elysia 2.0.0-beta.2 → 2.0.0-beta.21

package/dist/cookie/crypto.js

@@ -10,22 +10,17 @@ const algorithm = {
 };
 const encoder = new TextEncoder();
 let _nodeCrypto;
-let _nodeCryptoResolved = false;
 function nodeCrypto() {
-	if (!_nodeCryptoResolved) {
-		_nodeCryptoResolved = true;
-		try {
-			_nodeCrypto = globalThis.process?.getBuiltinModule?.("node:crypto");
-		} catch {}
-	}
+	try {
+		_nodeCrypto ??= globalThis.process?.getBuiltinModule?.("node:crypto");
+	} catch {}
 	return _nodeCrypto;
 }
-const HMAC_PROBE_DIGEST = "bzs6y9cVmkYub8fplSKaOuuqMqJlDwhMypFT/jSdCEk=";
 const bunCryptoHasher = (() => {
 	const hasher = globalThis.Bun?.CryptoHasher;
-	if (typeof hasher !== "function") return void 0;
+	if (typeof hasher !== "function" || typeof hasher.prototype?.copy !== "function") return void 0;
 	try {
-		return new hasher("sha256", "elysia").update("probe").digest("base64") === HMAC_PROBE_DIGEST ? hasher : void 0;
+		return new hasher("sha256", "elysia").update("probe").digest("base64") === "bzs6y9cVmkYub8fplSKaOuuqMqJlDwhMypFT/jSdCEk=" ? hasher : void 0;
 	} catch {
 		return;
 	}
@@ -37,7 +32,15 @@ function coerceValue(val) {
 	if (typeof val !== "string") return val + "";
 	return val;
 }
-const signCookieBun = (val, secret) => `${val}.${new bunCryptoHasher("sha256", secret).update(val).digest("base64").replace(removeTrailingEquals, "")}`;
+const bunHasherCache = /* @__PURE__ */ new Map();
+const signCookieBun = (val, secret) => {
+	let keyed = bunHasherCache.get(secret);
+	if (!keyed) {
+		if (bunHasherCache.size >= 256) require_utils.evictOldestHalf(bunHasherCache);
+		bunHasherCache.set(secret, keyed = new bunCryptoHasher("sha256", secret));
+	}
+	return `${val}.${keyed.copy().update(val).digest("base64").replace(removeTrailingEquals, "")}`;
+};
 const signCookieNode = (val, secret) => `${val}.${nodeCrypto().createHmac("sha256", secret).update(val).digest("base64").replace(removeTrailingEquals, "")}`;
 const signCookieSyncImpl = hmacProvider === "bun" ? signCookieBun : signCookieNode;
 const keyCache = /* @__PURE__ */ new Map();
@@ -62,19 +65,22 @@ async function signCookieSubtle(val, secret) {
 	const hmacBuffer = await crypto.subtle.sign("HMAC", await importSecretKey(secret), encoder.encode(val));
 	return `${val}.${btoa(String.fromCharCode(...new Uint8Array(hmacBuffer))).replace(removeTrailingEquals, "")}`;
 }
-async function signCookie(val, secret) {
+const deriveSignKey = (secret, name) => `${name.length}\0${name}${secret}`;
+async function signCookie(val, secret, name) {
 	val = coerceValue(val);
-	if (secret === null || secret === void 0) throw new TypeError("Secret key must be provided");
+	if (!secret?.trim()) throw new TypeError("Secret key must be provided");
+	if (name !== void 0) secret = deriveSignKey(secret, name);
 	if (hasSyncHmac) return signCookieSyncImpl(val, secret);
 	return signCookieSubtle(val, secret);
 }
-function signCookieSync(val, secret) {
+function signCookieSync(val, secret, name) {
 	val = coerceValue(val);
-	if (secret === null || secret === void 0) throw new TypeError("Secret key must be provided");
+	if (!secret?.trim()) throw new TypeError("Secret key must be provided");
 	if (!hasSyncHmac) throw new Error("signCookieSync called without a sync HMAC available");
+	if (name !== void 0) secret = deriveSignKey(secret, name);
 	return signCookieSyncImpl(val, secret);
 }
-async function unsignCookie(input, secret) {
+async function unsignCookie(input, secret, name) {
 	if (typeof input !== "string") throw new TypeError("Signed cookie string must be provided.");
 	const dot = input.lastIndexOf(".");
 	if (dot === -1) {
@@ -82,10 +88,10 @@ async function unsignCookie(input, secret) {
 		return false;
 	}
 	const tentativeValue = input.slice(0, dot);
-	if (secret === null) return false;
