unjwt 0.8.2 → 0.8.3

package/dist/_chunks/_codec-jwe.d.mts

@@ -39,7 +39,7 @@ interface SessionBaseConfig<MaxAge extends ExpiresIn | undefined = ExpiresIn | u
    *   first 15 minutes change nothing; the first read after that issues a fresh hour. Must be
    *   shorter than `maxAge`.
    *
-   * A read that cannot write (a read-only context, a response already sent) does not reissue;
+   * A read that cannot write (a read-only event, a response already sent) does not reissue;
    * the next request, carrying the same token, does.
    *
    * @default undefined — the session expires at `iat + maxAge` however often it is read.
@@ -124,63 +124,59 @@ export type OpenedSessionState<T extends SessionRecord, MaxAge extends ExpiresIn
   createdAt: number;
 };
 /** One session, defined once from its config and used on any request. */
-export interface SessionDefinition<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TContext = unknown> {
+export interface SessionDefinition<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent = unknown> {
   /** Reads the request's session once and returns its manager; later calls on the same request share that state. */
-  use: (context: TContext) => Promise<SessionManager<T, MaxAge>>;
+  use: (event: TEvent) => Promise<SessionManager<T, MaxAge>>;
   /** The token the request carries (this response's own write first), unopened. */
-  token: (context: TContext) => string | undefined;
+  token: (event: TEvent) => string | undefined;
   /** Mints a token for `data` with a fresh `jti` and `iat`, and `exp` from `maxAge` (`options.maxAge` overrides it); reads and writes nothing. */
   issue: (data?: Partial<SessionData<T>>, options?: SessionIssueOptions) => Promise<string>;
   /** Opens a token into session state, checking `typ`, pinned algorithms, `jti`/`iat` and `exp` when `maxAge` is set; the key-lookup hook receives no request. */
   open: (token: string) => Promise<OpenedSessionState<T, MaxAge>>;
 }
-/** A web-standard request event: reads, and writes while `res` is there. */
-export interface SessionRequestEvent {
-  readonly req: Request;
+interface SessionRequestBase {
   /** The response being prepared; without it the session is read-only. */
   readonly res?: {
     readonly headers: Headers;
   };
-  /** The framework's per-request state, where `sessions` is kept; without it state is keyed on `req`. */
+  /** Per-request state shared with the framework, where `sessions` is kept; without it state is keyed on `req`, else on this object. */
   readonly context?: Record<string, unknown>;
 }
-/** A request by its headers: a `Request` itself, a WebSocket upgrade's request, a peer's `request` with its `context`. */
-export interface SessionRequestHeaders {
+/** A request event: by its `Request`, or by its `Headers` (a `Request` itself, a WebSocket upgrade's request). */
+export type SessionRequestEvent = SessionRequestBase & ({
+  readonly req: Request;
+  readonly headers?: Headers;
+} | {
   readonly headers: Headers;
-  /** The response being prepared, such as the headers a WebSocket `upgrade` returns; without it the session is read-only. */
-  readonly res?: {
-    readonly headers: Headers;
-  };
-  /** Per-request state shared with the framework; without it state is keyed on this object. */
-  readonly context?: Record<string, unknown>;
-}
+  readonly req?: Request;
+});
 /** A token handed in directly; sending a re-issued one is the caller's job. */
-export interface SessionToken {
+export interface SessionHandedToken {
   token: string | undefined;
 }
-/** What `use()` takes: a request event, a request by its headers, or a token in hand. */
-export type SessionContext = SessionRequestEvent | SessionRequestHeaders | SessionToken;
+/** What the Web session driver takes: a request event, or a token in hand. */
+export type WebSessionEvent = SessionRequestEvent | SessionHandedToken;
 /** The cookies of one request and its response, as a framework exposes them. */
 export interface CookieJar<A extends ExpirableCookieAttributes = ExpirableCookieAttributes> {
   /** The request's cookie. */
   read(name: string): string | undefined;
   /** The value this response already assigned to `name` (`""` once deleted), when the framework exposes it. */
   written?(name: string): string | undefined;
-  /** Absent when this context cannot take a `Set-Cookie` (a headers-only event). */
+  /** Absent when this event cannot take a `Set-Cookie` (a request without a response). */
   write?(name: string, value: string, attrs: A): void;
 }
 /** The primitives a framework supplies; the session core builds the cookie and header transports over them. */
-export interface SessionDriver<TContext> {
+export interface SessionDriver<TEvent> {
   /** Message prefix for every error the adapter emits. */
   prefix: string;
   /** The per-request record session state and the session-name registry live in. */
-  state(context: TContext): Record<string, unknown>;
-  header(context: TContext, name: string): string | null | undefined;
-  cookies(context: TContext): CookieJar;
+  state(event: TEvent): Record<string, unknown>;
+  header(event: TEvent, name: string): string | null | undefined;
+  cookies(event: TEvent): CookieJar;
   /** Platform signal that the response can still change (Node `headersSent`); absent = trust the jar. */
-  writable?(context: TContext): boolean;
-  /** A token the context carries directly, when it does: no cookie or header is consulted. */
-  handed?(context: TContext): {
+  writable?(event: TEvent): boolean;
+  /** A token the event carries directly, when it does: no cookie or header is consulted. */
+  handed?(event: TEvent): {
     token: string | undefined;
   } | undefined;
 }

package/dist/_chunks/_codec-jws.mjs

@@ -409,21 +409,21 @@ function decodeValue(value) {
 		return value;
 	}
 }
-function resolveTransport(driver, context, options) {
-	const handed = driver.handed?.(context);
+function resolveTransport(driver, event, options) {
+	const handed = driver.handed?.(event);
 	if (handed) return {
 		read: () => handed.token,
 		readonly: false,
 		writable: () => true
 	};
 	const { config, name } = options;
-	const header = headerReader(driver, context, options);
+	const header = headerReader(driver, event, options);
 	if (config.cookie === false) return {
 		read: header,
 		readonly: false,
 		writable: () => true
 	};
-	const jar = driver.cookies(context);
+	const jar = driver.cookies(event);
 	const store = responseStore(jar);
 	const transport = {
 		read: () => {
@@ -432,7 +432,7 @@ function resolveTransport(driver, context, options) {
 			return (written ?? readChunked(jar, name)) || header?.() || void 0;
 		},
 		readonly: !store,
-		writable: () => driver.writable?.(context) ?? true
+		writable: () => driver.writable?.(event) ?? true
 	};
 	if (!store) return transport;
 	transport.write = (token, { attrs, chunkMaxLength }) => {
@@ -471,11 +471,11 @@ function headerToken(value) {
 	if (/^bearer$/i.test(first)) return words.length === 2 ? second : void 0;
 	return words.length === 1 && first ? first : void 0;
 }
-function headerReader(driver, context, options) {
+function headerReader(driver, event, options) {
 	const { config, name } = options;
 	if (config.sessionHeader === false) return void 0;
 	const header = sessionHeaderName(name, config.sessionHeader);
-	return () => headerToken(driver.header(context, header));
+	return () => headerToken(driver.header(event, header));
 }
 function responseStore(jar) {
 	const write = jar.write?.bind(jar);
@@ -486,7 +486,7 @@ function responseStore(jar) {
 	};
 }
 const kSessionNames = Symbol("unjwt_session_names");
-function bindSession(context, config, options) {
+function bindSession(event, config, options) {
 	const { driver, codec, actions, hookArgs } = options;
 	const { prefix } = driver;
 	const name = config.name || codec.defaultName;
@@ -497,22 +497,22 @@ function bindSession(context, config, options) {
 		...config.cookie
 	}, { prefix });
 	assertRolling(config, { prefix });
-	const record = driver.state(context);
+	const record = driver.state(event);
 	claimSessionName(record, {
 		name,
 		family: codec.family,
 		prefix
 	});
 	return {
-		context,
+		event,
 		config,
 		driver,
 		codec,
 		actions,
 		name,
-		args: hookArgs(context),
+		args: hookArgs(event),
 		store: recordSlotStore(record, `${codec.family}:${name}`),
-		transport: resolveTransport(driver, context, {
+		transport: resolveTransport(driver, event, {
 			config,
 			name
 		})
@@ -828,19 +828,19 @@ function snapshotSession(session) {
 function defineSession(config, options) {
 	const { driver, codec, hookArgs } = options;
 	const actions = sessionActions();
-	const bind = (context) => bindSession(context, config, {
+	const bind = (event) => bindSession(event, config, {
 		driver,
 		codec,
 		actions,
 		hookArgs
 	});
 	return {
-		use: async (context) => {
-			const binding = bind(context);
+		use: async (event) => {
+			const binding = bind(event);
 			await loadSession(binding);
 			return sessionManager(binding);
 		},
-		token: (context) => sessionToken(bind(context)),
+		token: (event) => sessionToken(bind(event)),
 		issue: async (data, issueOptions) => {
 			await codec.assertKeys(config);
 			const issue = codec.issuer(config);

package/dist/_chunks/_jwt-internal.mjs

@@ -283,29 +283,32 @@ function getPlaintextBytes(payload) {
 	throw new JWTError("Plaintext must be a string, Uint8Array, or a JSON-serializable object.", "ERR_INVALID_OPTION");
 }
 function computeJwtTimeClaims(payload, options) {
-	const { currentDate, expiresIn, expiresAt, notBeforeIn, notBeforeAt } = options ?? {};
+	const { currentDate, issuedAt, expiresIn, expiresAt, notBeforeIn, notBeforeAt } = options ?? {};
+	if (issuedAt !== void 0 && typeof issuedAt !== "boolean" && !(issuedAt instanceof Date)) throw new JWTError("\"issuedAt\" must be a boolean or a Date.", "ERR_INVALID_OPTION");
 	if (expiresIn !== void 0 && expiresAt !== void 0) throw new JWTError("\"expiresIn\" and \"expiresAt\" are mutually exclusive; pass only one.", "ERR_JWT_CLAIM_INVALID");
 	if (notBeforeIn !== void 0 && notBeforeAt !== void 0) throw new JWTError("\"notBeforeIn\" and \"notBeforeAt\" are mutually exclusive; pass only one.", "ERR_JWT_CLAIM_INVALID");
 	const hasExpHint = expiresIn !== void 0 || expiresAt !== void 0;
 	const hasNbfHint = notBeforeIn !== void 0 || notBeforeAt !== void 0;
-	if (!hasExpHint && !hasNbfHint) return void 0;
+	const hasIatHint = issuedAt === true || issuedAt instanceof Date;
+	if (!hasExpHint && !hasNbfHint && !hasIatHint) return void 0;
 	if (!payload || typeof payload !== "object" || payload instanceof Uint8Array) return void 0;
 	const wantsExp = hasExpHint && (!("exp" in payload) || payload.exp === void 0);
 	const wantsNbf = hasNbfHint && (!("nbf" in payload) || payload.nbf === void 0);
-	if (!wantsExp && !wantsNbf) return void 0;
+	const wantsIat = hasIatHint && (!("iat" in payload) || payload.iat === void 0);
+	if (!wantsExp && !wantsNbf && !wantsIat) return void 0;
 	const now = Math.round((currentDate ?? /* @__PURE__ */ new Date()).getTime() / 1e3);
 	const claims = { ...payload };
-	claims.iat ||= now;
+	claims.iat ||= issuedAt instanceof Date ? Math.floor(_instantOf(issuedAt, "issuedAt") / 1e3) : now;
 	if (wantsExp) {
 		if (expiresAt !== void 0) claims.exp = Math.floor(_instantOf(expiresAt, "expiresAt") / 1e3);
-		else if (expiresIn !== void 0) claims.exp = claims.iat + computeDurationInSeconds(expiresIn);
+		else if (expiresIn !== void 0) claims.exp = now + computeDurationInSeconds(expiresIn);
 	}
 	if (wantsNbf) {
 		if (notBeforeAt !== void 0) claims.nbf = Math.floor(_instantOf(notBeforeAt, "notBeforeAt") / 1e3);
 		else if (notBeforeIn !== void 0) {
 			const offset = parseDurationSeconds(notBeforeIn);
 			if (offset < 0) throw new JWTError("\"notBeforeIn\" must be zero or a positive duration.", "ERR_JWT_CLAIM_INVALID");
-			claims.nbf = claims.iat + offset;
+			claims.nbf = now + offset;
 		}
 	}
 	return claims;

package/dist/_chunks/index.d.mts

@@ -210,13 +210,15 @@ export interface JWTClaimValidationOptions {
 }
 /** Time claims a producer computes; a claim already in the payload is kept as given. */
 export interface JWTTimeClaimOptions {
-  /** Reference moment for `iat` and relative durations. @default new Date() */
+  /** The clock: `iat` when written, and the base of `expiresIn` / `notBeforeIn`. @default new Date() */
   currentDate?: Date;
-  /** Duration until `exp`; exclusive with `expiresAt`. */
+  /** Writes `iat` on its own: `true` as `currentDate`, a `Date` as that instant; `false` is unset. `exp`/`nbf` options write it either way. */
+  issuedAt?: boolean | Date;
+  /** Duration from `currentDate` until `exp`; exclusive with `expiresAt`. */
   expiresIn?: ExpiresIn;
   /** Absolute `exp`; exclusive with `expiresIn`. */
   expiresAt?: Date;
-  /** Duration from `iat` until `nbf` (`0` sets `nbf = iat`); exclusive with `notBeforeAt`. */
+  /** Duration from `currentDate` until `nbf` (`0` sets `nbf` to it); exclusive with `notBeforeAt`. */
   notBeforeIn?: ExpiresIn;
   /** Absolute `nbf` (RFC 7519 §4.1.5); exclusive with `notBeforeIn`. */
   notBeforeAt?: Date;

package/dist/_chunks/jwt.d.mts

@@ -24,7 +24,8 @@ export declare function getPlaintextBytes(payload: JOSEPayload): Uint8Array<Arra
 export type ComputeJwtTimeClaimsOptions = JWTTimeClaimOptions;
 /**
  * Return a copy of an object payload with `iat` and the requested `exp` / `nbf`, or `undefined` when none applies.
- * Both members of `expiresIn`/`expiresAt` or `notBeforeIn`/`notBeforeAt` throw `ERR_JWT_CLAIM_INVALID`.
+ * `currentDate` is the clock: `iat` when written, and the base of `expiresIn` / `notBeforeIn`;
+ * `issuedAt` writes `iat` alone, a `Date` as that instant. Both members of `expiresIn`/`expiresAt` or `notBeforeIn`/`notBeforeAt` throw `ERR_JWT_CLAIM_INVALID`.
  */
 export declare function computeJwtTimeClaims(payload: unknown, options?: ComputeJwtTimeClaimsOptions): JWTClaims | undefined;
 /** Validate critical headers in JWS semantics. */

package/dist/session/index.d.mts

@@ -1,4 +1,4 @@
-import { CookieJar, JWESessionConfig, JWESessionHooks, JWSSessionConfig, JWSSessionHooks, OpenedSessionState, SessionClaims, SessionContext, SessionData, SessionDecryptOptions, SessionDefinition, SessionDriver, SessionEncryptOptions, SessionIssueOptions, SessionManager, SessionRecord, SessionRequestEvent, SessionRequestHeaders, SessionSignOptions, SessionState, SessionToken, SessionUpdate, SessionUpdateTrigger, SessionVerifyOptions } from "../_chunks/_codec-jwe.mjs";
+import { CookieJar, JWESessionConfig, JWESessionHooks, JWSSessionConfig, JWSSessionHooks, OpenedSessionState, SessionClaims, SessionData, SessionDecryptOptions, SessionDefinition, SessionDriver, SessionEncryptOptions, SessionHandedToken, SessionIssueOptions, SessionManager, SessionRecord, SessionRequestEvent, SessionSignOptions, SessionState, SessionUpdate, SessionUpdateTrigger, SessionVerifyOptions, WebSessionEvent } from "../_chunks/_codec-jwe.mjs";
 import { CookieAttributes } from "../_chunks/_cookie-attributes.mjs";
 import { CompositeKey, ContentEncryptionAlgorithm, DeriveJWKOptions, DeriveJWKReturn, DeriveKeyOptions, DeriveKeyReturn, Duration, ECDHEphemeralKeyInput, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, GeneratedJWKMap, GeneratedKeyMap, ImportedKey, ImportedKeyMap, ImportedPEMJWK, JOSEConsumerOptions, JOSELimits, JOSEPayload, JOSEPayloadMode, JOSEPayloadTypeMap, JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyLookup, JWEKeyManagementHeaderParameters, JWELibraryHeaderName, JWEMultiDecryptKey, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKMetadata, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_Algorithm, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHashedAlgorithm, JWSHeaderParameters, JWSKeyLookup, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JWTConfirmation, JWTTimeClaimOptions, JoseHeaderParameters, KeyManagementAlgorithm, KeyWrapAlgorithmOf, KeyWrappingAlgorithm, MaxTokenAge, NotBeforeIn, PEMType, PayloadOf, ToPublicJWKReturn, UnwrapKeyOptions, UnwrapKeyResult, UnwrappingKeyFor, WrapKeyOptions, WrapKeyResult, WrappingKeyFor } from "../_chunks/index.mjs";
 import { thumbprint } from "../_chunks/index2.mjs";
@@ -6,39 +6,39 @@ import { deriveJWKFromPassword, exportPEM, generateJWK, importPEM, toPublicJWK }
 /** Session state for the current request, mirroring the claims of its JWS token. */
 interface SessionJWS<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> extends SessionState<T, MaxAge> {}
 /** JWS session hooks; `onRead`, `onExpire` and `onError` are mutually exclusive per token. */
-interface SessionHooksJWS<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TContext = SessionContext> extends JWSSessionHooks<SessionJWS<T, MaxAge>, SessionManager<T, MaxAge>, {
-  context: TContext;
-}, SessionConfigJWS<T, MaxAge, TContext>> {}
+interface SessionHooksJWS<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent = WebSessionEvent> extends JWSSessionHooks<SessionJWS<T, MaxAge>, SessionManager<T, MaxAge>, {
+  event: TEvent;
+}, SessionConfigJWS<T, MaxAge, TEvent>> {}
 /** Configuration for a JWS-backed (signed, not encrypted) session. */
-interface SessionConfigJWS<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TContext = SessionContext> extends JWSSessionConfig<MaxAge, CookieAttributes> {
+interface SessionConfigJWS<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent = WebSessionEvent> extends JWSSessionConfig<MaxAge, CookieAttributes> {
   /** Cookie and session-header name. Default `"unjwt-jws"`; a `.<digits>` suffix throws `ERR_SESSION_CONFIG_INVALID`. */
   name?: string;
-  hooks?: SessionHooksJWS<T, MaxAge, TContext>;
+  hooks?: SessionHooksJWS<T, MaxAge, TEvent>;
 }
 /** Defines a JWS (signed, not encrypted) session once, its data readable by clients; `use`, `token`, `issue` and `open` serve every request. */
-export declare function defineJWSSession<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TContext extends SessionContext = SessionContext>(config: SessionConfigJWS<T, MaxAge, TContext>): SessionDefinition<T, MaxAge, TContext>;
+export declare function defineJWSSession<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends WebSessionEvent = WebSessionEvent>(config: SessionConfigJWS<T, MaxAge, TEvent>): SessionDefinition<T, MaxAge, TEvent>;
 /** Defines a JWS (signed, not encrypted) session over a framework driver of your own. */
-export declare function defineJWSSession<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TContext = SessionContext>(config: SessionConfigJWS<T, MaxAge, TContext>, options: {
-  driver: SessionDriver<TContext>;
-}): SessionDefinition<T, MaxAge, TContext>;
+export declare function defineJWSSession<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent = WebSessionEvent>(config: SessionConfigJWS<T, MaxAge, TEvent>, options: {
+  driver: SessionDriver<TEvent>;
+}): SessionDefinition<T, MaxAge, TEvent>;
 /** Session state for the current request, mirroring the claims of its JWE token. */
 interface SessionJWE<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> extends SessionState<T, MaxAge> {}
 /** JWE session hooks; `onRead`, `onExpire` and `onError` are mutually exclusive per token. */
-interface SessionHooksJWE<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TContext = SessionContext> extends JWESessionHooks<SessionJWE<T, MaxAge>, SessionManager<T, MaxAge>, {
-  context: TContext;
-}, SessionConfigJWE<T, MaxAge, TContext>> {}
+interface SessionHooksJWE<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent = WebSessionEvent> extends JWESessionHooks<SessionJWE<T, MaxAge>, SessionManager<T, MaxAge>, {
+  event: TEvent;
+}, SessionConfigJWE<T, MaxAge, TEvent>> {}
 /** Configuration for a JWE-backed (encrypted) session. */
-interface SessionConfigJWE<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TContext = SessionContext> extends JWESessionConfig<MaxAge, CookieAttributes> {
+interface SessionConfigJWE<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent = WebSessionEvent> extends JWESessionConfig<MaxAge, CookieAttributes> {
   /** Cookie and session-header name. Default `"unjwt-jwe"`; a `.<digits>` suffix throws `ERR_SESSION_CONFIG_INVALID`. */
   name?: string;
-  hooks?: SessionHooksJWE<T, MaxAge, TContext>;
+  hooks?: SessionHooksJWE<T, MaxAge, TEvent>;
 }
 /** Defines a JWE (encrypted) session once; `use`, `token`, `issue` and `open` serve every request. */
-export declare function defineJWESession<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TContext extends SessionContext = SessionContext>(config: SessionConfigJWE<T, MaxAge, TContext>): SessionDefinition<T, MaxAge, TContext>;
+export declare function defineJWESession<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent extends WebSessionEvent = WebSessionEvent>(config: SessionConfigJWE<T, MaxAge, TEvent>): SessionDefinition<T, MaxAge, TEvent>;
 /** Defines a JWE (encrypted) session over a framework driver of your own. */
-export declare function defineJWESession<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TContext = SessionContext>(config: SessionConfigJWE<T, MaxAge, TContext>, options: {
-  driver: SessionDriver<TContext>;
-}): SessionDefinition<T, MaxAge, TContext>;
+export declare function defineJWESession<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent = WebSessionEvent>(config: SessionConfigJWE<T, MaxAge, TEvent>, options: {
+  driver: SessionDriver<TEvent>;
+}): SessionDefinition<T, MaxAge, TEvent>;
 /** Types a session driver for a framework; pass it to `defineJWSSession` / `defineJWESession` as `{ driver }`. */
-export declare function defineSessionDriver<TContext>(driver: SessionDriver<TContext>): SessionDriver<TContext>;
-export { type CompositeKey, type ContentEncryptionAlgorithm, type CookieAttributes, type CookieJar, type DeriveJWKOptions, type DeriveJWKReturn, type DeriveKeyOptions, type DeriveKeyReturn, type Duration, type ECDHEphemeralKeyInput, type ExpiresIn, type GenerateJWKOptions, type GenerateJWKReturn, type GenerateKeyAlgorithm, type GenerateKeyOptions, type GenerateKeyReturn, type GeneratedJWKMap, type GeneratedKeyMap, type ImportedKey, type ImportedKeyMap, type ImportedPEMJWK, type JOSEConsumerOptions, type JOSELimits, type JOSEPayload, type JOSEPayloadMode, type JOSEPayloadTypeMap, type JWEAsymmetricPrivateJWK, type JWEAsymmetricPublicJWK, type JWEDecryptJWK, type JWEDecryptOptions, type JWEDecryptResult, type JWEEncryptJWK, type JWEEncryptOptions, type JWEFlattenedSerialization, type JWEGeneralRecipient, type JWEGeneralSerialization, type JWEHeaderParameters, type JWEKeyLookup, type JWEKeyManagementHeaderParameters, type JWELibraryHeaderName, type JWEMultiDecryptKey, type JWEMultiDecryptOptions, type JWEMultiDecryptResult, type JWEMultiEncryptOptions, type JWEMultiRecipient, type JWEProtectedHeader, type JWK, type JWKAlgorithm, type JWKCacheAdapter, type JWKLookupFunction, type JWKLookupFunctionHeader, type JWKMetadata, type JWKPEMAlgorithm, type JWKParameters, type JWKSet, type JWK_AES_Algorithm, type JWK_AES_CBC_HMAC, type JWK_AES_GCM, type JWK_AES_GCM_KW, type JWK_AES_KW, type JWK_Asymmetric, type JWK_Asymmetric_Algorithm, type JWK_EC, type JWK_ECDH_ES, type JWK_ECDSA, type JWK_EC_Private, type JWK_EC_Public, type JWK_HMAC, type JWK_OKP, type JWK_OKP_Private, type JWK_OKP_Public, type JWK_OKP_SIGN, type JWK_PBES2, type JWK_Pair, type JWK_Private, type JWK_Public, type JWK_RSA, type JWK_RSA_ENC, type JWK_RSA_PSS, type JWK_RSA_Private, type JWK_RSA_Public, type JWK_RSA_SIGN, type JWK_Symmetric, type JWK_Symmetric_Algorithm, type JWK_oct, type JWSAlgorithm, type JWSAsymmetricPrivateJWK, type JWSAsymmetricPublicJWK, type JWSFlattenedSerialization, type JWSGeneralSerialization, type JWSGeneralSignature, type JWSHashedAlgorithm, type JWSHeaderParameters, type JWSKeyLookup, type JWSMultiSignOptions, type JWSMultiSigner, type JWSMultiVerifyAllOptions, type JWSMultiVerifyOptions, type JWSMultiVerifyOutcome, type JWSMultiVerifyResult, type JWSProtectedHeader, type JWSSignJWK, type JWSSignOptions, type JWSVerifyJWK, type JWSVerifyOptions, type JWSVerifyResult, type JWT, type JWTClaimValidationOptions, type JWTClaims, type JWTConfirmation, type JWTTimeClaimOptions, type JoseHeaderParameters, type KeyManagementAlgorithm, type KeyWrapAlgorithmOf, type KeyWrappingAlgorithm, type MaxTokenAge, type NotBeforeIn, type OpenedSessionState, type PEMType, type PayloadOf, type SessionClaims, type SessionConfigJWE, type SessionConfigJWS, type SessionContext, type SessionData, type SessionDecryptOptions, type SessionDefinition, type SessionDriver, type SessionEncryptOptions, type SessionHooksJWE, type SessionHooksJWS, type SessionIssueOptions, type SessionJWE, type SessionJWS, type SessionManager, type SessionRequestEvent, type SessionRequestHeaders, type SessionSignOptions, type SessionToken, type SessionUpdate, type SessionUpdateTrigger, type SessionVerifyOptions, type ToPublicJWKReturn, type UnwrapKeyOptions, type UnwrapKeyResult, type UnwrappingKeyFor, type WrapKeyOptions, type WrapKeyResult, type WrappingKeyFor, deriveJWKFromPassword, exportPEM, generateJWK, importPEM, thumbprint, toPublicJWK };
+export declare function defineSessionDriver<TEvent>(driver: SessionDriver<TEvent>): SessionDriver<TEvent>;
+export { type CompositeKey, type ContentEncryptionAlgorithm, type CookieAttributes, type CookieJar, type DeriveJWKOptions, type DeriveJWKReturn, type DeriveKeyOptions, type DeriveKeyReturn, type Duration, type ECDHEphemeralKeyInput, type ExpiresIn, type GenerateJWKOptions, type GenerateJWKReturn, type GenerateKeyAlgorithm, type GenerateKeyOptions, type GenerateKeyReturn, type GeneratedJWKMap, type GeneratedKeyMap, type ImportedKey, type ImportedKeyMap, type ImportedPEMJWK, type JOSEConsumerOptions, type JOSELimits, type JOSEPayload, type JOSEPayloadMode, type JOSEPayloadTypeMap, type JWEAsymmetricPrivateJWK, type JWEAsymmetricPublicJWK, type JWEDecryptJWK, type JWEDecryptOptions, type JWEDecryptResult, type JWEEncryptJWK, type JWEEncryptOptions, type JWEFlattenedSerialization, type JWEGeneralRecipient, type JWEGeneralSerialization, type JWEHeaderParameters, type JWEKeyLookup, type JWEKeyManagementHeaderParameters, type JWELibraryHeaderName, type JWEMultiDecryptKey, type JWEMultiDecryptOptions, type JWEMultiDecryptResult, type JWEMultiEncryptOptions, type JWEMultiRecipient, type JWEProtectedHeader, type JWK, type JWKAlgorithm, type JWKCacheAdapter, type JWKLookupFunction, type JWKLookupFunctionHeader, type JWKMetadata, type JWKPEMAlgorithm, type JWKParameters, type JWKSet, type JWK_AES_Algorithm, type JWK_AES_CBC_HMAC, type JWK_AES_GCM, type JWK_AES_GCM_KW, type JWK_AES_KW, type JWK_Asymmetric, type JWK_Asymmetric_Algorithm, type JWK_EC, type JWK_ECDH_ES, type JWK_ECDSA, type JWK_EC_Private, type JWK_EC_Public, type JWK_HMAC, type JWK_OKP, type JWK_OKP_Private, type JWK_OKP_Public, type JWK_OKP_SIGN, type JWK_PBES2, type JWK_Pair, type JWK_Private, type JWK_Public, type JWK_RSA, type JWK_RSA_ENC, type JWK_RSA_PSS, type JWK_RSA_Private, type JWK_RSA_Public, type JWK_RSA_SIGN, type JWK_Symmetric, type JWK_Symmetric_Algorithm, type JWK_oct, type JWSAlgorithm, type JWSAsymmetricPrivateJWK, type JWSAsymmetricPublicJWK, type JWSFlattenedSerialization, type JWSGeneralSerialization, type JWSGeneralSignature, type JWSHashedAlgorithm, type JWSHeaderParameters, type JWSKeyLookup, type JWSMultiSignOptions, type JWSMultiSigner, type JWSMultiVerifyAllOptions, type JWSMultiVerifyOptions, type JWSMultiVerifyOutcome, type JWSMultiVerifyResult, type JWSProtectedHeader, type JWSSignJWK, type JWSSignOptions, type JWSVerifyJWK, type JWSVerifyOptions, type JWSVerifyResult, type JWT, type JWTClaimValidationOptions, type JWTClaims, type JWTConfirmation, type JWTTimeClaimOptions, type JoseHeaderParameters, type KeyManagementAlgorithm, type KeyWrapAlgorithmOf, type KeyWrappingAlgorithm, type MaxTokenAge, type NotBeforeIn, type OpenedSessionState, type PEMType, type PayloadOf, type SessionClaims, type SessionConfigJWE, type SessionConfigJWS, type SessionData, type SessionDecryptOptions, type SessionDefinition, type SessionDriver, type SessionEncryptOptions, type SessionHandedToken, type SessionHooksJWE, type SessionHooksJWS, type SessionIssueOptions, type SessionJWE, type SessionJWS, type SessionManager, type SessionRequestEvent, type SessionSignOptions, type SessionUpdate, type SessionUpdateTrigger, type SessionVerifyOptions, type ToPublicJWKReturn, type UnwrapKeyOptions, type UnwrapKeyResult, type UnwrappingKeyFor, type WebSessionEvent, type WrapKeyOptions, type WrapKeyResult, type WrappingKeyFor, deriveJWKFromPassword, exportPEM, generateJWK, importPEM, thumbprint, toPublicJWK };

package/dist/session/index.mjs

@@ -47,26 +47,28 @@ const PREFIX = "[unjwt/session]";
 const SESSIONS = /* @__PURE__ */ new WeakMap();
 const webSessionDriver = {
 	prefix: PREFIX,
-	state: (context) => {
-		if (isHanded(context)) return sessionsOf(context);
-		if (context.context) return contextSessions(context.context);
-		return sessionsOf("req" in context ? webRequest(context) : context);
+	state: (event) => {
+		if (isHanded(event)) return sessionsOf(event);
+		if (event.context) return contextSessions(event.context);
+		return sessionsOf(event.req ? webRequest(event.req) : event);
 	},
-	header: (context, name) => isHanded(context) ? void 0 : requestHeaders(context).get(name),
-	cookies: (context) => isHanded(context) ? { read: () => void 0 } : webCookieJar(requestHeaders(context), context.res?.headers),
-	handed: (context) => isHanded(context) ? { token: context.token } : void 0
+	header: (event, name) => isHanded(event) ? void 0 : requestHeaders(event).get(name),
+	cookies: (event) => isHanded(event) ? { read: () => void 0 } : webCookieJar(requestHeaders(event), event.res?.headers),
+	handed: (event) => isHanded(event) ? { token: event.token } : void 0
 };
-function isHanded(context) {
-	if ("req" in context || "headers" in context) return false;
-	if ("token" in context) return true;
-	throw invalidConfigError(`${PREFIX} use() got neither a request event, a request's headers, nor a token.`);
+function isHanded(event) {
+	if ("req" in event || "headers" in event) return false;
+	if ("token" in event) return true;
+	throw invalidConfigError(`${PREFIX} use() got neither a request event nor a token.`);
 }
-function requestHeaders(context) {
-	return "req" in context ? webRequest(context).headers : context.headers;
+function requestHeaders(event) {
+	if (event.req) return webRequest(event.req).headers;
+	if (event.headers) return event.headers;
+	throw invalidConfigError(`${PREFIX} use() got a request event with neither "req" nor "headers".`);
 }
-function webRequest(context) {
-	const headers = context.req.headers;
-	if (typeof headers === "object" && headers !== null && "get" in headers) return context.req;
+function webRequest(req) {
+	const headers = req.headers;
+	if (typeof headers === "object" && headers !== null && "get" in headers) return req;
 	throw invalidConfigError(`${PREFIX} use() got an event whose "req" is not a web Request.`);
 }
 function contextSessions(context) {
@@ -87,7 +89,7 @@ function defineJWSSession(config, options) {
 	const driver = options?.driver ?? webSessionDriver;
 	return defineSession(config, {
 		driver,
-		hookArgs: (context) => ({ context }),
+		hookArgs: (event) => ({ event }),
 		codec: createJWSCodec({
 			prefix: driver.prefix,
 			defaultName: "unjwt-jws"
@@ -98,7 +100,7 @@ function defineJWESession(config, options) {
 	const driver = options?.driver ?? webSessionDriver;
 	return defineSession(config, {
 		driver,
-		hookArgs: (context) => ({ context }),
+		hookArgs: (event) => ({ event }),
 		codec: createJWECodec({
 			prefix: driver.prefix,
 			defaultName: "unjwt-jwe"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.8.2",
+  "version": "0.8.3",
   "description": "A collection of JWT utilities based on the Web Crypto API.",
   "keywords": [
     "auth",