unjwt 0.5.38 → 0.5.39

package/dist/_chunks/utils.mjs

@@ -0,0 +1,374 @@
+import { t as __exportAll } from "./chunk.mjs";
+//#region src/core/utils/jwt.ts
+/**
+* Apply default typ/cty semantics shared by JWS & JWE.
+* - If typ is undefined and payload is a non-Uint8Array object, set typ="JWT".
+* - If typ is "JWT" and payload is a non-Uint8Array object, ensure cty defaults to "application/json".
+*/
+function applyTypCtyDefaults(header, payload) {
+	const isObjectPayload = typeof payload === "object" && payload !== null && !(payload instanceof Uint8Array);
+	if (header.typ === void 0 && isObjectPayload) header.typ = "JWT";
+	if (header.typ?.toLowerCase().includes("jwt") && isObjectPayload) header.cty ||= "application/json";
+	return header;
+}
+/** Returns true when headers indicate JSON content. */
+function isJWTContent(header) {
+	if (!header) return false;
+	if (header.typ?.toLowerCase().includes("jwt")) return true;
+	const cty = header.cty?.toLowerCase();
+	return cty === "json" || cty === "application/json" || !!cty && cty.endsWith("+json");
+}
+/**
+* Given a decoded string and JOSE headers, return an object if JSON, otherwise the string.
+*/
+function decodeMaybeJWTString(decodedString, header) {
+	if (isJWTContent(header)) {
+		if (decodedString.startsWith("{") && decodedString.endsWith("}") || decodedString.startsWith("[") && decodedString.endsWith("]")) try {
+			return sanitizeObject(JSON.parse(decodedString));
+		} catch {}
+	}
+	return decodedString;
+}
+/**
+* Decode a payload that is represented as raw bytes into T | string, honoring forceUint8Array and headers.
+*/
+function decodePayloadFromBytes(bytes, header, forceUint8Array) {
+	if (forceUint8Array) return bytes;
+	return decodeMaybeJWTString(textDecoder.decode(bytes), header);
+}
+/**
+* Decode a payload that is a Base64URL segment into T | string | Uint8Array based on flags and headers.
+*/
+function decodePayloadFromB64UrlSegment(payloadEncoded, header, forceUint8Array) {
+	if (forceUint8Array) return base64UrlDecode(payloadEncoded, false);
+	return decodeMaybeJWTString(base64UrlDecode(payloadEncoded), header);
+}
+/** Convert plaintext input to bytes, shared by JWS & JWE when preparing payload. */
+function getPlaintextBytes(payload) {
+	if (payload instanceof Uint8Array) return payload;
+	if (typeof payload === "string") return textEncoder.encode(payload);
+	if (typeof payload === "object" && payload !== null) return textEncoder.encode(JSON.stringify(payload));
+	throw new TypeError("Plaintext must be a string, Uint8Array, or a JSON-serializable object.");
+}
+const TIME_CONSTANTS = Object.freeze({
+	s: 1,
+	second: 1,
+	seconds: 1,
+	m: 60,
+	minute: 60,
+	minutes: 60,
+	h: 3600,
+	hour: 3600,
+	hours: 3600,
+	D: 86400,
+	day: 86400,
+	days: 86400,
+	W: 604800,
+	week: 604800,
+	weeks: 604800,
+	M: 2592e3,
+	month: 2592e3,
+	months: 2592e3,
+	Y: 31536e3,
+	year: 31536e3,
+	years: 31536e3
+});
+const EXPIRES_IN_REGEX = /^(\d+)(s|second|seconds|m|minute|minutes|h|hour|hours|D|day|days|W|week|weeks|M|month|months|Y|year|years)?$/;
+function computeExpiresInSeconds(expiresIn) {
+	if (typeof expiresIn === "number") {
+		if (!Number.isInteger(expiresIn) || expiresIn <= 0) throw new TypeError("If 'expiresIn' is a number, it must be a positive integer representing seconds.");
+		return expiresIn;
+	}
+	if (typeof expiresIn === "string") {
+		const match = expiresIn.match(EXPIRES_IN_REGEX);
+		if (!match || !match[1]) throw new TypeError("Invalid 'expiresIn' format. Must be a positive integer or a string like '10m', '2h', '7D', etc.");
+		return Number.parseInt(match[1], 10) * TIME_CONSTANTS[match[2] || "s"];
+	}
+	throw new TypeError("'expiresIn' must be a number or a string representing time duration.");
+}
+const computeMaxTokenAgeSeconds = computeExpiresInSeconds;
+/** Optionally compute iat/exp when signing JWTs. */
+function computeJwtTimeClaims(payload, headerTyp, expiresIn, currentDate = /* @__PURE__ */ new Date()) {
+	if (expiresIn === void 0 || !headerTyp?.toLowerCase().includes("jwt") || !(payload && typeof payload === "object") || payload instanceof Uint8Array || payload.exp) return;
+	const now = Math.round(currentDate.getTime() / 1e3);
+	const claims = { ...payload };
+	claims.iat ||= now;
+	claims.exp = claims.iat + computeExpiresInSeconds(expiresIn);
+	return claims;
+}
+/** Validate JWT claims under JWS verification rules (or custom JWE implementations). */
