unjwt 0.8.0 → 0.8.2

package/dist/_chunks/jws.d.mts

@@ -1,4 +1,4 @@
-import { JOSEPayload, JOSEPayloadMode, JWKLookupFunction, JWKSet, JWSAlgorithm, JWSFlattenedSerialization, JWSGeneralSerialization, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWTClaims, PayloadOf } from "./index.mjs";
+import { JOSEPayload, JOSEPayloadMode, JWKSet, JWSAlgorithm, JWSFlattenedSerialization, JWSGeneralSerialization, JWSKeyLookup, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWTClaims, PayloadOf } from "./index.mjs";
 import "./_internal.mjs";
 /**
  * Signs a payload with multiple signers as a JWS General JSON Serialization (RFC 7515 §7.2.1).
@@ -11,14 +11,14 @@ export declare function signMulti(payload: JOSEPayload, signers: JWSMultiSigner[
  * Per-signature failures are collected and the last one is thrown when none verifies.
  * The payload type follows `options.payload`, as in `verify`.
  */
-export declare function verifyMulti<T extends Record<string, unknown> = JWTClaims>(jws: JWSGeneralSerialization | JWSFlattenedSerialization, keyOrLookup: CryptoKey | JWKSet | JWSVerifyJWK | Uint8Array<ArrayBuffer> | JWKLookupFunction, options?: JWSMultiVerifyOptions<"json"> & {
+export declare function verifyMulti<T extends object = JWTClaims>(jws: JWSGeneralSerialization | JWSFlattenedSerialization, keyOrLookup: CryptoKey | JWKSet | JWSVerifyJWK | Uint8Array<ArrayBuffer> | JWSKeyLookup, options?: JWSMultiVerifyOptions<"json"> & {
   forceUint8Array?: false;
 }): Promise<JWSMultiVerifyResult<T>>;
 /** @deprecated `forceUint8Array` is replaced by `payload: "bytes"`; removed in v0.9.0. */
-export declare function verifyMulti(jws: JWSGeneralSerialization | JWSFlattenedSerialization, keyOrLookup: CryptoKey | JWKSet | JWSVerifyJWK | Uint8Array<ArrayBuffer> | JWKLookupFunction, options: JWSMultiVerifyOptions & {
+export declare function verifyMulti(jws: JWSGeneralSerialization | JWSFlattenedSerialization, keyOrLookup: CryptoKey | JWKSet | JWSVerifyJWK | Uint8Array<ArrayBuffer> | JWSKeyLookup, options: JWSMultiVerifyOptions & {
   forceUint8Array: true;
 }): Promise<JWSMultiVerifyResult<Uint8Array<ArrayBuffer>>>;
-export declare function verifyMulti<Mode extends JOSEPayloadMode = JOSEPayloadMode>(jws: JWSGeneralSerialization | JWSFlattenedSerialization, keyOrLookup: CryptoKey | JWKSet | JWSVerifyJWK | Uint8Array<ArrayBuffer> | JWKLookupFunction, options?: JWSMultiVerifyOptions<Mode>): Promise<JWSMultiVerifyResult<PayloadOf<Mode>>>;
+export declare function verifyMulti<Mode extends JOSEPayloadMode = JOSEPayloadMode>(jws: JWSGeneralSerialization | JWSFlattenedSerialization, keyOrLookup: CryptoKey | JWKSet | JWSVerifyJWK | Uint8Array<ArrayBuffer> | JWSKeyLookup, options?: JWSMultiVerifyOptions<Mode>): Promise<JWSMultiVerifyResult<PayloadOf<Mode>>>;
 /**
  * Verifies every signature independently and returns one outcome per signature; only
  * a malformed envelope throws (`ERR_JWS_INVALID_SERIALIZATION`). The payload type follows `options.payload`.
@@ -27,14 +27,14 @@ export declare function verifyMulti<Mode extends JOSEPayloadMode = JOSEPayloadMo
  * const outcomes = await verifyMultiAll(jws, (header) => jwkSet);
  * if (!outcomes.every((o) => o.verified)) throw new Error("not all signatures verified");
  */
-export declare function verifyMultiAll<T extends Record<string, unknown> = JWTClaims>(jws: JWSGeneralSerialization | JWSFlattenedSerialization, keyResolver: JWKLookupFunction, options?: JWSMultiVerifyAllOptions<"json"> & {
+export declare function verifyMultiAll<T extends object = JWTClaims>(jws: JWSGeneralSerialization | JWSFlattenedSerialization, keyResolver: JWSKeyLookup, options?: JWSMultiVerifyAllOptions<"json"> & {
   forceUint8Array?: false;
 }): Promise<JWSMultiVerifyOutcome<T>[]>;
 /** @deprecated `forceUint8Array` is replaced by `payload: "bytes"`; removed in v0.9.0. */
-export declare function verifyMultiAll(jws: JWSGeneralSerialization | JWSFlattenedSerialization, keyResolver: JWKLookupFunction, options: JWSMultiVerifyAllOptions & {
+export declare function verifyMultiAll(jws: JWSGeneralSerialization | JWSFlattenedSerialization, keyResolver: JWSKeyLookup, options: JWSMultiVerifyAllOptions & {
   forceUint8Array: true;
 }): Promise<JWSMultiVerifyOutcome<Uint8Array<ArrayBuffer>>[]>;
-export declare function verifyMultiAll<Mode extends JOSEPayloadMode = JOSEPayloadMode>(jws: JWSGeneralSerialization | JWSFlattenedSerialization, keyResolver: JWKLookupFunction, options?: JWSMultiVerifyAllOptions<Mode>): Promise<JWSMultiVerifyOutcome<PayloadOf<Mode>>[]>;
+export declare function verifyMultiAll<Mode extends JOSEPayloadMode = JOSEPayloadMode>(jws: JWSGeneralSerialization | JWSFlattenedSerialization, keyResolver: JWSKeyLookup, options?: JWSMultiVerifyAllOptions<Mode>): Promise<JWSMultiVerifyOutcome<PayloadOf<Mode>>[]>;
 /** Converts a single-signature General JWS to Flattened form (RFC 7515 §7.2.2); otherwise `ERR_JWS_INVALID_SERIALIZATION`. */
 export declare function generalToFlattenedJWS(jws: JWSGeneralSerialization): JWSFlattenedSerialization;
 /** Creates a JWS Compact Serialization; an object payload is JSON-serialized, `alg` is required unless the JWK carries one. */
@@ -46,11 +46,11 @@ export declare function sign(payload: JOSEPayload, key: CryptoKey | Uint8Array<A
  * Verifies a JWS Compact Serialization against a key, JWK Set or key resolver.
  * The payload type follows `options.payload`: claims `T` for `"json"` (default), `string`, or `Uint8Array`.
  */
-export declare function verify<T extends Record<string, unknown> = JWTClaims>(jws: string, key: CryptoKey | JWKSet | JWSVerifyJWK | Uint8Array<ArrayBuffer> | JWKLookupFunction, options?: JWSVerifyOptions<"json"> & {
+export declare function verify<T extends object = JWTClaims>(jws: string, key: CryptoKey | JWKSet | JWSVerifyJWK | Uint8Array<ArrayBuffer> | JWSKeyLookup, options?: JWSVerifyOptions<"json"> & {
   forceUint8Array?: false;
 }): Promise<JWSVerifyResult<T>>;
 /** @deprecated `forceUint8Array` is replaced by `payload: "bytes"`; removed in v0.9.0. */
-export declare function verify(jws: string, key: CryptoKey | JWKSet | JWSVerifyJWK | Uint8Array<ArrayBuffer> | JWKLookupFunction, options: JWSVerifyOptions & {
+export declare function verify(jws: string, key: CryptoKey | JWKSet | JWSVerifyJWK | Uint8Array<ArrayBuffer> | JWSKeyLookup, options: JWSVerifyOptions & {
   forceUint8Array: true;
 }): Promise<JWSVerifyResult<Uint8Array<ArrayBuffer>>>;
-export declare function verify<Mode extends JOSEPayloadMode = JOSEPayloadMode>(jws: string, key: CryptoKey | JWKSet | JWSVerifyJWK | Uint8Array<ArrayBuffer> | JWKLookupFunction, options?: JWSVerifyOptions<Mode>): Promise<JWSVerifyResult<PayloadOf<Mode>>>;
+export declare function verify<Mode extends JOSEPayloadMode = JOSEPayloadMode>(jws: string, key: CryptoKey | JWKSet | JWSVerifyJWK | Uint8Array<ArrayBuffer> | JWSKeyLookup, options?: JWSVerifyOptions<Mode>): Promise<JWSVerifyResult<PayloadOf<Mode>>>;

package/dist/_chunks/jws.mjs

@@ -1,7 +1,7 @@
 import { sanitizeObjectCopy, textEncoder } from "./libs/unsecure.mjs";
 import { JWTError, applyTypDefault, base64UrlStringify, computeJwtTimeClaims, getPlaintextBytes, isJWK, isJWKSet, parsePayloadText, validateCriticalHeadersJWS } from "./_jwt-internal.mjs";
-import { inferJWSAllowedAlgorithms } from "./algorithms.mjs";
-import { JWS_ALG_CTX, applyB64Header, asJWTError, asKeyLookupError, asKeyUsageError, assertB64Option, assertCompactToken, assertConsumerOptions, assertEntryLimit, assertJWKSetCandidates, assertNotStringKey, assertOptionEntry, assertProducerCrit, assertProtectedOnlyOption, assertSerializationObject, buildJWKSetFilter, checkAlgAllowed, checkJWSAlgSupported, checkJWSB64, checkProtectedTyp, checkSerializationEntry, decodeJWSPayload, decodeProtectedHeader, decodeSegment, getJWKsFromSet, importKey, keyMatchesHeader, resolveKeyInput, resolveLimit, resolvePayloadMode, resolveSigningKey, serializeProtectedHeader, sign as sign$1, stringKeyError, validateClaimsIfJson, verify as verify$1 } from "./jwk.mjs";
+import { inferJWSAllowedAlgorithms } from "./digest.mjs";
+import { JWS_ALG_CTX, applyB64Header, asJWTError, asKeyLookupError, asKeyUsageError, assertB64Option, assertCompactToken, assertConsumerOptions, assertEntryLimit, assertJWKSetCandidates, assertJWSAlgSupported, assertNotStringKey, assertOptionEntry, assertProducerConfirmation, assertProducerCrit, assertProducerKeyHeaders, assertProtectedOnlyOption, assertSerializationObject, buildJWKSetFilter, checkAlgAllowed, checkJWSAlgSupported, checkJWSB64, checkProtectedTyp, checkSerializationEntry, decodeJWSPayload, decodeProtectedHeader, decodeSegment, getJWKsFromSet, importKey, keyMatchesHeader, resolveKeyInput, resolveLimit, resolvePayloadMode, resolveSigningKey, serializeProtectedHeader, sign as sign$1, stringKeyError, validateClaimsIfJson, verify as verify$1 } from "./jwk.mjs";
 function buildJWSProtectedHeader(alg, key, userHeader, options) {
 	const safeHeader = sanitizeObjectCopy(userHeader);
 	const header = {};
@@ -66,8 +66,17 @@ async function signMulti(payload, signers, options = {}) {
 			tier: "unprotected",
 			family: "JWS"
 		});
+		assertProducerKeyHeaders(signer.protectedHeader, {
+			tier: "protected",
+			family: "JWS"
+		});
+		assertProducerKeyHeaders(signer.unprotectedHeader, {
+			tier: "unprotected",
+			family: "JWS"
+		});
 		assertB64Option(signer.protectedHeader);
 	}
+	assertProducerConfirmation(payload);
 	const resolvedAlgs = signers.map((s, i) => _resolveSignerAlg(s, i));
 	const b64 = _resolveB64(signers);
 	const computedPayload = computeJwtTimeClaims(payload, options);
@@ -449,13 +458,17 @@ async function sign(payload, key, options = {}) {
 	});
 	assertNotStringKey(key);
 	const { protectedHeader: userHeader } = options;
+	assertProducerKeyHeaders(userHeader, {
+		tier: "protected",
+		family: "JWS"
+	});
+	assertProducerConfirmation(payload);
 	let { alg } = options;
 	if (!alg) {
 		if (isJWK(key) && key.alg) alg = key.alg;
 		else throw new JWTError("JWS \"alg\" (Algorithm) must be provided in options", "ERR_JWS_ALG_MISSING");
 	}
-	const algSupportError = checkJWSAlgSupported(alg);
-	if (algSupportError) throw algSupportError;
+	assertJWSAlgSupported(alg);
 	let signingKey;
 	try {
 		signingKey = await resolveSigningKey(alg, await importKey(key, {
@@ -498,8 +511,7 @@ async function verify(jws, key, options = {}) {
 	const protectedHeader = decodeProtectedHeader(protectedHeaderEncoded, "JWS");
 	if (!protectedHeader.alg) throw new JWTError("Invalid JWS: Protected header must be an object with an \"alg\" property.", "ERR_JWS_INVALID");
 	const alg = protectedHeader.alg;
-	const algSupportError = checkJWSAlgSupported(alg);
-	if (algSupportError) throw algSupportError;
+	assertJWSAlgSupported(alg);
 	const headerError = checkJWSB64(protectedHeader) ?? checkProtectedTyp(options.typ, protectedHeader, { family: "JWS" });
 	if (headerError) throw headerError;
 	const signatureBytes = decodeSegment(signatureEncoded, {

package/dist/_chunks/jwt.d.mts

@@ -1,4 +1,4 @@
-import { Duration, JOSEPayloadMode, JWTClaimValidationOptions, JWTClaims, JWTErrorCode, JWTTimeClaimOptions, PayloadOf } from "./index.mjs";
+import { Duration, JOSEPayload, JOSEPayloadMode, JWTClaimValidationOptions, JWTClaims, JWTErrorCode, JWTTimeClaimOptions, PayloadOf } from "./index.mjs";
 /** Set `typ: "JWT"` on a header without `typ` when the payload is an object (not a `Uint8Array`). */
 export declare function applyTypDefault<T extends {
   typ?: string;
@@ -19,7 +19,7 @@ export declare function parsePayloadText(bytes: Uint8Array<ArrayBuffer>, options
 export declare function parsePayloadSegment<T = JWTClaims>(payloadEncoded: string, options?: ParsePayloadOptions<"json">): T;
 export declare function parsePayloadSegment<Mode extends JOSEPayloadMode = JOSEPayloadMode>(payloadEncoded: string, options?: ParsePayloadOptions<Mode>): PayloadOf<Mode>;
 /** Encode a payload to bytes; a non-serializable one throws `ERR_INVALID_OPTION`. */
-export declare function getPlaintextBytes(payload: string | Uint8Array<ArrayBuffer> | Record<string, unknown>): Uint8Array<ArrayBuffer>;
+export declare function getPlaintextBytes(payload: JOSEPayload): Uint8Array<ArrayBuffer>;
 /** Options for {@link computeJwtTimeClaims}. */
 export type ComputeJwtTimeClaimsOptions = JWTTimeClaimOptions;
 /**

package/dist/_chunks/libs/cookie-es.mjs

@@ -0,0 +1,255 @@
+const COOKIE_MAX_AGE_LIMIT = 3456e4;
+function endIndex(str, min, len) {
+	const index = str.indexOf(";", min);
+	return index === -1 ? len : index;
+}
+function eqIndex(str, min, max) {
+	const index = str.indexOf("=", min);
+	return index < max ? index : -1;
+}
+function valueSlice(str, min, max) {
+	if (min === max) return "";
+	let start = min;
+	let end = max;
+	do {
+		const code = str.charCodeAt(start);
+		if (code !== 32 && code !== 9) break;
+	} while (++start < end);
+	while (end > start) {
+		const code = str.charCodeAt(end - 1);
+		if (code !== 32 && code !== 9) break;
+		end--;
+	}
+	return str.slice(start, end);
+}
+const NullObject = /* @__PURE__ */ (() => {
+	const C = function() {};
+	C.prototype = Object.create(null);
+	return C;
+})();
+function parse(str, options) {
+	const obj = new NullObject();
+	const len = str.length;
+	if (len < 2) return obj;
+	const dec = options?.decode || decode;
+	const allowMultiple = options?.allowMultiple || false;
+	let index = 0;
+	do {
+		const eqIdx = eqIndex(str, index, len);
+		if (eqIdx === -1) break;
+		const endIdx = endIndex(str, index, len);
+		if (eqIdx > endIdx) {
+			index = str.lastIndexOf(";", eqIdx - 1) + 1;
+			continue;
+		}
+		const key = valueSlice(str, index, eqIdx);
+		if (options?.filter && !options.filter(key)) {
+			index = endIdx + 1;
+			continue;
+		}
+		const val = dec(valueSlice(str, eqIdx + 1, endIdx));
+		if (allowMultiple) {
+			const existing = obj[key];
+			if (existing === void 0) obj[key] = val;
+			else if (Array.isArray(existing)) existing.push(val);
+			else obj[key] = [existing, val];
+		} else if (obj[key] === void 0) obj[key] = val;
+		index = endIdx + 1;
+	} while (index < len);
+	return obj;
+}
+function decode(str) {
+	if (!str.includes("%")) return str;
+	try {
+		return decodeURIComponent(str);
+	} catch {
+		return str;
+	}
+}
+const cookieNameRegExp = /^[\u0021-\u003A\u003C\u003E-\u007E]+$/;
+const cookieValueRegExp = /^[\u0021-\u003A\u003C-\u007E]*$/;
+const domainValueRegExp = /^([.]?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)([.][a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$/i;
+const pathValueRegExp = /^[\u0020-\u003A\u003C-\u007E]*$/;
+const __toString = Object.prototype.toString;
+function serialize(_a0, _a1, _a2) {
+	const isObj = typeof _a0 === "object" && _a0 !== null;
+	const options = isObj ? _a1 : _a2;
+	const stringify = options?.stringify || JSON.stringify;
+	const cookie = isObj ? _a0 : {
+		..._a2,
+		name: _a0,
+		value: _a1 == void 0 ? "" : typeof _a1 === "string" ? _a1 : stringify(_a1)
+	};
+	const enc = options?.encode || encodeURIComponent;
+	if (!cookieNameRegExp.test(cookie.name)) throw new TypeError(`argument name is invalid: ${cookie.name}`);
+	const value = cookie.value ? enc(cookie.value) : "";
+	if (!cookieValueRegExp.test(value)) throw new TypeError(`argument val is invalid: ${cookie.value}`);
+	if (!cookie.secure) {
+		if (cookie.partitioned) throw new TypeError(`Partitioned cookies must have the Secure attribute`);
+		if (cookie.sameSite && String(cookie.sameSite).toLowerCase() === "none") throw new TypeError(`SameSite=None cookies must have the Secure attribute`);
+		if (cookie.name.length > 9 && cookie.name.charCodeAt(0) === 95 && cookie.name.charCodeAt(1) === 95) {
+			const nameLower = cookie.name.toLowerCase();
+			if (nameLower.startsWith("__secure-") || nameLower.startsWith("__host-")) throw new TypeError(`${cookie.name} cookies must have the Secure attribute`);
+		}
+	}
+	if (cookie.name.length > 7 && cookie.name.charCodeAt(0) === 95 && cookie.name.charCodeAt(1) === 95 && cookie.name.toLowerCase().startsWith("__host-")) {
+		if (cookie.path !== "/") throw new TypeError(`__Host- cookies must have Path=/`);
+		if (cookie.domain) throw new TypeError(`__Host- cookies must not have a Domain attribute`);
+	}
+	let str = cookie.name + "=" + value;
+	if (cookie.maxAge !== void 0) {
+		if (!Number.isInteger(cookie.maxAge)) throw new TypeError(`option maxAge is invalid: ${cookie.maxAge}`);
+		str += "; Max-Age=" + Math.max(0, Math.min(cookie.maxAge, COOKIE_MAX_AGE_LIMIT));
+	}
+	if (cookie.domain) {
+		if (!domainValueRegExp.test(cookie.domain)) throw new TypeError(`option domain is invalid: ${cookie.domain}`);
+		str += "; Domain=" + cookie.domain;
+	}
+	if (cookie.path) {
+		if (!pathValueRegExp.test(cookie.path)) throw new TypeError(`option path is invalid: ${cookie.path}`);
+		str += "; Path=" + cookie.path;
+	}
+	if (cookie.expires) {
+		if (!isDate(cookie.expires) || !Number.isFinite(cookie.expires.valueOf())) throw new TypeError(`option expires is invalid: ${cookie.expires}`);
+		str += "; Expires=" + cookie.expires.toUTCString();
+	}
+	if (cookie.httpOnly) str += "; HttpOnly";
+	if (cookie.secure) str += "; Secure";
+	if (cookie.partitioned) str += "; Partitioned";
+	if (cookie.priority) switch (typeof cookie.priority === "string" ? cookie.priority.toLowerCase() : void 0) {
+		case "low":
+			str += "; Priority=Low";
+			break;
+		case "medium":
+			str += "; Priority=Medium";
+			break;
+		case "high":
+			str += "; Priority=High";
+			break;
+		default: throw new TypeError(`option priority is invalid: ${cookie.priority}`);
+	}
+	if (cookie.sameSite) switch (typeof cookie.sameSite === "string" ? cookie.sameSite.toLowerCase() : cookie.sameSite) {
+		case true:
+		case "strict":
+			str += "; SameSite=Strict";
+			break;
+		case "lax":
+			str += "; SameSite=Lax";
+			break;
+		case "none":
+			str += "; SameSite=None";
+			break;
+		default: throw new TypeError(`option sameSite is invalid: ${cookie.sameSite}`);
+	}
+	return str;
+}
+function isDate(val) {
+	return __toString.call(val) === "[object Date]";
+}
+const maxAgeRegExp = /^-?\d+$/;
+const _nullProto = /* @__PURE__ */ Object.getPrototypeOf({});
+function parseSetCookie(str, options) {
+	const len = str.length;
+	let _endIdx = len;
+	let eqIdx = -1;
+	for (let i = 0; i < len; i++) {
+		const c = str.charCodeAt(i);
+		if (c === 59) {
+			_endIdx = i;
+			break;
+		}
+		if (c === 61 && eqIdx === -1) eqIdx = i;
+	}
+	if (eqIdx >= _endIdx) eqIdx = -1;
+	const name = eqIdx === -1 ? "" : _trim(str, 0, eqIdx);
+	if (name && name in _nullProto) return void 0;
+	let value = eqIdx === -1 ? _trim(str, 0, _endIdx) : _trim(str, eqIdx + 1, _endIdx);
+	if (!name && !value) return void 0;
+	if (name.length + value.length > 4096) return void 0;
+	if (options?.decode !== false) value = _decode(value, options?.decode);
+	const setCookie = {
+		name,
+		value
+	};
+	let index = _endIdx + 1;
+	while (index < len) {
+		let endIdx = len;
+		let attrEqIdx = -1;
+		for (let i = index; i < len; i++) {
+			const c = str.charCodeAt(i);
+			if (c === 59) {
+				endIdx = i;
+				break;
+			}
+			if (c === 61 && attrEqIdx === -1) attrEqIdx = i;
+		}
+		if (attrEqIdx >= endIdx) attrEqIdx = -1;
+		const attr = attrEqIdx === -1 ? _trim(str, index, endIdx) : _trim(str, index, attrEqIdx);
+		const val = attrEqIdx === -1 ? void 0 : _trim(str, attrEqIdx + 1, endIdx);
+		if (val === void 0 || val.length <= 1024) switch (attr.toLowerCase()) {
+			case "httponly":
+				setCookie.httpOnly = true;
+				break;
+			case "secure":
+				setCookie.secure = true;
+				break;
+			case "partitioned":
+				setCookie.partitioned = true;
+				break;
+			case "domain":
+				if (val) setCookie.domain = (val.charCodeAt(0) === 46 ? val.slice(1) : val).toLowerCase();
+				break;
+			case "path":
+				setCookie.path = val;
+				break;
+			case "max-age":
+				if (val && maxAgeRegExp.test(val)) setCookie.maxAge = Math.min(Number(val), COOKIE_MAX_AGE_LIMIT);
+				break;
+			case "expires": {
+				if (!val) break;
+				const date = new Date(val);
+				if (Number.isFinite(date.valueOf())) {
+					const maxDate = new Date(Date.now() + COOKIE_MAX_AGE_LIMIT * 1e3);
+					setCookie.expires = date > maxDate ? maxDate : date;
+				}
+				break;
+			}
+			case "priority": {
+				if (!val) break;
+				const priority = val.toLowerCase();
+				if (priority === "low" || priority === "medium" || priority === "high") setCookie.priority = priority;
+				break;
+			}
+			case "samesite": {
+				if (!val) break;
+				const sameSite = val.toLowerCase();
+				if (sameSite === "lax" || sameSite === "strict" || sameSite === "none") setCookie.sameSite = sameSite;
+				else setCookie.sameSite = "lax";
+				break;
+			}
+			default: {
+				const attrLower = attr.toLowerCase();
+				if (attrLower && !(attrLower in _nullProto)) setCookie[attrLower] = val;
+			}
+		}
+		index = endIdx + 1;
+	}
+	return setCookie;
+}
+function _trim(str, start, end) {
+	if (start === end) return "";
+	let s = start;
+	let e = end;
+	while (s < e && (str.charCodeAt(s) === 32 || str.charCodeAt(s) === 9)) s++;
+	while (e > s && (str.charCodeAt(e - 1) === 32 || str.charCodeAt(e - 1) === 9)) e--;
+	return str.slice(s, e);
+}
+function _decode(value, decode) {
+	if (!decode && !value.includes("%")) return value;
+	try {
+		return (decode || decodeURIComponent)(value);
+	} catch {
+		return value;
+	}
+}
+export { parse, parseSetCookie, serialize };

package/dist/adapters/elysia/index.d.mts

@@ -1,19 +1,9 @@
-import { CompositeKey, ContentEncryptionAlgorithm, DeriveKeyOptions, DeriveKeyReturn, Duration, ECDHEphemeralKeyInput, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, GeneratedJWKMap, GeneratedKeyMap, ImportedKey, ImportedKeyMap, JOSEConsumerOptions, JOSELimits, JOSEPayload, JOSEPayloadMode, JOSEPayloadTypeMap, JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyManagementHeaderParameters, JWELibraryHeaderName, JWEMultiDecryptKey, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKMetadata, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHeaderParameters, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JWTTimeClaimOptions, JoseHeaderParameters, KeyManagementAlgorithm, MaxTokenAge, NotBeforeIn, PayloadOf, UnwrapKeyOptions, UnwrapKeyResult, UnwrappingKeyFor, WrapKeyOptions, WrapKeyResult, WrappingKeyFor } from "../../_chunks/index.mjs";
-import { JWESessionConfig, JWESessionHooks, JWSSessionConfig, JWSSessionHooks, SessionClaims, SessionData, SessionDecryptOptions, SessionEncryptOptions, SessionIssueOptions, SessionManager, SessionRecord, SessionSignOptions, SessionState, SessionUpdate, SessionUpdateTrigger, SessionVerifyOptions } from "../../_chunks/_codec-jwe.mjs";
+import { JWESessionConfig, JWESessionHooks, JWSSessionConfig, JWSSessionHooks, OpenedSessionState, SessionClaims, SessionData, SessionDecryptOptions, SessionDefinition, SessionEncryptOptions, SessionIssueOptions, SessionManager, SessionRecord, SessionSignOptions, SessionState, SessionUpdate, SessionUpdateTrigger, SessionVerifyOptions } from "../../_chunks/_codec-jwe.mjs";
+import { CookieAttributes } from "../../_chunks/_cookie-attributes.mjs";
+import { CompositeKey, ContentEncryptionAlgorithm, DeriveJWKOptions, DeriveJWKReturn, DeriveKeyOptions, DeriveKeyReturn, Duration, ECDHEphemeralKeyInput, ExpiresIn, GenerateJWKOptions, GenerateJWKReturn, GenerateKeyAlgorithm, GenerateKeyOptions, GenerateKeyReturn, GeneratedJWKMap, GeneratedKeyMap, ImportedKey, ImportedKeyMap, ImportedPEMJWK, JOSEConsumerOptions, JOSELimits, JOSEPayload, JOSEPayloadMode, JOSEPayloadTypeMap, JWEAsymmetricPrivateJWK, JWEAsymmetricPublicJWK, JWEDecryptJWK, JWEDecryptOptions, JWEDecryptResult, JWEEncryptJWK, JWEEncryptOptions, JWEFlattenedSerialization, JWEGeneralRecipient, JWEGeneralSerialization, JWEHeaderParameters, JWEKeyLookup, JWEKeyManagementHeaderParameters, JWELibraryHeaderName, JWEMultiDecryptKey, JWEMultiDecryptOptions, JWEMultiDecryptResult, JWEMultiEncryptOptions, JWEMultiRecipient, JWEProtectedHeader, JWK, JWKAlgorithm, JWKCacheAdapter, JWKLookupFunction, JWKLookupFunctionHeader, JWKMetadata, JWKPEMAlgorithm, JWKParameters, JWKSet, JWK_AES_Algorithm, JWK_AES_CBC_HMAC, JWK_AES_GCM, JWK_AES_GCM_KW, JWK_AES_KW, JWK_Asymmetric, JWK_Asymmetric_Algorithm, JWK_EC, JWK_ECDH_ES, JWK_ECDSA, JWK_EC_Private, JWK_EC_Public, JWK_HMAC, JWK_OKP, JWK_OKP_Private, JWK_OKP_Public, JWK_OKP_SIGN, JWK_PBES2, JWK_Pair, JWK_Private, JWK_Public, JWK_RSA, JWK_RSA_ENC, JWK_RSA_PSS, JWK_RSA_Private, JWK_RSA_Public, JWK_RSA_SIGN, JWK_Symmetric, JWK_Symmetric_Algorithm, JWK_oct, JWSAlgorithm, JWSAsymmetricPrivateJWK, JWSAsymmetricPublicJWK, JWSFlattenedSerialization, JWSGeneralSerialization, JWSGeneralSignature, JWSHashedAlgorithm, JWSHeaderParameters, JWSKeyLookup, JWSMultiSignOptions, JWSMultiSigner, JWSMultiVerifyAllOptions, JWSMultiVerifyOptions, JWSMultiVerifyOutcome, JWSMultiVerifyResult, JWSProtectedHeader, JWSSignJWK, JWSSignOptions, JWSVerifyJWK, JWSVerifyOptions, JWSVerifyResult, JWT, JWTClaimValidationOptions, JWTClaims, JWTConfirmation, JWTTimeClaimOptions, JoseHeaderParameters, KeyManagementAlgorithm, KeyWrapAlgorithmOf, KeyWrappingAlgorithm, MaxTokenAge, NotBeforeIn, PEMType, PayloadOf, ToPublicJWKReturn, UnwrapKeyOptions, UnwrapKeyResult, UnwrappingKeyFor, WrapKeyOptions, WrapKeyResult, WrappingKeyFor } from "../../_chunks/index.mjs";
 import { thumbprint } from "../../_chunks/index2.mjs";
-import { deriveJWKFromPassword, exportPEM, generateJWK, importPEM } from "../../core/jwk.mjs";
+import { deriveJWKFromPassword, exportPEM, generateJWK, importPEM, toPublicJWK } from "../../core/jwk.mjs";
 import { Elysia } from "elysia";
-interface CookieAttributes {
-  domain?: string;
-  expires?: Date;
-  httpOnly?: boolean;
-  maxAge?: number;
-  path?: string;
-  priority?: "low" | "medium" | "high";
-  sameSite?: boolean | "lax" | "strict" | "none";
-  secure?: boolean;
-  partitioned?: boolean;
-}
 interface ChunkableCookie {
   value: unknown;
   set(config: CookieAttributes & {
@@ -73,6 +63,11 @@ type SessionPlugin<Resolved extends Record<string, unknown>, GuardName extends s
   standaloneSchema: {};
   response: {};
 }>;
+/** A session definition on Elysia, plus the plugin that resolves its manager under `contextKey` (`K`). */
+interface SessionPluginDefinition<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, K extends string = "session"> extends SessionDefinition<T, MaxAge, SessionContext> {
+  /** Resolves the session onto the context under `contextKey`, with the guard macro answering 401 while no session is established. */
+  plugin: () => SessionPlugin<{ [P in K]: SessionManager<T, MaxAge>; }, `require${Capitalize<K>}`>;
+}
 interface SessionJWS<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined> extends SessionState<T, MaxAge> {}
 interface SessionHooksJWS<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TContext extends SessionContext = SessionContext> extends JWSSessionHooks<SessionJWS<T, MaxAge>, SessionManager<T, MaxAge>, {
   context: TContext;
@@ -82,7 +77,18 @@ interface SessionConfigJWS<T extends SessionRecord = SessionClaims, MaxAge exten
   contextKey?: string;
   hooks?: SessionHooksJWS<T, MaxAge, TContext>;
 }
+/** Defines a JWS (signed, not encrypted) session once: `use`, `token`, `issue` and `open` serve every request, `plugin()` mounts it on an app. */
+export declare function defineJWSSession<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, K extends string = "session">(config: SessionConfigJWS<T, MaxAge> & (K extends "session" ? {
+  contextKey?: K;
+} : {
+  contextKey: K;
+})): SessionPluginDefinition<T, MaxAge, K>;
+/**
+ * Create a JWS (signed, not encrypted) session manager for the request.
+ * @deprecated Use `defineJWSSession(config).use(context)`.
+ */
 export declare function createJWSSession<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TContext extends SessionContext = SessionContext>(context: TContext, config: SessionConfigJWS<T, MaxAge, TContext>): Promise<SessionManager<T, MaxAge>>;
+/** The Elysia plugin of a JWS (signed, not encrypted) session: `defineJWSSession(config).plugin()`. */
 export declare function jwsSession<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, K extends string = "session">(config: SessionConfigJWS<T, MaxAge> & (K extends "session" ? {
   contextKey?: K;
 } : {
@@ -97,10 +103,21 @@ interface SessionConfigJWE<T extends SessionRecord = SessionClaims, MaxAge exten
   contextKey?: string;
   hooks?: SessionHooksJWE<T, MaxAge, TContext>;
 }
+/** Defines a JWE (encrypted) session once: `use`, `token`, `issue` and `open` serve every request, `plugin()` mounts it on an app. */
+export declare function defineJWESession<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, K extends string = "session">(config: SessionConfigJWE<T, MaxAge> & (K extends "session" ? {
+  contextKey?: K;
+} : {
+  contextKey: K;
+})): SessionPluginDefinition<T, MaxAge, K>;
+/**
+ * Create a JWE (encrypted) session manager for the request.
+ * @deprecated Use `defineJWESession(config).use(context)`.
+ */
 export declare function createJWESession<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, TContext extends SessionContext = SessionContext>(context: TContext, config: SessionConfigJWE<T, MaxAge, TContext>): Promise<SessionManager<T, MaxAge>>;
+/** The Elysia plugin of a JWE (encrypted) session: `defineJWESession(config).plugin()`. */
 export declare function jweSession<T extends SessionRecord = SessionClaims, MaxAge extends ExpiresIn | undefined = ExpiresIn | undefined, K extends string = "session">(config: SessionConfigJWE<T, MaxAge> & (K extends "session" ? {
   contextKey?: K;
 } : {
   contextKey: K;
 })): SessionPlugin<{ [P in K]: SessionManager<T, MaxAge>; }, `require${Capitalize<K>}`>;
-export { type ChunkableCookie, type ChunkableCookieJar, type CompositeKey, type ContentEncryptionAlgorithm, type CookieAttributes, type DeriveKeyOptions, type DeriveKeyReturn, type Duration, type ECDHEphemeralKeyInput, type ExpiresIn, type GenerateJWKOptions, type GenerateJWKReturn, type GenerateKeyAlgorithm, type GenerateKeyOptions, type GenerateKeyReturn, type GeneratedJWKMap, type GeneratedKeyMap, type ImportedKey, type ImportedKeyMap, type JOSEConsumerOptions, type JOSELimits, type JOSEPayload, type JOSEPayloadMode, type JOSEPayloadTypeMap, type JWEAsymmetricPrivateJWK, type JWEAsymmetricPublicJWK, type JWEDecryptJWK, type JWEDecryptOptions, type JWEDecryptResult, type JWEEncryptJWK, type JWEEncryptOptions, type JWEFlattenedSerialization, type JWEGeneralRecipient, type JWEGeneralSerialization, type JWEHeaderParameters, type JWEKeyManagementHeaderParameters, type JWELibraryHeaderName, type JWEMultiDecryptKey, type JWEMultiDecryptOptions, type JWEMultiDecryptResult, type JWEMultiEncryptOptions, type JWEMultiRecipient, type JWEProtectedHeader, type JWK, type JWKAlgorithm, type JWKCacheAdapter, type JWKLookupFunction, type JWKLookupFunctionHeader, type JWKMetadata, type JWKPEMAlgorithm, type JWKParameters, type JWKSet, type JWK_AES_CBC_HMAC, type JWK_AES_GCM, type JWK_AES_GCM_KW, type JWK_AES_KW, type JWK_Asymmetric, type JWK_Asymmetric_Algorithm, type JWK_EC, type JWK_ECDH_ES, type JWK_ECDSA, type JWK_EC_Private, type JWK_EC_Public, type JWK_HMAC, type JWK_OKP, type JWK_OKP_Private, type JWK_OKP_Public, type JWK_OKP_SIGN, type JWK_PBES2, type JWK_Pair, type JWK_Private, type JWK_Public, type JWK_RSA, type JWK_RSA_ENC, type JWK_RSA_PSS, type JWK_RSA_Private, type JWK_RSA_Public, type JWK_RSA_SIGN, type JWK_Symmetric, type JWK_Symmetric_Algorithm, type JWK_oct, type JWSAlgorithm, type JWSAsymmetricPrivateJWK, type JWSAsymmetricPublicJWK, type JWSFlattenedSerialization, type JWSGeneralSerialization, type JWSGeneralSignature, type JWSHeaderParameters, type JWSMultiSignOptions, type JWSMultiSigner, type JWSMultiVerifyAllOptions, type JWSMultiVerifyOptions, type JWSMultiVerifyOutcome, type JWSMultiVerifyResult, type JWSProtectedHeader, type JWSSignJWK, type JWSSignOptions, type JWSVerifyJWK, type JWSVerifyOptions, type JWSVerifyResult, type JWT, type JWTClaimValidationOptions, type JWTClaims, type JWTTimeClaimOptions, type JoseHeaderParameters, type KeyManagementAlgorithm, type MaxTokenAge, type NotBeforeIn, type PayloadOf, type SessionClaims, type SessionConfigJWE, type SessionConfigJWS, type SessionContext, type SessionData, type SessionDecryptOptions, type SessionEncryptOptions, type SessionHooksJWE, type SessionHooksJWS, type SessionIssueOptions, type SessionJWE, type SessionJWS, type SessionManager, type SessionPlugin, type SessionSignOptions, type SessionUpdate, type SessionUpdateTrigger, type SessionVerifyOptions, type UnwrapKeyOptions, type UnwrapKeyResult, type UnwrappingKeyFor, type WrapKeyOptions, type WrapKeyResult, type WrappingKeyFor, type WriteChunkedCookieOptions, deriveJWKFromPassword, exportPEM, generateJWK, importPEM, thumbprint };
+export { type ChunkableCookie, type ChunkableCookieJar, type CompositeKey, type ContentEncryptionAlgorithm, type CookieAttributes, type DeriveJWKOptions, type DeriveJWKReturn, type DeriveKeyOptions, type DeriveKeyReturn, type Duration, type ECDHEphemeralKeyInput, type ExpiresIn, type GenerateJWKOptions, type GenerateJWKReturn, type GenerateKeyAlgorithm, type GenerateKeyOptions, type GenerateKeyReturn, type GeneratedJWKMap, type GeneratedKeyMap, type ImportedKey, type ImportedKeyMap, type ImportedPEMJWK, type JOSEConsumerOptions, type JOSELimits, type JOSEPayload, type JOSEPayloadMode, type JOSEPayloadTypeMap, type JWEAsymmetricPrivateJWK, type JWEAsymmetricPublicJWK, type JWEDecryptJWK, type JWEDecryptOptions, type JWEDecryptResult, type JWEEncryptJWK, type JWEEncryptOptions, type JWEFlattenedSerialization, type JWEGeneralRecipient, type JWEGeneralSerialization, type JWEHeaderParameters, type JWEKeyLookup, type JWEKeyManagementHeaderParameters, type JWELibraryHeaderName, type JWEMultiDecryptKey, type JWEMultiDecryptOptions, type JWEMultiDecryptResult, type JWEMultiEncryptOptions, type JWEMultiRecipient, type JWEProtectedHeader, type JWK, type JWKAlgorithm, type JWKCacheAdapter, type JWKLookupFunction, type JWKLookupFunctionHeader, type JWKMetadata, type JWKPEMAlgorithm, type JWKParameters, type JWKSet, type JWK_AES_Algorithm, type JWK_AES_CBC_HMAC, type JWK_AES_GCM, type JWK_AES_GCM_KW, type JWK_AES_KW, type JWK_Asymmetric, type JWK_Asymmetric_Algorithm, type JWK_EC, type JWK_ECDH_ES, type JWK_ECDSA, type JWK_EC_Private, type JWK_EC_Public, type JWK_HMAC, type JWK_OKP, type JWK_OKP_Private, type JWK_OKP_Public, type JWK_OKP_SIGN, type JWK_PBES2, type JWK_Pair, type JWK_Private, type JWK_Public, type JWK_RSA, type JWK_RSA_ENC, type JWK_RSA_PSS, type JWK_RSA_Private, type JWK_RSA_Public, type JWK_RSA_SIGN, type JWK_Symmetric, type JWK_Symmetric_Algorithm, type JWK_oct, type JWSAlgorithm, type JWSAsymmetricPrivateJWK, type JWSAsymmetricPublicJWK, type JWSFlattenedSerialization, type JWSGeneralSerialization, type JWSGeneralSignature, type JWSHashedAlgorithm, type JWSHeaderParameters, type JWSKeyLookup, type JWSMultiSignOptions, type JWSMultiSigner, type JWSMultiVerifyAllOptions, type JWSMultiVerifyOptions, type JWSMultiVerifyOutcome, type JWSMultiVerifyResult, type JWSProtectedHeader, type JWSSignJWK, type JWSSignOptions, type JWSVerifyJWK, type JWSVerifyOptions, type JWSVerifyResult, type JWT, type JWTClaimValidationOptions, type JWTClaims, type JWTConfirmation, type JWTTimeClaimOptions, type JoseHeaderParameters, type KeyManagementAlgorithm, type KeyWrapAlgorithmOf, type KeyWrappingAlgorithm, type MaxTokenAge, type NotBeforeIn, type OpenedSessionState, type PEMType, type PayloadOf, type SessionClaims, type SessionConfigJWE, type SessionConfigJWS, type SessionContext, type SessionData, type SessionDecryptOptions, type SessionDefinition, type SessionEncryptOptions, type SessionHooksJWE, type SessionHooksJWS, type SessionIssueOptions, type SessionJWE, type SessionJWS, type SessionManager, type SessionPlugin, type SessionPluginDefinition, type SessionSignOptions, type SessionUpdate, type SessionUpdateTrigger, type SessionVerifyOptions, type ToPublicJWKReturn, type UnwrapKeyOptions, type UnwrapKeyResult, type UnwrappingKeyFor, type WrapKeyOptions, type WrapKeyResult, type WrappingKeyFor, type WriteChunkedCookieOptions, deriveJWKFromPassword, exportPEM, generateJWK, importPEM, thumbprint, toPublicJWK };

package/dist/adapters/elysia/index.mjs

@@ -1,5 +1,5 @@
-import { deriveJWKFromPassword, exportPEM, generateJWK, importPEM, thumbprint } from "../../_chunks/jwk.mjs";
-import { bindSession, createJWECodec, createJWSCodec, invalidConfigError, loadSession, readChunked, recordSlotStore, removeChunked, resolveSessionToken, sessionActions, sessionManager, writeChunked } from "../../_chunks/_codec-jws.mjs";
+import { deriveJWKFromPassword, exportPEM, generateJWK, importPEM, thumbprint, toPublicJWK } from "../../_chunks/jwk.mjs";
+import { createJWECodec, createJWSCodec, defineSession, invalidConfigError } from "../../_chunks/_codec-jws.mjs";
 import { Elysia } from "elysia";
 function sessionPlugin(options) {
 	const contextKey = options.contextKey ?? "session";
@@ -25,21 +25,7 @@ function hasSessionId(session) {
 	return typeof session === "object" && session !== null && "id" in session && Boolean(session.id);
 }
 const PREFIX$1 = "[unjwt/elysia]";
-function readChunkedCookie(jar, name) {
-	return readChunked(cookieStore(jar), name);
-}
-function writeChunkedCookie(jar, name, value, options = {}) {
-	const { chunkMaxLength, ...attrs } = options;
-	writeChunked(cookieStore(jar), name, value, {
-		attrs,
-		chunkMaxLength,
-		prefix: PREFIX$1
-	});
-}
-function removeChunkedCookie(jar, name, attrs = {}) {
-	removeChunked(cookieStore(jar), name, { attrs });
-}
-function cookieStore(jar) {
+function reactiveCookieJar(jar) {
 	return {
 		read: (name) => {
 			const value = jar[name]?.value;
@@ -58,29 +44,12 @@ function reactiveCookie(jar, name) {
 }
 const PREFIX = "[unjwt/elysia]";
 const SESSIONS = /* @__PURE__ */ new WeakMap();
-const elysiaSessionPort = {
+const elysiaSessionDriver = {
 	prefix: PREFIX,
-	carrier: (context) => ({ context }),
-	store: (context, slot) => recordSlotStore(() => requestSessions(context.request), slot),
-	readToken: readSessionToken,
-	scope: (context) => context.request,
-	writable: () => true,
-	setCookie: (context, sessionName, token, { attrs, chunkMaxLength }) => {
-		writeChunkedCookie(context.cookie, sessionName, token, {
-			...attrs,
-			chunkMaxLength
-		});
-	},
-	deleteCookie: (context, sessionName, { attrs }) => {
-		removeChunkedCookie(context.cookie, sessionName, attrs);
-	}
+	state: (context) => requestSessions(context.request),
+	header: (context, name) => context.request.headers.get(name),
+	cookies: (context) => reactiveCookieJar(context.cookie)
 };
-function readSessionToken(context, sessionName, source) {
-	return resolveSessionToken(source, sessionName, {
-		cookie: (name) => readChunkedCookie(context.cookie, name),
-		header: (name) => context.request.headers.get(name)
-	});
-}
 function requestSessions(request) {
 	const existing = SESSIONS.get(request);
 	if (existing) return existing;
@@ -92,48 +61,58 @@ const codec$1 = createJWSCodec({
 	prefix: PREFIX,
 	defaultName: "elysia-jws"
 });
+function defineJWSSession(config) {
+	const definition = define$1(config);
+	return {
+		...definition,
+		plugin: () => sessionPlugin({
+			name: "unjwt/elysia-jws",
+			sessionName: config.name || codec$1.defaultName,
+			contextKey: config.contextKey,
+			create: definition.use
+		})
+	};
+}
 async function createJWSSession(context, config) {
-	const binding = bind$1(context, config);
-	await loadSession(binding);
-	return sessionManager(binding);
+	return define$1(config).use(context);
 }
 function jwsSession(config) {
-	return sessionPlugin({
-		name: "unjwt/elysia-jws",
-		sessionName: config.name || codec$1.defaultName,
-		contextKey: config.contextKey,
-		create: (context) => createJWSSession(context, config)
-	});
+	return defineJWSSession(config).plugin();
 }
-function bind$1(context, config) {
-	return bindSession(context, config, {
-		port: elysiaSessionPort,
-		codec: codec$1,
-		actions: sessionActions()
+function define$1(config) {
+	return defineSession(config, {
+		driver: elysiaSessionDriver,
+		hookArgs: (context) => ({ context }),
+		codec: codec$1
 	});
 }
 const codec = createJWECodec({
 	prefix: PREFIX,
 	defaultName: "elysia-jwe"
 });
+function defineJWESession(config) {
+	const definition = define(config);
+	return {
+		...definition,
+		plugin: () => sessionPlugin({
+			name: "unjwt/elysia-jwe",
+			sessionName: config.name || codec.defaultName,
+			contextKey: config.contextKey,
+			create: definition.use
+		})
+	};
+}
 async function createJWESession(context, config) {
-	const binding = bind(context, config);
-	await loadSession(binding);
-	return sessionManager(binding);
+	return define(config).use(context);
 }
 function jweSession(config) {
-	return sessionPlugin({
-		name: "unjwt/elysia-jwe",
-		sessionName: config.name || codec.defaultName,
-		contextKey: config.contextKey,
-		create: (context) => createJWESession(context, config)
-	});
+	return defineJWESession(config).plugin();
 }
-function bind(context, config) {
-	return bindSession(context, config, {
-		port: elysiaSessionPort,
-		codec,
-		actions: sessionActions()
+function define(config) {
+	return defineSession(config, {
+		driver: elysiaSessionDriver,
+		hookArgs: (context) => ({ context }),
+		codec
 	});
 }
-export { createJWESession, createJWSSession, deriveJWKFromPassword, exportPEM, generateJWK, importPEM, jweSession, jwsSession, thumbprint };
+export { createJWESession, createJWSSession, defineJWESession, defineJWSSession, deriveJWKFromPassword, exportPEM, generateJWK, importPEM, jweSession, jwsSession, thumbprint, toPublicJWK };