iron-session 6.1.1 → 7.0.0

package/README.md

@@ -2,8 +2,6 @@
 
 <p align="center"><b>⭐️ Featured in the <a href="https://nextjs.org/docs/authentication">Next.js documentation</a></b></p>
 
-**⚠️ Nov 2021 update**: The library was renamed to `iron-session` and fully rewritten in TypeScript, it includes lots of new features and fixes. Follow the migration guide here: https://github.com/vvo/iron-session/releases/tag/v6.0.0.
-
 _🛠 Node.js stateless session utility using signed and encrypted cookies to store data. Works with Next.js, Express, NestJs, Fastify, and any Node.js HTTP framework._
 
 The session data is stored in encrypted cookies ("seals"). And only your server can decode the session data. There are no session ids, making iron sessions "stateless" from the server point of view.
@@ -12,7 +10,7 @@ This strategy of storing session data is the same technique used by **frameworks
 
 The underlying cryptography library is [iron](https://hapi.dev/module/iron) which was [created by the lead developer of OAuth 2.0](https://hueniversedotcom.wordpress.com/2015/09/19/auth-to-see-the-wizard-or-i-wrote-an-oauth-replacement/).
 
-<p align="center"><b>Online demo at <a href="https://iron-session-example.vercel.app/">https://iron-session-example.vercel.app</a> 👀</b></p>
+<p align="center"><b>Online demo: <a href="https://iron-session-example.vercel.app/">https://iron-session-example.vercel.app</a> 👀</b></p>
 
 ---
 
@@ -32,8 +30,8 @@ _Table of contents:_
   - [Firebase usage](#firebase-usage)
 - [API](#api)
   - [ironOptions](#ironoptions)
-  - [Next.js: withIronSessionApiRoute(handler, ironOptions)](#nextjs-withironsessionapiroutehandler-ironoptions--req-nextapirequest-res-nextapiresponse--ironoptions--promiseironoptions)
-  - [Next.js: withIronSessionSsr(handler, ironOptions)](#nextjs-withironsessionapiroutehandler-ironoptions--req-nextapirequest-res-nextapiresponse--ironoptions--promiseironoptions)
+  - [Next.js: withIronSessionApiRoute(handler, ironOptions | (req: NextApiRequest, res: NextApiResponse) => IronOptions | Promise\<IronOptions\>)](#nextjs-withironsessionapiroutehandler-ironoptions--req-nextapirequest-res-nextapiresponse--ironoptions--promiseironoptions)
+  - [Next.js: withIronSessionSsr(handler, ironOptions | (req: IncomingMessage, res: ServerResponse) => IronOptions | Promise\<IronOptions\>)](#nextjs-withironsessionssrhandler-ironoptions--req-incomingmessage-res-serverresponse--ironoptions--promiseironoptions)
   - [Express: ironSession(ironOptions)](#express-ironsessionironoptions)
   - [session.save()](#sessionsave)
   - [session.destroy()](#sessiondestroy)
@@ -302,7 +300,7 @@ async function loginRoute(req, res) {
 
 import { withSessionSsr } from "lib/withSession";
 
-export const getServerSideProps = withIronSessionSsr(
+export const getServerSideProps = withSessionSsr(
   async function getServerSideProps({ req }) {
     const user = req.session.user;
 
@@ -568,7 +566,7 @@ Only two options are required: `password` and `cookieName`. Everything else is a
 
 - `password`, **required**: Private key used to encrypt the cookie. It has to be at least 32 characters long. Use https://1password.com/password-generator/ to generate strong passwords. `password` can be either a `string` or an `array` of objects like this: `[{id: 2, password: "..."}, {id: 1, password: "..."}]` to allow for password rotation.
 - `cookieName`, **required**: Name of the cookie to be stored
-- `ttl`, _optional_: In seconds, default to 14 days
+- `ttl`, _optional_: In seconds. Default to the equivalent of 14 days. You can set this to `0` and iron-session will compute the maximum allowed value by cookies (~70 years).
 - [`cookieOptions`](https://github.com/jshttp/cookie#cookieserializename-value-options), _optional_: Any option available from [jshttp/cookie#serialize](https://github.com/jshttp/cookie#cookieserializename-value-options). Default to:
 
 ```js

package/dist/index.d.ts

@@ -51,7 +51,9 @@ declare module "http" {
         session: IronSession;
     }
 }
-declare function getIronSession(req: IncomingMessage, res: ServerResponse, userSessionOptions: IronSessionOptions): Promise<IronSession>;
+declare type RequestType = IncomingMessage | Request;
+declare type ResponseType = ServerResponse | Response;
+declare function getIronSession(req: RequestType, res: ResponseType, userSessionOptions: IronSessionOptions): Promise<IronSession>;
 declare function unsealData<T = Record<string, unknown>>(seal: string, { password, ttl, }: {
     password: password;
     ttl?: number;

package/dist/index.js

@@ -4,32 +4,31 @@ var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
 var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __markAsModule = (target) => __defProp(target, "__esModule", { value: true });
 var __export = (target, all) => {
-  __markAsModule(target);
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
-var __reExport = (target, module2, desc) => {
-  if (module2 && typeof module2 === "object" || typeof module2 === "function") {
-    for (let key of __getOwnPropNames(module2))
-      if (!__hasOwnProp.call(target, key) && key !== "default")
-        __defProp(target, key, { get: () => module2[key], enumerable: !(desc = __getOwnPropDesc(module2, key)) || desc.enumerable });
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
   }
-  return target;
-};
-var __toModule = (module2) => {
-  return __reExport(__markAsModule(__defProp(module2 != null ? __create(__getProtoOf(module2)) : {}, "default", module2 && module2.__esModule && "default" in module2 ? { get: () => module2.default, enumerable: true } : { value: module2, enumerable: true })), module2);
+  return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target, mod));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
-__export(exports, {
+var src_exports = {};
+__export(src_exports, {
   getIronSession: () => getIronSession,
   sealData: () => sealData,
   unsealData: () => unsealData
 });
-var import_iron = __toModule(require("@hapi/iron"));
-var import_cookie = __toModule(require("cookie"));
+module.exports = __toCommonJS(src_exports);
+var Iron = __toESM(require("iron-webcrypto"));
+var import_cookie = __toESM(require("cookie"));
 var timestampSkewSec = 60;
 var fourteenDaysInSeconds = 15 * 24 * 3600;
 var currentMajorVersion = 2;
@@ -73,7 +72,7 @@ async function getIronSession(req, res, userSessionOptions) {
   } else {
     options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);
   }
-  const sealFromCookies = import_cookie.default.parse(req.headers.cookie || "")[options.cookieName];
+  const sealFromCookies = import_cookie.default.parse("credentials" in req ? req.headers.get("cookie") || "" : req.headers.cookie || "")[options.cookieName];
   const session = sealFromCookies === void 0 ? {} : await unsealData(sealFromCookies, {
     password: passwordsAsMap,
     ttl: options.ttl
@@ -81,14 +80,14 @@ async function getIronSession(req, res, userSessionOptions) {
   Object.defineProperties(session, {
     save: {
       value: async function save() {
-        if (res.headersSent === true) {
+        if ("headersSent" in res && res.headersSent === true) {
           throw new Error(`iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`);
         }
-        const seal = await sealData(session, {
+        const seal2 = await sealData(session, {
           password: passwordsAsMap,
           ttl: options.ttl
         });
-        const cookieValue = import_cookie.default.serialize(options.cookieName, seal, options.cookieOptions);
+        const cookieValue = import_cookie.default.serialize(options.cookieName, seal2, options.cookieOptions);
         if (cookieValue.length > 4096) {
           throw new Error(`iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`);
         }
@@ -112,6 +111,10 @@ async function getIronSession(req, res, userSessionOptions) {
 }
 function addToCookies(cookieValue, res) {
   var _a;
+  if ("headers" in res) {
+    res.headers.append("set-cookie", cookieValue);
+    return;
+  }
   let existingSetCookie = (_a = res.getHeader("set-cookie")) != null ? _a : [];
   if (typeof existingSetCookie === "string") {
     existingSetCookie = [existingSetCookie];
@@ -121,15 +124,15 @@ function addToCookies(cookieValue, res) {
 function computeCookieMaxAge(ttl) {
   return ttl - timestampSkewSec;
 }
-async function unsealData(seal, {
+async function unsealData(seal2, {
   password,
   ttl = fourteenDaysInSeconds
 }) {
   const passwordsAsMap = normalizeStringPasswordToMap(password);
-  const { sealWithoutVersion, tokenVersion } = parseSeal(seal);
+  const { sealWithoutVersion, tokenVersion } = parseSeal(seal2);
   try {
-    const data = await import_iron.default.unseal(sealWithoutVersion, passwordsAsMap, {
-      ...import_iron.default.defaults,
+    const data = await Iron.unseal(sealWithoutVersion, passwordsAsMap, {
+      ...Iron.defaults,
       ttl: ttl * 1e3
     });
     if (tokenVersion === 2) {
@@ -147,15 +150,15 @@ async function unsealData(seal, {
     throw error;
   }
 }
-function parseSeal(seal) {
-  if (seal[seal.length - 2] === versionDelimiter) {
-    const [sealWithoutVersion, tokenVersionAsString] = seal.split(versionDelimiter);
+function parseSeal(seal2) {
+  if (seal2[seal2.length - 2] === versionDelimiter) {
+    const [sealWithoutVersion, tokenVersionAsString] = seal2.split(versionDelimiter);
     return {
       sealWithoutVersion,
       tokenVersion: parseInt(tokenVersionAsString, 10)
     };
   }
-  return { sealWithoutVersion: seal, tokenVersion: null };
+  return { sealWithoutVersion: seal2, tokenVersion: null };
 }
 async function sealData(data, {
   password,
@@ -167,11 +170,11 @@ async function sealData(data, {
     id: mostRecentPasswordId.toString(),
     secret: passwordsAsMap[mostRecentPasswordId]
   };
-  const seal = await import_iron.default.seal(data, passwordForSeal, {
-    ...import_iron.default.defaults,
+  const seal2 = await Iron.seal(data, passwordForSeal, {
+    ...Iron.defaults,
     ttl: ttl * 1e3
   });
-  return `${seal}${versionDelimiter}${currentMajorVersion}`;
+  return `${seal2}${versionDelimiter}${currentMajorVersion}`;
 }
 function normalizeStringPasswordToMap(password) {
   return typeof password === "string" ? { 1: password } : password;
@@ -182,4 +185,4 @@ function normalizeStringPasswordToMap(password) {
   sealData,
   unsealData
 });
-//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1,7 +1 @@
-{
-  "version": 3,
-  "sources": ["../src/index.ts"],
-  "sourcesContent": ["import Iron from \"@hapi/iron\";\nimport type { CookieSerializeOptions } from \"cookie\";\nimport cookie from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype passwordsMap = { [id: string]: string };\ntype password = string | passwordsMap;\n\nconst fourteenDaysInSeconds = 15 * 24 * 3600;\n\n// We store a token major version to handle data format changes when any. So that when you upgrade the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: fourteenDaysInSeconds,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  /**\n   * This is the cookie name that will be used inside the browser. You should make sure it's unique given\n   * your application. Example: vercel-session\n   */\n  cookieName: string;\n\n  /**\n   * This is the password(s) that will be used to encrypt the cookie. It can be either a string or an object\n   * like {1: \"password\", 2: password}.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt the cookie and only the most\n   * recent (= highest key, 2 in this example) password will be used to encrypt the cookie. This allow you\n   * to use password rotation (security)\n   */\n  password: password;\n\n  /**\n   * This is the time in seconds that the session will be valid for. This also set the max-age attribute of\n   * the cookie automatically (minus 60 seconds so that the cookie always expire before the session).\n   */\n  ttl?: number;\n\n  /**\n   * This is the options that will be passed to the cookie library.\n   * You can see all of them here: https://github.com/jshttp/cookie#options-1.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser is closed) then you need\n   * to pass cookieOptions: { maxAge: undefined }.\n   */\n  cookieOptions?: CookieSerializeOptions;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-interface\nexport interface IronSessionData {\n  // If we allow for any keys, then there's no more type check on unknown properties\n  // which is not good\n  // If we allow for any keys, the later delete will work but I prefer to disable the\n  // check at this stage and\n  // provide good type checking instead\n  // [key: string]: unknown;\n}\n\nexport type IronSession = IronSessionData & {\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  destroy: () => void;\n\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  save: () => Promise<void>;\n};\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    session: IronSession;\n  }\n}\n\nexport async function getIronSession(\n  req: IncomingMessage,\n  res: ServerResponse,\n  userSessionOptions: IronSessionOptions,\n): Promise<IronSession> {\n  if (\n    !req ||\n    !res ||\n    !userSessionOptions ||\n    !userSessionOptions.cookieName ||\n    !userSessionOptions.password\n  ) {\n    throw new Error(\n      `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n    );\n  }\n\n  const passwordsAsMap = normalizeStringPasswordToMap(\n    userSessionOptions.password,\n  );\n\n  Object.values(\n    normalizeStringPasswordToMap(userSessionOptions.password),\n  ).forEach((password) => {\n    if (password.length < 32) {\n      throw new Error(\n        `iron-session: Bad usage. Password must be at least 32 characters long.`,\n      );\n    }\n  });\n\n  const options: Required<IronSessionOptions> = {\n    ...defaultOptions,\n    ...userSessionOptions,\n    cookieOptions: {\n      ...defaultOptions.cookieOptions,\n      ...(userSessionOptions.cookieOptions || {}),\n    },\n  };\n\n  if (options.ttl === 0) {\n    // ttl = 0 means no expiration\n    // but in reality cookies have to expire (can't have no max-age)\n    // 2147483647 is the max value for max-age in cookies\n    // see https://stackoverflow.com/a/11685301/147079\n    options.ttl = 2147483647;\n  }\n\n  if (\n    userSessionOptions.cookieOptions &&\n    \"maxAge\" in userSessionOptions.cookieOptions\n  ) {\n    // session cookie, do not set maxAge, consider token as infinite\n    if (userSessionOptions.cookieOptions.maxAge === undefined) {\n      options.ttl = 0;\n    } else {\n      options.cookieOptions.maxAge = computeCookieMaxAge(\n        userSessionOptions.cookieOptions.maxAge,\n      );\n    }\n  } else {\n    options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n  }\n\n  const sealFromCookies = cookie.parse(req.headers.cookie || \"\")[\n    options.cookieName\n  ];\n\n  const session =\n    sealFromCookies === undefined\n      ? {}\n      : await unsealData<IronSessionData>(sealFromCookies, {\n          password: passwordsAsMap,\n          ttl: options.ttl,\n        });\n\n  Object.defineProperties(session, {\n    save: {\n      value: async function save() {\n        if (res.headersSent === true) {\n          throw new Error(\n            `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`,\n          );\n        }\n        const seal = await sealData(session, {\n          password: passwordsAsMap,\n          ttl: options.ttl,\n        });\n        const cookieValue = cookie.serialize(\n          options.cookieName,\n          seal,\n          options.cookieOptions,\n        );\n\n        if (cookieValue.length > 4096) {\n          throw new Error(\n            `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n          );\n        }\n\n        addToCookies(cookieValue, res);\n      },\n    },\n    destroy: {\n      value: function destroy() {\n        Object.keys(session).forEach((key) => {\n          // @ts-ignore See comment on the IronSessionData interface\n          delete session[key];\n        });\n\n        const cookieValue = cookie.serialize(options.cookieName, \"\", {\n          ...options.cookieOptions,\n          maxAge: 0,\n        });\n        addToCookies(cookieValue, res);\n      },\n    },\n  });\n\n  return session as IronSession;\n}\n\nfunction addToCookies(cookieValue: string, res: ServerResponse) {\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nexport async function unsealData<T = Record<string, unknown>>(\n  seal: string,\n  {\n    password,\n    ttl = fourteenDaysInSeconds,\n  }: { password: password; ttl?: number },\n): Promise<T> {\n  const passwordsAsMap = normalizeStringPasswordToMap(password);\n  const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n  try {\n    const data = await Iron.unseal(sealWithoutVersion, passwordsAsMap, {\n      ...Iron.defaults,\n      ttl: ttl * 1000,\n    });\n\n    if (tokenVersion === 2) {\n      return data;\n    }\n\n    return {\n      ...data.persistent,\n    };\n  } catch (error) {\n    if (error instanceof Error) {\n      if (\n        error.message === \"Expired seal\" ||\n        error.message === \"Bad hmac value\" ||\n        error.message === \"Cannot find password: \" ||\n        error.message === \"Incorrect number of sealed components\"\n      ) {\n        // if seal expired or\n        // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n        // if we can't find back the password in the seal\n        // then we just start a new session over\n        return {} as T;\n      }\n    }\n\n    throw error;\n  }\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  if (seal[seal.length - 2] === versionDelimiter) {\n    const [sealWithoutVersion, tokenVersionAsString] =\n      seal.split(versionDelimiter);\n    return {\n      sealWithoutVersion,\n      tokenVersion: parseInt(tokenVersionAsString, 10),\n    };\n  }\n\n  return { sealWithoutVersion: seal, tokenVersion: null };\n}\n\nexport async function sealData(\n  data: unknown,\n  {\n    password,\n    ttl = fourteenDaysInSeconds,\n  }: { password: password; ttl?: number },\n) {\n  const passwordsAsMap = normalizeStringPasswordToMap(password);\n\n  const mostRecentPasswordId = Math.max(\n    ...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)),\n  );\n\n  const passwordForSeal = {\n    id: mostRecentPasswordId.toString(),\n    secret: passwordsAsMap[mostRecentPasswordId],\n  };\n\n  const seal = await Iron.seal(data, passwordForSeal, {\n    ...Iron.defaults,\n    ttl: ttl * 1000,\n  });\n\n  return `${seal}${versionDelimiter}${currentMajorVersion}`;\n}\n\nfunction normalizeStringPasswordToMap(password: password) {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAAiB;AAEjB,oBAAmB;AAKnB,IAAM,mBAAmB;AAKzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBAGF;AAAA,EACF,KAAK;AAAA,EACL,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA;AAAA;AAiEV,8BACE,KACA,KACA,oBACsB;AACtB,MACE,CAAC,OACD,CAAC,OACD,CAAC,sBACD,CAAC,mBAAmB,cACpB,CAAC,mBAAmB,UACpB;AACA,UAAM,IAAI,MACR;AAAA;AAIJ,QAAM,iBAAiB,6BACrB,mBAAmB;AAGrB,SAAO,OACL,6BAA6B,mBAAmB,WAChD,QAAQ,CAAC,aAAa;AACtB,QAAI,SAAS,SAAS,IAAI;AACxB,YAAM,IAAI,MACR;AAAA;AAAA;AAKN,QAAM,UAAwC;AAAA,OACzC;AAAA,OACA;AAAA,IACH,eAAe;AAAA,SACV,eAAe;AAAA,SACd,mBAAmB,iBAAiB;AAAA;AAAA;AAI5C,MAAI,QAAQ,QAAQ,GAAG;AAKrB,YAAQ,MAAM;AAAA;AAGhB,MACE,mBAAmB,iBACnB,YAAY,mBAAmB,eAC/B;AAEA,QAAI,mBAAmB,cAAc,WAAW,QAAW;AACzD,cAAQ,MAAM;AAAA,WACT;AACL,cAAQ,cAAc,SAAS,oBAC7B,mBAAmB,cAAc;AAAA;AAAA,SAGhC;AACL,YAAQ,cAAc,SAAS,oBAAoB,QAAQ;AAAA;AAG7D,QAAM,kBAAkB,sBAAO,MAAM,IAAI,QAAQ,UAAU,IACzD,QAAQ;AAGV,QAAM,UACJ,oBAAoB,SAChB,KACA,MAAM,WAA4B,iBAAiB;AAAA,IACjD,UAAU;AAAA,IACV,KAAK,QAAQ;AAAA;AAGrB,SAAO,iBAAiB,SAAS;AAAA,IAC/B,MAAM;AAAA,MACJ,OAAO,sBAAsB;AAC3B,YAAI,IAAI,gBAAgB,MAAM;AAC5B,gBAAM,IAAI,MACR;AAAA;AAGJ,cAAM,OAAO,MAAM,SAAS,SAAS;AAAA,UACnC,UAAU;AAAA,UACV,KAAK,QAAQ;AAAA;AAEf,cAAM,cAAc,sBAAO,UACzB,QAAQ,YACR,MACA,QAAQ;AAGV,YAAI,YAAY,SAAS,MAAM;AAC7B,gBAAM,IAAI,MACR,0CAA0C,YAAY;AAAA;AAI1D,qBAAa,aAAa;AAAA;AAAA;AAAA,IAG9B,SAAS;AAAA,MACP,OAAO,mBAAmB;AACxB,eAAO,KAAK,SAAS,QAAQ,CAAC,QAAQ;AAEpC,iBAAO,QAAQ;AAAA;AAGjB,cAAM,cAAc,sBAAO,UAAU,QAAQ,YAAY,IAAI;AAAA,aACxD,QAAQ;AAAA,UACX,QAAQ;AAAA;AAEV,qBAAa,aAAa;AAAA;AAAA;AAAA;AAKhC,SAAO;AAAA;AAGT,sBAAsB,aAAqB,KAAqB;AAvNhE;AAwNE,MAAI,oBACD,UAAI,UAAU,kBAAd,YAAqD;AACxD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC;AAAA;AAEvB,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB;AAAA;AAGrD,6BAA6B,KAAa;AAIxC,SAAO,MAAM;AAAA;AAGf,0BACE,MACA;AAAA,EACE;AAAA,EACA,MAAM;AAAA,GAEI;AACZ,QAAM,iBAAiB,6BAA6B;AACpD,QAAM,EAAE,oBAAoB,iBAAiB,UAAU;AAEvD,MAAI;AACF,UAAM,OAAO,MAAM,oBAAK,OAAO,oBAAoB,gBAAgB;AAAA,SAC9D,oBAAK;AAAA,MACR,KAAK,MAAM;AAAA;AAGb,QAAI,iBAAiB,GAAG;AACtB,aAAO;AAAA;AAGT,WAAO;AAAA,SACF,KAAK;AAAA;AAAA,WAEH,OAAP;AACA,QAAI,iBAAiB,OAAO;AAC1B,UACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,YAAY,4BAClB,MAAM,YAAY,yCAClB;AAKA,eAAO;AAAA;AAAA;AAIX,UAAM;AAAA;AAAA;AAIV,mBAAmB,MAGjB;AACA,MAAI,KAAK,KAAK,SAAS,OAAO,kBAAkB;AAC9C,UAAM,CAAC,oBAAoB,wBACzB,KAAK,MAAM;AACb,WAAO;AAAA,MACL;AAAA,MACA,cAAc,SAAS,sBAAsB;AAAA;AAAA;AAIjD,SAAO,EAAE,oBAAoB,MAAM,cAAc;AAAA;AAGnD,wBACE,MACA;AAAA,EACE;AAAA,EACA,MAAM;AAAA,GAER;AACA,QAAM,iBAAiB,6BAA6B;AAEpD,QAAM,uBAAuB,KAAK,IAChC,GAAG,OAAO,KAAK,gBAAgB,IAAI,CAAC,OAAO,SAAS,IAAI;AAG1D,QAAM,kBAAkB;AAAA,IACtB,IAAI,qBAAqB;AAAA,IACzB,QAAQ,eAAe;AAAA;AAGzB,QAAM,OAAO,MAAM,oBAAK,KAAK,MAAM,iBAAiB;AAAA,OAC/C,oBAAK;AAAA,IACR,KAAK,MAAM;AAAA;AAGb,SAAO,GAAG,OAAO,mBAAmB;AAAA;AAGtC,sCAAsC,UAAoB;AACxD,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,aAAa;AAAA;",
-  "names": []
-}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import * as Iron from \"iron-webcrypto\";\nimport type { CookieSerializeOptions } from \"cookie\";\nimport cookie from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype passwordsMap = { [id: string]: string };\ntype password = string | passwordsMap;\n\nconst fourteenDaysInSeconds = 15 * 24 * 3600;\n\n// We store a token major version to handle data format changes when any. So that when you upgrade the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: fourteenDaysInSeconds,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  /**\n   * This is the cookie name that will be used inside the browser. You should make sure it's unique given\n   * your application. Example: vercel-session\n   */\n  cookieName: string;\n\n  /**\n   * This is the password(s) that will be used to encrypt the cookie. It can be either a string or an object\n   * like {1: \"password\", 2: password}.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt the cookie and only the most\n   * recent (= highest key, 2 in this example) password will be used to encrypt the cookie. This allow you\n   * to use password rotation (security)\n   */\n  password: password;\n\n  /**\n   * This is the time in seconds that the session will be valid for. This also set the max-age attribute of\n   * the cookie automatically (minus 60 seconds so that the cookie always expire before the session).\n   */\n  ttl?: number;\n\n  /**\n   * This is the options that will be passed to the cookie library.\n   * You can see all of them here: https://github.com/jshttp/cookie#options-1.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser is closed) then you need\n   * to pass cookieOptions: { maxAge: undefined }.\n   */\n  cookieOptions?: CookieSerializeOptions;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-interface\nexport interface IronSessionData {\n  // If we allow for any keys, then there's no more type check on unknown properties\n  // which is not good\n  // If we allow for any keys, the later delete will work but I prefer to disable the\n  // check at this stage and\n  // provide good type checking instead\n  // [key: string]: unknown;\n}\n\nexport type IronSession = IronSessionData & {\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  destroy: () => void;\n\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  save: () => Promise<void>;\n};\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    session: IronSession;\n  }\n}\n\ntype RequestType = IncomingMessage | Request;\ntype ResponseType = ServerResponse | Response;\n\nexport async function getIronSession(\n  req: RequestType,\n  res: ResponseType,\n  userSessionOptions: IronSessionOptions,\n): Promise<IronSession> {\n  if (\n    !req ||\n    !res ||\n    !userSessionOptions ||\n    !userSessionOptions.cookieName ||\n    !userSessionOptions.password\n  ) {\n    throw new Error(\n      `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n    );\n  }\n\n  const passwordsAsMap = normalizeStringPasswordToMap(\n    userSessionOptions.password,\n  );\n\n  Object.values(\n    normalizeStringPasswordToMap(userSessionOptions.password),\n  ).forEach((password) => {\n    if (password.length < 32) {\n      throw new Error(\n        `iron-session: Bad usage. Password must be at least 32 characters long.`,\n      );\n    }\n  });\n\n  const options: Required<IronSessionOptions> = {\n    ...defaultOptions,\n    ...userSessionOptions,\n    cookieOptions: {\n      ...defaultOptions.cookieOptions,\n      ...(userSessionOptions.cookieOptions || {}),\n    },\n  };\n\n  if (options.ttl === 0) {\n    // ttl = 0 means no expiration\n    // but in reality cookies have to expire (can't have no max-age)\n    // 2147483647 is the max value for max-age in cookies\n    // see https://stackoverflow.com/a/11685301/147079\n    options.ttl = 2147483647;\n  }\n\n  if (\n    userSessionOptions.cookieOptions &&\n    \"maxAge\" in userSessionOptions.cookieOptions\n  ) {\n    // session cookie, do not set maxAge, consider token as infinite\n    if (userSessionOptions.cookieOptions.maxAge === undefined) {\n      options.ttl = 0;\n    } else {\n      options.cookieOptions.maxAge = computeCookieMaxAge(\n        userSessionOptions.cookieOptions.maxAge,\n      );\n    }\n  } else {\n    options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n  }\n\n  const sealFromCookies = cookie.parse(\n    \"credentials\" in req\n      ? req.headers.get(\"cookie\") || \"\"\n      : req.headers.cookie || \"\",\n  )[options.cookieName];\n\n  const session =\n    sealFromCookies === undefined\n      ? {}\n      : await unsealData<IronSessionData>(sealFromCookies, {\n          password: passwordsAsMap,\n          ttl: options.ttl,\n        });\n\n  Object.defineProperties(session, {\n    save: {\n      value: async function save() {\n        if (\"headersSent\" in res && res.headersSent === true) {\n          throw new Error(\n            `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`,\n          );\n        }\n        const seal = await sealData(session, {\n          password: passwordsAsMap,\n          ttl: options.ttl,\n        });\n        const cookieValue = cookie.serialize(\n          options.cookieName,\n          seal,\n          options.cookieOptions,\n        );\n\n        if (cookieValue.length > 4096) {\n          throw new Error(\n            `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n          );\n        }\n\n        addToCookies(cookieValue, res);\n      },\n    },\n    destroy: {\n      value: function destroy() {\n        Object.keys(session).forEach((key) => {\n          // @ts-ignore See comment on the IronSessionData interface\n          delete session[key];\n        });\n\n        const cookieValue = cookie.serialize(options.cookieName, \"\", {\n          ...options.cookieOptions,\n          maxAge: 0,\n        });\n        addToCookies(cookieValue, res);\n      },\n    },\n  });\n\n  return session as IronSession;\n}\n\nfunction addToCookies(cookieValue: string, res: ResponseType) {\n  if (\"headers\" in res) {\n    res.headers.append(\"set-cookie\", cookieValue);\n    return;\n  }\n\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nexport async function unsealData<T = Record<string, unknown>>(\n  seal: string,\n  {\n    password,\n    ttl = fourteenDaysInSeconds,\n  }: { password: password; ttl?: number },\n): Promise<T> {\n  const passwordsAsMap = normalizeStringPasswordToMap(password);\n  const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n  try {\n    const data = await Iron.unseal(sealWithoutVersion, passwordsAsMap, {\n      ...Iron.defaults,\n      ttl: ttl * 1000,\n    });\n\n    if (tokenVersion === 2) {\n      return data as T;\n    }\n\n    return {\n      // @ts-expect-error `persistent` does not exist on newer tokens\n      ...data.persistent,\n    };\n  } catch (error) {\n    if (error instanceof Error) {\n      if (\n        error.message === \"Expired seal\" ||\n        error.message === \"Bad hmac value\" ||\n        error.message === \"Cannot find password: \" ||\n        error.message === \"Incorrect number of sealed components\"\n      ) {\n        // if seal expired or\n        // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n        // if we can't find back the password in the seal\n        // then we just start a new session over\n        return {} as T;\n      }\n    }\n\n    throw error;\n  }\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  if (seal[seal.length - 2] === versionDelimiter) {\n    const [sealWithoutVersion, tokenVersionAsString] =\n      seal.split(versionDelimiter);\n    return {\n      sealWithoutVersion,\n      tokenVersion: parseInt(tokenVersionAsString, 10),\n    };\n  }\n\n  return { sealWithoutVersion: seal, tokenVersion: null };\n}\n\nexport async function sealData(\n  data: unknown,\n  {\n    password,\n    ttl = fourteenDaysInSeconds,\n  }: { password: password; ttl?: number },\n) {\n  const passwordsAsMap = normalizeStringPasswordToMap(password);\n\n  const mostRecentPasswordId = Math.max(\n    ...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)),\n  );\n\n  const passwordForSeal = {\n    id: mostRecentPasswordId.toString(),\n    secret: passwordsAsMap[mostRecentPasswordId],\n  };\n\n  const seal = await Iron.seal(data, passwordForSeal, {\n    ...Iron.defaults,\n    ttl: ttl * 1000,\n  });\n\n  return `${seal}${versionDelimiter}${currentMajorVersion}`;\n}\n\nfunction normalizeStringPasswordToMap(password: password) {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAAsB;AAEtB,oBAAmB;AAKnB,IAAM,mBAAmB;AAKzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBAGF;AAAA,EACF,KAAK;AAAA,EACL,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AACF;AAkEA,8BACE,KACA,KACA,oBACsB;AACtB,MACE,CAAC,OACD,CAAC,OACD,CAAC,sBACD,CAAC,mBAAmB,cACpB,CAAC,mBAAmB,UACpB;AACA,UAAM,IAAI,MACR,0LACF;AAAA,EACF;AAEA,QAAM,iBAAiB,6BACrB,mBAAmB,QACrB;AAEA,SAAO,OACL,6BAA6B,mBAAmB,QAAQ,CAC1D,EAAE,QAAQ,CAAC,aAAa;AACtB,QAAI,SAAS,SAAS,IAAI;AACxB,YAAM,IAAI,MACR,wEACF;AAAA,IACF;AAAA,EACF,CAAC;AAED,QAAM,UAAwC;AAAA,OACzC;AAAA,OACA;AAAA,IACH,eAAe;AAAA,SACV,eAAe;AAAA,SACd,mBAAmB,iBAAiB,CAAC;AAAA,IAC3C;AAAA,EACF;AAEA,MAAI,QAAQ,QAAQ,GAAG;AAKrB,YAAQ,MAAM;AAAA,EAChB;AAEA,MACE,mBAAmB,iBACnB,YAAY,mBAAmB,eAC/B;AAEA,QAAI,mBAAmB,cAAc,WAAW,QAAW;AACzD,cAAQ,MAAM;AAAA,IAChB,OAAO;AACL,cAAQ,cAAc,SAAS,oBAC7B,mBAAmB,cAAc,MACnC;AAAA,IACF;AAAA,EACF,OAAO;AACL,YAAQ,cAAc,SAAS,oBAAoB,QAAQ,GAAG;AAAA,EAChE;AAEA,QAAM,kBAAkB,sBAAO,MAC7B,iBAAiB,MACb,IAAI,QAAQ,IAAI,QAAQ,KAAK,KAC7B,IAAI,QAAQ,UAAU,EAC5B,EAAE,QAAQ;AAEV,QAAM,UACJ,oBAAoB,SAChB,CAAC,IACD,MAAM,WAA4B,iBAAiB;AAAA,IACjD,UAAU;AAAA,IACV,KAAK,QAAQ;AAAA,EACf,CAAC;AAEP,SAAO,iBAAiB,SAAS;AAAA,IAC/B,MAAM;AAAA,MACJ,OAAO,sBAAsB;AAC3B,YAAI,iBAAiB,OAAO,IAAI,gBAAgB,MAAM;AACpD,gBAAM,IAAI,MACR,qJACF;AAAA,QACF;AACA,cAAM,QAAO,MAAM,SAAS,SAAS;AAAA,UACnC,UAAU;AAAA,UACV,KAAK,QAAQ;AAAA,QACf,CAAC;AACD,cAAM,cAAc,sBAAO,UACzB,QAAQ,YACR,OACA,QAAQ,aACV;AAEA,YAAI,YAAY,SAAS,MAAM;AAC7B,gBAAM,IAAI,MACR,0CAA0C,YAAY,2DACxD;AAAA,QACF;AAEA,qBAAa,aAAa,GAAG;AAAA,MAC/B;AAAA,IACF;AAAA,IACA,SAAS;AAAA,MACP,OAAO,mBAAmB;AACxB,eAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AAEpC,iBAAO,QAAQ;AAAA,QACjB,CAAC;AAED,cAAM,cAAc,sBAAO,UAAU,QAAQ,YAAY,IAAI;AAAA,aACxD,QAAQ;AAAA,UACX,QAAQ;AAAA,QACV,CAAC;AACD,qBAAa,aAAa,GAAG;AAAA,MAC/B;AAAA,IACF;AAAA,EACF,CAAC;AAED,SAAO;AACT;AAEA,sBAAsB,aAAqB,KAAmB;AA5N9D;AA6NE,MAAI,aAAa,KAAK;AACpB,QAAI,QAAQ,OAAO,cAAc,WAAW;AAC5C;AAAA,EACF;AAEA,MAAI,oBACD,UAAI,UAAU,YAAY,MAA1B,YAAqD,CAAC;AACzD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC,iBAAiB;AAAA,EACxC;AACA,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB,WAAW,CAAC;AACjE;AAEA,6BAA6B,KAAa;AAIxC,SAAO,MAAM;AACf;AAEA,0BACE,OACA;AAAA,EACE;AAAA,EACA,MAAM;AAAA,GAEI;AACZ,QAAM,iBAAiB,6BAA6B,QAAQ;AAC5D,QAAM,EAAE,oBAAoB,iBAAiB,UAAU,KAAI;AAE3D,MAAI;AACF,UAAM,OAAO,MAAM,AAAK,YAAO,oBAAoB,gBAAgB;AAAA,SACzD;AAAA,MACR,KAAK,MAAM;AAAA,IACb,CAAC;AAED,QAAI,iBAAiB,GAAG;AACtB,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,SAEF,KAAK;AAAA,IACV;AAAA,EACF,SAAS,OAAP;AACA,QAAI,iBAAiB,OAAO;AAC1B,UACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,YAAY,4BAClB,MAAM,YAAY,yCAClB;AAKA,eAAO,CAAC;AAAA,MACV;AAAA,IACF;AAEA,UAAM;AAAA,EACR;AACF;AAEA,mBAAmB,OAGjB;AACA,MAAI,MAAK,MAAK,SAAS,OAAO,kBAAkB;AAC9C,UAAM,CAAC,oBAAoB,wBACzB,MAAK,MAAM,gBAAgB;AAC7B,WAAO;AAAA,MACL;AAAA,MACA,cAAc,SAAS,sBAAsB,EAAE;AAAA,IACjD;AAAA,EACF;AAEA,SAAO,EAAE,oBAAoB,OAAM,cAAc,KAAK;AACxD;AAEA,wBACE,MACA;AAAA,EACE;AAAA,EACA,MAAM;AAAA,GAER;AACA,QAAM,iBAAiB,6BAA6B,QAAQ;AAE5D,QAAM,uBAAuB,KAAK,IAChC,GAAG,OAAO,KAAK,cAAc,EAAE,IAAI,CAAC,OAAO,SAAS,IAAI,EAAE,CAAC,CAC7D;AAEA,QAAM,kBAAkB;AAAA,IACtB,IAAI,qBAAqB,SAAS;AAAA,IAClC,QAAQ,eAAe;AAAA,EACzB;AAEA,QAAM,QAAO,MAAM,AAAK,UAAK,MAAM,iBAAiB;AAAA,OAC1C;AAAA,IACR,KAAK,MAAM;AAAA,EACb,CAAC;AAED,SAAO,GAAG,QAAO,mBAAmB;AACtC;AAEA,sCAAsC,UAAoB;AACxD,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,SAAS,IAAI;AAC1D;","names":[]}

package/dist/index.mjs

@@ -1,5 +1,5 @@
 // src/index.ts
-import Iron from "@hapi/iron";
+import * as Iron from "iron-webcrypto";
 import cookie from "cookie";
 var timestampSkewSec = 60;
 var fourteenDaysInSeconds = 15 * 24 * 3600;
@@ -44,7 +44,7 @@ async function getIronSession(req, res, userSessionOptions) {
   } else {
     options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);
   }
-  const sealFromCookies = cookie.parse(req.headers.cookie || "")[options.cookieName];
+  const sealFromCookies = cookie.parse("credentials" in req ? req.headers.get("cookie") || "" : req.headers.cookie || "")[options.cookieName];
   const session = sealFromCookies === void 0 ? {} : await unsealData(sealFromCookies, {
     password: passwordsAsMap,
     ttl: options.ttl
@@ -52,14 +52,14 @@ async function getIronSession(req, res, userSessionOptions) {
   Object.defineProperties(session, {
     save: {
       value: async function save() {
-        if (res.headersSent === true) {
+        if ("headersSent" in res && res.headersSent === true) {
           throw new Error(`iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`);
         }
-        const seal = await sealData(session, {
+        const seal2 = await sealData(session, {
           password: passwordsAsMap,
           ttl: options.ttl
         });
-        const cookieValue = cookie.serialize(options.cookieName, seal, options.cookieOptions);
+        const cookieValue = cookie.serialize(options.cookieName, seal2, options.cookieOptions);
         if (cookieValue.length > 4096) {
           throw new Error(`iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`);
         }
@@ -83,6 +83,10 @@ async function getIronSession(req, res, userSessionOptions) {
 }
 function addToCookies(cookieValue, res) {
   var _a;
+  if ("headers" in res) {
+    res.headers.append("set-cookie", cookieValue);
+    return;
+  }
   let existingSetCookie = (_a = res.getHeader("set-cookie")) != null ? _a : [];
   if (typeof existingSetCookie === "string") {
     existingSetCookie = [existingSetCookie];
@@ -92,12 +96,12 @@ function addToCookies(cookieValue, res) {
 function computeCookieMaxAge(ttl) {
   return ttl - timestampSkewSec;
 }
-async function unsealData(seal, {
+async function unsealData(seal2, {
   password,
   ttl = fourteenDaysInSeconds
 }) {
   const passwordsAsMap = normalizeStringPasswordToMap(password);
-  const { sealWithoutVersion, tokenVersion } = parseSeal(seal);
+  const { sealWithoutVersion, tokenVersion } = parseSeal(seal2);
   try {
     const data = await Iron.unseal(sealWithoutVersion, passwordsAsMap, {
       ...Iron.defaults,
@@ -118,15 +122,15 @@ async function unsealData(seal, {
     throw error;
   }
 }
-function parseSeal(seal) {
-  if (seal[seal.length - 2] === versionDelimiter) {
-    const [sealWithoutVersion, tokenVersionAsString] = seal.split(versionDelimiter);
+function parseSeal(seal2) {
+  if (seal2[seal2.length - 2] === versionDelimiter) {
+    const [sealWithoutVersion, tokenVersionAsString] = seal2.split(versionDelimiter);
     return {
       sealWithoutVersion,
       tokenVersion: parseInt(tokenVersionAsString, 10)
     };
   }
-  return { sealWithoutVersion: seal, tokenVersion: null };
+  return { sealWithoutVersion: seal2, tokenVersion: null };
 }
 async function sealData(data, {
   password,
@@ -138,11 +142,11 @@ async function sealData(data, {
     id: mostRecentPasswordId.toString(),
     secret: passwordsAsMap[mostRecentPasswordId]
   };
-  const seal = await Iron.seal(data, passwordForSeal, {
+  const seal2 = await Iron.seal(data, passwordForSeal, {
     ...Iron.defaults,
     ttl: ttl * 1e3
   });
-  return `${seal}${versionDelimiter}${currentMajorVersion}`;
+  return `${seal2}${versionDelimiter}${currentMajorVersion}`;
 }
 function normalizeStringPasswordToMap(password) {
   return typeof password === "string" ? { 1: password } : password;
@@ -152,4 +156,4 @@ export {
   sealData,
   unsealData
 };
-//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1,7 +1 @@
-{
-  "version": 3,
-  "sources": ["../src/index.ts"],
-  "sourcesContent": ["import Iron from \"@hapi/iron\";\nimport type { CookieSerializeOptions } from \"cookie\";\nimport cookie from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype passwordsMap = { [id: string]: string };\ntype password = string | passwordsMap;\n\nconst fourteenDaysInSeconds = 15 * 24 * 3600;\n\n// We store a token major version to handle data format changes when any. So that when you upgrade the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: fourteenDaysInSeconds,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  /**\n   * This is the cookie name that will be used inside the browser. You should make sure it's unique given\n   * your application. Example: vercel-session\n   */\n  cookieName: string;\n\n  /**\n   * This is the password(s) that will be used to encrypt the cookie. It can be either a string or an object\n   * like {1: \"password\", 2: password}.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt the cookie and only the most\n   * recent (= highest key, 2 in this example) password will be used to encrypt the cookie. This allow you\n   * to use password rotation (security)\n   */\n  password: password;\n\n  /**\n   * This is the time in seconds that the session will be valid for. This also set the max-age attribute of\n   * the cookie automatically (minus 60 seconds so that the cookie always expire before the session).\n   */\n  ttl?: number;\n\n  /**\n   * This is the options that will be passed to the cookie library.\n   * You can see all of them here: https://github.com/jshttp/cookie#options-1.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser is closed) then you need\n   * to pass cookieOptions: { maxAge: undefined }.\n   */\n  cookieOptions?: CookieSerializeOptions;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-interface\nexport interface IronSessionData {\n  // If we allow for any keys, then there's no more type check on unknown properties\n  // which is not good\n  // If we allow for any keys, the later delete will work but I prefer to disable the\n  // check at this stage and\n  // provide good type checking instead\n  // [key: string]: unknown;\n}\n\nexport type IronSession = IronSessionData & {\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  destroy: () => void;\n\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  save: () => Promise<void>;\n};\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    session: IronSession;\n  }\n}\n\nexport async function getIronSession(\n  req: IncomingMessage,\n  res: ServerResponse,\n  userSessionOptions: IronSessionOptions,\n): Promise<IronSession> {\n  if (\n    !req ||\n    !res ||\n    !userSessionOptions ||\n    !userSessionOptions.cookieName ||\n    !userSessionOptions.password\n  ) {\n    throw new Error(\n      `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n    );\n  }\n\n  const passwordsAsMap = normalizeStringPasswordToMap(\n    userSessionOptions.password,\n  );\n\n  Object.values(\n    normalizeStringPasswordToMap(userSessionOptions.password),\n  ).forEach((password) => {\n    if (password.length < 32) {\n      throw new Error(\n        `iron-session: Bad usage. Password must be at least 32 characters long.`,\n      );\n    }\n  });\n\n  const options: Required<IronSessionOptions> = {\n    ...defaultOptions,\n    ...userSessionOptions,\n    cookieOptions: {\n      ...defaultOptions.cookieOptions,\n      ...(userSessionOptions.cookieOptions || {}),\n    },\n  };\n\n  if (options.ttl === 0) {\n    // ttl = 0 means no expiration\n    // but in reality cookies have to expire (can't have no max-age)\n    // 2147483647 is the max value for max-age in cookies\n    // see https://stackoverflow.com/a/11685301/147079\n    options.ttl = 2147483647;\n  }\n\n  if (\n    userSessionOptions.cookieOptions &&\n    \"maxAge\" in userSessionOptions.cookieOptions\n  ) {\n    // session cookie, do not set maxAge, consider token as infinite\n    if (userSessionOptions.cookieOptions.maxAge === undefined) {\n      options.ttl = 0;\n    } else {\n      options.cookieOptions.maxAge = computeCookieMaxAge(\n        userSessionOptions.cookieOptions.maxAge,\n      );\n    }\n  } else {\n    options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n  }\n\n  const sealFromCookies = cookie.parse(req.headers.cookie || \"\")[\n    options.cookieName\n  ];\n\n  const session =\n    sealFromCookies === undefined\n      ? {}\n      : await unsealData<IronSessionData>(sealFromCookies, {\n          password: passwordsAsMap,\n          ttl: options.ttl,\n        });\n\n  Object.defineProperties(session, {\n    save: {\n      value: async function save() {\n        if (res.headersSent === true) {\n          throw new Error(\n            `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`,\n          );\n        }\n        const seal = await sealData(session, {\n          password: passwordsAsMap,\n          ttl: options.ttl,\n        });\n        const cookieValue = cookie.serialize(\n          options.cookieName,\n          seal,\n          options.cookieOptions,\n        );\n\n        if (cookieValue.length > 4096) {\n          throw new Error(\n            `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n          );\n        }\n\n        addToCookies(cookieValue, res);\n      },\n    },\n    destroy: {\n      value: function destroy() {\n        Object.keys(session).forEach((key) => {\n          // @ts-ignore See comment on the IronSessionData interface\n          delete session[key];\n        });\n\n        const cookieValue = cookie.serialize(options.cookieName, \"\", {\n          ...options.cookieOptions,\n          maxAge: 0,\n        });\n        addToCookies(cookieValue, res);\n      },\n    },\n  });\n\n  return session as IronSession;\n}\n\nfunction addToCookies(cookieValue: string, res: ServerResponse) {\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nexport async function unsealData<T = Record<string, unknown>>(\n  seal: string,\n  {\n    password,\n    ttl = fourteenDaysInSeconds,\n  }: { password: password; ttl?: number },\n): Promise<T> {\n  const passwordsAsMap = normalizeStringPasswordToMap(password);\n  const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n  try {\n    const data = await Iron.unseal(sealWithoutVersion, passwordsAsMap, {\n      ...Iron.defaults,\n      ttl: ttl * 1000,\n    });\n\n    if (tokenVersion === 2) {\n      return data;\n    }\n\n    return {\n      ...data.persistent,\n    };\n  } catch (error) {\n    if (error instanceof Error) {\n      if (\n        error.message === \"Expired seal\" ||\n        error.message === \"Bad hmac value\" ||\n        error.message === \"Cannot find password: \" ||\n        error.message === \"Incorrect number of sealed components\"\n      ) {\n        // if seal expired or\n        // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n        // if we can't find back the password in the seal\n        // then we just start a new session over\n        return {} as T;\n      }\n    }\n\n    throw error;\n  }\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  if (seal[seal.length - 2] === versionDelimiter) {\n    const [sealWithoutVersion, tokenVersionAsString] =\n      seal.split(versionDelimiter);\n    return {\n      sealWithoutVersion,\n      tokenVersion: parseInt(tokenVersionAsString, 10),\n    };\n  }\n\n  return { sealWithoutVersion: seal, tokenVersion: null };\n}\n\nexport async function sealData(\n  data: unknown,\n  {\n    password,\n    ttl = fourteenDaysInSeconds,\n  }: { password: password; ttl?: number },\n) {\n  const passwordsAsMap = normalizeStringPasswordToMap(password);\n\n  const mostRecentPasswordId = Math.max(\n    ...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)),\n  );\n\n  const passwordForSeal = {\n    id: mostRecentPasswordId.toString(),\n    secret: passwordsAsMap[mostRecentPasswordId],\n  };\n\n  const seal = await Iron.seal(data, passwordForSeal, {\n    ...Iron.defaults,\n    ttl: ttl * 1000,\n  });\n\n  return `${seal}${versionDelimiter}${currentMajorVersion}`;\n}\n\nfunction normalizeStringPasswordToMap(password: password) {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n"],
-  "mappings": ";AAAA;AAEA;AAKA,IAAM,mBAAmB;AAKzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBAGF;AAAA,EACF,KAAK;AAAA,EACL,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA;AAAA;AAiEV,8BACE,KACA,KACA,oBACsB;AACtB,MACE,CAAC,OACD,CAAC,OACD,CAAC,sBACD,CAAC,mBAAmB,cACpB,CAAC,mBAAmB,UACpB;AACA,UAAM,IAAI,MACR;AAAA;AAIJ,QAAM,iBAAiB,6BACrB,mBAAmB;AAGrB,SAAO,OACL,6BAA6B,mBAAmB,WAChD,QAAQ,CAAC,aAAa;AACtB,QAAI,SAAS,SAAS,IAAI;AACxB,YAAM,IAAI,MACR;AAAA;AAAA;AAKN,QAAM,UAAwC;AAAA,OACzC;AAAA,OACA;AAAA,IACH,eAAe;AAAA,SACV,eAAe;AAAA,SACd,mBAAmB,iBAAiB;AAAA;AAAA;AAI5C,MAAI,QAAQ,QAAQ,GAAG;AAKrB,YAAQ,MAAM;AAAA;AAGhB,MACE,mBAAmB,iBACnB,YAAY,mBAAmB,eAC/B;AAEA,QAAI,mBAAmB,cAAc,WAAW,QAAW;AACzD,cAAQ,MAAM;AAAA,WACT;AACL,cAAQ,cAAc,SAAS,oBAC7B,mBAAmB,cAAc;AAAA;AAAA,SAGhC;AACL,YAAQ,cAAc,SAAS,oBAAoB,QAAQ;AAAA;AAG7D,QAAM,kBAAkB,OAAO,MAAM,IAAI,QAAQ,UAAU,IACzD,QAAQ;AAGV,QAAM,UACJ,oBAAoB,SAChB,KACA,MAAM,WAA4B,iBAAiB;AAAA,IACjD,UAAU;AAAA,IACV,KAAK,QAAQ;AAAA;AAGrB,SAAO,iBAAiB,SAAS;AAAA,IAC/B,MAAM;AAAA,MACJ,OAAO,sBAAsB;AAC3B,YAAI,IAAI,gBAAgB,MAAM;AAC5B,gBAAM,IAAI,MACR;AAAA;AAGJ,cAAM,OAAO,MAAM,SAAS,SAAS;AAAA,UACnC,UAAU;AAAA,UACV,KAAK,QAAQ;AAAA;AAEf,cAAM,cAAc,OAAO,UACzB,QAAQ,YACR,MACA,QAAQ;AAGV,YAAI,YAAY,SAAS,MAAM;AAC7B,gBAAM,IAAI,MACR,0CAA0C,YAAY;AAAA;AAI1D,qBAAa,aAAa;AAAA;AAAA;AAAA,IAG9B,SAAS;AAAA,MACP,OAAO,mBAAmB;AACxB,eAAO,KAAK,SAAS,QAAQ,CAAC,QAAQ;AAEpC,iBAAO,QAAQ;AAAA;AAGjB,cAAM,cAAc,OAAO,UAAU,QAAQ,YAAY,IAAI;AAAA,aACxD,QAAQ;AAAA,UACX,QAAQ;AAAA;AAEV,qBAAa,aAAa;AAAA;AAAA;AAAA;AAKhC,SAAO;AAAA;AAGT,sBAAsB,aAAqB,KAAqB;AAvNhE;AAwNE,MAAI,oBACD,UAAI,UAAU,kBAAd,YAAqD;AACxD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC;AAAA;AAEvB,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB;AAAA;AAGrD,6BAA6B,KAAa;AAIxC,SAAO,MAAM;AAAA;AAGf,0BACE,MACA;AAAA,EACE;AAAA,EACA,MAAM;AAAA,GAEI;AACZ,QAAM,iBAAiB,6BAA6B;AACpD,QAAM,EAAE,oBAAoB,iBAAiB,UAAU;AAEvD,MAAI;AACF,UAAM,OAAO,MAAM,KAAK,OAAO,oBAAoB,gBAAgB;AAAA,SAC9D,KAAK;AAAA,MACR,KAAK,MAAM;AAAA;AAGb,QAAI,iBAAiB,GAAG;AACtB,aAAO;AAAA;AAGT,WAAO;AAAA,SACF,KAAK;AAAA;AAAA,WAEH,OAAP;AACA,QAAI,iBAAiB,OAAO;AAC1B,UACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,YAAY,4BAClB,MAAM,YAAY,yCAClB;AAKA,eAAO;AAAA;AAAA;AAIX,UAAM;AAAA;AAAA;AAIV,mBAAmB,MAGjB;AACA,MAAI,KAAK,KAAK,SAAS,OAAO,kBAAkB;AAC9C,UAAM,CAAC,oBAAoB,wBACzB,KAAK,MAAM;AACb,WAAO;AAAA,MACL;AAAA,MACA,cAAc,SAAS,sBAAsB;AAAA;AAAA;AAIjD,SAAO,EAAE,oBAAoB,MAAM,cAAc;AAAA;AAGnD,wBACE,MACA;AAAA,EACE;AAAA,EACA,MAAM;AAAA,GAER;AACA,QAAM,iBAAiB,6BAA6B;AAEpD,QAAM,uBAAuB,KAAK,IAChC,GAAG,OAAO,KAAK,gBAAgB,IAAI,CAAC,OAAO,SAAS,IAAI;AAG1D,QAAM,kBAAkB;AAAA,IACtB,IAAI,qBAAqB;AAAA,IACzB,QAAQ,eAAe;AAAA;AAGzB,QAAM,OAAO,MAAM,KAAK,KAAK,MAAM,iBAAiB;AAAA,OAC/C,KAAK;AAAA,IACR,KAAK,MAAM;AAAA;AAGb,SAAO,GAAG,OAAO,mBAAmB;AAAA;AAGtC,sCAAsC,UAAoB;AACxD,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,aAAa;AAAA;",
-  "names": []
-}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import * as Iron from \"iron-webcrypto\";\nimport type { CookieSerializeOptions } from \"cookie\";\nimport cookie from \"cookie\";\nimport type { IncomingMessage, ServerResponse } from \"http\";\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/family/iron/api/?v=6.0.0#options\nconst timestampSkewSec = 60;\n\ntype passwordsMap = { [id: string]: string };\ntype password = string | passwordsMap;\n\nconst fourteenDaysInSeconds = 15 * 24 * 3600;\n\n// We store a token major version to handle data format changes when any. So that when you upgrade the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: {\n  ttl: number;\n  cookieOptions: CookieSerializeOptions;\n} = {\n  ttl: fourteenDaysInSeconds,\n  cookieOptions: {\n    httpOnly: true,\n    secure: true,\n    sameSite: \"lax\",\n    path: \"/\",\n  },\n};\n\nexport interface IronSessionOptions {\n  /**\n   * This is the cookie name that will be used inside the browser. You should make sure it's unique given\n   * your application. Example: vercel-session\n   */\n  cookieName: string;\n\n  /**\n   * This is the password(s) that will be used to encrypt the cookie. It can be either a string or an object\n   * like {1: \"password\", 2: password}.\n   *\n   * When you provide multiple passwords then all of them will be used to decrypt the cookie and only the most\n   * recent (= highest key, 2 in this example) password will be used to encrypt the cookie. This allow you\n   * to use password rotation (security)\n   */\n  password: password;\n\n  /**\n   * This is the time in seconds that the session will be valid for. This also set the max-age attribute of\n   * the cookie automatically (minus 60 seconds so that the cookie always expire before the session).\n   */\n  ttl?: number;\n\n  /**\n   * This is the options that will be passed to the cookie library.\n   * You can see all of them here: https://github.com/jshttp/cookie#options-1.\n   *\n   * If you want to use \"session cookies\" (cookies that are deleted when the browser is closed) then you need\n   * to pass cookieOptions: { maxAge: undefined }.\n   */\n  cookieOptions?: CookieSerializeOptions;\n}\n\n// eslint-disable-next-line @typescript-eslint/no-empty-interface\nexport interface IronSessionData {\n  // If we allow for any keys, then there's no more type check on unknown properties\n  // which is not good\n  // If we allow for any keys, the later delete will work but I prefer to disable the\n  // check at this stage and\n  // provide good type checking instead\n  // [key: string]: unknown;\n}\n\nexport type IronSession = IronSessionData & {\n  /**\n   * Destroys the session data and removes the cookie.\n   */\n  destroy: () => void;\n\n  /**\n   * Encrypts the session data and sets the cookie.\n   */\n  save: () => Promise<void>;\n};\n\ndeclare module \"http\" {\n  interface IncomingMessage {\n    session: IronSession;\n  }\n}\n\ntype RequestType = IncomingMessage | Request;\ntype ResponseType = ServerResponse | Response;\n\nexport async function getIronSession(\n  req: RequestType,\n  res: ResponseType,\n  userSessionOptions: IronSessionOptions,\n): Promise<IronSession> {\n  if (\n    !req ||\n    !res ||\n    !userSessionOptions ||\n    !userSessionOptions.cookieName ||\n    !userSessionOptions.password\n  ) {\n    throw new Error(\n      `iron-session: Bad usage. Minimum usage is const session = await getIronSession(req, res, { cookieName: \"...\", password: \"...\". Check the usage here: https://github.com/vvo/iron-session`,\n    );\n  }\n\n  const passwordsAsMap = normalizeStringPasswordToMap(\n    userSessionOptions.password,\n  );\n\n  Object.values(\n    normalizeStringPasswordToMap(userSessionOptions.password),\n  ).forEach((password) => {\n    if (password.length < 32) {\n      throw new Error(\n        `iron-session: Bad usage. Password must be at least 32 characters long.`,\n      );\n    }\n  });\n\n  const options: Required<IronSessionOptions> = {\n    ...defaultOptions,\n    ...userSessionOptions,\n    cookieOptions: {\n      ...defaultOptions.cookieOptions,\n      ...(userSessionOptions.cookieOptions || {}),\n    },\n  };\n\n  if (options.ttl === 0) {\n    // ttl = 0 means no expiration\n    // but in reality cookies have to expire (can't have no max-age)\n    // 2147483647 is the max value for max-age in cookies\n    // see https://stackoverflow.com/a/11685301/147079\n    options.ttl = 2147483647;\n  }\n\n  if (\n    userSessionOptions.cookieOptions &&\n    \"maxAge\" in userSessionOptions.cookieOptions\n  ) {\n    // session cookie, do not set maxAge, consider token as infinite\n    if (userSessionOptions.cookieOptions.maxAge === undefined) {\n      options.ttl = 0;\n    } else {\n      options.cookieOptions.maxAge = computeCookieMaxAge(\n        userSessionOptions.cookieOptions.maxAge,\n      );\n    }\n  } else {\n    options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n  }\n\n  const sealFromCookies = cookie.parse(\n    \"credentials\" in req\n      ? req.headers.get(\"cookie\") || \"\"\n      : req.headers.cookie || \"\",\n  )[options.cookieName];\n\n  const session =\n    sealFromCookies === undefined\n      ? {}\n      : await unsealData<IronSessionData>(sealFromCookies, {\n          password: passwordsAsMap,\n          ttl: options.ttl,\n        });\n\n  Object.defineProperties(session, {\n    save: {\n      value: async function save() {\n        if (\"headersSent\" in res && res.headersSent === true) {\n          throw new Error(\n            `iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()`,\n          );\n        }\n        const seal = await sealData(session, {\n          password: passwordsAsMap,\n          ttl: options.ttl,\n        });\n        const cookieValue = cookie.serialize(\n          options.cookieName,\n          seal,\n          options.cookieOptions,\n        );\n\n        if (cookieValue.length > 4096) {\n          throw new Error(\n            `iron-session: Cookie length is too big ${cookieValue.length}, browsers will refuse it. Try to remove some data.`,\n          );\n        }\n\n        addToCookies(cookieValue, res);\n      },\n    },\n    destroy: {\n      value: function destroy() {\n        Object.keys(session).forEach((key) => {\n          // @ts-ignore See comment on the IronSessionData interface\n          delete session[key];\n        });\n\n        const cookieValue = cookie.serialize(options.cookieName, \"\", {\n          ...options.cookieOptions,\n          maxAge: 0,\n        });\n        addToCookies(cookieValue, res);\n      },\n    },\n  });\n\n  return session as IronSession;\n}\n\nfunction addToCookies(cookieValue: string, res: ResponseType) {\n  if (\"headers\" in res) {\n    res.headers.append(\"set-cookie\", cookieValue);\n    return;\n  }\n\n  let existingSetCookie =\n    (res.getHeader(\"set-cookie\") as string[] | string) ?? [];\n  if (typeof existingSetCookie === \"string\") {\n    existingSetCookie = [existingSetCookie];\n  }\n  res.setHeader(\"set-cookie\", [...existingSetCookie, cookieValue]);\n}\n\nfunction computeCookieMaxAge(ttl: number) {\n  // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n  // It also allows for clock difference of 60 seconds maximum between server and clients.\n  // It also makes sure to expire the cookie immediately when value is 0\n  return ttl - timestampSkewSec;\n}\n\nexport async function unsealData<T = Record<string, unknown>>(\n  seal: string,\n  {\n    password,\n    ttl = fourteenDaysInSeconds,\n  }: { password: password; ttl?: number },\n): Promise<T> {\n  const passwordsAsMap = normalizeStringPasswordToMap(password);\n  const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n  try {\n    const data = await Iron.unseal(sealWithoutVersion, passwordsAsMap, {\n      ...Iron.defaults,\n      ttl: ttl * 1000,\n    });\n\n    if (tokenVersion === 2) {\n      return data as T;\n    }\n\n    return {\n      // @ts-expect-error `persistent` does not exist on newer tokens\n      ...data.persistent,\n    };\n  } catch (error) {\n    if (error instanceof Error) {\n      if (\n        error.message === \"Expired seal\" ||\n        error.message === \"Bad hmac value\" ||\n        error.message === \"Cannot find password: \" ||\n        error.message === \"Incorrect number of sealed components\"\n      ) {\n        // if seal expired or\n        // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n        // if we can't find back the password in the seal\n        // then we just start a new session over\n        return {} as T;\n      }\n    }\n\n    throw error;\n  }\n}\n\nfunction parseSeal(seal: string): {\n  sealWithoutVersion: string;\n  tokenVersion: number | null;\n} {\n  if (seal[seal.length - 2] === versionDelimiter) {\n    const [sealWithoutVersion, tokenVersionAsString] =\n      seal.split(versionDelimiter);\n    return {\n      sealWithoutVersion,\n      tokenVersion: parseInt(tokenVersionAsString, 10),\n    };\n  }\n\n  return { sealWithoutVersion: seal, tokenVersion: null };\n}\n\nexport async function sealData(\n  data: unknown,\n  {\n    password,\n    ttl = fourteenDaysInSeconds,\n  }: { password: password; ttl?: number },\n) {\n  const passwordsAsMap = normalizeStringPasswordToMap(password);\n\n  const mostRecentPasswordId = Math.max(\n    ...Object.keys(passwordsAsMap).map((id) => parseInt(id, 10)),\n  );\n\n  const passwordForSeal = {\n    id: mostRecentPasswordId.toString(),\n    secret: passwordsAsMap[mostRecentPasswordId],\n  };\n\n  const seal = await Iron.seal(data, passwordForSeal, {\n    ...Iron.defaults,\n    ttl: ttl * 1000,\n  });\n\n  return `${seal}${versionDelimiter}${currentMajorVersion}`;\n}\n\nfunction normalizeStringPasswordToMap(password: password) {\n  return typeof password === \"string\" ? { 1: password } : password;\n}\n"],"mappings":";AAAA;AAEA;AAKA,IAAM,mBAAmB;AAKzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBAGF;AAAA,EACF,KAAK;AAAA,EACL,eAAe;AAAA,IACb,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,MAAM;AAAA,EACR;AACF;AAkEA,8BACE,KACA,KACA,oBACsB;AACtB,MACE,CAAC,OACD,CAAC,OACD,CAAC,sBACD,CAAC,mBAAmB,cACpB,CAAC,mBAAmB,UACpB;AACA,UAAM,IAAI,MACR,0LACF;AAAA,EACF;AAEA,QAAM,iBAAiB,6BACrB,mBAAmB,QACrB;AAEA,SAAO,OACL,6BAA6B,mBAAmB,QAAQ,CAC1D,EAAE,QAAQ,CAAC,aAAa;AACtB,QAAI,SAAS,SAAS,IAAI;AACxB,YAAM,IAAI,MACR,wEACF;AAAA,IACF;AAAA,EACF,CAAC;AAED,QAAM,UAAwC;AAAA,OACzC;AAAA,OACA;AAAA,IACH,eAAe;AAAA,SACV,eAAe;AAAA,SACd,mBAAmB,iBAAiB,CAAC;AAAA,IAC3C;AAAA,EACF;AAEA,MAAI,QAAQ,QAAQ,GAAG;AAKrB,YAAQ,MAAM;AAAA,EAChB;AAEA,MACE,mBAAmB,iBACnB,YAAY,mBAAmB,eAC/B;AAEA,QAAI,mBAAmB,cAAc,WAAW,QAAW;AACzD,cAAQ,MAAM;AAAA,IAChB,OAAO;AACL,cAAQ,cAAc,SAAS,oBAC7B,mBAAmB,cAAc,MACnC;AAAA,IACF;AAAA,EACF,OAAO;AACL,YAAQ,cAAc,SAAS,oBAAoB,QAAQ,GAAG;AAAA,EAChE;AAEA,QAAM,kBAAkB,OAAO,MAC7B,iBAAiB,MACb,IAAI,QAAQ,IAAI,QAAQ,KAAK,KAC7B,IAAI,QAAQ,UAAU,EAC5B,EAAE,QAAQ;AAEV,QAAM,UACJ,oBAAoB,SAChB,CAAC,IACD,MAAM,WAA4B,iBAAiB;AAAA,IACjD,UAAU;AAAA,IACV,KAAK,QAAQ;AAAA,EACf,CAAC;AAEP,SAAO,iBAAiB,SAAS;AAAA,IAC/B,MAAM;AAAA,MACJ,OAAO,sBAAsB;AAC3B,YAAI,iBAAiB,OAAO,IAAI,gBAAgB,MAAM;AACpD,gBAAM,IAAI,MACR,qJACF;AAAA,QACF;AACA,cAAM,QAAO,MAAM,SAAS,SAAS;AAAA,UACnC,UAAU;AAAA,UACV,KAAK,QAAQ;AAAA,QACf,CAAC;AACD,cAAM,cAAc,OAAO,UACzB,QAAQ,YACR,OACA,QAAQ,aACV;AAEA,YAAI,YAAY,SAAS,MAAM;AAC7B,gBAAM,IAAI,MACR,0CAA0C,YAAY,2DACxD;AAAA,QACF;AAEA,qBAAa,aAAa,GAAG;AAAA,MAC/B;AAAA,IACF;AAAA,IACA,SAAS;AAAA,MACP,OAAO,mBAAmB;AACxB,eAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AAEpC,iBAAO,QAAQ;AAAA,QACjB,CAAC;AAED,cAAM,cAAc,OAAO,UAAU,QAAQ,YAAY,IAAI;AAAA,aACxD,QAAQ;AAAA,UACX,QAAQ;AAAA,QACV,CAAC;AACD,qBAAa,aAAa,GAAG;AAAA,MAC/B;AAAA,IACF;AAAA,EACF,CAAC;AAED,SAAO;AACT;AAEA,sBAAsB,aAAqB,KAAmB;AA5N9D;AA6NE,MAAI,aAAa,KAAK;AACpB,QAAI,QAAQ,OAAO,cAAc,WAAW;AAC5C;AAAA,EACF;AAEA,MAAI,oBACD,UAAI,UAAU,YAAY,MAA1B,YAAqD,CAAC;AACzD,MAAI,OAAO,sBAAsB,UAAU;AACzC,wBAAoB,CAAC,iBAAiB;AAAA,EACxC;AACA,MAAI,UAAU,cAAc,CAAC,GAAG,mBAAmB,WAAW,CAAC;AACjE;AAEA,6BAA6B,KAAa;AAIxC,SAAO,MAAM;AACf;AAEA,0BACE,OACA;AAAA,EACE;AAAA,EACA,MAAM;AAAA,GAEI;AACZ,QAAM,iBAAiB,6BAA6B,QAAQ;AAC5D,QAAM,EAAE,oBAAoB,iBAAiB,UAAU,KAAI;AAE3D,MAAI;AACF,UAAM,OAAO,MAAM,AAAK,YAAO,oBAAoB,gBAAgB;AAAA,SACzD;AAAA,MACR,KAAK,MAAM;AAAA,IACb,CAAC;AAED,QAAI,iBAAiB,GAAG;AACtB,aAAO;AAAA,IACT;AAEA,WAAO;AAAA,SAEF,KAAK;AAAA,IACV;AAAA,EACF,SAAS,OAAP;AACA,QAAI,iBAAiB,OAAO;AAC1B,UACE,MAAM,YAAY,kBAClB,MAAM,YAAY,oBAClB,MAAM,YAAY,4BAClB,MAAM,YAAY,yCAClB;AAKA,eAAO,CAAC;AAAA,MACV;AAAA,IACF;AAEA,UAAM;AAAA,EACR;AACF;AAEA,mBAAmB,OAGjB;AACA,MAAI,MAAK,MAAK,SAAS,OAAO,kBAAkB;AAC9C,UAAM,CAAC,oBAAoB,wBACzB,MAAK,MAAM,gBAAgB;AAC7B,WAAO;AAAA,MACL;AAAA,MACA,cAAc,SAAS,sBAAsB,EAAE;AAAA,IACjD;AAAA,EACF;AAEA,SAAO,EAAE,oBAAoB,OAAM,cAAc,KAAK;AACxD;AAEA,wBACE,MACA;AAAA,EACE;AAAA,EACA,MAAM;AAAA,GAER;AACA,QAAM,iBAAiB,6BAA6B,QAAQ;AAE5D,QAAM,uBAAuB,KAAK,IAChC,GAAG,OAAO,KAAK,cAAc,EAAE,IAAI,CAAC,OAAO,SAAS,IAAI,EAAE,CAAC,CAC7D;AAEA,QAAM,kBAAkB;AAAA,IACtB,IAAI,qBAAqB,SAAS;AAAA,IAClC,QAAQ,eAAe;AAAA,EACzB;AAEA,QAAM,QAAO,MAAM,AAAK,UAAK,MAAM,iBAAiB;AAAA,OAC1C;AAAA,IACR,KAAK,MAAM;AAAA,EACb,CAAC;AAED,SAAO,GAAG,QAAO,mBAAmB;AACtC;AAEA,sCAAsC,UAAoB;AACxD,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,SAAS,IAAI;AAC1D;","names":[]}

package/express/dist/index.js

@@ -1,32 +1,28 @@
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __markAsModule = (target) => __defProp(target, "__esModule", { value: true });
 var __export = (target, all) => {
-  __markAsModule(target);
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
-var __reExport = (target, module2, desc) => {
-  if (module2 && typeof module2 === "object" || typeof module2 === "function") {
-    for (let key of __getOwnPropNames(module2))
-      if (!__hasOwnProp.call(target, key) && key !== "default")
-        __defProp(target, key, { get: () => module2[key], enumerable: !(desc = __getOwnPropDesc(module2, key)) || desc.enumerable });
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
   }
-  return target;
-};
-var __toModule = (module2) => {
-  return __reExport(__markAsModule(__defProp(module2 != null ? __create(__getProtoOf(module2)) : {}, "default", module2 && module2.__esModule && "default" in module2 ? { get: () => module2.default, enumerable: true } : { value: module2, enumerable: true })), module2);
+  return to;
 };
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // express/index.ts
-__export(exports, {
+var express_exports = {};
+__export(express_exports, {
   ironSession: () => ironSession
 });
-var import_iron_session = __toModule(require("iron-session"));
+module.exports = __toCommonJS(express_exports);
+var import_iron_session = require("iron-session");
 
 // src/getPropertyDescriptorForReqSession.ts
 function getPropertyDescriptorForReqSession(session) {
@@ -62,4 +58,4 @@ function ironSession(sessionOptions) {
 0 && (module.exports = {
   ironSession
 });
-//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/express/dist/index.js.map

@@ -1,7 +1 @@
-{
-  "version": 3,
-  "sources": ["../index.ts", "../../src/getPropertyDescriptorForReqSession.ts"],
-  "sourcesContent": ["import type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport type { Request, Response, NextFunction } from \"express\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\n\nexport function ironSession(\n  sessionOptions: IronSessionOptions,\n): (req: Request, res: Response, next: NextFunction) => Promise<void> {\n  return async function ironSessionMiddleware(req, res, next) {\n    const session = await getIronSession(req, res, sessionOptions);\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n\n    next();\n  };\n}\n", "import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AACA,0BAA+B;;;ACChB,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA;AAAA,IAET,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK;AACzB,YAAM,cAAc,OAAO,KAAK;AAEhC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,MAAM;AAEvB,iBAAO,QAAQ;AAAA;AAAA;AAInB,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA;AAAA;AAAA;AAAA;;;ADlBtB,qBACL,gBACoE;AACpE,SAAO,qCAAqC,KAAK,KAAK,MAAM;AAC1D,UAAM,UAAU,MAAM,wCAAe,KAAK,KAAK;AAC/C,WAAO,eACL,KACA,WACA,mCAAmC;AAGrC;AAAA;AAAA;",
-  "names": []
-}
+{"version":3,"sources":["../index.ts","../../src/getPropertyDescriptorForReqSession.ts"],"sourcesContent":["import type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport type { Request, Response, NextFunction } from \"express\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\n\nexport function ironSession(\n  sessionOptions: IronSessionOptions,\n): (req: Request, res: Response, next: NextFunction) => Promise<void> {\n  return async function ironSessionMiddleware(req, res, next) {\n    const session = await getIronSession(req, res, sessionOptions);\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n\n    next();\n  };\n}\n","import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,0BAA+B;;;ACChB,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA,IACT;AAAA,IACA,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK,KAAK;AAC9B,YAAM,cAAc,OAAO,KAAK,OAAO;AAEvC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,GAAG,GAAG;AAEvB,iBAAO,QAAQ;AAAA,QACjB;AAAA,MACF,CAAC;AAED,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ADtBO,qBACL,gBACoE;AACpE,SAAO,qCAAqC,KAAK,KAAK,MAAM;AAC1D,UAAM,UAAU,MAAM,wCAAe,KAAK,KAAK,cAAc;AAC7D,WAAO,eACL,KACA,WACA,mCAAmC,OAAO,CAC5C;AAEA,SAAK;AAAA,EACP;AACF;","names":[]}

package/express/dist/index.mjs

@@ -34,4 +34,4 @@ function ironSession(sessionOptions) {
 export {
   ironSession
 };
-//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map

package/express/dist/index.mjs.map

@@ -1,7 +1 @@
-{
-  "version": 3,
-  "sources": ["../index.ts", "../../src/getPropertyDescriptorForReqSession.ts"],
-  "sourcesContent": ["import type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport type { Request, Response, NextFunction } from \"express\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\n\nexport function ironSession(\n  sessionOptions: IronSessionOptions,\n): (req: Request, res: Response, next: NextFunction) => Promise<void> {\n  return async function ironSessionMiddleware(req, res, next) {\n    const session = await getIronSession(req, res, sessionOptions);\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n\n    next();\n  };\n}\n", "import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],
-  "mappings": ";AACA;;;ACCe,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA;AAAA,IAET,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK;AACzB,YAAM,cAAc,OAAO,KAAK;AAEhC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,MAAM;AAEvB,iBAAO,QAAQ;AAAA;AAAA;AAInB,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA;AAAA;AAAA;AAAA;;;ADlBtB,qBACL,gBACoE;AACpE,SAAO,qCAAqC,KAAK,KAAK,MAAM;AAC1D,UAAM,UAAU,MAAM,eAAe,KAAK,KAAK;AAC/C,WAAO,eACL,KACA,WACA,mCAAmC;AAGrC;AAAA;AAAA;",
-  "names": []
-}
+{"version":3,"sources":["../index.ts","../../src/getPropertyDescriptorForReqSession.ts"],"sourcesContent":["import type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport type { Request, Response, NextFunction } from \"express\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\n\nexport function ironSession(\n  sessionOptions: IronSessionOptions,\n): (req: Request, res: Response, next: NextFunction) => Promise<void> {\n  return async function ironSessionMiddleware(req, res, next) {\n    const session = await getIronSession(req, res, sessionOptions);\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n\n    next();\n  };\n}\n","import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],"mappings":";AACA;;;ACCe,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA,IACT;AAAA,IACA,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK,KAAK;AAC9B,YAAM,cAAc,OAAO,KAAK,OAAO;AAEvC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,GAAG,GAAG;AAEvB,iBAAO,QAAQ;AAAA,QACjB;AAAA,MACF,CAAC;AAED,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ADtBO,qBACL,gBACoE;AACpE,SAAO,qCAAqC,KAAK,KAAK,MAAM;AAC1D,UAAM,UAAU,MAAM,eAAe,KAAK,KAAK,cAAc;AAC7D,WAAO,eACL,KACA,WACA,mCAAmC,OAAO,CAC5C;AAEA,SAAK;AAAA,EACP;AACF;","names":[]}

package/express/index.js

@@ -1,32 +1,28 @@
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __markAsModule = (target) => __defProp(target, "__esModule", { value: true });
 var __export = (target, all) => {
-  __markAsModule(target);
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
-var __reExport = (target, module2, desc) => {
-  if (module2 && typeof module2 === "object" || typeof module2 === "function") {
-    for (let key of __getOwnPropNames(module2))
-      if (!__hasOwnProp.call(target, key) && key !== "default")
-        __defProp(target, key, { get: () => module2[key], enumerable: !(desc = __getOwnPropDesc(module2, key)) || desc.enumerable });
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
   }
-  return target;
-};
-var __toModule = (module2) => {
-  return __reExport(__markAsModule(__defProp(module2 != null ? __create(__getProtoOf(module2)) : {}, "default", module2 && module2.__esModule && "default" in module2 ? { get: () => module2.default, enumerable: true } : { value: module2, enumerable: true })), module2);
+  return to;
 };
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // express/index.ts
-__export(exports, {
+var express_exports = {};
+__export(express_exports, {
   ironSession: () => ironSession
 });
-var import_iron_session = __toModule(require("iron-session"));
+module.exports = __toCommonJS(express_exports);
+var import_iron_session = require("iron-session");
 
 // src/getPropertyDescriptorForReqSession.ts
 function getPropertyDescriptorForReqSession(session) {
@@ -62,4 +58,4 @@ function ironSession(sessionOptions) {
 0 && (module.exports = {
   ironSession
 });
-//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/express/index.js.map

@@ -1,7 +1 @@
-{
-  "version": 3,
-  "sources": ["../index.ts", "../../src/getPropertyDescriptorForReqSession.ts"],
-  "sourcesContent": ["import type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport type { Request, Response, NextFunction } from \"express\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\n\nexport function ironSession(\n  sessionOptions: IronSessionOptions,\n): (req: Request, res: Response, next: NextFunction) => Promise<void> {\n  return async function ironSessionMiddleware(req, res, next) {\n    const session = await getIronSession(req, res, sessionOptions);\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n\n    next();\n  };\n}\n", "import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AACA,0BAA+B;;;ACChB,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA;AAAA,IAET,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK;AACzB,YAAM,cAAc,OAAO,KAAK;AAEhC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,MAAM;AAEvB,iBAAO,QAAQ;AAAA;AAAA;AAInB,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA;AAAA;AAAA;AAAA;;;ADlBtB,qBACL,gBACoE;AACpE,SAAO,qCAAqC,KAAK,KAAK,MAAM;AAC1D,UAAM,UAAU,MAAM,wCAAe,KAAK,KAAK;AAC/C,WAAO,eACL,KACA,WACA,mCAAmC;AAGrC;AAAA;AAAA;",
-  "names": []
-}
+{"version":3,"sources":["../index.ts","../../src/getPropertyDescriptorForReqSession.ts"],"sourcesContent":["import type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport type { Request, Response, NextFunction } from \"express\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\n\nexport function ironSession(\n  sessionOptions: IronSessionOptions,\n): (req: Request, res: Response, next: NextFunction) => Promise<void> {\n  return async function ironSessionMiddleware(req, res, next) {\n    const session = await getIronSession(req, res, sessionOptions);\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n\n    next();\n  };\n}\n","import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AACA,0BAA+B;;;ACChB,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA,IACT;AAAA,IACA,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK,KAAK;AAC9B,YAAM,cAAc,OAAO,KAAK,OAAO;AAEvC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,GAAG,GAAG;AAEvB,iBAAO,QAAQ;AAAA,QACjB;AAAA,MACF,CAAC;AAED,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ADtBO,qBACL,gBACoE;AACpE,SAAO,qCAAqC,KAAK,KAAK,MAAM;AAC1D,UAAM,UAAU,MAAM,wCAAe,KAAK,KAAK,cAAc;AAC7D,WAAO,eACL,KACA,WACA,mCAAmC,OAAO,CAC5C;AAEA,SAAK;AAAA,EACP;AACF;","names":[]}

package/express/index.mjs

@@ -34,4 +34,4 @@ function ironSession(sessionOptions) {
 export {
   ironSession
 };
-//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map

package/express/index.mjs.map

@@ -1,7 +1 @@
-{
-  "version": 3,
-  "sources": ["../index.ts", "../../src/getPropertyDescriptorForReqSession.ts"],
-  "sourcesContent": ["import type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport type { Request, Response, NextFunction } from \"express\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\n\nexport function ironSession(\n  sessionOptions: IronSessionOptions,\n): (req: Request, res: Response, next: NextFunction) => Promise<void> {\n  return async function ironSessionMiddleware(req, res, next) {\n    const session = await getIronSession(req, res, sessionOptions);\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n\n    next();\n  };\n}\n", "import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],
-  "mappings": ";AACA;;;ACCe,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA;AAAA,IAET,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK;AACzB,YAAM,cAAc,OAAO,KAAK;AAEhC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,MAAM;AAEvB,iBAAO,QAAQ;AAAA;AAAA;AAInB,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA;AAAA;AAAA;AAAA;;;ADlBtB,qBACL,gBACoE;AACpE,SAAO,qCAAqC,KAAK,KAAK,MAAM;AAC1D,UAAM,UAAU,MAAM,eAAe,KAAK,KAAK;AAC/C,WAAO,eACL,KACA,WACA,mCAAmC;AAGrC;AAAA;AAAA;",
-  "names": []
-}
+{"version":3,"sources":["../index.ts","../../src/getPropertyDescriptorForReqSession.ts"],"sourcesContent":["import type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport type { Request, Response, NextFunction } from \"express\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\n\nexport function ironSession(\n  sessionOptions: IronSessionOptions,\n): (req: Request, res: Response, next: NextFunction) => Promise<void> {\n  return async function ironSessionMiddleware(req, res, next) {\n    const session = await getIronSession(req, res, sessionOptions);\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n\n    next();\n  };\n}\n","import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],"mappings":";AACA;;;ACCe,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA,IACT;AAAA,IACA,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK,KAAK;AAC9B,YAAM,cAAc,OAAO,KAAK,OAAO;AAEvC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,GAAG,GAAG;AAEvB,iBAAO,QAAQ;AAAA,QACjB;AAAA,MACF,CAAC;AAED,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ADtBO,qBACL,gBACoE;AACpE,SAAO,qCAAqC,KAAK,KAAK,MAAM;AAC1D,UAAM,UAAU,MAAM,eAAe,KAAK,KAAK,cAAc;AAC7D,WAAO,eACL,KACA,WACA,mCAAmC,OAAO,CAC5C;AAEA,SAAK;AAAA,EACP;AACF;","names":[]}

package/next/dist/index.js

@@ -1,33 +1,29 @@
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __markAsModule = (target) => __defProp(target, "__esModule", { value: true });
 var __export = (target, all) => {
-  __markAsModule(target);
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
-var __reExport = (target, module2, desc) => {
-  if (module2 && typeof module2 === "object" || typeof module2 === "function") {
-    for (let key of __getOwnPropNames(module2))
-      if (!__hasOwnProp.call(target, key) && key !== "default")
-        __defProp(target, key, { get: () => module2[key], enumerable: !(desc = __getOwnPropDesc(module2, key)) || desc.enumerable });
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
   }
-  return target;
-};
-var __toModule = (module2) => {
-  return __reExport(__markAsModule(__defProp(module2 != null ? __create(__getProtoOf(module2)) : {}, "default", module2 && module2.__esModule && "default" in module2 ? { get: () => module2.default, enumerable: true } : { value: module2, enumerable: true })), module2);
+  return to;
 };
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // next/index.ts
-__export(exports, {
+var next_exports = {};
+__export(next_exports, {
   withIronSessionApiRoute: () => withIronSessionApiRoute,
   withIronSessionSsr: () => withIronSessionSsr
 });
-var import_iron_session = __toModule(require("iron-session"));
+module.exports = __toCommonJS(next_exports);
+var import_iron_session = require("iron-session");
 
 // src/getPropertyDescriptorForReqSession.ts
 function getPropertyDescriptorForReqSession(session) {
@@ -83,4 +79,4 @@ function withIronSessionSsr(handler, options) {
   withIronSessionApiRoute,
   withIronSessionSsr
 });
-//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/next/dist/index.js.map

@@ -1,7 +1 @@
-{
-  "version": 3,
-  "sources": ["../index.ts", "../../src/getPropertyDescriptorForReqSession.ts"],
-  "sourcesContent": ["import type {\n  NextApiHandler,\n  GetServerSidePropsContext,\n  GetServerSidePropsResult,\n  NextApiRequest,\n  NextApiResponse,\n} from \"next\";\nimport type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\nimport { IncomingMessage, ServerResponse } from \"http\";\n\n// Argument types based on getIronSession function\ntype GetIronSessionApiOptions = (\n  request: NextApiRequest,\n  response: NextApiResponse,\n) => Promise<IronSessionOptions> | IronSessionOptions;\n\nexport function withIronSessionApiRoute(\n  handler: NextApiHandler,\n  options: IronSessionOptions | GetIronSessionApiOptions,\n): NextApiHandler {\n  return async function nextApiHandlerWrappedWithIronSession(req, res) {\n    let sessionOptions: IronSessionOptions;\n\n    // If options is a function, call it and assign the results back.\n    if (options instanceof Function) {\n      sessionOptions = await options(req, res);\n    } else {\n      sessionOptions = options;\n    }\n\n    const session = await getIronSession(req, res, sessionOptions);\n\n    // we define req.session as being enumerable (so console.log(req) shows it)\n    // and we also want to allow people to do:\n    // req.session = { admin: true }; or req.session = {...req.session, admin: true};\n    // req.session.save();\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(req, res);\n  };\n}\n\n// Argument type based on the SSR context\ntype GetIronSessionSSROptions = (\n  request: IncomingMessage,\n  response: ServerResponse,\n) => Promise<IronSessionOptions> | IronSessionOptions;\n\nexport function withIronSessionSsr<\n  P extends { [key: string]: unknown } = { [key: string]: unknown },\n>(\n  handler: (\n    context: GetServerSidePropsContext,\n  ) => GetServerSidePropsResult<P> | Promise<GetServerSidePropsResult<P>>,\n  options: IronSessionOptions | GetIronSessionSSROptions,\n) {\n  return async function nextGetServerSidePropsHandlerWrappedWithIronSession(\n    context: GetServerSidePropsContext,\n  ) {\n    let sessionOptions: IronSessionOptions;\n\n    // If options is a function, call it and assign the results back.\n    if (options instanceof Function) {\n      sessionOptions = await options(context.req, context.res);\n    } else {\n      sessionOptions = options;\n    }\n\n    const session = await getIronSession(\n      context.req,\n      context.res,\n      sessionOptions,\n    );\n\n    Object.defineProperty(\n      context.req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(context);\n  };\n}\n", "import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAQA,0BAA+B;;;ACNhB,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA;AAAA,IAET,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK;AACzB,YAAM,cAAc,OAAO,KAAK;AAEhC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,MAAM;AAEvB,iBAAO,QAAQ;AAAA;AAAA;AAInB,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA;AAAA;AAAA;AAAA;;;ADLtB,iCACL,SACA,SACgB;AAChB,SAAO,oDAAoD,KAAK,KAAK;AACnE,QAAI;AAGJ,QAAI,mBAAmB,UAAU;AAC/B,uBAAiB,MAAM,QAAQ,KAAK;AAAA,WAC/B;AACL,uBAAiB;AAAA;AAGnB,UAAM,UAAU,MAAM,wCAAe,KAAK,KAAK;AAM/C,WAAO,eACL,KACA,WACA,mCAAmC;AAErC,WAAO,QAAQ,KAAK;AAAA;AAAA;AAUjB,4BAGL,SAGA,SACA;AACA,SAAO,mEACL,SACA;AACA,QAAI;AAGJ,QAAI,mBAAmB,UAAU;AAC/B,uBAAiB,MAAM,QAAQ,QAAQ,KAAK,QAAQ;AAAA,WAC/C;AACL,uBAAiB;AAAA;AAGnB,UAAM,UAAU,MAAM,wCACpB,QAAQ,KACR,QAAQ,KACR;AAGF,WAAO,eACL,QAAQ,KACR,WACA,mCAAmC;AAErC,WAAO,QAAQ;AAAA;AAAA;",
-  "names": []
-}
+{"version":3,"sources":["../index.ts","../../src/getPropertyDescriptorForReqSession.ts"],"sourcesContent":["import type {\n  NextApiHandler,\n  GetServerSidePropsContext,\n  GetServerSidePropsResult,\n  NextApiRequest,\n  NextApiResponse,\n} from \"next\";\nimport type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\nimport { IncomingMessage, ServerResponse } from \"http\";\n\n// Argument types based on getIronSession function\ntype GetIronSessionApiOptions = (\n  request: NextApiRequest,\n  response: NextApiResponse,\n) => Promise<IronSessionOptions> | IronSessionOptions;\n\nexport function withIronSessionApiRoute(\n  handler: NextApiHandler,\n  options: IronSessionOptions | GetIronSessionApiOptions,\n): NextApiHandler {\n  return async function nextApiHandlerWrappedWithIronSession(req, res) {\n    let sessionOptions: IronSessionOptions;\n\n    // If options is a function, call it and assign the results back.\n    if (options instanceof Function) {\n      sessionOptions = await options(req, res);\n    } else {\n      sessionOptions = options;\n    }\n\n    const session = await getIronSession(req, res, sessionOptions);\n\n    // we define req.session as being enumerable (so console.log(req) shows it)\n    // and we also want to allow people to do:\n    // req.session = { admin: true }; or req.session = {...req.session, admin: true};\n    // req.session.save();\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(req, res);\n  };\n}\n\n// Argument type based on the SSR context\ntype GetIronSessionSSROptions = (\n  request: IncomingMessage,\n  response: ServerResponse,\n) => Promise<IronSessionOptions> | IronSessionOptions;\n\nexport function withIronSessionSsr<\n  P extends { [key: string]: unknown } = { [key: string]: unknown },\n>(\n  handler: (\n    context: GetServerSidePropsContext,\n  ) => GetServerSidePropsResult<P> | Promise<GetServerSidePropsResult<P>>,\n  options: IronSessionOptions | GetIronSessionSSROptions,\n) {\n  return async function nextGetServerSidePropsHandlerWrappedWithIronSession(\n    context: GetServerSidePropsContext,\n  ) {\n    let sessionOptions: IronSessionOptions;\n\n    // If options is a function, call it and assign the results back.\n    if (options instanceof Function) {\n      sessionOptions = await options(context.req, context.res);\n    } else {\n      sessionOptions = options;\n    }\n\n    const session = await getIronSession(\n      context.req,\n      context.res,\n      sessionOptions,\n    );\n\n    Object.defineProperty(\n      context.req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(context);\n  };\n}\n","import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQA,0BAA+B;;;ACNhB,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA,IACT;AAAA,IACA,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK,KAAK;AAC9B,YAAM,cAAc,OAAO,KAAK,OAAO;AAEvC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,GAAG,GAAG;AAEvB,iBAAO,QAAQ;AAAA,QACjB;AAAA,MACF,CAAC;AAED,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ADTO,iCACL,SACA,SACgB;AAChB,SAAO,oDAAoD,KAAK,KAAK;AACnE,QAAI;AAGJ,QAAI,mBAAmB,UAAU;AAC/B,uBAAiB,MAAM,QAAQ,KAAK,GAAG;AAAA,IACzC,OAAO;AACL,uBAAiB;AAAA,IACnB;AAEA,UAAM,UAAU,MAAM,wCAAe,KAAK,KAAK,cAAc;AAM7D,WAAO,eACL,KACA,WACA,mCAAmC,OAAO,CAC5C;AACA,WAAO,QAAQ,KAAK,GAAG;AAAA,EACzB;AACF;AAQO,4BAGL,SAGA,SACA;AACA,SAAO,mEACL,SACA;AACA,QAAI;AAGJ,QAAI,mBAAmB,UAAU;AAC/B,uBAAiB,MAAM,QAAQ,QAAQ,KAAK,QAAQ,GAAG;AAAA,IACzD,OAAO;AACL,uBAAiB;AAAA,IACnB;AAEA,UAAM,UAAU,MAAM,wCACpB,QAAQ,KACR,QAAQ,KACR,cACF;AAEA,WAAO,eACL,QAAQ,KACR,WACA,mCAAmC,OAAO,CAC5C;AACA,WAAO,QAAQ,OAAO;AAAA,EACxB;AACF;","names":[]}

package/next/dist/index.mjs

@@ -54,4 +54,4 @@ export {
   withIronSessionApiRoute,
   withIronSessionSsr
 };
-//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map

package/next/dist/index.mjs.map

@@ -1,7 +1 @@
-{
-  "version": 3,
-  "sources": ["../index.ts", "../../src/getPropertyDescriptorForReqSession.ts"],
-  "sourcesContent": ["import type {\n  NextApiHandler,\n  GetServerSidePropsContext,\n  GetServerSidePropsResult,\n  NextApiRequest,\n  NextApiResponse,\n} from \"next\";\nimport type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\nimport { IncomingMessage, ServerResponse } from \"http\";\n\n// Argument types based on getIronSession function\ntype GetIronSessionApiOptions = (\n  request: NextApiRequest,\n  response: NextApiResponse,\n) => Promise<IronSessionOptions> | IronSessionOptions;\n\nexport function withIronSessionApiRoute(\n  handler: NextApiHandler,\n  options: IronSessionOptions | GetIronSessionApiOptions,\n): NextApiHandler {\n  return async function nextApiHandlerWrappedWithIronSession(req, res) {\n    let sessionOptions: IronSessionOptions;\n\n    // If options is a function, call it and assign the results back.\n    if (options instanceof Function) {\n      sessionOptions = await options(req, res);\n    } else {\n      sessionOptions = options;\n    }\n\n    const session = await getIronSession(req, res, sessionOptions);\n\n    // we define req.session as being enumerable (so console.log(req) shows it)\n    // and we also want to allow people to do:\n    // req.session = { admin: true }; or req.session = {...req.session, admin: true};\n    // req.session.save();\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(req, res);\n  };\n}\n\n// Argument type based on the SSR context\ntype GetIronSessionSSROptions = (\n  request: IncomingMessage,\n  response: ServerResponse,\n) => Promise<IronSessionOptions> | IronSessionOptions;\n\nexport function withIronSessionSsr<\n  P extends { [key: string]: unknown } = { [key: string]: unknown },\n>(\n  handler: (\n    context: GetServerSidePropsContext,\n  ) => GetServerSidePropsResult<P> | Promise<GetServerSidePropsResult<P>>,\n  options: IronSessionOptions | GetIronSessionSSROptions,\n) {\n  return async function nextGetServerSidePropsHandlerWrappedWithIronSession(\n    context: GetServerSidePropsContext,\n  ) {\n    let sessionOptions: IronSessionOptions;\n\n    // If options is a function, call it and assign the results back.\n    if (options instanceof Function) {\n      sessionOptions = await options(context.req, context.res);\n    } else {\n      sessionOptions = options;\n    }\n\n    const session = await getIronSession(\n      context.req,\n      context.res,\n      sessionOptions,\n    );\n\n    Object.defineProperty(\n      context.req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(context);\n  };\n}\n", "import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],
-  "mappings": ";AAQA;;;ACNe,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA;AAAA,IAET,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK;AACzB,YAAM,cAAc,OAAO,KAAK;AAEhC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,MAAM;AAEvB,iBAAO,QAAQ;AAAA;AAAA;AAInB,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA;AAAA;AAAA;AAAA;;;ADLtB,iCACL,SACA,SACgB;AAChB,SAAO,oDAAoD,KAAK,KAAK;AACnE,QAAI;AAGJ,QAAI,mBAAmB,UAAU;AAC/B,uBAAiB,MAAM,QAAQ,KAAK;AAAA,WAC/B;AACL,uBAAiB;AAAA;AAGnB,UAAM,UAAU,MAAM,eAAe,KAAK,KAAK;AAM/C,WAAO,eACL,KACA,WACA,mCAAmC;AAErC,WAAO,QAAQ,KAAK;AAAA;AAAA;AAUjB,4BAGL,SAGA,SACA;AACA,SAAO,mEACL,SACA;AACA,QAAI;AAGJ,QAAI,mBAAmB,UAAU;AAC/B,uBAAiB,MAAM,QAAQ,QAAQ,KAAK,QAAQ;AAAA,WAC/C;AACL,uBAAiB;AAAA;AAGnB,UAAM,UAAU,MAAM,eACpB,QAAQ,KACR,QAAQ,KACR;AAGF,WAAO,eACL,QAAQ,KACR,WACA,mCAAmC;AAErC,WAAO,QAAQ;AAAA;AAAA;",
-  "names": []
-}
+{"version":3,"sources":["../index.ts","../../src/getPropertyDescriptorForReqSession.ts"],"sourcesContent":["import type {\n  NextApiHandler,\n  GetServerSidePropsContext,\n  GetServerSidePropsResult,\n  NextApiRequest,\n  NextApiResponse,\n} from \"next\";\nimport type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\nimport { IncomingMessage, ServerResponse } from \"http\";\n\n// Argument types based on getIronSession function\ntype GetIronSessionApiOptions = (\n  request: NextApiRequest,\n  response: NextApiResponse,\n) => Promise<IronSessionOptions> | IronSessionOptions;\n\nexport function withIronSessionApiRoute(\n  handler: NextApiHandler,\n  options: IronSessionOptions | GetIronSessionApiOptions,\n): NextApiHandler {\n  return async function nextApiHandlerWrappedWithIronSession(req, res) {\n    let sessionOptions: IronSessionOptions;\n\n    // If options is a function, call it and assign the results back.\n    if (options instanceof Function) {\n      sessionOptions = await options(req, res);\n    } else {\n      sessionOptions = options;\n    }\n\n    const session = await getIronSession(req, res, sessionOptions);\n\n    // we define req.session as being enumerable (so console.log(req) shows it)\n    // and we also want to allow people to do:\n    // req.session = { admin: true }; or req.session = {...req.session, admin: true};\n    // req.session.save();\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(req, res);\n  };\n}\n\n// Argument type based on the SSR context\ntype GetIronSessionSSROptions = (\n  request: IncomingMessage,\n  response: ServerResponse,\n) => Promise<IronSessionOptions> | IronSessionOptions;\n\nexport function withIronSessionSsr<\n  P extends { [key: string]: unknown } = { [key: string]: unknown },\n>(\n  handler: (\n    context: GetServerSidePropsContext,\n  ) => GetServerSidePropsResult<P> | Promise<GetServerSidePropsResult<P>>,\n  options: IronSessionOptions | GetIronSessionSSROptions,\n) {\n  return async function nextGetServerSidePropsHandlerWrappedWithIronSession(\n    context: GetServerSidePropsContext,\n  ) {\n    let sessionOptions: IronSessionOptions;\n\n    // If options is a function, call it and assign the results back.\n    if (options instanceof Function) {\n      sessionOptions = await options(context.req, context.res);\n    } else {\n      sessionOptions = options;\n    }\n\n    const session = await getIronSession(\n      context.req,\n      context.res,\n      sessionOptions,\n    );\n\n    Object.defineProperty(\n      context.req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(context);\n  };\n}\n","import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],"mappings":";AAQA;;;ACNe,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA,IACT;AAAA,IACA,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK,KAAK;AAC9B,YAAM,cAAc,OAAO,KAAK,OAAO;AAEvC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,GAAG,GAAG;AAEvB,iBAAO,QAAQ;AAAA,QACjB;AAAA,MACF,CAAC;AAED,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ADTO,iCACL,SACA,SACgB;AAChB,SAAO,oDAAoD,KAAK,KAAK;AACnE,QAAI;AAGJ,QAAI,mBAAmB,UAAU;AAC/B,uBAAiB,MAAM,QAAQ,KAAK,GAAG;AAAA,IACzC,OAAO;AACL,uBAAiB;AAAA,IACnB;AAEA,UAAM,UAAU,MAAM,eAAe,KAAK,KAAK,cAAc;AAM7D,WAAO,eACL,KACA,WACA,mCAAmC,OAAO,CAC5C;AACA,WAAO,QAAQ,KAAK,GAAG;AAAA,EACzB;AACF;AAQO,4BAGL,SAGA,SACA;AACA,SAAO,mEACL,SACA;AACA,QAAI;AAGJ,QAAI,mBAAmB,UAAU;AAC/B,uBAAiB,MAAM,QAAQ,QAAQ,KAAK,QAAQ,GAAG;AAAA,IACzD,OAAO;AACL,uBAAiB;AAAA,IACnB;AAEA,UAAM,UAAU,MAAM,eACpB,QAAQ,KACR,QAAQ,KACR,cACF;AAEA,WAAO,eACL,QAAQ,KACR,WACA,mCAAmC,OAAO,CAC5C;AACA,WAAO,QAAQ,OAAO;AAAA,EACxB;AACF;","names":[]}

package/next/index.js

@@ -1,33 +1,29 @@
-var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __markAsModule = (target) => __defProp(target, "__esModule", { value: true });
 var __export = (target, all) => {
-  __markAsModule(target);
   for (var name in all)
     __defProp(target, name, { get: all[name], enumerable: true });
 };
-var __reExport = (target, module2, desc) => {
-  if (module2 && typeof module2 === "object" || typeof module2 === "function") {
-    for (let key of __getOwnPropNames(module2))
-      if (!__hasOwnProp.call(target, key) && key !== "default")
-        __defProp(target, key, { get: () => module2[key], enumerable: !(desc = __getOwnPropDesc(module2, key)) || desc.enumerable });
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
   }
-  return target;
-};
-var __toModule = (module2) => {
-  return __reExport(__markAsModule(__defProp(module2 != null ? __create(__getProtoOf(module2)) : {}, "default", module2 && module2.__esModule && "default" in module2 ? { get: () => module2.default, enumerable: true } : { value: module2, enumerable: true })), module2);
+  return to;
 };
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // next/index.ts
-__export(exports, {
+var next_exports = {};
+__export(next_exports, {
   withIronSessionApiRoute: () => withIronSessionApiRoute,
   withIronSessionSsr: () => withIronSessionSsr
 });
-var import_iron_session = __toModule(require("iron-session"));
+module.exports = __toCommonJS(next_exports);
+var import_iron_session = require("iron-session");
 
 // src/getPropertyDescriptorForReqSession.ts
 function getPropertyDescriptorForReqSession(session) {
@@ -83,4 +79,4 @@ function withIronSessionSsr(handler, options) {
   withIronSessionApiRoute,
   withIronSessionSsr
 });
-//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/next/index.js.map

@@ -1,7 +1 @@
-{
-  "version": 3,
-  "sources": ["../index.ts", "../../src/getPropertyDescriptorForReqSession.ts"],
-  "sourcesContent": ["import type {\n  NextApiHandler,\n  GetServerSidePropsContext,\n  GetServerSidePropsResult,\n  NextApiRequest,\n  NextApiResponse,\n} from \"next\";\nimport type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\nimport { IncomingMessage, ServerResponse } from \"http\";\n\n// Argument types based on getIronSession function\ntype GetIronSessionApiOptions = (\n  request: NextApiRequest,\n  response: NextApiResponse,\n) => Promise<IronSessionOptions> | IronSessionOptions;\n\nexport function withIronSessionApiRoute(\n  handler: NextApiHandler,\n  options: IronSessionOptions | GetIronSessionApiOptions,\n): NextApiHandler {\n  return async function nextApiHandlerWrappedWithIronSession(req, res) {\n    let sessionOptions: IronSessionOptions;\n\n    // If options is a function, call it and assign the results back.\n    if (options instanceof Function) {\n      sessionOptions = await options(req, res);\n    } else {\n      sessionOptions = options;\n    }\n\n    const session = await getIronSession(req, res, sessionOptions);\n\n    // we define req.session as being enumerable (so console.log(req) shows it)\n    // and we also want to allow people to do:\n    // req.session = { admin: true }; or req.session = {...req.session, admin: true};\n    // req.session.save();\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(req, res);\n  };\n}\n\n// Argument type based on the SSR context\ntype GetIronSessionSSROptions = (\n  request: IncomingMessage,\n  response: ServerResponse,\n) => Promise<IronSessionOptions> | IronSessionOptions;\n\nexport function withIronSessionSsr<\n  P extends { [key: string]: unknown } = { [key: string]: unknown },\n>(\n  handler: (\n    context: GetServerSidePropsContext,\n  ) => GetServerSidePropsResult<P> | Promise<GetServerSidePropsResult<P>>,\n  options: IronSessionOptions | GetIronSessionSSROptions,\n) {\n  return async function nextGetServerSidePropsHandlerWrappedWithIronSession(\n    context: GetServerSidePropsContext,\n  ) {\n    let sessionOptions: IronSessionOptions;\n\n    // If options is a function, call it and assign the results back.\n    if (options instanceof Function) {\n      sessionOptions = await options(context.req, context.res);\n    } else {\n      sessionOptions = options;\n    }\n\n    const session = await getIronSession(\n      context.req,\n      context.res,\n      sessionOptions,\n    );\n\n    Object.defineProperty(\n      context.req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(context);\n  };\n}\n", "import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAQA,0BAA+B;;;ACNhB,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA;AAAA,IAET,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK;AACzB,YAAM,cAAc,OAAO,KAAK;AAEhC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,MAAM;AAEvB,iBAAO,QAAQ;AAAA;AAAA;AAInB,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA;AAAA;AAAA;AAAA;;;ADLtB,iCACL,SACA,SACgB;AAChB,SAAO,oDAAoD,KAAK,KAAK;AACnE,QAAI;AAGJ,QAAI,mBAAmB,UAAU;AAC/B,uBAAiB,MAAM,QAAQ,KAAK;AAAA,WAC/B;AACL,uBAAiB;AAAA;AAGnB,UAAM,UAAU,MAAM,wCAAe,KAAK,KAAK;AAM/C,WAAO,eACL,KACA,WACA,mCAAmC;AAErC,WAAO,QAAQ,KAAK;AAAA;AAAA;AAUjB,4BAGL,SAGA,SACA;AACA,SAAO,mEACL,SACA;AACA,QAAI;AAGJ,QAAI,mBAAmB,UAAU;AAC/B,uBAAiB,MAAM,QAAQ,QAAQ,KAAK,QAAQ;AAAA,WAC/C;AACL,uBAAiB;AAAA;AAGnB,UAAM,UAAU,MAAM,wCACpB,QAAQ,KACR,QAAQ,KACR;AAGF,WAAO,eACL,QAAQ,KACR,WACA,mCAAmC;AAErC,WAAO,QAAQ;AAAA;AAAA;",
-  "names": []
-}
+{"version":3,"sources":["../index.ts","../../src/getPropertyDescriptorForReqSession.ts"],"sourcesContent":["import type {\n  NextApiHandler,\n  GetServerSidePropsContext,\n  GetServerSidePropsResult,\n  NextApiRequest,\n  NextApiResponse,\n} from \"next\";\nimport type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\nimport { IncomingMessage, ServerResponse } from \"http\";\n\n// Argument types based on getIronSession function\ntype GetIronSessionApiOptions = (\n  request: NextApiRequest,\n  response: NextApiResponse,\n) => Promise<IronSessionOptions> | IronSessionOptions;\n\nexport function withIronSessionApiRoute(\n  handler: NextApiHandler,\n  options: IronSessionOptions | GetIronSessionApiOptions,\n): NextApiHandler {\n  return async function nextApiHandlerWrappedWithIronSession(req, res) {\n    let sessionOptions: IronSessionOptions;\n\n    // If options is a function, call it and assign the results back.\n    if (options instanceof Function) {\n      sessionOptions = await options(req, res);\n    } else {\n      sessionOptions = options;\n    }\n\n    const session = await getIronSession(req, res, sessionOptions);\n\n    // we define req.session as being enumerable (so console.log(req) shows it)\n    // and we also want to allow people to do:\n    // req.session = { admin: true }; or req.session = {...req.session, admin: true};\n    // req.session.save();\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(req, res);\n  };\n}\n\n// Argument type based on the SSR context\ntype GetIronSessionSSROptions = (\n  request: IncomingMessage,\n  response: ServerResponse,\n) => Promise<IronSessionOptions> | IronSessionOptions;\n\nexport function withIronSessionSsr<\n  P extends { [key: string]: unknown } = { [key: string]: unknown },\n>(\n  handler: (\n    context: GetServerSidePropsContext,\n  ) => GetServerSidePropsResult<P> | Promise<GetServerSidePropsResult<P>>,\n  options: IronSessionOptions | GetIronSessionSSROptions,\n) {\n  return async function nextGetServerSidePropsHandlerWrappedWithIronSession(\n    context: GetServerSidePropsContext,\n  ) {\n    let sessionOptions: IronSessionOptions;\n\n    // If options is a function, call it and assign the results back.\n    if (options instanceof Function) {\n      sessionOptions = await options(context.req, context.res);\n    } else {\n      sessionOptions = options;\n    }\n\n    const session = await getIronSession(\n      context.req,\n      context.res,\n      sessionOptions,\n    );\n\n    Object.defineProperty(\n      context.req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(context);\n  };\n}\n","import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQA,0BAA+B;;;ACNhB,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA,IACT;AAAA,IACA,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK,KAAK;AAC9B,YAAM,cAAc,OAAO,KAAK,OAAO;AAEvC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,GAAG,GAAG;AAEvB,iBAAO,QAAQ;AAAA,QACjB;AAAA,MACF,CAAC;AAED,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ADTO,iCACL,SACA,SACgB;AAChB,SAAO,oDAAoD,KAAK,KAAK;AACnE,QAAI;AAGJ,QAAI,mBAAmB,UAAU;AAC/B,uBAAiB,MAAM,QAAQ,KAAK,GAAG;AAAA,IACzC,OAAO;AACL,uBAAiB;AAAA,IACnB;AAEA,UAAM,UAAU,MAAM,wCAAe,KAAK,KAAK,cAAc;AAM7D,WAAO,eACL,KACA,WACA,mCAAmC,OAAO,CAC5C;AACA,WAAO,QAAQ,KAAK,GAAG;AAAA,EACzB;AACF;AAQO,4BAGL,SAGA,SACA;AACA,SAAO,mEACL,SACA;AACA,QAAI;AAGJ,QAAI,mBAAmB,UAAU;AAC/B,uBAAiB,MAAM,QAAQ,QAAQ,KAAK,QAAQ,GAAG;AAAA,IACzD,OAAO;AACL,uBAAiB;AAAA,IACnB;AAEA,UAAM,UAAU,MAAM,wCACpB,QAAQ,KACR,QAAQ,KACR,cACF;AAEA,WAAO,eACL,QAAQ,KACR,WACA,mCAAmC,OAAO,CAC5C;AACA,WAAO,QAAQ,OAAO;AAAA,EACxB;AACF;","names":[]}

package/next/index.mjs

@@ -54,4 +54,4 @@ export {
   withIronSessionApiRoute,
   withIronSessionSsr
 };
-//# sourceMappingURL=index.mjs.map
+//# sourceMappingURL=index.mjs.map

package/next/index.mjs.map

@@ -1,7 +1 @@
-{
-  "version": 3,
-  "sources": ["../index.ts", "../../src/getPropertyDescriptorForReqSession.ts"],
-  "sourcesContent": ["import type {\n  NextApiHandler,\n  GetServerSidePropsContext,\n  GetServerSidePropsResult,\n  NextApiRequest,\n  NextApiResponse,\n} from \"next\";\nimport type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\nimport { IncomingMessage, ServerResponse } from \"http\";\n\n// Argument types based on getIronSession function\ntype GetIronSessionApiOptions = (\n  request: NextApiRequest,\n  response: NextApiResponse,\n) => Promise<IronSessionOptions> | IronSessionOptions;\n\nexport function withIronSessionApiRoute(\n  handler: NextApiHandler,\n  options: IronSessionOptions | GetIronSessionApiOptions,\n): NextApiHandler {\n  return async function nextApiHandlerWrappedWithIronSession(req, res) {\n    let sessionOptions: IronSessionOptions;\n\n    // If options is a function, call it and assign the results back.\n    if (options instanceof Function) {\n      sessionOptions = await options(req, res);\n    } else {\n      sessionOptions = options;\n    }\n\n    const session = await getIronSession(req, res, sessionOptions);\n\n    // we define req.session as being enumerable (so console.log(req) shows it)\n    // and we also want to allow people to do:\n    // req.session = { admin: true }; or req.session = {...req.session, admin: true};\n    // req.session.save();\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(req, res);\n  };\n}\n\n// Argument type based on the SSR context\ntype GetIronSessionSSROptions = (\n  request: IncomingMessage,\n  response: ServerResponse,\n) => Promise<IronSessionOptions> | IronSessionOptions;\n\nexport function withIronSessionSsr<\n  P extends { [key: string]: unknown } = { [key: string]: unknown },\n>(\n  handler: (\n    context: GetServerSidePropsContext,\n  ) => GetServerSidePropsResult<P> | Promise<GetServerSidePropsResult<P>>,\n  options: IronSessionOptions | GetIronSessionSSROptions,\n) {\n  return async function nextGetServerSidePropsHandlerWrappedWithIronSession(\n    context: GetServerSidePropsContext,\n  ) {\n    let sessionOptions: IronSessionOptions;\n\n    // If options is a function, call it and assign the results back.\n    if (options instanceof Function) {\n      sessionOptions = await options(context.req, context.res);\n    } else {\n      sessionOptions = options;\n    }\n\n    const session = await getIronSession(\n      context.req,\n      context.res,\n      sessionOptions,\n    );\n\n    Object.defineProperty(\n      context.req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(context);\n  };\n}\n", "import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],
-  "mappings": ";AAQA;;;ACNe,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA;AAAA,IAET,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK;AACzB,YAAM,cAAc,OAAO,KAAK;AAEhC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,MAAM;AAEvB,iBAAO,QAAQ;AAAA;AAAA;AAInB,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA;AAAA;AAAA;AAAA;;;ADLtB,iCACL,SACA,SACgB;AAChB,SAAO,oDAAoD,KAAK,KAAK;AACnE,QAAI;AAGJ,QAAI,mBAAmB,UAAU;AAC/B,uBAAiB,MAAM,QAAQ,KAAK;AAAA,WAC/B;AACL,uBAAiB;AAAA;AAGnB,UAAM,UAAU,MAAM,eAAe,KAAK,KAAK;AAM/C,WAAO,eACL,KACA,WACA,mCAAmC;AAErC,WAAO,QAAQ,KAAK;AAAA;AAAA;AAUjB,4BAGL,SAGA,SACA;AACA,SAAO,mEACL,SACA;AACA,QAAI;AAGJ,QAAI,mBAAmB,UAAU;AAC/B,uBAAiB,MAAM,QAAQ,QAAQ,KAAK,QAAQ;AAAA,WAC/C;AACL,uBAAiB;AAAA;AAGnB,UAAM,UAAU,MAAM,eACpB,QAAQ,KACR,QAAQ,KACR;AAGF,WAAO,eACL,QAAQ,KACR,WACA,mCAAmC;AAErC,WAAO,QAAQ;AAAA;AAAA;",
-  "names": []
-}
+{"version":3,"sources":["../index.ts","../../src/getPropertyDescriptorForReqSession.ts"],"sourcesContent":["import type {\n  NextApiHandler,\n  GetServerSidePropsContext,\n  GetServerSidePropsResult,\n  NextApiRequest,\n  NextApiResponse,\n} from \"next\";\nimport type { IronSessionOptions } from \"iron-session\";\nimport { getIronSession } from \"iron-session\";\nimport getPropertyDescriptorForReqSession from \"../src/getPropertyDescriptorForReqSession\";\nimport { IncomingMessage, ServerResponse } from \"http\";\n\n// Argument types based on getIronSession function\ntype GetIronSessionApiOptions = (\n  request: NextApiRequest,\n  response: NextApiResponse,\n) => Promise<IronSessionOptions> | IronSessionOptions;\n\nexport function withIronSessionApiRoute(\n  handler: NextApiHandler,\n  options: IronSessionOptions | GetIronSessionApiOptions,\n): NextApiHandler {\n  return async function nextApiHandlerWrappedWithIronSession(req, res) {\n    let sessionOptions: IronSessionOptions;\n\n    // If options is a function, call it and assign the results back.\n    if (options instanceof Function) {\n      sessionOptions = await options(req, res);\n    } else {\n      sessionOptions = options;\n    }\n\n    const session = await getIronSession(req, res, sessionOptions);\n\n    // we define req.session as being enumerable (so console.log(req) shows it)\n    // and we also want to allow people to do:\n    // req.session = { admin: true }; or req.session = {...req.session, admin: true};\n    // req.session.save();\n    Object.defineProperty(\n      req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(req, res);\n  };\n}\n\n// Argument type based on the SSR context\ntype GetIronSessionSSROptions = (\n  request: IncomingMessage,\n  response: ServerResponse,\n) => Promise<IronSessionOptions> | IronSessionOptions;\n\nexport function withIronSessionSsr<\n  P extends { [key: string]: unknown } = { [key: string]: unknown },\n>(\n  handler: (\n    context: GetServerSidePropsContext,\n  ) => GetServerSidePropsResult<P> | Promise<GetServerSidePropsResult<P>>,\n  options: IronSessionOptions | GetIronSessionSSROptions,\n) {\n  return async function nextGetServerSidePropsHandlerWrappedWithIronSession(\n    context: GetServerSidePropsContext,\n  ) {\n    let sessionOptions: IronSessionOptions;\n\n    // If options is a function, call it and assign the results back.\n    if (options instanceof Function) {\n      sessionOptions = await options(context.req, context.res);\n    } else {\n      sessionOptions = options;\n    }\n\n    const session = await getIronSession(\n      context.req,\n      context.res,\n      sessionOptions,\n    );\n\n    Object.defineProperty(\n      context.req,\n      \"session\",\n      getPropertyDescriptorForReqSession(session),\n    );\n    return handler(context);\n  };\n}\n","import type { IronSession } from \".\";\n\nexport default function getPropertyDescriptorForReqSession(\n  session: IronSession,\n): PropertyDescriptor {\n  return {\n    enumerable: true,\n    get() {\n      return session;\n    },\n    set(value) {\n      const keys = Object.keys(value);\n      const currentKeys = Object.keys(session);\n\n      currentKeys.forEach((key) => {\n        if (!keys.includes(key)) {\n          // @ts-ignore See comment in IronSessionData interface\n          delete session[key];\n        }\n      });\n\n      keys.forEach((key) => {\n        // @ts-ignore See comment in IronSessionData interface\n        session[key] = value[key];\n      });\n    },\n  };\n}\n"],"mappings":";AAQA;;;ACNe,4CACb,SACoB;AACpB,SAAO;AAAA,IACL,YAAY;AAAA,IACZ,MAAM;AACJ,aAAO;AAAA,IACT;AAAA,IACA,IAAI,OAAO;AACT,YAAM,OAAO,OAAO,KAAK,KAAK;AAC9B,YAAM,cAAc,OAAO,KAAK,OAAO;AAEvC,kBAAY,QAAQ,CAAC,QAAQ;AAC3B,YAAI,CAAC,KAAK,SAAS,GAAG,GAAG;AAEvB,iBAAO,QAAQ;AAAA,QACjB;AAAA,MACF,CAAC;AAED,WAAK,QAAQ,CAAC,QAAQ;AAEpB,gBAAQ,OAAO,MAAM;AAAA,MACvB,CAAC;AAAA,IACH;AAAA,EACF;AACF;;;ADTO,iCACL,SACA,SACgB;AAChB,SAAO,oDAAoD,KAAK,KAAK;AACnE,QAAI;AAGJ,QAAI,mBAAmB,UAAU;AAC/B,uBAAiB,MAAM,QAAQ,KAAK,GAAG;AAAA,IACzC,OAAO;AACL,uBAAiB;AAAA,IACnB;AAEA,UAAM,UAAU,MAAM,eAAe,KAAK,KAAK,cAAc;AAM7D,WAAO,eACL,KACA,WACA,mCAAmC,OAAO,CAC5C;AACA,WAAO,QAAQ,KAAK,GAAG;AAAA,EACzB;AACF;AAQO,4BAGL,SAGA,SACA;AACA,SAAO,mEACL,SACA;AACA,QAAI;AAGJ,QAAI,mBAAmB,UAAU;AAC/B,uBAAiB,MAAM,QAAQ,QAAQ,KAAK,QAAQ,GAAG;AAAA,IACzD,OAAO;AACL,uBAAiB;AAAA,IACnB;AAEA,UAAM,UAAU,MAAM,eACpB,QAAQ,KACR,QAAQ,KACR,cACF;AAEA,WAAO,eACL,QAAQ,KACR,WACA,mCAAmC,OAAO,CAC5C;AACA,WAAO,QAAQ,OAAO;AAAA,EACxB;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "iron-session",
-  "version": "6.1.1",
+  "version": "7.0.0",
   "description": "Node.js stateless session utility using signed and encrypted cookies to store data. Works with Next.js, Express, NestJs, Fastify, and any Node.js HTTP framework.",
   "keywords": [
     "Next.js",
@@ -121,27 +121,27 @@
     }
   },
   "dependencies": {
-    "@hapi/iron": "^6.0.0",
-    "@types/cookie": "^0.4.0",
+    "@types/cookie": "^0.5.1",
     "@types/express": "^4.17.13",
     "@types/node": "^16.11.7",
-    "cookie": "^0.4.2"
+    "cookie": "^0.5.0",
+    "iron-webcrypto": "^0.0.1"
   },
   "devDependencies": {
-    "@swc/core": "^1.2.156",
-    "@swc/jest": "^0.2.20",
+    "@swc/core": "^1.2.197",
+    "@swc/jest": "^0.2.21",
     "@tsconfig/node12": "1.0.9",
-    "@types/jest": "^27.4.1",
-    "@typescript-eslint/eslint-plugin": "^5.15.0",
-    "@typescript-eslint/parser": "^5.15.0",
-    "concurrently": "^7.0.0",
-    "eslint": "^8.11.0",
-    "jest": "^27.5.1",
-    "prettier": "^2.6.0",
-    "prettier-plugin-packagejson": "^2.2.16",
+    "@types/jest": "^28.1.1",
+    "@typescript-eslint/eslint-plugin": "^5.27.1",
+    "@typescript-eslint/parser": "^5.27.1",
+    "concurrently": "^7.2.1",
+    "eslint": "^8.17.0",
+    "jest": "^28.1.1",
+    "prettier": "2.6.2",
+    "prettier-plugin-packagejson": "^2.2.18",
     "rimraf": "3.0.2",
-    "tsup": "5.6.0",
-    "typescript": "^4.6.2"
+    "tsup": "^6.1.0",
+    "typescript": "4.7.3"
   },
   "peerDependencies": {
     "express": ">=4",