use-convex 1.3.0 → 2.0.0

package/dist/runtime/utils/authClientOptions.d.ts

@@ -1,61 +1,54 @@
 /**
- * Runtime Convex Auth client knobs (React `ConvexAuthProvider` parity).
- *
- * Serializable defaults also live on `convex.auth` module options
- * (`storageNamespace`, `storage: 'localStorage' | 'inMemory'`,
- * `shouldHandleCode: boolean`). Call {@link configureConvexAuth} from a
- * client plugin (`enforce: 'pre'`) for `replaceURL`, function
- * `shouldHandleCode`, or a custom {@link ConvexAuthTokenStorage}.
+ * Runtime knobs for the Convex Auth client that can't live in serializable
+ * module options: a custom TokenStorage, extra ambient sign-ins, or a custom
+ * `replaceUrl`. Call {@link configureConvexAuth} from a client plugin with
+ * `enforce: 'pre'` so the options land before the auth plugin creates the
+ * client.
+ */
+/**
+ * Token storage (`@convex-dev/auth/browser` `TokenStorage`). Methods may be
+ * sync or async, e.g. Capacitor Preferences or an encrypted store.
  */
 export type ConvexAuthTokenStorage = {
-    getItem: (key: string) => string | undefined | null | Promise<string | undefined | null>;
+    getItem: (key: string) => string | null | undefined | Promise<string | null | undefined>;
     setItem: (key: string, value: string) => void | Promise<void>;
     removeItem: (key: string) => void | Promise<void>;
 };
-export type ConvexAuthStorageMode = 'localStorage' | 'inMemory';
+export type { ConvexAuthStorageMode } from './authStorage.js';
+/**
+ * An ambient sign-in registration (`AmbientSignInClient` in
+ * `@convex-dev/auth`): a method that finishes on its own at startup, like
+ * an OAuth callback. Typed loosely here so this file needs no Convex Auth
+ * import; the auth plugin passes it straight to `AuthClient`.
+ */
+export type ConvexAmbientSignIn = {
+    id: string;
+    setup: (ctx: never) => void | {
+        onInit?: () => void;
+    };
+};
 export type ConvexAuthClientOptions = {
     /**
-     * When `false` (or a function returning false), ignore `?code=` OAuth
-     * callbacks. Defaults to handling the code when a verifier is stored.
+     * Custom token storage. Overrides `convex.auth.storage`.
      */
-    shouldHandleCode?: boolean | (() => boolean);
+    storage?: ConvexAuthTokenStorage;
     /**
-     * Replace the URL after stripping `?code=` (JS routers). Defaults to
-     * `history.replaceState`.
+     * Replaces the default ambient sign-ins (`[oauth()]`). Pass `[]` to
+     * disable OAuth callback handling, or include `convexOAuth()` alongside
+     * your own.
      */
-    replaceURL?: (relativeUrl: string) => void | Promise<void>;
+    ambientSignIns?: ConvexAmbientSignIn[];
     /**
-     * Token storage. `'localStorage'` (default), `'inMemory'`, or a custom
-     * {@link ConvexAuthTokenStorage} (e.g. `sessionStorage`, Secure Store).
+     * Replace the page URL after an OAuth callback strips its params.
+     * Defaults to `history.replaceState`, then syncs `vue-router`.
      */
-    storage?: ConvexAuthStorageMode | ConvexAuthTokenStorage;
-    /**
-     * Namespace for storage keys (non-alphanumeric chars stripped). Defaults
-     * to the Convex deployment URL.
-     */
-    storageNamespace?: string;
-};
-/** Serializable subset safe for `runtimeConfig.public.convex.auth`. */
-export type ConvexAuthModuleClientOptions = {
-    shouldHandleCode?: boolean;
-    storage?: ConvexAuthStorageMode;
-    storageNamespace?: string;
+    replaceUrl?: (url: string) => void;
 };
 /**
  * Set runtime Convex Auth knobs. Merge is shallow — later calls override
- * earlier keys. Prefer calling from a client plugin with `enforce: 'pre'`
- * so options land before the auth plugin consumes OAuth codes.
+ * earlier keys.
  */
 export declare function configureConvexAuth(options: ConvexAuthClientOptions): void;
-/** @internal */
-export declare function setConvexAuthModuleDefaults(options: ConvexAuthModuleClientOptions): void;
-/** Merged module defaults + {@link configureConvexAuth} overrides. */
 export declare function getConvexAuthClientOptions(): ConvexAuthClientOptions;
 /** @internal */
 export declare function resetConvexAuthClientOptionsForTests(): void;
-/** @internal */
-export declare function createInMemoryTokenStorage(): ConvexAuthTokenStorage;
-/** @internal */
-export declare function resetInMemoryTokenStorageForTests(): void;
-/** Resolve the active token storage from merged auth options. */
-export declare function resolveAuthTokenStorage(options?: ConvexAuthClientOptions): ConvexAuthTokenStorage;

package/dist/runtime/utils/authClientOptions.js

@@ -1,73 +1,10 @@
 let runtimeOverrides = {};
-let moduleDefaults = {};
 export function configureConvexAuth(options) {
   runtimeOverrides = { ...runtimeOverrides, ...options };
 }
-export function setConvexAuthModuleDefaults(options) {
-  moduleDefaults = { ...options };
-}
 export function getConvexAuthClientOptions() {
-  return {
-    ...moduleDefaults,
-    ...runtimeOverrides
-  };
+  return { ...runtimeOverrides };
 }
 export function resetConvexAuthClientOptionsForTests() {
   runtimeOverrides = {};
-  moduleDefaults = {};
-}
-const inMemory = /* @__PURE__ */ new Map();
-export function createInMemoryTokenStorage() {
-  return {
-    getItem: (key) => inMemory.get(key) ?? null,
-    setItem: (key, value) => {
-      inMemory.set(key, value);
-    },
-    removeItem: (key) => {
-      inMemory.delete(key);
-    }
-  };
-}
-export function resetInMemoryTokenStorageForTests() {
-  inMemory.clear();
-}
-const localStorageAdapter = {
-  getItem: (key) => {
-    if (typeof window === "undefined") {
-      return null;
-    }
-    try {
-      return window.localStorage.getItem(key);
-    } catch {
-      return null;
-    }
-  },
-  setItem: (key, value) => {
-    if (typeof window === "undefined") {
-      return;
-    }
-    try {
-      window.localStorage.setItem(key, value);
-    } catch {
-    }
-  },
-  removeItem: (key) => {
-    if (typeof window === "undefined") {
-      return;
-    }
-    try {
-      window.localStorage.removeItem(key);
-    } catch {
-    }
-  }
-};
-export function resolveAuthTokenStorage(options = getConvexAuthClientOptions()) {
-  const storage = options.storage;
-  if (storage === "inMemory") {
-    return createInMemoryTokenStorage();
-  }
-  if (storage && typeof storage === "object") {
-    return storage;
-  }
-  return localStorageAdapter;
 }

package/dist/runtime/utils/authCookie.d.ts

@@ -1,19 +1,13 @@
-import { type ComputedRef } from 'vue';
+import { type ComputedRef, type Ref } from 'vue';
 /**
- * Shared JWT cookie for SSR snapshots. Same name + options as persistTokens
- * so plugin reads and sign-in/out writes share one Nuxt cookie ref.
- *
- * When `auth.httpOnly` is set, this cookie is HttpOnly (server-readable only).
+ * Convex Auth access token shared between server and client via the Nuxt
+ * payload. The server fills it from the (refreshed) SSR session; the client
+ * auth plugin keeps it in sync with the live `AuthClient` token.
  */
+export declare function useConvexAuthTokenState(): Ref<string | null>;
+/** BYO providers: readable JWT cookie written by the app after sign-in. */
 export declare function useAuthJwtCookie(): import("nuxt/app").CookieRef<string | null> | undefined;
-/**
- * Readable presence marker used when JWT is HttpOnly so the client can still
- * compute `hasSsrSession` / `showAuthedUi` without reading the token.
- */
-export declare function useAuthPresentCookie(): import("nuxt/app").CookieRef<string | null> | undefined;
-/** Reactive JWT for HttpClient + SSR. Empty on the client when HttpOnly. */
+/** Reactive JWT for HttpClient + SSR. */
 export declare function useSsrTokenRef(): ComputedRef<string | undefined>;
-/**
- * Session hint for UI gating: JWT readable, or HttpOnly presence cookie.
- */
+/** Session hint for UI gating: a JWT is known for this request / client. */
 export declare function useHasSsrSessionRef(): ComputedRef<boolean>;

package/dist/runtime/utils/authCookie.js

@@ -1,46 +1,42 @@
 import { computed } from "vue";
-import { useCookie, useRuntimeConfig } from "nuxt/app";
+import { useCookie, useRuntimeConfig, useState } from "nuxt/app";
 import {
-  AUTH_JWT_COOKIE_MAX_AGE,
+  SSR_TOKEN_STATE_KEY,
   cookieValueToSsrToken,
-  isHttpOnlyAuth,
-  resolveAuthCookieName,
-  resolveAuthPresentCookieName
+  isConvexAuth,
+  resolveAuthCookieName
 } from "./authStorage.js";
-function cookieOptions(httpOnly) {
-  return {
-    sameSite: "lax",
-    secure: process.env.NODE_ENV === "production",
-    maxAge: AUTH_JWT_COOKIE_MAX_AGE,
-    path: "/",
-    httpOnly
-  };
+function readAuthConfig() {
+  const config = useRuntimeConfig();
+  return config.public.convex?.auth;
+}
+export function useConvexAuthTokenState() {
+  return useState(SSR_TOKEN_STATE_KEY, () => null);
 }
 export function useAuthJwtCookie() {
-  const config = useRuntimeConfig();
-  const convexConfig = config.public.convex;
-  const name = resolveAuthCookieName(convexConfig?.auth);
-  if (!name) {
+  const auth = readAuthConfig();
+  if (isConvexAuth(auth)) {
     return void 0;
   }
-  const httpOnly = isHttpOnlyAuth(convexConfig?.auth);
-  return useCookie(name, cookieOptions(httpOnly));
-}
-export function useAuthPresentCookie() {
-  const config = useRuntimeConfig();
-  const convexConfig = config.public.convex;
-  const name = resolveAuthPresentCookieName(convexConfig?.auth);
+  const name = resolveAuthCookieName(auth);
   if (!name) {
     return void 0;
   }
-  return useCookie(name, cookieOptions(false));
+  return useCookie(name, {
+    sameSite: "lax",
+    secure: process.env.NODE_ENV === "production",
+    path: "/"
+  });
 }
 export function useSsrTokenRef() {
+  if (isConvexAuth(readAuthConfig())) {
+    const state = useConvexAuthTokenState();
+    return computed(() => state.value || void 0);
+  }
   const cookie = useAuthJwtCookie();
   return computed(() => cookieValueToSsrToken(cookie?.value));
 }
 export function useHasSsrSessionRef() {
   const token = useSsrTokenRef();
-  const present = useAuthPresentCookie();
-  return computed(() => !!token.value || present?.value === "1");
+  return computed(() => !!token.value);
 }

package/dist/runtime/utils/authStorage.d.ts

@@ -1,96 +1,93 @@
 /**
- * Convex Auth client storage helpers (mirrors @convex-dev/auth/react).
+ * Shared auth configuration helpers.
+ *
+ * Kept free of `@convex-dev/auth` imports: apps that bring their own provider
+ * (Clerk, Auth0, custom JWT) load this file without installing Convex Auth.
  */
-import { type ConvexAuthStorageMode, type ConvexAuthTokenStorage } from './authClientOptions.js';
-export declare const JWT_STORAGE_KEY = "__convexAuthJWT";
-export declare const REFRESH_TOKEN_STORAGE_KEY = "__convexAuthRefreshToken";
-export declare const VERIFIER_STORAGE_KEY = "__convexAuthOAuthVerifier";
-export declare const AUTH_JWT_COOKIE_MAX_AGE: number;
-export declare const DEFAULT_CONVEX_AUTH_COOKIE = "convex_jwt";
-/** Readable marker so the client knows an HttpOnly session exists. */
-export declare const DEFAULT_AUTH_PRESENT_COOKIE = "convex_auth_present";
-/** HttpOnly JWT cookie (Next.js Convex Auth naming). */
-export declare const HTTPONLY_JWT_COOKIE = "__convexAuthJWT";
-/** HttpOnly refresh cookie. */
-export declare const HTTPONLY_REFRESH_COOKIE = "__convexAuthRefreshToken";
+/** Session model for first-party Convex Auth v2. */
+export type ConvexAuthMode = 'ssr' | 'spa';
+/** Client token storage for Convex Auth. */
+export type ConvexAuthStorageMode = 'localStorage' | 'inMemory';
+/**
+ * Names of the session functions `setupConvexAuth` returns, as exported from
+ * the app's Convex functions (e.g. `convex/auth.ts` → `'auth:refreshSession'`).
+ */
+export type ConvexAuthApiNames = {
+    refreshSession?: string;
+    signOut?: string;
+    isAuthenticated?: string;
+};
 export type ConvexAuthConfig = {
-    provider?: string;
-    cookie?: string;
+    provider?: 'convex-auth';
     /**
-     * Store JWT + refresh in HttpOnly cookies via Nitro (Next.js parity).
-     * When true, JS cannot read tokens from `document.cookie`; `fetchToken`
-     * uses same-origin POST `/api/convex/auth/session` with `{ getToken: true }`.
-     * Prefer `true` in production. Does not make sessions XSS-proof.
-     */
-    httpOnly?: boolean;
-    /** Readable presence cookie when `httpOnly` is set (UI only). */
-    presentCookie?: string;
-    /**
-     * Namespace for local token keys (React `storageNamespace` parity).
-     * Non-alphanumeric characters are stripped. Defaults to the deployment URL.
+     * BYO providers: cookie whose value is a JWT for SSR queries and Nitro
+     * `fetch*` helpers. Ignored for `provider: 'convex-auth'`, which manages
+     * its own cookies.
      */
+    cookie?: string;
+    /** @see ModuleAuthOptions.mode */
+    mode?: ConvexAuthMode;
+    /** @see ModuleAuthOptions.api */
+    api?: ConvexAuthApiNames;
+    /** @see ModuleAuthOptions.routePrefix */
+    routePrefix?: string;
+    /** @see ModuleAuthOptions.storageNamespace */
     storageNamespace?: string;
-    /**
-     * Client token storage mode. Use {@link configureConvexAuth} for a custom
-     * {@link ConvexAuthTokenStorage}. Ignored when `httpOnly` is enabled.
-     * @default 'localStorage'
-     */
+    /** @see ModuleAuthOptions.storage */
     storage?: ConvexAuthStorageMode;
-    /**
-     * When `false`, do not consume `?code=` OAuth callbacks. For a function
-     * gate, call {@link configureConvexAuth} with `shouldHandleCode`.
-     */
-    shouldHandleCode?: boolean;
+    /** @see ModuleAuthOptions.verbose */
+    verbose?: boolean;
+};
+/** Server-only Convex Auth options (`runtimeConfig.convexAuth`). */
+export interface ConvexAuthServerRuntimeConfig {
+    /** Sign-in function names the auth proxy forwards, e.g. `'auth:signInWithUsernamePassword'`. */
+    signIn?: string[];
+    /** Origins trusted besides the request's own Host. */
+    allowedOrigins?: string[];
+    /** Cookie attributes. `secure` defaults to true except on localhost. */
+    cookie?: {
+        secure?: boolean;
+        domain?: string;
+        path?: string;
+    };
+}
+/** The Convex Auth v2 access-token cookie (fixed by `@convex-dev/auth/ssr`). */
+export declare const CONVEX_AUTH_JWT_COOKIE = "__convexAuthJWT";
+/** The Convex Auth v2 refresh-token cookie (fixed by `@convex-dev/auth/ssr`). */
+export declare const CONVEX_AUTH_REFRESH_COOKIE = "__convexAuthRefreshToken";
+export declare const DEFAULT_AUTH_ROUTE_PREFIX = "/api/convex/auth";
+export declare const DEFAULT_CONVEX_AUTH_API: Required<ConvexAuthApiNames>;
+/** `useState` key carrying the SSR access token to the client payload. */
+export declare const SSR_TOKEN_STATE_KEY = "convex:auth-token";
+export declare function isConvexAuth(auth?: ConvexAuthConfig): boolean;
+/** SSR mode is the default for Convex Auth: Nuxt renders on the server. */
+export declare function resolveAuthMode(auth?: ConvexAuthConfig): ConvexAuthMode;
+export declare function isSsrConvexAuth(auth?: ConvexAuthConfig): boolean;
+export declare function resolveAuthApiNames(auth?: ConvexAuthConfig): Required<ConvexAuthApiNames>;
+export declare function resolveAuthRoutes(auth?: ConvexAuthConfig): {
+    signIn: string;
+    refresh: string;
+    signOut: string;
 };
-export type { ConvexAuthTokenStorage, ConvexAuthStorageMode };
-export declare function storageNamespace(urlOrNamespace: string): string;
-export declare function storageKey(base: string, urlOrNamespace: string): string;
-/**
- * Flatten FormData (or pass through a plain record) the same way the React
- * Convex Auth client does before calling `auth:signIn`.
- */
-export declare function flattenSignInParams(params?: FormData | Record<string, string>): Record<string, string>;
 /**
- * Resolve the auth cookie name for runtime config / SSR JWT reads.
- * When `provider === 'convex-auth'` and cookie is omitted, default to `convex_jwt`
- * (or the HttpOnly JWT name when `httpOnly` is enabled).
+ * Cookie holding the JWT for SSR reads: the Convex Auth access-token cookie
+ * in SSR mode, the configured cookie for BYO providers, otherwise none.
+ * Convex Auth SPA mode keeps tokens in browser storage, so it has no cookie.
  */
 export declare function resolveAuthCookieName(auth?: ConvexAuthConfig): string | undefined;
-export declare function resolveAuthPresentCookieName(auth?: ConvexAuthConfig): string | undefined;
-export declare function resolveAuthRefreshCookieName(auth?: ConvexAuthConfig): string | undefined;
-export declare function isHttpOnlyAuth(auth?: ConvexAuthConfig): boolean;
 /** Empty / missing cookies are not a session. */
 export declare function cookieValueToSsrToken(value: string | null | undefined): string | undefined;
 /**
- * Read a stored value.
- * Sync storage returns `string | null`. Async {@link ConvexAuthTokenStorage}
- * returns a Promise — callers that can wait should use {@link readLocalAsync}.
- */
-export declare function readStored(key: string): string | null | Promise<string | null>;
-/** Sync read. Returns null when storage is async (use {@link readLocalAsync}). */
-export declare function readLocal(key: string): string | null;
-export declare function readLocalAsync(key: string): Promise<string | null>;
-export declare function writeLocal(key: string, value: string | null): void;
-export declare function writeLocalAsync(key: string, value: string | null): Promise<void>;
-/**
- * `storage: 'inMemory'` cannot survive the IdP redirect, so the OAuth
- * verifier is kept in a short-lived cookie (Next.js in-memory parity).
- * JWTs stay in memory. Other storage modes keep the verifier with the tokens.
+ * Whether a JWT's `exp` claim is within `skewSeconds` of now (or unreadable).
+ * Signature is not checked — this only decides whether to refresh.
  */
-export declare function readVerifier(key: string): string | null | Promise<string | null>;
-export declare function readVerifierAsync(key: string): Promise<string | null>;
-export declare function writeVerifier(key: string, value: string | null): Promise<void>;
-/** @internal */
-export declare function readBrowserCookie(name: string): string | null;
-/** @internal */
-export declare function writeBrowserCookie(name: string, value: string | null, maxAgeSeconds: number): void;
+export declare function isJwtExpiring(token: string, skewSeconds?: number, nowMs?: number): boolean;
 /**
- * Whether the current URL's `?code=` should be treated as an OAuth callback.
- * Requires a stored verifier (we started the flow). Honors
- * `shouldHandleCode` from module options / {@link configureConvexAuth}.
+ * A stable identity for the session a JWT belongs to: `iss` + `sub`.
+ *
+ * Convex Auth rotates the access token every minute but keeps the session
+ * id in `sub`, so this changes on sign-in / sign-out / account switch, not
+ * on rotation. Tokens without readable claims fall back to the token itself
+ * (any change is treated as a new session). Empty for no token.
  */
-export declare function shouldConsumeOAuthCode(options: {
-    code: string | null;
-    verifier: string | null;
-    shouldHandleCode?: boolean | (() => boolean);
-}): boolean;
+export declare function sessionKeyFromToken(token: string | null | undefined): string;

package/dist/runtime/utils/authStorage.js

@@ -1,156 +1,75 @@
-import {
-  getConvexAuthClientOptions,
-  resolveAuthTokenStorage
-} from "./authClientOptions.js";
-export const JWT_STORAGE_KEY = "__convexAuthJWT";
-export const REFRESH_TOKEN_STORAGE_KEY = "__convexAuthRefreshToken";
-export const VERIFIER_STORAGE_KEY = "__convexAuthOAuthVerifier";
-export const AUTH_JWT_COOKIE_MAX_AGE = 60 * 60 * 24 * 30;
-export const DEFAULT_CONVEX_AUTH_COOKIE = "convex_jwt";
-export const DEFAULT_AUTH_PRESENT_COOKIE = "convex_auth_present";
-export const HTTPONLY_JWT_COOKIE = "__convexAuthJWT";
-export const HTTPONLY_REFRESH_COOKIE = "__convexAuthRefreshToken";
-export function storageNamespace(urlOrNamespace) {
-  return urlOrNamespace.replace(/[^a-z0-9]/gi, "");
-}
-export function storageKey(base, urlOrNamespace) {
-  return `${base}_${storageNamespace(urlOrNamespace)}`;
-}
-export function flattenSignInParams(params) {
-  if (params === void 0) {
-    return {};
-  }
-  if (typeof FormData !== "undefined" && params instanceof FormData) {
-    const out = {};
-    params.forEach((value, key) => {
-      if (typeof value === "string") {
-        out[key] = value;
-      }
-    });
-    return out;
-  }
-  return { ...params };
+export const CONVEX_AUTH_JWT_COOKIE = "__convexAuthJWT";
+export const CONVEX_AUTH_REFRESH_COOKIE = "__convexAuthRefreshToken";
+export const DEFAULT_AUTH_ROUTE_PREFIX = "/api/convex/auth";
+export const DEFAULT_CONVEX_AUTH_API = {
+  refreshSession: "auth:refreshSession",
+  signOut: "auth:signOut",
+  isAuthenticated: "auth:isAuthenticated"
+};
+export const SSR_TOKEN_STATE_KEY = "convex:auth-token";
+export function isConvexAuth(auth) {
+  return auth?.provider === "convex-auth";
+}
+export function resolveAuthMode(auth) {
+  return auth?.mode ?? "ssr";
+}
+export function isSsrConvexAuth(auth) {
+  return isConvexAuth(auth) && resolveAuthMode(auth) === "ssr";
+}
+export function resolveAuthApiNames(auth) {
+  return { ...DEFAULT_CONVEX_AUTH_API, ...auth?.api };
+}
+export function resolveAuthRoutes(auth) {
+  const prefix = (auth?.routePrefix ?? DEFAULT_AUTH_ROUTE_PREFIX).replace(/\/+$/, "");
+  return {
+    signIn: `${prefix}/signin`,
+    refresh: `${prefix}/refresh`,
+    signOut: `${prefix}/signout`
+  };
 }
 export function resolveAuthCookieName(auth) {
-  if (auth?.httpOnly) {
-    return auth.cookie ?? HTTPONLY_JWT_COOKIE;
+  if (isConvexAuth(auth)) {
+    return isSsrConvexAuth(auth) ? CONVEX_AUTH_JWT_COOKIE : void 0;
   }
-  if (auth?.cookie) {
-    return auth.cookie;
-  }
-  if (auth?.provider === "convex-auth") {
-    return DEFAULT_CONVEX_AUTH_COOKIE;
-  }
-  return void 0;
-}
-export function resolveAuthPresentCookieName(auth) {
-  if (!auth?.httpOnly) {
-    return void 0;
-  }
-  return auth.presentCookie ?? DEFAULT_AUTH_PRESENT_COOKIE;
-}
-export function resolveAuthRefreshCookieName(auth) {
-  if (!auth?.httpOnly) {
-    return void 0;
-  }
-  return HTTPONLY_REFRESH_COOKIE;
-}
-export function isHttpOnlyAuth(auth) {
-  return auth?.httpOnly === true;
+  return auth?.cookie || void 0;
 }
 export function cookieValueToSsrToken(value) {
   return value || void 0;
 }
-const OAUTH_VERIFIER_MAX_AGE_SECONDS = 60 * 10;
-function activeStorage() {
-  return resolveAuthTokenStorage(getConvexAuthClientOptions());
-}
-function authStorageIsInMemory() {
-  return getConvexAuthClientOptions().storage === "inMemory";
-}
-export function readStored(key) {
-  const value = activeStorage().getItem(key);
-  if (value instanceof Promise) {
-    return value.then((stored) => stored ?? null);
-  }
-  return value ?? null;
-}
-export function readLocal(key) {
-  const value = readStored(key);
-  if (value instanceof Promise) {
-    return null;
-  }
-  return value;
-}
-export async function readLocalAsync(key) {
-  return await readStored(key);
-}
-export function writeLocal(key, value) {
-  void writeLocalAsync(key, value);
-}
-export async function writeLocalAsync(key, value) {
-  const storage = activeStorage();
-  if (value === null) {
-    await storage.removeItem(key);
-  } else {
-    await storage.setItem(key, value);
-  }
-}
-export function readVerifier(key) {
-  if (authStorageIsInMemory()) {
-    return readBrowserCookie(key);
-  }
-  return readStored(key);
-}
-export async function readVerifierAsync(key) {
-  return await readVerifier(key);
-}
-export async function writeVerifier(key, value) {
-  if (authStorageIsInMemory()) {
-    writeBrowserCookie(key, value, OAUTH_VERIFIER_MAX_AGE_SECONDS);
-    return;
-  }
-  await writeLocalAsync(key, value);
-}
-function escapeRegExp(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-export function readBrowserCookie(name) {
-  if (typeof document === "undefined") {
-    return null;
-  }
-  const match = document.cookie.match(new RegExp(`(?:^|; )${escapeRegExp(name)}=([^;]*)`));
-  const raw = match?.[1];
-  if (!raw) {
-    return null;
+export function isJwtExpiring(token, skewSeconds = 10, nowMs = Date.now()) {
+  const payload = token.split(".")[1];
+  if (!payload) {
+    return true;
   }
   try {
-    return decodeURIComponent(raw);
+    const base64 = payload.replace(/-/g, "+").replace(/_/g, "/");
+    const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+    const json = typeof atob === "function" ? atob(padded) : globalThis.Buffer.from(padded, "base64").toString();
+    const exp = JSON.parse(json).exp;
+    if (typeof exp !== "number") {
+      return true;
+    }
+    return exp * 1e3 - skewSeconds * 1e3 <= nowMs;
   } catch {
-    return raw;
-  }
-}
-export function writeBrowserCookie(name, value, maxAgeSeconds) {
-  if (typeof document === "undefined") {
-    return;
-  }
-  const secure = typeof location !== "undefined" && location.protocol === "https:" ? "; Secure" : "";
-  if (value === null) {
-    document.cookie = `${name}=; Max-Age=0; Path=/; SameSite=Lax${secure}`;
-    return;
+    return true;
   }
-  document.cookie = `${name}=${encodeURIComponent(value)}; Max-Age=${maxAgeSeconds}; Path=/; SameSite=Lax${secure}`;
 }
-export function shouldConsumeOAuthCode(options) {
-  if (options.code === null || options.verifier === null) {
-    return false;
-  }
-  const gate = options.shouldHandleCode ?? getConvexAuthClientOptions().shouldHandleCode;
-  if (gate === void 0) {
-    return true;
+export function sessionKeyFromToken(token) {
+  if (!token) {
+    return "";
   }
-  if (typeof gate === "function") {
-    return gate();
+  const payload = token.split(".")[1];
+  if (payload) {
+    try {
+      const base64 = payload.replace(/-/g, "+").replace(/_/g, "/");
+      const padded = base64 + "=".repeat((4 - base64.length % 4) % 4);
+      const json = typeof atob === "function" ? atob(padded) : globalThis.Buffer.from(padded, "base64").toString();
+      const claims = JSON.parse(json);
+      if (typeof claims.sub === "string" && claims.sub) {
+        return `${typeof claims.iss === "string" ? claims.iss : ""}|${claims.sub}`;
+      }
+    } catch {
+    }
   }
-  return gate;
+  return token;
 }