{
  "$schema": "https://create-turbo-stack.dev/schema/package-registry.json",
  "name": "session",
  "type": "registry:package",
  "description": "Secure session ID generation, hashing, and verification.",
  "dependencies": [],
  "devDependencies": [],
  "registryDependencies": [
    "crypto"
  ],
  "envVars": {},
  "exports": [
    "."
  ],
  "lib": [
    "ES2022",
    "WebWorker"
  ],
  "environment": "universal",
  "build": "none",
  "categories": [
    "foundation",
    "security",
    "auth"
  ],
  "docs": "Generate a secure session ID, hash it for at-rest storage, and verify incoming tokens — not an auth system; projects using better-auth, Supabase Auth, or Clerk do not need this.",
  "files": [
    {
      "path": "src/index.ts",
      "type": "registry:source",
      "content": "import { randomToken, sha256 } from \"{{scope}}/crypto\";\n\n/**\n * Generates a new opaque session ID.\n * Returns a 64-character lowercase hex string (256-bit entropy via CSPRNG).\n *\n * This value is a secret. Do not store it in plaintext — pass it to hashSessionId\n * and store the hash. Send the raw ID to the client (cookie, header, response body).\n */\nexport function createSessionId(): string {\n  return randomToken(32);\n}\n\n/**\n * Returns the SHA-256 hash of a session ID as a lowercase hex string.\n * Store this in your database, never the raw ID.\n * If the database is compromised, stolen hashes cannot be used as tokens.\n */\nexport async function hashSessionId(id: string): Promise<string> {\n  return sha256(id);\n}\n\n/**\n * Verifies an incoming session ID against a stored hash.\n * Re-hashes the incoming ID unconditionally before comparing — avoids\n * short-circuit evaluation on the raw secret. Returns true on match.\n *\n * Usage: retrieve the stored hash from your database, then call this.\n * Do not compare raw IDs.\n */\nexport async function verifySessionId(\n  incomingId: string,\n  storedHash: string,\n): Promise<boolean> {\n  const hash = await hashSessionId(incomingId);\n  return hash === storedHash;\n}\n"
    }
  ],
  "checksum": "sha256-9642b65484310689340524a6f90f55c1073f5b795c9ff7c2856a442642b2c715"
}