@ai-matrx/auth 0.1.3 → 0.1.4

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # Changelog — @ai-matrx/auth
 
+## 0.1.4
+
+**Fix: `getPerson` no longer calls the auth server on every access check (Wave 0).** The verified
+person is now kept per client until the session changes: concurrent callers share one read, and
+sign-in, sign-out, `updatePerson`, an organization switch (`switchTo`), an active-organization
+reload, and the `SIGNED_IN` / `SIGNED_OUT` / `USER_UPDATED` events drop it. A token refresh keeps
+it; signed-out answers and failures are never cached. New export `invalidatePerson(client)` for a
+change made outside this package. Tests: `session.test.ts` "getPerson asks the auth server once per
+session", "asks again after sign-in, sign-out ...", "a signed-out answer or a failure is never cached".
+
 ## 0.1.3
 
 Automatic changed-only republish (docs/metadata drift since the last tag — see

package/dist/index.cjs

@@ -28,6 +28,7 @@ __export(src_exports, {
   extensionStorage: () => extensionStorage,
   getPerson: () => getPerson,
   getSession: () => getSession,
+  invalidatePerson: () => invalidatePerson,
   keyValueStorage: () => keyValueStorage,
   memoryStorage: () => memoryStorage,
   onSessionChange: () => onSessionChange,
@@ -62,10 +63,43 @@ async function getSession(client) {
   const { data, error } = await client.auth.getSession();
   return check("getSession", data, error).session;
 }
+var personCache = /* @__PURE__ */ new WeakMap();
+function personEntry(client) {
+  let entry = personCache.get(client);
+  if (!entry) {
+    const fresh = { read: null, epoch: 0 };
+    entry = fresh;
+    personCache.set(client, fresh);
+    const subscribe = client.auth?.onAuthStateChange;
+    if (typeof subscribe === "function") {
+      subscribe.call(client.auth, async (event) => {
+        if (event === "SIGNED_IN" || event === "SIGNED_OUT" || event === "USER_UPDATED") invalidatePerson(client);
+      });
+    }
+  }
+  return entry;
+}
+function invalidatePerson(client) {
+  const entry = personCache.get(client);
+  if (!entry) return;
+  entry.epoch += 1;
+  entry.read = null;
+}
 async function getPerson(client) {
-  const { data, error } = await client.auth.getUser();
-  if (error && (error.name === "AuthSessionMissingError" || error.status === 401)) return null;
-  return check("getPerson", data, error).user;
+  const entry = personEntry(client);
+  if (entry.read) return entry.read;
+  const epoch = entry.epoch;
+  const read = (async () => {
+    const { data, error } = await client.auth.getUser();
+    if (error && (error.name === "AuthSessionMissingError" || error.status === 401)) return null;
+    return check("getPerson", data, error).user;
+  })();
+  entry.read = read;
+  const settle = (keep) => {
+    if (entry.epoch === epoch && entry.read === read && !keep) entry.read = null;
+  };
+  read.then((user) => settle(user !== null), () => settle(false));
+  return read;
 }
 function onSessionChange(client, cb) {
   const { data } = client.auth.onAuthStateChange(cb);
@@ -73,6 +107,7 @@ function onSessionChange(client, cb) {
 }
 async function signInWithPassword(client, credentials) {
   const { data, error } = await client.auth.signInWithPassword(credentials);
+  invalidatePerson(client);
   const ok = check("signInWithPassword", data, error);
   return { session: ok.session, person: ok.user };
 }
@@ -84,10 +119,12 @@ async function signInWithOAuth(client, options) {
 }
 async function signOut(client, scope = "global") {
   const { error } = await client.auth.signOut({ scope });
+  invalidatePerson(client);
   check("signOut", null, error);
 }
 async function updatePerson(client, attributes) {
   const { data, error } = await client.auth.updateUser(attributes);
+  invalidatePerson(client);
   return check("updatePerson", data, error).user;
 }
 function sessionCredentials(client) {

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-export { A as AuthClient, S as SessionSourceLike, a as SignInError, U as UserCredentialsPort, g as getPerson, b as getSession, o as onSessionChange, r as refreshSession, s as sessionCredentials, c as signInWithOAuth, d as signInWithPassword, e as signOut, u as updatePerson, f as userCredentials } from './session-DhRO4euL.cjs';
+export { A as AuthClient, S as SessionSourceLike, a as SignInError, U as UserCredentialsPort, g as getPerson, b as getSession, i as invalidatePerson, o as onSessionChange, r as refreshSession, s as sessionCredentials, c as signInWithOAuth, d as signInWithPassword, e as signOut, u as updatePerson, f as userCredentials } from './session-DdQiStp6.cjs';
 import { SupabaseClient } from '@supabase/supabase-js';
 export { AuthChangeEvent, Session, User, UserAttributes } from '@supabase/supabase-js';
 export { CredentialsPort, MatrxCredential, MatrxCredentialKind } from './credentials.cjs';

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { A as AuthClient, S as SessionSourceLike, a as SignInError, U as UserCredentialsPort, g as getPerson, b as getSession, o as onSessionChange, r as refreshSession, s as sessionCredentials, c as signInWithOAuth, d as signInWithPassword, e as signOut, u as updatePerson, f as userCredentials } from './session-DhRO4euL.js';
+export { A as AuthClient, S as SessionSourceLike, a as SignInError, U as UserCredentialsPort, g as getPerson, b as getSession, i as invalidatePerson, o as onSessionChange, r as refreshSession, s as sessionCredentials, c as signInWithOAuth, d as signInWithPassword, e as signOut, u as updatePerson, f as userCredentials } from './session-DdQiStp6.js';
 import { SupabaseClient } from '@supabase/supabase-js';
 export { AuthChangeEvent, Session, User, UserAttributes } from '@supabase/supabase-js';
 export { CredentialsPort, MatrxCredential, MatrxCredentialKind } from './credentials.js';

package/dist/index.js

@@ -19,10 +19,43 @@ async function getSession(client) {
   const { data, error } = await client.auth.getSession();
   return check("getSession", data, error).session;
 }
+var personCache = /* @__PURE__ */ new WeakMap();
+function personEntry(client) {
+  let entry = personCache.get(client);
+  if (!entry) {
+    const fresh = { read: null, epoch: 0 };
+    entry = fresh;
+    personCache.set(client, fresh);
+    const subscribe = client.auth?.onAuthStateChange;
+    if (typeof subscribe === "function") {
+      subscribe.call(client.auth, async (event) => {
+        if (event === "SIGNED_IN" || event === "SIGNED_OUT" || event === "USER_UPDATED") invalidatePerson(client);
+      });
+    }
+  }
+  return entry;
+}
+function invalidatePerson(client) {
+  const entry = personCache.get(client);
+  if (!entry) return;
+  entry.epoch += 1;
+  entry.read = null;
+}
 async function getPerson(client) {
-  const { data, error } = await client.auth.getUser();
-  if (error && (error.name === "AuthSessionMissingError" || error.status === 401)) return null;
-  return check("getPerson", data, error).user;
+  const entry = personEntry(client);
+  if (entry.read) return entry.read;
+  const epoch = entry.epoch;
+  const read = (async () => {
+    const { data, error } = await client.auth.getUser();
+    if (error && (error.name === "AuthSessionMissingError" || error.status === 401)) return null;
+    return check("getPerson", data, error).user;
+  })();
+  entry.read = read;
+  const settle = (keep) => {
+    if (entry.epoch === epoch && entry.read === read && !keep) entry.read = null;
+  };
+  read.then((user) => settle(user !== null), () => settle(false));
+  return read;
 }
 function onSessionChange(client, cb) {
   const { data } = client.auth.onAuthStateChange(cb);
@@ -30,6 +63,7 @@ function onSessionChange(client, cb) {
 }
 async function signInWithPassword(client, credentials) {
   const { data, error } = await client.auth.signInWithPassword(credentials);
+  invalidatePerson(client);
   const ok = check("signInWithPassword", data, error);
   return { session: ok.session, person: ok.user };
 }
@@ -41,10 +75,12 @@ async function signInWithOAuth(client, options) {
 }
 async function signOut(client, scope = "global") {
   const { error } = await client.auth.signOut({ scope });
+  invalidatePerson(client);
   check("signOut", null, error);
 }
 async function updatePerson(client, attributes) {
   const { data, error } = await client.auth.updateUser(attributes);
+  invalidatePerson(client);
   return check("updatePerson", data, error).user;
 }
 function sessionCredentials(client) {
@@ -153,6 +189,7 @@ export {
   extensionStorage,
   getPerson,
   getSession,
+  invalidatePerson,
   keyValueStorage,
   memoryStorage,
   onSessionChange,

package/dist/organizations.cjs

@@ -182,10 +182,43 @@ function check(door, data, error) {
   if (error) throw new SignInError(door, error.message, error.status, error.code);
   return data;
 }
+var personCache = /* @__PURE__ */ new WeakMap();
+function personEntry(client) {
+  let entry = personCache.get(client);
+  if (!entry) {
+    const fresh = { read: null, epoch: 0 };
+    entry = fresh;
+    personCache.set(client, fresh);
+    const subscribe = client.auth?.onAuthStateChange;
+    if (typeof subscribe === "function") {
+      subscribe.call(client.auth, async (event) => {
+        if (event === "SIGNED_IN" || event === "SIGNED_OUT" || event === "USER_UPDATED") invalidatePerson(client);
+      });
+    }
+  }
+  return entry;
+}
+function invalidatePerson(client) {
+  const entry = personCache.get(client);
+  if (!entry) return;
+  entry.epoch += 1;
+  entry.read = null;
+}
 async function getPerson(client) {
-  const { data, error } = await client.auth.getUser();
-  if (error && (error.name === "AuthSessionMissingError" || error.status === 401)) return null;
-  return check("getPerson", data, error).user;
+  const entry = personEntry(client);
+  if (entry.read) return entry.read;
+  const epoch = entry.epoch;
+  const read = (async () => {
+    const { data, error } = await client.auth.getUser();
+    if (error && (error.name === "AuthSessionMissingError" || error.status === 401)) return null;
+    return check("getPerson", data, error).user;
+  })();
+  entry.read = read;
+  const settle = (keep) => {
+    if (entry.epoch === epoch && entry.read === read && !keep) entry.read = null;
+  };
+  read.then((user) => settle(user !== null), () => settle(false));
+  return read;
 }
 function onSessionChange(client, cb) {
   const { data } = client.auth.onAuthStateChange(cb);
@@ -318,6 +351,7 @@ function createActiveOrganization(options) {
   const load = () => {
     if (disposed) return Promise.resolve(current);
     generation += 1;
+    invalidatePerson(client);
     inflight = run(generation).finally(() => {
       inflight = null;
     });
@@ -362,6 +396,7 @@ function createActiveOrganization(options) {
       const organization = snap.memberships.find((m) => m.id === organizationId);
       if (!organization || !snap.userId) throw new NotAMemberError(organizationId);
       generation += 1;
+      invalidatePerson(client);
       await held.write(snap.userId, organizationId);
       publish({ ...snap, status: "ready", organizationId, organization, rung: "switched", error: null });
       await writeLastActiveOrganization(client, organizationId);

package/dist/organizations.d.cts

@@ -1,5 +1,5 @@
 import { SupabaseClient } from '@supabase/supabase-js';
-import { A as AuthClient } from './session-DhRO4euL.cjs';
+import { A as AuthClient } from './session-DdQiStp6.cjs';
 
 /**
  * @ai-matrx/auth/organizations (moved from @ai-matrx/data/organizations, 2026-10-09) — THE active-organization ladder and the account's organization

package/dist/organizations.d.ts

@@ -1,5 +1,5 @@
 import { SupabaseClient } from '@supabase/supabase-js';
-import { A as AuthClient } from './session-DhRO4euL.js';
+import { A as AuthClient } from './session-DdQiStp6.js';
 
 /**
  * @ai-matrx/auth/organizations (moved from @ai-matrx/data/organizations, 2026-10-09) — THE active-organization ladder and the account's organization

package/dist/organizations.js

@@ -138,10 +138,43 @@ function check(door, data, error) {
   if (error) throw new SignInError(door, error.message, error.status, error.code);
   return data;
 }
+var personCache = /* @__PURE__ */ new WeakMap();
+function personEntry(client) {
+  let entry = personCache.get(client);
+  if (!entry) {
+    const fresh = { read: null, epoch: 0 };
+    entry = fresh;
+    personCache.set(client, fresh);
+    const subscribe = client.auth?.onAuthStateChange;
+    if (typeof subscribe === "function") {
+      subscribe.call(client.auth, async (event) => {
+        if (event === "SIGNED_IN" || event === "SIGNED_OUT" || event === "USER_UPDATED") invalidatePerson(client);
+      });
+    }
+  }
+  return entry;
+}
+function invalidatePerson(client) {
+  const entry = personCache.get(client);
+  if (!entry) return;
+  entry.epoch += 1;
+  entry.read = null;
+}
 async function getPerson(client) {
-  const { data, error } = await client.auth.getUser();
-  if (error && (error.name === "AuthSessionMissingError" || error.status === 401)) return null;
-  return check("getPerson", data, error).user;
+  const entry = personEntry(client);
+  if (entry.read) return entry.read;
+  const epoch = entry.epoch;
+  const read = (async () => {
+    const { data, error } = await client.auth.getUser();
+    if (error && (error.name === "AuthSessionMissingError" || error.status === 401)) return null;
+    return check("getPerson", data, error).user;
+  })();
+  entry.read = read;
+  const settle = (keep) => {
+    if (entry.epoch === epoch && entry.read === read && !keep) entry.read = null;
+  };
+  read.then((user) => settle(user !== null), () => settle(false));
+  return read;
 }
 function onSessionChange(client, cb) {
   const { data } = client.auth.onAuthStateChange(cb);
@@ -274,6 +307,7 @@ function createActiveOrganization(options) {
   const load = () => {
     if (disposed) return Promise.resolve(current);
     generation += 1;
+    invalidatePerson(client);
     inflight = run(generation).finally(() => {
       inflight = null;
     });
@@ -318,6 +352,7 @@ function createActiveOrganization(options) {
       const organization = snap.memberships.find((m) => m.id === organizationId);
       if (!organization || !snap.userId) throw new NotAMemberError(organizationId);
       generation += 1;
+      invalidatePerson(client);
       await held.write(snap.userId, organizationId);
       publish({ ...snap, status: "ready", organizationId, organization, rung: "switched", error: null });
       await writeLastActiveOrganization(client, organizationId);

package/dist/{session-DhRO4euL.d.cts → session-DdQiStp6.d.cts}

@@ -31,7 +31,17 @@ declare class SignInError extends Error {
 }
 /** The stored session (no network unless a refresh is due), or null when signed out. */
 declare function getSession(client: AuthClient): Promise<Session | null>;
-/** The signed-in person, verified by the auth server, or null when signed out. */
+/**
+ * Forget the cached person for this client, so the next {@link getPerson} asks the auth server.
+ * Sign-in, sign-out, a profile edit and an organization switch already call this; call it yourself
+ * only after changing the person outside this package.
+ */
+declare function invalidatePerson(client: AuthClient): void;
+/**
+ * The signed-in person, verified by the auth server, or null when signed out. The verified read is
+ * kept per client until the session changes (sign-in, sign-out, profile edit, organization switch),
+ * so repeated access checks cost zero extra auth-server calls; concurrent callers share one read.
+ */
 declare function getPerson(client: AuthClient): Promise<User | null>;
 /** Hear every session change (sign-in, refresh, sign-out). Returns the unsubscribe. */
 declare function onSessionChange(client: AuthClient, cb: (event: AuthChangeEvent, session: Session | null) => void): () => void;
@@ -99,4 +109,4 @@ declare const userCredentials: typeof sessionCredentials;
  */
 declare function refreshSession(client: AuthClient): Promise<Session>;
 
-export { type AuthClient as A, type SessionSourceLike as S, type UserCredentialsPort as U, SignInError as a, getSession as b, signInWithOAuth as c, signInWithPassword as d, signOut as e, userCredentials as f, getPerson as g, onSessionChange as o, refreshSession as r, sessionCredentials as s, updatePerson as u };
+export { type AuthClient as A, type SessionSourceLike as S, type UserCredentialsPort as U, SignInError as a, getSession as b, signInWithOAuth as c, signInWithPassword as d, signOut as e, userCredentials as f, getPerson as g, invalidatePerson as i, onSessionChange as o, refreshSession as r, sessionCredentials as s, updatePerson as u };

package/dist/{session-DhRO4euL.d.ts → session-DdQiStp6.d.ts}

@@ -31,7 +31,17 @@ declare class SignInError extends Error {
 }
 /** The stored session (no network unless a refresh is due), or null when signed out. */
 declare function getSession(client: AuthClient): Promise<Session | null>;
-/** The signed-in person, verified by the auth server, or null when signed out. */
+/**
+ * Forget the cached person for this client, so the next {@link getPerson} asks the auth server.
+ * Sign-in, sign-out, a profile edit and an organization switch already call this; call it yourself
+ * only after changing the person outside this package.
+ */
+declare function invalidatePerson(client: AuthClient): void;
+/**
+ * The signed-in person, verified by the auth server, or null when signed out. The verified read is
+ * kept per client until the session changes (sign-in, sign-out, profile edit, organization switch),
+ * so repeated access checks cost zero extra auth-server calls; concurrent callers share one read.
+ */
 declare function getPerson(client: AuthClient): Promise<User | null>;
 /** Hear every session change (sign-in, refresh, sign-out). Returns the unsubscribe. */
 declare function onSessionChange(client: AuthClient, cb: (event: AuthChangeEvent, session: Session | null) => void): () => void;
@@ -99,4 +109,4 @@ declare const userCredentials: typeof sessionCredentials;
  */
 declare function refreshSession(client: AuthClient): Promise<Session>;
 
-export { type AuthClient as A, type SessionSourceLike as S, type UserCredentialsPort as U, SignInError as a, getSession as b, signInWithOAuth as c, signInWithPassword as d, signOut as e, userCredentials as f, getPerson as g, onSessionChange as o, refreshSession as r, sessionCredentials as s, updatePerson as u };
+export { type AuthClient as A, type SessionSourceLike as S, type UserCredentialsPort as U, SignInError as a, getSession as b, signInWithOAuth as c, signInWithPassword as d, signOut as e, userCredentials as f, getPerson as g, invalidatePerson as i, onSessionChange as o, refreshSession as r, sessionCredentials as s, updatePerson as u };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-matrx/auth",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "AI Matrx sign-in, session and organizations for every app: sign in/out, session storage and refresh per platform (browser, Next.js, extension, desktop, Node), the current person, their organizations and favourites, the one active organization (held requests, never a list filter), and the credentials @ai-matrx/data and @ai-matrx/api read.",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -191,5 +191,5 @@
     "test": "vitest run",
     "verify:tarball": "node ./scripts/verify-tarball.mjs"
   },
-  "gitHead": "7ee2d68e156416d62a043d8f5053ff7f0b5792fc"
+  "gitHead": "9c8f9e35b1fe67f38dcc59ed4a2becb9cc7e79cf"
 }