@davaux/session 0.8.0 → 0.8.1

package/dist/index.d.ts

@@ -0,0 +1,69 @@
+import type { MiddlewareFn } from 'davaux';
+declare module 'davaux' {
+    interface State {
+        session: Session;
+    }
+}
+/**
+ * Per-request session object. Stores arbitrary key-value data serialised into
+ * an HMAC-signed cookie. Mutations (`set`, `delete`, `destroy`) are persisted
+ * automatically before the response headers are sent.
+ */
+export declare class Session {
+    private readonly _data;
+    private _dirty;
+    private _destroyed;
+    constructor(data?: Record<string, unknown>);
+    /** Retrieve a session value by key. Returns `undefined` when absent. */
+    get<T = unknown>(key: string): T | undefined;
+    /** Store a value under `key`. Marks the session dirty so it is persisted. */
+    set(key: string, value: unknown): void;
+    /** Remove `key` from the session. Marks the session dirty so it is persisted. */
+    delete(key: string): void;
+    /** Clear all session data and delete the cookie on response. */
+    destroy(): void;
+    /** Snapshot of current session data. */
+    get data(): Record<string, unknown>;
+    /** @internal */
+    get dirty(): boolean;
+    /** @internal */
+    get destroyed(): boolean;
+}
+export interface SessionOptions {
+    /**
+     * Secret(s) used to sign the session cookie with HMAC-SHA256.
+     * Pass an array for rotation: the first secret signs new sessions,
+     * all are accepted for verification.
+     */
+    secret: string | string[];
+    /** Cookie name. Default: `'session'` */
+    cookieName?: string;
+    /** Max-Age in seconds. Omit for a session cookie (clears on browser close). */
+    maxAge?: number;
+    /** Default: `true` */
+    httpOnly?: boolean;
+    /** Default: `false`. Enable in production to require HTTPS. */
+    secure?: boolean;
+    /** Default: `'Lax'` */
+    sameSite?: 'Strict' | 'Lax' | 'None';
+    /** Default: `'/'` */
+    path?: string;
+    domain?: string;
+}
+/**
+ * HMAC-signed cookie session middleware. Parses the incoming session cookie,
+ * exposes the data as `ctx.state.session`, and automatically writes an updated
+ * cookie when the session is mutated or destroyed.
+ *
+ * Pass an array of secrets for key rotation: the first secret signs new
+ * sessions, all secrets are accepted for verification.
+ *
+ * @example
+ * import { sessionMiddleware } from '@davaux/session'
+ * export default sessionMiddleware({
+ *   secret: process.env.SESSION_SECRET!,
+ *   maxAge: 60 * 60 * 24 * 7, // 1 week
+ * })
+ */
+export declare function sessionMiddleware(options: SessionOptions): MiddlewareFn;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAA;AAI1C,OAAO,QAAQ,QAAQ,CAAC;IACtB,UAAU,KAAK;QACb,OAAO,EAAE,OAAO,CAAA;KACjB;CACF;AAID;;;;GAIG;AACH,qBAAa,OAAO;IAClB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAyB;IAC/C,OAAO,CAAC,MAAM,CAAQ;IACtB,OAAO,CAAC,UAAU,CAAQ;gBAEd,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;IAI9C,wEAAwE;IACxE,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS;IAI5C,6EAA6E;IAC7E,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI;IAKtC,iFAAiF;IACjF,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAKzB,gEAAgE;IAChE,OAAO,IAAI,IAAI;IAKf,wCAAwC;IACxC,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAElC;IAED,gBAAgB;IAChB,IAAI,KAAK,IAAI,OAAO,CAEnB;IAED,gBAAgB;IAChB,IAAI,SAAS,IAAI,OAAO,CAEvB;CACF;AAID,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACzB,wCAAwC;IACxC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,sBAAsB;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,+DAA+D;IAC/D,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,uBAAuB;IACvB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;IACpC,qBAAqB;IACrB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAmCD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,cAAc,GAAG,YAAY,CA8CvE"}

package/dist/index.js

@@ -0,0 +1,129 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+// ─── Session ──────────────────────────────────────────────────────────────────
+/**
+ * Per-request session object. Stores arbitrary key-value data serialised into
+ * an HMAC-signed cookie. Mutations (`set`, `delete`, `destroy`) are persisted
+ * automatically before the response headers are sent.
+ */
+export class Session {
+    _data;
+    _dirty = false;
+    _destroyed = false;
+    constructor(data = {}) {
+        this._data = data;
+    }
+    /** Retrieve a session value by key. Returns `undefined` when absent. */
+    get(key) {
+        return this._data[key];
+    }
+    /** Store a value under `key`. Marks the session dirty so it is persisted. */
+    set(key, value) {
+        this._data[key] = value;
+        this._dirty = true;
+    }
+    /** Remove `key` from the session. Marks the session dirty so it is persisted. */
+    delete(key) {
+        delete this._data[key];
+        this._dirty = true;
+    }
+    /** Clear all session data and delete the cookie on response. */
+    destroy() {
+        this._destroyed = true;
+        this._dirty = false;
+    }
+    /** Snapshot of current session data. */
+    get data() {
+        return { ...this._data };
+    }
+    /** @internal */
+    get dirty() {
+        return this._dirty;
+    }
+    /** @internal */
+    get destroyed() {
+        return this._destroyed;
+    }
+}
+// ─── Signing ──────────────────────────────────────────────────────────────────
+function sign(payload, secret) {
+    const sig = createHmac('sha256', secret).update(payload).digest('base64url');
+    return `${payload}.${sig}`;
+}
+function verify(value, secrets) {
+    const dot = value.lastIndexOf('.');
+    if (dot === -1)
+        return null;
+    const payload = value.slice(0, dot);
+    const sigBuf = Buffer.from(value.slice(dot + 1), 'base64url');
+    for (const secret of secrets) {
+        const expectedBuf = createHmac('sha256', secret).update(payload).digest();
+        if (expectedBuf.length === sigBuf.length && timingSafeEqual(expectedBuf, sigBuf)) {
+            try {
+                return JSON.parse(Buffer.from(payload, 'base64url').toString('utf-8'));
+            }
+            catch {
+                return null;
+            }
+        }
+    }
+    return null;
+}
+// ─── Middleware ───────────────────────────────────────────────────────────────
+/**
+ * HMAC-signed cookie session middleware. Parses the incoming session cookie,
+ * exposes the data as `ctx.state.session`, and automatically writes an updated
+ * cookie when the session is mutated or destroyed.
+ *
+ * Pass an array of secrets for key rotation: the first secret signs new
+ * sessions, all secrets are accepted for verification.
+ *
+ * @example
+ * import { sessionMiddleware } from '@davaux/session'
+ * export default sessionMiddleware({
+ *   secret: process.env.SESSION_SECRET!,
+ *   maxAge: 60 * 60 * 24 * 7, // 1 week
+ * })
+ */
+export function sessionMiddleware(options) {
+    const secrets = Array.isArray(options.secret) ? options.secret : [options.secret];
+    if (secrets.length === 0 || secrets.some((s) => !s)) {
+        throw new Error('@davaux/session: at least one non-empty secret is required');
+    }
+    if (secrets.some((s) => s.length < 32)) {
+        console.warn('@davaux/session: secret should be at least 32 characters — short secrets are weak and easy to brute-force');
+    }
+    const name = options.cookieName ?? 'session';
+    return async (ctx, next) => {
+        const raw = ctx.cookies.get(name);
+        const existing = raw ? verify(raw, secrets) : null;
+        const session = new Session(existing ?? {});
+        ctx.state.session = session;
+        // Inject the session cookie right before headers are committed.
+        // This approach handles the common case where the route handler calls
+        // res.writeHead() inside next(), after which res.setHeader() would fail.
+        const originalWriteHead = ctx.res.writeHead.bind(ctx.res);
+        // biome-ignore lint/suspicious/noExplicitAny: writeHead has multiple overloads
+        ctx.res.writeHead = ((...args) => {
+            ctx.res.writeHead = originalWriteHead;
+            if (session.destroyed) {
+                ctx.cookies.delete(name, { path: options.path ?? '/' });
+            }
+            else if (session.dirty) {
+                const payload = Buffer.from(JSON.stringify(session.data)).toString('base64url');
+                const signed = sign(payload, secrets[0]);
+                ctx.cookies.set(name, signed, {
+                    httpOnly: options.httpOnly ?? true,
+                    secure: options.secure ?? false,
+                    sameSite: options.sameSite ?? 'Lax',
+                    maxAge: options.maxAge,
+                    path: options.path ?? '/',
+                    domain: options.domain,
+                });
+            }
+            // biome-ignore lint/suspicious/noExplicitAny: forwarding overloaded args
+            return originalWriteHead(...args);
+        });
+        await next();
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAYzD,iFAAiF;AAEjF;;;;GAIG;AACH,MAAM,OAAO,OAAO;IACD,KAAK,CAAyB;IACvC,MAAM,GAAG,KAAK,CAAA;IACd,UAAU,GAAG,KAAK,CAAA;IAE1B,YAAY,OAAgC,EAAE;QAC5C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAA;IACnB,CAAC;IAED,wEAAwE;IACxE,GAAG,CAAc,GAAW;QAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAA;IACzC,CAAC;IAED,6EAA6E;IAC7E,GAAG,CAAC,GAAW,EAAE,KAAc;QAC7B,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAA;QACvB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;IACpB,CAAC;IAED,iFAAiF;IACjF,MAAM,CAAC,GAAW;QAChB,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACtB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;IACpB,CAAC;IAED,gEAAgE;IAChE,OAAO;QACL,IAAI,CAAC,UAAU,GAAG,IAAI,CAAA;QACtB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAA;IACrB,CAAC;IAED,wCAAwC;IACxC,IAAI,IAAI;QACN,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,EAAE,CAAA;IAC1B,CAAC;IAED,gBAAgB;IAChB,IAAI,KAAK;QACP,OAAO,IAAI,CAAC,MAAM,CAAA;IACpB,CAAC;IAED,gBAAgB;IAChB,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;CACF;AA0BD,iFAAiF;AAEjF,SAAS,IAAI,CAAC,OAAe,EAAE,MAAc;IAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAA;IAC5E,OAAO,GAAG,OAAO,IAAI,GAAG,EAAE,CAAA;AAC5B,CAAC;AAED,SAAS,MAAM,CAAC,KAAa,EAAE,OAAiB;IAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,GAAG,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IAE3B,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IACnC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAA;IAE7D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAA;QACzE,IAAI,WAAW,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC;YACjF,IAAI,CAAC;gBACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAGpE,CAAA;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAuB;IACvD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACjF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAA;IAC/E,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,EAAE,CAAC;QACvC,OAAO,CAAC,IAAI,CACV,2GAA2G,CAC5G,CAAA;IACH,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,IAAI,SAAS,CAAA;IAE5C,OAAO,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAClD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAA;QAC3C,GAAG,CAAC,KAAK,CAAC,OAAO,GAAG,OAAO,CAAA;QAE3B,gEAAgE;QAChE,sEAAsE;QACtE,yEAAyE;QACzE,MAAM,iBAAiB,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAA6B,CAAA;QACrF,+EAA+E;QAC/E,GAAG,CAAC,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,GAAG,IAAW,EAAE,EAAE;YACtC,GAAG,CAAC,GAAG,CAAC,SAAS,GAAG,iBAAiB,CAAA;YACrC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAA;YACzD,CAAC;iBAAM,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;gBAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;gBACxC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE;oBAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,IAAI;oBAClC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,KAAK;oBAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,KAAK;oBACnC,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,GAAG;oBACzB,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB,CAAC,CAAA;YACJ,CAAC;YACD,yEAAyE;YACzE,OAAQ,iBAAqD,CAAC,GAAG,IAAI,CAAC,CAAA;QACxE,CAAC,CAA6B,CAAA;QAE9B,MAAM,IAAI,EAAE,CAAA;IACd,CAAC,CAAA;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@davaux/session",
-  "version": "0.8.0",
+  "version": "0.8.1",
   "description": "HMAC-signed cookie sessions for Davaux",
   "type": "module",
   "author": "David L Dyess II",
@@ -13,6 +13,9 @@
     "url": "https://codeberg.org/davaux/davaux/issues"
   },
   "homepage": "https://codeberg.org/davaux/davaux#readme",
+  "files": [
+    "dist"
+  ],
   "exports": {
     ".": {
       "import": "./dist/index.js",
@@ -24,11 +27,11 @@
     "typecheck": "tsc --noEmit"
   },
   "peerDependencies": {
-    "davaux": ">=0.8.0"
+    "davaux": ">=0.8.1"
   },
   "devDependencies": {
     "@types/node": "^25.0.0",
     "davaux": "*",
     "typescript": "^6.0.3"
   }
-}
+}

package/CLAUDE.md

@@ -1,95 +0,0 @@
-<!-- pka-generated -->
-# @davaux/session
-
-> Generated by Project Knowledge Analyzer on 2026-06-06T21:53:10.444Z
-
-## Overview
-
-HMAC-signed cookie sessions for Davaux
-
-**Version**: 0.8.0
-**Author**: David L Dyess II
-**License**: MIT
-**Repository**: https://codeberg.org/davaux/davaux#readme
-
-## Tech Stack
-
-- **Language**: TypeScript
-- **Module System**: ESM (`type: module`)
-
-## Commands
-
-- `npm run build` — tsc
-- `npm run typecheck` — tsc --noEmit
-
-## Project Structure
-
-```
-├── CLAUDE.md
-├── README.md
-├── package.json
-├── tsconfig.json
-└── src/
-    └── index.ts
-
-```
-
-## Entry Points
-
-- `src/index.ts`
-
-## Files by Type
-
-### Documentation (2)
-- `CLAUDE.md`
-- `README.md`
-
-### Config (2)
-- `package.json`
-- `tsconfig.json`
-
-### Module (1)
-- `src/index.ts`
-
-
-## Git
-- **Branch**: main
-- **Last Commit**: chore: Add alpha status note to README
-- **Author**: David Dyess II
-- **Date**: 2026-06-06 15:52:27 -0600
-- **Remote**: https://codeberg.org/davaux/davaux.git
-
-### Recent Commits
-```
-f527031 chore: Add alpha status note to README
-90c819e chore: Add repo info to package.json files
-b200d9d feat(davaux)!: Add OmlCacheConfig - opt-in with includes option or opt-out with excludes option; Fix OML implementation to follow OML spec - use output instead of return
-3bce0c2 chore: Update and add READMEs to packages; update ROADMAP
-fc27c20 fix(davaux): Remove old dist folder on new builds; fix server port per DavauxConfig
-c760659 feat(davaux): Add minify CSS in production builds
-c899ab8 fix(davaux): Added method JS and JSX extenstion to scanner
-7d99f04 feat(davaux): Add support for declarative partial updates
-3b47f37 chore: Bump package versions to 0.8.0
-aa0460f chore: Add CHANGELOG.md
-```
-
-## Dependencies
-
-
-### Development
-@types/node, davaux, typescript
-
-
-
-
-
-
-
-
-
-## Exported Symbols
-
-**`src/index.ts`**
-`Session`, `sessionMiddleware`, `SessionOptions`
-
-

package/src/index.ts

@@ -1,186 +0,0 @@
-import { createHmac, timingSafeEqual } from 'node:crypto'
-import type { ServerResponse } from 'node:http'
-import type { MiddlewareFn } from 'davaux'
-
-// ─── State augmentation ───────────────────────────────────────────────────────
-
-declare module 'davaux' {
-  interface State {
-    session: Session
-  }
-}
-
-// ─── Session ──────────────────────────────────────────────────────────────────
-
-/**
- * Per-request session object. Stores arbitrary key-value data serialised into
- * an HMAC-signed cookie. Mutations (`set`, `delete`, `destroy`) are persisted
- * automatically before the response headers are sent.
- */
-export class Session {
-  private readonly _data: Record<string, unknown>
-  private _dirty = false
-  private _destroyed = false
-
-  constructor(data: Record<string, unknown> = {}) {
-    this._data = data
-  }
-
-  /** Retrieve a session value by key. Returns `undefined` when absent. */
-  get<T = unknown>(key: string): T | undefined {
-    return this._data[key] as T | undefined
-  }
-
-  /** Store a value under `key`. Marks the session dirty so it is persisted. */
-  set(key: string, value: unknown): void {
-    this._data[key] = value
-    this._dirty = true
-  }
-
-  /** Remove `key` from the session. Marks the session dirty so it is persisted. */
-  delete(key: string): void {
-    delete this._data[key]
-    this._dirty = true
-  }
-
-  /** Clear all session data and delete the cookie on response. */
-  destroy(): void {
-    this._destroyed = true
-    this._dirty = false
-  }
-
-  /** Snapshot of current session data. */
-  get data(): Record<string, unknown> {
-    return { ...this._data }
-  }
-
-  /** @internal */
-  get dirty(): boolean {
-    return this._dirty
-  }
-
-  /** @internal */
-  get destroyed(): boolean {
-    return this._destroyed
-  }
-}
-
-// ─── Options ──────────────────────────────────────────────────────────────────
-
-export interface SessionOptions {
-  /**
-   * Secret(s) used to sign the session cookie with HMAC-SHA256.
-   * Pass an array for rotation: the first secret signs new sessions,
-   * all are accepted for verification.
-   */
-  secret: string | string[]
-  /** Cookie name. Default: `'session'` */
-  cookieName?: string
-  /** Max-Age in seconds. Omit for a session cookie (clears on browser close). */
-  maxAge?: number
-  /** Default: `true` */
-  httpOnly?: boolean
-  /** Default: `false`. Enable in production to require HTTPS. */
-  secure?: boolean
-  /** Default: `'Lax'` */
-  sameSite?: 'Strict' | 'Lax' | 'None'
-  /** Default: `'/'` */
-  path?: string
-  domain?: string
-}
-
-// ─── Signing ──────────────────────────────────────────────────────────────────
-
-function sign(payload: string, secret: string): string {
-  const sig = createHmac('sha256', secret).update(payload).digest('base64url')
-  return `${payload}.${sig}`
-}
-
-function verify(value: string, secrets: string[]): Record<string, unknown> | null {
-  const dot = value.lastIndexOf('.')
-  if (dot === -1) return null
-
-  const payload = value.slice(0, dot)
-  const sigBuf = Buffer.from(value.slice(dot + 1), 'base64url')
-
-  for (const secret of secrets) {
-    const expectedBuf = createHmac('sha256', secret).update(payload).digest()
-    if (expectedBuf.length === sigBuf.length && timingSafeEqual(expectedBuf, sigBuf)) {
-      try {
-        return JSON.parse(Buffer.from(payload, 'base64url').toString('utf-8')) as Record<
-          string,
-          unknown
-        >
-      } catch {
-        return null
-      }
-    }
-  }
-
-  return null
-}
-
-// ─── Middleware ───────────────────────────────────────────────────────────────
-
-/**
- * HMAC-signed cookie session middleware. Parses the incoming session cookie,
- * exposes the data as `ctx.state.session`, and automatically writes an updated
- * cookie when the session is mutated or destroyed.
- *
- * Pass an array of secrets for key rotation: the first secret signs new
- * sessions, all secrets are accepted for verification.
- *
- * @example
- * import { sessionMiddleware } from '@davaux/session'
- * export default sessionMiddleware({
- *   secret: process.env.SESSION_SECRET!,
- *   maxAge: 60 * 60 * 24 * 7, // 1 week
- * })
- */
-export function sessionMiddleware(options: SessionOptions): MiddlewareFn {
-  const secrets = Array.isArray(options.secret) ? options.secret : [options.secret]
-  if (secrets.length === 0 || secrets.some((s) => !s)) {
-    throw new Error('@davaux/session: at least one non-empty secret is required')
-  }
-  if (secrets.some((s) => s.length < 32)) {
-    console.warn(
-      '@davaux/session: secret should be at least 32 characters — short secrets are weak and easy to brute-force',
-    )
-  }
-
-  const name = options.cookieName ?? 'session'
-
-  return async (ctx, next) => {
-    const raw = ctx.cookies.get(name)
-    const existing = raw ? verify(raw, secrets) : null
-    const session = new Session(existing ?? {})
-    ctx.state.session = session
-
-    // Inject the session cookie right before headers are committed.
-    // This approach handles the common case where the route handler calls
-    // res.writeHead() inside next(), after which res.setHeader() would fail.
-    const originalWriteHead = ctx.res.writeHead.bind(ctx.res) as typeof ctx.res.writeHead
-    // biome-ignore lint/suspicious/noExplicitAny: writeHead has multiple overloads
-    ctx.res.writeHead = ((...args: any[]) => {
-      ctx.res.writeHead = originalWriteHead
-      if (session.destroyed) {
-        ctx.cookies.delete(name, { path: options.path ?? '/' })
-      } else if (session.dirty) {
-        const payload = Buffer.from(JSON.stringify(session.data)).toString('base64url')
-        const signed = sign(payload, secrets[0])
-        ctx.cookies.set(name, signed, {
-          httpOnly: options.httpOnly ?? true,
-          secure: options.secure ?? false,
-          sameSite: options.sameSite ?? 'Lax',
-          maxAge: options.maxAge,
-          path: options.path ?? '/',
-          domain: options.domain,
-        })
-      }
-      // biome-ignore lint/suspicious/noExplicitAny: forwarding overloaded args
-      return (originalWriteHead as (...a: any[]) => ServerResponse)(...args)
-    }) as typeof ctx.res.writeHead
-
-    await next()
-  }
-}

package/tsconfig.json

@@ -1,17 +0,0 @@
-{
-  "compilerOptions": {
-    "target": "ESNext",
-    "module": "NodeNext",
-    "moduleResolution": "NodeNext",
-    "strict": true,
-    "declaration": true,
-    "declarationMap": true,
-    "sourceMap": true,
-    "outDir": "./dist",
-    "rootDir": "./src",
-    "skipLibCheck": true,
-    "lib": ["ESNext"],
-    "types": ["node"]
-  },
-  "include": ["src/**/*"]
-}