@ai-matrx/auth 0.0.0 → 0.1.1

package/CHANGELOG.md

@@ -0,0 +1,32 @@
+# Changelog — @ai-matrx/auth
+
+## 0.1.1
+
+Automatic changed-only republish (docs/metadata drift since the last tag — see
+`git diff npm/auth/v0.1.0..npm/auth/v0.1.1 -- apps/shared/auth`).
+No source changes intended and no consumer action required.
+
+## 0.1.0 — 2026-10-09
+
+First release. Approved by Arman 2026-10-09 ("auth: sign-in, session, organizations").
+
+- Root: sign-in/out doors (`signInWithPassword`, `signInWithOAuth`, `signOut`, `getSession`,
+  `getPerson`, `onSessionChange`, `updatePerson`, new `refreshSession`), `sessionCredentials`
+  (the one session → `user` credential mapping; `userCredentials` kept as its shipped name),
+  session storage per platform (`memoryStorage`, `browserStorage`, `extensionStorage`,
+  `keyValueStorage`; `/node` `fileStorage`), and `createAuthClient` (refuses a secret key).
+- `/organizations`: the active-organization ladder, membership/account-choice/favourite doors and
+  the refusal classifier, plus NEW `createActiveOrganization` — the held-request store
+  (`ensureOrgId` waits for the ladder, refuses by name with none, a record's org wins; `switchTo`
+  saves last active; identity-keyed per-tab hold; sign-out resets). Never a list filter.
+- `/react`: `useSession`, `useActiveOrganization`, `useSessionIdentity`.
+- MOVED IN, behavior verbatim: `@ai-matrx/data/auth` (root), `/organizations`,
+  `/session-identity`, `/testing`, `/next` (every Next.js client), the auth and active-org cookies
+  (`/cookies`, from `@ai-matrx/data/db`); the five-kind credentials port (`/credentials`, from
+  `@ai-matrx/api/credentials`).
+
+### Consumer action
+
+None. Every moved name keeps its old path (`@ai-matrx/data/*`, `@ai-matrx/api/credentials`
+re-export from here). New code imports `@ai-matrx/auth`.
+

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 AI Matrix Engine
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,33 @@
 # @ai-matrx/auth
 
-Reserved for the planned AI Matrx shared authentication package. This `0.0.0` release reserves the canonical package name; it does not contain an implementation yet.
+Sign-in, session and organizations for every AI Matrx app — the small package at the top of the
+app. Framework-free core; `/react` and `/next` sections; pay only for the sections you import.
+
+```ts
+import { createAuthClient, signInWithPassword, sessionCredentials, signOut } from "@ai-matrx/auth";
+import { createActiveOrganization, readMemberships } from "@ai-matrx/auth/organizations";
+
+const supabase = createAuthClient({ url: "https://db.matrxserver.com", key: PUBLISHABLE_KEY });
+const { person } = await signInWithPassword(supabase, { email, password });
+const active = createActiveOrganization({ client: supabase });
+const orgId = await active.ensureOrgId();           // held until the ladder answers
+const credentials = sessionCredentials(supabase);   // hand to @ai-matrx/api's createApi
+```
+
+| Section | What |
+|---|---|
+| `@ai-matrx/auth` | sign-in/out, session, refresh, `sessionCredentials`, storage per platform, `createAuthClient` |
+| `/organizations` | memberships, favourites, the active-organization ladder and `createActiveOrganization` |
+| `/credentials` | the five credential kinds and the one credential → header mapping |
+| `/session-identity` | who is acting, live from the session |
+| `/cookies` | the domain-wide auth cookie and the active-organization cookie |
+| `/next` | every Next.js Supabase client (browser, RSC, route, middleware) |
+| `/react` | `useSession`, `useActiveOrganization`, `useSessionIdentity` |
+| `/node` | `fileStorage` — a script's session survives between runs |
+| `/testing` | fake sessions for tests |
+
+Session storage: browser `browserStorage()`, extension `extensionStorage()`, desktop
+`keyValueStorage(store)`, Node `fileStorage(path)` or `memoryStorage()`, Next.js `/next`.
+
+The active organization is never a list filter: reads show everything the person can see; the
+active organization is only where new things are saved and which organization a server call runs in.

package/dist/auth-cookie-DWx6Q3xo.d.cts

@@ -0,0 +1,168 @@
+/**
+ * Shared auth-cookie options for EVERY Supabase client an application
+ * constructs (browser, server, middleware, OAuth callbacks). All construction
+ * sites MUST pass these options — a client using the default cookie name
+ * cannot see the session the others wrote.
+ *
+ * WHY (the 2026-07 Matrx deployment split): one login must work on every
+ * subdomain of the platform's apex (e.g. app.example.com, manage.example.com),
+ * so on those hosts the auth cookie is issued domain-wide
+ * (`Domain=.example.com`) instead of Supabase's default host-only cookie.
+ *
+ * The cookie is also RENAMED (default `sb-<project-ref>-auth-token` →
+ * `sb-matrx-auth`): re-issuing an existing host-only cookie as domain-wide
+ * under the SAME name leaves two same-name cookies in the browser (different
+ * Domain attributes = distinct cookies), and whichever the browser sends
+ * first wins — auth flaps. A new name makes the transition deterministic:
+ * every user re-logs-in exactly once and the old cookie expires unused.
+ * The `sb-` prefix is kept on purpose — cleanup paths that scrub session
+ * cookies delete by that prefix.
+ *
+ * The Domain attribute is ONLY set on real apex hosts. localhost and preview
+ * hosts get a host-only cookie — a browser rejects any Set-Cookie whose
+ * Domain does not cover the current host, so setting it unconditionally would
+ * silently break auth everywhere else.
+ *
+ * The apex domain is a VALUE the host passes in (never read from an env var
+ * here): `createAuthCookie({ apexDomain: "aimatrx.com" })`.
+ *
+ * THE RENAME MIGRATION (0.5.0 — moved in from matrx-frontend, where it was
+ * 44 lines of host code every other consumer would have had to re-derive):
+ * replacing the auth authority (a new Supabase project) means a NEW cookie
+ * name, and a tab still running the OLD bundle keeps writing the OLD name for
+ * days. `migrateLegacyCookies` seeds the new storage key from the old one
+ * ONLY when the new key is absent — never overwriting a live session — and
+ * `isCurrentCookie` recognizes both the base name and Supabase's numbered
+ * chunk suffixes (`<name>.0`, `<name>.1`, …), which a naive `startsWith`
+ * check gets wrong for any cookie that merely shares the prefix.
+ */
+/** Structurally compatible with @supabase/ssr's CookieOptionsWithName. */
+interface AuthCookieOptions {
+    name: string;
+    /** Remote hosts require HTTPS; loopback development remains usable over HTTP. */
+    secure: boolean;
+    domain?: string;
+}
+/** A cookie as read from a request — name + value, nothing else needed. */
+interface AuthCookieValue {
+    name: string;
+    value: string;
+}
+declare const DEFAULT_AUTH_COOKIE_NAME = "sb-matrx-auth";
+interface CreateAuthCookieArgs {
+    /** The apex domain one login must span (e.g. `"aimatrx.com"`). */
+    apexDomain: string;
+    /** Override only for a second, unrelated deployment — never per-app. */
+    cookieName?: string;
+    /**
+     * The storage key a PREVIOUS auth authority used. When present, cookies
+     * under this name are seeded onto `cookieName` (absent-only) by
+     * `migrateLegacyCookies`, and the middleware binding clears them at the
+     * scope this host issued them on.
+     */
+    legacyCookieName?: string;
+}
+interface AuthCookie {
+    cookieName: string;
+    /** The superseded storage key, when this deployment has one. */
+    legacyCookieName: string | undefined;
+    /**
+     * Cookie options for the host serving the current request.
+     * @param host `Host` header or `window.location.hostname` (port tolerated).
+     */
+    optionsForHost(host: string | null | undefined): AuthCookieOptions;
+    /** Browser variant — resolves the host from `window` (SSR-safe). */
+    browserOptions(): AuthCookieOptions;
+    /**
+     * Is this cookie name the CURRENT auth cookie — base name or one of
+     * Supabase's numbered chunks (`<name>.0`)? A prefix test is wrong: it
+     * matches `<name>.anything`, including unrelated cookies.
+     */
+    isCurrentCookie(name: string): boolean;
+    /**
+     * Cookies to seed under the current name, derived from the legacy name.
+     * Returns `[]` when any current cookie already exists (never overwrite a
+     * live session) or when no legacy name is configured.
+     */
+    migrateLegacyCookies(cookies: readonly AuthCookieValue[]): AuthCookieValue[];
+    /**
+     * THE POISONED-JAR READ. A browser can hold the SAME auth cookie name twice
+     * — once host-only, once at `.apex` — because different Domain attributes
+     * make distinct cookies, and it sends both in one `Cookie` header. Every
+     * reassembler downstream (`@supabase/ssr`'s `combineChunks`) resolves a
+     * chunk with `find()`, i.e. FIRST WINS, and the browser decides the order.
+     * An empty shadow that sorts first therefore reassembles to `""` and every
+     * server read answers anonymous while the tab is signed in.
+     *
+     * This collapses each auth-cookie NAME to one entry, preferring the first
+     * NON-EMPTY value. Non-auth cookies pass through untouched, in order.
+     *
+     * A `Cookie` header carries no Domain, so which scope a value came from is
+     * genuinely unknowable here — non-empty-wins is the strongest correct rule
+     * available, and `@supabase/ssr` already refuses a chunk set that decodes
+     * incoherently. `shadowedNames` names every auth cookie that arrived more
+     * than once, so the caller can EXPIRE the losing scope instead of leaving
+     * the user to clear cookies by hand.
+     *
+     * THE SECOND POISON, AND IT IS AN IDENTITY LEAK: one storage key arriving
+     * BOTH unchunked (`<name>`) and chunked (`<name>.0`, `<name>.1`). These are
+     * DIFFERENT cookie names, so the per-name collapse above cannot see them,
+     * and `@supabase/ssr`'s `combineChunks` returns the UNCHUNKED value the
+     * moment it is non-empty — it never even reads the chunks. A stale base
+     * cookie therefore shadows a freshly written chunked pair, and every read
+     * resolves the PREVIOUS person while the new session sits unread beside it.
+     * That is a different user's session being served, not merely a logout.
+     *
+     * `applyServerStorage` never writes that shape — it removes every chunk-like
+     * sibling of whatever it writes — so a jar holding both is RESIDUE from a
+     * removal that did not land (see `middlewareSession`: a two-scope removal
+     * collapses on `ResponseCookies`, which is how this residue is made).
+     *
+     * WHICH COPY IS NEWER IS UNKNOWABLE HERE, and both directions of residue are
+     * producible, so preferring either shape is a coin flip on WHOSE SESSION TO
+     * SERVE. This drops the whole family from the read instead: nobody is signed
+     * in, every name in it is returned in `ambiguousNames` to be expired, and the
+     * host's honest-screen banner says so with the one action that fixes it. A
+     * wrong sign-out is recoverable in one click; a wrong identity is not.
+     */
+    reconcile(cookies: readonly AuthCookieValue[]): ReconciledAuthCookies;
+}
+/** The outcome of {@link AuthCookie.reconcile}. */
+interface ReconciledAuthCookies {
+    /** One entry per name; auth names resolved to their non-empty value. */
+    cookies: AuthCookieValue[];
+    /** Auth cookie names that arrived more than once (i.e. at two scopes). */
+    shadowedNames: string[];
+    /**
+     * Auth cookie names belonging to a storage key that arrived UNCHUNKED AND
+     * CHUNKED at once — see {@link AuthCookie.reconcile}. Their values have been
+     * dropped from `cookies`, and they must be expired on EVERY host, including
+     * the ones that issue a host-only cookie: unlike a two-scope shadow there is
+     * no copy here that could be the good one.
+     */
+    ambiguousNames: string[];
+    /** The storage keys that arrived in both shapes. Named for the scream. */
+    ambiguousKeys: string[];
+    /** `true` when the jar is split and needs healing. */
+    split: boolean;
+}
+/**
+ * Parse a raw `Cookie` request header, **PRESERVING DUPLICATES AND ORDER**.
+ *
+ * 🚨 THIS IS THE ONLY WAY TO SEE A SPLIT JAR. Next's `RequestCookies` (and the
+ * `cookies()` store built on it) parses the header into a Map keyed by NAME,
+ * so two same-name cookies at two Domain scopes collapse to ONE before any
+ * application code runs — and the survivor is whichever the browser happened
+ * to send LAST. Measured against the real class:
+ *
+ *   "sb-…-v2.0=; sb-…-v2.0=base64-REAL"  ->  [{ value: "base64-REAL" }]   works
+ *   "sb-…-v2.0=base64-REAL; sb-…-v2.0="  ->  [{ value: "" }]              anonymous
+ *
+ * That coin flip IS the production break, and it is invisible from the
+ * collapsed jar: reconciliation over `getAll()` is a no-op no matter how
+ * carefully it is written. Every door must therefore reconcile over THIS.
+ */
+declare function parseCookieHeader(header: string | null | undefined): AuthCookieValue[];
+declare function createAuthCookie(args: CreateAuthCookieArgs): AuthCookie;
+
+export { type AuthCookie as A, type CreateAuthCookieArgs as C, DEFAULT_AUTH_COOKIE_NAME as D, type ReconciledAuthCookies as R, type AuthCookieOptions as a, type AuthCookieValue as b, createAuthCookie as c, parseCookieHeader as p };

package/dist/auth-cookie-DWx6Q3xo.d.ts

@@ -0,0 +1,168 @@
+/**
+ * Shared auth-cookie options for EVERY Supabase client an application
+ * constructs (browser, server, middleware, OAuth callbacks). All construction
+ * sites MUST pass these options — a client using the default cookie name
+ * cannot see the session the others wrote.
+ *
+ * WHY (the 2026-07 Matrx deployment split): one login must work on every
+ * subdomain of the platform's apex (e.g. app.example.com, manage.example.com),
+ * so on those hosts the auth cookie is issued domain-wide
+ * (`Domain=.example.com`) instead of Supabase's default host-only cookie.
+ *
+ * The cookie is also RENAMED (default `sb-<project-ref>-auth-token` →
+ * `sb-matrx-auth`): re-issuing an existing host-only cookie as domain-wide
+ * under the SAME name leaves two same-name cookies in the browser (different
+ * Domain attributes = distinct cookies), and whichever the browser sends
+ * first wins — auth flaps. A new name makes the transition deterministic:
+ * every user re-logs-in exactly once and the old cookie expires unused.
+ * The `sb-` prefix is kept on purpose — cleanup paths that scrub session
+ * cookies delete by that prefix.
+ *
+ * The Domain attribute is ONLY set on real apex hosts. localhost and preview
+ * hosts get a host-only cookie — a browser rejects any Set-Cookie whose
+ * Domain does not cover the current host, so setting it unconditionally would
+ * silently break auth everywhere else.
+ *
+ * The apex domain is a VALUE the host passes in (never read from an env var
+ * here): `createAuthCookie({ apexDomain: "aimatrx.com" })`.
+ *
+ * THE RENAME MIGRATION (0.5.0 — moved in from matrx-frontend, where it was
+ * 44 lines of host code every other consumer would have had to re-derive):
+ * replacing the auth authority (a new Supabase project) means a NEW cookie
+ * name, and a tab still running the OLD bundle keeps writing the OLD name for
+ * days. `migrateLegacyCookies` seeds the new storage key from the old one
+ * ONLY when the new key is absent — never overwriting a live session — and
+ * `isCurrentCookie` recognizes both the base name and Supabase's numbered
+ * chunk suffixes (`<name>.0`, `<name>.1`, …), which a naive `startsWith`
+ * check gets wrong for any cookie that merely shares the prefix.
+ */
+/** Structurally compatible with @supabase/ssr's CookieOptionsWithName. */
+interface AuthCookieOptions {
+    name: string;
+    /** Remote hosts require HTTPS; loopback development remains usable over HTTP. */
+    secure: boolean;
+    domain?: string;
+}
+/** A cookie as read from a request — name + value, nothing else needed. */
+interface AuthCookieValue {
+    name: string;
+    value: string;
+}
+declare const DEFAULT_AUTH_COOKIE_NAME = "sb-matrx-auth";
+interface CreateAuthCookieArgs {
+    /** The apex domain one login must span (e.g. `"aimatrx.com"`). */
+    apexDomain: string;
+    /** Override only for a second, unrelated deployment — never per-app. */
+    cookieName?: string;
+    /**
+     * The storage key a PREVIOUS auth authority used. When present, cookies
+     * under this name are seeded onto `cookieName` (absent-only) by
+     * `migrateLegacyCookies`, and the middleware binding clears them at the
+     * scope this host issued them on.
+     */
+    legacyCookieName?: string;
+}
+interface AuthCookie {
+    cookieName: string;
+    /** The superseded storage key, when this deployment has one. */
+    legacyCookieName: string | undefined;
+    /**
+     * Cookie options for the host serving the current request.
+     * @param host `Host` header or `window.location.hostname` (port tolerated).
+     */
+    optionsForHost(host: string | null | undefined): AuthCookieOptions;
+    /** Browser variant — resolves the host from `window` (SSR-safe). */
+    browserOptions(): AuthCookieOptions;
+    /**
+     * Is this cookie name the CURRENT auth cookie — base name or one of
+     * Supabase's numbered chunks (`<name>.0`)? A prefix test is wrong: it
+     * matches `<name>.anything`, including unrelated cookies.
+     */
+    isCurrentCookie(name: string): boolean;
+    /**
+     * Cookies to seed under the current name, derived from the legacy name.
+     * Returns `[]` when any current cookie already exists (never overwrite a
+     * live session) or when no legacy name is configured.
+     */
+    migrateLegacyCookies(cookies: readonly AuthCookieValue[]): AuthCookieValue[];
+    /**
+     * THE POISONED-JAR READ. A browser can hold the SAME auth cookie name twice
+     * — once host-only, once at `.apex` — because different Domain attributes
+     * make distinct cookies, and it sends both in one `Cookie` header. Every
+     * reassembler downstream (`@supabase/ssr`'s `combineChunks`) resolves a
+     * chunk with `find()`, i.e. FIRST WINS, and the browser decides the order.
+     * An empty shadow that sorts first therefore reassembles to `""` and every
+     * server read answers anonymous while the tab is signed in.
+     *
+     * This collapses each auth-cookie NAME to one entry, preferring the first
+     * NON-EMPTY value. Non-auth cookies pass through untouched, in order.
+     *
+     * A `Cookie` header carries no Domain, so which scope a value came from is
+     * genuinely unknowable here — non-empty-wins is the strongest correct rule
+     * available, and `@supabase/ssr` already refuses a chunk set that decodes
+     * incoherently. `shadowedNames` names every auth cookie that arrived more
+     * than once, so the caller can EXPIRE the losing scope instead of leaving
+     * the user to clear cookies by hand.
+     *
+     * THE SECOND POISON, AND IT IS AN IDENTITY LEAK: one storage key arriving
+     * BOTH unchunked (`<name>`) and chunked (`<name>.0`, `<name>.1`). These are
+     * DIFFERENT cookie names, so the per-name collapse above cannot see them,
+     * and `@supabase/ssr`'s `combineChunks` returns the UNCHUNKED value the
+     * moment it is non-empty — it never even reads the chunks. A stale base
+     * cookie therefore shadows a freshly written chunked pair, and every read
+     * resolves the PREVIOUS person while the new session sits unread beside it.
+     * That is a different user's session being served, not merely a logout.
+     *
+     * `applyServerStorage` never writes that shape — it removes every chunk-like
+     * sibling of whatever it writes — so a jar holding both is RESIDUE from a
+     * removal that did not land (see `middlewareSession`: a two-scope removal
+     * collapses on `ResponseCookies`, which is how this residue is made).
+     *
+     * WHICH COPY IS NEWER IS UNKNOWABLE HERE, and both directions of residue are
+     * producible, so preferring either shape is a coin flip on WHOSE SESSION TO
+     * SERVE. This drops the whole family from the read instead: nobody is signed
+     * in, every name in it is returned in `ambiguousNames` to be expired, and the
+     * host's honest-screen banner says so with the one action that fixes it. A
+     * wrong sign-out is recoverable in one click; a wrong identity is not.
+     */
+    reconcile(cookies: readonly AuthCookieValue[]): ReconciledAuthCookies;
+}
+/** The outcome of {@link AuthCookie.reconcile}. */
+interface ReconciledAuthCookies {
+    /** One entry per name; auth names resolved to their non-empty value. */
+    cookies: AuthCookieValue[];
+    /** Auth cookie names that arrived more than once (i.e. at two scopes). */
+    shadowedNames: string[];
+    /**
+     * Auth cookie names belonging to a storage key that arrived UNCHUNKED AND
+     * CHUNKED at once — see {@link AuthCookie.reconcile}. Their values have been
+     * dropped from `cookies`, and they must be expired on EVERY host, including
+     * the ones that issue a host-only cookie: unlike a two-scope shadow there is
+     * no copy here that could be the good one.
+     */
+    ambiguousNames: string[];
+    /** The storage keys that arrived in both shapes. Named for the scream. */
+    ambiguousKeys: string[];
+    /** `true` when the jar is split and needs healing. */
+    split: boolean;
+}
+/**
+ * Parse a raw `Cookie` request header, **PRESERVING DUPLICATES AND ORDER**.
+ *
+ * 🚨 THIS IS THE ONLY WAY TO SEE A SPLIT JAR. Next's `RequestCookies` (and the
+ * `cookies()` store built on it) parses the header into a Map keyed by NAME,
+ * so two same-name cookies at two Domain scopes collapse to ONE before any
+ * application code runs — and the survivor is whichever the browser happened
+ * to send LAST. Measured against the real class:
+ *
+ *   "sb-…-v2.0=; sb-…-v2.0=base64-REAL"  ->  [{ value: "base64-REAL" }]   works
+ *   "sb-…-v2.0=base64-REAL; sb-…-v2.0="  ->  [{ value: "" }]              anonymous
+ *
+ * That coin flip IS the production break, and it is invisible from the
+ * collapsed jar: reconciliation over `getAll()` is a no-op no matter how
+ * carefully it is written. Every door must therefore reconcile over THIS.
+ */
+declare function parseCookieHeader(header: string | null | undefined): AuthCookieValue[];
+declare function createAuthCookie(args: CreateAuthCookieArgs): AuthCookie;
+
+export { type AuthCookie as A, type CreateAuthCookieArgs as C, DEFAULT_AUTH_COOKIE_NAME as D, type ReconciledAuthCookies as R, type AuthCookieOptions as a, type AuthCookieValue as b, createAuthCookie as c, parseCookieHeader as p };

package/dist/cookies.cjs

@@ -0,0 +1,233 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/cookies.ts
+var cookies_exports = {};
+__export(cookies_exports, {
+  DEFAULT_ACTIVE_ORG_COOKIE_MAX_AGE: () => DEFAULT_ACTIVE_ORG_COOKIE_MAX_AGE,
+  DEFAULT_ACTIVE_ORG_COOKIE_NAME: () => DEFAULT_ACTIVE_ORG_COOKIE_NAME,
+  DEFAULT_AUTH_COOKIE_NAME: () => DEFAULT_AUTH_COOKIE_NAME,
+  createActiveOrgCookie: () => createActiveOrgCookie,
+  createAuthCookie: () => createAuthCookie,
+  decodeActiveOrgSelection: () => decodeActiveOrgSelection,
+  encodeActiveOrgSelection: () => encodeActiveOrgSelection,
+  parseCookieHeader: () => parseCookieHeader
+});
+module.exports = __toCommonJS(cookies_exports);
+
+// src/cookies/auth-cookie.ts
+var DEFAULT_AUTH_COOKIE_NAME = "sb-matrx-auth";
+function parseCookieHeader(header) {
+  if (!header) return [];
+  const out = [];
+  for (const pair of header.split(";")) {
+    const eq = pair.indexOf("=");
+    const name = (eq === -1 ? pair : pair.slice(0, eq)).trim();
+    if (!name) continue;
+    const raw = eq === -1 ? "" : pair.slice(eq + 1).trim();
+    let value = raw;
+    try {
+      value = decodeURIComponent(raw);
+    } catch {
+    }
+    out.push({ name, value });
+  }
+  return out;
+}
+function belongsToStorageKey(name, storageKey) {
+  if (name === storageKey) return true;
+  if (!name.startsWith(`${storageKey}.`)) return false;
+  return /^(0|[1-9][0-9]*)$/.test(name.slice(storageKey.length + 1));
+}
+function renamedCookie(cookie, from, to) {
+  if (cookie.name === from) return { ...cookie, name: to };
+  const prefix = `${from}.`;
+  if (!cookie.name.startsWith(prefix)) return null;
+  const chunk = cookie.name.slice(prefix.length);
+  if (!/^(0|[1-9][0-9]*)$/.test(chunk)) return null;
+  return { ...cookie, name: `${to}.${chunk}` };
+}
+function createAuthCookie(args) {
+  const cookieName = args.cookieName ?? DEFAULT_AUTH_COOKIE_NAME;
+  const legacyCookieName = args.legacyCookieName;
+  const apex = args.apexDomain.toLowerCase();
+  const optionsForHost = (host) => {
+    const normalized = (host ?? "").toLowerCase();
+    const hostname = normalized.startsWith("[") ? normalized.slice(1, normalized.indexOf("]")) : normalized === "::1" ? normalized : normalized.split(":")[0] ?? "";
+    const loopback = hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "::1" || /^127(?:\.(?:0|[1-9]\d{0,2})){3}$/.test(hostname) && hostname.split(".").every((part) => Number(part) <= 255);
+    const secure = !loopback;
+    const onApex = hostname === apex || hostname.endsWith(`.${apex}`);
+    return onApex ? { name: cookieName, domain: `.${apex}`, secure } : { name: cookieName, secure };
+  };
+  const isCurrentCookie = (name) => belongsToStorageKey(name, cookieName);
+  const isAuthCookie = (name) => isCurrentCookie(name) || legacyCookieName !== void 0 && (name === legacyCookieName || name.startsWith(`${legacyCookieName}.`));
+  const reconcile = (cookies) => {
+    const seen = /* @__PURE__ */ new Map();
+    const out = [];
+    const shadowed = /* @__PURE__ */ new Set();
+    for (const cookie of cookies) {
+      const at = seen.get(cookie.name);
+      if (at === void 0) {
+        seen.set(cookie.name, out.length);
+        out.push({ name: cookie.name, value: cookie.value });
+        continue;
+      }
+      if (!isAuthCookie(cookie.name)) continue;
+      shadowed.add(cookie.name);
+      const held = out[at];
+      if (held !== void 0 && held.value.length === 0) {
+        out[at] = { name: cookie.name, value: cookie.value };
+      }
+    }
+    const ambiguous = /* @__PURE__ */ new Set();
+    const ambiguousKeys = [];
+    const byName = new Map(out.map((cookie) => [cookie.name, cookie]));
+    const storageKeys = [cookieName, ...legacyCookieName ? [legacyCookieName] : []];
+    for (const storageKey of storageKeys) {
+      const unchunked = byName.get(storageKey);
+      const firstChunk = byName.get(`${storageKey}.0`);
+      if (!unchunked?.value || !firstChunk?.value) continue;
+      ambiguousKeys.push(storageKey);
+      for (const { name } of out) {
+        if (belongsToStorageKey(name, storageKey)) ambiguous.add(name);
+      }
+    }
+    const resolved = ambiguous.size === 0 ? out : out.filter(({ name }) => !ambiguous.has(name));
+    const shadowedNames = [...shadowed];
+    const ambiguousNames = [...ambiguous];
+    return {
+      cookies: resolved,
+      shadowedNames,
+      ambiguousNames,
+      ambiguousKeys,
+      split: shadowedNames.length > 0 || ambiguousNames.length > 0
+    };
+  };
+  return {
+    cookieName,
+    legacyCookieName,
+    optionsForHost,
+    reconcile,
+    browserOptions: () => optionsForHost(
+      typeof window !== "undefined" ? window.location.hostname : null
+    ),
+    isCurrentCookie,
+    migrateLegacyCookies: (cookies) => {
+      if (!legacyCookieName) return [];
+      if (cookies.some(({ name }) => isCurrentCookie(name))) return [];
+      return cookies.flatMap((cookie) => {
+        const renamed = renamedCookie(cookie, legacyCookieName, cookieName);
+        return renamed ? [renamed] : [];
+      });
+    }
+  };
+}
+
+// src/cookies/active-org-cookie.ts
+var import_uuid = require("@ai-matrx/kit/uuid");
+var DEFAULT_ACTIVE_ORG_COOKIE_NAME = "matrx-active-org";
+var DEFAULT_ACTIVE_ORG_COOKIE_MAX_AGE = 60 * 60 * 24 * 365;
+function encodeActiveOrgSelection(selection) {
+  if (!(0, import_uuid.isUuidShape)(selection.userId) || !(0, import_uuid.isUuidShape)(selection.organizationId)) {
+    throw new Error(
+      "encodeActiveOrgSelection: userId and organizationId must both be UUIDs."
+    );
+  }
+  return `${selection.userId.toLowerCase()}:${selection.organizationId.toLowerCase()}`;
+}
+function decodeActiveOrgSelection(raw) {
+  if (!raw) return null;
+  const parts = raw.split(":");
+  if (parts.length !== 2) return null;
+  const [userId, organizationId] = parts;
+  if (!(0, import_uuid.isUuidShape)(userId) || !(0, import_uuid.isUuidShape)(organizationId)) return null;
+  return {
+    userId: userId.toLowerCase(),
+    organizationId: organizationId.toLowerCase()
+  };
+}
+function selectionFor(cookies, cookieName, userId) {
+  if (!userId) return null;
+  const wanted = userId.toLowerCase();
+  for (const cookie of cookies) {
+    if (cookie.name !== cookieName) continue;
+    const decoded = decodeActiveOrgSelection(cookie.value);
+    if (decoded && decoded.userId === wanted) return decoded.organizationId;
+  }
+  return null;
+}
+function attributes(options, maxAge, secure) {
+  const parts = [`Path=/`, `Max-Age=${maxAge}`, `SameSite=Lax`];
+  if (options.domain) parts.push(`Domain=${options.domain}`);
+  if (secure) parts.push("Secure");
+  return parts.join("; ");
+}
+function hasDocument() {
+  return typeof document !== "undefined" && typeof document.cookie === "string";
+}
+function createActiveOrgCookie(args) {
+  const cookieName = args.cookieName ?? DEFAULT_ACTIVE_ORG_COOKIE_NAME;
+  const maxAge = args.maxAgeSeconds ?? DEFAULT_ACTIVE_ORG_COOKIE_MAX_AGE;
+  const apexes = args.apexDomains.map((apex) => apex.toLowerCase());
+  const optionsForHost = (host) => {
+    const hostname = (host ?? "").split(":")[0]?.toLowerCase() ?? "";
+    const apex = apexes.find(
+      (candidate) => hostname === candidate || hostname.endsWith(`.${candidate}`)
+    );
+    return apex ? { name: cookieName, domain: `.${apex}` } : { name: cookieName };
+  };
+  const serialize = (host, selection, secure = false) => {
+    const options = optionsForHost(host);
+    if (!selection) {
+      return `${cookieName}=; ${attributes(options, 0, secure)}`;
+    }
+    return `${cookieName}=${encodeActiveOrgSelection(selection)}; ${attributes(options, maxAge, secure)}`;
+  };
+  const browserHost = () => typeof window !== "undefined" ? window.location.hostname : null;
+  const browserSecure = () => typeof window !== "undefined" && window.location.protocol === "https:";
+  const expireHostOnly = (secure) => {
+    document.cookie = `${cookieName}=; ${attributes({ name: cookieName }, 0, secure)}`;
+  };
+  return {
+    cookieName,
+    optionsForHost,
+    serialize,
+    readFromCookieHeader: (header, userId) => selectionFor(parseCookieHeader(header), cookieName, userId),
+    read: (userId) => {
+      if (!hasDocument()) return null;
+      return selectionFor(parseCookieHeader(document.cookie), cookieName, userId);
+    },
+    write: (selection) => {
+      if (!hasDocument()) return;
+      const host = browserHost();
+      const secure = browserSecure();
+      if (optionsForHost(host).domain) expireHostOnly(secure);
+      document.cookie = serialize(host, selection, secure);
+    },
+    clear: () => {
+      if (!hasDocument()) return;
+      const host = browserHost();
+      const secure = browserSecure();
+      expireHostOnly(secure);
+      if (optionsForHost(host).domain) {
+        document.cookie = serialize(host, null, secure);
+      }
+    }
+  };
+}