@eggjs/session 4.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) Alibaba Group Holding Limited and other contributors.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,134 @@
+# @eggjs/session
+
+[![NPM version][npm-image]][npm-url]
+[![Node.js CI](https://github.com/eggjs/session/actions/workflows/nodejs.yml/badge.svg)](https://github.com/eggjs/session/actions/workflows/nodejs.yml)
+[![Test coverage][codecov-image]][codecov-url]
+[![Known Vulnerabilities][snyk-image]][snyk-url]
+[![npm download][download-image]][download-url]
+[![Node.js Version](https://img.shields.io/node/v/@eggjs/session.svg?style=flat)](https://nodejs.org/en/download/)
+[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=flat-square)](https://makeapullrequest.com)
+![CodeRabbit Pull Request Reviews](https://img.shields.io/coderabbit/prs/github/eggjs/session)
+
+[npm-image]: https://img.shields.io/npm/v/@eggjs/session.svg?style=flat-square
+[npm-url]: https://npmjs.org/package/@eggjs/session
+[codecov-image]: https://codecov.io/gh/eggjs/session/branch/master/graph/badge.svg
+[codecov-url]: https://codecov.io/gh/eggjs/session
+[snyk-image]: https://snyk.io/test/npm/@eggjs/session/badge.svg?style=flat-square
+[snyk-url]: https://snyk.io/test/npm/@eggjs/session
+[download-image]: https://img.shields.io/npm/dm/@eggjs/session.svg?style=flat-square
+[download-url]: https://npmjs.org/package/@eggjs/session
+
+Session plugin for egg, based on [koa-session](https://github.com/koajs/session).
+
+## Install
+
+```bash
+npm i @eggjs/session
+```
+
+## Usage
+
+egg-session is a built-in plugin in egg and enabled by default.
+
+```js
+// {app_root}/config/plugin.js
+exports.session = true; // enable by default
+```
+
+### External Store
+
+egg-session support external store, you can store your sessions in redis, memcached or other databases.
+
+For example, if you want to store session in redis, you must:
+
+1. Dependent [egg-redis](https://github.com/eggjs/egg-redis)
+
+  ```bash
+  npm i --save egg-redis
+  ```
+
+2. Import egg-redis as a plugin and set the configuration
+
+  ```js
+  // config/plugin.js
+  exports.redis = {
+    enable: true,
+    package: 'egg-redis',
+  };
+  ```
+
+  ```js
+  // config/config.default.js
+  exports.redis = {
+    // your redis configurations
+  };
+  ```
+
+3. Implement a session store with redis
+
+  ```js
+  // app.js
+
+  module.exports = app => {
+    // set redis session store
+    // session store must have 3 methods
+    // define sessionStore in `app.js` so you can access `app.redis`
+    app.sessionStore = {
+      async get(key) {
+        const res = await app.redis.get(key);
+        if (!res) return null;
+        return JSON.parse(res);
+      },
+
+      async set(key, value, maxAge) {
+        // maxAge not present means session cookies
+        // we can't exactly know the maxAge and just set an appropriate value like one day
+        if (!maxAge) maxAge = 24 * 60 * 60 * 1000;
+        value = JSON.stringify(value);
+        await app.redis.set(key, value, 'PX', maxAge);
+      },
+
+      async destroy(key) {
+        await app.redis.del(key);
+      },
+    };
+
+    // session store can be a session store class
+    // app.sessionStore = class Store {
+    //   constructor(app) {
+    //     this.app = app;
+    //   }
+    //   async get() {}
+    //   async set() {}
+    //   async destroy() {}
+    // };
+  };
+  ```
+
+Once you use external session store, session is strong dependent on your external store, you can't access session if your external store is down. **Use external session stores only if necessary, avoid use session as a cache, keep session lean and stored by cookie!**
+
+## Configuration
+
+Support all configurations in [koa-session](https://github.com/koajs/session).
+
+* logValue
+
+```bash
+Support not to print the session value when session event trigger log. Default to be true.
+```
+
+[View the default configurations](https://github.com/eggjs/egg-session/blob/master/config/config.default.js)
+
+## Questions & Suggestions
+
+Please open an issue [here](https://github.com/eggjs/egg/issues).
+
+## License
+
+[MIT](LICENSE)
+
+## Contributors
+
+[![Contributors](https://contrib.rocks/image?repo=eggjs/session)](https://github.com/eggjs/session/graphs/contributors)
+
+Made with [contributors-img](https://contrib.rocks).

package/dist/commonjs/app/extend/application.d.ts

@@ -0,0 +1,33 @@
+import { EggCore } from '@eggjs/core';
+import type { SessionConfig } from '../../config/config.default.js';
+export type SessionStore = Required<SessionConfig>['store'];
+export type SessionStoreOrAppSessionStoreClass = SessionStore | {
+    new (app: Application): SessionStore;
+};
+export default class Application extends EggCore {
+    /**
+     * set session external store
+     *
+     * ```js
+     * app.sessionStore = {
+     *   get(key): Promise<unknown>,
+     *   set(key, data): Promise<void>,
+     *   destroy(key): Promise<void>,
+     * };
+     *
+     * app.sessionStore = class SessionStore {
+     *   constructor(app) {
+     *   }
+     *   get(key): Promise<unknown>,
+     *   set(key, data): Promise<void>,
+     *   destroy(key): Promise<void>,
+     * }
+     * ```
+     * @param {Class|Object} store session store class or instance
+     */
+    set sessionStore(store: SessionStoreOrAppSessionStoreClass | null | undefined);
+    /**
+     * get sessionStore instance
+     */
+    get sessionStore(): SessionStore | undefined;
+}

package/dist/commonjs/app/extend/application.js

@@ -0,0 +1,55 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const node_assert_1 = __importDefault(require("node:assert"));
+const core_1 = require("@eggjs/core");
+class Application extends core_1.EggCore {
+    /**
+     * set session external store
+     *
+     * ```js
+     * app.sessionStore = {
+     *   get(key): Promise<unknown>,
+     *   set(key, data): Promise<void>,
+     *   destroy(key): Promise<void>,
+     * };
+     *
+     * app.sessionStore = class SessionStore {
+     *   constructor(app) {
+     *   }
+     *   get(key): Promise<unknown>,
+     *   set(key, data): Promise<void>,
+     *   destroy(key): Promise<void>,
+     * }
+     * ```
+     * @param {Class|Object} store session store class or instance
+     */
+    set sessionStore(store) {
+        if (this.config.session.store && this.config.env !== 'unittest') {
+            this.coreLogger.warn('[@eggjs/session] sessionStore already exists and will be overwrite');
+        }
+        // support this.sessionStore = null to disable external store
+        if (!store) {
+            this.config.session.store = undefined;
+            this.coreLogger.info('[@eggjs/session] sessionStore is disabled');
+            return;
+        }
+        if (typeof store === 'function') {
+            store = new store(this);
+        }
+        (0, node_assert_1.default)(typeof store.get === 'function', 'store.get must be function');
+        (0, node_assert_1.default)(typeof store.set === 'function', 'store.set must be function');
+        (0, node_assert_1.default)(typeof store.destroy === 'function', 'store.destroy must be function');
+        this.config.session.store = store;
+    }
+    /**
+     * get sessionStore instance
+     */
+    get sessionStore() {
+        return this.config.session.store;
+    }
+}
+exports.default = Application;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBwbGljYXRpb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvYXBwL2V4dGVuZC9hcHBsaWNhdGlvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7OztBQUFBLDhEQUFpQztBQUNqQyxzQ0FBc0M7QUFTdEMsTUFBcUIsV0FBWSxTQUFRLGNBQU87SUFDOUM7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7T0FtQkc7SUFDSCxJQUFJLFlBQVksQ0FBQyxLQUE0RDtRQUMzRSxJQUFJLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLEtBQUssSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsS0FBSyxVQUFVLEVBQUUsQ0FBQztZQUNoRSxJQUFJLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxvRUFBb0UsQ0FBQyxDQUFDO1FBQzdGLENBQUM7UUFFRCw2REFBNkQ7UUFDN0QsSUFBSSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ1gsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsS0FBSyxHQUFHLFNBQVMsQ0FBQztZQUN0QyxJQUFJLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQywyQ0FBMkMsQ0FBQyxDQUFDO1lBQ2xFLE9BQU87UUFDVCxDQUFDO1FBRUQsSUFBSSxPQUFPLEtBQUssS0FBSyxVQUFVLEVBQUUsQ0FBQztZQUNoQyxLQUFLLEdBQUcsSUFBSSxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDMUIsQ0FBQztRQUNELElBQUEscUJBQU0sRUFBQyxPQUFPLEtBQUssQ0FBQyxHQUFHLEtBQUssVUFBVSxFQUFFLDRCQUE0QixDQUFDLENBQUM7UUFDdEUsSUFBQSxxQkFBTSxFQUFDLE9BQU8sS0FBSyxDQUFDLEdBQUcsS0FBSyxVQUFVLEVBQUUsNEJBQTRCLENBQUMsQ0FBQztRQUN0RSxJQUFBLHFCQUFNLEVBQUMsT0FBTyxLQUFLLENBQUMsT0FBTyxLQUFLLFVBQVUsRUFBRSxnQ0FBZ0MsQ0FBQyxDQUFDO1FBQzlFLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLEtBQUssR0FBRyxLQUFLLENBQUM7SUFDcEMsQ0FBQztJQUVEOztPQUVHO0lBQ0gsSUFBSSxZQUFZO1FBQ2QsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUM7SUFDbkMsQ0FBQztDQUNGO0FBaERELDhCQWdEQyJ9

package/dist/commonjs/app/middleware/session.d.ts

@@ -0,0 +1,2 @@
+import { createSession } from 'koa-session';
+export default createSession;

package/dist/commonjs/app/middleware/session.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const koa_session_1 = require("koa-session");
+exports.default = koa_session_1.createSession;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2Vzc2lvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy9hcHAvbWlkZGxld2FyZS9zZXNzaW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7O0FBQUEsNkNBQTRDO0FBRTVDLGtCQUFlLDJCQUFhLENBQUMifQ==

package/dist/commonjs/app.d.ts

@@ -0,0 +1,6 @@
+import type { ILifecycleBoot, EggCore } from '@eggjs/core';
+export default class AppBoot implements ILifecycleBoot {
+    private readonly app;
+    constructor(app: EggCore);
+    configWillLoad(): void;
+}

package/dist/commonjs/app.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const config_default_js_1 = require("./config/config.default.js");
+class AppBoot {
+    app;
+    constructor(app) {
+        this.app = app;
+    }
+    configWillLoad() {
+        const app = this.app;
+        config_default_js_1.SessionConfig.parse(app.config.session);
+        if (!app.config.session.httpOnly) {
+            app.coreLogger.warn('[@eggjs/session]: please set `config.session.httpOnly` to true. It is very dangerous if session can read by client JavaScript.');
+        }
+        app.config.coreMiddleware.push('session');
+        // listen on session's events
+        app.on('session:missed', ({ ctx, key }) => {
+            ctx.coreLogger.warn('[session][missed] key(%s)', key);
+        });
+        app.on('session:expired', ({ ctx, key, value }) => {
+            ctx.coreLogger.warn('[session][expired] key(%s) value(%j)', key, app.config.session.logValue ? value : '');
+        });
+        app.on('session:invalid', ({ ctx, key, value }) => {
+            ctx.coreLogger.warn('[session][invalid] key(%s) value(%j)', key, app.config.session.logValue ? value : '');
+        });
+    }
+}
+exports.default = AppBoot;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBwLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2FwcC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOztBQUNBLGtFQUEyRDtBQUUzRCxNQUFxQixPQUFPO0lBQ1QsR0FBRyxDQUFDO0lBRXJCLFlBQVksR0FBWTtRQUN0QixJQUFJLENBQUMsR0FBRyxHQUFHLEdBQUcsQ0FBQztJQUNqQixDQUFDO0lBRUQsY0FBYztRQUNaLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUM7UUFDckIsaUNBQWEsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUV4QyxJQUFJLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDakMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsZ0lBQWdJLENBQUMsQ0FBQztRQUN4SixDQUFDO1FBQ0QsR0FBRyxDQUFDLE1BQU0sQ0FBQyxjQUFjLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzFDLDZCQUE2QjtRQUM3QixHQUFHLENBQUMsRUFBRSxDQUFDLGdCQUFnQixFQUFFLENBQUMsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLEVBQUUsRUFBRTtZQUN4QyxHQUFHLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQywyQkFBMkIsRUFBRSxHQUFHLENBQUMsQ0FBQztRQUN4RCxDQUFDLENBQUMsQ0FBQztRQUNILEdBQUcsQ0FBQyxFQUFFLENBQUMsaUJBQWlCLEVBQUUsQ0FBQyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFBRTtZQUNoRCxHQUFHLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxzQ0FBc0MsRUFBRSxHQUFHLEVBQUUsR0FBRyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQzdHLENBQUMsQ0FBQyxDQUFDO1FBQ0gsR0FBRyxDQUFDLEVBQUUsQ0FBQyxpQkFBaUIsRUFBRSxDQUFDLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFO1lBQ2hELEdBQUcsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLHNDQUFzQyxFQUFFLEdBQUcsRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDN0csQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0NBQ0Y7QUExQkQsMEJBMEJDIn0=

package/dist/commonjs/config/config.default.d.ts

@@ -0,0 +1,206 @@
+import z from 'zod';
+export declare const SessionConfig: z.ZodObject<z.objectUtil.extendShape<{
+    key: z.ZodDefault<z.ZodString>;
+    maxAge: z.ZodOptional<z.ZodUnion<[z.ZodNumber, z.ZodLiteral<"session">]>>;
+    autoCommit: z.ZodDefault<z.ZodBoolean>;
+    overwrite: z.ZodDefault<z.ZodBoolean>;
+    httpOnly: z.ZodDefault<z.ZodBoolean>;
+    signed: z.ZodDefault<z.ZodBoolean>;
+    rolling: z.ZodDefault<z.ZodBoolean>;
+    renew: z.ZodDefault<z.ZodBoolean>;
+    secure: z.ZodOptional<z.ZodBoolean>;
+    sameSite: z.ZodOptional<z.ZodString>;
+    externalKey: z.ZodOptional<z.ZodObject<{
+        get: z.ZodFunction<z.ZodTuple<[z.ZodAny], z.ZodUnknown>, z.ZodString>;
+        set: z.ZodFunction<z.ZodTuple<[z.ZodAny, z.ZodString], z.ZodUnknown>, z.ZodVoid>;
+    }, "strip", z.ZodTypeAny, {
+        set: (args_0: any, args_1: string, ...args: unknown[]) => void;
+        get: (args_0: any, ...args: unknown[]) => string;
+    }, {
+        set: (args_0: any, args_1: string, ...args: unknown[]) => void;
+        get: (args_0: any, ...args: unknown[]) => string;
+    }>>;
+    store: z.ZodOptional<z.ZodObject<{
+        get: z.ZodFunction<z.ZodTuple<[z.ZodString, z.ZodNumber, z.ZodObject<{
+            rolling: z.ZodBoolean;
+            ctx: z.ZodAny;
+        }, "strip", z.ZodTypeAny, {
+            rolling: boolean;
+            ctx?: any;
+        }, {
+            rolling: boolean;
+            ctx?: any;
+        }>], z.ZodUnknown>, z.ZodPromise<z.ZodAny>>;
+        set: z.ZodFunction<z.ZodTuple<[z.ZodString, z.ZodAny, z.ZodNumber, z.ZodObject<{
+            rolling: z.ZodBoolean;
+            changed: z.ZodBoolean;
+            ctx: z.ZodAny;
+        }, "strip", z.ZodTypeAny, {
+            rolling: boolean;
+            changed: boolean;
+            ctx?: any;
+        }, {
+            rolling: boolean;
+            changed: boolean;
+            ctx?: any;
+        }>], z.ZodUnknown>, z.ZodPromise<z.ZodVoid>>;
+        destroy: z.ZodFunction<z.ZodTuple<[z.ZodString, z.ZodObject<{
+            ctx: z.ZodAny;
+        }, "strip", z.ZodTypeAny, {
+            ctx?: any;
+        }, {
+            ctx?: any;
+        }>], z.ZodUnknown>, z.ZodPromise<z.ZodVoid>>;
+    }, "strip", z.ZodTypeAny, {
+        set: (args_0: string, args_1: any, args_2: number, args_3: {
+            rolling: boolean;
+            changed: boolean;
+            ctx?: any;
+        }, ...args: unknown[]) => Promise<void>;
+        get: (args_0: string, args_1: number, args_2: {
+            rolling: boolean;
+            ctx?: any;
+        }, ...args: unknown[]) => Promise<any>;
+        destroy: (args_0: string, args_1: {
+            ctx?: any;
+        }, ...args: unknown[]) => Promise<void>;
+    }, {
+        set: (args_0: string, args_1: any, args_2: number, args_3: {
+            rolling: boolean;
+            changed: boolean;
+            ctx?: any;
+        }, ...args: unknown[]) => Promise<void>;
+        get: (args_0: string, args_1: number, args_2: {
+            rolling: boolean;
+            ctx?: any;
+        }, ...args: unknown[]) => Promise<any>;
+        destroy: (args_0: string, args_1: {
+            ctx?: any;
+        }, ...args: unknown[]) => Promise<void>;
+    }>>;
+    ContextStore: z.ZodOptional<z.ZodAny>;
+    encode: z.ZodDefault<z.ZodOptional<z.ZodFunction<z.ZodTuple<[z.ZodAny], z.ZodUnknown>, z.ZodString>>>;
+    decode: z.ZodDefault<z.ZodFunction<z.ZodTuple<[z.ZodString], z.ZodUnknown>, z.ZodAny>>;
+    genid: z.ZodOptional<z.ZodFunction<z.ZodTuple<[z.ZodAny], z.ZodUnknown>, z.ZodString>>;
+    prefix: z.ZodOptional<z.ZodString>;
+    valid: z.ZodOptional<z.ZodFunction<z.ZodTuple<[z.ZodAny, z.ZodAny], z.ZodUnknown>, z.ZodAny>>;
+    beforeSave: z.ZodOptional<z.ZodFunction<z.ZodTuple<[z.ZodAny, z.ZodAny], z.ZodUnknown>, z.ZodVoid>>;
+}, {
+    logValue: z.ZodDefault<z.ZodBoolean>;
+}>, "strip", z.ZodTypeAny, {
+    logValue: boolean;
+    key: string;
+    autoCommit: boolean;
+    overwrite: boolean;
+    httpOnly: boolean;
+    signed: boolean;
+    rolling: boolean;
+    renew: boolean;
+    encode: (args_0: any, ...args: unknown[]) => string;
+    decode: (args_0: string, ...args: unknown[]) => any;
+    maxAge?: number | "session" | undefined;
+    secure?: boolean | undefined;
+    sameSite?: string | undefined;
+    externalKey?: {
+        set: (args_0: any, args_1: string, ...args: unknown[]) => void;
+        get: (args_0: any, ...args: unknown[]) => string;
+    } | undefined;
+    store?: {
+        set: (args_0: string, args_1: any, args_2: number, args_3: {
+            rolling: boolean;
+            changed: boolean;
+            ctx?: any;
+        }, ...args: unknown[]) => Promise<void>;
+        get: (args_0: string, args_1: number, args_2: {
+            rolling: boolean;
+            ctx?: any;
+        }, ...args: unknown[]) => Promise<any>;
+        destroy: (args_0: string, args_1: {
+            ctx?: any;
+        }, ...args: unknown[]) => Promise<void>;
+    } | undefined;
+    ContextStore?: any;
+    genid?: ((args_0: any, ...args: unknown[]) => string) | undefined;
+    prefix?: string | undefined;
+    valid?: ((args_0: any, args_1: any, ...args: unknown[]) => any) | undefined;
+    beforeSave?: ((args_0: any, args_1: any, ...args: unknown[]) => void) | undefined;
+}, {
+    logValue?: boolean | undefined;
+    key?: string | undefined;
+    maxAge?: number | "session" | undefined;
+    autoCommit?: boolean | undefined;
+    overwrite?: boolean | undefined;
+    httpOnly?: boolean | undefined;
+    signed?: boolean | undefined;
+    rolling?: boolean | undefined;
+    renew?: boolean | undefined;
+    secure?: boolean | undefined;
+    sameSite?: string | undefined;
+    externalKey?: {
+        set: (args_0: any, args_1: string, ...args: unknown[]) => void;
+        get: (args_0: any, ...args: unknown[]) => string;
+    } | undefined;
+    store?: {
+        set: (args_0: string, args_1: any, args_2: number, args_3: {
+            rolling: boolean;
+            changed: boolean;
+            ctx?: any;
+        }, ...args: unknown[]) => Promise<void>;
+        get: (args_0: string, args_1: number, args_2: {
+            rolling: boolean;
+            ctx?: any;
+        }, ...args: unknown[]) => Promise<any>;
+        destroy: (args_0: string, args_1: {
+            ctx?: any;
+        }, ...args: unknown[]) => Promise<void>;
+    } | undefined;
+    ContextStore?: any;
+    encode?: ((args_0: any, ...args: unknown[]) => string) | undefined;
+    decode?: ((args_0: string, ...args: unknown[]) => any) | undefined;
+    genid?: ((args_0: any, ...args: unknown[]) => string) | undefined;
+    prefix?: string | undefined;
+    valid?: ((args_0: any, args_1: any, ...args: unknown[]) => any) | undefined;
+    beforeSave?: ((args_0: any, args_1: any, ...args: unknown[]) => void) | undefined;
+}>;
+export type SessionConfig = z.infer<typeof SessionConfig>;
+declare const _default: {
+    session: {
+        logValue: boolean;
+        key: string;
+        autoCommit: boolean;
+        overwrite: boolean;
+        httpOnly: boolean;
+        signed: boolean;
+        rolling: boolean;
+        renew: boolean;
+        encode: (args_0: any, ...args: unknown[]) => string;
+        decode: (args_0: string, ...args: unknown[]) => any;
+        maxAge?: number | "session" | undefined;
+        secure?: boolean | undefined;
+        sameSite?: string | undefined;
+        externalKey?: {
+            set: (args_0: any, args_1: string, ...args: unknown[]) => void;
+            get: (args_0: any, ...args: unknown[]) => string;
+        } | undefined;
+        store?: {
+            set: (args_0: string, args_1: any, args_2: number, args_3: {
+                rolling: boolean;
+                changed: boolean;
+                ctx?: any;
+            }, ...args: unknown[]) => Promise<void>;
+            get: (args_0: string, args_1: number, args_2: {
+                rolling: boolean;
+                ctx?: any;
+            }, ...args: unknown[]) => Promise<any>;
+            destroy: (args_0: string, args_1: {
+                ctx?: any;
+            }, ...args: unknown[]) => Promise<void>;
+        } | undefined;
+        ContextStore?: any;
+        genid?: ((args_0: any, ...args: unknown[]) => string) | undefined;
+        prefix?: string | undefined;
+        valid?: ((args_0: any, args_1: any, ...args: unknown[]) => any) | undefined;
+        beforeSave?: ((args_0: any, args_1: any, ...args: unknown[]) => void) | undefined;
+    };
+};
+export default _default;

package/dist/commonjs/config/config.default.js

@@ -0,0 +1,20 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionConfig = void 0;
+const zod_1 = __importDefault(require("zod"));
+const koa_session_1 = require("koa-session");
+exports.SessionConfig = koa_session_1.SessionOptions.extend({
+    logValue: zod_1.default.boolean().default(true),
+});
+exports.default = {
+    session: exports.SessionConfig.parse({
+        maxAge: 24 * 3600 * 1000, // ms, one day
+        key: 'EGG_SESS',
+        httpOnly: true,
+        encrypt: true,
+    }),
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uZmlnLmRlZmF1bHQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvY29uZmlnL2NvbmZpZy5kZWZhdWx0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiI7Ozs7OztBQUFBLDhDQUFvQjtBQUNwQiw2Q0FBNkM7QUFFaEMsUUFBQSxhQUFhLEdBQUcsNEJBQWMsQ0FBQyxNQUFNLENBQUM7SUFDakQsUUFBUSxFQUFFLGFBQUMsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDO0NBQ3BDLENBQUMsQ0FBQztBQUlILGtCQUFlO0lBQ2IsT0FBTyxFQUFFLHFCQUFhLENBQUMsS0FBSyxDQUFDO1FBQzNCLE1BQU0sRUFBRSxFQUFFLEdBQUcsSUFBSSxHQUFHLElBQUksRUFBRSxjQUFjO1FBQ3hDLEdBQUcsRUFBRSxVQUFVO1FBQ2YsUUFBUSxFQUFFLElBQUk7UUFDZCxPQUFPLEVBQUUsSUFBSTtLQUNkLENBQUM7Q0FDSCxDQUFDIn0=

package/dist/commonjs/index.d.ts

@@ -0,0 +1,2 @@
+import './types.js';
+export * from './config/config.default.js';

package/dist/commonjs/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+require("./types.js");
+__exportStar(require("./config/config.default.js"), exports);
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7Ozs7Ozs7Ozs7Ozs7OztBQUFBLHNCQUFvQjtBQUVwQiw2REFBMkMifQ==

package/dist/commonjs/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

package/dist/commonjs/types.d.ts

@@ -0,0 +1,6 @@
+import type { SessionConfig } from './config/config.default.js';
+declare module '@eggjs/core' {
+    interface EggAppConfig {
+        session: SessionConfig;
+    }
+}

package/dist/commonjs/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdHlwZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiJ9

package/dist/esm/app/extend/application.d.ts

@@ -0,0 +1,33 @@
+import { EggCore } from '@eggjs/core';
+import type { SessionConfig } from '../../config/config.default.js';
+export type SessionStore = Required<SessionConfig>['store'];
+export type SessionStoreOrAppSessionStoreClass = SessionStore | {
+    new (app: Application): SessionStore;
+};
+export default class Application extends EggCore {
+    /**
+     * set session external store
+     *
+     * ```js
+     * app.sessionStore = {
+     *   get(key): Promise<unknown>,
+     *   set(key, data): Promise<void>,
+     *   destroy(key): Promise<void>,
+     * };
+     *
+     * app.sessionStore = class SessionStore {
+     *   constructor(app) {
+     *   }
+     *   get(key): Promise<unknown>,
+     *   set(key, data): Promise<void>,
+     *   destroy(key): Promise<void>,
+     * }
+     * ```
+     * @param {Class|Object} store session store class or instance
+     */
+    set sessionStore(store: SessionStoreOrAppSessionStoreClass | null | undefined);
+    /**
+     * get sessionStore instance
+     */
+    get sessionStore(): SessionStore | undefined;
+}

package/dist/esm/app/extend/application.js

@@ -0,0 +1,49 @@
+import assert from 'node:assert';
+import { EggCore } from '@eggjs/core';
+export default class Application extends EggCore {
+    /**
+     * set session external store
+     *
+     * ```js
+     * app.sessionStore = {
+     *   get(key): Promise<unknown>,
+     *   set(key, data): Promise<void>,
+     *   destroy(key): Promise<void>,
+     * };
+     *
+     * app.sessionStore = class SessionStore {
+     *   constructor(app) {
+     *   }
+     *   get(key): Promise<unknown>,
+     *   set(key, data): Promise<void>,
+     *   destroy(key): Promise<void>,
+     * }
+     * ```
+     * @param {Class|Object} store session store class or instance
+     */
+    set sessionStore(store) {
+        if (this.config.session.store && this.config.env !== 'unittest') {
+            this.coreLogger.warn('[@eggjs/session] sessionStore already exists and will be overwrite');
+        }
+        // support this.sessionStore = null to disable external store
+        if (!store) {
+            this.config.session.store = undefined;
+            this.coreLogger.info('[@eggjs/session] sessionStore is disabled');
+            return;
+        }
+        if (typeof store === 'function') {
+            store = new store(this);
+        }
+        assert(typeof store.get === 'function', 'store.get must be function');
+        assert(typeof store.set === 'function', 'store.set must be function');
+        assert(typeof store.destroy === 'function', 'store.destroy must be function');
+        this.config.session.store = store;
+    }
+    /**
+     * get sessionStore instance
+     */
+    get sessionStore() {
+        return this.config.session.store;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBwbGljYXRpb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi9zcmMvYXBwL2V4dGVuZC9hcHBsaWNhdGlvbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLE1BQU0sTUFBTSxhQUFhLENBQUM7QUFDakMsT0FBTyxFQUFFLE9BQU8sRUFBRSxNQUFNLGFBQWEsQ0FBQztBQVN0QyxNQUFNLENBQUMsT0FBTyxPQUFPLFdBQVksU0FBUSxPQUFPO0lBQzlDOzs7Ozs7Ozs7Ozs7Ozs7Ozs7O09BbUJHO0lBQ0gsSUFBSSxZQUFZLENBQUMsS0FBNEQ7UUFDM0UsSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxLQUFLLElBQUksSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLEtBQUssVUFBVSxFQUFFLENBQUM7WUFDaEUsSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsb0VBQW9FLENBQUMsQ0FBQztRQUM3RixDQUFDO1FBRUQsNkRBQTZEO1FBQzdELElBQUksQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUNYLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLEtBQUssR0FBRyxTQUFTLENBQUM7WUFDdEMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsMkNBQTJDLENBQUMsQ0FBQztZQUNsRSxPQUFPO1FBQ1QsQ0FBQztRQUVELElBQUksT0FBTyxLQUFLLEtBQUssVUFBVSxFQUFFLENBQUM7WUFDaEMsS0FBSyxHQUFHLElBQUksS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQzFCLENBQUM7UUFDRCxNQUFNLENBQUMsT0FBTyxLQUFLLENBQUMsR0FBRyxLQUFLLFVBQVUsRUFBRSw0QkFBNEIsQ0FBQyxDQUFDO1FBQ3RFLE1BQU0sQ0FBQyxPQUFPLEtBQUssQ0FBQyxHQUFHLEtBQUssVUFBVSxFQUFFLDRCQUE0QixDQUFDLENBQUM7UUFDdEUsTUFBTSxDQUFDLE9BQU8sS0FBSyxDQUFDLE9BQU8sS0FBSyxVQUFVLEVBQUUsZ0NBQWdDLENBQUMsQ0FBQztRQUM5RSxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxLQUFLLEdBQUcsS0FBSyxDQUFDO0lBQ3BDLENBQUM7SUFFRDs7T0FFRztJQUNILElBQUksWUFBWTtRQUNkLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDO0lBQ25DLENBQUM7Q0FDRiJ9

package/dist/esm/app/middleware/session.d.ts

@@ -0,0 +1,2 @@
+import { createSession } from 'koa-session';
+export default createSession;

package/dist/esm/app/middleware/session.js

@@ -0,0 +1,3 @@
+import { createSession } from 'koa-session';
+export default createSession;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2Vzc2lvbi5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3NyYy9hcHAvbWlkZGxld2FyZS9zZXNzaW9uLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxhQUFhLEVBQUUsTUFBTSxhQUFhLENBQUM7QUFFNUMsZUFBZSxhQUFhLENBQUMifQ==

package/dist/esm/app.d.ts

@@ -0,0 +1,6 @@
+import type { ILifecycleBoot, EggCore } from '@eggjs/core';
+export default class AppBoot implements ILifecycleBoot {
+    private readonly app;
+    constructor(app: EggCore);
+    configWillLoad(): void;
+}

package/dist/esm/app.js

@@ -0,0 +1,26 @@
+import { SessionConfig } from './config/config.default.js';
+export default class AppBoot {
+    app;
+    constructor(app) {
+        this.app = app;
+    }
+    configWillLoad() {
+        const app = this.app;
+        SessionConfig.parse(app.config.session);
+        if (!app.config.session.httpOnly) {
+            app.coreLogger.warn('[@eggjs/session]: please set `config.session.httpOnly` to true. It is very dangerous if session can read by client JavaScript.');
+        }
+        app.config.coreMiddleware.push('session');
+        // listen on session's events
+        app.on('session:missed', ({ ctx, key }) => {
+            ctx.coreLogger.warn('[session][missed] key(%s)', key);
+        });
+        app.on('session:expired', ({ ctx, key, value }) => {
+            ctx.coreLogger.warn('[session][expired] key(%s) value(%j)', key, app.config.session.logValue ? value : '');
+        });
+        app.on('session:invalid', ({ ctx, key, value }) => {
+            ctx.coreLogger.warn('[session][invalid] key(%s) value(%j)', key, app.config.session.logValue ? value : '');
+        });
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXBwLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vc3JjL2FwcC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFDQSxPQUFPLEVBQUUsYUFBYSxFQUFFLE1BQU0sNEJBQTRCLENBQUM7QUFFM0QsTUFBTSxDQUFDLE9BQU8sT0FBTyxPQUFPO0lBQ1QsR0FBRyxDQUFDO0lBRXJCLFlBQVksR0FBWTtRQUN0QixJQUFJLENBQUMsR0FBRyxHQUFHLEdBQUcsQ0FBQztJQUNqQixDQUFDO0lBRUQsY0FBYztRQUNaLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUM7UUFDckIsYUFBYSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBRXhDLElBQUksQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNqQyxHQUFHLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxnSUFBZ0ksQ0FBQyxDQUFDO1FBQ3hKLENBQUM7UUFDRCxHQUFHLENBQUMsTUFBTSxDQUFDLGNBQWMsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDMUMsNkJBQTZCO1FBQzdCLEdBQUcsQ0FBQyxFQUFFLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsRUFBRSxFQUFFO1lBQ3hDLEdBQUcsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLDJCQUEyQixFQUFFLEdBQUcsQ0FBQyxDQUFDO1FBQ3hELENBQUMsQ0FBQyxDQUFDO1FBQ0gsR0FBRyxDQUFDLEVBQUUsQ0FBQyxpQkFBaUIsRUFBRSxDQUFDLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUFFO1lBQ2hELEdBQUcsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLHNDQUFzQyxFQUFFLEdBQUcsRUFBRSxHQUFHLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDN0csQ0FBQyxDQUFDLENBQUM7UUFDSCxHQUFHLENBQUMsRUFBRSxDQUFDLGlCQUFpQixFQUFFLENBQUMsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLEtBQUssRUFBRSxFQUFFLEVBQUU7WUFDaEQsR0FBRyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsc0NBQXNDLEVBQUUsR0FBRyxFQUFFLEdBQUcsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUM3RyxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7Q0FDRiJ9

package/dist/esm/config/config.default.d.ts

@@ -0,0 +1,206 @@
+import z from 'zod';
+export declare const SessionConfig: z.ZodObject<z.objectUtil.extendShape<{
+    key: z.ZodDefault<z.ZodString>;
+    maxAge: z.ZodOptional<z.ZodUnion<[z.ZodNumber, z.ZodLiteral<"session">]>>;
+    autoCommit: z.ZodDefault<z.ZodBoolean>;
+    overwrite: z.ZodDefault<z.ZodBoolean>;
+    httpOnly: z.ZodDefault<z.ZodBoolean>;
+    signed: z.ZodDefault<z.ZodBoolean>;
+    rolling: z.ZodDefault<z.ZodBoolean>;
+    renew: z.ZodDefault<z.ZodBoolean>;
+    secure: z.ZodOptional<z.ZodBoolean>;
+    sameSite: z.ZodOptional<z.ZodString>;
+    externalKey: z.ZodOptional<z.ZodObject<{
+        get: z.ZodFunction<z.ZodTuple<[z.ZodAny], z.ZodUnknown>, z.ZodString>;
+        set: z.ZodFunction<z.ZodTuple<[z.ZodAny, z.ZodString], z.ZodUnknown>, z.ZodVoid>;
+    }, "strip", z.ZodTypeAny, {
+        set: (args_0: any, args_1: string, ...args: unknown[]) => void;
+        get: (args_0: any, ...args: unknown[]) => string;
+    }, {
+        set: (args_0: any, args_1: string, ...args: unknown[]) => void;
+        get: (args_0: any, ...args: unknown[]) => string;
+    }>>;
+    store: z.ZodOptional<z.ZodObject<{
+        get: z.ZodFunction<z.ZodTuple<[z.ZodString, z.ZodNumber, z.ZodObject<{
+            rolling: z.ZodBoolean;
+            ctx: z.ZodAny;
+        }, "strip", z.ZodTypeAny, {
+            rolling: boolean;
+            ctx?: any;
+        }, {
+            rolling: boolean;
+            ctx?: any;
+        }>], z.ZodUnknown>, z.ZodPromise<z.ZodAny>>;
+        set: z.ZodFunction<z.ZodTuple<[z.ZodString, z.ZodAny, z.ZodNumber, z.ZodObject<{
+            rolling: z.ZodBoolean;
+            changed: z.ZodBoolean;
+            ctx: z.ZodAny;
+        }, "strip", z.ZodTypeAny, {
+            rolling: boolean;
+            changed: boolean;
+            ctx?: any;
+        }, {
+            rolling: boolean;
+            changed: boolean;
+            ctx?: any;
+        }>], z.ZodUnknown>, z.ZodPromise<z.ZodVoid>>;
+        destroy: z.ZodFunction<z.ZodTuple<[z.ZodString, z.ZodObject<{
+            ctx: z.ZodAny;
+        }, "strip", z.ZodTypeAny, {
+            ctx?: any;
+        }, {
+            ctx?: any;
+        }>], z.ZodUnknown>, z.ZodPromise<z.ZodVoid>>;
+    }, "strip", z.ZodTypeAny, {
+        set: (args_0: string, args_1: any, args_2: number, args_3: {
+            rolling: boolean;
+            changed: boolean;
+            ctx?: any;
+        }, ...args: unknown[]) => Promise<void>;
+        get: (args_0: string, args_1: number, args_2: {
+            rolling: boolean;
+            ctx?: any;
+        }, ...args: unknown[]) => Promise<any>;
+        destroy: (args_0: string, args_1: {
+            ctx?: any;
+        }, ...args: unknown[]) => Promise<void>;
+    }, {
+        set: (args_0: string, args_1: any, args_2: number, args_3: {
+            rolling: boolean;
+            changed: boolean;
+            ctx?: any;
+        }, ...args: unknown[]) => Promise<void>;
+        get: (args_0: string, args_1: number, args_2: {
+            rolling: boolean;
+            ctx?: any;
+        }, ...args: unknown[]) => Promise<any>;
+        destroy: (args_0: string, args_1: {
+            ctx?: any;
+        }, ...args: unknown[]) => Promise<void>;
+    }>>;
+    ContextStore: z.ZodOptional<z.ZodAny>;
+    encode: z.ZodDefault<z.ZodOptional<z.ZodFunction<z.ZodTuple<[z.ZodAny], z.ZodUnknown>, z.ZodString>>>;
+    decode: z.ZodDefault<z.ZodFunction<z.ZodTuple<[z.ZodString], z.ZodUnknown>, z.ZodAny>>;
+    genid: z.ZodOptional<z.ZodFunction<z.ZodTuple<[z.ZodAny], z.ZodUnknown>, z.ZodString>>;
+    prefix: z.ZodOptional<z.ZodString>;
+    valid: z.ZodOptional<z.ZodFunction<z.ZodTuple<[z.ZodAny, z.ZodAny], z.ZodUnknown>, z.ZodAny>>;
+    beforeSave: z.ZodOptional<z.ZodFunction<z.ZodTuple<[z.ZodAny, z.ZodAny], z.ZodUnknown>, z.ZodVoid>>;
+}, {
+    logValue: z.ZodDefault<z.ZodBoolean>;
+}>, "strip", z.ZodTypeAny, {
+    logValue: boolean;
+    key: string;
+    autoCommit: boolean;
+    overwrite: boolean;
+    httpOnly: boolean;
+    signed: boolean;
+    rolling: boolean;
+    renew: boolean;
+    encode: (args_0: any, ...args: unknown[]) => string;
+    decode: (args_0: string, ...args: unknown[]) => any;
+    maxAge?: number | "session" | undefined;
+    secure?: boolean | undefined;
+    sameSite?: string | undefined;
+    externalKey?: {
+        set: (args_0: any, args_1: string, ...args: unknown[]) => void;
+        get: (args_0: any, ...args: unknown[]) => string;
+    } | undefined;
+    store?: {
+        set: (args_0: string, args_1: any, args_2: number, args_3: {
+            rolling: boolean;
+            changed: boolean;
+            ctx?: any;
+        }, ...args: unknown[]) => Promise<void>;
+        get: (args_0: string, args_1: number, args_2: {
+            rolling: boolean;
+            ctx?: any;
+        }, ...args: unknown[]) => Promise<any>;
+        destroy: (args_0: string, args_1: {
+            ctx?: any;
+        }, ...args: unknown[]) => Promise<void>;
+    } | undefined;
+    ContextStore?: any;
+    genid?: ((args_0: any, ...args: unknown[]) => string) | undefined;
+    prefix?: string | undefined;
+    valid?: ((args_0: any, args_1: any, ...args: unknown[]) => any) | undefined;
+    beforeSave?: ((args_0: any, args_1: any, ...args: unknown[]) => void) | undefined;
+}, {
+    logValue?: boolean | undefined;
+    key?: string | undefined;
+    maxAge?: number | "session" | undefined;
+    autoCommit?: boolean | undefined;
+    overwrite?: boolean | undefined;
+    httpOnly?: boolean | undefined;
+    signed?: boolean | undefined;
+    rolling?: boolean | undefined;
+    renew?: boolean | undefined;
+    secure?: boolean | undefined;
+    sameSite?: string | undefined;
+    externalKey?: {
+        set: (args_0: any, args_1: string, ...args: unknown[]) => void;
+        get: (args_0: any, ...args: unknown[]) => string;
+    } | undefined;
+    store?: {
+        set: (args_0: string, args_1: any, args_2: number, args_3: {
+            rolling: boolean;
+            changed: boolean;
+            ctx?: any;
+        }, ...args: unknown[]) => Promise<void>;
+        get: (args_0: string, args_1: number, args_2: {
+            rolling: boolean;
+            ctx?: any;
+        }, ...args: unknown[]) => Promise<any>;
+        destroy: (args_0: string, args_1: {
+            ctx?: any;
+        }, ...args: unknown[]) => Promise<void>;
+    } | undefined;
+    ContextStore?: any;
+    encode?: ((args_0: any, ...args: unknown[]) => string) | undefined;
+    decode?: ((args_0: string, ...args: unknown[]) => any) | undefined;
+    genid?: ((args_0: any, ...args: unknown[]) => string) | undefined;
+    prefix?: string | undefined;
+    valid?: ((args_0: any, args_1: any, ...args: unknown[]) => any) | undefined;
+    beforeSave?: ((args_0: any, args_1: any, ...args: unknown[]) => void) | undefined;
+}>;
+export type SessionConfig = z.infer<typeof SessionConfig>;
+declare const _default: {
+    session: {
+        logValue: boolean;
+        key: string;
+        autoCommit: boolean;
+        overwrite: boolean;
+        httpOnly: boolean;
+        signed: boolean;
+        rolling: boolean;
+        renew: boolean;
+        encode: (args_0: any, ...args: unknown[]) => string;
+        decode: (args_0: string, ...args: unknown[]) => any;
+        maxAge?: number | "session" | undefined;
+        secure?: boolean | undefined;
+        sameSite?: string | undefined;
+        externalKey?: {
+            set: (args_0: any, args_1: string, ...args: unknown[]) => void;
+            get: (args_0: any, ...args: unknown[]) => string;
+        } | undefined;
+        store?: {
+            set: (args_0: string, args_1: any, args_2: number, args_3: {
+                rolling: boolean;
+                changed: boolean;
+                ctx?: any;
+            }, ...args: unknown[]) => Promise<void>;
+            get: (args_0: string, args_1: number, args_2: {
+                rolling: boolean;
+                ctx?: any;
+            }, ...args: unknown[]) => Promise<any>;
+            destroy: (args_0: string, args_1: {
+                ctx?: any;
+            }, ...args: unknown[]) => Promise<void>;
+        } | undefined;
+        ContextStore?: any;
+        genid?: ((args_0: any, ...args: unknown[]) => string) | undefined;
+        prefix?: string | undefined;
+        valid?: ((args_0: any, args_1: any, ...args: unknown[]) => any) | undefined;
+        beforeSave?: ((args_0: any, args_1: any, ...args: unknown[]) => void) | undefined;
+    };
+};
+export default _default;

package/dist/esm/config/config.default.js

@@ -0,0 +1,14 @@
+import z from 'zod';
+import { SessionOptions } from 'koa-session';
+export const SessionConfig = SessionOptions.extend({
+    logValue: z.boolean().default(true),
+});
+export default {
+    session: SessionConfig.parse({
+        maxAge: 24 * 3600 * 1000, // ms, one day
+        key: 'EGG_SESS',
+        httpOnly: true,
+        encrypt: true,
+    }),
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uZmlnLmRlZmF1bHQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvY29uZmlnL2NvbmZpZy5kZWZhdWx0LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sQ0FBQyxNQUFNLEtBQUssQ0FBQztBQUNwQixPQUFPLEVBQUUsY0FBYyxFQUFFLE1BQU0sYUFBYSxDQUFDO0FBRTdDLE1BQU0sQ0FBQyxNQUFNLGFBQWEsR0FBRyxjQUFjLENBQUMsTUFBTSxDQUFDO0lBQ2pELFFBQVEsRUFBRSxDQUFDLENBQUMsT0FBTyxFQUFFLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQztDQUNwQyxDQUFDLENBQUM7QUFJSCxlQUFlO0lBQ2IsT0FBTyxFQUFFLGFBQWEsQ0FBQyxLQUFLLENBQUM7UUFDM0IsTUFBTSxFQUFFLEVBQUUsR0FBRyxJQUFJLEdBQUcsSUFBSSxFQUFFLGNBQWM7UUFDeEMsR0FBRyxFQUFFLFVBQVU7UUFDZixRQUFRLEVBQUUsSUFBSTtRQUNkLE9BQU8sRUFBRSxJQUFJO0tBQ2QsQ0FBQztDQUNILENBQUMifQ==

package/dist/esm/index.d.ts

@@ -0,0 +1,2 @@
+import './types.js';
+export * from './config/config.default.js';

package/dist/esm/index.js

@@ -0,0 +1,3 @@
+import './types.js';
+export * from './config/config.default.js';
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxZQUFZLENBQUM7QUFFcEIsY0FBYyw0QkFBNEIsQ0FBQyJ9

package/dist/esm/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

package/dist/esm/types.d.ts

@@ -0,0 +1,6 @@
+import type { SessionConfig } from './config/config.default.js';
+declare module '@eggjs/core' {
+    interface EggAppConfig {
+        session: SessionConfig;
+    }
+}

package/dist/esm/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi9zcmMvdHlwZXMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IiJ9

package/dist/package.json

@@ -0,0 +1,4 @@
+{
+  "name": "@eggjs/session",
+  "version": "4.0.0"
+}

package/package.json

@@ -0,0 +1,92 @@
+{
+  "name": "@eggjs/session",
+  "version": "4.0.0",
+  "publishConfig": {
+    "access": "public"
+  },
+  "description": "session plugin for egg",
+  "eggPlugin": {
+    "name": "session",
+    "exports": {
+      "import": "./dist/esm",
+      "require": "./dist/commonjs",
+      "typescript": "./src"
+    }
+  },
+  "repository": {
+    "type": "git",
+    "url": "git@github.com:eggjs/session.git"
+  },
+  "author": "dead_horse",
+  "keywords": [
+    "egg",
+    "egg-plugin",
+    "eggPlugin",
+    "session",
+    "cookie"
+  ],
+  "engines": {
+    "node": ">= 18.19.0"
+  },
+  "dependencies": {
+    "@eggjs/core": "^6.2.13",
+    "koa-session": "^7.0.2",
+    "zod": "^3.24.1"
+  },
+  "devDependencies": {
+    "@arethetypeswrong/cli": "^0.17.1",
+    "@eggjs/bin": "7",
+    "@eggjs/mock": "^6.0.5",
+    "@eggjs/supertest": "^8.2.0",
+    "@eggjs/tsconfig": "1",
+    "@types/mocha": "10",
+    "@types/node": "22",
+    "egg": "^4.0.1",
+    "egg-redis": "^2.6.0",
+    "eslint": "8",
+    "eslint-config-egg": "14",
+    "rimraf": "6",
+    "snap-shot-it": "^7.9.10",
+    "tshy": "3",
+    "tshy-after": "1",
+    "typescript": "5"
+  },
+  "scripts": {
+    "lint": "eslint --cache src test --ext .ts",
+    "pretest": "npm run clean && npm run lint -- --fix",
+    "test": "egg-bin test",
+    "test:snapshot:update": "SNAPSHOT_UPDATE=1 egg-bin test",
+    "preci": "npm run clean &&  npm run lint",
+    "ci": "egg-bin cov",
+    "postci": "npm run prepublishOnly && npm run clean",
+    "clean": "rimraf dist",
+    "prepublishOnly": "tshy && tshy-after && attw --pack"
+  },
+  "type": "module",
+  "tshy": {
+    "exports": {
+      ".": "./src/index.ts",
+      "./package.json": "./package.json"
+    }
+  },
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/esm/index.d.ts",
+        "default": "./dist/esm/index.js"
+      },
+      "require": {
+        "types": "./dist/commonjs/index.d.ts",
+        "default": "./dist/commonjs/index.js"
+      }
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "src"
+  ],
+  "types": "./dist/commonjs/index.d.ts",
+  "main": "./dist/commonjs/index.js",
+  "module": "./dist/esm/index.js"
+}

package/src/app/extend/application.ts

@@ -0,0 +1,59 @@
+import assert from 'node:assert';
+import { EggCore } from '@eggjs/core';
+import type { SessionConfig } from '../../config/config.default.js';
+
+export type SessionStore = Required<SessionConfig>['store'];
+
+export type SessionStoreOrAppSessionStoreClass = SessionStore | {
+  new(app: Application): SessionStore;
+};
+
+export default class Application extends EggCore {
+  /**
+   * set session external store
+   *
+   * ```js
+   * app.sessionStore = {
+   *   get(key): Promise<unknown>,
+   *   set(key, data): Promise<void>,
+   *   destroy(key): Promise<void>,
+   * };
+   *
+   * app.sessionStore = class SessionStore {
+   *   constructor(app) {
+   *   }
+   *   get(key): Promise<unknown>,
+   *   set(key, data): Promise<void>,
+   *   destroy(key): Promise<void>,
+   * }
+   * ```
+   * @param {Class|Object} store session store class or instance
+   */
+  set sessionStore(store: SessionStoreOrAppSessionStoreClass | null | undefined) {
+    if (this.config.session.store && this.config.env !== 'unittest') {
+      this.coreLogger.warn('[@eggjs/session] sessionStore already exists and will be overwrite');
+    }
+
+    // support this.sessionStore = null to disable external store
+    if (!store) {
+      this.config.session.store = undefined;
+      this.coreLogger.info('[@eggjs/session] sessionStore is disabled');
+      return;
+    }
+
+    if (typeof store === 'function') {
+      store = new store(this);
+    }
+    assert(typeof store.get === 'function', 'store.get must be function');
+    assert(typeof store.set === 'function', 'store.set must be function');
+    assert(typeof store.destroy === 'function', 'store.destroy must be function');
+    this.config.session.store = store;
+  }
+
+  /**
+   * get sessionStore instance
+   */
+  get sessionStore(): SessionStore | undefined {
+    return this.config.session.store;
+  }
+}

package/src/app/middleware/session.ts

@@ -0,0 +1,3 @@
+import { createSession } from 'koa-session';
+
+export default createSession;

package/src/app.ts

@@ -0,0 +1,30 @@
+import type { ILifecycleBoot, EggCore } from '@eggjs/core';
+import { SessionConfig } from './config/config.default.js';
+
+export default class AppBoot implements ILifecycleBoot {
+  private readonly app;
+
+  constructor(app: EggCore) {
+    this.app = app;
+  }
+
+  configWillLoad() {
+    const app = this.app;
+    SessionConfig.parse(app.config.session);
+
+    if (!app.config.session.httpOnly) {
+      app.coreLogger.warn('[@eggjs/session]: please set `config.session.httpOnly` to true. It is very dangerous if session can read by client JavaScript.');
+    }
+    app.config.coreMiddleware.push('session');
+    // listen on session's events
+    app.on('session:missed', ({ ctx, key }) => {
+      ctx.coreLogger.warn('[session][missed] key(%s)', key);
+    });
+    app.on('session:expired', ({ ctx, key, value }) => {
+      ctx.coreLogger.warn('[session][expired] key(%s) value(%j)', key, app.config.session.logValue ? value : '');
+    });
+    app.on('session:invalid', ({ ctx, key, value }) => {
+      ctx.coreLogger.warn('[session][invalid] key(%s) value(%j)', key, app.config.session.logValue ? value : '');
+    });
+  }
+}

package/src/config/config.default.ts

@@ -0,0 +1,17 @@
+import z from 'zod';
+import { SessionOptions } from 'koa-session';
+
+export const SessionConfig = SessionOptions.extend({
+  logValue: z.boolean().default(true),
+});
+
+export type SessionConfig = z.infer<typeof SessionConfig>;
+
+export default {
+  session: SessionConfig.parse({
+    maxAge: 24 * 3600 * 1000, // ms, one day
+    key: 'EGG_SESS',
+    httpOnly: true,
+    encrypt: true,
+  }),
+};

package/src/index.ts

@@ -0,0 +1,3 @@
+import './types.js';
+
+export * from './config/config.default.js';

package/src/types.ts

@@ -0,0 +1,8 @@
+import type { SessionConfig } from './config/config.default.js';
+
+declare module '@eggjs/core' {
+  // add EggAppConfig overrides types
+  interface EggAppConfig {
+    session: SessionConfig;
+  }
+}

package/src/typings/index.d.ts

@@ -0,0 +1,4 @@
+// make sure to import egg typings and let typescript know about it
+// @see https://github.com/whxaxes/blog/issues/11
+// and https://www.typescriptlang.org/docs/handbook/declaration-merging.html
+import 'egg';