unjwt 0.7.2 → 0.8.0

package/dist/_chunks/_codec-jws.mjs

@@ -0,0 +1,878 @@
+import { sanitizeObjectCopy } from "./libs/unsecure.mjs";
+import { JWTError, computeDurationInSeconds, expiredClaimMessage, isCryptoKey, isJWK, isJWKSet, isJWTError, isPlainObject, isPrivateJWK, isPublicJWK, isSymmetricJWK } from "./_jwt-internal.mjs";
+import { importKey, quoteTokenValue } from "./jwk.mjs";
+import { sign, verify } from "./jws.mjs";
+import { decrypt, encrypt } from "./jwe.mjs";
+const RESERVED_CLAIMS = [
+	"jti",
+	"iat",
+	"exp",
+	"nbf"
+];
+const SESSION_TYP = "session+jwt";
+const FORBIDDEN_KEYS = [
+	"__proto__",
+	"constructor",
+	"prototype"
+];
+const importedKeys = /* @__PURE__ */ new WeakMap();
+function invalidKeyError(message, cause) {
+	return new JWTError(message, "ERR_SESSION_KEY_INVALID", cause);
+}
+function invalidConfigError(message, cause) {
+	return new JWTError(message, "ERR_SESSION_CONFIG_INVALID", cause);
+}
+function invalidTokenError(message, cause) {
+	return new JWTError(message, "ERR_SESSION_TOKEN_INVALID", cause);
+}
+function readOnlyEventError(message) {
+	return new JWTError(message, "ERR_SESSION_READONLY_EVENT");
+}
+function expiredSessionError(options) {
+	const { id, expiresAt } = options;
+	const exp = Math.floor(expiresAt / 1e3);
+	return new JWTError(expiredClaimMessage(exp), "ERR_JWT_EXPIRED", {
+		jti: id,
+		exp
+	});
+}
+function rethrowAsInvalidToken(error, options) {
+	if (isJWTError(error, "ERR_JWT_EXPIRED")) throw error;
+	throw invalidTokenError(`${options.prefix} Invalid session token: ${messageOf(error)}`, error);
+}
+const TOKEN = /^[!#$%&'*+\-.^_`|~\w]+$/;
+const CHUNK_SUFFIX = /\.\d+$/;
+function assertSessionName(name, options) {
+	if (typeof name !== "string" || !TOKEN.test(name)) throw invalidConfigError(`${options.prefix} Session "name" must be a cookie name (RFC 6265 §4.1.1): letters, digits and !#$%&'*+-.^_\`|~ only. Got ${quoteTokenValue(name)}.`);
+	if (CHUNK_SUFFIX.test(name)) throw invalidConfigError(`${options.prefix} Session "name" cannot end in a dot and digits: ${quoteTokenValue(name)} is the cookie holding a chunk of the session named ${quoteTokenValue(name.replace(CHUNK_SUFFIX, ""))}.`);
+}
+function assertCookiePrefix(name, attrs, options) {
+	const lower = name.toLowerCase();
+	const host = lower.startsWith("__host-");
+	if (!host && !lower.startsWith("__secure-")) return;
+	const rule = host ? "\"__Host-\" cookie must be Secure, with Path=/ and no Domain" : "\"__Secure-\" cookie must be Secure";
+	if (attrs.secure === false || host && (attrs.domain !== void 0 || attrs.path !== void 0 && attrs.path !== "/")) throw invalidConfigError(`${options.prefix} Session ${quoteTokenValue(name)}: a ${rule} (RFC 6265bis §4.1.3).`);
+}
+function assertSessionHeader(header, options) {
+	if (header === void 0 || header === false) return;
+	if (typeof header === "string" && TOKEN.test(header)) return;
+	throw invalidConfigError(`${options.prefix} Session "sessionHeader" must be false or a header name: letters, digits and !#$%&'*+-.^_\`|~ only. Got ${quoteTokenValue(header)}.`);
+}
+function assertRolling(config, options) {
+	const { rolling } = config;
+	if (rolling === void 0) return;
+	if (config.maxAge === void 0) throw invalidConfigError(`${options.prefix} "rolling" needs a "maxAge" to extend.`);
+	if (rolling === true) return;
+	if (!isExpiresIn(rolling)) throw new JWTError(`${options.prefix} "rolling" must be true or a duration.`, "ERR_INVALID_OPTION");
+	computeDurationInSeconds(rolling);
+}
+function hasTokenSource(source) {
+	return source.cookie !== false || source.sessionHeader !== false;
+}
+function assertTokenSource(source, options) {
+	if (!hasTokenSource(source)) throw invalidConfigError(`${options.prefix} Session has no token source: "cookie" and "sessionHeader" are both disabled.`);
+}
+function assertKeyMaterial(key, options) {
+	if (typeof key === "string") throw invalidKeyError(`${options.prefix} Session "key" must be a JWK or a CryptoKey, not a password string. Derive one once with deriveJWKFromPassword() and pass the result.`);
+	if (!key) throw invalidKeyError(`${options.prefix} Session "key" is required.`);
+}
+async function assertImportableKey(key, options) {
+	if (!isJWK(key)) return;
+	const alg = key.alg ?? options.alg;
+	if (key.kty !== "oct" && !alg) return;
+	let imports = importedKeys.get(key);
+	if (!imports) {
+		imports = /* @__PURE__ */ new Map();
+		importedKeys.set(key, imports);
+	}
+	const slot = alg ?? "";
+	let pending = imports.get(slot);
+	if (!pending) {
+		pending = importKey(key, { alg }).then(() => void 0);
+		imports.set(slot, pending);
+	}
+	try {
+		await pending;
+	} catch (error) {
+		if (imports.get(slot) === pending) imports.delete(slot);
+		throw invalidKeyError(`${options.prefix} Invalid session key: ${messageOf(error)}`, error);
+	}
+}
+function sessionTyp(configured) {
+	return typeof configured === "string" && configured ? configured : SESSION_TYP;
+}
+function sessionHeaderName(sessionName, configured) {
+	if (typeof configured === "string") return configured.toLowerCase();
+	return `x-${sessionName.replace(/^__(?:host|secure)-/i, "").toLowerCase()}-session`;
+}
+function headerToken(value) {
+	if (typeof value !== "string") return void 0;
+	const words = value.trim().split(/\s+/);
+	const [first = "", second] = words;
+	if (/^bearer$/i.test(first)) return words.length === 2 ? second : void 0;
+	return words.length === 1 && first ? first : void 0;
+}
+function resolveSessionToken(source, sessionName, read) {
+	let cookieValue;
+	if (source.cookie !== false) {
+		const written = read.written?.(sessionName);
+		if (written === "") return void 0;
+		cookieValue = written ?? read.cookie(sessionName);
+	}
+	const headerValue = source.sessionHeader === false ? void 0 : headerToken(read.header(sessionHeaderName(sessionName, source.sessionHeader)));
+	return cookieValue || headerValue || void 0;
+}
+function resolveExpiresAt(createdAt, options) {
+	return options.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(options.maxAge) * 1e3;
+}
+function sessionRequiredClaims(configured, options) {
+	const required = /* @__PURE__ */ new Set([
+		...configured || [],
+		"jti",
+		"iat"
+	]);
+	if (options.maxAge !== void 0) required.add("exp");
+	return [...required];
+}
+function sanitizeSessionUpdate(update, options) {
+	if (!isPlainObject(update)) throw new JWTError(`${options.prefix} Session data must be a plain object, got ${Array.isArray(update) ? "an array" : typeof update}.`, "ERR_INVALID_OPTION");
+	const sanitized = Object.create(null);
+	for (const key of Object.keys(update)) {
+		if (FORBIDDEN_KEYS.includes(key)) throw new JWTError(`${options.prefix} Session data cannot carry the key "${key}".`, "ERR_INVALID_OPTION");
+		if (RESERVED_CLAIMS.includes(key)) continue;
+		sanitized[key] = update[key];
+	}
+	return sanitized;
+}
+function messageOf(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+function isExpiresIn(value) {
+	return typeof value === "number" || typeof value === "string";
+}
+function createSessionCodec(spec) {
+	const { prefix } = spec;
+	const alg = (config) => spec.issueOptions(config)?.alg;
+	const keyFor = (config, carrier) => spec.lookup(config, carrier) ?? spec.openKey(config);
+	const now = (config) => spec.issueOptions(config)?.currentDate?.getTime() ?? Date.now();
+	const openWith = async (config, token, key) => {
+		const payload = await spec.open(config, token, key).catch((error) => rethrowAsInvalidToken(error, { prefix }));
+		assertNotFromTheFuture(payload, {
+			now: now(config),
+			clockTolerance: spec.openOptions(config)?.clockTolerance,
+			prefix
+		});
+		return openedSession(payload);
+	};
+	const assertOpenKey = async (config) => {
+		if (spec.lookup(config, {})) return;
+		const key = spec.openKey(config);
+		for (const candidate of spec.importable ? spec.importable(key) : [key]) await assertImportableKey(candidate, {
+			alg: alg(config),
+			prefix
+		});
+	};
+	return {
+		family: spec.family,
+		defaultName: spec.defaultName,
+		defaultCookie: spec.defaultCookie,
+		now,
+		issuer: (config) => {
+			const key = spec.issueKey(config);
+			return (state) => spec.issue(config, sessionPayload(state), key);
+		},
+		assertKeys: async (config) => {
+			const key = spec.issueKey(config);
+			await assertImportableKey(key, {
+				alg: alg(config),
+				prefix
+			});
+			if (!isSymmetricJWK(key)) await assertOpenKey(config);
+		},
+		opener: (config, carrier) => {
+			const key = keyFor(config, carrier);
+			return (token) => openWith(config, token, key);
+		},
+		open: async (config, token, carrier) => {
+			await assertOpenKey(config);
+			return openWith(config, token, keyFor(config, carrier));
+		}
+	};
+}
+function sessionIssueOptions(options) {
+	return Object.assign({}, options, {
+		expiresIn: void 0,
+		expiresAt: void 0,
+		notBeforeIn: void 0,
+		notBeforeAt: void 0,
+		protectedHeader: {
+			...options?.protectedHeader,
+			typ: sessionTyp(options?.protectedHeader?.typ)
+		}
+	});
+}
+function sessionOpenOptions(options) {
+	const { maxAge, requiredClaims, typ, alg } = options;
+	return {
+		requiredClaims: sessionRequiredClaims(requiredClaims, { maxAge }),
+		typ: sessionTyp(typ),
+		maxTokenAge: void 0,
+		algorithms: alg ? [alg] : void 0,
+		payload: "json",
+		validateClaims: true
+	};
+}
+function isKeyPair(key) {
+	return "privateKey" in key || "publicKey" in key;
+}
+function assertKeyPair(pair, options) {
+	const { prefix, family } = options;
+	if (!isCryptoKey(pair.privateKey) && !isPrivateJWK(pair.privateKey)) throw invalidKeyError(`${prefix} Invalid ${family} key: "privateKey" must be a private JWK or a CryptoKey.`, pair);
+	if (!options.isPublic(pair.publicKey)) throw invalidKeyError(`${prefix} Invalid ${family} key: "publicKey" must be ${options.publicHalf}.`, pair);
+}
+function assertPinnedCryptoKey(key, options) {
+	if (isCryptoKey(key) && !options.pinned) throw invalidConfigError(`${options.prefix} A CryptoKey session key carries no algorithm: set ${options.hint}.`);
+}
+function sessionPayload(state) {
+	const iat = Math.floor(state.createdAt / 1e3);
+	const exp = state.expiresAt ? Math.floor(state.expiresAt / 1e3) : void 0;
+	const payload = {};
+	for (const key of Object.keys(state.data)) if (!RESERVED_CLAIMS.includes(key)) payload[key] = state.data[key];
+	payload.jti = state.id;
+	payload.iat = iat;
+	if (exp) payload.exp = exp;
+	return payload;
+}
+function assertNotFromTheFuture(payload, options) {
+	const tolerance = options.clockTolerance === void 0 ? 0 : computeDurationInSeconds(options.clockTolerance);
+	if (payload.iat > Math.floor(options.now / 1e3) + tolerance) throw invalidTokenError(`${options.prefix} Invalid session token: issued in the future (iat: ${(/* @__PURE__ */ new Date(payload.iat * 1e3)).toISOString()}).`);
+}
+function openedSession(payload) {
+	const data = Object.create(null);
+	for (const key of Object.keys(payload)) {
+		if (RESERVED_CLAIMS.includes(key)) continue;
+		data[key] = payload[key];
+	}
+	return {
+		id: payload.jti,
+		createdAt: payload.iat * 1e3,
+		expiresAt: payload.exp ? payload.exp * 1e3 : void 0,
+		data
+	};
+}
+const JWE_DEFAULT_COOKIE = {
+	path: "/",
+	secure: true,
+	httpOnly: true,
+	sameSite: "lax"
+};
+function createJWECodec(options) {
+	const { prefix, defaultName } = options;
+	return createSessionCodec({
+		family: "jwe",
+		prefix,
+		defaultName,
+		defaultCookie: JWE_DEFAULT_COOKIE,
+		issueOptions: (config) => config.jwe?.encryptOptions,
+		openOptions: (config) => config.jwe?.decryptOptions,
+		issueKey: (config) => getEncryptKey(config, prefix),
+		openKey: (config) => getDecryptKey(config, prefix),
+		lookup: (config, carrier) => {
+			const hooks = config.hooks;
+			if (!hooks?.onUnsealKeyLookup) return void 0;
+			return (header) => hooks.onUnsealKeyLookup?.({
+				header,
+				...carrier,
+				config
+			});
+		},
+		issue: (config, payload, key) => encrypt(payload, key, sessionIssueOptions(config.jwe?.encryptOptions)),
+		open: async (config, sealed, key) => {
+			const { decryptOptions, encryptOptions } = config.jwe ?? {};
+			const enc = encryptOptions?.enc;
+			const { payload } = await decrypt(sealed, key, {
+				...decryptOptions,
+				maxIterations: sessionMaxIterations(config),
+				...sessionOpenOptions({
+					maxAge: config.maxAge,
+					requiredClaims: decryptOptions?.requiredClaims,
+					typ: encryptOptions?.protectedHeader?.typ,
+					alg: encryptOptions?.alg
+				}),
+				encryptionAlgorithms: enc ? [enc] : void 0
+			});
+			return payload;
+		}
+	});
+}
+function sessionMaxIterations(config) {
+	const configured = config.jwe?.decryptOptions?.maxIterations;
+	if (configured !== void 0) return configured;
+	const alg = config.jwe?.encryptOptions?.alg ?? (isJWK(config.key) ? config.key.alg : void 0);
+	return typeof alg === "string" && alg.startsWith("PBES2") ? config.jwe?.encryptOptions?.p2c ?? 6e5 : void 0;
+}
+function getEncryptKey(config, prefix) {
+	const key = config.key;
+	assertKeyMaterial(key, { prefix });
+	let resolved;
+	if (isCryptoKey(key) || isSymmetricJWK(key)) resolved = key;
+	else if (isKeyPair(key)) {
+		assertJWEKeyPair(key, prefix);
+		resolved = key.publicKey ?? key.privateKey;
+	}
+	if (!resolved) throw invalidKeyError(`${prefix} Invalid JWE key. It must be a JWK or a CryptoKey.`, key);
+	assertPinnedAlgEnc(resolved, config, prefix);
+	return resolved;
+}
+function getDecryptKey(config, prefix) {
+	const key = config.key;
+	assertKeyMaterial(key, { prefix });
+	let resolved;
+	if (isCryptoKey(key) || isSymmetricJWK(key)) resolved = key;
+	else if (isKeyPair(key)) {
+		assertJWEKeyPair(key, prefix);
+		resolved = key.privateKey;
+	}
+	if (!resolved) throw invalidKeyError(`${prefix} Invalid JWE key. It must be a JWK, a private JWK, or a CryptoKey.`, key);
+	assertPinnedAlgEnc(resolved, config, prefix);
+	return resolved;
+}
+function assertJWEKeyPair(key, prefix) {
+	assertKeyPair(key, {
+		prefix,
+		family: "JWE",
+		isPublic: (half) => half === void 0 || isCryptoKey(half) || isPublicJWK(half),
+		publicHalf: "a public JWK or a CryptoKey"
+	});
+}
+function assertPinnedAlgEnc(key, config, prefix) {
+	const { alg, enc } = config.jwe?.encryptOptions ?? {};
+	assertPinnedCryptoKey(key, {
+		pinned: Boolean(alg && enc),
+		prefix,
+		hint: "\"jwe.encryptOptions.alg\" and \"enc\""
+	});
+}
+const kSessionPending = Symbol("unjwt_session_pending");
+function bindSession(carrier, config, options) {
+	const { port, codec, actions } = options;
+	const name = config.name || codec.defaultName;
+	assertSessionName(name, { prefix: port.prefix });
+	assertSessionHeader(config.sessionHeader, { prefix: port.prefix });
+	if (config.cookie !== false) assertCookiePrefix(name, {
+		...codec.defaultCookie,
+		...config.cookie
+	}, { prefix: port.prefix });
+	assertRolling(config, { prefix: port.prefix });
+	claimSessionName(port.scope(carrier), name, codec.family, port.prefix);
+	return {
+		carrier,
+		config,
+		port,
+		codec,
+		actions,
+		name,
+		args: port.carrier(carrier),
+		store: port.store(carrier, `${codec.family}:${name}`)
+	};
+}
+function sessionToken(binding) {
+	assertTokenSource(binding.config, { prefix: binding.port.prefix });
+	return binding.port.readToken(binding.carrier, binding.name, binding.config);
+}
+function recordSlotStore(record, slot) {
+	return {
+		get: () => record()[slot],
+		set: (state) => {
+			record()[slot] = state;
+		}
+	};
+}
+function sessionInstant(binding) {
+	const now = binding.codec.now(binding.config);
+	return now - now % 1e3;
+}
+function mintSessionId(config) {
+	return config.generateId?.() || crypto.randomUUID();
+}
+function emptySession(binding) {
+	const createdAt = sessionInstant(binding);
+	return typedSession({
+		id: void 0,
+		createdAt,
+		expiresAt: resolveExpiresAt(createdAt, { maxAge: binding.config.maxAge }),
+		data: Object.create(null),
+		token: void 0
+	});
+}
+function storedSession(store) {
+	const state = store.get();
+	return state === void 0 ? void 0 : typedSession(state);
+}
+function blankSession() {
+	return typedSession({
+		expiresAt: void 0,
+		data: {}
+	});
+}
+function openSessionToken(codec, config, options) {
+	return codec.open(config, options.token, options.carrier).then(typedSession);
+}
+function sessionCookie(binding, options = {}) {
+	const { chunkMaxLength, ...configured } = binding.config.cookie || {};
+	const attrs = {
+		...binding.codec.defaultCookie,
+		...configured
+	};
+	if (options.expiresAt !== void 0) {
+		attrs.expires = new Date(options.expiresAt);
+		attrs.maxAge = void 0;
+	}
+	return {
+		attrs,
+		chunkMaxLength
+	};
+}
+function dropSessionCookie(binding) {
+	const { config, port, carrier } = binding;
+	if (config.cookie === false) return;
+	if (!port.writable(carrier)) {
+		console.warn(`${port.prefix} Session expired but cookie cannot be cleared on a read-only event.`);
+		return;
+	}
+	port.deleteCookie(carrier, binding.name, sessionCookie(binding));
+}
+const SESSION_NAMES = /* @__PURE__ */ new WeakMap();
+function claimSessionName(scope, name, family, prefix) {
+	let registry = SESSION_NAMES.get(scope);
+	if (!registry) {
+		registry = /* @__PURE__ */ new Map();
+		SESSION_NAMES.set(scope, registry);
+	}
+	const holder = registry.get(name);
+	if (holder === void 0) {
+		registry.set(name, family);
+		return;
+	}
+	if (holder === family) return;
+	throw invalidConfigError(`${prefix} Session name "${name}" is already used by a ${holder.toUpperCase()} session on this request; a name is one cookie, so give this session a "name" of its own.`);
+}
+function typedSession(state) {
+	return state;
+}
+async function loadSession(binding) {
+	const { config, codec, store, args } = binding;
+	await codec.assertKeys(config);
+	const open = codec.opener(config, args);
+	const existing = storedSession(store);
+	if (existing) {
+		const session = existing[kSessionPending] ? await existing[kSessionPending] : existing;
+		if (session.token !== void 0 && session.expiresAt !== void 0 && session.expiresAt < codec.now(config)) {
+			dropSessionCookie(binding);
+			const freshSession = emptySession(binding);
+			store.set(freshSession);
+			await fireExpire(binding, {
+				session: {
+					id: session.id,
+					createdAt: session.createdAt,
+					expiresAt: session.expiresAt,
+					token: session.token
+				},
+				error: expiredSessionError({
+					id: session.id,
+					expiresAt: session.expiresAt
+				})
+			});
+			return freshSession;
+		}
+		return session;
+	}
+	const session = emptySession(binding);
+	store.set(session);
+	const token = sessionToken(binding);
+	if (!token) return session;
+	session.token = token;
+	const pending = open(token).then((opened) => {
+		Object.assign(session, opened);
+		return { failure: void 0 };
+	}, (error) => {
+		session.token = void 0;
+		return { failure: { error } };
+	}).then((outcome) => {
+		delete session[kSessionPending];
+		return outcome;
+	});
+	session[kSessionPending] = pending.then(() => session);
+	const { failure } = await pending;
+	if (failure) {
+		if (isJWTError(failure.error, "ERR_JWT_EXPIRED")) {
+			const { jti, iat, exp } = failure.error.cause;
+			dropSessionCookie(binding);
+			await fireExpire(binding, {
+				session: {
+					id: jti,
+					createdAt: iat ? iat * 1e3 : void 0,
+					expiresAt: exp ? exp * 1e3 : void 0,
+					token
+				},
+				error: failure.error
+			});
+		} else await config.hooks?.onError?.({
+			session: binding.actions.manager(binding),
+			...args,
+			error: failure.error,
+			config
+		});
+		return session;
+	}
+	await fireRead(binding, session);
+	await rollSession(binding, session);
+	return session;
+}
+async function fireRead(binding, session) {
+	if (session.id === void 0 || session.token === void 0) return;
+	await binding.config.hooks?.onRead?.({
+		session: binding.actions.manager(binding),
+		...binding.args,
+		config: binding.config
+	});
+}
+async function rollSession(binding, session) {
+	const { config, codec, port, carrier, store } = binding;
+	const { rolling } = config;
+	if (rolling === void 0 || store.get() !== session) return;
+	if (session.token === void 0 || session.expiresAt === void 0) return;
+	if (rolling !== true) {
+		if (session.expiresAt - codec.now(config) >= computeDurationInSeconds(rolling) * 1e3) return;
+	}
+	if (config.cookie !== false && !port.writable(carrier)) {
+		console.warn(`${port.prefix} Session not rolled: cookie cannot be written on a read-only event.`);
+		return;
+	}
+	await binding.actions.roll(binding);
+}
+async function fireExpire(binding, expired) {
+	await binding.config.hooks?.onExpire?.({
+		session: expired.session,
+		...binding.args,
+		error: expired.error,
+		config: binding.config
+	});
+}
+async function encodeSession(binding) {
+	const { config, codec, store } = binding;
+	await codec.assertKeys(config);
+	const issue = codec.issuer(config);
+	const session = storedSession(store) || (hasTokenSource(config) ? await loadSession(binding) : emptySession(binding));
+	return issue(session.id === void 0 ? {
+		...session,
+		id: mintSessionId(config)
+	} : session);
+}
+async function issueSession(binding, update, options, trigger = "update") {
+	const { config, port, store, args } = binding;
+	assertWritable(binding, "update");
+	const session = storedSession(store) || await loadSession(binding);
+	const oldSession = snapshotSession(session);
+	const resolved = typeof update === "function" ? update(session.data) : update;
+	if (resolved) Object.assign(session.data, sanitizeSessionUpdate(resolved, { prefix: port.prefix }));
+	for (const claim of RESERVED_CLAIMS) delete session.data[claim];
+	const maxAge = options?.maxAge ?? config.maxAge;
+	const createdAt = sessionInstant(binding);
+	const id = mintSessionId(config);
+	Object.assign(session, {
+		id,
+		createdAt,
+		expiresAt: resolveExpiresAt(createdAt, { maxAge })
+	});
+	let issued;
+	try {
+		const token = await encodeSession(binding);
+		if (config.cookie !== false) port.setCookie(binding.carrier, binding.name, token, sessionCookie(binding, { expiresAt: session.expiresAt }));
+		issued = Object.assign(session, {
+			id,
+			token
+		});
+	} catch (error_) {
+		Object.assign(session, {
+			id: oldSession.id,
+			createdAt: oldSession.createdAt,
+			expiresAt: oldSession.expiresAt,
+			data: oldSession.data
+		});
+		session.token = oldSession.token;
+		await config.hooks?.onError?.({
+			session: binding.actions.manager(binding),
+			...args,
+			error: error_,
+			config
+		});
+		throw error_;
+	}
+	await config.hooks?.onUpdate?.({
+		session: binding.actions.manager(binding),
+		oldSession,
+		trigger,
+		...args,
+		config
+	});
+	return issued;
+}
+async function dropSession(binding) {
+	const { config, port, store, args } = binding;
+	assertTokenSource(config, { prefix: port.prefix });
+	assertWritable(binding, "clear");
+	let session = storedSession(store);
+	if (session && session[kSessionPending]) session = await session[kSessionPending];
+	const oldSession = session && (session.id !== void 0 || session.token !== void 0) ? snapshotSession(session) : void 0;
+	store.set(emptySession(binding));
+	if (config.cookie !== false) port.deleteCookie(binding.carrier, binding.name, sessionCookie(binding));
+	await config.hooks?.onClear?.({
+		oldSession,
+		...args,
+		config
+	});
+}
+function sessionManager(binding) {
+	const { store } = binding;
+	const state = () => storedSession(store);
+	const manager = {
+		get id() {
+			return state()?.id;
+		},
+		get createdAt() {
+			return state()?.createdAt ?? Date.now();
+		},
+		get expiresAt() {
+			return (state() ?? blankSession()).expiresAt;
+		},
+		get data() {
+			return (state() ?? blankSession()).data;
+		},
+		get token() {
+			const session = state();
+			return session ? session.token : sessionToken(binding);
+		},
+		update: async (update, options) => {
+			await issueSession(binding, update, options);
+			return manager;
+		},
+		clear: async () => {
+			await dropSession(binding);
+			return manager;
+		}
+	};
+	return manager;
+}
+function sessionActions() {
+	return {
+		manager: (binding) => sessionManager(binding),
+		roll: async (binding) => {
+			await issueSession(binding, void 0, void 0, "rolling");
+		}
+	};
+}
+function assertWritable(binding, operation) {
+	const { config, port, carrier } = binding;
+	if (config.cookie !== false && !port.writable(carrier)) throw readOnlyEventError(`${port.prefix} Cannot ${operation} session on read-only event.`);
+}
+function snapshotSession(session) {
+	return {
+		...session,
+		data: sanitizeObjectCopy(session.data)
+	};
+}
+const CHUNK_MARKER = "__chunked__";
+const DEFAULT_CHUNK_MAX_LENGTH = 4e3;
+function responseCookieStore(cookies) {
+	return {
+		read: (name) => setCookieValues(cookies.response())[name] ?? cookies.request(name),
+		write: cookies.write
+	};
+}
+function readChunked(store, name) {
+	const main = store.read(name);
+	if (main === void 0) return void 0;
+	if (!main.startsWith("__chunked__")) return main;
+	const count = parseChunkCount(main);
+	if (count === 0) return void 0;
+	const parts = [];
+	for (let index = 1; index <= count; index++) {
+		const part = store.read(chunkName(name, index));
+		if (part === void 0) return void 0;
+		parts.push(part);
+	}
+	return parts.join("");
+}
+function writeChunked(store, name, value, options) {
+	const { attrs, chunkMaxLength, prefix } = options;
+	const max = chunkMaxLength && chunkMaxLength > 0 ? chunkMaxLength : DEFAULT_CHUNK_MAX_LENGTH;
+	const chunkCount = Math.ceil(value.length / max);
+	if (chunkCount > 16) throw invalidConfigError(`${prefix} Session token requires ${chunkCount} cookie chunks, exceeding the limit of 16.`);
+	const previousCount = parseChunkCount(store.read(name));
+	const firstSurplus = chunkCount <= 1 ? 1 : chunkCount + 1;
+	for (let index = firstSurplus; index <= previousCount; index++) expire(store, chunkName(name, index), attrs);
+	if (chunkCount <= 1) {
+		store.write(name, value, attrs);
+		return;
+	}
+	store.write(name, `${CHUNK_MARKER}${chunkCount}`, attrs);
+	for (let index = 1; index <= chunkCount; index++) store.write(chunkName(name, index), value.slice((index - 1) * max, index * max), attrs);
+}
+function removeChunked(store, name, options) {
+	const count = parseChunkCount(store.read(name));
+	expire(store, name, options.attrs);
+	for (let index = 1; index <= count; index++) expire(store, chunkName(name, index), options.attrs);
+}
+function readChunkedBy(read, name) {
+	return readChunked({
+		read,
+		write: noop
+	}, name);
+}
+function readChunkedFrom(cookies, name) {
+	return readChunkedBy((key) => cookies[key], name);
+}
+function readChunkedFromSetCookie(setCookies, name) {
+	const cookies = setCookieValues(setCookies);
+	if (cookies[name] === void 0) return void 0;
+	return readChunkedFrom(cookies, name);
+}
+function setCookieValues(setCookies) {
+	const cookies = Object.create(null);
+	for (const setCookie of setCookies) {
+		const pair = setCookiePair(setCookie);
+		if (pair) cookies[pair.name] = decodeValue(pair.value);
+	}
+	return cookies;
+}
+function setCookieName(setCookie) {
+	return setCookiePair(setCookie)?.name;
+}
+function chunkName(name, index) {
+	return `${name}.${index}`;
+}
+function isChunkName(cookieName, name) {
+	return cookieName.startsWith(`${name}.`) && /^\d+$/.test(cookieName.slice(name.length + 1));
+}
+function parseChunkCount(main) {
+	if (main === void 0 || !main.startsWith("__chunked__")) return 0;
+	const suffix = main.slice(11);
+	if (!/^\d+$/.test(suffix)) return 0;
+	const count = Number.parseInt(suffix, 10);
+	if (count < 1 || count > 16) return 0;
+	return count;
+}
+function expire(store, name, attrs) {
+	store.write(name, "", {
+		...attrs,
+		maxAge: 0,
+		expires: /* @__PURE__ */ new Date(0)
+	});
+}
+function setCookiePair(setCookie) {
+	const [pair = ""] = setCookie.split(";", 1);
+	const separator = pair.indexOf("=");
+	if (separator === -1) return void 0;
+	return {
+		name: pair.slice(0, separator).trim(),
+		value: pair.slice(separator + 1).trim()
+	};
+}
+function decodeValue(value) {
+	if (!value.includes("%")) return value;
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		return value;
+	}
+}
+function noop() {}
+const JWS_DEFAULT_COOKIE = {
+	path: "/",
+	secure: true,
+	httpOnly: false,
+	sameSite: "lax"
+};
+function createJWSCodec(options) {
+	const { prefix, defaultName } = options;
+	return createSessionCodec({
+		family: "jws",
+		prefix,
+		defaultName,
+		defaultCookie: JWS_DEFAULT_COOKIE,
+		issueOptions: (config) => config.jws?.signOptions,
+		openOptions: (config) => config.jws?.verifyOptions,
+		issueKey: (config) => getSignKey(config, prefix),
+		openKey: (config) => getVerifyKey(config, prefix),
+		lookup: (config, carrier) => {
+			const hooks = config.hooks;
+			if (!hooks?.onVerifyKeyLookup) return void 0;
+			return (header) => hooks.onVerifyKeyLookup?.({
+				header,
+				...carrier,
+				config
+			});
+		},
+		importable: (key) => isJWKSet(key) ? key.keys : [key],
+		issue: (config, payload, key) => sign(payload, key, sessionIssueOptions(config.jws?.signOptions)),
+		open: async (config, token, key) => {
+			const { verifyOptions, signOptions } = config.jws ?? {};
+			const { payload } = await verify(token, key, {
+				...verifyOptions,
+				...sessionOpenOptions({
+					maxAge: config.maxAge,
+					requiredClaims: verifyOptions?.requiredClaims,
+					typ: signOptions?.protectedHeader?.typ,
+					alg: signOptions?.alg
+				})
+			});
+			return payload;
+		}
+	});
+}
+function getSignKey(config, prefix) {
+	const key = config.key;
+	assertKeyMaterial(key, { prefix });
+	let resolved;
+	if (isCryptoKey(key) || isSymmetricJWK(key)) resolved = key;
+	else if (isKeyPair(key)) {
+		assertJWSKeyPair(key, prefix);
+		resolved = key.privateKey;
+	}
+	if (!resolved) throw invalidKeyError(`${prefix} Invalid JWS key. It must be a symmetric JWK, a private JWK, or a CryptoKey.`, key);
+	assertPinnedAlg(resolved, config, prefix);
+	return resolved;
+}
+function getVerifyKey(config, prefix) {
+	const key = config.key;
+	assertKeyMaterial(key, { prefix });
+	let resolved;
+	if (isCryptoKey(key) || isSymmetricJWK(key)) resolved = key;
+	else if (isKeyPair(key)) {
+		assertJWSKeyPair(key, prefix);
+		resolved = Array.isArray(key.publicKey) ? { keys: key.publicKey } : key.publicKey;
+	}
+	if (!resolved) throw invalidKeyError(`${prefix} Invalid JWS key. It must be a symmetric JWK, a public JWK/set, or a CryptoKey.`, key);
+	assertPinnedAlg(resolved, config, prefix);
+	return resolved;
+}
+function assertJWSKeyPair(key, prefix) {
+	assertKeyPair(key, {
+		prefix,
+		family: "JWS",
+		isPublic: (half) => isCryptoKey(half) || isPublicJWK(half) || isPublicKeyList(Array.isArray(half) ? half : isJWKSet(half) ? half.keys : void 0),
+		publicHalf: "a public JWK, a non-empty list or set of public JWKs, or a CryptoKey"
+	});
+}
+function isPublicKeyList(keys) {
+	return keys !== void 0 && keys.length > 0 && keys.every((candidate) => isPublicJWK(candidate));
+}
+function assertPinnedAlg(key, config, prefix) {
+	assertPinnedCryptoKey(key, {
+		pinned: Boolean(config.jws?.signOptions?.alg),
+		prefix,
+		hint: "\"jws.signOptions.alg\""
+	});
+}
+export { bindSession, createJWECodec, createJWSCodec, dropSession, encodeSession, invalidConfigError, isChunkName, issueSession, loadSession, openSessionToken, readChunked, readChunkedBy, readChunkedFrom, readChunkedFromSetCookie, recordSlotStore, removeChunked, resolveSessionToken, responseCookieStore, sessionActions, sessionManager, sessionToken, setCookieName, writeChunked };