unjwt 0.8.1 → 0.8.2

package/dist/_chunks/_codec-jws.mjs

@@ -36,6 +36,9 @@ function expiredSessionError(options) {
 		exp
 	});
 }
+function isTokenFailure(error) {
+	return !(isJWTError(error.cause, "ERR_JWK_KEY_NOT_FOUND") && error.cause.cause !== void 0);
+}
 function rethrowAsInvalidToken(error, options) {
 	if (isJWTError(error, "ERR_JWT_EXPIRED")) throw error;
 	throw invalidTokenError(`${options.prefix} Invalid session token: ${messageOf(error)}`, error);
@@ -43,9 +46,12 @@ function rethrowAsInvalidToken(error, options) {
 const TOKEN = /^[!#$%&'*+\-.^_`|~\w]+$/;
 const CHUNK_SUFFIX = /\.\d+$/;
 function assertSessionName(name, options) {
-	if (typeof name !== "string" || !TOKEN.test(name)) throw invalidConfigError(`${options.prefix} Session "name" must be a cookie name (RFC 6265 §4.1.1): letters, digits and !#$%&'*+-.^_\`|~ only. Got ${quoteTokenValue(name)}.`);
+	if (!isToken(name)) throw invalidConfigError(`${options.prefix} Session "name" must be a cookie name (RFC 6265 §4.1.1): letters, digits and !#$%&'*+-.^_\`|~ only. Got ${quoteTokenValue(name)}.`);
 	if (CHUNK_SUFFIX.test(name)) throw invalidConfigError(`${options.prefix} Session "name" cannot end in a dot and digits: ${quoteTokenValue(name)} is the cookie holding a chunk of the session named ${quoteTokenValue(name.replace(CHUNK_SUFFIX, ""))}.`);
 }
+function isToken(value) {
+	return typeof value === "string" && TOKEN.test(value);
+}
 function assertCookiePrefix(name, attrs, options) {
 	const lower = name.toLowerCase();
 	const host = lower.startsWith("__host-");
@@ -53,24 +59,13 @@ function assertCookiePrefix(name, attrs, options) {
 	const rule = host ? "\"__Host-\" cookie must be Secure, with Path=/ and no Domain" : "\"__Secure-\" cookie must be Secure";
 	if (attrs.secure === false || host && (attrs.domain !== void 0 || attrs.path !== void 0 && attrs.path !== "/")) throw invalidConfigError(`${options.prefix} Session ${quoteTokenValue(name)}: a ${rule} (RFC 6265bis §4.1.3).`);
 }
-function assertSessionHeader(header, options) {
-	if (header === void 0 || header === false) return;
-	if (typeof header === "string" && TOKEN.test(header)) return;
-	throw invalidConfigError(`${options.prefix} Session "sessionHeader" must be false or a header name: letters, digits and !#$%&'*+-.^_\`|~ only. Got ${quoteTokenValue(header)}.`);
-}
 function assertRolling(config, options) {
 	const { rolling } = config;
 	if (rolling === void 0) return;
 	if (config.maxAge === void 0) throw invalidConfigError(`${options.prefix} "rolling" needs a "maxAge" to extend.`);
 	if (rolling === true) return;
 	if (!isExpiresIn(rolling)) throw new JWTError(`${options.prefix} "rolling" must be true or a duration.`, "ERR_INVALID_OPTION");
-	computeDurationInSeconds(rolling);
-}
-function hasTokenSource(source) {
-	return source.cookie !== false || source.sessionHeader !== false;
-}
-function assertTokenSource(source, options) {
-	if (!hasTokenSource(source)) throw invalidConfigError(`${options.prefix} Session has no token source: "cookie" and "sessionHeader" are both disabled.`);
+	if (computeDurationInSeconds(rolling) >= computeDurationInSeconds(config.maxAge)) throw invalidConfigError(`${options.prefix} "rolling" must be shorter than "maxAge": the session would expire before it rolls.`);
 }
 function assertKeyMaterial(key, options) {
 	if (typeof key === "string") throw invalidKeyError(`${options.prefix} Session "key" must be a JWK or a CryptoKey, not a password string. Derive one once with deriveJWKFromPassword() and pass the result.`);
@@ -101,27 +96,6 @@ async function assertImportableKey(key, options) {
 function sessionTyp(configured) {
 	return typeof configured === "string" && configured ? configured : SESSION_TYP;
 }
-function sessionHeaderName(sessionName, configured) {
-	if (typeof configured === "string") return configured.toLowerCase();
-	return `x-${sessionName.replace(/^__(?:host|secure)-/i, "").toLowerCase()}-session`;
-}
-function headerToken(value) {
-	if (typeof value !== "string") return void 0;
-	const words = value.trim().split(/\s+/);
-	const [first = "", second] = words;
-	if (/^bearer$/i.test(first)) return words.length === 2 ? second : void 0;
-	return words.length === 1 && first ? first : void 0;
-}
-function resolveSessionToken(source, sessionName, read) {
-	let cookieValue;
-	if (source.cookie !== false) {
-		const written = read.written?.(sessionName);
-		if (written === "") return void 0;
-		cookieValue = written ?? read.cookie(sessionName);
-	}
-	const headerValue = source.sessionHeader === false ? void 0 : headerToken(read.header(sessionHeaderName(sessionName, source.sessionHeader)));
-	return cookieValue || headerValue || void 0;
-}
 function resolveExpiresAt(createdAt, options) {
 	return options.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(options.maxAge) * 1e3;
 }
@@ -153,7 +127,7 @@ function isExpiresIn(value) {
 function createSessionCodec(spec) {
 	const { prefix } = spec;
 	const alg = (config) => spec.issueOptions(config)?.alg;
-	const keyFor = (config, carrier) => spec.lookup(config, carrier) ?? spec.openKey(config);
+	const keyFor = (config, args) => spec.lookup(config, args) ?? spec.openKey(config);
 	const now = (config) => spec.issueOptions(config)?.currentDate?.getTime() ?? Date.now();
 	const openWith = async (config, token, key) => {
 		const payload = await spec.open(config, token, key).catch((error) => rethrowAsInvalidToken(error, { prefix }));
@@ -189,13 +163,13 @@ function createSessionCodec(spec) {
 			});
 			if (!isSymmetricJWK(key)) await assertOpenKey(config);
 		},
-		opener: (config, carrier) => {
-			const key = keyFor(config, carrier);
+		opener: (config, args) => {
+			const key = keyFor(config, args);
 			return (token) => openWith(config, token, key);
 		},
-		open: async (config, token, carrier) => {
+		open: async (config, token, args) => {
 			await assertOpenKey(config);
-			return openWith(config, token, keyFor(config, carrier));
+			return openWith(config, token, keyFor(config, args));
 		}
 	};
 }
@@ -277,12 +251,12 @@ function createJWECodec(options) {
 		openOptions: (config) => config.jwe?.decryptOptions,
 		issueKey: (config) => getEncryptKey(config, prefix),
 		openKey: (config) => getDecryptKey(config, prefix),
-		lookup: (config, carrier) => {
+		lookup: (config, args) => {
 			const hooks = config.hooks;
 			if (!hooks?.onUnsealKeyLookup) return void 0;
 			return (header) => hooks.onUnsealKeyLookup?.({
 				header,
-				...carrier,
+				...args,
 				config
 			});
 		},
@@ -353,43 +327,245 @@ function assertPinnedAlgEnc(key, config, prefix) {
 		hint: "\"jwe.encryptOptions.alg\" and \"enc\""
 	});
 }
-const kSessionPending = Symbol("unjwt_session_pending");
-function bindSession(carrier, config, options) {
-	const { port, codec, actions } = options;
+const CHUNK_MARKER = "__chunked__";
+const DEFAULT_CHUNK_MAX_LENGTH = 4e3;
+function readChunked(store, name) {
+	const main = store.read(name);
+	if (main === void 0) return void 0;
+	if (!main.startsWith("__chunked__")) return main;
+	const count = parseChunkCount(main);
+	if (count === 0) return void 0;
+	const parts = [];
+	for (let index = 1; index <= count; index++) {
+		const part = store.read(chunkName(name, index));
+		if (part === void 0) return void 0;
+		parts.push(part);
+	}
+	return parts.join("");
+}
+function writeChunked(store, name, value, options) {
+	const { attrs, chunkMaxLength, prefix } = options;
+	const max = chunkMaxLength && chunkMaxLength > 0 ? chunkMaxLength : DEFAULT_CHUNK_MAX_LENGTH;
+	const chunkCount = Math.ceil(value.length / max);
+	if (chunkCount > 16) throw invalidConfigError(`${prefix} Session token requires ${chunkCount} cookie chunks, exceeding the limit of 16.`);
+	const previousCount = parseChunkCount(store.read(name));
+	const firstSurplus = chunkCount <= 1 ? 1 : chunkCount + 1;
+	for (let index = firstSurplus; index <= previousCount; index++) expire(store, chunkName(name, index), attrs);
+	if (chunkCount <= 1) {
+		store.write(name, value, attrs);
+		return;
+	}
+	store.write(name, `${CHUNK_MARKER}${chunkCount}`, attrs);
+	for (let index = 1; index <= chunkCount; index++) store.write(chunkName(name, index), value.slice((index - 1) * max, index * max), attrs);
+}
+function removeChunked(store, name, options) {
+	const count = parseChunkCount(store.read(name));
+	expire(store, name, options.attrs);
+	for (let index = 1; index <= count; index++) expire(store, chunkName(name, index), options.attrs);
+}
+function setCookieValues(setCookies) {
+	const cookies = Object.create(null);
+	for (const setCookie of setCookies) {
+		const pair = setCookiePair(setCookie);
+		if (pair) cookies[pair.name] = decodeValue(pair.value);
+	}
+	return cookies;
+}
+function setCookieName(setCookie) {
+	return setCookiePair(setCookie)?.name;
+}
+function chunkName(name, index) {
+	return `${name}.${index}`;
+}
+function parseChunkCount(main) {
+	if (main === void 0 || !main.startsWith("__chunked__")) return 0;
+	const suffix = main.slice(11);
+	if (!/^\d+$/.test(suffix)) return 0;
+	const count = Number.parseInt(suffix, 10);
+	if (count < 1 || count > 16) return 0;
+	return count;
+}
+function expire(store, name, attrs) {
+	store.write(name, "", {
+		...attrs,
+		maxAge: 0,
+		expires: /* @__PURE__ */ new Date(0)
+	});
+}
+function setCookiePair(setCookie) {
+	const [pair = ""] = setCookie.split(";", 1);
+	const separator = pair.indexOf("=");
+	if (separator === -1) return void 0;
+	return {
+		name: pair.slice(0, separator).trim(),
+		value: pair.slice(separator + 1).trim()
+	};
+}
+function decodeValue(value) {
+	if (!value.includes("%")) return value;
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		return value;
+	}
+}
+function resolveTransport(driver, context, options) {
+	const handed = driver.handed?.(context);
+	if (handed) return {
+		read: () => handed.token,
+		readonly: false,
+		writable: () => true
+	};
+	const { config, name } = options;
+	const header = headerReader(driver, context, options);
+	if (config.cookie === false) return {
+		read: header,
+		readonly: false,
+		writable: () => true
+	};
+	const jar = driver.cookies(context);
+	const store = responseStore(jar);
+	const transport = {
+		read: () => {
+			const written = jar.written ? readChunked({ read: (key) => jar.written?.(key) }, name) : void 0;
+			if (written === "") return void 0;
+			return (written ?? readChunked(jar, name)) || header?.() || void 0;
+		},
+		readonly: !store,
+		writable: () => driver.writable?.(context) ?? true
+	};
+	if (!store) return transport;
+	transport.write = (token, { attrs, chunkMaxLength }) => {
+		writeChunked(store, name, token, {
+			attrs,
+			chunkMaxLength,
+			prefix: driver.prefix
+		});
+	};
+	transport.drop = ({ attrs }) => {
+		removeChunked(store, name, { attrs });
+	};
+	return transport;
+}
+function assertTokenSource(transport, options) {
+	if (!transport.read) throw invalidConfigError(`${options.prefix} Session has no token source: "cookie" and "sessionHeader" are both disabled.`);
+}
+function assertWritable(transport, options) {
+	const { operation, prefix } = options;
+	if (operation === "update" && transport.readonly) throw readOnlyEventError(`${prefix} Cannot update session on read-only event.`);
+	if (!transport.writable()) throw readOnlyEventError(`${prefix} Cannot update/clear session: the response was already sent.`);
+}
+function assertSessionHeader(header, options) {
+	if (header === void 0 || typeof header === "boolean") return;
+	if (isToken(header)) return;
+	throw invalidConfigError(`${options.prefix} Session "sessionHeader" must be true, false or a header name: letters, digits and !#$%&'*+-.^_\`|~ only. Got ${quoteTokenValue(header)}.`);
+}
+function sessionHeaderName(sessionName, configured) {
+	if (typeof configured === "string") return configured.toLowerCase();
+	return `x-${sessionName.replace(/^__(?:host|secure)-/i, "").toLowerCase()}-session`;
+}
+function headerToken(value) {
+	if (typeof value !== "string") return void 0;
+	const words = value.trim().split(/\s+/);
+	const [first = "", second] = words;
+	if (/^bearer$/i.test(first)) return words.length === 2 ? second : void 0;
+	return words.length === 1 && first ? first : void 0;
+}
+function headerReader(driver, context, options) {
+	const { config, name } = options;
+	if (config.sessionHeader === false) return void 0;
+	const header = sessionHeaderName(name, config.sessionHeader);
+	return () => headerToken(driver.header(context, header));
+}
+function responseStore(jar) {
+	const write = jar.write?.bind(jar);
+	if (!write) return void 0;
+	return {
+		read: (name) => jar.written?.(name) ?? jar.read(name),
+		write
+	};
+}
+const kSessionNames = Symbol("unjwt_session_names");
+function bindSession(context, config, options) {
+	const { driver, codec, actions, hookArgs } = options;
+	const { prefix } = driver;
 	const name = config.name || codec.defaultName;
-	assertSessionName(name, { prefix: port.prefix });
-	assertSessionHeader(config.sessionHeader, { prefix: port.prefix });
+	assertSessionName(name, { prefix });
+	assertSessionHeader(config.sessionHeader, { prefix });
 	if (config.cookie !== false) assertCookiePrefix(name, {
 		...codec.defaultCookie,
 		...config.cookie
-	}, { prefix: port.prefix });
-	assertRolling(config, { prefix: port.prefix });
-	claimSessionName(port.scope(carrier), name, codec.family, port.prefix);
+	}, { prefix });
+	assertRolling(config, { prefix });
+	const record = driver.state(context);
+	claimSessionName(record, {
+		name,
+		family: codec.family,
+		prefix
+	});
 	return {
-		carrier,
+		context,
 		config,
-		port,
+		driver,
 		codec,
 		actions,
 		name,
-		args: port.carrier(carrier),
-		store: port.store(carrier, `${codec.family}:${name}`)
+		args: hookArgs(context),
+		store: recordSlotStore(record, `${codec.family}:${name}`),
+		transport: resolveTransport(driver, context, {
+			config,
+			name
+		})
 	};
 }
 function sessionToken(binding) {
-	assertTokenSource(binding.config, { prefix: binding.port.prefix });
-	return binding.port.readToken(binding.carrier, binding.name, binding.config);
+	const { transport } = binding;
+	assertTokenSource(transport, { prefix: binding.driver.prefix });
+	return transport.read();
 }
 function recordSlotStore(record, slot) {
 	return {
-		get: () => record()[slot],
+		get: () => record[slot],
 		set: (state) => {
-			record()[slot] = state;
+			record[slot] = state;
 		}
 	};
 }
-function sessionInstant(binding) {
-	const now = binding.codec.now(binding.config);
+function sessionCookie(binding, options = {}) {
+	const { chunkMaxLength, ...configured } = binding.config.cookie || {};
+	const attrs = {
+		...binding.codec.defaultCookie,
+		...configured
+	};
+	if (options.expiresAt !== void 0) {
+		attrs.expires = new Date(options.expiresAt);
+		attrs.maxAge = void 0;
+	}
+	return {
+		attrs,
+		chunkMaxLength
+	};
+}
+function dropSessionCookie(binding) {
+	const { transport } = binding;
+	if (!transport.drop || !transport.writable()) return;
+	transport.drop(sessionCookie(binding));
+}
+function claimSessionName(record, options) {
+	const { name, family, prefix } = options;
+	const holder = record;
+	const registry = holder[kSessionNames] ||= /* @__PURE__ */ new Map();
+	const held = registry.get(name);
+	if (held === void 0) {
+		registry.set(name, family);
+		return;
+	}
+	if (held === family) return;
+	throw invalidConfigError(`${prefix} Session name "${name}" is already used by a ${held.toUpperCase()} session on this request; a name is one cookie, so give this session a "name" of its own.`);
+}
+const kSessionPending = Symbol("unjwt_session_pending");
+function sessionInstant(source) {
+	const now = source.codec.now(source.config);
 	return now - now % 1e3;
 }
 function mintSessionId(config) {
@@ -416,54 +592,19 @@ function blankSession() {
 	});
 }
 function openSessionToken(codec, config, options) {
-	return codec.open(config, options.token, options.carrier).then(typedSession);
-}
-function sessionCookie(binding, options = {}) {
-	const { chunkMaxLength, ...configured } = binding.config.cookie || {};
-	const attrs = {
-		...binding.codec.defaultCookie,
-		...configured
-	};
-	if (options.expiresAt !== void 0) {
-		attrs.expires = new Date(options.expiresAt);
-		attrs.maxAge = void 0;
-	}
-	return {
-		attrs,
-		chunkMaxLength
-	};
-}
-function dropSessionCookie(binding) {
-	const { config, port, carrier } = binding;
-	if (config.cookie === false) return;
-	if (!port.writable(carrier)) {
-		console.warn(`${port.prefix} Session expired but cookie cannot be cleared on a read-only event.`);
-		return;
-	}
-	port.deleteCookie(carrier, binding.name, sessionCookie(binding));
-}
-const SESSION_NAMES = /* @__PURE__ */ new WeakMap();
-function claimSessionName(scope, name, family, prefix) {
-	let registry = SESSION_NAMES.get(scope);
-	if (!registry) {
-		registry = /* @__PURE__ */ new Map();
-		SESSION_NAMES.set(scope, registry);
-	}
-	const holder = registry.get(name);
-	if (holder === void 0) {
-		registry.set(name, family);
-		return;
-	}
-	if (holder === family) return;
-	throw invalidConfigError(`${prefix} Session name "${name}" is already used by a ${holder.toUpperCase()} session on this request; a name is one cookie, so give this session a "name" of its own.`);
+	return codec.open(config, options.token, options.args).then(typedOpened);
 }
 function typedSession(state) {
 	return state;
 }
+function typedOpened(opened) {
+	return opened;
+}
 async function loadSession(binding) {
-	const { config, codec, store, args } = binding;
+	const { config, codec, store, args, transport } = binding;
 	await codec.assertKeys(config);
 	const open = codec.opener(config, args);
+	assertTokenSource(transport, { prefix: binding.driver.prefix });
 	const existing = storedSession(store);
 	if (existing) {
 		const session = existing[kSessionPending] ? await existing[kSessionPending] : existing;
@@ -489,7 +630,7 @@ async function loadSession(binding) {
 	}
 	const session = emptySession(binding);
 	store.set(session);
-	const token = sessionToken(binding);
+	const token = transport.read();
 	if (!token) return session;
 	session.token = token;
 	const pending = open(token).then((opened) => {
@@ -517,12 +658,15 @@ async function loadSession(binding) {
 				},
 				error: failure.error
 			});
-		} else await config.hooks?.onError?.({
-			session: binding.actions.manager(binding),
-			...args,
-			error: failure.error,
-			config
-		});
+		} else {
+			if (isJWTError(failure.error, "ERR_SESSION_TOKEN_INVALID") && isTokenFailure(failure.error)) dropSessionCookie(binding);
+			await config.hooks?.onError?.({
+				session: binding.actions.manager(binding),
+				...args,
+				error: failure.error,
+				config
+			});
+		}
 		return session;
 	}
 	await fireRead(binding, session);
@@ -538,17 +682,14 @@ async function fireRead(binding, session) {
 	});
 }
 async function rollSession(binding, session) {
-	const { config, codec, port, carrier, store } = binding;
+	const { config, codec, transport, store } = binding;
 	const { rolling } = config;
 	if (rolling === void 0 || store.get() !== session) return;
 	if (session.token === void 0 || session.expiresAt === void 0) return;
 	if (rolling !== true) {
-		if (session.expiresAt - codec.now(config) >= computeDurationInSeconds(rolling) * 1e3) return;
-	}
-	if (config.cookie !== false && !port.writable(carrier)) {
-		console.warn(`${port.prefix} Session not rolled: cookie cannot be written on a read-only event.`);
-		return;
+		if (codec.now(config) - session.createdAt < computeDurationInSeconds(rolling) * 1e3) return;
 	}
+	if (transport.readonly || !transport.writable()) return;
 	await binding.actions.roll(binding);
 }
 async function fireExpire(binding, expired) {
@@ -560,22 +701,25 @@ async function fireExpire(binding, expired) {
 	});
 }
 async function encodeSession(binding) {
-	const { config, codec, store } = binding;
+	const { config, codec, store, transport } = binding;
 	await codec.assertKeys(config);
 	const issue = codec.issuer(config);
-	const session = storedSession(store) || (hasTokenSource(config) ? await loadSession(binding) : emptySession(binding));
+	const session = storedSession(store) || (transport.read ? await loadSession(binding) : emptySession(binding));
 	return issue(session.id === void 0 ? {
 		...session,
 		id: mintSessionId(config)
 	} : session);
 }
 async function issueSession(binding, update, options, trigger = "update") {
-	const { config, port, store, args } = binding;
-	assertWritable(binding, "update");
+	const { config, driver, store, args, transport } = binding;
+	assertWritable(transport, {
+		operation: "update",
+		prefix: driver.prefix
+	});
 	const session = storedSession(store) || await loadSession(binding);
 	const oldSession = snapshotSession(session);
 	const resolved = typeof update === "function" ? update(session.data) : update;
-	if (resolved) Object.assign(session.data, sanitizeSessionUpdate(resolved, { prefix: port.prefix }));
+	if (resolved) Object.assign(session.data, sanitizeSessionUpdate(resolved, { prefix: driver.prefix }));
 	for (const claim of RESERVED_CLAIMS) delete session.data[claim];
 	const maxAge = options?.maxAge ?? config.maxAge;
 	const createdAt = sessionInstant(binding);
@@ -588,7 +732,7 @@ async function issueSession(binding, update, options, trigger = "update") {
 	let issued;
 	try {
 		const token = await encodeSession(binding);
-		if (config.cookie !== false) port.setCookie(binding.carrier, binding.name, token, sessionCookie(binding, { expiresAt: session.expiresAt }));
+		transport.write?.(token, sessionCookie(binding, { expiresAt: session.expiresAt }));
 		issued = Object.assign(session, {
 			id,
 			token
@@ -619,14 +763,17 @@ async function issueSession(binding, update, options, trigger = "update") {
 	return issued;
 }
 async function dropSession(binding) {
-	const { config, port, store, args } = binding;
-	assertTokenSource(config, { prefix: port.prefix });
-	assertWritable(binding, "clear");
+	const { config, driver, store, args, transport } = binding;
+	assertTokenSource(transport, { prefix: driver.prefix });
+	assertWritable(transport, {
+		operation: "clear",
+		prefix: driver.prefix
+	});
 	let session = storedSession(store);
 	if (session && session[kSessionPending]) session = await session[kSessionPending];
 	const oldSession = session && (session.id !== void 0 || session.token !== void 0) ? snapshotSession(session) : void 0;
 	store.set(emptySession(binding));
-	if (config.cookie !== false) port.deleteCookie(binding.carrier, binding.name, sessionCookie(binding));
+	transport.drop?.(sessionCookie(binding));
 	await config.hooks?.onClear?.({
 		oldSession,
 		...args,
@@ -672,122 +819,49 @@ function sessionActions() {
 		}
 	};
 }
-function assertWritable(binding, operation) {
-	const { config, port, carrier } = binding;
-	if (config.cookie !== false && !port.writable(carrier)) throw readOnlyEventError(`${port.prefix} Cannot ${operation} session on read-only event.`);
-}
 function snapshotSession(session) {
 	return {
 		...session,
 		data: sanitizeObjectCopy(session.data)
 	};
 }
-const CHUNK_MARKER = "__chunked__";
-const DEFAULT_CHUNK_MAX_LENGTH = 4e3;
-function responseCookieStore(cookies) {
-	return {
-		read: (name) => setCookieValues(cookies.response())[name] ?? cookies.request(name),
-		write: cookies.write
-	};
-}
-function readChunked(store, name) {
-	const main = store.read(name);
-	if (main === void 0) return void 0;
-	if (!main.startsWith("__chunked__")) return main;
-	const count = parseChunkCount(main);
-	if (count === 0) return void 0;
-	const parts = [];
-	for (let index = 1; index <= count; index++) {
-		const part = store.read(chunkName(name, index));
-		if (part === void 0) return void 0;
-		parts.push(part);
-	}
-	return parts.join("");
-}
-function writeChunked(store, name, value, options) {
-	const { attrs, chunkMaxLength, prefix } = options;
-	const max = chunkMaxLength && chunkMaxLength > 0 ? chunkMaxLength : DEFAULT_CHUNK_MAX_LENGTH;
-	const chunkCount = Math.ceil(value.length / max);
-	if (chunkCount > 16) throw invalidConfigError(`${prefix} Session token requires ${chunkCount} cookie chunks, exceeding the limit of 16.`);
-	const previousCount = parseChunkCount(store.read(name));
-	const firstSurplus = chunkCount <= 1 ? 1 : chunkCount + 1;
-	for (let index = firstSurplus; index <= previousCount; index++) expire(store, chunkName(name, index), attrs);
-	if (chunkCount <= 1) {
-		store.write(name, value, attrs);
-		return;
-	}
-	store.write(name, `${CHUNK_MARKER}${chunkCount}`, attrs);
-	for (let index = 1; index <= chunkCount; index++) store.write(chunkName(name, index), value.slice((index - 1) * max, index * max), attrs);
-}
-function removeChunked(store, name, options) {
-	const count = parseChunkCount(store.read(name));
-	expire(store, name, options.attrs);
-	for (let index = 1; index <= count; index++) expire(store, chunkName(name, index), options.attrs);
-}
-function readChunkedBy(read, name) {
-	return readChunked({
-		read,
-		write: noop
-	}, name);
-}
-function readChunkedFrom(cookies, name) {
-	return readChunkedBy((key) => cookies[key], name);
-}
-function readChunkedFromSetCookie(setCookies, name) {
-	const cookies = setCookieValues(setCookies);
-	if (cookies[name] === void 0) return void 0;
-	return readChunkedFrom(cookies, name);
-}
-function setCookieValues(setCookies) {
-	const cookies = Object.create(null);
-	for (const setCookie of setCookies) {
-		const pair = setCookiePair(setCookie);
-		if (pair) cookies[pair.name] = decodeValue(pair.value);
-	}
-	return cookies;
-}
-function setCookieName(setCookie) {
-	return setCookiePair(setCookie)?.name;
-}
-function chunkName(name, index) {
-	return `${name}.${index}`;
-}
-function isChunkName(cookieName, name) {
-	return cookieName.startsWith(`${name}.`) && /^\d+$/.test(cookieName.slice(name.length + 1));
-}
-function parseChunkCount(main) {
-	if (main === void 0 || !main.startsWith("__chunked__")) return 0;
-	const suffix = main.slice(11);
-	if (!/^\d+$/.test(suffix)) return 0;
-	const count = Number.parseInt(suffix, 10);
-	if (count < 1 || count > 16) return 0;
-	return count;
-}
-function expire(store, name, attrs) {
-	store.write(name, "", {
-		...attrs,
-		maxAge: 0,
-		expires: /* @__PURE__ */ new Date(0)
+function defineSession(config, options) {
+	const { driver, codec, hookArgs } = options;
+	const actions = sessionActions();
+	const bind = (context) => bindSession(context, config, {
+		driver,
+		codec,
+		actions,
+		hookArgs
 	});
-}
-function setCookiePair(setCookie) {
-	const [pair = ""] = setCookie.split(";", 1);
-	const separator = pair.indexOf("=");
-	if (separator === -1) return void 0;
 	return {
-		name: pair.slice(0, separator).trim(),
-		value: pair.slice(separator + 1).trim()
+		use: async (context) => {
+			const binding = bind(context);
+			await loadSession(binding);
+			return sessionManager(binding);
+		},
+		token: (context) => sessionToken(bind(context)),
+		issue: async (data, issueOptions) => {
+			await codec.assertKeys(config);
+			const issue = codec.issuer(config);
+			const createdAt = sessionInstant({
+				codec,
+				config
+			});
+			return issue({
+				id: mintSessionId(config),
+				createdAt,
+				expiresAt: resolveExpiresAt(createdAt, { maxAge: issueOptions?.maxAge ?? config.maxAge }),
+				data: sanitizeSessionUpdate(data ?? {}, { prefix: driver.prefix }),
+				token: void 0
+			});
+		},
+		open: (token) => openSessionToken(codec, config, {
+			token,
+			args: {}
+		})
 	};
 }
-function decodeValue(value) {
-	if (!value.includes("%")) return value;
-	try {
-		return decodeURIComponent(value);
-	} catch {
-		return value;
-	}
-}
-function noop() {}
 const JWS_DEFAULT_COOKIE = {
 	path: "/",
 	secure: true,
@@ -805,12 +879,12 @@ function createJWSCodec(options) {
 		openOptions: (config) => config.jws?.verifyOptions,
 		issueKey: (config) => getSignKey(config, prefix),
 		openKey: (config) => getVerifyKey(config, prefix),
-		lookup: (config, carrier) => {
+		lookup: (config, args) => {
 			const hooks = config.hooks;
 			if (!hooks?.onVerifyKeyLookup) return void 0;
 			return (header) => hooks.onVerifyKeyLookup?.({
 				header,
-				...carrier,
+				...args,
 				config
 			});
 		},
@@ -875,4 +949,4 @@ function assertPinnedAlg(key, config, prefix) {
 		hint: "\"jws.signOptions.alg\""
 	});
 }
-export { bindSession, createJWECodec, createJWSCodec, dropSession, encodeSession, invalidConfigError, isChunkName, issueSession, loadSession, openSessionToken, readChunked, readChunkedBy, readChunkedFrom, readChunkedFromSetCookie, recordSlotStore, removeChunked, resolveSessionToken, responseCookieStore, sessionActions, sessionManager, sessionToken, setCookieName, writeChunked };
+export { bindSession, createJWECodec, createJWSCodec, defineSession, dropSession, encodeSession, invalidConfigError, issueSession, loadSession, openSessionToken, sessionActions, setCookieName, setCookieValues };