@robelest/convex-auth 0.0.4-preview.18 → 0.0.4-preview.19

package/dist/server/index.js

@@ -1,1368 +1,5 @@
-import { Fx } from "./fx.js";
-import { isLocalHost } from "./utils.js";
-import { enterpriseConnectionWhereValidator, enterpriseDomainInputValidator, enterpriseDomainVerificationInputValidator, enterprisePolicyPatchValidator, enterpriseSamlAttributeMappingValidator, enterpriseSamlSpValidator, enterpriseStatusValidator } from "./enterpriseValidators.js";
-import { actionGeneric, makeFunctionReference, mutationGeneric, queryGeneric } from "convex/server";
-import { ConvexError, v } from "convex/values";
-import { parse, serialize } from "cookie";
-import { ConvexHttpClient } from "convex/browser";
-import { jwtDecode } from "jwt-decode";
+import { AuthCtx, createAuth } from "./auth.js";
+import { enterprise, scim, sso } from "./mounts.js";
+import { authCookieNames, parseAuthCookies, serializeAuthCookies, server, shouldProxyAuthAction, structuredAuthCookies } from "./ssr.js";
 
-//#region src/server/index.ts
-const signInActionRef = makeFunctionReference("auth:signIn");
-const signOutActionRef = makeFunctionReference("auth:signOut");
-function requireSignedInUser(auth) {
-	return async (ctx) => {
-		return await auth.user.id(ctx);
-	};
-}
-function normalizeCreatorRoleIds(roles) {
-	return roles?.map((role) => typeof role === "string" ? role : role.id);
-}
-async function resolveMountedEnterpriseTarget(auth, ctx, target) {
-	if (target.groupId !== void 0) return {
-		enterpriseId: target.enterpriseId,
-		groupId: target.groupId,
-		resolvedGroupId: target.groupId
-	};
-	if (target.enterpriseId !== void 0) {
-		const enterprise = await auth.sso.admin.connection.get(ctx, target.enterpriseId);
-		if (enterprise === null) throw new ConvexError({
-			code: "INVALID_PARAMETERS",
-			message: "Enterprise not found."
-		});
-		return {
-			enterpriseId: enterprise._id,
-			groupId: enterprise.groupId,
-			resolvedGroupId: enterprise.groupId
-		};
-	}
-	if (target.domain !== void 0) {
-		const resolved = await auth.sso.admin.connection.getByDomain(ctx, target.domain);
-		if (resolved?.enterprise === void 0) throw new ConvexError({
-			code: "INVALID_PARAMETERS",
-			message: "Enterprise not found."
-		});
-		return {
-			enterpriseId: resolved.enterprise._id,
-			groupId: resolved.enterprise.groupId,
-			resolvedGroupId: resolved.enterprise.groupId
-		};
-	}
-	return {
-		enterpriseId: void 0,
-		groupId: void 0,
-		resolvedGroupId: null
-	};
-}
-function createMountedAdminAuthorizer(auth, options) {
-	const requireUserId = requireSignedInUser(auth);
-	return async (ctx, permission, target = {}) => {
-		const userId = await requireUserId(ctx);
-		if (userId === null) return {
-			ok: false,
-			code: "NOT_SIGNED_IN"
-		};
-		if (!options?.admin?.authorized) return {
-			ok: false,
-			code: "FORBIDDEN"
-		};
-		const resolved = await resolveMountedEnterpriseTarget(auth, ctx, target);
-		const authResult = await options.admin.authorized(ctx, {
-			userId,
-			permission,
-			enterpriseId: resolved.enterpriseId,
-			groupId: resolved.groupId,
-			resolvedGroupId: resolved.resolvedGroupId
-		});
-		if (authResult && !authResult.ok) return {
-			ok: false,
-			code: "FORBIDDEN"
-		};
-		return {
-			ok: true,
-			userId,
-			...resolved
-		};
-	};
-}
-/**
-* Build optional public SSO management actions that apps can mount under
-* `convex/auth/sso/**` when they want client-callable enterprise APIs.
-*
-* `admin` is for tenant-admin control-plane operations and should be mounted
-* with an explicit authorization policy. `client` is for end-user sign-in
-* helpers and does not require tenant-admin authorization.
-*/
-function sso(auth, options) {
-	const authorize = createMountedAdminAuthorizer(auth, options);
-	const adminRoleIds = normalizeCreatorRoleIds(options?.admin?.roles);
-	return {
-		admin: {
-			connection: {
-				create: mutationGeneric({
-					args: {
-						groupId: v.optional(v.string()),
-						name: v.optional(v.string()),
-						slug: v.optional(v.string()),
-						status: v.optional(enterpriseStatusValidator),
-						domain: v.optional(v.string())
-					},
-					handler: async (ctx, args) => {
-						const authResult = await authorize(ctx, "sso.connection.create", { groupId: args.groupId });
-						if (!authResult.ok) return {
-							ok: false,
-							code: authResult.code
-						};
-						const { userId } = authResult;
-						const createsGroup = args.groupId === void 0;
-						const groupId = args.groupId ?? (await auth.group.create(ctx, {
-							name: args.name?.trim() || args.slug?.trim() || "Enterprise",
-							slug: args.slug,
-							type: "enterprise"
-						})).groupId;
-						if (createsGroup) await auth.member.create(ctx, {
-							groupId,
-							userId,
-							roleIds: adminRoleIds
-						});
-						const created = await auth.sso.admin.connection.create(ctx, {
-							groupId,
-							name: args.name,
-							slug: args.slug,
-							status: args.status
-						});
-						if (args.domain) await auth.sso.admin.connection.domain.set(ctx, created.enterpriseId, [{
-							domain: args.domain,
-							isPrimary: true
-						}]);
-						return {
-							...created,
-							groupId,
-							createdGroup: createsGroup
-						};
-					}
-				}),
-				get: queryGeneric({
-					args: { enterpriseId: v.string() },
-					handler: async (ctx, args) => {
-						if (!(await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId })).ok) return null;
-						return await auth.sso.admin.connection.get(ctx, args.enterpriseId);
-					}
-				}),
-				getByGroup: queryGeneric({
-					args: { groupId: v.string() },
-					handler: async (ctx, args) => {
-						if (!(await authorize(ctx, "sso.connection.read", { groupId: args.groupId })).ok) return null;
-						return await auth.sso.admin.connection.getByGroup(ctx, args.groupId);
-					}
-				}),
-				getByDomain: queryGeneric({
-					args: { domain: v.string() },
-					handler: async (ctx, args) => {
-						if (!(await authorize(ctx, "sso.connection.read", { domain: args.domain })).ok) return null;
-						return await auth.sso.admin.connection.getByDomain(ctx, args.domain);
-					}
-				}),
-				list: queryGeneric({
-					args: {
-						where: v.optional(enterpriseConnectionWhereValidator),
-						limit: v.optional(v.number()),
-						cursor: v.optional(v.union(v.string(), v.null())),
-						orderBy: v.optional(v.string()),
-						order: v.optional(v.union(v.literal("asc"), v.literal("desc")))
-					},
-					handler: async (ctx, args) => {
-						if (!(await authorize(ctx, "sso.connection.read", { groupId: args.where?.groupId })).ok) return null;
-						return await auth.sso.admin.connection.list(ctx, args);
-					}
-				}),
-				update: mutationGeneric({
-					args: {
-						enterpriseId: v.string(),
-						data: v.object({
-							name: v.optional(v.string()),
-							slug: v.optional(v.string()),
-							status: v.optional(enterpriseStatusValidator)
-						})
-					},
-					handler: async (ctx, args) => {
-						const _auth = await authorize(ctx, "sso.connection.manage", { enterpriseId: args.enterpriseId });
-						if (!_auth.ok) return {
-							ok: false,
-							code: _auth.code
-						};
-						await auth.sso.admin.connection.update(ctx, args.enterpriseId, args.data);
-						return {
-							ok: true,
-							enterpriseId: args.enterpriseId
-						};
-					}
-				}),
-				delete: mutationGeneric({
-					args: { enterpriseId: v.string() },
-					handler: async (ctx, args) => {
-						const _auth = await authorize(ctx, "sso.connection.manage", { enterpriseId: args.enterpriseId });
-						if (!_auth.ok) return {
-							ok: false,
-							code: _auth.code
-						};
-						return await auth.sso.admin.connection.delete(ctx, args.enterpriseId);
-					}
-				}),
-				status: queryGeneric({
-					args: { enterpriseId: v.string() },
-					handler: async (ctx, args) => {
-						if (!(await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId })).ok) return null;
-						return await auth.sso.admin.connection.status(ctx, args.enterpriseId);
-					}
-				}),
-				domain: {
-					list: queryGeneric({
-						args: { enterpriseId: v.string() },
-						handler: async (ctx, args) => {
-							if (!(await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId })).ok) return null;
-							return await auth.sso.admin.connection.domain.list(ctx, args.enterpriseId);
-						}
-					}),
-					validate: queryGeneric({
-						args: { enterpriseId: v.string() },
-						handler: async (ctx, args) => {
-							if (!(await authorize(ctx, "sso.domain.manage", { enterpriseId: args.enterpriseId })).ok) return null;
-							return await auth.sso.admin.connection.domain.validate(ctx, args.enterpriseId);
-						}
-					}),
-					set: mutationGeneric({
-						args: {
-							enterpriseId: v.string(),
-							domains: v.array(enterpriseDomainInputValidator)
-						},
-						handler: async (ctx, args) => {
-							const _auth = await authorize(ctx, "sso.domain.manage", { enterpriseId: args.enterpriseId });
-							if (!_auth.ok) return {
-								ok: false,
-								code: _auth.code
-							};
-							return await auth.sso.admin.connection.domain.set(ctx, args.enterpriseId, args.domains);
-						}
-					}),
-					verification: {
-						request: mutationGeneric({
-							args: enterpriseDomainVerificationInputValidator,
-							handler: async (ctx, args) => {
-								const _auth = await authorize(ctx, "sso.domain.manage", { enterpriseId: args.enterpriseId });
-								if (!_auth.ok) return {
-									ok: false,
-									code: _auth.code
-								};
-								return await auth.sso.admin.connection.domain.verification.request(ctx, args);
-							}
-						}),
-						confirm: actionGeneric({
-							args: enterpriseDomainVerificationInputValidator,
-							handler: async (ctx, args) => {
-								const _auth = await authorize(ctx, "sso.domain.manage", { enterpriseId: args.enterpriseId });
-								if (!_auth.ok) return {
-									ok: false,
-									code: _auth.code
-								};
-								return await auth.sso.admin.connection.domain.verification.confirm(ctx, args);
-							}
-						})
-					}
-				}
-			},
-			oidc: {
-				configure: mutationGeneric({
-					args: {
-						enterpriseId: v.string(),
-						issuer: v.optional(v.string()),
-						discoveryUrl: v.optional(v.string()),
-						clientId: v.string(),
-						clientSecret: v.optional(v.string()),
-						scopes: v.optional(v.array(v.string())),
-						authorizationParams: v.optional(v.record(v.string(), v.string())),
-						clockToleranceSeconds: v.optional(v.number()),
-						strictIssuer: v.optional(v.boolean()),
-						extraFields: v.optional(v.record(v.string(), v.string()))
-					},
-					handler: async (ctx, args) => {
-						const _auth = await authorize(ctx, "sso.protocol.manage", { enterpriseId: args.enterpriseId });
-						if (!_auth.ok) return {
-							ok: false,
-							code: _auth.code
-						};
-						return await auth.sso.admin.oidc.configure(ctx, args);
-					}
-				}),
-				get: queryGeneric({
-					args: { enterpriseId: v.string() },
-					handler: async (ctx, args) => {
-						if (!(await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId })).ok) return null;
-						return await auth.sso.admin.oidc.get(ctx, args.enterpriseId);
-					}
-				}),
-				validate: actionGeneric({
-					args: { enterpriseId: v.string() },
-					handler: async (ctx, args) => {
-						const _auth = await authorize(ctx, "sso.protocol.manage", { enterpriseId: args.enterpriseId });
-						if (!_auth.ok) return {
-							ok: false,
-							code: _auth.code
-						};
-						return await auth.sso.admin.oidc.validate(ctx, args.enterpriseId);
-					}
-				})
-			},
-			saml: {
-				configure: actionGeneric({
-					args: {
-						enterpriseId: v.string(),
-						metadataXml: v.optional(v.string()),
-						metadataUrl: v.optional(v.string()),
-						domains: v.optional(v.array(v.string())),
-						signAuthnRequests: v.optional(v.boolean()),
-						attributeMapping: v.optional(enterpriseSamlAttributeMappingValidator),
-						sp: v.optional(enterpriseSamlSpValidator)
-					},
-					handler: async (ctx, args) => {
-						const _auth = await authorize(ctx, "sso.protocol.manage", { enterpriseId: args.enterpriseId });
-						if (!_auth.ok) return {
-							ok: false,
-							code: _auth.code
-						};
-						return await auth.sso.admin.saml.configure(ctx, args);
-					}
-				}),
-				validate: queryGeneric({
-					args: { enterpriseId: v.string() },
-					handler: async (ctx, args) => {
-						if (!(await authorize(ctx, "sso.protocol.manage", { enterpriseId: args.enterpriseId })).ok) return null;
-						return await auth.sso.admin.saml.validate(ctx, args.enterpriseId);
-					}
-				})
-			},
-			policy: {
-				get: queryGeneric({
-					args: { enterpriseId: v.string() },
-					handler: async (ctx, args) => {
-						if (!(await authorize(ctx, "sso.connection.read", { enterpriseId: args.enterpriseId })).ok) return null;
-						return await auth.sso.admin.policy.get(ctx, args.enterpriseId);
-					}
-				}),
-				update: mutationGeneric({
-					args: {
-						enterpriseId: v.string(),
-						patch: enterprisePolicyPatchValidator
-					},
-					handler: async (ctx, args) => {
-						const _auth = await authorize(ctx, "sso.policy.manage", { enterpriseId: args.enterpriseId });
-						if (!_auth.ok) return {
-							ok: false,
-							code: _auth.code
-						};
-						return await auth.sso.admin.policy.update(ctx, args.enterpriseId, args.patch);
-					}
-				}),
-				validate: queryGeneric({
-					args: { enterpriseId: v.string() },
-					handler: async (ctx, args) => {
-						if (!(await authorize(ctx, "sso.policy.manage", { enterpriseId: args.enterpriseId })).ok) return null;
-						return await auth.sso.admin.policy.validate(ctx, args.enterpriseId);
-					}
-				})
-			},
-			audit: { list: queryGeneric({
-				args: {
-					enterpriseId: v.optional(v.string()),
-					groupId: v.optional(v.string()),
-					limit: v.optional(v.number())
-				},
-				handler: async (ctx, args) => {
-					if (!(await authorize(ctx, "sso.audit.read", {
-						enterpriseId: args.enterpriseId,
-						groupId: args.groupId
-					})).ok) return null;
-					return await auth.sso.admin.audit.list(ctx, args);
-				}
-			}) },
-			webhook: {
-				delivery: { list: queryGeneric({
-					args: {
-						enterpriseId: v.string(),
-						limit: v.optional(v.number())
-					},
-					handler: async (ctx, args) => {
-						if (!(await authorize(ctx, "sso.webhook.manage", { enterpriseId: args.enterpriseId })).ok) return null;
-						return await auth.sso.admin.webhook.delivery.list(ctx, args);
-					}
-				}) },
-				endpoint: {
-					create: mutationGeneric({
-						args: {
-							enterpriseId: v.string(),
-							url: v.string(),
-							secret: v.string(),
-							subscriptions: v.array(v.string()),
-							createdByUserId: v.optional(v.string())
-						},
-						handler: async (ctx, args) => {
-							const authResult = await authorize(ctx, "sso.webhook.manage", { enterpriseId: args.enterpriseId });
-							if (!authResult.ok) return {
-								ok: false,
-								code: authResult.code
-							};
-							const { userId } = authResult;
-							return {
-								_id: (await auth.sso.admin.webhook.endpoint.create(ctx, {
-									...args,
-									createdByUserId: args.createdByUserId ?? userId
-								})).endpointId,
-								enterpriseId: args.enterpriseId,
-								url: args.url,
-								subscriptions: args.subscriptions,
-								createdByUserId: args.createdByUserId ?? userId,
-								status: "active",
-								failureCount: 0
-							};
-						}
-					}),
-					list: queryGeneric({
-						args: { enterpriseId: v.string() },
-						handler: async (ctx, args) => {
-							if (!(await authorize(ctx, "sso.webhook.manage", { enterpriseId: args.enterpriseId })).ok) return null;
-							return (await auth.sso.admin.webhook.endpoint.list(ctx, args.enterpriseId)).map((endpoint) => {
-								const { secretHash: _secretHash, ...rest } = endpoint;
-								return rest;
-							});
-						}
-					}),
-					disable: mutationGeneric({
-						args: { endpointId: v.string() },
-						handler: async (ctx, args) => {
-							const endpoint = await auth.sso.admin.webhook.endpoint.get(ctx, args.endpointId);
-							if (!endpoint) return {
-								ok: false,
-								code: "INVALID_PARAMETERS"
-							};
-							const _auth = await authorize(ctx, "sso.webhook.manage", {
-								enterpriseId: endpoint.enterpriseId,
-								groupId: endpoint.groupId
-							});
-							if (!_auth.ok) return {
-								ok: false,
-								code: _auth.code
-							};
-							return await auth.sso.admin.webhook.endpoint.disable(ctx, args.endpointId);
-						}
-					})
-				}
-			}
-		},
-		client: {
-			signIn: queryGeneric({
-				args: {
-					enterpriseId: v.optional(v.string()),
-					email: v.optional(v.string()),
-					domain: v.optional(v.string()),
-					redirectTo: v.optional(v.string())
-				},
-				handler: async (ctx, args) => {
-					return await auth.sso.client.signIn(ctx, args);
-				}
-			}),
-			metadata: queryGeneric({
-				args: {
-					enterpriseId: v.string(),
-					entityId: v.optional(v.string()),
-					acsUrl: v.optional(v.string()),
-					sloUrl: v.optional(v.string())
-				},
-				handler: async (ctx, args) => {
-					return await auth.sso.client.metadata(ctx, args);
-				}
-			})
-		}
-	};
-}
-/**
-* Build optional public SCIM management actions that apps can mount under
-* `convex/auth/scim/**` when they want client-callable enterprise admin APIs.
-*/
-function scim(auth, options) {
-	const authorize = createMountedAdminAuthorizer(auth, options);
-	return { admin: {
-		configure: mutationGeneric({
-			args: {
-				enterpriseId: v.string(),
-				basePath: v.optional(v.string()),
-				status: v.optional(enterpriseStatusValidator)
-			},
-			handler: async (ctx, args) => {
-				const _auth = await authorize(ctx, "scim.manage", { enterpriseId: args.enterpriseId });
-				if (!_auth.ok) return {
-					ok: false,
-					code: _auth.code
-				};
-				return await auth.scim.admin.configure(ctx, args);
-			}
-		}),
-		get: queryGeneric({
-			args: { enterpriseId: v.string() },
-			handler: async (ctx, args) => {
-				if (!(await authorize(ctx, "scim.manage", { enterpriseId: args.enterpriseId })).ok) return null;
-				return await auth.scim.admin.get(ctx, args.enterpriseId);
-			}
-		}),
-		validate: queryGeneric({
-			args: { enterpriseId: v.string() },
-			handler: async (ctx, args) => {
-				if (!(await authorize(ctx, "scim.manage", { enterpriseId: args.enterpriseId })).ok) return null;
-				return await auth.scim.admin.validate(ctx, args.enterpriseId);
-			}
-		})
-	} };
-}
-/**
-* Build a flat mounted enterprise API surface for app-owned Convex exports.
-*
-* The returned object contains tenant-admin SSO and SCIM control-plane
-* functions plus end-user enterprise sign-in helpers. The `authorized`
-* callback is required for admin operations.
-*/
-function enterprise(auth, options) {
-	const mountedSso = sso(auth, { admin: options.admin });
-	const mountedScim = scim(auth, { admin: { authorized: options.admin.authorized } });
-	return {
-		createConnection: mountedSso.admin.connection.create,
-		getConnection: mountedSso.admin.connection.get,
-		getConnectionByGroup: mountedSso.admin.connection.getByGroup,
-		getConnectionByDomain: mountedSso.admin.connection.getByDomain,
-		listConnections: mountedSso.admin.connection.list,
-		updateConnection: mountedSso.admin.connection.update,
-		deleteConnection: mountedSso.admin.connection.delete,
-		getConnectionStatus: mountedSso.admin.connection.status,
-		listDomains: mountedSso.admin.connection.domain.list,
-		validateDomains: mountedSso.admin.connection.domain.validate,
-		setDomains: mountedSso.admin.connection.domain.set,
-		requestDomainVerification: mountedSso.admin.connection.domain.verification.request,
-		confirmDomainVerification: mountedSso.admin.connection.domain.verification.confirm,
-		configureOidc: mountedSso.admin.oidc.configure,
-		getOidc: mountedSso.admin.oidc.get,
-		validateOidc: mountedSso.admin.oidc.validate,
-		configureSaml: mountedSso.admin.saml.configure,
-		validateSaml: mountedSso.admin.saml.validate,
-		getPolicy: mountedSso.admin.policy.get,
-		updatePolicy: mountedSso.admin.policy.update,
-		validatePolicy: mountedSso.admin.policy.validate,
-		listAudit: mountedSso.admin.audit.list,
-		createWebhookEndpoint: mountedSso.admin.webhook.endpoint.create,
-		listWebhookEndpoints: mountedSso.admin.webhook.endpoint.list,
-		listWebhookDeliveries: mountedSso.admin.webhook.delivery.list,
-		disableWebhookEndpoint: mountedSso.admin.webhook.endpoint.disable,
-		configureScim: mountedScim.admin.configure,
-		getScim: mountedScim.admin.get,
-		validateScim: mountedScim.admin.validate,
-		signIn: mountedSso.client.signIn,
-		metadata: mountedSso.client.metadata
-	};
-}
-const TOKEN_COOKIE_BASE_NAME = "__convexAuthJWT";
-const REFRESH_COOKIE_BASE_NAME = "__convexAuthRefreshToken";
-const VERIFIER_COOKIE_BASE_NAME = "__convexAuthOAuthVerifier";
-const DERIVED_COOKIE_NAMESPACE_FALLBACK = "convexauth";
-/**
-* Derive the cookie names used for auth tokens.
-*
-* On localhost the names are unprefixed; on production hosts they
-* use the `__Host-` prefix for tighter security.
-*
-* @param host - The `Host` header value. Omit to use unprefixed names.
-* @param cookieNamespace - Optional namespace suffix for cookie isolation.
-* @returns An object with `token`, `refreshToken`, and `verifier` cookie names.
-*/
-function authCookieNames(host, cookieNamespace) {
-	const prefix = isLocalHost(host) ? "" : "__Host-";
-	const namespace = normalizeCookieNamespace(cookieNamespace);
-	const suffix = namespace === null ? "" : `_${namespace}`;
-	return {
-		token: `${prefix}${TOKEN_COOKIE_BASE_NAME}${suffix}`,
-		refreshToken: `${prefix}${REFRESH_COOKIE_BASE_NAME}${suffix}`,
-		verifier: `${prefix}${VERIFIER_COOKIE_BASE_NAME}${suffix}`
-	};
-}
-/**
-* Parse auth cookie values from a raw `Cookie` header string.
-*
-* @param cookieHeader - The raw `Cookie` header, or `null`/`undefined`.
-* @param host - The `Host` header, used to determine cookie name prefixes.
-* @param cookieNamespace - Optional namespace suffix for cookie isolation.
-* @returns Parsed {@link AuthCookies} with `token`, `refreshToken`, and `verifier`.
-*/
-function parseAuthCookies(cookieHeader, host, cookieNamespace) {
-	const names = authCookieNames(host, cookieNamespace);
-	const legacyNames = authCookieNames(host);
-	const parsed = parse(cookieHeader ?? "");
-	return {
-		token: parsed[names.token] ?? (legacyNames.token !== names.token ? parsed[legacyNames.token] ?? null : null),
-		refreshToken: parsed[names.refreshToken] ?? (legacyNames.refreshToken !== names.refreshToken ? parsed[legacyNames.refreshToken] ?? null : null),
-		verifier: parsed[names.verifier] ?? (legacyNames.verifier !== names.verifier ? parsed[legacyNames.verifier] ?? null : null)
-	};
-}
-/**
-* Serialize auth cookies into `Set-Cookie` header strings.
-*
-* Nulled-out values produce deletion cookies (maxAge 0, expired date).
-*
-* @param cookies - The auth cookie values to serialize.
-* @param host - The `Host` header, used for cookie name prefixes and `Secure` flag.
-* @param config - Cookie lifetime config. Defaults to session cookies.
-* @param cookieNamespace - Optional namespace suffix for cookie isolation.
-* @returns An array of three `Set-Cookie` header strings.
-*/
-function serializeAuthCookies(cookies, host, config = { maxAge: null }, cookieNamespace) {
-	const names = authCookieNames(host, cookieNamespace);
-	const legacyNames = authCookieNames(host);
-	const base = {
-		path: "/",
-		httpOnly: true,
-		sameSite: "lax",
-		secure: !isLocalHost(host)
-	};
-	const maxAge = config.maxAge ?? void 0;
-	const serialized = [
-		serialize(names.token, cookies.token ?? "", {
-			...base,
-			maxAge: cookies.token === null ? 0 : maxAge,
-			expires: cookies.token === null ? /* @__PURE__ */ new Date(0) : void 0
-		}),
-		serialize(names.refreshToken, cookies.refreshToken ?? "", {
-			...base,
-			maxAge: cookies.refreshToken === null ? 0 : maxAge,
-			expires: cookies.refreshToken === null ? /* @__PURE__ */ new Date(0) : void 0
-		}),
-		serialize(names.verifier, cookies.verifier ?? "", {
-			...base,
-			maxAge: cookies.verifier === null ? 0 : maxAge,
-			expires: cookies.verifier === null ? /* @__PURE__ */ new Date(0) : void 0
-		})
-	];
-	if (legacyNames.token !== names.token) serialized.push(serialize(legacyNames.token, "", {
-		...base,
-		maxAge: 0,
-		expires: /* @__PURE__ */ new Date(0)
-	}), serialize(legacyNames.refreshToken, "", {
-		...base,
-		maxAge: 0,
-		expires: /* @__PURE__ */ new Date(0)
-	}), serialize(legacyNames.verifier, "", {
-		...base,
-		maxAge: 0,
-		expires: /* @__PURE__ */ new Date(0)
-	}));
-	return serialized;
-}
-/**
-* Build structured cookie objects for any SSR framework.
-*
-* Use with SvelteKit's `event.cookies.set()`, TanStack Start's `setCookie()`,
-* Next.js's `cookies().set()`, or any other framework cookie API.
-*/
-function structuredAuthCookies(cookies, host, config = { maxAge: null }, cookieNamespace) {
-	const names = authCookieNames(host, cookieNamespace);
-	const legacyNames = authCookieNames(host);
-	const base = {
-		path: "/",
-		httpOnly: true,
-		secure: !isLocalHost(host),
-		sameSite: "lax"
-	};
-	const maxAge = config.maxAge ?? void 0;
-	const structured = [
-		{
-			name: names.token,
-			value: cookies.token ?? "",
-			options: {
-				...base,
-				maxAge: cookies.token === null ? 0 : maxAge,
-				expires: cookies.token === null ? /* @__PURE__ */ new Date(0) : void 0
-			}
-		},
-		{
-			name: names.refreshToken,
-			value: cookies.refreshToken ?? "",
-			options: {
-				...base,
-				maxAge: cookies.refreshToken === null ? 0 : maxAge,
-				expires: cookies.refreshToken === null ? /* @__PURE__ */ new Date(0) : void 0
-			}
-		},
-		{
-			name: names.verifier,
-			value: cookies.verifier ?? "",
-			options: {
-				...base,
-				maxAge: cookies.verifier === null ? 0 : maxAge,
-				expires: cookies.verifier === null ? /* @__PURE__ */ new Date(0) : void 0
-			}
-		}
-	];
-	if (legacyNames.token !== names.token) structured.push({
-		name: legacyNames.token,
-		value: "",
-		options: {
-			...base,
-			maxAge: 0,
-			expires: /* @__PURE__ */ new Date(0)
-		}
-	}, {
-		name: legacyNames.refreshToken,
-		value: "",
-		options: {
-			...base,
-			maxAge: 0,
-			expires: /* @__PURE__ */ new Date(0)
-		}
-	}, {
-		name: legacyNames.verifier,
-		value: "",
-		options: {
-			...base,
-			maxAge: 0,
-			expires: /* @__PURE__ */ new Date(0)
-		}
-	});
-	return structured;
-}
-/**
-* Check whether a request pathname matches the auth proxy route.
-*
-* Handles trailing-slash ambiguity: both `/api/auth` and `/api/auth/`
-* match regardless of how `apiRoute` is configured.
-*
-* @param pathname - The request URL pathname.
-* @param apiRoute - The configured proxy route (e.g. `"/api/auth"`).
-* @returns `true` when the pathname matches the proxy route.
-*/
-function shouldProxyAuthAction(pathname, apiRoute) {
-	if (apiRoute.endsWith("/")) return pathname === apiRoute || pathname === apiRoute.slice(0, -1);
-	return pathname === apiRoute || pathname === `${apiRoute}/`;
-}
-const REQUIRED_TOKEN_LIFETIME_MS = 6e4;
-const MINIMUM_REQUIRED_TOKEN_LIFETIME_MS = 1e4;
-function normalizeCookieNamespace(cookieNamespace) {
-	if (cookieNamespace === void 0 || cookieNamespace === null) return null;
-	const normalized = cookieNamespace.trim().replace(/[^a-zA-Z0-9]+/g, "_").replace(/^_+|_+$/g, "").toLowerCase();
-	return normalized.length > 0 ? normalized : null;
-}
-/**
-* Safely check if a string is a valid URL without throwing.
-*/
-function canParseUrl(value) {
-	try {
-		new URL(value);
-		return true;
-	} catch {
-		return false;
-	}
-}
-function serializeAuthCookie(cookie) {
-	const parts = [`${cookie.name}=${cookie.value}`, `Path=${cookie.options.path}`];
-	if (cookie.options.httpOnly) parts.push("HttpOnly");
-	if (cookie.options.secure) parts.push("Secure");
-	if (cookie.options.sameSite) parts.push(`SameSite=${cookie.options.sameSite}`);
-	if (cookie.options.maxAge !== void 0) parts.push(`Max-Age=${cookie.options.maxAge}`);
-	if (cookie.options.expires) parts.push(`Expires=${cookie.options.expires.toUTCString()}`);
-	return parts.join("; ");
-}
-function buildRedirectResponse(location, cookies) {
-	const headers = new Headers({ Location: location });
-	for (const cookie of cookies) headers.append("Set-Cookie", serializeAuthCookie(cookie));
-	return new Response(null, {
-		status: 302,
-		headers
-	});
-}
-function deriveCookieNamespaceFromUrl(url) {
-	if (!canParseUrl(url)) return DERIVED_COOKIE_NAMESPACE_FALLBACK;
-	const parsed = new URL(url);
-	return normalizeCookieNamespace(`${parsed.hostname}${parsed.pathname}`) ?? DERIVED_COOKIE_NAMESPACE_FALLBACK;
-}
-function normalizeIssuer(value) {
-	if (!canParseUrl(value)) return value.replace(/\/+$/, "");
-	const parsed = new URL(value);
-	const pathname = parsed.pathname === "/" ? "" : parsed.pathname.replace(/\/+$/, "");
-	return `${parsed.protocol}//${parsed.host}${pathname}`;
-}
-function convexSiteIssuerFromCloudUrl(value) {
-	if (!canParseUrl(value)) return null;
-	const parsed = new URL(value);
-	if (!parsed.hostname.endsWith(".convex.cloud")) return null;
-	parsed.hostname = parsed.hostname.slice(0, -13) + ".convex.site";
-	return normalizeIssuer(parsed.toString());
-}
-function defaultAcceptedIssuersForUrl(value) {
-	const issuers = [normalizeIssuer(value)];
-	const siteIssuer = convexSiteIssuerFromCloudUrl(value);
-	if (siteIssuer !== null) issuers.push(siteIssuer);
-	return issuers;
-}
-/**
-* Create an SSR auth helper for server-side frameworks.
-*
-* Handles cookie-based token management, OAuth code exchange,
-* and automatic JWT refresh on page loads. Works with any
-* framework that gives you a `Request` object — SvelteKit,
-* TanStack Start, Remix, Next.js, etc.
-*
-* @param options - SSR configuration (Convex API URL, issuer rules, proxy route, cookie lifetime).
-* @returns An object with `token`, `verify`, `proxy`, and `refresh` methods.
-*
-* @example SvelteKit hooks
-* ```ts
-* // src/hooks.server.ts
-* import { server } from '@robelest/convex-auth/server';
-*
-* const auth = server({ url: CONVEX_URL });
-*
-* export const handle = async ({ event, resolve }) => {
-*   const { cookies, token } = await auth.refresh(event.request);
-*   for (const c of cookies) event.cookies.set(c.name, c.value, c.options);
-*   event.locals.token = token;
-*   return resolve(event);
-* };
-* ```
-*
-* @example Generic proxy endpoint
-* ```ts
-* if (shouldProxyAuthAction(url.pathname, '/api/auth')) {
-*   return auth.proxy(request);
-* }
-* ```
-*/
-function server(options) {
-	const convexUrl = options.url;
-	const apiRoute = options.apiRoute ?? "/api/auth";
-	const cookieConfig = { maxAge: options.cookieMaxAge ?? null };
-	const verbose = options.verbose ?? false;
-	const cookieNamespace = normalizeCookieNamespace(options.cookieNamespace) ?? deriveCookieNamespaceFromUrl(convexUrl);
-	const acceptedIssuers = new Set((options.acceptedIssuers ?? defaultAcceptedIssuersForUrl(convexUrl)).map(normalizeIssuer).filter((issuer) => issuer.length > 0));
-	return {
-		token(request) {
-			return parseAuthCookies(request.headers.get("cookie"), request.headers.get("host") ?? new URL(request.url).host, cookieNamespace).token;
-		},
-		async verify(request) {
-			const token = parseAuthCookies(request.headers.get("cookie"), request.headers.get("host") ?? new URL(request.url).host, cookieNamespace).token;
-			if (token === null) return false;
-			const decodedToken = await Fx.run(Fx.attempt(async () => jwtDecode(token), (decoded) => decoded, () => null));
-			if (decodedToken?.exp === void 0 || decodedToken.iss === void 0) return false;
-			if (!acceptedIssuers.has(normalizeIssuer(decodedToken.iss))) return false;
-			return decodedToken.exp * 1e3 > Date.now();
-		},
-		async proxy(request) {
-			const requestDispatch = !shouldProxyAuthAction(new URL(request.url).pathname, apiRoute) ? { kind: "invalidRoute" } : request.method !== "POST" ? { kind: "invalidMethod" } : (() => {
-				const originHeader = request.headers.get("origin");
-				if (originHeader === null) return false;
-				const forwardedProtoHeader = request.headers.get("x-forwarded-proto");
-				const protocol = forwardedProtoHeader !== null ? (() => {
-					const forwardedProto = forwardedProtoHeader.split(",")[0]?.trim();
-					if (forwardedProto !== void 0 && forwardedProto.length > 0) return forwardedProto.endsWith(":") ? forwardedProto : `${forwardedProto}:`;
-					return new URL(request.url).protocol;
-				})() : new URL(request.url).protocol;
-				const requestHost = request.headers.get("host") ?? new URL(request.url).host;
-				const hostCandidate = `${protocol}//${requestHost}`;
-				const host$1 = canParseUrl(hostCandidate) ? new URL(hostCandidate).host : requestHost;
-				if (!canParseUrl(originHeader)) return true;
-				const originUrl = new URL(originHeader);
-				return originUrl.host !== host$1 || originUrl.protocol !== protocol;
-			})() ? { kind: "invalidOrigin" } : { kind: "valid" };
-			const validationErrorResponse = await Fx.run(Fx.match(requestDispatch, requestDispatch.kind, {
-				invalidRoute: () => new Response("Invalid route", { status: 404 }),
-				invalidMethod: () => new Response("Invalid method", { status: 405 }),
-				invalidOrigin: () => new Response("Invalid origin", { status: 403 }),
-				valid: () => null
-			}));
-			if (validationErrorResponse !== null) return validationErrorResponse;
-			const body = await Fx.run(Fx.attempt(async () => {
-				const parsed = await request.json();
-				if (typeof parsed !== "object" || parsed === null) return null;
-				return parsed;
-			}, (parsed) => parsed, () => null));
-			if (body === null) return new Response("Invalid request body", { status: 400 });
-			const action = body.action;
-			const args = typeof body.args === "object" && body.args !== null ? body.args : {};
-			const actionDispatch = action === "auth:signIn" ? { action: "sessionStart" } : action === "auth:signOut" ? { action: "sessionStop" } : null;
-			if (actionDispatch === null) return new Response("Invalid action", { status: 400 });
-			const host = request.headers.get("host") ?? new URL(request.url).host;
-			const currentCookies = parseAuthCookies(request.headers.get("cookie"), host, cookieNamespace);
-			return Fx.run(Fx.match(actionDispatch, actionDispatch.action, {
-				sessionStart: (_) => Fx.from({
-					ok: async () => {
-						const refreshDispatch = args.refreshToken === void 0 ? { kind: "passthrough" } : currentCookies.refreshToken === null ? { kind: "refreshRequestedWithoutCookie" } : {
-							kind: "hydrateRefreshFromCookie",
-							refreshToken: currentCookies.refreshToken
-						};
-						const refreshResponse = await Fx.run(Fx.match(refreshDispatch, refreshDispatch.kind, {
-							passthrough: async () => null,
-							hydrateRefreshFromCookie: async ({ refreshToken }) => {
-								args.refreshToken = refreshToken;
-								return null;
-							},
-							refreshRequestedWithoutCookie: async () => {
-								const currentToken = currentCookies.token;
-								const decodedToken = currentToken === null ? null : await Fx.run(Fx.attempt(async () => jwtDecode(currentToken), (decoded) => decoded, () => null));
-								const tokenDispatch = currentToken !== null && decodedToken?.exp !== void 0 && decodedToken.iss !== void 0 && acceptedIssuers.has(normalizeIssuer(decodedToken.iss)) && decodedToken.exp * 1e3 > Date.now() ? {
-									kind: "validToken",
-									token: currentToken
-								} : { kind: "missingToken" };
-								return await Fx.run(Fx.match(tokenDispatch, tokenDispatch.kind, {
-									validToken: ({ token }) => new Response(JSON.stringify({ tokens: {
-										token,
-										refreshToken: "dummy"
-									} }), {
-										status: 200,
-										headers: { "Content-Type": "application/json" }
-									}),
-									missingToken: () => new Response(JSON.stringify({ tokens: null }), {
-										status: 200,
-										headers: { "Content-Type": "application/json" }
-									})
-								}));
-							}
-						}));
-						const refreshDecision = refreshResponse !== null ? {
-							kind: "shortCircuit",
-							response: refreshResponse
-						} : { kind: "continue" };
-						const maybeShortCircuitResponse = await Fx.run(Fx.match(refreshDecision, refreshDecision.kind, {
-							shortCircuit: ({ response }) => response,
-							continue: () => null
-						}));
-						if (maybeShortCircuitResponse !== null) return maybeShortCircuitResponse;
-						const client = new ConvexHttpClient(convexUrl);
-						const authDispatch = args.refreshToken === void 0 && args.params?.code === void 0 && currentCookies.token !== null ? {
-							kind: "attachAuth",
-							token: currentCookies.token
-						} : { kind: "skipAuth" };
-						await Fx.run(Fx.match(authDispatch, authDispatch.kind, {
-							attachAuth: ({ token }) => {
-								client.setAuth(token);
-							},
-							skipAuth: () => void 0
-						}));
-						return Fx.run(Fx.from({
-							ok: () => client.action(signInActionRef, args),
-							err: (error) => error
-						}).pipe(Fx.fold({
-							ok: (result) => Fx.run(Fx.match(result, result.kind, {
-								redirect: (redirectResult) => {
-									const response = new Response(JSON.stringify({
-										kind: "redirect",
-										redirect: redirectResult.redirect,
-										verifier: redirectResult.verifier
-									}), {
-										status: 200,
-										headers: { "Content-Type": "application/json" }
-									});
-									for (const value of serializeAuthCookies({
-										...currentCookies,
-										verifier: redirectResult.verifier
-									}, host, cookieConfig, cookieNamespace)) response.headers.append("Set-Cookie", value);
-									return Fx.succeed(response);
-								},
-								signedIn: (signedInResult) => {
-									const response = new Response(JSON.stringify({
-										kind: "signedIn",
-										tokens: signedInResult.tokens === null ? null : {
-											token: signedInResult.tokens.token,
-											refreshToken: "dummy"
-										}
-									}), {
-										status: 200,
-										headers: { "Content-Type": "application/json" }
-									});
-									for (const value of serializeAuthCookies({
-										token: signedInResult.tokens?.token ?? null,
-										refreshToken: signedInResult.tokens?.refreshToken ?? null,
-										verifier: null
-									}, host, cookieConfig, cookieNamespace)) response.headers.append("Set-Cookie", value);
-									return Fx.succeed(response);
-								},
-								started: (startedResult) => Fx.succeed(new Response(JSON.stringify(startedResult), {
-									status: 200,
-									headers: { "Content-Type": "application/json" }
-								})),
-								passkeyOptions: (passkeyOptionsResult) => Fx.succeed(new Response(JSON.stringify(passkeyOptionsResult), {
-									status: 200,
-									headers: { "Content-Type": "application/json" }
-								})),
-								totpRequired: (totpRequiredResult) => Fx.succeed(new Response(JSON.stringify(totpRequiredResult), {
-									status: 200,
-									headers: { "Content-Type": "application/json" }
-								})),
-								totpSetup: (totpSetupResult) => Fx.succeed(new Response(JSON.stringify(totpSetupResult), {
-									status: 200,
-									headers: { "Content-Type": "application/json" }
-								})),
-								deviceCode: (deviceCodeResult) => Fx.succeed(new Response(JSON.stringify(deviceCodeResult), {
-									status: 200,
-									headers: { "Content-Type": "application/json" }
-								}))
-							})),
-							err: (error) => {
-								const errorBody = error instanceof ConvexError && typeof error.data === "object" && error.data !== null && "code" in error.data ? {
-									error: error.data.message ?? String(error),
-									authError: error.data
-								} : { error: error instanceof Error ? error.message : String(error) };
-								const response = new Response(JSON.stringify(errorBody), {
-									status: 400,
-									headers: { "Content-Type": "application/json" }
-								});
-								const clearSession = args.refreshToken !== void 0 && error instanceof ConvexError && typeof error.data === "object" && error.data !== null && error.data.code === "INVALID_REFRESH_TOKEN";
-								for (const value of serializeAuthCookies({
-									token: clearSession ? null : currentCookies.token,
-									refreshToken: clearSession ? null : currentCookies.refreshToken,
-									verifier: null
-								}, host, cookieConfig, cookieNamespace)) response.headers.append("Set-Cookie", value);
-								return response;
-							}
-						})));
-					},
-					err: (e) => e
-				}),
-				sessionStop: (_) => Fx.from({
-					ok: async () => {
-						await Fx.run(Fx.from({
-							ok: () => (() => {
-								const client = new ConvexHttpClient(convexUrl);
-								if (currentCookies.token !== null) client.setAuth(currentCookies.token);
-								return client.action(signOutActionRef);
-							})(),
-							err: (error) => error
-						}).pipe(Fx.recover((error) => {
-							console.error("[convex-auth/server] proxy sign-out failed", error);
-							const fallbackDispatch = currentCookies.refreshToken !== null ? {
-								kind: "attemptFallback",
-								refreshToken: currentCookies.refreshToken
-							} : { kind: "skipFallback" };
-							return Fx.match(fallbackDispatch, fallbackDispatch.kind, {
-								attemptFallback: ({ refreshToken }) => Fx.from({
-									ok: async () => {
-										const refreshed = await new ConvexHttpClient(convexUrl).action(signInActionRef, { refreshToken });
-										const refreshedTokens = await Fx.run(Fx.match(refreshed, refreshed.kind, {
-											signedIn: (signedInResult) => Fx.succeed(signedInResult.tokens),
-											redirect: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for sign-out fallback refresh")),
-											started: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for sign-out fallback refresh")),
-											passkeyOptions: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for sign-out fallback refresh")),
-											totpRequired: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for sign-out fallback refresh")),
-											totpSetup: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for sign-out fallback refresh")),
-											deviceCode: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for sign-out fallback refresh"))
-										}));
-										const fallbackSignOutDispatch = refreshedTokens !== null ? {
-											kind: "signOutWithRefreshed",
-											token: refreshedTokens.token
-										} : { kind: "skipRefreshedSignOut" };
-										await Fx.match(fallbackSignOutDispatch, fallbackSignOutDispatch.kind, {
-											signOutWithRefreshed: async ({ token }) => {
-												const client = new ConvexHttpClient(convexUrl);
-												client.setAuth(token);
-												await client.action(signOutActionRef);
-											},
-											skipRefreshedSignOut: async () => void 0
-										});
-									},
-									err: (fallbackError) => fallbackError
-								}).pipe(Fx.recover((fallbackError) => {
-									console.error("[convex-auth/server] proxy sign-out fallback failed", fallbackError);
-									return Fx.succeed(void 0);
-								})),
-								skipFallback: () => Fx.succeed(void 0)
-							});
-						}), Fx.map(() => void 0)));
-						const response = new Response(JSON.stringify(null), {
-							status: 200,
-							headers: { "Content-Type": "application/json" }
-						});
-						for (const value of serializeAuthCookies({
-							token: null,
-							refreshToken: null,
-							verifier: null
-						}, host, cookieConfig, cookieNamespace)) response.headers.append("Set-Cookie", value);
-						return response;
-					},
-					err: (e) => e
-				})
-			}));
-		},
-		async refresh(request) {
-			const host = request.headers.get("host") ?? new URL(request.url).host;
-			const currentCookies = parseAuthCookies(request.headers.get("cookie"), host, cookieNamespace);
-			const currentToken = currentCookies.token;
-			const originHeader = request.headers.get("origin");
-			const forwardedProtoHeader = request.headers.get("x-forwarded-proto");
-			const protocol = forwardedProtoHeader !== null ? (() => {
-				const forwardedProto = forwardedProtoHeader.split(",")[0]?.trim();
-				if (forwardedProto !== void 0 && forwardedProto.length > 0) return forwardedProto.endsWith(":") ? forwardedProto : `${forwardedProto}:`;
-				return new URL(request.url).protocol;
-			})() : new URL(request.url).protocol;
-			const requestHost = request.headers.get("host") ?? new URL(request.url).host;
-			const hostCandidate = `${protocol}//${requestHost}`;
-			const normalizedHost = canParseUrl(hostCandidate) ? new URL(hostCandidate).host : requestHost;
-			const originUrl = originHeader !== null && canParseUrl(originHeader) ? new URL(originHeader) : null;
-			const corsDispatch = originHeader !== null && (originUrl === null || originUrl.host !== normalizedHost || originUrl.protocol !== protocol) ? { kind: "crossOrigin" } : { kind: "sameOrigin" };
-			const corsRefreshResult = await Fx.run(Fx.match(corsDispatch, corsDispatch.kind, {
-				crossOrigin: () => ({
-					redirect: false,
-					cookies: [],
-					token: null
-				}),
-				sameOrigin: () => null
-			}));
-			if (corsRefreshResult !== null) return corsRefreshResult;
-			const requestUrl = new URL(request.url);
-			const code = requestUrl.searchParams.get("code");
-			const shouldHandleCode = options.shouldHandleCode === void 0 ? true : typeof options.shouldHandleCode === "function" ? await options.shouldHandleCode(request) : options.shouldHandleCode;
-			const codeExchangeDispatch = code !== null && request.method === "GET" && request.headers.get("accept")?.includes("text/html") && shouldHandleCode ? {
-				kind: "exchange",
-				code
-			} : { kind: "skip" };
-			const codeExchangeResult = await Fx.run(Fx.match(codeExchangeDispatch, codeExchangeDispatch.kind, {
-				exchange: async ({ code: verificationCode }) => {
-					const redirectUrl = new URL(requestUrl.toString());
-					return Fx.run(Fx.from({
-						ok: async () => {
-							const result = await new ConvexHttpClient(convexUrl).action(signInActionRef, {
-								params: { code: verificationCode },
-								verifier: currentCookies.verifier ?? void 0
-							});
-							return {
-								kind: "signedIn",
-								tokens: await Fx.run(Fx.match(result, result.kind, {
-									signedIn: (signedInResult) => Fx.succeed(signedInResult.tokens),
-									redirect: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for code exchange")),
-									started: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for code exchange")),
-									passkeyOptions: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for code exchange")),
-									totpRequired: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for code exchange")),
-									totpSetup: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for code exchange")),
-									deviceCode: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for code exchange"))
-								}))
-							};
-						},
-						err: (error) => error
-					}).pipe(Fx.fold({
-						ok: (result) => {
-							redirectUrl.searchParams.delete("code");
-							const cookies = structuredAuthCookies({
-								token: result.tokens?.token ?? null,
-								refreshToken: result.tokens?.refreshToken ?? null,
-								verifier: null
-							}, host, cookieConfig, cookieNamespace);
-							return {
-								redirect: true,
-								response: buildRedirectResponse(redirectUrl.toString(), cookies)
-							};
-						},
-						err: (error) => {
-							console.error("[convex-auth/server] code exchange failed", error);
-							const errorCode = error instanceof ConvexError && typeof error.data === "object" && error.data !== null && typeof error.data.code === "string" ? error.data.code : null;
-							if (!(errorCode === "OAUTH_INVALID_STATE" || errorCode === "OAUTH_PROVIDER_ERROR" || errorCode === "OAUTH_MISSING_ID_TOKEN" || errorCode === "OAUTH_INVALID_PROFILE" || errorCode === "OAUTH_MISSING_VERIFIER" || errorCode === "INVALID_VERIFIER" || errorCode === "INVALID_VERIFICATION_CODE")) return {
-								redirect: false,
-								cookies: [],
-								token: currentCookies.token
-							};
-							redirectUrl.searchParams.delete("code");
-							const cookies = structuredAuthCookies({
-								token: currentCookies.token,
-								refreshToken: currentCookies.refreshToken,
-								verifier: null
-							}, host, cookieConfig, cookieNamespace);
-							return {
-								redirect: true,
-								response: buildRedirectResponse(redirectUrl.toString(), cookies)
-							};
-						}
-					})));
-				},
-				skip: async () => null
-			}));
-			const codeExchangeDecision = codeExchangeResult !== null ? {
-				kind: "done",
-				result: codeExchangeResult
-			} : { kind: "continue" };
-			const maybeCodeExchangeResult = await Fx.run(Fx.match(codeExchangeDecision, codeExchangeDecision.kind, {
-				done: ({ result }) => result,
-				continue: () => null
-			}));
-			if (maybeCodeExchangeResult !== null) return maybeCodeExchangeResult;
-			const tokens = await Fx.run(Fx.gen(function* () {
-				const { token, refreshToken } = currentCookies;
-				const malformedRefreshTokenDispatch = refreshToken !== null && (refreshToken.trim().length === 0 || refreshToken === "dummy") ? { kind: "malformed" } : { kind: "ok" };
-				const malformedRefreshTokenResult = yield* Fx.match(malformedRefreshTokenDispatch, malformedRefreshTokenDispatch.kind, {
-					malformed: () => {
-						if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refresh token cookie malformed, clearing auth cookies`);
-						return null;
-					},
-					ok: () => void 0
-				});
-				if (malformedRefreshTokenResult !== void 0) return malformedRefreshTokenResult;
-				const decodedToken = token === null ? null : yield* Fx.attempt(async () => jwtDecode(token), (decoded) => decoded, () => null);
-				const issuerDispatch = decodedToken?.iss !== void 0 && !acceptedIssuers.has(normalizeIssuer(decodedToken.iss)) ? { kind: "issuerMismatch" } : { kind: "issuerOk" };
-				const issuerResult = yield* Fx.match(issuerDispatch, issuerDispatch.kind, {
-					issuerMismatch: () => {
-						if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Access token issuer mismatch, clearing auth cookies`);
-						return null;
-					},
-					issuerOk: () => void 0
-				});
-				if (issuerResult !== void 0) return issuerResult;
-				const tokenState = token === null ? refreshToken === null ? { kind: "none" } : {
-					kind: "refreshOnly",
-					refreshToken
-				} : refreshToken === null ? {
-					kind: "accessOnly",
-					token
-				} : {
-					kind: "both",
-					token,
-					refreshToken
-				};
-				return yield* Fx.match(tokenState, tokenState.kind, {
-					none: () => {
-						if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] No auth cookies found, skipping refresh`);
-						return Fx.succeed(void 0);
-					},
-					refreshOnly: ({ refreshToken: refreshTokenValue }) => {
-						if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Access token cookie missing, attempting refresh-token recovery`);
-						return Fx.from({
-							ok: async () => {
-								const result = await new ConvexHttpClient(convexUrl).action(signInActionRef, { refreshToken: refreshTokenValue });
-								const tokens$1 = await Fx.run(Fx.match(result, result.kind, {
-									signedIn: (signedInResult) => Fx.succeed(signedInResult.tokens),
-									redirect: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-									started: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-									passkeyOptions: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-									totpRequired: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-									totpSetup: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-									deviceCode: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh"))
-								}));
-								if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refreshed tokens, null=${tokens$1 === null}`);
-								return tokens$1;
-							},
-							err: (error) => error
-						}).pipe(Fx.recover((error) => {
-							console.error("[convex-auth/server] refresh-token exchange failed", error);
-							if ((error instanceof ConvexError && typeof error.data === "object" && error.data !== null && typeof error.data.code === "string" ? error.data.code : null) === "INVALID_REFRESH_TOKEN") {
-								if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refresh token rejected, clearing auth cookies`);
-								return Fx.succeed(null);
-							}
-							if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Token refresh failed transiently, keeping current cookies`);
-							return Fx.succeed(void 0);
-						}));
-					},
-					accessOnly: () => {
-						const accessOnlyDispatch = decodedToken?.exp !== void 0 && decodedToken.iss !== void 0 && acceptedIssuers.has(normalizeIssuer(decodedToken.iss)) && decodedToken.exp * 1e3 > Date.now() ? { kind: "accessValid" } : { kind: "accessInvalid" };
-						return Fx.match(accessOnlyDispatch, accessOnlyDispatch.kind, {
-							accessValid: () => {
-								if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refresh token cookie missing but access token still valid`);
-								return Fx.succeed(void 0);
-							},
-							accessInvalid: () => {
-								if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refresh token cookie missing and access token invalid, clearing`);
-								return Fx.succeed(null);
-							}
-						});
-					},
-					both: ({ refreshToken: refreshTokenValue }) => {
-						const bothDecodeDispatch = decodedToken?.exp === void 0 || decodedToken.iat === void 0 ? { kind: "undecodable" } : {
-							kind: "decoded",
-							decodedToken
-						};
-						return Fx.match(bothDecodeDispatch, bothDecodeDispatch.kind, {
-							undecodable: () => {
-								if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Failed to decode access token, attempting refresh-token recovery`);
-								return Fx.from({
-									ok: async () => {
-										const result = await new ConvexHttpClient(convexUrl).action(signInActionRef, { refreshToken: refreshTokenValue });
-										const tokens$1 = await Fx.run(Fx.match(result, result.kind, {
-											signedIn: (signedInResult) => Fx.succeed(signedInResult.tokens),
-											redirect: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-											started: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-											passkeyOptions: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-											totpRequired: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-											totpSetup: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-											deviceCode: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh"))
-										}));
-										if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refreshed tokens, null=${tokens$1 === null}`);
-										return tokens$1;
-									},
-									err: (error) => error
-								}).pipe(Fx.recover((error) => {
-									console.error("[convex-auth/server] refresh-token exchange failed", error);
-									if ((error instanceof ConvexError && typeof error.data === "object" && error.data !== null && typeof error.data.code === "string" ? error.data.code : null) === "INVALID_REFRESH_TOKEN") {
-										if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refresh token rejected, clearing auth cookies`);
-										return Fx.succeed(null);
-									}
-									if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Token refresh failed transiently, keeping current cookies`);
-									return Fx.succeed(void 0);
-								}));
-							},
-							decoded: ({ decodedToken: decodedAccessToken }) => {
-								const totalTokenLifetimeMs = decodedAccessToken.exp * 1e3 - decodedAccessToken.iat * 1e3;
-								const minimumExpiration = Date.now() + Math.min(REQUIRED_TOKEN_LIFETIME_MS, Math.max(MINIMUM_REQUIRED_TOKEN_LIFETIME_MS, totalTokenLifetimeMs / 10));
-								const expirationDispatch = decodedAccessToken.exp * 1e3 > minimumExpiration ? { kind: "skipRefresh" } : { kind: "refresh" };
-								return Fx.match(expirationDispatch, expirationDispatch.kind, {
-									skipRefresh: () => {
-										if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Token valid long enough, skipping refresh`);
-										return Fx.succeed(void 0);
-									},
-									refresh: () => Fx.from({
-										ok: async () => {
-											const result = await new ConvexHttpClient(convexUrl).action(signInActionRef, { refreshToken: refreshTokenValue });
-											const tokens$1 = await Fx.run(Fx.match(result, result.kind, {
-												signedIn: (signedInResult) => Fx.succeed(signedInResult.tokens),
-												redirect: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-												started: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-												passkeyOptions: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-												totpRequired: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-												totpSetup: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-												deviceCode: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh"))
-											}));
-											if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refreshed tokens, null=${tokens$1 === null}`);
-											return tokens$1;
-										},
-										err: (error) => error
-									}).pipe(Fx.recover((error) => {
-										console.error("[convex-auth/server] refresh-token exchange failed", error);
-										if ((error instanceof ConvexError && typeof error.data === "object" && error.data !== null && typeof error.data.code === "string" ? error.data.code : null) === "INVALID_REFRESH_TOKEN") {
-											if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refresh token rejected, clearing auth cookies`);
-											return Fx.succeed(null);
-										}
-										if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Token refresh failed transiently, keeping current cookies`);
-										return Fx.succeed(void 0);
-									}))
-								});
-							}
-						});
-					}
-				});
-			}));
-			if (tokens === void 0) return {
-				redirect: false,
-				cookies: [],
-				token: currentToken
-			};
-			return {
-				redirect: false,
-				cookies: structuredAuthCookies({
-					token: tokens?.token ?? null,
-					refreshToken: tokens?.refreshToken ?? null,
-					verifier: null
-				}, host, cookieConfig, cookieNamespace),
-				token: tokens?.token ?? null
-			};
-		}
-	};
-}
-
-//#endregion
-export { authCookieNames, enterprise, parseAuthCookies, scim, serializeAuthCookies, server, shouldProxyAuthAction, sso, structuredAuthCookies };
-//# sourceMappingURL=index.js.map
+export { AuthCtx, authCookieNames, createAuth, enterprise, parseAuthCookies, scim, serializeAuthCookies, server, shouldProxyAuthAction, sso, structuredAuthCookies };