@holo-js/auth-clerk 0.3.16 → 0.3.17

package/dist/index.mjs

@@ -58,7 +58,6 @@ function normalizeClerkRequest(input) {
 // src/index.ts
 var CLERK_RUNTIME_STATE_KEY = "__holoJsAuthClerkRuntime";
 var clerkDefaultProviderRuntimeCache = /* @__PURE__ */ new Map();
-var clerkIdentitySyncLocks = /* @__PURE__ */ new Map();
 var AUTH_PROVIDER_MARKER = /* @__PURE__ */ Symbol.for("holo-js.auth.provider");
 function getRuntimeState() {
   const runtimeGlobal = globalThis;
@@ -345,19 +344,6 @@ function resolveGuardAndProvider(provider) {
     adapter
   };
 }
-function requireUserId(adapter, user, message) {
-  const userId = adapter.getId(user);
-  if (typeof userId !== "string" && typeof userId !== "number") {
-    throw new Error(message);
-  }
-  return userId;
-}
-function requireUserRecord(user, message) {
-  if (!user || typeof user !== "object") {
-    throw new Error(message);
-  }
-  return user;
-}
 function createClerkSessionPayload(authenticated, session) {
   const user = authenticated.user;
   return Object.freeze({
@@ -485,56 +471,6 @@ function normalizeHostedProfile(profile) {
     raw: profile.raw
   });
 }
-async function findUserByEmail(adapter, email) {
-  const user = await adapter.findByCredentials({ email: email.trim() });
-  return user ? requireUserRecord(user, "[@holo-js/auth-clerk] Auth provider lookups must return object users.") : null;
-}
-async function updateLocalUser(adapter, user, input) {
-  const current = user;
-  const changed = Object.entries(input).some(([key, value]) => {
-    if (key === "email_verified_at") {
-      return value instanceof Date && !current.email_verified_at;
-    }
-    return !Object.is(value, user[key]);
-  });
-  if (!changed) {
-    return { user, changed: false };
-  }
-  if (adapter.update) {
-    return {
-      user: requireUserRecord(
-        await adapter.update(user, input),
-        "[@holo-js/auth-clerk] Auth provider updates must return object users."
-      ),
-      changed: true
-    };
-  }
-  throw new Error(
-    "[@holo-js/auth-clerk] Auth provider adapters must implement update() to persist profile changes."
-  );
-}
-async function ensureNoUnexpectedEmailCollision(adapter, providerName, profile, currentUserId) {
-  const resolvedEmail = resolvePrimaryEmail(profile).email;
-  if (!resolvedEmail) {
-    return;
-  }
-  const matched = await findUserByEmail(adapter, resolvedEmail);
-  if (!matched) {
-    return;
-  }
-  if (requireUserId(
-    adapter,
-    matched,
-    "[@holo-js/auth-clerk] Matched local users must expose a serializable id."
-  ) !== currentUserId) {
-    throw new ClerkAuthConflictError({
-      provider: providerName,
-      clerkUserId: profile.id,
-      email: resolvedEmail,
-      message: `[@holo-js/auth-clerk] Clerk email "${resolvedEmail}" collides with a different local user.`
-    });
-  }
-}
 function isEmailVerificationRequired() {
   return authRuntimeInternals3.getRuntimeBindings().config.emailVerification.required === true;
 }
@@ -554,47 +490,6 @@ function createIdentityRecord(input) {
     updatedAt: now
   });
 }
-async function withIdentitySyncLock(key, callback) {
-  const previous = clerkIdentitySyncLocks.get(key) ?? Promise.resolve();
-  let release;
-  const gate = new Promise((resolve) => {
-    release = resolve;
-  });
-  const current = previous.then(() => gate);
-  clerkIdentitySyncLocks.set(key, current);
-  await previous;
-  try {
-    return await callback();
-  } finally {
-    release();
-    if (clerkIdentitySyncLocks.get(key) === current) {
-      clerkIdentitySyncLocks.delete(key);
-    }
-  }
-}
-async function claimNewIdentity(identityStore, identity) {
-  if (identityStore.claim) {
-    return await identityStore.claim(identity);
-  }
-  await identityStore.save(identity);
-  return identity;
-}
-function sameUserId(left, right) {
-  return String(left) === String(right);
-}
-async function resolveClaimedIdentityUser(adapter, identity, fallback) {
-  if (sameUserId(identity.userId, fallback.userId)) {
-    return fallback.user;
-  }
-  const claimedUser = requireUserRecord(
-    await adapter.findById(identity.userId),
-    "[@holo-js/auth-clerk] Claimed Clerk identities must reference an existing local user."
-  );
-  if (adapter.delete) {
-    await adapter.delete(fallback.userId);
-  }
-  return claimedUser;
-}
 function getSessionTokenFromRequest(request, sessionCookie) {
   const authorization = request.headers.get("authorization")?.trim();
   if (authorization) {
@@ -803,124 +698,41 @@ async function syncIdentity(session, provider, options = {}) {
   if (verificationRequired && !verifiedEmail) {
     throw new Error(`[@holo-js/auth-clerk] Clerk identity "${profile.id}" must provide a verified email address.`);
   }
-  return await withIdentitySyncLock(`${providerName}:${profile.id}`, async () => {
-    const identityStore = getBindings().identityStore;
-    const existingIdentity = await identityStore.findByProviderUserId(providerName, profile.id);
-    if (existingIdentity) {
-      const existingLinkedUser = await adapter.findById(existingIdentity.userId);
-      let linkedUser = existingLinkedUser ? requireUserRecord(existingLinkedUser, "[@holo-js/auth-clerk] Auth provider lookups must return object users.") : null;
-      if (!linkedUser) {
-        const emailMatchedUser = verifiedEmail ? await findUserByEmail(adapter, verifiedEmail) : null;
-        if (emailMatchedUser) {
-          throw new ClerkAuthConflictError({
-            provider: providerName,
-            clerkUserId: profile.id,
-            email: verifiedEmail,
-            message: `[@holo-js/auth-clerk] Clerk email "${verifiedEmail}" matches an existing local user and must be linked explicitly.`
-          });
-        }
-        linkedUser = requireUserRecord(
-          await adapter.create(resolveCreateUserInput(profile, options.user)),
-          "[@holo-js/auth-clerk] Auth provider create() must return an object user."
-        );
-        const relinked = await updateLocalUser(adapter, linkedUser, resolveUpdateUserInput(profile, options.user));
-        const relinkedUser = relinked.user;
-        const identity3 = createIdentityRecord({
-          provider: providerName,
-          guard,
-          authProvider,
-          userId: requireUserId(
-            adapter,
-            relinkedUser,
-            "[@holo-js/auth-clerk] Relinked local users must expose a serializable id."
-          ),
-          profile,
-          previous: existingIdentity
-        });
-        await identityStore.save(identity3);
-        return Object.freeze({
-          provider: providerName,
-          guard,
-          authProvider,
-          status: "relinked",
-          user: serializeLocalUser(adapter, relinkedUser, authProvider),
-          identity: identity3,
-          session
-        });
-      }
-      await ensureNoUnexpectedEmailCollision(
-        adapter,
-        providerName,
-        profile,
-        requireUserId(
-          adapter,
-          linkedUser,
-          "[@holo-js/auth-clerk] Linked local users must expose a serializable id."
-        )
-      );
-      const updated = await updateLocalUser(adapter, linkedUser, resolveUpdateUserInput(profile, options.user));
-      const identity2 = createIdentityRecord({
-        provider: providerName,
-        guard,
-        authProvider,
-        userId: requireUserId(
-          adapter,
-          updated.user,
-          "[@holo-js/auth-clerk] Updated local users must expose a serializable id."
-        ),
-        profile,
-        previous: existingIdentity
-      });
-      await identityStore.save(identity2);
-      return Object.freeze({
-        provider: providerName,
-        guard,
-        authProvider,
-        status: updated.changed ? "updated" : "linked",
-        user: serializeLocalUser(adapter, updated.user, authProvider),
-        identity: identity2,
-        session
-      });
-    }
-    let localUser = verifiedEmail ? await findUserByEmail(adapter, verifiedEmail) : null;
-    if (localUser) {
-      throw new ClerkAuthConflictError({
-        provider: providerName,
-        clerkUserId: profile.id,
-        email: verifiedEmail,
-        message: `[@holo-js/auth-clerk] Clerk email "${verifiedEmail}" matches an existing local user and must be linked explicitly.`
-      });
-    }
-    localUser = requireUserRecord(
-      await adapter.create(resolveCreateUserInput(profile, options.user)),
-      "[@holo-js/auth-clerk] Auth provider create() must return an object user."
-    );
-    const identity = createIdentityRecord({
+  const synchronized = await authRuntimeInternals3.syncHostedIdentity({
+    provider: providerName,
+    providerUserId: profile.id,
+    adapter,
+    identityStore: getBindings().identityStore,
+    ownership: "serialized-claim",
+    verifiedEmail,
+    email: resolvedEmail.email,
+    errorPrefix: "[@holo-js/auth-clerk]",
+    identityLabel: "Clerk",
+    createUserInput: () => resolveCreateUserInput(profile, options.user),
+    updateUserInput: () => resolveUpdateUserInput(profile, options.user),
+    createIdentity: (userId, previous) => createIdentityRecord({
       provider: providerName,
       guard,
       authProvider,
-      userId: requireUserId(
-        adapter,
-        localUser,
-        "[@holo-js/auth-clerk] Created local users must expose a serializable id."
-      ),
-      profile
-    });
-    const claimedIdentity = await claimNewIdentity(identityStore, identity);
-    const claimedUser = await resolveClaimedIdentityUser(adapter, claimedIdentity, {
-      user: localUser,
-      userId: identity.userId
-    });
-    const claimedStatus = sameUserId(claimedIdentity.userId, identity.userId) ? "created" : "linked";
-    return Object.freeze({
+      userId,
+      profile,
+      previous
+    }),
+    conflict: (email, collision) => new ClerkAuthConflictError({
       provider: providerName,
-      guard,
-      authProvider,
-      status: claimedStatus,
-      user: serializeLocalUser(adapter, claimedUser, authProvider),
-      identity: claimedIdentity,
-      session
-    });
+      clerkUserId: profile.id,
+      email,
+      message: collision ? `[@holo-js/auth-clerk] Clerk email "${email}" collides with a different local user.` : `[@holo-js/auth-clerk] Clerk email "${email}" matches an existing local user and must be linked explicitly.`
+    })
+  });
+  return Object.freeze({
+    provider: providerName,
+    guard,
+    authProvider,
+    status: synchronized.status,
+    user: serializeLocalUser(adapter, synchronized.user, authProvider),
+    identity: synchronized.identity,
+    session
   });
 }
 async function authenticate(input, provider) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@holo-js/auth-clerk",
-  "version": "0.3.16",
+  "version": "0.3.17",
   "description": "Holo-JS Framework - Clerk auth integration contracts",
   "type": "module",
   "license": "MIT",
@@ -24,8 +24,8 @@
   },
   "dependencies": {
     "@clerk/backend": "^3.4.7",
-    "@holo-js/auth": "^0.3.16",
-    "@holo-js/session": "^0.3.16"
+    "@holo-js/auth": "^0.3.17",
+    "@holo-js/session": "^0.3.17"
   },
   "devDependencies": {
     "@types/node": "^22.10.2",