npm - iron-session - Versions diffs - 8.0.0 → 8.0.2 - Mend

iron-session 8.0.0 → 8.0.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (8) hide show

package/README.md CHANGED Viewed

@@ -1,13 +1,32 @@
-# iron-session [![GitHub license](https://img.shields.io/github/license/vvo/iron-session?style=flat)](https://github.com/vvo/iron-session/blob/master/LICENSE) [![npm](https://img.shields.io/npm/v/iron-session)](https://www.npmjs.com/package/iron-session) [![Downloads](https://img.shields.io/npm/dm/next-iron-session.svg)](http://npm-stat.com/charts.html?package=iron-session)
+# iron-session ![GitHub Workflow Status (with event)](https://img.shields.io/github/actions/workflow/status/vvo/iron-session/ci.yaml) [![GitHub license](https://img.shields.io/github/license/vvo/iron-session?style=flat)](https://github.com/vvo/iron-session/blob/master/LICENSE) [![npm](https://img.shields.io/npm/v/iron-session)](https://www.npmjs.com/package/iron-session) ![npm](https://img.shields.io/npm/dm/iron-session) ![npm package minimized gzipped size (select exports)](https://img.shields.io/bundlejs/size/iron-session?exports=getIronSession)
 **`iron-session` is a secure, stateless, and cookie-based session library for JavaScript.**
-<p align="center">Online demo: <a href="https://get-iron-session.vercel.app/">https://get-iron-session.vercel.app</a> 👀</p>
+<div align="right"><sub><i>our sponsor:</i></sup></div>
+---
+<div align="center">
+  <a href="https://stytch.com?utm_source=oss-sponsorship&utm_medium=paid_sponsorship&utm_content=logo&utm_campaign=iron-session">
+    <picture>
+      <source width="200px" media="(prefers-color-scheme: dark)" srcset="./sponsor/stytch_white.svg'>
+      <source width="200px" media="(prefers-color-scheme: light)" srcset="./sponsor/stytch_charcoal.svg">
+      <img width="200px" src="./sponsor/stytch_charcoal.svg" />
+    </picture>
+  </a>
+   <p align="center">API-first authentication, authorization, and fraud prevention</p>
+   <p align="center">
+       <a href="https://stytch.com?utm_source=oss-sponsorship&utm_medium=paid_sponsorship&utm_content=website-link&utm_campaign=iron-session"><b>Website</b></a> •
+       <a href="https://stytch.com/docs?utm_source=oss-sponsorship&utm_medium=paid_sponsorship&utm_content=docs-link&utm_campaign=iron-session"><b>Documentation</b></a>
+   </p>
+</div>
+---
 The session data is stored in signed and encrypted cookies which are decoded by your server code in a stateless fashion (= no network involved). This is the same technique used by frameworks like
 [Ruby On Rails](https://guides.rubyonrails.org/security.html#session-storage).
-<p align="center"><i>⭐️ Featured in the <a href="https://nextjs.org/docs/authentication">Next.js documentation</a></i></p>
+<p align="center"><i>Online demo and examples: <a href="https://get-iron-session.vercel.app/">https://get-iron-session.vercel.app</a></i> 👀 <br/>
+ <i>Featured in the <a href="https://nextjs.org/docs/authentication">Next.js documentation</a></i> ⭐️</p>
 ## Table of Contents
@@ -22,8 +41,9 @@ The session data is stored in signed and encrypted cookies which are decoded by
   - [`getIronSession<T>(cookieStore, sessionOptions): Promise<IronSession<T>>`](#getironsessiontcookiestore-sessionoptions-promiseironsessiont)
   - [`session.save(): Promise<void>`](#sessionsave-promisevoid)
   - [`session.destroy(): void`](#sessiondestroy-void)
+  - [`session.updateConfig(sessionOptions: SessionOptions): void`](#sessionupdateconfigsessionoptions-sessionoptions-void)
   - [`sealData(data: unknown, { password, ttl }): Promise<string>`](#sealdatadata-unknown--password-ttl--promisestring)
-  - [`unSealData<T>(seal: string, { password, ttl }): Promise<T>`](#unsealdatatseal-string--password-ttl--promiset)
+  - [`unsealData<T>(seal: string, { password, ttl }): Promise<T>`](#unsealdatatseal-string--password-ttl--promiset)
 - [FAQ](#faq)
   - [Why use pure cookies for sessions?](#why-use-pure-cookies-for-sessions)
   - [How to invalidate sessions?](#how-to-invalidate-sessions)
@@ -59,7 +79,7 @@ export function post(req, res) {
 ```ts
 // Next.js Route Handlers (App Router)
-import { cookies } from 'next/header';
+import { cookies } from 'next/headers';
 import { getIronSession } from 'iron-session';
 export function GET() {
@@ -75,15 +95,15 @@ export function POST() {
 ```tsx
 // Next.js Server Components and Server Actions (App Router)
-import { cookies } from 'next/header';
+import { cookies } from 'next/headers';
 import { getIronSession } from 'iron-session';
-async function getIronSession() {
+async function getIronSessionData() {
   const session = await getIronSession(cookies(), { password: "...", cookieName: "..." });
 }
 function Profile() {
-  const session = await getIronSession();
+  const session = await getIronSessionData();
   return <div>{session.username}</div>;
 }
@@ -143,14 +163,18 @@ await session.save()
 Destroys the session. This is a synchronous operation as it only removes the cookie. It must be done before headers are sent to the client.
 ```ts
-await session.destroy()
+session.destroy()
 ```
+### `session.updateConfig(sessionOptions: SessionOptions): void`
+Updates the configuration of the session with new session options. You still need to call save() if you want them to be applied.
 ### `sealData(data: unknown, { password, ttl }): Promise<string>`
 This is the underlying method and seal mechanism that powers `iron-session`. You can use it to seal any `data` you want and pass it around. One usecase are magic links: you generate a seal that contains a user id to login and send it to a route on your website (like `/magic-login`). Once received, you can safely decode the seal with `unsealData` and log the user in.
-### `unSealData<T>(seal: string, { password, ttl }): Promise<T>`
+### `unsealData<T>(seal: string, { password, ttl }): Promise<T>`
 This is the opposite of `sealData` and allow you to decode a seal to get the original data back.

package/dist/index.cjs CHANGED Viewed

@@ -238,7 +238,7 @@ async function getIronSessionFromCookieStore(cookieStore, sessionOptions, sealDa
       "iron-session: Bad usage. Password must be at least 32 characters long."
     );
   }
-  const sessionConfig = getSessionConfig(sessionOptions);
+  let sessionConfig = getSessionConfig(sessionOptions);
   const sealFromCookies = getServerActionCookie(
     sessionConfig.cookieName,
     cookieStore
@@ -248,6 +248,11 @@ async function getIronSessionFromCookieStore(cookieStore, sessionOptions, sealDa
     ttl: sessionConfig.ttl
   }) : {};
   Object.defineProperties(session, {
+    updateConfig: {
+      value: function updateConfig(newSessionOptions) {
+        sessionConfig = getSessionConfig(newSessionOptions);
+      }
+    },
     save: {
       value: async function save() {
         const seal = await sealData2(session, {

package/dist/index.cjs.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/core.ts","../src/index.ts"],"names":["sealData","unsealData","getIronSession"],"mappings":";AACA,SAAS,OAAO,iBAA8C;AAC9D;AAAA,EACE,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,UAAU;AAAA,OACL;AAiHP,IAAM,mBAAmB;AACzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBACJ;AAAA,EACE,KAAK;AAAA,EACL,eAAe,EAAE,UAAU,MAAM,QAAQ,MAAM,UAAU,OAAO,MAAM,IAAI;AAC5E;AAEF,SAAS,6BAA6B,UAAkC;AACtE,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,SAAS,IAAI;AAC1D;AAEA,SAAS,UAAU,MAGjB;AACA,QAAM,CAAC,oBAAoB,oBAAoB,IAC7C,KAAK,MAAM,gBAAgB;AAC7B,QAAM,eACJ,wBAAwB,OAAO,OAAO,SAAS,sBAAsB,EAAE;AAGzE,SAAO,EAAE,oBAAyC,aAAa;AACjE;AAEA,SAAS,oBAAoB,KAAqB;AAChD,MAAI,QAAQ,GAAG;AAKb,WAAO;AAAA,EACT;AAIA,SAAO,MAAM;AACf;AAEA,SAAS,UAAU,KAAkB,YAA4B;AAC/D,SACE;AAAA,KACG,aAAa,OAAO,OAAO,IAAI,QAAQ,QAAQ,aAC5C,IAAI,QAAQ,IAAI,QAAQ,IACvB,IAAwB,QAAQ,WAAW;AAAA,EAClD,EAAE,UAAU,KAAK;AAErB;AAEA,SAAS,sBACP,YACA,eACQ;AACR,QAAM,eAAe,cAAc,IAAI,UAAU;AACjD,QAAM,SAAS,cAAc;AAC7B,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,UAAU,KAAmB,aAA2B;AAC/D,MAAI,aAAa,OAAO,OAAO,IAAI,QAAQ,WAAW,YAAY;AAChE,QAAI,QAAQ,OAAO,cAAc,WAAW;AAC5C;AAAA,EACF;AACA,MAAI,oBAAqB,IAAuB,UAAU,YAAY,KAAK,CAAC;AAC5E,MAAI,CAAC,MAAM,QAAQ,iBAAiB,GAAG;AACrC,wBAAoB,CAAC,kBAAkB,SAAS,CAAC;AAAA,EACnD;AACA,EAAC,IAAuB,UAAU,cAAc;AAAA,IAC9C,GAAG;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEO,SAAS,eAAe,SAAiB;AAC9C,SAAO,eAAeA,UACpB,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,GACiB;AACjB,UAAM,eAAe,6BAA6B,QAAQ;AAE1D,UAAM,uBAAuB,KAAK;AAAA,MAChC,GAAG,OAAO,KAAK,YAAY,EAAE,IAAI,MAAM;AAAA,IACzC;AACA,UAAM,kBAAkB;AAAA,MACtB,IAAI,qBAAqB,SAAS;AAAA,MAClC,QAAQ,aAAa,oBAAoB;AAAA,IAC3C;AAEA,UAAM,OAAO,MAAM,SAAS,SAAS,MAAM,iBAAiB;AAAA,MAC1D,GAAG;AAAA,MACH,KAAK,MAAM;AAAA,IACb,CAAC;AAED,WAAO,GAAG,IAAI,GAAG,gBAAgB,GAAG,mBAAmB;AAAA,EACzD;AACF;AAEO,SAAS,iBAAiB,SAAiB;AAChD,SAAO,eAAeC,YACpB,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,GACY;AACZ,UAAM,eAAe,6BAA6B,QAAQ;AAC1D,UAAM,EAAE,oBAAoB,aAAa,IAAI,UAAU,IAAI;AAE3D,QAAI;AACF,YAAM,OACH,MAAM,WAAW,SAAS,oBAAoB,cAAc;AAAA,QAC3D,GAAG;AAAA,QACH,KAAK,MAAM;AAAA,MACb,CAAC,KAAM,CAAC;AAEV,UAAI,iBAAiB,GAAG;AACtB,eAAO;AAAA,MACT;AAGA,aAAO,EAAE,GAAG,KAAK,WAAW;AAAA,IAC9B,SAAS,OAAO;AACd,UACE,iBAAiB,SACjB,4FAA4F;AAAA,QAC1F,MAAM;AAAA,MACR,GACA;AAKA,eAAO,CAAC;AAAA,MACV;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,iBACP,gBAC0B;AAC1B,QAAM,UAAU;AAAA,IACd,GAAG;AAAA,IACH,GAAG;AAAA,IACH,eAAe;AAAA,MACb,GAAG,eAAe;AAAA,MAClB,GAAI,eAAe,iBAAiB,CAAC;AAAA,IACvC;AAAA,EACF;AAEA,MACE,eAAe,iBACf,YAAY,eAAe,eAC3B;AACA,QAAI,eAAe,cAAc,WAAW,QAAW;AAErD,cAAQ,MAAM;AAAA,IAChB;AAAA,EACF,OAAO;AACL,YAAQ,cAAc,SAAS,oBAAoB,QAAQ,GAAG;AAAA,EAChE;AAEA,SAAO;AACT;AAEA,IAAM,kBACJ;AAEK,SAAS,qBACdD,WACAC,aACA;AACA,SAAOC;AAWP,iBAAeA,gBACb,kBACA,qBACA,gBACyB;AACzB,QAAI,CAAC,kBAAkB;AACrB,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AAEA,QAAI,CAAC,qBAAqB;AACxB,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AAEA,QAAI,CAAC,gBAAgB;AACnB,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACAF;AAAA,QACAC;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM;AACZ,UAAM,MAAM;AAEZ,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AAEA,QAAI,CAAC,eAAe,YAAY;AAC9B,YAAM,IAAI,MAAM,+CAA+C;AAAA,IACjE;AAEA,QAAI,CAAC,eAAe,UAAU;AAC5B,YAAM,IAAI,MAAM,4CAA4C;AAAA,IAC9D;AAEA,UAAM,eAAe,6BAA6B,eAAe,QAAQ;AAEzE,QAAI,OAAO,OAAO,YAAY,EAAE,KAAK,CAAC,aAAa,SAAS,SAAS,EAAE,GAAG;AACxE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,gBAAgB,iBAAiB,cAAc;AAEnD,UAAM,kBAAkB,UAAU,KAAK,cAAc,UAAU;AAC/D,UAAM,UAAU,kBACZ,MAAMA,YAAc,iBAAiB;AAAA,MACnC,UAAU;AAAA,MACV,KAAK,cAAc;AAAA,IACrB,CAAC,IACA,CAAC;AAEN,WAAO,iBAAiB,SAAS;AAAA,MAC/B,cAAc;AAAA,QACZ,OAAO,SAAS,aAAa,mBAAmC;AAC9D,0BAAgB,iBAAiB,iBAAiB;AAAA,QACpD;AAAA,MACF;AAAA,MACA,MAAM;AAAA,QACJ,OAAO,eAAe,OAAO;AAC3B,cAAI,iBAAiB,OAAO,IAAI,aAAa;AAC3C,kBAAM,IAAI;AAAA,cACR;AAAA,YACF;AAAA,UACF;AAEA,gBAAM,OAAO,MAAMD,UAAS,SAAS;AAAA,YACnC,UAAU;AAAA,YACV,KAAK,cAAc;AAAA,UACrB,CAAC;AACD,gBAAM,cAAc;AAAA,YAClB,cAAc;AAAA,YACd;AAAA,YACA,cAAc;AAAA,UAChB;AAEA,cAAI,YAAY,SAAS,MAAM;AAC7B,kBAAM,IAAI;AAAA,cACR,2CAA2C,YAAY,MAAM;AAAA,YAC/D;AAAA,UACF;AAEA,oBAAU,KAAK,WAAW;AAAA,QAC5B;AAAA,MACF;AAAA,MAEA,SAAS;AAAA,QACP,OAAO,SAAS,UAAU;AACxB,iBAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AACpC,mBAAQ,QAAoC,GAAG;AAAA,UACjD,CAAC;AACD,gBAAM,cAAc,UAAU,cAAc,YAAY,IAAI;AAAA,YAC1D,GAAG,cAAc;AAAA,YACjB,QAAQ;AAAA,UACV,CAAC;AAED,oBAAU,KAAK,WAAW;AAAA,QAC5B;AAAA,MACF;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AACF;AAEA,eAAe,8BACb,aACA,gBACAA,WACAC,aACyB;AACzB,MAAI,CAAC,eAAe,YAAY;AAC9B,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAEA,MAAI,CAAC,eAAe,UAAU;AAC5B,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AAEA,QAAM,eAAe,6BAA6B,eAAe,QAAQ;AAEzE,MAAI,OAAO,OAAO,YAAY,EAAE,KAAK,CAAC,aAAa,SAAS,SAAS,EAAE,GAAG;AACxE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,gBAAgB,iBAAiB,cAAc;AACrD,QAAM,kBAAkB;AAAA,IACtB,cAAc;AAAA,IACd;AAAA,EACF;AACA,QAAM,UAAU,kBACZ,MAAMA,YAAc,iBAAiB;AAAA,IACnC,UAAU;AAAA,IACV,KAAK,cAAc;AAAA,EACrB,CAAC,IACA,CAAC;AAEN,SAAO,iBAAiB,SAAS;AAAA,IAC/B,MAAM;AAAA,MACJ,OAAO,eAAe,OAAO;AAC3B,cAAM,OAAO,MAAMD,UAAS,SAAS;AAAA,UACnC,UAAU;AAAA,UACV,KAAK,cAAc;AAAA,QACrB,CAAC;AAED,cAAM,eACJ,cAAc,WAAW,SACzB,KAAK,SACL,KAAK,UAAU,cAAc,aAAa,EAAE;AAE9C,YAAI,eAAe,MAAM;AACvB,gBAAM,IAAI;AAAA,YACR,2CAA2C,YAAY;AAAA,UACzD;AAAA,QACF;AAEA,oBAAY;AAAA,UACV,cAAc;AAAA,UACd;AAAA,UACA,cAAc;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAAA,IAEA,SAAS;AAAA,MACP,OAAO,SAAS,UAAU;AACxB,eAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AACpC,iBAAQ,QAAoC,GAAG;AAAA,QACjD,CAAC;AAED,cAAM,gBAAgB,EAAE,GAAG,cAAc,eAAe,QAAQ,EAAE;AAClE,oBAAY,IAAI,cAAc,YAAY,IAAI,aAAa;AAAA,MAC7D;AAAA,IACF;AAAA,EACF,CAAC;AAED,SAAO;AACT;;;AC5eA,YAAY,YAAY;AAGjB,IAAM,WAAW,eAAe,MAAM;AACtC,IAAM,aAAa,iBAAiB,MAAM;AAC1C,IAAM,iBAAiB,qBAAqB,UAAU,UAAU","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"http\";\nimport { parse, serialize, type CookieSerializeOptions } from \"cookie\";\nimport {\n defaults as ironDefaults,\n seal as ironSeal,\n unseal as ironUnseal,\n} from \"iron-webcrypto\";\n\ntype PasswordsMap = Record<string, string>;\ntype Password = PasswordsMap \| string;\ntype RequestType = IncomingMessage \| Request;\ntype ResponseType = Response \| ServerResponse;\n\n/*\n {@link https://wicg.github.io/cookie-store/#dictdef-cookielistitem CookieListItem}\n * as specified by W3C.