@opengeni/api-router 2.3.2-canary.2 → 2.4.2-canary.0

package/dist/mcp/receipts.d.ts

@@ -9,6 +9,15 @@ export type McpMutationReceiptInput = Omit<McpMutationReceiptType, "receiptVersi
  * accidentally adding an unbounded entity or a copy of request fields.
  */
 export declare function mcpMutationReceipt(input: McpMutationReceiptInput): McpMutationReceiptType;
+export declare function sessionControlMutationReceipt(input: {
+    operation: "session_pause" | "session_resume";
+    sessionId: string;
+    state: string;
+    receiptId: string;
+    timestamp: string;
+    outcome: "changed" | "unchanged" | "replayed";
+    interruptionCount: number;
+}): McpMutationReceiptType;
 export type SessionCreateReceiptResult = {
     session: {
         id: string;

package/dist/organization-recovery-notifications.d.ts

@@ -0,0 +1,41 @@
+import type { Database } from "@opengeni/db";
+import { prepareOrganizationRecoveryNotifications, settleOrganizationRecoveryNotification, type OrganizationRecoveryNotificationClaim, type OrganizationRecoveryNotificationSettlement } from "@opengeni/db";
+export type OrganizationRecoveryNotificationDeliveryResult = {
+    status: "sent";
+    providerMessageId: string | null;
+} | {
+    status: "failed";
+    errorClass: string;
+} | {
+    status: "outcome_unknown";
+};
+export interface OrganizationRecoveryNotificationTransport {
+    readonly provider: string;
+    send(claim: OrganizationRecoveryNotificationClaim): Promise<OrganizationRecoveryNotificationDeliveryResult>;
+}
+export type OrganizationRecoveryNotificationLifecycle = {
+    prepare: typeof prepareOrganizationRecoveryNotifications;
+    settle: typeof settleOrganizationRecoveryNotification;
+};
+export declare function dispatchOrganizationRecoveryNotifications(input: {
+    db: Database;
+    transport: OrganizationRecoveryNotificationTransport;
+    claimOwner: string;
+    limit?: number;
+    leaseSeconds?: number;
+    lifecycle?: OrganizationRecoveryNotificationLifecycle;
+}): Promise<OrganizationRecoveryNotificationSettlement[]>;
+export declare class InMemoryOrganizationRecoveryNotificationTransport implements OrganizationRecoveryNotificationTransport {
+    readonly provider = "fake";
+    readonly attempts: Array<{
+        idempotencyKey: string;
+        payloadDigest: string;
+        recipientCanonicalIdentityId: string;
+        providerMessageId: string;
+    }>;
+    private readonly deliveries;
+    private readonly scripted;
+    enqueue(...results: OrganizationRecoveryNotificationDeliveryResult[]): void;
+    logicalDeliveryCount(): number;
+    send(claim: OrganizationRecoveryNotificationClaim): Promise<OrganizationRecoveryNotificationDeliveryResult>;
+}

package/dist/routes/managed-auth-session-sets.d.ts

@@ -0,0 +1,19 @@
+import { type ApiRouteDeps } from "@opengeni/core";
+import type { Hono } from "hono";
+export declare function registerManagedAuthSessionSetRoutes(app: Hono, deps: ApiRouteDeps): void;
+/**
+ * Better Auth 1.6.26 provider lifecycle routes retained while session-set mode
+ * owns all selected-session reads, enumeration, revocation, and user mutation.
+ * The list is intentionally exact so a dependency upgrade cannot silently add
+ * a selected-session capability under the wildcard.
+ */
+export declare function requireManagedAuthProviderRouteAllowed(method: string, pathname: string): void;
+/** Remove provider bearer/session material and enforce browser-auth cache/cookie policy. */
+export declare function scrubManagedAuthProviderResponse(response: Response, options?: {
+    replacementCookies?: readonly string[] | undefined;
+}): Promise<Response>;
+export declare function parseSupportedDeepLink(path: string): {
+    workspaceId: string | null;
+    sessionId: string | null;
+    permission: "workspace:read" | "sessions:read";
+} | null;

package/dist/routes/organization-recovery.d.ts

@@ -0,0 +1,19 @@
+import { getManagedAuthRequestActorAdmissionStamp, getManagedAuthRequestActorLeaseStamp, requireCanonicalHumanRequestIdentity } from "@opengeni/core/canonical-human-identities";
+import type { ApiRouteDeps } from "@opengeni/core";
+import { acceptOrganizationRecoveryCustody, approveOrganizationRecoveryOperation, cancelOrganizationRecoveryOperation, configureOrganizationRecoveryPolicy, disableOrganizationRecoveryPolicy, executeOrganizationRecoveryOperation, getOrganizationRecoveryOverview, startOrganizationRecoveryOperation } from "@opengeni/db";
+import type { Hono } from "hono";
+export type OrganizationRecoveryRouteServices = {
+    requireCanonicalHumanRequestIdentity: typeof requireCanonicalHumanRequestIdentity;
+    getManagedAuthRequestActorAdmissionStamp: typeof getManagedAuthRequestActorAdmissionStamp;
+    getManagedAuthRequestActorLeaseStamp: typeof getManagedAuthRequestActorLeaseStamp;
+    getOrganizationRecoveryOverview: typeof getOrganizationRecoveryOverview;
+    configureOrganizationRecoveryPolicy: typeof configureOrganizationRecoveryPolicy;
+    acceptOrganizationRecoveryCustody: typeof acceptOrganizationRecoveryCustody;
+    disableOrganizationRecoveryPolicy: typeof disableOrganizationRecoveryPolicy;
+    startOrganizationRecoveryOperation: typeof startOrganizationRecoveryOperation;
+    approveOrganizationRecoveryOperation: typeof approveOrganizationRecoveryOperation;
+    cancelOrganizationRecoveryOperation: typeof cancelOrganizationRecoveryOperation;
+    executeOrganizationRecoveryOperation: typeof executeOrganizationRecoveryOperation;
+};
+export declare function organizationRecoveryHttpError(error: unknown): Error;
+export declare function registerOrganizationRecoveryRoutes(app: Hono, deps: ApiRouteDeps, services?: OrganizationRecoveryRouteServices): void;

package/dist/routes/workspaces.d.ts

@@ -20,5 +20,6 @@ export declare function workspaceMembersResponse(members: readonly WorkspaceMemb
         createdAt: string;
     }[];
 };
+export declare function workspaceUpdateRequestsAccountTransfer(value: unknown): boolean;
 export declare function registerWorkspaceRoutes(app: Hono, deps: ApiRouteDeps): void;
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/api-router",
-  "version": "2.3.2-canary.2",
+  "version": "2.4.2-canary.0",
   "description": "OpenGeni HTTP surface: the Hono adapter/router (createApp), routes, MCP HTTP transport, and HTTP access adapters over @opengeni/core. An engine-distribution surface — its runtime closure includes engine-internal packages.",
   "license": "Apache-2.0",
   "repository": {
@@ -43,23 +43,23 @@
     "@hono/zod-validator": "^0.7.6",
     "@llamaindex/liteparse": "^1.5.3",
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "@opengeni/agent-proto": "^0.5.1-canary.4",
-    "@opengeni/artifact-tool": "^0.3.7-canary.2",
-    "@opengeni/capabilities": "^0.3.1-canary.3",
-    "@opengeni/codemode": "^0.4.15-canary.2",
-    "@opengeni/codex": "^0.2.19-canary.3",
-    "@opengeni/config": "^0.20.1-canary.2",
-    "@opengeni/contracts": "^2.5.0-canary.2",
-    "@opengeni/core": "^2.4.0-canary.2",
-    "@opengeni/db": "^3.4.0-canary.2",
-    "@opengeni/documents": "^0.8.2-canary.2",
-    "@opengeni/events": "^0.4.0-canary.2",
-    "@opengeni/github": "^0.5.5-canary.2",
-    "@opengeni/network": "^0.2.3-canary.3",
-    "@opengeni/observability": "^0.8.6-canary.2",
-    "@opengeni/runtime": "^1.4.0-canary.2",
-    "@opengeni/storage": "^0.2.108-canary.2",
-    "@opengeni/xai-subscription": "^0.1.2-canary.3",
+    "@opengeni/agent-proto": "^0.5.1-canary.5",
+    "@opengeni/artifact-tool": "^0.3.8-canary.0",
+    "@opengeni/capabilities": "^0.3.1-canary.4",
+    "@opengeni/codemode": "^0.4.16-canary.0",
+    "@opengeni/codex": "^0.2.19-canary.4",
+    "@opengeni/config": "^0.21.0-canary.0",
+    "@opengeni/contracts": "^2.6.0-canary.0",
+    "@opengeni/core": "^2.5.2-canary.0",
+    "@opengeni/db": "^3.5.2-canary.0",
+    "@opengeni/documents": "^0.8.5-canary.0",
+    "@opengeni/events": "^0.4.3-canary.0",
+    "@opengeni/github": "^0.6.0-canary.0",
+    "@opengeni/network": "^0.2.3-canary.4",
+    "@opengeni/observability": "^0.8.8-canary.0",
+    "@opengeni/runtime": "^1.4.1-canary.0",
+    "@opengeni/storage": "^0.2.109-canary.0",
+    "@opengeni/xai-subscription": "^0.1.2-canary.4",
     "@temporalio/client": "^1.17.0",
     "better-auth": "^1.6.14",
     "hono": "^4.12.18",

package/src/app.ts

@@ -36,7 +36,10 @@ import {
   configureChildLifecycleNotices,
   configureWorkspaceControlRequestLockTimeoutMs,
   dbSql,
+  getManagedAuthSessionSetSnapshot,
   getWorkspace,
+  reapManagedAuthIsolatedSessions,
+  reapExpiredManagedAuthSessionSets,
   rlsContextForWorkspace,
   withSessionRlsActorContext,
 } from "@opengeni/db";
@@ -49,21 +52,32 @@ import { Hono } from "hono";
 import { bodyLimit } from "hono/body-limit";
 import { compress } from "hono/compress";
 import { cors } from "hono/cors";
+import { getCookie } from "hono/cookie";
 import { HTTPException } from "hono/http-exception";
 import { ApiHttpError, workspaceControlBusyHttpError } from "./http/api-error";
 import type { ContentfulStatusCode } from "hono/utils/http-status";
 import type { ApiRouteDeps, AppDependencies } from "@opengeni/core";
 import {
   CodexCompactionV2ProviderLockedError,
+  ManagedAuthActorLeaseOutcomeUnknownError,
   hasPermission,
   requireAccessGrant,
   requireLiveAgentAttemptAuthorization,
   requirePermission,
+  releaseManagedAuthRequestActorLease,
+  validateManagedAuthRequestActorLease,
   requireSessionAuthorization,
   SessionAuthorizationDeniedError,
   SessionAuthorizationUnavailableError,
 } from "@opengeni/core";
 import { createManagedAuth } from "./auth/managed-auth";
+import {
+  MANAGED_AUTH_SESSION_SET_COOKIE,
+  ManagedAuthActorChangeError,
+  managedAuthSha256,
+} from "@opengeni/core/managed-auth-session-sets";
+import { createBetterAuthSessionAdapter } from "./auth/managed-auth-session-adapter";
+import { runManagedAuthDiscardedProviderSession } from "./auth/managed-auth-attempt-context";
 import { createManagedEmailTransport } from "./auth/managed-email";
 import { assertManagedEmailTransportMetadata } from "./auth/organization-user-setup";
 import { createApiSandboxClient, makeResumeBoxById } from "./sandbox/access";
@@ -135,7 +149,13 @@ import { registerEditableArtifactRoutes } from "./routes/editable-artifacts";
 import { registerVideoGenerationRoutes } from "./routes/video-generation";
 import { registerCanonicalHumanIdentityRoutes } from "./routes/canonical-human-identities";
 import { registerOrganizationMembershipRoutes } from "./routes/organization-memberships";
+import { registerOrganizationRecoveryRoutes } from "./routes/organization-recovery";
 import { registerManagedOnboardingRoutes } from "./routes/managed-onboarding";
+import {
+  registerManagedAuthSessionSetRoutes,
+  requireManagedAuthProviderRouteAllowed,
+  scrubManagedAuthProviderResponse,
+} from "./routes/managed-auth-session-sets";
 import { registerUserResourceAuthorityRoutes } from "./routes/user-resource-authorities";
 import { registerConnectionAuthorityRoutes } from "./routes/connection-authorities";
 import { projectClientModel } from "./model-catalog";
@@ -167,6 +187,8 @@ export { workflowIdForSession } from "@opengeni/core";
 export { replaySessionEvents, sseSessionStream, sseWorkspaceControlStream } from "./http/sse";
 
 export const API_MAX_REQUEST_BODY_BYTES = 32 * 1024 * 1024;
+const managedAuthReaperDatabases = new WeakSet<object>();
+const MANAGED_AUTH_REAPER_INTERVAL_MS = 60_000;
 
 /** Effective Hono bodyLimit — API JSON ceiling or voice multipart + multipart overhead. */
 export function apiRequestBodyLimitBytes(settings: {
@@ -202,6 +224,9 @@ export function createAppComposition(deps: AppDependencies): {
   assertManagedEmailTransportMetadata(managedEmailTransport);
   const managedAuth =
     deps.managedAuth ?? createManagedAuth(deps.settings, deps.db, managedEmailTransport);
+  const managedAuthSessionAdapter =
+    deps.managedAuthSessionAdapter ??
+    (managedAuth ? createBetterAuthSessionAdapter(managedAuth, deps.db) : null);
   const objectStorage =
     deps.objectStorage === undefined ? createObjectStorage(deps.settings) : deps.objectStorage;
   let documentServices: DocumentServices | null = deps.documentServices ?? null;
@@ -284,6 +309,24 @@ export function createAppComposition(deps: AppDependencies): {
   const resumeBoxById = deps.resumeBoxById ?? makeResumeBoxById(sandboxClient);
   const observability =
     deps.observability ?? createObservability(deps.settings, { component: "api" });
+  if (
+    managedAuth &&
+    deps.settings.managedAuthSessionSetMode !== "legacy" &&
+    !managedAuthReaperDatabases.has(deps.db as object)
+  ) {
+    managedAuthReaperDatabases.add(deps.db as object);
+    const timer = setInterval(() => {
+      void Promise.all([
+        reapManagedAuthIsolatedSessions(deps.db, 100),
+        reapExpiredManagedAuthSessionSets(deps.db, 100),
+      ]).catch((error) => {
+        observability.error("Managed isolated-auth orphan reap failed", {
+          errorClass: error instanceof Error ? error.name : "UnknownError",
+        });
+      });
+    }, MANAGED_AUTH_REAPER_INTERVAL_MS);
+    (timer as ReturnType<typeof setInterval> & { unref?: () => void }).unref?.();
+  }
   const transcription =
     deps.transcription === undefined
       ? createTranscriptionService({
@@ -304,6 +347,7 @@ export function createAppComposition(deps: AppDependencies): {
     githubStateSecret:
       deps.githubStateSecret ?? deps.settings.githubAppManifestStateSecret ?? crypto.randomUUID(),
     managedAuth,
+    managedAuthSessionAdapter,
     managedEmailTransport,
     objectStorage,
     documentIndexer,
@@ -332,13 +376,17 @@ export function createAppComposition(deps: AppDependencies): {
       "Range",
       "X-OpenGeni-Access-Key",
       "X-OpenGeni-Api-Contract",
+      "X-OpenGeni-Actor-Epoch",
       "X-OpenGeni-Correlation-Id",
+      "X-OpenGeni-Session-Csrf",
       "X-OpenGeni-Subject",
     ],
     exposeHeaders: [
       "Accept-Ranges",
       "Content-Range",
       "X-OpenGeni-Api-Contract",
+      "X-OpenGeni-Actor-Epoch",
+      "X-OpenGeni-Actor-State",
       "X-OpenGeni-Correlation-Id",
     ],
   };
@@ -495,11 +543,93 @@ export function createAppComposition(deps: AppDependencies): {
     await next();
   });
 
+  app.use("/v1/*", async (c, next) => {
+    try {
+      await next();
+      try {
+        await validateManagedAuthRequestActorLease(c.req.raw);
+      } catch (error) {
+        if (error instanceof ManagedAuthActorChangeError) {
+          c.header("x-opengeni-actor-state", "changed");
+          throw new HTTPException(409, { message: error.code, cause: error });
+        }
+        if (error instanceof ManagedAuthActorLeaseOutcomeUnknownError) {
+          throw new ApiHttpError(503, {
+            code: "upstream_unavailable",
+            message: error.code,
+            retryable: true,
+            outcomeUnknown: true,
+            details: { managedAuthCode: error.code },
+          });
+        }
+        throw error;
+      }
+    } finally {
+      await releaseManagedAuthRequestActorLease(c.req.raw).catch((error) => {
+        observability.error("Managed actor mutation lease release failed", {
+          errorClass: error instanceof Error ? error.name : "UnknownError",
+        });
+      });
+    }
+  });
+
   // These product-owned auth routes must be registered before Better Auth's
   // wildcard handler or the provider returns its own 404 first.
   registerManagedOnboardingRoutes(app, routeDeps);
+  registerManagedAuthSessionSetRoutes(app, routeDeps);
   if (managedAuth) {
-    app.on(["GET", "POST"], "/v1/auth/*", (c) => managedAuth.handler(c.req.raw));
+    app.on(["GET", "POST"], "/v1/auth/*", async (c) => {
+      if (deps.settings.managedAuthSessionSetMode === "legacy") {
+        return await managedAuth.handler(c.req.raw);
+      }
+      requireManagedAuthProviderRouteAllowed(c.req.method, new URL(c.req.url).pathname);
+      // Provider authentication/recovery is isolated from whichever actor the
+      // browser currently renders. Selected-session capabilities are all
+      // product-owned above this wildcard and generation/epoch fenced.
+      const headers = new Headers(c.req.raw.headers);
+      headers.delete("cookie");
+      headers.delete("authorization");
+      headers.delete("x-forwarded-user");
+      const providerRequest = new Request(c.req.raw, { headers });
+      const authority = getCookie(c, MANAGED_AUTH_SESSION_SET_COOKIE);
+      const discardProviderSession =
+        deps.settings.managedAuthSessionSetMode === "broker" || authority !== undefined;
+      const providerResponse = discardProviderSession
+        ? await runManagedAuthDiscardedProviderSession(
+            async () => await managedAuth.handler(providerRequest),
+          )
+        : await managedAuth.handler(providerRequest);
+      let replacementCookies: readonly string[] | undefined;
+      if (deps.settings.managedAuthSessionSetMode === "broker") {
+        replacementCookies = await managedAuthSessionAdapter!.createLegacySelectedSessionCookies(
+          null,
+          c.req.header("cookie") ?? null,
+        );
+      } else {
+        if (authority !== undefined) {
+          const snapshot = await getManagedAuthSessionSetSnapshot(deps.db, {
+            authorityHash: managedAuthSha256(authority),
+            mode: "dual",
+            includeInternal: true,
+            readOnly: true,
+          });
+          if (snapshot) {
+            replacementCookies =
+              await managedAuthSessionAdapter!.createLegacySelectedSessionCookies(
+                snapshot.selected,
+                c.req.header("cookie") ?? null,
+              );
+          } else {
+            replacementCookies =
+              await managedAuthSessionAdapter!.createLegacySelectedSessionCookies(
+                null,
+                c.req.header("cookie") ?? null,
+              );
+          }
+        }
+      }
+      return await scrubManagedAuthProviderResponse(providerResponse, { replacementCookies });
+    });
   }
 
   app.get("/healthz", (c) =>
@@ -585,6 +715,7 @@ export function createAppComposition(deps: AppDependencies): {
             : {}),
         },
         productAccessMode: deps.settings.productAccessMode,
+        managedAuthSessionSetMode: deps.settings.managedAuthSessionSetMode,
         auth: clientAuthConfig(deps.settings),
         analytics: clientAnalyticsConfig(deps.settings),
         // Channel-A structured services (P4.4) ride exec/readFile/createEditor,
@@ -765,6 +896,7 @@ export function createAppComposition(deps: AppDependencies): {
   registerVideoGenerationRoutes(app, routeDeps);
   registerCanonicalHumanIdentityRoutes(app, routeDeps);
   registerOrganizationMembershipRoutes(app, routeDeps);
+  registerOrganizationRecoveryRoutes(app, routeDeps);
   registerUserResourceAuthorityRoutes(app, routeDeps);
   registerConnectionAuthorityRoutes(app, routeDeps);
   registerSlackInteractionRoutes(app, routeDeps);

package/src/auth/managed-auth-attempt-context.ts

@@ -0,0 +1,24 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+
+type ManagedAuthAttemptContext =
+  | { kind: "isolated_transaction"; transactionId: string }
+  | { kind: "discard_provider_session" };
+
+const managedAuthAttemptStorage = new AsyncLocalStorage<ManagedAuthAttemptContext>();
+
+export function runManagedAuthAttempt<T>(transactionId: string, action: () => T): T {
+  return managedAuthAttemptStorage.run({ kind: "isolated_transaction", transactionId }, action);
+}
+
+export function runManagedAuthDiscardedProviderSession<T>(action: () => T): T {
+  return managedAuthAttemptStorage.run({ kind: "discard_provider_session" }, action);
+}
+
+export function currentManagedAuthAttemptId(): string | null {
+  const context = managedAuthAttemptStorage.getStore();
+  return context?.kind === "isolated_transaction" ? context.transactionId : null;
+}
+
+export function shouldDiscardCurrentManagedAuthProviderSession(): boolean {
+  return managedAuthAttemptStorage.getStore()?.kind === "discard_provider_session";
+}

package/src/auth/managed-auth-session-adapter.ts

@@ -0,0 +1,205 @@
+import type {
+  ManagedAuthResolvedSession,
+  ManagedAuthSessionAdapter,
+} from "@opengeni/core/managed-auth-session-sets";
+import { sql } from "drizzle-orm";
+import type { Database } from "@opengeni/db";
+import type { ManagedAuth } from "@opengeni/core";
+import { createHmac, timingSafeEqual } from "node:crypto";
+import { runManagedAuthAttempt } from "./managed-auth-attempt-context";
+
+export function createBetterAuthSessionAdapter(
+  auth: ManagedAuth,
+  db: Database,
+): ManagedAuthSessionAdapter {
+  return {
+    async authenticate(input) {
+      if (input.provider !== "email_password") {
+        throw new Error("unsupported managed authentication provider");
+      }
+      const result = await runManagedAuthAttempt(
+        input.transactionId,
+        async () =>
+          await auth.api.signInEmail({
+            body: {
+              email: input.credentials.email,
+              password: input.credentials.password,
+              rememberMe: true,
+            },
+            headers: input.headers,
+            returnHeaders: true,
+          }),
+      );
+      const token = result.response?.token;
+      if (typeof token !== "string") {
+        throw new Error("managed authentication did not create an isolated session");
+      }
+      const resolved = await (await auth.$context).internalAdapter.findSession(token);
+      if (!resolved?.session?.id) {
+        throw new Error("managed authentication session could not be resolved");
+      }
+      return { authSessionId: resolved.session.id };
+    },
+
+    async resolveSelectedSession(input): Promise<ManagedAuthResolvedSession | null> {
+      const resolved = await (await auth.$context).internalAdapter.findSession(input.token);
+      return liveResolvedSession(resolved);
+    },
+
+    async resolveAmbientSession(headers): Promise<ManagedAuthResolvedSession | null> {
+      const context = await auth.$context;
+      const signed = cookieValue(headers.get("cookie"), context.authCookies.sessionToken.name);
+      const token = signed ? verifiedSignedCookieValue(signed, context.secret) : null;
+      if (!token) return null;
+      const resolved = await context.internalAdapter.findSession(token);
+      return liveResolvedSession(resolved);
+    },
+
+    async refreshSelectedSession(input): Promise<ManagedAuthResolvedSession | null> {
+      const context = await auth.$context;
+      const cookie = context.authCookies.sessionToken;
+      const headers = new Headers({
+        cookie: `${cookie.name}=${signedCookieValue(input.token, context.secret)}`,
+      });
+      const resolved = await auth.api.getSession({ headers, returnHeaders: true });
+      if (!resolved.response) return null;
+      // The provider may renew its durable expiry and emit token/cache cookies;
+      // this server-side selected-slot resolution intentionally discards them.
+      return resolved.response as ManagedAuthResolvedSession;
+    },
+
+    async revokeSession(input) {
+      await db.execute(sql`delete from auth_sessions where id = ${input.authSessionId}`);
+    },
+
+    async createLegacySelectedSessionCookies(input, currentCookieHeader) {
+      const context = await auth.$context;
+      const cookie = context.authCookies.sessionToken;
+      const value = input ? signedCookieValue(input.token, context.secret) : "";
+      const headers = [
+        serializeCookieHeader(cookie.name, value, {
+          ...cookie.attributes,
+          ...(input ? {} : { maxAge: 0, expires: new Date(0) }),
+        }),
+      ];
+      for (const cacheCookie of [
+        context.authCookies.sessionData,
+        context.authCookies.accountData,
+        context.authCookies.dontRememberToken,
+      ]) {
+        for (const name of cacheCookieNames(cacheCookie.name, currentCookieHeader)) {
+          headers.push(
+            serializeCookieHeader(name, "", {
+              ...cacheCookie.attributes,
+              maxAge: 0,
+              expires: new Date(0),
+            }),
+          );
+        }
+      }
+      return headers;
+    },
+  };
+}
+
+function liveResolvedSession(value: unknown): ManagedAuthResolvedSession | null {
+  if (!value || typeof value !== "object") return null;
+  const session = (value as { session?: { expiresAt?: unknown } }).session;
+  const expiresAt = session?.expiresAt;
+  const expiryMillis =
+    expiresAt instanceof Date
+      ? expiresAt.getTime()
+      : typeof expiresAt === "string" || typeof expiresAt === "number"
+        ? new Date(expiresAt).getTime()
+        : Number.NaN;
+  if (!Number.isFinite(expiryMillis) || expiryMillis <= Date.now()) return null;
+  return value as ManagedAuthResolvedSession;
+}
+
+function cookieValue(header: string | null, name: string): string | null {
+  if (!header) return null;
+  for (const part of header.split(";")) {
+    const separator = part.indexOf("=");
+    if (separator < 0 || part.slice(0, separator).trim() !== name) continue;
+    return part.slice(separator + 1).trim() || null;
+  }
+  return null;
+}
+
+function verifiedSignedCookieValue(value: string, secret: string): string | null {
+  let decoded: string;
+  try {
+    decoded = decodeURIComponent(value);
+  } catch {
+    return null;
+  }
+  const separator = decoded.lastIndexOf(".");
+  if (separator <= 0) return null;
+  const token = decoded.slice(0, separator);
+  const signature = decoded.slice(separator + 1);
+  const expected = createHmac("sha256", secret).update(token, "utf8").digest("base64");
+  const actualBytes = Buffer.from(signature, "utf8");
+  const expectedBytes = Buffer.from(expected, "utf8");
+  return actualBytes.length === expectedBytes.length && timingSafeEqual(actualBytes, expectedBytes)
+    ? token
+    : null;
+}
+
+function signedCookieValue(value: string, secret: string): string {
+  return encodeURIComponent(
+    `${value}.${createHmac("sha256", secret).update(value, "utf8").digest("base64")}`,
+  );
+}
+
+function serializeCookieHeader(
+  name: string,
+  value: string,
+  attributes: {
+    domain?: string;
+    expires?: Date;
+    httpOnly?: boolean;
+    maxAge?: number;
+    path?: string;
+    partitioned?: boolean;
+    prefix?: "secure" | "host";
+    sameSite?: string;
+    secure?: boolean;
+  },
+): string {
+  let cookieName = name;
+  if (attributes.prefix === "secure" && !cookieName.startsWith("__Secure-")) {
+    cookieName = `__Secure-${cookieName}`;
+  } else if (attributes.prefix === "host" && !cookieName.startsWith("__Host-")) {
+    cookieName = `__Host-${cookieName}`;
+  }
+  if (cookieName.startsWith("__Secure-")) attributes.secure = true;
+  if (cookieName.startsWith("__Host-")) {
+    attributes.secure = true;
+    attributes.path = "/";
+    delete attributes.domain;
+  }
+  let header = `${cookieName}=${value}`;
+  if (attributes.maxAge !== undefined)
+    header += `; Max-Age=${Math.max(0, Math.floor(attributes.maxAge))}`;
+  if (attributes.domain) header += `; Domain=${attributes.domain}`;
+  if (attributes.path) header += `; Path=${attributes.path}`;
+  if (attributes.expires) header += `; Expires=${attributes.expires.toUTCString()}`;
+  if (attributes.httpOnly) header += "; HttpOnly";
+  if (attributes.secure) header += "; Secure";
+  if (attributes.sameSite) {
+    header += `; SameSite=${attributes.sameSite[0]?.toUpperCase()}${attributes.sameSite.slice(1)}`;
+  }
+  if (attributes.partitioned) header += "; Partitioned";
+  return header;
+}
+
+function cacheCookieNames(baseName: string, cookieHeader?: string | null): string[] {
+  const names = new Set([baseName]);
+  for (const part of cookieHeader?.split(";") ?? []) {
+    const separator = part.indexOf("=");
+    if (separator < 0) continue;
+    const name = part.slice(0, separator).trim();
+    if (name === baseName || name.startsWith(`${baseName}.`)) names.add(name);
+  }
+  return [...names].sort();
+}