unjwt 0.8.5 → 0.9.1

package/dist/utils/index.d.mts

@@ -1,7 +1,7 @@
-import { BytesSource, UnsecureError, UnsecureErrorCode, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder } from "../_chunks/libs/unsecure.mjs";
+import { UnsecureError, UnsecureErrorCode, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder } from "../_chunks/libs/unsecure.mjs";
 import { isUnsecureError } from "../_chunks/error.mjs";
 import { StrictOmit } from "../_chunks/index.mjs";
-import { DigestHash, digestUrl } from "../_chunks/digest.mjs";
 import { computeDurationInSeconds, isJWTContent, validateJwtClaims } from "../_chunks/jwt.mjs";
-import { Base64ParseOptions, ComputeJwtTimeClaimsOptions, DecodeOptions, DecodePayloadOptions, DecodeReturnAs, InferAlgorithmsOptions, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeJwtTimeClaims, concatUint8Arrays, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, validateCriticalHeadersJWE, validateCriticalHeadersJWS } from "../_chunks/index6.mjs";
-export { type Base64ParseOptions, type BytesSource, ComputeJwtTimeClaimsOptions, DecodeOptions, DecodePayloadOptions, type DecodeReturnAs, type DigestHash, type InferAlgorithmsOptions, type StrictOmit, UnsecureError, type UnsecureErrorCode, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeDurationInSeconds, computeJwtTimeClaims, concatUint8Arrays, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, digestUrl, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims };
+import { DigestHash, digestUrl } from "../_chunks/digest.mjs";
+import { Base64ParseOptions, DecodeReturnAs, assertCryptoKey, base64Parse, base64Stringify, base64UrlParse, base64UrlStringify, concatUint8Arrays, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray } from "../_chunks/index6.mjs";
+export { type Base64ParseOptions, type DecodeReturnAs, type DigestHash, type StrictOmit, UnsecureError, type UnsecureErrorCode, assertCryptoKey, base64Parse, base64Stringify, base64UrlParse, base64UrlStringify, computeDurationInSeconds, concatUint8Arrays, digestUrl, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder, validateJwtClaims };

package/dist/utils/index.mjs

@@ -1,13 +1,5 @@
 import { UnsecureError, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder } from "../_chunks/libs/unsecure.mjs";
 import { isUnsecureError } from "../error.mjs";
-import { applyTypDefault, assertCritShape as assertCritShape$1, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeDurationInSeconds, computeJwtTimeClaims as computeJwtTimeClaims$1, concatUint8Arrays, getPlaintextBytes as getPlaintextBytes$1, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, parsePayloadBytes, parsePayloadSegment, validateCriticalHeadersJWE as validateCriticalHeadersJWE$1, validateCriticalHeadersJWS as validateCriticalHeadersJWS$1, validateJwtClaims } from "../_chunks/jwt.mjs";
+import { assertCryptoKey, base64Parse, base64Stringify, base64UrlParse, base64UrlStringify, computeDurationInSeconds, concatUint8Arrays, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, maybeArray, validateJwtClaims } from "../_chunks/jwt.mjs";
 import { digestUrl, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms } from "../_chunks/digest.mjs";
-const applyTypCtyDefaults = applyTypDefault;
-const decodePayloadFromBytes = parsePayloadBytes;
-const decodePayloadFromB64UrlSegment = parsePayloadSegment;
-const getPlaintextBytes = getPlaintextBytes$1;
-const computeJwtTimeClaims = computeJwtTimeClaims$1;
-const validateCriticalHeadersJWS = validateCriticalHeadersJWS$1;
-const validateCriticalHeadersJWE = validateCriticalHeadersJWE$1;
-const assertCritShape = assertCritShape$1;
-export { UnsecureError, applyTypCtyDefaults, assertCritShape, assertCryptoKey, base64Decode, base64Encode, base64Parse, base64Stringify, base64UrlDecode, base64UrlEncode, base64UrlParse, base64UrlStringify, computeDurationInSeconds, computeJwtTimeClaims, concatUint8Arrays, decodePayloadFromB64UrlSegment, decodePayloadFromBytes, digestUrl, getPlaintextBytes, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder, validateCriticalHeadersJWE, validateCriticalHeadersJWS, validateJwtClaims };
+export { UnsecureError, assertCryptoKey, base64Parse, base64Stringify, base64UrlParse, base64UrlStringify, computeDurationInSeconds, concatUint8Arrays, digestUrl, inferJWEAllowedAlgorithms, inferJWSAllowedAlgorithms, isAsymmetricJWK, isCryptoKey, isCryptoKeyPair, isJWK, isJWKSet, isJWTContent, isPrivateJWK, isPublicJWK, isSymmetricJWK, isUnsecureError, maybeArray, safeJsonParse, sanitizeObject, sanitizeObjectCopy, secureRandomBytes, textDecoder, textEncoder, validateJwtClaims };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unjwt",
-  "version": "0.8.5",
+  "version": "0.9.1",
   "description": "A collection of JWT utilities based on the Web Crypto API.",
   "keywords": [
     "auth",
@@ -80,22 +80,6 @@
     "./internal": {
       "types": "./dist/core/internal.d.mts",
       "default": "./dist/core/internal.mjs"
-    },
-    "./adapters/h3": {
-      "types": "./dist/adapters/h3/index.d.mts",
-      "default": "./dist/adapters/h3/index.mjs"
-    },
-    "./adapters/h3v1": {
-      "types": "./dist/adapters/h3v1/index.d.mts",
-      "default": "./dist/adapters/h3v1/index.mjs"
-    },
-    "./adapters/h3v2": {
-      "types": "./dist/adapters/h3/index.d.mts",
-      "default": "./dist/adapters/h3/index.mjs"
-    },
-    "./adapters/elysia": {
-      "types": "./dist/adapters/elysia/index.d.mts",
-      "default": "./dist/adapters/elysia/index.mjs"
     }
   },
   "devDependencies": {
@@ -104,9 +88,8 @@
     "@vitest/coverage-v8": "^5.0.4",
     "automd": "^0.4.3",
     "cookie-es": "^3.1.1",
-    "elysia": "^1.4.30",
     "h3": "^2.0.5",
-    "h3v1": "npm:h3@^1.15.11",
+    "hono": "^4.13.13",
     "jose": "^6.2.12",
     "obuild": "^0.4.45",
     "oxfmt": "^0.73.0",
@@ -119,18 +102,6 @@
     "unsecure": "^0.3.4",
     "vitest": "^5.0.4"
   },
-  "peerDependencies": {
-    "elysia": "^1.4.29",
-    "h3": "^1.15.4 || ^2.0.1"
-  },
-  "peerDependenciesMeta": {
-    "elysia": {
-      "optional": true
-    },
-    "h3": {
-      "optional": true
-    }
-  },
   "simple-git-hooks": {
     "pre-commit": "pnpm build --stub && pnpm lint && pnpm typecheck"
   },
@@ -149,6 +120,7 @@
   "scripts": {
     "build": "obuild",
     "dev": "pnpm --dir playgrounds/h3 dev",
+    "docs": "pnpm --filter unjwt-docs dev",
     "dev:nuxt": "pnpm --dir playgrounds/nuxt-4 dev",
     "dev:nitro": "pnpm --dir playgrounds/nitro dev",
     "dev:prepare": "obuild --stub && pnpm --dir playgrounds/nuxt-4 prepare && pnpm simple-git-hooks",
@@ -157,7 +129,7 @@
     "fmt": "automd && oxlint --fix . && oxfmt .",
     "test": "vitest run --slowTestThreshold=1000",
     "test:coverage": "vitest run --coverage --slowTestThreshold=1000",
-    "typecheck": "tsc --noEmit",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p examples && tsc --noEmit -p test/examples",
     "bench": "vitest bench --run"
   }
 }

package/dist/_chunks/codec-jwe.d.mts

@@ -1,280 +0,0 @@
-import "./error.mjs";
-import { ExpiresIn, JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEEncryptJWK, JWEEncryptOptions, JWEHeaderParameters, JWKSet, JWK_HMAC, JWK_oct, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSHeaderParameters, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWTClaims, StrictOmit } from "./index.mjs";
-interface ExpirableCookieAttributes {
-  expires?: Date;
-  maxAge?: number;
-}
-/** Session data shape; `any` values let an `interface` (no index signature) satisfy it. */
-export type SessionRecord = Record<string, any>;
-export interface SessionClaims extends Required<Pick<JWTClaims, "jti" | "iat">>, StrictOmit<JWTClaims, "jti" | "iat"> {}
-/** Session data without the adapter-owned `jti`, `iat`, `exp` and `nbf`. */
-export type SessionData<T extends SessionRecord = SessionClaims> = StrictOmit<T, "jti" | "iat" | "exp" | "nbf">;
-/** Why `onUpdate` fired: an `update()` call, or `rolling` reissuing a session that was read. */
-export type SessionUpdateTrigger = "update" | "rolling";
-export type SessionUpdate<T extends SessionRecord = SessionClaims> = Partial<SessionData<T>> | ((oldData: SessionData<T>) => Partial<SessionData<T>> | undefined);
-export interface SessionManager<T extends SessionRecord = SessionClaims, ConfigMaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
-  readonly id: string | undefined;
-  readonly createdAt: number;
-  /** Expiry in ms: `exp`, or `iat + maxAge` when sooner; always a number when the session has a `maxAge`. */
-  readonly expiresAt: ConfigMaxAge extends ExpiresIn ? number : number | undefined;
-  readonly data: SessionData<T>;
-  readonly token: string | undefined;
-  /**
-   * Issues a new token after merging `update`; `options.maxAge` overrides this token's lifetime.
-   * Later reads see the data's JSON round trip. Rolls back if issuing or the cookie write fails;
-   * a throwing `onUpdate` rejects but keeps the new session.
-   */
-  update: (update?: SessionUpdate<T>, options?: SessionIssueOptions) => Promise<SessionManager<T, ConfigMaxAge>>;
-  clear: () => Promise<SessionManager<T, ConfigMaxAge>>;
-}
-/** The config members every session shares, whether it signs or seals its token. */
-interface SessionBaseConfig<MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> {
-  /** Sets `exp = iat + maxAge`, requires `exp` on incoming tokens and ends them at `iat + maxAge` at the latest, drives cookie expiry; unset never expires. */
-  maxAge?: MaxAge;
-  /**
-   * Reissue the session when it is read, needs `maxAge`.
-   *
-   * - `true`: every read reissues.
-   * - a duration: a read reissues once the token is at least that old, so an active session is
-   *   re-signed at most once per duration. With `maxAge: "1h"` and `rolling: "15m"`, reads in the
-   *   first 15 minutes change nothing; the first read after that issues a fresh hour. Must be
-   *   shorter than `maxAge`.
-   *
-   * A read that cannot write (a read-only event, a response already sent) does not reissue;
-   * the next request, carrying the same token, does.
-   *
-   * @default undefined — the session expires at `iat + maxAge` however often it is read.
-   */
-  rolling?: true | ExpiresIn;
-  /** Drives the cookie name and default header; prefer `__Host-`; a trailing `.<digits>` is refused. */
-  name?: string;
-  /**
-   * Header carrying a bare or `Bearer` token: a header name, `true` for `x-<name>-session` (cookie prefix stripped), or `false` for none.
-   * A request that carries it is read from it and never from the cookie, and writes no cookie back; any other value is a token failure (`onError`).
-   * Left unset, a session with cookies still reads `x-<name>-session`, and so does one with `cookie: false`.
-   */
-  sessionHeader?: boolean | string;
-  /** Session ID (`jti`) generator. Default `crypto.randomUUID`. */
-  generateId?: () => string;
-}
-/**
- * Lifecycle hooks; `onRead`, `onExpire` and `onError` are mutually exclusive per incoming token.
- * `session` is the live manager, so a hook can `update()` or `clear()` in place; `oldSession` is a snapshot.
- */
-interface SessionHooks<TSession, TManager, TArgs extends Record<string, unknown>, TConfig> {
-  /** Fires once per request, when the session is read from its token. */
-  onRead?: (args: TArgs & {
-    session: TManager & {
-      id: string;
-      token: string;
-    };
-    config: TConfig;
-  }) => void | Promise<void>;
-  /** Fires after a token is issued and, on a cookie session, its cookie written, by `update()` or by `rolling`; a throw rejects without rollback. */
-  onUpdate?: (args: TArgs & {
-    session: TManager & {
-      id: string;
-      token: string;
-    };
-    /** Deep-copied snapshot of the session before the update. */
-    oldSession: TSession;
-    trigger: SessionUpdateTrigger;
-    config: TConfig;
-  }) => void | Promise<void>;
-  /** Fires when the session is cleared. */
-  onClear?: (args: TArgs & {
-    oldSession: TSession | undefined;
-    config: TConfig;
-  }) => void | Promise<void>;
-  /** Fires when the incoming token is expired. Receives the expired token's decoded claims. */
-  onExpire?: (args: TArgs & {
-    session: {
-      id: string | undefined;
-      createdAt: number | undefined;
-      expiresAt: number | undefined;
-      token: string;
-    };
-    error: Error;
-    config: TConfig;
-  }) => void | Promise<void>;
-  /** Fires on read-path failures other than expiry, and on write-path issue failures. */
-  onError?: (args: TArgs & {
-    session: TManager;
-    error: any;
-    config: TConfig;
-  }) => void | Promise<void>;
-}
-/** Per-issue overrides for a single `update()` call. */
-export interface SessionIssueOptions {
-  /** Lifetime for this issue only, overriding the config's `maxAge`; a read under that `maxAge` still ends the session at `iat + maxAge`. */
-  maxAge?: ExpiresIn;
-}
-/** In-request session state, mirroring the claims of the underlying token. */
-export interface SessionState<T extends SessionRecord, MaxAge extends ExpiresIn | undefined> {
-  /** JWT `jti`; `undefined` until the session is persisted. */
-  id: string | undefined;
-  /** In ms; mirrors the JWT `iat` claim (seconds). */
-  createdAt: number;
-  /** In ms; mirrors the JWT `exp` claim (seconds), or `iat + maxAge` when sooner. */
-  expiresAt: MaxAge extends ExpiresIn ? number : number | undefined;
-  data: SessionData<T>;
-  token: string | undefined;
-}
-/** Session state read back from a token: always carries its `id` and `createdAt`. */
-export type OpenedSessionState<T extends SessionRecord, MaxAge extends ExpiresIn | undefined> = Pick<SessionState<T, MaxAge>, "id" | "createdAt" | "expiresAt" | "data"> & {
-  id: string;
-  createdAt: number;
-};
-/** One session, defined once from its config and used on any request. */
-export interface SessionDefinition<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TEvent = unknown> {
-  /** Reads the request's session once and returns its manager; later calls on the same request share that state. */
-  use: (event: TEvent) => Promise<SessionManager<T, MaxAge>>;
-  /** The session's token once `use()` read or wrote it, else the one the request carries (the session header before the cookie), unopened. */
-  token: (event: TEvent) => string | undefined;
-  /** Mints a token for `data` with a fresh `jti` and `iat`, and `exp` from `maxAge` (`options.maxAge` overrides it); reads and writes nothing. */
-  issue: (data?: Partial<SessionData<T>>, options?: SessionIssueOptions) => Promise<string>;
-  /** Opens a token into session state, checking `typ`, pinned algorithms, `jti`/`iat` and `exp` when `maxAge` is set; the key-lookup hook receives no request. */
-  open: (token: string) => Promise<OpenedSessionState<T, MaxAge>>;
-}
-interface SessionRequestBase {
-  /**
-   * The response being prepared; without it the session is read-only.
-   * With `errHeaders` too (h3 v2, which sends only those for a thrown handler), every cookie write lands in both.
-   */
-  readonly res?: {
-    readonly headers: Headers;
-    readonly errHeaders?: Headers;
-  };
-  /** Per-request state shared with the framework, where `sessions` is kept; without it state is keyed on `req`, else on this object. */
-  readonly context?: Record<string, unknown>;
-}
-/** A request event: by its `Request`, or by its `Headers` (a `Request` itself, a WebSocket upgrade's request). */
-export type SessionRequestEvent = SessionRequestBase & ({
-  readonly req: Request;
-  readonly headers?: Headers;
-} | {
-  readonly headers: Headers;
-  readonly req?: Request;
-});
-/** A token handed in directly; sending a re-issued one is the caller's job. */
-export interface SessionHandedToken {
-  token: string | undefined;
-}
-/** What the Web session driver takes: a request event, or a token in hand. */
-export type WebSessionEvent = SessionRequestEvent | SessionHandedToken;
-/** The cookies of one request and its response, as a framework exposes them. */
-export interface CookieJar<A extends ExpirableCookieAttributes = ExpirableCookieAttributes> {
-  /** The request's cookie. */
-  read(name: string): string | undefined;
-  /** The value this response already assigned to `name` (`""` once deleted), when the framework exposes it. */
-  written?(name: string): string | undefined;
-  /** Absent when this event cannot take a `Set-Cookie` (a request without a response). */
-  write?(name: string, value: string, attrs: A): void;
-}
-/** The primitives a framework supplies; the session core builds the cookie and header transports over them. */
-export interface SessionDriver<TEvent> {
-  /** Message prefix for every error the adapter emits. */
-  prefix: string;
-  /** The per-request record session state and the session-name registry live in. */
-  state(event: TEvent): Record<string, unknown>;
-  header(event: TEvent, name: string): string | null | undefined;
-  cookies(event: TEvent): CookieJar;
-  /** Platform signal that the response can still change (Node `headersSent`); absent = trust the jar. */
-  writable?(event: TEvent): boolean;
-  /** A token the event carries directly, when it does: no cookie or header is consulted. */
-  handed?(event: TEvent): {
-    token: string | undefined;
-  } | undefined;
-}
-/** HS* `oct` JWK, `CryptoKey` (requires pinned `alg`), or a pair: private signs, public JWK/list/set verifies. */
-type JWSSessionKey = CryptoKey | JWK_oct<JWK_HMAC> | {
-  privateKey: JWSAsymmetricPrivateJWK | CryptoKey;
-  publicKey: JWSAsymmetricPublicJWK | JWSAsymmetricPublicJWK[] | JWKSet | CryptoKey;
-};
-/** JWS verify overrides, minus the options the adapter owns. */
-export type SessionVerifyOptions = StrictOmit<JWSVerifyOptions, "algorithms" | "typ" | "maxTokenAge" | "validateClaims" | "forceUint8Array" | "payload">;
-/** JWS sign options, minus those setting `exp`/`nbf` (the adapter mints `exp` from `maxAge`). */
-export type SessionSignOptions = StrictOmit<JWSSignOptions, "expiresIn" | "expiresAt" | "notBeforeIn" | "notBeforeAt">;
-/** JWS sign/verify overrides a session accepts. */
-interface JWSSessionOptions {
-  signOptions?: SessionSignOptions;
-  verifyOptions?: SessionVerifyOptions;
-}
-/** The config of a JWS-backed (signed, not encrypted) session, minus its hooks. */
-export interface JWSSessionConfig<MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TCookie extends object = object> extends SessionBaseConfig<MaxAge> {
-  /** Key used for signing — see {@link JWSSessionKey}. */
-  key: JWSSessionKey;
-  /** `false` to disable. Defaults: `path="/"`, `secure`, `sameSite: "lax"`, `httpOnly: false` (payload is client-readable). */
-  cookie?: false | (TCookie & {
-    chunkMaxLength?: number;
-  });
-  /** Pinned `signOptions.alg` restricts verification; `protectedHeader.typ` defaults to `"session+jwt"` (RFC 8725 §3.11). */
-  jws?: JWSSessionOptions;
-}
-/** JWS session hooks, plus the verify key lookup. */
-export interface JWSSessionHooks<TSession, TManager, TArgs extends Record<string, unknown>, TConfig> extends SessionHooks<TSession, TManager, TArgs, TConfig> {
-  /** Resolve the verification key(s) for the incoming token from its protected header (e.g. by `kid`). */
-  onVerifyKeyLookup?: (args: Partial<TArgs> & {
-    header: JWSHeaderParameters;
-    config: TConfig;
-  }) => JWKSet | JWSVerifyJWK | Promise<JWKSet | JWSVerifyJWK>;
-}
-/**
- * A symmetric `oct` JWK, or a `CryptoKey` (requires pinned `alg` and `enc`): the one key seals and unseals.
- *
- * The `{ privateKey, publicKey? }` pair members are deprecated: a pair seals with its public half,
- * so anyone holding the public key can mint a session the server accepts. Use an `oct` JWK, or
- * `defineJWSSession` for a key pair.
- */
-type JWESessionKey = CryptoKey | JWEEncryptJWK | {
-  /**
-   * Unseals; a private JWK alone seals with its own public half.
-   * @deprecated A pair seals with its public half, so anyone holding the public key can mint a session the server accepts. Use an `oct` JWK, or `defineJWSSession` for a key pair.
-   */
-  privateKey: JWEAsymmetricPrivateJWK;
-  /**
-   * Seals.
-   * @deprecated A pair seals with its public half, so anyone holding the public key can mint a session the server accepts. Use an `oct` JWK, or `defineJWSSession` for a key pair.
-   */
-  publicKey?: JWEAsymmetricPublicJWK | CryptoKey;
-} | {
-  /**
-   * Unseals; a private `CryptoKey` has no public half to derive, so it comes with one.
-   * @deprecated A pair seals with its public half, so anyone holding the public key can mint a session the server accepts. Use an `oct` JWK, or `defineJWSSession` for a key pair.
-   */
-  privateKey: CryptoKey;
-  /**
-   * Seals.
-   * @deprecated A pair seals with its public half, so anyone holding the public key can mint a session the server accepts. Use an `oct` JWK, or `defineJWSSession` for a key pair.
-   */
-  publicKey: JWEAsymmetricPublicJWK | CryptoKey;
-};
-/** JWE decrypt overrides, minus the options the adapter owns. */
-export type SessionDecryptOptions = StrictOmit<JWEDecryptOptions, "algorithms" | "encryptionAlgorithms" | "typ" | "maxTokenAge" | "validateClaims" | "forceUint8Array" | "payload">;
-/** JWE encrypt options, minus those setting `exp`/`nbf` (the adapter mints `exp` from `maxAge`). */
-export type SessionEncryptOptions = StrictOmit<JWEEncryptOptions, "expiresIn" | "expiresAt" | "notBeforeIn" | "notBeforeAt">;
-/** JWE encrypt/decrypt overrides a session accepts. */
-interface JWESessionOptions {
-  encryptOptions?: SessionEncryptOptions;
-  decryptOptions?: SessionDecryptOptions;
-}
-/** The config of a JWE-backed (encrypted) session, minus its hooks. */
-export interface JWESessionConfig<MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TCookie extends object = object> extends SessionBaseConfig<MaxAge> {
-  /** Key used for sealing — see {@link JWESessionKey}. */
-  key: JWESessionKey;
-  /** `false` to disable. Defaults: `path="/"`, `secure`, `sameSite: "lax"`, `httpOnly: true`. */
-  cookie?: false | (TCookie & {
-    chunkMaxLength?: number;
-  });
-  /** Pinned `encryptOptions.alg`/`enc` restrict unsealing; `protectedHeader.typ` defaults to `"session+jwt"` (RFC 8725 §3.11). */
-  jwe?: JWESessionOptions;
-}
-/** JWE session hooks, plus the unseal key lookup. */
-export interface JWESessionHooks<TSession, TManager, TArgs extends Record<string, unknown>, TConfig> extends SessionHooks<TSession, TManager, TArgs, TConfig> {
-  /** Resolve the decryption key for the incoming token from its protected header (e.g. by `kid`). */
-  onUnsealKeyLookup?: (args: Partial<TArgs> & {
-    header: JWEHeaderParameters;
-    config: TConfig;
-  }) => JWEDecryptJWK | Promise<JWEDecryptJWK>;
-}
-export {};