullProtoObj();
-  }
-  const existingSession = context.sessions[sessionName];
-  if (existingSession) {
-    const session2 = existingSession[kGetSessionPromise$1] ? await existingSession[kGetSessionPromise$1] : existingSession;
-    if (session2.expiresAt !== void 0 && session2.expiresAt < Date.now() && hasWritableResponse$1(event)) {
-      await config.hooks?.onExpire?.({
-        event,
-        error: new Error(
-          `JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${new Date(session2.expiresAt * 1e3).toISOString()})`
-        ),
-        config
-      });
-      return clearJWESession(event, config).then(
-        () => getJWESession(event, config)
-      );
-    }
-    await config.hooks?.onRead?.({
-      event,
-      session: session2,
-      config
-    });
-    return session2;
-  }
-  const now = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
-  const createdAt = now - now % 1e3;
-  const session = {
-    id: void 0,
-    createdAt,
-    expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3,
-    data: new NullProtoObj()
-  };
-  context.sessions[sessionName] = session;
-  const token = getJWESessionToken(event, config);
-  if (token) {
-    const promise = unsealJWESession(event, config, token).catch(async (error_) => {
-      if (error_ instanceof Error) {
-        const message = error_.message;
-        if (message.includes("Token has expired") || message.includes("Token is too old")) {
-          await config.hooks?.onExpire?.({
-            event,
-            error: error_,
-            config
-          });
-          return void 0;
-        }
-      }
-      await config.hooks?.onError?.({
-        event,
-        error: error_,
-        config
-      });
-      return void 0;
-    }).then((unsealed) => {
-      if (unsealed) {
-        Object.assign(session, unsealed);
-      }
-      delete session[kGetSessionPromise$1];
-      return session;
-    });
-    session[kGetSessionPromise$1] = promise;
-    await promise;
-  }
-  await config.hooks?.onRead?.({
-    event,
-    session,
-    config
-  });
-  return session;
+	const sessionName = config.name || DEFAULT_NAME$1;
+	const context = getEventContext(event);
+	if (!context.sessions) context.sessions = new NullProtoObj();
+	const existingSession = context.sessions[sessionName];
+	if (existingSession) {
+		const session = existingSession[kGetSessionPromise$1] ? await existingSession[kGetSessionPromise$1] : existingSession;
+		/**
+		* We check if a session is expired before returning it. If it is expired we clear it and create a new one,
+		* unless we have a read-only event in which case we just return it as it was valid at the time of reading
+		* the cookie/header (like in a websocket upgrade)
+		*/
+		if (session.expiresAt !== void 0 && session.expiresAt < Date.now() && hasWritableResponse$1(event)) {
+			await config.hooks?.onExpire?.({
+				event,
+				error: /* @__PURE__ */ new Error(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(session.expiresAt * 1e3)).toISOString()})`),
+				config
+			});
+			return clearJWESession(event, config).then(() => getJWESession(event, config));
+		}
+		await config.hooks?.onRead?.({
+			event,
+			session,
+			config
+		});
+		return session;
+	}
+	const now = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
+	const createdAt = now - now % 1e3;
+	const session = {
+		id: void 0,
+		createdAt,
+		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3,
+		data: new NullProtoObj()
+	};
+	context.sessions[sessionName] = session;
+	const token = getJWESessionToken(event, config);
+	if (token) {
+		session[kSessionToken$1] = token;
+		const promise = unsealJWESession(event, config, token).catch(async (error_) => {
+			if (error_ instanceof Error) {
+				const message = error_.message;
+				if (message.includes("Token has expired") || message.includes("Token is too old")) {
+					await config.hooks?.onExpire?.({
+						event,
+						error: error_,
+						config
+					});
+					return;
+				}
+			}
+			await config.hooks?.onError?.({
+				event,
+				error: error_,
+				config
+			});
+		}).then((unsealed) => {
+			if (unsealed) Object.assign(session, unsealed);
+			delete session[kGetSessionPromise$1];
+			return session;
+		});
+		session[kGetSessionPromise$1] = promise;
+		await promise;
+	}
+	await config.hooks?.onRead?.({
+		event,
+		session,
+		config
+	});
+	return session;
 }
 function getJWESessionToken(event, config) {
-  const sessionName = config.name || DEFAULT_NAME$1;
-  let token;
-  if (config.sessionHeader !== false) {
-    const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
-    const headerValue = event.req.headers.get(headerName);
-    if (typeof headerValue === "string") {
-      token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
-    }
-  }
-  if (config.cookie !== false && hasWritableResponse$1(event)) {
-    const setCookie = event.res.headers.get("set-cookie");
-    if (typeof setCookie === "string") {
-      token = findSetCookie$1(setCookie, sessionName);
-    }
-  }
-  if (!token) {
-    token = getChunkedCookie(event, sessionName);
-  }
-  return token;
+	const sessionName = config.name || DEFAULT_NAME$1;
+	let token;
+	if (config.sessionHeader !== false) {
+		const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
+		const headerValue = event.req.headers.get(headerName);
+		if (typeof headerValue === "string") token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
+	}
+	if (config.cookie !== false && hasWritableResponse$1(event)) {
+		const setCookie = event.res.headers.get("set-cookie");
+		if (typeof setCookie === "string") token = findSetCookie$1(setCookie, sessionName);
+	}
+	if (!token) token = getChunkedCookie(event, sessionName);
+	return token;
 }
+/**
+* Update the session data for the current request.
+*/
 async function updateJWESession(event, config, update) {
-  const sessionName = config.name || DEFAULT_NAME$1;
-  const context = getEventContext(event);
-  const session = context.sessions?.[sessionName] || await getJWESession(event, config);
-  if (typeof update === "function") {
-    update = update(session.data);
-  }
-  if (update) {
-    const oldSession = { ...session, data: { ...session.data } };
-    Object.assign(session.data, update);
-    await config.hooks?.onUpdate?.({
-      oldSession,
-      session,
-      event,
-      config
-    });
-  }
-  const now = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
-  const createdAt = now - now % 1e3;
-  Object.assign(session, {
-    id: config.generateId?.() || crypto.randomUUID(),
-    createdAt,
-    expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3
-  });
-  if (config.cookie !== false && hasWritableResponse$1(event)) {
-    const sealed = await sealJWESession(event, config);
-    setChunkedCookie(event, sessionName, sealed, {
-      ...DEFAULT_COOKIE$1,
-      expires: config.maxAge === void 0 ? void 0 : new Date(
-        session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3
-      ),
-      ...config.cookie
-    });
-  }
-  return session;
+	const sessionName = config.name || DEFAULT_NAME$1;
+	const session = getEventContext(event).sessions?.[sessionName] || await getJWESession(event, config);
+	if (typeof update === "function") update = update(session.data);
+	if (update) {
+		const oldSession = {
+			...session,
+			data: { ...session.data }
+		};
+		Object.assign(session.data, update);
+		await config.hooks?.onUpdate?.({
+			oldSession,
+			session,
+			event,
+			config
+		});
+	}
+	const now = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
+	const createdAt = now - now % 1e3;
+	Object.assign(session, {
+		id: config.generateId?.() || crypto.randomUUID(),
+		createdAt,
+		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3
+	});
+	if (config.cookie !== false && hasWritableResponse$1(event)) {
+		const sealed = await sealJWESession(event, config);
+		session[kSessionToken$1] = sealed;
+		setChunkedCookie(event, sessionName, sealed, {
+			...DEFAULT_COOKIE$1,
+			expires: config.maxAge === void 0 ? void 0 : new Date(session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3),
+			...config.cookie
+		});
+	}
+	return session;
 }
+/**
+* Produce a JWE for the current session.
+*/
 async function sealJWESession(event, config) {
-  const key = getEncryptKey(config.key);
-  const sessionName = config.name || DEFAULT_NAME$1;
-  const context = getEventContext(event);
-  const session = context.sessions?.[sessionName] || await getJWESession(event, config);
-  const iat = Math.floor(session.createdAt / 1e3);
-  const exp = session.expiresAt ? Math.floor(session.expiresAt / 1e3) : void 0;
-  const payload = {
-    ...session.data,
-    jti: session.id,
-    iat
-  };
-  if (exp) {
-    payload.exp = exp;
-  }
-  let typ = void 0;
-  if (config.jwe?.encryptOptions?.protectedHeader?.typ && typeof config.jwe.encryptOptions.protectedHeader.typ === "string" && config.jwe.encryptOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
-    typ = config.jwe.encryptOptions.protectedHeader.typ;
-  }
-  const token = await encrypt(payload, key, {
-    ...config.jwe?.encryptOptions,
-    expiresIn: void 0,
-    // controlled via 'exp' claim
-    protectedHeader: {
-      ...config.jwe?.encryptOptions?.protectedHeader,
-      typ: typ || "JWT",
-      cty: "application/json"
-    }
-  });
-  return token;
+	const key = getEncryptKey(config.key);
+	const sessionName = config.name || DEFAULT_NAME$1;
+	const session = getEventContext(event).sessions?.[sessionName] || await getJWESession(event, config);
+	const iat = Math.floor(session.createdAt / 1e3);
+	const exp = session.expiresAt ? Math.floor(session.expiresAt / 1e3) : void 0;
+	const payload = {
+		...session.data,
+		jti: session.id,
+		iat
+	};
+	if (exp) payload.exp = exp;
+	let typ = void 0;
+	if (config.jwe?.encryptOptions?.protectedHeader?.typ && typeof config.jwe.encryptOptions.protectedHeader.typ === "string" && config.jwe.encryptOptions.protectedHeader.typ.toLowerCase().includes("jwt")) typ = config.jwe.encryptOptions.protectedHeader.typ;
+	return await encrypt(payload, key, {
+		...config.jwe?.encryptOptions,
+		expiresIn: void 0,
+		protectedHeader: {
+			...config.jwe?.encryptOptions?.protectedHeader,
+			typ: typ || "JWT",
+			cty: "application/json"
+		}
+	});
 }
+/**
+* Decrypt the JWE and return a Session-compatible object.
