alepha 0.23.0 → 0.24.0

package/dist/server/cookies/index.browser.js

@@ -1,4 +1,4 @@
-import { $inject, $module, Alepha, AlephaError, KIND, Primitive, createPrimitive } from "alepha";
+import { $hook, $inject, $module, Alepha, AlephaError, KIND, Primitive, createPrimitive } from "alepha";
 import { AlephaServer } from "alepha/server";
 import { DateTimeProvider } from "alepha/datetime";
 //#region ../../src/server/cookies/services/CookieParser.ts
@@ -32,7 +32,7 @@ var CookieParser = class {
 		const parts = [];
 		parts.push(`${name}=${cookie.value}`);
 		if (cookie.path) parts.push(`Path=${cookie.path}`);
-		if (cookie.maxAge) parts.push(`Max-Age=${cookie.maxAge}`);
+		if (cookie.maxAge != null) parts.push(`Max-Age=${cookie.maxAge}`);
 		if (cookie.secure !== false && isHttps) parts.push("Secure");
 		if (cookie.httpOnly) parts.push("HttpOnly");
 		if (cookie.sameSite) parts.push(`SameSite=${cookie.sameSite}`);
@@ -41,6 +41,100 @@ var CookieParser = class {
 	}
 };
 //#endregion
+//#region ../../src/server/cookies/providers/AtomCookiePersistence.browser.ts
+/**
+* Browser variant of AtomCookiePersistence: reads `document.cookie` for every
+* `persist: "cookie"` atom, and writes it back on every mutation.
+*
+* Like the server variant, atoms are resolved from the `StateManager`
+* registry (`alepha.store.listAtoms()`) rather than from a map fed by
+* `state:register` — that event fires once, is never replayed, and
+* `$module.register()` registers `atoms[]` before the module's `services[]`
+* exist, so an event-sourced map would miss every atom declared the
+* documented way. The `configure` hook sweeps everything registered up to
+* boot; `state:register` covers atoms that first register later (lazily, on
+* first read).
+*
+* Cookie names are NOT APP_NAME-prefixed here, because `APP_NAME` is not
+* reachable in the browser: `BuildClientTask` only `define`s
+* `process.env.NODE_ENV` for the client bundle, and the SSR hydration
+* payload (`ReactServerTemplateProvider.buildHydrationData`) only carries
+* registered atom values + router layers — never the raw `env` store key.
+* The server variant (`AtomCookiePersistence.ts`) matches this by passing
+* `prefix: false` to `ServerCookiesProvider`, specifically for atom-cookie
+* traffic — every other server cookie ($cookie primitive) still gets the
+* APP_NAME namespace. See `ServerCookiesProvider.prefixName`.
+*/
+var AtomCookiePersistence = class {
+	alepha = $inject(Alepha);
+	cookieParser = $inject(CookieParser);
+	dateTime = $inject(DateTimeProvider);
+	onConfigure = $hook({
+		on: "configure",
+		handler: () => {
+			for (const atom of this.cookieAtoms()) this.read(atom);
+		}
+	});
+	onRegister = $hook({
+		on: "state:register",
+		handler: ({ atom }) => {
+			if (atom.options.persist !== "cookie") return;
+			this.read(atom);
+		}
+	});
+	onMutate = $hook({
+		on: "state:mutate",
+		handler: ({ key, value }) => {
+			const atom = this.alepha.store.getAtom(String(key));
+			if (!atom || atom.options.persist !== "cookie") return;
+			if (value === void 0) {
+				this.clearCookie(atom.key);
+				return;
+			}
+			const cookie = {
+				value: encodeURIComponent(JSON.stringify(value)),
+				path: "/",
+				sameSite: "lax",
+				maxAge: this.dateTime.duration([365, "days"]).as("seconds")
+			};
+			document.cookie = this.cookieParser.cookieToString(atom.key, cookie);
+		}
+	});
+	/**
+	* Every registered atom declared with `persist: "cookie"`, read live from
+	* the state manager's registry.
+	*/
+	cookieAtoms() {
+		return this.alepha.store.listAtoms().filter((atom) => atom.options.persist === "cookie");
+	}
+	/**
+	* Seed an atom's state from `document.cookie`, if a cookie exists for it.
+	* Idempotent: re-reading an atom that already holds the cookie's value is
+	* a no-op write of the same data.
+	*/
+	read(atom) {
+		const raw = this.cookieParser.parseRequestCookies(document.cookie)[atom.key];
+		if (!raw) return;
+		try {
+			this.alepha.store.set(atom.key, JSON.parse(decodeURIComponent(raw)), { skipEvents: true });
+		} catch {
+			this.clearCookie(atom.key);
+		}
+	}
+	/**
+	* Expire a cookie immediately, mirroring
+	* `ServerCookiesProvider.deleteCookie`'s `Max-Age=0` semantics.
+	*/
+	clearCookie(name) {
+		document.cookie = this.cookieParser.cookieToString(name, {
+			value: "",
+			path: "/",
+			sameSite: "lax",
+			maxAge: 0
+		});
+	}
+};
+//#endregion
 //#region ../../src/server/cookies/primitives/$cookie.browser.ts
 /**
 * Creates a browser-side cookie primitive for client-side cookie management.
@@ -56,7 +150,7 @@ var CookieParser = class {
 * class ClientCookies {
 *   preferences = $cookie({
 *     name: "user-prefs",
-*     schema: t.object({ theme: t.text(), language: t.text() }),
+*     schema: z.object({ theme: z.text(), language: z.text() }),
 *     ttl: [30, "days"]
 *   });
 *
@@ -148,9 +242,13 @@ $cookie[KIND] = BrowserCookiePrimitive;
 const AlephaServerCookies = $module({
 	name: "alepha.server.cookies",
 	primitives: [],
-	services: [AlephaServer]
+	services: [
+		AlephaServer,
+		CookieParser,
+		AtomCookiePersistence
+	]
 });
 //#endregion
-export { $cookie, AlephaServerCookies, BrowserCookiePrimitive };
+export { $cookie, AlephaServerCookies, AtomCookiePersistence, BrowserCookiePrimitive };
 
 //# sourceMappingURL=index.browser.js.map

package/dist/server/cookies/index.browser.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.browser.js","names":[],"sources":["../../../src/server/cookies/services/CookieParser.ts","../../../src/server/cookies/primitives/$cookie.browser.ts","../../../src/server/cookies/index.browser.ts"],"sourcesContent":["import type { Cookie } from \"../primitives/$cookie.ts\";\n\nexport class CookieParser {\n  public parseRequestCookies(header: string): Record<string, string> {\n    const cookies: Record<string, string> = {};\n    const parts = header.split(\";\");\n    for (const part of parts) {\n      const eqIndex = part.indexOf(\"=\");\n      if (eqIndex === -1) {\n        continue;\n      }\n\n      const key = part.slice(0, eqIndex).trim();\n      const value = part.slice(eqIndex + 1).trim();\n\n      if (!key || !value) {\n        continue;\n      }\n\n      cookies[key] = value;\n    }\n\n    return cookies;\n  }\n\n  public serializeResponseCookies(\n    cookies: Record<string, Cookie | null>,\n    isHttps: boolean,\n  ): string[] {\n    const headers = [];\n\n    for (const [name, cookie] of Object.entries(cookies)) {\n      // If the cookie is null, we need to delete it\n      if (cookie == null) {\n        headers.push(`${name}=; Path=/; Max-Age=0`);\n        continue;\n      }\n\n      if (!cookie.value) {\n        continue;\n      }\n\n      headers.push(this.cookieToString(name, cookie, isHttps));\n    }\n\n    return headers;\n  }\n\n  public cookieToString(\n    name: string,\n    cookie: Cookie,\n    isHttps?: boolean,\n  ): string {\n    const parts: string[] = [];\n\n    parts.push(`${name}=${cookie.value}`);\n\n    if (cookie.path) {\n      parts.push(`Path=${cookie.path}`);\n    }\n    if (cookie.maxAge) {\n      parts.push(`Max-Age=${cookie.maxAge}`);\n    }\n    if (cookie.secure !== false && isHttps) {\n      parts.push(\"Secure\");\n    }\n    if (cookie.httpOnly) {\n      parts.push(\"HttpOnly\");\n    }\n    if (cookie.sameSite) {\n      parts.push(`SameSite=${cookie.sameSite}`);\n    }\n    if (cookie.domain) {\n      parts.push(`Domain=${cookie.domain}`);\n    }\n\n    return parts.join(\"; \");\n  }\n}\n","import {\n  $inject,\n  Alepha,\n  AlephaError,\n  createPrimitive,\n  KIND,\n  Primitive,\n  type Static,\n  type TSchema,\n} from \"alepha\";\nimport { DateTimeProvider } from \"alepha/datetime\";\nimport { CookieParser } from \"../services/CookieParser.ts\";\nimport type {\n  AbstractCookiePrimitive,\n  Cookie,\n  CookiePrimitiveOptions,\n  Cookies,\n} from \"./$cookie.ts\";\n\n/**\n * Creates a browser-side cookie primitive for client-side cookie management.\n *\n * Browser-specific version of $cookie that uses document.cookie API. Supports type-safe\n * cookie operations with schema validation but excludes encryption/signing (use server-side\n * $cookie for secure operations).\n *\n * **Note**: This is the browser version - encryption, signing, and compression are not supported.\n *\n * @example\n * ```ts\n * class ClientCookies {\n *   preferences = $cookie({\n *     name: \"user-prefs\",\n *     schema: t.object({ theme: t.text(), language: t.text() }),\n *     ttl: [30, \"days\"]\n *   });\n *\n *   savePreferences() {\n *     this.preferences.set({ theme: \"dark\", language: \"en\" });\n *   }\n *\n *   getPreferences() {\n *     return this.preferences.get() ?? { theme: \"light\", language: \"en\" };\n *   }\n * }\n * ```\n */\nexport const $cookie = <T extends TSchema>(\n  options: CookiePrimitiveOptions<T>,\n  extendedOptions?: Omit<CookiePrimitiveOptions<T>, \"schema\">,\n): AbstractCookiePrimitive<T> => {\n  if (extendedOptions) {\n    options = {\n      key: options.key,\n      schema: options.schema,\n      ...extendedOptions,\n    };\n  }\n  return createPrimitive(BrowserCookiePrimitive<T>, options);\n};\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class BrowserCookiePrimitive<T extends TSchema>\n  extends Primitive<CookiePrimitiveOptions<T>>\n  implements AbstractCookiePrimitive<T>\n{\n  protected cookieParser = $inject(CookieParser);\n  protected alepha = $inject(Alepha);\n  protected dateTimeProvider = $inject(DateTimeProvider);\n  protected cookie?: Cookie;\n\n  protected onInit() {\n    if (this.options.key) {\n      this.alepha.events.on(\"state:mutate\", ({ key, value }) => {\n        if (key === this.options.key) {\n          this.set(value);\n        }\n      });\n      this.alepha.events.on(\"configure\", () => {\n        try {\n          const value = this.get();\n          if (value !== undefined) {\n            this.alepha.set(this.options.key as any, value);\n          }\n        } catch {}\n      });\n    }\n  }\n\n  public get schema(): T {\n    return this.options.schema;\n  }\n\n  public get name(): string {\n    return this.options.name ?? `${this.config.propertyKey}`;\n  }\n\n  public set(data: Static<T>): void {\n    const value = JSON.stringify(this.alepha.codec.decode(this.schema, data));\n    const options = this.options;\n\n    if (options.compress) {\n      throw new AlephaError(\"Compression is not supported in browser cookies.\");\n    }\n\n    if (options.encrypt) {\n      throw new AlephaError(\"Encryption is not supported in browser cookies.\");\n    }\n\n    if (options.sign) {\n      throw new AlephaError(\"Signing is not supported in browser cookies.\");\n    }\n\n    const cookie: Cookie = {\n      value: encodeURIComponent(value),\n      path: options.path ?? \"/\",\n      sameSite: options.sameSite ?? \"lax\",\n      secure: false,\n      httpOnly: false,\n      domain: options.domain,\n    };\n\n    if (options.ttl) {\n      cookie.maxAge = this.dateTimeProvider.duration(options.ttl).as(\"seconds\");\n    }\n\n    // biome-ignore lint/suspicious/noDocumentCookie: ...\n    document.cookie = this.cookieParser.cookieToString(this.name, cookie);\n  }\n\n  public get(options?: { cookies?: Cookies }): Static<T> | undefined {\n    const cookie = this.cookieParser.parseRequestCookies(document.cookie)[\n      this.name\n    ];\n    if (!cookie) {\n      return undefined;\n    }\n\n    const rawValue = decodeURIComponent(cookie);\n\n    if (this.options.compress) {\n      throw new AlephaError(\"Compression is not supported in browser cookies.\");\n    }\n\n    if (this.options.encrypt) {\n      throw new AlephaError(\"Encryption is not supported in browser cookies.\");\n    }\n\n    if (this.options.sign) {\n      throw new AlephaError(\"Signing is not supported in browser cookies.\");\n    }\n\n    return this.alepha.codec.decode(this.schema, JSON.parse(rawValue));\n  }\n\n  public del(): void {\n    const options = this.options;\n    const cookie: Cookie = {\n      value: \"\",\n      path: options.path ?? \"/\",\n      sameSite: options.sameSite ?? \"lax\",\n      secure: false,\n      httpOnly: false,\n      domain: options.domain,\n      maxAge: 0, // Set maxAge to 0 to delete the cookie\n    };\n\n    // biome-ignore lint/suspicious/noDocumentCookie: ...\n    document.cookie = this.cookieParser.cookieToString(this.name, cookie);\n  }\n}\n\n$cookie[KIND] = BrowserCookiePrimitive;\n","import { $module } from \"alepha\";\nimport { AlephaServer } from \"alepha/server\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport * from \"./primitives/$cookie.browser.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport const AlephaServerCookies = $module({\n  name: \"alepha.server.cookies\",\n  primitives: [],\n  services: [AlephaServer],\n});\n"],"mappings":";;;;AAEA,IAAa,eAAb,MAA0B;CACxB,oBAA2B,QAAwC;EACjE,MAAM,UAAkC,CAAC;EACzC,MAAM,QAAQ,OAAO,MAAM,GAAG;EAC9B,KAAK,MAAM,QAAQ,OAAO;GACxB,MAAM,UAAU,KAAK,QAAQ,GAAG;GAChC,IAAI,YAAY,IACd;GAGF,MAAM,MAAM,KAAK,MAAM,GAAG,OAAO,EAAE,KAAK;GACxC,MAAM,QAAQ,KAAK,MAAM,UAAU,CAAC,EAAE,KAAK;GAE3C,IAAI,CAAC,OAAO,CAAC,OACX;GAGF,QAAQ,OAAO;EACjB;EAEA,OAAO;CACT;CAEA,yBACE,SACA,SACU;EACV,MAAM,UAAU,CAAC;EAEjB,KAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,OAAO,GAAG;GAEpD,IAAI,UAAU,MAAM;IAClB,QAAQ,KAAK,GAAG,KAAK,qBAAqB;IAC1C;GACF;GAEA,IAAI,CAAC,OAAO,OACV;GAGF,QAAQ,KAAK,KAAK,eAAe,MAAM,QAAQ,OAAO,CAAC;EACzD;EAEA,OAAO;CACT;CAEA,eACE,MACA,QACA,SACQ;EACR,MAAM,QAAkB,CAAC;EAEzB,MAAM,KAAK,GAAG,KAAK,GAAG,OAAO,OAAO;EAEpC,IAAI,OAAO,MACT,MAAM,KAAK,QAAQ,OAAO,MAAM;EAElC,IAAI,OAAO,QACT,MAAM,KAAK,WAAW,OAAO,QAAQ;EAEvC,IAAI,OAAO,WAAW,SAAS,SAC7B,MAAM,KAAK,QAAQ;EAErB,IAAI,OAAO,UACT,MAAM,KAAK,UAAU;EAEvB,IAAI,OAAO,UACT,MAAM,KAAK,YAAY,OAAO,UAAU;EAE1C,IAAI,OAAO,QACT,MAAM,KAAK,UAAU,OAAO,QAAQ;EAGtC,OAAO,MAAM,KAAK,IAAI;CACxB;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AC/BA,MAAa,WACX,SACA,oBAC+B;CAC/B,IAAI,iBACF,UAAU;EACR,KAAK,QAAQ;EACb,QAAQ,QAAQ;EAChB,GAAG;CACL;CAEF,OAAO,gBAAgB,wBAA2B,OAAO;AAC3D;AAIA,IAAa,yBAAb,cACU,UAEV;CACE,eAAyB,QAAQ,YAAY;CAC7C,SAAmB,QAAQ,MAAM;CACjC,mBAA6B,QAAQ,gBAAgB;CACrD;CAEA,SAAmB;EACjB,IAAI,KAAK,QAAQ,KAAK;GACpB,KAAK,OAAO,OAAO,GAAG,iBAAiB,EAAE,KAAK,YAAY;IACxD,IAAI,QAAQ,KAAK,QAAQ,KACvB,KAAK,IAAI,KAAK;GAElB,CAAC;GACD,KAAK,OAAO,OAAO,GAAG,mBAAmB;IACvC,IAAI;KACF,MAAM,QAAQ,KAAK,IAAI;KACvB,IAAI,UAAU,KAAA,GACZ,KAAK,OAAO,IAAI,KAAK,QAAQ,KAAY,KAAK;IAElD,QAAQ,CAAC;GACX,CAAC;EACH;CACF;CAEA,IAAW,SAAY;EACrB,OAAO,KAAK,QAAQ;CACtB;CAEA,IAAW,OAAe;EACxB,OAAO,KAAK,QAAQ,QAAQ,GAAG,KAAK,OAAO;CAC7C;CAEA,IAAW,MAAuB;EAChC,MAAM,QAAQ,KAAK,UAAU,KAAK,OAAO,MAAM,OAAO,KAAK,QAAQ,IAAI,CAAC;EACxE,MAAM,UAAU,KAAK;EAErB,IAAI,QAAQ,UACV,MAAM,IAAI,YAAY,kDAAkD;EAG1E,IAAI,QAAQ,SACV,MAAM,IAAI,YAAY,iDAAiD;EAGzE,IAAI,QAAQ,MACV,MAAM,IAAI,YAAY,8CAA8C;EAGtE,MAAM,SAAiB;GACrB,OAAO,mBAAmB,KAAK;GAC/B,MAAM,QAAQ,QAAQ;GACtB,UAAU,QAAQ,YAAY;GAC9B,QAAQ;GACR,UAAU;GACV,QAAQ,QAAQ;EAClB;EAEA,IAAI,QAAQ,KACV,OAAO,SAAS,KAAK,iBAAiB,SAAS,QAAQ,GAAG,EAAE,GAAG,SAAS;EAI1E,SAAS,SAAS,KAAK,aAAa,eAAe,KAAK,MAAM,MAAM;CACtE;CAEA,IAAW,SAAwD;EACjE,MAAM,SAAS,KAAK,aAAa,oBAAoB,SAAS,MAAM,EAClE,KAAK;EAEP,IAAI,CAAC,QACH;EAGF,MAAM,WAAW,mBAAmB,MAAM;EAE1C,IAAI,KAAK,QAAQ,UACf,MAAM,IAAI,YAAY,kDAAkD;EAG1E,IAAI,KAAK,QAAQ,SACf,MAAM,IAAI,YAAY,iDAAiD;EAGzE,IAAI,KAAK,QAAQ,MACf,MAAM,IAAI,YAAY,8CAA8C;EAGtE,OAAO,KAAK,OAAO,MAAM,OAAO,KAAK,QAAQ,KAAK,MAAM,QAAQ,CAAC;CACnE;CAEA,MAAmB;EACjB,MAAM,UAAU,KAAK;EACrB,MAAM,SAAiB;GACrB,OAAO;GACP,MAAM,QAAQ,QAAQ;GACtB,UAAU,QAAQ,YAAY;GAC9B,QAAQ;GACR,UAAU;GACV,QAAQ,QAAQ;GAChB,QAAQ;EACV;EAGA,SAAS,SAAS,KAAK,aAAa,eAAe,KAAK,MAAM,MAAM;CACtE;AACF;AAEA,QAAQ,QAAQ;;;ACpKhB,MAAa,sBAAsB,QAAQ;CACzC,MAAM;CACN,YAAY,CAAC;CACb,UAAU,CAAC,YAAY;AACzB,CAAC"}
+{"version":3,"file":"index.browser.js","names":[],"sources":["../../../src/server/cookies/services/CookieParser.ts","../../../src/server/cookies/providers/AtomCookiePersistence.browser.ts","../../../src/server/cookies/primitives/$cookie.browser.ts","../../../src/server/cookies/index.browser.ts"],"sourcesContent":["import type { Cookie } from \"../primitives/$cookie.ts\";\n\nexport class CookieParser {\n  public parseRequestCookies(header: string): Record<string, string> {\n    const cookies: Record<string, string> = {};\n    const parts = header.split(\";\");\n    for (const part of parts) {\n      const eqIndex = part.indexOf(\"=\");\n      if (eqIndex === -1) {\n        continue;\n      }\n\n      const key = part.slice(0, eqIndex).trim();\n      const value = part.slice(eqIndex + 1).trim();\n\n      if (!key || !value) {\n        continue;\n      }\n\n      cookies[key] = value;\n    }\n\n    return cookies;\n  }\n\n  public serializeResponseCookies(\n    cookies: Record<string, Cookie | null>,\n    isHttps: boolean,\n  ): string[] {\n    const headers = [];\n\n    for (const [name, cookie] of Object.entries(cookies)) {\n      // If the cookie is null, we need to delete it\n      if (cookie == null) {\n        headers.push(`${name}=; Path=/; Max-Age=0`);\n        continue;\n      }\n\n      if (!cookie.value) {\n        continue;\n      }\n\n      headers.push(this.cookieToString(name, cookie, isHttps));\n    }\n\n    return headers;\n  }\n\n  public cookieToString(\n    name: string,\n    cookie: Cookie,\n    isHttps?: boolean,\n  ): string {\n    const parts: string[] = [];\n\n    parts.push(`${name}=${cookie.value}`);\n\n    if (cookie.path) {\n      parts.push(`Path=${cookie.path}`);\n    }\n    // `!= null`, not truthy: `maxAge: 0` is the standard \"delete this\n    // cookie now\" value (used by AtomCookiePersistence.browser.ts's\n    // clearCookie() and BrowserCookiePrimitive.del()). A truthy check would\n    // silently drop `Max-Age` for exactly that value, turning a deletion\n    // into a plain (non-expiring-until-session-end) write.\n    if (cookie.maxAge != null) {\n      parts.push(`Max-Age=${cookie.maxAge}`);\n    }\n    if (cookie.secure !== false && isHttps) {\n      parts.push(\"Secure\");\n    }\n    if (cookie.httpOnly) {\n      parts.push(\"HttpOnly\");\n    }\n    if (cookie.sameSite) {\n      parts.push(`SameSite=${cookie.sameSite}`);\n    }\n    if (cookie.domain) {\n      parts.push(`Domain=${cookie.domain}`);\n    }\n\n    return parts.join(\"; \");\n  }\n}\n","import { $hook, $inject, Alepha, type Atom, type State } from \"alepha\";\nimport { DateTimeProvider } from \"alepha/datetime\";\nimport type { Cookie } from \"../primitives/$cookie.ts\";\nimport { CookieParser } from \"../services/CookieParser.ts\";\n\n/**\n * Browser variant of AtomCookiePersistence: reads `document.cookie` for every\n * `persist: \"cookie\"` atom, and writes it back on every mutation.\n *\n * Like the server variant, atoms are resolved from the `StateManager`\n * registry (`alepha.store.listAtoms()`) rather than from a map fed by\n * `state:register` — that event fires once, is never replayed, and\n * `$module.register()` registers `atoms[]` before the module's `services[]`\n * exist, so an event-sourced map would miss every atom declared the\n * documented way. The `configure` hook sweeps everything registered up to\n * boot; `state:register` covers atoms that first register later (lazily, on\n * first read).\n *\n * Cookie names are NOT APP_NAME-prefixed here, because `APP_NAME` is not\n * reachable in the browser: `BuildClientTask` only `define`s\n * `process.env.NODE_ENV` for the client bundle, and the SSR hydration\n * payload (`ReactServerTemplateProvider.buildHydrationData`) only carries\n * registered atom values + router layers — never the raw `env` store key.\n * The server variant (`AtomCookiePersistence.ts`) matches this by passing\n * `prefix: false` to `ServerCookiesProvider`, specifically for atom-cookie\n * traffic — every other server cookie ($cookie primitive) still gets the\n * APP_NAME namespace. See `ServerCookiesProvider.prefixName`.\n */\nexport class AtomCookiePersistence {\n  protected readonly alepha = $inject(Alepha);\n  protected readonly cookieParser = $inject(CookieParser);\n  protected readonly dateTime = $inject(DateTimeProvider);\n\n  protected readonly onConfigure = $hook({\n    on: \"configure\",\n    handler: () => {\n      for (const atom of this.cookieAtoms()) {\n        this.read(atom);\n      }\n    },\n  });\n\n  protected readonly onRegister = $hook({\n    on: \"state:register\",\n    handler: ({ atom }) => {\n      if (atom.options.persist !== \"cookie\") {\n        return;\n      }\n      this.read(atom);\n    },\n  });\n\n  protected readonly onMutate = $hook({\n    on: \"state:mutate\",\n    handler: ({ key, value }) => {\n      const atom = this.alepha.store.getAtom(String(key));\n      if (!atom || atom.options.persist !== \"cookie\") {\n        return;\n      }\n\n      if (value === undefined) {\n        // Without this branch, `store.del(atom)` would write the literal\n        // string \"undefined\", and the next read's `JSON.parse(\"undefined\")`\n        // would throw into the catch in `read()` on every page load.\n        this.clearCookie(atom.key);\n        return;\n      }\n\n      const cookie: Cookie = {\n        value: encodeURIComponent(JSON.stringify(value)),\n        path: \"/\",\n        sameSite: \"lax\",\n        maxAge: this.dateTime.duration([365, \"days\"]).as(\"seconds\"),\n      };\n      // biome-ignore lint/suspicious/noDocumentCookie: cookie persistence adapter\n      document.cookie = this.cookieParser.cookieToString(atom.key, cookie);\n    },\n  });\n\n  /**\n   * Every registered atom declared with `persist: \"cookie\"`, read live from\n   * the state manager's registry.\n   */\n  protected cookieAtoms(): Array<Atom<any, any>> {\n    return this.alepha.store\n      .listAtoms()\n      .filter((atom) => atom.options.persist === \"cookie\");\n  }\n\n  /**\n   * Seed an atom's state from `document.cookie`, if a cookie exists for it.\n   * Idempotent: re-reading an atom that already holds the cookie's value is\n   * a no-op write of the same data.\n   */\n  protected read(atom: Atom<any, any>): void {\n    const raw = this.cookieParser.parseRequestCookies(document.cookie)[\n      atom.key\n    ];\n    if (!raw) {\n      return;\n    }\n\n    try {\n      this.alepha.store.set(\n        atom.key as keyof State,\n        JSON.parse(decodeURIComponent(raw)),\n        { skipEvents: true },\n      );\n    } catch {\n      // Corrupted cookie (invalid JSON/encoding, or a value that no longer\n      // matches the atom's schema — `store.set` validates against it) —\n      // clear it instead of leaving it to keep throwing on every future\n      // read. Mirrors the web-storage adapter's parity\n      // (StateManager.bindWebStorage removes the bad entry too).\n      this.clearCookie(atom.key);\n    }\n  }\n\n  /**\n   * Expire a cookie immediately, mirroring\n   * `ServerCookiesProvider.deleteCookie`'s `Max-Age=0` semantics.\n   */\n  protected clearCookie(name: string): void {\n    const cookie: Cookie = {\n      value: \"\",\n      path: \"/\",\n      sameSite: \"lax\",\n      maxAge: 0,\n    };\n    // biome-ignore lint/suspicious/noDocumentCookie: cookie persistence adapter\n    document.cookie = this.cookieParser.cookieToString(name, cookie);\n  }\n}\n","import {\n  $inject,\n  Alepha,\n  AlephaError,\n  createPrimitive,\n  KIND,\n  Primitive,\n  type Static,\n  type TSchema,\n} from \"alepha\";\nimport { DateTimeProvider } from \"alepha/datetime\";\nimport { CookieParser } from \"../services/CookieParser.ts\";\nimport type {\n  AbstractCookiePrimitive,\n  Cookie,\n  CookiePrimitiveOptions,\n  Cookies,\n} from \"./$cookie.ts\";\n\n/**\n * Creates a browser-side cookie primitive for client-side cookie management.\n *\n * Browser-specific version of $cookie that uses document.cookie API. Supports type-safe\n * cookie operations with schema validation but excludes encryption/signing (use server-side\n * $cookie for secure operations).\n *\n * **Note**: This is the browser version - encryption, signing, and compression are not supported.\n *\n * @example\n * ```ts\n * class ClientCookies {\n *   preferences = $cookie({\n *     name: \"user-prefs\",\n *     schema: z.object({ theme: z.text(), language: z.text() }),\n *     ttl: [30, \"days\"]\n *   });\n *\n *   savePreferences() {\n *     this.preferences.set({ theme: \"dark\", language: \"en\" });\n *   }\n *\n *   getPreferences() {\n *     return this.preferences.get() ?? { theme: \"light\", language: \"en\" };\n *   }\n * }\n * ```\n */\nexport const $cookie = <T extends TSchema>(\n  options: CookiePrimitiveOptions<T>,\n  extendedOptions?: Omit<CookiePrimitiveOptions<T>, \"schema\">,\n): AbstractCookiePrimitive<T> => {\n  if (extendedOptions) {\n    options = {\n      key: options.key,\n      schema: options.schema,\n      ...extendedOptions,\n    };\n  }\n  return createPrimitive(BrowserCookiePrimitive<T>, options);\n};\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport class BrowserCookiePrimitive<T extends TSchema>\n  extends Primitive<CookiePrimitiveOptions<T>>\n  implements AbstractCookiePrimitive<T>\n{\n  protected cookieParser = $inject(CookieParser);\n  protected alepha = $inject(Alepha);\n  protected dateTimeProvider = $inject(DateTimeProvider);\n  protected cookie?: Cookie;\n\n  protected onInit() {\n    if (this.options.key) {\n      this.alepha.events.on(\"state:mutate\", ({ key, value }) => {\n        if (key === this.options.key) {\n          this.set(value);\n        }\n      });\n      this.alepha.events.on(\"configure\", () => {\n        try {\n          const value = this.get();\n          if (value !== undefined) {\n            this.alepha.set(this.options.key as any, value);\n          }\n        } catch {}\n      });\n    }\n  }\n\n  public get schema(): T {\n    return this.options.schema;\n  }\n\n  public get name(): string {\n    return this.options.name ?? `${this.config.propertyKey}`;\n  }\n\n  public set(data: Static<T>): void {\n    const value = JSON.stringify(this.alepha.codec.decode(this.schema, data));\n    const options = this.options;\n\n    if (options.compress) {\n      throw new AlephaError(\"Compression is not supported in browser cookies.\");\n    }\n\n    if (options.encrypt) {\n      throw new AlephaError(\"Encryption is not supported in browser cookies.\");\n    }\n\n    if (options.sign) {\n      throw new AlephaError(\"Signing is not supported in browser cookies.\");\n    }\n\n    const cookie: Cookie = {\n      value: encodeURIComponent(value),\n      path: options.path ?? \"/\",\n      sameSite: options.sameSite ?? \"lax\",\n      secure: false,\n      httpOnly: false,\n      domain: options.domain,\n    };\n\n    if (options.ttl) {\n      cookie.maxAge = this.dateTimeProvider.duration(options.ttl).as(\"seconds\");\n    }\n\n    // biome-ignore lint/suspicious/noDocumentCookie: ...\n    document.cookie = this.cookieParser.cookieToString(this.name, cookie);\n  }\n\n  public get(options?: { cookies?: Cookies }): Static<T> | undefined {\n    const cookie = this.cookieParser.parseRequestCookies(document.cookie)[\n      this.name\n    ];\n    if (!cookie) {\n      return undefined;\n    }\n\n    const rawValue = decodeURIComponent(cookie);\n\n    if (this.options.compress) {\n      throw new AlephaError(\"Compression is not supported in browser cookies.\");\n    }\n\n    if (this.options.encrypt) {\n      throw new AlephaError(\"Encryption is not supported in browser cookies.\");\n    }\n\n    if (this.options.sign) {\n      throw new AlephaError(\"Signing is not supported in browser cookies.\");\n    }\n\n    return this.alepha.codec.decode(this.schema, JSON.parse(rawValue));\n  }\n\n  public del(): void {\n    const options = this.options;\n    const cookie: Cookie = {\n      value: \"\",\n      path: options.path ?? \"/\",\n      sameSite: options.sameSite ?? \"lax\",\n      secure: false,\n      httpOnly: false,\n      domain: options.domain,\n      maxAge: 0, // Set maxAge to 0 to delete the cookie\n    };\n\n    // biome-ignore lint/suspicious/noDocumentCookie: ...\n    document.cookie = this.cookieParser.cookieToString(this.name, cookie);\n  }\n}\n\n$cookie[KIND] = BrowserCookiePrimitive;\n","import { $module } from \"alepha\";\nimport { AlephaServer } from \"alepha/server\";\nimport { AtomCookiePersistence } from \"./providers/AtomCookiePersistence.browser.ts\";\nimport { CookieParser } from \"./services/CookieParser.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport * from \"./primitives/$cookie.browser.ts\";\nexport * from \"./providers/AtomCookiePersistence.browser.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport const AlephaServerCookies = $module({\n  name: \"alepha.server.cookies\",\n  primitives: [],\n  services: [AlephaServer, CookieParser, AtomCookiePersistence],\n});\n"],"mappings":";;;;AAEA,IAAa,eAAb,MAA0B;CACxB,oBAA2B,QAAwC;EACjE,MAAM,UAAkC,CAAC;EACzC,MAAM,QAAQ,OAAO,MAAM,GAAG;EAC9B,KAAK,MAAM,QAAQ,OAAO;GACxB,MAAM,UAAU,KAAK,QAAQ,GAAG;GAChC,IAAI,YAAY,IACd;GAGF,MAAM,MAAM,KAAK,MAAM,GAAG,OAAO,CAAC,CAAC,KAAK;GACxC,MAAM,QAAQ,KAAK,MAAM,UAAU,CAAC,CAAC,CAAC,KAAK;GAE3C,IAAI,CAAC,OAAO,CAAC,OACX;GAGF,QAAQ,OAAO;EACjB;EAEA,OAAO;CACT;CAEA,yBACE,SACA,SACU;EACV,MAAM,UAAU,CAAC;EAEjB,KAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,OAAO,GAAG;GAEpD,IAAI,UAAU,MAAM;IAClB,QAAQ,KAAK,GAAG,KAAK,qBAAqB;IAC1C;GACF;GAEA,IAAI,CAAC,OAAO,OACV;GAGF,QAAQ,KAAK,KAAK,eAAe,MAAM,QAAQ,OAAO,CAAC;EACzD;EAEA,OAAO;CACT;CAEA,eACE,MACA,QACA,SACQ;EACR,MAAM,QAAkB,CAAC;EAEzB,MAAM,KAAK,GAAG,KAAK,GAAG,OAAO,OAAO;EAEpC,IAAI,OAAO,MACT,MAAM,KAAK,QAAQ,OAAO,MAAM;EAOlC,IAAI,OAAO,UAAU,MACnB,MAAM,KAAK,WAAW,OAAO,QAAQ;EAEvC,IAAI,OAAO,WAAW,SAAS,SAC7B,MAAM,KAAK,QAAQ;EAErB,IAAI,OAAO,UACT,MAAM,KAAK,UAAU;EAEvB,IAAI,OAAO,UACT,MAAM,KAAK,YAAY,OAAO,UAAU;EAE1C,IAAI,OAAO,QACT,MAAM,KAAK,UAAU,OAAO,QAAQ;EAGtC,OAAO,MAAM,KAAK,IAAI;CACxB;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;ACvDA,IAAa,wBAAb,MAAmC;CACjC,SAA4B,QAAQ,MAAM;CAC1C,eAAkC,QAAQ,YAAY;CACtD,WAA8B,QAAQ,gBAAgB;CAEtD,cAAiC,MAAM;EACrC,IAAI;EACJ,eAAe;GACb,KAAK,MAAM,QAAQ,KAAK,YAAY,GAClC,KAAK,KAAK,IAAI;EAElB;CACF,CAAC;CAED,aAAgC,MAAM;EACpC,IAAI;EACJ,UAAU,EAAE,WAAW;GACrB,IAAI,KAAK,QAAQ,YAAY,UAC3B;GAEF,KAAK,KAAK,IAAI;EAChB;CACF,CAAC;CAED,WAA8B,MAAM;EAClC,IAAI;EACJ,UAAU,EAAE,KAAK,YAAY;GAC3B,MAAM,OAAO,KAAK,OAAO,MAAM,QAAQ,OAAO,GAAG,CAAC;GAClD,IAAI,CAAC,QAAQ,KAAK,QAAQ,YAAY,UACpC;GAGF,IAAI,UAAU,KAAA,GAAW;IAIvB,KAAK,YAAY,KAAK,GAAG;IACzB;GACF;GAEA,MAAM,SAAiB;IACrB,OAAO,mBAAmB,KAAK,UAAU,KAAK,CAAC;IAC/C,MAAM;IACN,UAAU;IACV,QAAQ,KAAK,SAAS,SAAS,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,GAAG,SAAS;GAC5D;GAEA,SAAS,SAAS,KAAK,aAAa,eAAe,KAAK,KAAK,MAAM;EACrE;CACF,CAAC;;;;;CAMD,cAA+C;EAC7C,OAAO,KAAK,OAAO,MAChB,UAAU,CAAC,CACX,QAAQ,SAAS,KAAK,QAAQ,YAAY,QAAQ;CACvD;;;;;;CAOA,KAAe,MAA4B;EACzC,MAAM,MAAM,KAAK,aAAa,oBAAoB,SAAS,MAAM,CAAC,CAChE,KAAK;EAEP,IAAI,CAAC,KACH;EAGF,IAAI;GACF,KAAK,OAAO,MAAM,IAChB,KAAK,KACL,KAAK,MAAM,mBAAmB,GAAG,CAAC,GAClC,EAAE,YAAY,KAAK,CACrB;EACF,QAAQ;GAMN,KAAK,YAAY,KAAK,GAAG;EAC3B;CACF;;;;;CAMA,YAAsB,MAAoB;EAQxC,SAAS,SAAS,KAAK,aAAa,eAAe,MAAM;GANvD,OAAO;GACP,MAAM;GACN,UAAU;GACV,QAAQ;EAGoD,CAAC;CACjE;AACF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACrFA,MAAa,WACX,SACA,oBAC+B;CAC/B,IAAI,iBACF,UAAU;EACR,KAAK,QAAQ;EACb,QAAQ,QAAQ;EAChB,GAAG;CACL;CAEF,OAAO,gBAAgB,wBAA2B,OAAO;AAC3D;AAIA,IAAa,yBAAb,cACU,UAEV;CACE,eAAyB,QAAQ,YAAY;CAC7C,SAAmB,QAAQ,MAAM;CACjC,mBAA6B,QAAQ,gBAAgB;CACrD;CAEA,SAAmB;EACjB,IAAI,KAAK,QAAQ,KAAK;GACpB,KAAK,OAAO,OAAO,GAAG,iBAAiB,EAAE,KAAK,YAAY;IACxD,IAAI,QAAQ,KAAK,QAAQ,KACvB,KAAK,IAAI,KAAK;GAElB,CAAC;GACD,KAAK,OAAO,OAAO,GAAG,mBAAmB;IACvC,IAAI;KACF,MAAM,QAAQ,KAAK,IAAI;KACvB,IAAI,UAAU,KAAA,GACZ,KAAK,OAAO,IAAI,KAAK,QAAQ,KAAY,KAAK;IAElD,QAAQ,CAAC;GACX,CAAC;EACH;CACF;CAEA,IAAW,SAAY;EACrB,OAAO,KAAK,QAAQ;CACtB;CAEA,IAAW,OAAe;EACxB,OAAO,KAAK,QAAQ,QAAQ,GAAG,KAAK,OAAO;CAC7C;CAEA,IAAW,MAAuB;EAChC,MAAM,QAAQ,KAAK,UAAU,KAAK,OAAO,MAAM,OAAO,KAAK,QAAQ,IAAI,CAAC;EACxE,MAAM,UAAU,KAAK;EAErB,IAAI,QAAQ,UACV,MAAM,IAAI,YAAY,kDAAkD;EAG1E,IAAI,QAAQ,SACV,MAAM,IAAI,YAAY,iDAAiD;EAGzE,IAAI,QAAQ,MACV,MAAM,IAAI,YAAY,8CAA8C;EAGtE,MAAM,SAAiB;GACrB,OAAO,mBAAmB,KAAK;GAC/B,MAAM,QAAQ,QAAQ;GACtB,UAAU,QAAQ,YAAY;GAC9B,QAAQ;GACR,UAAU;GACV,QAAQ,QAAQ;EAClB;EAEA,IAAI,QAAQ,KACV,OAAO,SAAS,KAAK,iBAAiB,SAAS,QAAQ,GAAG,CAAC,CAAC,GAAG,SAAS;EAI1E,SAAS,SAAS,KAAK,aAAa,eAAe,KAAK,MAAM,MAAM;CACtE;CAEA,IAAW,SAAwD;EACjE,MAAM,SAAS,KAAK,aAAa,oBAAoB,SAAS,MAAM,CAAC,CACnE,KAAK;EAEP,IAAI,CAAC,QACH;EAGF,MAAM,WAAW,mBAAmB,MAAM;EAE1C,IAAI,KAAK,QAAQ,UACf,MAAM,IAAI,YAAY,kDAAkD;EAG1E,IAAI,KAAK,QAAQ,SACf,MAAM,IAAI,YAAY,iDAAiD;EAGzE,IAAI,KAAK,QAAQ,MACf,MAAM,IAAI,YAAY,8CAA8C;EAGtE,OAAO,KAAK,OAAO,MAAM,OAAO,KAAK,QAAQ,KAAK,MAAM,QAAQ,CAAC;CACnE;CAEA,MAAmB;EACjB,MAAM,UAAU,KAAK;EACrB,MAAM,SAAiB;GACrB,OAAO;GACP,MAAM,QAAQ,QAAQ;GACtB,UAAU,QAAQ,YAAY;GAC9B,QAAQ;GACR,UAAU;GACV,QAAQ,QAAQ;GAChB,QAAQ;EACV;EAGA,SAAS,SAAS,KAAK,aAAa,eAAe,KAAK,MAAM,MAAM;CACtE;AACF;AAEA,QAAQ,QAAQ;;;ACjKhB,MAAa,sBAAsB,QAAQ;CACzC,MAAM;CACN,YAAY,CAAC;CACb,UAAU;EAAC;EAAc;EAAc;CAAqB;AAC9D,CAAC"}

package/dist/server/cookies/index.d.ts

@@ -1,7 +1,6 @@
-import { Alepha, KIND, Primitive, Static, TSchema } from "alepha";
+import { Alepha, Atom, KIND, Primitive, Static, TSchema } from "alepha";
 import { SecretProvider } from "alepha/crypto";
 import { DateTimeProvider, DurationLike } from "alepha/datetime";
-
 //#region ../../src/server/cookies/services/CookieParser.d.ts
 declare class CookieParser {
   parseRequestCookies(header: string): Record<string, string>;
@@ -37,11 +36,16 @@ declare class ServerCookiesProvider {
    * When `APP_NAME` is unset the name is returned unchanged, so existing
    * single-app deployments keep their current cookie names. Same convention as
    * the `APP_NAME` prefix used by R2 storage and server-timing.
+   *
+   * Pass `prefix = false` to skip the namespace entirely — used for
+   * `persist: "cookie"` atoms, whose browser-side counterpart cannot see
+   * `APP_NAME` and therefore always uses the bare name. See
+   * `CookiePrimitiveOptions.prefix`.
    */
-  protected prefixName(name: string): string;
+  protected prefixName(name: string, prefix?: boolean): string;
   getCookie<T extends TSchema>(name: string, options: CookiePrimitiveOptions<T>, contextCookies?: Cookies): Static<T> | undefined;
   setCookie<T extends TSchema>(name: string, options: CookiePrimitiveOptions<T>, data: Static<T>, contextCookies?: Cookies): void;
-  deleteCookie<T extends TSchema>(name: string, contextCookies?: Cookies): void;
+  deleteCookie<T extends TSchema>(name: string, contextCookies?: Cookies, prefix?: boolean): void;
   protected encrypt(text: string): string;
   protected decrypt(encryptedText: string): string;
   /**
@@ -111,6 +115,21 @@ interface CookiePrimitiveOptions<T extends TSchema> {
    * Optional key to link this cookie to an Atom, enabling automatic synchronization between the cookie and the Atom's state.
    */
   key?: string;
+  /**
+   * Internal escape hatch: when explicitly set to `false`, the server skips
+   * the `APP_NAME` cookie-name namespace applied by
+   * `ServerCookiesProvider.prefixName()`.
+   *
+   * Used by `AtomCookiePersistence` so the cookie name the server
+   * reads/writes for a `persist: "cookie"` atom matches the bare name its
+   * browser variant uses — `APP_NAME` is not reachable client-side (not
+   * baked into the client bundle, not part of SSR hydration), so the
+   * browser can only ever use the bare atom key.
+   *
+   * Application code declaring `$cookie(...)` directly should leave this
+   * unset — it defaults to `true` (prefixed), matching every other cookie.
+   */
+  prefix?: boolean;
 }
 interface AbstractCookiePrimitive<T extends TSchema> {
   readonly name: string;
@@ -165,6 +184,54 @@ interface Cookie {
   domain?: string;
 }
 //#endregion
+//#region ../../src/server/cookies/providers/AtomCookiePersistence.d.ts
+/**
+ * Binds every atom declared with `persist: "cookie"` to an HTTP cookie.
+ *
+ * - `server:onRequest` — seeds the request-scoped state from the cookie, so
+ *   SSR renders with the persisted value.
+ * - `state:mutate` — writes the new value back as a Set-Cookie header.
+ * - `state:register` — an atom registering lazily *during* a request (first
+ *   touched by an SSR render, after `server:onRequest` already ran) reads
+ *   its cookie right away, so that render still sees the persisted value.
+ *
+ * Atoms are resolved from the `StateManager` registry
+ * (`alepha.store.listAtoms()`) on every request and every mutation, never
+ * from a map built up from `state:register` events. That event fires exactly
+ * once per atom and is never replayed, while `$module.register()` registers
+ * `atoms[]` BEFORE it wires `imports[]` and injects `services[]` — so the
+ * documented `$module({ atoms, imports: [AlephaServerCookies], services })`
+ * shape registers every atom before this provider exists. An event-sourced
+ * map would stay empty forever there, making `persist: "cookie"` a silent
+ * no-op in both directions. Reading the registry on demand is
+ * order-independent.
+ *
+ * The cookie is named after the atom key, lives 365 days, SameSite=lax,
+ * path "/". For custom cookie options (encryption, signing, custom TTL),
+ * declare an explicit `$cookie({ key: atom.key, ... })` binding instead.
+ */
+declare class AtomCookiePersistence {
+  protected readonly alepha: Alepha;
+  protected readonly log: import("alepha/logger").Logger;
+  protected readonly serverCookies: ServerCookiesProvider;
+  protected readonly onRequest: import("alepha").HookPrimitive<"server:onRequest">;
+  protected readonly onRegister: import("alepha").HookPrimitive<"state:register">;
+  protected readonly onMutate: import("alepha").HookPrimitive<"state:mutate">;
+  /**
+   * Every registered atom declared with `persist: "cookie"`, read live from
+   * the state manager's registry.
+   */
+  protected cookieAtoms(): Array<Atom<any, any>>;
+  protected read(atom: Atom<any, any>, cookies?: Cookies): void;
+  protected cookieOptions(atom: Atom<any, any>): {
+    schema: any;
+    path: string;
+    sameSite: "lax";
+    ttl: DurationLike;
+    prefix: boolean;
+  };
+}
+//#endregion
 //#region ../../src/server/cookies/index.d.ts
 declare module "alepha/server" {
   interface ServerRequest {
@@ -181,5 +248,5 @@ declare module "alepha/server" {
  */
 declare const AlephaServerCookies: import("alepha").Service<import("alepha").Module>;
 //#endregion
-export { $cookie, AbstractCookiePrimitive, AlephaServerCookies, Cookie, CookiePrimitive, CookiePrimitiveOptions, Cookies, ServerCookiesProvider };
+export { $cookie, AbstractCookiePrimitive, AlephaServerCookies, AtomCookiePersistence, Cookie, CookiePrimitive, CookiePrimitiveOptions, Cookies, ServerCookiesProvider };
 //# sourceMappingURL=index.d.ts.map

package/dist/server/cookies/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","names":[],"sources":["../../../src/server/cookies/services/CookieParser.ts","../../../src/server/cookies/providers/ServerCookiesProvider.ts","../../../src/server/cookies/primitives/$cookie.ts","../../../src/server/cookies/index.ts"],"mappings":";;;;;cAEa,YAAA;EACJ,mBAAA,CAAoB,MAAA,WAAiB,MAAA;EAsBrC,wBAAA,CACL,OAAA,EAAS,MAAA,SAAe,MAAA,UACxB,OAAA;EAqBK,cAAA,CACL,IAAA,UACA,MAAA,EAAQ,MAAA,EACR,OAAA;AAAA;;;cCxBS,qBAAA;EAAA,mBACQ,MAAA,EAAM,MAAA;EAAA,mBACN,GAAA,0BAAG,MAAA;EAAA,mBACH,YAAA,EAAY,YAAA;EAAA,mBACZ,gBAAA,EAAgB,gBAAA;EAAA,mBAChB,cAAA,EAAc,cAAA;EAAA,mBAGd,SAAA;EAAA,mBACA,SAAA;EAAA,mBACA,eAAA;EAAA,mBACA,gBAAA;EAAA,SAEH,SAAA,mBAAS,aAAA;EAAA,SAYT,QAAA,mBAAQ,aAAA;EAAA,SAYR,MAAA,mBAAM,aAAA;EAAA,UAeZ,qBAAA,CAAsB,OAAA,GAAU,OAAA,GAAU,OAAA;EDrD1B;;;;;;;;;AAyBP;;;;ACxBrB;EDD4B,UC8EhB,UAAA,CAAW,IAAA;EAMd,SAAA,WAAoB,OAAA,EACzB,IAAA,UACA,OAAA,EAAS,sBAAA,CAAuB,CAAA,GAChC,cAAA,GAAiB,OAAA,GAChB,MAAA,CAAO,CAAA;EA6CH,SAAA,WAAoB,OAAA,EACzB,IAAA,UACA,OAAA,EAAS,sBAAA,CAAuB,CAAA,GAChC,IAAA,EAAM,MAAA,CAAO,CAAA,GACb,cAAA,GAAiB,OAAA;EAoCZ,YAAA,WAAuB,OAAA,EAC5B,IAAA,UACA,cAAA,GAAiB,OAAA;EAAA,UAQT,OAAA,CAAQ,IAAA;EAAA,UAWR,OAAA,CAAQ,aAAA;EA7IwB;;;;EAAA,UAsKhC,SAAA,IAAa,MAAA;EAAA,UAIb,IAAA,CAAK,IAAA;AAAA;;;;;ADvPjB;;;cEca,OAAA;EAAA,WAAqB,OAAA,EAAO,OAAA,EAC9B,sBAAA,CAAuB,CAAA,GAAE,eAAA,GAChB,IAAA,CAAK,sBAAA,CAAuB,CAAA,eAC7C,uBAAA,CAAwB,CAAA;EAAA;;UAaV,sBAAA,WAAiC,OAAA;EFkBhC;;;EEdhB,MAAA,EAAQ,CAAA;EFXD;;;EEgBP,IAAA;EFdE;;;EEmBF,IAAA;EFIE;;;EECF,GAAA,GAAM,YAAA;;;;EAKN,MAAA;ED7BgC;;;ECkChC,QAAA;ED9BmC;;;ECmCnC,QAAA;ED4C2B;;;ECvC3B,MAAA;ED2CU;;;ECtCV,QAAA;EDqFW;;;EChFX,OAAA;EDsH8B;;;ECjH9B,IAAA;ED+J6B;;;EC1J7B,GAAA;AAAA;AAAA,UAGe,uBAAA,WAAkC,OAAA;EAAA,SACxC,IAAA;EAAA,SACA,OAAA,EAAS,sBAAA,CAAuB,CAAA;EACzC,GAAA,CACE,KAAA,EAAO,MAAA,CAAO,CAAA,GACd,OAAA;IAAY,OAAA,GAAU,OAAA;IAAS,GAAA,GAAM,YAAA;EAAA;EAEvC,GAAA,CAAI,OAAA;IAAY,OAAA,GAAU,OAAA;EAAA,IAAY,MAAA,CAAO,CAAA;EAC7C,GAAA,CAAI,OAAA;IAAY,OAAA,GAAU,OAAA;EAAA;AAAA;AAAA,cAGf,eAAA,WAA0B,OAAA,UAC7B,SAAA,CAAU,sBAAA,CAAuB,CAAA,cAC9B,uBAAA,CAAwB,CAAA;EAAA,mBAEhB,qBAAA,EAAqB,qBAAA;EAAA,UAE9B,MAAA;EAAA,IAoBC,MAAA,IAAU,CAAA;EAAA,IAIV,IAAA;EDxDyC;;;EC+D7C,GAAA,CACL,KAAA,EAAO,MAAA,CAAO,CAAA,GACd,OAAA;IAAY,OAAA,GAAU,OAAA;IAAS,GAAA,GAAM,YAAA;EAAA;EDhC5B;;;ECgDJ,GAAA,CAAI,OAAA;IAAY,OAAA,GAAU,OAAA;EAAA,IAAY,MAAA,CAAO,CAAA;ED9C1C;;;ECyDH,GAAA,CAAI,OAAA;IAAY,OAAA,GAAU,OAAA;EAAA;AAAA;AAAA,UASlB,OAAA;EACf,GAAA,EAAK,MAAA;EACL,GAAA,EAAK,MAAA,SAAe,MAAA;AAAA;AAAA,UAGL,MAAA;EACf,KAAA;EACA,IAAA;EACA,MAAA;EACA,MAAA;EACA,QAAA;EACA,QAAA;EACA,MAAA;AAAA;;;;YClLU,aAAA;IACR,OAAA,EAAS,OAAO;EAAA;AAAA;;;;;;;;;cAYP,mBAAA,mBAAmB,OAAA,kBAAA,MAAA"}
+{"version":3,"file":"index.d.ts","names":[],"sources":["../../../src/server/cookies/services/CookieParser.ts","../../../src/server/cookies/providers/ServerCookiesProvider.ts","../../../src/server/cookies/primitives/$cookie.ts","../../../src/server/cookies/providers/AtomCookiePersistence.ts","../../../src/server/cookies/index.ts"],"mappings":";;;;cAEa;EACJ,oBAAoB,iBAAiB;EAsBrC,yBACL,SAAS,eAAe,gBACxB;EAqBK,eACL,cACA,QAAQ,QACR;;;;cCxBS;qBACQ,QAAM;qBACN,6BAAG;qBACH,cAAY;qBACZ,kBAAgB;qBAChB,gBAAc;qBAGd;qBACA;qBACA;qBACA;WAEH,4BAAS;WAYT,2BAAQ;WAYR,yBAAM;YAeZ,sBAAsB,UAAU,UAAU;;;;;;;;;;;;;;;;;;;;YA8B1C,WAAW,cAAc;EAO5B,UAAU,UAAU,SACzB,cACA,SAAS,uBAAuB,IAChC,iBAAiB,UAChB,OAAO;EA8CH,UAAU,UAAU,SACzB,cACA,SAAS,uBAAuB,IAChC,MAAM,OAAO,IACb,iBAAiB;EAoCZ,aAAa,UAAU,SAC5B,cACA,iBAAiB,SACjB;YAQQ,QAAQ;YAWR,QAAQ;;;;;YAyBR,aAAa;YAIb,KAAK;;;;;;;;;cCjPJ;GAAW,UAAU,SAAO,SAC9B,uBAAuB,IAAE,kBAChB,KAAK,uBAAuB,gBAC7C,wBAAwB;;;UAaV,uBAAuB,UAAU;;;;EAIhD,QAAQ;;;;EAKR;;;;EAKA;;;;EAKA,MAAM;;;;EAKN;;;;EAKA;;;;EAKA;;;;EAKA;;;;EAKA;;;;EAKA;;;;EAKA;;;;EAKA;;;;;;;;;;;;;;;EAgBA;;UAGe,wBAAwB,UAAU;WACxC;WACA,SAAS,uBAAuB;EACzC,IACE,OAAO,OAAO,IACd;IAAY,UAAU;IAAS,MAAM;;EAEvC,IAAI;IAAY,UAAU;MAAY,OAAO;EAC7C,IAAI;IAAY,UAAU;;;cAGf,gBAAgB,UAAU,iBAC7B,UAAU,uBAAuB,eAC9B,wBAAwB;qBAEhB,uBAAqB;YAE9B;MAoBC,UAAU;MAIV;;;;EAOJ,IACL,OAAO,OAAO,IACd;IAAY,UAAU;IAAS,MAAM;;;;;EAgBhC,IAAI;IAAY,UAAU;MAAY,OAAO;;;;EAW7C,IAAI;IAAY,UAAU;;;UASlB;EACf,KAAK;EACL,KAAK,eAAe;;UAGL;EACf;EACA;EACA;EACA;EACA;EACA;EACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;cCjLW;qBACQ,QAAM;qBACN,6BAAG;qBACH,eAAa;qBAEb,4BAAS;qBAmBT,6BAAU;qBAeV,2BAAQ;;;;;YAwBjB,eAAe,MAAM;YAMrB,KAAK,MAAM,gBAAgB,UAAU;YA+BrC,cAAc,MAAM;IAE1B;IACA;IACA;IACA,KAAsB;IAQtB;;;;;;YChIM;IACR,SAAS;;;;;;;;;;;cAYA,sCAAmB,yBAAA"}

package/dist/server/cookies/index.js

@@ -36,7 +36,7 @@ var CookieParser = class {
 		const parts = [];
 		parts.push(`${name}=${cookie.value}`);
 		if (cookie.path) parts.push(`Path=${cookie.path}`);
-		if (cookie.maxAge) parts.push(`Max-Age=${cookie.maxAge}`);
+		if (cookie.maxAge != null) parts.push(`Max-Age=${cookie.maxAge}`);
 		if (cookie.secure !== false && isHttps) parts.push("Secure");
 		if (cookie.httpOnly) parts.push("HttpOnly");
 		if (cookie.sameSite) parts.push(`SameSite=${cookie.sameSite}`);
@@ -102,15 +102,22 @@ var ServerCookiesProvider = class {
 	* When `APP_NAME` is unset the name is returned unchanged, so existing
 	* single-app deployments keep their current cookie names. Same convention as
 	* the `APP_NAME` prefix used by R2 storage and server-timing.
+	*
+	* Pass `prefix = false` to skip the namespace entirely — used for
+	* `persist: "cookie"` atoms, whose browser-side counterpart cannot see
+	* `APP_NAME` and therefore always uses the bare name. See
+	* `CookiePrimitiveOptions.prefix`.
 	*/
-	prefixName(name) {
+	prefixName(name, prefix = true) {
+		if (!prefix) return name;
 		const app = this.alepha.env.APP_NAME;
 		if (!app) return name;
 		return `${String(app).toLowerCase()}.${name}`;
 	}
 	getCookie(name, options, contextCookies) {
 		const cookies = this.getCookiesFromContext(contextCookies);
-		let rawValue = cookies.req[this.prefixName(name)];
+		const prefixed = options.prefix !== false;
+		let rawValue = cookies.req[this.prefixName(name, prefixed)];
 		if (!rawValue) return void 0;
 		try {
 			rawValue = decodeURIComponent(rawValue);
@@ -129,7 +136,7 @@ var ServerCookiesProvider = class {
 			return this.alepha.codec.decode(options.schema, JSON.parse(rawValue));
 		} catch (error) {
 			this.log.warn(`Failed to parse cookie "${name}"`, error);
-			this.deleteCookie(name, cookies);
+			this.deleteCookie(name, cookies, prefixed);
 			return;
 		}
 	}
@@ -148,11 +155,11 @@ var ServerCookiesProvider = class {
 			domain: options.domain
 		};
 		if (options.ttl) cookie.maxAge = this.dateTimeProvider.duration(options.ttl).as("seconds");
-		cookies.res[this.prefixName(name)] = cookie;
+		cookies.res[this.prefixName(name, options.prefix !== false)] = cookie;
 	}
-	deleteCookie(name, contextCookies) {
+	deleteCookie(name, contextCookies, prefix = true) {
 		const cookies = this.getCookiesFromContext(contextCookies);
-		cookies.res[this.prefixName(name)] = null;
+		cookies.res[this.prefixName(name, prefix)] = null;
 	}
 	encrypt(text) {
 		const iv = randomBytes(this.IV_LENGTH);
@@ -245,6 +252,92 @@ var CookiePrimitive = class extends Primitive {
 };
 $cookie[KIND] = CookiePrimitive;
 //#endregion
+//#region ../../src/server/cookies/providers/AtomCookiePersistence.ts
+/**
+* Binds every atom declared with `persist: "cookie"` to an HTTP cookie.
+*
+* - `server:onRequest` — seeds the request-scoped state from the cookie, so
+*   SSR renders with the persisted value.
+* - `state:mutate` — writes the new value back as a Set-Cookie header.
+* - `state:register` — an atom registering lazily *during* a request (first
+*   touched by an SSR render, after `server:onRequest` already ran) reads
+*   its cookie right away, so that render still sees the persisted value.
+*
+* Atoms are resolved from the `StateManager` registry
+* (`alepha.store.listAtoms()`) on every request and every mutation, never
+* from a map built up from `state:register` events. That event fires exactly
+* once per atom and is never replayed, while `$module.register()` registers
+* `atoms[]` BEFORE it wires `imports[]` and injects `services[]` — so the
+* documented `$module({ atoms, imports: [AlephaServerCookies], services })`
+* shape registers every atom before this provider exists. An event-sourced
+* map would stay empty forever there, making `persist: "cookie"` a silent
+* no-op in both directions. Reading the registry on demand is
+* order-independent.
+*
+* The cookie is named after the atom key, lives 365 days, SameSite=lax,
+* path "/". For custom cookie options (encryption, signing, custom TTL),
+* declare an explicit `$cookie({ key: atom.key, ... })` binding instead.
+*/
+var AtomCookiePersistence = class {
+	alepha = $inject(Alepha);
+	log = $logger();
+	serverCookies = $inject(ServerCookiesProvider);
+	onRequest = $hook({
+		on: "server:onRequest",
+		after: [this.serverCookies],
+		handler: ({ request }) => {
+			for (const atom of this.cookieAtoms()) this.read(atom, request.cookies);
+		}
+	});
+	onRegister = $hook({
+		on: "state:register",
+		handler: ({ atom }) => {
+			if (atom.options.persist !== "cookie") return;
+			if (this.alepha.store.get("alepha.http.request")) this.read(atom);
+		}
+	});
+	onMutate = $hook({
+		on: "state:mutate",
+		handler: ({ key, value }) => {
+			const atom = this.alepha.store.getAtom(String(key));
+			if (!atom || atom.options.persist !== "cookie") return;
+			try {
+				this.serverCookies.setCookie(atom.key, this.cookieOptions(atom), value);
+			} catch (error) {
+				this.log.debug(`Cannot persist atom "${atom.key}" to cookie`, { error });
+			}
+		}
+	});
+	/**
+	* Every registered atom declared with `persist: "cookie"`, read live from
+	* the state manager's registry.
+	*/
+	cookieAtoms() {
+		return this.alepha.store.listAtoms().filter((atom) => atom.options.persist === "cookie");
+	}
+	read(atom, cookies) {
+		if (!this.alepha.context.exists()) {
+			this.log.debug(`Skipping cookie read for atom "${atom.key}": no active request context.`);
+			return;
+		}
+		try {
+			const value = this.serverCookies.getCookie(atom.key, this.cookieOptions(atom), cookies);
+			if (value !== void 0) this.alepha.store.set(atom.key, value, { skipEvents: true });
+		} catch (error) {
+			this.log.debug(`Cannot read cookie for atom "${atom.key}"`, { error });
+		}
+	}
+	cookieOptions(atom) {
+		return {
+			schema: atom.schema,
+			path: "/",
+			sameSite: "lax",
+			ttl: [365, "days"],
+			prefix: false
+		};
+	}
+};
+//#endregion
 //#region ../../src/server/cookies/index.ts
 /**
 * Server and browser-safe cookie handling.
@@ -260,10 +353,11 @@ const AlephaServerCookies = $module({
 	services: [
 		AlephaServer,
 		ServerCookiesProvider,
-		CookieParser
+		CookieParser,
+		AtomCookiePersistence
 	]
 });
 //#endregion
-export { $cookie, AlephaServerCookies, CookiePrimitive, ServerCookiesProvider };
+export { $cookie, AlephaServerCookies, AtomCookiePersistence, CookiePrimitive, ServerCookiesProvider };
 
 //# sourceMappingURL=index.js.map

package/dist/server/cookies/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../../../src/server/cookies/services/CookieParser.ts","../../../src/server/cookies/providers/ServerCookiesProvider.ts","../../../src/server/cookies/primitives/$cookie.ts","../../../src/server/cookies/index.ts"],"sourcesContent":["import type { Cookie } from \"../primitives/$cookie.ts\";\n\nexport class CookieParser {\n  public parseRequestCookies(header: string): Record<string, string> {\n    const cookies: Record<string, string> = {};\n    const parts = header.split(\";\");\n    for (const part of parts) {\n      const eqIndex = part.indexOf(\"=\");\n      if (eqIndex === -1) {\n        continue;\n      }\n\n      const key = part.slice(0, eqIndex).trim();\n      const value = part.slice(eqIndex + 1).trim();\n\n      if (!key || !value) {\n        continue;\n      }\n\n      cookies[key] = value;\n    }\n\n    return cookies;\n  }\n\n  public serializeResponseCookies(\n    cookies: Record<string, Cookie | null>,\n    isHttps: boolean,\n  ): string[] {\n    const headers = [];\n\n    for (const [name, cookie] of Object.entries(cookies)) {\n      // If the cookie is null, we need to delete it\n      if (cookie == null) {\n        headers.push(`${name}=; Path=/; Max-Age=0`);\n        continue;\n      }\n\n      if (!cookie.value) {\n        continue;\n      }\n\n      headers.push(this.cookieToString(name, cookie, isHttps));\n    }\n\n    return headers;\n  }\n\n  public cookieToString(\n    name: string,\n    cookie: Cookie,\n    isHttps?: boolean,\n  ): string {\n    const parts: string[] = [];\n\n    parts.push(`${name}=${cookie.value}`);\n\n    if (cookie.path) {\n      parts.push(`Path=${cookie.path}`);\n    }\n    if (cookie.maxAge) {\n      parts.push(`Max-Age=${cookie.maxAge}`);\n    }\n    if (cookie.secure !== false && isHttps) {\n      parts.push(\"Secure\");\n    }\n    if (cookie.httpOnly) {\n      parts.push(\"HttpOnly\");\n    }\n    if (cookie.sameSite) {\n      parts.push(`SameSite=${cookie.sameSite}`);\n    }\n    if (cookie.domain) {\n      parts.push(`Domain=${cookie.domain}`);\n    }\n\n    return parts.join(\"; \");\n  }\n}\n","import {\n  createCipheriv,\n  createDecipheriv,\n  createHash,\n  createHmac,\n  randomBytes,\n  timingSafeEqual,\n} from \"node:crypto\";\nimport { deflateRawSync, inflateRawSync } from \"node:zlib\";\nimport {\n  $hook,\n  $inject,\n  Alepha,\n  AlephaError,\n  type Static,\n  type TSchema,\n} from \"alepha\";\nimport { SecretProvider } from \"alepha/crypto\";\nimport { DateTimeProvider } from \"alepha/datetime\";\nimport { $logger } from \"alepha/logger\";\nimport type {\n  Cookie,\n  CookiePrimitiveOptions,\n  Cookies,\n} from \"../primitives/$cookie.ts\";\nimport { CookieParser } from \"../services/CookieParser.ts\";\n\nexport class ServerCookiesProvider {\n  protected readonly alepha = $inject(Alepha);\n  protected readonly log = $logger();\n  protected readonly cookieParser = $inject(CookieParser);\n  protected readonly dateTimeProvider = $inject(DateTimeProvider);\n  protected readonly secretProvider = $inject(SecretProvider);\n\n  // crypto constants\n  protected readonly ALGORITHM = \"aes-256-gcm\";\n  protected readonly IV_LENGTH = 16; // For GCM\n  protected readonly AUTH_TAG_LENGTH = 16;\n  protected readonly SIGNATURE_LENGTH = 32; // For SHA256\n\n  public readonly onRequest = $hook({\n    on: \"server:onRequest\",\n    handler: ({ request }) => {\n      request.cookies = {\n        req: this.cookieParser.parseRequestCookies(\n          request.headers.cookie ?? \"\",\n        ),\n        res: {},\n      };\n    },\n  });\n\n  public readonly onAction = $hook({\n    on: \"action:onRequest\",\n    handler: ({ request }) => {\n      request.cookies = {\n        req: this.cookieParser.parseRequestCookies(\n          request.headers.cookie ?? \"\",\n        ),\n        res: {},\n      };\n    },\n  });\n\n  public readonly onSend = $hook({\n    on: \"server:onSend\",\n    handler: ({ request }) => {\n      if (request.cookies && Object.keys(request.cookies.res).length > 0) {\n        const setCookieHeaders = this.cookieParser.serializeResponseCookies(\n          request.cookies.res,\n          request.url.protocol === \"https:\",\n        );\n        if (setCookieHeaders.length > 0) {\n          request.reply.headers[\"set-cookie\"] = setCookieHeaders;\n        }\n      }\n    },\n  });\n\n  protected getCookiesFromContext(cookies?: Cookies): Cookies {\n    const contextCookies = this.alepha.store.get(\n      \"alepha.http.request\",\n    )?.cookies;\n    if (cookies) return cookies;\n    if (contextCookies) return contextCookies;\n    throw new AlephaError(\n      \"Cookie context is not available. This method must be called within a server request cycle.\",\n    );\n  }\n\n  /**\n   * Namespaces a cookie name with the app's `APP_NAME` (lowercased) so that\n   * two Alepha apps sharing a cookie jar do not collide.\n   *\n   * Cookies are scoped by host + path only — never by port — so two apps on\n   * `localhost:3000` and `localhost:4000` would otherwise both read/write a\n   * cookie literally named `tokens` and silently clobber each other (and,\n   * because each encrypts with its own `APP_SECRET`, the foreign cookie fails\n   * to decrypt and gets deleted, logging the user out).\n   *\n   * When `APP_NAME` is unset the name is returned unchanged, so existing\n   * single-app deployments keep their current cookie names. Same convention as\n   * the `APP_NAME` prefix used by R2 storage and server-timing.\n   */\n  protected prefixName(name: string): string {\n    const app = this.alepha.env.APP_NAME;\n    if (!app) return name;\n    return `${String(app).toLowerCase()}.${name}`;\n  }\n\n  public getCookie<T extends TSchema>(\n    name: string,\n    options: CookiePrimitiveOptions<T>,\n    contextCookies?: Cookies,\n  ): Static<T> | undefined {\n    const cookies = this.getCookiesFromContext(contextCookies);\n    let rawValue = cookies.req[this.prefixName(name)];\n\n    if (!rawValue) return undefined;\n\n    try {\n      rawValue = decodeURIComponent(rawValue);\n\n      if (options.sign) {\n        const signature = rawValue.substring(0, this.SIGNATURE_LENGTH * 2);\n        const value = rawValue.substring(this.SIGNATURE_LENGTH * 2);\n        const expectedSignature = this.sign(value);\n\n        if (\n          !timingSafeEqual(\n            Buffer.from(signature, \"hex\"),\n            Buffer.from(expectedSignature, \"hex\"),\n          )\n        ) {\n          this.log.warn(`Invalid signature for cookie \"${name}\".`);\n          return undefined;\n        }\n        rawValue = value;\n      }\n\n      if (options.encrypt) {\n        rawValue = this.decrypt(rawValue);\n      }\n\n      if (options.compress) {\n        rawValue = inflateRawSync(Buffer.from(rawValue, \"base64\")).toString(\n          \"utf8\",\n        );\n      }\n\n      return this.alepha.codec.decode(options.schema, JSON.parse(rawValue));\n    } catch (error) {\n      this.log.warn(`Failed to parse cookie \"${name}\"`, error);\n      // corrupted or invalid cookie, instruct browser to delete it on next response\n      this.deleteCookie(name, cookies);\n      return undefined;\n    }\n  }\n\n  public setCookie<T extends TSchema>(\n    name: string,\n    options: CookiePrimitiveOptions<T>,\n    data: Static<T>,\n    contextCookies?: Cookies,\n  ): void {\n    const cookies = this.getCookiesFromContext(contextCookies);\n    let value = JSON.stringify(this.alepha.codec.decode(options.schema, data));\n\n    if (options.compress) {\n      value = deflateRawSync(value).toString(\"base64\");\n    }\n\n    if (options.encrypt) {\n      value = this.encrypt(value);\n    }\n\n    if (options.sign) {\n      value = this.sign(value) + value;\n    }\n\n    const cookie: Cookie = {\n      value: encodeURIComponent(value),\n      path: options.path ?? \"/\",\n      // \"lax\" is correct here — \"strict\" would break OAuth flows because OAuth callbacks\n      // are top-level redirects from the IdP, and strict cookies are not sent on cross-site\n      // top-level navigations. \"lax\" is Chrome's own default and the industry standard.\n      sameSite: options.sameSite ?? \"lax\",\n      secure: options.secure ?? this.alepha.isProduction(),\n      httpOnly: options.httpOnly,\n      domain: options.domain,\n    };\n\n    if (options.ttl) {\n      cookie.maxAge = this.dateTimeProvider.duration(options.ttl).as(\"seconds\");\n    }\n\n    cookies.res[this.prefixName(name)] = cookie;\n  }\n\n  public deleteCookie<T extends TSchema>(\n    name: string,\n    contextCookies?: Cookies,\n  ): void {\n    const cookies = this.getCookiesFromContext(contextCookies);\n    cookies.res[this.prefixName(name)] = null;\n  }\n\n  // --- Crypto & Parsing ---\n\n  protected encrypt(text: string): string {\n    const iv = randomBytes(this.IV_LENGTH);\n    const cipher = createCipheriv(this.ALGORITHM, this.deriveKey(), iv);\n    const encrypted = Buffer.concat([\n      cipher.update(text, \"utf8\"),\n      cipher.final(),\n    ]);\n    const authTag = cipher.getAuthTag();\n    return Buffer.concat([iv, authTag, encrypted]).toString(\"base64\");\n  }\n\n  protected decrypt(encryptedText: string): string {\n    const data = Buffer.from(encryptedText, \"base64\");\n    const iv = data.subarray(0, this.IV_LENGTH);\n    const authTag = data.subarray(\n      this.IV_LENGTH,\n      this.IV_LENGTH + this.AUTH_TAG_LENGTH,\n    );\n\n    const encrypted = data.subarray(this.IV_LENGTH + this.AUTH_TAG_LENGTH);\n    const decipher = createDecipheriv(this.ALGORITHM, this.deriveKey(), iv);\n\n    decipher.setAuthTag(authTag);\n\n    const decrypted = Buffer.concat([\n      decipher.update(encrypted),\n      decipher.final(),\n    ]);\n\n    return decrypted.toString(\"utf8\");\n  }\n\n  /**\n   * Derives a 32-byte key from APP_SECRET via SHA-256.\n   * Accepts any string length — no padding or truncation needed.\n   */\n  protected deriveKey(): Buffer {\n    return createHash(\"sha256\").update(this.secretProvider.secretKey).digest();\n  }\n\n  protected sign(data: string): string {\n    return createHmac(\"sha256\", this.deriveKey()).update(data).digest(\"hex\");\n  }\n}\n","import {\n  $inject,\n  createPrimitive,\n  KIND,\n  Primitive,\n  type Static,\n  type TSchema,\n} from \"alepha\";\nimport type { DurationLike } from \"alepha/datetime\";\nimport { ServerCookiesProvider } from \"../providers/ServerCookiesProvider.ts\";\n\n/**\n * Declares a type-safe, configurable HTTP cookie.\n * This primitive provides methods to get, set, and delete the cookie\n * within the server request/response cycle.\n */\nexport const $cookie = <T extends TSchema>(\n  options: CookiePrimitiveOptions<T>,\n  extendedOptions?: Omit<CookiePrimitiveOptions<T>, \"schema\">,\n): AbstractCookiePrimitive<T> => {\n  if (extendedOptions) {\n    options = {\n      key: options.key,\n      schema: options.schema,\n      ...extendedOptions,\n    };\n  }\n  return createPrimitive(CookiePrimitive<T>, options);\n};\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport interface CookiePrimitiveOptions<T extends TSchema> {\n  /**\n   * The schema for the cookie's value, used for validation and type safety.\n   */\n  schema: T;\n\n  /**\n   * The name of the cookie.\n   */\n  name?: string;\n\n  /**\n   * The cookie's path. Defaults to \"/\".\n   */\n  path?: string;\n\n  /**\n   * Time-to-live for the cookie. Maps to `Max-Age`.\n   */\n  ttl?: DurationLike;\n\n  /**\n   * If true, the cookie is only sent over HTTPS. Defaults to true in production.\n   */\n  secure?: boolean;\n\n  /**\n   * If true, the cookie cannot be accessed by client-side scripts.\n   */\n  httpOnly?: boolean;\n\n  /**\n   * SameSite policy for the cookie. Defaults to \"lax\".\n   */\n  sameSite?: \"strict\" | \"lax\" | \"none\";\n\n  /**\n   * The domain for the cookie.\n   */\n  domain?: string;\n\n  /**\n   * If true, the cookie value will be compressed using zlib.\n   */\n  compress?: boolean;\n\n  /**\n   * If true, the cookie value will be encrypted. Requires `COOKIE_SECRET` env var.\n   */\n  encrypt?: boolean;\n\n  /**\n   * If true, the cookie will be signed to prevent tampering. Requires `COOKIE_SECRET` env var.\n   */\n  sign?: boolean;\n\n  /**\n   * Optional key to link this cookie to an Atom, enabling automatic synchronization between the cookie and the Atom's state.\n   */\n  key?: string;\n}\n\nexport interface AbstractCookiePrimitive<T extends TSchema> {\n  readonly name: string;\n  readonly options: CookiePrimitiveOptions<T>;\n  set(\n    value: Static<T>,\n    options?: { cookies?: Cookies; ttl?: DurationLike },\n  ): void;\n  get(options?: { cookies?: Cookies }): Static<T> | undefined;\n  del(options?: { cookies?: Cookies }): void;\n}\n\nexport class CookiePrimitive<T extends TSchema>\n  extends Primitive<CookiePrimitiveOptions<T>>\n  implements AbstractCookiePrimitive<T>\n{\n  protected readonly serverCookiesProvider = $inject(ServerCookiesProvider);\n\n  protected onInit() {\n    if (this.options.key) {\n      this.alepha.events.on(\"state:mutate\", ({ key, value }) => {\n        if (key === this.options.key) {\n          this.set(value);\n        }\n      });\n      this.alepha.events.on(\"server:onRequest\", ({ request }) => {\n        try {\n          const value = this.get(request);\n          if (value !== undefined) {\n            this.alepha.store.set(this.options.key as any, value, {\n              skipEvents: true,\n            });\n          }\n        } catch {}\n      });\n    }\n  }\n\n  public get schema(): T {\n    return this.options.schema;\n  }\n\n  public get name(): string {\n    return this.options.name ?? `${this.config.propertyKey}`;\n  }\n\n  /**\n   * Sets the cookie with the given value in the current request's response.\n   */\n  public set(\n    value: Static<T>,\n    options?: { cookies?: Cookies; ttl?: DurationLike },\n  ): void {\n    this.serverCookiesProvider.setCookie(\n      this.name,\n      {\n        ...this.options,\n        ttl: options?.ttl ?? this.options.ttl,\n      },\n      value,\n      options?.cookies,\n    );\n  }\n\n  /**\n   * Gets the cookie value from the current request. Returns undefined if not found or invalid.\n   */\n  public get(options?: { cookies?: Cookies }): Static<T> | undefined {\n    return this.serverCookiesProvider.getCookie(\n      this.name,\n      this.options,\n      options?.cookies,\n    );\n  }\n\n  /**\n   * Deletes the cookie in the current request's response.\n   */\n  public del(options?: { cookies?: Cookies }): void {\n    this.serverCookiesProvider.deleteCookie(this.name, options?.cookies);\n  }\n}\n\n$cookie[KIND] = CookiePrimitive;\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport interface Cookies {\n  req: Record<string, string>;\n  res: Record<string, Cookie | null>;\n}\n\nexport interface Cookie {\n  value: string;\n  path?: string;\n  maxAge?: number;\n  secure?: boolean;\n  httpOnly?: boolean;\n  sameSite?: \"strict\" | \"lax\" | \"none\";\n  domain?: string;\n}\n","import { $module } from \"alepha\";\nimport { AlephaServer } from \"alepha/server\";\nimport { $cookie, type Cookies } from \"./primitives/$cookie.ts\";\nimport { ServerCookiesProvider } from \"./providers/ServerCookiesProvider.ts\";\nimport { CookieParser } from \"./services/CookieParser.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport * from \"./primitives/$cookie.ts\";\nexport * from \"./providers/ServerCookiesProvider.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\ndeclare module \"alepha/server\" {\n  interface ServerRequest {\n    cookies: Cookies;\n  }\n}\n\n/**\n * Server and browser-safe cookie handling.\n *\n * **Features:**\n * - Cookie management on server and browser\n *\n * @module alepha.server.cookies\n */\nexport const AlephaServerCookies = $module({\n  name: \"alepha.server.cookies\",\n  primitives: [$cookie],\n  services: [AlephaServer, ServerCookiesProvider, CookieParser],\n});\n"],"mappings":";;;;;;;;AAEA,IAAa,eAAb,MAA0B;CACxB,oBAA2B,QAAwC;EACjE,MAAM,UAAkC,CAAC;EACzC,MAAM,QAAQ,OAAO,MAAM,GAAG;EAC9B,KAAK,MAAM,QAAQ,OAAO;GACxB,MAAM,UAAU,KAAK,QAAQ,GAAG;GAChC,IAAI,YAAY,IACd;GAGF,MAAM,MAAM,KAAK,MAAM,GAAG,OAAO,EAAE,KAAK;GACxC,MAAM,QAAQ,KAAK,MAAM,UAAU,CAAC,EAAE,KAAK;GAE3C,IAAI,CAAC,OAAO,CAAC,OACX;GAGF,QAAQ,OAAO;EACjB;EAEA,OAAO;CACT;CAEA,yBACE,SACA,SACU;EACV,MAAM,UAAU,CAAC;EAEjB,KAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,OAAO,GAAG;GAEpD,IAAI,UAAU,MAAM;IAClB,QAAQ,KAAK,GAAG,KAAK,qBAAqB;IAC1C;GACF;GAEA,IAAI,CAAC,OAAO,OACV;GAGF,QAAQ,KAAK,KAAK,eAAe,MAAM,QAAQ,OAAO,CAAC;EACzD;EAEA,OAAO;CACT;CAEA,eACE,MACA,QACA,SACQ;EACR,MAAM,QAAkB,CAAC;EAEzB,MAAM,KAAK,GAAG,KAAK,GAAG,OAAO,OAAO;EAEpC,IAAI,OAAO,MACT,MAAM,KAAK,QAAQ,OAAO,MAAM;EAElC,IAAI,OAAO,QACT,MAAM,KAAK,WAAW,OAAO,QAAQ;EAEvC,IAAI,OAAO,WAAW,SAAS,SAC7B,MAAM,KAAK,QAAQ;EAErB,IAAI,OAAO,UACT,MAAM,KAAK,UAAU;EAEvB,IAAI,OAAO,UACT,MAAM,KAAK,YAAY,OAAO,UAAU;EAE1C,IAAI,OAAO,QACT,MAAM,KAAK,UAAU,OAAO,QAAQ;EAGtC,OAAO,MAAM,KAAK,IAAI;CACxB;AACF;;;ACnDA,IAAa,wBAAb,MAAmC;CACjC,SAA4B,QAAQ,MAAM;CAC1C,MAAyB,QAAQ;CACjC,eAAkC,QAAQ,YAAY;CACtD,mBAAsC,QAAQ,gBAAgB;CAC9D,iBAAoC,QAAQ,cAAc;CAG1D,YAA+B;CAC/B,YAA+B;CAC/B,kBAAqC;CACrC,mBAAsC;CAEtC,YAA4B,MAAM;EAChC,IAAI;EACJ,UAAU,EAAE,cAAc;GACxB,QAAQ,UAAU;IAChB,KAAK,KAAK,aAAa,oBACrB,QAAQ,QAAQ,UAAU,EAC5B;IACA,KAAK,CAAC;GACR;EACF;CACF,CAAC;CAED,WAA2B,MAAM;EAC/B,IAAI;EACJ,UAAU,EAAE,cAAc;GACxB,QAAQ,UAAU;IAChB,KAAK,KAAK,aAAa,oBACrB,QAAQ,QAAQ,UAAU,EAC5B;IACA,KAAK,CAAC;GACR;EACF;CACF,CAAC;CAED,SAAyB,MAAM;EAC7B,IAAI;EACJ,UAAU,EAAE,cAAc;GACxB,IAAI,QAAQ,WAAW,OAAO,KAAK,QAAQ,QAAQ,GAAG,EAAE,SAAS,GAAG;IAClE,MAAM,mBAAmB,KAAK,aAAa,yBACzC,QAAQ,QAAQ,KAChB,QAAQ,IAAI,aAAa,QAC3B;IACA,IAAI,iBAAiB,SAAS,GAC5B,QAAQ,MAAM,QAAQ,gBAAgB;GAE1C;EACF;CACF,CAAC;CAED,sBAAgC,SAA4B;EAC1D,MAAM,iBAAiB,KAAK,OAAO,MAAM,IACvC,qBACF,GAAG;EACH,IAAI,SAAS,OAAO;EACpB,IAAI,gBAAgB,OAAO;EAC3B,MAAM,IAAI,YACR,4FACF;CACF;;;;;;;;;;;;;;;CAgBA,WAAqB,MAAsB;EACzC,MAAM,MAAM,KAAK,OAAO,IAAI;EAC5B,IAAI,CAAC,KAAK,OAAO;EACjB,OAAO,GAAG,OAAO,GAAG,EAAE,YAAY,EAAE,GAAG;CACzC;CAEA,UACE,MACA,SACA,gBACuB;EACvB,MAAM,UAAU,KAAK,sBAAsB,cAAc;EACzD,IAAI,WAAW,QAAQ,IAAI,KAAK,WAAW,IAAI;EAE/C,IAAI,CAAC,UAAU,OAAO,KAAA;EAEtB,IAAI;GACF,WAAW,mBAAmB,QAAQ;GAEtC,IAAI,QAAQ,MAAM;IAChB,MAAM,YAAY,SAAS,UAAU,GAAG,KAAK,mBAAmB,CAAC;IACjE,MAAM,QAAQ,SAAS,UAAU,KAAK,mBAAmB,CAAC;IAC1D,MAAM,oBAAoB,KAAK,KAAK,KAAK;IAEzC,IACE,CAAC,gBACC,OAAO,KAAK,WAAW,KAAK,GAC5B,OAAO,KAAK,mBAAmB,KAAK,CACtC,GACA;KACA,KAAK,IAAI,KAAK,iCAAiC,KAAK,GAAG;KACvD;IACF;IACA,WAAW;GACb;GAEA,IAAI,QAAQ,SACV,WAAW,KAAK,QAAQ,QAAQ;GAGlC,IAAI,QAAQ,UACV,WAAW,eAAe,OAAO,KAAK,UAAU,QAAQ,CAAC,EAAE,SACzD,MACF;GAGF,OAAO,KAAK,OAAO,MAAM,OAAO,QAAQ,QAAQ,KAAK,MAAM,QAAQ,CAAC;EACtE,SAAS,OAAO;GACd,KAAK,IAAI,KAAK,2BAA2B,KAAK,IAAI,KAAK;GAEvD,KAAK,aAAa,MAAM,OAAO;GAC/B;EACF;CACF;CAEA,UACE,MACA,SACA,MACA,gBACM;EACN,MAAM,UAAU,KAAK,sBAAsB,cAAc;EACzD,IAAI,QAAQ,KAAK,UAAU,KAAK,OAAO,MAAM,OAAO,QAAQ,QAAQ,IAAI,CAAC;EAEzE,IAAI,QAAQ,UACV,QAAQ,eAAe,KAAK,EAAE,SAAS,QAAQ;EAGjD,IAAI,QAAQ,SACV,QAAQ,KAAK,QAAQ,KAAK;EAG5B,IAAI,QAAQ,MACV,QAAQ,KAAK,KAAK,KAAK,IAAI;EAG7B,MAAM,SAAiB;GACrB,OAAO,mBAAmB,KAAK;GAC/B,MAAM,QAAQ,QAAQ;GAItB,UAAU,QAAQ,YAAY;GAC9B,QAAQ,QAAQ,UAAU,KAAK,OAAO,aAAa;GACnD,UAAU,QAAQ;GAClB,QAAQ,QAAQ;EAClB;EAEA,IAAI,QAAQ,KACV,OAAO,SAAS,KAAK,iBAAiB,SAAS,QAAQ,GAAG,EAAE,GAAG,SAAS;EAG1E,QAAQ,IAAI,KAAK,WAAW,IAAI,KAAK;CACvC;CAEA,aACE,MACA,gBACM;EACN,MAAM,UAAU,KAAK,sBAAsB,cAAc;EACzD,QAAQ,IAAI,KAAK,WAAW,IAAI,KAAK;CACvC;CAIA,QAAkB,MAAsB;EACtC,MAAM,KAAK,YAAY,KAAK,SAAS;EACrC,MAAM,SAAS,eAAe,KAAK,WAAW,KAAK,UAAU,GAAG,EAAE;EAClE,MAAM,YAAY,OAAO,OAAO,CAC9B,OAAO,OAAO,MAAM,MAAM,GAC1B,OAAO,MAAM,CACf,CAAC;EACD,MAAM,UAAU,OAAO,WAAW;EAClC,OAAO,OAAO,OAAO;GAAC;GAAI;GAAS;EAAS,CAAC,EAAE,SAAS,QAAQ;CAClE;CAEA,QAAkB,eAA+B;EAC/C,MAAM,OAAO,OAAO,KAAK,eAAe,QAAQ;EAChD,MAAM,KAAK,KAAK,SAAS,GAAG,KAAK,SAAS;EAC1C,MAAM,UAAU,KAAK,SACnB,KAAK,WACL,KAAK,YAAY,KAAK,eACxB;EAEA,MAAM,YAAY,KAAK,SAAS,KAAK,YAAY,KAAK,eAAe;EACrE,MAAM,WAAW,iBAAiB,KAAK,WAAW,KAAK,UAAU,GAAG,EAAE;EAEtE,SAAS,WAAW,OAAO;EAO3B,OALkB,OAAO,OAAO,CAC9B,SAAS,OAAO,SAAS,GACzB,SAAS,MAAM,CACjB,CAEe,EAAE,SAAS,MAAM;CAClC;;;;;CAMA,YAA8B;EAC5B,OAAO,WAAW,QAAQ,EAAE,OAAO,KAAK,eAAe,SAAS,EAAE,OAAO;CAC3E;CAEA,KAAe,MAAsB;EACnC,OAAO,WAAW,UAAU,KAAK,UAAU,CAAC,EAAE,OAAO,IAAI,EAAE,OAAO,KAAK;CACzE;AACF;;;;;;;;AC5OA,MAAa,WACX,SACA,oBAC+B;CAC/B,IAAI,iBACF,UAAU;EACR,KAAK,QAAQ;EACb,QAAQ,QAAQ;EAChB,GAAG;CACL;CAEF,OAAO,gBAAgB,iBAAoB,OAAO;AACpD;AA6EA,IAAa,kBAAb,cACU,UAEV;CACE,wBAA2C,QAAQ,qBAAqB;CAExE,SAAmB;EACjB,IAAI,KAAK,QAAQ,KAAK;GACpB,KAAK,OAAO,OAAO,GAAG,iBAAiB,EAAE,KAAK,YAAY;IACxD,IAAI,QAAQ,KAAK,QAAQ,KACvB,KAAK,IAAI,KAAK;GAElB,CAAC;GACD,KAAK,OAAO,OAAO,GAAG,qBAAqB,EAAE,cAAc;IACzD,IAAI;KACF,MAAM,QAAQ,KAAK,IAAI,OAAO;KAC9B,IAAI,UAAU,KAAA,GACZ,KAAK,OAAO,MAAM,IAAI,KAAK,QAAQ,KAAY,OAAO,EACpD,YAAY,KACd,CAAC;IAEL,QAAQ,CAAC;GACX,CAAC;EACH;CACF;CAEA,IAAW,SAAY;EACrB,OAAO,KAAK,QAAQ;CACtB;CAEA,IAAW,OAAe;EACxB,OAAO,KAAK,QAAQ,QAAQ,GAAG,KAAK,OAAO;CAC7C;;;;CAKA,IACE,OACA,SACM;EACN,KAAK,sBAAsB,UACzB,KAAK,MACL;GACE,GAAG,KAAK;GACR,KAAK,SAAS,OAAO,KAAK,QAAQ;EACpC,GACA,OACA,SAAS,OACX;CACF;;;;CAKA,IAAW,SAAwD;EACjE,OAAO,KAAK,sBAAsB,UAChC,KAAK,MACL,KAAK,SACL,SAAS,OACX;CACF;;;;CAKA,IAAW,SAAuC;EAChD,KAAK,sBAAsB,aAAa,KAAK,MAAM,SAAS,OAAO;CACrE;AACF;AAEA,QAAQ,QAAQ;;;;;;;;;;;ACrJhB,MAAa,sBAAsB,QAAQ;CACzC,MAAM;CACN,YAAY,CAAC,OAAO;CACpB,UAAU;EAAC;EAAc;EAAuB;CAAY;AAC9D,CAAC"}
+{"version":3,"file":"index.js","names":[],"sources":["../../../src/server/cookies/services/CookieParser.ts","../../../src/server/cookies/providers/ServerCookiesProvider.ts","../../../src/server/cookies/primitives/$cookie.ts","../../../src/server/cookies/providers/AtomCookiePersistence.ts","../../../src/server/cookies/index.ts"],"sourcesContent":["import type { Cookie } from \"../primitives/$cookie.ts\";\n\nexport class CookieParser {\n  public parseRequestCookies(header: string): Record<string, string> {\n    const cookies: Record<string, string> = {};\n    const parts = header.split(\";\");\n    for (const part of parts) {\n      const eqIndex = part.indexOf(\"=\");\n      if (eqIndex === -1) {\n        continue;\n      }\n\n      const key = part.slice(0, eqIndex).trim();\n      const value = part.slice(eqIndex + 1).trim();\n\n      if (!key || !value) {\n        continue;\n      }\n\n      cookies[key] = value;\n    }\n\n    return cookies;\n  }\n\n  public serializeResponseCookies(\n    cookies: Record<string, Cookie | null>,\n    isHttps: boolean,\n  ): string[] {\n    const headers = [];\n\n    for (const [name, cookie] of Object.entries(cookies)) {\n      // If the cookie is null, we need to delete it\n      if (cookie == null) {\n        headers.push(`${name}=; Path=/; Max-Age=0`);\n        continue;\n      }\n\n      if (!cookie.value) {\n        continue;\n      }\n\n      headers.push(this.cookieToString(name, cookie, isHttps));\n    }\n\n    return headers;\n  }\n\n  public cookieToString(\n    name: string,\n    cookie: Cookie,\n    isHttps?: boolean,\n  ): string {\n    const parts: string[] = [];\n\n    parts.push(`${name}=${cookie.value}`);\n\n    if (cookie.path) {\n      parts.push(`Path=${cookie.path}`);\n    }\n    // `!= null`, not truthy: `maxAge: 0` is the standard \"delete this\n    // cookie now\" value (used by AtomCookiePersistence.browser.ts's\n    // clearCookie() and BrowserCookiePrimitive.del()). A truthy check would\n    // silently drop `Max-Age` for exactly that value, turning a deletion\n    // into a plain (non-expiring-until-session-end) write.\n    if (cookie.maxAge != null) {\n      parts.push(`Max-Age=${cookie.maxAge}`);\n    }\n    if (cookie.secure !== false && isHttps) {\n      parts.push(\"Secure\");\n    }\n    if (cookie.httpOnly) {\n      parts.push(\"HttpOnly\");\n    }\n    if (cookie.sameSite) {\n      parts.push(`SameSite=${cookie.sameSite}`);\n    }\n    if (cookie.domain) {\n      parts.push(`Domain=${cookie.domain}`);\n    }\n\n    return parts.join(\"; \");\n  }\n}\n","import {\n  createCipheriv,\n  createDecipheriv,\n  createHash,\n  createHmac,\n  randomBytes,\n  timingSafeEqual,\n} from \"node:crypto\";\nimport { deflateRawSync, inflateRawSync } from \"node:zlib\";\nimport {\n  $hook,\n  $inject,\n  Alepha,\n  AlephaError,\n  type Static,\n  type TSchema,\n} from \"alepha\";\nimport { SecretProvider } from \"alepha/crypto\";\nimport { DateTimeProvider } from \"alepha/datetime\";\nimport { $logger } from \"alepha/logger\";\nimport type {\n  Cookie,\n  CookiePrimitiveOptions,\n  Cookies,\n} from \"../primitives/$cookie.ts\";\nimport { CookieParser } from \"../services/CookieParser.ts\";\n\nexport class ServerCookiesProvider {\n  protected readonly alepha = $inject(Alepha);\n  protected readonly log = $logger();\n  protected readonly cookieParser = $inject(CookieParser);\n  protected readonly dateTimeProvider = $inject(DateTimeProvider);\n  protected readonly secretProvider = $inject(SecretProvider);\n\n  // crypto constants\n  protected readonly ALGORITHM = \"aes-256-gcm\";\n  protected readonly IV_LENGTH = 16; // For GCM\n  protected readonly AUTH_TAG_LENGTH = 16;\n  protected readonly SIGNATURE_LENGTH = 32; // For SHA256\n\n  public readonly onRequest = $hook({\n    on: \"server:onRequest\",\n    handler: ({ request }) => {\n      request.cookies = {\n        req: this.cookieParser.parseRequestCookies(\n          request.headers.cookie ?? \"\",\n        ),\n        res: {},\n      };\n    },\n  });\n\n  public readonly onAction = $hook({\n    on: \"action:onRequest\",\n    handler: ({ request }) => {\n      request.cookies = {\n        req: this.cookieParser.parseRequestCookies(\n          request.headers.cookie ?? \"\",\n        ),\n        res: {},\n      };\n    },\n  });\n\n  public readonly onSend = $hook({\n    on: \"server:onSend\",\n    handler: ({ request }) => {\n      if (request.cookies && Object.keys(request.cookies.res).length > 0) {\n        const setCookieHeaders = this.cookieParser.serializeResponseCookies(\n          request.cookies.res,\n          request.url.protocol === \"https:\",\n        );\n        if (setCookieHeaders.length > 0) {\n          request.reply.headers[\"set-cookie\"] = setCookieHeaders;\n        }\n      }\n    },\n  });\n\n  protected getCookiesFromContext(cookies?: Cookies): Cookies {\n    const contextCookies = this.alepha.store.get(\n      \"alepha.http.request\",\n    )?.cookies;\n    if (cookies) return cookies;\n    if (contextCookies) return contextCookies;\n    throw new AlephaError(\n      \"Cookie context is not available. This method must be called within a server request cycle.\",\n    );\n  }\n\n  /**\n   * Namespaces a cookie name with the app's `APP_NAME` (lowercased) so that\n   * two Alepha apps sharing a cookie jar do not collide.\n   *\n   * Cookies are scoped by host + path only — never by port — so two apps on\n   * `localhost:3000` and `localhost:4000` would otherwise both read/write a\n   * cookie literally named `tokens` and silently clobber each other (and,\n   * because each encrypts with its own `APP_SECRET`, the foreign cookie fails\n   * to decrypt and gets deleted, logging the user out).\n   *\n   * When `APP_NAME` is unset the name is returned unchanged, so existing\n   * single-app deployments keep their current cookie names. Same convention as\n   * the `APP_NAME` prefix used by R2 storage and server-timing.\n   *\n   * Pass `prefix = false` to skip the namespace entirely — used for\n   * `persist: \"cookie\"` atoms, whose browser-side counterpart cannot see\n   * `APP_NAME` and therefore always uses the bare name. See\n   * `CookiePrimitiveOptions.prefix`.\n   */\n  protected prefixName(name: string, prefix = true): string {\n    if (!prefix) return name;\n    const app = this.alepha.env.APP_NAME;\n    if (!app) return name;\n    return `${String(app).toLowerCase()}.${name}`;\n  }\n\n  public getCookie<T extends TSchema>(\n    name: string,\n    options: CookiePrimitiveOptions<T>,\n    contextCookies?: Cookies,\n  ): Static<T> | undefined {\n    const cookies = this.getCookiesFromContext(contextCookies);\n    const prefixed = options.prefix !== false;\n    let rawValue = cookies.req[this.prefixName(name, prefixed)];\n\n    if (!rawValue) return undefined;\n\n    try {\n      rawValue = decodeURIComponent(rawValue);\n\n      if (options.sign) {\n        const signature = rawValue.substring(0, this.SIGNATURE_LENGTH * 2);\n        const value = rawValue.substring(this.SIGNATURE_LENGTH * 2);\n        const expectedSignature = this.sign(value);\n\n        if (\n          !timingSafeEqual(\n            Buffer.from(signature, \"hex\"),\n            Buffer.from(expectedSignature, \"hex\"),\n          )\n        ) {\n          this.log.warn(`Invalid signature for cookie \"${name}\".`);\n          return undefined;\n        }\n        rawValue = value;\n      }\n\n      if (options.encrypt) {\n        rawValue = this.decrypt(rawValue);\n      }\n\n      if (options.compress) {\n        rawValue = inflateRawSync(Buffer.from(rawValue, \"base64\")).toString(\n          \"utf8\",\n        );\n      }\n\n      return this.alepha.codec.decode(options.schema, JSON.parse(rawValue));\n    } catch (error) {\n      this.log.warn(`Failed to parse cookie \"${name}\"`, error);\n      // corrupted or invalid cookie, instruct browser to delete it on next response\n      this.deleteCookie(name, cookies, prefixed);\n      return undefined;\n    }\n  }\n\n  public setCookie<T extends TSchema>(\n    name: string,\n    options: CookiePrimitiveOptions<T>,\n    data: Static<T>,\n    contextCookies?: Cookies,\n  ): void {\n    const cookies = this.getCookiesFromContext(contextCookies);\n    let value = JSON.stringify(this.alepha.codec.decode(options.schema, data));\n\n    if (options.compress) {\n      value = deflateRawSync(value).toString(\"base64\");\n    }\n\n    if (options.encrypt) {\n      value = this.encrypt(value);\n    }\n\n    if (options.sign) {\n      value = this.sign(value) + value;\n    }\n\n    const cookie: Cookie = {\n      value: encodeURIComponent(value),\n      path: options.path ?? \"/\",\n      // \"lax\" is correct here — \"strict\" would break OAuth flows because OAuth callbacks\n      // are top-level redirects from the IdP, and strict cookies are not sent on cross-site\n      // top-level navigations. \"lax\" is Chrome's own default and the industry standard.\n      sameSite: options.sameSite ?? \"lax\",\n      secure: options.secure ?? this.alepha.isProduction(),\n      httpOnly: options.httpOnly,\n      domain: options.domain,\n    };\n\n    if (options.ttl) {\n      cookie.maxAge = this.dateTimeProvider.duration(options.ttl).as(\"seconds\");\n    }\n\n    cookies.res[this.prefixName(name, options.prefix !== false)] = cookie;\n  }\n\n  public deleteCookie<T extends TSchema>(\n    name: string,\n    contextCookies?: Cookies,\n    prefix = true,\n  ): void {\n    const cookies = this.getCookiesFromContext(contextCookies);\n    cookies.res[this.prefixName(name, prefix)] = null;\n  }\n\n  // --- Crypto & Parsing ---\n\n  protected encrypt(text: string): string {\n    const iv = randomBytes(this.IV_LENGTH);\n    const cipher = createCipheriv(this.ALGORITHM, this.deriveKey(), iv);\n    const encrypted = Buffer.concat([\n      cipher.update(text, \"utf8\"),\n      cipher.final(),\n    ]);\n    const authTag = cipher.getAuthTag();\n    return Buffer.concat([iv, authTag, encrypted]).toString(\"base64\");\n  }\n\n  protected decrypt(encryptedText: string): string {\n    const data = Buffer.from(encryptedText, \"base64\");\n    const iv = data.subarray(0, this.IV_LENGTH);\n    const authTag = data.subarray(\n      this.IV_LENGTH,\n      this.IV_LENGTH + this.AUTH_TAG_LENGTH,\n    );\n\n    const encrypted = data.subarray(this.IV_LENGTH + this.AUTH_TAG_LENGTH);\n    const decipher = createDecipheriv(this.ALGORITHM, this.deriveKey(), iv);\n\n    decipher.setAuthTag(authTag);\n\n    const decrypted = Buffer.concat([\n      decipher.update(encrypted),\n      decipher.final(),\n    ]);\n\n    return decrypted.toString(\"utf8\");\n  }\n\n  /**\n   * Derives a 32-byte key from APP_SECRET via SHA-256.\n   * Accepts any string length — no padding or truncation needed.\n   */\n  protected deriveKey(): Buffer {\n    return createHash(\"sha256\").update(this.secretProvider.secretKey).digest();\n  }\n\n  protected sign(data: string): string {\n    return createHmac(\"sha256\", this.deriveKey()).update(data).digest(\"hex\");\n  }\n}\n","import {\n  $inject,\n  createPrimitive,\n  KIND,\n  Primitive,\n  type Static,\n  type TSchema,\n} from \"alepha\";\nimport type { DurationLike } from \"alepha/datetime\";\nimport { ServerCookiesProvider } from \"../providers/ServerCookiesProvider.ts\";\n\n/**\n * Declares a type-safe, configurable HTTP cookie.\n * This primitive provides methods to get, set, and delete the cookie\n * within the server request/response cycle.\n */\nexport const $cookie = <T extends TSchema>(\n  options: CookiePrimitiveOptions<T>,\n  extendedOptions?: Omit<CookiePrimitiveOptions<T>, \"schema\">,\n): AbstractCookiePrimitive<T> => {\n  if (extendedOptions) {\n    options = {\n      key: options.key,\n      schema: options.schema,\n      ...extendedOptions,\n    };\n  }\n  return createPrimitive(CookiePrimitive<T>, options);\n};\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport interface CookiePrimitiveOptions<T extends TSchema> {\n  /**\n   * The schema for the cookie's value, used for validation and type safety.\n   */\n  schema: T;\n\n  /**\n   * The name of the cookie.\n   */\n  name?: string;\n\n  /**\n   * The cookie's path. Defaults to \"/\".\n   */\n  path?: string;\n\n  /**\n   * Time-to-live for the cookie. Maps to `Max-Age`.\n   */\n  ttl?: DurationLike;\n\n  /**\n   * If true, the cookie is only sent over HTTPS. Defaults to true in production.\n   */\n  secure?: boolean;\n\n  /**\n   * If true, the cookie cannot be accessed by client-side scripts.\n   */\n  httpOnly?: boolean;\n\n  /**\n   * SameSite policy for the cookie. Defaults to \"lax\".\n   */\n  sameSite?: \"strict\" | \"lax\" | \"none\";\n\n  /**\n   * The domain for the cookie.\n   */\n  domain?: string;\n\n  /**\n   * If true, the cookie value will be compressed using zlib.\n   */\n  compress?: boolean;\n\n  /**\n   * If true, the cookie value will be encrypted. Requires `COOKIE_SECRET` env var.\n   */\n  encrypt?: boolean;\n\n  /**\n   * If true, the cookie will be signed to prevent tampering. Requires `COOKIE_SECRET` env var.\n   */\n  sign?: boolean;\n\n  /**\n   * Optional key to link this cookie to an Atom, enabling automatic synchronization between the cookie and the Atom's state.\n   */\n  key?: string;\n\n  /**\n   * Internal escape hatch: when explicitly set to `false`, the server skips\n   * the `APP_NAME` cookie-name namespace applied by\n   * `ServerCookiesProvider.prefixName()`.\n   *\n   * Used by `AtomCookiePersistence` so the cookie name the server\n   * reads/writes for a `persist: \"cookie\"` atom matches the bare name its\n   * browser variant uses — `APP_NAME` is not reachable client-side (not\n   * baked into the client bundle, not part of SSR hydration), so the\n   * browser can only ever use the bare atom key.\n   *\n   * Application code declaring `$cookie(...)` directly should leave this\n   * unset — it defaults to `true` (prefixed), matching every other cookie.\n   */\n  prefix?: boolean;\n}\n\nexport interface AbstractCookiePrimitive<T extends TSchema> {\n  readonly name: string;\n  readonly options: CookiePrimitiveOptions<T>;\n  set(\n    value: Static<T>,\n    options?: { cookies?: Cookies; ttl?: DurationLike },\n  ): void;\n  get(options?: { cookies?: Cookies }): Static<T> | undefined;\n  del(options?: { cookies?: Cookies }): void;\n}\n\nexport class CookiePrimitive<T extends TSchema>\n  extends Primitive<CookiePrimitiveOptions<T>>\n  implements AbstractCookiePrimitive<T>\n{\n  protected readonly serverCookiesProvider = $inject(ServerCookiesProvider);\n\n  protected onInit() {\n    if (this.options.key) {\n      this.alepha.events.on(\"state:mutate\", ({ key, value }) => {\n        if (key === this.options.key) {\n          this.set(value);\n        }\n      });\n      this.alepha.events.on(\"server:onRequest\", ({ request }) => {\n        try {\n          const value = this.get(request);\n          if (value !== undefined) {\n            this.alepha.store.set(this.options.key as any, value, {\n              skipEvents: true,\n            });\n          }\n        } catch {}\n      });\n    }\n  }\n\n  public get schema(): T {\n    return this.options.schema;\n  }\n\n  public get name(): string {\n    return this.options.name ?? `${this.config.propertyKey}`;\n  }\n\n  /**\n   * Sets the cookie with the given value in the current request's response.\n   */\n  public set(\n    value: Static<T>,\n    options?: { cookies?: Cookies; ttl?: DurationLike },\n  ): void {\n    this.serverCookiesProvider.setCookie(\n      this.name,\n      {\n        ...this.options,\n        ttl: options?.ttl ?? this.options.ttl,\n      },\n      value,\n      options?.cookies,\n    );\n  }\n\n  /**\n   * Gets the cookie value from the current request. Returns undefined if not found or invalid.\n   */\n  public get(options?: { cookies?: Cookies }): Static<T> | undefined {\n    return this.serverCookiesProvider.getCookie(\n      this.name,\n      this.options,\n      options?.cookies,\n    );\n  }\n\n  /**\n   * Deletes the cookie in the current request's response.\n   */\n  public del(options?: { cookies?: Cookies }): void {\n    this.serverCookiesProvider.deleteCookie(this.name, options?.cookies);\n  }\n}\n\n$cookie[KIND] = CookiePrimitive;\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport interface Cookies {\n  req: Record<string, string>;\n  res: Record<string, Cookie | null>;\n}\n\nexport interface Cookie {\n  value: string;\n  path?: string;\n  maxAge?: number;\n  secure?: boolean;\n  httpOnly?: boolean;\n  sameSite?: \"strict\" | \"lax\" | \"none\";\n  domain?: string;\n}\n","import { $hook, $inject, Alepha, type Atom, type State } from \"alepha\";\nimport type { DurationLike } from \"alepha/datetime\";\nimport { $logger } from \"alepha/logger\";\nimport type { Cookies } from \"../primitives/$cookie.ts\";\nimport { ServerCookiesProvider } from \"./ServerCookiesProvider.ts\";\n\n/**\n * Binds every atom declared with `persist: \"cookie\"` to an HTTP cookie.\n *\n * - `server:onRequest` — seeds the request-scoped state from the cookie, so\n *   SSR renders with the persisted value.\n * - `state:mutate` — writes the new value back as a Set-Cookie header.\n * - `state:register` — an atom registering lazily *during* a request (first\n *   touched by an SSR render, after `server:onRequest` already ran) reads\n *   its cookie right away, so that render still sees the persisted value.\n *\n * Atoms are resolved from the `StateManager` registry\n * (`alepha.store.listAtoms()`) on every request and every mutation, never\n * from a map built up from `state:register` events. That event fires exactly\n * once per atom and is never replayed, while `$module.register()` registers\n * `atoms[]` BEFORE it wires `imports[]` and injects `services[]` — so the\n * documented `$module({ atoms, imports: [AlephaServerCookies], services })`\n * shape registers every atom before this provider exists. An event-sourced\n * map would stay empty forever there, making `persist: \"cookie\"` a silent\n * no-op in both directions. Reading the registry on demand is\n * order-independent.\n *\n * The cookie is named after the atom key, lives 365 days, SameSite=lax,\n * path \"/\". For custom cookie options (encryption, signing, custom TTL),\n * declare an explicit `$cookie({ key: atom.key, ... })` binding instead.\n */\nexport class AtomCookiePersistence {\n  protected readonly alepha = $inject(Alepha);\n  protected readonly log = $logger();\n  protected readonly serverCookies = $inject(ServerCookiesProvider);\n\n  protected readonly onRequest = $hook({\n    on: \"server:onRequest\",\n    // Explicit dependency instead of relying on `services` array order in\n    // `AlephaServerCookies`: this hook needs `request.cookies`, which is\n    // only populated by `ServerCookiesProvider.onRequest`. If that ever ran\n    // second, `getCookiesFromContext` would throw, get caught, and log at\n    // debug — cookies silently ignored in production with no visible error.\n    after: [this.serverCookies],\n    handler: ({ request }) => {\n      // `alepha.http.request` is not set in the store yet at this point in\n      // the request lifecycle (`ServerRouterProvider` sets it only after\n      // `server:onRequest` resolves), so the request-scoped cookie jar must\n      // be passed explicitly rather than resolved from context.\n      for (const atom of this.cookieAtoms()) {\n        this.read(atom, request.cookies);\n      }\n    },\n  });\n\n  protected readonly onRegister = $hook({\n    on: \"state:register\",\n    handler: ({ atom }) => {\n      if (atom.options.persist !== \"cookie\") {\n        return;\n      }\n\n      // Only the lazy, mid-request case is handled here — every atom already\n      // registered when the request started was swept by `onRequest` above.\n      if (this.alepha.store.get(\"alepha.http.request\")) {\n        this.read(atom);\n      }\n    },\n  });\n\n  protected readonly onMutate = $hook({\n    on: \"state:mutate\",\n    handler: ({ key, value }) => {\n      const atom = this.alepha.store.getAtom(String(key));\n      if (!atom || atom.options.persist !== \"cookie\") {\n        return;\n      }\n      try {\n        this.serverCookies.setCookie(atom.key, this.cookieOptions(atom), value);\n      } catch (error) {\n        // Outside a request cycle there is no response to attach the\n        // Set-Cookie header to; browser-side writes are handled by the\n        // browser variant of this provider.\n        this.log.debug(`Cannot persist atom \"${atom.key}\" to cookie`, {\n          error,\n        });\n      }\n    },\n  });\n\n  /**\n   * Every registered atom declared with `persist: \"cookie\"`, read live from\n   * the state manager's registry.\n   */\n  protected cookieAtoms(): Array<Atom<any, any>> {\n    return this.alepha.store\n      .listAtoms()\n      .filter((atom) => atom.options.persist === \"cookie\");\n  }\n\n  protected read(atom: Atom<any, any>, cookies?: Cookies): void {\n    // Safety net, not a live bug today: an ALS provider is always installed\n    // by `core/index.ts` / `core/index.workerd.ts`, so every request already\n    // runs inside its own fork. But `store.set(..., { skipEvents: true })`\n    // below has no `skipContext`, so if no fork were active,\n    // `StateManager.set()` would fall through to writing the APP-LEVEL\n    // store — turning one user's cookie value into what every subsequent\n    // cookieless request reads. Degrade to \"cookie ignored\" instead.\n    if (!this.alepha.context.exists()) {\n      this.log.debug(\n        `Skipping cookie read for atom \"${atom.key}\": no active request context.`,\n      );\n      return;\n    }\n\n    try {\n      const value = this.serverCookies.getCookie(\n        atom.key,\n        this.cookieOptions(atom),\n        cookies,\n      );\n      if (value !== undefined) {\n        this.alepha.store.set(atom.key as keyof State, value, {\n          skipEvents: true,\n        });\n      }\n    } catch (error) {\n      this.log.debug(`Cannot read cookie for atom \"${atom.key}\"`, { error });\n    }\n  }\n\n  protected cookieOptions(atom: Atom<any, any>) {\n    return {\n      schema: atom.schema,\n      path: \"/\",\n      sameSite: \"lax\" as const,\n      ttl: [365, \"days\"] as DurationLike,\n      // The browser variant of this adapter cannot see APP_NAME (not baked\n      // into the client bundle, not part of SSR hydration — see\n      // AtomCookiePersistence.browser.ts), so it always reads/writes the\n      // bare atom key. Skip the APP_NAME prefix here too — specifically for\n      // atom-persisted cookies — so both sides agree on the same cookie\n      // name. Every other server cookie ($cookie primitive) still gets the\n      // namespace; see ServerCookiesProvider.prefixName.\n      prefix: false,\n    };\n  }\n}\n","import { $module } from \"alepha\";\nimport { AlephaServer } from \"alepha/server\";\nimport { $cookie, type Cookies } from \"./primitives/$cookie.ts\";\nimport { AtomCookiePersistence } from \"./providers/AtomCookiePersistence.ts\";\nimport { ServerCookiesProvider } from \"./providers/ServerCookiesProvider.ts\";\nimport { CookieParser } from \"./services/CookieParser.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport * from \"./primitives/$cookie.ts\";\nexport * from \"./providers/AtomCookiePersistence.ts\";\nexport * from \"./providers/ServerCookiesProvider.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\ndeclare module \"alepha/server\" {\n  interface ServerRequest {\n    cookies: Cookies;\n  }\n}\n\n/**\n * Server and browser-safe cookie handling.\n *\n * **Features:**\n * - Cookie management on server and browser\n *\n * @module alepha.server.cookies\n */\nexport const AlephaServerCookies = $module({\n  name: \"alepha.server.cookies\",\n  primitives: [$cookie],\n  services: [\n    AlephaServer,\n    ServerCookiesProvider,\n    CookieParser,\n    AtomCookiePersistence,\n  ],\n});\n"],"mappings":";;;;;;;;AAEA,IAAa,eAAb,MAA0B;CACxB,oBAA2B,QAAwC;EACjE,MAAM,UAAkC,CAAC;EACzC,MAAM,QAAQ,OAAO,MAAM,GAAG;EAC9B,KAAK,MAAM,QAAQ,OAAO;GACxB,MAAM,UAAU,KAAK,QAAQ,GAAG;GAChC,IAAI,YAAY,IACd;GAGF,MAAM,MAAM,KAAK,MAAM,GAAG,OAAO,CAAC,CAAC,KAAK;GACxC,MAAM,QAAQ,KAAK,MAAM,UAAU,CAAC,CAAC,CAAC,KAAK;GAE3C,IAAI,CAAC,OAAO,CAAC,OACX;GAGF,QAAQ,OAAO;EACjB;EAEA,OAAO;CACT;CAEA,yBACE,SACA,SACU;EACV,MAAM,UAAU,CAAC;EAEjB,KAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,OAAO,GAAG;GAEpD,IAAI,UAAU,MAAM;IAClB,QAAQ,KAAK,GAAG,KAAK,qBAAqB;IAC1C;GACF;GAEA,IAAI,CAAC,OAAO,OACV;GAGF,QAAQ,KAAK,KAAK,eAAe,MAAM,QAAQ,OAAO,CAAC;EACzD;EAEA,OAAO;CACT;CAEA,eACE,MACA,QACA,SACQ;EACR,MAAM,QAAkB,CAAC;EAEzB,MAAM,KAAK,GAAG,KAAK,GAAG,OAAO,OAAO;EAEpC,IAAI,OAAO,MACT,MAAM,KAAK,QAAQ,OAAO,MAAM;EAOlC,IAAI,OAAO,UAAU,MACnB,MAAM,KAAK,WAAW,OAAO,QAAQ;EAEvC,IAAI,OAAO,WAAW,SAAS,SAC7B,MAAM,KAAK,QAAQ;EAErB,IAAI,OAAO,UACT,MAAM,KAAK,UAAU;EAEvB,IAAI,OAAO,UACT,MAAM,KAAK,YAAY,OAAO,UAAU;EAE1C,IAAI,OAAO,QACT,MAAM,KAAK,UAAU,OAAO,QAAQ;EAGtC,OAAO,MAAM,KAAK,IAAI;CACxB;AACF;;;ACxDA,IAAa,wBAAb,MAAmC;CACjC,SAA4B,QAAQ,MAAM;CAC1C,MAAyB,QAAQ;CACjC,eAAkC,QAAQ,YAAY;CACtD,mBAAsC,QAAQ,gBAAgB;CAC9D,iBAAoC,QAAQ,cAAc;CAG1D,YAA+B;CAC/B,YAA+B;CAC/B,kBAAqC;CACrC,mBAAsC;CAEtC,YAA4B,MAAM;EAChC,IAAI;EACJ,UAAU,EAAE,cAAc;GACxB,QAAQ,UAAU;IAChB,KAAK,KAAK,aAAa,oBACrB,QAAQ,QAAQ,UAAU,EAC5B;IACA,KAAK,CAAC;GACR;EACF;CACF,CAAC;CAED,WAA2B,MAAM;EAC/B,IAAI;EACJ,UAAU,EAAE,cAAc;GACxB,QAAQ,UAAU;IAChB,KAAK,KAAK,aAAa,oBACrB,QAAQ,QAAQ,UAAU,EAC5B;IACA,KAAK,CAAC;GACR;EACF;CACF,CAAC;CAED,SAAyB,MAAM;EAC7B,IAAI;EACJ,UAAU,EAAE,cAAc;GACxB,IAAI,QAAQ,WAAW,OAAO,KAAK,QAAQ,QAAQ,GAAG,CAAC,CAAC,SAAS,GAAG;IAClE,MAAM,mBAAmB,KAAK,aAAa,yBACzC,QAAQ,QAAQ,KAChB,QAAQ,IAAI,aAAa,QAC3B;IACA,IAAI,iBAAiB,SAAS,GAC5B,QAAQ,MAAM,QAAQ,gBAAgB;GAE1C;EACF;CACF,CAAC;CAED,sBAAgC,SAA4B;EAC1D,MAAM,iBAAiB,KAAK,OAAO,MAAM,IACvC,qBACF,CAAC,EAAE;EACH,IAAI,SAAS,OAAO;EACpB,IAAI,gBAAgB,OAAO;EAC3B,MAAM,IAAI,YACR,4FACF;CACF;;;;;;;;;;;;;;;;;;;;CAqBA,WAAqB,MAAc,SAAS,MAAc;EACxD,IAAI,CAAC,QAAQ,OAAO;EACpB,MAAM,MAAM,KAAK,OAAO,IAAI;EAC5B,IAAI,CAAC,KAAK,OAAO;EACjB,OAAO,GAAG,OAAO,GAAG,CAAC,CAAC,YAAY,EAAE,GAAG;CACzC;CAEA,UACE,MACA,SACA,gBACuB;EACvB,MAAM,UAAU,KAAK,sBAAsB,cAAc;EACzD,MAAM,WAAW,QAAQ,WAAW;EACpC,IAAI,WAAW,QAAQ,IAAI,KAAK,WAAW,MAAM,QAAQ;EAEzD,IAAI,CAAC,UAAU,OAAO,KAAA;EAEtB,IAAI;GACF,WAAW,mBAAmB,QAAQ;GAEtC,IAAI,QAAQ,MAAM;IAChB,MAAM,YAAY,SAAS,UAAU,GAAG,KAAK,mBAAmB,CAAC;IACjE,MAAM,QAAQ,SAAS,UAAU,KAAK,mBAAmB,CAAC;IAC1D,MAAM,oBAAoB,KAAK,KAAK,KAAK;IAEzC,IACE,CAAC,gBACC,OAAO,KAAK,WAAW,KAAK,GAC5B,OAAO,KAAK,mBAAmB,KAAK,CACtC,GACA;KACA,KAAK,IAAI,KAAK,iCAAiC,KAAK,GAAG;KACvD;IACF;IACA,WAAW;GACb;GAEA,IAAI,QAAQ,SACV,WAAW,KAAK,QAAQ,QAAQ;GAGlC,IAAI,QAAQ,UACV,WAAW,eAAe,OAAO,KAAK,UAAU,QAAQ,CAAC,CAAC,CAAC,SACzD,MACF;GAGF,OAAO,KAAK,OAAO,MAAM,OAAO,QAAQ,QAAQ,KAAK,MAAM,QAAQ,CAAC;EACtE,SAAS,OAAO;GACd,KAAK,IAAI,KAAK,2BAA2B,KAAK,IAAI,KAAK;GAEvD,KAAK,aAAa,MAAM,SAAS,QAAQ;GACzC;EACF;CACF;CAEA,UACE,MACA,SACA,MACA,gBACM;EACN,MAAM,UAAU,KAAK,sBAAsB,cAAc;EACzD,IAAI,QAAQ,KAAK,UAAU,KAAK,OAAO,MAAM,OAAO,QAAQ,QAAQ,IAAI,CAAC;EAEzE,IAAI,QAAQ,UACV,QAAQ,eAAe,KAAK,CAAC,CAAC,SAAS,QAAQ;EAGjD,IAAI,QAAQ,SACV,QAAQ,KAAK,QAAQ,KAAK;EAG5B,IAAI,QAAQ,MACV,QAAQ,KAAK,KAAK,KAAK,IAAI;EAG7B,MAAM,SAAiB;GACrB,OAAO,mBAAmB,KAAK;GAC/B,MAAM,QAAQ,QAAQ;GAItB,UAAU,QAAQ,YAAY;GAC9B,QAAQ,QAAQ,UAAU,KAAK,OAAO,aAAa;GACnD,UAAU,QAAQ;GAClB,QAAQ,QAAQ;EAClB;EAEA,IAAI,QAAQ,KACV,OAAO,SAAS,KAAK,iBAAiB,SAAS,QAAQ,GAAG,CAAC,CAAC,GAAG,SAAS;EAG1E,QAAQ,IAAI,KAAK,WAAW,MAAM,QAAQ,WAAW,KAAK,KAAK;CACjE;CAEA,aACE,MACA,gBACA,SAAS,MACH;EACN,MAAM,UAAU,KAAK,sBAAsB,cAAc;EACzD,QAAQ,IAAI,KAAK,WAAW,MAAM,MAAM,KAAK;CAC/C;CAIA,QAAkB,MAAsB;EACtC,MAAM,KAAK,YAAY,KAAK,SAAS;EACrC,MAAM,SAAS,eAAe,KAAK,WAAW,KAAK,UAAU,GAAG,EAAE;EAClE,MAAM,YAAY,OAAO,OAAO,CAC9B,OAAO,OAAO,MAAM,MAAM,GAC1B,OAAO,MAAM,CACf,CAAC;EACD,MAAM,UAAU,OAAO,WAAW;EAClC,OAAO,OAAO,OAAO;GAAC;GAAI;GAAS;EAAS,CAAC,CAAC,CAAC,SAAS,QAAQ;CAClE;CAEA,QAAkB,eAA+B;EAC/C,MAAM,OAAO,OAAO,KAAK,eAAe,QAAQ;EAChD,MAAM,KAAK,KAAK,SAAS,GAAG,KAAK,SAAS;EAC1C,MAAM,UAAU,KAAK,SACnB,KAAK,WACL,KAAK,YAAY,KAAK,eACxB;EAEA,MAAM,YAAY,KAAK,SAAS,KAAK,YAAY,KAAK,eAAe;EACrE,MAAM,WAAW,iBAAiB,KAAK,WAAW,KAAK,UAAU,GAAG,EAAE;EAEtE,SAAS,WAAW,OAAO;EAO3B,OALkB,OAAO,OAAO,CAC9B,SAAS,OAAO,SAAS,GACzB,SAAS,MAAM,CACjB,CAEe,CAAC,CAAC,SAAS,MAAM;CAClC;;;;;CAMA,YAA8B;EAC5B,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,eAAe,SAAS,CAAC,CAAC,OAAO;CAC3E;CAEA,KAAe,MAAsB;EACnC,OAAO,WAAW,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK;CACzE;AACF;;;;;;;;ACpPA,MAAa,WACX,SACA,oBAC+B;CAC/B,IAAI,iBACF,UAAU;EACR,KAAK,QAAQ;EACb,QAAQ,QAAQ;EAChB,GAAG;CACL;CAEF,OAAO,gBAAgB,iBAAoB,OAAO;AACpD;AA6FA,IAAa,kBAAb,cACU,UAEV;CACE,wBAA2C,QAAQ,qBAAqB;CAExE,SAAmB;EACjB,IAAI,KAAK,QAAQ,KAAK;GACpB,KAAK,OAAO,OAAO,GAAG,iBAAiB,EAAE,KAAK,YAAY;IACxD,IAAI,QAAQ,KAAK,QAAQ,KACvB,KAAK,IAAI,KAAK;GAElB,CAAC;GACD,KAAK,OAAO,OAAO,GAAG,qBAAqB,EAAE,cAAc;IACzD,IAAI;KACF,MAAM,QAAQ,KAAK,IAAI,OAAO;KAC9B,IAAI,UAAU,KAAA,GACZ,KAAK,OAAO,MAAM,IAAI,KAAK,QAAQ,KAAY,OAAO,EACpD,YAAY,KACd,CAAC;IAEL,QAAQ,CAAC;GACX,CAAC;EACH;CACF;CAEA,IAAW,SAAY;EACrB,OAAO,KAAK,QAAQ;CACtB;CAEA,IAAW,OAAe;EACxB,OAAO,KAAK,QAAQ,QAAQ,GAAG,KAAK,OAAO;CAC7C;;;;CAKA,IACE,OACA,SACM;EACN,KAAK,sBAAsB,UACzB,KAAK,MACL;GACE,GAAG,KAAK;GACR,KAAK,SAAS,OAAO,KAAK,QAAQ;EACpC,GACA,OACA,SAAS,OACX;CACF;;;;CAKA,IAAW,SAAwD;EACjE,OAAO,KAAK,sBAAsB,UAChC,KAAK,MACL,KAAK,SACL,SAAS,OACX;CACF;;;;CAKA,IAAW,SAAuC;EAChD,KAAK,sBAAsB,aAAa,KAAK,MAAM,SAAS,OAAO;CACrE;AACF;AAEA,QAAQ,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACjKhB,IAAa,wBAAb,MAAmC;CACjC,SAA4B,QAAQ,MAAM;CAC1C,MAAyB,QAAQ;CACjC,gBAAmC,QAAQ,qBAAqB;CAEhE,YAA+B,MAAM;EACnC,IAAI;EAMJ,OAAO,CAAC,KAAK,aAAa;EAC1B,UAAU,EAAE,cAAc;GAKxB,KAAK,MAAM,QAAQ,KAAK,YAAY,GAClC,KAAK,KAAK,MAAM,QAAQ,OAAO;EAEnC;CACF,CAAC;CAED,aAAgC,MAAM;EACpC,IAAI;EACJ,UAAU,EAAE,WAAW;GACrB,IAAI,KAAK,QAAQ,YAAY,UAC3B;GAKF,IAAI,KAAK,OAAO,MAAM,IAAI,qBAAqB,GAC7C,KAAK,KAAK,IAAI;EAElB;CACF,CAAC;CAED,WAA8B,MAAM;EAClC,IAAI;EACJ,UAAU,EAAE,KAAK,YAAY;GAC3B,MAAM,OAAO,KAAK,OAAO,MAAM,QAAQ,OAAO,GAAG,CAAC;GAClD,IAAI,CAAC,QAAQ,KAAK,QAAQ,YAAY,UACpC;GAEF,IAAI;IACF,KAAK,cAAc,UAAU,KAAK,KAAK,KAAK,cAAc,IAAI,GAAG,KAAK;GACxE,SAAS,OAAO;IAId,KAAK,IAAI,MAAM,wBAAwB,KAAK,IAAI,cAAc,EAC5D,MACF,CAAC;GACH;EACF;CACF,CAAC;;;;;CAMD,cAA+C;EAC7C,OAAO,KAAK,OAAO,MAChB,UAAU,CAAC,CACX,QAAQ,SAAS,KAAK,QAAQ,YAAY,QAAQ;CACvD;CAEA,KAAe,MAAsB,SAAyB;EAQ5D,IAAI,CAAC,KAAK,OAAO,QAAQ,OAAO,GAAG;GACjC,KAAK,IAAI,MACP,kCAAkC,KAAK,IAAI,8BAC7C;GACA;EACF;EAEA,IAAI;GACF,MAAM,QAAQ,KAAK,cAAc,UAC/B,KAAK,KACL,KAAK,cAAc,IAAI,GACvB,OACF;GACA,IAAI,UAAU,KAAA,GACZ,KAAK,OAAO,MAAM,IAAI,KAAK,KAAoB,OAAO,EACpD,YAAY,KACd,CAAC;EAEL,SAAS,OAAO;GACd,KAAK,IAAI,MAAM,gCAAgC,KAAK,IAAI,IAAI,EAAE,MAAM,CAAC;EACvE;CACF;CAEA,cAAwB,MAAsB;EAC5C,OAAO;GACL,QAAQ,KAAK;GACb,MAAM;GACN,UAAU;GACV,KAAK,CAAC,KAAK,MAAM;GAQjB,QAAQ;EACV;CACF;AACF;;;;;;;;;;;ACtHA,MAAa,sBAAsB,QAAQ;CACzC,MAAM;CACN,YAAY,CAAC,OAAO;CACpB,UAAU;EACR;EACA;EACA;EACA;CACF;AACF,CAAC"}