@lowdefy/api 5.6.0 → 6.0.0

package/dist/context/createAuthorize.js

@@ -13,7 +13,7 @@
   See the License for the specific language governing permissions and
   limitations under the License.
 */ import { ConfigError } from '@lowdefy/errors';
-function createAuthorize({ session }) {
+function createAuthorize({ session, system = false }) {
     // Next-auth getSession provides a session object if the user is authenticated
     // else session will be null
     const authenticated = !!session;
@@ -24,6 +24,9 @@ function createAuthorize({ session }) {
         });
     }
     function authorize(config) {
+        // A system context (scheduled, webhook, detached runs) was authorized at the
+        // transport layer, so nested endpoint calls are never gated on a user session.
+        if (system === true) return true;
         const { auth } = config;
         if (auth.public === true) return true;
         if (auth.public === false) {

package/dist/context/resolveStrategyCaller.js

@@ -0,0 +1,56 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+// Tries the configured API auth strategies in config order; the first
+// verifier match wins. A strategy caller is a config-derived, org-less
+// principal: roles are the strategy's static grant unioned with any
+// claim-derived roles, and attributes are the static bag shallow-merged
+// with claim-mapped values (claim wins), so _user.attributes reads the same
+// for session and strategy callers.
+async function resolveStrategyCaller({ headers, logger, strategies }) {
+    for (const strategy of strategies ?? []){
+        const match = await strategy.verify({
+            headers,
+            logger
+        });
+        if (type.isNone(match)) {
+            continue;
+        }
+        const roles = [
+            ...new Set([
+                ...strategy.roles,
+                ...match.roles ?? []
+            ])
+        ];
+        const attributes = {
+            ...strategy.attributes,
+            ...match.attributes ?? {}
+        };
+        logger.debug({
+            event: 'auth_strategy_authenticated',
+            authMethod: strategy.type,
+            strategyId: strategy.id
+        }, `Request authenticated by auth strategy "${strategy.id}" (${strategy.type}).`);
+        return {
+            ...match.user,
+            authMethod: strategy.type,
+            strategyId: strategy.id,
+            roles,
+            attributes
+        };
+    }
+    return null;
+}
+export default resolveStrategyCaller;

package/dist/index.js

@@ -15,14 +15,24 @@
 */ import buildEndpointResult from './response/buildEndpointResult.js';
 import callAgent from './routes/agent/callAgent.js';
 import callEndpoint from './routes/endpoints/callEndpoint.js';
+import getEndpointConfig from './routes/endpoints/getEndpointConfig.js';
 import callRequest from './routes/request/callRequest.js';
 import createApiContext from './context/createApiContext.js';
+import createChannelRegistry from './routes/websocket/createChannelRegistry.js';
+import createMcpServer from './routes/mcp/createMcpServer.js';
+import createWebSocketConnection from './routes/websocket/createWebSocketConnection.js';
 import createSessionCallback from './routes/auth/callbacks/createSessionCallback.js';
+import getAuthConfig from './routes/auth/getAuthConfig.js';
+import getAuthStrategies from './routes/auth/strategies/getAuthStrategies.js';
 import getHomeAndMenus from './routes/rootConfig/getHomeAndMenus.js';
-import getNextAuthConfig from './routes/auth/getNextAuthConfig.js';
+import resolveStrategyCaller from './context/resolveStrategyCaller.js';
 import getPageConfig from './routes/page/getPageConfig.js';
 import getRootConfig from './routes/rootConfig/getRootConfig.js';
 import logClientError from './routes/log/logClientError.js';
 import redactErrorResponse from './response/redactErrorResponse.js';
 import redactResponse from './response/redactResponse.js';
-export { buildEndpointResult, callAgent, callEndpoint, callRequest, createApiContext, createSessionCallback, getHomeAndMenus, getNextAuthConfig, getPageConfig, getRootConfig, logClientError, redactErrorResponse, redactResponse };
+import forwardScheduledEndpoint from './routes/endpoints/forwardScheduledEndpoint.js';
+import runDetachedEndpoint from './routes/endpoints/runDetachedEndpoint.js';
+import runWebhookEndpoint from './routes/endpoints/runWebhookEndpoint.js';
+import runScheduledEndpoint from './routes/endpoints/runScheduledEndpoint.js';
+export { buildEndpointResult, callAgent, callEndpoint, getEndpointConfig, callRequest, createApiContext, createChannelRegistry, createMcpServer, createSessionCallback, createWebSocketConnection, getAuthConfig, getAuthStrategies, getHomeAndMenus, getPageConfig, getRootConfig, logClientError, redactErrorResponse, redactResponse, resolveStrategyCaller, forwardScheduledEndpoint, runDetachedEndpoint, runWebhookEndpoint, runScheduledEndpoint };

package/dist/routes/agent/callAgent.js

@@ -12,17 +12,8 @@
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
-*/ import { type } from '@lowdefy/helpers';
-import buildEndpointResult from '../../response/buildEndpointResult.js';
-import createEvaluateOperators from '../../context/createEvaluateOperators.js';
-import authorizeAgent from './authorizeAgent.js';
-import authorizeApiEndpoint from '../endpoints/authorizeApiEndpoint.js';
-import getEndpointConfig from '../endpoints/getEndpointConfig.js';
-import runRoutine from '../endpoints/runRoutine.js';
-import getAgentConfig from './getAgentConfig.js';
-import getAgentResolver from './getAgentResolver.js';
-import getConnectionConfig from '../connections/getConnectionConfig.js';
-import getConnection from '../connections/getConnection.js';
+*/ import createEvaluateOperators from '../../context/createEvaluateOperators.js';
+import prepareAgent from './prepareAgent.js';
 async function callAgent(context, { agentId, pageId, messages, conversationId, urlQuery, sharedState }) {
     const { logger } = context;
     context.pageId = pageId;
@@ -32,12 +23,6 @@ async function callAgent(context, { agentId, pageId, messages, conversationId, u
         agentId,
         pageId
     });
-    const agentConfig = await getAgentConfig(context, {
-        agentId
-    });
-    authorizeAgent(context, {
-        agentConfig
-    });
     const agentContext = {
         conversationId: conversationId ?? undefined,
         pageId,
@@ -45,174 +30,12 @@ async function callAgent(context, { agentId, pageId, messages, conversationId, u
         urlQuery: urlQuery ?? {},
         userId: context.user?.sub ?? context.user?.id ?? null
     };
-    // Evaluate operators in agent properties (e.g. _user, _secret, _payload)
-    agentConfig.properties = context.evaluateOperators({
-        input: agentConfig.properties ?? {},
-        location: agentConfig.agentId,
-        payload: agentContext,
-        state: {},
-        steps: {}
-    });
-    // Load connection config from build artifacts using agent's connectionId
-    const connectionConfig = await getConnectionConfig(context, {
-        connectionId: agentConfig.connectionId,
-        configKey: agentConfig['~k']
-    });
-    // Get connection plugin from registry
-    const connection = getConnection(context, {
-        connectionConfig
-    });
-    // Evaluate operators in connection properties
-    const connectionProperties = context.evaluateOperators({
-        input: connectionConfig.properties || {},
-        location: connectionConfig.connectionId,
-        payload: {},
-        state: {},
-        steps: {}
-    });
-    // Create connection instance (e.g., Anthropic provider)
-    const connectionInstance = connection.create({
-        connection: connectionProperties
-    });
-    // Get agent type from plugin registry
-    const agentType = getAgentResolver(context, {
-        agentConfig
-    });
-    // Build resolver context with callEndpoint that allows InternalApi endpoints
-    const resolverContext = {
+    const { agentConfig, connectionInstance, agentType, resolverContext } = await prepareAgent(context, {
+        agentId,
         agentContext,
-        i18n: context.i18n,
-        evaluateOperators: (input)=>context.evaluateOperators({
-                input,
-                location: agentConfig.agentId,
-                payload: agentContext,
-                state: {},
-                steps: {}
-            }),
-        callEndpoint: async (endpointId, { payload, abortSignal })=>{
-            const endpointConfig = await getEndpointConfig(context, {
-                endpointId
-            });
-            authorizeApiEndpoint(context, {
-                endpointConfig
-            });
-            const routineContext = {
-                steps: {},
-                payload: payload ?? {},
-                arrayIndices: [],
-                items: {},
-                state: {},
-                endpointDepth: 0
-            };
-            const { error, response, status } = await runRoutine(context, routineContext, {
-                routine: endpointConfig.routine
-            });
-            return buildEndpointResult(context, {
-                error,
-                response,
-                status
-            });
-        },
-        getEndpointConfig: async ({ endpointId })=>{
-            return getEndpointConfig(context, {
-                endpointId
-            });
-        },
-        getAgentConfig: async ({ agentId })=>{
-            const subAgentConfig = await getAgentConfig(context, {
-                agentId
-            });
-            authorizeAgent(context, {
-                agentConfig: subAgentConfig
-            });
-            return subAgentConfig;
-        },
-        getConnectionForAgent: async ({ agentConfig: subAgentConfig })=>{
-            const subConnectionConfig = await getConnectionConfig(context, {
-                connectionId: subAgentConfig.connectionId,
-                configKey: subAgentConfig['~k']
-            });
-            const subConnection = getConnection(context, {
-                connectionConfig: subConnectionConfig
-            });
-            const subConnectionProperties = context.evaluateOperators({
-                input: subConnectionConfig.properties || {},
-                location: subConnectionConfig.connectionId,
-                payload: {},
-                state: {},
-                steps: {}
-            });
-            return subConnection.create({
-                connection: subConnectionProperties
-            });
-        },
-        resolveMcpSources: async ({ agentConfig: subAgentConfig })=>{
-            const resolvedMcp = [];
-            for (const mcpSource of subAgentConfig.mcp ?? []){
-                if (!type.isNone(mcpSource.connectionId)) {
-                    const mcpConnConfig = await getConnectionConfig(context, {
-                        connectionId: mcpSource.connectionId,
-                        configKey: subAgentConfig['~k']
-                    });
-                    const mcpConnection = getConnection(context, {
-                        connectionConfig: mcpConnConfig
-                    });
-                    const mcpConnProps = context.evaluateOperators({
-                        input: mcpConnConfig.properties || {},
-                        location: mcpConnConfig.connectionId,
-                        payload: {},
-                        state: {},
-                        steps: {}
-                    });
-                    const mcpConfig = mcpConnection.create({
-                        connection: mcpConnProps
-                    });
-                    const { connectionId: _, ...overrides } = mcpSource;
-                    resolvedMcp.push({
-                        ...mcpConfig,
-                        ...overrides
-                    });
-                } else {
-                    resolvedMcp.push(mcpSource);
-                }
-            }
-            return resolvedMcp;
-        }
-    };
-    // Resolve MCP connection references to inline config.
-    // Agent-level overrides (like confirm) may still contain operators —
-    // handleAgentChat evaluates those via its existing evaluateOperators call.
-    const resolvedMcp = [];
-    for (const mcpSource of agentConfig.mcp ?? []){
-        if (!type.isNone(mcpSource.connectionId)) {
-            const mcpConnConfig = await getConnectionConfig(context, {
-                connectionId: mcpSource.connectionId,
-                configKey: agentConfig['~k']
-            });
-            const mcpConnection = getConnection(context, {
-                connectionConfig: mcpConnConfig
-            });
-            const mcpConnProps = context.evaluateOperators({
-                input: mcpConnConfig.properties || {},
-                location: mcpConnConfig.connectionId,
-                payload: {},
-                state: {},
-                steps: {}
-            });
-            const mcpConfig = mcpConnection.create({
-                connection: mcpConnProps
-            });
-            // Merge: connection properties as base, agent-level overrides on top
-            const { connectionId: _, ...overrides } = mcpSource;
-            resolvedMcp.push({
-                ...mcpConfig,
-                ...overrides
-            });
-        } else {
-            resolvedMcp.push(mcpSource);
-        }
-    }
-    agentConfig.mcp = resolvedMcp;
+        endpointDepth: 0,
+        mode: 'chat'
+    });
     // Call the agent resolver
     const { response } = await agentType.resolver({
         connection: connectionInstance,

package/dist/routes/agent/prepareAgent.js

@@ -0,0 +1,173 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import buildEndpointResult from '../../response/buildEndpointResult.js';
+import getEndpointConfig from '../endpoints/getEndpointConfig.js';
+import invokeEndpoint from '../endpoints/invokeEndpoint.js';
+import authorizeAgent from './authorizeAgent.js';
+import getAgentConfig from './getAgentConfig.js';
+import getAgentResolver from './getAgentResolver.js';
+import getConnectionConfig from '../connections/getConnectionConfig.js';
+import getConnection from '../connections/getConnection.js';
+// Shared agent invocation construction for the streaming chat route (callAgent)
+// and the headless CallAgent routine step (handleAgentCall): loads the agent
+// config, evaluates operators, creates the provider connection, and builds the
+// resolver context. mode ('chat' | 'generate') selects the resolver's execution
+// path; endpointDepth threads the endpoint call depth cap through agent tool
+// and hook endpoint calls.
+async function prepareAgent(context, { agentId, agentContext, endpointDepth = 0, mode = 'chat' }) {
+    const agentConfig = await getAgentConfig(context, {
+        agentId
+    });
+    authorizeAgent(context, {
+        agentConfig
+    });
+    // Evaluate operators in agent properties (e.g. _user, _secret, _payload)
+    agentConfig.properties = context.evaluateOperators({
+        input: agentConfig.properties ?? {},
+        location: agentConfig.agentId,
+        payload: agentContext,
+        state: {},
+        steps: {}
+    });
+    // Load connection config from build artifacts using agent's connectionId
+    const connectionConfig = await getConnectionConfig(context, {
+        connectionId: agentConfig.connectionId,
+        configKey: agentConfig['~k']
+    });
+    // Get connection plugin from registry
+    const connection = getConnection(context, {
+        connectionConfig
+    });
+    // Evaluate operators in connection properties
+    const connectionProperties = context.evaluateOperators({
+        input: connectionConfig.properties || {},
+        location: connectionConfig.connectionId,
+        payload: {},
+        state: {},
+        steps: {}
+    });
+    // Create connection instance (e.g., Anthropic provider)
+    const connectionInstance = connection.create({
+        connection: connectionProperties
+    });
+    // Get agent type from plugin registry
+    const agentType = getAgentResolver(context, {
+        agentConfig
+    });
+    // Build resolver context with callEndpoint that allows InternalApi endpoints
+    const resolverContext = {
+        agentContext,
+        i18n: context.i18n,
+        mode,
+        evaluateOperators: (input)=>context.evaluateOperators({
+                input,
+                location: agentConfig.agentId,
+                payload: agentContext,
+                state: {},
+                steps: {}
+            }),
+        callEndpoint: async (endpointId, { payload })=>{
+            const { error, response, status } = await invokeEndpoint(context, {
+                endpointId,
+                payload,
+                endpointDepth
+            });
+            return buildEndpointResult(context, {
+                error,
+                response,
+                status
+            });
+        },
+        getEndpointConfig: async ({ endpointId })=>{
+            return getEndpointConfig(context, {
+                endpointId
+            });
+        },
+        getAgentConfig: async ({ agentId: subAgentId })=>{
+            const subAgentConfig = await getAgentConfig(context, {
+                agentId: subAgentId
+            });
+            authorizeAgent(context, {
+                agentConfig: subAgentConfig
+            });
+            return subAgentConfig;
+        },
+        getConnectionForAgent: async ({ agentConfig: subAgentConfig })=>{
+            const subConnectionConfig = await getConnectionConfig(context, {
+                connectionId: subAgentConfig.connectionId,
+                configKey: subAgentConfig['~k']
+            });
+            const subConnection = getConnection(context, {
+                connectionConfig: subConnectionConfig
+            });
+            const subConnectionProperties = context.evaluateOperators({
+                input: subConnectionConfig.properties || {},
+                location: subConnectionConfig.connectionId,
+                payload: {},
+                state: {},
+                steps: {}
+            });
+            return subConnection.create({
+                connection: subConnectionProperties
+            });
+        },
+        resolveMcpSources: async ({ agentConfig: subAgentConfig })=>{
+            const resolvedMcp = [];
+            for (const mcpSource of subAgentConfig.mcp ?? []){
+                if (!type.isNone(mcpSource.connectionId)) {
+                    const mcpConnConfig = await getConnectionConfig(context, {
+                        connectionId: mcpSource.connectionId,
+                        configKey: subAgentConfig['~k']
+                    });
+                    const mcpConnection = getConnection(context, {
+                        connectionConfig: mcpConnConfig
+                    });
+                    const mcpConnProps = context.evaluateOperators({
+                        input: mcpConnConfig.properties || {},
+                        location: mcpConnConfig.connectionId,
+                        payload: {},
+                        state: {},
+                        steps: {}
+                    });
+                    const mcpConfig = mcpConnection.create({
+                        connection: mcpConnProps
+                    });
+                    const { connectionId: _, ...overrides } = mcpSource;
+                    resolvedMcp.push({
+                        ...mcpConfig,
+                        ...overrides
+                    });
+                } else {
+                    resolvedMcp.push(mcpSource);
+                }
+            }
+            return resolvedMcp;
+        }
+    };
+    // Resolve MCP connection references to inline config.
+    // Agent-level overrides (like confirm) may still contain operators —
+    // handleAgentChat evaluates those via its existing evaluateOperators call.
+    agentConfig.mcp = await resolverContext.resolveMcpSources({
+        agentConfig
+    });
+    return {
+        agentConfig,
+        connectionInstance,
+        agentType,
+        resolverContext
+    };
+}
+export default prepareAgent;

package/dist/routes/auth/createLogger.js

@@ -20,11 +20,8 @@
 };
 function createLogger({ logger }) {
     return {
-        error: (code, metadata)=>{
-            const error = metadata instanceof Error ? metadata : metadata?.error;
-            if (error) {
-                error.code = code;
-            }
+        // Auth.js v5 logger contract: error(error), warn(code), debug(message, metadata).
+        error: (error)=>{
             logger.error(error);
         },
         warn: (code)=>{

package/dist/routes/auth/createPrefixedCookies.js

@@ -0,0 +1,52 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ function slugifyPrefix(value) {
+    return String(value).trim().toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+}
+// Injects an app-specific prefix into each Auth.js cookie name so multiple apps
+// on the same host do not share a cookie jar (browsers do not scope cookies by
+// port). Only names are overridden — Auth.js v5 deep-merges `config.cookies`
+// into its defaults, so cookie options (httpOnly, secure, maxAge) stay in sync
+// with @auth/core's per-request defaults. Names mirror defaultCookies in
+// @auth/core/lib/utils/cookie.js.
+function createPrefixedCookies({ prefix, useSecureCookies }) {
+    const securePrefix = useSecureCookies ? '__Secure-' : '';
+    const hostPrefix = useSecureCookies ? '__Host-' : '';
+    return {
+        sessionToken: {
+            name: `${securePrefix}${prefix}.authjs.session-token`
+        },
+        callbackUrl: {
+            name: `${securePrefix}${prefix}.authjs.callback-url`
+        },
+        csrfToken: {
+            name: `${hostPrefix}${prefix}.authjs.csrf-token`
+        },
+        pkceCodeVerifier: {
+            name: `${securePrefix}${prefix}.authjs.pkce.code_verifier`
+        },
+        state: {
+            name: `${securePrefix}${prefix}.authjs.state`
+        },
+        nonce: {
+            name: `${securePrefix}${prefix}.authjs.nonce`
+        },
+        webauthnChallenge: {
+            name: `${securePrefix}${prefix}.authjs.challenge`
+        }
+    };
+}
+export { slugifyPrefix };
+export default createPrefixedCookies;

package/dist/routes/auth/{getNextAuthConfig.js → getAuthConfig.js}

@@ -19,10 +19,11 @@ import createCallbacks from './callbacks/createCallbacks.js';
 import createEvents from './events/createEvents.js';
 import createLogger from './createLogger.js';
 import createProviders from './createProviders.js';
-const nextAuthConfig = {};
+import resolveCookies from './resolveCookies.js';
+const authConfigCache = {};
 let initialized = false;
-function getNextAuthConfig({ appMeta, authJson, logger, plugins, secrets }) {
-    if (initialized) return nextAuthConfig;
+function getAuthConfig({ appMeta, authJson, dev, logger, plugins, secrets }) {
+    if (initialized) return authConfigCache;
     const operatorsParser = new ServerParser({
         lowdefyApp: appMeta,
         operators: {
@@ -40,36 +41,46 @@ function getNextAuthConfig({ appMeta, authJson, logger, plugins, secrets }) {
     if (operatorErrors.length > 0) {
         throw operatorErrors[0];
     }
-    nextAuthConfig.adapter = createAdapter({
+    authConfigCache.adapter = createAdapter({
         authConfig,
         logger,
         plugins
     });
-    nextAuthConfig.callbacks = createCallbacks({
+    authConfigCache.callbacks = createCallbacks({
         authConfig,
         logger,
         plugins
     });
-    nextAuthConfig.events = createEvents({
+    authConfigCache.events = createEvents({
         authConfig,
         logger,
         plugins
     });
-    nextAuthConfig.logger = createLogger({
+    authConfigCache.logger = createLogger({
         logger
     });
-    nextAuthConfig.providers = createProviders({
+    authConfigCache.providers = createProviders({
         authConfig,
         logger,
         plugins
     });
-    nextAuthConfig.debug = authConfig.debug ?? logger?.isLevelEnabled('debug') === true;
-    nextAuthConfig.pages = authConfig.authPages;
-    nextAuthConfig.session = authConfig.session;
-    nextAuthConfig.theme = authConfig.theme;
-    nextAuthConfig.cookies = authConfig?.advanced?.cookies;
-    nextAuthConfig.originalRedirectCallback = nextAuthConfig.callbacks.redirect;
+    authConfigCache.debug = authConfig.debug ?? logger?.isLevelEnabled('debug') === true;
+    authConfigCache.pages = authConfig.authPages;
+    authConfigCache.session = authConfig.session;
+    authConfigCache.theme = authConfig.theme;
+    authConfigCache.cookies = resolveCookies({
+        appMeta,
+        authConfig,
+        dev
+    });
+    // Auth.js v5 reads AUTH_SECRET; the v4 NEXTAUTH_SECRET variable is not
+    // supported — deployments must rename it (see the v5-to-v6 migration doc).
+    authConfigCache.secret = process.env.AUTH_SECRET;
+    // Self-hosted servers run behind arbitrary proxies; derive URLs from request
+    // headers (v4 derived them from NEXTAUTH_URL, aliased to AUTH_URL at startup).
+    authConfigCache.trustHost = true;
+    authConfigCache.basePath = '/api/auth';
     initialized = true;
-    return nextAuthConfig;
+    return authConfigCache;
 }
-export default getNextAuthConfig;
+export default getAuthConfig;

package/dist/routes/auth/resolveCookies.js

@@ -0,0 +1,37 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/ import { type } from '@lowdefy/helpers';
+import createPrefixedCookies, { slugifyPrefix } from './createPrefixedCookies.js';
+// Cookie name resolution, in order of precedence:
+//   1. An explicit `auth.advanced.cookies` object is used verbatim.
+//   2. An explicit `auth.advanced.cookiePrefix` namespaces cookie names (dev and prod).
+//   3. When running the dev server, derive a prefix from the app slug/name so multiple
+//      apps on localhost do not share a cookie jar (browsers do not scope cookies by
+//      port). Production is left untouched, returning undefined for Auth.js defaults.
+function resolveCookies({ appMeta, authConfig, dev }) {
+    const explicitCookies = authConfig?.advanced?.cookies;
+    if (!type.isNone(explicitCookies)) return explicitCookies;
+    const devPrefix = dev ? slugifyPrefix(appMeta?.slug ?? appMeta?.name ?? '') : '';
+    const prefix = authConfig?.advanced?.cookiePrefix ?? (devPrefix === '' ? undefined : devPrefix);
+    if (type.isNone(prefix) || prefix === '') return undefined;
+    // Auth.js v5 reads AUTH_URL with NEXTAUTH_URL as a v4 fallback.
+    const authUrl = process.env.AUTH_URL ?? process.env.NEXTAUTH_URL;
+    const useSecureCookies = authUrl?.startsWith('https://') ?? false;
+    return createPrefixedCookies({
+        prefix,
+        useSecureCookies
+    });
+}
+export default resolveCookies;