+*/
 async function unsealJWESession(event, config, sealed) {
-  const key = config.hooks?.onUnsealKeyLookup ? (header) => config.hooks.onUnsealKeyLookup({
-    header,
-    event,
-    config
-  }) : getDecryptKey(config.key);
-  const alg = config.jwe?.encryptOptions?.alg;
-  const enc = config.jwe?.encryptOptions?.enc;
-  if (config.jwe?.encryptOptions?.protectedHeader?.typ && typeof config.jwe.encryptOptions.protectedHeader.typ === "string" && config.jwe.encryptOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
-    config.jwe.encryptOptions.protectedHeader.typ;
-  }
-  const { payload } = await decrypt(sealed, key, {
-    ...config.jwe?.decryptOptions,
-    requiredClaims: [
-      .../* @__PURE__ */ new Set([
-        ...config.jwe?.decryptOptions?.requiredClaims || [],
-        "jti",
-        "iat"
-      ])
-    ],
-    maxTokenAge: config.maxAge,
-    algorithms: alg ? [alg] : void 0,
-    encryptionAlgorithms: enc ? [enc] : void 0,
-    unwrappedKeyAlgorithm: void 0,
-    keyUsage: void 0,
-    forceUint8Array: false,
-    validateJWT: true
-  }).catch((error_) => {
-    if (error_ instanceof Error) {
-      throw error_;
-    }
-    throw new Error(String(error_));
-  });
-  const { jti, iat, exp, ...data } = payload;
-  return {
-    id: jti,
-    createdAt: iat * 1e3,
-    expiresAt: exp ? exp * 1e3 : void 0,
-    data: data && typeof data === "object" ? data : new NullProtoObj()
-  };
+	const key = config.hooks?.onUnsealKeyLookup ? (header) => config.hooks.onUnsealKeyLookup({
+		header,
+		event,
+		config
+	}) : getDecryptKey(config.key);
+	const alg = config.jwe?.encryptOptions?.alg;
+	const enc = config.jwe?.encryptOptions?.enc;
+	let typ = void 0;
+	if (config.jwe?.encryptOptions?.protectedHeader?.typ && typeof config.jwe.encryptOptions.protectedHeader.typ === "string" && config.jwe.encryptOptions.protectedHeader.typ.toLowerCase().includes("jwt")) typ = config.jwe.encryptOptions.protectedHeader.typ;
+	const { payload } = await decrypt(sealed, key, {
+		...config.jwe?.decryptOptions,
+		requiredClaims: [...new Set([
+			...config.jwe?.decryptOptions?.requiredClaims || [],
+			"jti",
+			"iat"
+		])],
+		typ: typ || "JWT",
+		maxTokenAge: config.maxAge,
+		algorithms: alg ? [alg] : void 0,
+		encryptionAlgorithms: enc ? [enc] : void 0,
+		unwrappedKeyAlgorithm: void 0,
+		keyUsage: void 0,
+		forceUint8Array: false,
+		validateJWT: true
+	}).catch((error_) => {
+		if (error_ instanceof Error) throw error_;
+		throw new Error(String(error_));
+	});
+	const { jti, iat, exp, ...data } = payload;
+	return {
+		id: jti,
+		createdAt: iat * 1e3,
+		expiresAt: exp ? exp * 1e3 : void 0,
+		data: data && typeof data === "object" ? data : new NullProtoObj()
+	};
 }
+/**
+* Clear the session (delete from context and drop cookie).
+*/
 async function clearJWESession(event, config) {
-  const context = getEventContext(event);
-  const sessionName = config.name || DEFAULT_NAME$1;
-  let session = context.sessions?.[sessionName];
-  if (session && session[kGetSessionPromise$1]) {
-    session = await session[kGetSessionPromise$1];
-  }
-  if (context.sessions?.[sessionName]) {
-    delete context.sessions[sessionName];
-  }
-  if (config.cookie !== false && hasWritableResponse$1(event)) {
-    setChunkedCookie(event, sessionName, "", {
-      ...DEFAULT_COOKIE$1,
-      ...config.cookie,
-      expires: /* @__PURE__ */ new Date(0),
-      maxAge: void 0
-    });
-    await config.hooks?.onClear?.({
-      session,
-      event,
-      config
-    });
-  }
+	const context = getEventContext(event);
+	const sessionName = config.name || DEFAULT_NAME$1;
+	let session = context.sessions?.[sessionName];
+	if (session && session[kGetSessionPromise$1]) session = await session[kGetSessionPromise$1];
+	if (context.sessions?.[sessionName]) delete context.sessions[sessionName];
+	if (config.cookie !== false && hasWritableResponse$1(event)) {
+		setChunkedCookie(event, sessionName, "", {
+			...DEFAULT_COOKIE$1,
+			...config.cookie,
+			expires: /* @__PURE__ */ new Date(0),
+			maxAge: void 0
+		});
+		await config.hooks?.onClear?.({
+			session,
+			event,
+			config
+		});
+	}
 }
 function getSessionFromContext$1(event, sessionName) {
-  const context = getEventContext(event);
-  return context.sessions?.[sessionName];
+	return getEventContext(event).sessions?.[sessionName];
 }
 function hasWritableResponse$1(event) {
-  return Boolean(event.res);
+	return Boolean(event.res);
 }
 function getEncryptKey(key) {
-  if (!key) {
-    throw new Error("Session: JWE key is required.");
-  }
-  let _key;
-  if (typeof key === "string") {
-    _key = key;
-  } else if (isSymmetricJWK(key) || isPrivateJWK(key)) {
-    _key = key;
-  } else if ("publicKey" in key && isPublicJWK(key.publicKey)) {
-    _key = key.publicKey;
-  } else if ("privateKey" in key && isPrivateJWK(key.privateKey)) {
-    _key = key.privateKey;
-  }
-  if (!_key) {
-    throw new Error(
-      "Session: Invalid JWE key. It must be a password string or valid JWK.",
-      { cause: key }
-    );
-  }
-  return _key;
+	if (!key) throw new Error("Session: JWE key is required.");
+	let _key;
+	if (typeof key === "string") _key = key;
+	else if (isSymmetricJWK(key) || isPrivateJWK(key)) _key = key;
+	else if ("publicKey" in key && isPublicJWK(key.publicKey)) _key = key.publicKey;
+	else if ("privateKey" in key && isPrivateJWK(key.privateKey)) _key = key.privateKey;
+	if (!_key) throw new Error("Session: Invalid JWE key. It must be a password string or valid JWK.", { cause: key });
+	return _key;
 }
 function getDecryptKey(key) {
-  if (!key) {
-    throw new Error("Session: JWE key is required.");
-  }
-  let _key = void 0;
-  if (typeof key === "string") {
-    _key = key;
-  } else if (isSymmetricJWK(key)) {
-    _key = key;
-  } else if ("privateKey" in key) {
-    _key = key.privateKey;
-  }
-  if (!_key) {
-    throw new Error(
-      "Session: Invalid JWE key. It must be a password string or a valid private JWK.",
-      { cause: key }
-    );
-  }
-  return _key;
+	if (!key) throw new Error("Session: JWE key is required.");
+	let _key = void 0;
+	if (typeof key === "string") _key = key;
+	else if (isSymmetricJWK(key)) _key = key;
+	else if ("privateKey" in key) _key = key.privateKey;
+	if (!_key) throw new Error("Session: Invalid JWE key. It must be a password string or a valid private JWK.", { cause: key });
+	return _key;
 }
 function findSetCookie$1(setCookie, name) {
-  const regex = new RegExp(`(?:^|,\\s*)${name}=([^;]+)`);
-  const match = setCookie.match(regex);
-  return match ? match[1] : void 0;
+	const regex = new RegExp(`(?:^|,\\s*)${name}=([^;]+)`);
+	const match = setCookie.match(regex);
+	return match ? match[1] : void 0;
 }
-
+//#endregion
+//#region src/adapters/h3v2/session/jws.ts
 const kGetSessionPromise = Symbol("h3_jws_getSession");
+const kSessionToken = Symbol("h3_jws_sessionToken");
 const DEFAULT_NAME = "h3-jws";
 const DEFAULT_COOKIE = {
-  path: "/",
-  secure: true,
-  httpOnly: false
+	path: "/",
+	secure: true,
+	httpOnly: false
 };
 async function useJWSSession(event, config) {
-  const sessionName = config.name || DEFAULT_NAME;
-  await getJWSSession(event, config);
-  const sessionManager = {
-    get id() {
-      return getSessionFromContext(event, sessionName)?.id;
-    },
-    get createdAt() {
-      return getSessionFromContext(event, sessionName)?.createdAt ?? Date.now();
