unjwt 0.7.3 → 0.8.1

package/dist/adapters/elysia/index.mjs

@@ -1,608 +1,139 @@
-import { computeDurationInSeconds, isJWTError, isPrivateJWK, isPublicJWK, isSymmetricJWK } from "../../_chunks/utils.mjs";
-import { sanitizeObjectCopy } from "../../_chunks/libs/unsecure.mjs";
-import { deriveJWKFromPassword, exportPEM, generateJWK, importPEM } from "../../_chunks/jwk.mjs";
-import { sign, verify } from "../../_chunks/jws.mjs";
-import { decrypt, encrypt } from "../../_chunks/jwe.mjs";
+import { deriveJWKFromPassword, exportPEM, generateJWK, importPEM, thumbprint } from "../../_chunks/jwk.mjs";
+import { bindSession, createJWECodec, createJWSCodec, invalidConfigError, loadSession, readChunked, recordSlotStore, removeChunked, resolveSessionToken, sessionActions, sessionManager, writeChunked } from "../../_chunks/_codec-jws.mjs";
 import { Elysia } from "elysia";
-function guardName(contextKey) {
-	return `require${contextKey.charAt(0).toUpperCase()}${contextKey.slice(1)}`;
-}
-const CHUNK_MARKER = "__chunked__";
-const DEFAULT_CHUNK_MAX_LENGTH = 4e3;
-const MAX_CHUNK_COUNT = 100;
-function readChunkedCookie(jar, name) {
-	const main = asString(jar[name]?.value);
-	if (main === void 0) return void 0;
-	if (!main.startsWith(CHUNK_MARKER)) return main;
-	const count = parseChunkCount(main);
-	if (count === 0) return void 0;
-	const parts = [];
-	for (let i = 1; i <= count; i++) {
-		const part = asString(jar[chunkName(name, i)]?.value);
-		if (part === void 0) return void 0;
-		parts.push(part);
-	}
-	return parts.join("");
-}
-function writeChunkedCookie(jar, name, value, options = {}) {
-	const { chunkMaxLength, ...attrs } = options;
-	const max = chunkMaxLength && chunkMaxLength > 0 ? chunkMaxLength : DEFAULT_CHUNK_MAX_LENGTH;
-	const chunkCount = Math.ceil(value.length / max);
-	if (chunkCount > MAX_CHUNK_COUNT) throw new Error(`[unjwt/elysia] Session token requires ${chunkCount} cookie chunks, exceeding the limit of ${MAX_CHUNK_COUNT}.`);
-	const previousCount = parseChunkCount(asString(jar[name]?.value));
-	const firstSurplus = chunkCount <= 1 ? 1 : chunkCount + 1;
-	for (let i = firstSurplus; i <= previousCount; i++) expireCookie(jar, chunkName(name, i), attrs);
-	if (chunkCount <= 1) {
-		jar[name].set({
-			...attrs,
-			value
-		});
-		return;
-	}
-	jar[name].set({
-		...attrs,
-		value: `${CHUNK_MARKER}${chunkCount}`
-	});
-	for (let i = 1; i <= chunkCount; i++) {
-		const slice = value.slice((i - 1) * max, i * max);
-		jar[chunkName(name, i)].set({
-			...attrs,
-			value: slice
-		});
-	}
-}
-function removeChunkedCookie(jar, name, attrs = {}) {
-	const count = parseChunkCount(asString(jar[name]?.value));
-	expireCookie(jar, name, attrs);
-	for (let i = 1; i <= count; i++) expireCookie(jar, chunkName(name, i), attrs);
-}
-function expireCookie(jar, fullName, attrs) {
-	jar[fullName].set({
-		...attrs,
-		value: "",
-		maxAge: 0,
-		expires: /* @__PURE__ */ new Date(0)
-	});
-}
-function chunkName(name, index) {
-	return `${name}.${index}`;
-}
-function parseChunkCount(main) {
-	if (main === void 0 || !main.startsWith(CHUNK_MARKER)) return 0;
-	const suffix = main.slice(11);
-	if (!/^\d+$/.test(suffix)) return 0;
-	const count = Number.parseInt(suffix, 10);
-	if (count < 1 || count > MAX_CHUNK_COUNT) return 0;
-	return count;
-}
-function asString(value) {
-	return typeof value === "string" ? value : void 0;
-}
-const DEFAULT_NAME$1 = "elysia-jws";
-const DEFAULT_COOKIE$1 = {
-	path: "/",
-	secure: true,
-	httpOnly: false
-};
-async function createJWSSession(context, config) {
-	const state = emptySession$1(config);
-	await initFromToken$1(context, config, state);
-	return buildManager$1(context, config, state);
-}
-function jwsSession(config) {
-	const contextKey = config.contextKey ?? "session";
+function sessionPlugin(options) {
+	const contextKey = options.contextKey ?? "session";
+	const seed = `${options.sessionName}:${contextKey}`;
 	return new Elysia({
-		name: "unjwt/elysia-jws",
-		seed: contextKey
+		name: options.name,
+		seed
 	}).resolve({ as: "scoped" }, async ({ cookie, request }) => {
-		const session = await createJWSSession({
+		const session = await options.create({
 			cookie,
 			request
-		}, config);
+		});
 		return { [contextKey]: session };
 	}).macro({ [guardName(contextKey)]: { resolve(ctx) {
-		if (!ctx[contextKey]?.id) return ctx.status(401, "Unauthorized");
+		if (!hasSessionId(ctx[contextKey])) return ctx.status(401, "Unauthorized");
 		return {};
 	} } });
 }
-function buildManager$1(context, config, state) {
-	const manager = {
-		get id() {
-			return state.id;
-		},
-		get createdAt() {
-			return state.createdAt;
-		},
-		get expiresAt() {
-			return state.expiresAt;
-		},
-		get data() {
-			return state.data;
-		},
-		get token() {
-			return state.token;
-		},
-		update: async (update) => {
-			await updateSession$1(context, config, state, update);
-			return manager;
-		},
-		clear: async () => {
-			await clearSession$1(context, config, state);
-			return manager;
-		}
-	};
-	return manager;
-}
-async function initFromToken$1(context, config, state) {
-	const token = readToken$1(context, config);
-	if (!token) return;
-	state.token = token;
-	let exclusiveHookFired = false;
-	try {
-		const unsealed = await verifySession(context, config, token);
-		Object.assign(state, unsealed);
-	} catch (error_) {
-		exclusiveHookFired = true;
-		if (isJWTError(error_, "ERR_JWT_EXPIRED")) await config.hooks?.onExpire?.({
-			session: {
-				id: error_.cause.jti,
-				createdAt: error_.cause.iat ? error_.cause.iat * 1e3 : void 0,
-				expiresAt: error_.cause.exp ? error_.cause.exp * 1e3 : void 0,
-				token
-			},
-			context,
-			error: error_,
-			config
-		});
-		else await config.hooks?.onError?.({
-			session: state,
-			context,
-			error: error_,
-			config
-		});
-	}
-	if (!exclusiveHookFired && state.id !== void 0 && state.token !== void 0) await config.hooks?.onRead?.({
-		session: state,
-		context,
-		config
-	});
+function guardName(contextKey) {
+	return `require${contextKey.charAt(0).toUpperCase()}${contextKey.slice(1)}`;
 }
-async function updateSession$1(context, config, state, update) {
-	const oldSession = {
-		...state,
-		data: sanitizeObjectCopy(state.data)
-	};
-	const resolvedUpdate = typeof update === "function" ? update(state.data) : update;
-	if (resolvedUpdate) Object.assign(state.data, resolvedUpdate);
-	const now = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
-	const createdAt = now - now % 1e3;
-	state.id = config.generateId?.() || crypto.randomUUID();
-	state.createdAt = createdAt;
-	state.expiresAt = config.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(config.maxAge) * 1e3;
-	let token;
-	try {
-		token = await signSession(config, state);
-	} catch (error_) {
-		state.id = oldSession.id;
-		state.createdAt = oldSession.createdAt;
-		state.expiresAt = oldSession.expiresAt;
-		state.data = oldSession.data;
-		state.token = oldSession.token;
-		await config.hooks?.onError?.({
-			session: state,
-			context,
-			error: error_,
-			config
-		});
-		throw error_;
-	}
-	state.token = token;
-	if (config.cookie !== false) {
-		const { chunkMaxLength, ...attrs } = {
-			...DEFAULT_COOKIE$1,
-			...config.cookie
-		};
-		writeChunkedCookie(context.cookie, config.name || DEFAULT_NAME$1, token, {
-			...attrs,
-			chunkMaxLength,
-			expires: config.maxAge === void 0 ? void 0 : new Date(createdAt + computeDurationInSeconds(config.maxAge) * 1e3)
-		});
-	}
-	await config.hooks?.onUpdate?.({
-		session: state,
-		oldSession,
-		context,
-		config
-	});
+function hasSessionId(session) {
+	return typeof session === "object" && session !== null && "id" in session && Boolean(session.id);
 }
-async function clearSession$1(context, config, state) {
-	const oldSession = state.id !== void 0 || state.token !== void 0 ? {
-		...state,
-		data: sanitizeObjectCopy(state.data)
-	} : void 0;
-	const fresh = emptySession$1(config);
-	state.id = fresh.id;
-	state.createdAt = fresh.createdAt;
-	state.expiresAt = fresh.expiresAt;
-	state.data = fresh.data;
-	state.token = fresh.token;
-	if (config.cookie !== false) {
-		const { chunkMaxLength: _chunkMaxLength, ...attrs } = {
-			...DEFAULT_COOKIE$1,
-			...config.cookie
-		};
-		removeChunkedCookie(context.cookie, config.name || DEFAULT_NAME$1, attrs);
-	}
-	await config.hooks?.onClear?.({
-		oldSession,
-		context,
-		config
-	});
+const PREFIX$1 = "[unjwt/elysia]";
+function readChunkedCookie(jar, name) {
+	return readChunked(cookieStore(jar), name);
 }
-async function signSession(config, state) {
-	const key = getSignKey(config.key);
-	const iat = Math.floor(state.createdAt / 1e3);
-	const exp = state.expiresAt ? Math.floor(state.expiresAt / 1e3) : void 0;
-	const payload = {
-		...state.data,
-		jti: state.id,
-		iat
-	};
-	if (exp) payload.exp = exp;
-	return sign(payload, key, {
-		...config.jws?.signOptions,
-		expiresIn: void 0,
-		protectedHeader: {
-			...config.jws?.signOptions?.protectedHeader,
-			kid: "kid" in key ? key.kid : void 0,
-			typ: resolveTyp$1(config) || "JWT",
-			cty: "application/json"
-		}
+function writeChunkedCookie(jar, name, value, options = {}) {
+	const { chunkMaxLength, ...attrs } = options;
+	writeChunked(cookieStore(jar), name, value, {
+		attrs,
+		chunkMaxLength,
+		prefix: PREFIX$1
 	});
 }
-async function verifySession(context, config, token) {
-	const alg = config.jws?.signOptions?.alg;
-	const { payload } = await verify(token, config.hooks?.onVerifyKeyLookup ? (header) => config.hooks.onVerifyKeyLookup({
-		header,
-		context,
-		config
-	}) : getVerifyKey(config.key), {
-		...config.jws?.verifyOptions,
-		requiredClaims: [.../* @__PURE__ */ new Set([
-			...config.jws?.verifyOptions?.requiredClaims || [],
-			"jti",
-			"iat"
-		])],
-		typ: resolveTyp$1(config) || "JWT",
-		algorithms: alg ? [alg] : void 0,
-		forceUint8Array: false,
-		validateClaims: true
-	}).catch((error_) => {
-		if (isJWTError(error_, "ERR_JWT_EXPIRED")) throw error_;
-		const message = error_ instanceof Error ? error_.message : String(error_);
-		throw new Error(`Invalid session token: ${message}`);
-	});
-	const { jti, iat, exp, ...data } = payload;
-	return {
-		id: jti,
-		createdAt: iat * 1e3,
-		expiresAt: exp ? exp * 1e3 : void 0,
-		data: data && typeof data === "object" ? data : emptyData$1()
-	};
+function removeChunkedCookie(jar, name, attrs = {}) {
+	removeChunked(cookieStore(jar), name, { attrs });
 }
-function emptySession$1(config) {
-	const now = config.jws?.signOptions?.currentDate?.getTime() ?? Date.now();
-	const createdAt = now - now % 1e3;
+function cookieStore(jar) {
 	return {
-		id: void 0,
-		createdAt,
-		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(config.maxAge) * 1e3,
-		data: emptyData$1(),
-		token: void 0
-	};
-}
-function emptyData$1() {
-	return Object.create(null);
-}
-function readToken$1(context, config) {
-	const sessionName = config.name || DEFAULT_NAME$1;
-	if (config.sessionHeader !== false) {
-		const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
-		const headerValue = context.request.headers.get(headerName);
-		if (typeof headerValue === "string") return headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
-	}
-	if (config.cookie !== false) return readChunkedCookie(context.cookie, sessionName);
-}
-function resolveTyp$1(config) {
-	const typ = config.jws?.signOptions?.protectedHeader?.typ;
-	if (typeof typ === "string" && typ.toLowerCase().includes("jwt")) return typ;
-}
-function getSignKey(key) {
-	if (!key) throw new Error("[unjwt/elysia] JWS key is required.");
-	let _key;
-	if (isSymmetricJWK(key)) _key = key;
-	else if ("privateKey" in key && isPrivateJWK(key.privateKey)) _key = key.privateKey;
-	if (!_key) throw new Error("[unjwt/elysia] Invalid JWS key. It must be a symmetric JWK or a private JWK.", { cause: key });
-	return _key;
-}
-function getVerifyKey(key) {
-	if (!key) throw new Error("[unjwt/elysia] JWS key is required.");
-	let _key;
-	if (isSymmetricJWK(key)) _key = key;
-	else if ("publicKey" in key) {
-		const publicKey = key.publicKey;
-		if (isPublicJWK(publicKey)) _key = publicKey;
-		else if (Array.isArray(publicKey)) {
-			const keys = publicKey.filter((candidate) => isPublicJWK(candidate));
-			if (keys.length > 0) _key = { keys };
-		} else if (publicKey && typeof publicKey === "object" && Array.isArray(publicKey.keys)) {
-			const keys = publicKey.keys.filter((candidate) => isPublicJWK(candidate));
-			if (keys.length > 0) _key = { keys };
-		}
-	}
-	if (!_key) throw new Error("[unjwt/elysia] Invalid JWS key. It must be a symmetric JWK or a public JWK/set.", { cause: key });
-	return _key;
-}
-const DEFAULT_NAME = "elysia-jwe";
-const DEFAULT_COOKIE = {
-	path: "/",
-	secure: true,
-	httpOnly: true
-};
-async function createJWESession(context, config) {
-	const state = emptySession(config);
-	await initFromToken(context, config, state);
-	return buildManager(context, config, state);
-}
-function jweSession(config) {
-	const contextKey = config.contextKey ?? "session";
-	return new Elysia({
-		name: "unjwt/elysia-jwe",
-		seed: contextKey
-	}).resolve({ as: "scoped" }, async ({ cookie, request }) => {
-		const session = await createJWESession({
-			cookie,
-			request
-		}, config);
-		return { [contextKey]: session };
-	}).macro({ [guardName(contextKey)]: { resolve(ctx) {
-		if (!ctx[contextKey]?.id) return ctx.status(401, "Unauthorized");
-		return {};
-	} } });
-}
-function buildManager(context, config, state) {
-	const manager = {
-		get id() {
-			return state.id;
-		},
-		get createdAt() {
-			return state.createdAt;
-		},
-		get expiresAt() {
-			return state.expiresAt;
-		},
-		get data() {
-			return state.data;
+		read: (name) => {
+			const value = jar[name]?.value;
+			return typeof value === "string" ? value : void 0;
 		},
-		get token() {
-			return state.token;
-		},
-		update: async (update) => {
-			await updateSession(context, config, state, update);
-			return manager;
-		},
-		clear: async () => {
-			await clearSession(context, config, state);
-			return manager;
-		}
+		write: (name, value, attrs) => reactiveCookie(jar, name).set({
+			...attrs,
+			value
+		})
 	};
-	return manager;
-}
-async function initFromToken(context, config, state) {
-	const token = readToken(context, config);
-	if (!token) return;
-	state.token = token;
-	let exclusiveHookFired = false;
-	try {
-		const unsealed = await unsealSession(context, config, token);
-		Object.assign(state, unsealed);
-	} catch (error_) {
-		exclusiveHookFired = true;
-		if (isJWTError(error_, "ERR_JWT_EXPIRED")) await config.hooks?.onExpire?.({
-			session: {
-				id: error_.cause.jti,
-				createdAt: error_.cause.iat ? error_.cause.iat * 1e3 : void 0,
-				expiresAt: error_.cause.exp ? error_.cause.exp * 1e3 : void 0,
-				token
-			},
-			context,
-			error: error_,
-			config
-		});
-		else await config.hooks?.onError?.({
-			session: state,
-			context,
-			error: error_,
-			config
-		});
-	}
-	if (!exclusiveHookFired && state.id !== void 0 && state.token !== void 0) await config.hooks?.onRead?.({
-		session: state,
-		context,
-		config
-	});
 }
-async function updateSession(context, config, state, update) {
-	const oldSession = {
-		...state,
-		data: sanitizeObjectCopy(state.data)
-	};
-	const resolvedUpdate = typeof update === "function" ? update(state.data) : update;
-	if (resolvedUpdate) Object.assign(state.data, resolvedUpdate);
-	const now = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
-	const createdAt = now - now % 1e3;
-	state.id = config.generateId?.() || crypto.randomUUID();
-	state.createdAt = createdAt;
-	state.expiresAt = config.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(config.maxAge) * 1e3;
-	let token;
-	try {
-		token = await sealSession(config, state);
-	} catch (error_) {
-		state.id = oldSession.id;
-		state.createdAt = oldSession.createdAt;
-		state.expiresAt = oldSession.expiresAt;
-		state.data = oldSession.data;
-		state.token = oldSession.token;
-		await config.hooks?.onError?.({
-			session: state,
-			context,
-			error: error_,
-			config
-		});
-		throw error_;
-	}
-	state.token = token;
-	if (config.cookie !== false) {
-		const { chunkMaxLength, ...attrs } = {
-			...DEFAULT_COOKIE,
-			...config.cookie
-		};
-		writeChunkedCookie(context.cookie, config.name || DEFAULT_NAME, token, {
+function reactiveCookie(jar, name) {
+	const cookie = jar[name];
+	if (!cookie || typeof cookie.set !== "function") throw invalidConfigError(`${PREFIX$1} Session cookie jar must expose a reactive cookie at "${name}" with a set() method — pass Elysia's own \`cookie\` context property.`);
+	return cookie;
+}
+const PREFIX = "[unjwt/elysia]";
+const SESSIONS = /* @__PURE__ */ new WeakMap();
+const elysiaSessionPort = {
+	prefix: PREFIX,
+	carrier: (context) => ({ context }),
+	store: (context, slot) => recordSlotStore(() => requestSessions(context.request), slot),
+	readToken: readSessionToken,
+	scope: (context) => context.request,
+	writable: () => true,
+	setCookie: (context, sessionName, token, { attrs, chunkMaxLength }) => {
+		writeChunkedCookie(context.cookie, sessionName, token, {
 			...attrs,
-			chunkMaxLength,
-			expires: config.maxAge === void 0 ? void 0 : new Date(createdAt + computeDurationInSeconds(config.maxAge) * 1e3)
+			chunkMaxLength
 		});
+	},
+	deleteCookie: (context, sessionName, { attrs }) => {
+		removeChunkedCookie(context.cookie, sessionName, attrs);
 	}
-	await config.hooks?.onUpdate?.({
-		session: state,
-		oldSession,
-		context,
-		config
+};
+function readSessionToken(context, sessionName, source) {
+	return resolveSessionToken(source, sessionName, {
+		cookie: (name) => readChunkedCookie(context.cookie, name),
+		header: (name) => context.request.headers.get(name)
 	});
 }
-async function clearSession(context, config, state) {
-	const oldSession = state.id !== void 0 || state.token !== void 0 ? {
-		...state,
-		data: sanitizeObjectCopy(state.data)
-	} : void 0;
-	const fresh = emptySession(config);
-	state.id = fresh.id;
-	state.createdAt = fresh.createdAt;
-	state.expiresAt = fresh.expiresAt;
-	state.data = fresh.data;
-	state.token = fresh.token;
-	if (config.cookie !== false) {
-		const { chunkMaxLength: _chunkMaxLength, ...attrs } = {
-			...DEFAULT_COOKIE,
-			...config.cookie
-		};
-		removeChunkedCookie(context.cookie, config.name || DEFAULT_NAME, attrs);
-	}
-	await config.hooks?.onClear?.({
-		oldSession,
-		context,
-		config
-	});
+function requestSessions(request) {
+	const existing = SESSIONS.get(request);
+	if (existing) return existing;
+	const created = Object.create(null);
+	SESSIONS.set(request, created);
+	return created;
+}
+const codec$1 = createJWSCodec({
+	prefix: PREFIX,
+	defaultName: "elysia-jws"
+});
+async function createJWSSession(context, config) {
+	const binding = bind$1(context, config);
+	await loadSession(binding);
+	return sessionManager(binding);
 }
-async function sealSession(config, state) {
-	const key = getEncryptKey(config.key);
-	const iat = Math.floor(state.createdAt / 1e3);
-	const exp = state.expiresAt ? Math.floor(state.expiresAt / 1e3) : void 0;
-	const payload = {
-		...state.data,
-		jti: state.id,
-		iat
-	};
-	if (exp) payload.exp = exp;
-	return encrypt(payload, key, {
-		...config.jwe?.encryptOptions,
-		expiresIn: void 0,
-		protectedHeader: {
-			...config.jwe?.encryptOptions?.protectedHeader,
-			typ: resolveTyp(config) || "JWT",
-			cty: "application/json"
-		}
+function jwsSession(config) {
+	return sessionPlugin({
+		name: "unjwt/elysia-jws",
+		sessionName: config.name || codec$1.defaultName,
+		contextKey: config.contextKey,
+		create: (context) => createJWSSession(context, config)
 	});
 }
-async function unsealSession(context, config, sealed) {
-	const key = config.hooks?.onUnsealKeyLookup ? (header) => config.hooks.onUnsealKeyLookup({
-		header,
-		context,
-		config
-	}) : getDecryptKey(config.key);
-	const alg = config.jwe?.encryptOptions?.alg;
-	const enc = config.jwe?.encryptOptions?.enc;
-	const { payload } = await decrypt(sealed, key, {
-		...config.jwe?.decryptOptions,
-		requiredClaims: [.../* @__PURE__ */ new Set([
-			...config.jwe?.decryptOptions?.requiredClaims || [],
-			"jti",
-			"iat"
-		])],
-		typ: resolveTyp(config) || "JWT",
-		maxTokenAge: config.maxAge,
-		algorithms: alg ? [alg] : void 0,
-		encryptionAlgorithms: enc ? [enc] : void 0,
-		unwrappedKeyAlgorithm: void 0,
-		keyUsage: void 0,
-		forceUint8Array: false,
-		validateClaims: true
-	}).catch((error_) => {
-		if (error_ instanceof Error) throw error_;
-		throw new Error(String(error_));
+function bind$1(context, config) {
+	return bindSession(context, config, {
+		port: elysiaSessionPort,
+		codec: codec$1,
+		actions: sessionActions()
 	});
-	const { jti, iat, exp, ...data } = payload;
-	return {
-		id: jti,
-		createdAt: iat * 1e3,
-		expiresAt: exp ? exp * 1e3 : void 0,
-		data: data && typeof data === "object" ? data : emptyData()
-	};
-}
-function emptySession(config) {
-	const now = config.jwe?.encryptOptions?.currentDate?.getTime() ?? Date.now();
-	const createdAt = now - now % 1e3;
-	return {
-		id: void 0,
-		createdAt,
-		expiresAt: config.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(config.maxAge) * 1e3,
-		data: emptyData(),
-		token: void 0
-	};
-}
-function emptyData() {
-	return Object.create(null);
 }
-function readToken(context, config) {
-	const sessionName = config.name || DEFAULT_NAME;
-	if (config.sessionHeader !== false) {
-		const headerName = typeof config.sessionHeader === "string" ? config.sessionHeader.toLowerCase() : `x-${sessionName.toLowerCase()}-session`;
-		const headerValue = context.request.headers.get(headerName);
-		if (typeof headerValue === "string") return headerValue.startsWith("Bearer ") ? headerValue.slice(7).trim() : headerValue;
-	}
-	if (config.cookie !== false) return readChunkedCookie(context.cookie, sessionName);
-}
-function resolveTyp(config) {
-	const typ = config.jwe?.encryptOptions?.protectedHeader?.typ;
-	if (typeof typ === "string" && typ.toLowerCase().includes("jwt")) return typ;
+const codec = createJWECodec({
+	prefix: PREFIX,
+	defaultName: "elysia-jwe"
+});
+async function createJWESession(context, config) {
+	const binding = bind(context, config);
+	await loadSession(binding);
+	return sessionManager(binding);
 }
-function getEncryptKey(key) {
-	if (!key) throw new Error("[unjwt/elysia] JWE key is required.");
-	let _key;
-	if (typeof key === "string") _key = key;
-	else if (isSymmetricJWK(key)) _key = key;
-	else if ("publicKey" in key && key.publicKey && isPublicJWK(key.publicKey)) _key = key.publicKey;
-	else if ("privateKey" in key && isPrivateJWK(key.privateKey)) _key = key.privateKey;
-	if (!_key) throw new Error("[unjwt/elysia] Invalid JWE key. It must be a password string or valid JWK.", { cause: key });
-	return _key;
+function jweSession(config) {
+	return sessionPlugin({
+		name: "unjwt/elysia-jwe",
+		sessionName: config.name || codec.defaultName,
+		contextKey: config.contextKey,
+		create: (context) => createJWESession(context, config)
+	});
 }
-function getDecryptKey(key) {
-	if (!key) throw new Error("[unjwt/elysia] JWE key is required.");
-	let _key;
-	if (typeof key === "string") _key = key;
-	else if (isSymmetricJWK(key)) _key = key;
-	else if ("privateKey" in key) _key = key.privateKey;
-	if (!_key) throw new Error("[unjwt/elysia] Invalid JWE key. It must be a password string or a valid private JWK.", { cause: key });
-	return _key;
+function bind(context, config) {
+	return bindSession(context, config, {
+		port: elysiaSessionPort,
+		codec,
+		actions: sessionActions()
+	});
 }
-export { createJWESession, createJWSSession, deriveJWKFromPassword, exportPEM, generateJWK, importPEM, jweSession, jwsSession };
+export { createJWESession, createJWSSession, deriveJWKFromPassword, exportPEM, generateJWK, importPEM, jweSession, jwsSession, thumbprint };