@ic-reactor/react 3.12.4 → 3.13.0

package/dist/auth/authentication-manager.js

@@ -1,9 +1,12 @@
 import { AnonymousIdentity } from "@icp-sdk/core/agent";
+import { isDelegationValid } from "@icp-sdk/core/identity";
 import { isDev } from "@ic-reactor/core";
 import { Principal } from "@icp-sdk/core/principal";
 import { safeGetCanisterEnv } from "@icp-sdk/core/agent/canister-env";
 import { probeLocalInternetIdentity, localInternetIdentityUnavailableError, } from "./local-ii-probe.js";
 import { IC_INTERNET_IDENTITY_PROVIDER, INTERNET_IDENTITY_PROVIDER_ENV_KEY, LOCAL_INTERNET_IDENTITY_CANISTER_ID, localInternetIdentityProvider, } from "./constants.js";
+import { recordAuthentication } from "../ownedAuthentication.js";
+import { detectAuthClientFlavor, detectAuthClientInstanceFlavor, toAuthClientConstructorOptions, toAuthClientSignInOptions, } from "./auth-client-compat.js";
 /**
  * Manages Internet Identity sign-in, session restoration, and authentication
  * state for a {@link ClientManager}.
@@ -68,6 +71,12 @@ export class AuthenticationManager {
             writable: true,
             value: false
         });
+        Object.defineProperty(this, "authClientFlavor", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: "legacy"
+        });
         Object.defineProperty(this, "authClientOptions", {
             enumerable: true,
             configurable: true,
@@ -85,18 +94,76 @@ export class AuthenticationManager {
                 error: undefined,
             }
         });
+        /** See {@link sessionChecked}. */
+        Object.defineProperty(this, "sessionCheckedValue", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: false
+        });
+        Object.defineProperty(this, "sessionCheckedSubscribers", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: []
+        });
+        /** Stops following the current client's session record; see `watchClient()`. */
+        Object.defineProperty(this, "unwatchClient", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
+        /**
+         * Set when the client's session record changed while an operation of this
+         * manager's own was running; see `followClient()`.
+         */
+        Object.defineProperty(this, "clientChangedDuringOperation", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: false
+        });
+        /** Counts `followClient()` passes, so that only the latest one publishes. */
+        Object.defineProperty(this, "followRevision", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: 0
+        });
+        /** Counts `dispose()` calls; see {@link releaseCount}. */
+        Object.defineProperty(this, "releases", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: 0
+        });
         Object.defineProperty(this, "identityProvider", {
             enumerable: true,
             configurable: true,
             writable: true,
             value: void 0
         });
+        /** The provider taken from the `ic_env` cookie, when no caller set one. */
+        Object.defineProperty(this, "envIdentityProvider", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         Object.defineProperty(this, "internetIdentityId", {
             enumerable: true,
             configurable: true,
             writable: true,
             value: void 0
         });
+        /** Whether `internetIdentityId` came from the caller rather than the cookie. */
+        Object.defineProperty(this, "internetIdentityIdIsExplicit", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         /**
          * Which authorize path the locally deployed Internet Identity serves, once
          * probed. `undefined` means not probed yet; `null` means it serves no sign-in
@@ -126,93 +193,19 @@ export class AuthenticationManager {
             configurable: true,
             writable: true,
             value: async () => {
-                if (this.authState.isAuthenticated) {
-                    // Returning on the cached flag alone meant a delegation that expired
-                    // mid-session was never re-observed: the UI kept rendering a signed-in
-                    // state while every update call failed, and only a reload recovered.
-                    // Re-ask the client, which reads the cached expiry rather than hitting
-                    // storage. A throw here is treated as "still valid" so a transient
-                    // failure cannot sign anyone out.