-	return require_utils.constantTimeEqual(await signCookie(tentativeValue, secret), input) ? tentativeValue : false;
+	if (!secret?.trim()) return false;
+	return require_utils.constantTimeEqual(await signCookie(tentativeValue, secret, name), input) ? tentativeValue : false;
 }
-function unsignCookieSync(input, secret) {
+function unsignCookieSync(input, secret, name) {
 	if (typeof input !== "string") throw new TypeError("Signed cookie string must be provided.");
 	const dot = input.lastIndexOf(".");
 	if (dot === -1) {
@@ -93,32 +99,36 @@ function unsignCookieSync(input, secret) {
 		return false;
 	}
 	const tentativeValue = input.slice(0, dot);
-	if (secret === null) return false;
-	return require_utils.constantTimeEqual(signCookieSync(tentativeValue, secret), input) ? tentativeValue : false;
+	if (!secret?.trim()) return false;
+	return require_utils.constantTimeEqual(signCookieSync(tentativeValue, secret, name), input) ? tentativeValue : false;
 }
-function unsignWithSecretsSync(name, value, secrets) {
+function unsignWithSecretsSync(name, value, secrets, legacy) {
 	if (typeof value !== "string") throw require_cookie_error.InvalidCookie.signature(name);
-	if (typeof secrets === "string") {
-		const temp = unsignCookieSync(value, secrets);
-		if (temp === false) throw require_cookie_error.InvalidCookie.signature(name);
-		return temp;
-	}
-	if (Array.isArray(secrets)) for (let i = 0; i < secrets.length; i++) {
-		const temp = unsignCookieSync(value, secrets[i]);
-		if (temp !== false) return temp;
+	for (let pass = 0; pass < 2; pass++) {
+		const bound = pass === 0 ? name : void 0;
+		if (typeof secrets === "string") {
+			const temp = unsignCookieSync(value, secrets, bound);
+			if (temp !== false) return temp;
+		} else if (Array.isArray(secrets)) for (let i = 0; i < secrets.length; i++) {
+			const temp = unsignCookieSync(value, secrets[i], bound);
+			if (temp !== false) return temp;
+		}
+		if (!legacy) break;
 	}
 	throw require_cookie_error.InvalidCookie.signature(name);
 }
-async function unsignWithSecrets(name, value, secrets) {
+async function unsignWithSecrets(name, value, secrets, legacy) {
 	if (typeof value !== "string") throw require_cookie_error.InvalidCookie.signature(name);
-	if (typeof secrets === "string") {
-		const temp = await unsignCookie(value, secrets);
-		if (temp === false) throw require_cookie_error.InvalidCookie.signature(name);
-		return temp;
-	}
-	if (Array.isArray(secrets)) for (let i = 0; i < secrets.length; i++) {
-		const temp = await unsignCookie(value, secrets[i]);
-		if (temp !== false) return temp;
+	for (let pass = 0; pass < 2; pass++) {
+		const bound = pass === 0 ? name : void 0;
+		if (typeof secrets === "string") {
+			const temp = await unsignCookie(value, secrets, bound);
+			if (temp !== false) return temp;
+		} else if (Array.isArray(secrets)) for (let i = 0; i < secrets.length; i++) {
+			const temp = await unsignCookie(value, secrets[i], bound);
+			if (temp !== false) return temp;
+		}
+		if (!legacy) break;
 	}
 	throw require_cookie_error.InvalidCookie.signature(name);
 }
@@ -139,7 +149,7 @@ function resolvePendingCookie(entry, name) {
 	const value = entry.value;
 	if (typeof value !== "string") throw require_cookie_error.InvalidCookie.signature(name);
 	if (!hasSyncHmac) throw new Error(`resolvePendingCookie called without sync HMAC. Unreachable under correct lane gating (cookie: "${name}")`);
-	const resolvedValue = maybeJsonDecode(unsignWithSecretsSync(name, value, entry["~unsign"]));
+	const resolvedValue = maybeJsonDecode(unsignWithSecretsSync(name, value, entry["~unsign"], !entry["~strict"]));
 	entry.value = resolvedValue;
 	if (resolvedValue !== null && typeof resolvedValue === "object") {
 		const raw = rawJsonValue.get(resolvedValue);
@@ -149,6 +159,7 @@ function resolvePendingCookie(entry, name) {
 }
 
 //#endregion
+exports.deriveSignKey = deriveSignKey;
 exports.hasSyncHmac = hasSyncHmac;
 exports.hmacProvider = hmacProvider;
 exports.importSecretKey = importSecretKey;

package/dist/cookie/crypto.mjs

@@ -9,22 +9,17 @@ const algorithm = {
 };
 const encoder = new TextEncoder();
 let _nodeCrypto;
-let _nodeCryptoResolved = false;
 function nodeCrypto() {
-	if (!_nodeCryptoResolved) {
-		_nodeCryptoResolved = true;
-		try {
-			_nodeCrypto = globalThis.process?.getBuiltinModule?.("node:crypto");
-		} catch {}
-	}
+	try {
+		_nodeCrypto ??= globalThis.process?.getBuiltinModule?.("node:crypto");
+	} catch {}
 	return _nodeCrypto;
 }
-const HMAC_PROBE_DIGEST = "bzs6y9cVmkYub8fplSKaOuuqMqJlDwhMypFT/jSdCEk=";
 const bunCryptoHasher = (() => {
 	const hasher = globalThis.Bun?.CryptoHasher;
-	if (typeof hasher !== "function") return void 0;
+	if (typeof hasher !== "function" || typeof hasher.prototype?.copy !== "function") return void 0;
 	try {
-		return new hasher("sha256", "elysia").update("probe").digest("base64") === HMAC_PROBE_DIGEST ? hasher : void 0;
+		return new hasher("sha256", "elysia").update("probe").digest("base64") === "bzs6y9cVmkYub8fplSKaOuuqMqJlDwhMypFT/jSdCEk=" ? hasher : void 0;
 	} catch {
 		return;
 	}
@@ -36,7 +31,15 @@ function coerceValue(val) {
 	if (typeof val !== "string") return val + "";
 	return val;
 }
-const signCookieBun = (val, secret) => `${val}.${new bunCryptoHasher("sha256", secret).update(val).digest("base64").replace(removeTrailingEquals, "")}`;
+const bunHasherCache = /* @__PURE__ */ new Map();
+const signCookieBun = (val, secret) => {
+	let keyed = bunHasherCache.get(secret);
+	if (!keyed) {
+		if (bunHasherCache.size >= 256) evictOldestHalf(bunHasherCache);
+		bunHasherCache.set(secret, keyed = new bunCryptoHasher("sha256", secret));
+	}
+	return `${val}.${keyed.copy().update(val).digest("base64").replace(removeTrailingEquals, "")}`;
+};
 const signCookieNode = (val, secret) => `${val}.${nodeCrypto().createHmac("sha256", secret).update(val).digest("base64").replace(removeTrailingEquals, "")}`;
 const signCookieSyncImpl = hmacProvider === "bun" ? signCookieBun : signCookieNode;
 const keyCache = /* @__PURE__ */ new Map();
@@ -61,19 +64,22 @@ async function signCookieSubtle(val, secret) {
 	const hmacBuffer = await crypto.subtle.sign("HMAC", await importSecretKey(secret), encoder.encode(val));
 	return `${val}.${btoa(String.fromCharCode(...new Uint8Array(hmacBuffer))).replace(removeTrailingEquals, "")}`;
 }
-async function signCookie(val, secret) {
+const deriveSignKey = (secret, name) => `${name.length}\0${name}${secret}`;
+async function signCookie(val, secret, name) {
 	val = coerceValue(val);
-	if (secret === null || secret === void 0) throw new TypeError("Secret key must be provided");
+	if (!secret?.trim()) throw new TypeError("Secret key must be provided");
+	if (name !== void 0) secret = deriveSignKey(secret, name);
 	if (hasSyncHmac) return signCookieSyncImpl(val, secret);
 	return signCookieSubtle(val, secret);
 }
-function signCookieSync(val, secret) {
+function signCookieSync(val, secret, name) {
 	val = coerceValue(val);
-	if (secret === null || secret === void 0) throw new TypeError("Secret key must be provided");
+	if (!secret?.trim()) throw new TypeError("Secret key must be provided");
 	if (!hasSyncHmac) throw new Error("signCookieSync called without a sync HMAC available");
+	if (name !== void 0) secret = deriveSignKey(secret, name);
 	return signCookieSyncImpl(val, secret);
 }
-async function unsignCookie(input, secret) {
+async function unsignCookie(input, secret, name) {
 	if (typeof input !== "string") throw new TypeError("Signed cookie string must be provided.");
 	const dot = input.lastIndexOf(".");
 	if (dot === -1) {
@@ -81,10 +87,10 @@ async function unsignCookie(input, secret) {
 		return false;
 	}
 	const tentativeValue = input.slice(0, dot);
-	if (secret === null) return false;
-	return constantTimeEqual(await signCookie(tentativeValue, secret), input) ? tentativeValue : false;
+	if (!secret?.trim()) return false;
+	return constantTimeEqual(await signCookie(tentativeValue, secret, name), input) ? tentativeValue : false;
 }
-function unsignCookieSync(input, secret) {
+function unsignCookieSync(input, secret, name) {
 	if (typeof input !== "string") throw new TypeError("Signed cookie string must be provided.");
 	const dot = input.lastIndexOf(".");
 	if (dot === -1) {
@@ -92,32 +98,36 @@ function unsignCookieSync(input, secret) {
 		return false;
 	}
 	const tentativeValue = input.slice(0, dot);
-	if (secret === null) return false;
-	return constantTimeEqual(signCookieSync(tentativeValue, secret), input) ? tentativeValue : false;
+	if (!secret?.trim()) return false;
+	return constantTimeEqual(signCookieSync(tentativeValue, secret, name), input) ? tentativeValue : false;
 }
-function unsignWithSecretsSync(name, value, secrets) {
+function unsignWithSecretsSync(name, value, secrets, legacy) {
 	if (typeof value !== "string") throw InvalidCookie.signature(name);
-	if (typeof secrets === "string") {
-		const temp = unsignCookieSync(value, secrets);
-		if (temp === false) throw InvalidCookie.signature(name);
-		return temp;
-	}
-	if (Array.isArray(secrets)) for (let i = 0; i < secrets.length; i++) {
-		const temp = unsignCookieSync(value, secrets[i]);
-		if (temp !== false) return temp;
+	for (let pass = 0; pass < 2; pass++) {
+		const bound = pass === 0 ? name : void 0;
+		if (typeof secrets === "string") {
+			const temp = unsignCookieSync(value, secrets, bound);
+			if (temp !== false) return temp;
+		} else if (Array.isArray(secrets)) for (let i = 0; i < secrets.length; i++) {
+			const temp = unsignCookieSync(value, secrets[i], bound);
+			if (temp !== false) return temp;
+		}
+		if (!legacy) break;
 	}
 	throw InvalidCookie.signature(name);
 }
-async function unsignWithSecrets(name, value, secrets) {
+async function unsignWithSecrets(name, value, secrets, legacy) {
 	if (typeof value !== "string") throw InvalidCookie.signature(name);
-	if (typeof secrets === "string") {
-		const temp = await unsignCookie(value, secrets);
-		if (temp === false) throw InvalidCookie.signature(name);
-		return temp;
-	}
-	if (Array.isArray(secrets)) for (let i = 0; i < secrets.length; i++) {
-		const temp = await unsignCookie(value, secrets[i]);
-		if (temp !== false) return temp;
+	for (let pass = 0; pass < 2; pass++) {
+		const bound = pass === 0 ? name : void 0;
+		if (typeof secrets === "string") {
+			const temp = await unsignCookie(value, secrets, bound);
+			if (temp !== false) return temp;
+		} else if (Array.isArray(secrets)) for (let i = 0; i < secrets.length; i++) {
+			const temp = await unsignCookie(value, secrets[i], bound);
+			if (temp !== false) return temp;
+		}
+		if (!legacy) break;
 	}
 	throw InvalidCookie.signature(name);
 }
@@ -138,7 +148,7 @@ function resolvePendingCookie(entry, name) {
 	const value = entry.value;
 	if (typeof value !== "string") throw InvalidCookie.signature(name);
 	if (!hasSyncHmac) throw new Error(`resolvePendingCookie called without sync HMAC. Unreachable under correct lane gating (cookie: "${name}")`);
-	const resolvedValue = maybeJsonDecode(unsignWithSecretsSync(name, value, entry["~unsign"]));
+	const resolvedValue = maybeJsonDecode(unsignWithSecretsSync(name, value, entry["~unsign"], !entry["~strict"]));
 	entry.value = resolvedValue;
 	if (resolvedValue !== null && typeof resolvedValue === "object") {
 		const raw = rawJsonValue.get(resolvedValue);
@@ -148,4 +158,4 @@ function resolvePendingCookie(entry, name) {
 }
 
 //#endregion
-export { hasSyncHmac, hmacProvider, importSecretKey, keyCache, maybeJsonDecode, rawJsonValue, resolvePendingCookie, signCookie, signCookieBun, signCookieNode, signCookieSubtle, signCookieSync, signCookieSyncImpl, unsignCookie, unsignCookieSync, unsignWithSecrets, unsignWithSecretsSync };
+export { deriveSignKey, hasSyncHmac, hmacProvider, importSecretKey, keyCache, maybeJsonDecode, rawJsonValue, resolvePendingCookie, signCookie, signCookieBun, signCookieNode, signCookieSubtle, signCookieSync, signCookieSyncImpl, unsignCookie, unsignCookieSync, unsignWithSecrets, unsignWithSecretsSync };

package/dist/cookie/error.d.ts

@@ -5,8 +5,7 @@ declare class InvalidCookie extends ElysiaError {
   key?: string | undefined;
   response: string;
   status: 400;
-  problemType: string;
-  problemTitle: string;
+  readonly code = "invalid-cookie";
   constructor(key?: string | undefined, response?: string, status?: number);
   static signature(key: string): InvalidCookie;
   static secret(key?: string): Omit<InvalidCookie, 'status'> & {

package/dist/cookie/error.js

@@ -1,4 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_universal_is_production = require('../universal/is-production.js');
 const require_error = require('../error.js');
 
 //#region src/cookie/error.ts
@@ -8,16 +9,17 @@ var InvalidCookie = class InvalidCookie extends require_error.ElysiaError {
 		this.key = key;
 		this.response = response;
 		this.status = 400;
-		this.problemType = "invalid-cookie";
-		this.problemTitle = "Invalid Cookie";
+		this.code = "invalid-cookie";
 		if (status) this.status = status;
 	}
 	static signature(key) {
 		return new InvalidCookie(key, `"${key}" has invalid cookie signature`);
 	}
 	static secret(key) {
-		if (key) return new InvalidCookie(key, `"${key}" is signed but no secret is provided`, 500);
-		return new InvalidCookie(void 0, `Cookie is signed but no secret is provided`, 500);
+		const advice = `${key ? `Cookie "${key}"` : "A cookie"} is signed but \`cookie.secrets\` is missing or empty`;
+		const error = new InvalidCookie(key, require_universal_is_production.isProduction() ? "Internal Server Error" : advice, 500);
+		error.message = advice;
+		return error;
 	}
 };
 

package/dist/cookie/error.mjs

@@ -1,3 +1,4 @@
+import { isProduction } from "../universal/is-production.mjs";
 import { ElysiaError } from "../error.mjs";
 
 //#region src/cookie/error.ts
@@ -7,16 +8,17 @@ var InvalidCookie = class InvalidCookie extends ElysiaError {
 		this.key = key;
 		this.response = response;
 		this.status = 400;
-		this.problemType = "invalid-cookie";
-		this.problemTitle = "Invalid Cookie";
+		this.code = "invalid-cookie";
 		if (status) this.status = status;
 	}
 	static signature(key) {
 		return new InvalidCookie(key, `"${key}" has invalid cookie signature`);
 	}
 	static secret(key) {
-		if (key) return new InvalidCookie(key, `"${key}" is signed but no secret is provided`, 500);
-		return new InvalidCookie(void 0, `Cookie is signed but no secret is provided`, 500);
+		const advice = `${key ? `Cookie "${key}"` : "A cookie"} is signed but \`cookie.secrets\` is missing or empty`;
+		const error = new InvalidCookie(key, isProduction() ? "Internal Server Error" : advice, 500);
+		error.message = advice;
+		return error;
 	}
 };
 

package/dist/cookie/lib.js

@@ -1,4 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_constants = require('../constants.js');
 const require_utils = require('../utils.js');
 const require_cookie_error = require('./error.js');
 
@@ -21,7 +22,7 @@ function parse(str) {
 		while (ks < ke && ((c = str.charCodeAt(ks)) === 32 || c === 9)) ks++;
 		while (ke > ks && ((c = str.charCodeAt(ke - 1)) === 32 || c === 9)) ke--;
 		const key = str.slice(ks, ke);
-		if (obj[key] === void 0) {
+		if (obj[key] === void 0 && !require_constants.dangerousKeys.has(key)) {
 			let vs = eq + 1, ve = semi;
 			while (vs < ve && ((c = str.charCodeAt(vs)) === 32 || c === 9)) vs++;
 			while (ve > vs && ((c = str.charCodeAt(ve - 1)) === 32 || c === 9)) ve--;
@@ -40,7 +41,11 @@ function serialize(name, value = "", options) {
 	if (value) value = encodeURIComponent(value);
 	let str = `${name}=${value}`;
 	const maxAge = options.maxAge;
-	if (maxAge !== void 0) str += "; Max-Age=" + maxAge;
+	if (maxAge !== void 0) {
+		const age = Math.floor(maxAge);
+		if (!Number.isFinite(age)) throw new require_cookie_error.InvalidCookie(`Invalid cookie Max-Age ${JSON.stringify(maxAge)}.`);
+		str += "; Max-Age=" + age;
+	}
 	const domain = options.domain;
 	if (domain) {
 		if (COOKIE_ATTR_INVALID.test(domain)) throw new require_cookie_error.InvalidCookie(`Invalid cookie Domain ${JSON.stringify(domain)}.`);

package/dist/cookie/lib.mjs

@@ -1,3 +1,4 @@
+import { dangerousKeys } from "../constants.mjs";
 import { nullObject } from "../utils.mjs";
 import { InvalidCookie } from "./error.mjs";
 
@@ -20,7 +21,7 @@ function parse(str) {
 		while (ks < ke && ((c = str.charCodeAt(ks)) === 32 || c === 9)) ks++;
 		while (ke > ks && ((c = str.charCodeAt(ke - 1)) === 32 || c === 9)) ke--;
 		const key = str.slice(ks, ke);
-		if (obj[key] === void 0) {
+		if (obj[key] === void 0 && !dangerousKeys.has(key)) {
 			let vs = eq + 1, ve = semi;
 			while (vs < ve && ((c = str.charCodeAt(vs)) === 32 || c === 9)) vs++;
 			while (ve > vs && ((c = str.charCodeAt(ve - 1)) === 32 || c === 9)) ve--;
@@ -39,7 +40,11 @@ function serialize(name, value = "", options) {
 	if (value) value = encodeURIComponent(value);
 	let str = `${name}=${value}`;
 	const maxAge = options.maxAge;
-	if (maxAge !== void 0) str += "; Max-Age=" + maxAge;
+	if (maxAge !== void 0) {
+		const age = Math.floor(maxAge);
+		if (!Number.isFinite(age)) throw new InvalidCookie(`Invalid cookie Max-Age ${JSON.stringify(maxAge)}.`);
+		str += "; Max-Age=" + age;
+	}
 	const domain = options.domain;
 	if (domain) {
 		if (COOKIE_ATTR_INVALID.test(domain)) throw new InvalidCookie(`Invalid cookie Domain ${JSON.stringify(domain)}.`);

package/dist/cookie/serialize.js

@@ -7,7 +7,7 @@ function serializeCookie(cookies) {
 	if (!cookies || !require_utils.isNotEmpty(cookies)) return;
 	let set;
 	let isArray = false;
-	for (const key in cookies) {
+	for (const key of Object.keys(cookies)) {
 		if (!key) continue;
 		const property = cookies[key];
 		if (!property) continue;

package/dist/cookie/serialize.mjs

@@ -6,7 +6,7 @@ function serializeCookie(cookies) {
 	if (!cookies || !isNotEmpty(cookies)) return;
 	let set;
 	let isArray = false;
-	for (const key in cookies) {
+	for (const key of Object.keys(cookies)) {
 		if (!key) continue;
 		const property = cookies[key];
 		if (!property) continue;

package/dist/cookie/types.d.ts

@@ -108,6 +108,16 @@ interface CookieOptions {
    * `null` in the array makes Elysia accept an unsigned cookie (intended only for a one-way unsigned→signed migration)
    */
   secrets?: string | null | (string | null)[];
+  /**
+   * Only use secret for signing cookie instead of secret + seperator + name
+   *
+   * Set to `false` once every signed cookie in circulation has been re-issued
+   *
+   * Applies to the app and route level
+   *
+   * @default true
+   */
+  legacySignature?: boolean;
 }
 //#endregion
 export { BaseCookie, CookieOptions };

package/dist/cookie/utils.d.ts

@@ -1,14 +1,10 @@
-import { CookieOptions } from "./types.js";
 import { Cookie } from "./cookie.js";
 import { Context } from "../context.js";
 import { CompiledCookieConfig } from "./config.js";
 import { hasSyncHmac } from "./crypto.js";
 
 //#region src/cookie/utils.d.ts
-declare function parseCookie(set: Context['set'], cookieString?: string | null, options?: CookieOptions & {
-  sign?: true | string | string[];
-}): Promise<Record<string, Cookie<unknown>>>;
-declare function parseCookieRawSync(cookieString: string | null | undefined, _config: CompiledCookieConfig): Record<string, unknown>;
+declare function parseCookieRawSync(cookieString: string | null | undefined, _config: CompiledCookieConfig): any;
 /**
  * Unsigned + unvalidated lane only
  *
@@ -17,9 +13,9 @@ declare function parseCookieRawSync(cookieString: string | null | undefined, _co
  */
 declare function parseCookieRawDeferred(cookieString: string | null | undefined, _config: CompiledCookieConfig): Record<string, unknown>;
 declare function parseCookieRawLazy(cookieString: string | null | undefined, config: CompiledCookieConfig): Record<string, unknown>;
-declare function parseCookieRaw(cookieString: string | null | undefined, config: CompiledCookieConfig): Promise<Record<string, unknown>>;
-declare function parseCookieRawSigned(cookieString: string | null | undefined, config: CompiledCookieConfig): Record<string, unknown>;
+declare function parseCookieRaw(cookieString: string | null | undefined, config: CompiledCookieConfig, lazy?: 1): Promise<Record<string, unknown>>;
+declare function parseCookieRawSigned(cookieString: string | null | undefined, config: CompiledCookieConfig, lazy?: 1): Record<string, unknown>;
 declare function buildCookieJar(set: Context['set'], raw: Record<string, unknown>, config: CompiledCookieConfig, lazySign?: 1, deferDecode?: 1): Record<string, Cookie<unknown>>;
 declare function signCookieValues(cookies: Context['set']['cookie'] | undefined, config: CompiledCookieConfig): Promise<void> | undefined;
 //#endregion
-export { buildCookieJar, hasSyncHmac, parseCookie, parseCookieRaw, parseCookieRawDeferred, parseCookieRawLazy, parseCookieRawSigned, parseCookieRawSync, signCookieValues };
+export { buildCookieJar, hasSyncHmac, parseCookieRaw, parseCookieRawDeferred, parseCookieRawLazy, parseCookieRawSigned, parseCookieRawSync, signCookieValues };