unjwt 0.5.39 → 0.5.40

package/dist/_chunks/index2.d.mts

@@ -1,4 +1,4 @@
-import { $ as JWK_Public, A as JWK, P as JWKSet, Q as JWK_Private, ct as JWK_oct, l as StrictOmit, t as ExpiresIn, v as JWTClaimValidationOptions, y as JWTClaims } from "./index.mjs";
+import { $ as JWK_Private, A as JWK, P as JWKSet, et as JWK_Public, l as StrictOmit, lt as JWK_oct, t as ExpiresIn, v as JWTClaimValidationOptions, y as JWTClaims } from "./index.mjs";
 
 //#region src/core/utils/jwt.d.ts
 /**

package/dist/_chunks/jwe.d.mts

@@ -1,8 +1,8 @@
-import { $ as JWK_Public, A as JWK, B as JWK_Asymmetric_Algorithm, C as DeriveKeyOptions, D as GenerateKeyAlgorithm, E as GenerateJWKReturn, F as JWK_AES_CBC_HMAC, G as JWK_EC_Public, H as JWK_ECDH_ES, I as JWK_AES_GCM, J as JWK_OKP_Private, K as JWK_HMAC, L as JWK_AES_GCM_KW, M as JWKPEMAlgorithm, N as JWKParameters, O as GenerateKeyOptions, P as JWKSet, Q as JWK_Private, R as JWK_AES_KW, S as ContentEncryptionAlgorithm, T as GenerateJWKOptions, U as JWK_ECDSA, V as JWK_EC, W as JWK_EC_Private, X as JWK_OKP_SIGN, Y as JWK_OKP_Public, Z as JWK_PBES2, _ as JWT, a as JWEEncryptOptions, at as JWK_RSA_SIGN, b as JoseHeaderParameters, c as JWEKeyManagementHeaderParameters, ct as JWK_oct, dt as WrapKeyOptions, et as JWK_RSA, ft as WrapKeyResult, i as JWEDecryptResult, it as JWK_RSA_Public, j as JWKAlgorithm, k as GenerateKeyReturn, lt as KeyManagementAlgorithm, nt as JWK_RSA_PSS, o as JWEHeaderParameters, ot as JWK_Symmetric, q as JWK_OKP, r as JWEDecryptOptions, rt as JWK_RSA_Private, s as JWEKeyLookupFunction, st as JWK_Symmetric_Algorithm, tt as JWK_RSA_ENC, ut as UnwrapKeyOptions, v as JWTClaimValidationOptions, w as DeriveKeyReturn, x as CompositeKey, y as JWTClaims, z as JWK_Asymmetric } from "./index.mjs";
+import { $ as JWK_Private, A as JWK, B as JWK_Asymmetric_Algorithm, C as DeriveKeyOptions, D as GenerateKeyAlgorithm, E as GenerateJWKReturn, F as JWK_AES_CBC_HMAC, G as JWK_EC_Public, H as JWK_ECDH_ES, I as JWK_AES_GCM, J as JWK_OKP_Private, K as JWK_HMAC, L as JWK_AES_GCM_KW, M as JWKPEMAlgorithm, N as JWKParameters, O as GenerateKeyOptions, P as JWKSet, Q as JWK_Pair, R as JWK_AES_KW, S as ContentEncryptionAlgorithm, T as GenerateJWKOptions, U as JWK_ECDSA, V as JWK_EC, W as JWK_EC_Private, X as JWK_OKP_SIGN, Y as JWK_OKP_Public, Z as JWK_PBES2, _ as JWT, a as JWEEncryptOptions, at as JWK_RSA_Public, b as JoseHeaderParameters, c as JWEKeyManagementHeaderParameters, ct as JWK_Symmetric_Algorithm, dt as UnwrapKeyOptions, et as JWK_Public, ft as WrapKeyOptions, i as JWEDecryptResult, it as JWK_RSA_Private, j as JWKAlgorithm, k as GenerateKeyReturn, lt as JWK_oct, nt as JWK_RSA_ENC, o as JWEHeaderParameters, ot as JWK_RSA_SIGN, pt as WrapKeyResult, q as JWK_OKP, r as JWEDecryptOptions, rt as JWK_RSA_PSS, s as JWEKeyLookupFunction, st as JWK_Symmetric, tt as JWK_RSA, ut as KeyManagementAlgorithm, v as JWTClaimValidationOptions, w as DeriveKeyReturn, x as CompositeKey, y as JWTClaims, z as JWK_Asymmetric } from "./index.mjs";
 
 //#region src/core/jwe.d.ts
 declare namespace jwe_d_exports {
-  export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEHeaderParameters, JWEKeyLookupFunction, JWEKeyManagementHeaderParameters, JWK, JWKAlgorithm, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWT, JWTClaimValidationOptions, JWTClaims, JoseHeaderParameters, KeyManagementAlgorithm, UnwrapKeyOptions, WrapKeyOptions, WrapKeyResult, decrypt, encrypt };
+  export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEHeaderParameters, JWEKeyLookupFunction, JWEKeyManagementHeaderParameters, JWK, JWKAlgorithm, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWT, JWTClaimValidationOptions, JWTClaims, JoseHeaderParameters, KeyManagementAlgorithm, UnwrapKeyOptions, WrapKeyOptions, WrapKeyResult, decrypt, encrypt };
 }
 /**
 * Encrypts a payload to produce a JWE Compact Serialization string.

package/dist/_chunks/jwk.d.mts

@@ -221,6 +221,19 @@ type JWK_Private = JWK_RSA_Private | JWK_EC_Private | JWK_OKP_Private;
 */
 type JWK = JWK_oct | JWK_RSA | JWK_EC | JWK_OKP;
 /**
+* A pair of public and private JSON Web Keys.
+*/
+type JWK_Pair = {
+  publicKey: JWK_RSA_Public;
+  privateKey: JWK_RSA_Private;
+} | {
+  publicKey: JWK_EC_Public;
+  privateKey: JWK_EC_Private;
+} | {
+  publicKey: JWK_OKP_Public;
+  privateKey: JWK_OKP_Private;
+};
+/**
 * JSON Web Key Set ({@link https://www.rfc-editor.org/rfc/rfc7517 JWK Set}). "RSA", "EC" and "oct" key types are supported.
 */
 interface JWKSet {
@@ -246,49 +259,6 @@ type JWK_Asymmetric_Algorithm = JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWK_RSA
 type JWKAlgorithm = JWK_Symmetric_Algorithm | JWK_Asymmetric_Algorithm | JWK_AES_CBC_HMAC | JWK_PBES2 | JWK_ECDH_ES | ("none" | "dir");
 type JWKPEMAlgorithm = JWK_RSA_PSS | JWK_RSA_SIGN | JWK_RSA_ENC | JWK_ECDSA | JWK_ECDH_ES | JWK_OKP_SIGN;
 //#endregion
-//#region src/core/types/jws.d.ts
-type JWS_SIGN_EXTRA = "Ed25519" | "EdDSA";
-/** JWS Signing Algorithm Identifier. */
-type JWSAlgorithm = JWK_HMAC | JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWS_SIGN_EXTRA;
-/** Recognized JWS Header Parameters, any other Header Members may also be present. */
-interface JWSHeaderParameters extends JoseHeaderParameters {
-  /** JWS "alg" (Algorithm) Header Parameter */
-  alg?: JWSAlgorithm;
-  /**
-  * This JWS Extension Header Parameter modifies the JWS Payload representation and the JWS Signing
-  * Input computation as per {@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}.
-  * If `false`, the payload is used directly without Base64URL encoding.
-  * Defaults to `true`.
-  */
-  b64?: boolean;
-}
-/** JWS Protected Header */
-interface JWSProtectedHeader extends JWSHeaderParameters {
-  alg: JWSAlgorithm;
-}
-/**
-* JWS (JSON Web Signature) options for signing
-*/
-interface JWSSignOptions {
-  /** The JWS Algorithm to use. Must be provided. */
-  alg?: JWSAlgorithm;
-  /**
-  * Additional protected header parameters. `alg` is automatically included.
-  * `typ` defaults to "JWT" if not provided and payload is an object.
-  */
-  protectedHeader?: JWSHeaderParameters;
-  /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
-  currentDate?: Date;
-  /**
-  * Time at which the JWS should expire, if no `exp` was already provided.
-  */
-  expiresIn?: ExpiresIn;
-}
-//#endregion
-//#region src/core/types/index.d.ts
-type ExpiresIn = number | `${number}` | `${number}${"s" | "second" | "seconds" | "m" | "minute" | "minutes" | "h" | "hour" | "hours" | "D" | "day" | "days" | "W" | "week" | "weeks" | "M" | "month" | "months" | "Y" | "year" | "years"}`;
-type MaxTokenAge = ExpiresIn;
-//#endregion
 //#region src/core/types/jwt.d.ts
 /** Header Parameters common to JWE and JWS */
 interface JoseHeaderParameters {
@@ -364,6 +334,68 @@ interface JWTClaimValidationOptions {
   critical?: string[];
 }
 //#endregion
+//#region src/core/types/jws.d.ts
+type JWS_SIGN_EXTRA = "Ed25519" | "EdDSA";
+/** JWS Signing Algorithm Identifier. */
+type JWSAlgorithm = JWK_HMAC | JWK_RSA_SIGN | JWK_RSA_PSS | JWK_ECDSA | JWS_SIGN_EXTRA;
+/** Recognized JWS Header Parameters, any other Header Members may also be present. */
+interface JWSHeaderParameters extends JoseHeaderParameters {
+  /** JWS "alg" (Algorithm) Header Parameter */
+  alg?: JWSAlgorithm;
+  /**
+  * This JWS Extension Header Parameter modifies the JWS Payload representation and the JWS Signing
+  * Input computation as per {@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}.
+  * If `false`, the payload is used directly without Base64URL encoding.
+  * Defaults to `true`.
+  */
+  b64?: boolean;
+}
+/** JWS Protected Header */
+interface JWSProtectedHeader extends JWSHeaderParameters {
+  alg: JWSAlgorithm;
+}
+/**
+* JWS (JSON Web Signature) options for signing
+*/
+interface JWSSignOptions {
+  /** The JWS Algorithm to use. Must be provided. */
+  alg?: JWSAlgorithm;
+  /**
+  * Additional protected header parameters. `alg` is automatically included.
+  * `typ` defaults to "JWT" if not provided and payload is an object.
+  */
+  protectedHeader?: JWSHeaderParameters;
+  /** Date to use when comparing NumericDate claims, defaults to `new Date()`. */
+  currentDate?: Date;
+  /**
+  * Time at which the JWS should expire, if no `exp` was already provided.
+  */
+  expiresIn?: ExpiresIn;
+}
+/** Result of JWS verification */
+interface JWSVerifyResult<T extends JWTClaims | Uint8Array<ArrayBuffer> | string = JWTClaims | Uint8Array<ArrayBuffer> | string> {
+  /** The decoded and verified payload. */
+  payload: T;
+  /** The JWS Protected Header. */
+  protectedHeader: JWSProtectedHeader;
+}
+/** Options for JWS verification */
+interface JWSVerifyOptions extends JWTClaimValidationOptions {
+  /** List of allowed algorithms. If provided, the JWS `alg` must be in this list. */
+  algorithms?: JWSAlgorithm[];
+  /** If true, forces the payload to be returned as a Uint8Array, otherwise type is inferred. */
+  forceUint8Array?: boolean;
+  /** Unless false, will parse payload as JWT and validate claims if applicable (typ "JWT"). */
+  validateJWT?: boolean;
+}
+/**
+* Key lookup function for JWS verification.
+* @param header The JWS Protected Header.
+* @param token The JWS token.
+* @returns The key material (CryptoKey, JWK, or raw Uint8Array) or a Promise resolving to it.
+*/
+type JWSKeyLookupFunction = (header: JWSProtectedHeader, token: string) => CryptoKey | JWK | JWKSet | Uint8Array<ArrayBuffer> | Promise<CryptoKey | JWK | JWKSet | Uint8Array<ArrayBuffer>>;
+//#endregion
 //#region src/core/utils/types.d.ts
 type StrictOmit<T, K extends keyof T | (string & {}) | (number & {}) | (symbol & {})> = { [P in keyof T as P extends K ? never : P]: T[P] };
 //#endregion
@@ -519,6 +551,10 @@ interface JWEDecryptResult<T extends JWTClaims | Uint8Array<ArrayBuffer> | strin
   aad?: Uint8Array<ArrayBuffer>;
 }
 //#endregion
+//#region src/core/types/index.d.ts
+type ExpiresIn = number | `${number}` | `${number}${"s" | "second" | "seconds" | "m" | "minute" | "minutes" | "h" | "hour" | "hours" | "D" | "day" | "days" | "W" | "week" | "weeks" | "M" | "month" | "months" | "Y" | "year" | "years"}`;
+type MaxTokenAge = ExpiresIn;
+//#endregion
 //#region src/core/jose/asn1.d.ts
 /** Key Import Function options. */
 interface KeyImportOptions {
@@ -572,4 +608,4 @@ declare function importJWKFromPEM<T extends JWK>(pem: string, pemType: "pkcs8" |
 */
 declare function exportJWKToPEM(jwk: JWK, pemFormat: "pkcs8" | "spki", algForCryptoKeyImport?: JWKPEMAlgorithm): Promise<string>;
 //#endregion
-export { JWK_RSA_ENC as $, JWKPEMAlgorithm as A, JWK_ECDH_ES as B, GenerateJWKOptions as C, GenerateKeyReturn as D, GenerateKeyOptions as E, JWK_AES_GCM_KW as F, JWK_OKP as G, JWK_EC_Private as H, JWK_AES_KW as I, JWK_OKP_SIGN as J, JWK_OKP_Private as K, JWK_Asymmetric as L, JWKSet as M, JWK_AES_CBC_HMAC as N, JWK as O, JWK_AES_GCM as P, JWK_RSA as Q, JWK_Asymmetric_Algorithm as R, DeriveKeyReturn as S, GenerateKeyAlgorithm as T, JWK_EC_Public as U, JWK_ECDSA as V, JWK_HMAC as W, JWK_Private as X, JWK_PBES2 as Y, JWK_Public as Z, JWSProtectedHeader as _, JWEDecryptOptions as a, JWK_Symmetric_Algorithm as at, ContentEncryptionAlgorithm as b, JWEHeaderParameters as c, UnwrapKeyOptions as ct, StrictOmit as d, JWK_RSA_PSS as et, JWT as f, ExpiresIn as g, JoseHeaderParameters as h, importJWKFromPEM as i, JWK_Symmetric as it, JWKParameters as j, JWKAlgorithm as k, JWEKeyLookupFunction as l, WrapKeyOptions as lt, JWTClaims as m, exportJWKToPEM as n, JWK_RSA_Public as nt, JWEDecryptResult as o, JWK_oct as ot, JWTClaimValidationOptions as p, JWK_OKP_Public as q, generateJWK as r, JWK_RSA_SIGN as rt, JWEEncryptOptions as s, KeyManagementAlgorithm as st, deriveJWKFromPassword as t, JWK_RSA_Private as tt, JWEKeyManagementHeaderParameters as u, WrapKeyResult as ut, JWSSignOptions as v, GenerateJWKReturn as w, DeriveKeyOptions as x, CompositeKey as y, JWK_EC as z };
+export { JWK_OKP_Public as $, GenerateJWKReturn as A, JWK_AES_GCM as B, JWTClaims as C, DeriveKeyOptions as D, ContentEncryptionAlgorithm as E, JWKAlgorithm as F, JWK_EC as G, JWK_AES_KW as H, JWKPEMAlgorithm as I, JWK_EC_Private as J, JWK_ECDH_ES as K, JWKParameters as L, GenerateKeyOptions as M, GenerateKeyReturn as N, DeriveKeyReturn as O, JWK as P, JWK_OKP_Private as Q, JWKSet as R, JWTClaimValidationOptions as S, CompositeKey as T, JWK_Asymmetric as U, JWK_AES_GCM_KW as V, JWK_Asymmetric_Algorithm as W, JWK_HMAC as X, JWK_EC_Public as Y, JWK_OKP as Z, JWSProtectedHeader as _, WrapKeyResult as _t, ExpiresIn as a, JWK_RSA as at, JWSVerifyResult as b, JWEDecryptResult as c, JWK_RSA_Private as ct, JWEKeyLookupFunction as d, JWK_Symmetric as dt, JWK_OKP_SIGN as et, JWEKeyManagementHeaderParameters as f, JWK_Symmetric_Algorithm as ft, JWSKeyLookupFunction as g, WrapKeyOptions as gt, JWSHeaderParameters as h, UnwrapKeyOptions as ht, importJWKFromPEM as i, JWK_Public as it, GenerateKeyAlgorithm as j, GenerateJWKOptions as k, JWEEncryptOptions as l, JWK_RSA_Public as lt, JWSAlgorithm as m, KeyManagementAlgorithm as mt, exportJWKToPEM as n, JWK_Pair as nt, MaxTokenAge as o, JWK_RSA_ENC as ot, StrictOmit as p, JWK_oct as pt, JWK_ECDSA as q, generateJWK as r, JWK_Private as rt, JWEDecryptOptions as s, JWK_RSA_PSS as st, deriveJWKFromPassword as t, JWK_PBES2 as tt, JWEHeaderParameters as u, JWK_RSA_SIGN as ut, JWSSignOptions as v, JoseHeaderParameters as w, JWT as x, JWSVerifyOptions as y, JWK_AES_CBC_HMAC as z };

package/dist/_chunks/jws.d.mts

@@ -1,46 +1,242 @@
-import { $ as JWK_Public, A as JWK, B as JWK_Asymmetric_Algorithm, C as DeriveKeyOptions, D as GenerateKeyAlgorithm, E as GenerateJWKReturn, F as JWK_AES_CBC_HMAC, G as JWK_EC_Public, H as JWK_ECDH_ES, I as JWK_AES_GCM, J as JWK_OKP_Private, K as JWK_HMAC, L as JWK_AES_GCM_KW, M as JWKPEMAlgorithm, N as JWKParameters, O as GenerateKeyOptions, P as JWKSet, Q as JWK_Private, R as JWK_AES_KW, S as ContentEncryptionAlgorithm, T as GenerateJWKOptions, U as JWK_ECDSA, V as JWK_EC, W as JWK_EC_Private, X as JWK_OKP_SIGN, Y as JWK_OKP_Public, Z as JWK_PBES2, _ as JWT, at as JWK_RSA_SIGN, b as JoseHeaderParameters, ct as JWK_oct, d as JWSHeaderParameters, dt as WrapKeyOptions, et as JWK_RSA, f as JWSKeyLookupFunction, ft as WrapKeyResult, g as JWSVerifyResult, h as JWSVerifyOptions, it as JWK_RSA_Public, j as JWKAlgorithm, k as GenerateKeyReturn, lt as KeyManagementAlgorithm, m as JWSSignOptions, nt as JWK_RSA_PSS, ot as JWK_Symmetric, p as JWSProtectedHeader, q as JWK_OKP, rt as JWK_RSA_Private, st as JWK_Symmetric_Algorithm, tt as JWK_RSA_ENC, u as JWSAlgorithm, ut as UnwrapKeyOptions, v as JWTClaimValidationOptions, w as DeriveKeyReturn, x as CompositeKey, y as JWTClaims, z as JWK_Asymmetric } from "./index.mjs";
+import { C as JWTClaims, R as JWKSet, S as JWTClaimValidationOptions, _ as JWSProtectedHeader, a as ExpiresIn, dt as JWK_Symmetric, it as JWK_Public, l as JWEEncryptOptions, p as StrictOmit, rt as JWK_Private, u as JWEHeaderParameters, v as JWSSignOptions } from "./jwk.mjs";
+import { H3Event } from "h3";
+import { CookieSerializeOptions } from "cookie-es";
 
-//#region src/core/jws.d.ts
-declare namespace jws_d_exports {
-  export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JWK, JWKAlgorithm, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSHeaderParameters, JWSKeyLookupFunction, JWSProtectedHeader, JWSSignOptions, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JoseHeaderParameters, KeyManagementAlgorithm, UnwrapKeyOptions, WrapKeyOptions, WrapKeyResult, sign, verify };
+//#region src/adapters/h3v1/session/types.d.ts
+interface SessionClaims extends Required<Pick<JWTClaims, "jti" | "iat">>, StrictOmit<JWTClaims, "jti" | "iat"> {}
+type SessionData<T extends Record<string, any> = SessionClaims> = StrictOmit<T, "jti" | "iat" | "exp">;
+type SessionUpdate<T extends Record<string, any> = SessionClaims> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
+interface SessionManager<T extends Record<string, any> = SessionClaims, ConfigMaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  readonly id: string | undefined;
+  readonly createdAt: number;
+  readonly expiresAt: ConfigMaxAge extends ExpiresIn ? number : "exp" extends keyof T ? T["exp"] : number | undefined;
+  readonly data: SessionData<T>;
+  readonly token: string | undefined;
+  update: (update?: SessionUpdate<T>) => Promise<SessionManager<T, ConfigMaxAge> & {
+    readonly id: string;
+  }>;
+  clear: () => Promise<SessionManager<T, ConfigMaxAge>>;
 }
+//#endregion
+//#region src/adapters/h3v1/session/jwe.d.ts
+declare const kGetSessionPromise$1: unique symbol;
+interface SessionJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  id: string | undefined;
+  createdAt: number;
+  expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
+  data: SessionData<T>;
+  [kGetSessionPromise$1]?: Promise<SessionJWE<T, MaxAge>>;
+}
+interface SessionHooksJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  onRead?: (args: {
+    session: SessionJWE<T, MaxAge>;
+    event: H3Event;
+    config: SessionConfigJWE<T, MaxAge>;
+  }) => void | Promise<void>;
+  onUpdate?: (args: {
+    session: SessionJWE<T, MaxAge>;
+    oldSession: SessionJWE<T, MaxAge>;
+    event: H3Event;
+    config: SessionConfigJWE<T, MaxAge>;
+  }) => void | Promise<void>;
+  onClear?: (args: {
+    session: SessionJWE<T, MaxAge> | undefined;
+    event: H3Event;
+    config: Partial<SessionConfigJWE<T, MaxAge>>;
+  }) => void | Promise<void>;
+  onExpire?: (args: {
+    event: H3Event;
+    error: Error;
+    config: SessionConfigJWE<T, MaxAge>;
+  }) => void | Promise<void>;
+  onError?: (args: {
+    event: H3Event;
+    error: any;
+    config: SessionConfigJWE<T, MaxAge>;
+  }) => void | Promise<void>;
+  onUnsealKeyLookup?: (args: {
+    header: JWEHeaderParameters;
+    event: H3Event;
+    config: SessionConfigJWE<T, MaxAge>;
+  }) => JWK_Symmetric | JWK_Private | Promise<JWK_Symmetric | JWK_Private>;
+}
+interface SessionConfigJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  /** @deprecated use `key` instead */
+  secret?: string | JWK_Symmetric | {
+    privateKey: JWK_Private | JWK_Symmetric;
+    publicKey?: JWK_Public;
+  };
+  /** Shared key used, string for PBES2 or Json Web Key (JWK) */
+  key: string | JWK_Symmetric | JWK_Private | {
+    privateKey: JWK_Private | JWK_Symmetric;
+    publicKey?: JWK_Public;
+  };
+  /** Session lifetime in seconds (used to derive exp from iat) */
+  maxAge?: MaxAge;
+  /** Default is "h3" */
+  name?: string;
+  /** Default is secure, httpOnly, path="/" */
+  cookie?: false | CookieSerializeOptions;
+  /** Default is x-h3-session / x-{name}-session */
+  sessionHeader?: false | string;
+  /** Default is crypto.randomUUID */
+  generateId?: () => string;
+  /** JWE configuration overrides */
+  jwe?: {
+    encryptOptions?: Omit<JWEEncryptOptions, "expiresIn">;
+    decryptOptions?: JWTClaimValidationOptions;
+  };
+  hooks?: SessionHooksJWE<T, MaxAge>;
+}
+type CompatEvent$1 = {
+  request: {
+    headers: Headers;
+  };
+  context: any;
+} | {
+  headers: Headers;
+  context: any;
+};
+/**
+* Create a session manager for the current request.
+*/
+declare function useJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
+/**
+* Get (and lazily initialize) the session for the current request.
+*/
+declare function getJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<SessionJWE<T, MaxAge>>;
+declare function getJWESessionToken<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): string | undefined;
 /**
-* Creates a JWS (JSON Web Signature) in Compact Serialization format.
-*
-* @param payload The payload to sign. Can be a string, Uint8Array, or an object (which will be JSON stringified).
-* @param key The signing key (CryptoKey, JWK, or raw symmetric key as Uint8Array).
-* @param options Signing options, including the algorithm (`alg`) and protected header parameters.
-* @returns A Promise resolving to the JWS Compact Serialization string.
-*/
-declare function sign(payload: JWTClaims, key: JWK_Symmetric | JWK_Private, options?: JWSSignOptions): Promise<string>;
-declare function sign(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: JWK_Symmetric | JWK_Private, options?: JWSSignOptions): Promise<string>;
-declare function sign(payload: JWTClaims, key: CryptoKey, options: JWSSignOptions & {
-  alg: JWSAlgorithm;
-}): Promise<string>;
-declare function sign(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: CryptoKey, options: JWSSignOptions & {
-  alg: JWSAlgorithm;
-}): Promise<string>;
-declare function sign(payload: JWTClaims, key: Uint8Array<ArrayBuffer>, options: JWSSignOptions & {
-  alg: JWSAlgorithm;
-}): Promise<string>;
-declare function sign(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: Uint8Array<ArrayBuffer>, options: JWSSignOptions & {
-  alg: JWSAlgorithm;
-}): Promise<string>;
-declare function sign(payload: string | Uint8Array<ArrayBuffer> | Record<string, any>, key: CryptoKey | JWK_Symmetric | JWK_Private | Uint8Array<ArrayBuffer>, options: JWSSignOptions & {
-  alg: JWSAlgorithm;
-}): Promise<string>;
-/**
-* Verifies a JWS (JSON Web Signature) in Compact Serialization format.
-*
-* @param jws The JWS Compact Serialization string.
-* @param key The verification key (CryptoKey, JWK, JWKSet, raw symmetric key as Uint8Array, or a function resolving the key or set).
-* @param options Verification options, such as allowed algorithms.
-* @returns A Promise resolving to an object containing the verified payload and protected header.
-* @throws If the JWS is invalid, signature verification fails, or options are not met.
-*/
-declare function verify<T extends JWTClaims | Uint8Array<ArrayBuffer> | string>(jws: string, key: CryptoKey | JWK_Symmetric | JWK_Public | JWKSet | Uint8Array<ArrayBuffer> | JWSKeyLookupFunction, options?: JWSVerifyOptions): Promise<JWSVerifyResult<T>>;
-declare function verify(jws: string, key: CryptoKey | JWK_Symmetric | JWK_Public | JWKSet | Uint8Array<ArrayBuffer> | JWSKeyLookupFunction, options: JWSVerifyOptions & {
-  forceUint8Array: true;
-}): Promise<JWSVerifyResult<Uint8Array<ArrayBuffer>>>;
+* Update the session (optionally mutating the session data) and re-issue the JWE token.
+*/
+declare function updateJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: SessionConfigJWE<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWE<T, MaxAge>>;
+/**
+* Produce a JWE for the current session.
+* Payload structure:
+* {
+*   jti: string;
+*   iat: number; (seconds)
+*   exp?: number; (seconds)
+*   data: Record<string, any>;
+* }
+*/
+declare function sealJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<string>;
+/**
+* Decrypt the JWE and return a Session-compatible object.
+*/
+declare function unsealJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>, sealed: string): Promise<Partial<SessionJWE<T, MaxAge>>>;
+/**
+* Clear the session (delete from context and drop cookie).
+*/
+declare function clearJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: Partial<SessionConfigJWE<T, MaxAge>>): Promise<void>;
+//#endregion
+//#region src/adapters/h3v1/session/jws.d.ts
+declare const kGetSessionPromise: unique symbol;
+interface SessionJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  id: string | undefined;
+  createdAt: number;
+  expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
+  data: SessionData<T>;
+  [kGetSessionPromise]?: Promise<SessionJWS<T, MaxAge>>;
+}
+interface SessionHooksJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  onRead?: (args: {
+    session: SessionJWS<T, MaxAge>;
+    event: H3Event;
+    config: SessionConfigJWS<T, MaxAge>;
+  }) => void | Promise<void>;
+  onUpdate?: (args: {
+    session: SessionJWS<T, MaxAge>;
+    oldSession: SessionJWS<T, MaxAge>;
+    event: H3Event;
+    config: SessionConfigJWS<T, MaxAge>;
+  }) => void | Promise<void>;
+  onClear?: (args: {
+    session: SessionJWS<T, MaxAge> | undefined;
+    event: H3Event;
+    config: Partial<SessionConfigJWS<T, MaxAge>>;
+  }) => void | Promise<void>;
+  onExpire?: (args: {
+    event: H3Event;
+    error: Error;
+    config: SessionConfigJWS<T, MaxAge>;
+  }) => void | Promise<void>;
+  onError?: (args: {
+    event: H3Event;
+    error: any;
+    config: SessionConfigJWS<T, MaxAge>;
+  }) => void | Promise<void>;
+  onVerifyKeyLookup?: (args: {
+    header: JWSProtectedHeader;
+    event: H3Event;
+    config: SessionConfigJWS<T, MaxAge>;
+  }) => JWKSet | JWK_Symmetric | JWK_Public | Promise<JWKSet | JWK_Symmetric | JWK_Public>;
+}
+interface SessionConfigJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  /**
+  * JWK (private for signing with RS/ES/PS, or symmetric oct) used for signing.
+  */
+  key: JWK_Symmetric | {
+    privateKey: JWK_Private;
+    publicKey: JWK_Public | JWK_Public[] | JWKSet;
+  };
+  /** Session lifetime in seconds (sets exp = iat + maxAge) */
+  maxAge?: MaxAge;
+  /** Default cookie / header name base */
+  name?: string;
+  /** Cookie options (false to disable cookies) */
+  cookie?: false | CookieSerializeOptions;
+  /** Custom header (false to disable header lookup) */
+  sessionHeader?: false | string;
+  /** Custom ID generator (defaults to crypto.randomUUID) */
+  generateId?: () => string;
+  /** JWS customization */
+  jws?: {
+    signOptions?: Omit<JWSSignOptions, "expiresIn">;
+    verifyOptions?: JWTClaimValidationOptions;
+  };
+  hooks?: SessionHooksJWS<T, MaxAge>;
+}
+type CompatEvent = {
+  request: {
+    headers: Headers;
+  };
+  context: any;
+} | {
+  headers: Headers;
+  context: any;
+};
+/**
+* Create a session manager for the current request using JWS (signed only, not encrypted).
+* NOTE: Contents are visible to clients (Base64URL-decoded JSON). Do not store secrets in session data.
+*/
+declare function useJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
+/**
+* Retrieve (and lazily initialize) the session.
+*/
+declare function getJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionJWS<T, MaxAge>>;
+/**
+* Update session data (if provided) and reissue JWS.
+*/
+declare function updateJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: SessionConfigJWS<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWS<T, MaxAge>>;
+/**
+* Sign current session as a compact JWS.
+* Payload claims:
+*  jti, iat, exp?, data, plus optional extraClaims (cannot override reserved)
+*/
+declare function signJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<string>;
+/**
+* Verify and parse a compact JWS into a Session structure.
+* Performs:
+*  - cryptographic signature verification
+*  - (optional) standard claim checks if validateJWT true
+*  - ensures jti & iat presence
+*  - enforces maxAge if provided
+*/
+declare function verifyJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>, token: string): Promise<Partial<SessionJWS<T, MaxAge>>>;
+/**
+* Destroy the session (context + cookie).
+*/
+declare function clearJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: Partial<SessionConfigJWS<T, MaxAge>>): Promise<void>;
 //#endregion
-export { sign as n, verify as r, jws_d_exports as t };
+export { SessionUpdate as C, SessionManager as S, unsealJWESession as _, getJWSSession as a, SessionClaims as b, useJWSSession as c, SessionHooksJWE as d, SessionJWE as f, sealJWESession as g, getJWESessionToken as h, clearJWSSession as i, verifyJWSSession as l, getJWESession as m, SessionHooksJWS as n, signJWSSession as o, clearJWESession as p, SessionJWS as r, updateJWSSession as s, SessionConfigJWS as t, SessionConfigJWE as u, updateJWESession as v, SessionData as x, useJWESession as y };

package/dist/_chunks/jws.mjs

@@ -187,7 +187,9 @@ function validateCriticalHeadersJWE(protectedHeader, understoodFromOptions) {
 */
 function sanitizeObject(obj) {
 	if (!obj || typeof obj !== "object") return obj;
-	sanitizeKeys(obj);
+	const seen = /* @__PURE__ */ new WeakSet();
+	seen.add(obj);
+	sanitizeKeys(obj, seen);
 	return obj;
 }
 function sanitizeKeys(current, seen) {
@@ -196,7 +198,6 @@ function sanitizeKeys(current, seen) {
 	if (Object.prototype.hasOwnProperty.call(current, "constructor")) delete current["constructor"];
 	const items = Array.isArray(current) ? current : Object.values(current);
 	for (const v of items) if (v && typeof v === "object") {
-		seen ??= /* @__PURE__ */ new WeakSet();
 		if (!seen.has(v)) {
 			seen.add(v);
 			sanitizeKeys(v, seen);

package/dist/_chunks/{h3v1.mjs → jws2.mjs}

@@ -36,10 +36,10 @@ async function useJWESession(event, config) {
 			await updateJWESession(event, config, update);
 			return sessionManager;
 		},
-		clear: () => {
+		clear: async () => {
 			if (!isEvent(event)) throw new Error("[h3] Cannot clear read-only session.");
-			clearJWESession(event, config);
-			return Promise.resolve(sessionManager);
+			await clearJWESession(event, config);
+			return sessionManager;
 		}
 	};
 	return sessionManager;
@@ -337,10 +337,10 @@ async function useJWSSession(event, config) {
 			await updateJWSSession(event, config, update);
 			return sessionManager;
 		},
-		clear: () => {
+		clear: async () => {
 			if (!isEvent(event)) throw new Error("[h3] Cannot clear read-only session.");
-			clearJWSSession(event, config);
-			return Promise.resolve(sessionManager);
+			await clearJWSSession(event, config);
+			return sessionManager;
 		}
 	};
 	return sessionManager;

package/dist/_chunks/utils.mjs

@@ -188,7 +188,9 @@ function validateCriticalHeadersJWE(protectedHeader, understoodFromOptions) {
 */
 function sanitizeObject(obj) {
 	if (!obj || typeof obj !== "object") return obj;
-	sanitizeKeys(obj);
+	const seen = /* @__PURE__ */ new WeakSet();
+	seen.add(obj);
+	sanitizeKeys(obj, seen);
 	return obj;
 }
 function sanitizeKeys(current, seen) {
@@ -197,7 +199,6 @@ function sanitizeKeys(current, seen) {
 	if (Object.prototype.hasOwnProperty.call(current, "constructor")) delete current["constructor"];
 	const items = Array.isArray(current) ? current : Object.values(current);
 	for (const v of items) if (v && typeof v === "object") {
-		seen ??= /* @__PURE__ */ new WeakSet();
 		if (!seen.has(v)) {
 			seen.add(v);
 			sanitizeKeys(v, seen);

package/dist/adapters/h3.d.mts

@@ -1,3 +1,3 @@
-import { $ as JWK_RSA_ENC, A as JWKPEMAlgorithm, B as JWK_ECDH_ES, C as GenerateJWKOptions, D as GenerateKeyReturn, E as GenerateKeyOptions, F as JWK_AES_GCM_KW, G as JWK_OKP, H as JWK_EC_Private, I as JWK_AES_KW, J as JWK_OKP_SIGN, K as JWK_OKP_Private, L as JWK_Asymmetric, M as JWKSet, N as JWK_AES_CBC_HMAC, O as JWK, P as JWK_AES_GCM, Q as JWK_RSA, R as JWK_Asymmetric_Algorithm, S as DeriveKeyReturn, T as GenerateKeyAlgorithm, U as JWK_EC_Public, V as JWK_ECDSA, W as JWK_HMAC, X as JWK_Private, Y as JWK_PBES2, Z as JWK_Public, a as JWEDecryptOptions, at as JWK_Symmetric_Algorithm, b as ContentEncryptionAlgorithm, c as JWEHeaderParameters, ct as UnwrapKeyOptions, et as JWK_RSA_PSS, f as JWT, h as JoseHeaderParameters, i as importJWKFromPEM, it as JWK_Symmetric, j as JWKParameters, k as JWKAlgorithm, l as JWEKeyLookupFunction, lt as WrapKeyOptions, m as JWTClaims, n as exportJWKToPEM, nt as JWK_RSA_Public, o as JWEDecryptResult, ot as JWK_oct, p as JWTClaimValidationOptions, q as JWK_OKP_Public, r as generateJWK, rt as JWK_RSA_SIGN, s as JWEEncryptOptions, st as KeyManagementAlgorithm, t as deriveJWKFromPassword, tt as JWK_RSA_Private, u as JWEKeyManagementHeaderParameters, ut as WrapKeyResult, w as GenerateJWKReturn, x as DeriveKeyOptions, y as CompositeKey, z as JWK_EC } from "../_chunks/jwk.mjs";
-import { C as SessionData, S as SessionClaims, T as SessionUpdate, _ as getJWESessionToken, a as clearJWSSession, b as updateJWESession, c as updateJWSSession, d as SessionConfigJWE, f as SessionHooksJWE, g as getJWESession, h as clearJWESession, i as SessionJWSConfig, l as useJWSSession, m as SessionJWEConfig, n as SessionHooksJWS, o as getJWSSession, p as SessionJWE, r as SessionJWS, s as signJWSSession, t as SessionConfigJWS, u as verifyJWSSession, v as sealJWESession, w as SessionManager, x as useJWESession, y as unsealJWESession } from "../_chunks/index.mjs";
-export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEHeaderParameters, JWEKeyLookupFunction, JWEKeyManagementHeaderParameters, JWK, JWKAlgorithm, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWT, JWTClaimValidationOptions, JWTClaims, JoseHeaderParameters, KeyManagementAlgorithm, SessionClaims, SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWEConfig, SessionJWS, SessionJWSConfig, SessionManager, SessionUpdate, UnwrapKeyOptions, WrapKeyOptions, WrapKeyResult, clearJWESession, clearJWSSession, deriveJWKFromPassword, exportJWKToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importJWKFromPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+import { $ as JWK_OKP_Public, A as GenerateJWKReturn, B as JWK_AES_GCM, C as JWTClaims, D as DeriveKeyOptions, E as ContentEncryptionAlgorithm, F as JWKAlgorithm, G as JWK_EC, H as JWK_AES_KW, I as JWKPEMAlgorithm, J as JWK_EC_Private, K as JWK_ECDH_ES, L as JWKParameters, M as GenerateKeyOptions, N as GenerateKeyReturn, O as DeriveKeyReturn, P as JWK, Q as JWK_OKP_Private, R as JWKSet, S as JWTClaimValidationOptions, T as CompositeKey, U as JWK_Asymmetric, V as JWK_AES_GCM_KW, W as JWK_Asymmetric_Algorithm, X as JWK_HMAC, Y as JWK_EC_Public, Z as JWK_OKP, _ as JWSProtectedHeader, _t as WrapKeyResult, a as ExpiresIn, at as JWK_RSA, b as JWSVerifyResult, c as JWEDecryptResult, ct as JWK_RSA_Private, d as JWEKeyLookupFunction, dt as JWK_Symmetric, et as JWK_OKP_SIGN, f as JWEKeyManagementHeaderParameters, ft as JWK_Symmetric_Algorithm, g as JWSKeyLookupFunction, gt as WrapKeyOptions, h as JWSHeaderParameters, ht as UnwrapKeyOptions, i as importJWKFromPEM, it as JWK_Public, j as GenerateKeyAlgorithm, k as GenerateJWKOptions, l as JWEEncryptOptions, lt as JWK_RSA_Public, m as JWSAlgorithm, mt as KeyManagementAlgorithm, n as exportJWKToPEM, nt as JWK_Pair, o as MaxTokenAge, ot as JWK_RSA_ENC, pt as JWK_oct, q as JWK_ECDSA, r as generateJWK, rt as JWK_Private, s as JWEDecryptOptions, st as JWK_RSA_PSS, t as deriveJWKFromPassword, tt as JWK_PBES2, u as JWEHeaderParameters, ut as JWK_RSA_SIGN, v as JWSSignOptions, w as JoseHeaderParameters, x as JWT, y as JWSVerifyOptions, z as JWK_AES_CBC_HMAC } from "../_chunks/jwk.mjs";
+import { C as SessionUpdate, S as SessionManager, _ as unsealJWESession, a as getJWSSession, b as SessionClaims, c as useJWSSession, d as SessionHooksJWE, f as SessionJWE, g as sealJWESession, h as getJWESessionToken, i as clearJWSSession, l as verifyJWSSession, m as getJWESession, n as SessionHooksJWS, o as signJWSSession, p as clearJWESession, r as SessionJWS, s as updateJWSSession, t as SessionConfigJWS, u as SessionConfigJWE, v as updateJWESession, x as SessionData, y as useJWESession } from "../_chunks/jws.mjs";
+export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEHeaderParameters, JWEKeyLookupFunction, JWEKeyManagementHeaderParameters, JWK, JWKAlgorithm, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSHeaderParameters, JWSKeyLookupFunction, JWSProtectedHeader, JWSSignOptions, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JoseHeaderParameters, KeyManagementAlgorithm, MaxTokenAge, type SessionClaims, type SessionConfigJWE, type SessionConfigJWS, type SessionData, type SessionHooksJWE, type SessionHooksJWS, type SessionJWE, type SessionJWS, type SessionManager, type SessionUpdate, UnwrapKeyOptions, WrapKeyOptions, WrapKeyResult, clearJWESession, clearJWSSession, deriveJWKFromPassword, exportJWKToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importJWKFromPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };

package/dist/adapters/h3.mjs

@@ -1,3 +1,3 @@
 import { a as deriveJWKFromPassword, c as importJWKFromPEM, o as exportJWKToPEM, s as generateJWK } from "../_chunks/jws.mjs";
-import { a as useJWSSession, c as getJWESession, d as unsealJWESession, f as updateJWESession, i as updateJWSSession, l as getJWESessionToken, n as getJWSSession, o as verifyJWSSession, p as useJWESession, r as signJWSSession, s as clearJWESession, t as clearJWSSession, u as sealJWESession } from "../_chunks/h3v1.mjs";
+import { a as useJWSSession, c as getJWESession, d as unsealJWESession, f as updateJWESession, i as updateJWSSession, l as getJWESessionToken, n as getJWSSession, o as verifyJWSSession, p as useJWESession, r as signJWSSession, s as clearJWESession, t as clearJWSSession, u as sealJWESession } from "../_chunks/jws2.mjs";
 export { clearJWESession, clearJWSSession, deriveJWKFromPassword, exportJWKToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importJWKFromPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };

package/dist/adapters/h3v1.d.mts

@@ -1,3 +1,3 @@
-import { $ as JWK_RSA_ENC, A as JWKPEMAlgorithm, B as JWK_ECDH_ES, C as GenerateJWKOptions, D as GenerateKeyReturn, E as GenerateKeyOptions, F as JWK_AES_GCM_KW, G as JWK_OKP, H as JWK_EC_Private, I as JWK_AES_KW, J as JWK_OKP_SIGN, K as JWK_OKP_Private, L as JWK_Asymmetric, M as JWKSet, N as JWK_AES_CBC_HMAC, O as JWK, P as JWK_AES_GCM, Q as JWK_RSA, R as JWK_Asymmetric_Algorithm, S as DeriveKeyReturn, T as GenerateKeyAlgorithm, U as JWK_EC_Public, V as JWK_ECDSA, W as JWK_HMAC, X as JWK_Private, Y as JWK_PBES2, Z as JWK_Public, a as JWEDecryptOptions, at as JWK_Symmetric_Algorithm, b as ContentEncryptionAlgorithm, c as JWEHeaderParameters, ct as UnwrapKeyOptions, et as JWK_RSA_PSS, f as JWT, h as JoseHeaderParameters, i as importJWKFromPEM, it as JWK_Symmetric, j as JWKParameters, k as JWKAlgorithm, l as JWEKeyLookupFunction, lt as WrapKeyOptions, m as JWTClaims, n as exportJWKToPEM, nt as JWK_RSA_Public, o as JWEDecryptResult, ot as JWK_oct, p as JWTClaimValidationOptions, q as JWK_OKP_Public, r as generateJWK, rt as JWK_RSA_SIGN, s as JWEEncryptOptions, st as KeyManagementAlgorithm, t as deriveJWKFromPassword, tt as JWK_RSA_Private, u as JWEKeyManagementHeaderParameters, ut as WrapKeyResult, w as GenerateJWKReturn, x as DeriveKeyOptions, y as CompositeKey, z as JWK_EC } from "../_chunks/jwk.mjs";
-import { C as SessionData, S as SessionClaims, T as SessionUpdate, _ as getJWESessionToken, a as clearJWSSession, b as updateJWESession, c as updateJWSSession, d as SessionConfigJWE, f as SessionHooksJWE, g as getJWESession, h as clearJWESession, i as SessionJWSConfig, l as useJWSSession, m as SessionJWEConfig, n as SessionHooksJWS, o as getJWSSession, p as SessionJWE, r as SessionJWS, s as signJWSSession, t as SessionConfigJWS, u as verifyJWSSession, v as sealJWESession, w as SessionManager, x as useJWESession, y as unsealJWESession } from "../_chunks/index.mjs";
-export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEHeaderParameters, JWEKeyLookupFunction, JWEKeyManagementHeaderParameters, JWK, JWKAlgorithm, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWT, JWTClaimValidationOptions, JWTClaims, JoseHeaderParameters, KeyManagementAlgorithm, SessionClaims, SessionConfigJWE, SessionConfigJWS, SessionData, SessionHooksJWE, SessionHooksJWS, SessionJWE, SessionJWEConfig, SessionJWS, SessionJWSConfig, SessionManager, SessionUpdate, UnwrapKeyOptions, WrapKeyOptions, WrapKeyResult, clearJWESession, clearJWSSession, deriveJWKFromPassword, exportJWKToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importJWKFromPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+import { $ as JWK_OKP_Public, A as GenerateJWKReturn, B as JWK_AES_GCM, C as JWTClaims, D as DeriveKeyOptions, E as ContentEncryptionAlgorithm, F as JWKAlgorithm, G as JWK_EC, H as JWK_AES_KW, I as JWKPEMAlgorithm, J as JWK_EC_Private, K as JWK_ECDH_ES, L as JWKParameters, M as GenerateKeyOptions, N as GenerateKeyReturn, O as DeriveKeyReturn, P as JWK, Q as JWK_OKP_Private, R as JWKSet, S as JWTClaimValidationOptions, T as CompositeKey, U as JWK_Asymmetric, V as JWK_AES_GCM_KW, W as JWK_Asymmetric_Algorithm, X as JWK_HMAC, Y as JWK_EC_Public, Z as JWK_OKP, _ as JWSProtectedHeader, _t as WrapKeyResult, a as ExpiresIn, at as JWK_RSA, b as JWSVerifyResult, c as JWEDecryptResult, ct as JWK_RSA_Private, d as JWEKeyLookupFunction, dt as JWK_Symmetric, et as JWK_OKP_SIGN, f as JWEKeyManagementHeaderParameters, ft as JWK_Symmetric_Algorithm, g as JWSKeyLookupFunction, gt as WrapKeyOptions, h as JWSHeaderParameters, ht as UnwrapKeyOptions, i as importJWKFromPEM, it as JWK_Public, j as GenerateKeyAlgorithm, k as GenerateJWKOptions, l as JWEEncryptOptions, lt as JWK_RSA_Public, m as JWSAlgorithm, mt as KeyManagementAlgorithm, n as exportJWKToPEM, nt as JWK_Pair, o as MaxTokenAge, ot as JWK_RSA_ENC, pt as JWK_oct, q as JWK_ECDSA, r as generateJWK, rt as JWK_Private, s as JWEDecryptOptions, st as JWK_RSA_PSS, t as deriveJWKFromPassword, tt as JWK_PBES2, u as JWEHeaderParameters, ut as JWK_RSA_SIGN, v as JWSSignOptions, w as JoseHeaderParameters, x as JWT, y as JWSVerifyOptions, z as JWK_AES_CBC_HMAC } from "../_chunks/jwk.mjs";
+import { C as SessionUpdate, S as SessionManager, _ as unsealJWESession, a as getJWSSession, b as SessionClaims, c as useJWSSession, d as SessionHooksJWE, f as SessionJWE, g as sealJWESession, h as getJWESessionToken, i as clearJWSSession, l as verifyJWSSession, m as getJWESession, n as SessionHooksJWS, o as signJWSSession, p as clearJWESession, r as SessionJWS, s as updateJWSSession, t as SessionConfigJWS, u as SessionConfigJWE, v as updateJWESession, x as SessionData, y as useJWESession } from "../_chunks/jws.mjs";
+export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEHeaderParameters, JWEKeyLookupFunction, JWEKeyManagementHeaderParameters, JWK, JWKAlgorithm, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSHeaderParameters, JWSKeyLookupFunction, JWSProtectedHeader, JWSSignOptions, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JoseHeaderParameters, KeyManagementAlgorithm, MaxTokenAge, type SessionClaims, type SessionConfigJWE, type SessionConfigJWS, type SessionData, type SessionHooksJWE, type SessionHooksJWS, type SessionJWE, type SessionJWS, type SessionManager, type SessionUpdate, UnwrapKeyOptions, WrapKeyOptions, WrapKeyResult, clearJWESession, clearJWSSession, deriveJWKFromPassword, exportJWKToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importJWKFromPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };

package/dist/adapters/h3v1.mjs

@@ -1,3 +1,3 @@
 import { a as deriveJWKFromPassword, c as importJWKFromPEM, o as exportJWKToPEM, s as generateJWK } from "../_chunks/jws.mjs";
-import { a as useJWSSession, c as getJWESession, d as unsealJWESession, f as updateJWESession, i as updateJWSSession, l as getJWESessionToken, n as getJWSSession, o as verifyJWSSession, p as useJWESession, r as signJWSSession, s as clearJWESession, t as clearJWSSession, u as sealJWESession } from "../_chunks/h3v1.mjs";
+import { a as useJWSSession, c as getJWESession, d as unsealJWESession, f as updateJWESession, i as updateJWSSession, l as getJWESessionToken, n as getJWSSession, o as verifyJWSSession, p as useJWESession, r as signJWSSession, s as clearJWESession, t as clearJWSSession, u as sealJWESession } from "../_chunks/jws2.mjs";
 export { clearJWESession, clearJWSSession, deriveJWKFromPassword, exportJWKToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importJWKFromPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };