From 55b914cb404342f30048ac7ef3bcb9828642ef14 Mon Sep 17 00:00:00 2001
From: Michael Freno <michaelt.freno@gmail.com>
Date: Sun, 11 Jan 2026 22:11:56 -0500
Subject: [PATCH] general: min deployment note, seal

---
 src/routes/downloads.tsx      |  2 +-
 src/server/session-helpers.ts | 37 ++++++++++++++++++++++++++++++++---
 2 files changed, 35 insertions(+), 4 deletions(-)

diff --git a/src/routes/downloads.tsx b/src/routes/downloads.tsx
index e838d28..8bd93bd 100644
--- a/src/routes/downloads.tsx
+++ b/src/routes/downloads.tsx
@@ -94,7 +94,7 @@ export default function DownloadsPage() {
 
               <div class="flex flex-col items-center gap-3">
                 <span class="text-subtext0 font-mono text-sm">
-                  platform: macOS (14.6+)
+                  platform: macOS (13.0+)
                 </span>
                 <Button
                   variant="download"
diff --git a/src/server/session-helpers.ts b/src/server/session-helpers.ts
index 1b20538..cd52c8e 100644
--- a/src/server/session-helpers.ts
+++ b/src/server/session-helpers.ts
@@ -1,7 +1,13 @@
 import { v4 as uuidV4 } from "uuid";
 import { createHash, randomBytes, timingSafeEqual } from "crypto";
 import type { H3Event } from "vinxi/http";
-import { clearSession, getSession, getCookie, setCookie } from "vinxi/http";
+import {
+  clearSession,
+  getSession,
+  getCookie,
+  setCookie,
+  updateSession
+} from "vinxi/http";
 import { ConnectionFactory } from "./database";
 import { env } from "~/env/server";
 import { AUTH_CONFIG, expiryToSeconds, CACHE_CONFIG } from "~/config";
@@ -204,13 +210,38 @@ export async function createAuthSession(
   });
 
   // Use updateSession to set session data directly
-  const { updateSession } = await import("vinxi/http");
+  console.log(
+    "[Session Create] Input sessionData:",
+    JSON.stringify(sessionData, null, 2)
+  );
   const session = await updateSession(event, configWithMaxAge, sessionData);
+  console.log(
+    "[Session Create] Returned session object:",
+    JSON.stringify(
+      {
+        id: session.id,
+        data: session.data,
+        createdAt: session.createdAt
+      },
+      null,
+      2
+    )
+  );
+
+  // Explicitly seal/flush the session to ensure cookie is written
+  // This is important in serverless environments where response might stream early
+  const { sealSession } = await import("vinxi/http");
+  sealSession(event, configWithMaxAge);
+  console.log("[Session Create] Explicitly sealed session cookie");
 
   console.log("[Session Create] Session created via updateSession API:", {
     sessionId: session.id,
     hasData: !!session.data,
-    dataKeys: session.data ? Object.keys(session.data) : []
+    dataKeys: session.data ? Object.keys(session.data) : [],
+    dataIsEmpty: session.data && Object.keys(session.data).length === 0,
+    inputDataKeys: Object.keys(sessionData),
+    configPassword: configWithMaxAge.password?.substring(0, 10) + "...",
+    configMaxAge: configWithMaxAge.maxAge
   });
 
   // Set a separate sessionId cookie for DB fallback (in case main session cookie fails)