-                    if (!this.authClient) {
-                        return this.authState.identity || undefined;
-                    }
-                    const stillValid = await Promise.resolve(this.authClient.isAuthenticated()).catch(() => true);
-                    if (stillValid) {
-                        return this.authState.identity || undefined;
-                    }
-                    // Expired. Re-deriving state from the client will not help: the v8
-                    // client keeps handing out the lapsed delegation from getIdentity()
-                    // until signOut() runs (only a fresh page load purges it), so the
-                    // expired identity would go straight back on the agent and every
-                    // refetch would be signed with it. End the session explicitly.
-                    await this.expireSession();
-                    return undefined;
-                }
-                if (this.authPromise) {
-                    return this.authPromise;
-                }
-                if (this.authModuleMissing) {
-                    return undefined;
+                const releases = this.releases;
+                try {
+                    return await this.checkSession();
                 }
-                this.authPromise = (async () => {
-                    if (isDev() && typeof window !== "undefined") {
-                        console.info(`%cic-reactor:%c Authenticating...`, "color: #3b82f6; font-weight: bold", "color: inherit", {
-                            network: this.clientManager.network,
-                            authClient: this.authClient ? "Shared Instance" : "Dynamic Import",
-                        });
+                finally {
+                    // Marked once the result is published, so the hooks never show the
+                    // starting state as the answer. A failed restore settles it too. One
+                    // that `dispose()` cut short read nothing, and leaves the check to the
+                    // restore of whatever mounts this manager again.
+                    if (releases === this.releases || this.authClient) {
+                        this.markSessionChecked();
                     }
-                    this.updateState({ isAuthenticating: true });
-                    // Anything that changes auth state — a logout, notably — bumps this. If
-                    // it moves while the awaits below are in flight, the result we are
-                    // holding describes a session that has since ended, and installing it
-                    // would put the signed-out user's delegation back on the agent.
-                    const revision = this.authStateRevision;
-                    try {
-                        if (!this.authClient) {
-                            const authClient = await this.initializeClient(this.resolveClientOptions());
-                            if (!authClient) {
-                                this.updateState({ isAuthenticating: false });
-                                return undefined;
-                            }
-                        }
-                        const clientIdentity = await this.authClient.getIdentity();
-                        const isAuthenticated = await this.authClient.isAuthenticated();
-                        if (revision !== this.authStateRevision) {
-                            // Superseded — leave whatever ran in the meantime in place.
-                            return this.authState.identity || undefined;
-                        }
-                        // A client that says it is not authenticated but still hands out a
-                        // non-anonymous identity is holding a delegation it will no longer
-                        // vouch for (expired, mid-session). Nothing may be signed with it.
-                        const identity = isAuthenticated || clientIdentity.getPrincipal().isAnonymous()
-                            ? clientIdentity
-                            : new AnonymousIdentity();
-                        // Restoring an anonymous session is the common first-load case; pushing
-                        // it through updateAgent would invalidate the whole query cache on
-                        // every mount for nothing. It is only skipped while the agent is
-                        // anonymous too, so a lapsed delegation still gets replaced.
-                        if (isAuthenticated ||
-                            !identity.getPrincipal().isAnonymous() ||
-                            !this.agentIsAnonymous()) {
-                            this.clientManager.updateAgent(identity);
-                        }
-                        this.updateState({
-                            identity,
-                            isAuthenticated,
-                            isAuthenticating: false,
-                        });
-                        return identity;
-                    }
-                    catch (error) {
-                        this.updateState({ error: error, isAuthenticating: false });
-                        console.error("Authentication failed:", error);
-                        throw error;
-                    }
-                    finally {
-                        this.authPromise = undefined;
-                    }
-                })();
-                return this.authPromise;
+                }
             }
         });
         Object.defineProperty(this, "login", {
@@ -240,7 +233,7 @@ export class AuthenticationManager {
                         await this.clientManager.initializeAgent();
                     }
                     this.clientManager.updateAgent(identity);
-                    this.updateState({
+                    this.publishSession({
                         identity,
                         isAuthenticated: true,
                         isAuthenticating: false,
@@ -257,11 +250,14 @@ export class AuthenticationManager {
                 }
                 catch (error) {
                     if (!didCompleteSignIn) {
-                        await loginOptions?.onError?.(error.message);
+                        // Recorded before the callback runs, as on success: an onError that
+                        // rejected used to skip this and strand `isAuthenticating: true` with
+                        // no error on record.
