unjwt 0.5.39 → 0.6.0

package/dist/_chunks/utils.mjs

@@ -1,4 +1,36 @@
-import { t as __exportAll } from "./chunk.mjs";
+//#region src/core/error.ts
+/**
+* Base error class for all unjwt errors. Every error thrown by the library is
+* an instance of `JWTError`, so a single `instanceof` check is sufficient to
+* distinguish library errors from other thrown values. Use the `code` property
+* (or the `isJWTError` type guard) to narrow to a specific error condition.
+*
+* @example
+* import { JWTError, isJWTError } from "unjwt/jws";
+*
+* try {
+*   await verify(token, key);
+* } catch (err) {
+*   if (isJWTError(err, "ERR_JWT_EXPIRED")) {
+*     console.log(err.cause.jti); // string | undefined
+*   }
+* }
+*/
+var JWTError = class extends Error {
+	code;
+	cause;
+	constructor(message, code, cause) {
+		super(message);
+		this.name = "JWTError";
+		this.code = code;
+		this.cause = cause;
+	}
+};
+function isJWTError(error, code) {
+	if (!(error instanceof JWTError)) return false;
+	return code === void 0 || error.code === code;
+}
+//#endregion
 //#region src/core/utils/jwt.ts
 /**
 * Apply default typ/cty semantics shared by JWS & JWE.
@@ -107,23 +139,31 @@ function validateJwtClaims(jwtClaims, options = {}) {
 	if (options.subject) allRequiredClaims.add("sub");
 	if (options.maxTokenAge) allRequiredClaims.add("iat");
 	for (const claimName of allRequiredClaims) if (!(claimName in jwtClaims)) missingClaims.add(claimName);
-	if (missingClaims.size > 0) throw new Error(`Missing required JWT Claims: ${[...missingClaims].join(", ")}`);
+	if (missingClaims.size > 0) throw new JWTError(`Missing required JWT Claims: ${[...missingClaims].join(", ")}`, "ERR_JWT_CLAIM_MISSING");
 	if (options.issuer) {
 		const expectedIssuers = maybeArray(options.issuer);
-		if (!jwtClaims.iss || !expectedIssuers.includes(jwtClaims.iss)) throw new Error(`Invalid JWT "iss" (Issuer) Claim: Expected ${expectedIssuers.join(" or ")}, got ${jwtClaims.iss}`);
+		if (!jwtClaims.iss || !expectedIssuers.includes(jwtClaims.iss)) throw new JWTError(`Invalid JWT "iss" (Issuer) Claim: Expected ${expectedIssuers.join(" or ")}, got ${jwtClaims.iss}`, "ERR_JWT_CLAIM_INVALID");
 	}
-	if (options.subject && jwtClaims.sub !== options.subject) throw new Error(`Invalid JWT "sub" (Subject) Claim: Expected ${options.subject}, got ${jwtClaims.sub}`);
+	if (options.subject && jwtClaims.sub !== options.subject) throw new JWTError(`Invalid JWT "sub" (Subject) Claim: Expected ${options.subject}, got ${jwtClaims.sub}`, "ERR_JWT_CLAIM_INVALID");
 	if (options.audience) {
 		const expectedAudiences = maybeArray(options.audience);
 		const claimAudience = maybeArray(jwtClaims.aud || []);
-		if (!claimAudience.some((aud) => expectedAudiences.includes(aud))) throw new Error(`Invalid JWT "aud" (Audience) Claim: Expected ${expectedAudiences.join(" or ")}, got ${claimAudience.join(", ")}`);
+		if (!claimAudience.some((aud) => expectedAudiences.includes(aud))) throw new JWTError(`Invalid JWT "aud" (Audience) Claim: Expected ${expectedAudiences.join(" or ")}, got ${claimAudience.join(", ")}`, "ERR_JWT_CLAIM_INVALID");
 	}
-	if (typeof jwtClaims.nbf === "number" && jwtClaims.nbf > currentTime + clockTolerance) throw new Error(`JWT "nbf" (Not Before) Claim validation failed: Token is not yet valid (nbf: ${(/* @__PURE__ */ new Date(jwtClaims.nbf * 1e3)).toISOString()})`);
-	if (typeof jwtClaims.exp === "number" && jwtClaims.exp <= currentTime - clockTolerance) throw new Error(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(jwtClaims.exp * 1e3)).toISOString()})`);
+	if (typeof jwtClaims.nbf === "number" && jwtClaims.nbf > currentTime + clockTolerance) throw new JWTError(`JWT "nbf" (Not Before) Claim validation failed: Token is not yet valid (nbf: ${(/* @__PURE__ */ new Date(jwtClaims.nbf * 1e3)).toISOString()})`, "ERR_JWT_NBF");
+	if (typeof jwtClaims.exp === "number" && jwtClaims.exp <= currentTime - clockTolerance) throw new JWTError(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(jwtClaims.exp * 1e3)).toISOString()})`, "ERR_JWT_EXPIRED", {
+		jti: jwtClaims.jti,
+		iat: jwtClaims.iat,
+		exp: jwtClaims.exp
+	});
 	if (options.maxTokenAge) {
-		if (typeof jwtClaims.iat !== "number") throw new TypeError("JWT \"iat\" (Issued At) Claim must be a number when maxTokenAge is set.");
-		if (jwtClaims.iat > currentTime + clockTolerance) throw new Error(`JWT "iat" (Issued At) Claim validation failed: Token was issued in the future (iat: ${(/* @__PURE__ */ new Date(jwtClaims.iat * 1e3)).toISOString()})`);
-		if (jwtClaims.iat < currentTime - computeMaxTokenAgeSeconds(options.maxTokenAge) - clockTolerance) throw new Error(`JWT "iat" (Issued At) Claim validation failed: Token is too old (maxTokenAge: ${options.maxTokenAge}s, iat: ${(/* @__PURE__ */ new Date(jwtClaims.iat * 1e3)).toISOString()})`);
+		if (typeof jwtClaims.iat !== "number") throw new JWTError("JWT \"iat\" (Issued At) Claim must be a number when maxTokenAge is set.", "ERR_JWT_CLAIM_INVALID");
+		if (jwtClaims.iat > currentTime + clockTolerance) throw new JWTError(`JWT "iat" (Issued At) Claim validation failed: Token was issued in the future (iat: ${(/* @__PURE__ */ new Date(jwtClaims.iat * 1e3)).toISOString()})`, "ERR_JWT_CLAIM_INVALID");
+		if (jwtClaims.iat < currentTime - computeMaxTokenAgeSeconds(options.maxTokenAge) - clockTolerance) throw new JWTError(`JWT "iat" (Issued At) Claim validation failed: Token is too old (maxTokenAge: ${options.maxTokenAge}s, iat: ${(/* @__PURE__ */ new Date(jwtClaims.iat * 1e3)).toISOString()})`, "ERR_JWT_EXPIRED", {
+			jti: jwtClaims.jti,
+			iat: jwtClaims.iat,
+			exp: jwtClaims.exp
+		});
 	}
 }
 const BASE_HEADER_PARAMS = [
@@ -138,11 +178,11 @@ const BASE_HEADER_PARAMS = [
 	"x5u"
 ];
 /** Validate critical headers in JWS semantics. */
-function validateCriticalHeadersJWS(protectedHeader, requiredHeaders = []) {
+function validateCriticalHeadersJWS(protectedHeader, recognizedHeaders = []) {
 	if (!protectedHeader.crit) return;
 	const missingHeaderParams = /* @__PURE__ */ new Set();
 	const recognizedParams = new Set([
-		...requiredHeaders,
+		...recognizedHeaders,
 		...BASE_HEADER_PARAMS,
 		"b64"
 	]);
@@ -150,14 +190,14 @@ function validateCriticalHeadersJWS(protectedHeader, requiredHeaders = []) {
 		if (recognizedParams.has(param) && (param in protectedHeader || param === "b64")) continue;
 		missingHeaderParams.add(param);
 	}
-	if (missingHeaderParams.size > 0) throw new Error(`Missing critical header parameters: ${[...missingHeaderParams].join(", ")}`);
+	if (missingHeaderParams.size > 0) throw new JWTError(`Missing critical header parameters: ${[...missingHeaderParams].join(", ")}`, "ERR_JWS_INVALID");
 }
 /** Validate critical headers in JWE semantics. */
-function validateCriticalHeadersJWE(protectedHeader, understoodFromOptions) {
-	if (protectedHeader.crit && !understoodFromOptions) throw new Error(`Unprocessed critical header parameters: ${protectedHeader.crit.join(", ")}`);
+function validateCriticalHeadersJWE(protectedHeader, recognizedHeaders) {
+	if (protectedHeader.crit && !recognizedHeaders) throw new JWTError(`Unprocessed critical header parameters: ${protectedHeader.crit.join(", ")}`, "ERR_JWE_INVALID");
 	if (!protectedHeader.crit) return;
 	const understoodParams = new Set([
-		...understoodFromOptions || [],
+		...recognizedHeaders || [],
 		...BASE_HEADER_PARAMS,
 		"enc",
 		"iv",
@@ -169,76 +209,41 @@ function validateCriticalHeadersJWE(protectedHeader, understoodFromOptions) {
 		"apv"
 	]);
 	for (const critParam of protectedHeader.crit) {
-		if (!Object.prototype.hasOwnProperty.call(protectedHeader, critParam)) throw new Error(`Critical header parameter "${critParam}" listed in "crit" but not present in the protected header.`);
-		if (!understoodParams.has(critParam)) throw new Error(`Unprocessed critical header parameters: ${critParam}`);
+		if (!Object.prototype.hasOwnProperty.call(protectedHeader, critParam)) throw new JWTError(`Critical header parameter "${critParam}" listed in "crit" but not present in the protected header.`, "ERR_JWE_INVALID");
+		if (!understoodParams.has(critParam)) throw new JWTError(`Unprocessed critical header parameters: ${critParam}`, "ERR_JWE_INVALID");
 	}
 }
 //#endregion
 //#region src/core/utils/sanitize.ts
 /**
-* Forked from unsecure@0.0.4
+* Originally derived from unsecure@0.0.4
 * Licensed under the MIT License.
 *
 * Source: https://github.com/sandros94/unsecure/blob/913ed5580c551153a19154b4916c67a8efb2be85/src/sanitize.ts
 */
 /**
-* Remove prototype-pollution vectors from a plain record in-place.
-* This strips __proto__, prototype, and constructor own properties.
-* Returns the same reference for convenience.
+* Returns a deep structural copy of `obj` with prototype-pollution vectors
+* stripped at every level (`__proto__`, `prototype`, `constructor`).
+*
+* The input is never modified. Arrays are copied element-by-element;
+* nested objects are recursed with a WeakSet cycle guard.
 */
 function sanitizeObject(obj) {
 	if (!obj || typeof obj !== "object") return obj;
-	sanitizeKeys(obj);
-	return obj;
+	return _sanitizeCopy(obj, /* @__PURE__ */ new WeakSet());
 }
-function sanitizeKeys(current, seen) {
-	if (Object.prototype.hasOwnProperty.call(current, "__proto__")) delete current["__proto__"];
-	if (Object.prototype.hasOwnProperty.call(current, "prototype")) delete current["prototype"];
-	if (Object.prototype.hasOwnProperty.call(current, "constructor")) delete current["constructor"];
-	const items = Array.isArray(current) ? current : Object.values(current);
-	for (const v of items) if (v && typeof v === "object") {
-		seen ??= /* @__PURE__ */ new WeakSet();
-		if (!seen.has(v)) {
-			seen.add(v);
-			sanitizeKeys(v, seen);
-		}
+function _sanitizeCopy(current, seen) {
+	seen.add(current);
+	if (Array.isArray(current)) return current.map((item) => item && typeof item === "object" && !seen.has(item) ? _sanitizeCopy(item, seen) : item);
+	const result = {};
+	for (const [key, value] of Object.entries(current)) {
+		if (key === "__proto__" || key === "prototype" || key === "constructor") continue;
+		result[key] = value && typeof value === "object" && !seen.has(value) ? _sanitizeCopy(value, seen) : value;
 	}
+	return result;
 }
 //#endregion
 //#region src/core/utils/index.ts
-var utils_exports = /* @__PURE__ */ __exportAll({
-	applyTypCtyDefaults: () => applyTypCtyDefaults,
-	assertCryptoKey: () => assertCryptoKey,
-	base64Decode: () => base64Decode,
-	base64Encode: () => base64Encode,
-	base64UrlDecode: () => base64UrlDecode,
-	base64UrlEncode: () => base64UrlEncode,
-	computeExpiresInSeconds: () => computeExpiresInSeconds,
-	computeJwtTimeClaims: () => computeJwtTimeClaims,
-	computeMaxTokenAgeSeconds: () => computeMaxTokenAgeSeconds,
-	concatUint8Arrays: () => concatUint8Arrays,
-	decodeMaybeJWTString: () => decodeMaybeJWTString,
-	decodePayloadFromB64UrlSegment: () => decodePayloadFromB64UrlSegment,
-	decodePayloadFromBytes: () => decodePayloadFromBytes,
-	getPlaintextBytes: () => getPlaintextBytes,
-	isAsymmetricJWK: () => isAsymmetricJWK,
-	isCryptoKey: () => isCryptoKey,
-	isCryptoKeyPair: () => isCryptoKeyPair,
-	isJWK: () => isJWK,
-	isJWKSet: () => isJWKSet,
-	isJWTContent: () => isJWTContent,
-	isPrivateJWK: () => isPrivateJWK,
-	isPublicJWK: () => isPublicJWK,
-	isSymmetricJWK: () => isSymmetricJWK,
-	maybeArray: () => maybeArray,
-	randomBytes: () => randomBytes,
-	sanitizeObject: () => sanitizeObject,
-	textDecoder: () => textDecoder,
-	textEncoder: () => textEncoder,
-	validateCriticalHeadersJWE: () => validateCriticalHeadersJWE,
-	validateCriticalHeadersJWS: () => validateCriticalHeadersJWS,
-	validateJwtClaims: () => validateJwtClaims
-});
 const textEncoder = /* @__PURE__ */ new TextEncoder();
 const textDecoder = /* @__PURE__ */ new TextDecoder();
 const _Buffer = /* @__PURE__ */ (() => {
@@ -371,4 +376,4 @@ function isPublicJWK(key) {
 	return false;
 }
 //#endregion
-export { validateCriticalHeadersJWE as A, computeJwtTimeClaims as C, decodePayloadFromBytes as D, decodePayloadFromB64UrlSegment as E, validateJwtClaims as M, getPlaintextBytes as O, computeExpiresInSeconds as S, decodeMaybeJWTString as T, textDecoder as _, base64UrlEncode as a, sanitizeObject as b, isCryptoKey as c, isJWKSet as d, isPrivateJWK as f, randomBytes as g, maybeArray as h, base64UrlDecode as i, validateCriticalHeadersJWS as j, isJWTContent as k, isCryptoKeyPair as l, isSymmetricJWK as m, base64Decode as n, concatUint8Arrays as o, isPublicJWK as p, base64Encode as r, isAsymmetricJWK as s, assertCryptoKey as t, isJWK as u, textEncoder as v, computeMaxTokenAgeSeconds as w, applyTypCtyDefaults as x, utils_exports as y };
+export { validateCriticalHeadersJWS as A, computeMaxTokenAgeSeconds as C, getPlaintextBytes as D, decodePayloadFromBytes as E, JWTError as M, isJWTError as N, isJWTContent as O, computeJwtTimeClaims as S, decodePayloadFromB64UrlSegment as T, textDecoder as _, base64UrlEncode as a, applyTypCtyDefaults as b, isCryptoKey as c, isJWKSet as d, isPrivateJWK as f, randomBytes as g, maybeArray as h, base64UrlDecode as i, validateJwtClaims as j, validateCriticalHeadersJWE as k, isCryptoKeyPair as l, isSymmetricJWK as m, base64Decode as n, concatUint8Arrays as o, isPublicJWK as p, base64Encode as r, isAsymmetricJWK as s, assertCryptoKey as t, isJWK as u, textEncoder as v, decodeMaybeJWTString as w, computeExpiresInSeconds as x, sanitizeObject as y };

package/dist/adapters/h3v1/index.d.mts

@@ -0,0 +1,282 @@
+import { $ as JWK_HMAC, A as GenerateJWKReturn, B as JWKParameters, C as JWTClaims, D as DeriveKeyOptions, E as ContentEncryptionAlgorithm, F as JWKAlgorithm, G as JWK_AES_KW, H as JWK_AES_CBC_HMAC, I as JWKCacheAdapter, J as JWK_EC, K as JWK_Asymmetric, L as JWKLookupFunction, M as GenerateKeyOptions, N as GenerateKeyReturn, O as DeriveKeyReturn, P as JWK, Q as JWK_EC_Public, R as JWKLookupFunctionHeader, S as JWTClaimValidationOptions, T as CompositeKey, U as JWK_AES_GCM, V as JWKSet, W as JWK_AES_GCM_KW, X as JWK_ECDSA, Y as JWK_ECDH_ES, Z as JWK_EC_Private, _ as JWSSignOptions, _t as KeyManagementAlgorithm, a as ExpiresIn, at as JWK_Pair, b as JOSEPayload, bt as WrapKeyResult, c as JWEDecryptResult, ct as JWK_RSA, d as JWEKeyManagementHeaderParameters, dt as JWK_RSA_Private, et as JWK_OKP, f as JWEProtectedHeader, ft as JWK_RSA_Public, g as JWSProtectedHeader, gt as JWK_oct, h as JWSHeaderParameters, ht as JWK_Symmetric_Algorithm, i as importFromPEM, it as JWK_PBES2, j as GenerateKeyAlgorithm, k as GenerateJWKOptions, l as JWEEncryptOptions, lt as JWK_RSA_ENC, m as JWSAlgorithm, mt as JWK_Symmetric, n as exportToPEM, nt as JWK_OKP_Public, o as MaxTokenAge, ot as JWK_Private, p as StrictOmit, pt as JWK_RSA_SIGN, q as JWK_Asymmetric_Algorithm, r as generateJWK, rt as JWK_OKP_SIGN, s as JWEDecryptOptions, st as JWK_Public, t as deriveJWKFromPassword, tt as JWK_OKP_Private, u as JWEHeaderParameters, ut as JWK_RSA_PSS, v as JWSVerifyOptions, vt as UnwrapKeyOptions, w as JoseHeaderParameters, x as JWT, y as JWSVerifyResult, yt as WrapKeyOptions, z as JWKPEMAlgorithm } from "../../_chunks/jwk.mjs";
+import { H3Event } from "h3";
+import { CookieSerializeOptions } from "cookie-es";
+
+//#region src/adapters/h3v1/session/types.d.ts
+interface SessionClaims extends Required<Pick<JWTClaims, "jti" | "iat">>, StrictOmit<JWTClaims, "jti" | "iat"> {}
+type SessionData<T extends Record<string, any> = SessionClaims> = StrictOmit<T, "jti" | "iat" | "exp">;
+type SessionUpdate<T extends Record<string, any> = SessionClaims> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
+interface SessionManager<T extends Record<string, any> = SessionClaims, ConfigMaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  readonly id: string | undefined;
+  readonly createdAt: number;
+  readonly expiresAt: ConfigMaxAge extends ExpiresIn ? number : "exp" extends keyof T ? T["exp"] : number | undefined;
+  readonly data: SessionData<T>;
+  readonly token: string | undefined;
+  update: (update?: SessionUpdate<T>) => Promise<SessionManager<T, ConfigMaxAge> & {
+    readonly id: string;
+    readonly token: string;
+  }>;
+  clear: () => Promise<SessionManager<T, ConfigMaxAge> & {
+    readonly id: undefined;
+    readonly createdAt: number;
+    readonly expiresAt: undefined;
+  }>;
+}
+//#endregion
+//#region src/adapters/h3v1/session/jwe.d.ts
+declare const kGetSessionPromise$1: unique symbol;
+interface SessionJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  id: string | undefined;
+  createdAt: number;
+  expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
+  data: SessionData<T>;
+  token: string | undefined;
+  [kGetSessionPromise$1]?: Promise<SessionJWE<T, MaxAge>>;
+}
+interface SessionHooksJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent$1 | H3Event = CompatEvent$1 | H3Event> {
+  onRead?: (args: {
+    session: SessionJWE<T, MaxAge> & {
+      id: string;
+      token: string;
+    };
+    event: TEvent;
+    config: SessionConfigJWE<T, MaxAge, TEvent>;
+  }) => void | Promise<void>;
+  onUpdate?: (args: {
+    /** Session after it has been updated.. */session: SessionJWE<T, MaxAge> & {
+      id: string;
+      token: string;
+    }; /** Snapshot of the session before was updated. */
+    oldSession: SessionJWE<T, MaxAge>;
+    event: TEvent;
+    config: SessionConfigJWE<T, MaxAge, TEvent>;
+  }) => void | Promise<void>;
+  onClear?: (args: {
+    oldSession: SessionJWE<T, MaxAge> | undefined;
+    event: TEvent;
+    config: SessionConfigJWE<T, MaxAge, TEvent>;
+  }) => void | Promise<void>;
+  onExpire?: (args: {
+    session: {
+      id: string | undefined;
+      createdAt: number | undefined;
+      expiresAt: number | undefined;
+      token: string;
+    };
+    event: TEvent;
+    error: Error;
+    config: SessionConfigJWE<T, MaxAge, TEvent>;
+  }) => void | Promise<void>;
+  onError?: (args: {
+    /**
+    * The session involved in the error.
+    */
+    session: SessionJWE<T, MaxAge>;
+    event: TEvent;
+    error: any;
+    config: SessionConfigJWE<T, MaxAge, TEvent>;
+  }) => void | Promise<void>;
+  onUnsealKeyLookup?: (args: {
+    header: JWEHeaderParameters;
+    event: TEvent;
+    config: SessionConfigJWE<T, MaxAge, TEvent>;
+  }) => JWK_Symmetric | JWK_Private | Promise<JWK_Symmetric | JWK_Private>;
+}
+interface SessionConfigJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent$1 | H3Event = CompatEvent$1 | H3Event> {
+  /** Shared key used, string for PBES2 or Json Web Key (JWK) */
+  key: string | JWK_Symmetric | JWK_Private | {
+    privateKey: JWK_Private | JWK_Symmetric;
+    publicKey?: JWK_Public;
+  };
+  /** Session lifetime in seconds (used to derive exp from iat) */
+  maxAge?: MaxAge;
+  /** Default is "h3" */
+  name?: string;
+  /** Default is secure, httpOnly, path="/" */
+  cookie?: false | CookieSerializeOptions;
+  /** Default is x-h3-session / x-{name}-session */
+  sessionHeader?: false | string;
+  /** Default is crypto.randomUUID */
+  generateId?: () => string;
+  /** JWE configuration overrides */
+  jwe?: {
+    encryptOptions?: Omit<JWEEncryptOptions, "expiresIn">;
+    decryptOptions?: JWTClaimValidationOptions;
+  };
+  hooks?: SessionHooksJWE<T, MaxAge, TEvent>;
+}
+type CompatEvent$1 = {
+  request: {
+    headers: Headers;
+  };
+  context: any;
+} | {
+  headers: Headers;
+  context: any;
+};
+/**
+* Create a session manager for the current request.
+*/
+declare function useJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent$1 | H3Event = CompatEvent$1 | H3Event>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>): Promise<SessionManager<T, MaxAge>>;
+/**
+* Get (and lazily initialize) the session for the current request.
+*/
+declare function getJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent$1 | H3Event = CompatEvent$1 | H3Event>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>): Promise<SessionJWE<T, MaxAge>>;
+declare function getJWESessionToken<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent$1 | H3Event = CompatEvent$1 | H3Event>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>): string | undefined;
+/**
+* Update the session (optionally mutating the session data) and re-issue the JWE token.
+*/
+declare function updateJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent$1 | H3Event = CompatEvent$1 | H3Event>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>, update?: SessionUpdate<T>): Promise<SessionJWE<T, MaxAge> & {
+  id: string;
+  token: string;
+}>;
+/**
+* Produce a JWE for the current session.
+* Payload structure:
+* {
+*   jti: string;
+*   iat: number; (seconds)
+*   exp?: number; (seconds)
+*   data: Record<string, any>;
+* }
+*/
+declare function sealJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent$1 | H3Event = CompatEvent$1 | H3Event>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>): Promise<string>;
+/**
+* Decrypt the JWE and return a Session-compatible object.
+*/
+declare function unsealJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent$1 | H3Event = CompatEvent$1 | H3Event>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>, sealed: string): Promise<Partial<SessionJWE<T, MaxAge>>>;
+/**
+* Clear the session (delete from context and drop cookie).
+*/
+declare function clearJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent$1 | H3Event = CompatEvent$1 | H3Event>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>): Promise<void>;
+//#endregion
+//#region src/adapters/h3v1/session/jws.d.ts
+declare const kGetSessionPromise: unique symbol;
+interface SessionJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  id: string | undefined;
+  createdAt: number;
+  expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
+  data: SessionData<T>;
+  token: string | undefined;
+  [kGetSessionPromise]?: Promise<SessionJWS<T, MaxAge>>;
+}
+interface SessionHooksJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent | H3Event = CompatEvent | H3Event> {
+  onRead?: (args: {
+    session: SessionJWS<T, MaxAge> & {
+      id: string;
+      token: string;
+    };
+    event: TEvent;
+    config: SessionConfigJWS<T, MaxAge, TEvent>;
+  }) => void | Promise<void>;
+  onUpdate?: (args: {
+    /** Session after it has been updated.. */session: SessionJWS<T, MaxAge> & {
+      id: string;
+      token: string;
+    }; /** Snapshot of the session before was updated. */
+    oldSession: SessionJWS<T, MaxAge>;
+    event: TEvent;
+    config: SessionConfigJWS<T, MaxAge, TEvent>;
+  }) => void | Promise<void>;
+  onClear?: (args: {
+    oldSession: SessionJWS<T, MaxAge> | undefined;
+    event: TEvent;
+    config: SessionConfigJWS<T, MaxAge, TEvent>;
+  }) => void | Promise<void>;
+  onExpire?: (args: {
+    session: {
+      id: string | undefined;
+      createdAt: number | undefined;
+      expiresAt: number | undefined;
+      token: string;
+    };
+    event: TEvent;
+    error: Error;
+    config: SessionConfigJWS<T, MaxAge, TEvent>;
+  }) => void | Promise<void>;
+  onError?: (args: {
+    /**
+    * The session involved in the error.
+    */
+    session: SessionJWS<T, MaxAge>;
+    event: TEvent;
+    error: any;
+    config: SessionConfigJWS<T, MaxAge, TEvent>;
+  }) => void | Promise<void>;
+  onVerifyKeyLookup?: (args: {
+    header: JWKLookupFunctionHeader;
+    event: TEvent;
+    config: SessionConfigJWS<T, MaxAge, TEvent>;
+  }) => JWKSet | JWK_Symmetric | JWK_Public | Promise<JWKSet | JWK_Symmetric | JWK_Public>;
+}
+interface SessionConfigJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent | H3Event = CompatEvent | H3Event> {
+  /**
+  * JWK (private for signing with RS/ES/PS, or symmetric oct) used for signing.
+  */
+  key: JWK_Symmetric | {
+    privateKey: JWK_Private;
+    publicKey: JWK_Public | JWK_Public[] | JWKSet;
+  };
+  /** Session lifetime in seconds (sets exp = iat + maxAge) */
+  maxAge?: MaxAge;
+  /** Default cookie / header name base */
+  name?: string;
+  /** Cookie options (false to disable cookies) */
+  cookie?: false | CookieSerializeOptions;
+  /** Custom header (false to disable header lookup) */
+  sessionHeader?: false | string;
+  /** Custom ID generator (defaults to crypto.randomUUID) */
+  generateId?: () => string;
+  /** JWS customization */
+  jws?: {
+    signOptions?: Omit<JWSSignOptions, "expiresIn">;
+    verifyOptions?: JWTClaimValidationOptions;
+  };
+  hooks?: SessionHooksJWS<T, MaxAge, TEvent>;
+}
+type CompatEvent = {
+  request: {
+    headers: Headers;
+  };
+  context: any;
+} | {
+  headers: Headers;
+  context: any;
+};
+/**
+* Create a session manager for the current request using JWS (signed only, not encrypted).
+* NOTE: Contents are visible to clients (Base64URL-decoded JSON). Do not store secrets in session data.
+*/
+declare function useJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent | H3Event = CompatEvent | H3Event>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>): Promise<SessionManager<T, MaxAge>>;
+/**
+* Retrieve (and lazily initialize) the session.
+*/
+declare function getJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent | H3Event = CompatEvent | H3Event>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>): Promise<SessionJWS<T, MaxAge>>;
+/**
+* Update session data (if provided) and reissue JWS.
+*/
+declare function updateJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent | H3Event = CompatEvent | H3Event>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>, update?: SessionUpdate<T>): Promise<SessionJWS<T, MaxAge> & {
+  id: string;
+  token: string;
+}>;
+/**
+* Sign current session as a compact JWS.
+* Payload claims:
+*  jti, iat, exp?, data, plus optional extraClaims (cannot override reserved)
+*/
+declare function signJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent | H3Event = CompatEvent | H3Event>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>): Promise<string>;
+/**
+* Verify and parse a compact JWS into a Session structure.
+* Performs:
+*  - cryptographic signature verification
+*  - (optional) standard claim checks if validateJWT true
+*  - ensures jti & iat presence
+*  - enforces maxAge if provided
+*/
+declare function verifyJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent | H3Event = CompatEvent | H3Event>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>, token: string): Promise<Partial<SessionJWS<T, MaxAge>>>;
+/**
+* Destroy the session (context + cookie).
+*/
+declare function clearJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent | H3Event = CompatEvent | H3Event>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>): Promise<void>;
+//#endregion
+export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JOSEPayload, JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSHeaderParameters, JWSProtectedHeader, JWSSignOptions, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JoseHeaderParameters, KeyManagementAlgorithm, MaxTokenAge, type SessionClaims, type SessionConfigJWE, type SessionConfigJWS, type SessionData, type SessionHooksJWE, type SessionHooksJWS, type SessionJWE, type SessionJWS, type SessionManager, type SessionUpdate, UnwrapKeyOptions, WrapKeyOptions, WrapKeyResult, clearJWESession, clearJWSSession, deriveJWKFromPassword, exportToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importFromPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };