@gusnips/react 0.9.1 → 0.9.3

package/README.md

@@ -34,9 +34,11 @@ token when you use it, so the losers of that race each invalidate the winner —
 signed out in the middle of a load that was working. Three separate codebases arrived at
 single-flight refresh independently. This is that.
 
-**A refresh that never reached the server is not a "no".** Dropping a packet tells you nothing
-about whether a session is good. So `refresh()` answers `{ token, reachedAuth }`, and only a real
-refusal signs anyone out. Before that split, a Wi-Fi blip logged people out mid-load.
+**Only auth ANSWERING is a "no".** Dropping a packet tells you nothing about whether a session is
+good, and neither does a 500 — that is auth failing, not auth answering. So `refresh()` answers
+`{ token, reachedAuth }`, and only a real refusal signs anyone out. Before that split, a Wi-Fi
+blip logged people out mid-load; without the second half, one bad minute at the auth server signs
+out everybody whose token happened to need refreshing.
 
 **A sign-out has a fail-safe timer.** Awaiting `signOut()` before redirecting covers a rejection,
 not a hang — and a hang leaves someone signed out in name only: every request 401ing, nothing
@@ -63,8 +65,9 @@ Supabase email links have two complete patterns. Keep either one, never half of
   implicit `#access_token` or a PKCE `?code`; it does not consume `token_hash`.
 
 Recovery and invite links continue to the new-password screen after the session opens. A callback
-must also tell a used or expired link apart from a request that never reached GoTrue: the first
-needs a new link, while the second can retry the same one.
+must also tell a used or expired link apart from a request that never landed — or one that landed
+and came back 5xx: the first needs a new link, and the other two can retry the same one, because
+the hash was never spent.
 
 There is also a deadline on every request, which none of the codebases this came from had. A
 request with no timeout is a spinner with no end.
@@ -183,6 +186,24 @@ const next = safeInternalPath(new URLSearchParams(location.search).get("next"))
 
 `createRequireAnonymous` already performs that check and falls back to the home path you gave it.
 
+Writing a return target down is the other direction, and it has its own hazard. A Supabase client
+with no `flowType` is on the **implicit** flow — the default — so a callback comes back as
+`#access_token=…&refresh_token=…`. A guard renders exactly when there is no session yet, which is
+that callback's own state while the client parses the fragment: point an OAuth `redirectTo` at a
+guarded route and a concatenated `pathname + search + hash` puts a refresh token into a query
+string, where it rides in `Referer`, lands in access logs and stays in history.
+
+```ts
+import { returnPathFromLocation } from "@gusnips/react";
+
+// Takes anything shaped like the current page: `window.location`, or `useLocation()`.
+const returnTo = returnPathFromLocation(window.location);
+```
+
+It keeps the page and drops only a fragment carrying a credential, because the page is the part
+worth returning to. `createRequireAuth` uses it; use it anywhere else you record where someone was
+— a dead-session redirect is the common one.
+
 ## Never dead-end anyone
 
 ```ts

package/dist/guards.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../src/guards.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAIvC;;;;;;;;;;;;;GAaG;AAEH,kDAAkD;AAClD,MAAM,WAAW,YAAY;IAC3B,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,OAAO,CAAC,GAAG,IACrB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,GAAG,CAAA;CAAE,CAAC;AAajG,MAAM,WAAW,YAAY;IAC3B,iEAAiE;IACjE,OAAO,EAAE,SAAS,CAAC;CACpB;AAED,gEAAgE;AAChE,eAAO,MAAM,iBAAiB,SAAS,CAAC;AAOxC;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,YAAY,EAC9B,UAAU,EAAE,MAAM,EAClB,EAAE,OAAO,EAAE,EAAE,YAAY,IAEG,cAAc;IAAE,QAAQ,EAAE,SAAS,CAAA;CAAE,iCAalE;AAED,oFAAoF;AACpF,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,YAAY,EAC9B,QAAQ,EAAE,MAAM,EAChB,EAAE,OAAO,EAAE,EAAE,YAAY,IAEQ,cAAc;IAAE,QAAQ,EAAE,SAAS,CAAA;CAAE,iCAUvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,YAAY,IAE1F,OAAO,CAAC,EAAE,EAAE,GAAG,KAAK,OAAO,EAC3B,UAAU,SAAS,GAAG,CAAC,MAAM,SAAS,CAAC,EACvC,SAAS,CAAC,KAAK,EAAE,OAAO,KAAK,SAAS,MAEP,cAAc;IAAE,QAAQ,EAAE,SAAS,CAAA;CAAE,iCAQvE"}
+{"version":3,"file":"guards.d.ts","sourceRoot":"","sources":["../src/guards.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC;AAIvC;;;;;;;;;;;;;GAaG;AAEH,kDAAkD;AAClD,MAAM,WAAW,YAAY;IAC3B,eAAe,EAAE,OAAO,CAAC;IACzB,SAAS,EAAE,OAAO,CAAC;CACpB;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,OAAO,CAAC,GAAG,IACrB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,GAAG,CAAA;CAAE,CAAC;AAajG,MAAM,WAAW,YAAY;IAC3B,iEAAiE;IACjE,OAAO,EAAE,SAAS,CAAC;CACpB;AAED,gEAAgE;AAChE,eAAO,MAAM,iBAAiB,SAAS,CAAC;AAOxC;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,YAAY,EAC9B,UAAU,EAAE,MAAM,EAClB,EAAE,OAAO,EAAE,EAAE,YAAY,IAEG,cAAc;IAAE,QAAQ,EAAE,SAAS,CAAA;CAAE,iCAiBlE;AAED,oFAAoF;AACpF,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,MAAM,YAAY,EAC9B,QAAQ,EAAE,MAAM,EAChB,EAAE,OAAO,EAAE,EAAE,YAAY,IAEQ,cAAc;IAAE,QAAQ,EAAE,SAAS,CAAA;CAAE,iCAUvE;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,YAAY,IAE1F,OAAO,CAAC,EAAE,EAAE,GAAG,KAAK,OAAO,EAC3B,UAAU,SAAS,GAAG,CAAC,MAAM,SAAS,CAAC,EACvC,SAAS,CAAC,KAAK,EAAE,OAAO,KAAK,SAAS,MAEP,cAAc;IAAE,QAAQ,EAAE,SAAS,CAAA;CAAE,iCAQvE"}

package/dist/guards.js

@@ -1,6 +1,6 @@
 import { Fragment as _Fragment, jsx as _jsx } from "react/jsx-runtime";
 import { Navigate, useLocation } from "react-router-dom";
-import { safeInternalPath } from "./internal-path.js";
+import { returnPathFromLocation, safeInternalPath } from "./internal-path.js";
 /** Query parameter carrying the route a sign-in interrupted. */
 export const AUTH_RETURN_PARAM = "next";
 function signInUrl(signInPath, returnTo) {
@@ -20,8 +20,12 @@ export function createRequireAuth(useSession, signInPath, { loading }) {
         if (!isAuthenticated) {
             // Query state survives a reload, an OAuth round trip and an email-link round trip. Router
             // state survives none of them, so it only looked like a remembered destination on the
-            // password path. The hash belongs too: tabs and anchored settings are real destinations.
-            const returnTo = location.pathname + location.search + location.hash;
+            // password path. The hash belongs too: tabs and anchored settings are real destinations —
+            // but not when it is the round trip itself, which is why this is not a concatenation. This
+            // guard renders exactly when there is no session yet, and that is the state an implicit-flow
+            // callback is in while its client parses the fragment: point an OAuth `redirectTo` at a
+            // guarded route and the raw hash is a refresh token, on its way into a query string.
+            const returnTo = returnPathFromLocation(location);
             return _jsx(Navigate, { to: signInUrl(signInPath, returnTo), replace: true });
         }
         return _jsx(_Fragment, { children: children });

package/dist/guards.js.map

@@ -1 +1 @@
-{"version":3,"file":"guards.js","sourceRoot":"","sources":["../src/guards.tsx"],"names":[],"mappings":";AAEA,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AA0DtD,gEAAgE;AAChE,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAExC,SAAS,SAAS,CAAC,UAAkB,EAAE,QAAgB;IACrD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACvD,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,iBAAiB,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;AACzF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAA8B,EAC9B,UAAkB,EAClB,EAAE,OAAO,EAAgB;IAEzB,OAAO,SAAS,WAAW,CAAC,EAAE,QAAQ,EAA2B;QAC/D,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,UAAU,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,IAAI,SAAS;YAAE,OAAO,4BAAG,OAAO,GAAI,CAAC;QACrC,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,0FAA0F;YAC1F,sFAAsF;YACtF,yFAAyF;YACzF,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC;YACrE,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,OAAO,SAAG,CAAC;QACnE,CAAC;QACD,OAAO,4BAAG,QAAQ,GAAI,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CACpC,UAA8B,EAC9B,QAAgB,EAChB,EAAE,OAAO,EAAgB;IAEzB,OAAO,SAAS,gBAAgB,CAAC,EAAE,QAAQ,EAA2B;QACpE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,UAAU,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,IAAI,SAAS;YAAE,OAAO,4BAAG,OAAO,GAAI,CAAC;QACrC,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAC5E,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,gBAAgB,CAAC,OAAO,CAAC,IAAI,QAAQ,EAAE,OAAO,SAAG,CAAC;QACzE,CAAC;QACD,OAAO,4BAAG,QAAQ,GAAI,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAM,KAAyB,EAAE,EAAE,OAAO,EAAgB;IAC5F,OAAO,SAAS,cAAc,CAC5B,KAA2B,EAC3B,QAAuC,EACvC,OAAsC;QAEtC,OAAO,SAAS,cAAc,CAAC,EAAE,QAAQ,EAA2B;YAClE,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC;YACtB,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,4BAAG,OAAO,GAAI,CAAC;YACtD,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO;gBAAE,OAAO,4BAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAI,CAAC;YACjE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO,4BAAG,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAI,CAAC;YAC7F,OAAO,4BAAG,QAAQ,GAAI,CAAC;QACzB,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"guards.js","sourceRoot":"","sources":["../src/guards.tsx"],"names":[],"mappings":";AAEA,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AA0D9E,gEAAgE;AAChE,MAAM,CAAC,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAExC,SAAS,SAAS,CAAC,UAAkB,EAAE,QAAgB;IACrD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IACvD,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,iBAAiB,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;AACzF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,UAA8B,EAC9B,UAAkB,EAClB,EAAE,OAAO,EAAgB;IAEzB,OAAO,SAAS,WAAW,CAAC,EAAE,QAAQ,EAA2B;QAC/D,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,UAAU,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,IAAI,SAAS;YAAE,OAAO,4BAAG,OAAO,GAAI,CAAC;QACrC,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,0FAA0F;YAC1F,sFAAsF;YACtF,0FAA0F;YAC1F,2FAA2F;YAC3F,6FAA6F;YAC7F,wFAAwF;YACxF,qFAAqF;YACrF,MAAM,QAAQ,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;YAClD,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,SAAS,CAAC,UAAU,EAAE,QAAQ,CAAC,EAAE,OAAO,SAAG,CAAC;QACnE,CAAC;QACD,OAAO,4BAAG,QAAQ,GAAI,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CACpC,UAA8B,EAC9B,QAAgB,EAChB,EAAE,OAAO,EAAgB;IAEzB,OAAO,SAAS,gBAAgB,CAAC,EAAE,QAAQ,EAA2B;QACpE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,GAAG,UAAU,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;QAC/B,IAAI,SAAS;YAAE,OAAO,4BAAG,OAAO,GAAI,CAAC;QACrC,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,OAAO,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAC5E,OAAO,KAAC,QAAQ,IAAC,EAAE,EAAE,gBAAgB,CAAC,OAAO,CAAC,IAAI,QAAQ,EAAE,OAAO,SAAG,CAAC;QACzE,CAAC;QACD,OAAO,4BAAG,QAAQ,GAAI,CAAC;IACzB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAM,KAAyB,EAAE,EAAE,OAAO,EAAgB;IAC5F,OAAO,SAAS,cAAc,CAC5B,KAA2B,EAC3B,QAAuC,EACvC,OAAsC;QAEtC,OAAO,SAAS,cAAc,CAAC,EAAE,QAAQ,EAA2B;YAClE,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC;YACtB,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,4BAAG,OAAO,GAAI,CAAC;YACtD,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO;gBAAE,OAAO,4BAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAI,CAAC;YACjE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,OAAO,4BAAG,OAAO,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAI,CAAC;YAC7F,OAAO,4BAAG,QAAQ,GAAI,CAAC;QACzB,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { cn } from "./cn.ts";
-export { safeInternalPath } from "./internal-path.ts";
+export { returnPathFromLocation, safeInternalPath, type PathParts } from "./internal-path.ts";
 export { ApiError, isAbortError, retryAfterSecs } from "./api-error.ts";
 export { createApiClient, type ApiClient, type ApiClientOptions, type RefreshResult, type RequestOptions, type SessionAdapter, } from "./api-client.ts";
 export { createSseParser, readSseStream, type SseFrame } from "./sse.ts";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EACL,eAAe,EACf,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,cAAc,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEjG,OAAO,EACL,aAAa,EACb,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,oBAAoB,EACpB,YAAY,EACZ,gBAAgB,EAChB,UAAU,GACX,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE9E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,KAAK,eAAe,EAAE,MAAM,WAAW,CAAC;AAElF,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA8BA,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,KAAK,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE9F,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EACL,eAAe,EACf,KAAK,SAAS,EACd,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,cAAc,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,KAAK,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEzE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEjG,OAAO,EACL,aAAa,EACb,KAAK,0BAA0B,EAC/B,KAAK,kBAAkB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,oBAAoB,EACpB,YAAY,EACZ,KAAK,cAAc,EACnB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,qBAAqB,EAC1B,KAAK,YAAY,EACjB,KAAK,SAAS,GACf,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,oBAAoB,EACpB,YAAY,EACZ,gBAAgB,EAChB,UAAU,GACX,MAAM,sBAAsB,CAAC;AAK9B,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE9E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAE,KAAK,eAAe,EAAE,MAAM,WAAW,CAAC;AAElF,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -28,7 +28,7 @@
 // Check that claim against `dist/`, never against this file: a type-only re-export looks
 // identical in source.
 export { cn } from "./cn.js";
-export { safeInternalPath } from "./internal-path.js";
+export { returnPathFromLocation, safeInternalPath } from "./internal-path.js";
 export { ApiError, isAbortError, retryAfterSecs } from "./api-error.js";
 export { createApiClient, } from "./api-client.js";
 export { createSseParser, readSseStream } from "./sse.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,EAAE;AACF,2CAA2C;AAC3C,EAAE;AACF,+FAA+F;AAC/F,gGAAgG;AAChG,+FAA+F;AAC/F,iGAAiG;AACjG,0BAA0B;AAC1B,EAAE;AACF,qEAAqE;AACrE,8DAA8D;AAC9D,uEAAuE;AACvE,gEAAgE;AAChE,4EAA4E;AAC5E,EAAE;AACF,2FAA2F;AAC3F,iGAAiG;AACjG,+FAA+F;AAC/F,gGAAgG;AAChG,4EAA4E;AAC5E,EAAE;AACF,2FAA2F;AAC3F,iGAAiG;AACjG,qFAAqF;AACrF,6FAA6F;AAC7F,iGAAiG;AACjG,yFAAyF;AACzF,uBAAuB;AAEvB,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EACL,eAAe,GAMhB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAiB,MAAM,UAAU,CAAC;AAEzE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAA6B,MAAM,YAAY,CAAC;AAEjG,OAAO,EACL,aAAa,GAGd,MAAM,qBAAsB,CAAC;AAC9B,OAAO,EACL,oBAAoB,EACpB,YAAY,GAQb,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,oBAAoB,EACpB,YAAY,EACZ,gBAAgB,EAChB,UAAU,GACX,MAAM,sBAAsB,CAAC;AAE9B,iGAAiG;AACjG,kGAAkG;AAClG,6FAA6F;AAC7F,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE9E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAwB,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,EAAE;AACF,2CAA2C;AAC3C,EAAE;AACF,+FAA+F;AAC/F,gGAAgG;AAChG,+FAA+F;AAC/F,iGAAiG;AACjG,0BAA0B;AAC1B,EAAE;AACF,qEAAqE;AACrE,8DAA8D;AAC9D,uEAAuE;AACvE,gEAAgE;AAChE,4EAA4E;AAC5E,EAAE;AACF,2FAA2F;AAC3F,iGAAiG;AACjG,+FAA+F;AAC/F,gGAAgG;AAChG,4EAA4E;AAC5E,EAAE;AACF,2FAA2F;AAC3F,iGAAiG;AACjG,qFAAqF;AACrF,6FAA6F;AAC7F,iGAAiG;AACjG,yFAAyF;AACzF,uBAAuB;AAEvB,OAAO,EAAE,EAAE,EAAE,MAAM,SAAS,CAAC;AAC7B,OAAO,EAAE,sBAAsB,EAAE,gBAAgB,EAAkB,MAAM,oBAAoB,CAAC;AAE9F,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACxE,OAAO,EACL,eAAe,GAMhB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAiB,MAAM,UAAU,CAAC;AAEzE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAA6B,MAAM,YAAY,CAAC;AAEjG,OAAO,EACL,aAAa,GAGd,MAAM,qBAAsB,CAAC;AAC9B,OAAO,EACL,oBAAoB,EACpB,YAAY,GAQb,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,0BAA0B,EAC1B,gBAAgB,EAChB,oBAAoB,EACpB,YAAY,EACZ,gBAAgB,EAChB,UAAU,GACX,MAAM,sBAAsB,CAAC;AAE9B,iGAAiG;AACjG,kGAAkG;AAClG,6FAA6F;AAC7F,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE9E,OAAO,EAAE,cAAc,EAAE,eAAe,EAAwB,MAAM,WAAW,CAAC"}

package/dist/internal-path.d.ts

@@ -7,4 +7,25 @@
  * Parsing against a fixed origin applies the browser's own rules rather than trying to copy them.
  */
 export declare function safeInternalPath(value: unknown): string | null;
+/** Anything shaped like the current page: `window.location` and react-router's `useLocation()`. */
+export interface PathParts {
+    pathname: string;
+    search: string;
+    hash: string;
+}
+/**
+ * Where someone is right now, written down so signing in can bring them back.
+ *
+ * The fragment is the half that is easy to get wrong, and getting it wrong leaks a credential. A
+ * Supabase client with no `flowType` uses the IMPLICIT flow, which returns the session in the
+ * fragment — `#access_token=…&refresh_token=…`. A return target is recorded in a query string, and
+ * a query string is not a fragment: it rides in `Referer`, it is written to every access log on the
+ * way, and it stays in history. So a fragment carrying a credential is dropped and the page is
+ * kept, because the page is the part worth returning to and the anchor is the part that is
+ * dangerous.
+ *
+ * Total on purpose — the caller is handing over its OWN address, which is on this origin by
+ * construction. Use `safeInternalPath` for the other direction, where someone else wrote the value.
+ */
+export declare function returnPathFromLocation({ pathname, search, hash }: PathParts): string;
 //# sourceMappingURL=internal-path.d.ts.map

package/dist/internal-path.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internal-path.d.ts","sourceRoot":"","sources":["../src/internal-path.ts"],"names":[],"mappings":"AAUA;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAU9D"}
+{"version":3,"file":"internal-path.d.ts","sourceRoot":"","sources":["../src/internal-path.ts"],"names":[],"mappings":"AAUA;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAU9D;AAeD,mGAAmG;AACnG,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,SAAS,GAAG,MAAM,CAKpF"}

package/dist/internal-path.js

@@ -28,4 +28,36 @@ export function safeInternalPath(value) {
         return null;
     }
 }
+/**
+ * The keys an OAuth or OIDC implicit response puts in the fragment that are themselves credentials
+ * (RFC 6749 §4.2.2, plus the two a provider token is passed through under). The rest of that
+ * response — `expires_in`, `token_type`, `state`, `type` — is metadata, worthless on its own.
+ */
+const CREDENTIAL_FRAGMENT_KEYS = [
+    "access_token",
+    "refresh_token",
+    "id_token",
+    "provider_token",
+    "provider_refresh_token",
+];
+/**
+ * Where someone is right now, written down so signing in can bring them back.
+ *
+ * The fragment is the half that is easy to get wrong, and getting it wrong leaks a credential. A
+ * Supabase client with no `flowType` uses the IMPLICIT flow, which returns the session in the
+ * fragment — `#access_token=…&refresh_token=…`. A return target is recorded in a query string, and
+ * a query string is not a fragment: it rides in `Referer`, it is written to every access log on the
+ * way, and it stays in history. So a fragment carrying a credential is dropped and the page is
+ * kept, because the page is the part worth returning to and the anchor is the part that is
+ * dangerous.
+ *
+ * Total on purpose — the caller is handing over its OWN address, which is on this origin by
+ * construction. Use `safeInternalPath` for the other direction, where someone else wrote the value.
+ */
+export function returnPathFromLocation({ pathname, search, hash }) {
+    const fragment = hash.startsWith("#") ? hash.slice(1) : hash;
+    const params = new URLSearchParams(fragment);
+    const carriesCredential = CREDENTIAL_FRAGMENT_KEYS.some((key) => params.has(key));
+    return `${pathname}${search}${carriesCredential ? "" : hash}`;
+}
 //# sourceMappingURL=internal-path.js.map

package/dist/internal-path.js.map

@@ -1 +1 @@
-{"version":3,"file":"internal-path.js","sourceRoot":"","sources":["../src/internal-path.ts"],"names":[],"mappings":"AAAA,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAEnD,SAAS,eAAe,CAAC,KAAa;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/F,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,eAAe;YAAE,OAAO,IAAI,CAAC;QAChD,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"internal-path.js","sourceRoot":"","sources":["../src/internal-path.ts"],"names":[],"mappings":"AAAA,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAEnD,SAAS,eAAe,CAAC,KAAa;IACpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IACjD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/F,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAC5C,IAAI,GAAG,CAAC,MAAM,KAAK,eAAe;YAAE,OAAO,IAAI,CAAC;QAChD,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,wBAAwB,GAAG;IAC/B,cAAc;IACd,eAAe;IACf,UAAU;IACV,gBAAgB;IAChB,wBAAwB;CACzB,CAAC;AASF;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAa;IAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,QAAQ,CAAC,CAAC;IAC7C,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAClF,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAChE,CAAC"}

package/dist/supabase-session.d.ts

@@ -19,9 +19,10 @@ export interface SupabaseSessionAuth {
 /**
  * Connects a Supabase auth client to {@link SessionAdapter}.
  *
- * The distinction this preserves is the one that decides whether anybody is signed out: a
- * retryable fetch error never reached GoTrue and says nothing about the session; any other auth
- * error is an answer. A thrown network error stays on the first side of that line too.
+ * The distinction this preserves is the one that decides whether anybody is signed out: only
+ * auth ANSWERING proves a session is gone. A fetch that never landed says nothing about it, and
+ * neither does a 5xx, which is auth failing rather than auth answering. A thrown network error
+ * stays on that side of the line too.
  */
 export declare function createSupabaseSessionAdapter(auth: SupabaseSessionAuth): SessionAdapter;
 export {};

package/dist/supabase-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"supabase-session.d.ts","sourceRoot":"","sources":["../src/supabase-session.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,UAAU,qBAAqB;IAC7B,IAAI,EAAE;QAAE,OAAO,EAAE;YAAE,YAAY,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,CAAC;CACpD;AAED,8FAA8F;AAC9F,MAAM,WAAW,mBAAmB;IAClC,UAAU,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC7C,cAAc,IAAI,OAAO,CAAC,qBAAqB,GAAG;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACtE,OAAO,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACxC;AAcD;;;;;;GAMG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,mBAAmB,GAAG,cAAc,CAsBtF"}
+{"version":3,"file":"supabase-session.d.ts","sourceRoot":"","sources":["../src/supabase-session.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEtD,UAAU,qBAAqB;IAC7B,IAAI,EAAE;QAAE,OAAO,EAAE;YAAE,YAAY,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAA;KAAE,CAAC;CACpD;AAED,8FAA8F;AAC9F,MAAM,WAAW,mBAAmB;IAClC,UAAU,IAAI,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC7C,cAAc,IAAI,OAAO,CAAC,qBAAqB,GAAG;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACtE,OAAO,IAAI,OAAO,CAAC;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CACxC;AAsBD;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,mBAAmB,GAAG,cAAc,CAsBtF"}

package/dist/supabase-session.js

@@ -2,6 +2,15 @@ import { isAuthError, isAuthRetryableFetchError } from "@supabase/supabase-js";
 function reachedAuth(error) {
     if (!isAuthError(error) || isAuthRetryableFetchError(error))
         return false;
+    // A 5xx is auth failing, not auth answering — and the vendor's predicate above cannot be
+    // relied on to say so, because it reads a list it owns and has already changed: at auth-js
+    // 2.91 it covered 502, 503 and 504, and at 2.108 it covers 500 through 530. Code leaning on
+    // it alone is right at whichever version happens to be installed, which is not the same as
+    // being right. Without this clause one bad minute at GoTrue signs out everybody whose token
+    // happened to need refreshing. Measured across the fleet: four backends answered 401 to
+    // their own auth provider's 500 for exactly this reason.
+    if ((error.status ?? 0) >= 500)
+        return false;
     // Newer clients name a refresh that reached GoTrue but was deliberately discarded because the
     // local session changed mid-flight. That race is a no-op, not proof that either session died.
     return error.name !== "AuthRefreshDiscardedError";
@@ -9,9 +18,10 @@ function reachedAuth(error) {
 /**
  * Connects a Supabase auth client to {@link SessionAdapter}.
  *
- * The distinction this preserves is the one that decides whether anybody is signed out: a
- * retryable fetch error never reached GoTrue and says nothing about the session; any other auth
- * error is an answer. A thrown network error stays on the first side of that line too.
+ * The distinction this preserves is the one that decides whether anybody is signed out: only
+ * auth ANSWERING proves a session is gone. A fetch that never landed says nothing about it, and
+ * neither does a 5xx, which is auth failing rather than auth answering. A thrown network error
+ * stays on that side of the line too.
  */
 export function createSupabaseSessionAdapter(auth) {
     return {

package/dist/supabase-session.js.map

@@ -1 +1 @@
-{"version":3,"file":"supabase-session.js","sourceRoot":"","sources":["../src/supabase-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,yBAAyB,EAAuB,MAAM,uBAAuB,CAAC;AAmBpG,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,yBAAyB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,8FAA8F;IAC9F,8FAA8F;IAC9F,OAAO,KAAK,CAAC,IAAI,KAAK,2BAA2B,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAyB;IACpE,OAAO;QACL,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,IAAI,CAAC;QAC5C,CAAC;QACD,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpD,OAAO;oBACL,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,IAAI;oBACzC,WAAW,EAAE,KAAK,KAAK,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC;iBAClD,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,KAAK;gBAAE,MAAM,KAAK,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"supabase-session.js","sourceRoot":"","sources":["../src/supabase-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,yBAAyB,EAAuB,MAAM,uBAAuB,CAAC;AAmBpG,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,yBAAyB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1E,yFAAyF;IACzF,2FAA2F;IAC3F,4FAA4F;IAC5F,2FAA2F;IAC3F,4FAA4F;IAC5F,wFAAwF;IACxF,yDAAyD;IACzD,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,GAAG;QAAE,OAAO,KAAK,CAAC;IAC7C,8FAA8F;IAC9F,8FAA8F;IAC9F,OAAO,KAAK,CAAC,IAAI,KAAK,2BAA2B,CAAC;AACpD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAyB;IACpE,OAAO;QACL,QAAQ,EAAE,KAAK,IAAI,EAAE;YACnB,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,IAAI,CAAC;QAC5C,CAAC;QACD,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpD,OAAO;oBACL,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,IAAI;oBACzC,WAAW,EAAE,KAAK,KAAK,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC;iBAClD,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,IAAI,EAAE;YAClB,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,KAAK;gBAAE,MAAM,KAAK,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gusnips/react",
-  "version": "0.9.1",
+  "version": "0.9.3",
   "description": "The headless runtime under a Vite + React SPA: typed fetch client with single-flight refresh, auth store, query defaults, route guards, error boundary, stale-tab recovery, i18n bootstrap.",
   "type": "module",
   "license": "MIT",

package/src/guards.test.ts

@@ -105,6 +105,21 @@ describe("createRequireAuth", () => {
     });
   });
 
+  // Point an OAuth `redirectTo` at a guarded route and this is the first render after the provider
+  // returns: no session yet, and the implicit flow's tokens still sitting in the address bar. The
+  // page is worth remembering; the fragment would be a refresh token written into a query string.
+  it("refuses to carry a callback's tokens into the sign-in URL", () => {
+    router.useLocation.mockReturnValueOnce({
+      pathname: "/dashboard",
+      search: "?tab=usage",
+      hash: "#access_token=eyJhbG.p.s&refresh_token=v1_abc&token_type=bearer",
+    });
+    expect(branch(render(guard(false)))).toEqual({
+      to: "/login?next=%2Fdashboard%3Ftab%3Dusage",
+      state: undefined,
+    });
+  });
+
   it("lets a signed-in visitor through", () => {
     expect(branch(render(guard(true)))).toBe("CONTENT");
   });

package/src/guards.tsx

@@ -1,7 +1,7 @@
 import type { UseQueryResult } from "@tanstack/react-query";
 import type { ReactNode } from "react";
 import { Navigate, useLocation } from "react-router-dom";
-import { safeInternalPath } from "./internal-path.ts";
+import { returnPathFromLocation, safeInternalPath } from "./internal-path.ts";
 
 /**
  * Route guards.
@@ -83,8 +83,12 @@ export function createRequireAuth(
     if (!isAuthenticated) {
       // Query state survives a reload, an OAuth round trip and an email-link round trip. Router
       // state survives none of them, so it only looked like a remembered destination on the
-      // password path. The hash belongs too: tabs and anchored settings are real destinations.
-      const returnTo = location.pathname + location.search + location.hash;
+      // password path. The hash belongs too: tabs and anchored settings are real destinations —
+      // but not when it is the round trip itself, which is why this is not a concatenation. This
+      // guard renders exactly when there is no session yet, and that is the state an implicit-flow
+      // callback is in while its client parses the fragment: point an OAuth `redirectTo` at a
+      // guarded route and the raw hash is a refresh token, on its way into a query string.
+      const returnTo = returnPathFromLocation(location);
       return <Navigate to={signInUrl(signInPath, returnTo)} replace />;
     }
     return <>{children}</>;

package/src/index.ts

@@ -29,7 +29,7 @@
 // identical in source.
 
 export { cn } from "./cn.ts";
-export { safeInternalPath } from "./internal-path.ts";
+export { returnPathFromLocation, safeInternalPath, type PathParts } from "./internal-path.ts";
 
 export { ApiError, isAbortError, retryAfterSecs } from "./api-error.ts";
 export {

package/src/internal-path.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, it } from "vitest";
-import { safeInternalPath } from "./internal-path.ts";
+import { returnPathFromLocation, safeInternalPath } from "./internal-path.ts";
 
 describe("safeInternalPath", () => {
   it.each([
@@ -26,3 +26,48 @@ describe("safeInternalPath", () => {
     expect(safeInternalPath(value)).toBeNull();
   });
 });
+
+describe("returnPathFromLocation", () => {
+  it("keeps the whole address, fragment included", () => {
+    expect(
+      returnPathFromLocation({
+        pathname: "/w/acme/products/api/changes",
+        search: "?feature=f1",
+        hash: "#change-8f3",
+      }),
+    ).toBe("/w/acme/products/api/changes?feature=f1#change-8f3");
+  });
+
+  it.each([
+    "access_token",
+    "refresh_token",
+    "id_token",
+    "provider_token",
+    "provider_refresh_token",
+  ])("drops a fragment carrying %s, and keeps the page", (key) => {
+    expect(
+      returnPathFromLocation({
+        pathname: "/app",
+        search: "?tab=repos",
+        hash: `#${key}=ey.J.h&expires_in=3600&token_type=bearer`,
+      }),
+    ).toBe("/app?tab=repos");
+  });
+
+  it("drops the whole implicit response, not only its credential keys", () => {
+    // Verbatim shape of what a Supabase client with no `flowType` puts back in the address bar.
+    const hash =
+      "#access_token=eyJhbG.payload.sig&expires_at=1790000000&expires_in=3600" +
+      "&provider_token=gho_x&refresh_token=v1_abc&token_type=bearer&type=magiclink";
+    expect(returnPathFromLocation({ pathname: "/app", search: "", hash })).toBe("/app");
+  });
+
+  it("keeps a fragment that only looks like parameters", () => {
+    const at = { pathname: "/docs", search: "", hash: "#tab=repos&expires_in=3600" };
+    expect(returnPathFromLocation(at)).toBe("/docs#tab=repos&expires_in=3600");
+  });
+
+  it("handles an address with no fragment at all", () => {
+    expect(returnPathFromLocation({ pathname: "/", search: "", hash: "" })).toBe("/");
+  });
+});

package/src/internal-path.ts

@@ -27,3 +27,44 @@ export function safeInternalPath(value: unknown): string | null {
     return null;
   }
 }
+
+/**
+ * The keys an OAuth or OIDC implicit response puts in the fragment that are themselves credentials
+ * (RFC 6749 §4.2.2, plus the two a provider token is passed through under). The rest of that
+ * response — `expires_in`, `token_type`, `state`, `type` — is metadata, worthless on its own.
+ */
+const CREDENTIAL_FRAGMENT_KEYS = [
+  "access_token",
+  "refresh_token",
+  "id_token",
+  "provider_token",
+  "provider_refresh_token",
+];
+
+/** Anything shaped like the current page: `window.location` and react-router's `useLocation()`. */
+export interface PathParts {
+  pathname: string;
+  search: string;
+  hash: string;
+}
+
+/**
+ * Where someone is right now, written down so signing in can bring them back.
+ *
+ * The fragment is the half that is easy to get wrong, and getting it wrong leaks a credential. A
+ * Supabase client with no `flowType` uses the IMPLICIT flow, which returns the session in the
+ * fragment — `#access_token=…&refresh_token=…`. A return target is recorded in a query string, and
+ * a query string is not a fragment: it rides in `Referer`, it is written to every access log on the
+ * way, and it stays in history. So a fragment carrying a credential is dropped and the page is
+ * kept, because the page is the part worth returning to and the anchor is the part that is
+ * dangerous.
+ *
+ * Total on purpose — the caller is handing over its OWN address, which is on this origin by
+ * construction. Use `safeInternalPath` for the other direction, where someone else wrote the value.
+ */
+export function returnPathFromLocation({ pathname, search, hash }: PathParts): string {
+  const fragment = hash.startsWith("#") ? hash.slice(1) : hash;
+  const params = new URLSearchParams(fragment);
+  const carriesCredential = CREDENTIAL_FRAGMENT_KEYS.some((key) => params.has(key));
+  return `${pathname}${search}${carriesCredential ? "" : hash}`;
+}

package/src/supabase-session.test.ts

@@ -67,6 +67,20 @@ describe("createSupabaseSessionAdapter", () => {
     await expect(thrown.refresh()).resolves.toEqual({ token: null, reachedAuth: true });
   });
 
+  it("keeps the session when auth answers with a failure of its own", async () => {
+    // `isAuthRetryableFetchError` says false for this one — it is an API error, not a fetch
+    // failure — so what holds the session is the status clause beside it. A 5xx is auth
+    // failing, never auth answering, and reading it as an answer signs the person out.
+    const outage = new AuthApiError("Internal Server Error", 500, undefined);
+    const adapter = createSupabaseSessionAdapter(
+      auth({
+        refreshSession: async () => ({ data: { session: null }, error: outage }),
+      }),
+    );
+
+    await expect(adapter.refresh()).resolves.toEqual({ token: null, reachedAuth: false });
+  });
+
   it("does not kill a session whose rotated refresh was discarded after a local race", async () => {
     const adapter = createSupabaseSessionAdapter(
       auth({

package/src/supabase-session.ts

@@ -19,6 +19,14 @@ type _SupabaseAuthFitsAdapter = Satisfied<
 
 function reachedAuth(error: unknown): boolean {
   if (!isAuthError(error) || isAuthRetryableFetchError(error)) return false;
+  // A 5xx is auth failing, not auth answering — and the vendor's predicate above cannot be
+  // relied on to say so, because it reads a list it owns and has already changed: at auth-js
+  // 2.91 it covered 502, 503 and 504, and at 2.108 it covers 500 through 530. Code leaning on
+  // it alone is right at whichever version happens to be installed, which is not the same as
+  // being right. Without this clause one bad minute at GoTrue signs out everybody whose token
+  // happened to need refreshing. Measured across the fleet: four backends answered 401 to
+  // their own auth provider's 500 for exactly this reason.
+  if ((error.status ?? 0) >= 500) return false;
   // Newer clients name a refresh that reached GoTrue but was deliberately discarded because the
   // local session changed mid-flight. That race is a no-op, not proof that either session died.
   return error.name !== "AuthRefreshDiscardedError";
@@ -27,9 +35,10 @@ function reachedAuth(error: unknown): boolean {
 /**
  * Connects a Supabase auth client to {@link SessionAdapter}.
  *
- * The distinction this preserves is the one that decides whether anybody is signed out: a
- * retryable fetch error never reached GoTrue and says nothing about the session; any other auth
- * error is an answer. A thrown network error stays on the first side of that line too.
+ * The distinction this preserves is the one that decides whether anybody is signed out: only
+ * auth ANSWERING proves a session is gone. A fetch that never landed says nothing about it, and
+ * neither does a 5xx, which is auth failing rather than auth answering. A thrown network error
+ * stays on that side of the line too.
  */
 export function createSupabaseSessionAdapter(auth: SupabaseSessionAuth): SessionAdapter {
   return {