toilscript 0.1.54 → 0.1.55

package/dist/importmap.json

@@ -1,7 +1,7 @@
 {
   "imports": {
-    "toilscript": "https://cdn.jsdelivr.net/npm/toilscript@0.1.54/dist/toilscript.js",
-    "toilscript/cli": "https://cdn.jsdelivr.net/npm/toilscript@0.1.54/dist/cli.js",
+    "toilscript": "https://cdn.jsdelivr.net/npm/toilscript@0.1.55/dist/toilscript.js",
+    "toilscript/cli": "https://cdn.jsdelivr.net/npm/toilscript@0.1.55/dist/cli.js",
     "binaryen": "https://cdn.jsdelivr.net/npm/binaryen@130.0.0-nightly.20260609/index.js",
     "long": "https://cdn.jsdelivr.net/npm/long@5.3.2/index.js"
   }

package/dist/toilscript.js

@@ -487,7 +487,8 @@ declare interface __Record`),n.push(e.id.toString()),n.push(`<TOmittable> {
 `}return e+=`    };
 `,e+=`}
 `,e}function uR(r){let i=`// ---- @user session client (reads the readable companion cookie) ----
-`;return i+=`const __TOIL_USER_COOKIE = "__Secure-toil_user";
+`;return i+=`const __TOIL_USER_COOKIE = "__Secure-toil_user"; // HTTPS (prod)
+`,i+=`const __TOIL_USER_COOKIE_HTTP = "toil_user";       // plain HTTP (dev): no __Secure- prefix
 
 `,i+=`function __toilReadCookie(name: string): string | null {
 `,i+=`    if (typeof document === "undefined" || !document.cookie) return null;
@@ -511,10 +512,12 @@ declare interface __Record`),n.push(e.id.toString()),n.push(`<TOmittable> {
 `,i+=`}
 
 `,i+=`/**
-`,i+=" * The signed-in user, decoded from the readable `__Secure-toil_user` companion\n",i+=" * cookie the server set at login, or `null`. Auto-typed to your `@user` class\n",i+=" * (`"+r+"`) with no type argument. DISPLAY-ONLY: the server re-verifies\n",i+=" * the HttpOnly signed session on every `@auth` request; never trust this for\n",i+=` * authorization (a client can forge it, fooling only its own UI).
+`,i+=" * The signed-in user, decoded from the readable `toil_user` companion cookie the\n",i+=" * server set at login (prefixed `__Secure-toil_user` over HTTPS), or `null`. Reads\n",i+=" * both names so a dev (http) session resolves. Auto-typed to your `@user` class\n",i+=" * (`"+r+"`) with no type argument. DISPLAY-ONLY: the server re-verifies\n",i+=" * the HttpOnly signed session on every `@auth` request; never trust this for\n",i+=` * authorization (a client can forge it, fooling only its own UI).
 `,i+=` */
 `,i+="export function getUser(): "+r+` | null {
-`,i+=`    const raw = __toilReadCookie(__TOIL_USER_COOKIE);
+`,i+=`    // Prefixed name (HTTPS/prod) first, then the bare name (plain HTTP/dev). A
+`,i+=`    // __Secure- cookie is never sent over http, so this resolves correctly on both.
+`,i+=`    const raw = __toilReadCookie(__TOIL_USER_COOKIE) ?? __toilReadCookie(__TOIL_USER_COOKIE_HTTP);
 `,i+=`    if (raw === null) return null;
 `,i+=`    const bytes = __toilB64UrlDecode(raw);
 `,i+=`    if (bytes === null) return null;