-    },
-    get expiresAt() {
-      return getSessionFromContext(event, sessionName)?.expiresAt;
-    },
-    get data() {
-      return getSessionFromContext(event, sessionName)?.data || {};
-    },
-    get token() {
-      return getJWSSessionToken(event, config);
-    },
-    update: async (update) => {
-      await updateJWSSession(event, config, update);
-      return sessionManager;
-    },
-    clear: async () => {
-      await clearJWSSession(event, config);
-      return sessionManager;
-    }
-  };
-  return sessionManager;
+	const sessionName = config.name || DEFAULT_NAME;
+	await getJWSSession(event, config);
+	const sessionManager = {
+		get id() {
+			return getSessionFromContext(event, sessionName)?.id;
+		},
+		get createdAt() {
+			return getSessionFromContext(event, sessionName)?.createdAt ?? Date.now();
+		},
+		get expiresAt() {
+			return getSessionFromContext(event, sessionName)?.expiresAt;
+		},
+		get data() {
+			return getSessionFromContext(event, sessionName)?.data || {};
+		},
+		get token() {
+			return getSessionFromContext(event, sessionName)?.[kSessionToken] ?? getJWSSessionToken(event, config);
+		},
+		update: async (update) => {
+			await updateJWSSession(event, config, update);
+			return sessionManager;
+		},
+		clear: async () => {
+			await clearJWSSession(event, config);
+			return sessionManager;
+		}
+	};
+	return sessionManager;
 }
 async function getJWSSession(event, config) {
-  const sessionName = config.name || DEFAULT_NAME;
-  const context = getEventContext(event);
-  if (!context.sessions) {
-    context.sessions = new NullProtoObj();
-  }
-  const existingSession = context.sessions[sessionName];
-  if (existingSession) {
-    const session2 = existingSession[kGetSessionPromise] ? await existingSession[kGetSessionPromise] : existingSession;
-    if (session2.expiresAt !== void 0 && session2.expiresAt < Date.now() && hasWritableResponse(event)) {
-      await config.hooks?.onExpire?.({
-        event,
-        error: new Error(
-          `JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${new Date(session2.expiresAt * 1e3).toISOString()})`
-        ),
-        config
-      });
-      return clearJWSSession(event, config).then(
-        () => getJWSSession(event, config)
-      );
-    }
-    await config.hooks?.onRead?.({
-      event,
-      session: session2,
-      config
-    });
-    return session2;
-  }
-  const now = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
-  const createdAt = now - now % 1e3;
-  const session = {
-    id: void 0,
-    createdAt,
-    expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3,
-    data: new NullProtoObj()
-  };
-  context.sessions[sessionName] = session;
-  const token = getJWSSessionToken(event, config);
-  if (token) {
-    const promise = verifyJWSSession(event, config, token).catch(async (error_) => {
-      if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
-        await config.hooks?.onExpire?.({
-          event,
-          error: error_,
-          config
-        });
-        return void 0;
-      }
-      await config.hooks?.onError?.({
-        event,
-        error: error_,
-        config
-      });
-      return void 0;
-    }).then((unsealed) => {
-      if (unsealed) {
-        Object.assign(session, unsealed);
-      }
-      delete session[kGetSessionPromise];
-      return session;
-    });
-    session[kGetSessionPromise] = promise;
-    await promise;
-  }
-  await config.hooks?.onRead?.({
-    event,
-    session,
-    config
-  });
-  return session;
+	const sessionName = config.name || DEFAULT_NAME;
+	const context = getEventContext(event);
+	if (!context.sessions) context.sessions = new NullProtoObj();
+	const existingSession = context.sessions[sessionName];
+	if (existingSession) {
+		const session = existingSession[kGetSessionPromise] ? await existingSession[kGetSessionPromise] : existingSession;
+		if (session.expiresAt !== void 0 && session.expiresAt < Date.now() && hasWritableResponse(event)) {
+			await config.hooks?.onExpire?.({
+				event,
+				error: /* @__PURE__ */ new Error(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(session.expiresAt * 1e3)).toISOString()})`),
+				config
+			});
+			return clearJWSSession(event, config).then(() => getJWSSession(event, config));
+		}
+		await config.hooks?.onRead?.({
+			event,
+			session,
+			config
+		});
+		return session;
+	}
+	const now = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
+	const createdAt = now - now % 1e3;
+	const session = {
+		id: void 0,
+		createdAt,
+		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3,
+		data: new NullProtoObj()
+	};
+	context.sessions[sessionName] = session;
+	const token = getJWSSessionToken(event, config);
+	if (token) {
+		session[kSessionToken] = token;
+		const promise = verifyJWSSession(event, config, token).catch(async (error_) => {
+			if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
+				await config.hooks?.onExpire?.({
+					event,
+					error: error_,
+					config
+				});
+				return;
+			}
+			await config.hooks?.onError?.({
+				event,
+				error: error_,
+				config
+			});
+		}).then((unsealed) => {
+			if (unsealed) Object.assign(session, unsealed);
+			delete session[kGetSessionPromise];
+			return session;
+		});
+		session[kGetSessionPromise] = promise;
+		await promise;
+	}
+	await config.hooks?.onRead?.({
+		event,
+		session,
+		config
+	});
+	return session;
 }
 function getJWSSessionToken(event, config) {
-  const sessionName = config.name || DEFAULT_NAME;
-  let token;
-  if (config.sessionHeader !== false) {
-    const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
-    const headerValue = event.req.headers.get(headerName);
-    if (typeof headerValue === "string") {
-      token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
-    }
-  }
-  if (config.cookie !== false && hasWritableResponse(event)) {
-    const setCookie = event.res.headers.get("set-cookie");
-    if (typeof setCookie === "string") {
-      token = findSetCookie(setCookie, sessionName);
-    }
-  }
-  if (!token) {
-    token = getChunkedCookie(event, sessionName);
-  }
-  return token;
+	const sessionName = config.name || DEFAULT_NAME;
+	let token;
+	if (config.sessionHeader !== false) {
+		const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
+		const headerValue = event.req.headers.get(headerName);
+		if (typeof headerValue === "string") token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
+	}
+	if (config.cookie !== false && hasWritableResponse(event)) {
+		const setCookie = event.res.headers.get("set-cookie");
+		if (typeof setCookie === "string") token = findSetCookie(setCookie, sessionName);
+	}
+	if (!token) token = getChunkedCookie(event, sessionName);
+	return token;
 }
 async function updateJWSSession(event, config, update) {
-  const sessionName = config.name || DEFAULT_NAME;
-  const context = getEventContext(event);
-  const session = context.sessions?.[sessionName] || await getJWSSession(event, config);
-  if (typeof update === "function") {
-    update = update(session.data);
-  }
-  if (update) {
-    const oldSession = { ...session, data: { ...session.data } };
-    Object.assign(session.data, update);
-    await config.hooks?.onUpdate?.({
-      session,
-      oldSession,
-      event,
-      config
-    });
-  }
-  const now = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
-  const createdAt = now - now % 1e3;
-  Object.assign(session, {
-    id: config.generateId?.() || crypto.randomUUID(),
-    createdAt,
-    expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3
-  });
-  if (config.cookie !== false && hasWritableResponse(event)) {
-    const token = await signJWSSession(event, config);
-    setChunkedCookie(event, sessionName, token, {
-      ...DEFAULT_COOKIE,
-      expires: config.maxAge === void 0 ? void 0 : new Date(
-        session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3
-      ),
-      ...config.cookie
-    });
-  }
-  return session;
+	const sessionName = config.name || DEFAULT_NAME;
+	const session = getEventContext(event).sessions?.[sessionName] || await getJWSSession(event, config);
+	if (typeof update === "function") update = update(session.data);
+	if (update) {
+		const oldSession = {
+			...session,
+			data: { ...session.data }
+		};
+		Object.assign(session.data, update);
+		await config.hooks?.onUpdate?.({
+			session,
+			oldSession,
+			event,
+			config
+		});
+	}
+	const now = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
+	const createdAt = now - now % 1e3;
+	Object.assign(session, {
+		id: config.generateId?.() || crypto.randomUUID(),
+		createdAt,
+		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3
+	});
+	if (config.cookie !== false && hasWritableResponse(event)) {
+		const token = await signJWSSession(event, config);
+		session[kSessionToken] = token;
+		setChunkedCookie(event, sessionName, token, {
+			...DEFAULT_COOKIE,
+			expires: config.maxAge === void 0 ? void 0 : new Date(session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3),
+			...config.cookie
+		});
+	}
+	return session;
 }
 async function signJWSSession(event, config) {
-  const key = getSignKey(config.key);
-  const sessionName = config.name || DEFAULT_NAME;
