camox 0.59.0 → 0.61.0

package/dist/lib/auth.js

@@ -1,6 +1,7 @@
 import { actionsStore } from "../features/provider/actionsStore.js";
 import { validatePreviewTarget } from "./preview-handoff.js";
-import { SERVER_AUTH_COOKIE_NAME, buildClearServerAuthCookieHeader, getServerAuthCookieHeader } from "./server-auth-cookie.js";
+import { buildClearServerAuthCookieHeader, buildServerAuthCookieHeader, getServerAuthCookieHeader, readServerAuthCookie } from "./server-auth-cookie.js";
+import { getCookie, getSetCookie, parseSetCookieHeader, withCookieHeader } from "./stored-auth-cookies.js";
 import { c } from "react/compiler-runtime";
 import * as React from "react";
 import { oneTimeTokenClient, organizationClient } from "better-auth/client/plugins";
@@ -9,60 +10,26 @@ import { createAuthClient } from "better-auth/react";
 //#region src/lib/auth.ts
 function writeServerAuthCookie(cookie) {
 	if (typeof document === "undefined") return;
-	const secure = window.location.protocol === "https:" ? "; Secure" : "";
+	const secure = window.location.protocol === "https:";
 	if (!cookie) {
-		document.cookie = `${buildClearServerAuthCookieHeader()}${secure}`;
+		document.cookie = `${buildClearServerAuthCookieHeader()}${secure ? "; Secure" : ""}`;
 		return;
 	}
-	document.cookie = `${SERVER_AUTH_COOKIE_NAME}=${encodeURIComponent(cookie)}; Path=/; SameSite=Lax; Max-Age=2592000${secure}`;
+	document.cookie = buildServerAuthCookieHeader(cookie, { secure });
 }
-function parseSetCookieHeader(header) {
-	const cookieMap = /* @__PURE__ */ new Map();
-	header.split(", ").forEach((cookie) => {
-		const [nameValue, ...attributes] = cookie.split("; ");
-		const [name, value] = nameValue.split("=");
-		const cookieObj = { value };
-		attributes.forEach((attr) => {
-			const [attrName, attrValue] = attr.split("=");
-			cookieObj[attrName.toLowerCase()] = attrValue;
-		});
-		cookieMap.set(name, cookieObj);
-	});
-	return cookieMap;
-}
-function getSetCookie(header, prevCookie) {
-	const parsed = parseSetCookieHeader(header);
-	let toSetCookie = {};
-	parsed.forEach((cookie, key) => {
-		const expiresAt = cookie["expires"];
-		const maxAge = cookie["max-age"];
-		let expires = null;
-		if (expiresAt) expires = new Date(String(expiresAt));
-		else if (maxAge) expires = new Date(Date.now() + Number(maxAge) * 1e3);
-		toSetCookie[key] = {
-			value: cookie["value"],
-			expires: expires ? expires.toISOString() : null
-		};
-	});
-	if (prevCookie) try {
-		toSetCookie = {
-			...JSON.parse(prevCookie),
-			...toSetCookie
-		};
-	} catch {}
-	return JSON.stringify(toSetCookie);
-}
-function getCookie(cookie) {
-	let parsed = {};
-	try {
-		parsed = JSON.parse(cookie);
-	} catch {}
-	const parts = [];
-	for (const [key, value] of Object.entries(parsed)) {
-		if (value.expires && new Date(value.expires) < /* @__PURE__ */ new Date()) continue;
-		parts.push(`${key}=${value.value}`);
-	}
-	return parts.join("; ");
+const STORED_COOKIES_KEY = "better-auth_cookie";
+/**
+* The stored cookies, with the session the website's Worker signed in with added: it exchanges a
+* sign-in's one-time token itself and sets only the mirror. Read storage through this alone,
+* since reading it writes the mirror back from storage.
+*/
+function readStoredCookies(storage, key = STORED_COOKIES_KEY) {
+	const stored = storage.getItem(key) || "{}";
+	if (typeof document === "undefined") return stored;
+	const adopted = withCookieHeader(stored, readServerAuthCookie(document.cookie));
+	if (!adopted) return stored;
+	storage.setItem(key, adopted);
+	return adopted;
 }
 /**
 * Read the cross-domain auth cookie from localStorage and return it as a
@@ -70,7 +37,7 @@ function getCookie(cookie) {
 */
 function getAuthCookieHeader() {
 	if (typeof window === "undefined") return "";
-	const cookie = getCookie(localStorage.getItem("better-auth_cookie") || "{}");
+	const cookie = getCookie(readStoredCookies(localStorage));
 	writeServerAuthCookie(cookie);
 	return cookie;
 }
@@ -87,10 +54,7 @@ function crossDomainClient(opts = {}) {
 		getActions(_, $store) {
 			store = $store;
 			return {
-				getCookie: () => {
-					const cookie = storage?.getItem(cookieName);
-					return getCookie(cookie || "{}");
-				},
+				getCookie: () => storage ? getCookie(readStoredCookies(storage, cookieName)) : "",
 				updateSession: () => {
 					$store.notify("$sessionSignal");
 				},
@@ -143,7 +107,7 @@ function crossDomainClient(opts = {}) {
 					options
 				};
 				options = options || {};
-				const cookie = getCookie(storage.getItem(cookieName) || "{}");
+				const cookie = getCookie(readStoredCookies(storage, cookieName));
 				writeServerAuthCookie(cookie);
 				options.credentials = getAuthRequestCredentials(cookie);
 				options.headers = {
@@ -181,6 +145,8 @@ function createCamoxAuthClient(apiUrl) {
 /**
 * Process a `?ott=` one-time token from the URL before the provider mounts.
 * Verifies the token against the API backend and notifies the session store.
+* The Worker exchanges a studio sign-in's token before rendering, so this handles a preview
+* link's, and any token the Worker couldn't exchange.
 *
 * Reports completion and explicit handoff failures instead of silently showing live content.
 * Keeps the handoff marker until SSR confirms authentication on the subsequent load.
@@ -258,7 +224,7 @@ function useProjectUuid() {
 }
 const subscribeToHydration = () => () => {};
 function hasStoredAuthCookie() {
-	return getCookie(localStorage.getItem("better-auth_cookie") || "{}") !== "";
+	return getCookie(readStoredCookies(localStorage)) !== "";
 }
 const noSubscription = () => () => {};
 /**

package/dist/lib/server-auth-cookie.js

@@ -1,8 +1,14 @@
 //#region src/lib/server-auth-cookie.ts
 const SERVER_AUTH_COOKIE_NAME = "camox_auth_cookie";
+/** How long the mirror lasts. The API still refuses a session that expired before it. */
+const SERVER_AUTH_COOKIE_MAX_AGE = 2592e3;
 function buildClearServerAuthCookieHeader() {
 	return `${SERVER_AUTH_COOKIE_NAME}=; Path=/; SameSite=Lax; Max-Age=0`;
 }
+/** Sets the mirror to a session, as a `Cookie` header's value. */
+function buildServerAuthCookieHeader(cookie, { secure }) {
+	return `${SERVER_AUTH_COOKIE_NAME}=${encodeURIComponent(cookie)}; Path=/; SameSite=Lax; Max-Age=${SERVER_AUTH_COOKIE_MAX_AGE}${secure ? "; Secure" : ""}`;
+}
 /**
 * The session to forward to the API for validation; cookie presence is not authentication. Only
 * the studio's session counts, which the SDK mirrors into `camox_auth_cookie`. Better Auth's own
@@ -10,7 +16,11 @@ function buildClearServerAuthCookieHeader() {
 * host (ADR 0028). Mirrored in apps/dispatch/src/previews.ts: keep the two in sync.
 */
 function getServerAuthCookieHeader(headers) {
-	const mirror = (headers.get("Cookie") ?? "").split(";").map((part) => part.trim()).find((part) => part.startsWith(`${SERVER_AUTH_COOKIE_NAME}=`));
+	return readServerAuthCookie(headers.get("Cookie") ?? "");
+}
+/** The mirror's session in a `Cookie` header's value, or `document.cookie`. */
+function readServerAuthCookie(cookieHeader) {
+	const mirror = cookieHeader.split(";").map((part) => part.trim()).find((part) => part.startsWith(`${SERVER_AUTH_COOKIE_NAME}=`));
 	if (!mirror) return "";
 	try {
 		return decodeURIComponent(mirror.slice(18));
@@ -20,4 +30,4 @@ function getServerAuthCookieHeader(headers) {
 }
 
 //#endregion
-export { SERVER_AUTH_COOKIE_NAME, buildClearServerAuthCookieHeader, getServerAuthCookieHeader };
+export { SERVER_AUTH_COOKIE_NAME, buildClearServerAuthCookieHeader, buildServerAuthCookieHeader, getServerAuthCookieHeader, readServerAuthCookie };

package/dist/lib/stored-auth-cookies.js

@@ -0,0 +1,76 @@
+//#region src/lib/stored-auth-cookies.ts
+function parseSetCookieHeader(header) {
+	const cookieMap = /* @__PURE__ */ new Map();
+	header.split(", ").forEach((cookie) => {
+		const [nameValue, ...attributes] = cookie.split("; ");
+		const [name, value] = nameValue.split("=");
+		const cookieObj = { value };
+		attributes.forEach((attr) => {
+			const [attrName, attrValue] = attr.split("=");
+			cookieObj[attrName.toLowerCase()] = attrValue;
+		});
+		cookieMap.set(name, cookieObj);
+	});
+	return cookieMap;
+}
+function getSetCookie(header, prevCookie) {
+	const parsed = parseSetCookieHeader(header);
+	let toSetCookie = {};
+	parsed.forEach((cookie, key) => {
+		const expiresAt = cookie["expires"];
+		const maxAge = cookie["max-age"];
+		let expires = null;
+		if (expiresAt) expires = new Date(String(expiresAt));
+		else if (maxAge) expires = new Date(Date.now() + Number(maxAge) * 1e3);
+		toSetCookie[key] = {
+			value: cookie["value"],
+			expires: expires ? expires.toISOString() : null
+		};
+	});
+	if (prevCookie) try {
+		toSetCookie = {
+			...JSON.parse(prevCookie),
+			...toSetCookie
+		};
+	} catch {}
+	return JSON.stringify(toSetCookie);
+}
+function getCookie(cookie) {
+	let parsed = {};
+	try {
+		parsed = JSON.parse(cookie);
+	} catch {}
+	const parts = [];
+	for (const [key, value] of Object.entries(parsed)) {
+		if (value.expires && new Date(value.expires) < /* @__PURE__ */ new Date()) continue;
+		parts.push(`${key}=${value.value}`);
+	}
+	return parts.join("; ");
+}
+/**
+* The stored cookies with those of a `Cookie` header's value added, when it holds one they don't:
+* a session the website's Worker signed in with. Null when they hold it already, even expired.
+*/
+function withCookieHeader(stored, header) {
+	let parsed = {};
+	try {
+		parsed = JSON.parse(stored);
+	} catch {}
+	let added = false;
+	for (const pair of header.split("; ")) {
+		const separator = pair.indexOf("=");
+		if (separator <= 0) continue;
+		const name = pair.slice(0, separator);
+		const value = pair.slice(separator + 1);
+		if (parsed[name]?.value === value) continue;
+		parsed[name] = {
+			value,
+			expires: null
+		};
+		added = true;
+	}
+	return added ? JSON.stringify(parsed) : null;
+}
+
+//#endregion
+export { getCookie, getSetCookie, parseSetCookieHeader, withCookieHeader };

package/dist/lib/use-thread.js

@@ -152,10 +152,10 @@ function useThread(apiUrl, projectId, draftId, t0) {
 	let t9;
 	if ($[23] !== socket || $[24] !== unaccepted) {
 		t9 = () => {
-			for (const [operationId_2, text] of unaccepted) transmit(socket, {
+			for (const [operationId_2, message] of unaccepted) transmit(socket, {
 				type: "send",
 				operationId: operationId_2,
-				text
+				...message
 			});
 		};
 		$[23] = socket;
@@ -200,15 +200,19 @@ function useThread(apiUrl, projectId, draftId, t0) {
 	React.useEffect(t12, t13);
 	let t14;
 	if ($[34] !== sent || $[35] !== socket) {
-		t14 = (text_0) => {
+		t14 = (text, where) => {
 			const operationId_3 = crypto.randomUUID();
+			const message_0 = where ? {
+				text,
+				where
+			} : { text };
 			sent.add(operationId_3);
 			setError(void 0);
-			setUnaccepted((current_3) => new Map(current_3).set(operationId_3, text_0));
+			setUnaccepted((current_3) => new Map(current_3).set(operationId_3, message_0));
 			transmit(socket, {
 				type: "send",
 				operationId: operationId_3,
-				text: text_0
+				...message_0
 			});
 		};
 		$[34] = sent;

package/dist/package.js

@@ -1,5 +1,5 @@
 //#region package.json
-var version = "0.59.0";
+var version = "0.61.0";
 
 //#endregion
 export { version };