@ai-matrx/auth 0.0.0 → 0.1.1

package/dist/next.cjs

@@ -0,0 +1,655 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/next.ts
+var next_exports = {};
+__export(next_exports, {
+  AMBIGUOUS_AUTH_COOKIE_HEADER: () => AMBIGUOUS_AUTH_COOKIE_HEADER,
+  AUTH_COOKIE_RESPONSE_HEADERS: () => AUTH_COOKIE_RESPONSE_HEADERS,
+  AUTH_REFRESH_CEILING_MS: () => AUTH_REFRESH_CEILING_MS,
+  DEFAULT_AUTH_COOKIE_NAME: () => DEFAULT_AUTH_COOKIE_NAME,
+  MissingSupabaseIdentityError: () => MissingSupabaseIdentityError,
+  SPLIT_COOKIE_JAR_HEADER: () => SPLIT_COOKIE_JAR_HEADER,
+  createAuthBudget: () => createAuthBudget,
+  createAuthCookie: () => createAuthCookie,
+  createNextSupabase: () => createNextSupabase,
+  serializeSetCookie: () => serializeSetCookie,
+  toResponseCookie: () => toResponseCookie
+});
+module.exports = __toCommonJS(next_exports);
+
+// src/next/supabase.ts
+var import_ssr = require("@supabase/ssr");
+
+// src/cookies/auth-cookie.ts
+var DEFAULT_AUTH_COOKIE_NAME = "sb-matrx-auth";
+function parseCookieHeader(header) {
+  if (!header) return [];
+  const out = [];
+  for (const pair of header.split(";")) {
+    const eq = pair.indexOf("=");
+    const name = (eq === -1 ? pair : pair.slice(0, eq)).trim();
+    if (!name) continue;
+    const raw = eq === -1 ? "" : pair.slice(eq + 1).trim();
+    let value = raw;
+    try {
+      value = decodeURIComponent(raw);
+    } catch {
+    }
+    out.push({ name, value });
+  }
+  return out;
+}
+function belongsToStorageKey(name, storageKey) {
+  if (name === storageKey) return true;
+  if (!name.startsWith(`${storageKey}.`)) return false;
+  return /^(0|[1-9][0-9]*)$/.test(name.slice(storageKey.length + 1));
+}
+function renamedCookie(cookie, from, to) {
+  if (cookie.name === from) return { ...cookie, name: to };
+  const prefix = `${from}.`;
+  if (!cookie.name.startsWith(prefix)) return null;
+  const chunk = cookie.name.slice(prefix.length);
+  if (!/^(0|[1-9][0-9]*)$/.test(chunk)) return null;
+  return { ...cookie, name: `${to}.${chunk}` };
+}
+function createAuthCookie(args) {
+  const cookieName = args.cookieName ?? DEFAULT_AUTH_COOKIE_NAME;
+  const legacyCookieName = args.legacyCookieName;
+  const apex = args.apexDomain.toLowerCase();
+  const optionsForHost = (host) => {
+    const normalized = (host ?? "").toLowerCase();
+    const hostname = normalized.startsWith("[") ? normalized.slice(1, normalized.indexOf("]")) : normalized === "::1" ? normalized : normalized.split(":")[0] ?? "";
+    const loopback = hostname === "localhost" || hostname.endsWith(".localhost") || hostname === "::1" || /^127(?:\.(?:0|[1-9]\d{0,2})){3}$/.test(hostname) && hostname.split(".").every((part) => Number(part) <= 255);
+    const secure = !loopback;
+    const onApex = hostname === apex || hostname.endsWith(`.${apex}`);
+    return onApex ? { name: cookieName, domain: `.${apex}`, secure } : { name: cookieName, secure };
+  };
+  const isCurrentCookie = (name) => belongsToStorageKey(name, cookieName);
+  const isAuthCookie = (name) => isCurrentCookie(name) || legacyCookieName !== void 0 && (name === legacyCookieName || name.startsWith(`${legacyCookieName}.`));
+  const reconcile = (cookies) => {
+    const seen = /* @__PURE__ */ new Map();
+    const out = [];
+    const shadowed = /* @__PURE__ */ new Set();
+    for (const cookie of cookies) {
+      const at = seen.get(cookie.name);
+      if (at === void 0) {
+        seen.set(cookie.name, out.length);
+        out.push({ name: cookie.name, value: cookie.value });
+        continue;
+      }
+      if (!isAuthCookie(cookie.name)) continue;
+      shadowed.add(cookie.name);
+      const held = out[at];
+      if (held !== void 0 && held.value.length === 0) {
+        out[at] = { name: cookie.name, value: cookie.value };
+      }
+    }
+    const ambiguous = /* @__PURE__ */ new Set();
+    const ambiguousKeys = [];
+    const byName = new Map(out.map((cookie) => [cookie.name, cookie]));
+    const storageKeys = [cookieName, ...legacyCookieName ? [legacyCookieName] : []];
+    for (const storageKey of storageKeys) {
+      const unchunked = byName.get(storageKey);
+      const firstChunk = byName.get(`${storageKey}.0`);
+      if (!unchunked?.value || !firstChunk?.value) continue;
+      ambiguousKeys.push(storageKey);
+      for (const { name } of out) {
+        if (belongsToStorageKey(name, storageKey)) ambiguous.add(name);
+      }
+    }
+    const resolved = ambiguous.size === 0 ? out : out.filter(({ name }) => !ambiguous.has(name));
+    const shadowedNames = [...shadowed];
+    const ambiguousNames = [...ambiguous];
+    return {
+      cookies: resolved,
+      shadowedNames,
+      ambiguousNames,
+      ambiguousKeys,
+      split: shadowedNames.length > 0 || ambiguousNames.length > 0
+    };
+  };
+  return {
+    cookieName,
+    legacyCookieName,
+    optionsForHost,
+    reconcile,
+    browserOptions: () => optionsForHost(
+      typeof window !== "undefined" ? window.location.hostname : null
+    ),
+    isCurrentCookie,
+    migrateLegacyCookies: (cookies) => {
+      if (!legacyCookieName) return [];
+      if (cookies.some(({ name }) => isCurrentCookie(name))) return [];
+      return cookies.flatMap((cookie) => {
+        const renamed = renamedCookie(cookie, legacyCookieName, cookieName);
+        return renamed ? [renamed] : [];
+      });
+    }
+  };
+}
+
+// src/next/supabase.ts
+var RESPONSE_COOKIE_ATTRIBUTES = [
+  "domain",
+  "path",
+  "maxAge",
+  "expires",
+  "httpOnly",
+  "secure",
+  "sameSite",
+  "priority",
+  "partitioned"
+];
+var AUTH_COOKIE_RESPONSE_HEADERS = Object.freeze({
+  "Cache-Control": "private, no-cache, no-store, must-revalidate, max-age=0",
+  Expires: "0",
+  Pragma: "no-cache"
+});
+var CARRIED_HEADERS = ["cache-control", "expires", "pragma"];
+var SPLIT_COOKIE_JAR_HEADER = "x-matrx-split-jar";
+var AMBIGUOUS_AUTH_COOKIE_HEADER = "x-matrx-auth-ambiguous";
+function toResponseCookie(cookie) {
+  const options = cookie.options ?? {};
+  const out = {
+    name: cookie.name,
+    value: cookie.value
+  };
+  for (const attribute of RESPONSE_COOKIE_ATTRIBUTES) {
+    const value = options[attribute];
+    if (value !== void 0) out[attribute] = value;
+  }
+  return out;
+}
+function hostOnlyExpiryHeader(name) {
+  return `${name}=; Path=/; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Secure; SameSite=Lax`;
+}
+function serializeSetCookie(cookie) {
+  const parts = [`${cookie.name}=${encodeURIComponent(cookie.value)}`];
+  parts.push(`Path=${cookie.path ?? "/"}`);
+  if (cookie.domain !== void 0) parts.push(`Domain=${cookie.domain}`);
+  if (cookie.maxAge !== void 0) parts.push(`Max-Age=${cookie.maxAge}`);
+  if (cookie.expires !== void 0) {
+    const expires = cookie.expires instanceof Date ? cookie.expires : new Date(cookie.expires);
+    parts.push(`Expires=${expires.toUTCString()}`);
+  }
+  if (cookie.httpOnly === true) parts.push("HttpOnly");
+  if (cookie.secure === true) parts.push("Secure");
+  if (typeof cookie.sameSite === "string") {
+    parts.push(`SameSite=${cookie.sameSite}`);
+  }
+  return parts.join("; ");
+}
+var MissingSupabaseIdentityError = class extends Error {
+  variable;
+  constructor(variable) {
+    super(
+      `@ai-matrx/data/next: missing required Supabase identity "${variable}". Pass it as a STATIC member access (process.env.${variable}) to createNextSupabase().`
+    );
+    this.name = "MissingSupabaseIdentityError";
+    this.variable = variable;
+  }
+};
+function requireIdentity(value, variable) {
+  const trimmed = value?.trim();
+  if (!trimmed) throw new MissingSupabaseIdentityError(variable);
+  return trimmed;
+}
+var AUTH_RESOLVE_TIMEOUT_MS = 2500;
+var IDENTITY_PATHS = [
+  "/auth/v1/user",
+  "/auth/v1/token?grant_type=refresh_token",
+  "/auth/v1/.well-known/jwks.json"
+];
+var AUTH_BUDGET_EXHAUSTED_STATUS = 408;
+var AUTH_BUDGET_EXHAUSTED_CODE = "auth_budget_exhausted";
+var AUTH_REFRESH_CEILING_MS = 8e3;
+var REFRESH_GRANT_PATH = "/auth/v1/token?grant_type=refresh_token";
+function createAuthBudget(timeoutMs, options = {}) {
+  const refreshCeilingMs = Math.max(timeoutMs, options.refreshCeilingMs ?? AUTH_REFRESH_CEILING_MS);
+  let deadline = null;
+  let exhausted = false;
+  const isIdentityCall = (url) => IDENTITY_PATHS.some((path) => url.includes(path));
+  const exhaustedResponse = () => new Response(
+    JSON.stringify({
+      error_code: AUTH_BUDGET_EXHAUSTED_CODE,
+      msg: `identity resolve budget of ${timeoutMs}ms is exhausted for this request; not retrying`
+    }),
+    {
+      status: AUTH_BUDGET_EXHAUSTED_STATUS,
+      headers: { "content-type": "application/json" }
+    }
+  );
+  const budgetedFetch = async (input, init) => {
+    const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
+    if (!isIdentityCall(url) || init?.signal) {
+      return fetch(input, init);
+    }
+    const now = Date.now();
+    if (deadline === null) deadline = now + timeoutMs;
+    const remaining = deadline - now;
+    if (exhausted || remaining <= 0) {
+      exhausted = true;
+      return exhaustedResponse();
+    }
+    const allowed = url.includes(REFRESH_GRANT_PATH) ? refreshCeilingMs : remaining;
+    try {
+      return await fetch(input, {
+        ...init,
+        signal: AbortSignal.timeout(allowed)
+      });
+    } catch (cause) {
+      const name = String(cause?.name ?? "");
+      if (name === "TimeoutError" || name === "AbortError") exhausted = true;
+      throw cause;
+    }
+  };
+  return {
+    fetch: budgetedFetch,
+    get exhausted() {
+      return exhausted;
+    }
+  };
+}
+function isAuthTransportFailure(error) {
+  if (!error || typeof error !== "object") return false;
+  const name = String(error.name ?? "");
+  if (name === "AuthRetryableFetchError" || name === "TimeoutError" || name === "AbortError") {
+    return true;
+  }
+  const status = error.status;
+  if (status === 0 || status === 504 || status === 503) return true;
+  const code = error.code;
+  return status === AUTH_BUDGET_EXHAUSTED_STATUS || code === AUTH_BUDGET_EXHAUSTED_CODE;
+}
+async function resolveIdentity(client, budget) {
+  const unreachable = (cause) => {
+    console.warn(
+      `[@ai-matrx/data/next] AUTH UNREACHABLE within ${AUTH_RESOLVE_TIMEOUT_MS}ms \u2014 this request is being passed through WITHOUT an identity and WITHOUT touching a single auth cookie. Nobody is being signed out: the shell resolves auth again on the client, and the next request re-resolves it here. If this is not rare, the auth authority (or the network to it) is the thing to fix \u2014 raising this budget only trades it back for a 504. Cause: ${String(cause)}`
+    );
+    return { user: null, authUnavailable: true };
+  };
+  try {
+    const { data, error } = await client.auth.getClaims();
+    if (error) {
+      return isAuthTransportFailure(error) || budget?.exhausted ? unreachable(error) : { user: null, authUnavailable: false };
+    }
+    const claims = data?.claims;
+    if (!claims || typeof claims.sub !== "string") {
+      return budget?.exhausted ? unreachable("identity budget exhausted before a token could be verified") : { user: null, authUnavailable: false };
+    }
+    return {
+      user: { ...claims, id: claims.sub },
+      authUnavailable: false
+    };
+  } catch (cause) {
+    return unreachable(cause);
+  }
+}
+var BROWSER_SLOT = /* @__PURE__ */ Symbol.for("ai-matrx.data.next.browser-client");
+function readBrowserSlot() {
+  return globalThis[BROWSER_SLOT];
+}
+function writeBrowserSlot(slot) {
+  globalThis[BROWSER_SLOT] = slot;
+}
+function createNextSupabase(config) {
+  const url = requireIdentity(config.supabaseUrl, "NEXT_PUBLIC_SUPABASE_URL");
+  const key = requireIdentity(
+    config.publishableKey,
+    "NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY"
+  );
+  const authCookie = createAuthCookie({
+    apexDomain: config.apexDomain,
+    ...config.cookieName !== void 0 ? { cookieName: config.cookieName } : {},
+    ...config.legacyCookieName !== void 0 ? { legacyCookieName: config.legacyCookieName } : {}
+  });
+  const wrap = config.wrapBrowserClient;
+  const slotKey = `${url}|${key}|${authCookie.cookieName}`;
+  const browserCookieAdapter = () => ({
+    getAll: () => authCookie.reconcile(
+      typeof document === "undefined" ? [] : parseCookieHeader(document.cookie)
+    ).cookies,
+    setAll: (cookiesToSet) => {
+      if (typeof document === "undefined") return;
+      for (const cookie of cookiesToSet) {
+        const options = cookie.options ?? {};
+        const parts = [
+          `${cookie.name}=${encodeURIComponent(cookie.value)}`,
+          `Path=${typeof options.path === "string" ? options.path : "/"}`
+        ];
+        if (typeof options.domain === "string") {
+          parts.push(`Domain=${options.domain}`);
+        }
+        if (typeof options.maxAge === "number") {
+          parts.push(`Max-Age=${options.maxAge}`);
+        }
+        if (typeof options.sameSite === "string") {
+          parts.push(`SameSite=${options.sameSite}`);
+        }
+        if (options.secure === true || location.protocol === "https:") parts.push("Secure");
+        document.cookie = parts.join("; ");
+      }
+    }
+  });
+  const browserClient = () => {
+    const existing = readBrowserSlot();
+    if (existing && existing.key === slotKey) {
+      return existing.client;
+    }
+    const raw = (0, import_ssr.createBrowserClient)(url, key, {
+      cookieOptions: authCookie.browserOptions(),
+      cookies: browserCookieAdapter()
+    });
+    const client = wrap ? wrap(raw) : raw;
+    writeBrowserSlot({ key: slotKey, client });
+    return client;
+  };
+  const reconciledGetAll = (getAllRaw, cookieHeader) => {
+    const parsed = parseCookieHeader(cookieHeader);
+    if (parsed.length > 0) {
+      const reconciled = authCookie.reconcile(parsed).cookies;
+      return () => reconciled;
+    }
+    return () => authCookie.reconcile(getAllRaw()).cookies;
+  };
+  const serverClient = ({
+    cookieStore,
+    host,
+    cookieHeader,
+    appendSetCookie
+  }) => {
+    const written = /* @__PURE__ */ new Set();
+    const budget = createAuthBudget(AUTH_RESOLVE_TIMEOUT_MS);
+    return (0, import_ssr.createServerClient)(url, key, {
+      cookieOptions: authCookie.optionsForHost(host),
+      global: { fetch: budget.fetch },
+      cookies: {
+        getAll: reconciledGetAll(() => cookieStore.getAll(), cookieHeader),
+        setAll: (cookiesToSet) => {
+          try {
+            const deferred = [];
+            for (const cookie of cookiesToSet) {
+              const { name, value, options } = cookie;
+              if (!written.has(name)) {
+                written.add(name);
+                cookieStore.set(name, value, options);
+                continue;
+              }
+              const header = serializeSetCookie(
+                toResponseCookie(cookie)
+              );
+              if (appendSetCookie) {
+                deferred.push(header);
+                continue;
+              }
+              console.warn(
+                `[@ai-matrx/data/next] DROPPED a second Set-Cookie for "${name}" on host "${host ?? "?"}": Next's cookie store keeps one entry per name, so this write would have DELETED the first one. Cookie value omitted. A Route Handler here must pass appendSetCookie \u2014 an unremoved auth cookie at the other scope makes the next request resolve the PREVIOUS person.`
+              );
+            }
+            for (const header of deferred) appendSetCookie?.(header);
+          } catch {
+          }
+        }
+      }
+    });
+  };
+  const routeClient = ({
+    requestCookies,
+    setCookie,
+    host,
+    cookieHeader,
+    appendSetCookie
+  }) => {
+    const written = /* @__PURE__ */ new Set();
+    const budget = createAuthBudget(AUTH_RESOLVE_TIMEOUT_MS);
+    return (0, import_ssr.createServerClient)(url, key, {
+      cookieOptions: authCookie.optionsForHost(host),
+      global: { fetch: budget.fetch },
+      cookies: {
+        getAll: reconciledGetAll(() => requestCookies.getAll(), cookieHeader),
+        setAll: (cookiesToSet) => {
+          if (budget.exhausted && cookiesToSet.length > 0) {
+            console.warn(
+              `[@ai-matrx/data/next] DROPPED ${cookiesToSet.length} auth cookie write(s) in a route on host "${host ?? "?"}": identity budget exhausted; nobody is signed out.`
+            );
+            return;
+          }
+          const deferred = [];
+          for (const cookie of cookiesToSet) {
+            const { name } = cookie;
+            if (!written.has(name)) {
+              written.add(name);
+              setCookie(cookie);
+              continue;
+            }
+            const header = serializeSetCookie(
+              toResponseCookie(cookie)
+            );
+            if (appendSetCookie) {
+              deferred.push(header);
+              continue;
+            }
+            console.warn(
+              `[@ai-matrx/data/next] DROPPED a second Set-Cookie for "${name}" on host "${host ?? "?"}": this door passed no appendSetCookie, and the response jar keeps one entry per name, so this write would have DELETED the first one. Cookie value omitted. Pass appendSetCookie from this route \u2014 an unremoved auth cookie at the other scope makes the next request resolve the PREVIOUS person.`
+            );
+          }
+          for (const header of deferred) appendSetCookie?.(header);
+        }
+      }
+    });
+  };
+  async function middlewareSession(args) {
+    const { host, requestCookies, createResponse, createRedirect } = args;
+    const hostCookieOptions = authCookie.optionsForHost(host);
+    let response = createResponse();
+    const rawCookies = parseCookieHeader(args.cookieHeader);
+    const baseline = authCookie.reconcile(
+      rawCookies.length > 0 ? rawCookies : requestCookies.getAll()
+    );
+    const shadowed = hostCookieOptions.domain ? new Set(baseline.shadowedNames) : /* @__PURE__ */ new Set();
+    for (const name of baseline.ambiguousNames) shadowed.add(name);
+    if (baseline.ambiguousKeys.length > 0) {
+      console.warn(
+        `[@ai-matrx/data/next] AMBIGUOUS auth cookie jar on host "${host ?? "?"}": ${baseline.ambiguousKeys.join(", ")} arrived UNCHUNKED and CHUNKED at once. Serving either would risk resolving a DIFFERENT person's session, so this request is treated as signed out and every cookie in those families is being expired at both scopes. The person signs in once and the jar is clean.`
+      );
+    }
+    const overlay = /* @__PURE__ */ new Map();
+    const readCookies = () => {
+      const merged = baseline.cookies.map(
+        (cookie) => overlay.has(cookie.name) ? { name: cookie.name, value: overlay.get(cookie.name) } : cookie
+      );
+      const seen = new Set(merged.map(({ name }) => name));
+      for (const [name, value] of overlay) {
+        if (!seen.has(name)) merged.push({ name, value });
+      }
+      return merged;
+    };
+    const noteWrite = (name, value) => {
+      overlay.set(name, value);
+      requestCookies.set(name, value);
+    };
+    const migrated = authCookie.migrateLegacyCookies(readCookies());
+    for (const { name, value } of migrated) noteWrite(name, value);
+    const writtenNames = /* @__PURE__ */ new Set();
+    const duplicateWrites = [];
+    const budget = createAuthBudget(AUTH_RESOLVE_TIMEOUT_MS);
+    const applyCookies = (cookiesToSet, headers = {}) => {
+      if (budget.exhausted && cookiesToSet.length > 0) {
+        console.warn(
+          `[@ai-matrx/data/next] DROPPED ${cookiesToSet.length} auth cookie write(s) on host "${host ?? "?"}": the identity budget was exhausted on this request, so nothing learned here is trusted enough to change the jar. Nobody is signed out; the next request re-resolves. Names: ${cookiesToSet.map((c) => c.name).join(", ")}`
+        );
+        return;
+      }
+      for (const { name, value } of cookiesToSet) noteWrite(name, value);
+      const next = createResponse();
+      for (const cookie of response.cookies.getAll()) {
+        next.cookies.set(cookie);
+      }
+      for (const cookie of cookiesToSet) {
+        const responseCookie = toResponseCookie(cookie);
+        if (writtenNames.has(responseCookie.name)) {
+          duplicateWrites.push(serializeSetCookie(responseCookie));
+          continue;
+        }
+        writtenNames.add(responseCookie.name);
+        next.cookies.set(responseCookie);
+      }
+      const responseHeaders = cookiesToSet.length > 0 ? { ...AUTH_COOKIE_RESPONSE_HEADERS, ...headers } : headers;
+      for (const [name, value] of Object.entries(responseHeaders)) {
+        next.headers.set(name, value);
+      }
+      response = next;
+    };
+    const client = (0, import_ssr.createServerClient)(url, key, {
+      cookieOptions: hostCookieOptions,
+      // Identity calls out of THIS pass share one deadline; see createAuthBudget.
+      global: { fetch: budget.fetch },
+      cookies: {
+        getAll: () => readCookies(),
+        setAll: (cookiesToSet, headers) => {
+          applyCookies(
+            cookiesToSet,
+            headers ?? {}
+          );
+        }
+      }
+    });
+    const { user, authUnavailable } = await resolveIdentity(client, budget);
+    if (user && migrated.length > 0) {
+      const { name: _name, ...cookieOptions } = hostCookieOptions;
+      applyCookies(
+        readCookies().filter(
+          ({ name, value }) => authCookie.isCurrentCookie(name) && value.length > 0
+        ).map(({ name, value }) => ({
+          name,
+          value,
+          options: { ...import_ssr.DEFAULT_COOKIE_OPTIONS, ...cookieOptions }
+        }))
+      );
+    }
+    if (authCookie.legacyCookieName && hostCookieOptions.domain) {
+      const legacy = authCookie.legacyCookieName;
+      for (const { name } of rawCookies) {
+        if (name === legacy || name.startsWith(`${legacy}.`)) shadowed.add(name);
+      }
+    }
+    if (authCookie.legacyCookieName && !authUnavailable) {
+      await (0, import_ssr.clearAuthCookiesAtScopes)({
+        getAll: () => readCookies(),
+        setAll: (cookiesToSet, headers) => {
+          applyCookies(
+            cookiesToSet,
+            headers ?? {}
+          );
+        },
+        storageKey: authCookie.legacyCookieName,
+        scopes: hostCookieOptions.domain ? [{ domain: hostCookieOptions.domain }] : [{}]
+      });
+    }
+    const healed = /* @__PURE__ */ new WeakSet();
+    const applyHeal = (target) => {
+      if (healed.has(target)) return target;
+      if (authUnavailable) return target;
+      if (shadowed.size === 0 && duplicateWrites.length === 0) return target;
+      healed.add(target);
+      const current = new Map(readCookies().map((c) => [c.name, c.value]));
+      const expiries = [];
+      for (const name of shadowed) {
+        const value = current.get(name) ?? "";
+        if (value.length > 0 && !user) {
+          continue;
+        }
+        if (value.length > 0) {
+          target.cookies.set(
+            toResponseCookie({
+              name,
+              value,
+              options: {
+                ...import_ssr.DEFAULT_COOKIE_OPTIONS,
+                domain: hostCookieOptions.domain,
+                path: "/",
+                // A Domain-scoped auth cookie only ever exists on https here,
+                // and `Secure` is not part of cookie identity, so re-issuing
+                // with it set can only tighten what is already there.
+                secure: true
+              }
+            })
+          );
+        } else if (hostCookieOptions.domain) {
+          expiries.push(
+            `${name}=; Path=/; Max-Age=0; Expires=Thu, 01 Jan 1970 00:00:00 GMT; Domain=${hostCookieOptions.domain}; Secure; SameSite=Lax`
+          );
+        }
+        expiries.push(hostOnlyExpiryHeader(name));
+      }
+      for (const header of duplicateWrites) {
+        target.headers.append("Set-Cookie", header);
+      }
+      for (const header of expiries) {
+        target.headers.append("Set-Cookie", header);
+      }
+      if (shadowed.size === 0) {
+        return target;
+      }
+      target.headers.set(SPLIT_COOKIE_JAR_HEADER, "1");
+      if (baseline.ambiguousKeys.length > 0) {
+        target.headers.set(AMBIGUOUS_AUTH_COOKIE_HEADER, "1");
+      }
+      for (const [key2, value] of Object.entries(AUTH_COOKIE_RESPONSE_HEADERS)) {
+        target.headers.set(key2, value);
+      }
+      console.warn(
+        `[@ai-matrx/data/next] split auth cookie jar healed on host "${host ?? "?"}": ${[...shadowed].join(", ")} arrived at two scopes; the host-only copies were expired so the ${hostCookieOptions.domain} set is the only one left.`
+      );
+      return target;
+    };
+    return {
+      user,
+      client,
+      get response() {
+        return applyHeal(response);
+      },
+      redirect: (targetUrl) => {
+        const redirect = createRedirect(targetUrl);
+        for (const cookie of response.cookies.getAll()) {
+          redirect.cookies.set(cookie);
+        }
+        for (const name of CARRIED_HEADERS) {
+          const value = response.headers.get(name);
+          if (value) redirect.headers.set(name, value);
+        }
+        return applyHeal(redirect);
+      },
+      splitCookieJar: shadowed.size > 0,
+      ambiguousAuthCookies: baseline.ambiguousKeys.length > 0,
+      authUnavailable
+    };
+  }
+  return {
+    authCookie,
+    cookieName: authCookie.cookieName,
+    optionsForHost: authCookie.optionsForHost,
+    browserOptions: authCookie.browserOptions,
+    browserClient,
+    serverClient,
+    routeClient,
+    middlewareSession
+  };
+}