unjwt 0.5.40 → 0.6.1

package/dist/adapters/h3v2/index.d.mts

@@ -0,0 +1,213 @@
+import { $ as JWK_HMAC, A as GenerateJWKReturn, B as JWKParameters, C as JWTClaims, D as DeriveKeyOptions, E as ContentEncryptionAlgorithm, F as JWKAlgorithm, G as JWK_AES_KW, H as JWK_AES_CBC_HMAC, I as JWKCacheAdapter, J as JWK_EC, K as JWK_Asymmetric, L as JWKLookupFunction, M as GenerateKeyOptions, N as GenerateKeyReturn, O as DeriveKeyReturn, P as JWK, Q as JWK_EC_Public, R as JWKLookupFunctionHeader, S as JWTClaimValidationOptions, T as CompositeKey, U as JWK_AES_GCM, V as JWKSet, W as JWK_AES_GCM_KW, X as JWK_ECDSA, Y as JWK_ECDH_ES, Z as JWK_EC_Private, _ as JWSSignOptions, _t as KeyManagementAlgorithm, a as ExpiresIn, at as JWK_Pair, b as JOSEPayload, bt as WrapKeyResult, c as JWEDecryptResult, ct as JWK_RSA, d as JWEKeyManagementHeaderParameters, dt as JWK_RSA_Private, et as JWK_OKP, f as JWEProtectedHeader, ft as JWK_RSA_Public, g as JWSProtectedHeader, gt as JWK_oct, h as JWSHeaderParameters, ht as JWK_Symmetric_Algorithm, i as importFromPEM, it as JWK_PBES2, j as GenerateKeyAlgorithm, k as GenerateJWKOptions, l as JWEEncryptOptions, lt as JWK_RSA_ENC, m as JWSAlgorithm, mt as JWK_Symmetric, n as exportToPEM, nt as JWK_OKP_Public, o as MaxTokenAge, ot as JWK_Private, p as StrictOmit, pt as JWK_RSA_SIGN, q as JWK_Asymmetric_Algorithm, r as generateJWK, rt as JWK_OKP_SIGN, s as JWEDecryptOptions, st as JWK_Public, t as deriveJWKFromPassword, tt as JWK_OKP_Private, u as JWEHeaderParameters, ut as JWK_RSA_PSS, v as JWSVerifyOptions, vt as UnwrapKeyOptions, w as JoseHeaderParameters, x as JWT, y as JWSVerifyResult, yt as WrapKeyOptions, z as JWKPEMAlgorithm } from "../../_chunks/jwk.mjs";
+import { H3Event, HTTPEvent } from "h3";
+import { CookieSerializeOptions } from "cookie-es";
+
+//#region src/adapters/h3v2/session/types.d.ts
+interface SessionClaims extends Required<Pick<JWTClaims, "jti" | "iat">>, StrictOmit<JWTClaims, "jti" | "iat"> {}
+type SessionData<T extends Record<string, any> = SessionClaims> = StrictOmit<T, "jti" | "iat" | "exp">;
+type SessionUpdate<T extends Record<string, any> = SessionClaims> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
+interface SessionManager<T extends Record<string, any> = SessionClaims, ConfigMaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  readonly id: string | undefined;
+  readonly createdAt: number;
+  readonly expiresAt: ConfigMaxAge extends ExpiresIn ? number : "exp" extends keyof T ? T["exp"] : number | undefined;
+  readonly data: SessionData<T>;
+  readonly token: string | undefined;
+  update: (update?: SessionUpdate<T>) => Promise<SessionManager<T, ConfigMaxAge>>;
+  clear: () => Promise<SessionManager<T, ConfigMaxAge>>;
+}
+//#endregion
+//#region src/adapters/h3v2/session/jwe.d.ts
+declare const kGetSessionPromise$1: unique symbol;
+interface SessionJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  id: string | undefined;
+  createdAt: number;
+  expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
+  data: SessionData<T>;
+  token: string | undefined;
+  [kGetSessionPromise$1]?: Promise<SessionJWE<T, MaxAge>>;
+}
+interface SessionHooksJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent | H3Event = HTTPEvent | H3Event> {
+  onRead?: (args: {
+    session: SessionJWE<T, MaxAge> & {
+      id: string;
+      token: string;
+    };
+    event: TEvent;
+    config: SessionConfigJWE<T, MaxAge, TEvent>;
+  }) => void | Promise<void>;
+  onUpdate?: (args: {
+    /** Session after it has been updated.. */session: SessionJWE<T, MaxAge> & {
+      id: string;
+      token: string;
+    }; /** Snapshot of the session before was updated. */
+    oldSession: SessionJWE<T, MaxAge>;
+    event: TEvent;
+    config: SessionConfigJWE<T, MaxAge, TEvent>;
+  }) => void | Promise<void>;
+  onClear?: (args: {
+    oldSession: SessionJWE<T, MaxAge> | undefined;
+    event: TEvent;
+    config: SessionConfigJWE<T, MaxAge, TEvent>;
+  }) => void | Promise<void>;
+  onExpire?: (args: {
+    session: {
+      id: string | undefined;
+      createdAt: number | undefined;
+      expiresAt: number | undefined;
+      token: string;
+    };
+    event: TEvent;
+    error: Error;
+    config: SessionConfigJWE<T, MaxAge, TEvent>;
+  }) => void | Promise<void>;
+  onError?: (args: {
+    /**
+    * The session involved in the error.
+    */
+    session: SessionJWE<T, MaxAge>;
+    event: TEvent;
+    error: any;
+    config: SessionConfigJWE<T, MaxAge, TEvent>;
+  }) => void | Promise<void>;
+  onUnsealKeyLookup?: (args: {
+    header: JWEHeaderParameters;
+    event: TEvent;
+    config: SessionConfigJWE<T, MaxAge, TEvent>;
+  }) => JWK_Symmetric | JWK_Private | Promise<JWK_Symmetric | JWK_Private>;
+}
+interface SessionConfigJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent | H3Event = HTTPEvent | H3Event> {
+  /** Shared secret used, string for PBES2 or Json Web Key (JWK) */
+  key: string | JWK_Symmetric | {
+    privateKey: JWK_Private | JWK_Symmetric;
+    publicKey?: JWK_Public;
+  };
+  /** Session lifetime in seconds (used to derive exp from iat) */
+  maxAge?: MaxAge;
+  /** Default is "h3" */
+  name?: string;
+  /** Default is secure, httpOnly, path="/" */
+  cookie?: false | (CookieSerializeOptions & {
+    chunkMaxLength?: number;
+  });
+  /** Default is x-h3-session / x-{name}-session */
+  sessionHeader?: false | string;
+  /** Default is crypto.randomUUID */
+  generateId?: () => string;
+  /** JWE configuration overrides */
+  jwe?: {
+    encryptOptions?: Omit<JWEEncryptOptions, "expiresIn">;
+    decryptOptions?: JWTClaimValidationOptions;
+  };
+  hooks?: SessionHooksJWE<T, MaxAge, TEvent>;
+}
+/**
+* Create a session manager for the current request.
+*/
+declare function useJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>): Promise<SessionManager<T, MaxAge>>;
+/**
+* Get the session for the current request.
+*/
+declare function getJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>): Promise<SessionJWE<T, MaxAge>>;
+declare function getJWESessionToken<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>): string | undefined;
+/**
+* Update the session data for the current request.
+*/
+declare function updateJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>, update?: SessionUpdate<T>): Promise<SessionJWE<T, MaxAge>>;
+/**
+* Produce a JWE for the current session.
+*/
+declare function sealJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>): Promise<string>;
+/**
+* Decrypt the JWE and return a Session-compatible object.
+*/
+declare function unsealJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>, sealed: string): Promise<Partial<SessionJWE<T, MaxAge>>>;
+/**
+* Clear the session (delete from context and drop cookie).
+*/
+declare function clearJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>): Promise<void>;
+//#endregion
+//#region src/adapters/h3v2/session/jws.d.ts
+declare const kGetSessionPromise: unique symbol;
+interface SessionJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  id: string | undefined;
+  createdAt: number;
+  expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
+  data: SessionData<T>;
+  token: string | undefined;
+  [kGetSessionPromise]?: Promise<SessionJWS<T, MaxAge>>;
+}
+interface SessionHooksJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent> {
+  onRead?: (args: {
+    session: SessionJWS<T, MaxAge> & {
+      id: string;
+      token: string;
+    };
+    event: TEvent;
+    config: SessionConfigJWS<T, MaxAge, TEvent>;
+  }) => void | Promise<void>;
+  onUpdate?: (args: {
+    /** Session after it has been updated.. */session: SessionJWS<T, MaxAge> & {
+      id: string;
+      token: string;
+    }; /** Snapshot of the session before was updated. */
+    oldSession: SessionJWS<T, MaxAge>;
+    event: TEvent;
+    config: SessionConfigJWS<T, MaxAge, TEvent>;
+  }) => void | Promise<void>;
+  onClear?: (args: {
+    oldSession: SessionJWS<T, MaxAge> | undefined;
+    event: TEvent;
+    config: SessionConfigJWS<T, MaxAge, TEvent>;
+  }) => void | Promise<void>;
+  onExpire?: (args: {
+    session: {
+      id: string | undefined;
+      createdAt: number | undefined;
+      expiresAt: number | undefined;
+      token: string;
+    };
+    event: TEvent;
+    error: Error;
+    config: SessionConfigJWS<T, MaxAge, TEvent>;
+  }) => void | Promise<void>;
+  onError?: (args: {
+    /**
+    * The session involved in the error.
+    */
+    session: SessionJWS<T, MaxAge>;
+    event: TEvent;
+    error: any;
+    config: SessionConfigJWS<T, MaxAge, TEvent>;
+  }) => void | Promise<void>;
+  onVerifyKeyLookup?: (args: {
+    header: JWKLookupFunctionHeader;
+    event: TEvent;
+    config: SessionConfigJWS<T, MaxAge, TEvent>;
+  }) => JWKSet | JWK_Symmetric | JWK_Public | Promise<JWKSet | JWK_Symmetric | JWK_Public>;
+}
+interface SessionConfigJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent> {
+  key: JWK_Symmetric | {
+    privateKey: JWK_Private;
+    publicKey: JWK_Public | JWK_Public[] | JWKSet;
+  };
+  maxAge?: MaxAge;
+  name?: string;
+  cookie?: false | (CookieSerializeOptions & {
+    chunkMaxLength?: number;
+  });
+  sessionHeader?: false | string;
+  generateId?: () => string;
+  jws?: {
+    signOptions?: Omit<JWSSignOptions, "expiresIn">;
+    verifyOptions?: JWTClaimValidationOptions;
+  };
+  hooks?: SessionHooksJWS<T, MaxAge, TEvent>;
+}
+declare function useJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>): Promise<SessionManager<T, MaxAge>>;
+declare function getJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>): Promise<SessionJWS<T, MaxAge>>;
+declare function updateJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>, update?: SessionUpdate<T>): Promise<SessionJWS<T, MaxAge>>;
+declare function signJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>): Promise<string>;
+declare function verifyJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>, token: string): Promise<Partial<SessionJWS<T, MaxAge>>>;
+declare function clearJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>): Promise<void>;
+//#endregion
+export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JOSEPayload, JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSHeaderParameters, JWSProtectedHeader, JWSSignOptions, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JoseHeaderParameters, KeyManagementAlgorithm, MaxTokenAge, type SessionClaims, type SessionConfigJWE, type SessionConfigJWS, type SessionData, type SessionHooksJWE, type SessionHooksJWS, type SessionJWE, type SessionJWS, type SessionManager, type SessionUpdate, UnwrapKeyOptions, WrapKeyOptions, WrapKeyResult, clearJWESession, clearJWSSession, deriveJWKFromPassword, exportToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importFromPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };

package/dist/adapters/{h3v2.mjs → h3v2/index.mjs}

@@ -1,9 +1,8 @@
-import { a as deriveJWKFromPassword, c as importJWKFromPEM, d as isSymmetricJWK, f as computeExpiresInSeconds, i as encrypt, l as isPrivateJWK, n as verify, o as exportJWKToPEM, r as decrypt, s as generateJWK, t as sign, u as isPublicJWK } from "../_chunks/jws.mjs";
+import { a as deriveJWKFromPassword, c as importFromPEM, d as isSymmetricJWK, f as computeExpiresInSeconds, i as encrypt, l as isPrivateJWK, m as isJWTError, n as verify, o as exportToPEM, p as JWTError, r as decrypt, s as generateJWK, t as sign, u as isPublicJWK } from "../../_chunks/jws.mjs";
 import { getChunkedCookie, getEventContext, setChunkedCookie } from "h3";
 import { NullProtoObj } from "rou3";
 //#region src/adapters/h3v2/session/jwe.ts
 const kGetSessionPromise$1 = Symbol("h3_jwe_getSession");
-const kSessionToken$1 = Symbol("h3_jwe_sessionToken");
 const DEFAULT_NAME$1 = "h3-jwe";
 const DEFAULT_COOKIE$1 = {
 	path: "/",
@@ -30,7 +29,7 @@ async function useJWESession(event, config) {
 			return getSessionFromContext$1(event, sessionName)?.data || {};
 		},
 		get token() {
-			return getSessionFromContext$1(event, sessionName)?.[kSessionToken$1] ?? getJWESessionToken(event, config);
+			return getSessionFromContext$1(event, sessionName)?.token ?? getJWESessionToken(event, config);
 		},
 		update: async (update) => {
 			await updateJWESession(event, config, update);
@@ -60,15 +59,42 @@ async function getJWESession(event, config) {
 		*/
 		if (session.expiresAt !== void 0 && session.expiresAt < Date.now()) {
 			await config.hooks?.onExpire?.({
+				session: {
+					id: session.id,
+					createdAt: session.createdAt,
+					expiresAt: session.expiresAt,
+					token: session.token
+				},
 				event,
-				error: /* @__PURE__ */ new Error(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(session.expiresAt * 1e3)).toISOString()})`),
+				error: new JWTError(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(session.expiresAt * 1e3)).toISOString()})`, "ERR_JWT_EXPIRED", {
+					jti: session.id,
+					exp: session.expiresAt / 1e3
+				}),
 				config
 			});
-			return clearJWESession(event, config).then(() => getJWESession(event, config));
+			delete context.sessions[sessionName];
+			if (config.cookie !== false) if (hasWritableResponse$1(event)) setChunkedCookie(event, sessionName, "", {
+				...DEFAULT_COOKIE$1,
+				...config.cookie,
+				expires: /* @__PURE__ */ new Date(0),
+				maxAge: void 0
+			});
+			else console.warn("[unjwt/h3] Session expired but cookie cannot be cleared on a read-only event.");
+			const freshNow = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
+			const freshCreatedAt = freshNow - freshNow % 1e3;
+			const freshSession = {
+				id: void 0,
+				createdAt: freshCreatedAt,
+				expiresAt: config.maxAge === void 0 ? void 0 : freshCreatedAt + computeExpiresInSeconds(config.maxAge) * 1e3,
+				data: new NullProtoObj(),
+				token: void 0
+			};
+			context.sessions[sessionName] = freshSession;
+			return freshSession;
 		}
-		await config.hooks?.onRead?.({
-			event,
+		if (session.id !== void 0 && session.token !== void 0) await config.hooks?.onRead?.({
 			session,
+			event,
 			config
 		});
 		return session;
@@ -79,25 +105,29 @@ async function getJWESession(event, config) {
 		id: void 0,
 		createdAt,
 		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3,
-		data: new NullProtoObj()
+		data: new NullProtoObj(),
+		token: void 0
 	};
 	context.sessions[sessionName] = session;
 	const token = getJWESessionToken(event, config);
+	let exclusiveHookFired = false;
 	if (token) {
-		session[kSessionToken$1] = token;
+		session.token = token;
 		const promise = unsealJWESession(event, config, token).catch(async (error_) => {
-			if (error_ instanceof Error) {
-				const message = error_.message;
-				if (message.includes("Token has expired") || message.includes("Token is too old")) {
-					await config.hooks?.onExpire?.({
-						event,
-						error: error_,
-						config
-					});
-					return;
-				}
-			}
-			await config.hooks?.onError?.({
+			exclusiveHookFired = true;
+			if (isJWTError(error_, "ERR_JWT_EXPIRED")) await config.hooks?.onExpire?.({
+				session: {
+					id: error_.cause.jti,
+					createdAt: error_.cause.iat ? error_.cause.iat * 1e3 : void 0,
+					expiresAt: error_.cause.exp ? error_.cause.exp * 1e3 : void 0,
+					token
+				},
+				event,
+				error: error_,
+				config
+			});
+			else await config.hooks?.onError?.({
+				session,
 				event,
 				error: error_,
 				config
@@ -110,9 +140,9 @@ async function getJWESession(event, config) {
 		session[kGetSessionPromise$1] = promise;
 		await promise;
 	}
-	await config.hooks?.onRead?.({
-		event,
+	if (!exclusiveHookFired && session.id !== void 0 && session.token !== void 0) await config.hooks?.onRead?.({
 		session,
+		event,
 		config
 	});
 	return session;
@@ -136,6 +166,8 @@ function getJWESessionToken(event, config) {
 * Update the session data for the current request.
 */
 async function updateJWESession(event, config, update) {
+	const canWriteCookie = hasWritableResponse$1(event);
+	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot update session on read-only event.");
 	const sessionName = config.name || DEFAULT_NAME$1;
 	const session = getEventContext(event).sessions?.[sessionName] || await getJWESession(event, config);
 	if (typeof update === "function") update = update(session.data);
@@ -151,21 +183,36 @@ async function updateJWESession(event, config, update) {
 		createdAt,
 		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3
 	});
-	if (config.cookie !== false && hasWritableResponse$1(event)) {
-		const sealed = await sealJWESession(event, config);
-		session[kSessionToken$1] = sealed;
-		setChunkedCookie(event, sessionName, sealed, {
-			...DEFAULT_COOKIE$1,
-			expires: config.maxAge === void 0 ? void 0 : new Date(session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3),
-			...config.cookie
+	let sealed;
+	try {
+		sealed = await sealJWESession(event, config);
+	} catch (error_) {
+		Object.assign(session, {
+			id: oldSession.id,
+			createdAt: oldSession.createdAt,
+			expiresAt: oldSession.expiresAt
 		});
-		await config.hooks?.onUpdate?.({
-			oldSession,
+		session.token = oldSession.token;
+		await config.hooks?.onError?.({
 			session,
 			event,
+			error: error_,
 			config
 		});
+		throw error_;
 	}
+	session.token = sealed;
+	if (config.cookie !== false && canWriteCookie) setChunkedCookie(event, sessionName, sealed, {
+		...DEFAULT_COOKIE$1,
+		expires: config.maxAge === void 0 ? void 0 : new Date(session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3),
+		...config.cookie
+	});
+	await config.hooks?.onUpdate?.({
+		session,
+		oldSession,
+		event,
+		config
+	});
 	return session;
 }
 /**
@@ -222,7 +269,7 @@ async function unsealJWESession(event, config, sealed) {
 		unwrappedKeyAlgorithm: void 0,
 		keyUsage: void 0,
 		forceUint8Array: false,
-		validateJWT: true
+		validateClaims: true
 	}).catch((error_) => {
 		if (error_ instanceof Error) throw error_;
 		throw new Error(String(error_));
@@ -239,24 +286,28 @@ async function unsealJWESession(event, config, sealed) {
 * Clear the session (delete from context and drop cookie).
 */
 async function clearJWESession(event, config) {
+	const canWriteCookie = hasWritableResponse$1(event);
+	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot clear session on read-only event.");
 	const context = getEventContext(event);
 	const sessionName = config.name || DEFAULT_NAME$1;
 	let session = context.sessions?.[sessionName];
 	if (session && session[kGetSessionPromise$1]) session = await session[kGetSessionPromise$1];
+	const oldSession = session ? {
+		...session,
+		data: { ...session.data }
+	} : void 0;
 	if (context.sessions?.[sessionName]) delete context.sessions[sessionName];
-	if (config.cookie !== false && hasWritableResponse$1(event)) {
-		setChunkedCookie(event, sessionName, "", {
-			...DEFAULT_COOKIE$1,
-			...config.cookie,
-			expires: /* @__PURE__ */ new Date(0),
-			maxAge: void 0
-		});
-		await config.hooks?.onClear?.({
-			session,
-			event,
-			config
-		});
-	}
+	if (config.cookie !== false && canWriteCookie) setChunkedCookie(event, sessionName, "", {
+		...DEFAULT_COOKIE$1,
+		...config.cookie,
+		expires: /* @__PURE__ */ new Date(0),
+		maxAge: void 0
+	});
+	await config.hooks?.onClear?.({
+		oldSession,
+		event,
+		config
+	});
 }
 function getSessionFromContext$1(event, sessionName) {
 	return getEventContext(event).sessions?.[sessionName];
@@ -291,7 +342,6 @@ function findSetCookie$1(setCookie, name) {
 //#endregion
 //#region src/adapters/h3v2/session/jws.ts
 const kGetSessionPromise = Symbol("h3_jws_getSession");
-const kSessionToken = Symbol("h3_jws_sessionToken");
 const DEFAULT_NAME = "h3-jws";
 const DEFAULT_COOKIE = {
 	path: "/",
@@ -315,7 +365,7 @@ async function useJWSSession(event, config) {
 			return getSessionFromContext(event, sessionName)?.data || {};
 		},
 		get token() {
-			return getSessionFromContext(event, sessionName)?.[kSessionToken] ?? getJWSSessionToken(event, config);
+			return getSessionFromContext(event, sessionName)?.token ?? getJWSSessionToken(event, config);
 		},
 		update: async (update) => {
 			await updateJWSSession(event, config, update);
@@ -337,15 +387,42 @@ async function getJWSSession(event, config) {
 		const session = existingSession[kGetSessionPromise] ? await existingSession[kGetSessionPromise] : existingSession;
 		if (session.expiresAt !== void 0 && session.expiresAt < Date.now()) {
 			await config.hooks?.onExpire?.({
+				session: {
+					id: session.id,
+					createdAt: session.createdAt,
+					expiresAt: session.expiresAt,
+					token: session.token
+				},
 				event,
-				error: /* @__PURE__ */ new Error(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(session.expiresAt * 1e3)).toISOString()})`),
+				error: new JWTError(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(session.expiresAt * 1e3)).toISOString()})`, "ERR_JWT_EXPIRED", {
+					jti: session.id,
+					exp: session.expiresAt / 1e3
+				}),
 				config
 			});
-			return clearJWSSession(event, config).then(() => getJWSSession(event, config));
+			delete context.sessions[sessionName];
+			if (config.cookie !== false) if (hasWritableResponse(event)) setChunkedCookie(event, sessionName, "", {
+				...DEFAULT_COOKIE,
+				...config.cookie,
+				expires: /* @__PURE__ */ new Date(0),
+				maxAge: void 0
+			});
+			else console.warn("[unjwt/h3] Session expired but cookie cannot be cleared on a read-only event.");
+			const freshNow = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
+			const freshCreatedAt = freshNow - freshNow % 1e3;
+			const freshSession = {
+				id: void 0,
+				createdAt: freshCreatedAt,
+				expiresAt: config.maxAge === void 0 ? void 0 : freshCreatedAt + computeExpiresInSeconds(config.maxAge) * 1e3,
+				data: new NullProtoObj(),
+				token: void 0
+			};
+			context.sessions[sessionName] = freshSession;
+			return freshSession;
 		}
-		await config.hooks?.onRead?.({
-			event,
+		if (session.id !== void 0 && session.token !== void 0) await config.hooks?.onRead?.({
 			session,
+			event,
 			config
 		});
 		return session;
@@ -356,22 +433,29 @@ async function getJWSSession(event, config) {
 		id: void 0,
 		createdAt,
 		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3,
-		data: new NullProtoObj()
+		data: new NullProtoObj(),
+		token: void 0
 	};
 	context.sessions[sessionName] = session;
 	const token = getJWSSessionToken(event, config);
+	let exclusiveHookFired = false;
 	if (token) {
-		session[kSessionToken] = token;
+		session.token = token;
 		const promise = verifyJWSSession(event, config, token).catch(async (error_) => {
-			if (error_ instanceof Error && (error_.message.includes("Token has expired") || error_.message.includes("Token is too old"))) {
-				await config.hooks?.onExpire?.({
-					event,
-					error: error_,
-					config
-				});
-				return;
-			}
-			await config.hooks?.onError?.({
+			exclusiveHookFired = true;
+			if (isJWTError(error_, "ERR_JWT_EXPIRED")) await config.hooks?.onExpire?.({
+				session: {
+					id: error_.cause.jti,
+					createdAt: error_.cause.iat ? error_.cause.iat * 1e3 : void 0,
+					expiresAt: error_.cause.exp ? error_.cause.exp * 1e3 : void 0,
+					token
+				},
+				event,
+				error: error_,
+				config
+			});
+			else await config.hooks?.onError?.({
+				session,
 				event,
 				error: error_,
 				config
@@ -384,9 +468,9 @@ async function getJWSSession(event, config) {
 		session[kGetSessionPromise] = promise;
 		await promise;
 	}
-	await config.hooks?.onRead?.({
-		event,
+	if (!exclusiveHookFired && session.id !== void 0 && session.token !== void 0) await config.hooks?.onRead?.({
 		session,
+		event,
 		config
 	});
 	return session;
@@ -407,6 +491,8 @@ function getJWSSessionToken(event, config) {
 	return token;
 }
 async function updateJWSSession(event, config, update) {
+	const canWriteCookie = hasWritableResponse(event);
