auth-vir 5.1.0 → 5.2.1

package/README.md

@@ -54,7 +54,7 @@ For the easiest usage, construct and use `BackendAuthClient` on your server and
 Use this on your host / server / backend to authenticate client / frontend requests.
 
 1. Expose the [`AuthHeaderName.CsrfToken`](https://electrovir.github.io/auth-vir/variables/AuthHeaderName.html) (or just `'csrf-token'`) header via CORS headers with either of the following options:
-    1. Set `customHeaders: [AuthHeaderName.CsrfToken]` in `implementService` from [`@rest-vir/implement-service`](https://www.npmjs.com/package/@rest-vir/implement-service).
+    1. Set `customHeaders: [AuthHeaderName.CsrfToken]` in `implementApi` from [`@rest-vir/host`](https://www.npmjs.com/package/@rest-vir/host).
     2. Set the header `Access-Control-Allow-Headers` to (at least) `AuthHeaderName.CsrfToken`.
 2. Set the `Access-Control-Allow-Origin` header (it cannot be `*`) and properly implement CORS headers and responses.
 3. Generate JWT signing and encryption keys with one of the following:
@@ -156,12 +156,12 @@ export async function createUser(
  */
 export async function getAuthenticatedUser(request: ClientRequest) {
     const userId = (
-        await extractUserIdFromRequestHeaders<MyUserId>(
-            request.getHeaders(),
+        await extractUserIdFromRequestHeaders<MyUserId>({
+            headers: request.getHeaders(),
             jwtParams,
-            csrfOption,
-            AuthCookie.Auth,
-        )
+            csrfHeaderNameOption: csrfOption,
+            cookieName: AuthCookie.Auth,
+        })
     )?.userId;
     const user = userId ? findUserInDatabaseById(userId) : undefined;
 
@@ -332,7 +332,7 @@ export async function sendAuthenticatedRequest(
     });
 
     if (response.status === HttpStatus.Unauthorized) {
-        throw new Error(`User no longer logged in.`);
+        throw new Error('User no longer logged in.');
     } else {
         return response;
     }
@@ -354,7 +354,7 @@ export async function logout(logoutUrl: string) {
 All of these configurations must be set for the auth exports in this package to function properly:
 
 -   Expose the [`AuthHeaderName.CsrfToken`](https://electrovir.github.io/auth-vir/variables/AuthHeaderName.html) (or just `'csrf-token'`) header via CORS headers with either of the following options:
-    1.  Set `customHeaders: [AuthHeaderName.CsrfToken]` in `implementService` from [`@rest-vir/implement-service`](https://www.npmjs.com/package/@rest-vir/implement-service).
+    1.  Set `customHeaders: [AuthHeaderName.CsrfToken]` in `implementApi` from [`@rest-vir/host`](https://www.npmjs.com/package/@rest-vir/host).
     2.  Set the header `Access-Control-Allow-Headers` to (at least) `AuthHeaderName.CsrfToken`.
 -   Set `credentials: include` in all fetch requests on the client that need to use or set the auth cookie.
 -   Server CORS should set `Access-Control-Allow-Origin` (it cannot be `*`).

package/dist/auth-client/backend-auth.client.d.ts

@@ -1,7 +1,6 @@
-import { type AnyObject, type JsonCompatibleObject, type MaybePromise, type PartialWithUndefined } from '@augment-vir/common';
+import { type AnyObject, type EmptyObject, type JsonCompatibleObject, type MaybePromise, type PartialWithUndefined, type RequireExactlyOne, type RequireOneOrNone } from '@augment-vir/common';
 import { type AnyDuration } from 'date-vir';
 import { type IncomingHttpHeaders, type OutgoingHttpHeaders } from 'node:http';
-import { type EmptyObject, type RequireExactlyOne, type RequireOneOrNone } from 'type-fest';
 import { type UserIdResult } from '../auth.js';
 import { type CookieParams } from '../cookie.js';
 import { type CsrfHeaderNameOption } from '../csrf-token.js';
@@ -150,6 +149,12 @@ export type BackendAuthClientConfig<DatabaseUser extends AnyObject, UserId exten
      * JWT embedded in the `HttpOnly` auth cookie.
      */
     csrfCookieOrigin: string;
+    /**
+     * Optional suffix appended to cookie names (e.g., `'staging'` produces `auth-staging`,
+     * `auth-vir-csrf-staging`). When `undefined`, cookie names are unchanged. Useful for
+     * running multiple environments on the same domain without cookie collisions.
+     */
+    cookieNameSuffix: string;
 }>>;
 /**
  * An auth client for creating and validating JWTs embedded in cookies. This should only be used in

package/dist/auth-client/backend-auth.client.js

@@ -1,7 +1,7 @@
 import { ensureArray, } from '@augment-vir/common';
 import { calculateRelativeDate, createUtcFullDate, getNowInUtcTimezone, isDateAfter, } from 'date-vir';
 import { extractUserIdFromRequestHeaders, generateLogoutHeaders, insecureExtractUserIdFromCookieAlone, } from '../auth.js';
-import { AuthCookie, clearCsrfCookie, generateAuthCookie, generateCsrfCookie, } from '../cookie.js';
+import { AuthCookie, clearCsrfCookie, generateAuthCookie, generateCsrfCookie, resolveCookieName, } from '../cookie.js';
 import { generateCsrfToken } from '../csrf-token.js';
 import { AuthHeaderName, mergeHeaderValues } from '../headers.js';
 import { parseJwtKeys } from '../jwt/jwt-keys.js';
@@ -64,6 +64,7 @@ export class BackendAuthClient {
             jwtParams: await this.getJwtParams(),
             isDev: this.config.isDev,
             authCookie: isSignUpCookie ? AuthCookie.SignUp : AuthCookie.Auth,
+            cookieNameSuffix: this.config.cookieNameSuffix,
         };
     }
     /** Calls the provided `getUserFromDatabase` config. */
@@ -154,6 +155,7 @@ export class BackendAuthClient {
             const csrfCookie = generateCsrfCookie(userIdResult.csrfToken, {
                 ...cookieParams,
                 hostOrigin: this.resolveCsrfCookieOrigin(cookieParams.hostOrigin),
+                cookieNameSuffix: this.config.cookieNameSuffix,
             });
             return {
                 'set-cookie': [
@@ -197,7 +199,13 @@ export class BackendAuthClient {
     }
     /** Securely extract a user from their request headers. */
     async getSecureUser({ requestHeaders, isSignUpCookie, allowUserAuthRefresh, }) {
-        const userIdResult = await extractUserIdFromRequestHeaders(requestHeaders, await this.getJwtParams(), this.config.csrf, isSignUpCookie ? AuthCookie.SignUp : AuthCookie.Auth);
+        const userIdResult = await extractUserIdFromRequestHeaders({
+            headers: requestHeaders,
+            jwtParams: await this.getJwtParams(),
+            csrfHeaderNameOption: this.config.csrf,
+            cookieName: isSignUpCookie ? AuthCookie.SignUp : AuthCookie.Auth,
+            cookieNameSuffix: this.config.cookieNameSuffix,
+        });
         if (!userIdResult) {
             this.logForUser({
                 user: undefined,
@@ -244,6 +252,7 @@ export class BackendAuthClient {
         const csrfCookie = generateCsrfCookie(userIdResult.csrfToken, {
             hostOrigin: this.resolveCsrfCookieOrigin(authCookieOrigin),
             isDev: this.config.isDev,
+            cookieNameSuffix: this.config.cookieNameSuffix,
         });
         return {
             user: assumedUser || user,
@@ -302,6 +311,7 @@ export class BackendAuthClient {
             ? clearCsrfCookie({
                 hostOrigin: this.config.csrfCookieOrigin,
                 isDev: this.config.isDev,
+                cookieNameSuffix: this.config.cookieNameSuffix,
             })
             : undefined;
         return {
@@ -321,6 +331,7 @@ export class BackendAuthClient {
         const csrfCookie = generateCsrfCookie(existingUserIdResult.csrfToken, {
             ...cookieParams,
             hostOrigin: this.resolveCsrfCookieOrigin(cookieParams.hostOrigin),
+            cookieNameSuffix: this.config.cookieNameSuffix,
         });
         return {
             'set-cookie': [
@@ -340,6 +351,7 @@ export class BackendAuthClient {
         const csrfCookie = generateCsrfCookie(csrfToken, {
             ...cookieParams,
             hostOrigin: this.resolveCsrfCookieOrigin(cookieParams.hostOrigin),
+            cookieNameSuffix: this.config.cookieNameSuffix,
         });
         return {
             'set-cookie': [
@@ -351,7 +363,8 @@ export class BackendAuthClient {
     /** Use these headers to log a user in. */
     async createLoginHeaders({ userId, requestHeaders, isSignUpCookie, }) {
         const oppositeCookieName = isSignUpCookie ? AuthCookie.Auth : AuthCookie.SignUp;
-        const hasExistingOppositeCookie = requestHeaders.cookie?.includes(`${oppositeCookieName}=`);
+        const resolvedOppositeCookieName = resolveCookieName(oppositeCookieName, this.config.cookieNameSuffix);
+        const hasExistingOppositeCookie = requestHeaders.cookie?.includes(`${resolvedOppositeCookieName}=`);
         const discardOppositeCookieHeaders = hasExistingOppositeCookie
             ? generateLogoutHeaders(await this.getCookieParams({
                 isSignUpCookie: !isSignUpCookie,
@@ -360,7 +373,13 @@ export class BackendAuthClient {
                 preserveCsrf: true,
             })
             : undefined;
-        const existingUserIdResult = await extractUserIdFromRequestHeaders(requestHeaders, await this.getJwtParams(), this.config.csrf, isSignUpCookie ? AuthCookie.SignUp : AuthCookie.Auth);
+        const existingUserIdResult = await extractUserIdFromRequestHeaders({
+            headers: requestHeaders,
+            jwtParams: await this.getJwtParams(),
+            csrfHeaderNameOption: this.config.csrf,
+            cookieName: isSignUpCookie ? AuthCookie.SignUp : AuthCookie.Auth,
+            cookieNameSuffix: this.config.cookieNameSuffix,
+        });
         const cookieParams = await this.getCookieParams({
             isSignUpCookie,
             requestHeaders,
@@ -405,7 +424,12 @@ export class BackendAuthClient {
      */
     async getInsecureUser({ requestHeaders, allowUserAuthRefresh, }) {
         // eslint-disable-next-line @typescript-eslint/no-deprecated
-        const userIdResult = await insecureExtractUserIdFromCookieAlone(requestHeaders, await this.getJwtParams(), AuthCookie.Auth);
+        const userIdResult = await insecureExtractUserIdFromCookieAlone({
+            headers: requestHeaders,
+            jwtParams: await this.getJwtParams(),
+            cookieName: AuthCookie.Auth,
+            cookieNameSuffix: this.config.cookieNameSuffix,
+        });
         if (!userIdResult) {
             this.logForUser({
                 user: undefined,

package/dist/auth-client/frontend-auth.client.d.ts

@@ -1,6 +1,5 @@
-import { type createBlockingInterval, type JsonCompatibleObject, type MaybePromise, type PartialWithUndefined, type SelectFrom } from '@augment-vir/common';
+import { type createBlockingInterval, type EmptyObject, type JsonCompatibleObject, type MaybePromise, type PartialWithUndefined, type SelectFrom } from '@augment-vir/common';
 import { type AnyDuration } from 'date-vir';
-import { type EmptyObject } from 'type-fest';
 import { type CsrfHeaderNameOption } from '../csrf-token.js';
 /**
  * Config for {@link FrontendAuthClient}.
@@ -10,6 +9,11 @@ import { type CsrfHeaderNameOption } from '../csrf-token.js';
 export type FrontendAuthClientConfig = Readonly<{
     csrf: Readonly<CsrfHeaderNameOption>;
 }> & PartialWithUndefined<{
+    /**
+     * Optional suffix appended to cookie names (e.g., `'staging'` produces
+     * `auth-vir-csrf-staging`). When `undefined`, cookie names are unchanged.
+     */
+    cookieNameSuffix: string;
     /**
      * Determine if the current user can assume the identity of another user. If this is not
      * defined, all users will be blocked from assuming other user identities.

package/dist/auth-client/frontend-auth.client.js

@@ -53,11 +53,13 @@ export class FrontendAuthClient {
             localStorage.removeItem(storageKey);
             return true;
         }
-        else if (!(await this.config.canAssumeUser?.())) {
+        else if (await this.config.canAssumeUser?.()) {
+            localStorage.setItem(storageKey, JSON.stringify(assumedUserParams));
+            return true;
+        }
+        else {
             return false;
         }
-        localStorage.setItem(storageKey, JSON.stringify(assumedUserParams));
-        return true;
     }
     /** Gets the assumed user params stored in local storage, if any. */
     getAssumedUser() {
@@ -79,7 +81,7 @@ export class FrontendAuthClient {
      * combine them with these.
      */
     createAuthenticatedRequestInit() {
-        const csrfToken = getCurrentCsrfToken();
+        const csrfToken = getCurrentCsrfToken(this.config.cookieNameSuffix);
         const assumedUser = this.getAssumedUser();
         const headers = {
             ...(csrfToken

package/dist/auth.d.ts

@@ -1,6 +1,6 @@
-import { type SelectFrom } from '@augment-vir/common';
+import { type PartialWithUndefined, type SelectFrom } from '@augment-vir/common';
 import { type FullDate, type UtcTimezone } from 'date-vir';
-import { AuthCookie, type CookieParams } from './cookie.js';
+import { type AuthCookie, type CookieParams } from './cookie.js';
 import { type CsrfHeaderNameOption } from './csrf-token.js';
 import { type ParseJwtParams } from './jwt/jwt.js';
 import { type JwtUserData } from './jwt/user-jwt.js';
@@ -37,7 +37,13 @@ export type UserIdResult<UserId extends string | number> = {
  * @category Auth : Host
  * @returns The extracted user id or `undefined` if no valid auth headers exist.
  */
-export declare function extractUserIdFromRequestHeaders<UserId extends string | number>(headers: HeaderContainer, jwtParams: Readonly<ParseJwtParams>, csrfHeaderNameOption: Readonly<CsrfHeaderNameOption>, cookieName?: AuthCookie): Promise<Readonly<UserIdResult<UserId>> | undefined>;
+export declare function extractUserIdFromRequestHeaders<UserId extends string | number>({ headers, jwtParams, csrfHeaderNameOption, cookieName, cookieNameSuffix, }: Readonly<{
+    headers: HeaderContainer;
+    jwtParams: Readonly<ParseJwtParams>;
+    csrfHeaderNameOption: Readonly<CsrfHeaderNameOption>;
+    cookieName: AuthCookie;
+    cookieNameSuffix?: string | undefined;
+}>): Promise<Readonly<UserIdResult<UserId>> | undefined>;
 /**
  * Extract a user id from just the cookie, without CSRF token validation. This is _less secure_ than
  * {@link extractUserIdFromRequestHeaders} as a result. This should only be used in rare
@@ -46,7 +52,12 @@ export declare function extractUserIdFromRequestHeaders<UserId extends string |
  * @deprecated Prefer {@link extractUserIdFromRequestHeaders} instead: it is more secure.
  * @category Auth : Host
  */
-export declare function insecureExtractUserIdFromCookieAlone<UserId extends string | number>(headers: HeaderContainer, jwtParams: Readonly<ParseJwtParams>, cookieName: AuthCookie): Promise<Readonly<UserIdResult<UserId>> | undefined>;
+export declare function insecureExtractUserIdFromCookieAlone<UserId extends string | number>({ headers, jwtParams, cookieName, cookieNameSuffix, }: Readonly<{
+    headers: HeaderContainer;
+    jwtParams: Readonly<ParseJwtParams>;
+    cookieName: AuthCookie;
+    cookieNameSuffix?: string | undefined;
+}>): Promise<Readonly<UserIdResult<UserId>> | undefined>;
 /**
  * Used by host (backend) code to set headers on a response object. Sets both the auth JWT cookie
  * and the CSRF token cookie. The CSRF cookie is not `HttpOnly` so that frontend JavaScript can read
@@ -71,11 +82,13 @@ sessionStartedAt?: number | undefined): Promise<Record<string, string[]>>;
 export declare function generateLogoutHeaders(cookieConfig: Readonly<SelectFrom<CookieParams, {
     hostOrigin: true;
     isDev: true;
-}>>, options?: Readonly<{
+}>> & PartialWithUndefined<{
+    cookieNameSuffix: string;
+}>, options?: Readonly<PartialWithUndefined<{
     /**
-     * When `true`, the CSRF cookie is preserved (not cleared). Use this when clearing only one
-     * cookie type (e.g., the auth cookie) while keeping the other active session (e.g.,
+     * When `true`, the CSRF cookie is preserved (not cleared). Use this when clearing only
+     * one cookie type (e.g., the auth cookie) while keeping the other active session (e.g.,
      * sign-up) that still needs its CSRF token.
      */
-    preserveCsrf?: boolean | undefined;
-}>): Record<string, string[]>;
+    preserveCsrf: boolean;
+}>>): Record<string, string[]>;

package/dist/auth.js

@@ -1,4 +1,4 @@
-import { AuthCookie, clearAuthCookie, clearCsrfCookie, extractCookieJwt, generateAuthCookie, generateCsrfCookie, } from './cookie.js';
+import { clearAuthCookie, clearCsrfCookie, extractCookieJwt, generateAuthCookie, generateCsrfCookie, } from './cookie.js';
 import { generateCsrfToken, resolveCsrfHeaderName } from './csrf-token.js';
 function readHeader(headers, headerName) {
     if (headers instanceof Headers) {
@@ -28,14 +28,19 @@ function readCsrfTokenHeader(headers, csrfHeaderNameOption) {
  * @category Auth : Host
  * @returns The extracted user id or `undefined` if no valid auth headers exist.
  */
-export async function extractUserIdFromRequestHeaders(headers, jwtParams, csrfHeaderNameOption, cookieName = AuthCookie.Auth) {
+export async function extractUserIdFromRequestHeaders({ headers, jwtParams, csrfHeaderNameOption, cookieName, cookieNameSuffix, }) {
     try {
         const csrfToken = readCsrfTokenHeader(headers, csrfHeaderNameOption);
         const cookie = readHeader(headers, 'cookie');
         if (!cookie || !csrfToken) {
             return undefined;
         }
-        const jwt = await extractCookieJwt(cookie, jwtParams, cookieName);
+        const jwt = await extractCookieJwt({
+            rawCookie: cookie,
+            jwtParams,
+            cookieName,
+            cookieNameSuffix,
+        });
         if (!jwt || jwt.data.csrfToken !== csrfToken) {
             return undefined;
         }
@@ -60,13 +65,18 @@ export async function extractUserIdFromRequestHeaders(headers, jwtParams, csrfHe
  * @deprecated Prefer {@link extractUserIdFromRequestHeaders} instead: it is more secure.
  * @category Auth : Host
  */
-export async function insecureExtractUserIdFromCookieAlone(headers, jwtParams, cookieName) {
+export async function insecureExtractUserIdFromCookieAlone({ headers, jwtParams, cookieName, cookieNameSuffix, }) {
     try {
         const cookie = readHeader(headers, 'cookie');
         if (!cookie) {
             return undefined;
         }
-        const jwt = await extractCookieJwt(cookie, jwtParams, cookieName);
+        const jwt = await extractCookieJwt({
+            rawCookie: cookie,
+            jwtParams,
+            cookieName,
+            cookieNameSuffix,
+        });
         if (!jwt) {
             return undefined;
         }

package/dist/cookie.d.ts

@@ -1,6 +1,5 @@
-import { type PartialWithUndefined, type SelectFrom } from '@augment-vir/common';
+import { type PartialWithUndefined, type Primitive, type SelectFrom } from '@augment-vir/common';
 import { type AnyDuration } from 'date-vir';
-import { type Primitive } from 'type-fest';
 import { type CreateJwtParams, type ParseJwtParams, type ParsedJwt } from './jwt/jwt.js';
 import { type JwtUserData } from './jwt/user-jwt.js';
 /**
@@ -16,6 +15,13 @@ export declare enum AuthCookie {
     /** Used for storing the CSRF token. Not `HttpOnly` so that frontend JS can read it. */
     Csrf = "auth-vir-csrf"
 }
+/**
+ * Resolves a cookie name by appending a suffix when provided. When `cookieNameSuffix` is
+ * `undefined`, the base name is returned unchanged.
+ *
+ * @category Internal
+ */
+export declare function resolveCookieName(baseCookieName: AuthCookie, cookieNameSuffix?: string | undefined): string;
 /**
  * Parameters for {@link generateAuthCookie}.
  *
@@ -54,6 +60,12 @@ export type CookieParams = {
      * @default false
      */
     isDev: boolean;
+    /**
+     * Optional suffix appended to cookie names (e.g., `'staging'` produces `auth-staging`). When
+     * `undefined`, cookie names are unchanged. Useful for running multiple environments on the same
+     * domain without cookie collisions.
+     */
+    cookieNameSuffix: string;
 }>;
 /**
  * Generate a secure cookie that stores the user JWT data. Used in host (backend) code.
@@ -75,7 +87,9 @@ export declare function generateAuthCookie(userJwtData: Readonly<JwtUserData>, c
 export declare function generateCsrfCookie(csrfToken: string, cookieConfig: Readonly<SelectFrom<CookieParams, {
     hostOrigin: true;
     isDev: true;
-}>>): string;
+}>> & PartialWithUndefined<{
+    cookieNameSuffix: string;
+}>): string;
 /**
  * Generate a cookie value that will clear the previous auth cookie. Use this when signing out.
  *
@@ -86,6 +100,7 @@ export declare function clearAuthCookie(cookieConfig: Readonly<SelectFrom<Cookie
     isDev: true;
 }>> & PartialWithUndefined<{
     authCookie: AuthCookie;
+    cookieNameSuffix: string;
 }>): string;
 /**
  * Generate a cookie value that will clear the CSRF token cookie. Use this when signing out.
@@ -95,7 +110,9 @@ export declare function clearAuthCookie(cookieConfig: Readonly<SelectFrom<Cookie
 export declare function clearCsrfCookie(cookieConfig: Readonly<SelectFrom<CookieParams, {
     hostOrigin: true;
     isDev: true;
-}>>): string;
+}>> & PartialWithUndefined<{
+    cookieNameSuffix: string;
+}>): string;
 /**
  * Generate a cookie string from a raw set of parameters.
  *
@@ -108,4 +125,10 @@ export declare function generateCookie(params: Readonly<Record<string, Exclude<P
  * @category Internal
  * @returns The extracted auth Cookie JWT data or `undefined` if no valid auth JWT data was found.
  */
-export declare function extractCookieJwt(rawCookie: string, jwtParams: Readonly<ParseJwtParams>, cookieName: AuthCookie): Promise<undefined | ParsedJwt<JwtUserData>>;
+export declare function extractCookieJwt({ rawCookie, jwtParams, cookieName, cookieNameSuffix, }: {
+    rawCookie: string;
+    jwtParams: Readonly<ParseJwtParams>;
+    cookieName: AuthCookie;
+} & PartialWithUndefined<{
+    cookieNameSuffix: string;
+}>): Promise<undefined | ParsedJwt<JwtUserData>>;

package/dist/cookie.js

@@ -17,6 +17,20 @@ export var AuthCookie;
     /** Used for storing the CSRF token. Not `HttpOnly` so that frontend JS can read it. */
     AuthCookie["Csrf"] = "auth-vir-csrf";
 })(AuthCookie || (AuthCookie = {}));
+/**
+ * Resolves a cookie name by appending a suffix when provided. When `cookieNameSuffix` is
+ * `undefined`, the base name is returned unchanged.
+ *
+ * @category Internal
+ */
+export function resolveCookieName(baseCookieName, cookieNameSuffix) {
+    return [
+        baseCookieName,
+        cookieNameSuffix,
+    ]
+        .filter(check.isTruthy)
+        .join('-');
+}
 function generateSetCookie({ name, value, httpOnly, cookieConfig, }) {
     return generateCookie({
         [name]: value,
@@ -39,7 +53,7 @@ function generateSetCookie({ name, value, httpOnly, cookieConfig, }) {
  */
 export async function generateAuthCookie(userJwtData, cookieConfig) {
     return generateSetCookie({
-        name: cookieConfig.authCookie || AuthCookie.Auth,
+        name: resolveCookieName(cookieConfig.authCookie || AuthCookie.Auth, cookieConfig.cookieNameSuffix),
         value: await createUserJwt(userJwtData, cookieConfig.jwtParams),
         httpOnly: true,
         cookieConfig,
@@ -58,7 +72,7 @@ export async function generateAuthCookie(userJwtData, cookieConfig) {
  */
 export function generateCsrfCookie(csrfToken, cookieConfig) {
     return generateSetCookie({
-        name: AuthCookie.Csrf,
+        name: resolveCookieName(AuthCookie.Csrf, cookieConfig.cookieNameSuffix),
         value: csrfToken,
         httpOnly: false,
         cookieConfig: {
@@ -76,7 +90,7 @@ export function generateCsrfCookie(csrfToken, cookieConfig) {
  */
 export function clearAuthCookie(cookieConfig) {
     return generateSetCookie({
-        name: cookieConfig.authCookie || AuthCookie.Auth,
+        name: resolveCookieName(cookieConfig.authCookie || AuthCookie.Auth, cookieConfig.cookieNameSuffix),
         value: 'redacted',
         httpOnly: true,
         cookieConfig,
@@ -89,7 +103,7 @@ export function clearAuthCookie(cookieConfig) {
  */
 export function clearCsrfCookie(cookieConfig) {
     return generateSetCookie({
-        name: AuthCookie.Csrf,
+        name: resolveCookieName(AuthCookie.Csrf, cookieConfig.cookieNameSuffix),
         value: 'redacted',
         httpOnly: false,
         cookieConfig,
@@ -125,13 +139,14 @@ export function generateCookie(params) {
  * @category Internal
  * @returns The extracted auth Cookie JWT data or `undefined` if no valid auth JWT data was found.
  */
-export async function extractCookieJwt(rawCookie, jwtParams, cookieName) {
-    const cookieRegExp = new RegExp(`${escapeStringForRegExp(cookieName)}=[^;]+(?:;|$)`);
+export async function extractCookieJwt({ rawCookie, jwtParams, cookieName, cookieNameSuffix, }) {
+    const resolvedName = resolveCookieName(cookieName, cookieNameSuffix);
+    const cookieRegExp = new RegExp(`${escapeStringForRegExp(resolvedName)}=[^;]+(?:;|$)`);
     const [cookieValue] = safeMatch(rawCookie, cookieRegExp);
     if (!cookieValue) {
         return undefined;
     }
-    const rawJwt = cookieValue.replace(`${cookieName}=`, '').replace(';', '');
+    const rawJwt = cookieValue.replace(`${resolvedName}=`, '').replace(';', '');
     const jwt = await parseUserJwt(rawJwt, jwtParams);
     return jwt;
 }

package/dist/csrf-token.d.ts

@@ -1,4 +1,4 @@
-import { type RequireExactlyOne } from 'type-fest';
+import { type RequireExactlyOne } from '@augment-vir/common';
 /**
  * Generates a random, cryptographically secure CSRF token string.
  *
@@ -30,4 +30,4 @@ export declare function resolveCsrfHeaderName(options: Readonly<CsrfHeaderNameOp
  *
  * @category Auth : Client
  */
-export declare function getCurrentCsrfToken(): string | undefined;
+export declare function getCurrentCsrfToken(cookieNameSuffix?: string | undefined): string | undefined;

package/dist/csrf-token.js

@@ -1,6 +1,6 @@
 import { check } from '@augment-vir/assert';
-import { escapeStringForRegExp, randomString, safeMatch } from '@augment-vir/common';
-import { AuthCookie } from './cookie.js';
+import { escapeStringForRegExp, randomString, safeMatch, } from '@augment-vir/common';
+import { AuthCookie, resolveCookieName } from './cookie.js';
 /**
  * Generates a random, cryptographically secure CSRF token string.
  *
@@ -35,8 +35,9 @@ export function resolveCsrfHeaderName(options) {
  *
  * @category Auth : Client
  */
-export function getCurrentCsrfToken() {
-    const cookieRegExp = new RegExp(`${escapeStringForRegExp(AuthCookie.Csrf)}=([^;]+)`);
+export function getCurrentCsrfToken(cookieNameSuffix) {
+    const resolvedName = resolveCookieName(AuthCookie.Csrf, cookieNameSuffix);
+    const cookieRegExp = new RegExp(`${escapeStringForRegExp(resolvedName)}=([^;]+)`);
     const [, value,] = safeMatch(globalThis.document.cookie, cookieRegExp);
     return value || undefined;
 }

package/dist/generated/client.d.ts

@@ -9,12 +9,14 @@ export * from "./enums.js";
  * Type-safe database client for TypeScript
  * @example
  * ```
- * const prisma = new PrismaClient()
+ * const prisma = new PrismaClient({
+ *   adapter: new PrismaPg({ connectionString: process.env.DATABASE_URL })
+ * })
  * // Fetch zero or more Users
  * const users = await prisma.user.findMany()
  * ```
  *
- * Read more in our [docs](https://www.prisma.io/docs/reference/tools-and-interfaces/prisma-client).
+ * Read more in our [docs](https://pris.ly/d/client).
  */
 export declare const PrismaClient: $Class.PrismaClientConstructor;
 export type PrismaClient<LogOpts extends Prisma.LogLevel = never, OmitOpts extends Prisma.PrismaClientOptions["omit"] = Prisma.PrismaClientOptions["omit"], ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> = $Class.PrismaClient<LogOpts, OmitOpts, ExtArgs>;

package/dist/generated/client.js

@@ -21,12 +21,14 @@ export * from "./enums.js";
  * Type-safe database client for TypeScript
  * @example
  * ```
- * const prisma = new PrismaClient()
+ * const prisma = new PrismaClient({
+ *   adapter: new PrismaPg({ connectionString: process.env.DATABASE_URL })
+ * })
  * // Fetch zero or more Users
  * const users = await prisma.user.findMany()
  * ```
  *
- * Read more in our [docs](https://www.prisma.io/docs/reference/tools-and-interfaces/prisma-client).
+ * Read more in our [docs](https://pris.ly/d/client).
  */
-export const PrismaClient = $Class.getPrismaClientClass(__dirname);
+export const PrismaClient = $Class.getPrismaClientClass();
 export { Prisma };

package/dist/generated/internal/class.d.ts

@@ -8,16 +8,18 @@ export interface PrismaClientConstructor {
    * Type-safe database client for TypeScript
    * @example
    * ```
-   * const prisma = new PrismaClient()
+   * const prisma = new PrismaClient({
+   *   adapter: new PrismaPg({ connectionString: process.env.DATABASE_URL })
+   * })
    * // Fetch zero or more Users
    * const users = await prisma.user.findMany()
    * ```
    *
-   * Read more in our [docs](https://www.prisma.io/docs/reference/tools-and-interfaces/prisma-client).
+   * Read more in our [docs](https://pris.ly/d/client).
    */
     new <Options extends Prisma.PrismaClientOptions = Prisma.PrismaClientOptions, LogOpts extends LogOptions<Options> = LogOptions<Options>, OmitOpts extends Prisma.PrismaClientOptions['omit'] = Options extends {
         omit: infer U;
-    } ? U : Prisma.PrismaClientOptions['omit'], ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs>(options?: Prisma.Subset<Options, Prisma.PrismaClientOptions>): PrismaClient<LogOpts, OmitOpts, ExtArgs>;
+    } ? U : Prisma.PrismaClientOptions['omit'], ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs>(options: Prisma.PrismaClientConstructorArgs<Options>): PrismaClient<LogOpts, OmitOpts, ExtArgs>;
 }
 /**
  * ## Prisma Client
@@ -25,12 +27,14 @@ export interface PrismaClientConstructor {
  * Type-safe database client for TypeScript
  * @example
  * ```
- * const prisma = new PrismaClient()
+ * const prisma = new PrismaClient({
+ *   adapter: new PrismaPg({ connectionString: process.env.DATABASE_URL })
+ * })
  * // Fetch zero or more Users
  * const users = await prisma.user.findMany()
  * ```
  *
- * Read more in our [docs](https://www.prisma.io/docs/reference/tools-and-interfaces/prisma-client).
+ * Read more in our [docs](https://pris.ly/d/client).
  */
 export interface PrismaClient<in LogOpts extends Prisma.LogLevel = never, in out OmitOpts extends Prisma.PrismaClientOptions['omit'] = Prisma.PrismaClientOptions['omit'], in out ExtArgs extends runtime.Types.Extensions.InternalArgs = runtime.Types.Extensions.DefaultArgs> {
     [K: symbol]: {
@@ -52,7 +56,7 @@ export interface PrismaClient<in LogOpts extends Prisma.LogLevel = never, in out
        * const result = await prisma.$executeRaw`UPDATE User SET cool = ${true} WHERE email = ${'user@email.com'};`
        * ```
        *
-       * Read more in our [docs](https://www.prisma.io/docs/reference/tools-and-interfaces/prisma-client/raw-database-access).
+       * Read more in our [docs](https://pris.ly/d/raw-queries).
        */
     $executeRaw<T = unknown>(query: TemplateStringsArray | Prisma.Sql, ...values: any[]): Prisma.PrismaPromise<number>;
     /**
@@ -63,7 +67,7 @@ export interface PrismaClient<in LogOpts extends Prisma.LogLevel = never, in out
      * const result = await prisma.$executeRawUnsafe('UPDATE User SET cool = $1 WHERE email = $2 ;', true, 'user@email.com')
      * ```
      *
-     * Read more in our [docs](https://www.prisma.io/docs/reference/tools-and-interfaces/prisma-client/raw-database-access).
+     * Read more in our [docs](https://pris.ly/d/raw-queries).
      */
     $executeRawUnsafe<T = unknown>(query: string, ...values: any[]): Prisma.PrismaPromise<number>;
     /**
@@ -73,7 +77,7 @@ export interface PrismaClient<in LogOpts extends Prisma.LogLevel = never, in out
      * const result = await prisma.$queryRaw`SELECT * FROM User WHERE id = ${1} OR email = ${'user@email.com'};`
      * ```
      *
-     * Read more in our [docs](https://www.prisma.io/docs/reference/tools-and-interfaces/prisma-client/raw-database-access).
+     * Read more in our [docs](https://pris.ly/d/raw-queries).
      */
     $queryRaw<T = unknown>(query: TemplateStringsArray | Prisma.Sql, ...values: any[]): Prisma.PrismaPromise<T>;
     /**
@@ -84,7 +88,7 @@ export interface PrismaClient<in LogOpts extends Prisma.LogLevel = never, in out
      * const result = await prisma.$queryRawUnsafe('SELECT * FROM User WHERE id = $1 OR email = $2;', 1, 'user@email.com')
      * ```
      *
-     * Read more in our [docs](https://www.prisma.io/docs/reference/tools-and-interfaces/prisma-client/raw-database-access).
+     * Read more in our [docs](https://pris.ly/d/raw-queries).
      */
     $queryRawUnsafe<T = unknown>(query: string, ...values: any[]): Prisma.PrismaPromise<T>;
     /**
@@ -98,9 +102,11 @@ export interface PrismaClient<in LogOpts extends Prisma.LogLevel = never, in out
      * ])
      * ```
      *
-     * Read more in our [docs](https://www.prisma.io/docs/concepts/components/prisma-client/transactions).
+     * Read more in our [docs](https://www.prisma.io/docs/orm/prisma-client/queries/transactions).
      */
     $transaction<P extends Prisma.PrismaPromise<any>[]>(arg: [...P], options?: {
+        maxWait?: number;
+        timeout?: number;
         isolationLevel?: Prisma.TransactionIsolationLevel;
     }): runtime.Types.Utils.JsPromise<runtime.Types.Utils.UnwrapTuple<P>>;
     $transaction<R>(fn: (prisma: Omit<PrismaClient, runtime.ITXClientDenyList>) => runtime.Types.Utils.JsPromise<R>, options?: {
@@ -123,4 +129,4 @@ export interface PrismaClient<in LogOpts extends Prisma.LogLevel = never, in out
         omit: OmitOpts;
     }>;
 }
-export declare function getPrismaClientClass(dirname: string): PrismaClientConstructor;
+export declare function getPrismaClientClass(): PrismaClientConstructor;