@robelest/convex-auth 0.0.4-preview.27 → 0.0.4-preview.28

package/dist/server/prefetch.js

@@ -1,7 +1,6 @@
-import { isLocalHost } from "./url.js";
 import { log } from "./log.js";
+import { isLocalHost } from "./url.js";
 import { ConvexError } from "convex/values";
-import { Cause, Effect, Exit, Match } from "effect";
 import { ConvexHttpClient } from "convex/browser";
 import { makeFunctionReference } from "convex/server";
 import { parse, serialize } from "cookie";
@@ -156,20 +155,15 @@ function shouldProxyAuthAction(pathname, apiRoute) {
 	if (apiRoute.endsWith("/")) return pathname === apiRoute || pathname === apiRoute.slice(0, -1);
 	return pathname === apiRoute || pathname === `${apiRoute}/`;
 }
-const REQUIRED_TOKEN_LIFETIME_MS = 6e4;
-const MINIMUM_REQUIRED_TOKEN_LIFETIME_MS = 1e4;
+const REQUIRED_TOKEN_LIFETIME_MS = 3e4;
+const MINIMUM_REQUIRED_TOKEN_LIFETIME_MS = 5e3;
 const JSON_HEADERS = { "Content-Type": "application/json" };
-function runBoundary(effect) {
-	return Effect.runPromiseExit(effect).then(Exit.match({
-		onSuccess: (value) => value,
-		onFailure: (cause) => Promise.reject(Cause.squash(cause))
-	}));
-}
 function decodeToken(token) {
-	return Effect.try({
-		try: () => jwtDecode(token),
-		catch: () => null
-	}).pipe(Effect.catch(() => Effect.succeed(null)));
+	try {
+		return jwtDecode(token);
+	} catch {
+		return null;
+	}
 }
 function jsonResponse(body, status = 200) {
 	return new Response(JSON.stringify(body), {
@@ -191,7 +185,8 @@ function getProxyErrorBody(error) {
 	} : { error: error instanceof Error ? error.message : String(error) };
 }
 function extractSignedInTokens(result, context) {
-	return Match.value(result).pipe(Match.when({ kind: "signedIn" }, ({ tokens }) => Effect.succeed(tokens)), Match.orElse(() => Effect.fail(/* @__PURE__ */ new Error(`Invalid \`auth:signIn\` result for ${context}`))));
+	if (result.kind === "signedIn") return result.tokens;
+	throw new Error(`Invalid \`auth:signIn\` result for ${context}`);
 }
 function normalizeCookieNamespace(cookieNamespace) {
 	if (cookieNamespace === void 0 || cookieNamespace === null) return null;
@@ -302,12 +297,10 @@ function server(options) {
 			return parseAuthCookies(request.headers.get("cookie"), request.headers.get("host") ?? new URL(request.url).host, cookieNamespace).token;
 		},
 		async verify(request) {
-			return runBoundary(Effect.gen(function* () {
-				const token = parseAuthCookies(request.headers.get("cookie"), request.headers.get("host") ?? new URL(request.url).host, cookieNamespace).token;
-				if (token === null) return false;
-				const decodedToken = yield* decodeToken(token);
-				return decodedToken?.exp !== void 0 && decodedToken.iss !== void 0 && acceptedIssuers.has(normalizeIssuer(decodedToken.iss)) && decodedToken.exp * 1e3 > Date.now();
-			}).pipe(Effect.withSpan("convex-auth.ssr.refresh")));
+			const token = parseAuthCookies(request.headers.get("cookie"), request.headers.get("host") ?? new URL(request.url).host, cookieNamespace).token;
+			if (token === null) return false;
+			const decodedToken = decodeToken(token);
+			return decodedToken?.exp !== void 0 && decodedToken.iss !== void 0 && acceptedIssuers.has(normalizeIssuer(decodedToken.iss)) && decodedToken.exp * 1e3 > Date.now();
 		},
 		async proxy(request) {
 			const createClient = (token) => {
@@ -315,184 +308,85 @@ function server(options) {
 				if (token !== null && token !== void 0) client.setAuth(token);
 				return client;
 			};
-			const runSignIn = (client, args) => Effect.tryPromise({
-				try: () => client.action(signInActionRef, args),
-				catch: (error) => error
-			});
-			const runSignOut = (token) => Effect.tryPromise({
-				try: () => createClient(token).action(signOutActionRef),
-				catch: (error) => error
-			});
-			const hydrateProxySignInClient = (currentCookies, args) => Effect.gen(function* () {
+			const runSignIn = async (client, args$1) => client.action(signInActionRef, args$1);
+			const runSignOut = async (token) => createClient(token).action(signOutActionRef);
+			const hydrateProxySignInClient = async (currentCookies$1, args$1) => {
 				const client = createClient();
-				const requestParams = typeof args.params === "object" && args.params !== null ? args.params : void 0;
-				if (!(args.refreshToken === void 0 && requestParams?.code === void 0)) return {
+				const requestParams = typeof args$1.params === "object" && args$1.params !== null ? args$1.params : void 0;
+				if (!(args$1.refreshToken === void 0 && requestParams?.code === void 0)) return {
 					client,
-					cookies: currentCookies
+					cookies: currentCookies$1
 				};
-				const currentToken = currentCookies.token;
-				const decodedToken = currentToken === null ? null : yield* decodeToken(currentToken);
-				if (currentToken !== null && decodedToken?.exp !== void 0 && decodedToken.iss !== void 0 && acceptedIssuers.has(normalizeIssuer(decodedToken.iss)) && decodedToken.exp * 1e3 > Date.now()) {
-					yield* Effect.sync(() => {
-						client.setAuth(currentToken);
-					});
+				const currentToken = currentCookies$1.token;
+				const decodedTokenValue = currentToken === null ? null : decodeToken(currentToken);
+				if (currentToken !== null && decodedTokenValue?.exp !== void 0 && decodedTokenValue.iss !== void 0 && acceptedIssuers.has(normalizeIssuer(decodedTokenValue.iss)) && decodedTokenValue.exp * 1e3 > Date.now()) {
+					client.setAuth(currentToken);
 					return {
 						client,
-						cookies: currentCookies
+						cookies: currentCookies$1
 					};
 				}
-				if (currentCookies.refreshToken === null) return {
+				if (currentCookies$1.refreshToken === null) return {
 					client,
-					cookies: currentCookies
+					cookies: currentCookies$1
 				};
-				const refreshedTokens = yield* runSignIn(createClient(), { refreshToken: currentCookies.refreshToken }).pipe(Effect.flatMap((result) => extractSignedInTokens(result, "proxy sign-in auth hydration")), Effect.catch(() => Effect.succeed(null)));
+				let refreshedTokens = null;
+				try {
+					refreshedTokens = extractSignedInTokens(await runSignIn(createClient(), { refreshToken: currentCookies$1.refreshToken }), "proxy sign-in auth hydration");
+				} catch {
+					refreshedTokens = null;
+				}
 				if (refreshedTokens === null) return {
 					client,
-					cookies: currentCookies
+					cookies: currentCookies$1
 				};
-				yield* Effect.sync(() => {
-					client.setAuth(refreshedTokens.token);
-				});
+				client.setAuth(refreshedTokens.token);
 				return {
 					client,
 					cookies: {
 						token: refreshedTokens.token,
 						refreshToken: refreshedTokens.refreshToken,
-						verifier: currentCookies.verifier
+						verifier: currentCookies$1.verifier
 					}
 				};
-			});
-			const toSignInProxyResponse = (result, args, currentCookies, host) => Match.value(result).pipe(Match.when({ kind: "redirect" }, (redirectResult) => Effect.sync(() => appendCookieHeaders(jsonResponse({
-				kind: "redirect",
-				redirect: redirectResult.redirect,
-				verifier: redirectResult.verifier
-			}), serializeAuthCookies({
-				...currentCookies,
-				verifier: redirectResult.verifier
-			}, host, cookieConfig, cookieNamespace)))), Match.when({ kind: "signedIn" }, (signedInResult) => Effect.sync(() => {
-				const nextCookies = signedInResult.tokens === null ? {
-					token: currentCookies.token,
-					refreshToken: currentCookies.refreshToken,
-					verifier: null
-				} : {
-					token: signedInResult.tokens.token,
-					refreshToken: signedInResult.tokens.refreshToken,
-					verifier: null
-				};
-				return appendCookieHeaders(jsonResponse({
-					kind: "signedIn",
-					tokens: signedInResult.tokens === null ? null : {
-						token: signedInResult.tokens.token,
-						refreshToken: "dummy"
-					}
-				}), serializeAuthCookies(nextCookies, host, cookieConfig, cookieNamespace));
-			})), Match.when({ kind: "started" }, (startedResult) => Effect.succeed(jsonResponse(startedResult))), Match.when({ kind: "passkeyOptions" }, (passkeyOptionsResult) => Effect.succeed(jsonResponse(passkeyOptionsResult))), Match.when({ kind: "totpRequired" }, (totpRequiredResult) => Effect.succeed(jsonResponse(totpRequiredResult))), Match.when({ kind: "totpSetup" }, (totpSetupResult) => Effect.succeed(jsonResponse(totpSetupResult))), Match.when({ kind: "deviceCode" }, (deviceCodeResult) => Effect.succeed(jsonResponse(deviceCodeResult))), Match.exhaustive).pipe(Effect.catch((error) => Effect.sync(() => {
-				const response = jsonResponse(getProxyErrorBody(error), 400);
-				const clearSession = args.refreshToken !== void 0 && getConvexErrorCode(error) === "INVALID_REFRESH_TOKEN";
-				return appendCookieHeaders(response, serializeAuthCookies({
-					token: clearSession ? null : currentCookies.token,
-					refreshToken: clearSession ? null : currentCookies.refreshToken,
-					verifier: null
-				}, host, cookieConfig, cookieNamespace));
-			})));
-			return runBoundary(Effect.gen(function* () {
-				const requestDispatch = !shouldProxyAuthAction(new URL(request.url).pathname, apiRoute) ? { kind: "invalidRoute" } : request.method !== "POST" ? { kind: "invalidMethod" } : (() => {
-					const originHeader = request.headers.get("origin");
-					if (originHeader === null) return false;
-					const forwardedProtoHeader = request.headers.get("x-forwarded-proto");
-					const protocol = forwardedProtoHeader !== null ? (() => {
-						const forwardedProto = forwardedProtoHeader.split(",")[0]?.trim();
-						if (forwardedProto !== void 0 && forwardedProto.length > 0) return forwardedProto.endsWith(":") ? forwardedProto : `${forwardedProto}:`;
-						return new URL(request.url).protocol;
-					})() : new URL(request.url).protocol;
-					const requestHost = request.headers.get("host") ?? new URL(request.url).host;
-					const hostCandidate = `${protocol}//${requestHost}`;
-					const host$1 = canParseUrl(hostCandidate) ? new URL(hostCandidate).host : requestHost;
-					if (!canParseUrl(originHeader)) return true;
-					const originUrl = new URL(originHeader);
-					return originUrl.host !== host$1 || originUrl.protocol !== protocol;
-				})() ? { kind: "invalidOrigin" } : { kind: "valid" };
-				const validationErrorResponse = Match.value(requestDispatch).pipe(Match.when({ kind: "invalidRoute" }, () => new Response("Invalid route", { status: 404 })), Match.when({ kind: "invalidMethod" }, () => new Response("Invalid method", { status: 405 })), Match.when({ kind: "invalidOrigin" }, () => new Response("Invalid origin", { status: 403 })), Match.when({ kind: "valid" }, () => null), Match.exhaustive);
-				if (validationErrorResponse !== null) return validationErrorResponse;
-				const body = yield* Effect.tryPromise({
-					try: () => request.json(),
-					catch: () => null
-				}).pipe(Effect.catch(() => Effect.succeed(null)), Effect.map((parsed) => typeof parsed === "object" && parsed !== null ? parsed : null));
-				if (body === null) return new Response("Invalid request body", { status: 400 });
-				const action = body.action;
-				const args = typeof body.args === "object" && body.args !== null ? { ...body.args } : {};
-				if (args.refreshToken === null) args.refreshToken = void 0;
-				const actionDispatch = action === "auth:signIn" ? { action: "sessionStart" } : action === "auth:signOut" ? { action: "sessionStop" } : null;
-				if (actionDispatch === null) return new Response("Invalid action", { status: 400 });
-				const host = request.headers.get("host") ?? new URL(request.url).host;
-				const currentCookies = parseAuthCookies(request.headers.get("cookie"), host, cookieNamespace);
-				return yield* Match.value(actionDispatch).pipe(Match.when({ action: "sessionStart" }, () => Effect.gen(function* () {
-					const refreshResponse = yield* Match.value({
-						kind: args.refreshToken === void 0 ? "passthrough" : currentCookies.refreshToken === null ? "refreshRequestedWithoutCookie" : "hydrateRefreshFromCookie",
-						refreshToken: currentCookies.refreshToken
-					}).pipe(Match.when({ kind: "passthrough" }, () => Effect.succeed(null)), Match.when({ kind: "hydrateRefreshFromCookie" }, ({ refreshToken }) => Effect.sync(() => {
-						args.refreshToken = refreshToken ?? void 0;
-						return null;
-					})), Match.when({ kind: "refreshRequestedWithoutCookie" }, () => Effect.gen(function* () {
-						const currentToken = currentCookies.token;
-						const decodedToken = currentToken === null ? null : yield* decodeToken(currentToken);
-						return Match.value(currentToken !== null && decodedToken?.exp !== void 0 && decodedToken.iss !== void 0 && acceptedIssuers.has(normalizeIssuer(decodedToken.iss)) && decodedToken.exp * 1e3 > Date.now() ? {
-							kind: "validToken",
-							token: currentToken
-						} : { kind: "missingToken" }).pipe(Match.when({ kind: "validToken" }, ({ token }) => jsonResponse({ tokens: {
-							token,
-							refreshToken: "dummy"
-						} })), Match.when({ kind: "missingToken" }, () => jsonResponse({ tokens: null })), Match.exhaustive);
-					})), Match.exhaustive);
-					if (refreshResponse !== null) return refreshResponse;
-					const { client, cookies: effectiveCookies } = yield* hydrateProxySignInClient(currentCookies, args);
-					return yield* runSignIn(client, args).pipe(Effect.flatMap((result) => toSignInProxyResponse(result, args, effectiveCookies, host)), Effect.catch((error) => Effect.succeed(appendCookieHeaders(jsonResponse(getProxyErrorBody(error), 400), serializeAuthCookies({
-						token: effectiveCookies.token,
-						refreshToken: effectiveCookies.refreshToken,
+			};
+			const toSignInProxyResponse = (result, args$1, currentCookies$1, host$1) => {
+				if (result.kind === "redirect") return appendCookieHeaders(jsonResponse({
+					kind: "redirect",
+					redirect: result.redirect,
+					verifier: result.verifier
+				}), serializeAuthCookies({
+					...currentCookies$1,
+					verifier: result.verifier
+				}, host$1, cookieConfig, cookieNamespace));
+				if (result.kind === "signedIn") {
+					const nextCookies = result.tokens === null ? {
+						token: currentCookies$1.token,
+						refreshToken: currentCookies$1.refreshToken,
 						verifier: null
-					}, host, cookieConfig, cookieNamespace)))));
-				})), Match.when({ action: "sessionStop" }, () => Effect.gen(function* () {
-					yield* runSignOut(currentCookies.token).pipe(Effect.catch((error) => Effect.gen(function* () {
-						yield* Effect.sync(() => {
-							log("ERROR", "[convex-auth/server] proxy sign-out failed", error);
-						});
-						yield* Match.value(currentCookies.refreshToken).pipe(Match.when(null, () => Effect.void), Match.orElse((refreshToken) => Effect.gen(function* () {
-							yield* runSignIn(createClient(), { refreshToken }).pipe(Effect.flatMap((refreshed) => extractSignedInTokens(refreshed, "sign-out fallback refresh")), Effect.flatMap((refreshedTokens) => refreshedTokens !== null ? runSignOut(refreshedTokens.token) : Effect.void), Effect.catch((fallbackError) => Effect.sync(() => {
-								log("ERROR", "[convex-auth/server] proxy sign-out fallback failed", fallbackError);
-							})));
-						})));
-					})));
-					return appendCookieHeaders(jsonResponse(null), serializeAuthCookies({
-						token: null,
-						refreshToken: null,
+					} : {
+						token: result.tokens.token,
+						refreshToken: result.tokens.refreshToken,
 						verifier: null
-					}, host, cookieConfig, cookieNamespace));
-				})), Match.exhaustive);
-			}));
-		},
-		async refresh(request) {
-			const createClient = () => new ConvexHttpClient(convexUrl);
-			const logVerbose = (message) => verbose ? Effect.sync(() => {
-				log("DEBUG", `${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] ${message}`);
-			}) : Effect.void;
-			const refreshWithToken = (refreshToken) => Effect.tryPromise({
-				try: () => createClient().action(signInActionRef, { refreshToken }),
-				catch: (error) => error
-			}).pipe(Effect.flatMap((result) => extractSignedInTokens(result, "token refresh")), Effect.tap((tokens) => logVerbose(`Refreshed tokens, null=${tokens === null}`)), Effect.catch((error) => Effect.gen(function* () {
-				yield* Effect.sync(() => {
-					log("ERROR", "[convex-auth/server] refresh-token exchange failed", error);
-				});
-				if (getConvexErrorCode(error) === "INVALID_REFRESH_TOKEN") {
-					yield* logVerbose("Refresh token rejected, clearing auth cookies");
-					return null;
+					};
+					return appendCookieHeaders(jsonResponse({
+						kind: "signedIn",
+						tokens: result.tokens === null ? null : {
+							token: result.tokens.token,
+							refreshToken: "dummy"
+						}
+					}), serializeAuthCookies(nextCookies, host$1, cookieConfig, cookieNamespace));
 				}
-				yield* logVerbose("Token refresh failed transiently, keeping current cookies");
-			})));
-			return runBoundary(Effect.gen(function* () {
-				const host = request.headers.get("host") ?? new URL(request.url).host;
-				const currentCookies = parseAuthCookies(request.headers.get("cookie"), host, cookieNamespace);
-				const currentToken = currentCookies.token;
+				if (result.kind === "started") return jsonResponse(result);
+				if (result.kind === "passkeyOptions") return jsonResponse(result);
+				if (result.kind === "totpRequired") return jsonResponse(result);
+				if (result.kind === "totpSetup") return jsonResponse(result);
+				if (result.kind === "deviceCode") return jsonResponse(result);
+				return jsonResponse(result);
+			};
+			const requestDispatch = !shouldProxyAuthAction(new URL(request.url).pathname, apiRoute) ? { kind: "invalidRoute" } : request.method !== "POST" ? { kind: "invalidMethod" } : (() => {
 				const originHeader = request.headers.get("origin");
+				if (originHeader === null) return false;
 				const forwardedProtoHeader = request.headers.get("x-forwarded-proto");
 				const protocol = forwardedProtoHeader !== null ? (() => {
 					const forwardedProto = forwardedProtoHeader.split(",")[0]?.trim();
@@ -501,129 +395,237 @@ function server(options) {
 				})() : new URL(request.url).protocol;
 				const requestHost = request.headers.get("host") ?? new URL(request.url).host;
 				const hostCandidate = `${protocol}//${requestHost}`;
-				const normalizedHost = canParseUrl(hostCandidate) ? new URL(hostCandidate).host : requestHost;
-				const originUrl = originHeader !== null && canParseUrl(originHeader) ? new URL(originHeader) : null;
-				if (originHeader !== null && (originUrl === null || originUrl.host !== normalizedHost || originUrl.protocol !== protocol)) return {
-					redirect: false,
-					cookies: [],
-					token: null
-				};
-				const requestUrl = new URL(request.url);
-				const code = requestUrl.searchParams.get("code");
-				const shouldHandleCodeOption = options.shouldHandleCode;
-				const shouldHandleCode = shouldHandleCodeOption === void 0 ? true : typeof shouldHandleCodeOption === "function" ? yield* Effect.sync(() => shouldHandleCodeOption(request)).pipe(Effect.flatMap((result) => typeof result === "boolean" ? Effect.succeed(result) : Effect.promise(() => result))) : shouldHandleCodeOption;
-				const codeExchangeResult = yield* Match.value(code !== null && request.method === "GET" && request.headers.get("accept")?.includes("text/html") && shouldHandleCode ? {
-					kind: "exchange",
-					code
-				} : { kind: "skip" }).pipe(Match.when({ kind: "skip" }, () => Effect.succeed(null)), Match.when({ kind: "exchange" }, ({ code: verificationCode }) => {
-					const redirectUrl = new URL(requestUrl.toString());
-					return Effect.gen(function* () {
-						const result = yield* Effect.tryPromise({
-							try: () => createClient().action(signInActionRef, {
-								params: { code: verificationCode },
-								verifier: currentCookies.verifier ?? void 0
-							}),
-							catch: (error) => error
-						}).pipe(Effect.flatMap((value) => extractSignedInTokens(value, "code exchange")));
-						redirectUrl.searchParams.delete("code");
-						const cookies = structuredAuthCookies({
-							token: result?.token ?? null,
-							refreshToken: result?.refreshToken ?? null,
-							verifier: null
-						}, host, cookieConfig, cookieNamespace);
-						return {
-							redirect: true,
-							response: buildRedirectResponse(redirectUrl.toString(), cookies)
-						};
-					}).pipe(Effect.catch((error) => Effect.gen(function* () {
-						yield* Effect.sync(() => {
-							log("ERROR", "[convex-auth/server] code exchange failed", error);
-						});
-						if (![
-							"OAUTH_INVALID_STATE",
-							"OAUTH_PROVIDER_ERROR",
-							"OAUTH_MISSING_ID_TOKEN",
-							"OAUTH_INVALID_PROFILE",
-							"OAUTH_MISSING_VERIFIER",
-							"INVALID_VERIFIER",
-							"INVALID_VERIFICATION_CODE"
-						].includes(getConvexErrorCode(error) ?? "")) return {
-							redirect: false,
-							cookies: [],
-							token: currentCookies.token
-						};
+				const host$1 = canParseUrl(hostCandidate) ? new URL(hostCandidate).host : requestHost;
+				if (!canParseUrl(originHeader)) return true;
+				const originUrl = new URL(originHeader);
+				return originUrl.host !== host$1 || originUrl.protocol !== protocol;
+			})() ? { kind: "invalidOrigin" } : { kind: "valid" };
+			let validationErrorResponse = null;
+			if (requestDispatch.kind === "invalidRoute") validationErrorResponse = new Response("Invalid route", { status: 404 });
+			else if (requestDispatch.kind === "invalidMethod") validationErrorResponse = new Response("Invalid method", { status: 405 });
+			else if (requestDispatch.kind === "invalidOrigin") validationErrorResponse = new Response("Invalid origin", { status: 403 });
+			if (validationErrorResponse !== null) return validationErrorResponse;
+			let body = null;
+			try {
+				const parsed = await request.json();
+				body = typeof parsed === "object" && parsed !== null ? parsed : null;
+			} catch {
+				body = null;
+			}
+			if (body === null) return new Response("Invalid request body", { status: 400 });
+			const action = body.action;
+			const args = typeof body.args === "object" && body.args !== null ? { ...body.args } : {};
+			if (args.refreshToken === null) args.refreshToken = void 0;
+			const actionDispatch = action === "auth:signIn" ? { action: "sessionStart" } : action === "auth:signOut" ? { action: "sessionStop" } : null;
+			if (actionDispatch === null) return new Response("Invalid action", { status: 400 });
+			const host = request.headers.get("host") ?? new URL(request.url).host;
+			const currentCookies = parseAuthCookies(request.headers.get("cookie"), host, cookieNamespace);
+			if (actionDispatch.action === "sessionStart") {
+				let refreshResponse = null;
+				if (args.refreshToken === void 0) refreshResponse = null;
+				else if (currentCookies.refreshToken === null) {
+					const currentToken = currentCookies.token;
+					const decodedToken = currentToken === null ? null : decodeToken(currentToken);
+					if (currentToken !== null && decodedToken?.exp !== void 0 && decodedToken.iss !== void 0 && acceptedIssuers.has(normalizeIssuer(decodedToken.iss)) && decodedToken.exp * 1e3 > Date.now()) refreshResponse = jsonResponse({ tokens: {
+						token: currentToken,
+						refreshToken: "dummy"
+					} });
+					else refreshResponse = jsonResponse({ tokens: null });
+				} else {
+					args.refreshToken = currentCookies.refreshToken ?? void 0;
+					refreshResponse = null;
+				}
+				if (refreshResponse !== null) return refreshResponse;
+				const { client, cookies: effectiveCookies } = await hydrateProxySignInClient(currentCookies, args);
+				try {
+					return toSignInProxyResponse(await runSignIn(client, args), args, effectiveCookies, host);
+				} catch (error) {
+					return appendCookieHeaders(jsonResponse(getProxyErrorBody(error), 400), serializeAuthCookies({
+						token: effectiveCookies.token,
+						refreshToken: effectiveCookies.refreshToken,
+						verifier: null
+					}, host, cookieConfig, cookieNamespace));
+				}
+			} else {
+				try {
+					await runSignOut(currentCookies.token);
+				} catch (error) {
+					log("ERROR", "[convex-auth/server] proxy sign-out failed", error);
+					if (currentCookies.refreshToken !== null) try {
+						const refreshedTokens = extractSignedInTokens(await runSignIn(createClient(), { refreshToken: currentCookies.refreshToken }), "sign-out fallback refresh");
+						if (refreshedTokens !== null) await runSignOut(refreshedTokens.token);
+					} catch (fallbackError) {
+						log("ERROR", "[convex-auth/server] proxy sign-out fallback failed", fallbackError);
+					}
+				}
+				return appendCookieHeaders(jsonResponse(null), serializeAuthCookies({
+					token: null,
+					refreshToken: null,
+					verifier: null
+				}, host, cookieConfig, cookieNamespace));
+			}
+		},
+		async refresh(request) {
+			const createClient = () => new ConvexHttpClient(convexUrl);
+			const logVerbose = (message) => {
+				if (verbose) log("DEBUG", `${(/* @__PURE__ */ new Date()).toISOString()} [convex-auth/server] ${message}`);
+			};
+			const refreshWithToken = async (refreshToken$1) => {
+				try {
+					const tokens$1 = extractSignedInTokens(await createClient().action(signInActionRef, { refreshToken: refreshToken$1 }), "token refresh");
+					logVerbose(`Refreshed tokens, null=${tokens$1 === null}`);
+					return tokens$1;
+				} catch (error) {
+					log("ERROR", "[convex-auth/server] refresh-token exchange failed", error);
+					if (getConvexErrorCode(error) === "INVALID_REFRESH_TOKEN") {
+						logVerbose("Refresh token rejected, clearing auth cookies");
+						return null;
+					}
+					logVerbose("Token refresh failed transiently, keeping current cookies");
+					return;
+				}
+			};
+			const host = request.headers.get("host") ?? new URL(request.url).host;
+			const currentCookies = parseAuthCookies(request.headers.get("cookie"), host, cookieNamespace);
+			const currentToken = currentCookies.token;
+			const originHeader = request.headers.get("origin");
+			const forwardedProtoHeader = request.headers.get("x-forwarded-proto");
+			const protocol = forwardedProtoHeader !== null ? (() => {
+				const forwardedProto = forwardedProtoHeader.split(",")[0]?.trim();
+				if (forwardedProto !== void 0 && forwardedProto.length > 0) return forwardedProto.endsWith(":") ? forwardedProto : `${forwardedProto}:`;
+				return new URL(request.url).protocol;
+			})() : new URL(request.url).protocol;
+			const requestHost = request.headers.get("host") ?? new URL(request.url).host;
+			const hostCandidate = `${protocol}//${requestHost}`;
+			const normalizedHost = canParseUrl(hostCandidate) ? new URL(hostCandidate).host : requestHost;
+			const originUrl = originHeader !== null && canParseUrl(originHeader) ? new URL(originHeader) : null;
+			if (originHeader !== null && (originUrl === null || originUrl.host !== normalizedHost || originUrl.protocol !== protocol)) return {
+				redirect: false,
+				cookies: [],
+				token: null
+			};
+			const requestUrl = new URL(request.url);
+			const code = requestUrl.searchParams.get("code");
+			const shouldHandleCodeOption = options.shouldHandleCode;
+			let shouldHandleCode;
+			if (shouldHandleCodeOption === void 0) shouldHandleCode = true;
+			else if (typeof shouldHandleCodeOption === "function") {
+				const result = shouldHandleCodeOption(request);
+				shouldHandleCode = typeof result === "boolean" ? result : await result;
+			} else shouldHandleCode = shouldHandleCodeOption;
+			let codeExchangeResult = null;
+			if (code !== null && request.method === "GET" && request.headers.get("accept")?.includes("text/html") && shouldHandleCode) {
+				const redirectUrl = new URL(requestUrl.toString());
+				try {
+					const tokens$1 = extractSignedInTokens(await createClient().action(signInActionRef, {
+						params: { code },
+						verifier: currentCookies.verifier ?? void 0
+					}), "code exchange");
+					redirectUrl.searchParams.delete("code");
+					const cookies = structuredAuthCookies({
+						token: tokens$1?.token ?? null,
+						refreshToken: tokens$1?.refreshToken ?? null,
+						verifier: null
+					}, host, cookieConfig, cookieNamespace);
+					codeExchangeResult = {
+						redirect: true,
+						response: buildRedirectResponse(redirectUrl.toString(), cookies)
+					};
+				} catch (error) {
+					log("ERROR", "[convex-auth/server] code exchange failed", error);
+					if (![
+						"OAUTH_INVALID_STATE",
+						"OAUTH_PROVIDER_ERROR",
+						"OAUTH_MISSING_ID_TOKEN",
+						"OAUTH_INVALID_PROFILE",
+						"OAUTH_MISSING_VERIFIER",
+						"INVALID_VERIFIER",
+						"INVALID_VERIFICATION_CODE"
+					].includes(getConvexErrorCode(error) ?? "")) codeExchangeResult = {
+						redirect: false,
+						cookies: [],
+						token: currentCookies.token
+					};
+					else {
 						redirectUrl.searchParams.delete("code");
 						const cookies = structuredAuthCookies({
 							token: currentCookies.token,
 							refreshToken: currentCookies.refreshToken,
 							verifier: null
 						}, host, cookieConfig, cookieNamespace);
-						return {
+						codeExchangeResult = {
 							redirect: true,
 							response: buildRedirectResponse(redirectUrl.toString(), cookies)
 						};
-					})));
-				}), Match.exhaustive);
-				if (codeExchangeResult !== null) return codeExchangeResult;
-				const { token, refreshToken } = currentCookies;
-				if (refreshToken !== null && (refreshToken.trim().length === 0 || refreshToken === "dummy")) {
-					yield* logVerbose("Refresh token cookie malformed, clearing auth cookies");
-					return {
-						redirect: false,
-						cookies: structuredAuthCookies({
-							token: null,
-							refreshToken: null,
-							verifier: null
-						}, host, cookieConfig, cookieNamespace),
-						token: null
-					};
-				}
-				const decodedToken = token === null ? null : yield* decodeToken(token);
-				if (decodedToken?.iss !== void 0 && !acceptedIssuers.has(normalizeIssuer(decodedToken.iss))) {
-					yield* logVerbose("Access token issuer mismatch, clearing auth cookies");
-					return {
-						redirect: false,
-						cookies: structuredAuthCookies({
-							token: null,
-							refreshToken: null,
-							verifier: null
-						}, host, cookieConfig, cookieNamespace),
-						token: null
-					};
+					}
 				}
-				const tokens = yield* Match.value(token === null ? refreshToken === null ? { kind: "none" } : {
-					kind: "refreshOnly",
-					refreshToken
-				} : refreshToken === null ? {
-					kind: "accessOnly",
-					token
-				} : {
-					kind: "both",
-					token,
-					refreshToken
-				}).pipe(Match.when({ kind: "none" }, () => logVerbose("No auth cookies found, skipping refresh").pipe(Effect.as(void 0))), Match.when({ kind: "refreshOnly" }, ({ refreshToken: refreshToken$1 }) => logVerbose("Access token cookie missing, attempting refresh-token recovery").pipe(Effect.andThen(() => refreshWithToken(refreshToken$1)))), Match.when({ kind: "accessOnly" }, () => decodedToken?.exp !== void 0 && decodedToken.iss !== void 0 && acceptedIssuers.has(normalizeIssuer(decodedToken.iss)) && decodedToken.exp * 1e3 > Date.now() ? logVerbose("Refresh token cookie missing but access token still valid").pipe(Effect.as(void 0)) : logVerbose("Refresh token cookie missing and access token invalid, clearing").pipe(Effect.as(null))), Match.when({ kind: "both" }, ({ refreshToken: refreshToken$1 }) => Match.value(decodedToken?.exp === void 0 || decodedToken.iat === void 0 ? { kind: "undecodable" } : {
-					kind: "decoded",
-					decodedToken
-				}).pipe(Match.when({ kind: "undecodable" }, () => logVerbose("Failed to decode access token, attempting refresh-token recovery").pipe(Effect.andThen(() => refreshWithToken(refreshToken$1)))), Match.when({ kind: "decoded" }, ({ decodedToken: decodedToken$1 }) => {
-					const totalTokenLifetimeMs = decodedToken$1.exp * 1e3 - decodedToken$1.iat * 1e3;
-					const minimumExpiration = Date.now() + Math.min(REQUIRED_TOKEN_LIFETIME_MS, Math.max(MINIMUM_REQUIRED_TOKEN_LIFETIME_MS, totalTokenLifetimeMs / 10));
-					return decodedToken$1.exp * 1e3 > minimumExpiration ? logVerbose("Token valid long enough, skipping refresh").pipe(Effect.as(void 0)) : refreshWithToken(refreshToken$1);
-				}), Match.exhaustive)), Match.exhaustive);
-				if (tokens === void 0) return {
+			}
+			if (codeExchangeResult !== null) return codeExchangeResult;
+			const { token, refreshToken } = currentCookies;
+			if (refreshToken !== null && (refreshToken.trim().length === 0 || refreshToken === "dummy")) {
+				logVerbose("Refresh token cookie malformed, clearing auth cookies");
+				return {
 					redirect: false,
-					cookies: [],
-					token: currentToken
+					cookies: structuredAuthCookies({
+						token: null,
+						refreshToken: null,
+						verifier: null
+					}, host, cookieConfig, cookieNamespace),
+					token: null
 				};
+			}
+			const decodedToken = token === null ? null : decodeToken(token);
+			if (decodedToken?.iss !== void 0 && !acceptedIssuers.has(normalizeIssuer(decodedToken.iss))) {
+				logVerbose("Access token issuer mismatch, clearing auth cookies");
 				return {
 					redirect: false,
 					cookies: structuredAuthCookies({
-						token: tokens?.token ?? null,
-						refreshToken: tokens?.refreshToken ?? null,
+						token: null,
+						refreshToken: null,
 						verifier: null
 					}, host, cookieConfig, cookieNamespace),
-					token: tokens?.token ?? null
+					token: null
 				};
-			}));
+			}
+			let tokens;
+			if (token === null && refreshToken === null) {
+				logVerbose("No auth cookies found, skipping refresh");
+				tokens = void 0;
+			} else if (token === null && refreshToken !== null) {
+				logVerbose("Access token cookie missing, attempting refresh-token recovery");
+				tokens = await refreshWithToken(refreshToken);
+			} else if (token !== null && refreshToken === null) if (decodedToken?.exp !== void 0 && decodedToken.iss !== void 0 && acceptedIssuers.has(normalizeIssuer(decodedToken.iss)) && decodedToken.exp * 1e3 > Date.now()) {
+				logVerbose("Refresh token cookie missing but access token still valid");
+				tokens = void 0;
+			} else {
+				logVerbose("Refresh token cookie missing and access token invalid, clearing");
+				tokens = null;
+			}
+			else if (decodedToken?.exp === void 0 || decodedToken.iat === void 0) {
+				logVerbose("Failed to decode access token, attempting refresh-token recovery");
+				tokens = await refreshWithToken(refreshToken);
+			} else {
+				const totalTokenLifetimeMs = decodedToken.exp * 1e3 - decodedToken.iat * 1e3;
+				const minimumExpiration = Date.now() + Math.min(REQUIRED_TOKEN_LIFETIME_MS, Math.max(MINIMUM_REQUIRED_TOKEN_LIFETIME_MS, totalTokenLifetimeMs / 10));
+				if (decodedToken.exp * 1e3 > minimumExpiration) {
+					logVerbose("Token valid long enough, skipping refresh");
+					tokens = void 0;
+				} else tokens = await refreshWithToken(refreshToken);
+			}
+			if (tokens === void 0) return {
+				redirect: false,
+				cookies: [],
+				token: currentToken
+			};
+			return {
+				redirect: false,
+				cookies: structuredAuthCookies({
+					token: tokens?.token ?? null,
+					refreshToken: tokens?.refreshToken ?? null,
+					verifier: null
+				}, host, cookieConfig, cookieNamespace),
+				token: tokens?.token ?? null
+			};
 		}
 	};
 }