elysia 2.0.0-beta.2 → 2.0.0-beta.3

package/dist/compile/handler/index.js

@@ -198,10 +198,10 @@ function resolveChainNode(root, node) {
 	}
 	return resolved;
 }
-const chainResolver = (root) => {
+function chainResolver(root) {
 	const frozenRoot = require_generation.frozenRootOf(root);
 	return frozenRoot["~ext"]?.macro || frozenRoot["~scopeChildren"] ? (node) => resolveChainNode(root, node) : void 0;
-};
+}
 const localMacroRoot = (instance, root) => instance !== root && instance["~scopeChild"] === true && require_generation.frozenRootOf(instance)["~ext"]?.macro ? instance : root;
 function composeRootHook(root, inheritedChain) {
 	const resolve = chainResolver(root);
@@ -211,7 +211,8 @@ function composeRootHook(root, inheritedChain) {
 	if (!locals) return inherited;
 	return require_utils.mergeHook(inherited, locals);
 }
-function buildNativeStaticResponse([, , handler, instance, localHook, appHook, inheritedChain, macroScope], root) {
+function buildNativeStaticResponse(route, root) {
+	const [, , handler, instance, localHook, appHook, inheritedChain, macroScope] = route;
 	if (typeof handler === "function" || handler instanceof Error || handler instanceof Promise) return;
 	const frozenRoot = require_generation.frozenRootOf(root);
 	const adapter = frozenRoot["~config"]?.adapter ?? require_adapter_constants.defaultAdapter;
@@ -273,7 +274,8 @@ function isContextFreeHandler(handler) {
 	const source = Function.prototype.toString.call(handler);
 	return isBareArrow.test(source) && !isSucroseOpaque.test(source);
 }
-function compileHandler([_method, path, handler, instance, localHook, appHook, inheritedChain, macroScope], root, precomputedStatic) {
+function compileHandler(route, root, precomputedStatic) {
+	let [_method, path, handler, instance, localHook, appHook, inheritedChain, macroScope] = route;
 	const frozenRoot = require_generation.frozenRootOf(root);
 	const adapter = frozenRoot["~config"]?.adapter ?? require_adapter_constants.defaultAdapter;
 	const method = _method;

package/dist/compile/handler/index.mjs

@@ -197,10 +197,10 @@ function resolveChainNode(root, node) {
 	}
 	return resolved;
 }
-const chainResolver = (root) => {
+function chainResolver(root) {
 	const frozenRoot = frozenRootOf(root);
 	return frozenRoot["~ext"]?.macro || frozenRoot["~scopeChildren"] ? (node) => resolveChainNode(root, node) : void 0;
-};
+}
 const localMacroRoot = (instance, root) => instance !== root && instance["~scopeChild"] === true && frozenRootOf(instance)["~ext"]?.macro ? instance : root;
 function composeRootHook(root, inheritedChain) {
 	const resolve = chainResolver(root);
@@ -210,7 +210,8 @@ function composeRootHook(root, inheritedChain) {
 	if (!locals) return inherited;
 	return mergeHook(inherited, locals);
 }
-function buildNativeStaticResponse([, , handler, instance, localHook, appHook, inheritedChain, macroScope], root) {
+function buildNativeStaticResponse(route, root) {
+	const [, , handler, instance, localHook, appHook, inheritedChain, macroScope] = route;
 	if (typeof handler === "function" || handler instanceof Error || handler instanceof Promise) return;
 	const frozenRoot = frozenRootOf(root);
 	const adapter = frozenRoot["~config"]?.adapter ?? defaultAdapter;
@@ -272,7 +273,8 @@ function isContextFreeHandler(handler) {
 	const source = Function.prototype.toString.call(handler);
 	return isBareArrow.test(source) && !isSucroseOpaque.test(source);
 }
-function compileHandler([_method, path, handler, instance, localHook, appHook, inheritedChain, macroScope], root, precomputedStatic) {
+function compileHandler(route, root, precomputedStatic) {
+	let [_method, path, handler, instance, localHook, appHook, inheritedChain, macroScope] = route;
 	const frozenRoot = frozenRootOf(root);
 	const adapter = frozenRoot["~config"]?.adapter ?? defaultAdapter;
 	const method = _method;

package/dist/compile/handler/utils.js

@@ -60,7 +60,7 @@ function extractDeriveKeys(fn) {
 }
 function replaceDeriveContext(context, derivative) {
 	const next = Object.create(Object.getPrototypeOf(context));
-	Object.assign(next, derivative);
+	require_utils.assignOwn(next, derivative);
 	next.request = context.request;
 	next["~sig"] = context["~sig"];
 	next["~afterResponse"] = context["~afterResponse"];
@@ -334,7 +334,7 @@ function mapBeforeHandle(_hooks, derive, link, isAsync, report, abortGuard) {
 				code += "if(tmp instanceof es)_r=tmp\nelse if(tmp){if(typeof tmp==='object'||typeof tmp==='function')c=rdc(c,tmp);tmp=undefined}\n";
 			} else {
 				const keys = extractDeriveKeys(fn);
-				const merge = keys && keys.length ? keys.map((k) => `c[${JSON.stringify(k)}]=tmp[${JSON.stringify(k)}]`).join(";") : "Object.assign(c,tmp)";
+				const merge = keys && keys.length && !keys.includes("__proto__") ? keys.map((k) => `c[${JSON.stringify(k)}]=tmp[${JSON.stringify(k)}]`).join(";") : "Object.hasOwn(tmp,'__proto__')?Object.defineProperties(c,Object.getOwnPropertyDescriptors(tmp)):Object.assign(c,tmp)";
 				code += `if(tmp instanceof es)_r=tmp
 else if(tmp){${merge};tmp=undefined}\n`;
 			}

package/dist/compile/handler/utils.mjs

@@ -1,4 +1,4 @@
-import { deriveEntryFn, isMapDeriveEntry } from "../../utils.mjs";
+import { assignOwn, deriveEntryFn, isMapDeriveEntry } from "../../utils.mjs";
 import { ELYSIA_TYPES } from "../../type/constants.mjs";
 import { skipClone } from "../../adapter/skip-clone.mjs";
 import { ElysiaStatus } from "../../error.mjs";
@@ -59,7 +59,7 @@ function extractDeriveKeys(fn) {
 }
 function replaceDeriveContext(context, derivative) {
 	const next = Object.create(Object.getPrototypeOf(context));
-	Object.assign(next, derivative);
+	assignOwn(next, derivative);
 	next.request = context.request;
 	next["~sig"] = context["~sig"];
 	next["~afterResponse"] = context["~afterResponse"];
@@ -333,7 +333,7 @@ function mapBeforeHandle(_hooks, derive, link, isAsync, report, abortGuard) {
 				code += "if(tmp instanceof es)_r=tmp\nelse if(tmp){if(typeof tmp==='object'||typeof tmp==='function')c=rdc(c,tmp);tmp=undefined}\n";
 			} else {
 				const keys = extractDeriveKeys(fn);
-				const merge = keys && keys.length ? keys.map((k) => `c[${JSON.stringify(k)}]=tmp[${JSON.stringify(k)}]`).join(";") : "Object.assign(c,tmp)";
+				const merge = keys && keys.length && !keys.includes("__proto__") ? keys.map((k) => `c[${JSON.stringify(k)}]=tmp[${JSON.stringify(k)}]`).join(";") : "Object.hasOwn(tmp,'__proto__')?Object.defineProperties(c,Object.getOwnPropertyDescriptors(tmp)):Object.assign(c,tmp)";
 				code += `if(tmp instanceof es)_r=tmp
 else if(tmp){${merge};tmp=undefined}\n`;
 			}

package/dist/context.js

@@ -46,7 +46,6 @@ function clearContextCache() {
 	sharedEmptyDecorator = null;
 	sharedEmptyContext = null;
 }
-const pathValue = Symbol("path");
 function buildEmptyContext(Base, headers = null, warnPathMutation = false) {
 	const immutableHeaders = headers !== null && Object.isFrozen(headers);
 	let warnedPathMutation = false;
@@ -54,14 +53,14 @@ function buildEmptyContext(Base, headers = null, warnPathMutation = false) {
 		enumerable: true,
 		configurable: true,
 		get() {
-			return this[pathValue];
+			return this["~path"];
 		},
 		set(value) {
-			if (pathValue in this && !warnedPathMutation) {
+			if ("~path" in this && !warnedPathMutation) {
 				warnedPathMutation = true;
 				console.warn("[elysia] context.path is readonly; request-hook rerouting will stop working in a future release.");
 			}
-			this[pathValue] = value;
+			this["~path"] = value;
 		}
 	} : void 0;
 	class Context extends Base {

package/dist/context.mjs

@@ -45,7 +45,6 @@ function clearContextCache() {
 	sharedEmptyDecorator = null;
 	sharedEmptyContext = null;
 }
-const pathValue = Symbol("path");
 function buildEmptyContext(Base, headers = null, warnPathMutation = false) {
 	const immutableHeaders = headers !== null && Object.isFrozen(headers);
 	let warnedPathMutation = false;
@@ -53,14 +52,14 @@ function buildEmptyContext(Base, headers = null, warnPathMutation = false) {
 		enumerable: true,
 		configurable: true,
 		get() {
-			return this[pathValue];
+			return this["~path"];
 		},
 		set(value) {
-			if (pathValue in this && !warnedPathMutation) {
+			if ("~path" in this && !warnedPathMutation) {
 				warnedPathMutation = true;
 				console.warn("[elysia] context.path is readonly; request-hook rerouting will stop working in a future release.");
 			}
-			this[pathValue] = value;
+			this["~path"] = value;
 		}
 	} : void 0;
 	class Context extends Base {

package/dist/cookie/config.d.ts

@@ -18,6 +18,7 @@ interface CompiledCookieConfig {
   globalSecrets: string | null | (string | null)[] | undefined;
   hasSign: boolean;
   verify: 'lazy' | 'eager';
+  legacySignature: boolean;
 }
 declare function compileCookieConfig(routeSchema: AnySchema | undefined, appConfig: AppCookieConfig | undefined): CompiledCookieConfig;
 declare function resolveSignSecrets(name: string, config: CompiledCookieConfig): CompiledCookieConfig['globalSecrets'] | undefined;

package/dist/cookie/config.js

@@ -31,7 +31,7 @@ function normalizeSign(sign) {
 	if (Array.isArray(sign)) return sign.length ? sign : void 0;
 	return [sign];
 }
-const hasUsableSecret = (secrets) => secrets == null ? false : Array.isArray(secrets) ? secrets.some((s) => s != null) : true;
+const hasUsableSecret = (secrets) => Array.isArray(secrets) ? secrets.some((s) => !!s?.trim()) : !!secrets?.trim();
 function compileCookieConfig(routeSchema, appConfig) {
 	const routeConfig = routeSchema?.config ?? void 0;
 	const appAttributes = getAttributes(appConfig);
@@ -74,7 +74,8 @@ function compileCookieConfig(routeSchema, appConfig) {
 		globalSignSet: Array.isArray(globalSign) ? new Set(globalSign) : void 0,
 		globalSecrets,
 		hasSign,
-		verify: appConfig?.verify ?? "lazy"
+		verify: appConfig?.verify ?? "lazy",
+		legacySignature: (routeConfig?.legacySignature ?? appConfig?.legacySignature) !== false
 	};
 }
 function resolveSignSecrets(name, config) {

package/dist/cookie/config.mjs

@@ -30,7 +30,7 @@ function normalizeSign(sign) {
 	if (Array.isArray(sign)) return sign.length ? sign : void 0;
 	return [sign];
 }
-const hasUsableSecret = (secrets) => secrets == null ? false : Array.isArray(secrets) ? secrets.some((s) => s != null) : true;
+const hasUsableSecret = (secrets) => Array.isArray(secrets) ? secrets.some((s) => !!s?.trim()) : !!secrets?.trim();
 function compileCookieConfig(routeSchema, appConfig) {
 	const routeConfig = routeSchema?.config ?? void 0;
 	const appAttributes = getAttributes(appConfig);
@@ -73,7 +73,8 @@ function compileCookieConfig(routeSchema, appConfig) {
 		globalSignSet: Array.isArray(globalSign) ? new Set(globalSign) : void 0,
 		globalSecrets,
 		hasSign,
-		verify: appConfig?.verify ?? "lazy"
+		verify: appConfig?.verify ?? "lazy",
+		legacySignature: (routeConfig?.legacySignature ?? appConfig?.legacySignature) !== false
 	};
 }
 function resolveSignSecrets(name, config) {

package/dist/cookie/cookie.d.ts

@@ -10,6 +10,7 @@ declare class Cookie<T = any> implements BaseCookie {
   constructor(name: string, setRef: {
     cookie?: Record<string, BaseCookie>;
   }, initial?: Partial<BaseCookie>);
+  static isCookie(v: unknown): v is Cookie;
   get cookie(): BaseCookie;
   set cookie(jar: BaseCookie);
   protected get setCookie(): BaseCookie;

package/dist/cookie/cookie.js

@@ -1,4 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
+const require_utils = require('../utils.js');
 const require_cookie_crypto = require('./crypto.js');
 
 //#region src/cookie/cookie.ts
@@ -23,6 +24,9 @@ var Cookie = class {
 		this.#setRef = setRef;
 		this.#initial = initial;
 	}
+	static isCookie(v) {
+		return typeof v === "object" && v !== null && #name in v;
+	}
 	get #jar() {
 		return this.#setRef.cookie ??= Object.create(null);
 	}
@@ -56,7 +60,7 @@ var Cookie = class {
 	set value(value) {
 		if (this.cookie.value === value && (!value || typeof value !== "object")) return;
 		const j = this.#jar;
-		if (!(this.#name in j)) j[this.#name] = { ...this.#initial };
+		if (!(this.#name in j)) j[this.#name] = Object.assign(require_utils.nullObject(), this.#initial);
 		j[this.#name].value = value;
 	}
 	update(config) {
@@ -66,10 +70,7 @@ var Cookie = class {
 		return this;
 	}
 	set(config) {
-		const cookie = Object.assign({
-			...this.#initial,
-			value: this.value
-		}, typeof config === "function" ? config(this.cookie) : config);
+		const cookie = Object.assign(require_utils.nullObject(), this.#initial, { value: this.value }, typeof config === "function" ? config(this.cookie) : config);
 		delete cookie["~raw"];
 		this.setCookie = cookie;
 		return this;

package/dist/cookie/cookie.mjs

@@ -1,3 +1,4 @@
+import { nullObject } from "../utils.mjs";
 import { resolvePendingCookie } from "./crypto.mjs";
 
 //#region src/cookie/cookie.ts
@@ -22,6 +23,9 @@ var Cookie = class {
 		this.#setRef = setRef;
 		this.#initial = initial;
 	}
+	static isCookie(v) {
+		return typeof v === "object" && v !== null && #name in v;
+	}
 	get #jar() {
 		return this.#setRef.cookie ??= Object.create(null);
 	}
@@ -55,7 +59,7 @@ var Cookie = class {
 	set value(value) {
 		if (this.cookie.value === value && (!value || typeof value !== "object")) return;
 		const j = this.#jar;
-		if (!(this.#name in j)) j[this.#name] = { ...this.#initial };
+		if (!(this.#name in j)) j[this.#name] = Object.assign(nullObject(), this.#initial);
 		j[this.#name].value = value;
 	}
 	update(config) {
@@ -65,10 +69,7 @@ var Cookie = class {
 		return this;
 	}
 	set(config) {
-		const cookie = Object.assign({
-			...this.#initial,
-			value: this.value
-		}, typeof config === "function" ? config(this.cookie) : config);
+		const cookie = Object.assign(nullObject(), this.#initial, { value: this.value }, typeof config === "function" ? config(this.cookie) : config);
 		delete cookie["~raw"];
 		this.setCookie = cookie;
 		return this;

package/dist/cookie/crypto.d.ts

@@ -7,14 +7,15 @@ declare const signCookieSyncImpl: (val: string, secret: string) => string;
 declare const keyCache: Map<string, Promise<CryptoKey>>;
 declare function importSecretKey(secret: string): Promise<CryptoKey>;
 declare function signCookieSubtle(val: string, secret: string): Promise<string>;
-declare function signCookie(val: string, secret: string | null): Promise<string>;
-declare function signCookieSync(val: string, secret: string | null): string;
-declare function unsignCookie(input: string, secret: string | null): Promise<string | false>;
-declare function unsignCookieSync(input: string, secret: string | null): string | false;
-declare function unsignWithSecretsSync(name: string, value: unknown, secrets: string | null | (string | null)[] | undefined): string;
-declare function unsignWithSecrets(name: string, value: unknown, secrets: string | null | (string | null)[] | undefined): Promise<string>;
+declare const deriveSignKey: (secret: string, name: string) => string;
+declare function signCookie(val: string, secret: string | null, name?: string): Promise<string>;
+declare function signCookieSync(val: string, secret: string | null, name?: string): string;
+declare function unsignCookie(input: string, secret: string | null, name?: string): Promise<string | false>;
+declare function unsignCookieSync(input: string, secret: string | null, name?: string): string | false;
+declare function unsignWithSecretsSync(name: string, value: unknown, secrets: string | null | (string | null)[] | undefined, legacy?: boolean): string;
+declare function unsignWithSecrets(name: string, value: unknown, secrets: string | null | (string | null)[] | undefined, legacy?: boolean): Promise<string>;
 declare const rawJsonValue: WeakMap<object, string>;
 declare function maybeJsonDecode(value: unknown): any;
 declare function resolvePendingCookie(entry: Record<string, any>, name: string): void;
 //#endregion
-export { hasSyncHmac, hmacProvider, importSecretKey, keyCache, maybeJsonDecode, rawJsonValue, resolvePendingCookie, signCookie, signCookieBun, signCookieNode, signCookieSubtle, signCookieSync, signCookieSyncImpl, unsignCookie, unsignCookieSync, unsignWithSecrets, unsignWithSecretsSync };
+export { deriveSignKey, hasSyncHmac, hmacProvider, importSecretKey, keyCache, maybeJsonDecode, rawJsonValue, resolvePendingCookie, signCookie, signCookieBun, signCookieNode, signCookieSubtle, signCookieSync, signCookieSyncImpl, unsignCookie, unsignCookieSync, unsignWithSecrets, unsignWithSecretsSync };

package/dist/cookie/crypto.js

@@ -20,12 +20,11 @@ function nodeCrypto() {
 	}
 	return _nodeCrypto;
 }
-const HMAC_PROBE_DIGEST = "bzs6y9cVmkYub8fplSKaOuuqMqJlDwhMypFT/jSdCEk=";
 const bunCryptoHasher = (() => {
 	const hasher = globalThis.Bun?.CryptoHasher;
 	if (typeof hasher !== "function") return void 0;
 	try {
-		return new hasher("sha256", "elysia").update("probe").digest("base64") === HMAC_PROBE_DIGEST ? hasher : void 0;
+		return new hasher("sha256", "elysia").update("probe").digest("base64") === "bzs6y9cVmkYub8fplSKaOuuqMqJlDwhMypFT/jSdCEk=" ? hasher : void 0;
 	} catch {
 		return;
 	}
@@ -62,19 +61,22 @@ async function signCookieSubtle(val, secret) {
 	const hmacBuffer = await crypto.subtle.sign("HMAC", await importSecretKey(secret), encoder.encode(val));
 	return `${val}.${btoa(String.fromCharCode(...new Uint8Array(hmacBuffer))).replace(removeTrailingEquals, "")}`;
 }
-async function signCookie(val, secret) {
+const deriveSignKey = (secret, name) => `${name.length}\0${name}${secret}`;
+async function signCookie(val, secret, name) {
 	val = coerceValue(val);
-	if (secret === null || secret === void 0) throw new TypeError("Secret key must be provided");
+	if (!secret?.trim()) throw new TypeError("Secret key must be provided");
+	if (name !== void 0) secret = deriveSignKey(secret, name);
 	if (hasSyncHmac) return signCookieSyncImpl(val, secret);
 	return signCookieSubtle(val, secret);
 }
-function signCookieSync(val, secret) {
+function signCookieSync(val, secret, name) {
 	val = coerceValue(val);
-	if (secret === null || secret === void 0) throw new TypeError("Secret key must be provided");
+	if (!secret?.trim()) throw new TypeError("Secret key must be provided");
 	if (!hasSyncHmac) throw new Error("signCookieSync called without a sync HMAC available");
+	if (name !== void 0) secret = deriveSignKey(secret, name);
 	return signCookieSyncImpl(val, secret);
 }
-async function unsignCookie(input, secret) {
+async function unsignCookie(input, secret, name) {
 	if (typeof input !== "string") throw new TypeError("Signed cookie string must be provided.");
 	const dot = input.lastIndexOf(".");
 	if (dot === -1) {
@@ -82,10 +84,10 @@ async function unsignCookie(input, secret) {
 		return false;
 	}
 	const tentativeValue = input.slice(0, dot);
-	if (secret === null) return false;
-	return require_utils.constantTimeEqual(await signCookie(tentativeValue, secret), input) ? tentativeValue : false;
+	if (!secret?.trim()) return false;
+	return require_utils.constantTimeEqual(await signCookie(tentativeValue, secret, name), input) ? tentativeValue : false;
 }
-function unsignCookieSync(input, secret) {
+function unsignCookieSync(input, secret, name) {
 	if (typeof input !== "string") throw new TypeError("Signed cookie string must be provided.");
 	const dot = input.lastIndexOf(".");
 	if (dot === -1) {
@@ -93,32 +95,36 @@ function unsignCookieSync(input, secret) {
 		return false;
 	}
 	const tentativeValue = input.slice(0, dot);
-	if (secret === null) return false;
-	return require_utils.constantTimeEqual(signCookieSync(tentativeValue, secret), input) ? tentativeValue : false;
+	if (!secret?.trim()) return false;
+	return require_utils.constantTimeEqual(signCookieSync(tentativeValue, secret, name), input) ? tentativeValue : false;
 }
-function unsignWithSecretsSync(name, value, secrets) {
+function unsignWithSecretsSync(name, value, secrets, legacy) {
 	if (typeof value !== "string") throw require_cookie_error.InvalidCookie.signature(name);
-	if (typeof secrets === "string") {
-		const temp = unsignCookieSync(value, secrets);
-		if (temp === false) throw require_cookie_error.InvalidCookie.signature(name);
-		return temp;
-	}
-	if (Array.isArray(secrets)) for (let i = 0; i < secrets.length; i++) {
-		const temp = unsignCookieSync(value, secrets[i]);
-		if (temp !== false) return temp;
+	for (let pass = 0; pass < 2; pass++) {
+		const bound = pass === 0 ? name : void 0;
+		if (typeof secrets === "string") {
+			const temp = unsignCookieSync(value, secrets, bound);
+			if (temp !== false) return temp;
+		} else if (Array.isArray(secrets)) for (let i = 0; i < secrets.length; i++) {
+			const temp = unsignCookieSync(value, secrets[i], bound);
+			if (temp !== false) return temp;
+		}
+		if (!legacy) break;
 	}
 	throw require_cookie_error.InvalidCookie.signature(name);
 }
-async function unsignWithSecrets(name, value, secrets) {
+async function unsignWithSecrets(name, value, secrets, legacy) {
 	if (typeof value !== "string") throw require_cookie_error.InvalidCookie.signature(name);
-	if (typeof secrets === "string") {
-		const temp = await unsignCookie(value, secrets);
-		if (temp === false) throw require_cookie_error.InvalidCookie.signature(name);
-		return temp;
-	}
-	if (Array.isArray(secrets)) for (let i = 0; i < secrets.length; i++) {
-		const temp = await unsignCookie(value, secrets[i]);
-		if (temp !== false) return temp;
+	for (let pass = 0; pass < 2; pass++) {
+		const bound = pass === 0 ? name : void 0;
+		if (typeof secrets === "string") {
+			const temp = await unsignCookie(value, secrets, bound);
+			if (temp !== false) return temp;
+		} else if (Array.isArray(secrets)) for (let i = 0; i < secrets.length; i++) {
+			const temp = await unsignCookie(value, secrets[i], bound);
+			if (temp !== false) return temp;
+		}
+		if (!legacy) break;
 	}
 	throw require_cookie_error.InvalidCookie.signature(name);
 }
@@ -139,7 +145,7 @@ function resolvePendingCookie(entry, name) {
 	const value = entry.value;
 	if (typeof value !== "string") throw require_cookie_error.InvalidCookie.signature(name);
 	if (!hasSyncHmac) throw new Error(`resolvePendingCookie called without sync HMAC. Unreachable under correct lane gating (cookie: "${name}")`);
-	const resolvedValue = maybeJsonDecode(unsignWithSecretsSync(name, value, entry["~unsign"]));
+	const resolvedValue = maybeJsonDecode(unsignWithSecretsSync(name, value, entry["~unsign"], !entry["~strict"]));
 	entry.value = resolvedValue;
 	if (resolvedValue !== null && typeof resolvedValue === "object") {
 		const raw = rawJsonValue.get(resolvedValue);
@@ -149,6 +155,7 @@ function resolvePendingCookie(entry, name) {
 }
 
 //#endregion
+exports.deriveSignKey = deriveSignKey;
 exports.hasSyncHmac = hasSyncHmac;
 exports.hmacProvider = hmacProvider;
 exports.importSecretKey = importSecretKey;

package/dist/cookie/crypto.mjs

@@ -19,12 +19,11 @@ function nodeCrypto() {
 	}
 	return _nodeCrypto;
 }
-const HMAC_PROBE_DIGEST = "bzs6y9cVmkYub8fplSKaOuuqMqJlDwhMypFT/jSdCEk=";
 const bunCryptoHasher = (() => {
 	const hasher = globalThis.Bun?.CryptoHasher;
 	if (typeof hasher !== "function") return void 0;
 	try {
-		return new hasher("sha256", "elysia").update("probe").digest("base64") === HMAC_PROBE_DIGEST ? hasher : void 0;
+		return new hasher("sha256", "elysia").update("probe").digest("base64") === "bzs6y9cVmkYub8fplSKaOuuqMqJlDwhMypFT/jSdCEk=" ? hasher : void 0;
 	} catch {
 		return;
 	}
@@ -61,19 +60,22 @@ async function signCookieSubtle(val, secret) {
 	const hmacBuffer = await crypto.subtle.sign("HMAC", await importSecretKey(secret), encoder.encode(val));
 	return `${val}.${btoa(String.fromCharCode(...new Uint8Array(hmacBuffer))).replace(removeTrailingEquals, "")}`;
 }
-async function signCookie(val, secret) {
+const deriveSignKey = (secret, name) => `${name.length}\0${name}${secret}`;
+async function signCookie(val, secret, name) {
 	val = coerceValue(val);
-	if (secret === null || secret === void 0) throw new TypeError("Secret key must be provided");
+	if (!secret?.trim()) throw new TypeError("Secret key must be provided");
+	if (name !== void 0) secret = deriveSignKey(secret, name);
 	if (hasSyncHmac) return signCookieSyncImpl(val, secret);
 	return signCookieSubtle(val, secret);
 }
-function signCookieSync(val, secret) {
+function signCookieSync(val, secret, name) {
 	val = coerceValue(val);
-	if (secret === null || secret === void 0) throw new TypeError("Secret key must be provided");
+	if (!secret?.trim()) throw new TypeError("Secret key must be provided");
 	if (!hasSyncHmac) throw new Error("signCookieSync called without a sync HMAC available");
+	if (name !== void 0) secret = deriveSignKey(secret, name);
 	return signCookieSyncImpl(val, secret);
 }
-async function unsignCookie(input, secret) {
+async function unsignCookie(input, secret, name) {
 	if (typeof input !== "string") throw new TypeError("Signed cookie string must be provided.");
 	const dot = input.lastIndexOf(".");
 	if (dot === -1) {
@@ -81,10 +83,10 @@ async function unsignCookie(input, secret) {
 		return false;
 	}
 	const tentativeValue = input.slice(0, dot);
-	if (secret === null) return false;
-	return constantTimeEqual(await signCookie(tentativeValue, secret), input) ? tentativeValue : false;
+	if (!secret?.trim()) return false;
+	return constantTimeEqual(await signCookie(tentativeValue, secret, name), input) ? tentativeValue : false;
 }
-function unsignCookieSync(input, secret) {
+function unsignCookieSync(input, secret, name) {
 	if (typeof input !== "string") throw new TypeError("Signed cookie string must be provided.");
 	const dot = input.lastIndexOf(".");
 	if (dot === -1) {
@@ -92,32 +94,36 @@ function unsignCookieSync(input, secret) {
 		return false;
 	}
 	const tentativeValue = input.slice(0, dot);
-	if (secret === null) return false;
-	return constantTimeEqual(signCookieSync(tentativeValue, secret), input) ? tentativeValue : false;
+	if (!secret?.trim()) return false;
+	return constantTimeEqual(signCookieSync(tentativeValue, secret, name), input) ? tentativeValue : false;
 }
-function unsignWithSecretsSync(name, value, secrets) {
+function unsignWithSecretsSync(name, value, secrets, legacy) {
 	if (typeof value !== "string") throw InvalidCookie.signature(name);
-	if (typeof secrets === "string") {
-		const temp = unsignCookieSync(value, secrets);
-		if (temp === false) throw InvalidCookie.signature(name);
-		return temp;
-	}
-	if (Array.isArray(secrets)) for (let i = 0; i < secrets.length; i++) {
-		const temp = unsignCookieSync(value, secrets[i]);
-		if (temp !== false) return temp;
+	for (let pass = 0; pass < 2; pass++) {
+		const bound = pass === 0 ? name : void 0;
+		if (typeof secrets === "string") {
+			const temp = unsignCookieSync(value, secrets, bound);
+			if (temp !== false) return temp;
+		} else if (Array.isArray(secrets)) for (let i = 0; i < secrets.length; i++) {
+			const temp = unsignCookieSync(value, secrets[i], bound);
+			if (temp !== false) return temp;
+		}
+		if (!legacy) break;
 	}
 	throw InvalidCookie.signature(name);
 }
-async function unsignWithSecrets(name, value, secrets) {
+async function unsignWithSecrets(name, value, secrets, legacy) {
 	if (typeof value !== "string") throw InvalidCookie.signature(name);
-	if (typeof secrets === "string") {
-		const temp = await unsignCookie(value, secrets);
-		if (temp === false) throw InvalidCookie.signature(name);
-		return temp;
-	}
-	if (Array.isArray(secrets)) for (let i = 0; i < secrets.length; i++) {
-		const temp = await unsignCookie(value, secrets[i]);
-		if (temp !== false) return temp;
+	for (let pass = 0; pass < 2; pass++) {
+		const bound = pass === 0 ? name : void 0;
+		if (typeof secrets === "string") {
+			const temp = await unsignCookie(value, secrets, bound);
+			if (temp !== false) return temp;
+		} else if (Array.isArray(secrets)) for (let i = 0; i < secrets.length; i++) {
+			const temp = await unsignCookie(value, secrets[i], bound);
+			if (temp !== false) return temp;
+		}
+		if (!legacy) break;
 	}
 	throw InvalidCookie.signature(name);
 }
@@ -138,7 +144,7 @@ function resolvePendingCookie(entry, name) {
 	const value = entry.value;
 	if (typeof value !== "string") throw InvalidCookie.signature(name);
 	if (!hasSyncHmac) throw new Error(`resolvePendingCookie called without sync HMAC. Unreachable under correct lane gating (cookie: "${name}")`);
-	const resolvedValue = maybeJsonDecode(unsignWithSecretsSync(name, value, entry["~unsign"]));
+	const resolvedValue = maybeJsonDecode(unsignWithSecretsSync(name, value, entry["~unsign"], !entry["~strict"]));
 	entry.value = resolvedValue;
 	if (resolvedValue !== null && typeof resolvedValue === "object") {
 		const raw = rawJsonValue.get(resolvedValue);
@@ -148,4 +154,4 @@ function resolvePendingCookie(entry, name) {
 }
 
 //#endregion
-export { hasSyncHmac, hmacProvider, importSecretKey, keyCache, maybeJsonDecode, rawJsonValue, resolvePendingCookie, signCookie, signCookieBun, signCookieNode, signCookieSubtle, signCookieSync, signCookieSyncImpl, unsignCookie, unsignCookieSync, unsignWithSecrets, unsignWithSecretsSync };
+export { deriveSignKey, hasSyncHmac, hmacProvider, importSecretKey, keyCache, maybeJsonDecode, rawJsonValue, resolvePendingCookie, signCookie, signCookieBun, signCookieNode, signCookieSubtle, signCookieSync, signCookieSyncImpl, unsignCookie, unsignCookieSync, unsignWithSecrets, unsignWithSecretsSync };

package/dist/cookie/error.js

@@ -16,8 +16,7 @@ var InvalidCookie = class InvalidCookie extends require_error.ElysiaError {
 		return new InvalidCookie(key, `"${key}" has invalid cookie signature`);
 	}
 	static secret(key) {
-		if (key) return new InvalidCookie(key, `"${key}" is signed but no secret is provided`, 500);
-		return new InvalidCookie(void 0, `Cookie is signed but no secret is provided`, 500);
+		return new InvalidCookie(key, `${key ? `Cookie "${key}"` : "A cookie"} is signed but \`cookie.secrets\` is missing or empty. Set it to a non-empty string: an empty secret signs with a zero-length key, which anyone can forge.`, 500);
 	}
 };
 

package/dist/cookie/error.mjs

@@ -15,8 +15,7 @@ var InvalidCookie = class InvalidCookie extends ElysiaError {
 		return new InvalidCookie(key, `"${key}" has invalid cookie signature`);
 	}
 	static secret(key) {
-		if (key) return new InvalidCookie(key, `"${key}" is signed but no secret is provided`, 500);
-		return new InvalidCookie(void 0, `Cookie is signed but no secret is provided`, 500);
+		return new InvalidCookie(key, `${key ? `Cookie "${key}"` : "A cookie"} is signed but \`cookie.secrets\` is missing or empty. Set it to a non-empty string: an empty secret signs with a zero-length key, which anyone can forge.`, 500);
 	}
 };
 

package/dist/cookie/lib.js

@@ -40,7 +40,11 @@ function serialize(name, value = "", options) {
 	if (value) value = encodeURIComponent(value);
 	let str = `${name}=${value}`;
 	const maxAge = options.maxAge;
-	if (maxAge !== void 0) str += "; Max-Age=" + maxAge;
+	if (maxAge !== void 0) {
+		const age = Math.floor(maxAge);
+		if (!Number.isFinite(age)) throw new require_cookie_error.InvalidCookie(`Invalid cookie Max-Age ${JSON.stringify(maxAge)}.`);
+		str += "; Max-Age=" + age;
+	}
 	const domain = options.domain;
 	if (domain) {
 		if (COOKIE_ATTR_INVALID.test(domain)) throw new require_cookie_error.InvalidCookie(`Invalid cookie Domain ${JSON.stringify(domain)}.`);

package/dist/cookie/lib.mjs

@@ -39,7 +39,11 @@ function serialize(name, value = "", options) {
 	if (value) value = encodeURIComponent(value);
 	let str = `${name}=${value}`;
 	const maxAge = options.maxAge;
-	if (maxAge !== void 0) str += "; Max-Age=" + maxAge;
+	if (maxAge !== void 0) {
+		const age = Math.floor(maxAge);
+		if (!Number.isFinite(age)) throw new InvalidCookie(`Invalid cookie Max-Age ${JSON.stringify(maxAge)}.`);
+		str += "; Max-Age=" + age;
+	}
 	const domain = options.domain;
 	if (domain) {
 		if (COOKIE_ATTR_INVALID.test(domain)) throw new InvalidCookie(`Invalid cookie Domain ${JSON.stringify(domain)}.`);

package/dist/cookie/serialize.js

@@ -7,7 +7,7 @@ function serializeCookie(cookies) {
 	if (!cookies || !require_utils.isNotEmpty(cookies)) return;
 	let set;
 	let isArray = false;
-	for (const key in cookies) {
+	for (const key of Object.keys(cookies)) {
 		if (!key) continue;
 		const property = cookies[key];
 		if (!property) continue;