-  const context = getEventContext(event);
-  const session = context.sessions?.[sessionName] || await getJWSSession(event, config);
-  const iat = Math.floor(session.createdAt / 1e3);
-  const exp = session.expiresAt ? Math.floor(session.expiresAt / 1e3) : void 0;
-  const payload = {
-    ...session.data,
-    jti: session.id,
-    iat
-  };
-  if (exp) {
-    payload.exp = exp;
-  }
-  let typ;
-  if (config.jws?.signOptions?.protectedHeader?.typ && typeof config.jws.signOptions.protectedHeader.typ === "string" && config.jws.signOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
-    typ = config.jws.signOptions.protectedHeader.typ;
-  }
-  const token = await sign(payload, key, {
-    ...config.jws?.signOptions,
-    expiresIn: void 0,
-    // controlled via 'exp' claim
-    protectedHeader: {
-      ...config.jws?.signOptions?.protectedHeader,
-      kid: "kid" in key ? key.kid : void 0,
-      typ: typ || "JWT",
-      cty: "application/json"
-    }
-  });
-  return token;
+	const key = getSignKey(config.key);
+	const sessionName = config.name || DEFAULT_NAME;
+	const session = getEventContext(event).sessions?.[sessionName] || await getJWSSession(event, config);
+	const iat = Math.floor(session.createdAt / 1e3);
+	const exp = session.expiresAt ? Math.floor(session.expiresAt / 1e3) : void 0;
+	const payload = {
+		...session.data,
+		jti: session.id,
+		iat
+	};
+	if (exp) payload.exp = exp;
+	let typ;
+	if (config.jws?.signOptions?.protectedHeader?.typ && typeof config.jws.signOptions.protectedHeader.typ === "string" && config.jws.signOptions.protectedHeader.typ.toLowerCase().includes("jwt")) typ = config.jws.signOptions.protectedHeader.typ;
+	return await sign(payload, key, {
+		...config.jws?.signOptions,
+		expiresIn: void 0,
+		protectedHeader: {
+			...config.jws?.signOptions?.protectedHeader,
+			kid: "kid" in key ? key.kid : void 0,
+			typ: typ || "JWT",
+			cty: "application/json"
+		}
+	});
 }
 async function verifyJWSSession(event, config, token) {
-  const alg = config.jws?.signOptions?.alg;
-  const jwk = config.hooks?.onVerifyKeyLookup ? (header) => config.hooks.onVerifyKeyLookup({
-    header,
-    event,
-    config
-  }) : getVerifyKey(config.key);
-  let typ;
-  if (config.jws?.signOptions?.protectedHeader?.typ && typeof config.jws.signOptions.protectedHeader.typ === "string" && config.jws.signOptions.protectedHeader.typ.toLowerCase().includes("jwt")) {
-    typ = config.jws.signOptions.protectedHeader.typ;
-  }
-  const { payload } = await verify(token, jwk, {
-    ...config.jws?.verifyOptions,
-    requiredClaims: [
-      .../* @__PURE__ */ new Set([
-        ...config.jws?.verifyOptions?.requiredClaims || [],
-        "jti",
-        "iat"
-      ])
-    ],
-    typ: typ || "JWT",
-    algorithms: alg ? [alg] : void 0,
-    forceUint8Array: false,
-    validateJWT: true
-  }).catch((error_) => {
-    const message = error_ instanceof Error ? error_.message : String(error_);
-    throw new Error(`Invalid session token: ${message}`);
-  });
-  const { jti, iat, exp, ...data } = payload;
-  return {
-    id: jti,
-    createdAt: iat * 1e3,
-    expiresAt: exp ? exp * 1e3 : void 0,
-    data: data && typeof data === "object" ? data : new NullProtoObj()
-  };
+	const alg = config.jws?.signOptions?.alg;
+	const jwk = config.hooks?.onVerifyKeyLookup ? (header) => config.hooks.onVerifyKeyLookup({
+		header,
+		event,
+		config
+	}) : getVerifyKey(config.key);
+	let typ;
+	if (config.jws?.signOptions?.protectedHeader?.typ && typeof config.jws.signOptions.protectedHeader.typ === "string" && config.jws.signOptions.protectedHeader.typ.toLowerCase().includes("jwt")) typ = config.jws.signOptions.protectedHeader.typ;
+	const { payload } = await verify(token, jwk, {
+		...config.jws?.verifyOptions,
+		requiredClaims: [...new Set([
+			...config.jws?.verifyOptions?.requiredClaims || [],
+			"jti",
+			"iat"
+		])],
+		typ: typ || "JWT",
+		algorithms: alg ? [alg] : void 0,
+		forceUint8Array: false,
+		validateJWT: true
+	}).catch((error_) => {
+		const message = error_ instanceof Error ? error_.message : String(error_);
+		throw new Error(`Invalid session token: ${message}`);
+	});
+	const { jti, iat, exp, ...data } = payload;
+	return {
+		id: jti,
+		createdAt: iat * 1e3,
+		expiresAt: exp ? exp * 1e3 : void 0,
+		data: data && typeof data === "object" ? data : new NullProtoObj()
+	};
 }
 async function clearJWSSession(event, config) {
-  const context = getEventContext(event);
-  const sessionName = config.name || DEFAULT_NAME;
-  let session = context.sessions?.[sessionName];
-  if (session && session[kGetSessionPromise]) {
-    session = await session[kGetSessionPromise];
-  }
-  if (context.sessions?.[sessionName]) {
-    delete context.sessions[sessionName];
-  }
-  if (config.cookie !== false && hasWritableResponse(event)) {
-    setChunkedCookie(event, sessionName, "", {
-      ...DEFAULT_COOKIE,
-      ...config.cookie,
-      expires: /* @__PURE__ */ new Date(0),
-      maxAge: void 0
-    });
-    await config.hooks?.onClear?.({
-      session,
-      event,
-      config
-    });
-  }
+	const context = getEventContext(event);
+	const sessionName = config.name || DEFAULT_NAME;
+	let session = context.sessions?.[sessionName];
+	if (session && session[kGetSessionPromise]) session = await session[kGetSessionPromise];
+	if (context.sessions?.[sessionName]) delete context.sessions[sessionName];
+	if (config.cookie !== false && hasWritableResponse(event)) {
+		setChunkedCookie(event, sessionName, "", {
+			...DEFAULT_COOKIE,
+			...config.cookie,
+			expires: /* @__PURE__ */ new Date(0),
+			maxAge: void 0
+		});
+		await config.hooks?.onClear?.({
+			session,
+			event,
+			config
+		});
+	}
 }
 function getSessionFromContext(event, sessionName) {
-  const context = getEventContext(event);
-  return context.sessions?.[sessionName];
+	return getEventContext(event).sessions?.[sessionName];
 }
 function hasWritableResponse(event) {
-  return Boolean(event.res);
+	return Boolean(event.res);
 }
 function getSignKey(key) {
-  if (!key) {
-    throw new Error("Session: JWS key is required.");
-  }
-  let _key;
-  if (isSymmetricJWK(key)) {
-    _key = key;
-  } else if ("privateKey" in key && isPrivateJWK(key.privateKey)) {
-    _key = key.privateKey;
-  }
-  if (!_key) {
-    throw new Error(
-      "Session: Invalid JWS key. It must be a symmetric JWK or a private JWK.",
-      { cause: key }
-    );
-  }
-  return _key;
+	if (!key) throw new Error("Session: JWS key is required.");
+	let _key;
+	if (isSymmetricJWK(key)) _key = key;
+	else if ("privateKey" in key && isPrivateJWK(key.privateKey)) _key = key.privateKey;
+	if (!_key) throw new Error("Session: Invalid JWS key. It must be a symmetric JWK or a private JWK.", { cause: key });
+	return _key;
 }
 function getVerifyKey(key) {
-  if (!key) {
-    throw new Error("Session: JWS key is required.");
-  }
-  let _key;
-  if (isSymmetricJWK(key)) {
-    _key = key;
-  } else if ("publicKey" in key) {
-    const publicKey = key.publicKey;
-    if (isPublicJWK(publicKey)) {
-      _key = publicKey;
-    } else if (Array.isArray(publicKey)) {
-      const keys = publicKey.filter(
-        (candidate) => isPublicJWK(candidate)
-      );
-      if (keys.length > 0) {
-        _key = { keys };
-      }
-    } else if (publicKey && typeof publicKey === "object" && Array.isArray(publicKey.keys)) {
-      const keys = publicKey.keys.filter(
-        (candidate) => isPublicJWK(candidate)
-      );
-      if (keys.length > 0) {
-        _key = { keys };
-      }
-    }
-  }
-  if (!_key) {
-    throw new Error(
-      "Session: Invalid JWS key. It must be a symmetric JWK or a public JWK/set.",
-      { cause: key }
-    );
-  }
-  return _key;
+	if (!key) throw new Error("Session: JWS key is required.");
+	let _key;
+	if (isSymmetricJWK(key)) _key = key;
+	else if ("publicKey" in key) {
+		const publicKey = key.publicKey;
+		if (isPublicJWK(publicKey)) _key = publicKey;
+		else if (Array.isArray(publicKey)) {
+			const keys = publicKey.filter((candidate) => isPublicJWK(candidate));
+			if (keys.length > 0) _key = { keys };
+		} else if (publicKey && typeof publicKey === "object" && Array.isArray(publicKey.keys)) {
+			const keys = publicKey.keys.filter((candidate) => isPublicJWK(candidate));
+			if (keys.length > 0) _key = { keys };
+		}
+	}
+	if (!_key) throw new Error("Session: Invalid JWS key. It must be a symmetric JWK or a public JWK/set.", { cause: key });
+	return _key;
 }
 function findSetCookie(setCookie, name) {
-  const regex = new RegExp(`(?:^|,\\s*)${name}=([^;]+)`);
-  const match = setCookie.match(regex);
-  return match ? match[1] : void 0;
+	const regex = new RegExp(`(?:^|,\\s*)${name}=([^;]+)`);
+	const match = setCookie.match(regex);
+	return match ? match[1] : void 0;
 }
-
-export { clearJWESession, clearJWSSession, getJWESession, getJWESessionToken, getJWSSession, getJWSSessionToken, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+//#endregion
+export { clearJWESession, clearJWSSession, deriveJWKFromPassword, exportJWKToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, getJWSSessionToken, importJWKFromPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };