@robelest/convex-auth 0.0.4-preview.25 → 0.0.4-preview.28

package/dist/server/ssr.js

@@ -1,777 +0,0 @@
-import { isLocalHost } from "./utils.js";
-import { Fx } from "@robelest/fx";
-import { makeFunctionReference } from "convex/server";
-import { ConvexError } from "convex/values";
-import { parse, serialize } from "cookie";
-import { ConvexHttpClient } from "convex/browser";
-import { jwtDecode } from "jwt-decode";
-
-//#region src/server/ssr.ts
-const signInActionRef = makeFunctionReference("auth:signIn");
-const signOutActionRef = makeFunctionReference("auth:signOut");
-const TOKEN_COOKIE_BASE_NAME = "__convexAuthJWT";
-const REFRESH_COOKIE_BASE_NAME = "__convexAuthRefreshToken";
-const VERIFIER_COOKIE_BASE_NAME = "__convexAuthOAuthVerifier";
-const DERIVED_COOKIE_NAMESPACE_FALLBACK = "convexauth";
-/**
-* Derive the cookie names used for auth tokens.
-*
-* On localhost the names are unprefixed; on production hosts they
-* use the `__Host-` prefix for tighter security.
-*
-* @param host - The `Host` header value. Omit to use unprefixed names.
-* @param cookieNamespace - Optional namespace suffix for cookie isolation.
-* @returns An object with `token`, `refreshToken`, and `verifier` cookie names.
-*/
-function authCookieNames(host, cookieNamespace) {
-	const prefix = isLocalHost(host) ? "" : "__Host-";
-	const namespace = normalizeCookieNamespace(cookieNamespace);
-	const suffix = namespace === null ? "" : `_${namespace}`;
-	return {
-		token: `${prefix}${TOKEN_COOKIE_BASE_NAME}${suffix}`,
-		refreshToken: `${prefix}${REFRESH_COOKIE_BASE_NAME}${suffix}`,
-		verifier: `${prefix}${VERIFIER_COOKIE_BASE_NAME}${suffix}`
-	};
-}
-/**
-* Parse auth cookie values from a raw `Cookie` header string.
-*
-* @param cookieHeader - The raw `Cookie` header, or `null`/`undefined`.
-* @param host - The `Host` header, used to determine cookie name prefixes.
-* @param cookieNamespace - Optional namespace suffix for cookie isolation.
-* @returns Parsed {@link AuthCookies} with `token`, `refreshToken`, and `verifier`.
-*/
-function parseAuthCookies(cookieHeader, host, cookieNamespace) {
-	const names = authCookieNames(host, cookieNamespace);
-	const parsed = parse(cookieHeader ?? "");
-	return {
-		token: parsed[names.token] ?? null,
-		refreshToken: parsed[names.refreshToken] ?? null,
-		verifier: parsed[names.verifier] ?? null
-	};
-}
-/**
-* Serialize auth cookies into `Set-Cookie` header strings.
-*
-* Nulled-out values produce deletion cookies (maxAge 0, expired date).
-*
-* @param cookies - The auth cookie values to serialize.
-* @param host - The `Host` header, used for cookie name prefixes and `Secure` flag.
-* @param config - Cookie lifetime config. Defaults to session cookies.
-* @param cookieNamespace - Optional namespace suffix for cookie isolation.
-* @returns An array of three `Set-Cookie` header strings.
-*/
-function serializeAuthCookies(cookies, host, config = { maxAge: null }, cookieNamespace) {
-	const names = authCookieNames(host, cookieNamespace);
-	const base = {
-		path: "/",
-		httpOnly: true,
-		sameSite: "lax",
-		secure: !isLocalHost(host)
-	};
-	const maxAge = config.maxAge ?? void 0;
-	return [
-		serialize(names.token, cookies.token ?? "", {
-			...base,
-			maxAge: cookies.token === null ? 0 : maxAge,
-			expires: cookies.token === null ? /* @__PURE__ */ new Date(0) : void 0
-		}),
-		serialize(names.refreshToken, cookies.refreshToken ?? "", {
-			...base,
-			maxAge: cookies.refreshToken === null ? 0 : maxAge,
-			expires: cookies.refreshToken === null ? /* @__PURE__ */ new Date(0) : void 0
-		}),
-		serialize(names.verifier, cookies.verifier ?? "", {
-			...base,
-			maxAge: cookies.verifier === null ? 0 : maxAge,
-			expires: cookies.verifier === null ? /* @__PURE__ */ new Date(0) : void 0
-		})
-	];
-}
-/**
-* Build structured cookie objects for any SSR framework.
-*
-* Use with SvelteKit's `event.cookies.set()`, TanStack Start's `setCookie()`,
-* Next.js's `cookies().set()`, or any other framework cookie API.
-*
-* @param cookies - The auth cookie values to convert.
-* @param host - The `Host` header, used for cookie name prefixes and `Secure`.
-* @param config - Cookie lifetime config. Defaults to session cookies.
-* @param cookieNamespace - Optional namespace suffix for cookie isolation.
-* @returns Structured cookie descriptors ready for framework cookie APIs.
-*/
-function structuredAuthCookies(cookies, host, config = { maxAge: null }, cookieNamespace) {
-	const names = authCookieNames(host, cookieNamespace);
-	const base = {
-		path: "/",
-		httpOnly: true,
-		secure: !isLocalHost(host),
-		sameSite: "lax"
-	};
-	const maxAge = config.maxAge ?? void 0;
-	return [
-		{
-			name: names.token,
-			value: cookies.token ?? "",
-			options: {
-				...base,
-				maxAge: cookies.token === null ? 0 : maxAge,
-				expires: cookies.token === null ? /* @__PURE__ */ new Date(0) : void 0
-			}
-		},
-		{
-			name: names.refreshToken,
-			value: cookies.refreshToken ?? "",
-			options: {
-				...base,
-				maxAge: cookies.refreshToken === null ? 0 : maxAge,
-				expires: cookies.refreshToken === null ? /* @__PURE__ */ new Date(0) : void 0
-			}
-		},
-		{
-			name: names.verifier,
-			value: cookies.verifier ?? "",
-			options: {
-				...base,
-				maxAge: cookies.verifier === null ? 0 : maxAge,
-				expires: cookies.verifier === null ? /* @__PURE__ */ new Date(0) : void 0
-			}
-		}
-	];
-}
-/**
-* Check whether a request pathname matches the auth proxy route.
-*
-* Handles trailing-slash ambiguity: both `/api/auth` and `/api/auth/`
-* match regardless of how `apiRoute` is configured.
-*
-* @param pathname - The request URL pathname.
-* @param apiRoute - The configured proxy route (e.g. `"/api/auth"`).
-* @returns `true` when the pathname matches the proxy route.
-*
-* @see {@link server}
-*/
-function shouldProxyAuthAction(pathname, apiRoute) {
-	if (apiRoute.endsWith("/")) return pathname === apiRoute || pathname === apiRoute.slice(0, -1);
-	return pathname === apiRoute || pathname === `${apiRoute}/`;
-}
-const REQUIRED_TOKEN_LIFETIME_MS = 6e4;
-const MINIMUM_REQUIRED_TOKEN_LIFETIME_MS = 1e4;
-function normalizeCookieNamespace(cookieNamespace) {
-	if (cookieNamespace === void 0 || cookieNamespace === null) return null;
-	const normalized = cookieNamespace.trim().replace(/[^a-zA-Z0-9]+/g, "_").replace(/^_+|_+$/g, "").toLowerCase();
-	return normalized.length > 0 ? normalized : null;
-}
-/**
-* Safely check if a string is a valid URL without throwing.
-*/
-function canParseUrl(value) {
-	try {
-		new URL(value);
-		return true;
-	} catch {
-		return false;
-	}
-}
-function serializeAuthCookie(cookie) {
-	const parts = [`${cookie.name}=${cookie.value}`, `Path=${cookie.options.path}`];
-	if (cookie.options.httpOnly) parts.push("HttpOnly");
-	if (cookie.options.secure) parts.push("Secure");
-	if (cookie.options.sameSite) parts.push(`SameSite=${cookie.options.sameSite}`);
-	if (cookie.options.maxAge !== void 0) parts.push(`Max-Age=${cookie.options.maxAge}`);
-	if (cookie.options.expires) parts.push(`Expires=${cookie.options.expires.toUTCString()}`);
-	return parts.join("; ");
-}
-function buildRedirectResponse(location, cookies) {
-	const headers = new Headers({ Location: location });
-	for (const cookie of cookies) headers.append("Set-Cookie", serializeAuthCookie(cookie));
-	return new Response(null, {
-		status: 302,
-		headers
-	});
-}
-function deriveCookieNamespaceFromUrl(url) {
-	if (!canParseUrl(url)) return DERIVED_COOKIE_NAMESPACE_FALLBACK;
-	const parsed = new URL(url);
-	return normalizeCookieNamespace(`${parsed.hostname}${parsed.pathname}`) ?? DERIVED_COOKIE_NAMESPACE_FALLBACK;
-}
-function normalizeIssuer(value) {
-	if (!canParseUrl(value)) return value.replace(/\/+$/, "");
-	const parsed = new URL(value);
-	const pathname = parsed.pathname === "/" ? "" : parsed.pathname.replace(/\/+$/, "");
-	return `${parsed.protocol}//${parsed.host}${pathname}`;
-}
-function convexSiteIssuerFromCloudUrl(value) {
-	if (!canParseUrl(value)) return null;
-	const parsed = new URL(value);
-	if (!parsed.hostname.endsWith(".convex.cloud")) return null;
-	parsed.hostname = parsed.hostname.slice(0, -13) + ".convex.site";
-	return normalizeIssuer(parsed.toString());
-}
-function defaultAcceptedIssuersForUrl(value) {
-	const issuers = [normalizeIssuer(value)];
-	const siteIssuer = convexSiteIssuerFromCloudUrl(value);
-	if (siteIssuer !== null) issuers.push(siteIssuer);
-	return issuers;
-}
-/**
-* Create an SSR auth helper for server-side frameworks.
-*
-* Handles cookie-based token management, OAuth code exchange,
-* and automatic JWT refresh on page loads. Works with any
-* framework that gives you a `Request` object — SvelteKit,
-* TanStack Start, Remix, Next.js, etc.
-*
-* @param options - SSR configuration (Convex API URL, issuer rules, proxy route, cookie lifetime).
-* @returns An object with `token`, `verify`, `proxy`, and `refresh` methods.
-*
-* @example SvelteKit hooks
-* ```ts
-* // src/hooks.server.ts
-* import { server } from '@robelest/convex-auth/server';
-*
-* const auth = server({ url: CONVEX_URL });
-*
-* export const handle = async ({ event, resolve }) => {
-*   const { cookies, token } = await auth.refresh(event.request);
-*   for (const c of cookies) event.cookies.set(c.name, c.value, c.options);
-*   event.locals.token = token;
-*   return resolve(event);
-* };
-* ```
-*
-* @example Generic proxy endpoint
-* ```ts
-* if (shouldProxyAuthAction(url.pathname, '/api/auth')) {
-*   return auth.proxy(request);
-* }
-* ```
-*
-* @param options - Server-side auth configuration including Convex URL,
-*   accepted issuers, proxy route, and cookie behavior.
-* @returns SSR helpers for reading tokens, refreshing cookies, and proxying
-*   auth actions through an httpOnly-cookie layer.
-*
-* @see {@link shouldProxyAuthAction}
-*/
-function server(options) {
-	const convexUrl = options.url;
-	const apiRoute = options.apiRoute ?? "/api/auth";
-	const cookieConfig = { maxAge: options.cookieMaxAge ?? null };
-	const verbose = options.verbose ?? false;
-	const cookieNamespace = normalizeCookieNamespace(options.cookieNamespace) ?? deriveCookieNamespaceFromUrl(convexUrl);
-	const acceptedIssuers = new Set((options.acceptedIssuers ?? defaultAcceptedIssuersForUrl(convexUrl)).map(normalizeIssuer).filter((issuer) => issuer.length > 0));
-	return {
-		token(request) {
-			return parseAuthCookies(request.headers.get("cookie"), request.headers.get("host") ?? new URL(request.url).host, cookieNamespace).token;
-		},
-		async verify(request) {
-			const token = parseAuthCookies(request.headers.get("cookie"), request.headers.get("host") ?? new URL(request.url).host, cookieNamespace).token;
-			if (token === null) return false;
-			const decodedToken = await Fx.run(Fx.attempt(async () => jwtDecode(token), (decoded) => decoded, () => null));
-			if (decodedToken?.exp === void 0 || decodedToken.iss === void 0) return false;
-			if (!acceptedIssuers.has(normalizeIssuer(decodedToken.iss))) return false;
-			return decodedToken.exp * 1e3 > Date.now();
-		},
-		async proxy(request) {
-			const requestDispatch = !shouldProxyAuthAction(new URL(request.url).pathname, apiRoute) ? { kind: "invalidRoute" } : request.method !== "POST" ? { kind: "invalidMethod" } : (() => {
-				const originHeader = request.headers.get("origin");
-				if (originHeader === null) return false;
-				const forwardedProtoHeader = request.headers.get("x-forwarded-proto");
-				const protocol = forwardedProtoHeader !== null ? (() => {
-					const forwardedProto = forwardedProtoHeader.split(",")[0]?.trim();
-					if (forwardedProto !== void 0 && forwardedProto.length > 0) return forwardedProto.endsWith(":") ? forwardedProto : `${forwardedProto}:`;
-					return new URL(request.url).protocol;
-				})() : new URL(request.url).protocol;
-				const requestHost = request.headers.get("host") ?? new URL(request.url).host;
-				const hostCandidate = `${protocol}//${requestHost}`;
-				const host$1 = canParseUrl(hostCandidate) ? new URL(hostCandidate).host : requestHost;
-				if (!canParseUrl(originHeader)) return true;
-				const originUrl = new URL(originHeader);
-				return originUrl.host !== host$1 || originUrl.protocol !== protocol;
-			})() ? { kind: "invalidOrigin" } : { kind: "valid" };
-			const validationErrorResponse = await Fx.run(Fx.match(requestDispatch, requestDispatch.kind, {
-				invalidRoute: () => new Response("Invalid route", { status: 404 }),
-				invalidMethod: () => new Response("Invalid method", { status: 405 }),
-				invalidOrigin: () => new Response("Invalid origin", { status: 403 }),
-				valid: () => null
-			}));
-			if (validationErrorResponse !== null) return validationErrorResponse;
-			const body = await Fx.run(Fx.attempt(async () => {
-				const parsed = await request.json();
-				if (typeof parsed !== "object" || parsed === null) return null;
-				return parsed;
-			}, (parsed) => parsed, () => null));
-			if (body === null) return new Response("Invalid request body", { status: 400 });
-			const action = body.action;
-			const args = typeof body.args === "object" && body.args !== null ? body.args : {};
-			const actionDispatch = action === "auth:signIn" ? { action: "sessionStart" } : action === "auth:signOut" ? { action: "sessionStop" } : null;
-			if (actionDispatch === null) return new Response("Invalid action", { status: 400 });
-			const host = request.headers.get("host") ?? new URL(request.url).host;
-			const currentCookies = parseAuthCookies(request.headers.get("cookie"), host, cookieNamespace);
-			return Fx.run(Fx.match(actionDispatch, actionDispatch.action, {
-				sessionStart: (_) => Fx.promise(async () => {
-					const refreshDispatch = args.refreshToken === void 0 ? { kind: "passthrough" } : currentCookies.refreshToken === null ? { kind: "refreshRequestedWithoutCookie" } : {
-						kind: "hydrateRefreshFromCookie",
-						refreshToken: currentCookies.refreshToken
-					};
-					const refreshResponse = await Fx.run(Fx.match(refreshDispatch, refreshDispatch.kind, {
-						passthrough: async () => null,
-						hydrateRefreshFromCookie: async ({ refreshToken }) => {
-							args.refreshToken = refreshToken;
-							return null;
-						},
-						refreshRequestedWithoutCookie: async () => {
-							const currentToken = currentCookies.token;
-							const decodedToken = currentToken === null ? null : await Fx.run(Fx.attempt(async () => jwtDecode(currentToken), (decoded) => decoded, () => null));
-							const tokenDispatch = currentToken !== null && decodedToken?.exp !== void 0 && decodedToken.iss !== void 0 && acceptedIssuers.has(normalizeIssuer(decodedToken.iss)) && decodedToken.exp * 1e3 > Date.now() ? {
-								kind: "validToken",
-								token: currentToken
-							} : { kind: "missingToken" };
-							return await Fx.run(Fx.match(tokenDispatch, tokenDispatch.kind, {
-								validToken: ({ token }) => new Response(JSON.stringify({ tokens: {
-									token,
-									refreshToken: "dummy"
-								} }), {
-									status: 200,
-									headers: { "Content-Type": "application/json" }
-								}),
-								missingToken: () => new Response(JSON.stringify({ tokens: null }), {
-									status: 200,
-									headers: { "Content-Type": "application/json" }
-								})
-							}));
-						}
-					}));
-					const refreshDecision = refreshResponse !== null ? {
-						kind: "shortCircuit",
-						response: refreshResponse
-					} : { kind: "continue" };
-					const maybeShortCircuitResponse = await Fx.run(Fx.match(refreshDecision, refreshDecision.kind, {
-						shortCircuit: ({ response }) => response,
-						continue: () => null
-					}));
-					if (maybeShortCircuitResponse !== null) return maybeShortCircuitResponse;
-					const client = new ConvexHttpClient(convexUrl);
-					const authDispatch = args.refreshToken === void 0 && args.params?.code === void 0 && currentCookies.token !== null ? {
-						kind: "attachAuth",
-						token: currentCookies.token
-					} : { kind: "skipAuth" };
-					await Fx.run(Fx.match(authDispatch, authDispatch.kind, {
-						attachAuth: ({ token }) => {
-							client.setAuth(token);
-						},
-						skipAuth: () => void 0
-					}));
-					return Fx.run(Fx.from({
-						ok: () => client.action(signInActionRef, args),
-						err: (error) => error
-					}).pipe(Fx.fold({
-						ok: (result) => Fx.run(Fx.match(result, result.kind, {
-							redirect: (redirectResult) => {
-								const response = new Response(JSON.stringify({
-									kind: "redirect",
-									redirect: redirectResult.redirect,
-									verifier: redirectResult.verifier
-								}), {
-									status: 200,
-									headers: { "Content-Type": "application/json" }
-								});
-								for (const value of serializeAuthCookies({
-									...currentCookies,
-									verifier: redirectResult.verifier
-								}, host, cookieConfig, cookieNamespace)) response.headers.append("Set-Cookie", value);
-								return Fx.succeed(response);
-							},
-							signedIn: (signedInResult) => {
-								const response = new Response(JSON.stringify({
-									kind: "signedIn",
-									tokens: signedInResult.tokens === null ? null : {
-										token: signedInResult.tokens.token,
-										refreshToken: "dummy"
-									}
-								}), {
-									status: 200,
-									headers: { "Content-Type": "application/json" }
-								});
-								for (const value of serializeAuthCookies({
-									token: signedInResult.tokens?.token ?? null,
-									refreshToken: signedInResult.tokens?.refreshToken ?? null,
-									verifier: null
-								}, host, cookieConfig, cookieNamespace)) response.headers.append("Set-Cookie", value);
-								return Fx.succeed(response);
-							},
-							started: (startedResult) => Fx.succeed(new Response(JSON.stringify(startedResult), {
-								status: 200,
-								headers: { "Content-Type": "application/json" }
-							})),
-							passkeyOptions: (passkeyOptionsResult) => Fx.succeed(new Response(JSON.stringify(passkeyOptionsResult), {
-								status: 200,
-								headers: { "Content-Type": "application/json" }
-							})),
-							totpRequired: (totpRequiredResult) => Fx.succeed(new Response(JSON.stringify(totpRequiredResult), {
-								status: 200,
-								headers: { "Content-Type": "application/json" }
-							})),
-							totpSetup: (totpSetupResult) => Fx.succeed(new Response(JSON.stringify(totpSetupResult), {
-								status: 200,
-								headers: { "Content-Type": "application/json" }
-							})),
-							deviceCode: (deviceCodeResult) => Fx.succeed(new Response(JSON.stringify(deviceCodeResult), {
-								status: 200,
-								headers: { "Content-Type": "application/json" }
-							}))
-						})),
-						err: (error) => {
-							const errorBody = error instanceof ConvexError && typeof error.data === "object" && error.data !== null && "code" in error.data ? {
-								error: error.data.message ?? String(error),
-								authError: error.data
-							} : { error: error instanceof Error ? error.message : String(error) };
-							const response = new Response(JSON.stringify(errorBody), {
-								status: 400,
-								headers: { "Content-Type": "application/json" }
-							});
-							const clearSession = args.refreshToken !== void 0 && error instanceof ConvexError && typeof error.data === "object" && error.data !== null && error.data.code === "INVALID_REFRESH_TOKEN";
-							for (const value of serializeAuthCookies({
-								token: clearSession ? null : currentCookies.token,
-								refreshToken: clearSession ? null : currentCookies.refreshToken,
-								verifier: null
-							}, host, cookieConfig, cookieNamespace)) response.headers.append("Set-Cookie", value);
-							return response;
-						}
-					})));
-				}),
-				sessionStop: (_) => Fx.promise(async () => {
-					await Fx.run(Fx.from({
-						ok: () => (() => {
-							const client = new ConvexHttpClient(convexUrl);
-							if (currentCookies.token !== null) client.setAuth(currentCookies.token);
-							return client.action(signOutActionRef);
-						})(),
-						err: (error) => error
-					}).pipe(Fx.recover((error) => {
-						console.error("[convex-auth/server] proxy sign-out failed", error);
-						const fallbackDispatch = currentCookies.refreshToken !== null ? {
-							kind: "attemptFallback",
-							refreshToken: currentCookies.refreshToken
-						} : { kind: "skipFallback" };
-						return Fx.match(fallbackDispatch, fallbackDispatch.kind, {
-							attemptFallback: ({ refreshToken }) => Fx.from({
-								ok: async () => {
-									const refreshed = await new ConvexHttpClient(convexUrl).action(signInActionRef, { refreshToken });
-									const refreshedTokens = await Fx.run(Fx.match(refreshed, refreshed.kind, {
-										signedIn: (signedInResult) => Fx.succeed(signedInResult.tokens),
-										redirect: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for sign-out fallback refresh")),
-										started: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for sign-out fallback refresh")),
-										passkeyOptions: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for sign-out fallback refresh")),
-										totpRequired: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for sign-out fallback refresh")),
-										totpSetup: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for sign-out fallback refresh")),
-										deviceCode: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for sign-out fallback refresh"))
-									}));
-									const fallbackSignOutDispatch = refreshedTokens !== null ? {
-										kind: "signOutWithRefreshed",
-										token: refreshedTokens.token
-									} : { kind: "skipRefreshedSignOut" };
-									await Fx.run(Fx.match(fallbackSignOutDispatch, fallbackSignOutDispatch.kind, {
-										signOutWithRefreshed: ({ token }) => Fx.promise(async () => {
-											const client = new ConvexHttpClient(convexUrl);
-											client.setAuth(token);
-											await client.action(signOutActionRef);
-										}),
-										skipRefreshedSignOut: () => Fx.succeed(void 0)
-									}));
-								},
-								err: (error$1) => error$1
-							}).pipe(Fx.recover((fallbackError) => {
-								console.error("[convex-auth/server] proxy sign-out fallback failed", fallbackError);
-								return Fx.succeed(void 0);
-							})),
-							skipFallback: () => Fx.succeed(void 0)
-						});
-					}), Fx.map(() => void 0)));
-					const response = new Response(JSON.stringify(null), {
-						status: 200,
-						headers: { "Content-Type": "application/json" }
-					});
-					for (const value of serializeAuthCookies({
-						token: null,
-						refreshToken: null,
-						verifier: null
-					}, host, cookieConfig, cookieNamespace)) response.headers.append("Set-Cookie", value);
-					return response;
-				})
-			}));
-		},
-		async refresh(request) {
-			const host = request.headers.get("host") ?? new URL(request.url).host;
-			const currentCookies = parseAuthCookies(request.headers.get("cookie"), host, cookieNamespace);
-			const currentToken = currentCookies.token;
-			const originHeader = request.headers.get("origin");
-			const forwardedProtoHeader = request.headers.get("x-forwarded-proto");
-			const protocol = forwardedProtoHeader !== null ? (() => {
-				const forwardedProto = forwardedProtoHeader.split(",")[0]?.trim();
-				if (forwardedProto !== void 0 && forwardedProto.length > 0) return forwardedProto.endsWith(":") ? forwardedProto : `${forwardedProto}:`;
-				return new URL(request.url).protocol;
-			})() : new URL(request.url).protocol;
-			const requestHost = request.headers.get("host") ?? new URL(request.url).host;
-			const hostCandidate = `${protocol}//${requestHost}`;
-			const normalizedHost = canParseUrl(hostCandidate) ? new URL(hostCandidate).host : requestHost;
-			const originUrl = originHeader !== null && canParseUrl(originHeader) ? new URL(originHeader) : null;
-			const corsDispatch = originHeader !== null && (originUrl === null || originUrl.host !== normalizedHost || originUrl.protocol !== protocol) ? { kind: "crossOrigin" } : { kind: "sameOrigin" };
-			const corsRefreshResult = await Fx.run(Fx.match(corsDispatch, corsDispatch.kind, {
-				crossOrigin: () => ({
-					redirect: false,
-					cookies: [],
-					token: null
-				}),
-				sameOrigin: () => null
-			}));
-			if (corsRefreshResult !== null) return corsRefreshResult;
-			const requestUrl = new URL(request.url);
-			const code = requestUrl.searchParams.get("code");
-			const shouldHandleCode = options.shouldHandleCode === void 0 ? true : typeof options.shouldHandleCode === "function" ? await options.shouldHandleCode(request) : options.shouldHandleCode;
-			const codeExchangeDispatch = code !== null && request.method === "GET" && request.headers.get("accept")?.includes("text/html") && shouldHandleCode ? {
-				kind: "exchange",
-				code
-			} : { kind: "skip" };
-			const codeExchangeResult = await Fx.run(Fx.match(codeExchangeDispatch, codeExchangeDispatch.kind, {
-				exchange: async ({ code: verificationCode }) => {
-					const redirectUrl = new URL(requestUrl.toString());
-					return Fx.run(Fx.from({
-						ok: async () => {
-							const result = await new ConvexHttpClient(convexUrl).action(signInActionRef, {
-								params: { code: verificationCode },
-								verifier: currentCookies.verifier ?? void 0
-							});
-							return {
-								kind: "signedIn",
-								tokens: await Fx.run(Fx.match(result, result.kind, {
-									signedIn: (signedInResult) => Fx.succeed(signedInResult.tokens),
-									redirect: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for code exchange")),
-									started: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for code exchange")),
-									passkeyOptions: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for code exchange")),
-									totpRequired: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for code exchange")),
-									totpSetup: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for code exchange")),
-									deviceCode: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for code exchange"))
-								}))
-							};
-						},
-						err: (error) => error
-					}).pipe(Fx.fold({
-						ok: (result) => {
-							redirectUrl.searchParams.delete("code");
-							const cookies = structuredAuthCookies({
-								token: result.tokens?.token ?? null,
-								refreshToken: result.tokens?.refreshToken ?? null,
-								verifier: null
-							}, host, cookieConfig, cookieNamespace);
-							return {
-								redirect: true,
-								response: buildRedirectResponse(redirectUrl.toString(), cookies)
-							};
-						},
-						err: (error) => {
-							console.error("[convex-auth/server] code exchange failed", error);
-							const errorCode = error instanceof ConvexError && typeof error.data === "object" && error.data !== null && typeof error.data.code === "string" ? error.data.code : null;
-							if (!(errorCode === "OAUTH_INVALID_STATE" || errorCode === "OAUTH_PROVIDER_ERROR" || errorCode === "OAUTH_MISSING_ID_TOKEN" || errorCode === "OAUTH_INVALID_PROFILE" || errorCode === "OAUTH_MISSING_VERIFIER" || errorCode === "INVALID_VERIFIER" || errorCode === "INVALID_VERIFICATION_CODE")) return {
-								redirect: false,
-								cookies: [],
-								token: currentCookies.token
-							};
-							redirectUrl.searchParams.delete("code");
-							const cookies = structuredAuthCookies({
-								token: currentCookies.token,
-								refreshToken: currentCookies.refreshToken,
-								verifier: null
-							}, host, cookieConfig, cookieNamespace);
-							return {
-								redirect: true,
-								response: buildRedirectResponse(redirectUrl.toString(), cookies)
-							};
-						}
-					})));
-				},
-				skip: async () => null
-			}));
-			const codeExchangeDecision = codeExchangeResult !== null ? {
-				kind: "done",
-				result: codeExchangeResult
-			} : { kind: "continue" };
-			const maybeCodeExchangeResult = await Fx.run(Fx.match(codeExchangeDecision, codeExchangeDecision.kind, {
-				done: ({ result }) => result,
-				continue: () => null
-			}));
-			if (maybeCodeExchangeResult !== null) return maybeCodeExchangeResult;
-			const tokens = await Fx.run(Fx.gen(function* () {
-				const { token, refreshToken } = currentCookies;
-				const malformedRefreshTokenDispatch = refreshToken !== null && (refreshToken.trim().length === 0 || refreshToken === "dummy") ? { kind: "malformed" } : { kind: "ok" };
-				const malformedRefreshTokenResult = yield* Fx.match(malformedRefreshTokenDispatch, malformedRefreshTokenDispatch.kind, {
-					malformed: () => {
-						if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refresh token cookie malformed, clearing auth cookies`);
-						return null;
-					},
-					ok: () => void 0
-				});
-				if (malformedRefreshTokenResult !== void 0) return malformedRefreshTokenResult;
-				const decodedToken = token === null ? null : yield* Fx.attempt(async () => jwtDecode(token), (decoded) => decoded, () => null);
-				const issuerDispatch = decodedToken?.iss !== void 0 && !acceptedIssuers.has(normalizeIssuer(decodedToken.iss)) ? { kind: "issuerMismatch" } : { kind: "issuerOk" };
-				const issuerResult = yield* Fx.match(issuerDispatch, issuerDispatch.kind, {
-					issuerMismatch: () => {
-						if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Access token issuer mismatch, clearing auth cookies`);
-						return null;
-					},
-					issuerOk: () => void 0
-				});
-				if (issuerResult !== void 0) return issuerResult;
-				const tokenState = token === null ? refreshToken === null ? { kind: "none" } : {
-					kind: "refreshOnly",
-					refreshToken
-				} : refreshToken === null ? {
-					kind: "accessOnly",
-					token
-				} : {
-					kind: "both",
-					token,
-					refreshToken
-				};
-				return yield* Fx.match(tokenState, tokenState.kind, {
-					none: () => {
-						if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] No auth cookies found, skipping refresh`);
-						return Fx.succeed(void 0);
-					},
-					refreshOnly: ({ refreshToken: refreshTokenValue }) => {
-						if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Access token cookie missing, attempting refresh-token recovery`);
-						return Fx.from({
-							ok: async () => {
-								const result = await new ConvexHttpClient(convexUrl).action(signInActionRef, { refreshToken: refreshTokenValue });
-								const tokens$1 = await Fx.run(Fx.match(result, result.kind, {
-									signedIn: (signedInResult) => Fx.succeed(signedInResult.tokens),
-									redirect: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-									started: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-									passkeyOptions: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-									totpRequired: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-									totpSetup: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-									deviceCode: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh"))
-								}));
-								if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refreshed tokens, null=${tokens$1 === null}`);
-								return tokens$1;
-							},
-							err: (error) => error
-						}).pipe(Fx.recover((error) => {
-							console.error("[convex-auth/server] refresh-token exchange failed", error);
-							if ((error instanceof ConvexError && typeof error.data === "object" && error.data !== null && typeof error.data.code === "string" ? error.data.code : null) === "INVALID_REFRESH_TOKEN") {
-								if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refresh token rejected, clearing auth cookies`);
-								return Fx.succeed(null);
-							}
-							if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Token refresh failed transiently, keeping current cookies`);
-							return Fx.succeed(void 0);
-						}));
-					},
-					accessOnly: () => {
-						const accessOnlyDispatch = decodedToken?.exp !== void 0 && decodedToken.iss !== void 0 && acceptedIssuers.has(normalizeIssuer(decodedToken.iss)) && decodedToken.exp * 1e3 > Date.now() ? { kind: "accessValid" } : { kind: "accessInvalid" };
-						return Fx.match(accessOnlyDispatch, accessOnlyDispatch.kind, {
-							accessValid: () => {
-								if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refresh token cookie missing but access token still valid`);
-								return Fx.succeed(void 0);
-							},
-							accessInvalid: () => {
-								if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refresh token cookie missing and access token invalid, clearing`);
-								return Fx.succeed(null);
-							}
-						});
-					},
-					both: ({ refreshToken: refreshTokenValue }) => {
-						const bothDecodeDispatch = decodedToken?.exp === void 0 || decodedToken.iat === void 0 ? { kind: "undecodable" } : {
-							kind: "decoded",
-							decodedToken
-						};
-						return Fx.match(bothDecodeDispatch, bothDecodeDispatch.kind, {
-							undecodable: () => {
-								if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Failed to decode access token, attempting refresh-token recovery`);
-								return Fx.from({
-									ok: async () => {
-										const result = await new ConvexHttpClient(convexUrl).action(signInActionRef, { refreshToken: refreshTokenValue });
-										const tokens$1 = await Fx.run(Fx.match(result, result.kind, {
-											signedIn: (signedInResult) => Fx.succeed(signedInResult.tokens),
-											redirect: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-											started: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-											passkeyOptions: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-											totpRequired: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-											totpSetup: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-											deviceCode: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh"))
-										}));
-										if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refreshed tokens, null=${tokens$1 === null}`);
-										return tokens$1;
-									},
-									err: (error) => error
-								}).pipe(Fx.recover((error) => {
-									console.error("[convex-auth/server] refresh-token exchange failed", error);
-									if ((error instanceof ConvexError && typeof error.data === "object" && error.data !== null && typeof error.data.code === "string" ? error.data.code : null) === "INVALID_REFRESH_TOKEN") {
-										if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refresh token rejected, clearing auth cookies`);
-										return Fx.succeed(null);
-									}
-									if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Token refresh failed transiently, keeping current cookies`);
-									return Fx.succeed(void 0);
-								}));
-							},
-							decoded: ({ decodedToken: decodedAccessToken }) => {
-								const totalTokenLifetimeMs = decodedAccessToken.exp * 1e3 - decodedAccessToken.iat * 1e3;
-								const minimumExpiration = Date.now() + Math.min(REQUIRED_TOKEN_LIFETIME_MS, Math.max(MINIMUM_REQUIRED_TOKEN_LIFETIME_MS, totalTokenLifetimeMs / 10));
-								const expirationDispatch = decodedAccessToken.exp * 1e3 > minimumExpiration ? { kind: "skipRefresh" } : { kind: "refresh" };
-								return Fx.match(expirationDispatch, expirationDispatch.kind, {
-									skipRefresh: () => {
-										if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Token valid long enough, skipping refresh`);
-										return Fx.succeed(void 0);
-									},
-									refresh: () => Fx.from({
-										ok: async () => {
-											const result = await new ConvexHttpClient(convexUrl).action(signInActionRef, { refreshToken: refreshTokenValue });
-											const tokens$1 = await Fx.run(Fx.match(result, result.kind, {
-												signedIn: (signedInResult) => Fx.succeed(signedInResult.tokens),
-												redirect: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-												started: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-												passkeyOptions: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-												totpRequired: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-												totpSetup: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh")),
-												deviceCode: () => Fx.fatal(/* @__PURE__ */ new Error("Invalid `auth:signIn` result for token refresh"))
-											}));
-											if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refreshed tokens, null=${tokens$1 === null}`);
-											return tokens$1;
-										},
-										err: (error) => error
-									}).pipe(Fx.recover((error) => {
-										console.error("[convex-auth/server] refresh-token exchange failed", error);
-										if ((error instanceof ConvexError && typeof error.data === "object" && error.data !== null && typeof error.data.code === "string" ? error.data.code : null) === "INVALID_REFRESH_TOKEN") {
-											if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Refresh token rejected, clearing auth cookies`);
-											return Fx.succeed(null);
-										}
-										if (verbose) console.debug(`${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] Token refresh failed transiently, keeping current cookies`);
-										return Fx.succeed(void 0);
-									}))
-								});
-							}
-						});
-					}
-				});
-			}));
-			if (tokens === void 0) return {
-				redirect: false,
-				cookies: [],
-				token: currentToken
-			};
-			return {
-				redirect: false,
-				cookies: structuredAuthCookies({
-					token: tokens?.token ?? null,
-					refreshToken: tokens?.refreshToken ?? null,
-					verifier: null
-				}, host, cookieConfig, cookieNamespace),
-				token: tokens?.token ?? null
-			};
-		}
-	};
-}
-
-//#endregion
-export { authCookieNames, parseAuthCookies, serializeAuthCookies, server, shouldProxyAuthAction, structuredAuthCookies };
-//# sourceMappingURL=ssr.js.map