unjwt 0.7.1 → 0.7.3

package/dist/adapters/h3v2/index.d.mts

@@ -1,4 +1,4 @@
-import { $ as DeriveKeyOptions, A as JWSMultiSigner, At as JWK_PBES2, B as JWSVerifyResult, Bt as JWK_Symmetric, C as JWSAsymmetricPrivateJWK, Ct as JWK_EC_Private, D as JWSGeneralSignature, Dt as JWK_OKP_Private, E as JWSGeneralSerialization, Et as JWK_OKP, F as JWSProtectedHeader, Ft as JWK_RSA_ENC, Gt as UnwrappingKeyFor, Ht as JWK_oct, I as JWSSignJWK, It as JWK_RSA_PSS, J as JWTClaimValidationOptions, Jt as WrappingKeyFor, K as JOSEPayload, Kt as WrapKeyOptions, L as JWSSignOptions, Lt as JWK_RSA_Private, M as JWSMultiVerifyOptions, Mt as JWK_Private, N as JWSMultiVerifyOutcome, Nt as JWK_Public, O as JWSHeaderParameters, Ot as JWK_OKP_Public, P as JWSMultiVerifyResult, Pt as JWK_RSA, Q as ContentEncryptionAlgorithm, R as JWSVerifyJWK, Rt as JWK_RSA_Public, S as JWSAlgorithm, St as JWK_ECDSA, T as JWSFlattenedSerialization, Tt as JWK_HMAC, Ut as KeyManagementAlgorithm, V as StrictOmit, Vt as JWK_Symmetric_Algorithm, Wt as UnwrapKeyOptions, X as JoseHeaderParameters, Y as JWTClaims, Z as CompositeKey, _ as JWEMultiDecryptOptions, _t as JWK_AES_KW, a as JWEAsymmetricPrivateJWK, at as GenerateKeyReturn, b as JWEMultiRecipient, bt as JWK_EC, c as JWEDecryptOptions, ct as JWKCacheAdapter, d as JWEEncryptOptions, dt as JWKPEMAlgorithm, et as DeriveKeyReturn, f as JWEFlattenedSerialization, ft as JWKParameters, g as JWEKeyManagementHeaderParameters, gt as JWK_AES_GCM_KW, h as JWEHeaderParameters, ht as JWK_AES_GCM, i as NotBeforeIn, it as GenerateKeyOptions, j as JWSMultiVerifyAllOptions, jt as JWK_Pair, k as JWSMultiSignOptions, kt as JWK_OKP_SIGN, l as JWEDecryptResult, lt as JWKLookupFunction, m as JWEGeneralSerialization, mt as JWK_AES_CBC_HMAC, n as ExpiresIn, nt as GenerateJWKReturn, o as JWEAsymmetricPublicJWK, ot as JWK, p as JWEGeneralRecipient, pt as JWKSet, q as JWT, qt as WrapKeyResult, r as MaxTokenAge, rt as GenerateKeyAlgorithm, s as JWEDecryptJWK, st as JWKAlgorithm, t as Duration, tt as GenerateJWKOptions, u as JWEEncryptJWK, ut as JWKLookupFunctionHeader, v as JWEMultiDecryptResult, vt as JWK_Asymmetric, w as JWSAsymmetricPublicJWK, wt as JWK_EC_Public, x as JWEProtectedHeader, xt as JWK_ECDH_ES, y as JWEMultiEncryptOptions, yt as JWK_Asymmetric_Algorithm, z as JWSVerifyOptions, zt as JWK_RSA_SIGN } from "../../_chunks/index.mjs";
+import { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, Duration, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JOSEPayload, JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHeaderParameters, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JoseHeaderParameters, KeyManagementAlgorithm, MaxTokenAge, NotBeforeIn, StrictOmit, UnwrapKeyOptions, UnwrappingKeyFor, WrapKeyOptions, WrapKeyResult, WrappingKeyFor } from "../../_chunks/index.mjs";
 import { deriveJWKFromPassword, exportPEM, exportToPEM, generateJWK, importFromPEM, importPEM } from "../../core/jwk.mjs";
 import { H3Event, HTTPEvent } from "h3";
 import { CookieSerializeOptions } from "cookie-es";
@@ -15,6 +15,10 @@ interface SessionManager<T extends Record<string, any> = SessionClaims, ConfigMa
   clear: () => Promise<SessionManager<T, ConfigMaxAge>>;
 }
 declare const kGetSessionPromise$1: unique symbol;
+/**
+* In-memory session state for the current request, mirroring the claims of
+* the underlying compact JWE token.
+*/
 interface SessionJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
   /** Session ID — mirrors the JWT `jti` claim. `undefined` until the session is persisted. */
   id: string | undefined;
@@ -22,11 +26,23 @@ interface SessionJWE<T extends Record<string, any> = SessionClaims, MaxAge exten
   createdAt: number;
   /** Session expiry time in ms — mirrors the JWT `exp` claim (seconds). */
   expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
+  /** Session data — carried in the token payload, spread at the top level. */
   data: SessionData<T>;
+  /** The current compact JWE token. `undefined` until the session is persisted. */
   token: string | undefined;
   [kGetSessionPromise$1]?: Promise<SessionJWE<T, MaxAge>>;
 }
+/**
+* Lifecycle hooks for JWE sessions. `onRead`, `onExpire`, and `onError` are
+* mutually exclusive per incoming token — `onRead` fires only when a session
+* was successfully established from it.
+*/
 interface SessionHooksJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent | H3Event = HTTPEvent | H3Event> {
+  /**
+  * Fires when an incoming token was decrypted and the session established.
+  * May fire more than once per request when `useJWESession` is called
+  * concurrently in the same handler — dedupe via `session.id` if needed.
+  */
   onRead?: (args: {
     session: SessionJWE<T, MaxAge> & {
       id: string;
@@ -35,20 +51,23 @@ interface SessionHooksJWE<T extends Record<string, any> = SessionClaims, MaxAge
     event: TEvent;
     config: SessionConfigJWE<T, MaxAge, TEvent>;
   }) => void | Promise<void>;
+  /** Fires after a new token was sealed — including pure token refreshes (update with no data). */
   onUpdate?: (args: {
-    /** Session after it has been updated.. */session: SessionJWE<T, MaxAge> & {
+    /** Session after the update. */session: SessionJWE<T, MaxAge> & {
       id: string;
       token: string;
-    }; /** Snapshot of the session before was updated. */
+    }; /** Deep-copied snapshot of the session before the update. */
     oldSession: SessionJWE<T, MaxAge>;
     event: TEvent;
     config: SessionConfigJWE<T, MaxAge, TEvent>;
   }) => void | Promise<void>;
+  /** Fires when the session is cleared. */
   onClear?: (args: {
-    oldSession: SessionJWE<T, MaxAge> | undefined;
+    /** Last known session before clearing, if any. */oldSession: SessionJWE<T, MaxAge> | undefined;
     event: TEvent;
     config: SessionConfigJWE<T, MaxAge, TEvent>;
   }) => void | Promise<void>;
+  /** Fires when the incoming token is expired. Receives the expired token's decoded claims. */
   onExpire?: (args: {
     session: {
       id: string | undefined;
@@ -60,6 +79,7 @@ interface SessionHooksJWE<T extends Record<string, any> = SessionClaims, MaxAge
     error: Error;
     config: SessionConfigJWE<T, MaxAge, TEvent>;
   }) => void | Promise<void>;
+  /** Fires on read-path failures other than expiry, and on write-path seal failures. */
   onError?: (args: {
     /**
     * The session involved in the error.
@@ -69,56 +89,82 @@ interface SessionHooksJWE<T extends Record<string, any> = SessionClaims, MaxAge
     error: any;
     config: SessionConfigJWE<T, MaxAge, TEvent>;
   }) => void | Promise<void>;
+  /** Resolve the decryption key for the incoming token from its protected header (e.g. by `kid`). */
   onUnsealKeyLookup?: (args: {
     header: JWEHeaderParameters;
     event: TEvent;
     config: SessionConfigJWE<T, MaxAge, TEvent>;
   }) => JWEDecryptJWK | Promise<JWEDecryptJWK>;
 }
+/**
+* Configuration for a JWE-backed (encrypted) session.
+*/
 interface SessionConfigJWE<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent | H3Event = HTTPEvent | H3Event> {
-  /** Shared secret used, string for PBES2 or Json Web Key (JWK) */
+  /**
+  * Secret used for sealing — a password string (PBES2), a symmetric JWK, or
+  * an asymmetric pair: the public key seals, the private key unseals.
+  */
   key: string | JWEEncryptJWK | {
     privateKey: JWEAsymmetricPrivateJWK;
     publicKey?: JWEAsymmetricPublicJWK;
   };
-  /** Session lifetime in seconds (used to derive exp from iat) */
+  /**
+  * Session lifetime in seconds — sets `exp = iat + maxAge` in the token and
+  * drives the cookie expiry. Without it the library writes no `exp` — though
+  * an `exp` key in the session data is then carried into the token as its
+  * actual expiry claim.
+  */
   maxAge?: MaxAge;
-  /** Default is "h3" */
+  /** Session name — drives the cookie name and the default session header. Default `"h3-jwe"`. */
   name?: string;
-  /** Default is secure, httpOnly, path="/" */
+  /** Cookie options (`false` to disable). Defaults: `path="/"`, `secure`, `httpOnly: true`. */
   cookie?: false | (CookieSerializeOptions & {
     chunkMaxLength?: number;
   });
-  /** Default is x-h3-session / x-{name}-session */
+  /** Request header to read the token from (`false` to disable). Default `x-<name>-session`. */
   sessionHeader?: false | string;
-  /** Default is crypto.randomUUID */
+  /** Session ID (`jti`) generator. Default `crypto.randomUUID`. */
   generateId?: () => string;
-  /** JWE configuration overrides */
+  /** JWE encrypt/decrypt overrides. Set `encryptOptions.alg` and `enc` to pin the session algorithms — unsealing then accepts only them. */
   jwe?: {
     encryptOptions?: Omit<JWEEncryptOptions, "expiresIn">;
     decryptOptions?: JWTClaimValidationOptions;
   };
+  /** Lifecycle hooks — see {@link SessionHooksJWE}. */
   hooks?: SessionHooksJWE<T, MaxAge, TEvent>;
 }
 /**
-* Create a session manager for the current request.
+* Create a session manager for the current request using JWE (encrypted).
 */
 declare function useJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>): Promise<SessionManager<T, MaxAge>>;
 /**
-* Get the session for the current request.
+* Get (and lazily initialize) the session for the current request.
 */
 declare function getJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>): Promise<SessionJWE<T, MaxAge>>;
+/**
+* Read the raw session token for the request. The session header (default
+* `x-<name>-session`, `Bearer ` prefix stripped) takes precedence, then a
+* freshly-minted token on the response's `Set-Cookie`, then the session cookie.
+*/
 declare function getJWESessionToken<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>): string | undefined;
 /**
-* Update the session data for the current request.
+* Update the session data (if provided) and reissue the JWE token.
 */
 declare function updateJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>, update?: SessionUpdate<T>): Promise<SessionJWE<T, MaxAge>>;
 /**
-* Produce a JWE for the current session.
+* Seal the current session as a compact JWE.
+* Payload: `session.data` spread at the top level, plus the reserved claims
+* `jti`, `iat`, and `exp` (when `maxAge` is set), which overwrite any
+* same-named keys in the session data.
 */
 declare function sealJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>): Promise<string>;
 /**
-* Decrypt the JWE and return a Session-compatible object.
+* Decrypt and parse a compact JWE into a Session structure.
+* Performs:
+*  - authenticated decryption
+*  - claim validation (always on): `jti` & `iat` required, `exp` honoured
+*  - `typ` header check and alg/enc pinning when configured
+*  - `maxAge` enforced as `maxTokenAge` when provided
 */
 declare function unsealJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>, sealed: string): Promise<Partial<SessionJWE<T, MaxAge>>>;
 /**
@@ -126,6 +172,10 @@ declare function unsealJWESession<T extends Record<string, any> = SessionClaims,
 */
 declare function clearJWESession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWE<T, MaxAge, TEvent>): Promise<void>;
 declare const kGetSessionPromise: unique symbol;
+/**
+* In-memory session state for the current request, mirroring the claims of
+* the underlying compact JWS token.
+*/
 interface SessionJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
   /** Session ID — mirrors the JWT `jti` claim. `undefined` until the session is persisted. */
   id: string | undefined;
@@ -133,11 +183,23 @@ interface SessionJWS<T extends Record<string, any> = SessionClaims, MaxAge exten
   createdAt: number;
   /** Session expiry time in ms — mirrors the JWT `exp` claim (seconds). */
   expiresAt: MaxAge extends ExpiresIn ? number : T["exp"];
+  /** Session data — carried in the token payload, spread at the top level. */
   data: SessionData<T>;
+  /** The current compact JWS token. `undefined` until the session is persisted. */
   token: string | undefined;
   [kGetSessionPromise]?: Promise<SessionJWS<T, MaxAge>>;
 }
+/**
+* Lifecycle hooks for JWS sessions. `onRead`, `onExpire`, and `onError` are
+* mutually exclusive per incoming token — `onRead` fires only when a session
+* was successfully established from it.
+*/
 interface SessionHooksJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent> {
+  /**
+  * Fires when an incoming token was verified and the session established.
+  * May fire more than once per request when `useJWSSession` is called
+  * concurrently in the same handler — dedupe via `session.id` if needed.
+  */
   onRead?: (args: {
     session: SessionJWS<T, MaxAge> & {
       id: string;
@@ -146,20 +208,23 @@ interface SessionHooksJWS<T extends Record<string, any> = SessionClaims, MaxAge
     event: TEvent;
     config: SessionConfigJWS<T, MaxAge, TEvent>;
   }) => void | Promise<void>;
+  /** Fires after a new token was signed — including pure token refreshes (update with no data). */
   onUpdate?: (args: {
-    /** Session after it has been updated.. */session: SessionJWS<T, MaxAge> & {
+    /** Session after the update. */session: SessionJWS<T, MaxAge> & {
       id: string;
       token: string;
-    }; /** Snapshot of the session before was updated. */
+    }; /** Deep-copied snapshot of the session before the update. */
     oldSession: SessionJWS<T, MaxAge>;
     event: TEvent;
     config: SessionConfigJWS<T, MaxAge, TEvent>;
   }) => void | Promise<void>;
+  /** Fires when the session is cleared. */
   onClear?: (args: {
-    oldSession: SessionJWS<T, MaxAge> | undefined;
+    /** Last known session before clearing, if any. */oldSession: SessionJWS<T, MaxAge> | undefined;
     event: TEvent;
     config: SessionConfigJWS<T, MaxAge, TEvent>;
   }) => void | Promise<void>;
+  /** Fires when the incoming token is expired. Receives the expired token's decoded claims. */
   onExpire?: (args: {
     session: {
       id: string | undefined;
@@ -171,6 +236,7 @@ interface SessionHooksJWS<T extends Record<string, any> = SessionClaims, MaxAge
     error: Error;
     config: SessionConfigJWS<T, MaxAge, TEvent>;
   }) => void | Promise<void>;
+  /** Fires on read-path failures other than expiry, and on write-path sign failures. */
   onError?: (args: {
     /**
     * The session involved in the error.
@@ -180,34 +246,88 @@ interface SessionHooksJWS<T extends Record<string, any> = SessionClaims, MaxAge
     error: any;
     config: SessionConfigJWS<T, MaxAge, TEvent>;
   }) => void | Promise<void>;
+  /** Resolve the verification key(s) for the incoming token from its protected header (e.g. by `kid`). */
   onVerifyKeyLookup?: (args: {
     header: JWKLookupFunctionHeader;
     event: TEvent;
     config: SessionConfigJWS<T, MaxAge, TEvent>;
   }) => JWKSet | JWSVerifyJWK | Promise<JWKSet | JWSVerifyJWK>;
 }
+/**
+* Configuration for a JWS-backed (signed, not encrypted) session.
+*/
 interface SessionConfigJWS<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent> {
+  /**
+  * JWK used for signing — a symmetric `oct` (HS*) key, or an asymmetric pair:
+  * the private key signs, the public side verifies (single JWK, array, or
+  * JWKSet for rotation).
+  */
   key: JWK_oct<JWK_HMAC> | {
     privateKey: JWSAsymmetricPrivateJWK;
     publicKey: JWSAsymmetricPublicJWK | JWSAsymmetricPublicJWK[] | JWKSet;
   };
+  /**
+  * Session lifetime in seconds — sets `exp = iat + maxAge` in the token and
+  * drives the cookie expiry. Without it the library writes no `exp` — though
+  * an `exp` key in the session data is then carried into the token as its
+  * actual expiry claim.
+  */
   maxAge?: MaxAge;
+  /** Session name — drives the cookie name and the default session header. Default `"h3-jws"`. */
   name?: string;
+  /** Cookie options (`false` to disable). Defaults: `path="/"`, `secure`, `httpOnly: false` — the JWS payload is client-readable by design. */
   cookie?: false | (CookieSerializeOptions & {
     chunkMaxLength?: number;
   });
+  /** Request header to read the token from (`false` to disable). Default `x-<name>-session`. */
   sessionHeader?: false | string;
+  /** Session ID (`jti`) generator. Default `crypto.randomUUID`. */
   generateId?: () => string;
+  /** JWS sign/verify overrides. Set `signOptions.alg` to pin the session algorithm — verification then accepts only it. */
   jws?: {
     signOptions?: Omit<JWSSignOptions, "expiresIn">;
     verifyOptions?: JWTClaimValidationOptions;
   };
+  /** Lifecycle hooks — see {@link SessionHooksJWS}. */
   hooks?: SessionHooksJWS<T, MaxAge, TEvent>;
 }
+/**
+* Create a session manager for the current request using JWS (signed only, not encrypted).
+* NOTE: Contents are visible to clients (Base64URL-decoded JSON). Do not store secrets in session data.
+*/
 declare function useJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>): Promise<SessionManager<T, MaxAge>>;
+/**
+* Get (and lazily initialize) the session for the current request.
+*/
 declare function getJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>): Promise<SessionJWS<T, MaxAge>>;
+/**
+* Read the raw session token for the request. The session header (default
+* `x-<name>-session`, `Bearer ` prefix stripped) takes precedence, then a
+* freshly-minted token on the response's `Set-Cookie`, then the session cookie.
+*/
+declare function getJWSSessionToken<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>): string | undefined;
+/**
+* Update the session data (if provided) and reissue the JWS token.
+*/
 declare function updateJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>, update?: SessionUpdate<T>): Promise<SessionJWS<T, MaxAge>>;
+/**
+* Sign the current session as a compact JWS.
+* Payload: `session.data` spread at the top level, plus the reserved claims
+* `jti`, `iat`, and `exp` (when `maxAge` is set), which overwrite any
+* same-named keys in the session data.
+*/
 declare function signJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>): Promise<string>;
+/**
+* Verify and parse a compact JWS into a Session structure.
+* Performs:
+*  - cryptographic signature verification
+*  - claim validation (always on): `jti` & `iat` required, `exp` honoured
+*  - `typ` header check and algorithm pinning when configured
+*  - `maxAge` enforced as `maxTokenAge` when provided
+*/
 declare function verifyJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>, token: string): Promise<Partial<SessionJWS<T, MaxAge>>>;
+/**
+* Clear the session (delete from context and drop cookie).
+*/
 declare function clearJWSSession<T extends Record<string, any> = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends HTTPEvent = HTTPEvent>(event: TEvent, config: SessionConfigJWS<T, MaxAge, TEvent>): Promise<void>;
-export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, Duration, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JOSEPayload, JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHeaderParameters, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JoseHeaderParameters, KeyManagementAlgorithm, MaxTokenAge, NotBeforeIn, type SessionClaims, type SessionConfigJWE, type SessionConfigJWS, type SessionData, type SessionHooksJWE, type SessionHooksJWS, type SessionJWE, type SessionJWS, type SessionManager, type SessionUpdate, UnwrapKeyOptions, UnwrappingKeyFor, WrapKeyOptions, WrapKeyResult, WrappingKeyFor, clearJWESession, clearJWSSession, deriveJWKFromPassword, exportPEM, exportToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importFromPEM, importPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+export { type CompositeKey, type ContentEncryptionAlgorithm, type DeriveKeyOptions, type DeriveKeyReturn, type Duration, type ExpiresIn, type GenerateJWKOptions, type GenerateJWKReturn, type GenerateKeyAlgorithm, type GenerateKeyOptions, type GenerateKeyReturn, type JOSEPayload, type JWEAsymmetricPrivateJWK, type JWEAsymmetricPublicJWK, type JWEDecryptJWK, type JWEDecryptOptions, type JWEDecryptResult, type JWEEncryptJWK, type JWEEncryptOptions, type JWEFlattenedSerialization, type JWEGeneralRecipient, type JWEGeneralSerialization, type JWEHeaderParameters, type JWEKeyManagementHeaderParameters, type JWEMultiDecryptOptions, type JWEMultiDecryptResult, type JWEMultiEncryptOptions, type JWEMultiRecipient, type JWEProtectedHeader, type JWK, type JWKAlgorithm, type JWKCacheAdapter, type JWKLookupFunction, type JWKLookupFunctionHeader, type JWKPEMAlgorithm, type JWKParameters, type JWKSet, type JWK_AES_CBC_HMAC, type JWK_AES_GCM, type JWK_AES_GCM_KW, type JWK_AES_KW, type JWK_Asymmetric, type JWK_Asymmetric_Algorithm, type JWK_EC, type JWK_ECDH_ES, type JWK_ECDSA, type JWK_EC_Private, type JWK_EC_Public, type JWK_HMAC, type JWK_OKP, type JWK_OKP_Private, type JWK_OKP_Public, type JWK_OKP_SIGN, type JWK_PBES2, type JWK_Pair, type JWK_Private, type JWK_Public, type JWK_RSA, type JWK_RSA_ENC, type JWK_RSA_PSS, type JWK_RSA_Private, type JWK_RSA_Public, type JWK_RSA_SIGN, type JWK_Symmetric, type JWK_Symmetric_Algorithm, type JWK_oct, type JWSAlgorithm, type JWSAsymmetricPrivateJWK, type JWSAsymmetricPublicJWK, type JWSFlattenedSerialization, type JWSGeneralSerialization, type JWSGeneralSignature, type JWSHeaderParameters, type JWSMultiSignOptions, type JWSMultiSigner, type JWSMultiVerifyAllOptions, type JWSMultiVerifyOptions, type JWSMultiVerifyOutcome, type JWSMultiVerifyResult, type JWSProtectedHeader, type JWSSignJWK, type JWSSignOptions, type JWSVerifyJWK, type JWSVerifyOptions, type JWSVerifyResult, type JWT, type JWTClaimValidationOptions, type JWTClaims, type JoseHeaderParameters, type KeyManagementAlgorithm, type MaxTokenAge, type NotBeforeIn, type SessionClaims, type SessionConfigJWE, type SessionConfigJWS, type SessionData, type SessionHooksJWE, type SessionHooksJWS, type SessionJWE, type SessionJWS, type SessionManager, type SessionUpdate, type UnwrapKeyOptions, type UnwrappingKeyFor, type WrapKeyOptions, type WrapKeyResult, type WrappingKeyFor, clearJWESession, clearJWSSession, deriveJWKFromPassword, exportPEM, exportToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, getJWSSessionToken, importFromPEM, importPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };

package/dist/adapters/h3v2/index.mjs

@@ -1,7 +1,8 @@
-import { D as JWTError, O as isJWTError, c as isPrivateJWK, l as isPublicJWK, p as computeDurationInSeconds, u as isSymmetricJWK } from "../../_chunks/utils.mjs";
-import { c as exportPEM, g as importPEM, i as deriveJWKFromPassword, l as exportToPEM, m as importFromPEM, u as generateJWK } from "../../_chunks/jwk.mjs";
-import { n as verify, t as sign } from "../../_chunks/jws.mjs";
-import { n as encrypt, t as decrypt } from "../../_chunks/jwe.mjs";
+import { JWTError, computeDurationInSeconds, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK } from "../../_chunks/utils.mjs";
+import { sanitizeObjectCopy } from "../../_chunks/libs/unsecure.mjs";
+import { deriveJWKFromPassword, exportPEM, exportToPEM, generateJWK, importFromPEM, importPEM } from "../../_chunks/jwk.mjs";
+import { sign, verify } from "../../_chunks/jws.mjs";
+import { decrypt, encrypt } from "../../_chunks/jwe.mjs";
 import { getChunkedCookie, getEventContext, setChunkedCookie } from "h3";
 import { NullProtoObj } from "rou3";
 const kGetSessionPromise$1 = Symbol("h3_jwe_getSession");
@@ -158,11 +159,11 @@ async function updateJWESession(event, config, update) {
 	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot update session on read-only event.");
 	const sessionName = config.name || DEFAULT_NAME$1;
 	const session = getEventContext(event).sessions?.[sessionName] || await getJWESession(event, config);
-	if (typeof update === "function") update = update(session.data);
 	const oldSession = {
 		...session,
-		data: { ...session.data }
+		data: sanitizeObjectCopy(session.data)
 	};
+	if (typeof update === "function") update = update(session.data);
 	if (update) Object.assign(session.data, update);
 	const now = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
 	const createdAt = now - now % 1e3;
@@ -178,7 +179,8 @@ async function updateJWESession(event, config, update) {
 		Object.assign(session, {
 			id: oldSession.id,
 			createdAt: oldSession.createdAt,
-			expiresAt: oldSession.expiresAt
+			expiresAt: oldSession.expiresAt,
+			data: oldSession.data
 		});
 		session.token = oldSession.token;
 		await config.hooks?.onError?.({
@@ -239,7 +241,7 @@ async function unsealJWESession(event, config, sealed) {
 	if (config.jwe?.encryptOptions?.protectedHeader?.typ && typeof config.jwe.encryptOptions.protectedHeader.typ === "string" && config.jwe.encryptOptions.protectedHeader.typ.toLowerCase().includes("jwt")) typ = config.jwe.encryptOptions.protectedHeader.typ;
 	const { payload } = await decrypt(sealed, key, {
 		...config.jwe?.decryptOptions,
-		requiredClaims: [...new Set([
+		requiredClaims: [.../* @__PURE__ */ new Set([
 			...config.jwe?.decryptOptions?.requiredClaims || [],
 			"jti",
 			"iat"
@@ -273,7 +275,7 @@ async function clearJWESession(event, config) {
 	if (session && session[kGetSessionPromise$1]) session = await session[kGetSessionPromise$1];
 	const oldSession = session ? {
 		...session,
-		data: { ...session.data }
+		data: sanitizeObjectCopy(session.data)
 	} : void 0;
 	if (context.sessions?.[sessionName]) delete context.sessions[sessionName];
 	if (config.cookie !== false && canWriteCookie) setChunkedCookie(event, sessionName, "", {
@@ -472,11 +474,11 @@ async function updateJWSSession(event, config, update) {
 	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot update session on read-only event.");
 	const sessionName = config.name || DEFAULT_NAME;
 	const session = getEventContext(event).sessions?.[sessionName] || await getJWSSession(event, config);
-	if (typeof update === "function") update = update(session.data);
 	const oldSession = {
 		...session,
-		data: { ...session.data }
+		data: sanitizeObjectCopy(session.data)
 	};
+	if (typeof update === "function") update = update(session.data);
 	if (update) Object.assign(session.data, update);
 	const now = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
 	const createdAt = now - now % 1e3;
@@ -492,7 +494,8 @@ async function updateJWSSession(event, config, update) {
 		Object.assign(session, {
 			id: oldSession.id,
 			createdAt: oldSession.createdAt,
-			expiresAt: oldSession.expiresAt
+			expiresAt: oldSession.expiresAt,
+			data: oldSession.data
 		});
 		session.token = oldSession.token;
 		await config.hooks?.onError?.({
@@ -553,7 +556,7 @@ async function verifyJWSSession(event, config, token) {
 	if (config.jws?.signOptions?.protectedHeader?.typ && typeof config.jws.signOptions.protectedHeader.typ === "string" && config.jws.signOptions.protectedHeader.typ.toLowerCase().includes("jwt")) typ = config.jws.signOptions.protectedHeader.typ;
 	const { payload } = await verify(token, jwk, {
 		...config.jws?.verifyOptions,
-		requiredClaims: [...new Set([
+		requiredClaims: [.../* @__PURE__ */ new Set([
 			...config.jws?.verifyOptions?.requiredClaims || [],
 			"jti",
 			"iat"
@@ -584,7 +587,7 @@ async function clearJWSSession(event, config) {
 	if (session && session[kGetSessionPromise]) session = await session[kGetSessionPromise];
 	const oldSession = session ? {
 		...session,
-		data: { ...session.data }
+		data: sanitizeObjectCopy(session.data)
 	} : void 0;
 	if (context.sessions?.[sessionName]) delete context.sessions[sessionName];
 	if (config.cookie !== false && canWriteCookie) setChunkedCookie(event, sessionName, "", {
@@ -636,4 +639,4 @@ function findSetCookie(setCookie, name) {
 	const match = setCookie.match(regex);
 	return match ? match[1] : void 0;
 }
-export { clearJWESession, clearJWSSession, deriveJWKFromPassword, exportPEM, exportToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, importFromPEM, importPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+export { clearJWESession, clearJWSSession, deriveJWKFromPassword, exportPEM, exportToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, getJWSSessionToken, importFromPEM, importPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };

package/dist/core/jwe.d.mts

@@ -1,3 +1,3 @@
-import { G as isJWTError, H as JWTError, U as JWTErrorCauseMap, W as JWTErrorCode, _ as JWEMultiDecryptOptions, a as JWEAsymmetricPrivateJWK, b as JWEMultiRecipient, c as JWEDecryptOptions, d as JWEEncryptOptions, f as JWEFlattenedSerialization, g as JWEKeyManagementHeaderParameters, h as JWEHeaderParameters, l as JWEDecryptResult, m as JWEGeneralSerialization, o as JWEAsymmetricPublicJWK, p as JWEGeneralRecipient, s as JWEDecryptJWK, u as JWEEncryptJWK, v as JWEMultiDecryptResult, x as JWEProtectedHeader, y as JWEMultiEncryptOptions } from "../_chunks/index.mjs";
-import { a as generalToFlattened, i as encryptMulti, n as encrypt, r as decryptMulti, t as decrypt } from "../_chunks/jwe.mjs";
-export { JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWTError, JWTErrorCauseMap, JWTErrorCode, decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened, isJWTError };
+import { JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWTError, JWTErrorCauseMap, JWTErrorCode, isJWTError } from "../_chunks/index.mjs";
+import { decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened } from "../_chunks/jwe.mjs";
+export { type JWEAsymmetricPrivateJWK, type JWEAsymmetricPublicJWK, type JWEDecryptJWK, type JWEDecryptOptions, type JWEDecryptResult, type JWEEncryptJWK, type JWEEncryptOptions, type JWEFlattenedSerialization, type JWEGeneralRecipient, type JWEGeneralSerialization, type JWEHeaderParameters, type JWEKeyManagementHeaderParameters, type JWEMultiDecryptOptions, type JWEMultiDecryptResult, type JWEMultiEncryptOptions, type JWEMultiRecipient, type JWEProtectedHeader, JWTError, type JWTErrorCauseMap, type JWTErrorCode, decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened, isJWTError };

package/dist/core/jwe.mjs

@@ -1,3 +1,3 @@
-import { D as JWTError, O as isJWTError } from "../_chunks/utils.mjs";
-import { a as generalToFlattened, i as encryptMulti, n as encrypt, r as decryptMulti, t as decrypt } from "../_chunks/jwe.mjs";
+import { JWTError, isJWTError } from "../_chunks/utils.mjs";
+import { decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened } from "../_chunks/jwe.mjs";
 export { JWTError, decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened, isJWTError };

package/dist/core/jwk.d.mts

@@ -1,4 +1,4 @@
-import { $ as DeriveKeyOptions, At as JWK_PBES2, Bt as JWK_Symmetric, Ct as JWK_EC_Private, Dt as JWK_OKP_Private, Et as JWK_OKP, Ft as JWK_RSA_ENC, G as isJWTError, Gt as UnwrappingKeyFor, H as JWTError, Ht as JWK_oct, It as JWK_RSA_PSS, Jt as WrappingKeyFor, Kt as WrapKeyOptions, Lt as JWK_RSA_Private, Mt as JWK_Private, Nt as JWK_Public, Ot as JWK_OKP_Public, Pt as JWK_RSA, Q as ContentEncryptionAlgorithm, Rt as JWK_RSA_Public, St as JWK_ECDSA, Tt as JWK_HMAC, U as JWTErrorCauseMap, Ut as KeyManagementAlgorithm, Vt as JWK_Symmetric_Algorithm, W as JWTErrorCode, Wt as UnwrapKeyOptions, X as JoseHeaderParameters, Z as CompositeKey, _t as JWK_AES_KW, at as GenerateKeyReturn, bt as JWK_EC, ct as JWKCacheAdapter, dt as JWKPEMAlgorithm, et as DeriveKeyReturn, ft as JWKParameters, gt as JWK_AES_GCM_KW, ht as JWK_AES_GCM, it as GenerateKeyOptions, jt as JWK_Pair, kt as JWK_OKP_SIGN, lt as JWKLookupFunction, mt as JWK_AES_CBC_HMAC, nt as GenerateJWKReturn, ot as JWK, pt as JWKSet, qt as WrapKeyResult, rt as GenerateKeyAlgorithm, st as JWKAlgorithm, tt as GenerateJWKOptions, ut as JWKLookupFunctionHeader, vt as JWK_Asymmetric, wt as JWK_EC_Public, xt as JWK_ECDH_ES, yt as JWK_Asymmetric_Algorithm, zt as JWK_RSA_SIGN } from "../_chunks/index.mjs";
+import { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWTError, JWTErrorCauseMap, JWTErrorCode, JoseHeaderParameters, KeyManagementAlgorithm, UnwrapKeyOptions, UnwrappingKeyFor, WrapKeyOptions, WrapKeyResult, WrappingKeyFor, isJWTError } from "../_chunks/index.mjs";
 /**
 * Generates a cryptographic key for the specified JWA algorithm.
 *
@@ -28,6 +28,7 @@ import { $ as DeriveKeyOptions, At as JWK_PBES2, Bt as JWK_Symmetric, Ct as JWK_
 * @param options
 *   - `toJWK?` — when `true`, return JWK / JWK pair instead of `CryptoKey` / `CryptoKeyPair`.
 *   - `extractable?` — forwarded to `crypto.subtle.generateKey`. Defaults to `true`.
+*     Ignored when `toJWK` is set — the JWK output requires exporting the intermediate key.
 *   - `keyUsage?` — override the default usages derived from `alg`.
 *   - `modulusLength?` — RSA only; defaults to `2048`.
 *   - `publicExponent?` — RSA only; defaults to `0x010001`.
@@ -64,7 +65,6 @@ declare function generateKey<TAlg extends GenerateKeyAlgorithm, TOptions extends
 *            `"A128GCM"`, `"A256CBC-HS512"`). PBES2, `"dir"`, and `"none"` are
 *            not accepted.
 * @param options
-*   - `extractable?` — forwarded to `crypto.subtle.generateKey`. Defaults to `true`.
 *   - `keyUsage?` — override the default usages derived from `alg`.
 *   - `modulusLength?` — RSA only; defaults to `2048`.
 *   - `publicExponent?` — RSA only; defaults to `0x010001`.
@@ -109,12 +109,11 @@ declare function deriveKeyFromPassword<TAlg extends JWK_PBES2, TOptions extends
 *   - `salt` — PBKDF2 salt input (`p2s`). Must be at least 8 octets (RFC 7518 §4.8.1.1).
 *   - `iterations` — PBKDF2 iteration count (`p2c`). Must be a positive integer.
 *   - `keyUsage?` — defaults to `["wrapKey", "unwrapKey"]`.
-*   - `extractable?` — forwarded to `crypto.subtle.importKey`. Defaults to `false`.
 *   - JWK metadata (`kid`, `use`, `x5c`, `x5t`, `x5t#S256`, `x5u`) is merged onto the
 *     result. `alg`, `kty`, `key_ops`, and `ext` are managed by the library and cannot
 *     be overridden here.
 */
-declare function deriveJWKFromPassword(password: string | Uint8Array<ArrayBuffer>, alg: JWK_PBES2, options: Omit<DeriveKeyOptions, "toJWK"> & Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">): Promise<JWK_oct>;
+declare function deriveJWKFromPassword(password: string | Uint8Array<ArrayBuffer>, alg: JWK_PBES2, options: Omit<DeriveKeyOptions, "toJWK" | "extractable"> & Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">): Promise<JWK_oct>;
 /**
 * Default JWK import cache backed by a WeakMap.
 *
@@ -248,9 +247,12 @@ declare function unwrapKey<TAlg extends KeyManagementAlgorithm>(alg: TAlg, wrapp
 *            the key's intended algorithm and for setting the `alg` field on the resulting JWK.
 * @param options
 *   - `pemType?` — explicit PEM type; inferred from the label when omitted.
-*   - `extractable?` — forwarded to `crypto.subtle.importKey`. Defaults to `false` for private
-*     keys and `true` for public keys.
 *   - `jwkParams?` — additional JWK properties merged into the result (e.g. `kid`, `use`).
+*
+* The returned JWK always contains the key material in plain JavaScript — non-extractable
+* import is impossible for a PEM → JWK conversion (JWK export requires an extractable key).
+* To obtain a non-extractable `CryptoKey`, pass the result to
+* `importKey(jwk, { extractable: false })`.
 *     `alg`, `kty`, `key_ops`, and `ext` are reserved and cannot be overridden here.
 * @throws `JWTError("ERR_JWK_INVALID")` if the PEM type cannot be inferred (no recognised label
 *         and no `options.pemType`), or if the label does not match the requested/inferred type.
@@ -266,8 +268,7 @@ declare function unwrapKey<TAlg extends KeyManagementAlgorithm>(alg: TAlg, wrapp
 * ```
 */
 declare function importPEM<T extends JWK>(pem: string, alg: JWKPEMAlgorithm, options?: {
-  /** PEM type. Inferred from the PEM label when omitted. */pemType?: "pkcs8" | "spki" | "x509"; /** Passed to `crypto.subtle.importKey`. Defaults to `false` for private keys, `true` otherwise. */
-  extractable?: boolean; /** Additional JWK properties merged into the exported key (e.g. `kid`). */
+  /** PEM type. Inferred from the PEM label when omitted. */pemType?: "pkcs8" | "spki" | "x509"; /** Additional JWK properties merged into the exported key (e.g. `kid`). */
   jwkParams?: Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">;
 }): Promise<T>;
 /**
@@ -275,7 +276,6 @@ declare function importPEM<T extends JWK>(pem: string, alg: JWKPEMAlgorithm, opt
 * is now inferred from the PEM label by default.
 */
 declare function importFromPEM<T extends JWK>(pem: string, pemType: "pkcs8" | "spki" | "x509", alg: JWKPEMAlgorithm, options?: {
-  extractable?: boolean;
   jwkParams?: Omit<JWKParameters, "alg" | "kty" | "key_ops" | "ext">;
 }): Promise<T>;
 /**
@@ -384,4 +384,4 @@ declare function getJWKFromSet(jwkSet: JWKSet, kidOrProtectedHeader: string | (J
 * @returns An array of matching JWKs.
 */
 declare function getJWKsFromSet(jwkSet: JWKSet, filter?: (jwk: JWK) => boolean): JWK[];
-export { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWTError, type JWTErrorCauseMap, type JWTErrorCode, KeyManagementAlgorithm, UnwrapKeyOptions, UnwrappingKeyFor, WeakMapJWKCache, WrapKeyOptions, WrapKeyResult, WrappingKeyFor, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportKey, exportPEM, exportToPEM, generateJWK, generateKey, getJWKFromSet, getJWKsFromSet, importFromPEM, importKey, importPEM, isJWTError, unwrapKey, wrapKey };
+export { type CompositeKey, type ContentEncryptionAlgorithm, type DeriveKeyOptions, type DeriveKeyReturn, type GenerateJWKOptions, type GenerateJWKReturn, type GenerateKeyAlgorithm, type GenerateKeyOptions, type GenerateKeyReturn, type JWK, type JWKAlgorithm, type JWKCacheAdapter, type JWKLookupFunction, type JWKLookupFunctionHeader, type JWKPEMAlgorithm, type JWKParameters, type JWKSet, type JWK_AES_CBC_HMAC, type JWK_AES_GCM, type JWK_AES_GCM_KW, type JWK_AES_KW, type JWK_Asymmetric, type JWK_Asymmetric_Algorithm, type JWK_EC, type JWK_ECDH_ES, type JWK_ECDSA, type JWK_EC_Private, type JWK_EC_Public, type JWK_HMAC, type JWK_OKP, type JWK_OKP_Private, type JWK_OKP_Public, type JWK_OKP_SIGN, type JWK_PBES2, type JWK_Pair, type JWK_Private, type JWK_Public, type JWK_RSA, type JWK_RSA_ENC, type JWK_RSA_PSS, type JWK_RSA_Private, type JWK_RSA_Public, type JWK_RSA_SIGN, type JWK_Symmetric, type JWK_Symmetric_Algorithm, type JWK_oct, JWTError, type JWTErrorCauseMap, type JWTErrorCode, type KeyManagementAlgorithm, type UnwrapKeyOptions, type UnwrappingKeyFor, WeakMapJWKCache, type WrapKeyOptions, type WrapKeyResult, type WrappingKeyFor, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportKey, exportPEM, exportToPEM, generateJWK, generateKey, getJWKFromSet, getJWKsFromSet, importFromPEM, importKey, importPEM, isJWTError, unwrapKey, wrapKey };

package/dist/core/jwk.mjs

@@ -1,3 +1,3 @@
-import { D as JWTError, O as isJWTError } from "../_chunks/utils.mjs";
-import { _ as unwrapKey, a as deriveKeyFromPassword, c as exportPEM, d as generateKey, f as getJWKFromSet, g as importPEM, h as importKey, i as deriveJWKFromPassword, l as exportToPEM, m as importFromPEM, n as clearJWKCache, o as deriveSharedSecret, p as getJWKsFromSet, r as configureJWKCache, s as exportKey, t as WeakMapJWKCache, u as generateJWK, v as wrapKey } from "../_chunks/jwk.mjs";
+import { JWTError, isJWTError } from "../_chunks/utils.mjs";
+import { WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportKey, exportPEM, exportToPEM, generateJWK, generateKey, getJWKFromSet, getJWKsFromSet, importFromPEM, importKey, importPEM, unwrapKey, wrapKey } from "../_chunks/jwk.mjs";
 export { JWTError, WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportKey, exportPEM, exportToPEM, generateJWK, generateKey, getJWKFromSet, getJWKsFromSet, importFromPEM, importKey, importPEM, isJWTError, unwrapKey, wrapKey };

package/dist/core/jws.d.mts

@@ -1,3 +1,3 @@
-import { A as JWSMultiSigner, B as JWSVerifyResult, C as JWSAsymmetricPrivateJWK, D as JWSGeneralSignature, E as JWSGeneralSerialization, F as JWSProtectedHeader, G as isJWTError, H as JWTError, I as JWSSignJWK, L as JWSSignOptions, M as JWSMultiVerifyOptions, N as JWSMultiVerifyOutcome, O as JWSHeaderParameters, P as JWSMultiVerifyResult, R as JWSVerifyJWK, S as JWSAlgorithm, T as JWSFlattenedSerialization, U as JWTErrorCauseMap, W as JWTErrorCode, j as JWSMultiVerifyAllOptions, k as JWSMultiSignOptions, w as JWSAsymmetricPublicJWK, z as JWSVerifyOptions } from "../_chunks/index.mjs";
-import { a as verifyMulti, i as signMulti, n as verify, o as verifyMultiAll, r as generalToFlattenedJWS, t as sign } from "../_chunks/jws.mjs";
-export { JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHeaderParameters, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWTError, JWTErrorCauseMap, JWTErrorCode, generalToFlattenedJWS, isJWTError, sign, signMulti, verify, verifyMulti, verifyMultiAll };
+import { JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHeaderParameters, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWTError, JWTErrorCauseMap, JWTErrorCode, isJWTError } from "../_chunks/index.mjs";
+import { generalToFlattenedJWS, sign, signMulti, verify, verifyMulti, verifyMultiAll } from "../_chunks/jws.mjs";
+export { type JWSAlgorithm, type JWSAsymmetricPrivateJWK, type JWSAsymmetricPublicJWK, type JWSFlattenedSerialization, type JWSGeneralSerialization, type JWSGeneralSignature, type JWSHeaderParameters, type JWSMultiSignOptions, type JWSMultiSigner, type JWSMultiVerifyAllOptions, type JWSMultiVerifyOptions, type JWSMultiVerifyOutcome, type JWSMultiVerifyResult, type JWSProtectedHeader, type JWSSignJWK, type JWSSignOptions, type JWSVerifyJWK, type JWSVerifyOptions, type JWSVerifyResult, JWTError, type JWTErrorCauseMap, type JWTErrorCode, generalToFlattenedJWS, isJWTError, sign, signMulti, verify, verifyMulti, verifyMultiAll };

package/dist/core/jws.mjs

@@ -1,3 +1,3 @@
-import { D as JWTError, O as isJWTError } from "../_chunks/utils.mjs";
-import { a as verifyMulti, i as signMulti, n as verify, o as verifyMultiAll, r as generalToFlattenedJWS, t as sign } from "../_chunks/jws.mjs";
+import { JWTError, isJWTError } from "../_chunks/utils.mjs";
+import { generalToFlattenedJWS, sign, signMulti, verify, verifyMulti, verifyMultiAll } from "../_chunks/jws.mjs";
 export { JWTError, generalToFlattenedJWS, isJWTError, sign, signMulti, verify, verifyMulti, verifyMultiAll };