[{"data":1,"prerenderedAt":2176},["ShallowReactive",2],{"navigation":3,"-adapters-hooks":167,"-adapters-hooks-surround":2173},[4,22,78,106,141,148],{"title":5,"path":6,"stem":7,"children":8},"Introduction","\u002Fgetting-started","0.Getting-Started\u002F0.index",[9,10,14,18],{"title":5,"path":6,"stem":7},{"title":11,"path":12,"stem":13},"Installation","\u002Fgetting-started\u002Finstallation","0.Getting-Started\u002F1.installation",{"title":15,"path":16,"stem":17},"Quickstart","\u002Fgetting-started\u002Fquickstart","0.Getting-Started\u002F2.quickstart",{"title":19,"path":20,"stem":21},"Core concepts","\u002Fgetting-started\u002Fcore-concepts","0.Getting-Started\u002F3.core-concepts",{"title":23,"path":24,"stem":25,"children":26,"icon":28},"JWT","\u002Fjwt","1.JWT\u002F0.index",[27,29,52],{"title":23,"path":24,"stem":25,"icon":28},"i-carbon-certificate",{"title":30,"path":31,"stem":32,"children":33,"icon":35},"JWS","\u002Fjwt\u002Fjws","1.JWT\u002F1.JWS\u002F0.index",[34,36,40,44,48],{"title":30,"path":31,"stem":32,"icon":35},"i-carbon-document-signed",{"title":37,"path":38,"stem":39},"Signing","\u002Fjwt\u002Fjws\u002Fsigning","1.JWT\u002F1.JWS\u002F1.signing",{"title":41,"path":42,"stem":43},"Verifying","\u002Fjwt\u002Fjws\u002Fverifying","1.JWT\u002F1.JWS\u002F2.verifying",{"title":45,"path":46,"stem":47},"Multi-signature","\u002Fjwt\u002Fjws\u002Fmulti-signature","1.JWT\u002F1.JWS\u002F3.multi-signature",{"title":49,"path":50,"stem":51},"Algorithms","\u002Fjwt\u002Fjws\u002Falgorithms","1.JWT\u002F1.JWS\u002F4.algorithms",{"title":53,"path":54,"stem":55,"children":56,"icon":58},"JWE","\u002Fjwt\u002Fjwe","1.JWT\u002F2.JWE\u002F0.index",[57,59,63,67,71,75],{"title":53,"path":54,"stem":55,"icon":58},"i-carbon-locked",{"title":60,"path":61,"stem":62},"Encrypting","\u002Fjwt\u002Fjwe\u002Fencrypting","1.JWT\u002F2.JWE\u002F1.encrypting",{"title":64,"path":65,"stem":66},"Decrypting","\u002Fjwt\u002Fjwe\u002Fdecrypting","1.JWT\u002F2.JWE\u002F2.decrypting",{"title":68,"path":69,"stem":70},"Multi-recipient","\u002Fjwt\u002Fjwe\u002Fmulti-recipient","1.JWT\u002F2.JWE\u002F3.multi-recipient",{"title":72,"path":73,"stem":74},"ECDH-ES and end-to-end encryption","\u002Fjwt\u002Fjwe\u002Fecdh-es","1.JWT\u002F2.JWE\u002F4.ecdh-es",{"title":49,"path":76,"stem":77},"\u002Fjwt\u002Fjwe\u002Falgorithms","1.JWT\u002F2.JWE\u002F5.algorithms",{"title":79,"path":80,"stem":81,"children":82,"icon":84},"Examples","\u002Fexamples","10.Examples\u002F0.index",[83,85,90,94,98,102],{"title":79,"path":80,"stem":81,"icon":84},"i-carbon-code-reference",{"title":86,"path":87,"stem":88,"icon":89},"Authentication basics","\u002Fexamples\u002Fauthentication-basics","10.Examples\u002F1.authentication-basics","i-lucide-code",{"title":91,"path":92,"stem":93,"icon":89},"Consuming a JWKS endpoint","\u002Fexamples\u002Fjwks-endpoint","10.Examples\u002F2.jwks-endpoint",{"title":95,"path":96,"stem":97,"icon":89},"Refresh token pattern","\u002Fexamples\u002Frefresh-token-pattern","10.Examples\u002F3.refresh-token-pattern",{"title":99,"path":100,"stem":101,"icon":89},"End-to-end encryption","\u002Fexamples\u002Fend-to-end-encryption","10.Examples\u002F4.end-to-end-encryption",{"title":103,"path":104,"stem":105,"icon":89},"Signed receipts","\u002Fexamples\u002Fsigned-receipts","10.Examples\u002F5.signed-receipts",{"title":107,"path":108,"stem":109,"children":110,"icon":112},"JWK","\u002Fjwk","2.JWK\u002F0.index",[111,113,117,121,125,129,133,137],{"title":107,"path":108,"stem":109,"icon":112},"i-carbon-two-factor-authentication",{"title":114,"path":115,"stem":116},"Generating keys","\u002Fjwk\u002Fgenerating","2.JWK\u002F1.generating",{"title":118,"path":119,"stem":120},"Importing and exporting","\u002Fjwk\u002Fimport-export","2.JWK\u002F2.import-export",{"title":122,"path":123,"stem":124},"PEM conversion","\u002Fjwk\u002Fpem","2.JWK\u002F3.pem",{"title":126,"path":127,"stem":128},"Key wrapping","\u002Fjwk\u002Fwrapping","2.JWK\u002F4.wrapping",{"title":130,"path":131,"stem":132},"Password derivation","\u002Fjwk\u002Fpassword-derivation","2.JWK\u002F5.password-derivation",{"title":134,"path":135,"stem":136},"JWK Sets","\u002Fjwk\u002Fjwk-sets","2.JWK\u002F6.jwk-sets",{"title":138,"path":139,"stem":140},"JWK cache","\u002Fjwk\u002Fcache","2.JWK\u002F7.cache",{"title":142,"path":143,"stem":144,"children":145,"icon":147},"Utilities","\u002Futilities","3.Utilities\u002F0.index",[146],{"title":142,"path":143,"stem":144,"icon":147},"i-carbon-tool-box",{"title":149,"path":150,"stem":151,"children":152,"icon":154},"Adapters","\u002Fadapters","99.Adapters\u002F0.index",[153,155,159,163],{"title":149,"path":150,"stem":151,"icon":154},"i-carbon-plug",{"title":156,"path":157,"stem":158},"H3 sessions","\u002Fadapters\u002Fh3-sessions","99.Adapters\u002F1.h3-sessions",{"title":160,"path":161,"stem":162},"Lifecycle hooks","\u002Fadapters\u002Fhooks","99.Adapters\u002F2.hooks",{"title":164,"path":165,"stem":166},"Lower-level functions","\u002Fadapters\u002Flower-level","99.Adapters\u002F3.lower-level",{"id":168,"title":160,"body":169,"description":196,"extension":2168,"meta":2169,"navigation":2170,"path":161,"seo":2171,"stem":162,"__hash__":2172},"content\u002F99.Adapters\u002F2.hooks.md",{"type":170,"value":171,"toc":2147},"minimark",[172,189,447,454,459,567,590,596,599,663,672,678,692,805,808,814,823,876,886,892,898,964,974,1082,1098,1104,1115,1184,1197,1201,1208,1216,1263,1273,1280,1337,1343,1355,1359,2104,2120,2124,2143],[173,174,175,176,180,181,184,185,188],"p",{},"Both ",[177,178,179],"code",{},"useJWESession"," and ",[177,182,183],{},"useJWSSession"," accept a ",[177,186,187],{},"hooks"," object in their config — attach callbacks to key moments in the session lifecycle for logging, revocation tracking, key rotation, or side-effects.",[190,191,197],"pre",{"className":192,"code":193,"filename":194,"language":195,"meta":196,"style":196},"language-ts shiki shiki-themes github-light github-dark github-dark","useJWESession(event, {\n  key: secret,\n  hooks: {\n    onRead({ session, event, config }) {\n      \u002F* ... *\u002F\n    },\n    onUpdate({ session, oldSession, event, config }) {\n      \u002F* ... *\u002F\n    },\n    onClear({ oldSession, event, config }) {\n      \u002F* ... *\u002F\n    },\n    onExpire({ session, event, error, config }) {\n      \u002F* ... *\u002F\n    },\n    onError({ session, event, error, config }) {\n      \u002F* ... *\u002F\n    },\n    onUnsealKeyLookup({ header, event, config }) {\n      \u002F* JWE: return a key *\u002F\n    },\n    \u002F\u002F JWS uses `onVerifyKeyLookup` instead\n  },\n});\n","shape.ts","ts","",[177,198,199,211,217,223,250,257,263,288,293,298,318,323,328,353,358,363,387,392,397,418,424,429,435,441],{"__ignoreMap":196},[200,201,204,207],"span",{"class":202,"line":203},"line",1,[200,205,179],{"class":206},"shcOC",[200,208,210],{"class":209},"slsVL","(event, {\n",[200,212,214],{"class":202,"line":213},2,[200,215,216],{"class":209},"  key: secret,\n",[200,218,220],{"class":202,"line":219},3,[200,221,222],{"class":209},"  hooks: {\n",[200,224,226,229,232,236,239,242,244,247],{"class":202,"line":225},4,[200,227,228],{"class":206},"    onRead",[200,230,231],{"class":209},"({ ",[200,233,235],{"class":234},"sQHwn","session",[200,237,238],{"class":209},", ",[200,240,241],{"class":234},"event",[200,243,238],{"class":209},[200,245,246],{"class":234},"config",[200,248,249],{"class":209}," }) {\n",[200,251,253],{"class":202,"line":252},5,[200,254,256],{"class":255},"sCsY4","      \u002F* ... *\u002F\n",[200,258,260],{"class":202,"line":259},6,[200,261,262],{"class":209},"    },\n",[200,264,266,269,271,273,275,278,280,282,284,286],{"class":202,"line":265},7,[200,267,268],{"class":206},"    onUpdate",[200,270,231],{"class":209},[200,272,235],{"class":234},[200,274,238],{"class":209},[200,276,277],{"class":234},"oldSession",[200,279,238],{"class":209},[200,281,241],{"class":234},[200,283,238],{"class":209},[200,285,246],{"class":234},[200,287,249],{"class":209},[200,289,291],{"class":202,"line":290},8,[200,292,256],{"class":255},[200,294,296],{"class":202,"line":295},9,[200,297,262],{"class":209},[200,299,301,304,306,308,310,312,314,316],{"class":202,"line":300},10,[200,302,303],{"class":206},"    onClear",[200,305,231],{"class":209},[200,307,277],{"class":234},[200,309,238],{"class":209},[200,311,241],{"class":234},[200,313,238],{"class":209},[200,315,246],{"class":234},[200,317,249],{"class":209},[200,319,321],{"class":202,"line":320},11,[200,322,256],{"class":255},[200,324,326],{"class":202,"line":325},12,[200,327,262],{"class":209},[200,329,331,334,336,338,340,342,344,347,349,351],{"class":202,"line":330},13,[200,332,333],{"class":206},"    onExpire",[200,335,231],{"class":209},[200,337,235],{"class":234},[200,339,238],{"class":209},[200,341,241],{"class":234},[200,343,238],{"class":209},[200,345,346],{"class":234},"error",[200,348,238],{"class":209},[200,350,246],{"class":234},[200,352,249],{"class":209},[200,354,356],{"class":202,"line":355},14,[200,357,256],{"class":255},[200,359,361],{"class":202,"line":360},15,[200,362,262],{"class":209},[200,364,366,369,371,373,375,377,379,381,383,385],{"class":202,"line":365},16,[200,367,368],{"class":206},"    onError",[200,370,231],{"class":209},[200,372,235],{"class":234},[200,374,238],{"class":209},[200,376,241],{"class":234},[200,378,238],{"class":209},[200,380,346],{"class":234},[200,382,238],{"class":209},[200,384,246],{"class":234},[200,386,249],{"class":209},[200,388,390],{"class":202,"line":389},17,[200,391,256],{"class":255},[200,393,395],{"class":202,"line":394},18,[200,396,262],{"class":209},[200,398,400,403,405,408,410,412,414,416],{"class":202,"line":399},19,[200,401,402],{"class":206},"    onUnsealKeyLookup",[200,404,231],{"class":209},[200,406,407],{"class":234},"header",[200,409,238],{"class":209},[200,411,241],{"class":234},[200,413,238],{"class":209},[200,415,246],{"class":234},[200,417,249],{"class":209},[200,419,421],{"class":202,"line":420},20,[200,422,423],{"class":255},"      \u002F* JWE: return a key *\u002F\n",[200,425,427],{"class":202,"line":426},21,[200,428,262],{"class":209},[200,430,432],{"class":202,"line":431},22,[200,433,434],{"class":255},"    \u002F\u002F JWS uses `onVerifyKeyLookup` instead\n",[200,436,438],{"class":202,"line":437},23,[200,439,440],{"class":209},"  },\n",[200,442,444],{"class":202,"line":443},24,[200,445,446],{"class":209},"});\n",[173,448,449,450,453],{},"All hooks are ",[177,451,452],{},"async","-compatible.",[455,456,458],"h2",{"id":457},"when-each-hook-fires","When each hook fires",[460,461,462,478],"table",{},[463,464,465],"thead",{},[466,467,468,472,475],"tr",{},[469,470,471],"th",{},"Hook",[469,473,474],{},"Fires when",[469,476,477],{},"Mutually exclusive with",[479,480,481,500,517,535,554],"tbody",{},[466,482,483,489,492],{},[484,485,486],"td",{},[177,487,488],{},"onRead",[484,490,491],{},"A valid session token was decoded and loaded.",[484,493,494,238,497],{},[177,495,496],{},"onExpire",[177,498,499],{},"onError",[466,501,502,507,514],{},[484,503,504],{},[177,505,506],{},"onUpdate",[484,508,509,510,513],{},"After a successful ",[177,511,512],{},"session.update()"," (token signed\u002Fencrypted).",[484,515,516],{},"—",[466,518,519,524,531],{},[484,520,521],{},[177,522,523],{},"onClear",[484,525,526,527,530],{},"After an explicit ",[177,528,529],{},"session.clear()"," call.",[484,532,533],{},[177,534,496],{},[466,536,537,541,548],{},[484,538,539],{},[177,540,496],{},[484,542,543,544,547],{},"A token's ",[177,545,546],{},"exp"," is in the past (clock-driven expiry).",[484,549,550,238,552],{},[177,551,488],{},[177,553,523],{},[466,555,556,560,563],{},[484,557,558],{},[177,559,499],{},[484,561,562],{},"Token verification\u002Fdecryption fails for a non-expiry reason.",[484,564,565],{},[177,566,488],{},[568,569,570],"warning",{},[173,571,572,574,575,582,583,585,586,589],{},[177,573,496],{}," ",[576,577,578,579],"strong",{},"does not call ",[177,580,581],{},"clearSession",". It invalidates the cookie inline and fires its hook. ",[177,584,523],{}," is reserved for ",[576,587,588],{},"explicit"," termination (user logout, forced revocation) — these two events are semantically distinct and should trigger different downstream side effects.",[455,591,593,595],{"id":592},"onread-every-valid-request",[177,594,488],{}," — every valid request",[173,597,598],{},"Fires once per request when a valid session token is loaded. Use for request-scoped logging, last-activity tracking, etc.",[190,600,603],{"className":192,"code":601,"filename":602,"language":195,"meta":196,"style":196},"hooks: {\n  async onRead({ session, event }) {\n    await metrics.increment(\"session.read\", {\n      userId: session.data.userId,\n    });\n  },\n},\n","on-read.ts",[177,604,605,612,622,644,649,654,658],{"__ignoreMap":196},[200,606,607,609],{"class":202,"line":203},[200,608,187],{"class":206},[200,610,611],{"class":209},": {\n",[200,613,614,617,619],{"class":202,"line":213},[200,615,616],{"class":209},"  async ",[200,618,488],{"class":206},[200,620,621],{"class":209},"({ session, event }) {\n",[200,623,624,628,631,634,637,641],{"class":202,"line":219},[200,625,627],{"class":626},"so5gQ","    await",[200,629,630],{"class":209}," metrics.",[200,632,633],{"class":206},"increment",[200,635,636],{"class":209},"(",[200,638,640],{"class":639},"sfrk1","\"session.read\"",[200,642,643],{"class":209},", {\n",[200,645,646],{"class":202,"line":225},[200,647,648],{"class":209},"      userId: session.data.userId,\n",[200,650,651],{"class":202,"line":252},[200,652,653],{"class":209},"    });\n",[200,655,656],{"class":202,"line":259},[200,657,440],{"class":209},[200,659,660],{"class":202,"line":265},[200,661,662],{"class":209},"},\n",[173,664,665,666,668,669,671],{},"Only fires when the session was successfully decoded — failures go through ",[177,667,499],{}," or ",[177,670,496],{}," instead.",[455,673,675,677],{"id":674},"onupdate-session-created-or-rotated",[177,676,506],{}," — session created or rotated",[173,679,680,681,683,684,687,688,691],{},"Fires after ",[177,682,512],{}," succeeds. Receives both the ",[576,685,686],{},"new"," session and a ",[576,689,690],{},"snapshot of the old"," one:",[190,693,696],{"className":192,"code":694,"filename":695,"language":195,"meta":196,"style":196},"hooks: {\n  async onUpdate({ session, oldSession, event }) {\n    \u002F\u002F First-time session creation: oldSession.id is undefined\n    if (!oldSession.id) {\n      await audit.log(\"session.created\", { userId: session.data.userId });\n    } else {\n      await audit.log(\"session.rotated\", {\n        oldJti: oldSession.id,\n        newJti: session.id,\n      });\n    }\n  },\n},\n","on-update.ts",[177,697,698,704,713,718,732,751,762,777,782,787,792,797,801],{"__ignoreMap":196},[200,699,700,702],{"class":202,"line":203},[200,701,187],{"class":206},[200,703,611],{"class":209},[200,705,706,708,710],{"class":202,"line":213},[200,707,616],{"class":209},[200,709,506],{"class":206},[200,711,712],{"class":209},"({ session, oldSession, event }) {\n",[200,714,715],{"class":202,"line":219},[200,716,717],{"class":255},"    \u002F\u002F First-time session creation: oldSession.id is undefined\n",[200,719,720,723,726,729],{"class":202,"line":225},[200,721,722],{"class":626},"    if",[200,724,725],{"class":209}," (",[200,727,728],{"class":626},"!",[200,730,731],{"class":209},"oldSession.id) {\n",[200,733,734,737,740,743,745,748],{"class":202,"line":252},[200,735,736],{"class":626},"      await",[200,738,739],{"class":209}," audit.",[200,741,742],{"class":206},"log",[200,744,636],{"class":209},[200,746,747],{"class":639},"\"session.created\"",[200,749,750],{"class":209},", { userId: session.data.userId });\n",[200,752,753,756,759],{"class":202,"line":259},[200,754,755],{"class":209},"    } ",[200,757,758],{"class":626},"else",[200,760,761],{"class":209}," {\n",[200,763,764,766,768,770,772,775],{"class":202,"line":265},[200,765,736],{"class":626},[200,767,739],{"class":209},[200,769,742],{"class":206},[200,771,636],{"class":209},[200,773,774],{"class":639},"\"session.rotated\"",[200,776,643],{"class":209},[200,778,779],{"class":202,"line":290},[200,780,781],{"class":209},"        oldJti: oldSession.id,\n",[200,783,784],{"class":202,"line":295},[200,785,786],{"class":209},"        newJti: session.id,\n",[200,788,789],{"class":202,"line":300},[200,790,791],{"class":209},"      });\n",[200,793,794],{"class":202,"line":320},[200,795,796],{"class":209},"    }\n",[200,798,799],{"class":202,"line":325},[200,800,440],{"class":209},[200,802,803],{"class":202,"line":330},[200,804,662],{"class":209},[173,806,807],{},"Useful for audit trails, detecting first-time logins, and syncing session state to external stores.",[455,809,811,813],{"id":810},"onclear-explicit-termination",[177,812,523],{}," — explicit termination",[173,815,680,816,818,819,822],{},[177,817,529],{},". Receives the old session snapshot (may be ",[177,820,821],{},"undefined"," if no session existed):",[190,824,827],{"className":192,"code":825,"filename":826,"language":195,"meta":196,"style":196},"hooks: {\n  async onClear({ oldSession, event }) {\n    if (oldSession?.id) {\n      await revocationList.add(oldSession.id);\n    }\n  },\n},\n","on-clear.ts",[177,828,829,835,844,851,864,868,872],{"__ignoreMap":196},[200,830,831,833],{"class":202,"line":203},[200,832,187],{"class":206},[200,834,611],{"class":209},[200,836,837,839,841],{"class":202,"line":213},[200,838,616],{"class":209},[200,840,523],{"class":206},[200,842,843],{"class":209},"({ oldSession, event }) {\n",[200,845,846,848],{"class":202,"line":219},[200,847,722],{"class":626},[200,849,850],{"class":209}," (oldSession?.id) {\n",[200,852,853,855,858,861],{"class":202,"line":225},[200,854,736],{"class":626},[200,856,857],{"class":209}," revocationList.",[200,859,860],{"class":206},"add",[200,862,863],{"class":209},"(oldSession.id);\n",[200,865,866],{"class":202,"line":252},[200,867,796],{"class":209},[200,869,870],{"class":202,"line":259},[200,871,440],{"class":209},[200,873,874],{"class":202,"line":265},[200,875,662],{"class":209},[173,877,878,879,882,883,885],{},"This is the ",[576,880,881],{},"logout"," path — users intentionally ending their session. ",[177,884,496],{}," is a different event (clock-driven, not user-driven) and doesn't fire here.",[455,887,889,891],{"id":888},"onexpire-natural-expiry",[177,890,496],{}," — natural expiry",[173,893,894,895,897],{},"Fires when a token's ",[177,896,546],{}," claim is in the past. Receives a snapshot of the expired token:",[190,899,902],{"className":192,"code":900,"filename":901,"language":195,"meta":196,"style":196},"hooks: {\n  async onExpire({ session, event, error, config }) {\n    \u002F\u002F session.id is the jti from the expired token (if the token was decodable)\n    \u002F\u002F session.expiresAt is the old exp × 1000 ms\n    \u002F\u002F error is a JWTError with code like \"ERR_JWT_EXPIRED\"\n    if (session.id) {\n      await revocationList.add(session.id);\n    }\n  },\n},\n","on-expire.ts",[177,903,904,910,919,924,929,934,941,952,956,960],{"__ignoreMap":196},[200,905,906,908],{"class":202,"line":203},[200,907,187],{"class":206},[200,909,611],{"class":209},[200,911,912,914,916],{"class":202,"line":213},[200,913,616],{"class":209},[200,915,496],{"class":206},[200,917,918],{"class":209},"({ session, event, error, config }) {\n",[200,920,921],{"class":202,"line":219},[200,922,923],{"class":255},"    \u002F\u002F session.id is the jti from the expired token (if the token was decodable)\n",[200,925,926],{"class":202,"line":225},[200,927,928],{"class":255},"    \u002F\u002F session.expiresAt is the old exp × 1000 ms\n",[200,930,931],{"class":202,"line":252},[200,932,933],{"class":255},"    \u002F\u002F error is a JWTError with code like \"ERR_JWT_EXPIRED\"\n",[200,935,936,938],{"class":202,"line":259},[200,937,722],{"class":626},[200,939,940],{"class":209}," (session.id) {\n",[200,942,943,945,947,949],{"class":202,"line":265},[200,944,736],{"class":626},[200,946,857],{"class":209},[200,948,860],{"class":206},[200,950,951],{"class":209},"(session.id);\n",[200,953,954],{"class":202,"line":290},[200,955,796],{"class":209},[200,957,958],{"class":202,"line":295},[200,959,440],{"class":209},[200,961,962],{"class":202,"line":300},[200,963,662],{"class":209},[173,965,966,968,969,973],{},[177,967,496],{}," is where the ",[970,971,972],"a",{"href":96},"refresh-token pattern"," lives — check a separate refresh session and mint a new access token:",[190,975,978],{"className":192,"code":976,"filename":977,"language":195,"meta":196,"style":196},"import { getJWESession, updateJWSSession } from \"unjwt\u002Fadapters\u002Fh3v2\";\n\nhooks: {\n  async onExpire({ event, config }) {\n    const refresh = await getJWESession(event, refreshConfig);\n    if (refresh.data.sub) {\n      await updateJWSSession(event, config, {\n        sub: refresh.data.sub,\n        scope: refresh.data.scope,\n      });\n    }\n  },\n},\n","on-expire-refresh.ts",[177,979,980,997,1003,1009,1018,1039,1046,1056,1061,1066,1070,1074,1078],{"__ignoreMap":196},[200,981,982,985,988,991,994],{"class":202,"line":203},[200,983,984],{"class":626},"import",[200,986,987],{"class":209}," { getJWESession, updateJWSSession } ",[200,989,990],{"class":626},"from",[200,992,993],{"class":639}," \"unjwt\u002Fadapters\u002Fh3v2\"",[200,995,996],{"class":209},";\n",[200,998,999],{"class":202,"line":213},[200,1000,1002],{"emptyLinePlaceholder":1001},true,"\n",[200,1004,1005,1007],{"class":202,"line":219},[200,1006,187],{"class":206},[200,1008,611],{"class":209},[200,1010,1011,1013,1015],{"class":202,"line":225},[200,1012,616],{"class":209},[200,1014,496],{"class":206},[200,1016,1017],{"class":209},"({ event, config }) {\n",[200,1019,1020,1023,1027,1030,1033,1036],{"class":202,"line":252},[200,1021,1022],{"class":626},"    const",[200,1024,1026],{"class":1025},"suiK_"," refresh",[200,1028,1029],{"class":626}," =",[200,1031,1032],{"class":626}," await",[200,1034,1035],{"class":206}," getJWESession",[200,1037,1038],{"class":209},"(event, refreshConfig);\n",[200,1040,1041,1043],{"class":202,"line":259},[200,1042,722],{"class":626},[200,1044,1045],{"class":209}," (refresh.data.sub) {\n",[200,1047,1048,1050,1053],{"class":202,"line":265},[200,1049,736],{"class":626},[200,1051,1052],{"class":206}," updateJWSSession",[200,1054,1055],{"class":209},"(event, config, {\n",[200,1057,1058],{"class":202,"line":290},[200,1059,1060],{"class":209},"        sub: refresh.data.sub,\n",[200,1062,1063],{"class":202,"line":295},[200,1064,1065],{"class":209},"        scope: refresh.data.scope,\n",[200,1067,1068],{"class":202,"line":300},[200,1069,791],{"class":209},[200,1071,1072],{"class":202,"line":320},[200,1073,796],{"class":209},[200,1075,1076],{"class":202,"line":325},[200,1077,440],{"class":209},[200,1079,1080],{"class":202,"line":330},[200,1081,662],{"class":209},[173,1083,1084,1087,1088,1090,1091,1094,1095,1097],{},[177,1085,1086],{},"session.id"," in ",[177,1089,496],{}," is populated from the expired token's ",[177,1092,1093],{},"jti"," when the token was cryptographically valid but past its ",[177,1096,546],{},". This lets you correlate expired-token events with issued-session records (e.g. to decrement an active-session counter).",[455,1099,1101,1103],{"id":1100},"onerror-verification-failures",[177,1102,499],{}," — verification failures",[173,1105,1106,1107,1110,1111,1114],{},"Fires when a token exists in the cookie\u002Fheader but fails verification for a reason ",[576,1108,1109],{},"other than expiry"," — bad signature, unknown ",[177,1112,1113],{},"kid",", disallowed algorithm, malformed structure:",[190,1116,1119],{"className":192,"code":1117,"filename":1118,"language":195,"meta":196,"style":196},"hooks: {\n  async onError({ session, event, error }) {\n    logger.warn(\"session.verify.failed\", {\n      code: error.code,\n      ip: event.request.headers.get(\"x-forwarded-for\"),\n    });\n  },\n},\n","on-error.ts",[177,1120,1121,1127,1136,1151,1156,1172,1176,1180],{"__ignoreMap":196},[200,1122,1123,1125],{"class":202,"line":203},[200,1124,187],{"class":206},[200,1126,611],{"class":209},[200,1128,1129,1131,1133],{"class":202,"line":213},[200,1130,616],{"class":209},[200,1132,499],{"class":206},[200,1134,1135],{"class":209},"({ session, event, error }) {\n",[200,1137,1138,1141,1144,1146,1149],{"class":202,"line":219},[200,1139,1140],{"class":209},"    logger.",[200,1142,1143],{"class":206},"warn",[200,1145,636],{"class":209},[200,1147,1148],{"class":639},"\"session.verify.failed\"",[200,1150,643],{"class":209},[200,1152,1153],{"class":202,"line":225},[200,1154,1155],{"class":209},"      code: error.code,\n",[200,1157,1158,1161,1164,1166,1169],{"class":202,"line":252},[200,1159,1160],{"class":209},"      ip: event.request.headers.",[200,1162,1163],{"class":206},"get",[200,1165,636],{"class":209},[200,1167,1168],{"class":639},"\"x-forwarded-for\"",[200,1170,1171],{"class":209},"),\n",[200,1173,1174],{"class":202,"line":259},[200,1175,653],{"class":209},[200,1177,1178],{"class":202,"line":265},[200,1179,440],{"class":209},[200,1181,1182],{"class":202,"line":290},[200,1183,662],{"class":209},[173,1185,1186,1187,1189,1190,238,1193,1196],{},"Useful for tamper detection and fraud signals. The ",[177,1188,235],{}," argument is an empty manager (no ",[177,1191,1192],{},"data",[177,1194,1195],{},"id: undefined",") because verification couldn't produce a valid session.",[455,1198,1200],{"id":1199},"key-lookup-hooks","Key-lookup hooks",[173,1202,1203,1204,1207],{},"These are different — they don't fire on lifecycle events. They ",[576,1205,1206],{},"override"," the key used for verification \u002F unsealing on a per-request basis.",[1209,1210,1212,1215],"h3",{"id":1211},"onverifykeylookup-jws",[177,1213,1214],{},"onVerifyKeyLookup"," (JWS)",[190,1217,1220],{"className":192,"code":1218,"filename":1219,"language":195,"meta":196,"style":196},"hooks: {\n  onVerifyKeyLookup({ header, event, config }) {\n    \u002F\u002F Return a JWSVerifyJWK (HMAC oct or public asymmetric with a signing alg) or a JWKSet\n    return keyStore.forKid(header.kid);\n  },\n},\n","key-rotation-jws.ts",[177,1221,1222,1228,1236,1241,1255,1259],{"__ignoreMap":196},[200,1223,1224,1226],{"class":202,"line":203},[200,1225,187],{"class":206},[200,1227,611],{"class":209},[200,1229,1230,1233],{"class":202,"line":213},[200,1231,1232],{"class":206},"  onVerifyKeyLookup",[200,1234,1235],{"class":209},"({ header, event, config }) {\n",[200,1237,1238],{"class":202,"line":219},[200,1239,1240],{"class":255},"    \u002F\u002F Return a JWSVerifyJWK (HMAC oct or public asymmetric with a signing alg) or a JWKSet\n",[200,1242,1243,1246,1249,1252],{"class":202,"line":225},[200,1244,1245],{"class":626},"    return",[200,1247,1248],{"class":209}," keyStore.",[200,1250,1251],{"class":206},"forKid",[200,1253,1254],{"class":209},"(header.kid);\n",[200,1256,1257],{"class":202,"line":252},[200,1258,440],{"class":209},[200,1260,1261],{"class":202,"line":259},[200,1262,662],{"class":209},[173,1264,1265,1266,1269,1270,1272],{},"Overrides the ",[177,1267,1268],{},"config.key"," just for verification — signing still uses ",[177,1271,1268],{},". Classic use: rotate signing keys while continuing to verify tokens signed with retired keys.",[1209,1274,1276,1279],{"id":1275},"onunsealkeylookup-jwe",[177,1277,1278],{},"onUnsealKeyLookup"," (JWE)",[190,1281,1284],{"className":192,"code":1282,"filename":1283,"language":195,"meta":196,"style":196},"hooks: {\n  async onUnsealKeyLookup({ header, event, config }) {\n    \u002F\u002F Return a symmetric or private JWK\n    return await keyStore.forKid(header.kid!) ?? fallbackKey;\n  },\n},\n","key-rotation-jwe.ts",[177,1285,1286,1292,1300,1305,1329,1333],{"__ignoreMap":196},[200,1287,1288,1290],{"class":202,"line":203},[200,1289,187],{"class":206},[200,1291,611],{"class":209},[200,1293,1294,1296,1298],{"class":202,"line":213},[200,1295,616],{"class":209},[200,1297,1278],{"class":206},[200,1299,1235],{"class":209},[200,1301,1302],{"class":202,"line":219},[200,1303,1304],{"class":255},"    \u002F\u002F Return a symmetric or private JWK\n",[200,1306,1307,1309,1311,1313,1315,1318,1320,1323,1326],{"class":202,"line":225},[200,1308,1245],{"class":626},[200,1310,1032],{"class":626},[200,1312,1248],{"class":209},[200,1314,1251],{"class":206},[200,1316,1317],{"class":209},"(header.kid",[200,1319,728],{"class":626},[200,1321,1322],{"class":209},") ",[200,1324,1325],{"class":626},"??",[200,1327,1328],{"class":209}," fallbackKey;\n",[200,1330,1331],{"class":202,"line":252},[200,1332,440],{"class":209},[200,1334,1335],{"class":202,"line":259},[200,1336,662],{"class":209},[173,1338,1339,1340,1342],{},"Same idea for encrypted sessions — decryption uses the lookup result, encryption uses ",[177,1341,1268],{},".",[1344,1345,1346],"tip",{},[173,1347,1348,1349,1351,1352,1354],{},"For symmetric key rotation (JWE with pre-shared keys), rotate with overlap: your new sessions are encrypted with the new key, but ",[177,1350,1278],{}," returns the old key when the token's ",[177,1353,1113],{}," matches. Once all old-key-wrapped tokens have expired, retire the old key.",[455,1356,1358],{"id":1357},"hook-signatures","Hook signatures",[190,1360,1362],{"className":192,"code":1361,"language":195,"meta":196,"style":196},"interface SessionHooksJWS\u003CT, MaxAge, TEvent> {\n  onRead?(args: {\n    session: SessionJWS\u003CT, MaxAge> & { id: string; token: string };\n    event: TEvent;\n    config: SessionConfigJWS\u003CT, MaxAge, TEvent>;\n  }): void | Promise\u003Cvoid>;\n\n  onUpdate?(args: {\n    session: SessionJWS\u003CT, MaxAge> & { id: string; token: string };\n    oldSession: SessionJWS\u003CT, MaxAge>;\n    event: TEvent;\n    config: SessionConfigJWS\u003CT, MaxAge, TEvent>;\n  }): void | Promise\u003Cvoid>;\n\n  onClear?(args: {\n    oldSession: SessionJWS\u003CT, MaxAge> | undefined;\n    event: TEvent;\n    config: SessionConfigJWS\u003CT, MaxAge, TEvent>;\n  }): void | Promise\u003Cvoid>;\n\n  onExpire?(args: {\n    session: {\n      id: string | undefined;\n      createdAt: number | undefined;\n      expiresAt: number | undefined;\n      token: string;\n    };\n    event: TEvent;\n    error: Error;\n    config: SessionConfigJWS\u003CT, MaxAge, TEvent>;\n  }): void | Promise\u003Cvoid>;\n\n  onError?(args: {\n    session: SessionJWS\u003CT, MaxAge>;\n    event: TEvent;\n    error: any;\n    config: SessionConfigJWS\u003CT, MaxAge, TEvent>;\n  }): void | Promise\u003Cvoid>;\n\n  onVerifyKeyLookup?(args: {\n    header: JWKLookupFunctionHeader;\n    event: TEvent;\n    config: SessionConfigJWS\u003CT, MaxAge, TEvent>;\n  }): JWKSet | JWSVerifyJWK | Promise\u003CJWKSet | JWSVerifyJWK>;\n}\n",[177,1363,1364,1391,1409,1457,1469,1494,1517,1521,1536,1574,1593,1603,1625,1643,1647,1662,1688,1698,1720,1738,1742,1757,1765,1780,1796,1812,1824,1830,1841,1854,1877,1896,1901,1917,1936,1947,1959,1982,2001,2006,2021,2034,2045,2068,2098],{"__ignoreMap":196},[200,1365,1366,1369,1372,1375,1378,1380,1383,1385,1388],{"class":202,"line":203},[200,1367,1368],{"class":626},"interface",[200,1370,1371],{"class":206}," SessionHooksJWS",[200,1373,1374],{"class":209},"\u003C",[200,1376,1377],{"class":206},"T",[200,1379,238],{"class":209},[200,1381,1382],{"class":206},"MaxAge",[200,1384,238],{"class":209},[200,1386,1387],{"class":206},"TEvent",[200,1389,1390],{"class":209},"> {\n",[200,1392,1393,1396,1399,1401,1404,1407],{"class":202,"line":213},[200,1394,1395],{"class":206},"  onRead",[200,1397,1398],{"class":626},"?",[200,1400,636],{"class":209},[200,1402,1403],{"class":234},"args",[200,1405,1406],{"class":626},":",[200,1408,761],{"class":209},[200,1410,1411,1414,1416,1419,1421,1423,1425,1427,1430,1433,1436,1439,1441,1444,1447,1450,1452,1454],{"class":202,"line":219},[200,1412,1413],{"class":234},"    session",[200,1415,1406],{"class":626},[200,1417,1418],{"class":206}," SessionJWS",[200,1420,1374],{"class":209},[200,1422,1377],{"class":206},[200,1424,238],{"class":209},[200,1426,1382],{"class":206},[200,1428,1429],{"class":209},"> ",[200,1431,1432],{"class":626},"&",[200,1434,1435],{"class":209}," { ",[200,1437,1438],{"class":234},"id",[200,1440,1406],{"class":626},[200,1442,1443],{"class":1025}," string",[200,1445,1446],{"class":209},"; ",[200,1448,1449],{"class":234},"token",[200,1451,1406],{"class":626},[200,1453,1443],{"class":1025},[200,1455,1456],{"class":209}," };\n",[200,1458,1459,1462,1464,1467],{"class":202,"line":225},[200,1460,1461],{"class":234},"    event",[200,1463,1406],{"class":626},[200,1465,1466],{"class":206}," TEvent",[200,1468,996],{"class":209},[200,1470,1471,1474,1476,1479,1481,1483,1485,1487,1489,1491],{"class":202,"line":252},[200,1472,1473],{"class":234},"    config",[200,1475,1406],{"class":626},[200,1477,1478],{"class":206}," SessionConfigJWS",[200,1480,1374],{"class":209},[200,1482,1377],{"class":206},[200,1484,238],{"class":209},[200,1486,1382],{"class":206},[200,1488,238],{"class":209},[200,1490,1387],{"class":206},[200,1492,1493],{"class":209},">;\n",[200,1495,1496,1499,1501,1504,1507,1510,1512,1515],{"class":202,"line":259},[200,1497,1498],{"class":209},"  })",[200,1500,1406],{"class":626},[200,1502,1503],{"class":1025}," void",[200,1505,1506],{"class":626}," |",[200,1508,1509],{"class":206}," Promise",[200,1511,1374],{"class":209},[200,1513,1514],{"class":1025},"void",[200,1516,1493],{"class":209},[200,1518,1519],{"class":202,"line":265},[200,1520,1002],{"emptyLinePlaceholder":1001},[200,1522,1523,1526,1528,1530,1532,1534],{"class":202,"line":290},[200,1524,1525],{"class":206},"  onUpdate",[200,1527,1398],{"class":626},[200,1529,636],{"class":209},[200,1531,1403],{"class":234},[200,1533,1406],{"class":626},[200,1535,761],{"class":209},[200,1537,1538,1540,1542,1544,1546,1548,1550,1552,1554,1556,1558,1560,1562,1564,1566,1568,1570,1572],{"class":202,"line":295},[200,1539,1413],{"class":234},[200,1541,1406],{"class":626},[200,1543,1418],{"class":206},[200,1545,1374],{"class":209},[200,1547,1377],{"class":206},[200,1549,238],{"class":209},[200,1551,1382],{"class":206},[200,1553,1429],{"class":209},[200,1555,1432],{"class":626},[200,1557,1435],{"class":209},[200,1559,1438],{"class":234},[200,1561,1406],{"class":626},[200,1563,1443],{"class":1025},[200,1565,1446],{"class":209},[200,1567,1449],{"class":234},[200,1569,1406],{"class":626},[200,1571,1443],{"class":1025},[200,1573,1456],{"class":209},[200,1575,1576,1579,1581,1583,1585,1587,1589,1591],{"class":202,"line":300},[200,1577,1578],{"class":234},"    oldSession",[200,1580,1406],{"class":626},[200,1582,1418],{"class":206},[200,1584,1374],{"class":209},[200,1586,1377],{"class":206},[200,1588,238],{"class":209},[200,1590,1382],{"class":206},[200,1592,1493],{"class":209},[200,1594,1595,1597,1599,1601],{"class":202,"line":320},[200,1596,1461],{"class":234},[200,1598,1406],{"class":626},[200,1600,1466],{"class":206},[200,1602,996],{"class":209},[200,1604,1605,1607,1609,1611,1613,1615,1617,1619,1621,1623],{"class":202,"line":325},[200,1606,1473],{"class":234},[200,1608,1406],{"class":626},[200,1610,1478],{"class":206},[200,1612,1374],{"class":209},[200,1614,1377],{"class":206},[200,1616,238],{"class":209},[200,1618,1382],{"class":206},[200,1620,238],{"class":209},[200,1622,1387],{"class":206},[200,1624,1493],{"class":209},[200,1626,1627,1629,1631,1633,1635,1637,1639,1641],{"class":202,"line":330},[200,1628,1498],{"class":209},[200,1630,1406],{"class":626},[200,1632,1503],{"class":1025},[200,1634,1506],{"class":626},[200,1636,1509],{"class":206},[200,1638,1374],{"class":209},[200,1640,1514],{"class":1025},[200,1642,1493],{"class":209},[200,1644,1645],{"class":202,"line":355},[200,1646,1002],{"emptyLinePlaceholder":1001},[200,1648,1649,1652,1654,1656,1658,1660],{"class":202,"line":360},[200,1650,1651],{"class":206},"  onClear",[200,1653,1398],{"class":626},[200,1655,636],{"class":209},[200,1657,1403],{"class":234},[200,1659,1406],{"class":626},[200,1661,761],{"class":209},[200,1663,1664,1666,1668,1670,1672,1674,1676,1678,1680,1683,1686],{"class":202,"line":365},[200,1665,1578],{"class":234},[200,1667,1406],{"class":626},[200,1669,1418],{"class":206},[200,1671,1374],{"class":209},[200,1673,1377],{"class":206},[200,1675,238],{"class":209},[200,1677,1382],{"class":206},[200,1679,1429],{"class":209},[200,1681,1682],{"class":626},"|",[200,1684,1685],{"class":1025}," undefined",[200,1687,996],{"class":209},[200,1689,1690,1692,1694,1696],{"class":202,"line":389},[200,1691,1461],{"class":234},[200,1693,1406],{"class":626},[200,1695,1466],{"class":206},[200,1697,996],{"class":209},[200,1699,1700,1702,1704,1706,1708,1710,1712,1714,1716,1718],{"class":202,"line":394},[200,1701,1473],{"class":234},[200,1703,1406],{"class":626},[200,1705,1478],{"class":206},[200,1707,1374],{"class":209},[200,1709,1377],{"class":206},[200,1711,238],{"class":209},[200,1713,1382],{"class":206},[200,1715,238],{"class":209},[200,1717,1387],{"class":206},[200,1719,1493],{"class":209},[200,1721,1722,1724,1726,1728,1730,1732,1734,1736],{"class":202,"line":399},[200,1723,1498],{"class":209},[200,1725,1406],{"class":626},[200,1727,1503],{"class":1025},[200,1729,1506],{"class":626},[200,1731,1509],{"class":206},[200,1733,1374],{"class":209},[200,1735,1514],{"class":1025},[200,1737,1493],{"class":209},[200,1739,1740],{"class":202,"line":420},[200,1741,1002],{"emptyLinePlaceholder":1001},[200,1743,1744,1747,1749,1751,1753,1755],{"class":202,"line":426},[200,1745,1746],{"class":206},"  onExpire",[200,1748,1398],{"class":626},[200,1750,636],{"class":209},[200,1752,1403],{"class":234},[200,1754,1406],{"class":626},[200,1756,761],{"class":209},[200,1758,1759,1761,1763],{"class":202,"line":431},[200,1760,1413],{"class":234},[200,1762,1406],{"class":626},[200,1764,761],{"class":209},[200,1766,1767,1770,1772,1774,1776,1778],{"class":202,"line":437},[200,1768,1769],{"class":234},"      id",[200,1771,1406],{"class":626},[200,1773,1443],{"class":1025},[200,1775,1506],{"class":626},[200,1777,1685],{"class":1025},[200,1779,996],{"class":209},[200,1781,1782,1785,1787,1790,1792,1794],{"class":202,"line":443},[200,1783,1784],{"class":234},"      createdAt",[200,1786,1406],{"class":626},[200,1788,1789],{"class":1025}," number",[200,1791,1506],{"class":626},[200,1793,1685],{"class":1025},[200,1795,996],{"class":209},[200,1797,1799,1802,1804,1806,1808,1810],{"class":202,"line":1798},25,[200,1800,1801],{"class":234},"      expiresAt",[200,1803,1406],{"class":626},[200,1805,1789],{"class":1025},[200,1807,1506],{"class":626},[200,1809,1685],{"class":1025},[200,1811,996],{"class":209},[200,1813,1815,1818,1820,1822],{"class":202,"line":1814},26,[200,1816,1817],{"class":234},"      token",[200,1819,1406],{"class":626},[200,1821,1443],{"class":1025},[200,1823,996],{"class":209},[200,1825,1827],{"class":202,"line":1826},27,[200,1828,1829],{"class":209},"    };\n",[200,1831,1833,1835,1837,1839],{"class":202,"line":1832},28,[200,1834,1461],{"class":234},[200,1836,1406],{"class":626},[200,1838,1466],{"class":206},[200,1840,996],{"class":209},[200,1842,1844,1847,1849,1852],{"class":202,"line":1843},29,[200,1845,1846],{"class":234},"    error",[200,1848,1406],{"class":626},[200,1850,1851],{"class":206}," Error",[200,1853,996],{"class":209},[200,1855,1857,1859,1861,1863,1865,1867,1869,1871,1873,1875],{"class":202,"line":1856},30,[200,1858,1473],{"class":234},[200,1860,1406],{"class":626},[200,1862,1478],{"class":206},[200,1864,1374],{"class":209},[200,1866,1377],{"class":206},[200,1868,238],{"class":209},[200,1870,1382],{"class":206},[200,1872,238],{"class":209},[200,1874,1387],{"class":206},[200,1876,1493],{"class":209},[200,1878,1880,1882,1884,1886,1888,1890,1892,1894],{"class":202,"line":1879},31,[200,1881,1498],{"class":209},[200,1883,1406],{"class":626},[200,1885,1503],{"class":1025},[200,1887,1506],{"class":626},[200,1889,1509],{"class":206},[200,1891,1374],{"class":209},[200,1893,1514],{"class":1025},[200,1895,1493],{"class":209},[200,1897,1899],{"class":202,"line":1898},32,[200,1900,1002],{"emptyLinePlaceholder":1001},[200,1902,1904,1907,1909,1911,1913,1915],{"class":202,"line":1903},33,[200,1905,1906],{"class":206},"  onError",[200,1908,1398],{"class":626},[200,1910,636],{"class":209},[200,1912,1403],{"class":234},[200,1914,1406],{"class":626},[200,1916,761],{"class":209},[200,1918,1920,1922,1924,1926,1928,1930,1932,1934],{"class":202,"line":1919},34,[200,1921,1413],{"class":234},[200,1923,1406],{"class":626},[200,1925,1418],{"class":206},[200,1927,1374],{"class":209},[200,1929,1377],{"class":206},[200,1931,238],{"class":209},[200,1933,1382],{"class":206},[200,1935,1493],{"class":209},[200,1937,1939,1941,1943,1945],{"class":202,"line":1938},35,[200,1940,1461],{"class":234},[200,1942,1406],{"class":626},[200,1944,1466],{"class":206},[200,1946,996],{"class":209},[200,1948,1950,1952,1954,1957],{"class":202,"line":1949},36,[200,1951,1846],{"class":234},[200,1953,1406],{"class":626},[200,1955,1956],{"class":1025}," any",[200,1958,996],{"class":209},[200,1960,1962,1964,1966,1968,1970,1972,1974,1976,1978,1980],{"class":202,"line":1961},37,[200,1963,1473],{"class":234},[200,1965,1406],{"class":626},[200,1967,1478],{"class":206},[200,1969,1374],{"class":209},[200,1971,1377],{"class":206},[200,1973,238],{"class":209},[200,1975,1382],{"class":206},[200,1977,238],{"class":209},[200,1979,1387],{"class":206},[200,1981,1493],{"class":209},[200,1983,1985,1987,1989,1991,1993,1995,1997,1999],{"class":202,"line":1984},38,[200,1986,1498],{"class":209},[200,1988,1406],{"class":626},[200,1990,1503],{"class":1025},[200,1992,1506],{"class":626},[200,1994,1509],{"class":206},[200,1996,1374],{"class":209},[200,1998,1514],{"class":1025},[200,2000,1493],{"class":209},[200,2002,2004],{"class":202,"line":2003},39,[200,2005,1002],{"emptyLinePlaceholder":1001},[200,2007,2009,2011,2013,2015,2017,2019],{"class":202,"line":2008},40,[200,2010,1232],{"class":206},[200,2012,1398],{"class":626},[200,2014,636],{"class":209},[200,2016,1403],{"class":234},[200,2018,1406],{"class":626},[200,2020,761],{"class":209},[200,2022,2024,2027,2029,2032],{"class":202,"line":2023},41,[200,2025,2026],{"class":234},"    header",[200,2028,1406],{"class":626},[200,2030,2031],{"class":206}," JWKLookupFunctionHeader",[200,2033,996],{"class":209},[200,2035,2037,2039,2041,2043],{"class":202,"line":2036},42,[200,2038,1461],{"class":234},[200,2040,1406],{"class":626},[200,2042,1466],{"class":206},[200,2044,996],{"class":209},[200,2046,2048,2050,2052,2054,2056,2058,2060,2062,2064,2066],{"class":202,"line":2047},43,[200,2049,1473],{"class":234},[200,2051,1406],{"class":626},[200,2053,1478],{"class":206},[200,2055,1374],{"class":209},[200,2057,1377],{"class":206},[200,2059,238],{"class":209},[200,2061,1382],{"class":206},[200,2063,238],{"class":209},[200,2065,1387],{"class":206},[200,2067,1493],{"class":209},[200,2069,2071,2073,2075,2078,2080,2083,2085,2087,2089,2092,2094,2096],{"class":202,"line":2070},44,[200,2072,1498],{"class":209},[200,2074,1406],{"class":626},[200,2076,2077],{"class":206}," JWKSet",[200,2079,1506],{"class":626},[200,2081,2082],{"class":206}," JWSVerifyJWK",[200,2084,1506],{"class":626},[200,2086,1509],{"class":206},[200,2088,1374],{"class":209},[200,2090,2091],{"class":206},"JWKSet",[200,2093,1506],{"class":626},[200,2095,2082],{"class":206},[200,2097,1493],{"class":209},[200,2099,2101],{"class":202,"line":2100},45,[200,2102,2103],{"class":209},"}\n",[173,2105,2106,2109,2110,2112,2113,2115,2116,2119],{},[177,2107,2108],{},"SessionHooksJWE"," has the same shape; swap JWS types for JWE types, and ",[177,2111,1214],{}," for ",[177,2114,1278],{}," (which returns a ",[177,2117,2118],{},"JWEDecryptJWK",").",[455,2121,2123],{"id":2122},"see-also","See also",[2125,2126,2127,2133,2138],"ul",{},[2128,2129,2130],"li",{},[970,2131,2132],{"href":157},"H3 sessions →",[2128,2134,2135],{},[970,2136,2137],{"href":165},"Lower-level functions →",[2128,2139,2140],{},[970,2141,2142],{"href":96},"Example: refresh-token pattern →",[2144,2145,2146],"style",{},"html pre.shiki code .shcOC, html code.shiki .shcOC{--shiki-light:#6F42C1;--shiki-default:#B392F0;--shiki-dark:#B392F0}html pre.shiki code .slsVL, html code.shiki .slsVL{--shiki-light:#24292E;--shiki-default:#E1E4E8;--shiki-dark:#E1E4E8}html pre.shiki code .sQHwn, html code.shiki .sQHwn{--shiki-light:#E36209;--shiki-default:#FFAB70;--shiki-dark:#FFAB70}html pre.shiki code .sCsY4, html code.shiki .sCsY4{--shiki-light:#6A737D;--shiki-default:#6A737D;--shiki-dark:#6A737D}html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .so5gQ, html code.shiki .so5gQ{--shiki-light:#D73A49;--shiki-default:#F97583;--shiki-dark:#F97583}html pre.shiki code .sfrk1, html code.shiki .sfrk1{--shiki-light:#032F62;--shiki-default:#9ECBFF;--shiki-dark:#9ECBFF}html pre.shiki code .suiK_, html code.shiki .suiK_{--shiki-light:#005CC5;--shiki-default:#79B8FF;--shiki-dark:#79B8FF}",{"title":196,"searchDepth":213,"depth":213,"links":2148},[2149,2150,2152,2154,2156,2158,2160,2166,2167],{"id":457,"depth":213,"text":458},{"id":592,"depth":213,"text":2151},"onRead — every valid request",{"id":674,"depth":213,"text":2153},"onUpdate — session created or rotated",{"id":810,"depth":213,"text":2155},"onClear — explicit termination",{"id":888,"depth":213,"text":2157},"onExpire — natural expiry",{"id":1100,"depth":213,"text":2159},"onError — verification failures",{"id":1199,"depth":213,"text":1200,"children":2161},[2162,2164],{"id":1211,"depth":219,"text":2163},"onVerifyKeyLookup (JWS)",{"id":1275,"depth":219,"text":2165},"onUnsealKeyLookup (JWE)",{"id":1357,"depth":213,"text":1358},{"id":2122,"depth":213,"text":2123},"md",{},{},{"title":160,"description":196},"P3JMJPUxUsWPHnCSZq5o-3Dm_pE9S8ZIDfWvyEd4IoA",[2174,2175],{"title":156,"path":157,"stem":158,"description":196,"children":-1},{"title":164,"path":165,"stem":166,"description":196,"children":-1},1776888562330]