unjwt 0.7.3 → 0.8.0

package/dist/adapters/h3v2/index.mjs

@@ -1,642 +1,139 @@
-import { JWTError, computeDurationInSeconds, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK } from "../../_chunks/utils.mjs";
-import { sanitizeObjectCopy } from "../../_chunks/libs/unsecure.mjs";
-import { deriveJWKFromPassword, exportPEM, exportToPEM, generateJWK, importFromPEM, importPEM } from "../../_chunks/jwk.mjs";
-import { sign, verify } from "../../_chunks/jws.mjs";
-import { decrypt, encrypt } from "../../_chunks/jwe.mjs";
-import { getChunkedCookie, getEventContext, setChunkedCookie } from "h3";
-import { NullProtoObj } from "rou3";
-const kGetSessionPromise$1 = Symbol("h3_jwe_getSession");
-const DEFAULT_NAME$1 = "h3-jwe";
-const DEFAULT_COOKIE$1 = {
-	path: "/",
-	secure: true,
-	httpOnly: true
+import { deriveJWKFromPassword, exportPEM, generateJWK, importPEM, thumbprint } from "../../_chunks/jwk.mjs";
+import { bindSession, createJWECodec, createJWSCodec, dropSession, encodeSession, isChunkName, issueSession, loadSession, openSessionToken, readChunkedBy, readChunkedFromSetCookie, recordSlotStore, removeChunked, resolveSessionToken, responseCookieStore, sessionActions, sessionManager, sessionToken, setCookieName, writeChunked } from "../../_chunks/_codec-jws.mjs";
+import { getCookie, getEventContext, setCookie } from "h3";
+function eventCookieStore(event) {
+	return responseCookieStore({
+		request: (name) => getCookie(event, name),
+		response: () => event.res.headers.getSetCookie(),
+		write: (name, value, attrs) => setCookie(event, name, value, attrs)
+	});
+}
+const PREFIX = "[unjwt/h3]";
+const h3SessionPort = {
+	prefix: PREFIX,
+	carrier: (event) => ({ event }),
+	store: (event, slot) => recordSlotStore(() => {
+		const context = getEventContext(event);
+		return context.sessions ||= Object.create(null);
+	}, slot),
+	readToken: readSessionToken,
+	scope: (event) => getEventContext(event),
+	writable: hasWritableResponse,
+	setCookie: (event, sessionName, token, { attrs, chunkMaxLength }) => {
+		const target = cookieEvent(event);
+		writeChunked(eventCookieStore(target), sessionName, token, {
+			attrs,
+			chunkMaxLength,
+			prefix: PREFIX
+		});
+		stageSessionErrCookies(target, sessionName);
+	},
+	deleteCookie: (event, sessionName, { attrs }) => {
+		const target = cookieEvent(event);
+		removeChunked(eventCookieStore(target), sessionName, { attrs });
+		stageSessionErrCookies(target, sessionName);
+	}
 };
-async function useJWESession(event, config) {
-	const sessionName = config.name || DEFAULT_NAME$1;
-	await getJWESession(event, config);
-	const sessionManager = {
-		get id() {
-			return getSessionFromContext$1(event, sessionName)?.id;
-		},
-		get createdAt() {
-			return getSessionFromContext$1(event, sessionName)?.createdAt ?? Date.now();
-		},
-		get expiresAt() {
-			return getSessionFromContext$1(event, sessionName)?.expiresAt;
-		},
-		get data() {
-			return getSessionFromContext$1(event, sessionName)?.data || {};
-		},
-		get token() {
-			return getSessionFromContext$1(event, sessionName)?.token ?? getJWESessionToken(event, config);
-		},
-		update: async (update) => {
-			await updateJWESession(event, config, update);
-			return sessionManager;
-		},
-		clear: async () => {
-			await clearJWESession(event, config);
-			return sessionManager;
-		}
+function hasResponse(event) {
+	return "res" in event && Boolean(event.res);
+}
+function hasWritableResponse(event) {
+	if (!hasResponse(event)) return false;
+	const res = event.runtime?.node?.res;
+	return !res || !res.headersSent && !res.writableEnded;
+}
+function readSessionToken(event, sessionName, source) {
+	return resolveSessionToken(source, sessionName, {
+		written: (name) => hasResponse(event) ? readChunkedFromSetCookie(event.res.headers.getSetCookie(), name) : void 0,
+		cookie: (name) => readChunkedBy((key) => getCookie(event, key), name),
+		header: (name) => event.req.headers.get(name)
+	});
+}
+function stageSessionErrCookies(event, sessionName) {
+	const isSessionCookie = (cookie) => {
+		const name = setCookieName(cookie);
+		return name !== void 0 && (name === sessionName || isChunkName(name, sessionName));
 	};
-	return sessionManager;
+	const errHeaders = event.res.errHeaders;
+	const staged = [...errHeaders.getSetCookie().filter((cookie) => !isSessionCookie(cookie)), ...event.res.headers.getSetCookie().filter((cookie) => isSessionCookie(cookie))];
+	errHeaders.delete("set-cookie");
+	for (const cookie of staged) errHeaders.append("set-cookie", cookie);
+}
+function cookieEvent(event) {
+	return event;
+}
+const codec$1 = createJWECodec({
+	prefix: PREFIX,
+	defaultName: "h3-jwe"
+});
+async function useJWESession(event, config) {
+	const binding = bind$1(event, config);
+	await loadSession(binding);
+	return sessionManager(binding);
 }
 async function getJWESession(event, config) {
-	const sessionName = config.name || DEFAULT_NAME$1;
-	const context = getEventContext(event);
-	if (!context.sessions) context.sessions = new NullProtoObj();
-	const existingSession = context.sessions[sessionName];
-	if (existingSession) {
-		const session = existingSession[kGetSessionPromise$1] ? await existingSession[kGetSessionPromise$1] : existingSession;
-		if (session.expiresAt !== void 0 && session.expiresAt < Date.now()) {
-			await config.hooks?.onExpire?.({
-				session: {
-					id: session.id,
-					createdAt: session.createdAt,
-					expiresAt: session.expiresAt,
-					token: session.token
-				},
-				event,
-				error: new JWTError(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(session.expiresAt * 1e3)).toISOString()})`, "ERR_JWT_EXPIRED", {
-					jti: session.id,
-					exp: session.expiresAt / 1e3
-				}),
-				config
-			});
-			delete context.sessions[sessionName];
-			if (config.cookie !== false) if (hasWritableResponse$1(event)) setChunkedCookie(event, sessionName, "", {
-				...DEFAULT_COOKIE$1,
-				...config.cookie,
-				expires: /* @__PURE__ */ new Date(0),
-				maxAge: void 0
-			});
-			else console.warn("[unjwt/h3] Session expired but cookie cannot be cleared on a read-only event.");
-			const freshNow = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
-			const freshCreatedAt = freshNow - freshNow % 1e3;
-			const freshSession = {
-				id: void 0,
-				createdAt: freshCreatedAt,
-				expiresAt: config.maxAge === void 0 ? void 0 : freshCreatedAt + computeDurationInSeconds(config.maxAge) * 1e3,
-				data: new NullProtoObj(),
-				token: void 0
-			};
-			context.sessions[sessionName] = freshSession;
-			return freshSession;
-		}
-		if (session.id !== void 0 && session.token !== void 0) await config.hooks?.onRead?.({
-			session,
-			event,
-			config
-		});
-		return session;
-	}
-	const now = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
-	const createdAt = now - now % 1e3;
-	const session = {
-		id: void 0,
-		createdAt,
-		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(config.maxAge) * 1e3,
-		data: new NullProtoObj(),
-		token: void 0
-	};
-	context.sessions[sessionName] = session;
-	const token = getJWESessionToken(event, config);
-	let exclusiveHookFired = false;
-	if (token) {
-		session.token = token;
-		const promise = unsealJWESession(event, config, token).catch(async (error_) => {
-			exclusiveHookFired = true;
-			if (isJWTError(error_, "ERR_JWT_EXPIRED")) await config.hooks?.onExpire?.({
-				session: {
-					id: error_.cause.jti,
-					createdAt: error_.cause.iat ? error_.cause.iat * 1e3 : void 0,
-					expiresAt: error_.cause.exp ? error_.cause.exp * 1e3 : void 0,
-					token
-				},
-				event,
-				error: error_,
-				config
-			});
-			else await config.hooks?.onError?.({
-				session,
-				event,
-				error: error_,
-				config
-			});
-		}).then((unsealed) => {
-			if (unsealed) Object.assign(session, unsealed);
-			delete session[kGetSessionPromise$1];
-			return session;
-		});
-		session[kGetSessionPromise$1] = promise;
-		await promise;
-	}
-	if (!exclusiveHookFired && session.id !== void 0 && session.token !== void 0) await config.hooks?.onRead?.({
-		session,
-		event,
-		config
-	});
-	return session;
+	return loadSession(bind$1(event, config));
 }
 function getJWESessionToken(event, config) {
-	const sessionName = config.name || DEFAULT_NAME$1;
-	let token;
-	if (config.sessionHeader !== false) {
-		const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
-		const headerValue = event.req.headers.get(headerName);
-		if (typeof headerValue === "string") token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
-	}
-	if (config.cookie !== false && hasWritableResponse$1(event)) {
-		const setCookie = event.res.headers.get("set-cookie");
-		if (typeof setCookie === "string") token = findSetCookie$1(setCookie, sessionName);
-	}
-	if (!token) token = getChunkedCookie(event, sessionName);
-	return token;
+	return sessionToken(bind$1(event, config));
 }
-async function updateJWESession(event, config, update) {
-	const canWriteCookie = hasWritableResponse$1(event);
-	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot update session on read-only event.");
-	const sessionName = config.name || DEFAULT_NAME$1;
-	const session = getEventContext(event).sessions?.[sessionName] || await getJWESession(event, config);
-	const oldSession = {
-		...session,
-		data: sanitizeObjectCopy(session.data)
-	};
-	if (typeof update === "function") update = update(session.data);
-	if (update) Object.assign(session.data, update);
-	const now = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
-	const createdAt = now - now % 1e3;
-	Object.assign(session, {
-		id: config.generateId?.() || crypto.randomUUID(),
-		createdAt,
-		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(config.maxAge) * 1e3
-	});
-	let sealed;
-	try {
-		sealed = await sealJWESession(event, config);
-	} catch (error_) {
-		Object.assign(session, {
-			id: oldSession.id,
-			createdAt: oldSession.createdAt,
-			expiresAt: oldSession.expiresAt,
-			data: oldSession.data
-		});
-		session.token = oldSession.token;
-		await config.hooks?.onError?.({
-			session,
-			event,
-			error: error_,
-			config
-		});
-		throw error_;
-	}
-	session.token = sealed;
-	if (config.cookie !== false && canWriteCookie) setChunkedCookie(event, sessionName, sealed, {
-		...DEFAULT_COOKIE$1,
-		expires: config.maxAge === void 0 ? void 0 : new Date(session.createdAt + computeDurationInSeconds(config.maxAge) * 1e3),
-		...config.cookie
-	});
-	await config.hooks?.onUpdate?.({
-		session,
-		oldSession,
-		event,
-		config
-	});
-	return session;
+async function updateJWESession(event, config, update, options) {
+	return issueSession(bind$1(event, config), update, options);
 }
 async function sealJWESession(event, config) {
-	const key = getEncryptKey(config.key);
-	const sessionName = config.name || DEFAULT_NAME$1;
-	const session = getEventContext(event).sessions?.[sessionName] || await getJWESession(event, config);
-	const iat = Math.floor(session.createdAt / 1e3);
-	const exp = session.expiresAt ? Math.floor(session.expiresAt / 1e3) : void 0;
-	const payload = {
-		...session.data,
-		jti: session.id,
-		iat
-	};
-	if (exp) payload.exp = exp;
-	let typ = void 0;
-	if (config.jwe?.encryptOptions?.protectedHeader?.typ && typeof config.jwe.encryptOptions.protectedHeader.typ === "string" && config.jwe.encryptOptions.protectedHeader.typ.toLowerCase().includes("jwt")) typ = config.jwe.encryptOptions.protectedHeader.typ;
-	return await encrypt(payload, key, {
-		...config.jwe?.encryptOptions,
-		expiresIn: void 0,
-		protectedHeader: {
-			...config.jwe?.encryptOptions?.protectedHeader,
-			typ: typ || "JWT",
-			cty: "application/json"
-		}
-	});
+	return encodeSession(bind$1(event, config));
 }
 async function unsealJWESession(event, config, sealed) {
-	const key = config.hooks?.onUnsealKeyLookup ? (header) => config.hooks.onUnsealKeyLookup({
-		header,
-		event,
-		config
-	}) : getDecryptKey(config.key);
-	const alg = config.jwe?.encryptOptions?.alg;
-	const enc = config.jwe?.encryptOptions?.enc;
-	let typ = void 0;
-	if (config.jwe?.encryptOptions?.protectedHeader?.typ && typeof config.jwe.encryptOptions.protectedHeader.typ === "string" && config.jwe.encryptOptions.protectedHeader.typ.toLowerCase().includes("jwt")) typ = config.jwe.encryptOptions.protectedHeader.typ;
-	const { payload } = await decrypt(sealed, key, {
-		...config.jwe?.decryptOptions,
-		requiredClaims: [.../* @__PURE__ */ new Set([
-			...config.jwe?.decryptOptions?.requiredClaims || [],
-			"jti",
-			"iat"
-		])],
-		typ: typ || "JWT",
-		maxTokenAge: config.maxAge,
-		algorithms: alg ? [alg] : void 0,
-		encryptionAlgorithms: enc ? [enc] : void 0,
-		unwrappedKeyAlgorithm: void 0,
-		keyUsage: void 0,
-		forceUint8Array: false,
-		validateClaims: true
-	}).catch((error_) => {
-		if (error_ instanceof Error) throw error_;
-		throw new Error(String(error_));
+	return openSessionToken(codec$1, config, {
+		token: sealed,
+		carrier: { event }
 	});
-	const { jti, iat, exp, ...data } = payload;
-	return {
-		id: jti,
-		createdAt: iat * 1e3,
-		expiresAt: exp ? exp * 1e3 : void 0,
-		data: data && typeof data === "object" ? data : new NullProtoObj()
-	};
 }
 async function clearJWESession(event, config) {
-	const canWriteCookie = hasWritableResponse$1(event);
-	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot clear session on read-only event.");
-	const context = getEventContext(event);
-	const sessionName = config.name || DEFAULT_NAME$1;
-	let session = context.sessions?.[sessionName];
-	if (session && session[kGetSessionPromise$1]) session = await session[kGetSessionPromise$1];
-	const oldSession = session ? {
-		...session,
-		data: sanitizeObjectCopy(session.data)
-	} : void 0;
-	if (context.sessions?.[sessionName]) delete context.sessions[sessionName];
-	if (config.cookie !== false && canWriteCookie) setChunkedCookie(event, sessionName, "", {
-		...DEFAULT_COOKIE$1,
-		...config.cookie,
-		expires: /* @__PURE__ */ new Date(0),
-		maxAge: void 0
-	});
-	await config.hooks?.onClear?.({
-		oldSession,
-		event,
-		config
-	});
-}
-function getSessionFromContext$1(event, sessionName) {
-	return getEventContext(event).sessions?.[sessionName];
-}
-function hasWritableResponse$1(event) {
-	return Boolean(event.res);
-}
-function getEncryptKey(key) {
-	if (!key) throw new Error("Session: JWE key is required.");
-	let _key;
-	if (typeof key === "string") _key = key;
-	else if (isSymmetricJWK(key)) _key = key;
-	else if ("publicKey" in key && key.publicKey && isPublicJWK(key.publicKey)) _key = key.publicKey;
-	else if ("privateKey" in key && isPrivateJWK(key.privateKey)) _key = key.privateKey;
-	if (!_key) throw new Error("Session: Invalid JWE key. It must be a password string or valid JWK.", { cause: key });
-	return _key;
+	return dropSession(bind$1(event, config));
 }
-function getDecryptKey(key) {
-	if (!key) throw new Error("Session: JWE key is required.");
-	let _key = void 0;
-	if (typeof key === "string") _key = key;
-	else if (isSymmetricJWK(key)) _key = key;
-	else if ("privateKey" in key) _key = key.privateKey;
-	if (!_key) throw new Error("Session: Invalid JWE key. It must be a password string or a valid private JWK.", { cause: key });
-	return _key;
-}
-function findSetCookie$1(setCookie, name) {
-	const regex = new RegExp(`(?:^|,\\s*)${name}=([^;]+)`);
-	const match = setCookie.match(regex);
-	return match ? match[1] : void 0;
+function bind$1(event, config) {
+	return bindSession(event, config, {
+		port: h3SessionPort,
+		codec: codec$1,
+		actions: sessionActions()
+	});
 }
-const kGetSessionPromise = Symbol("h3_jws_getSession");
-const DEFAULT_NAME = "h3-jws";
-const DEFAULT_COOKIE = {
-	path: "/",
-	secure: true,
-	httpOnly: false
-};
+const codec = createJWSCodec({
+	prefix: PREFIX,
+	defaultName: "h3-jws"
+});
 async function useJWSSession(event, config) {
-	const sessionName = config.name || DEFAULT_NAME;
-	await getJWSSession(event, config);
-	const sessionManager = {
-		get id() {
-			return getSessionFromContext(event, sessionName)?.id;
-		},
-		get createdAt() {
-			return getSessionFromContext(event, sessionName)?.createdAt ?? Date.now();
-		},
-		get expiresAt() {
-			return getSessionFromContext(event, sessionName)?.expiresAt;
-		},
-		get data() {
-			return getSessionFromContext(event, sessionName)?.data || {};
-		},
-		get token() {
-			return getSessionFromContext(event, sessionName)?.token ?? getJWSSessionToken(event, config);
-		},
-		update: async (update) => {
-			await updateJWSSession(event, config, update);
-			return sessionManager;
-		},
-		clear: async () => {
-			await clearJWSSession(event, config);
-			return sessionManager;
-		}
-	};
-	return sessionManager;
+	const binding = bind(event, config);
+	await loadSession(binding);
+	return sessionManager(binding);
 }
 async function getJWSSession(event, config) {
-	const sessionName = config.name || DEFAULT_NAME;
-	const context = getEventContext(event);
-	if (!context.sessions) context.sessions = new NullProtoObj();
-	const existingSession = context.sessions[sessionName];
-	if (existingSession) {
-		const session = existingSession[kGetSessionPromise] ? await existingSession[kGetSessionPromise] : existingSession;
-		if (session.expiresAt !== void 0 && session.expiresAt < Date.now()) {
-			await config.hooks?.onExpire?.({
-				session: {
-					id: session.id,
-					createdAt: session.createdAt,
-					expiresAt: session.expiresAt,
-					token: session.token
-				},
-				event,
-				error: new JWTError(`JWT "exp" (Expiration Time) Claim validation failed: Token has expired (exp: ${(/* @__PURE__ */ new Date(session.expiresAt * 1e3)).toISOString()})`, "ERR_JWT_EXPIRED", {
-					jti: session.id,
-					exp: session.expiresAt / 1e3
-				}),
-				config
-			});
-			delete context.sessions[sessionName];
-			if (config.cookie !== false) if (hasWritableResponse(event)) setChunkedCookie(event, sessionName, "", {
-				...DEFAULT_COOKIE,
-				...config.cookie,
-				expires: /* @__PURE__ */ new Date(0),
-				maxAge: void 0
-			});
-			else console.warn("[unjwt/h3] Session expired but cookie cannot be cleared on a read-only event.");
-			const freshNow = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
-			const freshCreatedAt = freshNow - freshNow % 1e3;
-			const freshSession = {
-				id: void 0,
-				createdAt: freshCreatedAt,
-				expiresAt: config.maxAge === void 0 ? void 0 : freshCreatedAt + computeDurationInSeconds(config.maxAge) * 1e3,
-				data: new NullProtoObj(),
-				token: void 0
-			};
-			context.sessions[sessionName] = freshSession;
-			return freshSession;
-		}
-		if (session.id !== void 0 && session.token !== void 0) await config.hooks?.onRead?.({
-			session,
-			event,
-			config
-		});
-		return session;
-	}
-	const now = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
-	const createdAt = now - now % 1e3;
-	const session = {
-		id: void 0,
-		createdAt,
-		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(config.maxAge) * 1e3,
-		data: new NullProtoObj(),
-		token: void 0
-	};
-	context.sessions[sessionName] = session;
-	const token = getJWSSessionToken(event, config);
-	let exclusiveHookFired = false;
-	if (token) {
-		session.token = token;
-		const promise = verifyJWSSession(event, config, token).catch(async (error_) => {
-			exclusiveHookFired = true;
-			if (isJWTError(error_, "ERR_JWT_EXPIRED")) await config.hooks?.onExpire?.({
-				session: {
-					id: error_.cause.jti,
-					createdAt: error_.cause.iat ? error_.cause.iat * 1e3 : void 0,
-					expiresAt: error_.cause.exp ? error_.cause.exp * 1e3 : void 0,
-					token
-				},
-				event,
-				error: error_,
-				config
-			});
-			else await config.hooks?.onError?.({
-				session,
-				event,
-				error: error_,
-				config
-			});
-		}).then((unsealed) => {
-			if (unsealed) Object.assign(session, unsealed);
-			delete session[kGetSessionPromise];
-			return session;
-		});
-		session[kGetSessionPromise] = promise;
-		await promise;
-	}
-	if (!exclusiveHookFired && session.id !== void 0 && session.token !== void 0) await config.hooks?.onRead?.({
-		session,
-		event,
-		config
-	});
-	return session;
+	return loadSession(bind(event, config));
 }
 function getJWSSessionToken(event, config) {
-	const sessionName = config.name || DEFAULT_NAME;
-	let token;
-	if (config.sessionHeader !== false) {
-		const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
-		const headerValue = event.req.headers.get(headerName);
-		if (typeof headerValue === "string") token = headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
-	}
-	if (config.cookie !== false && hasWritableResponse(event)) {
-		const setCookie = event.res.headers.get("set-cookie");
-		if (typeof setCookie === "string") token = findSetCookie(setCookie, sessionName);
-	}
-	if (!token) token = getChunkedCookie(event, sessionName);
-	return token;
+	return sessionToken(bind(event, config));
 }
-async function updateJWSSession(event, config, update) {
-	const canWriteCookie = hasWritableResponse(event);
-	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot update session on read-only event.");
-	const sessionName = config.name || DEFAULT_NAME;
-	const session = getEventContext(event).sessions?.[sessionName] || await getJWSSession(event, config);
-	const oldSession = {
-		...session,
-		data: sanitizeObjectCopy(session.data)
-	};
-	if (typeof update === "function") update = update(session.data);
-	if (update) Object.assign(session.data, update);
-	const now = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
-	const createdAt = now - now % 1e3;
-	Object.assign(session, {
-		id: config.generateId?.() || crypto.randomUUID(),
-		createdAt,
-		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(config.maxAge) * 1e3
-	});
-	let token;
-	try {
-		token = await signJWSSession(event, config);
-	} catch (error_) {
-		Object.assign(session, {
-			id: oldSession.id,
-			createdAt: oldSession.createdAt,
-			expiresAt: oldSession.expiresAt,
-			data: oldSession.data
-		});
-		session.token = oldSession.token;
-		await config.hooks?.onError?.({
-			session,
-			event,
-			error: error_,
-			config
-		});
-		throw error_;
-	}
-	session.token = token;
-	if (config.cookie !== false && canWriteCookie) setChunkedCookie(event, sessionName, token, {
-		...DEFAULT_COOKIE,
-		expires: config.maxAge === void 0 ? void 0 : new Date(session.createdAt + computeDurationInSeconds(config.maxAge) * 1e3),
-		...config.cookie
-	});
-	await config.hooks?.onUpdate?.({
-		session,
-		oldSession,
-		event,
-		config
-	});
-	return session;
+async function updateJWSSession(event, config, update, options) {
+	return issueSession(bind(event, config), update, options);
 }
 async function signJWSSession(event, config) {
-	const key = getSignKey(config.key);
-	const sessionName = config.name || DEFAULT_NAME;
-	const session = getEventContext(event).sessions?.[sessionName] || await getJWSSession(event, config);
-	const iat = Math.floor(session.createdAt / 1e3);
-	const exp = session.expiresAt ? Math.floor(session.expiresAt / 1e3) : void 0;
-	const payload = {
-		...session.data,
-		jti: session.id,
-		iat
-	};
-	if (exp) payload.exp = exp;
-	let typ;
-	if (config.jws?.signOptions?.protectedHeader?.typ && typeof config.jws.signOptions.protectedHeader.typ === "string" && config.jws.signOptions.protectedHeader.typ.toLowerCase().includes("jwt")) typ = config.jws.signOptions.protectedHeader.typ;
-	return await sign(payload, key, {
-		...config.jws?.signOptions,
-		expiresIn: void 0,
-		protectedHeader: {
-			...config.jws?.signOptions?.protectedHeader,
-			kid: "kid" in key ? key.kid : void 0,
-			typ: typ || "JWT",
-			cty: "application/json"
-		}
-	});
+	return encodeSession(bind(event, config));
 }
 async function verifyJWSSession(event, config, token) {
-	const alg = config.jws?.signOptions?.alg;
-	const jwk = config.hooks?.onVerifyKeyLookup ? (header) => config.hooks.onVerifyKeyLookup({
-		header,
-		event,
-		config
-	}) : getVerifyKey(config.key);
-	let typ;
-	if (config.jws?.signOptions?.protectedHeader?.typ && typeof config.jws.signOptions.protectedHeader.typ === "string" && config.jws.signOptions.protectedHeader.typ.toLowerCase().includes("jwt")) typ = config.jws.signOptions.protectedHeader.typ;
-	const { payload } = await verify(token, jwk, {
-		...config.jws?.verifyOptions,
-		requiredClaims: [.../* @__PURE__ */ new Set([
-			...config.jws?.verifyOptions?.requiredClaims || [],
-			"jti",
-			"iat"
-		])],
-		typ: typ || "JWT",
-		algorithms: alg ? [alg] : void 0,
-		forceUint8Array: false,
-		validateClaims: true
-	}).catch((error_) => {
-		if (isJWTError(error_, "ERR_JWT_EXPIRED")) throw error_;
-		const message = error_ instanceof Error ? error_.message : String(error_);
-		throw new Error(`Invalid session token: ${message}`);
+	return openSessionToken(codec, config, {
+		token,
+		carrier: { event }
 	});
-	const { jti, iat, exp, ...data } = payload;
-	return {
-		id: jti,
-		createdAt: iat * 1e3,
-		expiresAt: exp ? exp * 1e3 : void 0,
-		data: data && typeof data === "object" ? data : new NullProtoObj()
-	};
 }
 async function clearJWSSession(event, config) {
-	const canWriteCookie = hasWritableResponse(event);
-	if (config.cookie !== false && !canWriteCookie) throw new Error("[unjwt/h3] Cannot clear session on read-only event.");
-	const context = getEventContext(event);
-	const sessionName = config.name || DEFAULT_NAME;
-	let session = context.sessions?.[sessionName];
-	if (session && session[kGetSessionPromise]) session = await session[kGetSessionPromise];
-	const oldSession = session ? {
-		...session,
-		data: sanitizeObjectCopy(session.data)
-	} : void 0;
-	if (context.sessions?.[sessionName]) delete context.sessions[sessionName];
-	if (config.cookie !== false && canWriteCookie) setChunkedCookie(event, sessionName, "", {
-		...DEFAULT_COOKIE,
-		...config.cookie,
-		expires: /* @__PURE__ */ new Date(0),
-		maxAge: void 0
-	});
-	await config.hooks?.onClear?.({
-		oldSession,
-		event,
-		config
-	});
+	return dropSession(bind(event, config));
 }
-function getSessionFromContext(event, sessionName) {
-	return getEventContext(event).sessions?.[sessionName];
-}
-function hasWritableResponse(event) {
-	return Boolean(event.res);
-}
-function getSignKey(key) {
-	if (!key) throw new Error("Session: JWS key is required.");
-	let _key;
-	if (isSymmetricJWK(key)) _key = key;
-	else if ("privateKey" in key && isPrivateJWK(key.privateKey)) _key = key.privateKey;
-	if (!_key) throw new Error("Session: Invalid JWS key. It must be a symmetric JWK or a private JWK.", { cause: key });
-	return _key;
-}
-function getVerifyKey(key) {
-	if (!key) throw new Error("Session: JWS key is required.");
-	let _key;
-	if (isSymmetricJWK(key)) _key = key;
-	else if ("publicKey" in key) {
-		const publicKey = key.publicKey;
-		if (isPublicJWK(publicKey)) _key = publicKey;
-		else if (Array.isArray(publicKey)) {
-			const keys = publicKey.filter((candidate) => isPublicJWK(candidate));
-			if (keys.length > 0) _key = { keys };
-		} else if (publicKey && typeof publicKey === "object" && Array.isArray(publicKey.keys)) {
-			const keys = publicKey.keys.filter((candidate) => isPublicJWK(candidate));
-			if (keys.length > 0) _key = { keys };
-		}
-	}
-	if (!_key) throw new Error("Session: Invalid JWS key. It must be a symmetric JWK or a public JWK/set.", { cause: key });
-	return _key;
-}
-function findSetCookie(setCookie, name) {
-	const regex = new RegExp(`(?:^|,\\s*)${name}=([^;]+)`);
-	const match = setCookie.match(regex);
-	return match ? match[1] : void 0;
+function bind(event, config) {
+	return bindSession(event, config, {
+		port: h3SessionPort,
+		codec,
+		actions: sessionActions()
+	});
 }
-export { clearJWESession, clearJWSSession, deriveJWKFromPassword, exportPEM, exportToPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, getJWSSessionToken, importFromPEM, importPEM, sealJWESession, signJWSSession, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };
+export { clearJWESession, clearJWSSession, deriveJWKFromPassword, exportPEM, generateJWK, getJWESession, getJWESessionToken, getJWSSession, getJWSSessionToken, importPEM, sealJWESession, signJWSSession, thumbprint, unsealJWESession, updateJWESession, updateJWSSession, useJWESession, useJWSSession, verifyJWSSession };