+function validateJwtClaims(jwtClaims, options = {}) {
+	const clockTolerance = options.clockTolerance ?? 0;
+	const currentTime = Math.round((options.currentDate ?? /* @__PURE__ */ new Date()).getTime() / 1e3);
+	const allRequiredClaims = new Set(options.requiredClaims || []);
+	const missingClaims = /* @__PURE__ */ new Set();
+	if (options.issuer) allRequiredClaims.add("iss");
+	if (options.audience) allRequiredClaims.add("aud");
+	if (options.subject) allRequiredClaims.add("sub");
+	if (options.maxTokenAge) allRequiredClaims.add("iat");
+	for (const claimName of allRequiredClaims) if (!(claimName in jwtClaims)) missingClaims.add(claimName);
+	if (missingClaims.size > 0) throw new Error(`Missing required JWT Claims: ${[...missingClaims].join(", ")}`);
+	if (options.issuer) {
+		const expectedIssuers = maybeArray(options.issuer);
+		if (!jwtClaims.iss || !expectedIssuers.includes(jwtClaims.iss)) throw new Error(`Invalid JWT "iss" (Issuer) Claim: Expected ${expectedIssuers.join(" or ")}, got ${jwtClaims.iss}`);
+	}
+	if (options.subject && jwtClaims.sub !== options.subject) throw new Error(`Invalid JWT "sub" (Subject) Claim: Expected ${options.subject}, got ${jwtClaims.sub}`);
+	if (options.audience) {
+		const expectedAudiences = maybeArray(options.audience);
+		const claimAudience = maybeArray(jwtClaims.aud || []);
+		if (!claimAudience.some((aud) => expectedAudiences.includes(aud))) throw new Error(`Invalid JWT "aud" (Audience) Claim: Expected ${expectedAudiences.join(" or ")}, got ${claimAudience.join(", ")}`);
+	}
+	if (typeof jwtClaims.nbf === "number" && jwtClaims.nbf > currentTime + clockTolerance) throw new Error(`JWT "nbf" (Not Before) Claim validation failed: Token is not yet valid (nbf: ${(/* @__PURE__ */ new Date(jwtClaims.nbf * 1e3)).toISOString()})`);
+	if (typeof jwtClaims.exp === "number" && jwtClaims.exp <= currentTime - clockTolerance) throw new Error(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(jwtClaims.exp * 1e3)).toISOString()})`);
+	if (options.maxTokenAge) {
+		if (typeof jwtClaims.iat !== "number") throw new TypeError("JWT \"iat\" (Issued At) Claim must be a number when maxTokenAge is set.");
+		if (jwtClaims.iat > currentTime + clockTolerance) throw new Error(`JWT "iat" (Issued At) Claim validation failed: Token was issued in the future (iat: ${(/* @__PURE__ */ new Date(jwtClaims.iat * 1e3)).toISOString()})`);
+		if (jwtClaims.iat < currentTime - computeMaxTokenAgeSeconds(options.maxTokenAge) - clockTolerance) throw new Error(`JWT "iat" (Issued At) Claim validation failed: Token is too old (maxTokenAge: ${options.maxTokenAge}s, iat: ${(/* @__PURE__ */ new Date(jwtClaims.iat * 1e3)).toISOString()})`);
+	}
+}
+const BASE_HEADER_PARAMS = [
+	"alg",
+	"typ",
+	"cty",
+	"kid",
+	"jwk",
+	"jku",
+	"x5c",
+	"x5t",
+	"x5u"
+];
+/** Validate critical headers in JWS semantics. */
+function validateCriticalHeadersJWS(protectedHeader, requiredHeaders = []) {
+	if (!protectedHeader.crit) return;
+	const missingHeaderParams = /* @__PURE__ */ new Set();
+	const recognizedParams = new Set([
+		...requiredHeaders,
+		...BASE_HEADER_PARAMS,
+		"b64"
+	]);
+	for (const param of protectedHeader.crit) {
+		if (recognizedParams.has(param) && (param in protectedHeader || param === "b64")) continue;
+		missingHeaderParams.add(param);
+	}
+	if (missingHeaderParams.size > 0) throw new Error(`Missing critical header parameters: ${[...missingHeaderParams].join(", ")}`);
+}
+/** Validate critical headers in JWE semantics. */
+function validateCriticalHeadersJWE(protectedHeader, understoodFromOptions) {
+	if (protectedHeader.crit && !understoodFromOptions) throw new Error(`Unprocessed critical header parameters: ${protectedHeader.crit.join(", ")}`);
+	if (!protectedHeader.crit) return;
+	const understoodParams = new Set([
+		...understoodFromOptions || [],
+		...BASE_HEADER_PARAMS,
+		"enc",
+		"iv",
+		"tag",
+		"p2s",
+		"p2c",
+		"epk",
+		"apu",
+		"apv"
+	]);
+	for (const critParam of protectedHeader.crit) {
+		if (!Object.prototype.hasOwnProperty.call(protectedHeader, critParam)) throw new Error(`Critical header parameter "${critParam}" listed in "crit" but not present in the protected header.`);
+		if (!understoodParams.has(critParam)) throw new Error(`Unprocessed critical header parameters: ${critParam}`);
+	}
+}
+//#endregion
+//#region src/core/utils/sanitize.ts
+/**
+* Forked from unsecure@0.0.4
+* Licensed under the MIT License.
+*
+* Source: https://github.com/sandros94/unsecure/blob/913ed5580c551153a19154b4916c67a8efb2be85/src/sanitize.ts
+*/
+/**
+* Remove prototype-pollution vectors from a plain record in-place.
+* This strips __proto__, prototype, and constructor own properties.
+* Returns the same reference for convenience.
+*/
+function sanitizeObject(obj) {
+	if (!obj || typeof obj !== "object") return obj;
+	sanitizeKeys(obj);
+	return obj;
+}
+function sanitizeKeys(current, seen) {
+	if (Object.prototype.hasOwnProperty.call(current, "__proto__")) delete current["__proto__"];
+	if (Object.prototype.hasOwnProperty.call(current, "prototype")) delete current["prototype"];
+	if (Object.prototype.hasOwnProperty.call(current, "constructor")) delete current["constructor"];
+	const items = Array.isArray(current) ? current : Object.values(current);
+	for (const v of items) if (v && typeof v === "object") {
+		seen ??= /* @__PURE__ */ new WeakSet();
+		if (!seen.has(v)) {
+			seen.add(v);
+			sanitizeKeys(v, seen);
+		}
+	}
+}
+//#endregion
+//#region src/core/utils/index.ts
+var utils_exports = /* @__PURE__ */ __exportAll({
+	applyTypCtyDefaults: () => applyTypCtyDefaults,
+	assertCryptoKey: () => assertCryptoKey,
+	base64Decode: () => base64Decode,
+	base64Encode: () => base64Encode,
+	base64UrlDecode: () => base64UrlDecode,
+	base64UrlEncode: () => base64UrlEncode,
+	computeExpiresInSeconds: () => computeExpiresInSeconds,
+	computeJwtTimeClaims: () => computeJwtTimeClaims,
+	computeMaxTokenAgeSeconds: () => computeMaxTokenAgeSeconds,
+	concatUint8Arrays: () => concatUint8Arrays,
+	decodeMaybeJWTString: () => decodeMaybeJWTString,
+	decodePayloadFromB64UrlSegment: () => decodePayloadFromB64UrlSegment,
+	decodePayloadFromBytes: () => decodePayloadFromBytes,
+	getPlaintextBytes: () => getPlaintextBytes,
+	isAsymmetricJWK: () => isAsymmetricJWK,
+	isCryptoKey: () => isCryptoKey,
+	isCryptoKeyPair: () => isCryptoKeyPair,
+	isJWK: () => isJWK,
+	isJWKSet: () => isJWKSet,
+	isJWTContent: () => isJWTContent,
+	isPrivateJWK: () => isPrivateJWK,
+	isPublicJWK: () => isPublicJWK,
+	isSymmetricJWK: () => isSymmetricJWK,
+	maybeArray: () => maybeArray,
+	randomBytes: () => randomBytes,
+	sanitizeObject: () => sanitizeObject,
+	textDecoder: () => textDecoder,
+	textEncoder: () => textEncoder,
+	validateCriticalHeadersJWE: () => validateCriticalHeadersJWE,
+	validateCriticalHeadersJWS: () => validateCriticalHeadersJWS,
+	validateJwtClaims: () => validateJwtClaims
+});
+const textEncoder = /* @__PURE__ */ new TextEncoder();
+const textDecoder = /* @__PURE__ */ new TextDecoder();
+const _Buffer = /* @__PURE__ */ (() => {
+	try {
+		return globalThis.Buffer;
+	} catch {
+		return;
+	}
+})();
+const _hasBuffer = typeof _Buffer?.from === "function";
+const _hasToBase64 = !_hasBuffer && typeof Uint8Array.prototype.toBase64 === "function";
+const _hasFromBase64 = !_hasBuffer && typeof Uint8Array.fromBase64 === "function";
+const _b64UrlEncOpts = /* @__PURE__ */ Object.freeze({
+	alphabet: "base64url",
+	omitPadding: true
+});
+const _b64UrlDecOpts = /* @__PURE__ */ Object.freeze({ alphabet: "base64url" });
+function _toBuffer(data) {
+	return data instanceof Uint8Array ? _Buffer.from(data.buffer, data.byteOffset, data.byteLength) : _Buffer.from(data);
+}
+function base64Encode(data) {
+	if (_hasBuffer) return _toBuffer(data).toString("base64");
+	const encodedData = data instanceof Uint8Array ? data : textEncoder.encode(data);
+	if (_hasToBase64) return encodedData.toBase64();
+	return btoa(String.fromCodePoint(...encodedData));
+}
+function base64UrlEncode(data) {
+	if (_hasBuffer) return _toBuffer(data).toString("base64url");
+	const encodedData = data instanceof Uint8Array ? data : textEncoder.encode(data);
+	if (_hasToBase64) return encodedData.toBase64(_b64UrlEncOpts);
+	return btoa(String.fromCodePoint(...encodedData)).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "");
+}
+function base64Decode(str, toString) {
+	const decodeToString = toString !== false;
+	if (!str) return decodeToString ? "" : new Uint8Array(0);
+	if (_hasBuffer) {
+		const buf = _Buffer.from(str, "base64");
+		return decodeToString ? buf.toString("utf8") : new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+	}
+	const data = _hasFromBase64 ? Uint8Array.fromBase64(str) : Uint8Array.from(atob(str), (b) => b.codePointAt(0));
+	return decodeToString ? textDecoder.decode(data) : data;
+}
+function base64UrlDecode(str, toString) {
+	const decodeToString = toString !== false;
+	if (!str) return decodeToString ? "" : new Uint8Array(0);
+	if (_hasBuffer) {
+		const buf = _Buffer.from(str, "base64url");
+		return decodeToString ? buf.toString("utf8") : new Uint8Array(buf.buffer, buf.byteOffset, buf.byteLength);
+	}
+	let data;
+	if (_hasFromBase64) data = Uint8Array.fromBase64(str, _b64UrlDecOpts);
+	else {
+		str = str.replace(/-/g, "+").replace(/_/g, "/");
+		while (str.length % 4) str += "=";
+		data = Uint8Array.from(atob(str), (b) => b.codePointAt(0));
+	}
+	return decodeToString ? textDecoder.decode(data) : data;
+}
+function randomBytes(length) {
+	return crypto.getRandomValues(new Uint8Array(length));
+}
+/**
+* Concatenates multiple Uint8Arrays
+* @param arrays Arrays to concatenate
+* @returns Concatenated array
+*/
+function concatUint8Arrays(...arrays) {
+	const totalLength = arrays.reduce((length, arr) => length + arr.length, 0);
+	const result = new Uint8Array(totalLength);
+	let offset = 0;
+	for (const arr of arrays) {
+		result.set(arr, offset);
+		offset += arr.length;
+	}
+	return result;
+}
+function maybeArray(item) {
+	return Array.isArray(item) ? item : [item];
+}
+function isJWK(key) {
+	return typeof key === "object" && key !== null && "kty" in key && typeof key.kty === "string";
+}
+function isJWKSet(key) {
+	return key && typeof key === "object" && "keys" in key && Array.isArray(key.keys);
+}
+function assertCryptoKey(key) {
+	if (!isCryptoKey(key)) throw new Error("CryptoKey instance expected");
+}
+function isCryptoKey(key) {
+	return key?.[Symbol.toStringTag] === "CryptoKey";
+}
+const isCryptoKeyPair = (key) => key && typeof key === "object" && isCryptoKey(key.publicKey) && isCryptoKey(key.privateKey);
+/** Returns true if the JWK is a symmetric (oct) key. */
+function isSymmetricJWK(key) {
+	return isJWK(key) && key.kty === "oct" && typeof key.k === "string";
+}
+/** Returns true if the JWK is an asymmetric (RSA, EC, OKP) key. */
+function isAsymmetricJWK(key) {
+	return !isSymmetricJWK(key);
+}
+/**
+* Type guard that checks if the provided JWK contains private key material.
+* It relies purely on the presence of private components (e.g. "d"), not on the alg value.
+*/
+function isPrivateJWK(key) {
+	if (!isJWK(key)) return false;
+	if (key.kty === "EC") return typeof key.d === "string";
+	if (key.kty === "OKP") return typeof key.d === "string";
+	if (key.kty === "RSA") return typeof key.d === "string";
+	return false;
+}
+/**
+* Type guard that checks if the provided JWK is a public (asymmetric) key.
+* This checks for the presence of public components and absence of private material.
+*/
+function isPublicJWK(key) {
+	if (!isJWK(key)) return false;
+	if (key.kty === "EC") {
+		const ec = key;
+		return typeof ec.x === "string" && typeof ec.y === "string" && typeof ec.d !== "string";
+	}
+	if (key.kty === "OKP") {
+		const okp = key;
+		return typeof okp.x === "string" && typeof okp.d !== "string";
+	}
+	if (key.kty === "RSA") {
+		const rsa = key;
+		return typeof rsa.n === "string" && typeof rsa.e === "string" && typeof rsa.d !== "string";
+	}
+	return false;
+}
+//#endregion
+export { validateCriticalHeadersJWE as A, computeJwtTimeClaims as C, decodePayloadFromBytes as D, decodePayloadFromB64UrlSegment as E, validateJwtClaims as M, getPlaintextBytes as O, computeExpiresInSeconds as S, decodeMaybeJWTString as T, textDecoder as _, base64UrlEncode as a, sanitizeObject as b, isCryptoKey as c, isJWKSet as d, isPrivateJWK as f, randomBytes as g, maybeArray as h, base64UrlDecode as i, validateCriticalHeadersJWS as j, isJWTContent as k, isCryptoKeyPair as l, isSymmetricJWK as m, base64Decode as n, concatUint8Arrays as o, isPublicJWK as p, base64Encode as r, isAsymmetricJWK as s, assertCryptoKey as t, isJWK as u, textEncoder as v, computeMaxTokenAgeSeconds as w, applyTypCtyDefaults as x, utils_exports as y };

package/dist/adapters/h3.d.mts

@@ -1,267 +1,3 @@
-import { b as JWEEncryptOptions, J as JWEHeaderParameters } from '../shared/unjwt.CMNtw8ek.mjs';
-export { d as JWEDecryptOptions, e as JWEDecryptResult, c as JWEKeyLookupFunction, a as JWEKeyManagementHeaderParameters } from '../shared/unjwt.CMNtw8ek.mjs';
-import { X as JWTClaims, E as ExpiresIn, r as JWK_Symmetric, u as JWK_Private, t as JWK_Public, Z as JWTClaimValidationOptions, w as JWKSet } from '../shared/unjwt.BCi3FEWr.mjs';
-export { C as CompositeKey, f as ContentEncryptionAlgorithm, D as DeriveKeyOptions, e as DeriveKeyReturn, c as GenerateJWKOptions, d as GenerateJWKReturn, G as GenerateKeyAlgorithm, a as GenerateKeyOptions, b as GenerateKeyReturn, v as JWK, S as JWKAlgorithm, T as JWKPEMAlgorithm, J as JWKParameters, H as JWK_AES_CBC_HMAC, I as JWK_AES_GCM, L as JWK_AES_GCM_KW, F as JWK_AES_KW, s as JWK_Asymmetric, R as JWK_Asymmetric_Algorithm, j as JWK_EC, O as JWK_ECDH_ES, A as JWK_ECDSA, i as JWK_EC_Private, h as JWK_EC_Public, x as JWK_HMAC, p as JWK_OKP, o as JWK_OKP_Private, n as JWK_OKP_Public, P as JWK_OKP_SIGN, N as JWK_PBES2, m as JWK_RSA, B as JWK_RSA_ENC, z as JWK_RSA_PSS, l as JWK_RSA_Private, k as JWK_RSA_Public, y as JWK_RSA_SIGN, Q as JWK_Symmetric_Algorithm, q as JWK_oct, Y as JWT, V as JoseHeaderParameters, K as KeyManagementAlgorithm, U as UnwrapKeyOptions, W as WrapKeyOptions, g as WrapKeyResult } from '../shared/unjwt.BCi3FEWr.mjs';
-import { S as StrictOmit } from '../shared/unjwt.JdKqVANs.mjs';
-import { CookieSerializeOptions } from 'cookie-es';
-import { H3Event } from 'h3';
-import { c as JWSSignOptions, b as JWSProtectedHeader } from '../shared/unjwt.BqdNUKDr.mjs';
-export { d as deriveJWKFromPassword, e as exportJWKToPEM, g as generateJWK, i as importJWKFromPEM } from '../shared/unjwt.BYDTEWa-.mjs';
-
-interface SessionClaims extends Required<Pick<JWTClaims, "jti" | "iat">>, StrictOmit<JWTClaims, "jti" | "iat"> {
-}
-type SessionData<T extends Record<string, any> = SessionClaims> = StrictOmit<T, "jti" | "iat" | "exp">;
-type SessionUpdate<T extends Record<string, any> = SessionClaims> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
-interface SessionManager<T extends Record<string, any> = SessionClaims, ConfigMaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
-    readonly id: string | undefined;
-    readonly createdAt: number;
-    readonly expiresAt: ConfigMaxAge extends ExpiresIn ? number : "exp" extends keyof T ? T["exp"] : number | undefined;
-    readonly data: SessionData<T>;
-    readonly token: string | undefined;
-    update: (update: SessionUpdate<T>) => Promise<SessionManager<T, ConfigMaxAge> & {
-        readonly id: string;
-    }>;
-    clear: () => Promise<SessionManager<T, ConfigMaxAge>>;
-}
-
-/**
- * This is a fork of h3 library's session utility functions.
- * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/src/utils/session.ts
- * @license MIT https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/LICENSE
- */
-
-declare const kGetSessionPromise$1: unique symbol;
-interface SessionJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
-    id: string | undefined;
-    createdAt: number;
-    expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
-    data: SessionData<T>;
-    [kGetSessionPromise$1]?: Promise<SessionJWE<T, MaxAge>>;
-}
-interface SessionHooksJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
-    onRead?: (args: {
-        session: SessionJWE<T, MaxAge>;
-        event: H3Event;
-        config: SessionConfigJWE<T, MaxAge>;
-    }) => void | Promise<void>;
-    onUpdate?: (args: {
-        session: SessionJWE<T, MaxAge>;
-        oldSession: SessionJWE<T, MaxAge>;
-        event: H3Event;
-        config: SessionConfigJWE<T, MaxAge>;
-    }) => void | Promise<void>;
-    onClear?: (args: {
-        session: SessionJWE<T, MaxAge> | undefined;
-        event: H3Event;
-        config: Partial<SessionConfigJWE<T, MaxAge>>;
-    }) => void | Promise<void>;
-    onExpire?: (args: {
-        event: H3Event;
-        error: Error;
-        config: SessionConfigJWE<T, MaxAge>;
-    }) => void | Promise<void>;
-    onError?: (args: {
-        event: H3Event;
-        error: any;
-        config: SessionConfigJWE<T, MaxAge>;
-    }) => void | Promise<void>;
-    onUnsealKeyLookup?: (args: {
-        header: JWEHeaderParameters;
-        event: H3Event;
-        config: SessionConfigJWE<T, MaxAge>;
-    }) => JWK_Symmetric | JWK_Private | Promise<JWK_Symmetric | JWK_Private>;
-}
-interface SessionConfigJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
-    /** @deprecated use `key` instead */
-    secret?: string | JWK_Symmetric | {
-        privateKey: JWK_Private | JWK_Symmetric;
-        publicKey?: JWK_Public;
-    };
-    /** Shared key used, string for PBES2 or Json Web Key (JWK) */
-    key: string | JWK_Symmetric | JWK_Private | {
-        privateKey: JWK_Private | JWK_Symmetric;
-        publicKey?: JWK_Public;
-    };
-    /** Session lifetime in seconds (used to derive exp from iat) */
-    maxAge?: MaxAge;
-    /** Default is "h3" */
-    name?: string;
-    /** Default is secure, httpOnly, path="/" */
-    cookie?: false | CookieSerializeOptions;
-    /** Default is x-h3-session / x-{name}-session */
-    sessionHeader?: false | string;
-    /** Default is crypto.randomUUID */
-    generateId?: () => string;
-    /** JWE configuration overrides */
-    jwe?: {
-        encryptOptions?: Omit<JWEEncryptOptions, "expiresIn">;
-        decryptOptions?: JWTClaimValidationOptions;
-    };
-    hooks?: SessionHooksJWE<T, MaxAge>;
-}
-/**
- * @deprecated use `SessionConfigJWE` instead
- */
-type SessionJWEConfig = SessionConfigJWE;
-type CompatEvent$1 = {
-    request: {
-        headers: Headers;
-    };
-    context: any;
-} | {
-    headers: Headers;
-    context: any;
-};
-/**
- * Create a session manager for the current request.
- */
-declare function useJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
-/**
- * Get (and lazily initialize) the session for the current request.
- */
-declare function getJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<SessionJWE<T, MaxAge>>;
-declare function getJWESessionToken<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): string | undefined;
-/**
- * Update the session (optionally mutating the session data) and re-issue the JWE token.
- */
-declare function updateJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: SessionConfigJWE<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWE<T, MaxAge>>;
-/**
- * Produce a JWE for the current session.
- * Payload structure:
- * {
- *   jti: string;
- *   iat: number; (seconds)
- *   exp?: number; (seconds)
- *   data: Record<string, any>;
- * }
- */
-declare function sealJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<string>;
-/**
- * Decrypt the JWE and return a Session-compatible object.
- */
-declare function unsealJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>, sealed: string): Promise<Partial<SessionJWE<T, MaxAge>>>;
-/**
- * Clear the session (delete from context and drop cookie).
- */
-declare function clearJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: Partial<SessionConfigJWE<T, MaxAge>>): Promise<void>;
-
-/**
- * This is a fork of h3 library's session utility functions.
- * @source https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/src/utils/session.ts
- * @license MIT https://github.com/h3js/h3/blob/b4dce71c256911335f3402d09f30ffad120ad61a/LICENSE
- */
-
-declare const kGetSessionPromise: unique symbol;
-interface SessionJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
-    id: string | undefined;
-    createdAt: number;
-    expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
-    data: SessionData<T>;
-    [kGetSessionPromise]?: Promise<SessionJWS<T, MaxAge>>;
-}
-interface SessionHooksJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
-    onRead?: (args: {
-        session: SessionJWS<T, MaxAge>;
-        event: H3Event;
-        config: SessionConfigJWS<T, MaxAge>;
-    }) => void | Promise<void>;
-    onUpdate?: (args: {
-        session: SessionJWS<T, MaxAge>;
-        oldSession: SessionJWS<T, MaxAge>;
-        event: H3Event;
-        config: SessionConfigJWS<T, MaxAge>;
-    }) => void | Promise<void>;
-    onClear?: (args: {
-        session: SessionJWS<T, MaxAge> | undefined;
-        event: H3Event;
-        config: Partial<SessionConfigJWS<T, MaxAge>>;
-    }) => void | Promise<void>;
-    onExpire?: (args: {
-        event: H3Event;
-        error: Error;
-        config: SessionConfigJWS<T, MaxAge>;
-    }) => void | Promise<void>;
-    onError?: (args: {
-        event: H3Event;
-        error: any;
-        config: SessionConfigJWS<T, MaxAge>;
-    }) => void | Promise<void>;
-    onVerifyKeyLookup?: (args: {
-        header: JWSProtectedHeader;
-        event: H3Event;
-        config: SessionConfigJWS<T, MaxAge>;
-    }) => JWKSet | JWK_Symmetric | JWK_Public | Promise<JWKSet | JWK_Symmetric | JWK_Public>;
-}
-interface SessionConfigJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
-    /**
-     * JWK (private for signing with RS/ES/PS, or symmetric oct) used for signing.
-     */
-    key: JWK_Symmetric | {
-        privateKey: JWK_Private;
-        publicKey: JWK_Public | JWK_Public[] | JWKSet;
-    };
-    /** Session lifetime in seconds (sets exp = iat + maxAge) */
-    maxAge?: MaxAge;
-    /** Default cookie / header name base */
-    name?: string;
-    /** Cookie options (false to disable cookies) */
-    cookie?: false | CookieSerializeOptions;
-    /** Custom header (false to disable header lookup) */
-    sessionHeader?: false | string;
-    /** Custom ID generator (defaults to crypto.randomUUID) */
-    generateId?: () => string;
-    /** JWS customization */
-    jws?: {
-        signOptions?: Omit<JWSSignOptions, "expiresIn">;
-        verifyOptions?: JWTClaimValidationOptions;
-    };
-    hooks?: SessionHooksJWS<T, MaxAge>;
-}
-/**
- * @deprecated use `SessionConfigJWS` instead
- */
-type SessionJWSConfig = SessionConfigJWS;
-type CompatEvent = {
-    request: {
-        headers: Headers;
-    };
-    context: any;
-} | {
-    headers: Headers;
-    context: any;
-};
-/**
- * Create a session manager for the current request using JWS (signed only, not encrypted).
- * NOTE: Contents are visible to clients (Base64URL-decoded JSON). Do not store secrets in session data.
- */
-declare function useJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
-/**
- * Retrieve (and lazily initialize) the session.
- */
-declare function getJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionJWS<T, MaxAge>>;
-/**
- * Update session data (if provided) and reissue JWS.
- */
-declare function updateJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: SessionConfigJWS<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWS<T, MaxAge>>;
-/**
- * Sign current session as a compact JWS.
- * Payload claims:
- *  jti, iat, exp?, data, plus optional extraClaims (cannot override reserved)
- */
-declare function signJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<string>;
-/**
- * Verify and parse a compact JWS into a Session structure.
- * Performs:
- *  - cryptographic signature verification
- *  - (optional) standard claim checks if validateJWT true
- *  - ensures jti & iat presence
- *  - enforces maxAge if provided
- */
-declare function verifyJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>, token: string): Promise<Partial<SessionJWS<T, MaxAge>>>;
-/**
- * Destroy the session (context + cookie).
- */
-declare function clearJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: Partial<SessionConfigJWS<T, MaxAge>>): Promise<void>;
-
-export { JWEEncryptOptions, JWEHeaderParameters, JWKSet, JWK_Private, JWK_Public, JWK_Symmetric, JWTClaimValidationOptions, JWTClaims, clearJWESession, clearJWSSession, getJWESession, getJWESessionToken, getJWSSession, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
-export type { SessionClaims, SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWEConfig, SessionJWS, SessionJWSConfig, SessionManager, SessionUpdate };
+import { $ as JWK_RSA_ENC, A as JWKPEMAlgorithm, B as JWK_ECDH_ES, C as GenerateJWKOptions, D as GenerateKeyReturn, E as GenerateKeyOptions, F as JWK_AES_GCM_KW, G as JWK_OKP, H as JWK_EC_Private, I as JWK_AES_KW, J as JWK_OKP_SIGN, K as JWK_OKP_Private, L as JWK_Asymmetric, M as JWKSet, N as JWK_AES_CBC_HMAC, O as JWK, P as JWK_AES_GCM, Q as JWK_RSA, R as JWK_Asymmetric_Algorithm, S as DeriveKeyReturn, T as GenerateKeyAlgorithm, U as JWK_EC_Public, V as JWK_ECDSA, W as JWK_HMAC, X as JWK_Private, Y as JWK_PBES2, Z as JWK_Public, a as JWEDecryptOptions, at as JWK_Symmetric_Algorithm, b as ContentEncryptionAlgorithm, c as JWEHeaderParameters, ct as UnwrapKeyOptions, et as JWK_RSA_PSS, f as JWT, h as JoseHeaderParameters, i as importJWKFromPEM, it as JWK_Symmetric, j as JWKParameters, k as JWKAlgorithm, l as JWEKeyLookupFunction, lt as WrapKeyOptions, m as JWTClaims, n as exportJWKToPEM, nt as JWK_RSA_Public, o as JWEDecryptResult, ot as JWK_oct, p as JWTClaimValidationOptions, q as JWK_OKP_Public, r as generateJWK, rt as JWK_RSA_SIGN, s as JWEEncryptOptions, st as KeyManagementAlgorithm, t as deriveJWKFromPassword, tt as JWK_RSA_Private, u as JWEKeyManagementHeaderParameters, ut as WrapKeyResult, w as GenerateJWKReturn, x as DeriveKeyOptions, y as CompositeKey, z as JWK_EC } from "../_chunks/jwk.mjs";
+import { C as SessionData, S as SessionClaims, T as SessionUpdate, _ as getJWESessionToken, a as clearJWSSession, b as updateJWESession, c as updateJWSSession, d as SessionConfigJWE, f as SessionHooksJWE, g as getJWESession, h as clearJWESession, i as SessionJWSConfig, l as useJWSSession, m as SessionJWEConfig, n as SessionHooksJWS, o as getJWSSession, p as SessionJWE, r as SessionJWS, s as signJWSSession, t as SessionConfigJWS, u as verifyJWSSession, v as sealJWESession, w as SessionManager, x as useJWESession, y as unsealJWESession } from "../_chunks/index.mjs";
+export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEHeaderParameters, JWEKeyLookupFunction, JWEKeyManagementHeaderParameters, JWK, JWKAlgorithm, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWT, JWTClaimValidationOptions, JWTClaims, JoseHeaderParameters, KeyManagementAlgorithm, SessionClaims, SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWEConfig, SessionJWS, SessionJWSConfig, SessionManager, SessionUpdate, UnwrapKeyOptions, WrapKeyOptions, WrapKeyResult, clearJWESession, clearJWSSession, deriveJWKFromPassword, exportJWKToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importJWKFromPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };