@xylex-group/athena 2.0.0 → 2.3.0

package/dist/cookies.js

@@ -0,0 +1,869 @@
+// src/cookies/base64.ts
+function getAtob() {
+  const candidate = globalThis.atob;
+  return typeof candidate === "function" ? candidate : void 0;
+}
+function getBtoa() {
+  const candidate = globalThis.btoa;
+  return typeof candidate === "function" ? candidate : void 0;
+}
+function bytesToBinaryString(bytes) {
+  let result = "";
+  for (const byte of bytes) {
+    result += String.fromCharCode(byte);
+  }
+  return result;
+}
+function binaryStringToBytes(binary) {
+  const bytes = new Uint8Array(binary.length);
+  for (let i = 0; i < binary.length; i++) {
+    bytes[i] = binary.charCodeAt(i);
+  }
+  return bytes;
+}
+function encodeBase64(bytes) {
+  const btoaFn = getBtoa();
+  if (btoaFn) {
+    return btoaFn(bytesToBinaryString(bytes));
+  }
+  return Buffer.from(bytes).toString("base64");
+}
+function decodeBase64(base64) {
+  const atobFn = getAtob();
+  if (atobFn) {
+    return binaryStringToBytes(atobFn(base64));
+  }
+  return new Uint8Array(Buffer.from(base64, "base64"));
+}
+function encodeBytesToBase64Url(bytes) {
+  return encodeBase64(bytes).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+function encodeStringToBase64Url(value) {
+  const bytes = new TextEncoder().encode(value);
+  return encodeBytesToBase64Url(bytes);
+}
+function decodeBase64UrlToBytes(value) {
+  const normalized = value.replace(/-/g, "+").replace(/_/g, "/");
+  const paddingLength = normalized.length % 4;
+  const padded = paddingLength === 0 ? normalized : `${normalized}${"=".repeat(4 - paddingLength)}`;
+  return decodeBase64(padded);
+}
+function decodeBase64UrlToString(value) {
+  return new TextDecoder().decode(decodeBase64UrlToBytes(value));
+}
+
+// src/cookies/cookie-utils.ts
+function tryDecode(str) {
+  if (str.indexOf("%") === -1) {
+    return str;
+  }
+  try {
+    return decodeURIComponent(str);
+  } catch {
+    return str;
+  }
+}
+var SECURE_COOKIE_PREFIX = "__Secure-";
+var HOST_COOKIE_PREFIX = "__Host-";
+function stripSecureCookiePrefix(cookieName) {
+  if (cookieName.startsWith(SECURE_COOKIE_PREFIX)) {
+    return cookieName.slice(SECURE_COOKIE_PREFIX.length);
+  }
+  if (cookieName.startsWith(HOST_COOKIE_PREFIX)) {
+    return cookieName.slice(HOST_COOKIE_PREFIX.length);
+  }
+  return cookieName;
+}
+function splitSetCookieHeader(setCookie) {
+  if (!setCookie) {
+    return [];
+  }
+  const result = [];
+  let start = 0;
+  let i = 0;
+  while (i < setCookie.length) {
+    if (setCookie[i] === ",") {
+      let j = i + 1;
+      while (j < setCookie.length && setCookie[j] === " ") {
+        j++;
+      }
+      while (j < setCookie.length && setCookie[j] !== "=" && setCookie[j] !== ";" && setCookie[j] !== ",") {
+        j++;
+      }
+      if (j < setCookie.length && setCookie[j] === "=") {
+        const part = setCookie.slice(start, i).trim();
+        if (part) {
+          result.push(part);
+        }
+        start = i + 1;
+        while (start < setCookie.length && setCookie[start] === " ") {
+          start++;
+        }
+        i = start;
+        continue;
+      }
+    }
+    i++;
+  }
+  const last = setCookie.slice(start).trim();
+  if (last) {
+    result.push(last);
+  }
+  return result;
+}
+function parseSetCookieHeader(setCookie) {
+  const cookies = /* @__PURE__ */ new Map();
+  const cookieArray = splitSetCookieHeader(setCookie);
+  for (const cookieString of cookieArray) {
+    const parts = cookieString.split(";").map((part) => part.trim());
+    const [nameValue, ...attributes] = parts;
+    const [name, ...valueParts] = (nameValue || "").split("=");