+	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot update session on read-only event.");
 	const sessionName = config.name || DEFAULT_NAME;
 	const session = getEventContext(event).sessions?.[sessionName] || await getJWSSession(event, config);
 	if (typeof update === "function") update = update(session.data);
@@ -422,21 +508,36 @@ async function updateJWSSession(event, config, update) {
 		createdAt,
 		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3
 	});
-	if (config.cookie !== false && hasWritableResponse(event)) {
-		const token = await signJWSSession(event, config);
-		session[kSessionToken] = token;
-		setChunkedCookie(event, sessionName, token, {
-			...DEFAULT_COOKIE,
-			expires: config.maxAge === void 0 ? void 0 : new Date(session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3),
-			...config.cookie
+	let token;
+	try {
+		token = await signJWSSession(event, config);
+	} catch (error_) {
+		Object.assign(session, {
+			id: oldSession.id,
+			createdAt: oldSession.createdAt,
+			expiresAt: oldSession.expiresAt
 		});
-		await config.hooks?.onUpdate?.({
+		session.token = oldSession.token;
+		await config.hooks?.onError?.({
 			session,
-			oldSession,
 			event,
+			error: error_,
 			config
 		});
+		throw error_;
 	}
+	session.token = token;
+	if (config.cookie !== false && canWriteCookie) setChunkedCookie(event, sessionName, token, {
+		...DEFAULT_COOKIE,
+		expires: config.maxAge === void 0 ? void 0 : new Date(session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3),
+		...config.cookie
+	});
+	await config.hooks?.onUpdate?.({
+		session,
+		oldSession,
+		event,
+		config
+	});
 	return session;
 }
 async function signJWSSession(event, config) {
@@ -483,8 +584,9 @@ async function verifyJWSSession(event, config, token) {
 		typ: typ || "JWT",
 		algorithms: alg ? [alg] : void 0,
 		forceUint8Array: false,
-		validateJWT: true
+		validateClaims: true
 	}).catch((error_) => {
+		if (isJWTError(error_, "ERR_JWT_EXPIRED")) throw error_;
 		const message = error_ instanceof Error ? error_.message : String(error_);
 		throw new Error(`Invalid session token: ${message}`);
 	});
@@ -497,24 +599,28 @@ async function verifyJWSSession(event, config, token) {
 	};
 }
 async function clearJWSSession(event, config) {
+	const canWriteCookie = hasWritableResponse(event);
+	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot clear session on read-only event.");
 	const context = getEventContext(event);
 	const sessionName = config.name || DEFAULT_NAME;
 	let session = context.sessions?.[sessionName];
 	if (session && session[kGetSessionPromise]) session = await session[kGetSessionPromise];
+	const oldSession = session ? {
+		...session,
+		data: { ...session.data }
+	} : void 0;
 	if (context.sessions?.[sessionName]) delete context.sessions[sessionName];
-	if (config.cookie !== false && hasWritableResponse(event)) {
-		setChunkedCookie(event, sessionName, "", {
-			...DEFAULT_COOKIE,
-			...config.cookie,
-			expires: /* @__PURE__ */ new Date(0),
-			maxAge: void 0
-		});
-		await config.hooks?.onClear?.({
-			session,
-			event,
-			config
-		});
-	}
+	if (config.cookie !== false && canWriteCookie) setChunkedCookie(event, sessionName, "", {
+		...DEFAULT_COOKIE,
+		...config.cookie,
+		expires: /* @__PURE__ */ new Date(0),
+		maxAge: void 0
+	});
+	await config.hooks?.onClear?.({
+		oldSession,
+		event,
+		config
+	});
 }
 function getSessionFromContext(event, sessionName) {
 	return getEventContext(event).sessions?.[sessionName];
@@ -554,4 +660,4 @@ function findSetCookie(setCookie, name) {
 	return match ? match[1] : void 0;
 }
 //#endregion
-export { clearJWESession, clearJWSSession, deriveJWKFromPassword, exportJWKToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importJWKFromPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+export { clearJWESession, clearJWSSession, deriveJWKFromPassword, exportToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importFromPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };