elysia 1.4.30 → 1.4.31

package/dist/schema.mjs

@@ -653,6 +653,356 @@ const isOptional = (schema) => schema ? schema?.[Kind] === "Import" && schema.Re
     }
     return Object.keys(result).length > 0 ? result : void 0;
   }
+}, hasOwn = (value, key) => Object.prototype.hasOwnProperty.call(value, key), cloneDefaultValue = (value) => {
+  if (Array.isArray(value)) return value.map(cloneDefaultValue);
+  if (value instanceof Date) return new Date(value);
+  if (value instanceof Map)
+    return new Map(
+      [...value].map(([key, entry]) => [
+        cloneDefaultValue(key),
+        cloneDefaultValue(entry)
+      ])
+    );
+  if (value instanceof Set)
+    return new Set([...value].map(cloneDefaultValue));
+  if (ArrayBuffer.isView(value) && "slice" in value)
+    return value.slice();
+  if (value === null || typeof value != "object") return value;
+  const cloned = /* @__PURE__ */ Object.create(null);
+  for (const key of Reflect.ownKeys(value))
+    Object.defineProperty(cloned, key, {
+      value: cloneDefaultValue(value[key]),
+      enumerable: Object.prototype.propertyIsEnumerable.call(value, key),
+      configurable: !0,
+      writable: !0
+    });
+  return cloned;
+}, cloneDefault = (value) => typeof value == "function" ? value() : cloneDefaultValue(value), resolveDefaultSchema = (schema, references) => {
+  if (schema[Kind] === "Import") {
+    const definitions = Object.values(schema.$defs ?? {}), target = schema.$defs?.[schema.$ref];
+    return target ? resolveDefaultSchema(
+      target,
+      [...references, ...definitions]
+    ) : schema;
+  }
+  if (schema[Kind] === "Ref" || schema[Kind] === "This") {
+    const reference = references.find(
+      (reference2) => reference2.$id === schema.$ref
+    );
+    if (reference) return resolveDefaultSchema(reference, references);
+  }
+  return schema;
+}, cloneSchemaInput = (value) => {
+  if (Array.isArray(value)) return value.map(cloneForDefaults);
+  if (value === null || typeof value != "object" || value instanceof Date || value instanceof Map || value instanceof Set || value instanceof ArrayBuffer || ArrayBuffer.isView(value) || Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null)
+    return value;
+  const cloned = /* @__PURE__ */ Object.create(null);
+  for (const key of Object.getOwnPropertyNames(value))
+    Object.defineProperty(cloned, key, {
+      value: cloneSchemaInput(value[key]),
+      enumerable: Object.prototype.propertyIsEnumerable.call(value, key),
+      configurable: !0,
+      writable: !0
+    });
+  for (const key of Object.getOwnPropertySymbols(value))
+    Object.defineProperty(cloned, key, {
+      value: cloneSchemaInput(value[key]),
+      enumerable: Object.prototype.propertyIsEnumerable.call(value, key),
+      configurable: !0,
+      writable: !0
+    });
+  return cloned;
+}, cloneForDefaults = cloneSchemaInput, skipFunctionDefaults = (inputSchema, references, functionDefaults, seen = /* @__PURE__ */ new Set()) => {
+  const schema = resolveDefaultSchema(inputSchema, references);
+  if (!seen.has(schema)) {
+    seen.add(schema), typeof schema.default == "function" && !functionDefaults.has(schema) && functionDefaults.set(schema, { skip: !0 });
+    for (const child of [
+      ...Object.values(schema.properties ?? {}),
+      ...Object.values(schema.patternProperties ?? {}),
+      ...schema.allOf ?? [],
+      ...schema.anyOf ?? [],
+      ...schema.oneOf ?? [],
+      ...Array.isArray(schema.items) ? schema.items : schema.items ? [schema.items] : [],
+      ...schema.not ? [schema.not] : [],
+      ...schema.additionalProperties && typeof schema.additionalProperties == "object" ? [schema.additionalProperties] : []
+    ])
+      skipFunctionDefaults(child, references, functionDefaults, seen);
+  }
+}, matchesExistingProperties = (inputSchema, input, references) => {
+  const schema = resolveDefaultSchema(inputSchema, references), properties = getSchemaProperties(schema);
+  if (!properties || input === null || typeof input != "object")
+    return input === void 0 || Value.Check(schema, references, input);
+  for (const [key, propertySchema] of Object.entries(properties))
+    if (hasOwn(input, key) && input[key] !== void 0 && !Value.Check(propertySchema, references, input[key]))
+      return !1;
+  return !0;
+}, prepareDefaultInput = (inputSchema, input, references, nullish, isRoot, functionDefaults) => {
+  const schema = resolveDefaultSchema(inputSchema, references);
+  let value = input;
+  const missing = value === void 0 || nullish && value === null;
+  typeof schema.default == "function" ? missing ? (value = cloneDefault(schema.default), functionDefaults.set(schema, { skip: !1, value })) : functionDefaults.has(schema) || functionDefaults.set(schema, { skip: !0 }) : missing && hasOwn(schema, "default") && (value = cloneDefault(schema.default));
+  const properties = getSchemaProperties(schema);
+  if (isRoot && value === void 0 && (schema[Kind] === "Object" || schema.type === "object") ? value = /* @__PURE__ */ Object.create(null) : value = cloneForDefaults(value), schema[Kind] === "Object" && properties && value !== null && typeof value == "object")
+    for (const [key, propertySchema] of Object.entries(properties)) {
+      const rawPropertyValue = hasOwn(value, key) ? value[key] : void 0, propertyValue = prepareDefaultInput(
+        propertySchema,
+        rawPropertyValue,
+        references,
+        nullish,
+        !1,
+        functionDefaults
+      );
+      propertyValue !== void 0 && Object.defineProperty(value, key, {
+        value: propertyValue,
+        enumerable: !0,
+        configurable: !0,
+        writable: !0
+      });
+    }
+  else if (Array.isArray(value) && schema.items)
+    if (Array.isArray(schema.items))
+      for (let i = 0; i < schema.items.length; i++)
+        value[i] = prepareDefaultInput(
+          schema.items[i],
+          value[i],
+          references,
+          nullish,
+          !1,
+          functionDefaults
+        );
+    else
+      for (let i = 0; i < value.length; i++)
+        value[i] = prepareDefaultInput(
+          schema.items,
+          value[i],
+          references,
+          nullish,
+          !1,
+          functionDefaults
+        );
+  if (schema.allOf)
+    for (const member of schema.allOf)
+      prepareDefaultInput(
+        member,
+        input,
+        references,
+        nullish,
+        !1,
+        functionDefaults
+      );
+  for (const members of [schema.anyOf, schema.oneOf])
+    if (members) {
+      let selected = !1;
+      for (const member of members) {
+        if (selected || !matchesExistingProperties(member, input, references)) {
+          skipFunctionDefaults(
+            member,
+            references,
+            functionDefaults
+          );
+          continue;
+        }
+        const candidate = prepareDefaultInput(
+          member,
+          input,
+          references,
+          nullish,
+          !1,
+          functionDefaults
+        );
+        Value.Check(member, references, candidate) && (selected = !0, value = candidate);
+      }
+    }
+  if (schema.patternProperties && value !== null && typeof value == "object")
+    for (const [pattern, propertySchema] of Object.entries(
+      schema.patternProperties
+    ))
+      for (const key of Object.keys(value))
+        new RegExp(pattern).test(key) && (value[key] = prepareDefaultInput(
+          propertySchema,
+          value[key],
+          references,
+          nullish,
+          !1,
+          functionDefaults
+        ));
+  return value;
+}, withResolvedFunctionDefaults = (functionDefaults, run) => {
+  const originals = [];
+  try {
+    for (const [schema, resolved] of functionDefaults) {
+      const descriptor = Object.getOwnPropertyDescriptor(schema, "default");
+      descriptor && (originals.push([schema, descriptor]), resolved.skip ? delete schema.default : Object.defineProperty(schema, "default", {
+        ...descriptor,
+        value: resolved.value
+      }));
+    }
+    return run();
+  } finally {
+    for (const [schema, descriptor] of originals)
+      Object.defineProperty(schema, "default", descriptor);
+  }
+}, restoreArrayBuffers = (inputSchema, input, defaulted, references) => {
+  const schema = resolveDefaultSchema(inputSchema, references);
+  if (schema[Kind] === "ArrayBuffer" && input instanceof ArrayBuffer)
+    return input;
+  const properties = getSchemaProperties(schema);
+  if (properties && input !== null && typeof input == "object" && defaulted !== null && typeof defaulted == "object")
+    for (const [key, propertySchema] of Object.entries(properties))
+      !hasOwn(input, key) || !hasOwn(defaulted, key) || Object.defineProperty(defaulted, key, {
+        value: restoreArrayBuffers(
+          propertySchema,
+          input[key],
+          defaulted[key],
+          references
+        ),
+        enumerable: !0,
+        configurable: !0,
+        writable: !0
+      });
+  else if (Array.isArray(input) && Array.isArray(defaulted) && schema.items)
+    if (Array.isArray(schema.items))
+      for (let i = 0; i < schema.items.length; i++)
+        defaulted[i] = restoreArrayBuffers(
+          schema.items[i],
+          input[i],
+          defaulted[i],
+          references
+        );
+    else
+      for (let i = 0; i < input.length; i++)
+        defaulted[i] = restoreArrayBuffers(
+          schema.items,
+          input[i],
+          defaulted[i],
+          references
+        );
+  return defaulted;
+}, repairPrototypeDefaults = (inputSchema, input, references, nullish) => {
+  const schema = resolveDefaultSchema(inputSchema, references);
+  if (schema.anyOf || schema.oneOf) {
+    const members = schema.anyOf ?? schema.oneOf;
+    for (const member of members) {
+      const candidate = repairPrototypeDefaults(
+        member,
+        cloneForDefaults(input),
+        references,
+        nullish
+      );
+      if (Value.Check(member, references, candidate)) return candidate;
+    }
+    return input;
+  }
+  if (schema.allOf) {
+    let value = input;
+    for (const member of schema.allOf)
+      value = repairPrototypeDefaults(
+        member,
+        value,
+        references,
+        nullish
+      );
+    return value;
+  }
+  const properties = getSchemaProperties(schema);
+  if (properties && input !== null && typeof input == "object")
+    for (const [key, propertySchema] of Object.entries(properties))
+      (!hasOwn(input, key) || nullish && input[key] === null) && hasOwn(propertySchema, "default") && Object.defineProperty(input, key, {
+        value: cloneDefault(propertySchema.default),
+        enumerable: !0,
+        configurable: !0,
+        writable: !0
+      }), hasOwn(input, key) && Object.defineProperty(input, key, {
+        value: repairPrototypeDefaults(
+          propertySchema,
+          input[key],
+          references,
+          nullish
+        ),
+        enumerable: !0,
+        configurable: !0,
+        writable: !0
+      });
+  else if (Array.isArray(input) && schema.items && !Array.isArray(schema.items))
+    for (let i = 0; i < input.length; i++)
+      input[i] = repairPrototypeDefaults(
+        schema.items,
+        input[i],
+        references,
+        nullish
+      );
+  return input;
+}, removeFileDefaults = (inputSchema, value, references) => {
+  const schema = resolveDefaultSchema(inputSchema, references), properties = getSchemaProperties(schema);
+  if (properties && value !== null && typeof value == "object")
+    for (const [key, propertySchema] of Object.entries(properties))
+      hasOwn(value, key) && (propertySchema[Kind] === "File" && value[key] === "File" || propertySchema[Kind] === "Files" && value[key] === "Files" ? delete value[key] : removeFileDefaults(propertySchema, value[key], references));
+  else if (Array.isArray(value) && schema.items && !Array.isArray(schema.items))
+    for (const item of value) removeFileDefaults(schema.items, item, references);
+}, mergeDefaultResult = (original, defaulted) => {
+  if (Array.isArray(defaulted)) {
+    const target2 = Array.isArray(original) ? original : [];
+    target2.length = defaulted.length;
+    for (let i = 0; i < defaulted.length; i++)
+      target2[i] = mergeDefaultResult(
+        Array.isArray(original) ? original[i] : void 0,
+        defaulted[i]
+      );
+    return target2;
+  }
+  if (defaulted === null || typeof defaulted != "object" || defaulted instanceof Date || defaulted instanceof Map || defaulted instanceof Set || defaulted instanceof ArrayBuffer || ArrayBuffer.isView(defaulted))
+    return defaulted;
+  const target = original !== null && typeof original == "object" && !Array.isArray(original) ? original : {};
+  for (const key of Object.getOwnPropertyNames(defaulted))
+    Object.defineProperty(target, key, {
+      value: mergeDefaultResult(
+        hasOwn(target, key) ? target[key] : void 0,
+        defaulted[key]
+      ),
+      enumerable: Object.prototype.propertyIsEnumerable.call(defaulted, key),
+      configurable: !0,
+      writable: !0
+    });
+  for (const key of Object.getOwnPropertySymbols(defaulted))
+    Object.defineProperty(target, key, {
+      value: mergeDefaultResult(
+        hasOwn(target, key) ? target[key] : void 0,
+        defaulted[key]
+      ),
+      enumerable: Object.prototype.propertyIsEnumerable.call(defaulted, key),
+      configurable: !0,
+      writable: !0
+    });
+  return target;
+}, applySchemaDefaults = (checker, value, nullish = !1) => {
+  const schema = checker.schema;
+  if (!schema) return value;
+  const references = typeof checker.References == "function" ? checker.References() : Object.values(schema.$defs ?? {}), functionDefaults = /* @__PURE__ */ new Map(), prepared = prepareDefaultInput(
+    schema,
+    value,
+    references,
+    nullish,
+    !0,
+    functionDefaults
+  );
+  return withResolvedFunctionDefaults(functionDefaults, () => {
+    const defaulted = repairPrototypeDefaults(
+      schema,
+      restoreArrayBuffers(
+        schema,
+        prepared,
+        Value.Default(
+          schema,
+          references,
+          cloneForDefaults(prepared)
+        ),
+        references
+      ),
+      references,
+      nullish
+    );
+    return removeFileDefaults(schema, defaulted, references), mergeDefaultResult(value, defaulted);
+  });
 }, mergeObjectSchemas = (schemas) => {
   if (schemas.length === 0)
     return {
@@ -803,6 +1153,8 @@ const isOptional = (schema) => schema ? schema?.[Kind] === "Import" && schema.Re
   }), cookieValidator.config = defaultConfig), cookieValidator;
 }, unwrapImportSchema = (schema) => schema && schema[Kind] === "Import" && schema.$defs[schema.$ref][Kind] === "Object" ? schema.$defs[schema.$ref] : schema;
 export {
+  applySchemaDefaults,
+  cloneSchemaInput,
   getCookieValidator,
   getResponseSchemaValidator,
   getSchemaProperties,

package/dist/types.d.ts

@@ -354,6 +354,11 @@ export type HookContainer<T extends Function = Function> = {
     hasReturn?: boolean;
 };
 export interface LifeCycleStore {
+    config?: {
+        allowMeta?: boolean;
+        mount?: Function;
+        cookie?: ElysiaConfig<any>['cookie'];
+    };
     type?: ContentType;
     start: HookContainer<GracefulHandler<any>>[];
     request: HookContainer<PreHandler<any, any>>[];
@@ -703,7 +708,13 @@ type _ResolveReturnTypeArray<T, Carry = {}> = T extends [
     infer Fn,
     ...infer Rest
 ] ? Exclude<Awaited<ReturnType<Fn>>, AnyElysiaCustomStatusResponse> extends infer Value extends Record<any, unknown> ? _ResolveReturnTypeArray<Rest, Value & Carry> : _ResolveReturnTypeArray<Rest, Carry & {}> : Prettify<Carry>;
-export type AnyLocalHook = LocalHook<any, any, any, any, any>;
+export type AnyLocalHook = LocalHook<any, any, any, any, any> & {
+    config?: {
+        allowMeta?: boolean;
+        mount?: Function;
+        cookie?: ElysiaConfig<any>['cookie'];
+    };
+};
 export interface BaseHookLifeCycle<in out Schema extends RouteSchema, in out Singleton extends SingletonBase, in out Errors extends {
     [key in string]: Error;
 }, in out Parser extends keyof any = ''> {

package/dist/utils.d.ts

@@ -3,6 +3,8 @@ import type { LifeCycleStore, MaybeArray, InputSchema, LifeCycleType, HookContai
 import { ElysiaFile } from './universal/file';
 export declare const replaceUrlPath: (url: string, pathname: string) => string;
 export declare const isClass: (v: Object) => boolean;
+export declare const isSafeObjectKey: (key: string) => boolean;
+export declare const safeAssign: <Target extends object>(target: Target, source: unknown) => Target;
 export declare const mergeDeep: <A extends Record<string, any>, B extends Record<string, any>>(target: A, source: B, options?: {
     skipKeys?: string[];
     override?: boolean;

package/dist/utils.js

@@ -39,6 +39,7 @@ __export(utils_exports, {
   isClass: () => isClass,
   isNotEmpty: () => isNotEmpty,
   isNumericString: () => isNumericString,
+  isSafeObjectKey: () => isSafeObjectKey,
   lifeCycleToArray: () => lifeCycleToArray,
   lifeCycleToFn: () => lifeCycleToFn,
   localHookToLifeCycleStore: () => localHookToLifeCycleStore,
@@ -54,6 +55,7 @@ __export(utils_exports, {
   randomId: () => randomId,
   redirect: () => redirect,
   replaceUrlPath: () => replaceUrlPath,
+  safeAssign: () => safeAssign,
   signCookie: () => signCookie,
   sse: () => sse,
   supportPerMethodInlineHandler: () => supportPerMethodInlineHandler,
@@ -69,7 +71,15 @@ v.toString && // Handle import * as Sentry from '@sentry/bun'
 // This also handle [object Date], [object Array]
 // and FFI value like [object Prisma]
 v.toString().startsWith("[object ") && v.toString() !== "[object Object]" || // If object prototype is not pure, then probably a class-like object
-isNotEmpty(Object.getPrototypeOf(v)), isObject = (item) => item && typeof item == "object" && !Array.isArray(item), mergeDeep = (target, source, options) => {
+isNotEmpty(Object.getPrototypeOf(v)), isObject = (item) => item && typeof item == "object" && !Array.isArray(item), dangerousKeys = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]), isSafeObjectKey = (key) => !dangerousKeys.has(key), safeAssign = (target, source) => {
+  if (source == null) return target;
+  const input = Object(source), output = target;
+  for (const key of Object.keys(input))
+    isSafeObjectKey(key) && (output[key] = input[key]);
+  for (const key of Object.getOwnPropertySymbols(input))
+    Object.prototype.propertyIsEnumerable.call(input, key) && (output[key] = input[key]);
+  return target;
+}, mergeDeep = (target, source, options) => {
   const skipKeys = options?.skipKeys, override = options?.override ?? !0, mergeArray = options?.mergeArray ?? !1, seen = options?.seen ?? /* @__PURE__ */ new WeakSet();
   if (!isObject(target) || !isObject(source) || seen.has(source)) return target;
   seen.add(source);
@@ -444,17 +454,31 @@ const encoder = new TextEncoder(), signCookie = async (val, secret) => {
     encoder.encode(val)
   );
   return val + "." + removeTrailingEquals(Buffer.from(hmacBuffer).toString("base64"));
-}, constantTimeEqual = typeof crypto?.timingSafeEqual == "function" ? (a, b) => {
-  const ab = Buffer.from(a, "utf8"), bb = Buffer.from(b, "utf8");
-  return ab.length !== bb.length ? !1 : crypto.timingSafeEqual(ab, bb);
-} : (a, b) => a === b, unsignCookie = async (input, secret) => {
+}, unsignCookie = async (input, secret) => {
   if (typeof input != "string")
     throw new TypeError("Signed cookie string must be provided.");
   const dot = input.lastIndexOf(".");
   if (dot === -1)
     return secret === null ? input : !1;
-  const tentativeValue = input.slice(0, dot), expectedInput = await signCookie(tentativeValue, secret);
-  return constantTimeEqual(expectedInput, input) ? tentativeValue : !1;
+  const tentativeValue = input.slice(0, dot), encodedSignature = input.slice(dot + 1);
+  if (!/^[A-Za-z0-9+/]{43}$/.test(encodedSignature)) return !1;
+  const signature = Buffer.from(encodedSignature, "base64");
+  if (removeTrailingEquals(signature.toString("base64")) !== encodedSignature)
+    return !1;
+  if (secret === null) throw new TypeError("Secret key must be provided");
+  const secretKey = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    !1,
+    ["verify"]
+  );
+  return await crypto.subtle.verify(
+    "HMAC",
+    secretKey,
+    signature,
+    encoder.encode(tentativeValue)
+  ) ? tentativeValue : !1;
 }, insertStandaloneValidator = (hook, name, value) => {
   if (!hook.standaloneValidator?.length || !Array.isArray(hook.standaloneValidator)) {
     hook.standaloneValidator = [
@@ -598,13 +622,35 @@ const fnToContainer = (fn, subType) => {
   const payload = typeof _payload == "string" ? { data: _payload } : _payload;
   return payload.sse = !0, payload.toSSE = () => {
     let payloadString = "";
-    return payload.id !== void 0 && payload.id !== null && (payloadString += `id: ${payload.id}
-`), payload.event && (payloadString += `event: ${payload.event}
-`), payload.retry !== void 0 && (payloadString += `retry: ${payload.retry}
-`), payload.data === null ? payloadString += `data: null
-` : typeof payload.data == "string" ? payloadString += `data: ${payload.data}
-` : typeof payload.data == "object" && (payloadString += `data: ${JSON.stringify(payload.data)}
-`), payloadString && (payloadString += `
+    if (payload.id !== void 0 && payload.id !== null) {
+      const id = String(payload.id);
+      if (/[\r\n]/.test(id))
+        throw new TypeError("SSE id must not contain newlines");
+      payloadString += `id: ${id}
+`;
+    }
+    if (payload.event) {
+      if (/[\r\n]/.test(payload.event))
+        throw new TypeError("SSE event must not contain newlines");
+      payloadString += `event: ${payload.event}
+`;
+    }
+    if (payload.retry !== void 0) {
+      if (!Number.isSafeInteger(payload.retry) || payload.retry < 0)
+        throw new TypeError(
+          "SSE retry must be a non-negative safe integer"
+        );
+      payloadString += `retry: ${payload.retry}
+`;
+    }
+    const data = typeof payload.data == "string" ? payload.data : JSON.stringify(payload.data);
+    if (data !== void 0)
+      for (const line of data.replace(/\r\n?/g, `
+`).split(`
+`))
+        payloadString += `data: ${line}
+`;
+    return payloadString && (payloadString += `
 `), payloadString;
   }, payload;
 };
@@ -675,6 +721,7 @@ function deepClone(source, weak = /* @__PURE__ */ new WeakMap()) {
   isClass,
   isNotEmpty,
   isNumericString,
+  isSafeObjectKey,
   lifeCycleToArray,
   lifeCycleToFn,
   localHookToLifeCycleStore,
@@ -690,6 +737,7 @@ function deepClone(source, weak = /* @__PURE__ */ new WeakMap()) {
   randomId,
   redirect,
   replaceUrlPath,
+  safeAssign,
   signCookie,
   sse,
   supportPerMethodInlineHandler,

package/dist/utils.mjs

@@ -8,7 +8,15 @@ v.toString && // Handle import * as Sentry from '@sentry/bun'
 // This also handle [object Date], [object Array]
 // and FFI value like [object Prisma]
 v.toString().startsWith("[object ") && v.toString() !== "[object Object]" || // If object prototype is not pure, then probably a class-like object
-isNotEmpty(Object.getPrototypeOf(v)), isObject = (item) => item && typeof item == "object" && !Array.isArray(item), mergeDeep = (target, source, options) => {
+isNotEmpty(Object.getPrototypeOf(v)), isObject = (item) => item && typeof item == "object" && !Array.isArray(item), dangerousKeys = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]), isSafeObjectKey = (key) => !dangerousKeys.has(key), safeAssign = (target, source) => {
+  if (source == null) return target;
+  const input = Object(source), output = target;
+  for (const key of Object.keys(input))
+    isSafeObjectKey(key) && (output[key] = input[key]);
+  for (const key of Object.getOwnPropertySymbols(input))
+    Object.prototype.propertyIsEnumerable.call(input, key) && (output[key] = input[key]);
+  return target;
+}, mergeDeep = (target, source, options) => {
   const skipKeys = options?.skipKeys, override = options?.override ?? !0, mergeArray = options?.mergeArray ?? !1, seen = options?.seen ?? /* @__PURE__ */ new WeakSet();
   if (!isObject(target) || !isObject(source) || seen.has(source)) return target;
   seen.add(source);
@@ -383,17 +391,31 @@ const encoder = new TextEncoder(), signCookie = async (val, secret) => {
     encoder.encode(val)
   );
   return val + "." + removeTrailingEquals(Buffer.from(hmacBuffer).toString("base64"));
-}, constantTimeEqual = typeof crypto?.timingSafeEqual == "function" ? (a, b) => {
-  const ab = Buffer.from(a, "utf8"), bb = Buffer.from(b, "utf8");
-  return ab.length !== bb.length ? !1 : crypto.timingSafeEqual(ab, bb);
-} : (a, b) => a === b, unsignCookie = async (input, secret) => {
+}, unsignCookie = async (input, secret) => {
   if (typeof input != "string")
     throw new TypeError("Signed cookie string must be provided.");
   const dot = input.lastIndexOf(".");
   if (dot === -1)
     return secret === null ? input : !1;
-  const tentativeValue = input.slice(0, dot), expectedInput = await signCookie(tentativeValue, secret);
-  return constantTimeEqual(expectedInput, input) ? tentativeValue : !1;
+  const tentativeValue = input.slice(0, dot), encodedSignature = input.slice(dot + 1);
+  if (!/^[A-Za-z0-9+/]{43}$/.test(encodedSignature)) return !1;
+  const signature = Buffer.from(encodedSignature, "base64");
+  if (removeTrailingEquals(signature.toString("base64")) !== encodedSignature)
+    return !1;
+  if (secret === null) throw new TypeError("Secret key must be provided");
+  const secretKey = await crypto.subtle.importKey(
+    "raw",
+    encoder.encode(secret),
+    { name: "HMAC", hash: "SHA-256" },
+    !1,
+    ["verify"]
+  );
+  return await crypto.subtle.verify(
+    "HMAC",
+    secretKey,
+    signature,
+    encoder.encode(tentativeValue)
+  ) ? tentativeValue : !1;
 }, insertStandaloneValidator = (hook, name, value) => {
   if (!hook.standaloneValidator?.length || !Array.isArray(hook.standaloneValidator)) {
     hook.standaloneValidator = [
@@ -537,13 +559,35 @@ const fnToContainer = (fn, subType) => {
   const payload = typeof _payload == "string" ? { data: _payload } : _payload;
   return payload.sse = !0, payload.toSSE = () => {
     let payloadString = "";
-    return payload.id !== void 0 && payload.id !== null && (payloadString += `id: ${payload.id}
-`), payload.event && (payloadString += `event: ${payload.event}
-`), payload.retry !== void 0 && (payloadString += `retry: ${payload.retry}
-`), payload.data === null ? payloadString += `data: null
-` : typeof payload.data == "string" ? payloadString += `data: ${payload.data}
-` : typeof payload.data == "object" && (payloadString += `data: ${JSON.stringify(payload.data)}
-`), payloadString && (payloadString += `
+    if (payload.id !== void 0 && payload.id !== null) {
+      const id = String(payload.id);
+      if (/[\r\n]/.test(id))
+        throw new TypeError("SSE id must not contain newlines");
+      payloadString += `id: ${id}
+`;
+    }
+    if (payload.event) {
+      if (/[\r\n]/.test(payload.event))
+        throw new TypeError("SSE event must not contain newlines");
+      payloadString += `event: ${payload.event}
+`;
+    }
+    if (payload.retry !== void 0) {
+      if (!Number.isSafeInteger(payload.retry) || payload.retry < 0)
+        throw new TypeError(
+          "SSE retry must be a non-negative safe integer"
+        );
+      payloadString += `retry: ${payload.retry}
+`;
+    }
+    const data = typeof payload.data == "string" ? payload.data : JSON.stringify(payload.data);
+    if (data !== void 0)
+      for (const line of data.replace(/\r\n?/g, `
+`).split(`
+`))
+        payloadString += `data: ${line}
+`;
+    return payloadString && (payloadString += `
 `), payloadString;
   }, payload;
 };
@@ -613,6 +657,7 @@ export {
   isClass,
   isNotEmpty,
   isNumericString,
+  isSafeObjectKey,
   lifeCycleToArray,
   lifeCycleToFn,
   localHookToLifeCycleStore,
@@ -628,6 +673,7 @@ export {
   randomId,
   redirect,
   replaceUrlPath,
+  safeAssign,
   signCookie,
   sse,
   supportPerMethodInlineHandler,

package/dist/ws/index.d.ts

@@ -73,5 +73,5 @@ export declare class ElysiaWS<Context = unknown, Route extends RouteSchema = {}>
     get id(): string;
 }
 export declare const createWSMessageParser: (parse: MaybeArray<WSParseHandler<any>>) => (ws: ServerWebSocket<any>, message: any) => Promise<any>;
-export declare const createHandleWSResponse: (responseValidator: TypeCheck<any> | ElysiaTypeCheck<any> | undefined) => (ws: ServerWebSocket<any>, data: unknown) => unknown;
+export declare const createHandleWSResponse: (responseValidator: TypeCheck<any> | ElysiaTypeCheck<any> | undefined) => (ws: ServerWebSocket<any>, data: unknown) => Promise<unknown>;
 export type { WSLocalHook } from './types';