+    if (!name) {
+      continue;
+    }
+    const value = unquoteCookieValue(valueParts.join("="));
+    const decodedValue = tryDecode(value);
+    const attrObj = { value: decodedValue };
+    for (const attribute of attributes) {
+      const [attrName, ...attrValueParts] = attribute.split("=");
+      const attrValue = attrValueParts.join("=");
+      const normalizedAttrName = attrName.trim().toLowerCase();
+      switch (normalizedAttrName) {
+        case "max-age":
+          attrObj["max-age"] = attrValue ? parseInt(attrValue.trim(), 10) : void 0;
+          break;
+        case "expires":
+          attrObj.expires = attrValue ? new Date(attrValue.trim()) : void 0;
+          break;
+        case "domain":
+          attrObj.domain = attrValue ? attrValue.trim() : void 0;
+          break;
+        case "path":
+          attrObj.path = attrValue ? attrValue.trim() : void 0;
+          break;
+        case "secure":
+          attrObj.secure = true;
+          break;
+        case "httponly":
+          attrObj.httponly = true;
+          break;
+        case "samesite":
+          attrObj.samesite = attrValue ? attrValue.trim().toLowerCase() : void 0;
+          break;
+        case "partitioned":
+          attrObj.partitioned = true;
+          break;
+        default:
+          attrObj[normalizedAttrName] = attrValue ? attrValue.trim() : true;
+          break;
+      }
+    }
+    cookies.set(name, attrObj);
+  }
+  return cookies;
+}
+function toCookieOptions(attributes) {
+  return {
+    maxAge: attributes["max-age"],
+    expires: attributes.expires,
+    domain: attributes.domain,
+    path: attributes.path,
+    secure: attributes.secure,
+    httpOnly: attributes.httponly,
+    sameSite: attributes.samesite,
+    partitioned: attributes.partitioned
+  };
+}
+var cookieNameRegex = /^[\w!#$%&'*.^`|~+-]+$/;
+function unquoteCookieValue(value) {
+  if (value.length < 2 || !value.startsWith('"') || !value.endsWith('"')) {
+    return value;
+  }
+  return value.slice(1, -1);
+}
+function parseCookies(cookieHeader) {
+  const cookies = cookieHeader.split("; ");
+  const cookieMap = /* @__PURE__ */ new Map();
+  cookies.forEach((cookie) => {
+    const [name, value] = cookie.split(/=(.*)/s);
+    cookieMap.set(name, value);
+  });
+  return cookieMap;
+}
+function setRequestCookie(headers, name, value) {
+  const cookieMap = parseCookies(headers.get("cookie") || "");
+  if (cookieNameRegex.test(name)) {
+    cookieMap.set(name, value);
+  }
+  headers.set(
+    "cookie",
+    Array.from(cookieMap, ([key, currentValue]) => `${key}=${encodeURIComponent(currentValue)}`).join("; ")
+  );
+}
+function applySetCookies(target, setCookieValues) {
+  const cookieMap = parseCookies(target.get("cookie") || "");
+  for (const setCookie of setCookieValues) {
+    for (const [name, attr] of parseSetCookieHeader(setCookie)) {
+      if (cookieNameRegex.test(name)) {
+        cookieMap.set(name, attr.value);
+      }
+    }
+  }
+  target.set(
+    "cookie",
+    Array.from(cookieMap, ([key, currentValue]) => `${key}=${encodeURIComponent(currentValue)}`).join("; ")
+  );
+}
+function setCookieToHeader(headers) {
+  return (context) => {
+    const setCookieHeader = context.response.headers.get("set-cookie");
+    if (!setCookieHeader) {
+      return;
+    }
+    applySetCookies(headers, [setCookieHeader]);
+  };
+}
+
+// src/cookies/crypto.ts
+var HS256_ALG = "HS256";
+async function getSubtleCrypto() {
+  const globalCrypto = globalThis.crypto;
+  if (globalCrypto?.subtle) {
+    return globalCrypto.subtle;
+  }
+  const { webcrypto } = await import('crypto');
+  const subtle = webcrypto.subtle;
+  if (!subtle) {
+    throw new Error("Web Crypto subtle API is unavailable.");
+  }
+  return subtle;
+}
+async function importHmacKey(secret, usage) {
+  const subtle = await getSubtleCrypto();
+  return subtle.importKey(
+    "raw",
+    new TextEncoder().encode(secret),
+    {
+      name: "HMAC",
+      hash: "SHA-256"
+    },
+    false,
+    [usage]
+  );
+}
+function bufferToBytes(buffer) {
+  return new Uint8Array(buffer);
+}
+function parseJwtPayload(payloadSegment) {
+  try {
+    const decoded = decodeBase64UrlToString(payloadSegment);
+    const payload = JSON.parse(decoded);
+    if (!payload || typeof payload !== "object") {
+      return null;
+    }
+    return payload;
+  } catch {
+    return null;
+  }
+}
+function isJwtExpired(payload) {
+  const exp = payload.exp;
+  if (typeof exp !== "number") {
+    return false;
+  }
+  return exp < Math.floor(Date.now() / 1e3);
+}
+async function signHmacBase64Url(secret, value) {
+  const subtle = await getSubtleCrypto();
+  const key = await importHmacKey(secret, "sign");
+  const signature = await subtle.sign("HMAC", key, new TextEncoder().encode(value));
+  return encodeBytesToBase64Url(bufferToBytes(signature));
+}
+async function signJwtHS256(payload, secret, expiresIn = 60 * 5) {
+  const now = Math.floor(Date.now() / 1e3);
+  const header = { alg: HS256_ALG, typ: "JWT" };
+  const fullPayload = {
+    ...payload,
+    iat: now,
+    exp: now + expiresIn
+  };
+  const headerPart = encodeStringToBase64Url(JSON.stringify(header));
+  const payloadPart = encodeStringToBase64Url(JSON.stringify(fullPayload));
+  const message = `${headerPart}.${payloadPart}`;
+  const signature = await signHmacBase64Url(secret, message);
+  return `${message}.${signature}`;
+}
+async function verifyJwtHS256(token, secret) {
+  const parts = token.split(".");
+  if (parts.length !== 3) {
+    return null;
+  }
+  const [headerPart, payloadPart, signaturePart] = parts;
+  if (!headerPart || !payloadPart || !signaturePart) {
+    return null;
+  }
+  let header = null;
+  try {
+    header = JSON.parse(decodeBase64UrlToString(headerPart));
+  } catch {
+    return null;
+  }
+  if (!header || header.alg !== HS256_ALG) {
+    return null;
+  }
+  const payload = parseJwtPayload(payloadPart);
+  if (!payload) {
+    return null;
+  }
+  const expectedSignature = await signHmacBase64Url(secret, `${headerPart}.${payloadPart}`);
+  if (expectedSignature !== signaturePart) {
+    return null;
+  }
+  if (isJwtExpired(payload)) {
+    return null;
+  }
+  return payload;
+}
+
+// src/cookies/session-store.ts
+var ALLOWED_COOKIE_SIZE = 4096;
+var ESTIMATED_EMPTY_COOKIE_SIZE = 200;
+var CHUNK_SIZE = ALLOWED_COOKIE_SIZE - ESTIMATED_EMPTY_COOKIE_SIZE;
+function getChunkIndex(cookieName) {
+  const parts = cookieName.split(".");
+  const lastPart = parts[parts.length - 1];
+  const index = parseInt(lastPart || "0", 10);
+  return Number.isNaN(index) ? 0 : index;
+}
+function readExistingChunks(cookieName, ctx) {
+  const chunks = {};
+  const cookies = parseCookies(ctx.headers?.get("cookie") || "");
+  for (const [name, value] of cookies) {
+    if (name.startsWith(cookieName)) {
+      chunks[name] = value;
+    }
+  }
+  return chunks;
+}
+function joinChunks(chunks) {
+  const sortedKeys = Object.keys(chunks).sort((left, right) => getChunkIndex(left) - getChunkIndex(right));
+  return sortedKeys.map((key) => chunks[key]).join("");
+}
+function chunkCookie(storeName, cookie, chunks, ctx) {
+  const chunkCount = Math.ceil(cookie.value.length / CHUNK_SIZE);
+  if (chunkCount === 1) {
+    chunks[cookie.name] = cookie.value;
+    return [cookie];
+  }
+  const cookies = [];
+  for (let index = 0; index < chunkCount; index++) {
+    const name = `${cookie.name}.${index}`;
+    const start = index * CHUNK_SIZE;
+    const value = cookie.value.substring(start, start + CHUNK_SIZE);
+    cookies.push({
+      ...cookie,
+      name,
+      value
+    });
+    chunks[name] = value;
+  }
+  ctx.logger?.debug?.(`CHUNKING_${storeName.toUpperCase()}_COOKIE`, {
+    message: `${storeName} cookie exceeds allowed ${ALLOWED_COOKIE_SIZE} bytes.`,
+    emptyCookieSize: ESTIMATED_EMPTY_COOKIE_SIZE,
+    valueSize: cookie.value.length,
+    chunkCount,
+    chunks: cookies.map((entry) => entry.value.length + ESTIMATED_EMPTY_COOKIE_SIZE)
+  });
+  return cookies;
+}
+function getCleanCookies(chunks, cookieOptions) {
+  const cleanedChunks = {};
+  for (const name in chunks) {
+    cleanedChunks[name] = {
+      name,
+      value: "",
+      attributes: {
+        ...cookieOptions,
+        maxAge: 0
+      }
+    };
+  }
+  return cleanedChunks;
+}
+var storeFactory = (storeName) => (cookieName, cookieOptions, ctx) => {
+  const chunks = readExistingChunks(cookieName, ctx);
+  return {
+    getValue() {
+      return joinChunks(chunks);
+    },
+    hasChunks() {
+      return Object.keys(chunks).length > 0;
+    },
+    chunk(value, options) {
+      const cleanedChunks = getCleanCookies(chunks, cookieOptions);
+      for (const name in chunks) {
+        delete chunks[name];
+      }
+      const cookies = cleanedChunks;
+      const chunked = chunkCookie(
+        storeName,
+        {
+          name: cookieName,
+          value,
+          attributes: {
+            ...cookieOptions,
+            ...options
+          }
+        },
+        chunks,
+        ctx
+      );
+      for (const chunk of chunked) {
+        cookies[chunk.name] = chunk;
+      }
+      return Object.values(cookies);
+    },
+    clean() {
+      const cleanedChunks = getCleanCookies(chunks, cookieOptions);
+      for (const name in chunks) {
+        delete chunks[name];
+      }
+      return Object.values(cleanedChunks);
+    },
+    setCookies(cookies) {
+      for (const cookie of cookies) {
+        ctx.setCookie(cookie.name, cookie.value, cookie.attributes);
+      }
+    }
+  };
+};
+var createSessionStore = storeFactory("Session");
+var createAccountStore = storeFactory("Account");
+function getChunkedCookie(ctx, cookieName) {
+  const value = ctx.getCookie?.(cookieName);
+  if (value) {
+    return value;
+  }
+  const chunks = [];
+  const cookieHeader = ctx.headers?.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  for (const [name, parsedValue] of parseCookies(cookieHeader)) {
+    if (!name.startsWith(`${cookieName}.`)) {
+      continue;
+    }
+    const parts = name.split(".");
+    const indexStr = parts.at(-1);
+    const index = parseInt(indexStr || "0", 10);
+    if (!Number.isNaN(index)) {
+      chunks.push({ index, value: parsedValue });
+    }
+  }
+  if (chunks.length === 0) {
+    return null;
+  }
+  chunks.sort((left, right) => left.index - right.index);
+  return chunks.map((entry) => entry.value).join("");
+}
+async function getAccountCookie(ctx, cookieName = ctx.context.authCookies.accountData.name) {
+  const value = getChunkedCookie(ctx, cookieName);
+  if (!value) {
+    return null;
+  }
+  try {
+    return JSON.parse(value);
+  } catch {
+  }
+  try {
+    return JSON.parse(decodeBase64UrlToString(value));
+  } catch {
+    return value;
+  }
+}
+
+// src/cookies/index.ts
+var DEFAULT_COOKIE_PREFIX = "athena-auth";
+var LEGACY_COOKIE_PREFIX = "better-auth";
+var DEFAULT_SESSION_MAX_AGE = 7 * 24 * 60 * 60;
+var DEFAULT_CACHE_MAX_AGE = 60 * 5;
+function isProductionRuntime() {
+  return typeof process !== "undefined" && process.env?.NODE_ENV === "production";
+}
+function getEnvironmentSecret() {
+  if (typeof process === "undefined") {
+    return void 0;
+  }
+  return process.env?.ATHENA_AUTH_SECRET || process.env?.BETTER_AUTH_SECRET || process.env?.AUTH_SECRET;
+}
+function isDynamicBaseURLConfig(baseURL) {
+  return typeof baseURL === "object" && baseURL !== null && "allowedHosts" in baseURL && Array.isArray(baseURL.allowedHosts);
+}
+function resolveCookiePrefixes(primaryPrefix) {
+  const prefixes = [primaryPrefix];
+  if (!prefixes.includes(DEFAULT_COOKIE_PREFIX)) {
+    prefixes.push(DEFAULT_COOKIE_PREFIX);
+  }
+  if (!prefixes.includes(LEGACY_COOKIE_PREFIX)) {
+    prefixes.push(LEGACY_COOKIE_PREFIX);
+  }
+  return prefixes;
+}
+function createError(message) {
+  return new Error(`@xylex-group/athena/cookies: ${message}`);
+}
+function getSecretOrThrow(secret) {
+  const resolved = secret || getEnvironmentSecret();
+  if (!resolved) {
+    throw createError(
+      "getCookieCache requires a secret. Pass `secret` or set ATHENA_AUTH_SECRET/BETTER_AUTH_SECRET/AUTH_SECRET."
+    );
+  }
+  return resolved;
+}
+function asObject(value) {
+  if (!value || typeof value !== "object") {
+    return null;
+  }
+  return value;
+}
+function getSessionTokenFromPair(session) {
+  const token = session.session?.token;
+  if (typeof token !== "string" || token.length === 0) {
+    throw createError("setSessionCookie requires `session.session.token` to be a non-empty string.");
+  }
+  return token;
+}
+async function resolveCookieVersion(versionConfig, session, user) {
+  if (!versionConfig) {
+    return "1";
+  }
+  if (typeof versionConfig === "string") {
+    return versionConfig;
+  }
+  return versionConfig(session, user);
+}
+function getSessionCookieCacheName(cookiePrefix, cookieName, isSecure) {
+  return isSecure ? `${SECURE_COOKIE_PREFIX}${cookiePrefix}.${cookieName}` : `${cookiePrefix}.${cookieName}`;
+}
+async function setCookieValue(ctx, name, value, attributes) {
+  const secret = ctx.context.secret;
+  if (secret && typeof ctx.setSignedCookie === "function") {
+    await ctx.setSignedCookie(name, value, secret, attributes);
+    return;
+  }
+  ctx.setCookie(name, value, attributes);
+}
+function parseJsonSafely(value) {
+  try {
+    return JSON.parse(value);
+  } catch {
+    return null;
+  }
+}
+function getIsSecureCookie(config) {
+  if (config?.isSecure !== void 0) {
+    return config.isSecure;
+  }
+  return isProductionRuntime();
+}
+function createCookieGetter(options) {
+  const baseURLString = typeof options.baseURL === "string" ? options.baseURL : void 0;
+  const dynamicProtocol = typeof options.baseURL === "object" && options.baseURL !== null ? options.baseURL.protocol : void 0;
+  const secure = options.advanced?.useSecureCookies !== void 0 ? options.advanced.useSecureCookies : dynamicProtocol === "https" ? true : dynamicProtocol === "http" ? false : baseURLString ? baseURLString.startsWith("https://") : isProductionRuntime();
+  const secureCookiePrefix = secure ? SECURE_COOKIE_PREFIX : "";
+  const crossSubdomainEnabled = !!options.advanced?.crossSubDomainCookies?.enabled;
+  const domain = crossSubdomainEnabled ? options.advanced?.crossSubDomainCookies?.domain || (baseURLString ? new URL(baseURLString).hostname : void 0) : void 0;
+  if (crossSubdomainEnabled && !domain && !isDynamicBaseURLConfig(options.baseURL)) {
+    throw createError("baseURL is required when `crossSubDomainCookies.enabled` is true.");
+  }
+  function createCookie(cookieName, overrideAttributes = {}) {
+    const prefix = options.advanced?.cookiePrefix || DEFAULT_COOKIE_PREFIX;
+    const name = options.advanced?.cookies?.[cookieName]?.name || `${prefix}.${cookieName}`;
+    const attributes = options.advanced?.cookies?.[cookieName]?.attributes || {};
+    return {
+      name: `${secureCookiePrefix}${name}`,
+      attributes: {
+        secure: !!secureCookiePrefix,
+        sameSite: "lax",
+        path: "/",
+        httpOnly: true,
+        ...crossSubdomainEnabled ? { domain } : {},
+        ...options.advanced?.defaultCookieAttributes,
+        ...overrideAttributes,
+        ...attributes
+      }
+    };
+  }
+  return createCookie;
+}
+function getCookies(options) {
+  const createCookie = createCookieGetter(options);
+  const sessionToken = createCookie("session_token", { maxAge: options.session?.expiresIn || DEFAULT_SESSION_MAX_AGE });
+  const sessionData = createCookie("session_data", { maxAge: options.session?.cookieCache?.maxAge || DEFAULT_CACHE_MAX_AGE });
+  const accountData = createCookie("account_data", { maxAge: options.session?.cookieCache?.maxAge || DEFAULT_CACHE_MAX_AGE });
+  const dontRememberToken = createCookie("dont_remember");
+  return {
+    sessionToken: {
+      name: sessionToken.name,
+      attributes: sessionToken.attributes
+    },
+    sessionData: {
+      name: sessionData.name,
+      attributes: sessionData.attributes
+    },
+    dontRememberToken: {
+      name: dontRememberToken.name,
+      attributes: dontRememberToken.attributes
+    },
+    accountData: {
+      name: accountData.name,
+      attributes: accountData.attributes
+    }
+  };
+}
+async function setCookieCache(ctx, session, dontRememberMe) {
+  const cookieCacheConfig = ctx.context.options?.session?.cookieCache;
+  if (!cookieCacheConfig?.enabled) {
+    return;
+  }
+  const version = await resolveCookieVersion(
+    cookieCacheConfig.version,
+    session.session,
+    session.user
+  );
+  const sessionData = {
+    session: session.session,
+    user: session.user,
+    updatedAt: Date.now(),
+    version
+  };
+  const baseAttributes = ctx.context.authCookies.sessionData.attributes;
+  const maxAge = dontRememberMe ? void 0 : baseAttributes.maxAge;
+  const options = {
+    ...baseAttributes,
+    maxAge
+  };
+  const expiresAt = Date.now() + (options.maxAge || 60) * 1e3;
+  const strategy = cookieCacheConfig.strategy || "compact";
+  const secret = getSecretOrThrow(ctx.context.secret);
+  let encoded;
+  if (strategy === "jwt") {
+    encoded = await signJwtHS256(sessionData, secret, options.maxAge || DEFAULT_CACHE_MAX_AGE);
+  } else if (strategy === "jwe") {
+    throw createError("`jwe` strategy is not supported by the SDK cookie helper.");
+  } else {
+    const signature = await signHmacBase64Url(
+      secret,
+      JSON.stringify({
+        ...sessionData,
+        expiresAt
+      })
+    );
+    encoded = encodeStringToBase64Url(
+      JSON.stringify({
+        session: sessionData,
+        expiresAt,
+        signature
+      })
+    );
+  }
+  if (encoded.length > 4093) {
+    const store = createSessionStore(ctx.context.authCookies.sessionData.name, options, ctx);
+    const cookies = store.chunk(encoded, options);
+    store.setCookies(cookies);
+  } else {
+    const store = createSessionStore(ctx.context.authCookies.sessionData.name, options, ctx);
+    if (store.hasChunks()) {
+      store.setCookies(store.clean());
+    }
+    ctx.setCookie(ctx.context.authCookies.sessionData.name, encoded, options);
+  }
+}
+async function setSessionCookie(ctx, session, dontRememberMe, overrides) {
+  if (dontRememberMe === void 0 && typeof ctx.getSignedCookie === "function" && ctx.context.secret) {
+    const existingFlag = await ctx.getSignedCookie(ctx.context.authCookies.dontRememberToken.name, ctx.context.secret);
+    dontRememberMe = !!existingFlag;
+  }
+  const resolvedDontRememberMe = dontRememberMe ?? false;
+  const token = getSessionTokenFromPair(session);
+  const options = ctx.context.authCookies.sessionToken.attributes;
+  const maxAge = resolvedDontRememberMe ? void 0 : ctx.context.sessionConfig?.expiresIn;
+  await setCookieValue(ctx, ctx.context.authCookies.sessionToken.name, token, {
+    ...options,
+    maxAge,
+    ...overrides
+  });
+  if (resolvedDontRememberMe) {
+    await setCookieValue(
+      ctx,
+      ctx.context.authCookies.dontRememberToken.name,
+      "true",
+      ctx.context.authCookies.dontRememberToken.attributes
+    );
+  }
+  await setCookieCache(ctx, session, resolvedDontRememberMe);
+  ctx.context.setNewSession?.(session);
+}
+function expireCookie(ctx, cookie) {
+  ctx.setCookie(cookie.name, "", {
+    ...cookie.attributes,
+    maxAge: 0
+  });
+}
+function deleteSessionCookie(ctx, skipDontRememberMe) {
+  expireCookie(ctx, ctx.context.authCookies.sessionToken);
+  expireCookie(ctx, ctx.context.authCookies.sessionData);
+  if (ctx.context.options?.account?.storeAccountCookie) {
+    expireCookie(ctx, ctx.context.authCookies.accountData);
+    const accountStore = createAccountStore(
+      ctx.context.authCookies.accountData.name,
+      ctx.context.authCookies.accountData.attributes,
+      ctx
+    );
+    accountStore.setCookies(accountStore.clean());
+  }
+  const sessionStore = createSessionStore(
+    ctx.context.authCookies.sessionData.name,
+    ctx.context.authCookies.sessionData.attributes,
+    ctx
+  );
+  sessionStore.setCookies(sessionStore.clean());
+  if (!skipDontRememberMe) {
+    expireCookie(ctx, ctx.context.authCookies.dontRememberToken);
+  }
+}
+var getSessionCookie = (request, config) => {
+  const cookies = (request instanceof Headers || !("headers" in request) ? request : request.headers).get("cookie");
+  if (!cookies) {
+    return null;
+  }
+  const { cookieName = "session_token", cookiePrefix = "athena-auth" } = config || {};
+  const parsedCookie = parseCookies(cookies);
+  const getCookie = (name) => parsedCookie.get(name) || parsedCookie.get(`${SECURE_COOKIE_PREFIX}${name}`);
+  const sessionToken = getCookie(`${cookiePrefix}.${cookieName}`) || getCookie(`${cookiePrefix}-${cookieName}`);
+  if (sessionToken) {
+    return sessionToken;
+  }
+  return null;
+};
+var getCookieCache = async (request, config) => {
+  const headers = request instanceof Headers || !("headers" in request) ? request : request.headers;
+  const cookieHeader = headers.get("cookie");
+  if (!cookieHeader) {
+    return null;
+  }
+  const parsedCookie = parseCookies(cookieHeader);
+  const cookieName = config?.cookieName || "session_data";
+  const requestedPrefix = config?.cookiePrefix || DEFAULT_COOKIE_PREFIX;
+  const strategy = config?.strategy || "compact";
+  const cookiePrefixes = resolveCookiePrefixes(requestedPrefix);
+  const isSecure = getIsSecureCookie(config);
+  const secret = getSecretOrThrow(config?.secret);
+  let sessionData;
+  for (const prefix of cookiePrefixes) {
+    const candidate = getSessionCookieCacheName(prefix, cookieName, isSecure);
+    const cookieValue = parsedCookie.get(candidate);
+    if (cookieValue) {
+      sessionData = cookieValue;
+      break;
+    }
+  }
+  if (!sessionData) {
+    const reconstructedChunks = [];
+    for (const prefix of cookiePrefixes) {
+      const candidate = getSessionCookieCacheName(prefix, cookieName, isSecure);
+      for (const [name, value] of parsedCookie.entries()) {
+        if (!name.startsWith(`${candidate}.`)) {
+          continue;
+        }
+        const parts = name.split(".");
+        const indexStr = parts[parts.length - 1];
+        const index = parseInt(indexStr || "0", 10);
+        if (!Number.isNaN(index)) {
+          reconstructedChunks.push({ index, value });
+        }
+      }
+      if (reconstructedChunks.length > 0) {
+        break;
+      }
+    }
+    if (reconstructedChunks.length > 0) {
+      reconstructedChunks.sort((left, right) => left.index - right.index);
+      sessionData = reconstructedChunks.map((chunk) => chunk.value).join("");
+    }
+  }
+  if (!sessionData) {
+    return null;
+  }
+  if (strategy === "jwe") {
+    throw createError(
+      "`jwe` strategy is not supported by the SDK cookie helper. Use compact/jwt or pass cookie data through the auth server."
+    );
+  }
+  if (strategy === "jwt") {
+    const payload = await verifyJwtHS256(sessionData, secret);
+    if (!payload) {
+      return null;
+    }
+    const sessionRecord = asObject(payload.session);
+    const userRecord = asObject(payload.user);
+    const updatedAt = payload.updatedAt;
+    if (!sessionRecord || !userRecord || typeof updatedAt !== "number") {
+      return null;
+    }
+    if (config?.version) {
+      const cookieVersion = typeof payload.version === "string" ? payload.version : "1";
+      const expectedVersion = typeof config.version === "string" ? config.version : await config.version(sessionRecord, userRecord);
+      if (cookieVersion !== expectedVersion) {
+        return null;
+      }
+    }
+    return {
+      session: sessionRecord,
+      user: userRecord,
+      updatedAt,
+      version: typeof payload.version === "string" ? payload.version : void 0
+    };
+  }
+  const compactPayload = parseJsonSafely(decodeBase64UrlToString(sessionData));
+  if (!compactPayload) {
+    return null;
+  }
+  const expectedSignature = await signHmacBase64Url(
+    secret,
+    JSON.stringify({
+      ...compactPayload.session,
+      expiresAt: compactPayload.expiresAt
+    })
+  );
+  if (expectedSignature !== compactPayload.signature) {
+    return null;
+  }
+  if (compactPayload.expiresAt <= Date.now()) {
+    return null;
+  }
+  const resolvedSession = compactPayload.session;
+  if (config?.version) {
+    const cookieVersion = resolvedSession.version || "1";
+    const expectedVersion = typeof config.version === "string" ? config.version : await config.version(resolvedSession.session, resolvedSession.user);
+    if (cookieVersion !== expectedVersion) {
+      return null;
+    }
+  }
+  const sessionObject = asObject(resolvedSession.session);
+  const userObject = asObject(resolvedSession.user);
+  if (!sessionObject || !userObject) {
+    return null;
+  }
+  return {
+    session: sessionObject,
+    user: userObject,
+    updatedAt: resolvedSession.updatedAt,
+    version: resolvedSession.version
+  };
+};
+
+export { HOST_COOKIE_PREFIX, SECURE_COOKIE_PREFIX, createCookieGetter, createSessionStore, deleteSessionCookie, expireCookie, getAccountCookie, getChunkedCookie, getCookieCache, getCookies, getSessionCookie, parseCookies, parseSetCookieHeader, setCookieCache, setCookieToHeader, setRequestCookie, setSessionCookie, splitSetCookieHeader, stripSecureCookiePrefix, toCookieOptions };
+//# sourceMappingURL=cookies.js.map
+//# sourceMappingURL=cookies.js.map