// ---------------------------------------------------------------------------// Auth-hint cookie — the client-readable "probably signed in" signal.//// The session cookie itself (cloud's `wos-session`, self-host's Better Auth// cookie) is HttpOnly, so on a fresh page load the SPA can't know it's signed// in until `/account/me` resolves. This cookie is the non-HttpOnly companion:// a display-only snapshot of the authenticated identity that `AuthProvider`// writes whenever `/account/me` confirms a session and reads back at the next// page load to render the app shell immediately, while `/account/me`// reconciles in the background.//// It is a HINT, never an authority: every API call is still authenticated by// the real session cookie server-side, and a stale or forged hint can only// change which placeholder the user briefly sees. Keep the payload to// display data the user already knows about themselves.//// The encode/decode half is pure (no DOM) so a server that wants to write or// clear the hint (cloud's logout does) shares one encoding with the client.// --------------------------------------------------------------------------- import { Option, Schema } from "effect"; export const AUTH_HINT_COOKIE = "executor-auth-hint"; /** Matches the session cookie lifetime (7 days). */export const AUTH_HINT_MAX_AGE_SECONDS = 60 * 60 * 24 * 7; const AuthHintSchema = Schema.Struct({  v: Schema.Literal(1),  user: Schema.Struct({    id: Schema.String,    email: Schema.String,    name: Schema.NullOr(Schema.String),    avatarUrl: Schema.NullOr(Schema.String),  }),  organization: Schema.NullOr(    Schema.Struct({ id: Schema.String, name: Schema.String, slug: Schema.String }),  ),}); export type AuthHint = typeof AuthHintSchema.Type; const AuthHintFromJson = Schema.fromJsonString(AuthHintSchema);const decodeAuthHintJson = Schema.decodeUnknownOption(AuthHintFromJson);// The cookie value arrives percent-encoded; a truncated/corrupted one can// make decodeURIComponent itself throw, which must read as "no hint".const decodeUriComponentOption = Option.liftThrowable(decodeURIComponent); const encodeAuthHintJson = Schema.encodeSync(AuthHintFromJson); /** Encode a hint as a wire-ready cookie VALUE (URI-encoded JSON). */export const encodeAuthHint = (hint: AuthHint): string =>  encodeURIComponent(encodeAuthHintJson(hint)); /** Decode a cookie VALUE back into a hint; null for anything malformed. */export const decodeAuthHint = (value: string | null | undefined): AuthHint | null => {  if (!value) return null;  return decodeUriComponentOption(value).pipe(Option.flatMap(decodeAuthHintJson), Option.getOrNull);}; // ── Browser-side cookie maintenance (AuthProvider) ─────────────────────────── export const writeAuthHintCookie = (hint: AuthHint): void => {  document.cookie = `${AUTH_HINT_COOKIE}=${encodeAuthHint(hint)}; Path=/; Max-Age=${AUTH_HINT_MAX_AGE_SECONDS}; SameSite=Lax${    window.location.protocol === "https:" ? "; Secure" : ""  }`;}; export const clearAuthHintCookie = (): void => {  document.cookie = `${AUTH_HINT_COOKIE}=; Path=/; Max-Age=0; SameSite=Lax`;}; export const readAuthHintCookie = (): AuthHint | null => {  const match = document.cookie    .split(";")    .map((c) => c.trim())    .find((c) => c.startsWith(`${AUTH_HINT_COOKIE}=`));  return decodeAuthHint(match ? match.slice(AUTH_HINT_COOKIE.length + 1) : null);};