unjwt 0.8.5 → 0.9.1

package/dist/_chunks/codec-jws.mjs

@@ -1,1005 +0,0 @@
-import { safeJsonParse } from "./libs/unsecure.mjs";
-import { JWTError, isJWTError } from "../error.mjs";
-import { computeDurationInSeconds, expiredClaimMessage, isCryptoKey, isJWK, isJWKSet, isPlainObject, isPrivateJWK, isPublicJWK, isSymmetricJWK, quoteTokenValue } from "./jwt.mjs";
-import { importKey } from "./algorithms.mjs";
-import { sign, verify } from "./jws.mjs";
-import { decrypt, encrypt } from "./jwe.mjs";
-import { toPublicJWK } from "./export.mjs";
-const RESERVED_CLAIMS = [
-	"jti",
-	"iat",
-	"exp",
-	"nbf"
-];
-const SESSION_TYP = "session+jwt";
-const FORBIDDEN_KEYS = [
-	"__proto__",
-	"constructor",
-	"prototype"
-];
-const importedKeys = /* @__PURE__ */ new WeakMap();
-function invalidKeyError(message, cause) {
-	return new JWTError(message, "ERR_SESSION_KEY_INVALID", cause);
-}
-function invalidConfigError(message, cause) {
-	return new JWTError(message, "ERR_SESSION_CONFIG_INVALID", cause);
-}
-function invalidTokenError(message, cause) {
-	return new JWTError(message, "ERR_SESSION_TOKEN_INVALID", cause);
-}
-function readOnlyEventError(message) {
-	return new JWTError(message, "ERR_SESSION_READONLY_EVENT");
-}
-function expiredSessionError(options) {
-	const { id, createdAt, expiresAt } = options;
-	const exp = Math.floor(expiresAt / 1e3);
-	const iat = createdAt === void 0 ? void 0 : Math.floor(createdAt / 1e3);
-	return new JWTError(expiredClaimMessage(exp), "ERR_JWT_EXPIRED", {
-		jti: id,
-		iat,
-		exp
-	});
-}
-function isTokenFailure(error) {
-	return !(isJWTError(error.cause, "ERR_JWK_KEY_NOT_FOUND") && error.cause.cause !== void 0);
-}
-function rethrowAsInvalidToken(error, options) {
-	if (isJWTError(error, "ERR_JWT_EXPIRED")) throw error;
-	throw invalidTokenError(`${options.prefix} Invalid session token: ${messageOf(error)}`, error);
-}
-const TOKEN = /^[!#$%&'*+\-.^_`|~\w]+$/;
-const CHUNK_SUFFIX = /\.\d+$/;
-function assertSessionName(name, options) {
-	if (!isToken(name)) throw invalidConfigError(`${options.prefix} Session "name" must be a valid cookie name (got ${quoteTokenValue(name)}).`);
-	if (CHUNK_SUFFIX.test(name)) throw invalidConfigError(`${options.prefix} Session "name" ${quoteTokenValue(name)} cannot end in a dot and digits.`);
-}
-function isToken(value) {
-	return typeof value === "string" && TOKEN.test(value);
-}
-function assertCookiePrefix(name, attrs, options) {
-	const lower = name.toLowerCase();
-	const host = lower.startsWith("__host-");
-	if (!host && !lower.startsWith("__secure-")) return;
-	const rule = host ? "\"__Host-\" cookie must be Secure, with Path=/ and no Domain" : "\"__Secure-\" cookie must be Secure";
-	if (attrs.secure === false || host && (attrs.domain !== void 0 || attrs.path !== void 0 && attrs.path !== "/")) throw invalidConfigError(`${options.prefix} Session ${quoteTokenValue(name)}: a ${rule}.`);
-}
-function assertRolling(config, options) {
-	const { rolling } = config;
-	if (rolling === void 0) return;
-	if (config.maxAge === void 0) throw invalidConfigError(`${options.prefix} "rolling" needs a "maxAge" to extend.`);
-	if (rolling === true) return;
-	if (!isExpiresIn(rolling)) throw new JWTError(`${options.prefix} "rolling" must be true or a duration.`, "ERR_INVALID_OPTION");
-	if (computeDurationInSeconds(rolling) >= computeDurationInSeconds(config.maxAge)) throw invalidConfigError(`${options.prefix} "rolling" must be shorter than "maxAge".`);
-}
-function assertKeyMaterial(key, options) {
-	if (typeof key === "string") throw invalidKeyError(`${options.prefix} Session "key" cannot be a string, use deriveJWKFromPassword().`);
-	if (!key) throw invalidKeyError(`${options.prefix} Session "key" is required.`);
-}
-async function assertImportableKey(key, options) {
-	if (!isJWK(key)) return;
-	const alg = key.alg ?? options.alg;
-	if (key.kty !== "oct" && !alg) return;
-	let imports = importedKeys.get(key);
-	if (!imports) {
-		imports = /* @__PURE__ */ new Map();
-		importedKeys.set(key, imports);
-	}
-	const slot = alg ?? "";
-	let pending = imports.get(slot);
-	if (!pending) {
-		pending = importKey(key, { alg }).then(() => void 0);
-		imports.set(slot, pending);
-	}
-	try {
-		await pending;
-	} catch (error) {
-		if (imports.get(slot) === pending) imports.delete(slot);
-		throw invalidKeyError(`${options.prefix} Invalid session key: ${messageOf(error)}`, error);
-	}
-}
-function sessionTyp(configured) {
-	return typeof configured === "string" && configured ? configured : SESSION_TYP;
-}
-function resolveExpiresAt(createdAt, options) {
-	return options.maxAge === void 0 ? void 0 : createdAt + computeDurationInSeconds(options.maxAge) * 1e3;
-}
-function sessionRequiredClaims(configured, options) {
-	const required = /* @__PURE__ */ new Set([
-		...configured || [],
-		"jti",
-		"iat"
-	]);
-	if (options.maxAge !== void 0) required.add("exp");
-	return [...required];
-}
-function sanitizeSessionUpdate(update, options) {
-	if (!isPlainObject(update)) throw new JWTError(`${options.prefix} Session data must be a plain object.`, "ERR_INVALID_OPTION");
-	const sanitized = Object.create(null);
-	for (const key of Object.keys(update)) {
-		if (FORBIDDEN_KEYS.includes(key)) throw new JWTError(`${options.prefix} Session data cannot carry the key "${key}".`, "ERR_INVALID_OPTION");
-		if (RESERVED_CLAIMS.includes(key)) continue;
-		sanitized[key] = update[key];
-	}
-	return sanitized;
-}
-function messageOf(error) {
-	return error instanceof Error ? error.message : String(error);
-}
-function isExpiresIn(value) {
-	return typeof value === "number" || typeof value === "string";
-}
-function createSessionCodec(spec) {
-	const { prefix } = spec;
-	const alg = (config) => spec.issueOptions(config)?.alg;
-	const keyFor = (config, args) => spec.lookup(config, args) ?? spec.openKey(config);
-	const now = (config) => spec.issueOptions(config)?.currentDate?.getTime() ?? Date.now();
-	const openWith = async (config, token, key) => {
-		const payload = await spec.open(config, token, key).catch((error) => rethrowAsInvalidToken(error, { prefix }));
-		const clock = {
-			now: now(config),
-			clockTolerance: spec.openOptions(config)?.clockTolerance
-		};
-		assertNotFromTheFuture(payload, {
-			...clock,
-			prefix
-		});
-		const opened = openedSession(payload, { maxAge: config.maxAge });
-		assertNotPastMaxAge(opened, clock);
-		return opened;
-	};
-	const assertOpenKey = async (config) => {
-		if (spec.lookup(config, {})) return;
-		const key = spec.openKey(config);
-		for (const candidate of spec.importable ? spec.importable(key) : [key]) await assertImportableKey(candidate, {
-			alg: alg(config),
-			prefix
-		});
-	};
-	return {
-		family: spec.family,
-		defaultName: spec.defaultName,
-		defaultCookie: spec.defaultCookie,
-		now,
-		issuer: (config) => {
-			const key = spec.issueKey(config);
-			return (state) => spec.issue(config, sessionPayload(state), key);
-		},
-		assertKeys: async (config) => {
-			const key = spec.issueKey(config);
-			await assertImportableKey(key, {
-				alg: alg(config),
-				prefix
-			});
-			if (!isSymmetricJWK(key)) await assertOpenKey(config);
-		},
-		opener: (config, args) => {
-			const key = keyFor(config, args);
-			return (token) => openWith(config, token, key);
-		},
-		open: async (config, token, args) => {
-			await assertOpenKey(config);
-			return openWith(config, token, keyFor(config, args));
-		}
-	};
-}
-function sessionIssueOptions(options) {
-	return Object.assign({}, options, {
-		expiresIn: void 0,
-		expiresAt: void 0,
-		notBeforeIn: void 0,
-		notBeforeAt: void 0,
-		protectedHeader: {
-			...options?.protectedHeader,
-			typ: sessionTyp(options?.protectedHeader?.typ)
-		}
-	});
-}
-function sessionOpenOptions(options) {
-	const { maxAge, requiredClaims, typ, alg } = options;
-	return {
-		requiredClaims: sessionRequiredClaims(requiredClaims, { maxAge }),
-		typ: sessionTyp(typ),
-		maxTokenAge: void 0,
-		algorithms: alg ? [alg] : void 0,
-		payload: "json",
-		validateClaims: true
-	};
-}
-function isKeyPair(key) {
-	return "privateKey" in key || "publicKey" in key;
-}
-function assertKeyPair(pair, options) {
-	const { prefix, family } = options;
-	if (!isCryptoKey(pair.privateKey) && !isPrivateJWK(pair.privateKey)) throw invalidKeyError(`${prefix} Invalid ${family} key: "privateKey" must be a private JWK or a CryptoKey.`, pair);
-	if (!options.isPublic(pair.publicKey)) throw invalidKeyError(`${prefix} Invalid ${family} key: "publicKey" must be ${options.publicHalf}.`, pair);
-}
-function assertPinnedCryptoKey(key, options) {
-	if (isCryptoKey(key) && !options.pinned) throw invalidConfigError(`${options.prefix} A CryptoKey session key carries no algorithm, set ${options.hint}.`);
-}
-function sessionPayload(state) {
-	const iat = Math.floor(state.createdAt / 1e3);
-	const exp = state.expiresAt ? Math.floor(state.expiresAt / 1e3) : void 0;
-	const payload = {};
-	for (const key of Object.keys(state.data)) if (!RESERVED_CLAIMS.includes(key)) payload[key] = state.data[key];
-	payload.jti = state.id;
-	payload.iat = iat;
-	if (exp) payload.exp = exp;
-	return payload;
-}
-function assertNotFromTheFuture(payload, options) {
-	if (payload.iat > Math.floor(options.now / 1e3) + toleranceSeconds(options.clockTolerance)) throw invalidTokenError(`${options.prefix} Invalid session token: "iat" is in the future (${(/* @__PURE__ */ new Date(payload.iat * 1e3)).toISOString()}).`);
-}
-function assertNotPastMaxAge(opened, options) {
-	const { expiresAt } = opened;
-	if (expiresAt === void 0) return;
-	if (expiresAt <= options.now - toleranceSeconds(options.clockTolerance) * 1e3) throw expiredSessionError({
-		id: opened.id,
-		createdAt: opened.createdAt,
-		expiresAt
-	});
-}
-function toleranceSeconds(clockTolerance) {
-	return clockTolerance === void 0 ? 0 : computeDurationInSeconds(clockTolerance);
-}
-function openedSession(payload, options) {
-	const data = Object.create(null);
-	for (const key of Object.keys(payload)) {
-		if (RESERVED_CLAIMS.includes(key)) continue;
-		data[key] = payload[key];
-	}
-	const createdAt = payload.iat * 1e3;
-	const exp = payload.exp ? payload.exp * 1e3 : void 0;
-	const bound = resolveExpiresAt(createdAt, options);
-	return {
-		id: payload.jti,
-		createdAt,
-		expiresAt: exp === void 0 || bound === void 0 ? exp ?? bound : Math.min(exp, bound),
-		data
-	};
-}
-const JWE_DEFAULT_COOKIE = {
-	path: "/",
-	secure: true,
-	httpOnly: true,
-	sameSite: "lax"
-};
-function createJWECodec(options) {
-	const { prefix, defaultName } = options;
-	return createSessionCodec({
-		family: "jwe",
-		prefix,
-		defaultName,
-		defaultCookie: JWE_DEFAULT_COOKIE,
-		issueOptions: (config) => config.jwe?.encryptOptions,
-		openOptions: (config) => config.jwe?.decryptOptions,
-		issueKey: (config) => getEncryptKey(config, prefix),
-		openKey: (config) => getDecryptKey(config, prefix),
-		lookup: (config, args) => {
-			const hooks = config.hooks;
-			if (!hooks?.onUnsealKeyLookup) return void 0;
-			return (header) => hooks.onUnsealKeyLookup?.({
-				header,
-				...args,
-				config
-			});
-		},
-		issue: (config, payload, key) => encrypt(payload, key, sessionIssueOptions(config.jwe?.encryptOptions)),
-		open: async (config, sealed, key) => {
-			const { decryptOptions, encryptOptions } = config.jwe ?? {};
-			const enc = encryptOptions?.enc;
-			const { payload } = await decrypt(sealed, key, {
-				...decryptOptions,
-				maxIterations: sessionMaxIterations(config),
-				...sessionOpenOptions({
-					maxAge: config.maxAge,
-					requiredClaims: decryptOptions?.requiredClaims,
-					typ: encryptOptions?.protectedHeader?.typ,
-					alg: encryptOptions?.alg
-				}),
-				encryptionAlgorithms: enc ? [enc] : void 0
-			});
-			return payload;
-		}
-	});
-}
-function sessionMaxIterations(config) {
-	const configured = config.jwe?.decryptOptions?.maxIterations;
-	if (configured !== void 0) return configured;
-	const alg = config.jwe?.encryptOptions?.alg ?? (isJWK(config.key) ? config.key.alg : void 0);
-	return typeof alg === "string" && alg.startsWith("PBES2") ? config.jwe?.encryptOptions?.p2c ?? 6e5 : void 0;
-}
-function getEncryptKey(config, prefix) {
-	const key = config.key;
-	assertKeyMaterial(key, { prefix });
-	let resolved;
-	if (isCryptoKey(key) || isSymmetricJWK(key)) resolved = key;
-	else if (isKeyPair(key)) resolved = jweKeyPair(key, prefix).publicKey;
-	if (!resolved) throw invalidKeyError(`${prefix} Invalid JWE key, expected a JWK or a CryptoKey.`, key);
-	assertPinnedAlgEnc(resolved, config, prefix);
-	return resolved;
-}
-function getDecryptKey(config, prefix) {
-	const key = config.key;
-	assertKeyMaterial(key, { prefix });
-	let resolved;
-	if (isCryptoKey(key) || isSymmetricJWK(key)) resolved = key;
-	else if (isKeyPair(key)) resolved = jweKeyPair(key, prefix).privateKey;
-	if (!resolved) throw invalidKeyError(`${prefix} Invalid JWE key, expected a JWK, a private JWK or a CryptoKey.`, key);
-	assertPinnedAlgEnc(resolved, config, prefix);
-	return resolved;
-}
-function jweKeyPair(key, prefix) {
-	const pair = {
-		privateKey: key.privateKey,
-		publicKey: key.publicKey ?? derivedPublicHalf(key.privateKey, prefix)
-	};
-	assertKeyPair(pair, {
-		prefix,
-		family: "JWE",
-		isPublic: (half) => isCryptoKey(half) || isPublicJWK(half),
-		publicHalf: "a public JWK or a CryptoKey"
-	});
-	return pair;
-}
-function derivedPublicHalf(privateKey, prefix) {
-	if (isPrivateJWK(privateKey)) return toPublicJWK(privateKey);
-	throw invalidKeyError(`${prefix} Invalid JWE key: a CryptoKey "privateKey" needs its "publicKey".`, privateKey);
-}
-function assertPinnedAlgEnc(key, config, prefix) {
-	const { alg, enc } = config.jwe?.encryptOptions ?? {};
-	assertPinnedCryptoKey(key, {
-		pinned: Boolean(alg && enc),
-		prefix,
-		hint: "\"jwe.encryptOptions.alg\" and \"enc\""
-	});
-}
-const kSessionPending = Symbol("unjwt_session_pending");
-function sessionInstant(source) {
-	const now = source.codec.now(source.config);
-	return now - now % 1e3;
-}
-function mintSessionId(config) {
-	return config.generateId?.() || crypto.randomUUID();
-}
-function emptySession(binding) {
-	const createdAt = sessionInstant(binding);
-	return typedSession({
-		id: void 0,
-		createdAt,
-		expiresAt: resolveExpiresAt(createdAt, { maxAge: binding.config.maxAge }),
-		data: Object.create(null),
-		token: void 0
-	});
-}
-function storedSession(store) {
-	const state = store.get();
-	return state === void 0 ? void 0 : typedSession(state);
-}
-function blankSession() {
-	return typedSession({
-		expiresAt: void 0,
-		data: {}
-	});
-}
-function openSessionToken(codec, config, options) {
-	return codec.open(config, options.token, options.args).then(typedOpened);
-}
-function typedSession(state) {
-	return state;
-}
-function typedOpened(opened) {
-	return opened;
-}
-const CHUNK_MARKER = "__chunked__";
-const DEFAULT_CHUNK_MAX_LENGTH = 4e3;
-function readChunked(store, name) {
-	const main = store.read(name);
-	if (main === void 0) return void 0;
-	if (!main.startsWith("__chunked__")) return main;
-	const count = parseChunkCount(main);
-	if (count === 0) return void 0;
-	const parts = [];
-	for (let index = 1; index <= count; index++) {
-		const part = store.read(chunkName(name, index));
-		if (part === void 0) return void 0;
-		parts.push(part);
-	}
-	return parts.join("");
-}
-function writeChunked(store, name, value, options) {
-	const { attrs, chunkMaxLength, prefix } = options;
-	const max = chunkMaxLength && chunkMaxLength > 0 ? chunkMaxLength : DEFAULT_CHUNK_MAX_LENGTH;
-	const chunkCount = Math.ceil(value.length / max);
-	if (chunkCount > 16) throw invalidConfigError(`${prefix} Session token requires ${chunkCount} cookie chunks, exceeding the limit of 16.`);
-	const previousCount = parseChunkCount(store.read(name));
-	const firstSurplus = chunkCount <= 1 ? 1 : chunkCount + 1;
-	for (let index = firstSurplus; index <= previousCount; index++) expire(store, chunkName(name, index), attrs);
-	if (chunkCount <= 1) {
-		store.write(name, value, attrs);
-		return;
-	}
-	store.write(name, `${CHUNK_MARKER}${chunkCount}`, attrs);
-	for (let index = 1; index <= chunkCount; index++) store.write(chunkName(name, index), value.slice((index - 1) * max, index * max), attrs);
-}
-function removeChunked(store, name, options) {
-	const count = parseChunkCount(store.read(name));
-	expire(store, name, options.attrs);
-	for (let index = 1; index <= count; index++) expire(store, chunkName(name, index), options.attrs);
-}
-function setCookieValues(setCookies) {
-	const cookies = Object.create(null);
-	for (const setCookie of setCookies) {
-		const pair = setCookiePair(setCookie);
-		if (pair) cookies[pair.name] = decodeValue(pair.value);
-	}
-	return cookies;
-}
-function setCookieName(setCookie) {
-	return setCookiePair(setCookie)?.name;
-}
-function mirrorSetCookie(name, headers) {
-	const { from, to } = headers;
-	const isThisCookie = (line) => setCookieName(line) === name;
-	const lines = [...to.getSetCookie().filter((line) => !isThisCookie(line)), ...from.getSetCookie().filter((line) => isThisCookie(line))];
-	to.delete("set-cookie");
-	for (const line of lines) to.append("set-cookie", line);
-}
-function chunkName(name, index) {
-	return `${name}.${index}`;
-}
-function parseChunkCount(main) {
-	if (main === void 0 || !main.startsWith("__chunked__")) return 0;
-	const suffix = main.slice(11);
-	if (!/^\d+$/.test(suffix)) return 0;
-	const count = Number.parseInt(suffix, 10);
-	if (count < 1 || count > 16) return 0;
-	return count;
-}
-function expire(store, name, attrs) {
-	store.write(name, "", {
-		...attrs,
-		maxAge: 0,
-		expires: /* @__PURE__ */ new Date(0)
-	});
-}
-function setCookiePair(setCookie) {
-	const [pair = ""] = setCookie.split(";", 1);
-	const separator = pair.indexOf("=");
-	if (separator === -1) return void 0;
-	return {
-		name: pair.slice(0, separator).trim(),
-		value: pair.slice(separator + 1).trim()
-	};
-}
-function decodeValue(value) {
-	if (!value.includes("%")) return value;
-	try {
-		return decodeURIComponent(value);
-	} catch {
-		return value;
-	}
-}
-function resolveTransport(driver, event, options) {
-	const handed = driver.handed?.(event);
-	if (handed) return {
-		source: "handed",
-		read: () => handed.token,
-		readonly: false,
-		writable: () => true
-	};
-	const { config, name } = options;
-	const header = presentedHeader(driver, event, options);
-	if (header || config.cookie === false) return {
-		source: "header",
-		read: config.sessionHeader === false ? void 0 : () => header?.token,
-		malformed: header?.malformed,
-		readonly: false,
-		writable: () => true
-	};
-	const jar = driver.cookies(event);
-	const store = responseStore(jar);
-	const transport = {
-		source: "cookie",
-		read: () => cookieToken(jar, name),
-		readonly: !store,
-		writable: () => driver.writable?.(event) ?? true
-	};
-	if (!store) return transport;
-	transport.write = (token, { attrs, chunkMaxLength }) => {
-		writeChunked(store, name, token, {
-			attrs,
-			chunkMaxLength,
-			prefix: driver.prefix
-		});
-	};
-	transport.drop = ({ attrs }) => {
-		removeChunked(store, name, { attrs });
-	};
-	return transport;
-}
-function assertTokenSource(transport, options) {
-	if (!transport.read) throw invalidConfigError(`${options.prefix} Session has no token source, enable "cookie" or "sessionHeader".`);
-}
-function assertWritable(transport, options) {
-	const { operation, prefix } = options;
-	if (operation === "update" && transport.readonly) throw readOnlyEventError(`${prefix} Cannot update session on read-only event.`);
-	if (!transport.writable()) throw readOnlyEventError(`${prefix} Cannot update/clear session: the response was already sent.`);
-}
-function assertSessionHeader(header, options) {
-	if (header === void 0 || typeof header === "boolean") return;
-	if (isToken(header)) return;
-	throw invalidConfigError(`${options.prefix} Session "sessionHeader" must be true, false or a header name (got ${quoteTokenValue(header)}).`);
-}
-function sessionHeaderName(sessionName, configured) {
-	if (typeof configured === "string") return configured.toLowerCase();
-	return `x-${sessionName.replace(/^__(?:host|secure)-/i, "").toLowerCase()}-session`;
-}
-function headerToken(value) {
-	if (typeof value !== "string") return void 0;
-	const words = value.trim().split(/\s+/);
-	const [first = "", second] = words;
-	if (/^bearer$/i.test(first)) return words.length === 2 ? second : void 0;
-	return words.length === 1 && first ? first : void 0;
-}
-function presentedHeader(driver, event, options) {
-	const { config, name } = options;
-	if (config.sessionHeader === false) return void 0;
-	const header = sessionHeaderName(name, config.sessionHeader);
-	const value = driver.header(event, header);
-	if (typeof value !== "string") return void 0;
-	const token = headerToken(value);
-	if (token) return { token };
-	return {
-		token: void 0,
-		malformed: invalidTokenError(`${driver.prefix} Invalid session token: the "${header}" header holds neither a token nor "Bearer <token>".`)
-	};
-}
-function cookieToken(jar, name) {
-	const written = jar.written ? readChunked({ read: (key) => jar.written?.(key) }, name) : void 0;
-	if (written === "") return void 0;
-	return (written ?? readChunked(jar, name)) || void 0;
-}
-function responseStore(jar) {
-	const write = jar.write?.bind(jar);
-	if (!write) return void 0;
-	return {
-		read: (name) => jar.written?.(name) ?? jar.read(name),
-		write
-	};
-}
-const kSessionNames = Symbol("unjwt_session_names");
-function bindSession(event, config, options) {
-	const { driver, codec, actions, hookArgs } = options;
-	const { prefix } = driver;
-	const name = config.name || codec.defaultName;
-	assertSessionName(name, { prefix });
-	assertSessionHeader(config.sessionHeader, { prefix });
-	if (config.cookie !== false) assertCookiePrefix(name, {
-		...codec.defaultCookie,
-		...config.cookie
-	}, { prefix });
-	assertRolling(config, { prefix });
-	const record = driver.state(event);
-	claimSessionName(record, {
-		name,
-		family: codec.family,
-		prefix
-	});
-	return {
-		event,
-		config,
-		driver,
-		codec,
-		actions,
-		name,
-		args: hookArgs(event),
-		store: recordSlotStore(record, `${codec.family}:${name}`),
-		transport: resolveTransport(driver, event, {
-			config,
-			name
-		})
-	};
-}
-function sessionToken(binding) {
-	const { transport } = binding;
-	assertTokenSource(transport, { prefix: binding.driver.prefix });
-	const session = storedSession(binding.store);
-	return session ? session.token : transport.read();
-}
-function recordSlotStore(record, slot) {
-	return {
-		get: () => record[slot],
-		set: (state) => {
-			record[slot] = state;
-		}
-	};
-}
-function sessionCookie(binding, options = {}) {
-	const { chunkMaxLength, ...configured } = binding.config.cookie || {};
-	const attrs = {
-		...binding.codec.defaultCookie,
-		...configured
-	};
-	if (options.expiresAt !== void 0) {
-		attrs.expires = new Date(options.expiresAt);
-		attrs.maxAge = void 0;
-	}
-	return {
-		attrs,
-		chunkMaxLength
-	};
-}
-function dropSessionCookie(binding) {
-	const { transport } = binding;
-	if (!transport.drop || !transport.writable()) return;
-	transport.drop(sessionCookie(binding));
-}
-function claimSessionName(record, options) {
-	const { name, family, prefix } = options;
-	const holder = record;
-	const registry = holder[kSessionNames] ||= /* @__PURE__ */ new Map();
-	const held = registry.get(name);
-	if (held === void 0) {
-		registry.set(name, family);
-		return;
-	}
-	if (held === family) return;
-	throw invalidConfigError(`${prefix} Session name "${name}" is already used by a ${held.toUpperCase()} session on this request.`);
-}
-async function loadSession(binding) {
-	const { config, codec, store, args, transport } = binding;
-	await codec.assertKeys(config);
-	const open = codec.opener(config, args);
-	assertTokenSource(transport, { prefix: binding.driver.prefix });
-	const existing = storedSession(store);
-	if (existing) {
-		const session = existing[kSessionPending] ? await existing[kSessionPending] : existing;
-		if (session.token !== void 0 && session.expiresAt !== void 0 && session.expiresAt < codec.now(config)) {
-			dropSessionCookie(binding);
-			const freshSession = emptySession(binding);
-			store.set(freshSession);
-			await fireExpire(binding, {
-				session: {
-					id: session.id,
-					createdAt: session.createdAt,
-					expiresAt: session.expiresAt,
-					token: session.token
-				},
-				error: expiredSessionError({
-					id: session.id,
-					createdAt: session.createdAt,
-					expiresAt: session.expiresAt
-				})
-			});
-			return freshSession;
-		}
-		return session;
-	}
-	const session = emptySession(binding);
-	store.set(session);
-	if (transport.malformed) {
-		await fireError(binding, transport.malformed);
-		return session;
-	}
-	const token = transport.read();
-	if (!token) return session;
-	session.token = token;
-	const pending = open(token).then((opened) => {
-		Object.assign(session, opened);
-		return { failure: void 0 };
-	}, (error) => {
-		session.token = void 0;
-		return { failure: { error } };
-	}).then((outcome) => {
-		delete session[kSessionPending];
-		return outcome;
-	});
-	session[kSessionPending] = pending.then(() => session);
-	const { failure } = await pending;
-	if (failure) {
-		if (isJWTError(failure.error, "ERR_JWT_EXPIRED")) {
-			const { jti, iat, exp } = failure.error.cause;
-			dropSessionCookie(binding);
-			await fireExpire(binding, {
-				session: {
-					id: jti,
-					createdAt: iat ? iat * 1e3 : void 0,
-					expiresAt: exp ? exp * 1e3 : void 0,
-					token
-				},
-				error: failure.error
-			});
-		} else {
-			if (isJWTError(failure.error, "ERR_SESSION_TOKEN_INVALID") && isTokenFailure(failure.error)) dropSessionCookie(binding);
-			await fireError(binding, failure.error);
-		}
-		return session;
-	}
-	await fireRead(binding, session);
-	await rollSession(binding, session);
-	return session;
-}
-async function fireRead(binding, session) {
-	if (session.id === void 0 || session.token === void 0) return;
-	await binding.config.hooks?.onRead?.({
-		session: binding.actions.manager(binding),
-		...binding.args,
-		config: binding.config
-	});
-}
-async function rollSession(binding, session) {
-	const { config, codec, transport, store } = binding;
-	const { rolling } = config;
-	if (rolling === void 0 || store.get() !== session) return;
-	if (session.token === void 0 || session.expiresAt === void 0) return;
-	if (rolling !== true) {
-		if (codec.now(config) - session.createdAt < computeDurationInSeconds(rolling) * 1e3) return;
-	}
-	if (transport.readonly || !transport.writable()) return;
-	await binding.actions.roll(binding);
-}
-async function fireError(binding, error) {
-	await binding.config.hooks?.onError?.({
-		session: binding.actions.manager(binding),
-		...binding.args,
-		error,
-		config: binding.config
-	});
-}
-async function fireExpire(binding, expired) {
-	await binding.config.hooks?.onExpire?.({
-		session: expired.session,
-		...binding.args,
-		error: expired.error,
-		config: binding.config
-	});
-}
-async function encodeSession(binding) {
-	const { config, codec, store, transport } = binding;
-	await codec.assertKeys(config);
-	const issue = codec.issuer(config);
-	const session = storedSession(store) || (transport.read ? await loadSession(binding) : emptySession(binding));
-	return issue(session.id === void 0 ? {
-		...session,
-		id: mintSessionId(config)
-	} : session);
-}
-async function issueSession(binding, update, options, trigger = "update") {
-	const { config, driver, store, args, transport } = binding;
-	assertWritable(transport, {
-		operation: "update",
-		prefix: driver.prefix
-	});
-	const session = storedSession(store) || await loadSession(binding);
-	const oldSession = snapshotSession(session);
-	const resolved = typeof update === "function" ? update(session.data) : update;
-	if (resolved) Object.assign(session.data, sanitizeSessionUpdate(resolved, { prefix: driver.prefix }));
-	for (const claim of RESERVED_CLAIMS) delete session.data[claim];
-	const maxAge = options?.maxAge ?? config.maxAge;
-	const createdAt = sessionInstant(binding);
-	const id = mintSessionId(config);
-	Object.assign(session, {
-		id,
-		createdAt,
-		expiresAt: resolveExpiresAt(createdAt, { maxAge })
-	});
-	let issued;
-	try {
-		const token = await encodeSession(binding);
-		transport.write?.(token, sessionCookie(binding, { expiresAt: session.expiresAt }));
-		issued = Object.assign(session, {
-			id,
-			token
-		});
-	} catch (error_) {
-		Object.assign(session, {
-			id: oldSession.id,
-			createdAt: oldSession.createdAt,
-			expiresAt: oldSession.expiresAt,
-			data: oldSession.data
-		});
-		session.token = oldSession.token;
-		await config.hooks?.onError?.({
-			session: binding.actions.manager(binding),
-			...args,
-			error: error_,
-			config
-		});
-		throw error_;
-	}
-	await config.hooks?.onUpdate?.({
-		session: binding.actions.manager(binding),
-		oldSession,
-		trigger,
-		...args,
-		config
-	});
-	return issued;
-}
-async function dropSession(binding) {
-	const { config, driver, store, args, transport } = binding;
-	assertTokenSource(transport, { prefix: driver.prefix });
-	assertWritable(transport, {
-		operation: "clear",
-		prefix: driver.prefix
-	});
-	let session = storedSession(store);
-	if (session && session[kSessionPending]) session = await session[kSessionPending];
-	const oldSession = session && (session.id !== void 0 || session.token !== void 0) ? snapshotSession(session) : void 0;
-	store.set(emptySession(binding));
-	transport.drop?.(sessionCookie(binding));
-	await config.hooks?.onClear?.({
-		oldSession,
-		...args,
-		config
-	});
-}
-function sessionManager(binding) {
-	const { store } = binding;
-	const state = () => storedSession(store);
-	const manager = {
-		get id() {
-			return state()?.id;
-		},
-		get createdAt() {
-			return state()?.createdAt ?? Date.now();
-		},
-		get expiresAt() {
-			return (state() ?? blankSession()).expiresAt;
-		},
-		get data() {
-			return (state() ?? blankSession()).data;
-		},
-		get token() {
-			return sessionToken(binding);
-		},
-		update: async (update, options) => {
-			await issueSession(binding, update, options);
-			return manager;
-		},
-		clear: async () => {
-			await dropSession(binding);
-			return manager;
-		}
-	};
-	return manager;
-}
-function sessionActions() {
-	return {
-		manager: (binding) => sessionManager(binding),
-		roll: async (binding) => {
-			await issueSession(binding, void 0, void 0, "rolling");
-		}
-	};
-}
-function snapshotSession(session) {
-	return {
-		...session,
-		data: safeJsonParse(JSON.stringify(session.data))
-	};
-}
-function defineSession(config, options) {
-	const { driver, codec, hookArgs } = options;
-	const actions = sessionActions();
-	const bind = (event) => bindSession(event, config, {
-		driver,
-		codec,
-		actions,
-		hookArgs
-	});
-	return {
-		use: async (event) => {
-			const binding = bind(event);
-			await loadSession(binding);
-			return sessionManager(binding);
-		},
-		token: (event) => sessionToken(bind(event)),
-		issue: async (data, issueOptions) => {
-			await codec.assertKeys(config);
-			const issue = codec.issuer(config);
-			const createdAt = sessionInstant({
-				codec,
-				config
-			});
-			return issue({
-				id: mintSessionId(config),
-				createdAt,
-				expiresAt: resolveExpiresAt(createdAt, { maxAge: issueOptions?.maxAge ?? config.maxAge }),
-				data: sanitizeSessionUpdate(data ?? {}, { prefix: driver.prefix }),
-				token: void 0
-			});
-		},
-		open: (token) => openSessionToken(codec, config, {
-			token,
-			args: {}
-		})
-	};
-}
-const JWS_DEFAULT_COOKIE = {
-	path: "/",
-	secure: true,
-	httpOnly: false,
-	sameSite: "lax"
-};
-function createJWSCodec(options) {
-	const { prefix, defaultName } = options;
-	return createSessionCodec({
-		family: "jws",
-		prefix,
-		defaultName,
-		defaultCookie: JWS_DEFAULT_COOKIE,
-		issueOptions: (config) => config.jws?.signOptions,
-		openOptions: (config) => config.jws?.verifyOptions,
-		issueKey: (config) => getSignKey(config, prefix),
-		openKey: (config) => getVerifyKey(config, prefix),
-		lookup: (config, args) => {
-			const hooks = config.hooks;
-			if (!hooks?.onVerifyKeyLookup) return void 0;
-			return (header) => hooks.onVerifyKeyLookup?.({
-				header,
-				...args,
-				config
-			});
-		},
-		importable: (key) => isJWKSet(key) ? key.keys : [key],
-		issue: (config, payload, key) => sign(payload, key, sessionIssueOptions(config.jws?.signOptions)),
-		open: async (config, token, key) => {
-			const { verifyOptions, signOptions } = config.jws ?? {};
-			const { payload } = await verify(token, key, {
-				...verifyOptions,
-				...sessionOpenOptions({
-					maxAge: config.maxAge,
-					requiredClaims: verifyOptions?.requiredClaims,
-					typ: signOptions?.protectedHeader?.typ,
-					alg: signOptions?.alg
-				})
-			});
-			return payload;
-		}
-	});
-}
-function getSignKey(config, prefix) {
-	const key = config.key;
-	assertKeyMaterial(key, { prefix });
-	let resolved;
-	if (isCryptoKey(key) || isSymmetricJWK(key)) resolved = key;
-	else if (isKeyPair(key)) {
-		assertJWSKeyPair(key, prefix);
-		resolved = key.privateKey;
-	}
-	if (!resolved) throw invalidKeyError(`${prefix} Invalid JWS key, expected a symmetric JWK, a private JWK or a CryptoKey.`, key);
-	assertPinnedAlg(resolved, config, prefix);
-	return resolved;
-}
-function getVerifyKey(config, prefix) {
-	const key = config.key;
-	assertKeyMaterial(key, { prefix });
-	let resolved;
-	if (isCryptoKey(key) || isSymmetricJWK(key)) resolved = key;
-	else if (isKeyPair(key)) {
-		assertJWSKeyPair(key, prefix);
-		resolved = Array.isArray(key.publicKey) ? { keys: key.publicKey } : key.publicKey;
-	}
-	if (!resolved) throw invalidKeyError(`${prefix} Invalid JWS key, expected a symmetric JWK, a public JWK/set or a CryptoKey.`, key);
-	assertPinnedAlg(resolved, config, prefix);
-	return resolved;
-}
-function assertJWSKeyPair(key, prefix) {
-	assertKeyPair(key, {
-		prefix,
-		family: "JWS",
-		isPublic: (half) => isCryptoKey(half) || isPublicJWK(half) || isPublicKeyList(Array.isArray(half) ? half : isJWKSet(half) ? half.keys : void 0),
-		publicHalf: "a public JWK, a non-empty JWK set or a CryptoKey"
-	});
-}
-function isPublicKeyList(keys) {
-	return keys !== void 0 && keys.length > 0 && keys.every((candidate) => isPublicJWK(candidate));
-}
-function assertPinnedAlg(key, config, prefix) {
-	assertPinnedCryptoKey(key, {
-		pinned: Boolean(config.jws?.signOptions?.alg),
-		prefix,
-		hint: "\"jws.signOptions.alg\""
-	});
-}
-export { bindSession, createJWECodec, createJWSCodec, defineSession, dropSession, encodeSession, invalidConfigError, issueSession, loadSession, mirrorSetCookie, openSessionToken, sessionActions, setCookieName, setCookieValues };