Function checkLiveAuth

src/artifacts/live-server.ts:56–64

(token: string | undefined, url: string, cookieHeader: string | undefined)

 *  set the access cookie. Pure → unit-testable. A `?k=<token>` match authorizes AND issues
 *  a cookie so the follow-up SSE / reload requests (which carry no query) stay authorized. */
export function checkLiveAuth(token: string | undefined, url: string, cookieHeader: string | undefined):
  { ok: boolean; setCookie: boolean } {
  if (!token) return { ok: true, setCookie: false };
  const q = url.match(/[?&]k=([^&]+)/);
  if (q && decodeURIComponent(q[1]!) === token) return { ok: true, setCookie: true };
  const c = (cookieHeader ?? '').match(/(?:^|;\s*)qx_live=([^;]+)/);
  if (c && decodeURIComponent(c[1]!) === token) return { ok: true, setCookie: false };
  return { ok: false, setCookie: false };
}

/** sha1 of the served HTML — the single comparison that correctly dedupes updates,
 *  rollbacks (same source, moved pointer), no-op rewrites, and the error overlay. */