@ai-matrx/auth 0.2.0 → 0.2.2

package/dist/index.cjs

@@ -22,25 +22,32 @@ var src_exports = {};
 __export(src_exports, {
   PROJECT_SIGNING_KEYS: () => PROJECT_SIGNING_KEYS,
   PROJECT_SIGNING_KEY_AUTHORITIES: () => PROJECT_SIGNING_KEY_AUTHORITIES,
+  SESSION_ATTACH_BUDGET_MS: () => SESSION_ATTACH_BUDGET_MS,
+  SESSION_RECOVERY_BUDGET_MS: () => SESSION_RECOVERY_BUDGET_MS,
   SecretKeyRefusedError: () => SecretKeyRefusedError,
   SignInError: () => SignInError,
   StorageUnavailableError: () => StorageUnavailableError,
+  WAIT_COOLDOWN_MS: () => WAIT_COOLDOWN_MS,
   accountFlagsFor: () => accountFlagsFor,
   browserStorage: () => browserStorage,
   confirmUnverifiableSession: () => confirmUnverifiableSession,
   createAuthClient: () => createAuthClient,
   createClaimsCache: () => createClaimsCache,
+  createSessionBarrier: () => createSessionBarrier,
   extensionStorage: () => extensionStorage,
   getClaimsUser: () => getClaimsUser,
   getPerson: () => getPerson,
   getSession: () => getSession,
+  heldOrganizationInStorage: () => heldOrganizationInStorage,
   invalidatePerson: () => invalidatePerson,
   isAuthTransportFailure: () => isAuthTransportFailure,
+  isSessionRefusal: () => isSessionRefusal,
   isSignedOutError: () => isSignedOutError,
   isUnverifiableTokenError: () => isUnverifiableTokenError,
   isUnverifiableTokenRefusal: () => isUnverifiableTokenRefusal,
   keyValueStorage: () => keyValueStorage,
   memoryStorage: () => memoryStorage,
+  oauthAuthClient: () => oauthAuthClient,
   onSessionChange: () => onSessionChange,
   pinnedSigningKeysFor: () => pinnedSigningKeysFor,
   refreshSession: () => refreshSession,
@@ -50,10 +57,375 @@ __export(src_exports, {
   signOut: () => signOut,
   updatePerson: () => updatePerson,
   userCredentials: () => userCredentials,
-  userFromClaims: () => userFromClaims
+  userFromClaims: () => userFromClaims,
+  withOAuthSession: () => withOAuthSession
 });
 module.exports = __toCommonJS(src_exports);
 
+// src/claims.ts
+var import_supabase_js = require("@supabase/supabase-js");
+async function getClaimsUser(client, jwt, options) {
+  const { data, error } = options ? await client.auth.getClaims(jwt, options) : await client.auth.getClaims(jwt);
+  if (error) {
+    if (isSignedOutError(error)) return { data: { user: null }, error: null };
+    return { data: { user: null }, error };
+  }
+  if (!data?.claims) return { data: { user: null }, error: null };
+  const user = userFromClaims(data.claims);
+  if (!user) {
+    return {
+      data: { user: null },
+      error: new import_supabase_js.AuthError("Verified token carries no `sub` claim", 401, "bad_jwt")
+    };
+  }
+  return { data: { user }, error: null };
+}
+var BUDGET_EXHAUSTED_STATUS = 408;
+var BUDGET_EXHAUSTED_CODE = "auth_budget_exhausted";
+function isAuthTransportFailure(error) {
+  if (!error || typeof error !== "object") return false;
+  const name = String(error.name ?? "");
+  if (name === "AuthRetryableFetchError" || name === "TimeoutError" || name === "AbortError") return true;
+  const status = error.status;
+  if (status === 0 || status === 504 || status === 503) return true;
+  return status === BUDGET_EXHAUSTED_STATUS || error.code === BUDGET_EXHAUSTED_CODE;
+}
+function isSignedOutError(error) {
+  return error instanceof import_supabase_js.AuthSessionMissingError || error.name === "AuthSessionMissingError" || error.code === "session_not_found";
+}
+function userFromClaims(claims) {
+  if (!claims || typeof claims.sub !== "string") return null;
+  return {
+    ...claims,
+    id: claims.sub,
+    app_metadata: claims.app_metadata ?? {},
+    user_metadata: claims.user_metadata ?? {}
+  };
+}
+function accountFlagsFor(claims) {
+  if (!claims) return { isGuest: false, hasAccount: false };
+  const isGuest = claims.is_anonymous === true;
+  return { isGuest, hasAccount: !isGuest };
+}
+var PROJECT_SIGNING_KEY_AUTHORITIES = [
+  "db.matrxserver.com",
+  "brsgrqvjdzwihsvnfqkf.supabase.co"
+];
+var PROJECT_SIGNING_KEYS = [
+  {
+    alg: "ES256",
+    crv: "P-256",
+    ext: true,
+    key_ops: ["verify"],
+    kid: "a00aed0b-202c-483a-91ff-fc74719a3bb2",
+    kty: "EC",
+    use: "sig",
+    x: "guqOsgjJqGVU6g_K0iIXKrzixlkeXKOqkPUQCconp6U",
+    y: "39zQtkzlfQuPf_MtIhYmMdxNQpIR2Pkl11AToywaslY"
+  }
+];
+function pinnedSigningKeysFor(supabaseUrl) {
+  if (!supabaseUrl) return [];
+  let host;
+  try {
+    host = new URL(supabaseUrl).host.toLowerCase();
+  } catch {
+    return [];
+  }
+  return PROJECT_SIGNING_KEY_AUTHORITIES.includes(host) ? PROJECT_SIGNING_KEYS : [];
+}
+function isUnverifiableTokenRefusal(result) {
+  if (result.status !== 401) return false;
+  if (result.error?.code !== "PGRST301") return false;
+  return !/expired/i.test(result.error?.message ?? "");
+}
+function isUnverifiableTokenError(error) {
+  if (!error) return false;
+  const name = String(error.name ?? "");
+  if (name === "AuthRetryableFetchError" || name === "TimeoutError" || name === "AbortError") return false;
+  if (name === "AuthSessionMissingError" || error.code === "session_not_found") return false;
+  const status = error.status;
+  if (status === 0 || status === 408 || status === 503 || status === 504) return false;
+  if (/expired/i.test(error.message ?? "")) return false;
+  return error.code === "bad_jwt" || name === "AuthInvalidJwtError";
+}
+async function confirmUnverifiableSession(auth, supabaseUrl) {
+  try {
+    const { error } = await auth.getClaims(void 0, { jwks: { keys: pinnedSigningKeysFor(supabaseUrl) } });
+    return isUnverifiableTokenError(error);
+  } catch {
+    return false;
+  }
+}
+function createClaimsCache(client, options) {
+  const ttl = options.ttlMs ?? 2e3;
+  let cached = null;
+  let inflight = null;
+  let listening = false;
+  return () => {
+    if (!listening) {
+      listening = true;
+      client.auth.onAuthStateChange((event) => {
+        if (event === "SIGNED_OUT" || event === "SIGNED_IN" || event === "TOKEN_REFRESHED" || event === "USER_UPDATED") {
+          cached = null;
+        }
+      });
+    }
+    if (cached && cached.expiresAt > Date.now()) return Promise.resolve(cached.value);
+    if (inflight) return inflight;
+    inflight = getClaimsUser(client, void 0, { jwks: { keys: pinnedSigningKeysFor(options.supabaseUrl) } }).then((result) => {
+      if (isUnverifiableTokenError(result.error)) options.onUnverifiable?.();
+      cached = { value: result, expiresAt: Date.now() + ttl };
+      return result;
+    }).finally(() => {
+      inflight = null;
+    });
+    return inflight;
+  };
+}
+
+// src/session-barrier.ts
+var SESSION_ATTACH_BUDGET_MS = 3e3;
+var SESSION_RECOVERY_BUDGET_MS = 5e3;
+var WAIT_COOLDOWN_MS = 3e4;
+function isSessionRefusal(result) {
+  const code = result.error?.code;
+  if (!code) return false;
+  if (result.status !== 401) return false;
+  return code === "42501" || code === "PGRST301" || code === "28000";
+}
+function isAuthLike(value) {
+  if (!value || typeof value !== "object") return false;
+  const candidate = value;
+  return typeof candidate.getSession === "function" && typeof candidate.onAuthStateChange === "function";
+}
+function readStorageKey(auth) {
+  if (!auth || typeof auth !== "object" || !("storageKey" in auth)) return null;
+  const key = auth.storageKey;
+  return typeof key === "string" && key.length > 0 ? key : null;
+}
+function defaultReadCookie() {
+  if (typeof document === "undefined") return null;
+  try {
+    return document.cookie;
+  } catch {
+    return null;
+  }
+}
+function createSessionBarrier(options) {
+  const attachBudget = options.attachBudgetMs ?? SESSION_ATTACH_BUDGET_MS;
+  const recoveryBudget = options.recoveryBudgetMs ?? SESSION_RECOVERY_BUDGET_MS;
+  const cooldown = options.waitCooldownMs ?? WAIT_COOLDOWN_MS;
+  const readCookie = options.readCookie ?? defaultReadCookie;
+  const isBrowser = options.isBrowser ?? (() => typeof window !== "undefined");
+  const now = options.now ?? (() => Date.now());
+  const warn = options.warn ?? ((m) => console.warn(m));
+  let boundAuth = null;
+  let storageKey = null;
+  let sessionPresent = null;
+  let waitSuppressedUntil = 0;
+  const waiting = /* @__PURE__ */ new Set();
+  const doorName = (ctx) => ctx.relation ? `${ctx.schema ?? "public"}.${ctx.relation}` : "(unknown)";
+  function drain() {
+    if (waiting.size === 0) return;
+    const pending = [...waiting];
+    waiting.clear();
+    for (const listener of pending) {
+      try {
+        listener();
+      } catch {
+      }
+    }
+  }
+  function markSession(present) {
+    const had = sessionPresent;
+    sessionPresent = present;
+    if (present === true && had !== true) drain();
+  }
+  function authCookiePresent() {
+    if (!storageKey) return null;
+    const cookie = readCookie();
+    if (cookie === null) return null;
+    if (!cookie) return false;
+    for (const pair of cookie.split(";")) {
+      const name = pair.slice(0, pair.indexOf("=")).trim() || pair.trim();
+      if (name === storageKey) return true;
+      if (name.startsWith(`${storageKey}.`)) {
+        const chunk = name.slice(storageKey.length + 1);
+        if (/^(0|[1-9][0-9]*)$/.test(chunk)) return true;
+      }
+    }
+    return false;
+  }
+  function sessionStateNow() {
+    if (sessionPresent === true) return "attached";
+    const cookie = authCookiePresent();
+    if (cookie === true) return "expected";
+    if (cookie === false && sessionPresent === false) return "absent";
+    return "unknown";
+  }
+  function sessionStateMarker() {
+    switch (sessionStateNow()) {
+      case "attached":
+        return "attached";
+      case "expected":
+        return "pre_attach";
+      case "absent":
+        return "signed_out";
+      default:
+        return "unknown";
+    }
+  }
+  function whenSessionAttached(listener) {
+    if (sessionPresent === true) {
+      try {
+        listener();
+      } catch {
+      }
+      return () => {
+      };
+    }
+    waiting.add(listener);
+    return () => {
+      waiting.delete(listener);
+    };
+  }
+  function waitForAttach(budgetMs) {
+    if (sessionPresent === true) return Promise.resolve(true);
+    return new Promise((resolve) => {
+      let settled = false;
+      const done = (attached) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        unsubscribe();
+        resolve(attached);
+      };
+      const unsubscribe = whenSessionAttached(() => done(true));
+      const timer = setTimeout(() => done(false), budgetMs);
+    });
+  }
+  async function probeSession() {
+    if (!boundAuth) return false;
+    try {
+      const { data, error } = await boundAuth.getSession();
+      const token = Boolean(data?.session?.access_token) && !error;
+      if (token) markSession(true);
+      return token;
+    } catch {
+      return false;
+    }
+  }
+  function announceRecovered(ctx) {
+    const door = doorName(ctx);
+    warn(
+      `[sessionBarrier] ${door} was refused because the request carried no session (42501/401). The session re-resolved and the retry was served. This firing means a real session-availability bug got past the proactive wait \u2014 it is not routine.`
+    );
+    options.report({
+      code: "SESSION_BARRIER_RECOVERED",
+      schema: ctx.schema,
+      relation: ctx.relation,
+      message: `${door} was refused for having no session, the session re-resolved, and the read was retried once and served. Nothing was lost; the race that caused it is DD-237.`,
+      status: 401,
+      sessionState: "attached",
+      durable: false
+    });
+  }
+  function announceUnrecovered(ctx, why) {
+    const door = doorName(ctx);
+    options.report({
+      code: "SESSION_BARRIER_UNRECOVERED",
+      schema: ctx.schema,
+      relation: ctx.relation,
+      message: why === "refused_again" ? `${door} was refused for having no session, the session re-resolved, and the retry was refused again. The read was NOT served and its data is missing \u2014 sign in again to repair it.` : `${door} was refused for having no session and the session did not come back within ${recoveryBudget} ms. The auth cookie is still in this browser, so the session is lapsed rather than absent \u2014 sign in again to repair it. The read was NOT retried and its data is missing.`,
+      status: 401,
+      sessionState: sessionStateMarker(),
+      durable: true
+    });
+  }
+  return {
+    install(client) {
+      if (!isBrowser()) return;
+      if (boundAuth) return;
+      if (!client || typeof client !== "object") return;
+      const auth = client.auth;
+      if (!isAuthLike(auth)) return;
+      boundAuth = auth;
+      storageKey = readStorageKey(auth);
+      options.setSessionStateProbe?.(() => sessionStateMarker());
+      try {
+        auth.onAuthStateChange((_event, session) => {
+          markSession(Boolean(session));
+        });
+      } catch {
+      }
+    },
+    reset() {
+      options.setSessionStateProbe?.(null);
+      waiting.clear();
+      boundAuth = null;
+      storageKey = null;
+      sessionPresent = null;
+      waitSuppressedUntil = 0;
+    },
+    announceSession: markSession,
+    authCookiePresent,
+    sessionStateNow,
+    sessionStateMarker,
+    hasAttachedSession: () => sessionPresent === true,
+    whenSessionAttached,
+    canSendImmediately(ctx) {
+      if (!isBrowser()) return true;
+      if (sessionPresent === true) return true;
+      if (options.bypassesSessionWait?.(ctx.relation)) return true;
+      if (now() < waitSuppressedUntil) return true;
+      return authCookiePresent() !== true;
+    },
+    async awaitSessionBeforeSend() {
+      if (await probeSession()) return;
+      if (await waitForAttach(attachBudget)) return;
+      waitSuppressedUntil = now() + cooldown;
+    },
+    isSessionRefusal,
+    shouldRecoverSession(ctx) {
+      if (!isBrowser()) return false;
+      if (options.isAnonymousByDesign?.(ctx.schema, ctx.relation)) return false;
+      return authCookiePresent() === true;
+    },
+    async endSessionIfUnverifiable(ctx, result) {
+      if (!isUnverifiableTokenRefusal(result)) return false;
+      const auth = boundAuth;
+      if (!auth?.getClaims || !auth.signOut || !options.endUnverifiable) return false;
+      if (!await confirmUnverifiableSession({ getClaims: auth.getClaims.bind(auth) }, options.supabaseUrl)) {
+        return false;
+      }
+      markSession(false);
+      await options.endUnverifiable(
+        { signOut: auth.signOut.bind(auth) },
+        { door: doorName(ctx), via: "postgrest" }
+      );
+      return true;
+    },
+    async recoverSessionForRetry(ctx) {
+      if (sessionPresent === true) markSession(false);
+      let recovered = await probeSession();
+      if (!recovered && now() >= waitSuppressedUntil) {
+        recovered = await waitForAttach(recoveryBudget);
+        if (!recovered) waitSuppressedUntil = now() + cooldown;
+      }
+      if (!recovered) announceUnrecovered(ctx, "no_session");
+      return recovered;
+    },
+    reportSessionRetryOutcome(ctx, retried) {
+      if (isSessionRefusal(retried)) {
+        announceUnrecovered(ctx, "refused_again");
+        return;
+      }
+      announceRecovered(ctx);
+    }
+  };
+}
+
 // src/session.ts
 var SignInError = class extends Error {
   door;
@@ -220,7 +592,7 @@ function keyValueStorage(store) {
 }
 
 // src/client.ts
-var import_supabase_js = require("@supabase/supabase-js");
+var import_supabase_js2 = require("@supabase/supabase-js");
 var SecretKeyRefusedError = class extends Error {
   constructor() {
     super("createAuthClient: a secret (service-role) key signs in nobody \u2014 pass the publishable key");
@@ -234,127 +606,157 @@ function createAuthClient(options) {
   if (options.storage) auth["storage"] = options.storage;
   if (options.storageKey) auth["storageKey"] = options.storageKey;
   if (options.detectSessionInUrl !== void 0) auth["detectSessionInUrl"] = options.detectSessionInUrl;
-  return (0, import_supabase_js.createClient)(options.url, options.key, { auth });
+  return (0, import_supabase_js2.createClient)(options.url, options.key, { auth });
 }
 
-// src/claims.ts
-var import_supabase_js2 = require("@supabase/supabase-js");
-async function getClaimsUser(client, jwt, options) {
-  const { data, error } = options ? await client.auth.getClaims(jwt, options) : await client.auth.getClaims(jwt);
-  if (error) {
-    if (isSignedOutError(error)) return { data: { user: null }, error: null };
-    return { data: { user: null }, error };
-  }
-  if (!data?.claims) return { data: { user: null }, error: null };
-  const user = userFromClaims(data.claims);
-  if (!user) {
-    return {
-      data: { user: null },
-      error: new import_supabase_js2.AuthError("Verified token carries no `sub` claim", 401, "bad_jwt")
-    };
+// src/matrx-oauth.ts
+var MatrxOAuthError = class extends Error {
+  code;
+  constructor(code, message) {
+    super(message);
+    this.name = "MatrxOAuthError";
+    this.code = code;
   }
-  return { data: { user }, error: null };
-}
-var BUDGET_EXHAUSTED_STATUS = 408;
-var BUDGET_EXHAUSTED_CODE = "auth_budget_exhausted";
-function isAuthTransportFailure(error) {
-  if (!error || typeof error !== "object") return false;
-  const name = String(error.name ?? "");
-  if (name === "AuthRetryableFetchError" || name === "TimeoutError" || name === "AbortError") return true;
-  const status = error.status;
-  if (status === 0 || status === 504 || status === 503) return true;
-  return status === BUDGET_EXHAUSTED_STATUS || error.code === BUDGET_EXHAUSTED_CODE;
-}
-function isSignedOutError(error) {
-  return error instanceof import_supabase_js2.AuthSessionMissingError || error.name === "AuthSessionMissingError" || error.code === "session_not_found";
-}
-function userFromClaims(claims) {
-  if (!claims || typeof claims.sub !== "string") return null;
-  return {
-    ...claims,
-    id: claims.sub,
-    app_metadata: claims.app_metadata ?? {},
-    user_metadata: claims.user_metadata ?? {}
-  };
-}
-function accountFlagsFor(claims) {
-  if (!claims) return { isGuest: false, hasAccount: false };
-  const isGuest = claims.is_anonymous === true;
-  return { isGuest, hasAccount: !isGuest };
+};
+function base64UrlDecodeToString(input) {
+  const b64 = input.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = b64 + "=".repeat((4 - b64.length % 4) % 4);
+  const bin = atob(padded);
+  const bytes = new Uint8Array(bin.length);
+  for (let i = 0; i < bin.length; i++) bytes[i] = bin.charCodeAt(i);
+  return new TextDecoder().decode(bytes);
 }
-var PROJECT_SIGNING_KEY_AUTHORITIES = [
-  "db.matrxserver.com",
-  "brsgrqvjdzwihsvnfqkf.supabase.co"
-];
-var PROJECT_SIGNING_KEYS = [
-  {
-    alg: "ES256",
-    crv: "P-256",
-    ext: true,
-    key_ops: ["verify"],
-    kid: "a00aed0b-202c-483a-91ff-fc74719a3bb2",
-    kty: "EC",
-    use: "sig",
-    x: "guqOsgjJqGVU6g_K0iIXKrzixlkeXKOqkPUQCconp6U",
-    y: "39zQtkzlfQuPf_MtIhYmMdxNQpIR2Pkl11AToywaslY"
-  }
-];
-function pinnedSigningKeysFor(supabaseUrl) {
-  if (!supabaseUrl) return [];
-  let host;
+function personIdFromAccessToken(token) {
+  const part = token.split(".")[1];
+  if (!part) throw new MatrxOAuthError("invalid_token", "the access token is not a JWT");
+  let payload;
   try {
-    host = new URL(supabaseUrl).host.toLowerCase();
+    payload = JSON.parse(base64UrlDecodeToString(part));
   } catch {
-    return [];
+    throw new MatrxOAuthError("invalid_token", "the access token payload is unreadable");
   }
-  return PROJECT_SIGNING_KEY_AUTHORITIES.includes(host) ? PROJECT_SIGNING_KEYS : [];
-}
-function isUnverifiableTokenRefusal(result) {
-  if (result.status !== 401) return false;
-  if (result.error?.code !== "PGRST301") return false;
-  return !/expired/i.test(result.error?.message ?? "");
+  if (typeof payload.sub !== "string" || payload.sub.length === 0) {
+    throw new MatrxOAuthError("invalid_token", "the access token has no subject");
+  }
+  return {
+    personId: payload.sub,
+    email: typeof payload.email === "string" && payload.email.length > 0 ? payload.email : null,
+    expiresAtMs: typeof payload.exp === "number" ? payload.exp * 1e3 : null
+  };
 }
-function isUnverifiableTokenError(error) {
-  if (!error) return false;
-  const name = String(error.name ?? "");
-  if (name === "AuthRetryableFetchError" || name === "TimeoutError" || name === "AbortError") return false;
-  if (name === "AuthSessionMissingError" || error.code === "session_not_found") return false;
-  const status = error.status;
-  if (status === 0 || status === 408 || status === 503 || status === 504) return false;
-  if (/expired/i.test(error.message ?? "")) return false;
-  return error.code === "bad_jwt" || name === "AuthInvalidJwtError";
+
+// src/oauth-session.ts
+var NOT_SUPPORTED = (what) => ({
+  data: { user: null, session: null },
+  error: { name: "AuthApiError", message: `${what} is not available on a "Sign in with AI Matrx" session`, status: 400 }
+});
+function userFromToken(accessToken) {
+  const claims = personIdFromAccessToken(accessToken);
+  return {
+    id: claims.personId,
+    aud: "authenticated",
+    role: "authenticated",
+    email: claims.email ?? void 0,
+    app_metadata: {},
+    user_metadata: {},
+    created_at: ""
+  };
 }
-async function confirmUnverifiableSession(auth, supabaseUrl) {
-  try {
-    const { error } = await auth.getClaims(void 0, { jwks: { keys: pinnedSigningKeysFor(supabaseUrl) } });
-    return isUnverifiableTokenError(error);
-  } catch {
-    return false;
-  }
+async function toSession(s, readUser) {
+  const user = readUser ? await readUser(s.accessToken) : userFromToken(s.accessToken);
+  if (!user) return null;
+  return {
+    access_token: s.accessToken,
+    refresh_token: "",
+    token_type: "bearer",
+    expires_at: Math.floor(s.expiresAtMs / 1e3),
+    expires_in: Math.max(0, Math.floor((s.expiresAtMs - Date.now()) / 1e3)),
+    user
+  };
 }
-function createClaimsCache(client, options) {
-  const ttl = options.ttlMs ?? 2e3;
-  let cached = null;
-  let inflight = null;
-  let listening = false;
-  return () => {
-    if (!listening) {
-      listening = true;
-      client.auth.onAuthStateChange((event) => {
-        if (event === "SIGNED_OUT" || event === "SIGNED_IN" || event === "TOKEN_REFRESHED" || event === "USER_UPDATED") {
-          cached = null;
-        }
+function oauthAuthClient(oauth, options = {}) {
+  const read = async () => {
+    const stored = await oauth.getSession();
+    return stored ? toSession(stored, options.readUser) : null;
+  };
+  const auth = {
+    async getSession() {
+      try {
+        return { data: { session: await read() }, error: null };
+      } catch (e) {
+        return { data: { session: null }, error: { name: "AuthUnknownError", message: e.message } };
+      }
+    },
+    async getUser() {
+      const stored = await oauth.getSession();
+      if (!stored) return { data: { user: null }, error: { name: "AuthSessionMissingError", message: "Auth session missing!", status: 400 } };
+      try {
+        const user = options.readUser ? await options.readUser(stored.accessToken) : userFromToken(stored.accessToken);
+        return { data: { user }, error: null };
+      } catch (e) {
+        return { data: { user: null }, error: { name: "AuthUnknownError", message: e.message } };
+      }
+    },
+    async refreshSession() {
+      try {
+        const token = await oauth.refresh();
+        const session = token ? await read() : null;
+        return { data: { session, user: session?.user ?? null }, error: null };
+      } catch (e) {
+        return { data: { session: null, user: null }, error: { name: "AuthRetryableFetchError", message: e.message, status: 0 } };
+      }
+    },
+    async signOut() {
+      await oauth.signOut();
+      return { error: null };
+    },
+    onAuthStateChange(callback) {
+      const deliver = (event, stored) => {
+        void (stored ? toSession(stored, options.readUser) : Promise.resolve(null)).then(
+          (session) => void callback(event, session),
+          () => void callback(event, null)
+        );
+      };
+      const stop = oauth.onChange((e) => {
+        if (e.type === "signed_out") deliver("SIGNED_OUT", null);
+        else deliver(e.type === "signed_in" ? "SIGNED_IN" : "TOKEN_REFRESHED", e.session);
       });
+      void oauth.getSession().then((stored) => deliver("INITIAL_SESSION", stored), () => deliver("INITIAL_SESSION", null));
+      return { data: { subscription: { id: "oauth", callback, unsubscribe: stop } } };
+    },
+    signInWithPassword: async () => NOT_SUPPORTED("Password sign-in"),
+    signInWithOAuth: async () => NOT_SUPPORTED("Provider sign-in"),
+    updateUser: async () => NOT_SUPPORTED("Editing the person")
+  };
+  return { auth };
+}
+function withOAuthSession(db, oauth, options = {}) {
+  const authClient = oauthAuthClient(oauth, options);
+  return new Proxy(db, {
+    get(target, prop) {
+      if (prop === "auth") return authClient.auth;
+      const value = Reflect.get(target, prop, target);
+      return typeof value === "function" ? value.bind(target) : value;
+    }
+  });
+}
+function heldOrganizationInStorage(storage, key = "ai-matrx.auth.active-organization") {
+  return {
+    async read(userId) {
+      try {
+        const raw = await storage.getItem(key);
+        if (!raw) return null;
+        const parsed = JSON.parse(raw);
+        return parsed.userId === userId && typeof parsed.organizationId === "string" ? parsed.organizationId : null;
+      } catch {
+        return null;
+      }
+    },
+    async write(userId, organizationId) {
+      await storage.setItem(key, JSON.stringify({ userId, organizationId }));
+    },
+    async clear() {
+      await storage.removeItem(key);
     }
-    if (cached && cached.expiresAt > Date.now()) return Promise.resolve(cached.value);
-    if (inflight) return inflight;
-    inflight = getClaimsUser(client, void 0, { jwks: { keys: pinnedSigningKeysFor(options.supabaseUrl) } }).then((result) => {
-      if (isUnverifiableTokenError(result.error)) options.onUnverifiable?.();
-      cached = { value: result, expiresAt: Date.now() + ttl };
-      return result;
-    }).finally(() => {
-      inflight = null;
-    });
-    return inflight;
   };
 }