unjwt 0.8.1 → 0.8.2

package/dist/adapters/h3v1/index.mjs

@@ -1,89 +1,64 @@
-import { deriveJWKFromPassword, exportPEM, generateJWK, importPEM, thumbprint } from "../../_chunks/jwk.mjs";
-import { bindSession, createJWECodec, createJWSCodec, dropSession, encodeSession, issueSession, loadSession, openSessionToken, readChunkedFrom, readChunkedFromSetCookie, recordSlotStore, removeChunked, resolveSessionToken, responseCookieStore, sessionActions, sessionManager, sessionToken, writeChunked } from "../../_chunks/_codec-jws.mjs";
-import { getCookie, isEvent, setCookie } from "h3";
-import { parse } from "cookie-es";
-function eventCookieStore(event) {
-	return responseCookieStore({
-		request: (name) => getCookie(event, name),
-		response: () => responseSetCookies(event),
-		write: (name, value, attrs) => setCookie(event, name, value, attrs)
-	});
-}
+import { deriveJWKFromPassword, exportPEM, generateJWK, importPEM, thumbprint, toPublicJWK } from "../../_chunks/jwk.mjs";
+import { bindSession, createJWECodec, createJWSCodec, defineSession, dropSession, encodeSession, issueSession, loadSession, openSessionToken, sessionActions, setCookieValues } from "../../_chunks/_codec-jws.mjs";
+import { parse } from "../../_chunks/libs/cookie-es.mjs";
+import { getCookie, getRequestHeader, getResponseHeader, isEvent, setCookie } from "h3";
 function responseSetCookies(event) {
-	const value = event.node.res.getHeader("set-cookie");
+	const value = getResponseHeader(event, "set-cookie");
 	if (Array.isArray(value)) return value;
 	return typeof value === "string" ? [value] : [];
 }
 const PREFIX = "[unjwt/h3]";
-const h3SessionPort = {
+const h3SessionDriver = {
 	prefix: PREFIX,
-	carrier: (event) => ({ event }),
-	store: (event, slot) => recordSlotStore(() => getSessionsContext(event), slot),
-	readToken: readSessionToken,
-	scope: getSessionsContext,
-	writable: hasWritableResponse,
-	setCookie: (event, sessionName, token, { attrs, chunkMaxLength }) => {
-		writeChunked(eventCookieStore(cookieEvent(event)), sessionName, token, {
-			attrs,
-			chunkMaxLength,
-			prefix: PREFIX
-		});
-	},
-	deleteCookie: (event, sessionName, { attrs }) => {
-		removeChunked(eventCookieStore(cookieEvent(event)), sessionName, { attrs });
-	}
+	state: (event) => event.context.sessions ||= Object.create(null),
+	header: (event, name) => isEvent(event) ? requestHeader(event, name) : compatHeaders(event).get(name),
+	cookies: (event) => isEvent(event) ? eventJar(event) : compatJar(event),
+	writable: (event) => !isEvent(event) || !event.handled
 };
-function getSessionsContext(event) {
-	return event.context.sessions ||= Object.create(null);
-}
-function hasWritableResponse(event) {
-	if (!isEvent(event)) return false;
-	const { res } = event.node;
-	return !res.headersSent && !res.writableEnded;
-}
-function readSessionToken(event, sessionName, source) {
-	return resolveSessionToken(source, sessionName, {
-		written: (name) => readChunkedFromSetCookie(getResponseSetCookie(event), name),
-		cookie: (name) => readChunkedFrom(getRequestCookies(event), name),
-		header: (name) => getRequestHeader(event, name)
-	});
-}
-function cookieEvent(event) {
-	return event;
-}
-function getRequestHeader(event, name) {
-	if ("node" in event && event.node) {
-		const value = event.node.req.headers[name];
-		return Array.isArray(value) ? value[0] : value;
-	}
-	return (("request" in event ? event.request?.headers : void 0) ?? ("headers" in event ? event.headers : void 0))?.get(name) ?? void 0;
-}
-function getRequestCookies(event) {
-	const header = getRequestHeader(event, "cookie");
+function eventJar(event) {
+	return {
+		read: (name) => getCookie(event, name),
+		written: (name) => setCookieValues(responseSetCookies(event))[name],
+		write: (name, value, attrs) => {
+			setCookie(event, name, value, attrs);
+		}
+	};
+}
+function compatJar(event) {
+	let cookies;
+	return { read: (name) => (cookies ||= compatCookies(event))[name] };
+}
+function requestHeader(event, name) {
+	const value = getRequestHeader(event, name);
+	return Array.isArray(value) ? value[0] : value;
+}
+function compatHeaders(event) {
+	return "request" in event ? event.request.headers : event.headers;
+}
+function compatCookies(event) {
+	const header = compatHeaders(event).get("cookie");
 	return header ? parse(header) : Object.create(null);
 }
-function getResponseSetCookie(event) {
-	if ("node" in event && event.node) return responseSetCookies(event);
-	const response = "response" in event ? event.response : void 0;
-	return hasHeaders(response) ? response.headers.getSetCookie() : [];
-}
-function hasHeaders(response) {
-	return typeof response === "object" && response !== null && "headers" in response && Boolean(response.headers);
-}
 const codec$1 = createJWECodec({
 	prefix: PREFIX,
 	defaultName: "h3-jwe"
 });
+const hookArgs$1 = (event) => ({ event });
+function defineJWESession(config) {
+	return defineSession(config, {
+		driver: h3SessionDriver,
+		hookArgs: hookArgs$1,
+		codec: codec$1
+	});
+}
 async function useJWESession(event, config) {
-	const binding = bind$1(event, config);
-	await loadSession(binding);
-	return sessionManager(binding);
+	return defineJWESession(config).use(event);
 }
 async function getJWESession(event, config) {
 	return loadSession(bind$1(event, config));
 }
 function getJWESessionToken(event, config) {
-	return sessionToken(bind$1(event, config));
+	return defineJWESession(config).token(event);
 }
 async function updateJWESession(event, config, update, options) {
 	return issueSession(bind$1(event, config), update, options);
@@ -94,7 +69,7 @@ async function sealJWESession(event, config) {
 async function unsealJWESession(event, config, sealed) {
 	return openSessionToken(codec$1, config, {
 		token: sealed,
-		carrier: { event }
+		args: { event }
 	});
 }
 async function clearJWESession(event, config) {
@@ -102,7 +77,8 @@ async function clearJWESession(event, config) {
 }
 function bind$1(event, config) {
 	return bindSession(event, config, {
-		port: h3SessionPort,
+		driver: h3SessionDriver,
+		hookArgs: hookArgs$1,
 		codec: codec$1,
 		actions: sessionActions()
 	});
@@ -111,16 +87,22 @@ const codec = createJWSCodec({
 	prefix: PREFIX,
 	defaultName: "h3-jws"
 });
+const hookArgs = (event) => ({ event });
+function defineJWSSession(config) {
+	return defineSession(config, {
+		driver: h3SessionDriver,
+		hookArgs,
+		codec
+	});
+}
 async function useJWSSession(event, config) {
-	const binding = bind(event, config);
-	await loadSession(binding);
-	return sessionManager(binding);
+	return defineJWSSession(config).use(event);
 }
 async function getJWSSession(event, config) {
 	return loadSession(bind(event, config));
 }
 function getJWSSessionToken(event, config) {
-	return sessionToken(bind(event, config));
+	return defineJWSSession(config).token(event);
 }
 async function updateJWSSession(event, config, update, options) {
 	return issueSession(bind(event, config), update, options);
@@ -131,7 +113,7 @@ async function signJWSSession(event, config) {
 async function verifyJWSSession(event, config, token) {
 	return openSessionToken(codec, config, {
 		token,
-		carrier: { event }
+		args: { event }
 	});
 }
 async function clearJWSSession(event, config) {
@@ -139,9 +121,10 @@ async function clearJWSSession(event, config) {
 }
 function bind(event, config) {
 	return bindSession(event, config, {
-		port: h3SessionPort,
+		driver: h3SessionDriver,
+		hookArgs,
 		codec,
 		actions: sessionActions()
 	});
 }
-export { clearJWESession, clearJWSSession, deriveJWKFromPassword, exportPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, getJWSSessionToken, importPEM, sealJWESession, signJWSSession, thumbprint, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+export { clearJWESession, clearJWSSession, defineJWESession, defineJWSSession, deriveJWKFromPassword, exportPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, getJWSSessionToken, importPEM, sealJWESession, signJWSSession, thumbprint, toPublicJWK, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };

package/dist/core/jwe.d.mts

@@ -1,5 +1,5 @@
 import { UnsecureError, UnsecureErrorCode } from "../_chunks/libs/unsecure.mjs";
-import { JOSEPayloadMode, JOSEPayloadTypeMap, JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWELibraryHeaderName, JWEMultiDecryptKey, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWTError, JWTErrorCauseMap, JWTErrorCode, KnownJWTErrorCode, PayloadOf, isJWTError, isUnsecureError } from "../_chunks/index.mjs";
+import { JOSEPayloadMode, JOSEPayloadTypeMap, JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyLookup, JWEKeyManagementHeaderParameters, JWELibraryHeaderName, JWEMultiDecryptKey, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWTError, JWTErrorCauseMap, JWTErrorCode, KnownJWTErrorCode, PayloadOf, isJWTError, isUnsecureError } from "../_chunks/index.mjs";
 import { decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened } from "../_chunks/jwe.mjs";
 import { DEFAULT_JOSE_LIMITS } from "../_chunks/_internal.mjs";
-export { DEFAULT_JOSE_LIMITS, type JOSEPayloadMode, type JOSEPayloadTypeMap, type JWEAsymmetricPrivateJWK, type JWEAsymmetricPublicJWK, type JWEDecryptJWK, type JWEDecryptOptions, type JWEDecryptResult, type JWEEncryptJWK, type JWEEncryptOptions, type JWEFlattenedSerialization, type JWEGeneralRecipient, type JWEGeneralSerialization, type JWEHeaderParameters, type JWEKeyManagementHeaderParameters, type JWELibraryHeaderName, type JWEMultiDecryptKey, type JWEMultiDecryptOptions, type JWEMultiDecryptResult, type JWEMultiEncryptOptions, type JWEMultiRecipient, type JWEProtectedHeader, JWTError, type JWTErrorCauseMap, type JWTErrorCode, type KnownJWTErrorCode, type PayloadOf, UnsecureError, type UnsecureErrorCode, decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened, isJWTError, isUnsecureError };
+export { DEFAULT_JOSE_LIMITS, type JOSEPayloadMode, type JOSEPayloadTypeMap, type JWEAsymmetricPrivateJWK, type JWEAsymmetricPublicJWK, type JWEDecryptJWK, type JWEDecryptOptions, type JWEDecryptResult, type JWEEncryptJWK, type JWEEncryptOptions, type JWEFlattenedSerialization, type JWEGeneralRecipient, type JWEGeneralSerialization, type JWEHeaderParameters, type JWEKeyLookup, type JWEKeyManagementHeaderParameters, type JWELibraryHeaderName, type JWEMultiDecryptKey, type JWEMultiDecryptOptions, type JWEMultiDecryptResult, type JWEMultiEncryptOptions, type JWEMultiRecipient, type JWEProtectedHeader, JWTError, type JWTErrorCauseMap, type JWTErrorCode, type KnownJWTErrorCode, type PayloadOf, UnsecureError, type UnsecureErrorCode, decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened, isJWTError, isUnsecureError };

package/dist/core/jwk.d.mts

@@ -1,5 +1,5 @@
 import { UnsecureError, UnsecureErrorCode } from "../_chunks/libs/unsecure.mjs";
-import { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, ECDHEphemeralKeyInput, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, GeneratedJWKMap, GeneratedKeyMap, ImportedKey, ImportedKeyMap, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKMetadata, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWTError, JWTErrorCauseMap, JWTErrorCode, KeyManagementAlgorithm, KnownJWTErrorCode, UnwrapKeyOptions, UnwrapKeyResult, UnwrappingKeyFor, WrapKeyOptions, WrapKeyResult, WrappingKeyFor, isJWTError, isUnsecureError } from "../_chunks/index.mjs";
+import { CompositeKey, ContentEncryptionAlgorithm, DeriveJWKOptions, DeriveJWKReturn, DeriveKeyOptions, DeriveKeyReturn, ECDHEphemeralKeyInput, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, GeneratedJWKMap, GeneratedKeyMap, ImportedKey, ImportedKeyMap, ImportedPEMJWK, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKMetadata, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_Algorithm, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWTError, JWTErrorCauseMap, JWTErrorCode, KeyManagementAlgorithm, KeyWrapAlgorithmOf, KeyWrappingAlgorithm, KnownJWTErrorCode, PEMType, ToPublicJWKReturn, UnwrapKeyOptions, UnwrapKeyResult, UnwrappingKeyFor, WrapKeyOptions, WrapKeyResult, WrappingKeyFor, isJWTError, isUnsecureError } from "../_chunks/index.mjs";
 import { ThumbprintHash, thumbprint } from "../_chunks/index2.mjs";
 /**
  * Generates a key for a JWA algorithm: a `CryptoKey` for symmetric algorithms, raw bytes for
@@ -58,17 +58,15 @@ export declare function deriveKeyFromPassword<TOptions extends DeriveKeyOptions>
  *   - JWK metadata (`use`, `x5c`, `x5t`, `x5t#S256`, `x5u`) is merged onto the result;
  *     `alg`, `kty`, `key_ops`, `ext` and key-material members are reserved (`ERR_INVALID_OPTION`).
  */
-export declare function deriveJWKFromPassword(password: string | Uint8Array<ArrayBuffer>, options: Omit<DeriveKeyOptions, "toJWK" | "extractable"> & Omit<JWKMetadata, "kid"> & {
-  kid?: string | false;
-}): Promise<JWK_oct>;
+export declare function deriveJWKFromPassword<TAlg extends JWK_PBES2, Kid extends string | false = string>(password: string | Uint8Array<ArrayBuffer>, options: DeriveJWKOptions<TAlg, Kid> & Omit<JWKMetadata, "kid">): Promise<DeriveJWKReturn<TAlg, Kid>>;
 /**
  * Default JWK import cache, keyed by JWK object identity: a copied JWK misses it, and a JWK
  * mutated in place keeps serving the old `CryptoKey`. Rotate by replacing the object.
  */
 export declare class WeakMapJWKCache implements JWKCacheAdapter {
   private readonly _map;
-  get(jwk: JWK, alg: string): CryptoKey | undefined;
-  set(jwk: JWK, alg: string, key: CryptoKey): void;
+  get(jwk: JWK, alg: JWKAlgorithm): CryptoKey | undefined;
+  set(jwk: JWK, alg: JWKAlgorithm, key: CryptoKey): void;
 }
 /**
  * Replaces the JWK import cache used by `importKey`, or disables it with `false`.
@@ -79,7 +77,7 @@ export declare class WeakMapJWKCache implements JWKCacheAdapter {
  *
  * @example
  * ```ts
- * const cacheKey = async (jwk: JWK, alg: string) =>
+ * const cacheKey = async (jwk: JWK, alg: JWKAlgorithm) =>
  *   `${await thumbprint(jwk)}:${"d" in jwk ? "private" : "public"}:${alg}`;
  * const map = new Map<string, CryptoKey>();
  * configureJWKCache({
@@ -112,9 +110,9 @@ export declare function importKey(key: JWK_oct, options: {
  * `alg` throws `ERR_JWK_INVALID`, except an `oct` JWK declaring a content encryption `alg` under
  * `"dir"`.
  */
-export declare function importKey<K extends CryptoKey | JWK | Uint8Array<ArrayBuffer>>(key: K, options?: string | {
+export declare function importKey<K extends CryptoKey | JWK | Uint8Array<ArrayBuffer>>(key: K, options?: JWKAlgorithm | {
   /** Algorithm hint. Required when `key.alg` is absent on an asymmetric JWK. */
-  alg?: string;
+  alg?: JWKAlgorithm;
   /** Reject on shape mismatch instead of silently importing. */
   expect?: "public" | "private";
   /** Defaults to `false` for private, `true` for public material; JWK `ext: false` wins. */
@@ -129,7 +127,17 @@ export declare function importKey<K extends CryptoKey | JWK | Uint8Array<ArrayBu
  * @throws `ERR_INVALID_OPTION` if `key` is not a `CryptoKey` or `jwkParams` sets a reserved member
  *   (`alg`, `kty`, `key_ops`, `ext`, key material); `ERR_JWK_INVALID` for a non-extractable key.
  */
+export declare function exportJWK<T extends JWK = JWK>(key: CryptoKey, jwkParams?: JWKMetadata): Promise<T>;
+/** @deprecated Use `exportJWK`; removed in 0.9.0. */
 export declare function exportKey<T extends JWK = JWK>(key: CryptoKey, jwkParams?: JWKMetadata): Promise<T>;
+/**
+ * Utility to derive the public half of an asymmetric JWK, or throw if the input is not asymmetric.
+ *
+ * @param jwk An asymmetric JWK (EC, OKP, RSA) with a private scalar (`d`).
+ * @throws `ERR_JWK_INVALID` if the input is not an asymmetric JWK.
+ * @returns A JWK with the same public members, without the private scalar.
+ */
+export declare function toPublicJWK<T extends JWK_Asymmetric>(jwk: T): ToPublicJWKReturn<T>;
 /**
  * Wraps a CEK under a JWA key management algorithm; the result shape follows `alg`.
  *
@@ -157,12 +165,12 @@ export declare function unwrapKey<TOptions extends UnwrapKeyOptions>(wrappedKey:
  *   `ERR_JWK_UNSUPPORTED` for an unknown `pemType`; `ERR_INVALID_OPTION` if `jwkParams` sets
  *   `alg`, `kty`, `key_ops`, `ext` or a key-material member.
  */
-export declare function importPEM<T extends JWK>(pem: string, alg: JWKPEMAlgorithm, options?: {
-  /** PEM type. Inferred from the PEM label when omitted. */
-  pemType?: "pkcs8" | "spki" | "x509";
+export declare function importPEM<A extends JWKPEMAlgorithm, Type extends PEMType | undefined = undefined>(pem: string, alg: A, options?: {
+  /** PEM type. Inferred from the PEM label when omitted, which leaves the result public or private. */
+  pemType?: Type;
   /** Additional JWK properties merged into the exported key (e.g. `kid`). */
   jwkParams?: JWKMetadata;
-}): Promise<T>;
+}): Promise<ImportedPEMJWK<A, Type>>;
 /**
  * Exports an asymmetric JWK as PEM: PKCS#8 when it carries `d`, SPKI otherwise.
  *
@@ -196,4 +204,4 @@ export declare function deriveSharedSecret(publicKey: CryptoKey | JWK_EC_Public,
  * An invalid set throws `ERR_JWK_INVALID`.
  */
 export declare function getJWKsFromSet(jwkSet: JWKSet, filter?: (jwk: JWK) => boolean): JWK[];
-export { type CompositeKey, type ContentEncryptionAlgorithm, type DeriveKeyOptions, type DeriveKeyReturn, type ECDHEphemeralKeyInput, type GenerateJWKOptions, type GenerateJWKReturn, type GenerateKeyAlgorithm, type GenerateKeyOptions, type GenerateKeyReturn, type GeneratedJWKMap, type GeneratedKeyMap, type ImportedKey, type ImportedKeyMap, type JWK, type JWKAlgorithm, type JWKCacheAdapter, type JWKLookupFunction, type JWKLookupFunctionHeader, type JWKMetadata, type JWKPEMAlgorithm, type JWKParameters, type JWKSet, type JWK_AES_CBC_HMAC, type JWK_AES_GCM, type JWK_AES_GCM_KW, type JWK_AES_KW, type JWK_Asymmetric, type JWK_Asymmetric_Algorithm, type JWK_EC, type JWK_ECDH_ES, type JWK_ECDSA, type JWK_EC_Private, type JWK_EC_Public, type JWK_HMAC, type JWK_OKP, type JWK_OKP_Private, type JWK_OKP_Public, type JWK_OKP_SIGN, type JWK_PBES2, type JWK_Pair, type JWK_Private, type JWK_Public, type JWK_RSA, type JWK_RSA_ENC, type JWK_RSA_PSS, type JWK_RSA_Private, type JWK_RSA_Public, type JWK_RSA_SIGN, type JWK_Symmetric, type JWK_Symmetric_Algorithm, type JWK_oct, JWTError, type JWTErrorCauseMap, type JWTErrorCode, type KeyManagementAlgorithm, type KnownJWTErrorCode, type ThumbprintHash, UnsecureError, type UnsecureErrorCode, type UnwrapKeyOptions, type UnwrapKeyResult, type UnwrappingKeyFor, type WrapKeyOptions, type WrapKeyResult, type WrappingKeyFor, isJWTError, isUnsecureError, thumbprint };
+export { type CompositeKey, type ContentEncryptionAlgorithm, type DeriveJWKOptions, type DeriveJWKReturn, type DeriveKeyOptions, type DeriveKeyReturn, type ECDHEphemeralKeyInput, type GenerateJWKOptions, type GenerateJWKReturn, type GenerateKeyAlgorithm, type GenerateKeyOptions, type GenerateKeyReturn, type GeneratedJWKMap, type GeneratedKeyMap, type ImportedKey, type ImportedKeyMap, type ImportedPEMJWK, type JWK, type JWKAlgorithm, type JWKCacheAdapter, type JWKLookupFunction, type JWKLookupFunctionHeader, type JWKMetadata, type JWKPEMAlgorithm, type JWKParameters, type JWKSet, type JWK_AES_Algorithm, type JWK_AES_CBC_HMAC, type JWK_AES_GCM, type JWK_AES_GCM_KW, type JWK_AES_KW, type JWK_Asymmetric, type JWK_Asymmetric_Algorithm, type JWK_EC, type JWK_ECDH_ES, type JWK_ECDSA, type JWK_EC_Private, type JWK_EC_Public, type JWK_HMAC, type JWK_OKP, type JWK_OKP_Private, type JWK_OKP_Public, type JWK_OKP_SIGN, type JWK_PBES2, type JWK_Pair, type JWK_Private, type JWK_Public, type JWK_RSA, type JWK_RSA_ENC, type JWK_RSA_PSS, type JWK_RSA_Private, type JWK_RSA_Public, type JWK_RSA_SIGN, type JWK_Symmetric, type JWK_Symmetric_Algorithm, type JWK_oct, JWTError, type JWTErrorCauseMap, type JWTErrorCode, type KeyManagementAlgorithm, type KeyWrapAlgorithmOf, type KeyWrappingAlgorithm, type KnownJWTErrorCode, type PEMType, type ThumbprintHash, type ToPublicJWKReturn, UnsecureError, type UnsecureErrorCode, type UnwrapKeyOptions, type UnwrapKeyResult, type UnwrappingKeyFor, type WrapKeyOptions, type WrapKeyResult, type WrappingKeyFor, isJWTError, isUnsecureError, thumbprint };

package/dist/core/jwk.mjs

@@ -1,4 +1,4 @@
 import { UnsecureError } from "../_chunks/libs/unsecure.mjs";
 import { JWTError, isJWTError, isUnsecureError } from "../_chunks/_jwt-internal.mjs";
-import { WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportKey, exportPEM, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, thumbprint, unwrapKey, wrapKey } from "../_chunks/jwk.mjs";
-export { JWTError, UnsecureError, WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportKey, exportPEM, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, isJWTError, isUnsecureError, thumbprint, unwrapKey, wrapKey };
+import { WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportJWK, exportKey, exportPEM, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, thumbprint, toPublicJWK, unwrapKey, wrapKey } from "../_chunks/jwk.mjs";
+export { JWTError, UnsecureError, WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportJWK, exportKey, exportPEM, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, isJWTError, isUnsecureError, thumbprint, toPublicJWK, unwrapKey, wrapKey };

package/dist/core/jws.d.mts

@@ -1,5 +1,5 @@
 import { UnsecureError, UnsecureErrorCode } from "../_chunks/libs/unsecure.mjs";
-import { JOSEPayloadMode, JOSEPayloadTypeMap, JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHeaderParameters, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWTError, JWTErrorCauseMap, JWTErrorCode, KnownJWTErrorCode, PayloadOf, isJWTError, isUnsecureError } from "../_chunks/index.mjs";
+import { JOSEPayloadMode, JOSEPayloadTypeMap, JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHashedAlgorithm, JWSHeaderParameters, JWSKeyLookup, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWTError, JWTErrorCauseMap, JWTErrorCode, KnownJWTErrorCode, PayloadOf, isJWTError, isUnsecureError } from "../_chunks/index.mjs";
 import { DEFAULT_JOSE_LIMITS } from "../_chunks/_internal.mjs";
 import { generalToFlattenedJWS, sign, signMulti, verify, verifyMulti, verifyMultiAll } from "../_chunks/jws.mjs";
-export { DEFAULT_JOSE_LIMITS, type JOSEPayloadMode, type JOSEPayloadTypeMap, type JWSAlgorithm, type JWSAsymmetricPrivateJWK, type JWSAsymmetricPublicJWK, type JWSFlattenedSerialization, type JWSGeneralSerialization, type JWSGeneralSignature, type JWSHeaderParameters, type JWSMultiSignOptions, type JWSMultiSigner, type JWSMultiVerifyAllOptions, type JWSMultiVerifyOptions, type JWSMultiVerifyOutcome, type JWSMultiVerifyResult, type JWSProtectedHeader, type JWSSignJWK, type JWSSignOptions, type JWSVerifyJWK, type JWSVerifyOptions, type JWSVerifyResult, JWTError, type JWTErrorCauseMap, type JWTErrorCode, type KnownJWTErrorCode, type PayloadOf, UnsecureError, type UnsecureErrorCode, generalToFlattenedJWS, isJWTError, isUnsecureError, sign, signMulti, verify, verifyMulti, verifyMultiAll };
+export { DEFAULT_JOSE_LIMITS, type JOSEPayloadMode, type JOSEPayloadTypeMap, type JWSAlgorithm, type JWSAsymmetricPrivateJWK, type JWSAsymmetricPublicJWK, type JWSFlattenedSerialization, type JWSGeneralSerialization, type JWSGeneralSignature, type JWSHashedAlgorithm, type JWSHeaderParameters, type JWSKeyLookup, type JWSMultiSignOptions, type JWSMultiSigner, type JWSMultiVerifyAllOptions, type JWSMultiVerifyOptions, type JWSMultiVerifyOutcome, type JWSMultiVerifyResult, type JWSProtectedHeader, type JWSSignJWK, type JWSSignOptions, type JWSVerifyJWK, type JWSVerifyOptions, type JWSVerifyResult, JWTError, type JWTErrorCauseMap, type JWTErrorCode, type KnownJWTErrorCode, type PayloadOf, UnsecureError, type UnsecureErrorCode, generalToFlattenedJWS, isJWTError, isUnsecureError, sign, signMulti, verify, verifyMulti, verifyMultiAll };

package/dist/core/utils/index.d.mts

@@ -1,5 +1,6 @@
 import { BytesSource, DecodeOptions, DecodeReturnAs, UnsecureError, UnsecureErrorCode, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder } from "../../_chunks/libs/unsecure.mjs";
 import { StrictOmit, isUnsecureError } from "../../_chunks/index.mjs";
+import { DigestHash, digestUrl } from "../../_chunks/digest.mjs";
 import { computeDurationInSeconds, isJWTContent, validateJwtClaims } from "../../_chunks/jwt.mjs";
 import { ComputeJwtTimeClaimsOptions, DecodePayloadOptions, InferAlgorithmsOptions, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeJwtTimeClaims, concatUint8Arrays, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, validateCriticalHeadersJWE, validateCriticalHeadersJWS } from "../../_chunks/index3.mjs";
-export { type BytesSource, ComputeJwtTimeClaimsOptions, type DecodeOptions, DecodePayloadOptions, type DecodeReturnAs, type InferAlgorithmsOptions, type StrictOmit, UnsecureError, type UnsecureErrorCode, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeDurationInSeconds, computeJwtTimeClaims, concatUint8Arrays, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims };
+export { type BytesSource, ComputeJwtTimeClaimsOptions, type DecodeOptions, DecodePayloadOptions, type DecodeReturnAs, type DigestHash, type InferAlgorithmsOptions, type StrictOmit, UnsecureError, type UnsecureErrorCode, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeDurationInSeconds, computeJwtTimeClaims, concatUint8Arrays, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, digestUrl, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims };

package/dist/core/utils/index.mjs

@@ -1,6 +1,6 @@
 import { UnsecureError, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder } from "../../_chunks/libs/unsecure.mjs";
 import { applyTypDefault, assertCritShape as assertCritShape$1, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeDurationInSeconds, computeJwtTimeClaims as computeJwtTimeClaims$1, concatUint8Arrays, getPlaintextBytes as getPlaintextBytes$1, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, parsePayloadBytes, parsePayloadSegment, validateCriticalHeadersJWE as validateCriticalHeadersJWE$1, validateCriticalHeadersJWS as validateCriticalHeadersJWS$1, validateJwtClaims } from "../../_chunks/_jwt-internal.mjs";
-import { inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms } from "../../_chunks/algorithms.mjs";
+import { digestUrl, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms } from "../../_chunks/digest.mjs";
 const applyTypCtyDefaults = applyTypDefault;
 const decodePayloadFromBytes = parsePayloadBytes;
 const decodePayloadFromB64UrlSegment = parsePayloadSegment;
@@ -9,4 +9,4 @@ const computeJwtTimeClaims = computeJwtTimeClaims$1;
 const validateCriticalHeadersJWS = validateCriticalHeadersJWS$1;
 const validateCriticalHeadersJWE = validateCriticalHeadersJWE$1;
 const assertCritShape = assertCritShape$1;
-export { UnsecureError, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeDurationInSeconds, computeJwtTimeClaims, concatUint8Arrays, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims };
+export { UnsecureError, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeDurationInSeconds, computeJwtTimeClaims, concatUint8Arrays, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, digestUrl, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims };

package/dist/index.d.mts

@@ -1,10 +1,11 @@
 import { BytesSource, DecodeOptions, DecodeReturnAs, UnsecureError, UnsecureErrorCode, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder } from "./_chunks/libs/unsecure.mjs";
-import { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, Duration, ECDHEphemeralKeyInput, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, GeneratedJWKMap, GeneratedKeyMap, ImportedKey, ImportedKeyMap, JOSEConsumerOptions, JOSELimits, JOSEPayload, JOSEPayloadMode, JOSEPayloadTypeMap, JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWELibraryHeaderName, JWEMultiDecryptKey, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKMetadata, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHeaderParameters, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JWTError, JWTErrorCauseMap, JWTErrorCode, JWTTimeClaimOptions, JoseHeaderParameters, KeyManagementAlgorithm, KnownJWTErrorCode, MaxTokenAge, NotBeforeIn, PayloadOf, StrictOmit, UnwrapKeyOptions, UnwrapKeyResult, UnwrappingKeyFor, WrapKeyOptions, WrapKeyResult, WrappingKeyFor, isJWTError, isUnsecureError } from "./_chunks/index.mjs";
+import { CompositeKey, ContentEncryptionAlgorithm, DeriveJWKOptions, DeriveJWKReturn, DeriveKeyOptions, DeriveKeyReturn, Duration, ECDHEphemeralKeyInput, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, GeneratedJWKMap, GeneratedKeyMap, ImportedKey, ImportedKeyMap, ImportedPEMJWK, JOSEConsumerOptions, JOSELimits, JOSEPayload, JOSEPayloadMode, JOSEPayloadTypeMap, JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyLookup, JWEKeyManagementHeaderParameters, JWELibraryHeaderName, JWEMultiDecryptKey, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKMetadata, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_Algorithm, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHashedAlgorithm, JWSHeaderParameters, JWSKeyLookup, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JWTConfirmation, JWTError, JWTErrorCauseMap, JWTErrorCode, JWTTimeClaimOptions, JoseHeaderParameters, KeyManagementAlgorithm, KeyWrapAlgorithmOf, KeyWrappingAlgorithm, KnownJWTErrorCode, MaxTokenAge, NotBeforeIn, PEMType, PayloadOf, StrictOmit, ToPublicJWKReturn, UnwrapKeyOptions, UnwrapKeyResult, UnwrappingKeyFor, WrapKeyOptions, WrapKeyResult, WrappingKeyFor, isJWTError, isUnsecureError } from "./_chunks/index.mjs";
 import { thumbprint } from "./_chunks/index2.mjs";
-import { WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportKey, exportPEM, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, unwrapKey, wrapKey } from "./core/jwk.mjs";
+import { DigestHash, digestUrl } from "./_chunks/digest.mjs";
+import { WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportJWK, exportKey, exportPEM, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, toPublicJWK, unwrapKey, wrapKey } from "./core/jwk.mjs";
 import { computeDurationInSeconds, isJWTContent, validateJwtClaims } from "./_chunks/jwt.mjs";
 import { decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened } from "./_chunks/jwe.mjs";
 import { DEFAULT_JOSE_LIMITS } from "./_chunks/_internal.mjs";
 import { generalToFlattenedJWS, sign, signMulti, verify, verifyMulti, verifyMultiAll } from "./_chunks/jws.mjs";
 import { ComputeJwtTimeClaimsOptions, DecodePayloadOptions, InferAlgorithmsOptions, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeJwtTimeClaims, concatUint8Arrays, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, validateCriticalHeadersJWE, validateCriticalHeadersJWS } from "./_chunks/index3.mjs";
-export { type BytesSource, type CompositeKey, ComputeJwtTimeClaimsOptions, type ContentEncryptionAlgorithm, DEFAULT_JOSE_LIMITS, type DecodeOptions, DecodePayloadOptions, type DecodeReturnAs, type DeriveKeyOptions, type DeriveKeyReturn, type Duration, type ECDHEphemeralKeyInput, type ExpiresIn, type GenerateJWKOptions, type GenerateJWKReturn, type GenerateKeyAlgorithm, type GenerateKeyOptions, type GenerateKeyReturn, type GeneratedJWKMap, type GeneratedKeyMap, type ImportedKey, type ImportedKeyMap, type InferAlgorithmsOptions, type JOSEConsumerOptions, type JOSELimits, type JOSEPayload, type JOSEPayloadMode, type JOSEPayloadTypeMap, type JWEAsymmetricPrivateJWK, type JWEAsymmetricPublicJWK, type JWEDecryptJWK, type JWEDecryptOptions, type JWEDecryptResult, type JWEEncryptJWK, type JWEEncryptOptions, type JWEFlattenedSerialization, type JWEGeneralRecipient, type JWEGeneralSerialization, type JWEHeaderParameters, type JWEKeyManagementHeaderParameters, type JWELibraryHeaderName, type JWEMultiDecryptKey, type JWEMultiDecryptOptions, type JWEMultiDecryptResult, type JWEMultiEncryptOptions, type JWEMultiRecipient, type JWEProtectedHeader, type JWK, type JWKAlgorithm, type JWKCacheAdapter, type JWKLookupFunction, type JWKLookupFunctionHeader, type JWKMetadata, type JWKPEMAlgorithm, type JWKParameters, type JWKSet, type JWK_AES_CBC_HMAC, type JWK_AES_GCM, type JWK_AES_GCM_KW, type JWK_AES_KW, type JWK_Asymmetric, type JWK_Asymmetric_Algorithm, type JWK_EC, type JWK_ECDH_ES, type JWK_ECDSA, type JWK_EC_Private, type JWK_EC_Public, type JWK_HMAC, type JWK_OKP, type JWK_OKP_Private, type JWK_OKP_Public, type JWK_OKP_SIGN, type JWK_PBES2, type JWK_Pair, type JWK_Private, type JWK_Public, type JWK_RSA, type JWK_RSA_ENC, type JWK_RSA_PSS, type JWK_RSA_Private, type JWK_RSA_Public, type JWK_RSA_SIGN, type JWK_Symmetric, type JWK_Symmetric_Algorithm, type JWK_oct, type JWSAlgorithm, type JWSAsymmetricPrivateJWK, type JWSAsymmetricPublicJWK, type JWSFlattenedSerialization, type JWSGeneralSerialization, type JWSGeneralSignature, type JWSHeaderParameters, type JWSMultiSignOptions, type JWSMultiSigner, type JWSMultiVerifyAllOptions, type JWSMultiVerifyOptions, type JWSMultiVerifyOutcome, type JWSMultiVerifyResult, type JWSProtectedHeader, type JWSSignJWK, type JWSSignOptions, type JWSVerifyJWK, type JWSVerifyOptions, type JWSVerifyResult, type JWT, type JWTClaimValidationOptions, type JWTClaims, JWTError, type JWTErrorCauseMap, type JWTErrorCode, type JWTTimeClaimOptions, type JoseHeaderParameters, type KeyManagementAlgorithm, type KnownJWTErrorCode, type MaxTokenAge, type NotBeforeIn, type PayloadOf, type StrictOmit, UnsecureError, type UnsecureErrorCode, type UnwrapKeyOptions, type UnwrapKeyResult, type UnwrappingKeyFor, WeakMapJWKCache, type WrapKeyOptions, type WrapKeyResult, type WrappingKeyFor, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, clearJWKCache, computeDurationInSeconds, computeJwtTimeClaims, concatUint8Arrays, configureJWKCache, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, decrypt, decryptMulti, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, encrypt, encryptMulti, exportKey, exportPEM, generalToFlattened, generalToFlattenedJWS, generateJWK, generateKey, getJWKsFromSet, getPlaintextBytes, importKey, importPEM, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, sign, signMulti, textDecoder, textEncoder, thumbprint, unwrapKey, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims, verify, verifyMulti, verifyMultiAll, wrapKey };
+export { type BytesSource, type CompositeKey, ComputeJwtTimeClaimsOptions, type ContentEncryptionAlgorithm, DEFAULT_JOSE_LIMITS, type DecodeOptions, DecodePayloadOptions, type DecodeReturnAs, type DeriveJWKOptions, type DeriveJWKReturn, type DeriveKeyOptions, type DeriveKeyReturn, type DigestHash, type Duration, type ECDHEphemeralKeyInput, type ExpiresIn, type GenerateJWKOptions, type GenerateJWKReturn, type GenerateKeyAlgorithm, type GenerateKeyOptions, type GenerateKeyReturn, type GeneratedJWKMap, type GeneratedKeyMap, type ImportedKey, type ImportedKeyMap, type ImportedPEMJWK, type InferAlgorithmsOptions, type JOSEConsumerOptions, type JOSELimits, type JOSEPayload, type JOSEPayloadMode, type JOSEPayloadTypeMap, type JWEAsymmetricPrivateJWK, type JWEAsymmetricPublicJWK, type JWEDecryptJWK, type JWEDecryptOptions, type JWEDecryptResult, type JWEEncryptJWK, type JWEEncryptOptions, type JWEFlattenedSerialization, type JWEGeneralRecipient, type JWEGeneralSerialization, type JWEHeaderParameters, type JWEKeyLookup, type JWEKeyManagementHeaderParameters, type JWELibraryHeaderName, type JWEMultiDecryptKey, type JWEMultiDecryptOptions, type JWEMultiDecryptResult, type JWEMultiEncryptOptions, type JWEMultiRecipient, type JWEProtectedHeader, type JWK, type JWKAlgorithm, type JWKCacheAdapter, type JWKLookupFunction, type JWKLookupFunctionHeader, type JWKMetadata, type JWKPEMAlgorithm, type JWKParameters, type JWKSet, type JWK_AES_Algorithm, type JWK_AES_CBC_HMAC, type JWK_AES_GCM, type JWK_AES_GCM_KW, type JWK_AES_KW, type JWK_Asymmetric, type JWK_Asymmetric_Algorithm, type JWK_EC, type JWK_ECDH_ES, type JWK_ECDSA, type JWK_EC_Private, type JWK_EC_Public, type JWK_HMAC, type JWK_OKP, type JWK_OKP_Private, type JWK_OKP_Public, type JWK_OKP_SIGN, type JWK_PBES2, type JWK_Pair, type JWK_Private, type JWK_Public, type JWK_RSA, type JWK_RSA_ENC, type JWK_RSA_PSS, type JWK_RSA_Private, type JWK_RSA_Public, type JWK_RSA_SIGN, type JWK_Symmetric, type JWK_Symmetric_Algorithm, type JWK_oct, type JWSAlgorithm, type JWSAsymmetricPrivateJWK, type JWSAsymmetricPublicJWK, type JWSFlattenedSerialization, type JWSGeneralSerialization, type JWSGeneralSignature, type JWSHashedAlgorithm, type JWSHeaderParameters, type JWSKeyLookup, type JWSMultiSignOptions, type JWSMultiSigner, type JWSMultiVerifyAllOptions, type JWSMultiVerifyOptions, type JWSMultiVerifyOutcome, type JWSMultiVerifyResult, type JWSProtectedHeader, type JWSSignJWK, type JWSSignOptions, type JWSVerifyJWK, type JWSVerifyOptions, type JWSVerifyResult, type JWT, type JWTClaimValidationOptions, type JWTClaims, type JWTConfirmation, JWTError, type JWTErrorCauseMap, type JWTErrorCode, type JWTTimeClaimOptions, type JoseHeaderParameters, type KeyManagementAlgorithm, type KeyWrapAlgorithmOf, type KeyWrappingAlgorithm, type KnownJWTErrorCode, type MaxTokenAge, type NotBeforeIn, type PEMType, type PayloadOf, type StrictOmit, type ToPublicJWKReturn, UnsecureError, type UnsecureErrorCode, type UnwrapKeyOptions, type UnwrapKeyResult, type UnwrappingKeyFor, WeakMapJWKCache, type WrapKeyOptions, type WrapKeyResult, type WrappingKeyFor, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, clearJWKCache, computeDurationInSeconds, computeJwtTimeClaims, concatUint8Arrays, configureJWKCache, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, decrypt, decryptMulti, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, digestUrl, encrypt, encryptMulti, exportJWK, exportKey, exportPEM, generalToFlattened, generalToFlattenedJWS, generateJWK, generateKey, getJWKsFromSet, getPlaintextBytes, importKey, importPEM, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, sign, signMulti, textDecoder, textEncoder, thumbprint, toPublicJWK, unwrapKey, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims, verify, verifyMulti, verifyMultiAll, wrapKey };

package/dist/index.mjs

@@ -1,8 +1,8 @@
 import { UnsecureError, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder } from "./_chunks/libs/unsecure.mjs";
 import { JWTError, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeDurationInSeconds, concatUint8Arrays, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, validateJwtClaims } from "./_chunks/_jwt-internal.mjs";
-import { inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms } from "./_chunks/algorithms.mjs";
-import { DEFAULT_JOSE_LIMITS, WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportKey, exportPEM, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, thumbprint, unwrapKey, wrapKey } from "./_chunks/jwk.mjs";
+import { digestUrl, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms } from "./_chunks/digest.mjs";
+import { DEFAULT_JOSE_LIMITS, WeakMapJWKCache, clearJWKCache, configureJWKCache, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, exportJWK, exportKey, exportPEM, generateJWK, generateKey, getJWKsFromSet, importKey, importPEM, thumbprint, toPublicJWK, unwrapKey, wrapKey } from "./_chunks/jwk.mjs";
 import { generalToFlattenedJWS, sign, signMulti, verify, verifyMulti, verifyMultiAll } from "./_chunks/jws.mjs";
 import { decrypt, decryptMulti, encrypt, encryptMulti, generalToFlattened } from "./_chunks/jwe.mjs";
 import { applyTypCtyDefaults, assertCritShape, computeJwtTimeClaims, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, validateCriticalHeadersJWE, validateCriticalHeadersJWS } from "./core/utils/index.mjs";
-export { DEFAULT_JOSE_LIMITS, JWTError, UnsecureError, WeakMapJWKCache, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, clearJWKCache, computeDurationInSeconds, computeJwtTimeClaims, concatUint8Arrays, configureJWKCache, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, decrypt, decryptMulti, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, encrypt, encryptMulti, exportKey, exportPEM, generalToFlattened, generalToFlattenedJWS, generateJWK, generateKey, getJWKsFromSet, getPlaintextBytes, importKey, importPEM, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, sign, signMulti, textDecoder, textEncoder, thumbprint, unwrapKey, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims, verify, verifyMulti, verifyMultiAll, wrapKey };
+export { DEFAULT_JOSE_LIMITS, JWTError, UnsecureError, WeakMapJWKCache, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, clearJWKCache, computeDurationInSeconds, computeJwtTimeClaims, concatUint8Arrays, configureJWKCache, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, decrypt, decryptMulti, deriveJWKFromPassword, deriveKeyFromPassword, deriveSharedSecret, digestUrl, encrypt, encryptMulti, exportJWK, exportKey, exportPEM, generalToFlattened, generalToFlattenedJWS, generateJWK, generateKey, getJWKsFromSet, getPlaintextBytes, importKey, importPEM, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, sign, signMulti, textDecoder, textEncoder, thumbprint, toPublicJWK, unwrapKey, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims, verify, verifyMulti, verifyMultiAll, wrapKey };

package/dist/session/index.d.mts

@@ -0,0 +1,44 @@
+import { CookieJar, JWESessionConfig, JWESessionHooks, JWSSessionConfig, JWSSessionHooks, OpenedSessionState, SessionClaims, SessionContext, SessionData, SessionDecryptOptions, SessionDefinition, SessionDriver, SessionEncryptOptions, SessionIssueOptions, SessionManager, SessionRecord, SessionRequestEvent, SessionRequestHeaders, SessionSignOptions, SessionState, SessionToken, SessionUpdate, SessionUpdateTrigger, SessionVerifyOptions } from "../_chunks/_codec-jwe.mjs";
+import { CookieAttributes } from "../_chunks/_cookie-attributes.mjs";
+import { CompositeKey, ContentEncryptionAlgorithm, DeriveJWKOptions, DeriveJWKReturn, DeriveKeyOptions, DeriveKeyReturn, Duration, ECDHEphemeralKeyInput, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, GeneratedJWKMap, GeneratedKeyMap, ImportedKey, ImportedKeyMap, ImportedPEMJWK, JOSEConsumerOptions, JOSELimits, JOSEPayload, JOSEPayloadMode, JOSEPayloadTypeMap, JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyLookup, JWEKeyManagementHeaderParameters, JWELibraryHeaderName, JWEMultiDecryptKey, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKMetadata, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_Algorithm, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHashedAlgorithm, JWSHeaderParameters, JWSKeyLookup, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JWTConfirmation, JWTTimeClaimOptions, JoseHeaderParameters, KeyManagementAlgorithm, KeyWrapAlgorithmOf, KeyWrappingAlgorithm, MaxTokenAge, NotBeforeIn, PEMType, PayloadOf, ToPublicJWKReturn, UnwrapKeyOptions, UnwrapKeyResult, UnwrappingKeyFor, WrapKeyOptions, WrapKeyResult, WrappingKeyFor } from "../_chunks/index.mjs";
+import { thumbprint } from "../_chunks/index2.mjs";
+import { deriveJWKFromPassword, exportPEM, generateJWK, importPEM, toPublicJWK } from "../core/jwk.mjs";
+/** Session state for the current request, mirroring the claims of its JWS token. */
+interface SessionJWS<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> extends SessionState<T, MaxAge> {}
+/** JWS session hooks; `onRead`, `onExpire` and `onError` are mutually exclusive per token. */
+interface SessionHooksJWS<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TContext = SessionContext> extends JWSSessionHooks<SessionJWS<T, MaxAge>, SessionManager<T, MaxAge>, {
+  context: TContext;
+}, SessionConfigJWS<T, MaxAge, TContext>> {}
+/** Configuration for a JWS-backed (signed, not encrypted) session. */
+interface SessionConfigJWS<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TContext = SessionContext> extends JWSSessionConfig<MaxAge, CookieAttributes> {
+  /** Cookie and session-header name. Default `"unjwt-jws"`; a `.<digits>` suffix throws `ERR_SESSION_CONFIG_INVALID`. */
+  name?: string;
+  hooks?: SessionHooksJWS<T, MaxAge, TContext>;
+}
+/** Defines a JWS (signed, not encrypted) session once, its data readable by clients; `use`, `token`, `issue` and `open` serve every request. */
+export declare function defineJWSSession<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TContext extends SessionContext = SessionContext>(config: SessionConfigJWS<T, MaxAge, TContext>): SessionDefinition<T, MaxAge, TContext>;
+/** Defines a JWS (signed, not encrypted) session over a framework driver of your own. */
+export declare function defineJWSSession<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TContext = SessionContext>(config: SessionConfigJWS<T, MaxAge, TContext>, options: {
+  driver: SessionDriver<TContext>;
+}): SessionDefinition<T, MaxAge, TContext>;
+/** Session state for the current request, mirroring the claims of its JWE token. */
+interface SessionJWE<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> extends SessionState<T, MaxAge> {}
+/** JWE session hooks; `onRead`, `onExpire` and `onError` are mutually exclusive per token. */
+interface SessionHooksJWE<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TContext = SessionContext> extends JWESessionHooks<SessionJWE<T, MaxAge>, SessionManager<T, MaxAge>, {
+  context: TContext;
+}, SessionConfigJWE<T, MaxAge, TContext>> {}
+/** Configuration for a JWE-backed (encrypted) session. */
+interface SessionConfigJWE<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TContext = SessionContext> extends JWESessionConfig<MaxAge, CookieAttributes> {
+  /** Cookie and session-header name. Default `"unjwt-jwe"`; a `.<digits>` suffix throws `ERR_SESSION_CONFIG_INVALID`. */
+  name?: string;
+  hooks?: SessionHooksJWE<T, MaxAge, TContext>;
+}
+/** Defines a JWE (encrypted) session once; `use`, `token`, `issue` and `open` serve every request. */
+export declare function defineJWESession<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TContext extends SessionContext = SessionContext>(config: SessionConfigJWE<T, MaxAge, TContext>): SessionDefinition<T, MaxAge, TContext>;
+/** Defines a JWE (encrypted) session over a framework driver of your own. */
+export declare function defineJWESession<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TContext = SessionContext>(config: SessionConfigJWE<T, MaxAge, TContext>, options: {
+  driver: SessionDriver<TContext>;
+}): SessionDefinition<T, MaxAge, TContext>;
+/** Types a session driver for a framework; pass it to `defineJWSSession` / `defineJWESession` as `{ driver }`. */
+export declare function defineSessionDriver<TContext>(driver: SessionDriver<TContext>): SessionDriver<TContext>;
+export { type CompositeKey, type ContentEncryptionAlgorithm, type CookieAttributes, type CookieJar, type DeriveJWKOptions, type DeriveJWKReturn, type DeriveKeyOptions, type DeriveKeyReturn, type Duration, type ECDHEphemeralKeyInput, type ExpiresIn, type GenerateJWKOptions, type GenerateJWKReturn, type GenerateKeyAlgorithm, type GenerateKeyOptions, type GenerateKeyReturn, type GeneratedJWKMap, type GeneratedKeyMap, type ImportedKey, type ImportedKeyMap, type ImportedPEMJWK, type JOSEConsumerOptions, type JOSELimits, type JOSEPayload, type JOSEPayloadMode, type JOSEPayloadTypeMap, type JWEAsymmetricPrivateJWK, type JWEAsymmetricPublicJWK, type JWEDecryptJWK, type JWEDecryptOptions, type JWEDecryptResult, type JWEEncryptJWK, type JWEEncryptOptions, type JWEFlattenedSerialization, type JWEGeneralRecipient, type JWEGeneralSerialization, type JWEHeaderParameters, type JWEKeyLookup, type JWEKeyManagementHeaderParameters, type JWELibraryHeaderName, type JWEMultiDecryptKey, type JWEMultiDecryptOptions, type JWEMultiDecryptResult, type JWEMultiEncryptOptions, type JWEMultiRecipient, type JWEProtectedHeader, type JWK, type JWKAlgorithm, type JWKCacheAdapter, type JWKLookupFunction, type JWKLookupFunctionHeader, type JWKMetadata, type JWKPEMAlgorithm, type JWKParameters, type JWKSet, type JWK_AES_Algorithm, type JWK_AES_CBC_HMAC, type JWK_AES_GCM, type JWK_AES_GCM_KW, type JWK_AES_KW, type JWK_Asymmetric, type JWK_Asymmetric_Algorithm, type JWK_EC, type JWK_ECDH_ES, type JWK_ECDSA, type JWK_EC_Private, type JWK_EC_Public, type JWK_HMAC, type JWK_OKP, type JWK_OKP_Private, type JWK_OKP_Public, type JWK_OKP_SIGN, type JWK_PBES2, type JWK_Pair, type JWK_Private, type JWK_Public, type JWK_RSA, type JWK_RSA_ENC, type JWK_RSA_PSS, type JWK_RSA_Private, type JWK_RSA_Public, type JWK_RSA_SIGN, type JWK_Symmetric, type JWK_Symmetric_Algorithm, type JWK_oct, type JWSAlgorithm, type JWSAsymmetricPrivateJWK, type JWSAsymmetricPublicJWK, type JWSFlattenedSerialization, type JWSGeneralSerialization, type JWSGeneralSignature, type JWSHashedAlgorithm, type JWSHeaderParameters, type JWSKeyLookup, type JWSMultiSignOptions, type JWSMultiSigner, type JWSMultiVerifyAllOptions, type JWSMultiVerifyOptions, type JWSMultiVerifyOutcome, type JWSMultiVerifyResult, type JWSProtectedHeader, type JWSSignJWK, type JWSSignOptions, type JWSVerifyJWK, type JWSVerifyOptions, type JWSVerifyResult, type JWT, type JWTClaimValidationOptions, type JWTClaims, type JWTConfirmation, type JWTTimeClaimOptions, type JoseHeaderParameters, type KeyManagementAlgorithm, type KeyWrapAlgorithmOf, type KeyWrappingAlgorithm, type MaxTokenAge, type NotBeforeIn, type OpenedSessionState, type PEMType, type PayloadOf, type SessionClaims, type SessionConfigJWE, type SessionConfigJWS, type SessionContext, type SessionData, type SessionDecryptOptions, type SessionDefinition, type SessionDriver, type SessionEncryptOptions, type SessionHooksJWE, type SessionHooksJWS, type SessionIssueOptions, type SessionJWE, type SessionJWS, type SessionManager, type SessionRequestEvent, type SessionRequestHeaders, type SessionSignOptions, type SessionToken, type SessionUpdate, type SessionUpdateTrigger, type SessionVerifyOptions, type ToPublicJWKReturn, type UnwrapKeyOptions, type UnwrapKeyResult, type UnwrappingKeyFor, type WrapKeyOptions, type WrapKeyResult, type WrappingKeyFor, deriveJWKFromPassword, exportPEM, generateJWK, importPEM, thumbprint, toPublicJWK };

package/dist/session/index.mjs

@@ -0,0 +1,111 @@
+import { deriveJWKFromPassword, exportPEM, generateJWK, importPEM, thumbprint, toPublicJWK } from "../_chunks/jwk.mjs";
+import { createJWECodec, createJWSCodec, defineSession, invalidConfigError, setCookieName, setCookieValues } from "../_chunks/_codec-jws.mjs";
+import { parse, parseSetCookie, serialize } from "../_chunks/libs/cookie-es.mjs";
+function webCookieJar(request, headers) {
+	let cookies;
+	const jar = { read: (name) => (cookies ||= requestCookies(request))[name] };
+	if (headers) {
+		jar.written = (name) => setCookieValues(headers.getSetCookie())[name];
+		jar.write = (name, value, attrs) => {
+			setCookie(headers, {
+				name,
+				value,
+				...attrs
+			});
+		};
+	}
+	return jar;
+}
+function requestCookies(request) {
+	const header = request.get("cookie");
+	return header ? parse(header) : Object.create(null);
+}
+function setCookie(headers, cookie) {
+	const line = serialize({
+		path: "/",
+		...cookie
+	});
+	const key = cookieKey(cookie);
+	const kept = headers.getSetCookie().filter((existing) => {
+		const parsed = parseSetCookie(existing);
+		return parsed ? cookieKey(parsed) !== key : setCookieName(existing) !== cookie.name;
+	});
+	headers.delete("set-cookie");
+	for (const existing of kept) headers.append("set-cookie", existing);
+	headers.append("set-cookie", line);
+}
+function cookieKey(cookie) {
+	const domain = (cookie.domain || "").replace(/^\./, "").toLowerCase();
+	return [
+		cookie.name,
+		domain,
+		cookie.path || "/",
+		cookie.partitioned ? "1" : "0"
+	].join(";");
+}
+const PREFIX = "[unjwt/session]";
+const SESSIONS = /* @__PURE__ */ new WeakMap();
+const webSessionDriver = {
+	prefix: PREFIX,
+	state: (context) => {
+		if (isHanded(context)) return sessionsOf(context);
+		if (context.context) return contextSessions(context.context);
+		return sessionsOf("req" in context ? webRequest(context) : context);
+	},
+	header: (context, name) => isHanded(context) ? void 0 : requestHeaders(context).get(name),
+	cookies: (context) => isHanded(context) ? { read: () => void 0 } : webCookieJar(requestHeaders(context), context.res?.headers),
+	handed: (context) => isHanded(context) ? { token: context.token } : void 0
+};
+function isHanded(context) {
+	if ("req" in context || "headers" in context) return false;
+	if ("token" in context) return true;
+	throw invalidConfigError(`${PREFIX} use() got neither a request event, a request's headers, nor a token.`);
+}
+function requestHeaders(context) {
+	return "req" in context ? webRequest(context).headers : context.headers;
+}
+function webRequest(context) {
+	const headers = context.req.headers;
+	if (typeof headers === "object" && headers !== null && "get" in headers) return context.req;
+	throw invalidConfigError(`${PREFIX} use() got an event whose "req" is not a web Request.`);
+}
+function contextSessions(context) {
+	const existing = context.sessions;
+	if (typeof existing === "object" && existing !== null) return existing;
+	const created = Object.create(null);
+	context.sessions = created;
+	return created;
+}
+function sessionsOf(key) {
+	const existing = SESSIONS.get(key);
+	if (existing) return existing;
+	const created = Object.create(null);
+	SESSIONS.set(key, created);
+	return created;
+}
+function defineJWSSession(config, options) {
+	const driver = options?.driver ?? webSessionDriver;
+	return defineSession(config, {
+		driver,
+		hookArgs: (context) => ({ context }),
+		codec: createJWSCodec({
+			prefix: driver.prefix,
+			defaultName: "unjwt-jws"
+		})
+	});
+}
+function defineJWESession(config, options) {
+	const driver = options?.driver ?? webSessionDriver;
+	return defineSession(config, {
+		driver,
+		hookArgs: (context) => ({ context }),
+		codec: createJWECodec({
+			prefix: driver.prefix,
+			defaultName: "unjwt-jwe"
+		})
+	});
+}
+function defineSessionDriver(driver) {
+	return driver;
+}
+export { defineJWESession, defineJWSSession, defineSessionDriver, deriveJWKFromPassword, exportPEM, generateJWK, importPEM, thumbprint, toPublicJWK };