unjwt 0.7.2 → 0.8.0

package/dist/adapters/h3v1/index.mjs

@@ -1,652 +1,147 @@
-import { JWTError, computeDurationInSeconds, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK } from "../../_chunks/utils.mjs";
-import { sanitizeObjectCopy } from "../../_chunks/libs/unsecure.mjs";
-import { deriveJWKFromPassword, exportPEM, exportToPEM, generateJWK, importFromPEM, importPEM } from "../../_chunks/jwk.mjs";
-import { sign, verify } from "../../_chunks/jws.mjs";
-import { decrypt, encrypt } from "../../_chunks/jwe.mjs";
-import { isEvent, setCookie } from "h3";
+import { deriveJWKFromPassword, exportPEM, generateJWK, importPEM, thumbprint } from "../../_chunks/jwk.mjs";
+import { bindSession, createJWECodec, createJWSCodec, dropSession, encodeSession, issueSession, loadSession, openSessionToken, readChunkedFrom, readChunkedFromSetCookie, recordSlotStore, removeChunked, resolveSessionToken, responseCookieStore, sessionActions, sessionManager, sessionToken, writeChunked } from "../../_chunks/_codec-jws.mjs";
+import { getCookie, isEvent, setCookie } from "h3";
 import { parse } from "cookie-es";
-const kGetSessionPromise$1 = Symbol("h3_jwe_getSession");
-const DEFAULT_NAME$1 = "h3-jwe";
-const DEFAULT_COOKIE$1 = {
-	path: "/",
-	secure: true,
-	httpOnly: true
-};
-async function useJWESession(event, config) {
-	const sessionName = config.name || DEFAULT_NAME$1;
-	await getJWESession(event, config);
-	const sessionManager = {
-		get id() {
-			return event.context.sessions?.[sessionName]?.id;
-		},
-		get createdAt() {
-			return event.context.sessions?.[sessionName]?.createdAt || Date.now();
-		},
-		get expiresAt() {
-			return event.context.sessions?.[sessionName]?.expiresAt;
-		},
-		get data() {
-			return event.context.sessions?.[sessionName]?.data || {};
-		},
-		get token() {
-			return (event.context.sessions?.[sessionName])?.token ?? getJWESessionToken(event, config);
-		},
-		update: async (update) => {
-			await updateJWESession(event, config, update);
-			return sessionManager;
-		},
-		clear: async () => {
-			await clearJWESession(event, config);
-			return sessionManager;
-		}
-	};
-	return sessionManager;
-}
-async function getJWESession(event, config) {
-	const sessionName = config.name || DEFAULT_NAME$1;
-	if (!event.context.sessions) event.context.sessions = Object.create(null);
-	const existingSession = event.context.sessions[sessionName];
-	if (existingSession) {
-		const session = existingSession[kGetSessionPromise$1] ? await existingSession[kGetSessionPromise$1] : existingSession;
-		if (session.expiresAt !== void 0 && session.expiresAt < Date.now()) {
-			await config.hooks?.onExpire?.({
-				session: {
-					id: session.id,
-					createdAt: session.createdAt,
-					expiresAt: session.expiresAt,
-					token: session.token
-				},
-				event,
-				error: new JWTError(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(session.expiresAt * 1e3)).toISOString()})`, "ERR_JWT_EXPIRED", {
-					jti: session.id,
-					exp: session.expiresAt / 1e3
-				}),
-				config
-			});
-			delete event.context.sessions[sessionName];
-			if (config.cookie !== false) if (isEvent(event)) setCookie(event, sessionName, "", {
-				...DEFAULT_COOKIE$1,
-				...config.cookie,
-				expires: /* @__PURE__ */ new Date(0),
-				maxAge: void 0
-			});
-			else console.warn("[unjwt/h3] Session expired but cookie cannot be cleared on a read-only event.");
-			const freshNow = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
-			const freshCreatedAt = freshNow - freshNow % 1e3;
-			const freshSession = {
-				id: void 0,
-				createdAt: freshCreatedAt,
-				expiresAt: config.maxAge === void 0 ? void 0 : freshCreatedAt + computeDurationInSeconds(config.maxAge) * 1e3,
-				data: Object.create(null),
-				token: void 0
-			};
-			event.context.sessions[sessionName] = freshSession;
-			return freshSession;
-		}
-		if (session.id !== void 0 && session.token !== void 0) await config.hooks?.onRead?.({
-			session,
-			event,
-			config
+function eventCookieStore(event) {
+	return responseCookieStore({
+		request: (name) => getCookie(event, name),
+		response: () => responseSetCookies(event),
+		write: (name, value, attrs) => setCookie(event, name, value, attrs)
+	});
+}
+function responseSetCookies(event) {
+	const value = event.node.res.getHeader("set-cookie");
+	if (Array.isArray(value)) return value;
+	return typeof value === "string" ? [value] : [];
+}
+const PREFIX = "[unjwt/h3]";
+const h3SessionPort = {
+	prefix: PREFIX,
+	carrier: (event) => ({ event }),
+	store: (event, slot) => recordSlotStore(() => getSessionsContext(event), slot),
+	readToken: readSessionToken,
+	scope: getSessionsContext,
+	writable: hasWritableResponse,
+	setCookie: (event, sessionName, token, { attrs, chunkMaxLength }) => {
+		writeChunked(eventCookieStore(cookieEvent(event)), sessionName, token, {
+			attrs,
+			chunkMaxLength,
+			prefix: PREFIX
 		});
-		return session;
+	},
+	deleteCookie: (event, sessionName, { attrs }) => {
+		removeChunked(eventCookieStore(cookieEvent(event)), sessionName, { attrs });
 	}
-	const now = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
-	const createdAt = now - now % 1e3;
-	const session = {
-		id: void 0,
-		createdAt,
-		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(config.maxAge) * 1e3,
-		data: Object.create(null),
-		token: void 0
-	};
-	event.context.sessions[sessionName] = session;
-	const token = getJWESessionToken(event, config);
-	let exclusiveHookFired = false;
-	if (token) {
-		session.token = token;
-		const promise = unsealJWESession(event, config, token).catch(async (error_) => {
-			exclusiveHookFired = true;
-			if (isJWTError(error_, "ERR_JWT_EXPIRED")) await config.hooks?.onExpire?.({
-				session: {
-					id: error_.cause.jti,
-					createdAt: error_.cause.iat ? error_.cause.iat * 1e3 : void 0,
-					expiresAt: error_.cause.exp ? error_.cause.exp * 1e3 : void 0,
-					token
-				},
-				error: error_,
-				event,
-				config
-			});
-			else await config.hooks?.onError?.({
-				session,
-				error: error_,
-				event,
-				config
-			});
-		}).then((unsealed) => {
-			if (unsealed) Object.assign(session, unsealed);
-			delete event.context.sessions[sessionName][kGetSessionPromise$1];
-			return session;
-		});
-		event.context.sessions[sessionName][kGetSessionPromise$1] = promise;
-		await promise;
-	}
-	if (!exclusiveHookFired && session.id !== void 0 && session.token !== void 0) await config.hooks?.onRead?.({
-		session,
-		event,
-		config
+};
+function getSessionsContext(event) {
+	return event.context.sessions ||= Object.create(null);
+}
+function hasWritableResponse(event) {
+	if (!isEvent(event)) return false;
+	const { res } = event.node;
+	return !res.headersSent && !res.writableEnded;
+}
+function readSessionToken(event, sessionName, source) {
+	return resolveSessionToken(source, sessionName, {
+		written: (name) => readChunkedFromSetCookie(getResponseSetCookie(event), name),
+		cookie: (name) => readChunkedFrom(getRequestCookies(event), name),
+		header: (name) => getRequestHeader(event, name)
 	});
-	return session;
 }
-function getJWESessionToken(event, config) {
-	const sessionName = config.name || DEFAULT_NAME$1;
-	let token;
-	if (config.sessionHeader !== false) {
-		const headerValue = _getReqHeader$1(event, typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`);
-		if (typeof headerValue === "string") token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
-	}
-	if (config.cookie !== false) {
-		const setCookie = _getResHeader$1(event, "set-cookie");
-		if (typeof setCookie === "string") token = findSetCookie$1(setCookie, sessionName);
-		else if (Array.isArray(setCookie)) for (const sc of setCookie) {
-			token = findSetCookie$1(sc, sessionName);
-			if (token) break;
-		}
-	}
-	if (!token) {
-		const cookieHeader = _getReqHeader$1(event, "cookie");
-		if (cookieHeader) token = parse(String(cookieHeader))[sessionName];
+function cookieEvent(event) {
+	return event;
+}
+function getRequestHeader(event, name) {
+	if ("node" in event && event.node) {
+		const value = event.node.req.headers[name];
+		return Array.isArray(value) ? value[0] : value;
 	}
-	return token;
+	return (("request" in event ? event.request?.headers : void 0) ?? ("headers" in event ? event.headers : void 0))?.get(name) ?? void 0;
 }
-function _getReqHeader$1(event, name) {
-	if (event.node) return event.node?.req.headers[name];
-	if (event.request) return event.request.headers?.get(name);
-	if (event.headers) return event.headers.get(name);
+function getRequestCookies(event) {
+	const header = getRequestHeader(event, "cookie");
+	return header ? parse(header) : Object.create(null);
 }
-function _getResHeader$1(event, name) {
-	if (event.node) return event.node?.res.getHeader(name);
-	if (event.response) return event.response.headers?.get(name);
+function getResponseSetCookie(event) {
+	if ("node" in event && event.node) return responseSetCookies(event);
+	const response = "response" in event ? event.response : void 0;
+	return hasHeaders(response) ? response.headers.getSetCookie() : [];
 }
-async function updateJWESession(event, config, update) {
-	const canWriteCookie = isEvent(event);
-	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot update session on read-only event.");
-	const sessionName = config.name || DEFAULT_NAME$1;
-	const session = event.context.sessions?.[sessionName] || await getJWESession(event, config);
-	const oldSession = {
-		...session,
-		data: sanitizeObjectCopy(session.data)
-	};
-	if (typeof update === "function") update = update(session.data);
-	if (update) Object.assign(session.data, update);
-	const now = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
-	const createdAt = now - now % 1e3;
-	Object.assign(session, {
-		id: config.generateId?.() || crypto.randomUUID(),
-		createdAt,
-		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(config.maxAge) * 1e3
-	});
-	let sealed;
-	try {
-		sealed = await sealJWESession(event, config);
-	} catch (error_) {
-		Object.assign(session, {
-			id: oldSession.id,
-			createdAt: oldSession.createdAt,
-			expiresAt: oldSession.expiresAt,
-			data: oldSession.data
-		});
-		session.token = oldSession.token;
-		await config.hooks?.onError?.({
-			session,
-			event,
-			error: error_,
-			config
-		});
-		throw error_;
-	}
-	session.token = sealed;
-	if (config.cookie !== false && canWriteCookie) setCookie(event, sessionName, sealed, {
-		...DEFAULT_COOKIE$1,
-		...config.cookie,
-		expires: config.maxAge === void 0 ? void 0 : new Date(session.createdAt + computeDurationInSeconds(config.maxAge) * 1e3)
-	});
-	await config.hooks?.onUpdate?.({
-		session,
-		oldSession,
-		event,
-		config
-	});
-	return session;
+function hasHeaders(response) {
+	return typeof response === "object" && response !== null && "headers" in response && Boolean(response.headers);
+}
+const codec$1 = createJWECodec({
+	prefix: PREFIX,
+	defaultName: "h3-jwe"
+});
+async function useJWESession(event, config) {
+	const binding = bind$1(event, config);
+	await loadSession(binding);
+	return sessionManager(binding);
+}
+async function getJWESession(event, config) {
+	return loadSession(bind$1(event, config));
+}
+function getJWESessionToken(event, config) {
+	return sessionToken(bind$1(event, config));
+}
+async function updateJWESession(event, config, update, options) {
+	return issueSession(bind$1(event, config), update, options);
 }
 async function sealJWESession(event, config) {
-	const key = getEncryptKey(config.key);
-	const sessionName = config.name || DEFAULT_NAME$1;
-	const session = event.context.sessions?.[sessionName] || await getJWESession(event, config);
-	const iat = Math.floor(session.createdAt / 1e3);
-	const exp = session.expiresAt ? Math.floor(session.expiresAt / 1e3) : void 0;
-	const payload = {
-		...session.data,
-		jti: session.id,
-		iat
-	};
-	if (exp) payload.exp = exp;
-	let typ = void 0;
-	if (config.jwe?.encryptOptions?.protectedHeader?.typ && typeof config.jwe.encryptOptions.protectedHeader.typ === "string" && config.jwe.encryptOptions.protectedHeader.typ.toLowerCase().includes("jwt")) typ = config.jwe.encryptOptions.protectedHeader.typ;
-	return await encrypt(payload, key, {
-		...config.jwe?.encryptOptions,
-		expiresIn: void 0,
-		protectedHeader: {
-			...config.jwe?.encryptOptions?.protectedHeader,
-			kid: typeof key === "string" ? void 0 : key.kid,
-			typ: typ || "JWT",
-			cty: "application/json"
-		}
-	});
+	return encodeSession(bind$1(event, config));
 }
 async function unsealJWESession(event, config, sealed) {
-	const key = config.hooks?.onUnsealKeyLookup ? (header) => config.hooks.onUnsealKeyLookup({
-		header,
-		event,
-		config
-	}) : getDecryptKey(config.key);
-	const alg = config.jwe?.encryptOptions?.alg;
-	const enc = config.jwe?.encryptOptions?.enc;
-	let typ = void 0;
-	if (config.jwe?.encryptOptions?.protectedHeader?.typ && typeof config.jwe.encryptOptions.protectedHeader.typ === "string" && config.jwe.encryptOptions.protectedHeader.typ.toLowerCase().includes("jwt")) typ = config.jwe.encryptOptions.protectedHeader.typ;
-	const { payload } = await decrypt(sealed, key, {
-		...config.jwe?.decryptOptions,
-		requiredClaims: [...new Set([
-			...config.jwe?.decryptOptions?.requiredClaims || [],
-			"jti",
-			"iat"
-		])],
-		typ: typ || "JWT",
-		maxTokenAge: config.maxAge,
-		algorithms: alg ? [alg] : void 0,
-		encryptionAlgorithms: enc ? [enc] : void 0,
-		unwrappedKeyAlgorithm: void 0,
-		keyUsage: void 0,
-		forceUint8Array: false,
-		validateClaims: true
-	}).catch((error_) => {
-		if (isJWTError(error_, "ERR_JWT_EXPIRED")) throw error_;
-		const message = error_ instanceof Error ? error_.message : String(error_);
-		throw new Error(`Invalid session token: ${message}`);
+	return openSessionToken(codec$1, config, {
+		token: sealed,
+		carrier: { event }
 	});
-	const { jti, iat, exp, ...data } = payload;
-	return {
-		id: jti,
-		createdAt: iat * 1e3,
-		expiresAt: exp ? exp * 1e3 : void 0,
-		data: data && typeof data === "object" ? data : Object.create(null)
-	};
 }
 async function clearJWESession(event, config) {
-	const canWriteCookie = isEvent(event);
-	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot clear session on read-only event.");
-	const sessionName = config.name || DEFAULT_NAME$1;
-	let session = event.context.sessions?.[sessionName];
-	if (session && session[kGetSessionPromise$1]) session = await session[kGetSessionPromise$1];
-	const oldSession = session ? {
-		...session,
-		data: sanitizeObjectCopy(session.data)
-	} : void 0;
-	if (event.context.sessions?.[sessionName]) delete event.context.sessions[sessionName];
-	if (config.cookie !== false && canWriteCookie) setCookie(event, sessionName, "", {
-		...DEFAULT_COOKIE$1,
-		...config.cookie,
-		expires: /* @__PURE__ */ new Date(0),
-		maxAge: void 0
-	});
-	await config.hooks?.onClear?.({
-		oldSession,
-		event,
-		config
-	});
-}
-function getEncryptKey(key) {
-	if (!key) throw new Error("Session: JWE key is required.");
-	let _key;
-	if (typeof key === "string") _key = key;
-	else if (isSymmetricJWK(key)) _key = key;
-	else if ("publicKey" in key && key.publicKey && isPublicJWK(key.publicKey)) _key = key.publicKey;
-	else if ("privateKey" in key && isPrivateJWK(key.privateKey)) _key = key.privateKey;
-	if (!_key) throw new Error("Session: Invalid JWE key. It must be a password string or valid JWK.", { cause: key });
-	return _key;
+	return dropSession(bind$1(event, config));
 }
-function getDecryptKey(key) {
-	if (!key) throw new Error("Session: JWE key is required.");
-	let _key = void 0;
-	if (typeof key === "string") _key = key;
-	else if (isSymmetricJWK(key)) _key = key;
-	else if ("privateKey" in key) _key = key.privateKey;
-	if (!_key) throw new Error("Session: Invalid JWE key. It must be a password string or a valid private JWK.", { cause: key });
-	return _key;
-}
-function findSetCookie$1(setCookie, name) {
-	const regex = new RegExp(`(?:^|,\\s*)${name}=([^;]+)`);
-	const match = setCookie.match(regex);
-	return match ? match[1] : void 0;
+function bind$1(event, config) {
+	return bindSession(event, config, {
+		port: h3SessionPort,
+		codec: codec$1,
+		actions: sessionActions()
+	});
 }
-const kGetSessionPromise = Symbol("h3_jws_getSession");
-const DEFAULT_NAME = "h3-jws";
-const DEFAULT_COOKIE = {
-	path: "/",
-	secure: true,
-	httpOnly: false
-};
+const codec = createJWSCodec({
+	prefix: PREFIX,
+	defaultName: "h3-jws"
+});
 async function useJWSSession(event, config) {
-	const sessionName = config.name || DEFAULT_NAME;
-	await getJWSSession(event, config);
-	const sessionManager = {
-		get id() {
-			return event.context.sessions?.[sessionName]?.id;
-		},
-		get createdAt() {
-			return event.context.sessions?.[sessionName]?.createdAt || Date.now();
-		},
-		get expiresAt() {
-			return event.context.sessions?.[sessionName]?.expiresAt;
-		},
-		get data() {
-			return event.context.sessions?.[sessionName]?.data || {};
-		},
-		get token() {
-			return (event.context.sessions?.[sessionName])?.token ?? getJWSSessionToken(event, config);
-		},
-		update: async (update) => {
-			await updateJWSSession(event, config, update);
-			return sessionManager;
-		},
-		clear: async () => {
-			await clearJWSSession(event, config);
-			return sessionManager;
-		}
-	};
-	return sessionManager;
+	const binding = bind(event, config);
+	await loadSession(binding);
+	return sessionManager(binding);
 }
 async function getJWSSession(event, config) {
-	const sessionName = config.name || DEFAULT_NAME;
-	if (!event.context.sessions) event.context.sessions = Object.create(null);
-	const existingSession = event.context.sessions[sessionName];
-	if (existingSession) {
-		const session = existingSession[kGetSessionPromise] ? await existingSession[kGetSessionPromise] : existingSession;
-		if (session.expiresAt !== void 0 && session.expiresAt < Date.now()) {
-			await config.hooks?.onExpire?.({
-				session: {
-					id: session.id,
-					createdAt: session.createdAt,
-					expiresAt: session.expiresAt,
-					token: session.token
-				},
-				event,
-				error: new JWTError(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(session.expiresAt * 1e3)).toISOString()})`, "ERR_JWT_EXPIRED", {
-					jti: session.id,
-					exp: session.expiresAt / 1e3
-				}),
-				config
-			});
-			delete event.context.sessions[sessionName];
-			if (config.cookie !== false) if (isEvent(event)) setCookie(event, sessionName, "", {
-				...DEFAULT_COOKIE,
-				...config.cookie,
-				expires: /* @__PURE__ */ new Date(0),
-				maxAge: void 0
-			});
-			else console.warn("[unjwt/h3] Session expired but cookie cannot be cleared on a read-only event.");
-			const freshNow = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
-			const freshCreatedAt = freshNow - freshNow % 1e3;
-			const freshSession = {
-				id: void 0,
-				createdAt: freshCreatedAt,
-				expiresAt: config.maxAge === void 0 ? void 0 : freshCreatedAt + computeDurationInSeconds(config.maxAge) * 1e3,
-				data: Object.create(null),
-				token: void 0
-			};
-			event.context.sessions[sessionName] = freshSession;
-			return freshSession;
-		}
-		if (session.id !== void 0 && session.token !== void 0) await config.hooks?.onRead?.({
-			session,
-			event,
-			config
-		});
-		return session;
-	}
-	const now = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
-	const createdAt = now - now % 1e3;
-	const session = {
-		id: void 0,
-		createdAt,
-		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(config.maxAge) * 1e3,
-		data: Object.create(null),
-		token: void 0
-	};
-	event.context.sessions[sessionName] = session;
-	const token = getJWSSessionToken(event, config);
-	let exclusiveHookFired = false;
-	if (token) {
-		session.token = token;
-		const promise = verifyJWSSession(event, config, token).catch(async (error_) => {
-			exclusiveHookFired = true;
-			if (isJWTError(error_, "ERR_JWT_EXPIRED")) await config.hooks?.onExpire?.({
-				session: {
-					id: error_.cause.jti,
-					createdAt: error_.cause.iat ? error_.cause.iat * 1e3 : void 0,
-					expiresAt: error_.cause.exp ? error_.cause.exp * 1e3 : void 0,
-					token
-				},
-				error: error_,
-				event,
-				config
-			});
-			else await config.hooks?.onError?.({
-				session,
-				error: error_,
-				event,
-				config
-			});
-		}).then((unsealed) => {
-			if (unsealed) Object.assign(session, unsealed);
-			delete event.context.sessions[sessionName][kGetSessionPromise];
-			return session;
-		});
-		session[kGetSessionPromise] = promise;
-		await promise;
-	}
-	if (!exclusiveHookFired && session.id !== void 0 && session.token !== void 0) await config.hooks?.onRead?.({
-		session,
-		event,
-		config
-	});
-	return session;
+	return loadSession(bind(event, config));
 }
 function getJWSSessionToken(event, config) {
-	const sessionName = config.name || DEFAULT_NAME;
-	let token;
-	if (config.sessionHeader !== false) {
-		const headerValue = _getReqHeader(event, typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`);
-		if (typeof headerValue === "string") token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
-	}
-	if (config.cookie !== false) {
-		const setCookie = _getResHeader(event, "set-cookie");
-		if (typeof setCookie === "string") token = findSetCookie(setCookie, sessionName);
-		else if (Array.isArray(setCookie)) for (const sc of setCookie) {
-			token = findSetCookie(sc, sessionName);
-			if (token) break;
-		}
-	}
-	if (!token) {
-		const cookieHeader = _getReqHeader(event, "cookie");
-		if (cookieHeader) token = parse(String(cookieHeader))[sessionName];
-	}
-	return token;
-}
-function _getReqHeader(event, name) {
-	if (event.node) return event.node.req.headers[name];
-	if (event.request) return event.request.headers.get(name);
-	if (event.headers) return event.headers.get(name);
+	return sessionToken(bind(event, config));
 }
-function _getResHeader(event, name) {
-	if (event.node) return event.node?.res.getHeader(name);
-	if (event.response) return event.response.headers?.get(name);
-}
-async function updateJWSSession(event, config, update) {
-	const canWriteCookie = isEvent(event);
-	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot update session on read-only event.");
-	const sessionName = config.name || DEFAULT_NAME;
-	const session = event.context.sessions?.[sessionName] || await getJWSSession(event, config);
-	const oldSession = {
-		...session,
-		data: sanitizeObjectCopy(session.data)
-	};
-	if (typeof update === "function") update = update(session.data);
-	if (update) Object.assign(session.data, update);
-	const now = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
-	const createdAt = now - now % 1e3;
-	Object.assign(session, {
-		id: config.generateId?.() || crypto.randomUUID(),
-		createdAt,
-		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(config.maxAge) * 1e3
-	});
-	let token;
-	try {
-		token = await signJWSSession(event, config);
-	} catch (error_) {
-		Object.assign(session, {
-			id: oldSession.id,
-			createdAt: oldSession.createdAt,
-			expiresAt: oldSession.expiresAt,
-			data: oldSession.data
-		});
-		session.token = oldSession.token;
-		await config.hooks?.onError?.({
-			session,
-			event,
-			error: error_,
-			config
-		});
-		throw error_;
-	}
-	session.token = token;
-	if (config.cookie !== false && canWriteCookie) setCookie(event, sessionName, token, {
-		...DEFAULT_COOKIE,
-		...config.cookie,
-		expires: config.maxAge === void 0 ? void 0 : new Date(session.createdAt + computeDurationInSeconds(config.maxAge) * 1e3)
-	});
-	await config.hooks?.onUpdate?.({
-		session,
-		oldSession,
-		event,
-		config
-	});
-	return session;
+async function updateJWSSession(event, config, update, options) {
+	return issueSession(bind(event, config), update, options);
 }
 async function signJWSSession(event, config) {
-	const key = getSignKey(config.key);
-	const sessionName = config.name || DEFAULT_NAME;
-	const session = event.context.sessions?.[sessionName] || await getJWSSession(event, config);
-	const iat = Math.floor(session.createdAt / 1e3);
-	const exp = session.expiresAt ? Math.floor(session.expiresAt / 1e3) : void 0;
-	const payload = {
-		...session.data,
-		jti: session.id,
-		iat
-	};
-	if (exp) payload.exp = exp;
-	let typ = void 0;
-	if (config.jws?.signOptions?.protectedHeader?.typ && typeof config.jws.signOptions.protectedHeader.typ === "string" && config.jws.signOptions.protectedHeader.typ.toLowerCase().includes("jwt")) typ = config.jws.signOptions.protectedHeader.typ;
-	return await sign(payload, key, {
-		...config.jws?.signOptions,
-		expiresIn: void 0,
-		protectedHeader: {
-			...config.jws?.signOptions?.protectedHeader,
-			kid: key.kid,
-			typ: typ || "JWT",
-			cty: "application/json"
-		}
-	});
+	return encodeSession(bind(event, config));
 }
 async function verifyJWSSession(event, config, token) {
-	const alg = config.jws?.signOptions?.alg;
-	const jwk = config.hooks?.onVerifyKeyLookup ? (header) => config.hooks.onVerifyKeyLookup({
-		header,
-		event,
-		config
-	}) : getVerifyKey(config.key);
-	let typ = void 0;
-	if (config.jws?.signOptions?.protectedHeader?.typ && typeof config.jws.signOptions.protectedHeader.typ === "string" && config.jws.signOptions.protectedHeader.typ.toLowerCase().includes("jwt")) typ = config.jws.signOptions.protectedHeader.typ;
-	const { payload } = await verify(token, jwk, {
-		...config.jws?.verifyOptions,
-		requiredClaims: [...new Set([
-			...config.jws?.verifyOptions?.requiredClaims || [],
-			"jti",
-			"iat"
-		])],
-		typ: typ || "JWT",
-		algorithms: alg ? [alg] : void 0,
-		forceUint8Array: false,
-		validateClaims: true
-	}).catch((error_) => {
-		if (isJWTError(error_, "ERR_JWT_EXPIRED")) throw error_;
-		const message = error_ instanceof Error ? error_.message : String(error_);
-		throw new Error(`Invalid session token: ${message}`);
+	return openSessionToken(codec, config, {
+		token,
+		carrier: { event }
 	});
-	const { jti, iat, exp, ...data } = payload;
-	return {
-		id: jti,
-		createdAt: iat * 1e3,
-		expiresAt: exp ? exp * 1e3 : void 0,
-		data: data && typeof data === "object" ? data : Object.create(null)
-	};
 }
 async function clearJWSSession(event, config) {
-	const canWriteCookie = isEvent(event);
-	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot clear session on read-only event.");
-	const sessionName = config.name || DEFAULT_NAME;
-	let session = event.context.sessions?.[sessionName];
-	if (session && session[kGetSessionPromise]) session = await session[kGetSessionPromise];
-	const oldSession = session ? {
-		...session,
-		data: sanitizeObjectCopy(session.data)
-	} : void 0;
-	if (event.context.sessions?.[sessionName]) delete event.context.sessions[sessionName];
-	if (config.cookie !== false && canWriteCookie) setCookie(event, sessionName, "", {
-		...DEFAULT_COOKIE,
-		...config.cookie,
-		expires: /* @__PURE__ */ new Date(0),
-		maxAge: void 0
-	});
-	await config.hooks?.onClear?.({
-		oldSession,
-		event,
-		config
-	});
-}
-function getSignKey(key) {
-	if (!key) throw new Error("Session: JWS key is required.");
-	let _key = void 0;
-	if (isSymmetricJWK(key)) _key = key;
-	else if ("privateKey" in key && isPrivateJWK(key.privateKey)) _key = key.privateKey;
-	if (!_key) throw new Error("Session: Invalid JWS key. It must be a symmetric JWK or a private JWK.", { cause: key });
-	return _key;
+	return dropSession(bind(event, config));
 }
-function getVerifyKey(key) {
-	if (!key) throw new Error("Session: JWS key is required.");
-	let _key = void 0;
-	if (isSymmetricJWK(key)) _key = key;
-	else if ("publicKey" in key && isPublicJWK(key.publicKey)) _key = key.publicKey;
-	else if ("publicKey" in key && Array.isArray(key.publicKey)) {
-		const keys = key.publicKey.filter((k) => isPublicJWK(k));
-		if (keys && keys.length > 0) _key = { keys };
-	}
-	if (!_key) throw new Error("Session: Invalid JWS key. It must be a symmetric JWK or a public JWK/set.", { cause: key });
-	return _key;
-}
-function findSetCookie(setCookie, name) {
-	const regex = new RegExp(`(?:^|,\\s*)${name}=([^;]+)`);
-	const match = setCookie.match(regex);
-	return match ? match[1] : void 0;
+function bind(event, config) {
+	return bindSession(event, config, {
+		port: h3SessionPort,
+		codec,
+		actions: sessionActions()
+	});
 }
-export { clearJWESession, clearJWSSession, deriveJWKFromPassword, exportPEM, exportToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, getJWSSessionToken, importFromPEM, importPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+export { clearJWESession, clearJWSSession, deriveJWKFromPassword, exportPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, getJWSSessionToken, importPEM, sealJWESession, signJWSSession, thumbprint, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };