unjwt 0.6.1 → 0.7.0

package/dist/adapters/h3v1/index.mjs

@@ -1,7 +1,9 @@
-import { a as deriveJWKFromPassword, c as importFromPEM, d as isSymmetricJWK, f as computeExpiresInSeconds, i as encrypt, l as isPrivateJWK, m as isJWTError, n as verify, o as exportToPEM, p as JWTError, r as decrypt, s as generateJWK, t as sign, u as isPublicJWK } from "../../_chunks/jws.mjs";
+import { D as JWTError, O as isJWTError, c as isPrivateJWK, l as isPublicJWK, p as computeDurationInSeconds, u as isSymmetricJWK } from "../../_chunks/utils.mjs";
+import { c as exportPEM, g as importPEM, i as deriveJWKFromPassword, l as exportToPEM, m as importFromPEM, u as generateJWK } from "../../_chunks/jwk.mjs";
+import { n as verify, t as sign } from "../../_chunks/jws.mjs";
+import { n as encrypt, t as decrypt } from "../../_chunks/jwe.mjs";
 import { isEvent, setCookie } from "h3";
 import { parse } from "cookie-es";
-//#region src/adapters/h3v1/session/jwe.ts
 const kGetSessionPromise$1 = Symbol("h3_jwe_getSession");
 const DEFAULT_NAME$1 = "h3-jwe";
 const DEFAULT_COOKIE$1 = {
@@ -9,9 +11,6 @@ const DEFAULT_COOKIE$1 = {
 	secure: true,
 	httpOnly: true
 };
-/**
-* Create a session manager for the current request.
-*/
 async function useJWESession(event, config) {
 	const sessionName = config.name || DEFAULT_NAME$1;
 	await getJWESession(event, config);
@@ -42,20 +41,12 @@ async function useJWESession(event, config) {
 	};
 	return sessionManager;
 }
-/**
-* Get (and lazily initialize) the session for the current request.
-*/
 async function getJWESession(event, config) {
 	const sessionName = config.name || DEFAULT_NAME$1;
 	if (!event.context.sessions) event.context.sessions = Object.create(null);
 	const existingSession = event.context.sessions[sessionName];
 	if (existingSession) {
 		const session = existingSession[kGetSessionPromise$1] ? await existingSession[kGetSessionPromise$1] : existingSession;
-		/**
-		* We check if a session is expired before returning it. If it is expired we clear it and create a new one,
-		* unless we have a read-only event in which case we just return it as it was valid at the time of reading
-		* the cookie/header (like in a websocket upgrade)
-		*/
 		if (session.expiresAt !== void 0 && session.expiresAt < Date.now()) {
 			await config.hooks?.onExpire?.({
 				session: {
@@ -84,7 +75,7 @@ async function getJWESession(event, config) {
 			const freshSession = {
 				id: void 0,
 				createdAt: freshCreatedAt,
-				expiresAt: config.maxAge === void 0 ? void 0 : freshCreatedAt + computeExpiresInSeconds(config.maxAge) * 1e3,
+				expiresAt: config.maxAge === void 0 ? void 0 : freshCreatedAt + computeDurationInSeconds(config.maxAge) * 1e3,
 				data: Object.create(null),
 				token: void 0
 			};
@@ -103,7 +94,7 @@ async function getJWESession(event, config) {
 	const session = {
 		id: void 0,
 		createdAt,
-		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3,
+		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(config.maxAge) * 1e3,
 		data: Object.create(null),
 		token: void 0
 	};
@@ -176,9 +167,6 @@ function _getResHeader$1(event, name) {
 	if (event.node) return event.node?.res.getHeader(name);
 	if (event.response) return event.response.headers?.get(name);
 }
-/**
-* Update the session (optionally mutating the session data) and re-issue the JWE token.
-*/
 async function updateJWESession(event, config, update) {
 	const canWriteCookie = isEvent(event);
 	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot update session on read-only event.");
@@ -195,7 +183,7 @@ async function updateJWESession(event, config, update) {
 	Object.assign(session, {
 		id: config.generateId?.() || crypto.randomUUID(),
 		createdAt,
-		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3
+		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(config.maxAge) * 1e3
 	});
 	let sealed;
 	try {
@@ -219,7 +207,7 @@ async function updateJWESession(event, config, update) {
 	if (config.cookie !== false && canWriteCookie) setCookie(event, sessionName, sealed, {
 		...DEFAULT_COOKIE$1,
 		...config.cookie,
-		expires: config.maxAge === void 0 ? void 0 : new Date(session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3)
+		expires: config.maxAge === void 0 ? void 0 : new Date(session.createdAt + computeDurationInSeconds(config.maxAge) * 1e3)
 	});
 	await config.hooks?.onUpdate?.({
 		session,
@@ -229,16 +217,6 @@ async function updateJWESession(event, config, update) {
 	});
 	return session;
 }
-/**
-* Produce a JWE for the current session.
-* Payload structure:
-* {
-*   jti: string;
-*   iat: number; (seconds)
-*   exp?: number; (seconds)
-*   data: Record<string, any>;
-* }
-*/
 async function sealJWESession(event, config) {
 	const key = getEncryptKey(config.key);
 	const sessionName = config.name || DEFAULT_NAME$1;
@@ -264,9 +242,6 @@ async function sealJWESession(event, config) {
 		}
 	});
 }
-/**
-* Decrypt the JWE and return a Session-compatible object.
-*/
 async function unsealJWESession(event, config, sealed) {
 	const key = config.hooks?.onUnsealKeyLookup ? (header) => config.hooks.onUnsealKeyLookup({
 		header,
@@ -305,9 +280,6 @@ async function unsealJWESession(event, config, sealed) {
 		data: data && typeof data === "object" ? data : Object.create(null)
 	};
 }
-/**
-* Clear the session (delete from context and drop cookie).
-*/
 async function clearJWESession(event, config) {
 	const canWriteCookie = isEvent(event);
 	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot clear session on read-only event.");
@@ -355,8 +327,6 @@ function findSetCookie$1(setCookie, name) {
 	const match = setCookie.match(regex);
 	return match ? match[1] : void 0;
 }
-//#endregion
-//#region src/adapters/h3v1/session/jws.ts
 const kGetSessionPromise = Symbol("h3_jws_getSession");
 const DEFAULT_NAME = "h3-jws";
 const DEFAULT_COOKIE = {
@@ -364,10 +334,6 @@ const DEFAULT_COOKIE = {
 	secure: true,
 	httpOnly: false
 };
-/**
-* Create a session manager for the current request using JWS (signed only, not encrypted).
-* NOTE: Contents are visible to clients (Base64URL-decoded JSON). Do not store secrets in session data.
-*/
 async function useJWSSession(event, config) {
 	const sessionName = config.name || DEFAULT_NAME;
 	await getJWSSession(event, config);
@@ -398,20 +364,12 @@ async function useJWSSession(event, config) {
 	};
 	return sessionManager;
 }
-/**
-* Retrieve (and lazily initialize) the session.
-*/
 async function getJWSSession(event, config) {
 	const sessionName = config.name || DEFAULT_NAME;
 	if (!event.context.sessions) event.context.sessions = Object.create(null);
 	const existingSession = event.context.sessions[sessionName];
 	if (existingSession) {
 		const session = existingSession[kGetSessionPromise] ? await existingSession[kGetSessionPromise] : existingSession;
-		/**
-		* We check if a session is expired before returning it. If it is expired we clear it and create a new one,
-		* unless we have a read-only event in which case we just return it as it was valid at the time of reading
-		* the cookie/header (like in a websocket upgrade)
-		*/
 		if (session.expiresAt !== void 0 && session.expiresAt < Date.now()) {
 			await config.hooks?.onExpire?.({
 				session: {
@@ -440,7 +398,7 @@ async function getJWSSession(event, config) {
 			const freshSession = {
 				id: void 0,
 				createdAt: freshCreatedAt,
-				expiresAt: config.maxAge === void 0 ? void 0 : freshCreatedAt + computeExpiresInSeconds(config.maxAge) * 1e3,
+				expiresAt: config.maxAge === void 0 ? void 0 : freshCreatedAt + computeDurationInSeconds(config.maxAge) * 1e3,
 				data: Object.create(null),
 				token: void 0
 			};
@@ -459,7 +417,7 @@ async function getJWSSession(event, config) {
 	const session = {
 		id: void 0,
 		createdAt,
-		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3,
+		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(config.maxAge) * 1e3,
 		data: Object.create(null),
 		token: void 0
 	};
@@ -532,9 +490,6 @@ function _getResHeader(event, name) {
 	if (event.node) return event.node?.res.getHeader(name);
 	if (event.response) return event.response.headers?.get(name);
 }
-/**
-* Update session data (if provided) and reissue JWS.
-*/
 async function updateJWSSession(event, config, update) {
 	const canWriteCookie = isEvent(event);
 	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot update session on read-only event.");
@@ -551,7 +506,7 @@ async function updateJWSSession(event, config, update) {
 	Object.assign(session, {
 		id: config.generateId?.() || crypto.randomUUID(),
 		createdAt,
-		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3
+		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(config.maxAge) * 1e3
 	});
 	let token;
 	try {
@@ -575,7 +530,7 @@ async function updateJWSSession(event, config, update) {
 	if (config.cookie !== false && canWriteCookie) setCookie(event, sessionName, token, {
 		...DEFAULT_COOKIE,
 		...config.cookie,
-		expires: config.maxAge === void 0 ? void 0 : new Date(session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3)
+		expires: config.maxAge === void 0 ? void 0 : new Date(session.createdAt + computeDurationInSeconds(config.maxAge) * 1e3)
 	});
 	await config.hooks?.onUpdate?.({
 		session,
@@ -585,11 +540,6 @@ async function updateJWSSession(event, config, update) {
 	});
 	return session;
 }
-/**
-* Sign current session as a compact JWS.
-* Payload claims:
-*  jti, iat, exp?, data, plus optional extraClaims (cannot override reserved)
-*/
 async function signJWSSession(event, config) {
 	const key = getSignKey(config.key);
 	const sessionName = config.name || DEFAULT_NAME;
@@ -615,14 +565,6 @@ async function signJWSSession(event, config) {
 		}
 	});
 }
-/**
-* Verify and parse a compact JWS into a Session structure.
-* Performs:
-*  - cryptographic signature verification
-*  - (optional) standard claim checks if validateJWT true
-*  - ensures jti & iat presence
-*  - enforces maxAge if provided
-*/
 async function verifyJWSSession(event, config, token) {
 	const alg = config.jws?.signOptions?.alg;
 	const jwk = config.hooks?.onVerifyKeyLookup ? (header) => config.hooks.onVerifyKeyLookup({
@@ -656,9 +598,6 @@ async function verifyJWSSession(event, config, token) {
 		data: data && typeof data === "object" ? data : Object.create(null)
 	};
 }
-/**
-* Destroy the session (context + cookie).
-*/
 async function clearJWSSession(event, config) {
 	const canWriteCookie = isEvent(event);
 	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot clear session on read-only event.");
@@ -707,5 +646,4 @@ function findSetCookie(setCookie, name) {
 	const match = setCookie.match(regex);
 	return match ? match[1] : void 0;
 }
-//#endregion
-export { clearJWESession, clearJWSSession, deriveJWKFromPassword, exportToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importFromPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+export { clearJWESession, clearJWSSession, deriveJWKFromPassword, exportPEM, exportToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importFromPEM, importPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };

package/dist/adapters/h3v2/index.d.mts

@@ -1,8 +1,7 @@
-import { $ as JWK_HMAC, A as GenerateJWKReturn, B as JWKParameters, C as JWTClaims, D as DeriveKeyOptions, E as ContentEncryptionAlgorithm, F as JWKAlgorithm, G as JWK_AES_KW, H as JWK_AES_CBC_HMAC, I as JWKCacheAdapter, J as JWK_EC, K as JWK_Asymmetric, L as JWKLookupFunction, M as GenerateKeyOptions, N as GenerateKeyReturn, O as DeriveKeyReturn, P as JWK, Q as JWK_EC_Public, R as JWKLookupFunctionHeader, S as JWTClaimValidationOptions, T as CompositeKey, U as JWK_AES_GCM, V as JWKSet, W as JWK_AES_GCM_KW, X as JWK_ECDSA, Y as JWK_ECDH_ES, Z as JWK_EC_Private, _ as JWSSignOptions, _t as KeyManagementAlgorithm, a as ExpiresIn, at as JWK_Pair, b as JOSEPayload, bt as WrapKeyResult, c as JWEDecryptResult, ct as JWK_RSA, d as JWEKeyManagementHeaderParameters, dt as JWK_RSA_Private, et as JWK_OKP, f as JWEProtectedHeader, ft as JWK_RSA_Public, g as JWSProtectedHeader, gt as JWK_oct, h as JWSHeaderParameters, ht as JWK_Symmetric_Algorithm, i as importFromPEM, it as JWK_PBES2, j as GenerateKeyAlgorithm, k as GenerateJWKOptions, l as JWEEncryptOptions, lt as JWK_RSA_ENC, m as JWSAlgorithm, mt as JWK_Symmetric, n as exportToPEM, nt as JWK_OKP_Public, o as MaxTokenAge, ot as JWK_Private, p as StrictOmit, pt as JWK_RSA_SIGN, q as JWK_Asymmetric_Algorithm, r as generateJWK, rt as JWK_OKP_SIGN, s as JWEDecryptOptions, st as JWK_Public, t as deriveJWKFromPassword, tt as JWK_OKP_Private, u as JWEHeaderParameters, ut as JWK_RSA_PSS, v as JWSVerifyOptions, vt as UnwrapKeyOptions, w as JoseHeaderParameters, x as JWT, y as JWSVerifyResult, yt as WrapKeyOptions, z as JWKPEMAlgorithm } from "../../_chunks/jwk.mjs";
+import { $ as JWKAlgorithm, A as JWSSignOptions, At as JWK_RSA_Public, B as JWTClaimValidationOptions, C as JWSMultiSignOptions, Ct as JWK_Pair, D as JWSMultiVerifyOutcome, Dt as JWK_RSA_ENC, E as JWSMultiVerifyOptions, Et as JWK_RSA, Ft as KeyManagementAlgorithm, G as DeriveKeyOptions, H as JoseHeaderParameters, It as UnwrapKeyOptions, J as GenerateJWKReturn, K as DeriveKeyReturn, Lt as WrapKeyOptions, M as JWSVerifyResult, Mt as JWK_Symmetric, N as StrictOmit, Nt as JWK_Symmetric_Algorithm, O as JWSMultiVerifyResult, Ot as JWK_RSA_PSS, Pt as JWK_oct, Q as JWK, R as JOSEPayload, Rt as WrapKeyResult, S as JWSHeaderParameters, St as JWK_PBES2, T as JWSMultiVerifyAllOptions, Tt as JWK_Public, U as CompositeKey, V as JWTClaims, W as ContentEncryptionAlgorithm, X as GenerateKeyOptions, Y as GenerateKeyAlgorithm, Z as GenerateKeyReturn, _ as JWEProtectedHeader, _t as JWK_HMAC, a as JWEDecryptOptions, at as JWKSet, b as JWSGeneralSerialization, bt as JWK_OKP_Public, c as JWEFlattenedSerialization, ct as JWK_AES_GCM_KW, d as JWEHeaderParameters, dt as JWK_Asymmetric_Algorithm, et as JWKCacheAdapter, f as JWEKeyManagementHeaderParameters, ft as JWK_EC, g as JWEMultiRecipient, gt as JWK_EC_Public, h as JWEMultiEncryptOptions, ht as JWK_EC_Private, i as NotBeforeIn, it as JWKParameters, j as JWSVerifyOptions, jt as JWK_RSA_SIGN, k as JWSProtectedHeader, kt as JWK_RSA_Private, l as JWEGeneralRecipient, lt as JWK_AES_KW, m as JWEMultiDecryptResult, mt as JWK_ECDSA, n as ExpiresIn, nt as JWKLookupFunctionHeader, o as JWEDecryptResult, ot as JWK_AES_CBC_HMAC, p as JWEMultiDecryptOptions, pt as JWK_ECDH_ES, q as GenerateJWKOptions, r as MaxTokenAge, rt as JWKPEMAlgorithm, s as JWEEncryptOptions, st as JWK_AES_GCM, t as Duration, tt as JWKLookupFunction, u as JWEGeneralSerialization, ut as JWK_Asymmetric, v as JWSAlgorithm, vt as JWK_OKP, w as JWSMultiSigner, wt as JWK_Private, x as JWSGeneralSignature, xt as JWK_OKP_SIGN, y as JWSFlattenedSerialization, yt as JWK_OKP_Private, z as JWT } from "../../_chunks/index.mjs";
+import { deriveJWKFromPassword, exportPEM, exportToPEM, generateJWK, importFromPEM, importPEM } from "../../core/jwk.mjs";
 import { H3Event, HTTPEvent } from "h3";
 import { CookieSerializeOptions } from "cookie-es";
-
-//#region src/adapters/h3v2/session/types.d.ts
 interface SessionClaims extends Required<Pick<JWTClaims, "jti" | "iat">>, StrictOmit<JWTClaims, "jti" | "iat"> {}
 type SessionData<T extends Record<string, any> = SessionClaims> = StrictOmit<T, "jti" | "iat" | "exp">;
 type SessionUpdate<T extends Record<string, any> = SessionClaims> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
@@ -15,12 +14,13 @@ interface SessionManager<T extends Record<string, any> = SessionClaims, ConfigMa
   update: (update?: SessionUpdate<T>) => Promise<SessionManager<T, ConfigMaxAge>>;
   clear: () => Promise<SessionManager<T, ConfigMaxAge>>;
 }
-//#endregion
-//#region src/adapters/h3v2/session/jwe.d.ts
 declare const kGetSessionPromise$1: unique symbol;
 interface SessionJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  /** Session ID — mirrors the JWT `jti` claim. `undefined` until the session is persisted. */
   id: string | undefined;
+  /** Session creation time in ms — mirrors the JWT `iat` claim (seconds). */
   createdAt: number;
+  /** Session expiry time in ms — mirrors the JWT `exp` claim (seconds). */
   expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
   data: SessionData<T>;
   token: string | undefined;
@@ -125,12 +125,13 @@ declare function unsealJWESession<T extends Record<string, any> = SessionClaims,
 * Clear the session (delete from context and drop cookie).
 */
 declare function clearJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>): Promise<void>;
-//#endregion
-//#region src/adapters/h3v2/session/jws.d.ts
 declare const kGetSessionPromise: unique symbol;
 interface SessionJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
+  /** Session ID — mirrors the JWT `jti` claim. `undefined` until the session is persisted. */
   id: string | undefined;
+  /** Session creation time in ms — mirrors the JWT `iat` claim (seconds). */
   createdAt: number;
+  /** Session expiry time in ms — mirrors the JWT `exp` claim (seconds). */
   expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
   data: SessionData<T>;
   token: string | undefined;
@@ -209,5 +210,4 @@ declare function updateJWSSession<T extends Record<string, any> = SessionClaims,
 declare function signJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>): Promise<string>;
 declare function verifyJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>, token: string): Promise<Partial<SessionJWS<T, MaxAge>>>;
 declare function clearJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>): Promise<void>;
-//#endregion
-export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JOSEPayload, JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSHeaderParameters, JWSProtectedHeader, JWSSignOptions, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JoseHeaderParameters, KeyManagementAlgorithm, MaxTokenAge, type SessionClaims, type SessionConfigJWE, type SessionConfigJWS, type SessionData, type SessionHooksJWE, type SessionHooksJWS, type SessionJWE, type SessionJWS, type SessionManager, type SessionUpdate, UnwrapKeyOptions, WrapKeyOptions, WrapKeyResult, clearJWESession, clearJWSSession, deriveJWKFromPassword, exportToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importFromPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, Duration, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JOSEPayload, JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHeaderParameters, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignOptions, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JoseHeaderParameters, KeyManagementAlgorithm, MaxTokenAge, NotBeforeIn, type SessionClaims, type SessionConfigJWE, type SessionConfigJWS, type SessionData, type SessionHooksJWE, type SessionHooksJWS, type SessionJWE, type SessionJWS, type SessionManager, type SessionUpdate, UnwrapKeyOptions, WrapKeyOptions, WrapKeyResult, clearJWESession, clearJWSSession, deriveJWKFromPassword, exportPEM, exportToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importFromPEM, importPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };

package/dist/adapters/h3v2/index.mjs

@@ -1,7 +1,9 @@
-import { a as deriveJWKFromPassword, c as importFromPEM, d as isSymmetricJWK, f as computeExpiresInSeconds, i as encrypt, l as isPrivateJWK, m as isJWTError, n as verify, o as exportToPEM, p as JWTError, r as decrypt, s as generateJWK, t as sign, u as isPublicJWK } from "../../_chunks/jws.mjs";
+import { D as JWTError, O as isJWTError, c as isPrivateJWK, l as isPublicJWK, p as computeDurationInSeconds, u as isSymmetricJWK } from "../../_chunks/utils.mjs";
+import { c as exportPEM, g as importPEM, i as deriveJWKFromPassword, l as exportToPEM, m as importFromPEM, u as generateJWK } from "../../_chunks/jwk.mjs";
+import { n as verify, t as sign } from "../../_chunks/jws.mjs";
+import { n as encrypt, t as decrypt } from "../../_chunks/jwe.mjs";
+import { t as NullProtoObj } from "../../_chunks/libs/rou3.mjs";
 import { getChunkedCookie, getEventContext, setChunkedCookie } from "h3";
-import { NullProtoObj } from "rou3";
-//#region src/adapters/h3v2/session/jwe.ts
 const kGetSessionPromise$1 = Symbol("h3_jwe_getSession");
 const DEFAULT_NAME$1 = "h3-jwe";
 const DEFAULT_COOKIE$1 = {
@@ -9,9 +11,6 @@ const DEFAULT_COOKIE$1 = {
 	secure: true,
 	httpOnly: true
 };
-/**
-* Create a session manager for the current request.
-*/
 async function useJWESession(event, config) {
 	const sessionName = config.name || DEFAULT_NAME$1;
 	await getJWESession(event, config);
@@ -42,9 +41,6 @@ async function useJWESession(event, config) {
 	};
 	return sessionManager;
 }
-/**
-* Get the session for the current request.
-*/
 async function getJWESession(event, config) {
 	const sessionName = config.name || DEFAULT_NAME$1;
 	const context = getEventContext(event);
@@ -52,11 +48,6 @@ async function getJWESession(event, config) {
 	const existingSession = context.sessions[sessionName];
 	if (existingSession) {
 		const session = existingSession[kGetSessionPromise$1] ? await existingSession[kGetSessionPromise$1] : existingSession;
-		/**
-		* We check if a session is expired before returning it. If it is expired we clear it and create a new one,
-		* unless we have a read-only event in which case we just return it as it was valid at the time of reading
-		* the cookie/header (like in a websocket upgrade)
-		*/
 		if (session.expiresAt !== void 0 && session.expiresAt < Date.now()) {
 			await config.hooks?.onExpire?.({
 				session: {
@@ -85,7 +76,7 @@ async function getJWESession(event, config) {
 			const freshSession = {
 				id: void 0,
 				createdAt: freshCreatedAt,
-				expiresAt: config.maxAge === void 0 ? void 0 : freshCreatedAt + computeExpiresInSeconds(config.maxAge) * 1e3,
+				expiresAt: config.maxAge === void 0 ? void 0 : freshCreatedAt + computeDurationInSeconds(config.maxAge) * 1e3,
 				data: new NullProtoObj(),
 				token: void 0
 			};
@@ -104,7 +95,7 @@ async function getJWESession(event, config) {
 	const session = {
 		id: void 0,
 		createdAt,
-		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3,
+		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(config.maxAge) * 1e3,
 		data: new NullProtoObj(),
 		token: void 0
 	};
@@ -162,9 +153,6 @@ function getJWESessionToken(event, config) {
 	if (!token) token = getChunkedCookie(event, sessionName);
 	return token;
 }
-/**
-* Update the session data for the current request.
-*/
 async function updateJWESession(event, config, update) {
 	const canWriteCookie = hasWritableResponse$1(event);
 	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot update session on read-only event.");
@@ -181,7 +169,7 @@ async function updateJWESession(event, config, update) {
 	Object.assign(session, {
 		id: config.generateId?.() || crypto.randomUUID(),
 		createdAt,
-		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3
+		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(config.maxAge) * 1e3
 	});
 	let sealed;
 	try {
@@ -204,7 +192,7 @@ async function updateJWESession(event, config, update) {
 	session.token = sealed;
 	if (config.cookie !== false && canWriteCookie) setChunkedCookie(event, sessionName, sealed, {
 		...DEFAULT_COOKIE$1,
-		expires: config.maxAge === void 0 ? void 0 : new Date(session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3),
+		expires: config.maxAge === void 0 ? void 0 : new Date(session.createdAt + computeDurationInSeconds(config.maxAge) * 1e3),
 		...config.cookie
 	});
 	await config.hooks?.onUpdate?.({
@@ -215,9 +203,6 @@ async function updateJWESession(event, config, update) {
 	});
 	return session;
 }
-/**
-* Produce a JWE for the current session.
-*/
 async function sealJWESession(event, config) {
 	const key = getEncryptKey(config.key);
 	const sessionName = config.name || DEFAULT_NAME$1;
@@ -242,9 +227,6 @@ async function sealJWESession(event, config) {
 		}
 	});
 }
-/**
-* Decrypt the JWE and return a Session-compatible object.
-*/
 async function unsealJWESession(event, config, sealed) {
 	const key = config.hooks?.onUnsealKeyLookup ? (header) => config.hooks.onUnsealKeyLookup({
 		header,
@@ -282,9 +264,6 @@ async function unsealJWESession(event, config, sealed) {
 		data: data && typeof data === "object" ? data : new NullProtoObj()
 	};
 }
-/**
-* Clear the session (delete from context and drop cookie).
-*/
 async function clearJWESession(event, config) {
 	const canWriteCookie = hasWritableResponse$1(event);
 	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot clear session on read-only event.");
@@ -339,8 +318,6 @@ function findSetCookie$1(setCookie, name) {
 	const match = setCookie.match(regex);
 	return match ? match[1] : void 0;
 }
-//#endregion
-//#region src/adapters/h3v2/session/jws.ts
 const kGetSessionPromise = Symbol("h3_jws_getSession");
 const DEFAULT_NAME = "h3-jws";
 const DEFAULT_COOKIE = {
@@ -413,7 +390,7 @@ async function getJWSSession(event, config) {
 			const freshSession = {
 				id: void 0,
 				createdAt: freshCreatedAt,
-				expiresAt: config.maxAge === void 0 ? void 0 : freshCreatedAt + computeExpiresInSeconds(config.maxAge) * 1e3,
+				expiresAt: config.maxAge === void 0 ? void 0 : freshCreatedAt + computeDurationInSeconds(config.maxAge) * 1e3,
 				data: new NullProtoObj(),
 				token: void 0
 			};
@@ -432,7 +409,7 @@ async function getJWSSession(event, config) {
 	const session = {
 		id: void 0,
 		createdAt,
-		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3,
+		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(config.maxAge) * 1e3,
 		data: new NullProtoObj(),
 		token: void 0
 	};
@@ -506,7 +483,7 @@ async function updateJWSSession(event, config, update) {
 	Object.assign(session, {
 		id: config.generateId?.() || crypto.randomUUID(),
 		createdAt,
-		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeExpiresInSeconds(config.maxAge) * 1e3
+		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(config.maxAge) * 1e3
 	});
 	let token;
 	try {
@@ -529,7 +506,7 @@ async function updateJWSSession(event, config, update) {
 	session.token = token;
 	if (config.cookie !== false && canWriteCookie) setChunkedCookie(event, sessionName, token, {
 		...DEFAULT_COOKIE,
-		expires: config.maxAge === void 0 ? void 0 : new Date(session.createdAt + computeExpiresInSeconds(config.maxAge) * 1e3),
+		expires: config.maxAge === void 0 ? void 0 : new Date(session.createdAt + computeDurationInSeconds(config.maxAge) * 1e3),
 		...config.cookie
 	});
 	await config.hooks?.onUpdate?.({
@@ -659,5 +636,4 @@ function findSetCookie(setCookie, name) {
 	const match = setCookie.match(regex);
 	return match ? match[1] : void 0;
 }
-//#endregion
-export { clearJWESession, clearJWSSession, deriveJWKFromPassword, exportToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importFromPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+export { clearJWESession, clearJWSSession, deriveJWKFromPassword, exportPEM, exportToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importFromPEM, importPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };

package/dist/core/jwe.d.mts

@@ -1,40 +1,3 @@
-import { A as JWK, L as JWKSet, N as JWKLookupFunction, S as ContentEncryptionAlgorithm, a as JWEEncryptOptions, c as JWEProtectedHeader, g as JOSEPayload, i as JWEDecryptResult, nt as JWK_Private, o as JWEHeaderParameters, pt as KeyManagementAlgorithm, r as JWEDecryptOptions, s as JWEKeyManagementHeaderParameters, ut as JWK_Symmetric } from "../_chunks/index.mjs";
-import { i as isJWTError, n as JWTErrorCauseMap, r as JWTErrorCode, t as JWTError } from "../_chunks/error.mjs";
-
-//#region src/core/jwe.d.ts
-/**
-* Encrypts a payload to produce a JWE Compact Serialization string.
-*
-* @param payload The payload to encrypt. Can be a string, Uint8Array, or a JSON-serializable object.
-* @param key The key encryption key (KEK). Can be a CryptoKey, JWK, or for PBES2, a password string/Uint8Array.
-* @param options JWE encryption options, including `alg` (key management algorithm) and `enc` (content encryption algorithm).
-* @returns A Promise resolving to the JWE Compact Serialization string.
-*/
-declare function encrypt(payload: JOSEPayload, key: JWK | string | Uint8Array<ArrayBuffer>, options?: JWEEncryptOptions): Promise<string>;
-declare function encrypt(payload: JOSEPayload, key: CryptoKey | JWK_Symmetric | Uint8Array<ArrayBuffer>, options: JWEEncryptOptions & {
-  alg: "dir";
-  enc: ContentEncryptionAlgorithm;
-}): Promise<string>;
-declare function encrypt(payload: JOSEPayload, key: CryptoKey, options: JWEEncryptOptions & {
-  alg: KeyManagementAlgorithm;
-  enc: ContentEncryptionAlgorithm;
-}): Promise<string>;
-declare function encrypt(payload: JOSEPayload, key: CryptoKey | JWK | string | Uint8Array<ArrayBuffer>, options: JWEEncryptOptions & {
-  alg: KeyManagementAlgorithm;
-  enc: ContentEncryptionAlgorithm;
-}): Promise<string>;
-/**
-* Decrypts a JWE Compact Serialization string.
-*
-* @param jwe The JWE Compact Serialization string.
-* @param key The key decryption key (KEK) or a function to look up the key.
-* @param options JWE decryption options.
-* @returns A Promise resolving to an object containing the decrypted plaintext, protected header, CEK, and AAD.
-* @throws If JWE is invalid, decryption fails, or options are not met.
-*/
-declare function decrypt<T extends JOSEPayload>(jwe: string, key: CryptoKey | JWKSet | JWK_Private | JWK_Symmetric | string | Uint8Array<ArrayBuffer> | JWKLookupFunction, options?: JWEDecryptOptions): Promise<JWEDecryptResult<T>>;
-declare function decrypt(jwe: string, key: CryptoKey | JWKSet | JWK_Private | JWK_Symmetric | string | Uint8Array<ArrayBuffer> | JWKLookupFunction, options: JWEDecryptOptions & {
-  forceUint8Array: true;
-}): Promise<JWEDecryptResult<Uint8Array<ArrayBuffer>>>;
-//#endregion
-export { JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEProtectedHeader, JWTError, type JWTErrorCauseMap, type JWTErrorCode, decrypt, encrypt, isJWTError };
+import { F as JWTErrorCauseMap, I as JWTErrorCode, L as isJWTError, P as JWTError, _ as JWEProtectedHeader, a as JWEDecryptOptions, c as JWEFlattenedSerialization, d as JWEHeaderParameters, f as JWEKeyManagementHeaderParameters, g as JWEMultiRecipient, h as JWEMultiEncryptOptions, l as JWEGeneralRecipient, m as JWEMultiDecryptResult, o as JWEDecryptResult, p as JWEMultiDecryptOptions, s as JWEEncryptOptions, u as JWEGeneralSerialization } from "../_chunks/index.mjs";
+import { a as generalToFlattened, i as encryptMulti, n as encrypt, r as decryptMulti, t as decrypt } from "../_chunks/jwe.mjs";
+export { JWEDecryptOptions, JWEDecryptResult, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWTError, JWTErrorCauseMap, JWTErrorCode, decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened, isJWTError };