unjwt 0.5.40 → 0.6.0

package/dist/_chunks/utils.mjs

@@ -1,4 +1,36 @@
-import { t as __exportAll } from "./chunk.mjs";
+//#region src/core/error.ts
+/**
+* Base error class for all unjwt errors. Every error thrown by the library is
+* an instance of `JWTError`, so a single `instanceof` check is sufficient to
+* distinguish library errors from other thrown values. Use the `code` property
+* (or the `isJWTError` type guard) to narrow to a specific error condition.
+*
+* @example
+* import { JWTError, isJWTError } from "unjwt/jws";
+*
+* try {
+*   await verify(token, key);
+* } catch (err) {
+*   if (isJWTError(err, "ERR_JWT_EXPIRED")) {
+*     console.log(err.cause.jti); // string | undefined
+*   }
+* }
+*/
+var JWTError = class extends Error {
+	code;
+	cause;
+	constructor(message, code, cause) {
+		super(message);
+		this.name = "JWTError";
+		this.code = code;
+		this.cause = cause;
+	}
+};
+function isJWTError(error, code) {
+	if (!(error instanceof JWTError)) return false;
+	return code === void 0 || error.code === code;
+}
+//#endregion
 //#region src/core/utils/jwt.ts
 /**
 * Apply default typ/cty semantics shared by JWS & JWE.
@@ -107,23 +139,31 @@ function validateJwtClaims(jwtClaims, options = {}) {
 	if (options.subject) allRequiredClaims.add("sub");
 	if (options.maxTokenAge) allRequiredClaims.add("iat");
 	for (const claimName of allRequiredClaims) if (!(claimName in jwtClaims)) missingClaims.add(claimName);
-	if (missingClaims.size > 0) throw new Error(`Missing required JWT Claims: ${[...missingClaims].join(", ")}`);
+	if (missingClaims.size > 0) throw new JWTError(`Missing required JWT Claims: ${[...missingClaims].join(", ")}`, "ERR_JWT_CLAIM_MISSING");
 	if (options.issuer) {
 		const expectedIssuers = maybeArray(options.issuer);
-		if (!jwtClaims.iss || !expectedIssuers.includes(jwtClaims.iss)) throw new Error(`Invalid JWT "iss" (Issuer) Claim: Expected ${expectedIssuers.join(" or ")}, got ${jwtClaims.iss}`);
+		if (!jwtClaims.iss || !expectedIssuers.includes(jwtClaims.iss)) throw new JWTError(`Invalid JWT "iss" (Issuer) Claim: Expected ${expectedIssuers.join(" or ")}, got ${jwtClaims.iss}`, "ERR_JWT_CLAIM_INVALID");
 	}
-	if (options.subject && jwtClaims.sub !== options.subject) throw new Error(`Invalid JWT "sub" (Subject) Claim: Expected ${options.subject}, got ${jwtClaims.sub}`);
+	if (options.subject && jwtClaims.sub !== options.subject) throw new JWTError(`Invalid JWT "sub" (Subject) Claim: Expected ${options.subject}, got ${jwtClaims.sub}`, "ERR_JWT_CLAIM_INVALID");
 	if (options.audience) {
 		const expectedAudiences = maybeArray(options.audience);
 		const claimAudience = maybeArray(jwtClaims.aud || []);
-		if (!claimAudience.some((aud) => expectedAudiences.includes(aud))) throw new Error(`Invalid JWT "aud" (Audience) Claim: Expected ${expectedAudiences.join(" or ")}, got ${claimAudience.join(", ")}`);
+		if (!claimAudience.some((aud) => expectedAudiences.includes(aud))) throw new JWTError(`Invalid JWT "aud" (Audience) Claim: Expected ${expectedAudiences.join(" or ")}, got ${claimAudience.join(", ")}`, "ERR_JWT_CLAIM_INVALID");
 	}
-	if (typeof jwtClaims.nbf === "number" && jwtClaims.nbf > currentTime + clockTolerance) throw new Error(`JWT "nbf" (Not Before) Claim validation failed: Token is not yet valid (nbf: ${(/* @__PURE__ */ new Date(jwtClaims.nbf * 1e3)).toISOString()})`);
-	if (typeof jwtClaims.exp === "number" && jwtClaims.exp <= currentTime - clockTolerance) throw new Error(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(jwtClaims.exp * 1e3)).toISOString()})`);
+	if (typeof jwtClaims.nbf === "number" && jwtClaims.nbf > currentTime + clockTolerance) throw new JWTError(`JWT "nbf" (Not Before) Claim validation failed: Token is not yet valid (nbf: ${(/* @__PURE__ */ new Date(jwtClaims.nbf * 1e3)).toISOString()})`, "ERR_JWT_NBF");
+	if (typeof jwtClaims.exp === "number" && jwtClaims.exp <= currentTime - clockTolerance) throw new JWTError(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(jwtClaims.exp * 1e3)).toISOString()})`, "ERR_JWT_EXPIRED", {
+		jti: jwtClaims.jti,
+		iat: jwtClaims.iat,
+		exp: jwtClaims.exp
+	});
 	if (options.maxTokenAge) {
-		if (typeof jwtClaims.iat !== "number") throw new TypeError("JWT \"iat\" (Issued At) Claim must be a number when maxTokenAge is set.");
-		if (jwtClaims.iat > currentTime + clockTolerance) throw new Error(`JWT "iat" (Issued At) Claim validation failed: Token was issued in the future (iat: ${(/* @__PURE__ */ new Date(jwtClaims.iat * 1e3)).toISOString()})`);
-		if (jwtClaims.iat < currentTime - computeMaxTokenAgeSeconds(options.maxTokenAge) - clockTolerance) throw new Error(`JWT "iat" (Issued At) Claim validation failed: Token is too old (maxTokenAge: ${options.maxTokenAge}s, iat: ${(/* @__PURE__ */ new Date(jwtClaims.iat * 1e3)).toISOString()})`);
+		if (typeof jwtClaims.iat !== "number") throw new JWTError("JWT \"iat\" (Issued At) Claim must be a number when maxTokenAge is set.", "ERR_JWT_CLAIM_INVALID");
+		if (jwtClaims.iat > currentTime + clockTolerance) throw new JWTError(`JWT "iat" (Issued At) Claim validation failed: Token was issued in the future (iat: ${(/* @__PURE__ */ new Date(jwtClaims.iat * 1e3)).toISOString()})`, "ERR_JWT_CLAIM_INVALID");
+		if (jwtClaims.iat < currentTime - computeMaxTokenAgeSeconds(options.maxTokenAge) - clockTolerance) throw new JWTError(`JWT "iat" (Issued At) Claim validation failed: Token is too old (maxTokenAge: ${options.maxTokenAge}s, iat: ${(/* @__PURE__ */ new Date(jwtClaims.iat * 1e3)).toISOString()})`, "ERR_JWT_EXPIRED", {
+			jti: jwtClaims.jti,
+			iat: jwtClaims.iat,
+			exp: jwtClaims.exp
+		});
 	}
 }
 const BASE_HEADER_PARAMS = [
@@ -138,11 +178,11 @@ const BASE_HEADER_PARAMS = [
 	"x5u"
 ];
 /** Validate critical headers in JWS semantics. */
-function validateCriticalHeadersJWS(protectedHeader, requiredHeaders = []) {
+function validateCriticalHeadersJWS(protectedHeader, recognizedHeaders = []) {
 	if (!protectedHeader.crit) return;
 	const missingHeaderParams = /* @__PURE__ */ new Set();
 	const recognizedParams = new Set([
-		...requiredHeaders,
+		...recognizedHeaders,
 		...BASE_HEADER_PARAMS,
 		"b64"
 	]);
@@ -150,14 +190,14 @@ function validateCriticalHeadersJWS(protectedHeader, requiredHeaders = []) {
 		if (recognizedParams.has(param) && (param in protectedHeader || param === "b64")) continue;
 		missingHeaderParams.add(param);
 	}
-	if (missingHeaderParams.size > 0) throw new Error(`Missing critical header parameters: ${[...missingHeaderParams].join(", ")}`);
+	if (missingHeaderParams.size > 0) throw new JWTError(`Missing critical header parameters: ${[...missingHeaderParams].join(", ")}`, "ERR_JWS_INVALID");
 }
 /** Validate critical headers in JWE semantics. */
-function validateCriticalHeadersJWE(protectedHeader, understoodFromOptions) {
-	if (protectedHeader.crit && !understoodFromOptions) throw new Error(`Unprocessed critical header parameters: ${protectedHeader.crit.join(", ")}`);
+function validateCriticalHeadersJWE(protectedHeader, recognizedHeaders) {
+	if (protectedHeader.crit && !recognizedHeaders) throw new JWTError(`Unprocessed critical header parameters: ${protectedHeader.crit.join(", ")}`, "ERR_JWE_INVALID");
 	if (!protectedHeader.crit) return;
 	const understoodParams = new Set([
-		...understoodFromOptions || [],
+		...recognizedHeaders || [],
 		...BASE_HEADER_PARAMS,
 		"enc",
 		"iv",
@@ -169,77 +209,41 @@ function validateCriticalHeadersJWE(protectedHeader, understoodFromOptions) {
 		"apv"
 	]);
 	for (const critParam of protectedHeader.crit) {
-		if (!Object.prototype.hasOwnProperty.call(protectedHeader, critParam)) throw new Error(`Critical header parameter "${critParam}" listed in "crit" but not present in the protected header.`);
-		if (!understoodParams.has(critParam)) throw new Error(`Unprocessed critical header parameters: ${critParam}`);
+		if (!Object.prototype.hasOwnProperty.call(protectedHeader, critParam)) throw new JWTError(`Critical header parameter "${critParam}" listed in "crit" but not present in the protected header.`, "ERR_JWE_INVALID");
+		if (!understoodParams.has(critParam)) throw new JWTError(`Unprocessed critical header parameters: ${critParam}`, "ERR_JWE_INVALID");
 	}
 }
 //#endregion
 //#region src/core/utils/sanitize.ts
 /**
-* Forked from unsecure@0.0.4
+* Originally derived from unsecure@0.0.4
 * Licensed under the MIT License.
 *
 * Source: https://github.com/sandros94/unsecure/blob/913ed5580c551153a19154b4916c67a8efb2be85/src/sanitize.ts
 */
 /**
-* Remove prototype-pollution vectors from a plain record in-place.
-* This strips __proto__, prototype, and constructor own properties.
-* Returns the same reference for convenience.
+* Returns a deep structural copy of `obj` with prototype-pollution vectors
+* stripped at every level (`__proto__`, `prototype`, `constructor`).
+*
+* The input is never modified. Arrays are copied element-by-element;
+* nested objects are recursed with a WeakSet cycle guard.
 */
 function sanitizeObject(obj) {
 	if (!obj || typeof obj !== "object") return obj;
-	const seen = /* @__PURE__ */ new WeakSet();
-	seen.add(obj);
-	sanitizeKeys(obj, seen);
-	return obj;
+	return _sanitizeCopy(obj, /* @__PURE__ */ new WeakSet());
 }
-function sanitizeKeys(current, seen) {
-	if (Object.prototype.hasOwnProperty.call(current, "__proto__")) delete current["__proto__"];
-	if (Object.prototype.hasOwnProperty.call(current, "prototype")) delete current["prototype"];
-	if (Object.prototype.hasOwnProperty.call(current, "constructor")) delete current["constructor"];
-	const items = Array.isArray(current) ? current : Object.values(current);
-	for (const v of items) if (v && typeof v === "object") {
-		if (!seen.has(v)) {
-			seen.add(v);
-			sanitizeKeys(v, seen);
-		}
+function _sanitizeCopy(current, seen) {
+	seen.add(current);
+	if (Array.isArray(current)) return current.map((item) => item && typeof item === "object" && !seen.has(item) ? _sanitizeCopy(item, seen) : item);
+	const result = {};
+	for (const [key, value] of Object.entries(current)) {
+		if (key === "__proto__" || key === "prototype" || key === "constructor") continue;
+		result[key] = value && typeof value === "object" && !seen.has(value) ? _sanitizeCopy(value, seen) : value;
 	}
+	return result;
 }
 //#endregion
 //#region src/core/utils/index.ts
-var utils_exports = /* @__PURE__ */ __exportAll({
-	applyTypCtyDefaults: () => applyTypCtyDefaults,
-	assertCryptoKey: () => assertCryptoKey,
-	base64Decode: () => base64Decode,
-	base64Encode: () => base64Encode,
-	base64UrlDecode: () => base64UrlDecode,
-	base64UrlEncode: () => base64UrlEncode,
-	computeExpiresInSeconds: () => computeExpiresInSeconds,
-	computeJwtTimeClaims: () => computeJwtTimeClaims,
-	computeMaxTokenAgeSeconds: () => computeMaxTokenAgeSeconds,
-	concatUint8Arrays: () => concatUint8Arrays,
-	decodeMaybeJWTString: () => decodeMaybeJWTString,
-	decodePayloadFromB64UrlSegment: () => decodePayloadFromB64UrlSegment,
-	decodePayloadFromBytes: () => decodePayloadFromBytes,
-	getPlaintextBytes: () => getPlaintextBytes,
-	isAsymmetricJWK: () => isAsymmetricJWK,
-	isCryptoKey: () => isCryptoKey,
-	isCryptoKeyPair: () => isCryptoKeyPair,
-	isJWK: () => isJWK,
-	isJWKSet: () => isJWKSet,
-	isJWTContent: () => isJWTContent,
-	isPrivateJWK: () => isPrivateJWK,
-	isPublicJWK: () => isPublicJWK,
-	isSymmetricJWK: () => isSymmetricJWK,
-	maybeArray: () => maybeArray,
-	randomBytes: () => randomBytes,
-	sanitizeObject: () => sanitizeObject,
-	textDecoder: () => textDecoder,
-	textEncoder: () => textEncoder,
-	validateCriticalHeadersJWE: () => validateCriticalHeadersJWE,
-	validateCriticalHeadersJWS: () => validateCriticalHeadersJWS,
-	validateJwtClaims: () => validateJwtClaims
-});
 const textEncoder = /* @__PURE__ */ new TextEncoder();
 const textDecoder = /* @__PURE__ */ new TextDecoder();
 const _Buffer = /* @__PURE__ */ (() => {
@@ -372,4 +376,4 @@ function isPublicJWK(key) {
 	return false;
 }
 //#endregion
-export { validateCriticalHeadersJWE as A, computeJwtTimeClaims as C, decodePayloadFromBytes as D, decodePayloadFromB64UrlSegment as E, validateJwtClaims as M, getPlaintextBytes as O, computeExpiresInSeconds as S, decodeMaybeJWTString as T, textDecoder as _, base64UrlEncode as a, sanitizeObject as b, isCryptoKey as c, isJWKSet as d, isPrivateJWK as f, randomBytes as g, maybeArray as h, base64UrlDecode as i, validateCriticalHeadersJWS as j, isJWTContent as k, isCryptoKeyPair as l, isSymmetricJWK as m, base64Decode as n, concatUint8Arrays as o, isPublicJWK as p, base64Encode as r, isAsymmetricJWK as s, assertCryptoKey as t, isJWK as u, textEncoder as v, computeMaxTokenAgeSeconds as w, applyTypCtyDefaults as x, utils_exports as y };
+export { validateCriticalHeadersJWS as A, computeMaxTokenAgeSeconds as C, getPlaintextBytes as D, decodePayloadFromBytes as E, JWTError as M, isJWTError as N, isJWTContent as O, computeJwtTimeClaims as S, decodePayloadFromB64UrlSegment as T, textDecoder as _, base64UrlEncode as a, applyTypCtyDefaults as b, isCryptoKey as c, isJWKSet as d, isPrivateJWK as f, randomBytes as g, maybeArray as h, base64UrlDecode as i, validateJwtClaims as j, validateCriticalHeadersJWE as k, isCryptoKeyPair as l, isSymmetricJWK as m, base64Decode as n, concatUint8Arrays as o, isPublicJWK as p, base64Encode as r, isAsymmetricJWK as s, assertCryptoKey as t, isJWK as u, textEncoder as v, decodeMaybeJWTString as w, computeExpiresInSeconds as x, sanitizeObject as y };

package/dist/{_chunks/jws.d.mts → adapters/h3v1/index.d.mts}

@@ -1,4 +1,4 @@
-import { C as JWTClaims, R as JWKSet, S as JWTClaimValidationOptions, _ as JWSProtectedHeader, a as ExpiresIn, dt as JWK_Symmetric, it as JWK_Public, l as JWEEncryptOptions, p as StrictOmit, rt as JWK_Private, u as JWEHeaderParameters, v as JWSSignOptions } from "./jwk.mjs";
+import { $ as JWK_HMAC, A as GenerateJWKReturn, B as JWKParameters, C as JWTClaims, D as DeriveKeyOptions, E as ContentEncryptionAlgorithm, F as JWKAlgorithm, G as JWK_AES_KW, H as JWK_AES_CBC_HMAC, I as JWKCacheAdapter, J as JWK_EC, K as JWK_Asymmetric, L as JWKLookupFunction, M as GenerateKeyOptions, N as GenerateKeyReturn, O as DeriveKeyReturn, P as JWK, Q as JWK_EC_Public, R as JWKLookupFunctionHeader, S as JWTClaimValidationOptions, T as CompositeKey, U as JWK_AES_GCM, V as JWKSet, W as JWK_AES_GCM_KW, X as JWK_ECDSA, Y as JWK_ECDH_ES, Z as JWK_EC_Private, _ as JWSSignOptions, _t as KeyManagementAlgorithm, a as ExpiresIn, at as JWK_Pair, b as JOSEPayload, bt as WrapKeyResult, c as JWEDecryptResult, ct as JWK_RSA, d as JWEKeyManagementHeaderParameters, dt as JWK_RSA_Private, et as JWK_OKP, f as JWEProtectedHeader, ft as JWK_RSA_Public, g as JWSProtectedHeader, gt as JWK_oct, h as JWSHeaderParameters, ht as JWK_Symmetric_Algorithm, i as importFromPEM, it as JWK_PBES2, j as GenerateKeyAlgorithm, k as GenerateJWKOptions, l as JWEEncryptOptions, lt as JWK_RSA_ENC, m as JWSAlgorithm, mt as JWK_Symmetric, n as exportToPEM, nt as JWK_OKP_Public, o as MaxTokenAge, ot as JWK_Private, p as StrictOmit, pt as JWK_RSA_SIGN, q as JWK_Asymmetric_Algorithm, r as generateJWK, rt as JWK_OKP_SIGN, s as JWEDecryptOptions, st as JWK_Public, t as deriveJWKFromPassword, tt as JWK_OKP_Private, u as JWEHeaderParameters, ut as JWK_RSA_PSS, v as JWSVerifyOptions, vt as UnwrapKeyOptions, w as JoseHeaderParameters, x as JWT, y as JWSVerifyResult, yt as WrapKeyOptions, z as JWKPEMAlgorithm } from "../../_chunks/jwk.mjs";
 import { H3Event } from "h3";
 import { CookieSerializeOptions } from "cookie-es";
 
@@ -14,8 +14,13 @@ interface SessionManager<T extends Record<string, any> = SessionClaims, ConfigMa
   readonly token: string | undefined;
   update: (update?: SessionUpdate<T>) => Promise<SessionManager<T, ConfigMaxAge> & {
     readonly id: string;
+    readonly token: string;
+  }>;
+  clear: () => Promise<SessionManager<T, ConfigMaxAge> & {
+    readonly id: undefined;
+    readonly createdAt: number;
+    readonly expiresAt: undefined;
   }>;
-  clear: () => Promise<SessionManager<T, ConfigMaxAge>>;
 }
 //#endregion
 //#region src/adapters/h3v1/session/jwe.d.ts
@@ -25,47 +30,59 @@ interface SessionJWE<T extends Record<string, any> = SessionClaims, MaxAge exten
   createdAt: number;
   expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
   data: SessionData<T>;
+  token: string | undefined;
   [kGetSessionPromise$1]?: Promise<SessionJWE<T, MaxAge>>;
 }
-interface SessionHooksJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+interface SessionHooksJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent$1 | H3Event = CompatEvent$1 | H3Event> {
   onRead?: (args: {
-    session: SessionJWE<T, MaxAge>;
-    event: H3Event;
-    config: SessionConfigJWE<T, MaxAge>;
+    session: SessionJWE<T, MaxAge> & {
+      id: string;
+      token: string;
+    };
+    event: TEvent;
+    config: SessionConfigJWE<T, MaxAge, TEvent>;
   }) => void | Promise<void>;
   onUpdate?: (args: {
-    session: SessionJWE<T, MaxAge>;
+    /** Session after it has been updated.. */session: SessionJWE<T, MaxAge> & {
+      id: string;
+      token: string;
+    }; /** Snapshot of the session before was updated. */
     oldSession: SessionJWE<T, MaxAge>;
-    event: H3Event;
-    config: SessionConfigJWE<T, MaxAge>;
+    event: TEvent;
+    config: SessionConfigJWE<T, MaxAge, TEvent>;
   }) => void | Promise<void>;
   onClear?: (args: {
-    session: SessionJWE<T, MaxAge> | undefined;
-    event: H3Event;
-    config: Partial<SessionConfigJWE<T, MaxAge>>;
+    oldSession: SessionJWE<T, MaxAge> | undefined;
+    event: TEvent;
+    config: SessionConfigJWE<T, MaxAge, TEvent>;
   }) => void | Promise<void>;
   onExpire?: (args: {
-    event: H3Event;
+    session: {
+      id: string | undefined;
+      createdAt: number | undefined;
+      expiresAt: number | undefined;
+      token: string;
+    };
+    event: TEvent;
     error: Error;
-    config: SessionConfigJWE<T, MaxAge>;
+    config: SessionConfigJWE<T, MaxAge, TEvent>;
   }) => void | Promise<void>;
   onError?: (args: {
-    event: H3Event;
+    /**
+    * The session involved in the error.
+    */
+    session: SessionJWE<T, MaxAge>;
+    event: TEvent;
     error: any;
-    config: SessionConfigJWE<T, MaxAge>;
+    config: SessionConfigJWE<T, MaxAge, TEvent>;
   }) => void | Promise<void>;
   onUnsealKeyLookup?: (args: {
     header: JWEHeaderParameters;
-    event: H3Event;
-    config: SessionConfigJWE<T, MaxAge>;
+    event: TEvent;
+    config: SessionConfigJWE<T, MaxAge, TEvent>;
   }) => JWK_Symmetric | JWK_Private | Promise<JWK_Symmetric | JWK_Private>;
 }
-interface SessionConfigJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
-  /** @deprecated use `key` instead */
-  secret?: string | JWK_Symmetric | {
-    privateKey: JWK_Private | JWK_Symmetric;
-    publicKey?: JWK_Public;
-  };
+interface SessionConfigJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent$1 | H3Event = CompatEvent$1 | H3Event> {
   /** Shared key used, string for PBES2 or Json Web Key (JWK) */
   key: string | JWK_Symmetric | JWK_Private | {
     privateKey: JWK_Private | JWK_Symmetric;
@@ -86,7 +103,7 @@ interface SessionConfigJWE<T extends Record<string, any> = SessionClaims, MaxAge
     encryptOptions?: Omit<JWEEncryptOptions, "expiresIn">;
     decryptOptions?: JWTClaimValidationOptions;
   };
-  hooks?: SessionHooksJWE<T, MaxAge>;
+  hooks?: SessionHooksJWE<T, MaxAge, TEvent>;
 }
 type CompatEvent$1 = {
   request: {
@@ -100,16 +117,19 @@ type CompatEvent$1 = {
 /**
 * Create a session manager for the current request.
 */
-declare function useJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
+declare function useJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent$1 | H3Event = CompatEvent$1 | H3Event>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>): Promise<SessionManager<T, MaxAge>>;
 /**
 * Get (and lazily initialize) the session for the current request.
 */
-declare function getJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<SessionJWE<T, MaxAge>>;
-declare function getJWESessionToken<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): string | undefined;
+declare function getJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent$1 | H3Event = CompatEvent$1 | H3Event>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>): Promise<SessionJWE<T, MaxAge>>;
+declare function getJWESessionToken<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent$1 | H3Event = CompatEvent$1 | H3Event>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>): string | undefined;
 /**
 * Update the session (optionally mutating the session data) and re-issue the JWE token.
 */
-declare function updateJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: SessionConfigJWE<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWE<T, MaxAge>>;
+declare function updateJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent$1 | H3Event = CompatEvent$1 | H3Event>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>, update?: SessionUpdate<T>): Promise<SessionJWE<T, MaxAge> & {
+  id: string;
+  token: string;
+}>;
 /**
 * Produce a JWE for the current session.
 * Payload structure:
@@ -120,15 +140,15 @@ declare function updateJWESession<T extends Record<string, any> = SessionClaims,
 *   data: Record<string, any>;
 * }
 */
-declare function sealJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>): Promise<string>;
+declare function sealJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent$1 | H3Event = CompatEvent$1 | H3Event>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>): Promise<string>;
 /**
 * Decrypt the JWE and return a Session-compatible object.
 */
-declare function unsealJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent$1, config: SessionConfigJWE<T, MaxAge>, sealed: string): Promise<Partial<SessionJWE<T, MaxAge>>>;
+declare function unsealJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent$1 | H3Event = CompatEvent$1 | H3Event>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>, sealed: string): Promise<Partial<SessionJWE<T, MaxAge>>>;
 /**
 * Clear the session (delete from context and drop cookie).
 */
-declare function clearJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: Partial<SessionConfigJWE<T, MaxAge>>): Promise<void>;
+declare function clearJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent$1 | H3Event = CompatEvent$1 | H3Event>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>): Promise<void>;
 //#endregion
 //#region src/adapters/h3v1/session/jws.d.ts
 declare const kGetSessionPromise: unique symbol;
@@ -137,42 +157,59 @@ interface SessionJWS<T extends Record<string, any> = SessionClaims, MaxAge exten
   createdAt: number;
   expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
   data: SessionData<T>;
+  token: string | undefined;
   [kGetSessionPromise]?: Promise<SessionJWS<T, MaxAge>>;
 }
-interface SessionHooksJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+interface SessionHooksJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent | H3Event = CompatEvent | H3Event> {
   onRead?: (args: {
-    session: SessionJWS<T, MaxAge>;
-    event: H3Event;
-    config: SessionConfigJWS<T, MaxAge>;
+    session: SessionJWS<T, MaxAge> & {
+      id: string;
+      token: string;
+    };
+    event: TEvent;
+    config: SessionConfigJWS<T, MaxAge, TEvent>;
   }) => void | Promise<void>;
   onUpdate?: (args: {
-    session: SessionJWS<T, MaxAge>;
+    /** Session after it has been updated.. */session: SessionJWS<T, MaxAge> & {
+      id: string;
+      token: string;
+    }; /** Snapshot of the session before was updated. */
     oldSession: SessionJWS<T, MaxAge>;
-    event: H3Event;
-    config: SessionConfigJWS<T, MaxAge>;
+    event: TEvent;
+    config: SessionConfigJWS<T, MaxAge, TEvent>;
   }) => void | Promise<void>;
   onClear?: (args: {
-    session: SessionJWS<T, MaxAge> | undefined;
-    event: H3Event;
-    config: Partial<SessionConfigJWS<T, MaxAge>>;
+    oldSession: SessionJWS<T, MaxAge> | undefined;
+    event: TEvent;
+    config: SessionConfigJWS<T, MaxAge, TEvent>;
   }) => void | Promise<void>;
   onExpire?: (args: {
-    event: H3Event;
+    session: {
+      id: string | undefined;
+      createdAt: number | undefined;
+      expiresAt: number | undefined;
+      token: string;
+    };
+    event: TEvent;
     error: Error;
-    config: SessionConfigJWS<T, MaxAge>;
+    config: SessionConfigJWS<T, MaxAge, TEvent>;
   }) => void | Promise<void>;
   onError?: (args: {
-    event: H3Event;
+    /**
+    * The session involved in the error.
+    */
+    session: SessionJWS<T, MaxAge>;
+    event: TEvent;
     error: any;
-    config: SessionConfigJWS<T, MaxAge>;
+    config: SessionConfigJWS<T, MaxAge, TEvent>;
   }) => void | Promise<void>;
   onVerifyKeyLookup?: (args: {
-    header: JWSProtectedHeader;
-    event: H3Event;
-    config: SessionConfigJWS<T, MaxAge>;
+    header: JWKLookupFunctionHeader;
+    event: TEvent;
+    config: SessionConfigJWS<T, MaxAge, TEvent>;
   }) => JWKSet | JWK_Symmetric | JWK_Public | Promise<JWKSet | JWK_Symmetric | JWK_Public>;
 }
-interface SessionConfigJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+interface SessionConfigJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent | H3Event = CompatEvent | H3Event> {
   /**
   * JWK (private for signing with RS/ES/PS, or symmetric oct) used for signing.
   */
@@ -195,7 +232,7 @@ interface SessionConfigJWS<T extends Record<string, any> = SessionClaims, MaxAge
     signOptions?: Omit<JWSSignOptions, "expiresIn">;
     verifyOptions?: JWTClaimValidationOptions;
   };
-  hooks?: SessionHooksJWS<T, MaxAge>;
+  hooks?: SessionHooksJWS<T, MaxAge, TEvent>;
 }
 type CompatEvent = {
   request: {
@@ -210,21 +247,24 @@ type CompatEvent = {
 * Create a session manager for the current request using JWS (signed only, not encrypted).
 * NOTE: Contents are visible to clients (Base64URL-decoded JSON). Do not store secrets in session data.
 */
-declare function useJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionManager<T, MaxAge>>;
+declare function useJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent | H3Event = CompatEvent | H3Event>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>): Promise<SessionManager<T, MaxAge>>;
 /**
 * Retrieve (and lazily initialize) the session.
 */
-declare function getJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<SessionJWS<T, MaxAge>>;
+declare function getJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent | H3Event = CompatEvent | H3Event>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>): Promise<SessionJWS<T, MaxAge>>;
 /**
 * Update session data (if provided) and reissue JWS.
 */
-declare function updateJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: SessionConfigJWS<T, MaxAge>, update?: SessionUpdate<T>): Promise<SessionJWS<T, MaxAge>>;
+declare function updateJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent | H3Event = CompatEvent | H3Event>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>, update?: SessionUpdate<T>): Promise<SessionJWS<T, MaxAge> & {
+  id: string;
+  token: string;
+}>;
 /**
 * Sign current session as a compact JWS.
 * Payload claims:
 *  jti, iat, exp?, data, plus optional extraClaims (cannot override reserved)
 */
-declare function signJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>): Promise<string>;
+declare function signJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent | H3Event = CompatEvent | H3Event>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>): Promise<string>;
 /**
 * Verify and parse a compact JWS into a Session structure.
 * Performs:
@@ -233,10 +273,10 @@ declare function signJWSSession<T extends Record<string, any> = SessionClaims, M
 *  - ensures jti & iat presence
 *  - enforces maxAge if provided
 */
-declare function verifyJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event | CompatEvent, config: SessionConfigJWS<T, MaxAge>, token: string): Promise<Partial<SessionJWS<T, MaxAge>>>;
+declare function verifyJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent | H3Event = CompatEvent | H3Event>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>, token: string): Promise<Partial<SessionJWS<T, MaxAge>>>;
 /**
 * Destroy the session (context + cookie).
 */
-declare function clearJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined>(event: H3Event, config: Partial<SessionConfigJWS<T, MaxAge>>): Promise<void>;
+declare function clearJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends CompatEvent | H3Event = CompatEvent | H3Event>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>): Promise<void>;
 //#endregion
-export { SessionUpdate as C, SessionManager as S, unsealJWESession as _, getJWSSession as a, SessionClaims as b, useJWSSession as c, SessionHooksJWE as d, SessionJWE as f, sealJWESession as g, getJWESessionToken as h, clearJWSSession as i, verifyJWSSession as l, getJWESession as m, SessionHooksJWS as n, signJWSSession as o, clearJWESession as p, SessionJWS as r, updateJWSSession as s, SessionConfigJWS as t, SessionConfigJWE as u, updateJWESession as v, SessionData as x, useJWESession as y };
+export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JOSEPayload, JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSHeaderParameters, JWSProtectedHeader, JWSSignOptions, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JoseHeaderParameters, KeyManagementAlgorithm, MaxTokenAge, type SessionClaims, type SessionConfigJWE, type SessionConfigJWS, type SessionData, type SessionHooksJWE, type SessionHooksJWS, type SessionJWE, type SessionJWS, type SessionManager, type SessionUpdate, UnwrapKeyOptions, WrapKeyOptions, WrapKeyResult, clearJWESession, clearJWSSession, deriveJWKFromPassword, exportToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importFromPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };