elysia 2.0.0-beta.2 → 2.0.0-beta.4

package/dist/cookie/crypto.d.ts

@@ -7,14 +7,15 @@ declare const signCookieSyncImpl: (val: string, secret: string) => string;
 declare const keyCache: Map<string, Promise<CryptoKey>>;
 declare function importSecretKey(secret: string): Promise<CryptoKey>;
 declare function signCookieSubtle(val: string, secret: string): Promise<string>;
-declare function signCookie(val: string, secret: string | null): Promise<string>;
-declare function signCookieSync(val: string, secret: string | null): string;
-declare function unsignCookie(input: string, secret: string | null): Promise<string | false>;
-declare function unsignCookieSync(input: string, secret: string | null): string | false;
-declare function unsignWithSecretsSync(name: string, value: unknown, secrets: string | null | (string | null)[] | undefined): string;
-declare function unsignWithSecrets(name: string, value: unknown, secrets: string | null | (string | null)[] | undefined): Promise<string>;
+declare const deriveSignKey: (secret: string, name: string) => string;
+declare function signCookie(val: string, secret: string | null, name?: string): Promise<string>;
+declare function signCookieSync(val: string, secret: string | null, name?: string): string;
+declare function unsignCookie(input: string, secret: string | null, name?: string): Promise<string | false>;
+declare function unsignCookieSync(input: string, secret: string | null, name?: string): string | false;
+declare function unsignWithSecretsSync(name: string, value: unknown, secrets: string | null | (string | null)[] | undefined, legacy?: boolean): string;
+declare function unsignWithSecrets(name: string, value: unknown, secrets: string | null | (string | null)[] | undefined, legacy?: boolean): Promise<string>;
 declare const rawJsonValue: WeakMap<object, string>;
 declare function maybeJsonDecode(value: unknown): any;
 declare function resolvePendingCookie(entry: Record<string, any>, name: string): void;
 //#endregion
-export { hasSyncHmac, hmacProvider, importSecretKey, keyCache, maybeJsonDecode, rawJsonValue, resolvePendingCookie, signCookie, signCookieBun, signCookieNode, signCookieSubtle, signCookieSync, signCookieSyncImpl, unsignCookie, unsignCookieSync, unsignWithSecrets, unsignWithSecretsSync };
+export { deriveSignKey, hasSyncHmac, hmacProvider, importSecretKey, keyCache, maybeJsonDecode, rawJsonValue, resolvePendingCookie, signCookie, signCookieBun, signCookieNode, signCookieSubtle, signCookieSync, signCookieSyncImpl, unsignCookie, unsignCookieSync, unsignWithSecrets, unsignWithSecretsSync };

package/dist/cookie/crypto.js

@@ -20,12 +20,11 @@ function nodeCrypto() {
 	}
 	return _nodeCrypto;
 }
-const HMAC_PROBE_DIGEST = "bzs6y9cVmkYub8fplSKaOuuqMqJlDwhMypFT/jSdCEk=";
 const bunCryptoHasher = (() => {
 	const hasher = globalThis.Bun?.CryptoHasher;
 	if (typeof hasher !== "function") return void 0;
 	try {
-		return new hasher("sha256", "elysia").update("probe").digest("base64") === HMAC_PROBE_DIGEST ? hasher : void 0;
+		return new hasher("sha256", "elysia").update("probe").digest("base64") === "bzs6y9cVmkYub8fplSKaOuuqMqJlDwhMypFT/jSdCEk=" ? hasher : void 0;
 	} catch {
 		return;
 	}
@@ -62,19 +61,22 @@ async function signCookieSubtle(val, secret) {
 	const hmacBuffer = await crypto.subtle.sign("HMAC", await importSecretKey(secret), encoder.encode(val));
 	return `${val}.${btoa(String.fromCharCode(...new Uint8Array(hmacBuffer))).replace(removeTrailingEquals, "")}`;
 }
-async function signCookie(val, secret) {
+const deriveSignKey = (secret, name) => `${name.length}\0${name}${secret}`;
+async function signCookie(val, secret, name) {
 	val = coerceValue(val);
-	if (secret === null || secret === void 0) throw new TypeError("Secret key must be provided");
+	if (!secret?.trim()) throw new TypeError("Secret key must be provided");
+	if (name !== void 0) secret = deriveSignKey(secret, name);
 	if (hasSyncHmac) return signCookieSyncImpl(val, secret);
 	return signCookieSubtle(val, secret);
 }
-function signCookieSync(val, secret) {
+function signCookieSync(val, secret, name) {
 	val = coerceValue(val);
-	if (secret === null || secret === void 0) throw new TypeError("Secret key must be provided");
+	if (!secret?.trim()) throw new TypeError("Secret key must be provided");
 	if (!hasSyncHmac) throw new Error("signCookieSync called without a sync HMAC available");
+	if (name !== void 0) secret = deriveSignKey(secret, name);
 	return signCookieSyncImpl(val, secret);
 }
-async function unsignCookie(input, secret) {
+async function unsignCookie(input, secret, name) {
 	if (typeof input !== "string") throw new TypeError("Signed cookie string must be provided.");
 	const dot = input.lastIndexOf(".");
 	if (dot === -1) {
@@ -82,10 +84,10 @@ async function unsignCookie(input, secret) {
 		return false;
 	}
 	const tentativeValue = input.slice(0, dot);
-	if (secret === null) return false;
-	return require_utils.constantTimeEqual(await signCookie(tentativeValue, secret), input) ? tentativeValue : false;
+	if (!secret?.trim()) return false;
+	return require_utils.constantTimeEqual(await signCookie(tentativeValue, secret, name), input) ? tentativeValue : false;
 }
-function unsignCookieSync(input, secret) {
+function unsignCookieSync(input, secret, name) {
 	if (typeof input !== "string") throw new TypeError("Signed cookie string must be provided.");
 	const dot = input.lastIndexOf(".");
 	if (dot === -1) {
@@ -93,32 +95,36 @@ function unsignCookieSync(input, secret) {
 		return false;
 	}
 	const tentativeValue = input.slice(0, dot);
-	if (secret === null) return false;
-	return require_utils.constantTimeEqual(signCookieSync(tentativeValue, secret), input) ? tentativeValue : false;
+	if (!secret?.trim()) return false;
+	return require_utils.constantTimeEqual(signCookieSync(tentativeValue, secret, name), input) ? tentativeValue : false;
 }
-function unsignWithSecretsSync(name, value, secrets) {
+function unsignWithSecretsSync(name, value, secrets, legacy) {
 	if (typeof value !== "string") throw require_cookie_error.InvalidCookie.signature(name);
-	if (typeof secrets === "string") {
-		const temp = unsignCookieSync(value, secrets);
-		if (temp === false) throw require_cookie_error.InvalidCookie.signature(name);
-		return temp;
-	}
-	if (Array.isArray(secrets)) for (let i = 0; i < secrets.length; i++) {
-		const temp = unsignCookieSync(value, secrets[i]);
-		if (temp !== false) return temp;
+	for (let pass = 0; pass < 2; pass++) {
+		const bound = pass === 0 ? name : void 0;
+		if (typeof secrets === "string") {
+			const temp = unsignCookieSync(value, secrets, bound);
+			if (temp !== false) return temp;
+		} else if (Array.isArray(secrets)) for (let i = 0; i < secrets.length; i++) {
+			const temp = unsignCookieSync(value, secrets[i], bound);
+			if (temp !== false) return temp;
+		}
+		if (!legacy) break;
 	}
 	throw require_cookie_error.InvalidCookie.signature(name);
 }
-async function unsignWithSecrets(name, value, secrets) {
+async function unsignWithSecrets(name, value, secrets, legacy) {
 	if (typeof value !== "string") throw require_cookie_error.InvalidCookie.signature(name);
-	if (typeof secrets === "string") {
-		const temp = await unsignCookie(value, secrets);
-		if (temp === false) throw require_cookie_error.InvalidCookie.signature(name);
-		return temp;
-	}
-	if (Array.isArray(secrets)) for (let i = 0; i < secrets.length; i++) {
-		const temp = await unsignCookie(value, secrets[i]);
-		if (temp !== false) return temp;
+	for (let pass = 0; pass < 2; pass++) {
+		const bound = pass === 0 ? name : void 0;
+		if (typeof secrets === "string") {
+			const temp = await unsignCookie(value, secrets, bound);
+			if (temp !== false) return temp;
+		} else if (Array.isArray(secrets)) for (let i = 0; i < secrets.length; i++) {
+			const temp = await unsignCookie(value, secrets[i], bound);
+			if (temp !== false) return temp;
+		}
+		if (!legacy) break;
 	}
 	throw require_cookie_error.InvalidCookie.signature(name);
 }
@@ -139,7 +145,7 @@ function resolvePendingCookie(entry, name) {
 	const value = entry.value;
 	if (typeof value !== "string") throw require_cookie_error.InvalidCookie.signature(name);
 	if (!hasSyncHmac) throw new Error(`resolvePendingCookie called without sync HMAC. Unreachable under correct lane gating (cookie: "${name}")`);
-	const resolvedValue = maybeJsonDecode(unsignWithSecretsSync(name, value, entry["~unsign"]));
+	const resolvedValue = maybeJsonDecode(unsignWithSecretsSync(name, value, entry["~unsign"], !entry["~strict"]));
 	entry.value = resolvedValue;
 	if (resolvedValue !== null && typeof resolvedValue === "object") {
 		const raw = rawJsonValue.get(resolvedValue);
@@ -149,6 +155,7 @@ function resolvePendingCookie(entry, name) {
 }
 
 //#endregion
+exports.deriveSignKey = deriveSignKey;
 exports.hasSyncHmac = hasSyncHmac;
 exports.hmacProvider = hmacProvider;
 exports.importSecretKey = importSecretKey;

package/dist/cookie/crypto.mjs

@@ -19,12 +19,11 @@ function nodeCrypto() {
 	}
 	return _nodeCrypto;
 }
-const HMAC_PROBE_DIGEST = "bzs6y9cVmkYub8fplSKaOuuqMqJlDwhMypFT/jSdCEk=";
 const bunCryptoHasher = (() => {
 	const hasher = globalThis.Bun?.CryptoHasher;
 	if (typeof hasher !== "function") return void 0;
 	try {
-		return new hasher("sha256", "elysia").update("probe").digest("base64") === HMAC_PROBE_DIGEST ? hasher : void 0;
+		return new hasher("sha256", "elysia").update("probe").digest("base64") === "bzs6y9cVmkYub8fplSKaOuuqMqJlDwhMypFT/jSdCEk=" ? hasher : void 0;
 	} catch {
 		return;
 	}
@@ -61,19 +60,22 @@ async function signCookieSubtle(val, secret) {
 	const hmacBuffer = await crypto.subtle.sign("HMAC", await importSecretKey(secret), encoder.encode(val));
 	return `${val}.${btoa(String.fromCharCode(...new Uint8Array(hmacBuffer))).replace(removeTrailingEquals, "")}`;
 }
-async function signCookie(val, secret) {
+const deriveSignKey = (secret, name) => `${name.length}\0${name}${secret}`;
+async function signCookie(val, secret, name) {
 	val = coerceValue(val);
-	if (secret === null || secret === void 0) throw new TypeError("Secret key must be provided");
+	if (!secret?.trim()) throw new TypeError("Secret key must be provided");
+	if (name !== void 0) secret = deriveSignKey(secret, name);
 	if (hasSyncHmac) return signCookieSyncImpl(val, secret);
 	return signCookieSubtle(val, secret);
 }
-function signCookieSync(val, secret) {
+function signCookieSync(val, secret, name) {
 	val = coerceValue(val);
-	if (secret === null || secret === void 0) throw new TypeError("Secret key must be provided");
+	if (!secret?.trim()) throw new TypeError("Secret key must be provided");
 	if (!hasSyncHmac) throw new Error("signCookieSync called without a sync HMAC available");
+	if (name !== void 0) secret = deriveSignKey(secret, name);
 	return signCookieSyncImpl(val, secret);
 }
-async function unsignCookie(input, secret) {
+async function unsignCookie(input, secret, name) {
 	if (typeof input !== "string") throw new TypeError("Signed cookie string must be provided.");
 	const dot = input.lastIndexOf(".");
 	if (dot === -1) {
@@ -81,10 +83,10 @@ async function unsignCookie(input, secret) {
 		return false;
 	}
 	const tentativeValue = input.slice(0, dot);
-	if (secret === null) return false;
-	return constantTimeEqual(await signCookie(tentativeValue, secret), input) ? tentativeValue : false;
+	if (!secret?.trim()) return false;
+	return constantTimeEqual(await signCookie(tentativeValue, secret, name), input) ? tentativeValue : false;
 }
-function unsignCookieSync(input, secret) {
+function unsignCookieSync(input, secret, name) {
 	if (typeof input !== "string") throw new TypeError("Signed cookie string must be provided.");
 	const dot = input.lastIndexOf(".");
 	if (dot === -1) {
@@ -92,32 +94,36 @@ function unsignCookieSync(input, secret) {
 		return false;
 	}
 	const tentativeValue = input.slice(0, dot);
-	if (secret === null) return false;
-	return constantTimeEqual(signCookieSync(tentativeValue, secret), input) ? tentativeValue : false;
+	if (!secret?.trim()) return false;
+	return constantTimeEqual(signCookieSync(tentativeValue, secret, name), input) ? tentativeValue : false;
 }
-function unsignWithSecretsSync(name, value, secrets) {
+function unsignWithSecretsSync(name, value, secrets, legacy) {
 	if (typeof value !== "string") throw InvalidCookie.signature(name);
-	if (typeof secrets === "string") {
-		const temp = unsignCookieSync(value, secrets);
-		if (temp === false) throw InvalidCookie.signature(name);
-		return temp;
-	}
-	if (Array.isArray(secrets)) for (let i = 0; i < secrets.length; i++) {
-		const temp = unsignCookieSync(value, secrets[i]);
-		if (temp !== false) return temp;
+	for (let pass = 0; pass < 2; pass++) {
+		const bound = pass === 0 ? name : void 0;
+		if (typeof secrets === "string") {
+			const temp = unsignCookieSync(value, secrets, bound);
+			if (temp !== false) return temp;
+		} else if (Array.isArray(secrets)) for (let i = 0; i < secrets.length; i++) {
+			const temp = unsignCookieSync(value, secrets[i], bound);
+			if (temp !== false) return temp;
+		}
+		if (!legacy) break;
 	}
 	throw InvalidCookie.signature(name);
 }
-async function unsignWithSecrets(name, value, secrets) {
+async function unsignWithSecrets(name, value, secrets, legacy) {
 	if (typeof value !== "string") throw InvalidCookie.signature(name);
-	if (typeof secrets === "string") {
-		const temp = await unsignCookie(value, secrets);
-		if (temp === false) throw InvalidCookie.signature(name);
-		return temp;
-	}
-	if (Array.isArray(secrets)) for (let i = 0; i < secrets.length; i++) {
-		const temp = await unsignCookie(value, secrets[i]);
-		if (temp !== false) return temp;
+	for (let pass = 0; pass < 2; pass++) {
+		const bound = pass === 0 ? name : void 0;
+		if (typeof secrets === "string") {
+			const temp = await unsignCookie(value, secrets, bound);
+			if (temp !== false) return temp;
+		} else if (Array.isArray(secrets)) for (let i = 0; i < secrets.length; i++) {
+			const temp = await unsignCookie(value, secrets[i], bound);
+			if (temp !== false) return temp;
+		}
+		if (!legacy) break;
 	}
 	throw InvalidCookie.signature(name);
 }
@@ -138,7 +144,7 @@ function resolvePendingCookie(entry, name) {
 	const value = entry.value;
 	if (typeof value !== "string") throw InvalidCookie.signature(name);
 	if (!hasSyncHmac) throw new Error(`resolvePendingCookie called without sync HMAC. Unreachable under correct lane gating (cookie: "${name}")`);
-	const resolvedValue = maybeJsonDecode(unsignWithSecretsSync(name, value, entry["~unsign"]));
+	const resolvedValue = maybeJsonDecode(unsignWithSecretsSync(name, value, entry["~unsign"], !entry["~strict"]));
 	entry.value = resolvedValue;
 	if (resolvedValue !== null && typeof resolvedValue === "object") {
 		const raw = rawJsonValue.get(resolvedValue);
@@ -148,4 +154,4 @@ function resolvePendingCookie(entry, name) {
 }
 
 //#endregion
-export { hasSyncHmac, hmacProvider, importSecretKey, keyCache, maybeJsonDecode, rawJsonValue, resolvePendingCookie, signCookie, signCookieBun, signCookieNode, signCookieSubtle, signCookieSync, signCookieSyncImpl, unsignCookie, unsignCookieSync, unsignWithSecrets, unsignWithSecretsSync };
+export { deriveSignKey, hasSyncHmac, hmacProvider, importSecretKey, keyCache, maybeJsonDecode, rawJsonValue, resolvePendingCookie, signCookie, signCookieBun, signCookieNode, signCookieSubtle, signCookieSync, signCookieSyncImpl, unsignCookie, unsignCookieSync, unsignWithSecrets, unsignWithSecretsSync };

package/dist/cookie/error.js

@@ -16,8 +16,7 @@ var InvalidCookie = class InvalidCookie extends require_error.ElysiaError {
 		return new InvalidCookie(key, `"${key}" has invalid cookie signature`);
 	}
 	static secret(key) {
-		if (key) return new InvalidCookie(key, `"${key}" is signed but no secret is provided`, 500);
-		return new InvalidCookie(void 0, `Cookie is signed but no secret is provided`, 500);
+		return new InvalidCookie(key, `${key ? `Cookie "${key}"` : "A cookie"} is signed but \`cookie.secrets\` is missing or empty. Set it to a non-empty string: an empty secret signs with a zero-length key, which anyone can forge.`, 500);
 	}
 };
 

package/dist/cookie/error.mjs

@@ -15,8 +15,7 @@ var InvalidCookie = class InvalidCookie extends ElysiaError {
 		return new InvalidCookie(key, `"${key}" has invalid cookie signature`);
 	}
 	static secret(key) {
-		if (key) return new InvalidCookie(key, `"${key}" is signed but no secret is provided`, 500);
-		return new InvalidCookie(void 0, `Cookie is signed but no secret is provided`, 500);
+		return new InvalidCookie(key, `${key ? `Cookie "${key}"` : "A cookie"} is signed but \`cookie.secrets\` is missing or empty. Set it to a non-empty string: an empty secret signs with a zero-length key, which anyone can forge.`, 500);
 	}
 };
 

package/dist/cookie/lib.js

@@ -40,7 +40,11 @@ function serialize(name, value = "", options) {
 	if (value) value = encodeURIComponent(value);
 	let str = `${name}=${value}`;
 	const maxAge = options.maxAge;
-	if (maxAge !== void 0) str += "; Max-Age=" + maxAge;
+	if (maxAge !== void 0) {
+		const age = Math.floor(maxAge);
+		if (!Number.isFinite(age)) throw new require_cookie_error.InvalidCookie(`Invalid cookie Max-Age ${JSON.stringify(maxAge)}.`);
+		str += "; Max-Age=" + age;
+	}
 	const domain = options.domain;
 	if (domain) {
 		if (COOKIE_ATTR_INVALID.test(domain)) throw new require_cookie_error.InvalidCookie(`Invalid cookie Domain ${JSON.stringify(domain)}.`);

package/dist/cookie/lib.mjs

@@ -39,7 +39,11 @@ function serialize(name, value = "", options) {
 	if (value) value = encodeURIComponent(value);
 	let str = `${name}=${value}`;
 	const maxAge = options.maxAge;
-	if (maxAge !== void 0) str += "; Max-Age=" + maxAge;
+	if (maxAge !== void 0) {
+		const age = Math.floor(maxAge);
+		if (!Number.isFinite(age)) throw new InvalidCookie(`Invalid cookie Max-Age ${JSON.stringify(maxAge)}.`);
+		str += "; Max-Age=" + age;
+	}
 	const domain = options.domain;
 	if (domain) {
 		if (COOKIE_ATTR_INVALID.test(domain)) throw new InvalidCookie(`Invalid cookie Domain ${JSON.stringify(domain)}.`);

package/dist/cookie/serialize.js

@@ -7,7 +7,7 @@ function serializeCookie(cookies) {
 	if (!cookies || !require_utils.isNotEmpty(cookies)) return;
 	let set;
 	let isArray = false;
-	for (const key in cookies) {
+	for (const key of Object.keys(cookies)) {
 		if (!key) continue;
 		const property = cookies[key];
 		if (!property) continue;

package/dist/cookie/serialize.mjs

@@ -6,7 +6,7 @@ function serializeCookie(cookies) {
 	if (!cookies || !isNotEmpty(cookies)) return;
 	let set;
 	let isArray = false;
-	for (const key in cookies) {
+	for (const key of Object.keys(cookies)) {
 		if (!key) continue;
 		const property = cookies[key];
 		if (!property) continue;

package/dist/cookie/types.d.ts

@@ -108,6 +108,16 @@ interface CookieOptions {
    * `null` in the array makes Elysia accept an unsigned cookie (intended only for a one-way unsigned→signed migration)
    */
   secrets?: string | null | (string | null)[];
+  /**
+   * Only use secret for signing cookie instead of secret + seperator + name
+   *
+   * Set to `false` once every signed cookie in circulation has been re-issued
+   *
+   * Applies to the app and route level
+   *
+   * @default true
+   */
+  legacySignature?: boolean;
 }
 //#endregion
 export { BaseCookie, CookieOptions };

package/dist/cookie/utils.js

@@ -69,7 +69,7 @@ async function parseCookieRaw(cookieString, config) {
 		if (v === void 0) continue;
 		let value = (0, deuri.default)(v) ?? v;
 		const signCheck = require_cookie_config.resolveSignSecrets(name, config);
-		if (signCheck !== void 0) value = await require_cookie_crypto.unsignWithSecrets(name, value, signCheck);
+		if (signCheck !== void 0) value = await require_cookie_crypto.unsignWithSecrets(name, value, signCheck, config.legacySignature);
 		out[name] = require_cookie_crypto.maybeJsonDecode(value);
 	}
 	return out;
@@ -85,7 +85,7 @@ function parseCookieRawSigned(cookieString, config) {
 		if (v === void 0) continue;
 		let value = (0, deuri.default)(v) ?? v;
 		const signCheck = require_cookie_config.resolveSignSecrets(name, config);
-		if (signCheck !== void 0) value = require_cookie_crypto.unsignWithSecretsSync(name, value, signCheck);
+		if (signCheck !== void 0) value = require_cookie_crypto.unsignWithSecretsSync(name, value, signCheck, config.legacySignature);
 		out[name] = require_cookie_crypto.maybeJsonDecode(value);
 	}
 	return out;
@@ -101,7 +101,10 @@ function buildCookieJar(set, raw, config, lazySign, deferDecode) {
 		if (entry.expires instanceof Date) entry.expires = new Date(entry.expires.getTime());
 		if (lazySign && typeof entry.value === "string") {
 			const secrets = require_cookie_config.resolveSignSecrets(name, config);
-			if (secrets !== void 0) entry["~unsign"] = secrets;
+			if (secrets !== void 0) {
+				entry["~unsign"] = secrets;
+				if (!config.legacySignature) entry["~strict"] = 1;
+			}
 		} else {
 			const value = entry.value;
 			if (value !== null && typeof value === "object") {
@@ -114,16 +117,27 @@ function buildCookieJar(set, raw, config, lazySign, deferDecode) {
 		return entry;
 	}
 	const cache = require_utils.nullObject();
+	function settle(key) {
+		if (!(key in store)) return;
+		const entry = materializeEntry(key);
+		if ("~unsign" in entry) require_cookie_crypto.resolvePendingCookie(entry, key);
+	}
 	return new Proxy(store, {
 		get(_, key) {
 			return cache[key] ??= new require_cookie_cookie.Cookie(key, set, key in store ? materializeEntry(key) : Object.assign(require_utils.nullObject(), config.defaults, config.fields[key]?.defaults));
 		},
+		has(target, key) {
+			if (typeof key === "string") settle(key);
+			return Reflect.has(target, key);
+		},
+		ownKeys(target) {
+			const keys = Reflect.ownKeys(target);
+			for (let i = 0; i < keys.length; i++) settle(keys[i]);
+			return keys;
+		},
 		getOwnPropertyDescriptor(target, key) {
-			if (typeof key === "string" && key in target) materializeEntry(key);
-			const descriptor = Reflect.getOwnPropertyDescriptor(target, key);
-			const entry = descriptor?.value;
-			if (entry && typeof entry === "object" && "~unsign" in entry) require_cookie_crypto.resolvePendingCookie(entry, String(key));
-			return descriptor;
+			if (typeof key === "string") settle(key);
+			return Reflect.getOwnPropertyDescriptor(target, key);
 		}
 	});
 }
@@ -142,11 +156,11 @@ function collectSignPending(cookies, config) {
 			if (property["~raw"] === value) continue;
 		} else if (typeof value !== "string") value = value + "";
 		const secret = Array.isArray(r.secrets) ? r.secrets[0] ?? null : r.secrets;
-		if (secret === null) throw new TypeError(`Cookie field "${key}" is signed but no \`secrets\` is provided.`);
+		if (!secret?.trim()) throw new TypeError(`Cookie field "${key}" is signed but no \`secrets\` is provided.`);
 		(pending ??= []).push([
 			property,
 			value,
-			secret
+			require_cookie_crypto.deriveSignKey(secret, key)
 		]);
 	}
 	return pending;
@@ -156,8 +170,8 @@ function signCookieValues(cookies, config) {
 	if (!pending) return;
 	if (require_cookie_crypto.hasSyncHmac) {
 		for (let i = 0; i < pending.length; i++) {
-			const [property, value, secret] = pending[i];
-			property.value = require_cookie_crypto.signCookieSyncImpl(value, secret);
+			const [property, value, key] = pending[i];
+			property.value = require_cookie_crypto.signCookieSyncImpl(value, key);
 		}
 		return;
 	}
@@ -165,8 +179,8 @@ function signCookieValues(cookies, config) {
 }
 async function signPending(pending) {
 	for (let i = 0; i < pending.length; i++) {
-		const [property, value, secret] = pending[i];
-		property.value = await require_cookie_crypto.signCookie(value, secret);
+		const [property, value, key] = pending[i];
+		property.value = await require_cookie_crypto.signCookie(value, key);
 	}
 }
 

package/dist/cookie/utils.mjs

@@ -1,7 +1,7 @@
 import { dangerousKeys } from "../constants.mjs";
 import { nullObject } from "../utils.mjs";
 import { parse } from "./lib.mjs";
-import { hasSyncHmac, maybeJsonDecode, rawJsonValue, resolvePendingCookie, signCookie, signCookieSyncImpl, unsignWithSecrets, unsignWithSecretsSync } from "./crypto.mjs";
+import { deriveSignKey, hasSyncHmac, maybeJsonDecode, rawJsonValue, resolvePendingCookie, signCookie, signCookieSyncImpl, unsignWithSecrets, unsignWithSecretsSync } from "./crypto.mjs";
 import { Cookie } from "./cookie.mjs";
 import { compileCookieConfig, isCookieSigned, resolveSignSecrets } from "./config.mjs";
 import decodeComponent from "deuri";
@@ -66,7 +66,7 @@ async function parseCookieRaw(cookieString, config) {
 		if (v === void 0) continue;
 		let value = decodeComponent(v) ?? v;
 		const signCheck = resolveSignSecrets(name, config);
-		if (signCheck !== void 0) value = await unsignWithSecrets(name, value, signCheck);
+		if (signCheck !== void 0) value = await unsignWithSecrets(name, value, signCheck, config.legacySignature);
 		out[name] = maybeJsonDecode(value);
 	}
 	return out;
@@ -82,7 +82,7 @@ function parseCookieRawSigned(cookieString, config) {
 		if (v === void 0) continue;
 		let value = decodeComponent(v) ?? v;
 		const signCheck = resolveSignSecrets(name, config);
-		if (signCheck !== void 0) value = unsignWithSecretsSync(name, value, signCheck);
+		if (signCheck !== void 0) value = unsignWithSecretsSync(name, value, signCheck, config.legacySignature);
 		out[name] = maybeJsonDecode(value);
 	}
 	return out;
@@ -98,7 +98,10 @@ function buildCookieJar(set, raw, config, lazySign, deferDecode) {
 		if (entry.expires instanceof Date) entry.expires = new Date(entry.expires.getTime());
 		if (lazySign && typeof entry.value === "string") {
 			const secrets = resolveSignSecrets(name, config);
-			if (secrets !== void 0) entry["~unsign"] = secrets;
+			if (secrets !== void 0) {
+				entry["~unsign"] = secrets;
+				if (!config.legacySignature) entry["~strict"] = 1;
+			}
 		} else {
 			const value = entry.value;
 			if (value !== null && typeof value === "object") {
@@ -111,16 +114,27 @@ function buildCookieJar(set, raw, config, lazySign, deferDecode) {
 		return entry;
 	}
 	const cache = nullObject();
+	function settle(key) {
+		if (!(key in store)) return;
+		const entry = materializeEntry(key);
+		if ("~unsign" in entry) resolvePendingCookie(entry, key);
+	}
 	return new Proxy(store, {
 		get(_, key) {
 			return cache[key] ??= new Cookie(key, set, key in store ? materializeEntry(key) : Object.assign(nullObject(), config.defaults, config.fields[key]?.defaults));
 		},
+		has(target, key) {
+			if (typeof key === "string") settle(key);
+			return Reflect.has(target, key);
+		},
+		ownKeys(target) {
+			const keys = Reflect.ownKeys(target);
+			for (let i = 0; i < keys.length; i++) settle(keys[i]);
+			return keys;
+		},
 		getOwnPropertyDescriptor(target, key) {
-			if (typeof key === "string" && key in target) materializeEntry(key);
-			const descriptor = Reflect.getOwnPropertyDescriptor(target, key);
-			const entry = descriptor?.value;
-			if (entry && typeof entry === "object" && "~unsign" in entry) resolvePendingCookie(entry, String(key));
-			return descriptor;
+			if (typeof key === "string") settle(key);
+			return Reflect.getOwnPropertyDescriptor(target, key);
 		}
 	});
 }
@@ -139,11 +153,11 @@ function collectSignPending(cookies, config) {
 			if (property["~raw"] === value) continue;
 		} else if (typeof value !== "string") value = value + "";
 		const secret = Array.isArray(r.secrets) ? r.secrets[0] ?? null : r.secrets;
-		if (secret === null) throw new TypeError(`Cookie field "${key}" is signed but no \`secrets\` is provided.`);
+		if (!secret?.trim()) throw new TypeError(`Cookie field "${key}" is signed but no \`secrets\` is provided.`);
 		(pending ??= []).push([
 			property,
 			value,
-			secret
+			deriveSignKey(secret, key)
 		]);
 	}
 	return pending;
@@ -153,8 +167,8 @@ function signCookieValues(cookies, config) {
 	if (!pending) return;
 	if (hasSyncHmac) {
 		for (let i = 0; i < pending.length; i++) {
-			const [property, value, secret] = pending[i];
-			property.value = signCookieSyncImpl(value, secret);
+			const [property, value, key] = pending[i];
+			property.value = signCookieSyncImpl(value, key);
 		}
 		return;
 	}
@@ -162,8 +176,8 @@ function signCookieValues(cookies, config) {
 }
 async function signPending(pending) {
 	for (let i = 0; i < pending.length; i++) {
-		const [property, value, secret] = pending[i];
-		property.value = await signCookie(value, secret);
+		const [property, value, key] = pending[i];
+		property.value = await signCookie(value, key);
 	}
 }
 

package/dist/handler/error.d.ts

@@ -2,17 +2,7 @@ import { AppHook } from "../types.js";
 import { Context } from "../context.js";
 
 //#region src/handler/error.d.ts
-/**
- * Adopt the intercepted error's `type` into a problem the hook produced
- * without one.
- *
- * `'about:blank'` is RFC 9457's "unspecified" default, so it's the only value
- * worth replacing — an explicit type the handler set always wins.
- *
- * The result is copied rather than mutated: `.error(Class, value)` wraps a
- * non-function into `() => value`, so the very same `ElysiaStatus` is replayed
- * on every request and an in-place write would leak across requests
- */
+declare const claimsProblemType: (error: any) => boolean;
 declare function adoptErrorType(result: any, error: any): any;
 /**
  * Response served once every error hook has declined the error.
@@ -21,6 +11,27 @@ declare function adoptErrorType(result: any, error: any): any;
  * which must land on *this* function rather than re-implementing it
  */
 declare function fallbackResponse(context: Context, error: any, mapResponse: (response: unknown, set: Context['set'], context?: Context) => unknown, defaultError?: Response): unknown;
+/**
+ * Numeric form of an annotated status, which may be written as a name.
+ * A numeric string keeps coercing so the production mask below can't be
+ * slipped past with `'502'`
+ */
+declare const resolveStatus: (status: unknown) => unknown;
+/**
+ * Body served by an error that carries a status but no usable body:
+ * its declared `response`, otherwise its message
+ */
+declare function statusFallbackBody(error: any, status: unknown): any;
+/**
+ * Read one annotation knob.
+ *
+ * Both knobs are canonically methods, so they're evaluated per serve and may
+ * be `async`. Running a stranger's function is side-effect surface (it may
+ * consume a stream or do IO), so it takes the same problem claim the shaping
+ * does — an unclaimed duck error never invokes one. A *value* annotation stays
+ * inert data and keeps duck-participating as it always has
+ */
+declare const readAnnotation: (self: any, key: "value" | "detail", claimsProblem: boolean) => any;
 declare function createErrorHandler(onErrors: AppHook['error'] | undefined, mapResponse: (response: unknown, set: Context['set'], ...any: unknown[]) => unknown, defaultError?: Response, allowUnsafe?: boolean): (context: Context, error: Error) => unknown;
 //#endregion
-export { adoptErrorType, createErrorHandler, fallbackResponse };
+export { adoptErrorType, claimsProblemType, createErrorHandler, fallbackResponse, readAnnotation, resolveStatus, statusFallbackBody };