\n /\ninterface CookieListItem\n extends Pick<\n CookieSerializeOptions,\n \"domain\" \| \"path\" \| \"sameSite\" \| \"secure\"\n > {\n /* A string with the name of a cookie. /\n name: string;\n /* A string containing the value of the cookie. /\n value: string;\n /* A number of milliseconds or Date interface containing the expires of the cookie. /\n expires?: CookieSerializeOptions[\"expires\"] \| number;\n}\n\n/\n Superset of {@link CookieListItem} extending it with\n * the `httpOnly`, `maxAge` and `priority` properties.\n /\ntype ResponseCookie = CookieListItem &\n Pick<CookieSerializeOptions, \"httpOnly\" \| \"maxAge\" \| \"priority\">;\n\n/\n The high-level type definition of the .get() and .set() methods\n * of { cookies() } from \"next/headers\"\n /\nexport interface CookieStore {\n get: (name: string) => { name: string; value: string } \| undefined;\n set: {\n (name: string, value: string, cookie?: Partial<ResponseCookie>): void;\n (options: ResponseCookie): void;\n };\n}\n\n/\n Set-Cookie Attributes do not include `encode`. We omit this from our `cookieOptions` type.\n \n @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie\n * @see https://developer.chrome.com/docs/devtools/application/cookies/\n /\ntype CookieOptions = Omit<CookieSerializeOptions, \"encode\">;\n\nexport interface SessionOptions {\n /\n The cookie name that will be used inside the browser. Make sure it's unique\n * given your application.\n \n @example 'vercel-session'\n /\n cookieName: string;\n\n /\n The password(s) that will be used to encrypt the cookie. Can either be a string\n * or an object.\n \n When you provide multiple passwords then all of them will be used to decrypt\n * the cookie. But only the most recent (`= highest key`, `2` in the example)\n * password will be used to encrypt the cookie. This allows password rotation.\n \n @example { 1: 'password-1', 2: 'password-2' }\n /\n password: Password;\n\n /\n The time (in seconds) that the session will be valid for. Also sets the\n * `max-age` attribute of the cookie automatically (`= ttl - 60s`, so that the\n * cookie always expire before the session).\n \n `ttl = 0` means no expiration.\n \n @default 1209600\n /\n ttl?: number;\n\n /\n The options that will be passed to the cookie library.\n \n If you want to use \"session cookies\" (cookies that are deleted when the browser\n * is closed) then you need to pass `cookieOptions: { maxAge: undefined }`\n \n @see https://github.com/jshttp/cookie#options-1\n /\n cookieOptions?: CookieOptions;\n}\n\nexport type IronSession<T> = T & {\n /\n Encrypts the session data and sets the cookie.\n /\n readonly save: () => Promise<void>;\n\n /\n Destroys the session data and removes the cookie.\n /\n readonly destroy: () => Promise<void>;\n\n /\n Update the session configuration. You still need to call save() to send the new cookie.\n /\n readonly updateConfig: (newSessionOptions: SessionOptions) => void;\n};\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/module/iron/api/?v=7.0.1#options\nconst timestampSkewSec = 60;\nconst fourteenDaysInSeconds = 14 24 * 3600;\n\n// We store a token major version to handle data format changes so that the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: Required<Pick<SessionOptions, \"ttl\" \| \"cookieOptions\">> =\n {\n ttl: fourteenDaysInSeconds,\n cookieOptions: { httpOnly: true, secure: true, sameSite: \"lax\", path: \"/\" },\n };\n\nfunction normalizeStringPasswordToMap(password: Password): PasswordsMap {\n return typeof password === \"string\" ? { 1: password } : password;\n}\n\nfunction parseSeal(seal: string): {\n sealWithoutVersion: string;\n tokenVersion: number \| null;\n} {\n const [sealWithoutVersion, tokenVersionAsString] =\n seal.split(versionDelimiter);\n const tokenVersion =\n tokenVersionAsString == null ? null : parseInt(tokenVersionAsString, 10);\n\n // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n return { sealWithoutVersion: sealWithoutVersion!, tokenVersion };\n}\n\nfunction computeCookieMaxAge(ttl: number): number {\n if (ttl === 0) {\n // ttl = 0 means no expiration\n // but in reality cookies have to expire (can't have no max-age)\n // 2147483647 is the max value for max-age in cookies\n // see https://stackoverflow.com/a/11685301/147079\n return 2147483647;\n }\n\n // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n // It also allows for clock difference of 60 seconds between server and clients.\n return ttl - timestampSkewSec;\n}\n\nfunction getCookie(req: RequestType, cookieName: string): string {\n return (\n parse(\n (\"headers\" in req && typeof req.headers.get === \"function\"\n ? req.headers.get(\"cookie\")\n : (req as IncomingMessage).headers.cookie) ?? \"\",\n )[cookieName] ?? \"\"\n );\n}\n\nfunction getServerActionCookie(\n cookieName: string,\n cookieHandler: CookieStore,\n): string {\n const cookieObject = cookieHandler.get(cookieName);\n const cookie = cookieObject?.value;\n if (typeof cookie === \"string\") {\n return cookie;\n }\n return \"\";\n}\n\nfunction setCookie(res: ResponseType, cookieValue: string): void {\n if (\"headers\" in res && typeof res.headers.append === \"function\") {\n res.headers.append(\"set-cookie\", cookieValue);\n return;\n }\n let existingSetCookie = (res as ServerResponse).getHeader(\"set-cookie\") ?? [];\n if (!Array.isArray(existingSetCookie)) {\n existingSetCookie = [existingSetCookie.toString()];\n }\n (res as ServerResponse).setHeader(\"set-cookie\", [\n ...existingSetCookie,\n cookieValue,\n ]);\n}\n\nexport function createSealData(_crypto: Crypto) {\n return async function sealData(\n data: unknown,\n {\n password,\n ttl = fourteenDaysInSeconds,\n }: { password: Password; ttl?: number },\n ): Promise<string> {\n const passwordsMap = normalizeStringPasswordToMap(password);\n\n const mostRecentPasswordId = Math.max(\n ...Object.keys(passwordsMap).map(Number),\n );\n const passwordForSeal = {\n id: mostRecentPasswordId.toString(),\n secret: passwordsMap[mostRecentPasswordId]!,\n };\n\n const seal = await ironSeal(_crypto, data, passwordForSeal, {\n ...ironDefaults,\n ttl: ttl * 1000,\n });\n\n return `${seal}${versionDelimiter}${currentMajorVersion}`;\n };\n}\n\nexport function createUnsealData(_crypto: Crypto) {\n return async function unsealData<T>(\n seal: string,\n {\n password,\n ttl = fourteenDaysInSeconds,\n }: { password: Password; ttl?: number },\n ): Promise<T> {\n const passwordsMap = normalizeStringPasswordToMap(password);\n const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n try {\n const data =\n (await ironUnseal(_crypto, sealWithoutVersion, passwordsMap, {\n ...ironDefaults,\n ttl: ttl * 1000,\n })) ?? {};\n\n if (tokenVersion === 2) {\n return data as T;\n }\n\n // @ts-expect-error `persistent` does not exist on newer tokens\n return { ...data.persistent } as T;\n } catch (error) {\n if (\n error instanceof Error &&\n /^(Expired seal\|Bad hmac value\|Cannot find password\|Incorrect number of sealed components)/.test(\n error.message,\n )\n ) {\n // if seal expired or\n // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n // if we can't find back the password in the seal\n // then we just start a new session over\n return {} as T;\n }\n\n throw error;\n }\n };\n}\n\nfunction getSessionConfig(\n sessionOptions: SessionOptions,\n): Required<SessionOptions> {\n const options = {\n ...defaultOptions,\n ...sessionOptions,\n cookieOptions: {\n ...defaultOptions.cookieOptions,\n ...(sessionOptions.cookieOptions \|\| {}),\n },\n };\n\n if (\n sessionOptions.cookieOptions &&\n \"maxAge\" in sessionOptions.cookieOptions\n ) {\n if (sessionOptions.cookieOptions.maxAge === undefined) {\n // session cookies, do not set maxAge, consider token as infinite\n options.ttl = 0;\n }\n } else {\n options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n }\n\n return options;\n}\n\nconst badUsageMessage =\n \"iron-session: Bad usage: use getIronSession(req, res, options) or getIronSession(cookieStore, options).\";\n\nexport function createGetIronSession(\n sealData: ReturnType<typeof createSealData>,\n unsealData: ReturnType<typeof createUnsealData>,\n) {\n return getIronSession;\n\n async function getIronSession<T extends object>(\n cookies: CookieStore,\n sessionOptions: SessionOptions,\n ): Promise<IronSession<T>>;\n async function getIronSession<T extends object>(\n req: RequestType,\n res: ResponseType,\n sessionOptions: SessionOptions,\n ): Promise<IronSession<T>>;\n async function getIronSession<T extends object>(\n reqOrCookieStore: RequestType \| CookieStore,\n resOrsessionOptions: ResponseType \| SessionOptions,\n sessionOptions?: SessionOptions,\n ): Promise<IronSession<T>> {\n if (!reqOrCookieStore) {\n throw new Error(badUsageMessage);\n }\n\n if (!resOrsessionOptions) {\n throw new Error(badUsageMessage);\n }\n\n if (!sessionOptions) {\n return getIronSessionFromCookieStore<T>(\n reqOrCookieStore as CookieStore,\n resOrsessionOptions as SessionOptions,\n sealData,\n unsealData,\n );\n }\n\n const req = reqOrCookieStore as RequestType;\n const res = resOrsessionOptions as ResponseType;\n\n if (!sessionOptions) {\n throw new Error(badUsageMessage);\n }\n\n if (!sessionOptions.cookieName) {\n throw new Error(\"iron-session: Bad usage. Missing cookie name.\");\n }\n\n if (!sessionOptions.password) {\n throw new Error(\"iron-session: Bad usage. Missing password.\");\n }\n\n const passwordsMap = normalizeStringPasswordToMap(sessionOptions.password);\n\n if (Object.values(passwordsMap).some((password) => password.length < 32)) {\n throw new Error(\n \"iron-session: Bad usage. Password must be at least 32 characters long.\",\n );\n }\n\n let sessionConfig = getSessionConfig(sessionOptions);\n\n const sealFromCookies = getCookie(req, sessionConfig.cookieName);\n const session = sealFromCookies\n ? await unsealData<T>(sealFromCookies, {\n password: passwordsMap,\n ttl: sessionConfig.ttl,\n })\n : ({} as T);\n\n Object.defineProperties(session, {\n updateConfig: {\n value: function updateConfig(newSessionOptions: SessionOptions) {\n sessionConfig = getSessionConfig(newSessionOptions);\n },\n },\n save: {\n value: async function save() {\n if (\"headersSent\" in res && res.headersSent) {\n throw new Error(\n \"iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()\",\n );\n }\n\n const seal = await sealData(session, {\n password: passwordsMap,\n ttl: sessionConfig.ttl,\n });\n const cookieValue = serialize(\n sessionConfig.cookieName,\n seal,\n sessionConfig.cookieOptions,\n );\n\n if (cookieValue.length > 4096) {\n throw new Error(\n `iron-session: Cookie length is too big (${cookieValue.length} bytes), browsers will refuse it. Try to remove some data.`,\n );\n }\n\n setCookie(res, cookieValue);\n },\n },\n\n destroy: {\n value: function destroy() {\n Object.keys(session).forEach((key) => {\n delete (session as Record<string, unknown>)[key];\n });\n const cookieValue = serialize(sessionConfig.cookieName, \"\", {\n ...sessionConfig.cookieOptions,\n maxAge: 0,\n });\n\n setCookie(res, cookieValue);\n },\n },\n });\n\n return session as IronSession<T>;\n }\n}\n\nasync function getIronSessionFromCookieStore<T extends object>(\n cookieStore: CookieStore,\n sessionOptions: SessionOptions,\n sealData: ReturnType<typeof createSealData>,\n unsealData: ReturnType<typeof createUnsealData>,\n): Promise<IronSession<T>> {\n if (!sessionOptions.cookieName) {\n throw new Error(\"iron-session: Bad usage. Missing cookie name.\");\n }\n\n if (!sessionOptions.password) {\n throw new Error(\"iron-session: Bad usage. Missing password.\");\n }\n\n const passwordsMap = normalizeStringPasswordToMap(sessionOptions.password);\n\n if (Object.values(passwordsMap).some((password) => password.length < 32)) {\n throw new Error(\n \"iron-session: Bad usage. Password must be at least 32 characters long.\",\n );\n }\n\n const sessionConfig = getSessionConfig(sessionOptions);\n const sealFromCookies = getServerActionCookie(\n sessionConfig.cookieName,\n cookieStore,\n );\n const session = sealFromCookies\n ? await unsealData<T>(sealFromCookies, {\n password: passwordsMap,\n ttl: sessionConfig.ttl,\n })\n : ({} as T);\n\n Object.defineProperties(session, {\n save: {\n value: async function save() {\n const seal = await sealData(session, {\n password: passwordsMap,\n ttl: sessionConfig.ttl,\n });\n\n const cookieLength =\n sessionConfig.cookieName.length +\n seal.length +\n JSON.stringify(sessionConfig.cookieOptions).length;\n\n if (cookieLength > 4096) {\n throw new Error(\n `iron-session: Cookie length is too big (${cookieLength} bytes), browsers will refuse it. Try to remove some data.`,\n );\n }\n\n cookieStore.set(\n sessionConfig.cookieName,\n seal,\n sessionConfig.cookieOptions,\n );\n },\n },\n\n destroy: {\n value: function destroy() {\n Object.keys(session).forEach((key) => {\n delete (session as Record<string, unknown>)[key];\n });\n\n const cookieOptions = { ...sessionConfig.cookieOptions, maxAge: 0 };\n cookieStore.set(sessionConfig.cookieName, \"\", cookieOptions);\n },\n },\n });\n\n return session as IronSession<T>;\n}\n","import {\n createGetIronSession,\n createSealData,\n createUnsealData,\n} from \"./core.js\";\n\nimport * as crypto from \"uncrypto\";\n\nexport type { IronSession, SessionOptions } from \"./core.js\";\nexport const sealData = createSealData(crypto);\nexport const unsealData = createUnsealData(crypto);\nexport const getIronSession = createGetIronSession(sealData, unsealData);\n"]}
1	+ {"version":3,"sources":["../src/core.ts","../src/index.ts"],"names":["sealData","unsealData","getIronSession"],"mappings":";AACA,SAAS,OAAO,iBAA8C;AAC9D;AAAA,EACE,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,UAAU;AAAA,OACL;AAiHP,IAAM,mBAAmB;AACzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBACJ;AAAA,EACE,KAAK;AAAA,EACL,eAAe,EAAE,UAAU,MAAM,QAAQ,MAAM,UAAU,OAAO,MAAM,IAAI;AAC5E;AAEF,SAAS,6BAA6B,UAAkC;AACtE,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,SAAS,IAAI;AAC1D;AAEA,SAAS,UAAU,MAGjB;AACA,QAAM,CAAC,oBAAoB,oBAAoB,IAC7C,KAAK,MAAM,gBAAgB;AAC7B,QAAM,eACJ,wBAAwB,OAAO,OAAO,SAAS,sBAAsB,EAAE;AAGzE,SAAO,EAAE,oBAAyC,aAAa;AACjE;AAEA,SAAS,oBAAoB,KAAqB;AAChD,MAAI,QAAQ,GAAG;AAKb,WAAO;AAAA,EACT;AAIA,SAAO,MAAM;AACf;AAEA,SAAS,UAAU,KAAkB,YAA4B;AAC/D,SACE;AAAA,KACG,aAAa,OAAO,OAAO,IAAI,QAAQ,QAAQ,aAC5C,IAAI,QAAQ,IAAI,QAAQ,IACvB,IAAwB,QAAQ,WAAW;AAAA,EAClD,EAAE,UAAU,KAAK;AAErB;AAEA,SAAS,sBACP,YACA,eACQ;AACR,QAAM,eAAe,cAAc,IAAI,UAAU;AACjD,QAAM,SAAS,cAAc;AAC7B,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,UAAU,KAAmB,aAA2B;AAC/D,MAAI,aAAa,OAAO,OAAO,IAAI,QAAQ,WAAW,YAAY;AAChE,QAAI,QAAQ,OAAO,cAAc,WAAW;AAC5C;AAAA,EACF;AACA,MAAI,oBAAqB,IAAuB,UAAU,YAAY,KAAK,CAAC;AAC5E,MAAI,CAAC,MAAM,QAAQ,iBAAiB,GAAG;AACrC,wBAAoB,CAAC,kBAAkB,SAAS,CAAC;AAAA,EACnD;AACA,EAAC,IAAuB,UAAU,cAAc;AAAA,IAC9C,GAAG;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEO,SAAS,eAAe,SAAiB;AAC9C,SAAO,eAAeA,UACpB,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,GACiB;AACjB,UAAM,eAAe,6BAA6B,QAAQ;AAE1D,UAAM,uBAAuB,KAAK;AAAA,MAChC,GAAG,OAAO,KAAK,YAAY,EAAE,IAAI,MAAM;AAAA,IACzC;AACA,UAAM,kBAAkB;AAAA,MACtB,IAAI,qBAAqB,SAAS;AAAA,MAClC,QAAQ,aAAa,oBAAoB;AAAA,IAC3C;AAEA,UAAM,OAAO,MAAM,SAAS,SAAS,MAAM,iBAAiB;AAAA,MAC1D,GAAG;AAAA,MACH,KAAK,MAAM;AAAA,IACb,CAAC;AAED,WAAO,GAAG,IAAI,GAAG,gBAAgB,GAAG,mBAAmB;AAAA,EACzD;AACF;AAEO,SAAS,iBAAiB,SAAiB;AAChD,SAAO,eAAeC,YACpB,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,GACY;AACZ,UAAM,eAAe,6BAA6B,QAAQ;AAC1D,UAAM,EAAE,oBAAoB,aAAa,IAAI,UAAU,IAAI;AAE3D,QAAI;AACF,YAAM,OACH,MAAM,WAAW,SAAS,oBAAoB,cAAc;AAAA,QAC3D,GAAG;AAAA,QACH,KAAK,MAAM;AAAA,MACb,CAAC,KAAM,CAAC;AAEV,UAAI,iBAAiB,GAAG;AACtB,eAAO;AAAA,MACT;AAGA,aAAO,EAAE,GAAG,KAAK,WAAW;AAAA,IAC9B,SAAS,OAAO;AACd,UACE,iBAAiB,SACjB,4FAA4F;AAAA,QAC1F,MAAM;AAAA,MACR,GACA;AAKA,eAAO,CAAC;AAAA,MACV;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,iBACP,gBAC0B;AAC1B,QAAM,UAAU;AAAA,IACd,GAAG;AAAA,IACH,GAAG;AAAA,IACH,eAAe;AAAA,MACb,GAAG,eAAe;AAAA,MAClB,GAAI,eAAe,iBAAiB,CAAC;AAAA,IACvC;AAAA,EACF;AAEA,MACE,eAAe,iBACf,YAAY,eAAe,eAC3B;AACA,QAAI,eAAe,cAAc,WAAW,QAAW;AAErD,cAAQ,MAAM;AAAA,IAChB;AAAA,EACF,OAAO;AACL,YAAQ,cAAc,SAAS,oBAAoB,QAAQ,GAAG;AAAA,EAChE;AAEA,SAAO;AACT;AAEA,IAAM,kBACJ;AAEK,SAAS,qBACdD,WACAC,aACA;AACA,SAAOC;AAWP,iBAAeA,gBACb,kBACA,qBACA,gBACyB;AACzB,QAAI,CAAC,kBAAkB;AACrB,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AAEA,QAAI,CAAC,qBAAqB;AACxB,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AAEA,QAAI,CAAC,gBAAgB;AACnB,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACAF;AAAA,QACAC;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM;AACZ,UAAM,MAAM;AAEZ,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AAEA,QAAI,CAAC,eAAe,YAAY;AAC9B,YAAM,IAAI,MAAM,+CAA+C;AAAA,IACjE;AAEA,QAAI,CAAC,eAAe,UAAU;AAC5B,YAAM,IAAI,MAAM,4CAA4C;AAAA,IAC9D;AAEA,UAAM,eAAe,6BAA6B,eAAe,QAAQ;AAEzE,QAAI,OAAO,OAAO,YAAY,EAAE,KAAK,CAAC,aAAa,SAAS,SAAS,EAAE,GAAG;AACxE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,gBAAgB,iBAAiB,cAAc;AAEnD,UAAM,kBAAkB,UAAU,KAAK,cAAc,UAAU;AAC/D,UAAM,UAAU,kBACZ,MAAMA,YAAc,iBAAiB;AAAA,MACnC,UAAU;AAAA,MACV,KAAK,cAAc;AAAA,IACrB,CAAC,IACA,CAAC;AAEN,WAAO,iBAAiB,SAAS;AAAA,MAC/B,cAAc;AAAA,QACZ,OAAO,SAAS,aAAa,mBAAmC;AAC9D,0BAAgB,iBAAiB,iBAAiB;AAAA,QACpD;AAAA,MACF;AAAA,MACA,MAAM;AAAA,QACJ,OAAO,eAAe,OAAO;AAC3B,cAAI,iBAAiB,OAAO,IAAI,aAAa;AAC3C,kBAAM,IAAI;AAAA,cACR;AAAA,YACF;AAAA,UACF;AAEA,gBAAM,OAAO,MAAMD,UAAS,SAAS;AAAA,YACnC,UAAU;AAAA,YACV,KAAK,cAAc;AAAA,UACrB,CAAC;AACD,gBAAM,cAAc;AAAA,YAClB,cAAc;AAAA,YACd;AAAA,YACA,cAAc;AAAA,UAChB;AAEA,cAAI,YAAY,SAAS,MAAM;AAC7B,kBAAM,IAAI;AAAA,cACR,2CAA2C,YAAY,MAAM;AAAA,YAC/D;AAAA,UACF;AAEA,oBAAU,KAAK,WAAW;AAAA,QAC5B;AAAA,MACF;AAAA,MAEA,SAAS;AAAA,QACP,OAAO,SAAS,UAAU;AACxB,iBAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AACpC,mBAAQ,QAAoC,GAAG;AAAA,UACjD,CAAC;AACD,gBAAM,cAAc,UAAU,cAAc,YAAY,IAAI;AAAA,YAC1D,GAAG,cAAc;AAAA,YACjB,QAAQ;AAAA,UACV,CAAC;AAED,oBAAU,KAAK,WAAW;AAAA,QAC5B;AAAA,MACF;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AACF;AAEA,eAAe,8BACb,aACA,gBACAA,WACAC,aACyB;AACzB,MAAI,CAAC,eAAe,YAAY;AAC9B,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAEA,MAAI,CAAC,eAAe,UAAU;AAC5B,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AAEA,QAAM,eAAe,6BAA6B,eAAe,QAAQ;AAEzE,MAAI,OAAO,OAAO,YAAY,EAAE,KAAK,CAAC,aAAa,SAAS,SAAS,EAAE,GAAG;AACxE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI,gBAAgB,iBAAiB,cAAc;AACnD,QAAM,kBAAkB;AAAA,IACtB,cAAc;AAAA,IACd;AAAA,EACF;AACA,QAAM,UAAU,kBACZ,MAAMA,YAAc,iBAAiB;AAAA,IACnC,UAAU;AAAA,IACV,KAAK,cAAc;AAAA,EACrB,CAAC,IACA,CAAC;AAEN,SAAO,iBAAiB,SAAS;AAAA,IAC/B,cAAc;AAAA,MACZ,OAAO,SAAS,aAAa,mBAAmC;AAC9D,wBAAgB,iBAAiB,iBAAiB;AAAA,MACpD;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,OAAO,eAAe,OAAO;AAC3B,cAAM,OAAO,MAAMD,UAAS,SAAS;AAAA,UACnC,UAAU;AAAA,UACV,KAAK,cAAc;AAAA,QACrB,CAAC;AAED,cAAM,eACJ,cAAc,WAAW,SACzB,KAAK,SACL,KAAK,UAAU,cAAc,aAAa,EAAE;AAE9C,YAAI,eAAe,MAAM;AACvB,gBAAM,IAAI;AAAA,YACR,2CAA2C,YAAY;AAAA,UACzD;AAAA,QACF;AAEA,oBAAY;AAAA,UACV,cAAc;AAAA,UACd;AAAA,UACA,cAAc;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAAA,IAEA,SAAS;AAAA,MACP,OAAO,SAAS,UAAU;AACxB,eAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AACpC,iBAAQ,QAAoC,GAAG;AAAA,QACjD,CAAC;AAED,cAAM,gBAAgB,EAAE,GAAG,cAAc,eAAe,QAAQ,EAAE;AAClE,oBAAY,IAAI,cAAc,YAAY,IAAI,aAAa;AAAA,MAC7D;AAAA,IACF;AAAA,EACF,CAAC;AAED,SAAO;AACT;;;ACjfA,YAAY,YAAY;AAGjB,IAAM,WAAW,eAAe,MAAM;AACtC,IAAM,aAAa,iBAAiB,MAAM;AAC1C,IAAM,iBAAiB,qBAAqB,UAAU,UAAU","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"http\";\nimport { parse, serialize, type CookieSerializeOptions } from \"cookie\";\nimport {\n defaults as ironDefaults,\n seal as ironSeal,\n unseal as ironUnseal,\n} from \"iron-webcrypto\";\n\ntype PasswordsMap = Record<string, string>;\ntype Password = PasswordsMap \| string;\ntype RequestType = IncomingMessage \| Request;\ntype ResponseType = Response \| ServerResponse;\n\n/*\n {@link https://wicg.github.io/cookie-store/#dictdef-cookielistitem CookieListItem}\n * as specified by W3C.\n /\ninterface CookieListItem\n extends Pick<\n CookieSerializeOptions,\n \"domain\" \| \"path\" \| \"sameSite\" \| \"secure\"\n > {\n /* A string with the name of a cookie. /\n name: string;\n /* A string containing the value of the cookie. /\n value: string;\n /* A number of milliseconds or Date interface containing the expires of the cookie. /\n expires?: CookieSerializeOptions[\"expires\"] \| number;\n}\n\n/\n Superset of {@link CookieListItem} extending it with\n * the `httpOnly`, `maxAge` and `priority` properties.\n /\ntype ResponseCookie = CookieListItem &\n Pick<CookieSerializeOptions, \"httpOnly\" \| \"maxAge\" \| \"priority\">;\n\n/\n The high-level type definition of the .get() and .set() methods\n * of { cookies() } from \"next/headers\"\n /\nexport interface CookieStore {\n get: (name: string) => { name: string; value: string } \| undefined;\n set: {\n (name: string, value: string, cookie?: Partial<ResponseCookie>): void;\n (options: ResponseCookie): void;\n };\n}\n\n/\n Set-Cookie Attributes do not include `encode`. We omit this from our `cookieOptions` type.\n \n @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie\n * @see https://developer.chrome.com/docs/devtools/application/cookies/\n /\ntype CookieOptions = Omit<CookieSerializeOptions, \"encode\">;\n\nexport interface SessionOptions {\n /\n The cookie name that will be used inside the browser. Make sure it's unique\n * given your application.\n \n @example 'vercel-session'\n /\n cookieName: string;\n\n /\n The password(s) that will be used to encrypt the cookie. Can either be a string\n * or an object.\n \n When you provide multiple passwords then all of them will be used to decrypt\n * the cookie. But only the most recent (`= highest key`, `2` in the example)\n * password will be used to encrypt the cookie. This allows password rotation.\n \n @example { 1: 'password-1', 2: 'password-2' }\n /\n password: Password;\n\n /\n The time (in seconds) that the session will be valid for. Also sets the\n * `max-age` attribute of the cookie automatically (`= ttl - 60s`, so that the\n * cookie always expire before the session).\n \n `ttl = 0` means no expiration.\n \n @default 1209600\n /\n ttl?: number;\n\n /\n The options that will be passed to the cookie library.\n \n If you want to use \"session cookies\" (cookies that are deleted when the browser\n * is closed) then you need to pass `cookieOptions: { maxAge: undefined }`\n \n @see https://github.com/jshttp/cookie#options-1\n /\n cookieOptions?: CookieOptions;\n}\n\nexport type IronSession<T> = T & {\n /\n Encrypts the session data and sets the cookie.\n /\n readonly save: () => Promise<void>;\n\n /\n Destroys the session data and removes the cookie.\n /\n readonly destroy: () => void;\n\n /\n Update the session configuration. You still need to call save() to send the new cookie.\n /\n readonly updateConfig: (newSessionOptions: SessionOptions) => void;\n};\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/module/iron/api/?v=7.0.1#options\nconst timestampSkewSec = 60;\nconst fourteenDaysInSeconds = 14 24 * 3600;\n\n// We store a token major version to handle data format changes so that the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: Required<Pick<SessionOptions, \"ttl\" \| \"cookieOptions\">> =\n {\n ttl: fourteenDaysInSeconds,\n cookieOptions: { httpOnly: true, secure: true, sameSite: \"lax\", path: \"/\" },\n };\n\nfunction normalizeStringPasswordToMap(password: Password): PasswordsMap {\n return typeof password === \"string\" ? { 1: password } : password;\n}\n\nfunction parseSeal(seal: string): {\n sealWithoutVersion: string;\n tokenVersion: number \| null;\n} {\n const [sealWithoutVersion, tokenVersionAsString] =\n seal.split(versionDelimiter);\n const tokenVersion =\n tokenVersionAsString == null ? null : parseInt(tokenVersionAsString, 10);\n\n // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n return { sealWithoutVersion: sealWithoutVersion!, tokenVersion };\n}\n\nfunction computeCookieMaxAge(ttl: number): number {\n if (ttl === 0) {\n // ttl = 0 means no expiration\n // but in reality cookies have to expire (can't have no max-age)\n // 2147483647 is the max value for max-age in cookies\n // see https://stackoverflow.com/a/11685301/147079\n return 2147483647;\n }\n\n // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n // It also allows for clock difference of 60 seconds between server and clients.\n return ttl - timestampSkewSec;\n}\n\nfunction getCookie(req: RequestType, cookieName: string): string {\n return (\n parse(\n (\"headers\" in req && typeof req.headers.get === \"function\"\n ? req.headers.get(\"cookie\")\n : (req as IncomingMessage).headers.cookie) ?? \"\",\n )[cookieName] ?? \"\"\n );\n}\n\nfunction getServerActionCookie(\n cookieName: string,\n cookieHandler: CookieStore,\n): string {\n const cookieObject = cookieHandler.get(cookieName);\n const cookie = cookieObject?.value;\n if (typeof cookie === \"string\") {\n return cookie;\n }\n return \"\";\n}\n\nfunction setCookie(res: ResponseType, cookieValue: string): void {\n if (\"headers\" in res && typeof res.headers.append === \"function\") {\n res.headers.append(\"set-cookie\", cookieValue);\n return;\n }\n let existingSetCookie = (res as ServerResponse).getHeader(\"set-cookie\") ?? [];\n if (!Array.isArray(existingSetCookie)) {\n existingSetCookie = [existingSetCookie.toString()];\n }\n (res as ServerResponse).setHeader(\"set-cookie\", [\n ...existingSetCookie,\n cookieValue,\n ]);\n}\n\nexport function createSealData(_crypto: Crypto) {\n return async function sealData(\n data: unknown,\n {\n password,\n ttl = fourteenDaysInSeconds,\n }: { password: Password; ttl?: number },\n ): Promise<string> {\n const passwordsMap = normalizeStringPasswordToMap(password);\n\n const mostRecentPasswordId = Math.max(\n ...Object.keys(passwordsMap).map(Number),\n );\n const passwordForSeal = {\n id: mostRecentPasswordId.toString(),\n secret: passwordsMap[mostRecentPasswordId]!,\n };\n\n const seal = await ironSeal(_crypto, data, passwordForSeal, {\n ...ironDefaults,\n ttl: ttl * 1000,\n });\n\n return `${seal}${versionDelimiter}${currentMajorVersion}`;\n };\n}\n\nexport function createUnsealData(_crypto: Crypto) {\n return async function unsealData<T>(\n seal: string,\n {\n password,\n ttl = fourteenDaysInSeconds,\n }: { password: Password; ttl?: number },\n ): Promise<T> {\n const passwordsMap = normalizeStringPasswordToMap(password);\n const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n try {\n const data =\n (await ironUnseal(_crypto, sealWithoutVersion, passwordsMap, {\n ...ironDefaults,\n ttl: ttl * 1000,\n })) ?? {};\n\n if (tokenVersion === 2) {\n return data as T;\n }\n\n // @ts-expect-error `persistent` does not exist on newer tokens\n return { ...data.persistent } as T;\n } catch (error) {\n if (\n error instanceof Error &&\n /^(Expired seal\|Bad hmac value\|Cannot find password\|Incorrect number of sealed components)/.test(\n error.message,\n )\n ) {\n // if seal expired or\n // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n // if we can't find back the password in the seal\n // then we just start a new session over\n return {} as T;\n }\n\n throw error;\n }\n };\n}\n\nfunction getSessionConfig(\n sessionOptions: SessionOptions,\n): Required<SessionOptions> {\n const options = {\n ...defaultOptions,\n ...sessionOptions,\n cookieOptions: {\n ...defaultOptions.cookieOptions,\n ...(sessionOptions.cookieOptions \|\| {}),\n },\n };\n\n if (\n sessionOptions.cookieOptions &&\n \"maxAge\" in sessionOptions.cookieOptions\n ) {\n if (sessionOptions.cookieOptions.maxAge === undefined) {\n // session cookies, do not set maxAge, consider token as infinite\n options.ttl = 0;\n }\n } else {\n options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n }\n\n return options;\n}\n\nconst badUsageMessage =\n \"iron-session: Bad usage: use getIronSession(req, res, options) or getIronSession(cookieStore, options).\";\n\nexport function createGetIronSession(\n sealData: ReturnType<typeof createSealData>,\n unsealData: ReturnType<typeof createUnsealData>,\n) {\n return getIronSession;\n\n async function getIronSession<T extends object>(\n cookies: CookieStore,\n sessionOptions: SessionOptions,\n ): Promise<IronSession<T>>;\n async function getIronSession<T extends object>(\n req: RequestType,\n res: ResponseType,\n sessionOptions: SessionOptions,\n ): Promise<IronSession<T>>;\n async function getIronSession<T extends object>(\n reqOrCookieStore: RequestType \| CookieStore,\n resOrsessionOptions: ResponseType \| SessionOptions,\n sessionOptions?: SessionOptions,\n ): Promise<IronSession<T>> {\n if (!reqOrCookieStore) {\n throw new Error(badUsageMessage);\n }\n\n if (!resOrsessionOptions) {\n throw new Error(badUsageMessage);\n }\n\n if (!sessionOptions) {\n return getIronSessionFromCookieStore<T>(\n reqOrCookieStore as CookieStore,\n resOrsessionOptions as SessionOptions,\n sealData,\n unsealData,\n );\n }\n\n const req = reqOrCookieStore as RequestType;\n const res = resOrsessionOptions as ResponseType;\n\n if (!sessionOptions) {\n throw new Error(badUsageMessage);\n }\n\n if (!sessionOptions.cookieName) {\n throw new Error(\"iron-session: Bad usage. Missing cookie name.\");\n }\n\n if (!sessionOptions.password) {\n throw new Error(\"iron-session: Bad usage. Missing password.\");\n }\n\n const passwordsMap = normalizeStringPasswordToMap(sessionOptions.password);\n\n if (Object.values(passwordsMap).some((password) => password.length < 32)) {\n throw new Error(\n \"iron-session: Bad usage. Password must be at least 32 characters long.\",\n );\n }\n\n let sessionConfig = getSessionConfig(sessionOptions);\n\n const sealFromCookies = getCookie(req, sessionConfig.cookieName);\n const session = sealFromCookies\n ? await unsealData<T>(sealFromCookies, {\n password: passwordsMap,\n ttl: sessionConfig.ttl,\n })\n : ({} as T);\n\n Object.defineProperties(session, {\n updateConfig: {\n value: function updateConfig(newSessionOptions: SessionOptions) {\n sessionConfig = getSessionConfig(newSessionOptions);\n },\n },\n save: {\n value: async function save() {\n if (\"headersSent\" in res && res.headersSent) {\n throw new Error(\n \"iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()\",\n );\n }\n\n const seal = await sealData(session, {\n password: passwordsMap,\n ttl: sessionConfig.ttl,\n });\n const cookieValue = serialize(\n sessionConfig.cookieName,\n seal,\n sessionConfig.cookieOptions,\n );\n\n if (cookieValue.length > 4096) {\n throw new Error(\n `iron-session: Cookie length is too big (${cookieValue.length} bytes), browsers will refuse it. Try to remove some data.`,\n );\n }\n\n setCookie(res, cookieValue);\n },\n },\n\n destroy: {\n value: function destroy() {\n Object.keys(session).forEach((key) => {\n delete (session as Record<string, unknown>)[key];\n });\n const cookieValue = serialize(sessionConfig.cookieName, \"\", {\n ...sessionConfig.cookieOptions,\n maxAge: 0,\n });\n\n setCookie(res, cookieValue);\n },\n },\n });\n\n return session as IronSession<T>;\n }\n}\n\nasync function getIronSessionFromCookieStore<T extends object>(\n cookieStore: CookieStore,\n sessionOptions: SessionOptions,\n sealData: ReturnType<typeof createSealData>,\n unsealData: ReturnType<typeof createUnsealData>,\n): Promise<IronSession<T>> {\n if (!sessionOptions.cookieName) {\n throw new Error(\"iron-session: Bad usage. Missing cookie name.\");\n }\n\n if (!sessionOptions.password) {\n throw new Error(\"iron-session: Bad usage. Missing password.\");\n }\n\n const passwordsMap = normalizeStringPasswordToMap(sessionOptions.password);\n\n if (Object.values(passwordsMap).some((password) => password.length < 32)) {\n throw new Error(\n \"iron-session: Bad usage. Password must be at least 32 characters long.\",\n );\n }\n\n let sessionConfig = getSessionConfig(sessionOptions);\n const sealFromCookies = getServerActionCookie(\n sessionConfig.cookieName,\n cookieStore,\n );\n const session = sealFromCookies\n ? await unsealData<T>(sealFromCookies, {\n password: passwordsMap,\n ttl: sessionConfig.ttl,\n })\n : ({} as T);\n\n Object.defineProperties(session, {\n updateConfig: {\n value: function updateConfig(newSessionOptions: SessionOptions) {\n sessionConfig = getSessionConfig(newSessionOptions);\n },\n },\n save: {\n value: async function save() {\n const seal = await sealData(session, {\n password: passwordsMap,\n ttl: sessionConfig.ttl,\n });\n\n const cookieLength =\n sessionConfig.cookieName.length +\n seal.length +\n JSON.stringify(sessionConfig.cookieOptions).length;\n\n if (cookieLength > 4096) {\n throw new Error(\n `iron-session: Cookie length is too big (${cookieLength} bytes), browsers will refuse it. Try to remove some data.`,\n );\n }\n\n cookieStore.set(\n sessionConfig.cookieName,\n seal,\n sessionConfig.cookieOptions,\n );\n },\n },\n\n destroy: {\n value: function destroy() {\n Object.keys(session).forEach((key) => {\n delete (session as Record<string, unknown>)[key];\n });\n\n const cookieOptions = { ...sessionConfig.cookieOptions, maxAge: 0 };\n cookieStore.set(sessionConfig.cookieName, \"\", cookieOptions);\n },\n },\n });\n\n return session as IronSession<T>;\n}\n","import {\n createGetIronSession,\n createSealData,\n createUnsealData,\n} from \"./core.js\";\n\nimport * as crypto from \"uncrypto\";\n\nexport type { IronSession, SessionOptions } from \"./core.js\";\nexport const sealData = createSealData(crypto);\nexport const unsealData = createUnsealData(crypto);\nexport const getIronSession = createGetIronSession(sealData, unsealData);\n"]}

package/dist/index.d.cts CHANGED Viewed

@@ -88,7 +88,7 @@ type IronSession<T> = T & {
     /**
      * Destroys the session data and removes the cookie.
      */
-    readonly destroy: () => Promise<void>;
+    readonly destroy: () => void;
     /**
      * Update the session configuration. You still need to call save() to send the new cookie.
      */

package/dist/index.d.ts CHANGED Viewed

@@ -88,7 +88,7 @@ type IronSession<T> = T & {
     /**
      * Destroys the session data and removes the cookie.
      */
-    readonly destroy: () => Promise<void>;
+    readonly destroy: () => void;
     /**
      * Update the session configuration. You still need to call save() to send the new cookie.
      */

package/dist/index.js CHANGED Viewed

@@ -216,7 +216,7 @@ async function getIronSessionFromCookieStore(cookieStore, sessionOptions, sealDa
       "iron-session: Bad usage. Password must be at least 32 characters long."
     );
   }
-  const sessionConfig = getSessionConfig(sessionOptions);
+  let sessionConfig = getSessionConfig(sessionOptions);
   const sealFromCookies = getServerActionCookie(
     sessionConfig.cookieName,
     cookieStore
@@ -226,6 +226,11 @@ async function getIronSessionFromCookieStore(cookieStore, sessionOptions, sealDa
     ttl: sessionConfig.ttl
   }) : {};
   Object.defineProperties(session, {
+    updateConfig: {
+      value: function updateConfig(newSessionOptions) {
+        sessionConfig = getSessionConfig(newSessionOptions);
+      }
+    },
     save: {
       value: async function save() {
         const seal = await sealData2(session, {

package/dist/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../src/core.ts","../src/index.ts"],"names":["sealData","unsealData","getIronSession"],"mappings":";AACA,SAAS,OAAO,iBAA8C;AAC9D;AAAA,EACE,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,UAAU;AAAA,OACL;AAiHP,IAAM,mBAAmB;AACzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBACJ;AAAA,EACE,KAAK;AAAA,EACL,eAAe,EAAE,UAAU,MAAM,QAAQ,MAAM,UAAU,OAAO,MAAM,IAAI;AAC5E;AAEF,SAAS,6BAA6B,UAAkC;AACtE,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,SAAS,IAAI;AAC1D;AAEA,SAAS,UAAU,MAGjB;AACA,QAAM,CAAC,oBAAoB,oBAAoB,IAC7C,KAAK,MAAM,gBAAgB;AAC7B,QAAM,eACJ,wBAAwB,OAAO,OAAO,SAAS,sBAAsB,EAAE;AAGzE,SAAO,EAAE,oBAAyC,aAAa;AACjE;AAEA,SAAS,oBAAoB,KAAqB;AAChD,MAAI,QAAQ,GAAG;AAKb,WAAO;AAAA,EACT;AAIA,SAAO,MAAM;AACf;AAEA,SAAS,UAAU,KAAkB,YAA4B;AAC/D,SACE;AAAA,KACG,aAAa,OAAO,OAAO,IAAI,QAAQ,QAAQ,aAC5C,IAAI,QAAQ,IAAI,QAAQ,IACvB,IAAwB,QAAQ,WAAW;AAAA,EAClD,EAAE,UAAU,KAAK;AAErB;AAEA,SAAS,sBACP,YACA,eACQ;AACR,QAAM,eAAe,cAAc,IAAI,UAAU;AACjD,QAAM,SAAS,cAAc;AAC7B,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,UAAU,KAAmB,aAA2B;AAC/D,MAAI,aAAa,OAAO,OAAO,IAAI,QAAQ,WAAW,YAAY;AAChE,QAAI,QAAQ,OAAO,cAAc,WAAW;AAC5C;AAAA,EACF;AACA,MAAI,oBAAqB,IAAuB,UAAU,YAAY,KAAK,CAAC;AAC5E,MAAI,CAAC,MAAM,QAAQ,iBAAiB,GAAG;AACrC,wBAAoB,CAAC,kBAAkB,SAAS,CAAC;AAAA,EACnD;AACA,EAAC,IAAuB,UAAU,cAAc;AAAA,IAC9C,GAAG;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEO,SAAS,eAAe,SAAiB;AAC9C,SAAO,eAAeA,UACpB,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,GACiB;AACjB,UAAM,eAAe,6BAA6B,QAAQ;AAE1D,UAAM,uBAAuB,KAAK;AAAA,MAChC,GAAG,OAAO,KAAK,YAAY,EAAE,IAAI,MAAM;AAAA,IACzC;AACA,UAAM,kBAAkB;AAAA,MACtB,IAAI,qBAAqB,SAAS;AAAA,MAClC,QAAQ,aAAa,oBAAoB;AAAA,IAC3C;AAEA,UAAM,OAAO,MAAM,SAAS,SAAS,MAAM,iBAAiB;AAAA,MAC1D,GAAG;AAAA,MACH,KAAK,MAAM;AAAA,IACb,CAAC;AAED,WAAO,GAAG,IAAI,GAAG,gBAAgB,GAAG,mBAAmB;AAAA,EACzD;AACF;AAEO,SAAS,iBAAiB,SAAiB;AAChD,SAAO,eAAeC,YACpB,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,GACY;AACZ,UAAM,eAAe,6BAA6B,QAAQ;AAC1D,UAAM,EAAE,oBAAoB,aAAa,IAAI,UAAU,IAAI;AAE3D,QAAI;AACF,YAAM,OACH,MAAM,WAAW,SAAS,oBAAoB,cAAc;AAAA,QAC3D,GAAG;AAAA,QACH,KAAK,MAAM;AAAA,MACb,CAAC,KAAM,CAAC;AAEV,UAAI,iBAAiB,GAAG;AACtB,eAAO;AAAA,MACT;AAGA,aAAO,EAAE,GAAG,KAAK,WAAW;AAAA,IAC9B,SAAS,OAAO;AACd,UACE,iBAAiB,SACjB,4FAA4F;AAAA,QAC1F,MAAM;AAAA,MACR,GACA;AAKA,eAAO,CAAC;AAAA,MACV;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,iBACP,gBAC0B;AAC1B,QAAM,UAAU;AAAA,IACd,GAAG;AAAA,IACH,GAAG;AAAA,IACH,eAAe;AAAA,MACb,GAAG,eAAe;AAAA,MAClB,GAAI,eAAe,iBAAiB,CAAC;AAAA,IACvC;AAAA,EACF;AAEA,MACE,eAAe,iBACf,YAAY,eAAe,eAC3B;AACA,QAAI,eAAe,cAAc,WAAW,QAAW;AAErD,cAAQ,MAAM;AAAA,IAChB;AAAA,EACF,OAAO;AACL,YAAQ,cAAc,SAAS,oBAAoB,QAAQ,GAAG;AAAA,EAChE;AAEA,SAAO;AACT;AAEA,IAAM,kBACJ;AAEK,SAAS,qBACdD,WACAC,aACA;AACA,SAAOC;AAWP,iBAAeA,gBACb,kBACA,qBACA,gBACyB;AACzB,QAAI,CAAC,kBAAkB;AACrB,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AAEA,QAAI,CAAC,qBAAqB;AACxB,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AAEA,QAAI,CAAC,gBAAgB;AACnB,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACAF;AAAA,QACAC;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM;AACZ,UAAM,MAAM;AAEZ,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AAEA,QAAI,CAAC,eAAe,YAAY;AAC9B,YAAM,IAAI,MAAM,+CAA+C;AAAA,IACjE;AAEA,QAAI,CAAC,eAAe,UAAU;AAC5B,YAAM,IAAI,MAAM,4CAA4C;AAAA,IAC9D;AAEA,UAAM,eAAe,6BAA6B,eAAe,QAAQ;AAEzE,QAAI,OAAO,OAAO,YAAY,EAAE,KAAK,CAAC,aAAa,SAAS,SAAS,EAAE,GAAG;AACxE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,gBAAgB,iBAAiB,cAAc;AAEnD,UAAM,kBAAkB,UAAU,KAAK,cAAc,UAAU;AAC/D,UAAM,UAAU,kBACZ,MAAMA,YAAc,iBAAiB;AAAA,MACnC,UAAU;AAAA,MACV,KAAK,cAAc;AAAA,IACrB,CAAC,IACA,CAAC;AAEN,WAAO,iBAAiB,SAAS;AAAA,MAC/B,cAAc;AAAA,QACZ,OAAO,SAAS,aAAa,mBAAmC;AAC9D,0BAAgB,iBAAiB,iBAAiB;AAAA,QACpD;AAAA,MACF;AAAA,MACA,MAAM;AAAA,QACJ,OAAO,eAAe,OAAO;AAC3B,cAAI,iBAAiB,OAAO,IAAI,aAAa;AAC3C,kBAAM,IAAI;AAAA,cACR;AAAA,YACF;AAAA,UACF;AAEA,gBAAM,OAAO,MAAMD,UAAS,SAAS;AAAA,YACnC,UAAU;AAAA,YACV,KAAK,cAAc;AAAA,UACrB,CAAC;AACD,gBAAM,cAAc;AAAA,YAClB,cAAc;AAAA,YACd;AAAA,YACA,cAAc;AAAA,UAChB;AAEA,cAAI,YAAY,SAAS,MAAM;AAC7B,kBAAM,IAAI;AAAA,cACR,2CAA2C,YAAY,MAAM;AAAA,YAC/D;AAAA,UACF;AAEA,oBAAU,KAAK,WAAW;AAAA,QAC5B;AAAA,MACF;AAAA,MAEA,SAAS;AAAA,QACP,OAAO,SAAS,UAAU;AACxB,iBAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AACpC,mBAAQ,QAAoC,GAAG;AAAA,UACjD,CAAC;AACD,gBAAM,cAAc,UAAU,cAAc,YAAY,IAAI;AAAA,YAC1D,GAAG,cAAc;AAAA,YACjB,QAAQ;AAAA,UACV,CAAC;AAED,oBAAU,KAAK,WAAW;AAAA,QAC5B;AAAA,MACF;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AACF;AAEA,eAAe,8BACb,aACA,gBACAA,WACAC,aACyB;AACzB,MAAI,CAAC,eAAe,YAAY;AAC9B,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAEA,MAAI,CAAC,eAAe,UAAU;AAC5B,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AAEA,QAAM,eAAe,6BAA6B,eAAe,QAAQ;AAEzE,MAAI,OAAO,OAAO,YAAY,EAAE,KAAK,CAAC,aAAa,SAAS,SAAS,EAAE,GAAG;AACxE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,gBAAgB,iBAAiB,cAAc;AACrD,QAAM,kBAAkB;AAAA,IACtB,cAAc;AAAA,IACd;AAAA,EACF;AACA,QAAM,UAAU,kBACZ,MAAMA,YAAc,iBAAiB;AAAA,IACnC,UAAU;AAAA,IACV,KAAK,cAAc;AAAA,EACrB,CAAC,IACA,CAAC;AAEN,SAAO,iBAAiB,SAAS;AAAA,IAC/B,MAAM;AAAA,MACJ,OAAO,eAAe,OAAO;AAC3B,cAAM,OAAO,MAAMD,UAAS,SAAS;AAAA,UACnC,UAAU;AAAA,UACV,KAAK,cAAc;AAAA,QACrB,CAAC;AAED,cAAM,eACJ,cAAc,WAAW,SACzB,KAAK,SACL,KAAK,UAAU,cAAc,aAAa,EAAE;AAE9C,YAAI,eAAe,MAAM;AACvB,gBAAM,IAAI;AAAA,YACR,2CAA2C,YAAY;AAAA,UACzD;AAAA,QACF;AAEA,oBAAY;AAAA,UACV,cAAc;AAAA,UACd;AAAA,UACA,cAAc;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAAA,IAEA,SAAS;AAAA,MACP,OAAO,SAAS,UAAU;AACxB,eAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AACpC,iBAAQ,QAAoC,GAAG;AAAA,QACjD,CAAC;AAED,cAAM,gBAAgB,EAAE,GAAG,cAAc,eAAe,QAAQ,EAAE;AAClE,oBAAY,IAAI,cAAc,YAAY,IAAI,aAAa;AAAA,MAC7D;AAAA,IACF;AAAA,EACF,CAAC;AAED,SAAO;AACT;;;AC5eA,YAAY,YAAY;AAGjB,IAAM,WAAW,eAAe,MAAM;AACtC,IAAM,aAAa,iBAAiB,MAAM;AAC1C,IAAM,iBAAiB,qBAAqB,UAAU,UAAU","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"http\";\nimport { parse, serialize, type CookieSerializeOptions } from \"cookie\";\nimport {\n defaults as ironDefaults,\n seal as ironSeal,\n unseal as ironUnseal,\n} from \"iron-webcrypto\";\n\ntype PasswordsMap = Record<string, string>;\ntype Password = PasswordsMap \| string;\ntype RequestType = IncomingMessage \| Request;\ntype ResponseType = Response \| ServerResponse;\n\n/*\n {@link https://wicg.github.io/cookie-store/#dictdef-cookielistitem CookieListItem}\n * as specified by W3C.\n /\ninterface CookieListItem\n extends Pick<\n CookieSerializeOptions,\n \"domain\" \| \"path\" \| \"sameSite\" \| \"secure\"\n > {\n /* A string with the name of a cookie. /\n name: string;\n /* A string containing the value of the cookie. /\n value: string;\n /* A number of milliseconds or Date interface containing the expires of the cookie. /\n expires?: CookieSerializeOptions[\"expires\"] \| number;\n}\n\n/\n Superset of {@link CookieListItem} extending it with\n * the `httpOnly`, `maxAge` and `priority` properties.\n /\ntype ResponseCookie = CookieListItem &\n Pick<CookieSerializeOptions, \"httpOnly\" \| \"maxAge\" \| \"priority\">;\n\n/\n The high-level type definition of the .get() and .set() methods\n * of { cookies() } from \"next/headers\"\n /\nexport interface CookieStore {\n get: (name: string) => { name: string; value: string } \| undefined;\n set: {\n (name: string, value: string, cookie?: Partial<ResponseCookie>): void;\n (options: ResponseCookie): void;\n };\n}\n\n/\n Set-Cookie Attributes do not include `encode`. We omit this from our `cookieOptions` type.\n \n @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie\n * @see https://developer.chrome.com/docs/devtools/application/cookies/\n /\ntype CookieOptions = Omit<CookieSerializeOptions, \"encode\">;\n\nexport interface SessionOptions {\n /\n The cookie name that will be used inside the browser. Make sure it's unique\n * given your application.\n \n @example 'vercel-session'\n /\n cookieName: string;\n\n /\n The password(s) that will be used to encrypt the cookie. Can either be a string\n * or an object.\n \n When you provide multiple passwords then all of them will be used to decrypt\n * the cookie. But only the most recent (`= highest key`, `2` in the example)\n * password will be used to encrypt the cookie. This allows password rotation.\n \n @example { 1: 'password-1', 2: 'password-2' }\n /\n password: Password;\n\n /\n The time (in seconds) that the session will be valid for. Also sets the\n * `max-age` attribute of the cookie automatically (`= ttl - 60s`, so that the\n * cookie always expire before the session).\n \n `ttl = 0` means no expiration.\n \n @default 1209600\n /\n ttl?: number;\n\n /\n The options that will be passed to the cookie library.\n \n If you want to use \"session cookies\" (cookies that are deleted when the browser\n * is closed) then you need to pass `cookieOptions: { maxAge: undefined }`\n \n @see https://github.com/jshttp/cookie#options-1\n /\n cookieOptions?: CookieOptions;\n}\n\nexport type IronSession<T> = T & {\n /\n Encrypts the session data and sets the cookie.\n /\n readonly save: () => Promise<void>;\n\n /\n Destroys the session data and removes the cookie.\n /\n readonly destroy: () => Promise<void>;\n\n /\n Update the session configuration. You still need to call save() to send the new cookie.\n /\n readonly updateConfig: (newSessionOptions: SessionOptions) => void;\n};\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/module/iron/api/?v=7.0.1#options\nconst timestampSkewSec = 60;\nconst fourteenDaysInSeconds = 14 24 * 3600;\n\n// We store a token major version to handle data format changes so that the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: Required<Pick<SessionOptions, \"ttl\" \| \"cookieOptions\">> =\n {\n ttl: fourteenDaysInSeconds,\n cookieOptions: { httpOnly: true, secure: true, sameSite: \"lax\", path: \"/\" },\n };\n\nfunction normalizeStringPasswordToMap(password: Password): PasswordsMap {\n return typeof password === \"string\" ? { 1: password } : password;\n}\n\nfunction parseSeal(seal: string): {\n sealWithoutVersion: string;\n tokenVersion: number \| null;\n} {\n const [sealWithoutVersion, tokenVersionAsString] =\n seal.split(versionDelimiter);\n const tokenVersion =\n tokenVersionAsString == null ? null : parseInt(tokenVersionAsString, 10);\n\n // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n return { sealWithoutVersion: sealWithoutVersion!, tokenVersion };\n}\n\nfunction computeCookieMaxAge(ttl: number): number {\n if (ttl === 0) {\n // ttl = 0 means no expiration\n // but in reality cookies have to expire (can't have no max-age)\n // 2147483647 is the max value for max-age in cookies\n // see https://stackoverflow.com/a/11685301/147079\n return 2147483647;\n }\n\n // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n // It also allows for clock difference of 60 seconds between server and clients.\n return ttl - timestampSkewSec;\n}\n\nfunction getCookie(req: RequestType, cookieName: string): string {\n return (\n parse(\n (\"headers\" in req && typeof req.headers.get === \"function\"\n ? req.headers.get(\"cookie\")\n : (req as IncomingMessage).headers.cookie) ?? \"\",\n )[cookieName] ?? \"\"\n );\n}\n\nfunction getServerActionCookie(\n cookieName: string,\n cookieHandler: CookieStore,\n): string {\n const cookieObject = cookieHandler.get(cookieName);\n const cookie = cookieObject?.value;\n if (typeof cookie === \"string\") {\n return cookie;\n }\n return \"\";\n}\n\nfunction setCookie(res: ResponseType, cookieValue: string): void {\n if (\"headers\" in res && typeof res.headers.append === \"function\") {\n res.headers.append(\"set-cookie\", cookieValue);\n return;\n }\n let existingSetCookie = (res as ServerResponse).getHeader(\"set-cookie\") ?? [];\n if (!Array.isArray(existingSetCookie)) {\n existingSetCookie = [existingSetCookie.toString()];\n }\n (res as ServerResponse).setHeader(\"set-cookie\", [\n ...existingSetCookie,\n cookieValue,\n ]);\n}\n\nexport function createSealData(_crypto: Crypto) {\n return async function sealData(\n data: unknown,\n {\n password,\n ttl = fourteenDaysInSeconds,\n }: { password: Password; ttl?: number },\n ): Promise<string> {\n const passwordsMap = normalizeStringPasswordToMap(password);\n\n const mostRecentPasswordId = Math.max(\n ...Object.keys(passwordsMap).map(Number),\n );\n const passwordForSeal = {\n id: mostRecentPasswordId.toString(),\n secret: passwordsMap[mostRecentPasswordId]!,\n };\n\n const seal = await ironSeal(_crypto, data, passwordForSeal, {\n ...ironDefaults,\n ttl: ttl * 1000,\n });\n\n return `${seal}${versionDelimiter}${currentMajorVersion}`;\n };\n}\n\nexport function createUnsealData(_crypto: Crypto) {\n return async function unsealData<T>(\n seal: string,\n {\n password,\n ttl = fourteenDaysInSeconds,\n }: { password: Password; ttl?: number },\n ): Promise<T> {\n const passwordsMap = normalizeStringPasswordToMap(password);\n const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n try {\n const data =\n (await ironUnseal(_crypto, sealWithoutVersion, passwordsMap, {\n ...ironDefaults,\n ttl: ttl * 1000,\n })) ?? {};\n\n if (tokenVersion === 2) {\n return data as T;\n }\n\n // @ts-expect-error `persistent` does not exist on newer tokens\n return { ...data.persistent } as T;\n } catch (error) {\n if (\n error instanceof Error &&\n /^(Expired seal\|Bad hmac value\|Cannot find password\|Incorrect number of sealed components)/.test(\n error.message,\n )\n ) {\n // if seal expired or\n // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n // if we can't find back the password in the seal\n // then we just start a new session over\n return {} as T;\n }\n\n throw error;\n }\n };\n}\n\nfunction getSessionConfig(\n sessionOptions: SessionOptions,\n): Required<SessionOptions> {\n const options = {\n ...defaultOptions,\n ...sessionOptions,\n cookieOptions: {\n ...defaultOptions.cookieOptions,\n ...(sessionOptions.cookieOptions \|\| {}),\n },\n };\n\n if (\n sessionOptions.cookieOptions &&\n \"maxAge\" in sessionOptions.cookieOptions\n ) {\n if (sessionOptions.cookieOptions.maxAge === undefined) {\n // session cookies, do not set maxAge, consider token as infinite\n options.ttl = 0;\n }\n } else {\n options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n }\n\n return options;\n}\n\nconst badUsageMessage =\n \"iron-session: Bad usage: use getIronSession(req, res, options) or getIronSession(cookieStore, options).\";\n\nexport function createGetIronSession(\n sealData: ReturnType<typeof createSealData>,\n unsealData: ReturnType<typeof createUnsealData>,\n) {\n return getIronSession;\n\n async function getIronSession<T extends object>(\n cookies: CookieStore,\n sessionOptions: SessionOptions,\n ): Promise<IronSession<T>>;\n async function getIronSession<T extends object>(\n req: RequestType,\n res: ResponseType,\n sessionOptions: SessionOptions,\n ): Promise<IronSession<T>>;\n async function getIronSession<T extends object>(\n reqOrCookieStore: RequestType \| CookieStore,\n resOrsessionOptions: ResponseType \| SessionOptions,\n sessionOptions?: SessionOptions,\n ): Promise<IronSession<T>> {\n if (!reqOrCookieStore) {\n throw new Error(badUsageMessage);\n }\n\n if (!resOrsessionOptions) {\n throw new Error(badUsageMessage);\n }\n\n if (!sessionOptions) {\n return getIronSessionFromCookieStore<T>(\n reqOrCookieStore as CookieStore,\n resOrsessionOptions as SessionOptions,\n sealData,\n unsealData,\n );\n }\n\n const req = reqOrCookieStore as RequestType;\n const res = resOrsessionOptions as ResponseType;\n\n if (!sessionOptions) {\n throw new Error(badUsageMessage);\n }\n\n if (!sessionOptions.cookieName) {\n throw new Error(\"iron-session: Bad usage. Missing cookie name.\");\n }\n\n if (!sessionOptions.password) {\n throw new Error(\"iron-session: Bad usage. Missing password.\");\n }\n\n const passwordsMap = normalizeStringPasswordToMap(sessionOptions.password);\n\n if (Object.values(passwordsMap).some((password) => password.length < 32)) {\n throw new Error(\n \"iron-session: Bad usage. Password must be at least 32 characters long.\",\n );\n }\n\n let sessionConfig = getSessionConfig(sessionOptions);\n\n const sealFromCookies = getCookie(req, sessionConfig.cookieName);\n const session = sealFromCookies\n ? await unsealData<T>(sealFromCookies, {\n password: passwordsMap,\n ttl: sessionConfig.ttl,\n })\n : ({} as T);\n\n Object.defineProperties(session, {\n updateConfig: {\n value: function updateConfig(newSessionOptions: SessionOptions) {\n sessionConfig = getSessionConfig(newSessionOptions);\n },\n },\n save: {\n value: async function save() {\n if (\"headersSent\" in res && res.headersSent) {\n throw new Error(\n \"iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()\",\n );\n }\n\n const seal = await sealData(session, {\n password: passwordsMap,\n ttl: sessionConfig.ttl,\n });\n const cookieValue = serialize(\n sessionConfig.cookieName,\n seal,\n sessionConfig.cookieOptions,\n );\n\n if (cookieValue.length > 4096) {\n throw new Error(\n `iron-session: Cookie length is too big (${cookieValue.length} bytes), browsers will refuse it. Try to remove some data.`,\n );\n }\n\n setCookie(res, cookieValue);\n },\n },\n\n destroy: {\n value: function destroy() {\n Object.keys(session).forEach((key) => {\n delete (session as Record<string, unknown>)[key];\n });\n const cookieValue = serialize(sessionConfig.cookieName, \"\", {\n ...sessionConfig.cookieOptions,\n maxAge: 0,\n });\n\n setCookie(res, cookieValue);\n },\n },\n });\n\n return session as IronSession<T>;\n }\n}\n\nasync function getIronSessionFromCookieStore<T extends object>(\n cookieStore: CookieStore,\n sessionOptions: SessionOptions,\n sealData: ReturnType<typeof createSealData>,\n unsealData: ReturnType<typeof createUnsealData>,\n): Promise<IronSession<T>> {\n if (!sessionOptions.cookieName) {\n throw new Error(\"iron-session: Bad usage. Missing cookie name.\");\n }\n\n if (!sessionOptions.password) {\n throw new Error(\"iron-session: Bad usage. Missing password.\");\n }\n\n const passwordsMap = normalizeStringPasswordToMap(sessionOptions.password);\n\n if (Object.values(passwordsMap).some((password) => password.length < 32)) {\n throw new Error(\n \"iron-session: Bad usage. Password must be at least 32 characters long.\",\n );\n }\n\n const sessionConfig = getSessionConfig(sessionOptions);\n const sealFromCookies = getServerActionCookie(\n sessionConfig.cookieName,\n cookieStore,\n );\n const session = sealFromCookies\n ? await unsealData<T>(sealFromCookies, {\n password: passwordsMap,\n ttl: sessionConfig.ttl,\n })\n : ({} as T);\n\n Object.defineProperties(session, {\n save: {\n value: async function save() {\n const seal = await sealData(session, {\n password: passwordsMap,\n ttl: sessionConfig.ttl,\n });\n\n const cookieLength =\n sessionConfig.cookieName.length +\n seal.length +\n JSON.stringify(sessionConfig.cookieOptions).length;\n\n if (cookieLength > 4096) {\n throw new Error(\n `iron-session: Cookie length is too big (${cookieLength} bytes), browsers will refuse it. Try to remove some data.`,\n );\n }\n\n cookieStore.set(\n sessionConfig.cookieName,\n seal,\n sessionConfig.cookieOptions,\n );\n },\n },\n\n destroy: {\n value: function destroy() {\n Object.keys(session).forEach((key) => {\n delete (session as Record<string, unknown>)[key];\n });\n\n const cookieOptions = { ...sessionConfig.cookieOptions, maxAge: 0 };\n cookieStore.set(sessionConfig.cookieName, \"\", cookieOptions);\n },\n },\n });\n\n return session as IronSession<T>;\n}\n","import {\n createGetIronSession,\n createSealData,\n createUnsealData,\n} from \"./core.js\";\n\nimport * as crypto from \"uncrypto\";\n\nexport type { IronSession, SessionOptions } from \"./core.js\";\nexport const sealData = createSealData(crypto);\nexport const unsealData = createUnsealData(crypto);\nexport const getIronSession = createGetIronSession(sealData, unsealData);\n"]}
1	+ {"version":3,"sources":["../src/core.ts","../src/index.ts"],"names":["sealData","unsealData","getIronSession"],"mappings":";AACA,SAAS,OAAO,iBAA8C;AAC9D;AAAA,EACE,YAAY;AAAA,EACZ,QAAQ;AAAA,EACR,UAAU;AAAA,OACL;AAiHP,IAAM,mBAAmB;AACzB,IAAM,wBAAwB,KAAK,KAAK;AAIxC,IAAM,sBAAsB;AAC5B,IAAM,mBAAmB;AAEzB,IAAM,iBACJ;AAAA,EACE,KAAK;AAAA,EACL,eAAe,EAAE,UAAU,MAAM,QAAQ,MAAM,UAAU,OAAO,MAAM,IAAI;AAC5E;AAEF,SAAS,6BAA6B,UAAkC;AACtE,SAAO,OAAO,aAAa,WAAW,EAAE,GAAG,SAAS,IAAI;AAC1D;AAEA,SAAS,UAAU,MAGjB;AACA,QAAM,CAAC,oBAAoB,oBAAoB,IAC7C,KAAK,MAAM,gBAAgB;AAC7B,QAAM,eACJ,wBAAwB,OAAO,OAAO,SAAS,sBAAsB,EAAE;AAGzE,SAAO,EAAE,oBAAyC,aAAa;AACjE;AAEA,SAAS,oBAAoB,KAAqB;AAChD,MAAI,QAAQ,GAAG;AAKb,WAAO;AAAA,EACT;AAIA,SAAO,MAAM;AACf;AAEA,SAAS,UAAU,KAAkB,YAA4B;AAC/D,SACE;AAAA,KACG,aAAa,OAAO,OAAO,IAAI,QAAQ,QAAQ,aAC5C,IAAI,QAAQ,IAAI,QAAQ,IACvB,IAAwB,QAAQ,WAAW;AAAA,EAClD,EAAE,UAAU,KAAK;AAErB;AAEA,SAAS,sBACP,YACA,eACQ;AACR,QAAM,eAAe,cAAc,IAAI,UAAU;AACjD,QAAM,SAAS,cAAc;AAC7B,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,UAAU,KAAmB,aAA2B;AAC/D,MAAI,aAAa,OAAO,OAAO,IAAI,QAAQ,WAAW,YAAY;AAChE,QAAI,QAAQ,OAAO,cAAc,WAAW;AAC5C;AAAA,EACF;AACA,MAAI,oBAAqB,IAAuB,UAAU,YAAY,KAAK,CAAC;AAC5E,MAAI,CAAC,MAAM,QAAQ,iBAAiB,GAAG;AACrC,wBAAoB,CAAC,kBAAkB,SAAS,CAAC;AAAA,EACnD;AACA,EAAC,IAAuB,UAAU,cAAc;AAAA,IAC9C,GAAG;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEO,SAAS,eAAe,SAAiB;AAC9C,SAAO,eAAeA,UACpB,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,GACiB;AACjB,UAAM,eAAe,6BAA6B,QAAQ;AAE1D,UAAM,uBAAuB,KAAK;AAAA,MAChC,GAAG,OAAO,KAAK,YAAY,EAAE,IAAI,MAAM;AAAA,IACzC;AACA,UAAM,kBAAkB;AAAA,MACtB,IAAI,qBAAqB,SAAS;AAAA,MAClC,QAAQ,aAAa,oBAAoB;AAAA,IAC3C;AAEA,UAAM,OAAO,MAAM,SAAS,SAAS,MAAM,iBAAiB;AAAA,MAC1D,GAAG;AAAA,MACH,KAAK,MAAM;AAAA,IACb,CAAC;AAED,WAAO,GAAG,IAAI,GAAG,gBAAgB,GAAG,mBAAmB;AAAA,EACzD;AACF;AAEO,SAAS,iBAAiB,SAAiB;AAChD,SAAO,eAAeC,YACpB,MACA;AAAA,IACE;AAAA,IACA,MAAM;AAAA,EACR,GACY;AACZ,UAAM,eAAe,6BAA6B,QAAQ;AAC1D,UAAM,EAAE,oBAAoB,aAAa,IAAI,UAAU,IAAI;AAE3D,QAAI;AACF,YAAM,OACH,MAAM,WAAW,SAAS,oBAAoB,cAAc;AAAA,QAC3D,GAAG;AAAA,QACH,KAAK,MAAM;AAAA,MACb,CAAC,KAAM,CAAC;AAEV,UAAI,iBAAiB,GAAG;AACtB,eAAO;AAAA,MACT;AAGA,aAAO,EAAE,GAAG,KAAK,WAAW;AAAA,IAC9B,SAAS,OAAO;AACd,UACE,iBAAiB,SACjB,4FAA4F;AAAA,QAC1F,MAAM;AAAA,MACR,GACA;AAKA,eAAO,CAAC;AAAA,MACV;AAEA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,SAAS,iBACP,gBAC0B;AAC1B,QAAM,UAAU;AAAA,IACd,GAAG;AAAA,IACH,GAAG;AAAA,IACH,eAAe;AAAA,MACb,GAAG,eAAe;AAAA,MAClB,GAAI,eAAe,iBAAiB,CAAC;AAAA,IACvC;AAAA,EACF;AAEA,MACE,eAAe,iBACf,YAAY,eAAe,eAC3B;AACA,QAAI,eAAe,cAAc,WAAW,QAAW;AAErD,cAAQ,MAAM;AAAA,IAChB;AAAA,EACF,OAAO;AACL,YAAQ,cAAc,SAAS,oBAAoB,QAAQ,GAAG;AAAA,EAChE;AAEA,SAAO;AACT;AAEA,IAAM,kBACJ;AAEK,SAAS,qBACdD,WACAC,aACA;AACA,SAAOC;AAWP,iBAAeA,gBACb,kBACA,qBACA,gBACyB;AACzB,QAAI,CAAC,kBAAkB;AACrB,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AAEA,QAAI,CAAC,qBAAqB;AACxB,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AAEA,QAAI,CAAC,gBAAgB;AACnB,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACAF;AAAA,QACAC;AAAA,MACF;AAAA,IACF;AAEA,UAAM,MAAM;AACZ,UAAM,MAAM;AAEZ,QAAI,CAAC,gBAAgB;AACnB,YAAM,IAAI,MAAM,eAAe;AAAA,IACjC;AAEA,QAAI,CAAC,eAAe,YAAY;AAC9B,YAAM,IAAI,MAAM,+CAA+C;AAAA,IACjE;AAEA,QAAI,CAAC,eAAe,UAAU;AAC5B,YAAM,IAAI,MAAM,4CAA4C;AAAA,IAC9D;AAEA,UAAM,eAAe,6BAA6B,eAAe,QAAQ;AAEzE,QAAI,OAAO,OAAO,YAAY,EAAE,KAAK,CAAC,aAAa,SAAS,SAAS,EAAE,GAAG;AACxE,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,QAAI,gBAAgB,iBAAiB,cAAc;AAEnD,UAAM,kBAAkB,UAAU,KAAK,cAAc,UAAU;AAC/D,UAAM,UAAU,kBACZ,MAAMA,YAAc,iBAAiB;AAAA,MACnC,UAAU;AAAA,MACV,KAAK,cAAc;AAAA,IACrB,CAAC,IACA,CAAC;AAEN,WAAO,iBAAiB,SAAS;AAAA,MAC/B,cAAc;AAAA,QACZ,OAAO,SAAS,aAAa,mBAAmC;AAC9D,0BAAgB,iBAAiB,iBAAiB;AAAA,QACpD;AAAA,MACF;AAAA,MACA,MAAM;AAAA,QACJ,OAAO,eAAe,OAAO;AAC3B,cAAI,iBAAiB,OAAO,IAAI,aAAa;AAC3C,kBAAM,IAAI;AAAA,cACR;AAAA,YACF;AAAA,UACF;AAEA,gBAAM,OAAO,MAAMD,UAAS,SAAS;AAAA,YACnC,UAAU;AAAA,YACV,KAAK,cAAc;AAAA,UACrB,CAAC;AACD,gBAAM,cAAc;AAAA,YAClB,cAAc;AAAA,YACd;AAAA,YACA,cAAc;AAAA,UAChB;AAEA,cAAI,YAAY,SAAS,MAAM;AAC7B,kBAAM,IAAI;AAAA,cACR,2CAA2C,YAAY,MAAM;AAAA,YAC/D;AAAA,UACF;AAEA,oBAAU,KAAK,WAAW;AAAA,QAC5B;AAAA,MACF;AAAA,MAEA,SAAS;AAAA,QACP,OAAO,SAAS,UAAU;AACxB,iBAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AACpC,mBAAQ,QAAoC,GAAG;AAAA,UACjD,CAAC;AACD,gBAAM,cAAc,UAAU,cAAc,YAAY,IAAI;AAAA,YAC1D,GAAG,cAAc;AAAA,YACjB,QAAQ;AAAA,UACV,CAAC;AAED,oBAAU,KAAK,WAAW;AAAA,QAC5B;AAAA,MACF;AAAA,IACF,CAAC;AAED,WAAO;AAAA,EACT;AACF;AAEA,eAAe,8BACb,aACA,gBACAA,WACAC,aACyB;AACzB,MAAI,CAAC,eAAe,YAAY;AAC9B,UAAM,IAAI,MAAM,+CAA+C;AAAA,EACjE;AAEA,MAAI,CAAC,eAAe,UAAU;AAC5B,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AAEA,QAAM,eAAe,6BAA6B,eAAe,QAAQ;AAEzE,MAAI,OAAO,OAAO,YAAY,EAAE,KAAK,CAAC,aAAa,SAAS,SAAS,EAAE,GAAG;AACxE,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI,gBAAgB,iBAAiB,cAAc;AACnD,QAAM,kBAAkB;AAAA,IACtB,cAAc;AAAA,IACd;AAAA,EACF;AACA,QAAM,UAAU,kBACZ,MAAMA,YAAc,iBAAiB;AAAA,IACnC,UAAU;AAAA,IACV,KAAK,cAAc;AAAA,EACrB,CAAC,IACA,CAAC;AAEN,SAAO,iBAAiB,SAAS;AAAA,IAC/B,cAAc;AAAA,MACZ,OAAO,SAAS,aAAa,mBAAmC;AAC9D,wBAAgB,iBAAiB,iBAAiB;AAAA,MACpD;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,OAAO,eAAe,OAAO;AAC3B,cAAM,OAAO,MAAMD,UAAS,SAAS;AAAA,UACnC,UAAU;AAAA,UACV,KAAK,cAAc;AAAA,QACrB,CAAC;AAED,cAAM,eACJ,cAAc,WAAW,SACzB,KAAK,SACL,KAAK,UAAU,cAAc,aAAa,EAAE;AAE9C,YAAI,eAAe,MAAM;AACvB,gBAAM,IAAI;AAAA,YACR,2CAA2C,YAAY;AAAA,UACzD;AAAA,QACF;AAEA,oBAAY;AAAA,UACV,cAAc;AAAA,UACd;AAAA,UACA,cAAc;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AAAA,IAEA,SAAS;AAAA,MACP,OAAO,SAAS,UAAU;AACxB,eAAO,KAAK,OAAO,EAAE,QAAQ,CAAC,QAAQ;AACpC,iBAAQ,QAAoC,GAAG;AAAA,QACjD,CAAC;AAED,cAAM,gBAAgB,EAAE,GAAG,cAAc,eAAe,QAAQ,EAAE;AAClE,oBAAY,IAAI,cAAc,YAAY,IAAI,aAAa;AAAA,MAC7D;AAAA,IACF;AAAA,EACF,CAAC;AAED,SAAO;AACT;;;ACjfA,YAAY,YAAY;AAGjB,IAAM,WAAW,eAAe,MAAM;AACtC,IAAM,aAAa,iBAAiB,MAAM;AAC1C,IAAM,iBAAiB,qBAAqB,UAAU,UAAU","sourcesContent":["import type { IncomingMessage, ServerResponse } from \"http\";\nimport { parse, serialize, type CookieSerializeOptions } from \"cookie\";\nimport {\n defaults as ironDefaults,\n seal as ironSeal,\n unseal as ironUnseal,\n} from \"iron-webcrypto\";\n\ntype PasswordsMap = Record<string, string>;\ntype Password = PasswordsMap \| string;\ntype RequestType = IncomingMessage \| Request;\ntype ResponseType = Response \| ServerResponse;\n\n/*\n {@link https://wicg.github.io/cookie-store/#dictdef-cookielistitem CookieListItem}\n * as specified by W3C.\n /\ninterface CookieListItem\n extends Pick<\n CookieSerializeOptions,\n \"domain\" \| \"path\" \| \"sameSite\" \| \"secure\"\n > {\n /* A string with the name of a cookie. /\n name: string;\n /* A string containing the value of the cookie. /\n value: string;\n /* A number of milliseconds or Date interface containing the expires of the cookie. /\n expires?: CookieSerializeOptions[\"expires\"] \| number;\n}\n\n/\n Superset of {@link CookieListItem} extending it with\n * the `httpOnly`, `maxAge` and `priority` properties.\n /\ntype ResponseCookie = CookieListItem &\n Pick<CookieSerializeOptions, \"httpOnly\" \| \"maxAge\" \| \"priority\">;\n\n/\n The high-level type definition of the .get() and .set() methods\n * of { cookies() } from \"next/headers\"\n /\nexport interface CookieStore {\n get: (name: string) => { name: string; value: string } \| undefined;\n set: {\n (name: string, value: string, cookie?: Partial<ResponseCookie>): void;\n (options: ResponseCookie): void;\n };\n}\n\n/\n Set-Cookie Attributes do not include `encode`. We omit this from our `cookieOptions` type.\n \n @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie\n * @see https://developer.chrome.com/docs/devtools/application/cookies/\n /\ntype CookieOptions = Omit<CookieSerializeOptions, \"encode\">;\n\nexport interface SessionOptions {\n /\n The cookie name that will be used inside the browser. Make sure it's unique\n * given your application.\n \n @example 'vercel-session'\n /\n cookieName: string;\n\n /\n The password(s) that will be used to encrypt the cookie. Can either be a string\n * or an object.\n \n When you provide multiple passwords then all of them will be used to decrypt\n * the cookie. But only the most recent (`= highest key`, `2` in the example)\n * password will be used to encrypt the cookie. This allows password rotation.\n \n @example { 1: 'password-1', 2: 'password-2' }\n /\n password: Password;\n\n /\n The time (in seconds) that the session will be valid for. Also sets the\n * `max-age` attribute of the cookie automatically (`= ttl - 60s`, so that the\n * cookie always expire before the session).\n \n `ttl = 0` means no expiration.\n \n @default 1209600\n /\n ttl?: number;\n\n /\n The options that will be passed to the cookie library.\n \n If you want to use \"session cookies\" (cookies that are deleted when the browser\n * is closed) then you need to pass `cookieOptions: { maxAge: undefined }`\n \n @see https://github.com/jshttp/cookie#options-1\n /\n cookieOptions?: CookieOptions;\n}\n\nexport type IronSession<T> = T & {\n /\n Encrypts the session data and sets the cookie.\n /\n readonly save: () => Promise<void>;\n\n /\n Destroys the session data and removes the cookie.\n /\n readonly destroy: () => void;\n\n /\n Update the session configuration. You still need to call save() to send the new cookie.\n /\n readonly updateConfig: (newSessionOptions: SessionOptions) => void;\n};\n\n// default time allowed to check for iron seal validity when ttl passed\n// see https://hapi.dev/module/iron/api/?v=7.0.1#options\nconst timestampSkewSec = 60;\nconst fourteenDaysInSeconds = 14 24 * 3600;\n\n// We store a token major version to handle data format changes so that the cookies\n// can be kept alive between upgrades, no need to disconnect everyone.\nconst currentMajorVersion = 2;\nconst versionDelimiter = \"~\";\n\nconst defaultOptions: Required<Pick<SessionOptions, \"ttl\" \| \"cookieOptions\">> =\n {\n ttl: fourteenDaysInSeconds,\n cookieOptions: { httpOnly: true, secure: true, sameSite: \"lax\", path: \"/\" },\n };\n\nfunction normalizeStringPasswordToMap(password: Password): PasswordsMap {\n return typeof password === \"string\" ? { 1: password } : password;\n}\n\nfunction parseSeal(seal: string): {\n sealWithoutVersion: string;\n tokenVersion: number \| null;\n} {\n const [sealWithoutVersion, tokenVersionAsString] =\n seal.split(versionDelimiter);\n const tokenVersion =\n tokenVersionAsString == null ? null : parseInt(tokenVersionAsString, 10);\n\n // eslint-disable-next-line @typescript-eslint/no-non-null-assertion\n return { sealWithoutVersion: sealWithoutVersion!, tokenVersion };\n}\n\nfunction computeCookieMaxAge(ttl: number): number {\n if (ttl === 0) {\n // ttl = 0 means no expiration\n // but in reality cookies have to expire (can't have no max-age)\n // 2147483647 is the max value for max-age in cookies\n // see https://stackoverflow.com/a/11685301/147079\n return 2147483647;\n }\n\n // The next line makes sure browser will expire cookies before seals are considered expired by the server.\n // It also allows for clock difference of 60 seconds between server and clients.\n return ttl - timestampSkewSec;\n}\n\nfunction getCookie(req: RequestType, cookieName: string): string {\n return (\n parse(\n (\"headers\" in req && typeof req.headers.get === \"function\"\n ? req.headers.get(\"cookie\")\n : (req as IncomingMessage).headers.cookie) ?? \"\",\n )[cookieName] ?? \"\"\n );\n}\n\nfunction getServerActionCookie(\n cookieName: string,\n cookieHandler: CookieStore,\n): string {\n const cookieObject = cookieHandler.get(cookieName);\n const cookie = cookieObject?.value;\n if (typeof cookie === \"string\") {\n return cookie;\n }\n return \"\";\n}\n\nfunction setCookie(res: ResponseType, cookieValue: string): void {\n if (\"headers\" in res && typeof res.headers.append === \"function\") {\n res.headers.append(\"set-cookie\", cookieValue);\n return;\n }\n let existingSetCookie = (res as ServerResponse).getHeader(\"set-cookie\") ?? [];\n if (!Array.isArray(existingSetCookie)) {\n existingSetCookie = [existingSetCookie.toString()];\n }\n (res as ServerResponse).setHeader(\"set-cookie\", [\n ...existingSetCookie,\n cookieValue,\n ]);\n}\n\nexport function createSealData(_crypto: Crypto) {\n return async function sealData(\n data: unknown,\n {\n password,\n ttl = fourteenDaysInSeconds,\n }: { password: Password; ttl?: number },\n ): Promise<string> {\n const passwordsMap = normalizeStringPasswordToMap(password);\n\n const mostRecentPasswordId = Math.max(\n ...Object.keys(passwordsMap).map(Number),\n );\n const passwordForSeal = {\n id: mostRecentPasswordId.toString(),\n secret: passwordsMap[mostRecentPasswordId]!,\n };\n\n const seal = await ironSeal(_crypto, data, passwordForSeal, {\n ...ironDefaults,\n ttl: ttl * 1000,\n });\n\n return `${seal}${versionDelimiter}${currentMajorVersion}`;\n };\n}\n\nexport function createUnsealData(_crypto: Crypto) {\n return async function unsealData<T>(\n seal: string,\n {\n password,\n ttl = fourteenDaysInSeconds,\n }: { password: Password; ttl?: number },\n ): Promise<T> {\n const passwordsMap = normalizeStringPasswordToMap(password);\n const { sealWithoutVersion, tokenVersion } = parseSeal(seal);\n\n try {\n const data =\n (await ironUnseal(_crypto, sealWithoutVersion, passwordsMap, {\n ...ironDefaults,\n ttl: ttl * 1000,\n })) ?? {};\n\n if (tokenVersion === 2) {\n return data as T;\n }\n\n // @ts-expect-error `persistent` does not exist on newer tokens\n return { ...data.persistent } as T;\n } catch (error) {\n if (\n error instanceof Error &&\n /^(Expired seal\|Bad hmac value\|Cannot find password\|Incorrect number of sealed components)/.test(\n error.message,\n )\n ) {\n // if seal expired or\n // if seal is not valid (encrypted using a different password, when passwords are badly rotated) or\n // if we can't find back the password in the seal\n // then we just start a new session over\n return {} as T;\n }\n\n throw error;\n }\n };\n}\n\nfunction getSessionConfig(\n sessionOptions: SessionOptions,\n): Required<SessionOptions> {\n const options = {\n ...defaultOptions,\n ...sessionOptions,\n cookieOptions: {\n ...defaultOptions.cookieOptions,\n ...(sessionOptions.cookieOptions \|\| {}),\n },\n };\n\n if (\n sessionOptions.cookieOptions &&\n \"maxAge\" in sessionOptions.cookieOptions\n ) {\n if (sessionOptions.cookieOptions.maxAge === undefined) {\n // session cookies, do not set maxAge, consider token as infinite\n options.ttl = 0;\n }\n } else {\n options.cookieOptions.maxAge = computeCookieMaxAge(options.ttl);\n }\n\n return options;\n}\n\nconst badUsageMessage =\n \"iron-session: Bad usage: use getIronSession(req, res, options) or getIronSession(cookieStore, options).\";\n\nexport function createGetIronSession(\n sealData: ReturnType<typeof createSealData>,\n unsealData: ReturnType<typeof createUnsealData>,\n) {\n return getIronSession;\n\n async function getIronSession<T extends object>(\n cookies: CookieStore,\n sessionOptions: SessionOptions,\n ): Promise<IronSession<T>>;\n async function getIronSession<T extends object>(\n req: RequestType,\n res: ResponseType,\n sessionOptions: SessionOptions,\n ): Promise<IronSession<T>>;\n async function getIronSession<T extends object>(\n reqOrCookieStore: RequestType \| CookieStore,\n resOrsessionOptions: ResponseType \| SessionOptions,\n sessionOptions?: SessionOptions,\n ): Promise<IronSession<T>> {\n if (!reqOrCookieStore) {\n throw new Error(badUsageMessage);\n }\n\n if (!resOrsessionOptions) {\n throw new Error(badUsageMessage);\n }\n\n if (!sessionOptions) {\n return getIronSessionFromCookieStore<T>(\n reqOrCookieStore as CookieStore,\n resOrsessionOptions as SessionOptions,\n sealData,\n unsealData,\n );\n }\n\n const req = reqOrCookieStore as RequestType;\n const res = resOrsessionOptions as ResponseType;\n\n if (!sessionOptions) {\n throw new Error(badUsageMessage);\n }\n\n if (!sessionOptions.cookieName) {\n throw new Error(\"iron-session: Bad usage. Missing cookie name.\");\n }\n\n if (!sessionOptions.password) {\n throw new Error(\"iron-session: Bad usage. Missing password.\");\n }\n\n const passwordsMap = normalizeStringPasswordToMap(sessionOptions.password);\n\n if (Object.values(passwordsMap).some((password) => password.length < 32)) {\n throw new Error(\n \"iron-session: Bad usage. Password must be at least 32 characters long.\",\n );\n }\n\n let sessionConfig = getSessionConfig(sessionOptions);\n\n const sealFromCookies = getCookie(req, sessionConfig.cookieName);\n const session = sealFromCookies\n ? await unsealData<T>(sealFromCookies, {\n password: passwordsMap,\n ttl: sessionConfig.ttl,\n })\n : ({} as T);\n\n Object.defineProperties(session, {\n updateConfig: {\n value: function updateConfig(newSessionOptions: SessionOptions) {\n sessionConfig = getSessionConfig(newSessionOptions);\n },\n },\n save: {\n value: async function save() {\n if (\"headersSent\" in res && res.headersSent) {\n throw new Error(\n \"iron-session: Cannot set session cookie: session.save() was called after headers were sent. Make sure to call it before any res.send() or res.end()\",\n );\n }\n\n const seal = await sealData(session, {\n password: passwordsMap,\n ttl: sessionConfig.ttl,\n });\n const cookieValue = serialize(\n sessionConfig.cookieName,\n seal,\n sessionConfig.cookieOptions,\n );\n\n if (cookieValue.length > 4096) {\n throw new Error(\n `iron-session: Cookie length is too big (${cookieValue.length} bytes), browsers will refuse it. Try to remove some data.`,\n );\n }\n\n setCookie(res, cookieValue);\n },\n },\n\n destroy: {\n value: function destroy() {\n Object.keys(session).forEach((key) => {\n delete (session as Record<string, unknown>)[key];\n });\n const cookieValue = serialize(sessionConfig.cookieName, \"\", {\n ...sessionConfig.cookieOptions,\n maxAge: 0,\n });\n\n setCookie(res, cookieValue);\n },\n },\n });\n\n return session as IronSession<T>;\n }\n}\n\nasync function getIronSessionFromCookieStore<T extends object>(\n cookieStore: CookieStore,\n sessionOptions: SessionOptions,\n sealData: ReturnType<typeof createSealData>,\n unsealData: ReturnType<typeof createUnsealData>,\n): Promise<IronSession<T>> {\n if (!sessionOptions.cookieName) {\n throw new Error(\"iron-session: Bad usage. Missing cookie name.\");\n }\n\n if (!sessionOptions.password) {\n throw new Error(\"iron-session: Bad usage. Missing password.\");\n }\n\n const passwordsMap = normalizeStringPasswordToMap(sessionOptions.password);\n\n if (Object.values(passwordsMap).some((password) => password.length < 32)) {\n throw new Error(\n \"iron-session: Bad usage. Password must be at least 32 characters long.\",\n );\n }\n\n let sessionConfig = getSessionConfig(sessionOptions);\n const sealFromCookies = getServerActionCookie(\n sessionConfig.cookieName,\n cookieStore,\n );\n const session = sealFromCookies\n ? await unsealData<T>(sealFromCookies, {\n password: passwordsMap,\n ttl: sessionConfig.ttl,\n })\n : ({} as T);\n\n Object.defineProperties(session, {\n updateConfig: {\n value: function updateConfig(newSessionOptions: SessionOptions) {\n sessionConfig = getSessionConfig(newSessionOptions);\n },\n },\n save: {\n value: async function save() {\n const seal = await sealData(session, {\n password: passwordsMap,\n ttl: sessionConfig.ttl,\n });\n\n const cookieLength =\n sessionConfig.cookieName.length +\n seal.length +\n JSON.stringify(sessionConfig.cookieOptions).length;\n\n if (cookieLength > 4096) {\n throw new Error(\n `iron-session: Cookie length is too big (${cookieLength} bytes), browsers will refuse it. Try to remove some data.`,\n );\n }\n\n cookieStore.set(\n sessionConfig.cookieName,\n seal,\n sessionConfig.cookieOptions,\n );\n },\n },\n\n destroy: {\n value: function destroy() {\n Object.keys(session).forEach((key) => {\n delete (session as Record<string, unknown>)[key];\n });\n\n const cookieOptions = { ...sessionConfig.cookieOptions, maxAge: 0 };\n cookieStore.set(sessionConfig.cookieName, \"\", cookieOptions);\n },\n },\n });\n\n return session as IronSession<T>;\n}\n","import {\n createGetIronSession,\n createSealData,\n createUnsealData,\n} from \"./core.js\";\n\nimport * as crypto from \"uncrypto\";\n\nexport type { IronSession, SessionOptions } from \"./core.js\";\nexport const sealData = createSealData(crypto);\nexport const unsealData = createUnsealData(crypto);\nexport const getIronSession = createGetIronSession(sealData, unsealData);\n"]}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "iron-session",
-  "version": "8.0.0",
+  "version": "8.0.2",
   "description": "Secure, stateless, and cookie-based session library for JavaScript",
   "keywords": [
     "session",
@@ -38,30 +38,29 @@
   },
   "dependencies": {
     "cookie": "0.6.0",
-    "iron-webcrypto": "1.0.0",
+    "iron-webcrypto": "1.2.1",
     "uncrypto": "0.1.3"
   },
   "devDependencies": {
-    "@types/cookie": "0.5.4",
-    "@types/node": "18.18.10",
-    "@typescript-eslint/eslint-plugin": "6.11.0",
-    "@typescript-eslint/parser": "6.11.0",
-    "c8": "8.0.1",
+    "@types/cookie": "0.6.0",
+    "@types/node": "20.14.2",
+    "@typescript-eslint/eslint-plugin": "7.13.0",
+    "@typescript-eslint/parser": "7.13.0",
+    "c8": "10.1.2",
     "concurrently": "8.2.2",
-    "eslint": "8.54.0",
-    "eslint-config-prettier": "9.0.0",
+    "eslint": "8.57.0",
+    "eslint-config-prettier": "9.1.0",
     "eslint-import-resolver-node": "0.3.9",
     "eslint-import-resolver-typescript": "3.6.1",
-    "eslint-plugin-import": "2.29.0",
-    "eslint-plugin-prettier": "5.0.1",
-    "prettier": "3.1.0",
-    "prettier-plugin-packagejson": "2.4.6",
-    "publint": "0.2.5",
-    "tsup": "8.0.0",
-    "tsx": "4.1.4",
-    "typescript": "5.2.2"
+    "eslint-plugin-import": "2.29.1",
+    "eslint-plugin-prettier": "5.1.3",
+    "prettier": "3.3.2",
+    "prettier-plugin-packagejson": "2.5.0",
+    "publint": "0.2.8",
+    "tsup": "8.1.0",
+    "tsx": "4.15.4",
+    "typescript": "5.4.5"
   },
-  "packageManager": "pnpm@8.10.5",
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org"
@@ -70,7 +69,8 @@
     "build": "tsup",
     "dev": "pnpm build && concurrently \"pnpm build --watch\" \"pnpm --filter=next-example dev\" ",
     "lint": "tsc --noEmit && tsc --noEmit -p examples/next/tsconfig.json && pnpm eslint . && publint",
-    "test": "c8 -r text -r lcov node --loader tsx --test src/*.test.ts && pnpm build",
-    "test:watch": "node --loader tsx --test --watch src/*.test.ts"
+    "start": "turbo start --filter=next-example",
+    "test": "c8 -r text -r lcov node --import tsx --test src/*.test.ts && pnpm build",
+    "test:watch": "node --import tsx --test --watch src/*.test.ts"
   }
 }