                         this.updateState({
                             error: error,
                             isAuthenticating: false,
                         });
+                        await loginOptions?.onError?.(error.message);
                     }
                     throw error;
                 }
@@ -272,35 +268,80 @@ export class AuthenticationManager {
             configurable: true,
             writable: true,
             value: async (options) => {
-                if (!this.authClient) {
+                // None built yet, or released by `dispose()`. Signing out needs no user
+                // gesture, so one can be built here.
+                const client = this.authClient ?? (await this.ensureClient());
+                if (!client) {
                     throw new Error("Authentication module is missing or failed to initialize. To use logout, install the optional auth peer: npm install @icp-sdk/auth. If it is already installed and your bundler could not resolve it, pass a pre-constructed client instead: new AuthenticationManager({ clientManager, authClient: new AuthClient(...) })");
                 }
                 this.updateState({ isAuthenticating: true, error: undefined });
                 try {
-                    await this.authClient.signOut(options);
-                    const identity = await this.authClient.getIdentity();
+                    // The client the sign-out started on, even once `dispose()` has released
+                    // it, as when the sign-out closes the widget that built this manager.
+                    // Reading `this.authClient` then failed the sign-out with a TypeError.
+                    await client.signOut(options);
+                    const identity = await client.getIdentity();
                     this.clientManager.updateAgent(identity);
-                    this.updateState({
+                    this.publishSession({
                         identity,
                         isAuthenticated: false,
                         isAuthenticating: false,
                     });
                 }
                 catch (error) {
-                    // Without this the manager was left with `isAuthenticating: true` and no
-                    // recorded error, so a button disabled on `isAuthenticating` stayed stuck
-                    // and nothing told the app why.
-                    this.updateState({ error: error, isAuthenticating: false });
+                    // A failed signOut does not always mean the session survived. v10 wipes
+                    // the device and drops to an anonymous identity before it raises a revoke
+                    // the canister did not answer, so keeping the session here left the app
+                    // signed in and the agent signing as the user who had just signed out.
+                    // Follow the client instead: once it no longer vouches for the session,
+                    // nothing may sign with it, which is the rule `authenticate()` applies
+                    // too. A v8 client that failed before forgetting anything still vouches
+                    // for its session and keeps it, unless its delegation has lapsed (see
+                    // vouchesFor()). A check that throws keeps it as well.
+                    //
+                    // Anything that changes auth state while that check is in flight, such
+                    // as a login that finishes meanwhile, bumps this. The check then
+                    // describes a client that has been used since, and its answer must not
+                    // replace the newer state, as in `authenticate()`.
+                    const revision = this.authStateRevision;
+                    const stillSignedIn = await Promise.resolve()
+                        .then(() => client.isAuthenticated())
+                        .catch(() => true);
+                    if (revision !== this.authStateRevision) {
+                        throw error;
+                    }
+                    if (this.vouchesFor(this.authState.identity, stillSignedIn)) {
+                        // Without this the manager was left with `isAuthenticating: true` and
+                        // no recorded error, so a button disabled on `isAuthenticating` stayed
+                        // stuck and nothing told the app why.
+                        this.publishSession({ error: error, isAuthenticating: false });
+                    }
+                    else {
+                        const identity = new AnonymousIdentity();
+                        this.clientManager.updateAgent(identity);
+                        // The error stays recorded: the device is signed out, but the session
+                        // may still be live at the identity provider.
+                        this.publishSession({
+                            identity,
+                            isAuthenticated: false,
+                            isAuthenticating: false,
+                            error: error,
+                        });
+                    }
                     throw error;
                 }
             }
         });
         this.clientManager = clientManager;
+        // For `createReactorProvider`, which disposes the managers built while
+        // its factory ran, and leaves alone those built elsewhere.
+        recordAuthentication(this);
         const canisterEnv = typeof window !== "undefined" ? getAuthenticationCanisterEnv() : undefined;
-        this.identityProvider =
-            identityProvider ||
-                acceptEnvIdentityProvider(canisterEnv?.[INTERNET_IDENTITY_PROVIDER_ENV_KEY] ||
-                    canisterEnv?.["PUBLIC_INTERNET_IDENTITY_PROVIDER"], clientManager);
+        this.envIdentityProvider = identityProvider
+            ? undefined
+            : acceptEnvIdentityProvider(canisterEnv?.[INTERNET_IDENTITY_PROVIDER_ENV_KEY] ||
+                canisterEnv?.["PUBLIC_INTERNET_IDENTITY_PROVIDER"], clientManager);
+        this.identityProvider = identityProvider || this.envIdentityProvider;
         // Same cookie, same decision. This one only ever reaches a local provider
         // URL, but `allowEnvConfig: false` has to mean the cookie is not consulted
         // rather than mostly not consulted.
@@ -311,10 +352,17 @@ export class AuthenticationManager {
                         canisterEnv?.["PUBLIC_CANISTER_ID:internet_identity"] ||
                         canisterEnv?.["CANISTER_ID_INTERNET_IDENTITY"])
                     : undefined);
+        this.internetIdentityIdIsExplicit = Boolean(internetIdentityId);
         this.defaultClientOptions = clientOptions;
         if (authClient) {
             this.authClientWasProvided = true;
             this.authClient = authClient;
+            // A caller-built client never goes through the module loader that
+            // detects the flavor, so read it off the instance. Without this a v10
+            // client handed in here was treated as v8, and `targets` reached it
+            // without the warning that it is ignored.
+            this.authClientFlavor = detectAuthClientInstanceFlavor(authClient);
+            this.watchClient(authClient);
             this.syncStateFromClient(this.authStateRevision).catch((error) => {
                 this.updateState({ error: error, isAuthenticating: false });
             });
@@ -329,10 +377,132 @@ export class AuthenticationManager {
     get client() {
         return this.authClient;
     }
+    /**
+     * @internal Used by the auth hooks.
+     *
+     * Whether this manager has checked its client for a session: a restore has
+     * settled, whether it found a session, found none or failed, or a sign-in or
+     * sign-out has completed. Until then {@link authState} is the signed-out state
+     * the manager starts in, which says nothing about the session, so the auth
+     * hooks report `isAuthenticating: true` instead.
+     */
+    get sessionChecked() {
+        return this.sessionCheckedValue;
+    }
+    /**
+     * @internal Used by the auth hooks.
+     *
+     * Records that the session has been checked, and tells the auth hooks the
+     * first time. A restore that failed counts: waiting on one that will not be
+     * retried would leave the hooks reporting `isAuthenticating: true` for good.
+     */
+    markSessionChecked() {
+        if (this.sessionCheckedValue)
+            return;
+        this.sessionCheckedValue = true;
+        const subscribers = this.sessionCheckedSubscribers;
+        this.sessionCheckedSubscribers = [];
+        for (const subscriber of subscribers)
+            subscriber();
+    }
+    /**
+     * @internal Used by the auth hooks.
+     *
+     * How many times {@link dispose} has run. A restore the hooks started
+     * compares it with the count it began with, to tell whether the manager was
+     * released while it ran.
+     */
+    get releaseCount() {
+        return this.releases;
+    }
+    /**
+     * @internal Used by the auth hooks.
+     *
+     * Calls `callback` once, when {@link sessionChecked} turns true. Nothing else
+     * announces it when the check that settles it publishes no state, as a
+     * restore that failed before it read the client does not.
+     *
+     * @returns An unsubscribe function.
+     */
+    subscribeSessionChecked(callback) {
+        if (this.sessionCheckedValue)
+            return () => { };
+        const subscription = () => callback();
+        this.sessionCheckedSubscribers.push(subscription);
+        return () => {
+            this.sessionCheckedSubscribers = this.sessionCheckedSubscribers.filter((subscriber) => subscriber !== subscription);
+        };
+    }
+    /**
+     * Releases the `@icp-sdk/auth` client this manager built.
+     *
+     * A v10 client hooks the page when it is built: activity listeners on
+     * `document`, focus and visibility listeners, a watch on the session record
+     * that every tab shares and, once signed in, a refresh timer. Nothing
+     * releases them when the manager is dropped, so a manager built per mount,
+     * as a server-rendered app builds one in its provider, left one live client
+     * behind on each remount. Call this when you discard the manager, from the
+     * cleanup of whatever built it.
+     *
+     * The client is disposed and forgotten, so a later {@link prepareClient},
+     * {@link login}, {@link logout} or restore that needs a client builds a new
+     * one. That keeps it safe in an effect cleanup under React's StrictMode,
+     * which runs the cleanup and then the effect again on the same manager. With
+     * `@icp-sdk/auth` v8 there is nothing to release, and the manager only drops
+     * its reference. A client passed in as `authClient` belongs to the caller: it
+     * is never disposed, and the manager goes on using it, but stops following its
+     * session record until its next {@link prepareClient}, {@link login} or
+     * {@link authenticate}, so that the caller's client does not keep a
+     * discarded manager alive.
+     *
+     * The auth state and the identity on the agent are left as they are. A
+     * restore reading the client when it is released ends without publishing
+     * what it read, and a sign-in or sign-out under way ends with what the
+     * released client reports. A restore `useAuth()` started stops, and
+     * releases any client it built meanwhile, once no `useAuth()` of this
+     * manager is mounted; one mounted later restores again.
+     *
+     * @example
+     * ```tsx
+     * const [authentication] = useState(
+     *   () => new AuthenticationManager({ clientManager })
+     * )
+     * useEffect(() => () => authentication.dispose(), [authentication])
+     * ```
+     */
+    dispose() {
+        this.releases++;
+        this.stopWatchingClient();
+        if (this.authClientWasProvided) {
+            return;
+        }
+        const client = this.authClient;
+        this.authClient = undefined;
+        this.authClientOptions = undefined;
+        if (client) {
+            disposeClient(client);
+        }
+    }
+    /**
+     * Subscribes to auth state changes.
+     *
+     * Callbacks run in the order they subscribed, after the state has changed. A
+     * callback that throws does not stop the others; the first error is rethrown
+     * to whatever made the change once they have all run. When a callback itself
+     * changes the state, the newer state is the last each callback hears.
+     *
+     * @param callback - Function called with the new state.
+     * @returns An unsubscribe function.
+     */
     subscribeAuthState(callback) {
-        this.authStateSubscribers.push(callback);
+        // Each subscription gets an entry of its own, so the unsubscribe it returns
+        // removes that one registration and no other. Filtering on the callback
+        // itself removed every registration of a function subscribed twice, as
+        // `ClientManager.subscribe` did before #513.
+        const subscription = (state) => callback(state);
+        this.authStateSubscribers.push(subscription);
         return () => {
-            this.authStateSubscribers = this.authStateSubscribers.filter((subscriber) => subscriber !== callback);
+            this.authStateSubscribers = this.authStateSubscribers.filter((subscriber) => subscriber !== subscription);
         };
     }
     /**
@@ -350,6 +520,7 @@ export class AuthenticationManager {
         await this.ensureLocalAuthorizePath();
         const clientOptions = this.resolveClientOptions(options);
         if (this.authClient && !this.shouldRecreateClient(clientOptions)) {
+            this.watchClient(this.authClient);
             return this.authClient;
         }
         return this.initializeClient(clientOptions);
@@ -373,7 +544,17 @@ export class AuthenticationManager {
         // An inconclusive probe must not change behaviour: the canister may be
         // fine and merely unreachable from here, and a diagnostic that blocks a
         // working login is worse than the failure it explains.
-        this.localAuthorizePath = inconclusive ? "/authorize" : path;
+        const authorizePath = inconclusive ? "/authorize" : path;
+        // With no sign-in UI, login fails with advice that depends on the
+        // installed @icp-sdk/auth major. A client IC Reactor builds itself shows
+        // its major only once the module has loaded, and that import is usually
+        // still in flight when the probe answers. Wait for it before recording the
+        // finding, so nothing reads `null` while the flavor still holds its
+        // `legacy` default and hands a v10 app the v8 advice.
+        if (authorizePath === null && !this.authClientWasProvided) {
+            await this.loadAuthClientConstructor().catch(() => undefined);
+        }
+        this.localAuthorizePath = authorizePath;
         if (path === "/#authorize" && !inconclusive) {
             console.warn(`[ic-reactor] Internet Identity canister ${canisterId} serves its sign-in UI at ` +
                 `"/" rather than "/authorize" — using the legacy #authorize flow. This is a ` +
@@ -391,27 +572,309 @@ export class AuthenticationManager {
     getPreparedClient(options) {
         return this.ensurePreparedClient(this.resolveClientOptions(options));
     }
+    async checkSession() {
+        if (this.authClient) {
+            this.watchClient(this.authClient);
+        }
+        if (this.authState.isAuthenticated) {
+            // Returning on the cached flag alone meant a delegation that expired
+            // mid-session was never re-observed: the UI kept rendering a signed-in
+            // state while every update call failed, and only a reload recovered.
+            // Re-ask the client, which reads the cached expiry rather than hitting
+            // storage. A throw here is treated as "still valid" so a transient
+            // failure cannot sign anyone out. A v8 delegation that has expired is
+            // not valid whatever the client answers: see vouchesFor().
+            if (!this.authClient) {
+                return this.authState.identity || undefined;
+            }
+            const isAuthenticated = await Promise.resolve(this.authClient.isAuthenticated()).catch(() => true);
+            if (this.vouchesFor(this.authState.identity, isAuthenticated)) {
+                return this.authState.identity || undefined;
+            }
+            // Expired, or ended in another tab. The v8 client keeps handing out the
+            // lapsed delegation from getIdentity() until signOut() runs (only a
+            // fresh page load purges it). End the session explicitly, in this tab
+            // only: see expireSession().
+            await this.expireSession(isAuthenticated);
+            return undefined;
+        }
+        if (this.authPromise) {
+            return this.authPromise;
+        }
+        if (this.authModuleMissing) {
+            return undefined;
+        }
+        this.authPromise = (async () => {
+            if (isDev() && typeof window !== "undefined") {
+                console.info(`%cic-reactor:%c Authenticating...`, "color: #3b82f6; font-weight: bold", "color: inherit", {
+                    network: this.clientManager.network,
+                    authClient: this.authClient ? "Shared Instance" : "Dynamic Import",
+                });
+            }
+            this.updateState({ isAuthenticating: true });
+            // Anything that changes auth state — a logout, notably — bumps this. If
+            // it moves while the awaits below are in flight, the result we are
+            // holding describes a session that has since ended, and installing it
+            // would put the signed-out user's delegation back on the agent.
+            const revision = this.authStateRevision;
+            try {
+                let client = this.authClient ??
+                    (await this.initializeClient(this.resolveClientOptions()));
+                if (!client) {
+                    this.updateState({ isAuthenticating: false });
+                    return undefined;
+                }
+                let { clientIdentity, isAuthenticated } = await this.readClientSession(client);
+                // Per-call options can replace the client while it is read, and
+                // `dispose()` can release it. Both answers used to be read from
+                // whichever client was current at the time, so they could come from two
+                // clients. A v10 client disposed while it restores hands out the
+                // anonymous identity, and the record its replacement reads still says
+                // signed in: the manager reported the anonymous principal signed in.
+                // The client in use now is read instead, and a manager that let go of
+                // its client publishes nothing. Nothing may be signed with what a
+                // released client held.
+                while (revision === this.authStateRevision &&
+                    client !== this.authClient) {
+                    if (!this.authClient) {
+                        this.updateState({ isAuthenticating: false });
+                        return this.authState.identity || undefined;
+                    }
+                    client = this.authClient;
+                    ({ clientIdentity, isAuthenticated } =
+                        await this.readClientSession(client));
+                }
+                if (revision !== this.authStateRevision) {
+                    // Superseded — leave whatever ran in the meantime in place.
+                    return this.authState.identity || undefined;
+                }
+                // A client that says it is not authenticated but still hands out a
+                // non-anonymous identity is holding a delegation it will no longer
+                // vouch for (expired, mid-session). So is a v8 client that says it is,
+                // once another tab has signed in again, while it hands out the
+                // delegation that lapsed in this one. Nothing may be signed with it.
+                const identity = isAuthenticated || clientIdentity.getPrincipal().isAnonymous()
+                    ? clientIdentity
+                    : new AnonymousIdentity();
+                // Restoring an anonymous session is the common first-load case; pushing
+                // it through updateAgent would invalidate the whole query cache on
+                // every mount for nothing. It is only skipped while the agent is
+                // anonymous too, so a lapsed delegation still gets replaced.
+                if (isAuthenticated ||
+                    !identity.getPrincipal().isAnonymous() ||
+                    !this.agentIsAnonymous()) {
+                    this.clientManager.updateAgent(identity);
+                }
+                this.updateState({
+                    identity,
+                    isAuthenticated,
+                    isAuthenticating: false,
+                });
+                return identity;
+            }
+            catch (error) {
+                this.updateState({ error: error, isAuthenticating: false });
+                console.error("Authentication failed:", error);
+                throw error;
+            }
+            finally {
+                this.authPromise = undefined;
+            }
+        })();
+        return this.authPromise;
+    }
     async initializeClient(options) {
         const AuthClient = await this.loadAuthClientConstructor();
         if (!AuthClient) {
             return undefined;
         }
-        this.authClient = new AuthClient(options);
+        // Every mounted `useAuth()` prepares the client at the same moment, and
+        // each call arrives here after the same await. Building one per caller
+        // left all but the last running with nothing able to reach them: on v8
+        // each registered the app's `onIdle` on the shared IdleManager again, so it
+        // fired once per consumer, and on v10 each kept its browser listeners and
+        // its session's refresh timer. Take the client an earlier caller built for
+        // the same options instead.
+        if (this.authClient && !this.shouldRecreateClient(options)) {
+            return this.authClient;
+        }
+        return this.installClient(new AuthClient(this.toClientOptions(options)), options);
+    }
+    /**
+     * Makes `client`, which this manager built for `options`, the current one.
+     *
+     * The client it replaces was built here too, for other options: a caller's
+     * `authClient` is never replaced. It was dropped with nothing released, so a
+     * v10 client kept its browser listeners, its state subscription and its
+     * session's refresh timer for the life of the page, one more for each switch
+     * between option sets, such as a one-click sign-in and a plain one (#729).
+     * v10 asks for `dispose()` on a client being discarded, and a new
+     * interaction already takes its signer channel from the old client, so this
+     * adds no failure of its own. A v8 client has nothing to dispose; see
+     * `withSharedIdleCallback()` for the callback it leaves registered.
+     */
+    installClient(client, options) {
+        const replaced = this.authClient;
+        this.stopWatchingClient();
+        this.authClient = client;
         this.authClientOptions = options;
-        return this.authClient;
+        if (replaced && replaced !== client) {
+            disposeClient(replaced);
+        }
+        this.watchClient(client);
+        return client;
+    }
+    /**
+     * Follows a v10 client's session record, which every tab of the origin
+     * shares.
+     *
+     * The manager learned about the session only through its own calls, while a
+     * v10 client follows the other tabs. After a sign-out in another tab, this
+     * tab's client dropped the session and its manager went on reporting the
+     * user signed in, with the replaced identity on the agent signing calls as
+     * the account the user had left. After a sign-in there as another account,
+     * the manager kept the old account while the client held the new one. When
+     * the old identity's app delegation then lapsed, its mint was refused and
+     * the client removed the record every tab reads, signing the new account out
+     * of every tab (#754). `subscribe()` fires after the record changes, here or
+     * in another tab, and the manager then reads the client again.
+     *
+     * v8 has no notification and never revokes a session, so a v8 client is not
+     * followed.
+     */
+    watchClient(client) {
+        if (this.unwatchClient || this.authClientFlavor !== "session") {
+            return;
+        }
+        const { subscribe } = client;
+        if (typeof subscribe !== "function") {
+            return;
+        }
+        this.unwatchClient = subscribe.call(client, () => {
+            // The client tells its listeners before it starts restoring for the new
+            // record, which it does right after they return. Reading it a microtask
+            // later waits for that restore. The state is published whether or not a
+            // subscriber throws, and there is no caller to hand that error to.
+            void Promise.resolve()
+                .then(() => this.followClient(client))
+                .catch(() => undefined);
+        });
+    }
+    stopWatchingClient() {
+        this.unwatchClient?.();
+        this.unwatchClient = undefined;
+    }
+    /**
+     * Reads the session from `client` after its record changed, and publishes
+     * it when it differs from what this manager holds, as `syncStateFromClient()`
+     * derives it. An error recorded for the session it replaces goes with it.
+     *
+     * An operation of the manager's own, which sets `isAuthenticating`, writes
+     * the record itself and publishes what the client holds when it ends, so a
+     * change during one is read again once it has. So is a change whose read
+     * something else published over.
+     */
+    async followClient(client) {
+        if (client !== this.authClient) {
+            return;
+        }
+        if (this.authState.isAuthenticating) {
+            this.clientChangedDuringOperation = true;
+            return;
+        }
+        const pass = ++this.followRevision;
+        const revision = this.authStateRevision;
+        const session = await this.readFollowedSession(client);
+        if (pass !== this.followRevision || client !== this.authClient) {
+            return;
+        }
+        if (revision !== this.authStateRevision) {
+            return this.followClient(client);
+        }
+        if (!session) {
+            return;
+        }
+        const current = this.authState;
+        const anonymous = session.identity.getPrincipal().isAnonymous();
+        const unchanged = session.isAuthenticated === current.isAuthenticated &&
+            (session.identity === current.identity ||
+                (!session.isAuthenticated &&
+                    anonymous &&
+                    current.identity?.getPrincipal().isAnonymous() === true));
+        if (unchanged) {
+            this.markSessionChecked();
+            return;
+        }
+        // As in `authenticate()`, an agent that is anonymous already is left as
+        // it is.
+        if (!anonymous || !this.agentIsAnonymous()) {
+            this.clientManager.updateAgent(session.identity);
+        }
+        this.publishSession({
+            identity: session.identity,
+            isAuthenticated: session.isAuthenticated,
+            isAuthenticating: false,
+            error: undefined,
+        });
+    }
+    /**
+     * The identity `client` hands out, and whether it vouches for it (see
+     * `vouchesFor()`). Both are read from the same client.
+     */
+    async readClientSession(client) {
+        const clientIdentity = await client.getIdentity();
+        const isAuthenticated = this.vouchesFor(clientIdentity, await client.isAuthenticated());
+        return { clientIdentity, isAuthenticated };
+    }
+    /**
+     * The session `client` holds, or `undefined` to leave the manager's as it is.
+     *
+     * v10 refuses to hand out an identity while the record names a sign-in it
+     * holds no credential for, as when restoring the account another tab signed
+     * in as failed. The session this manager holds is kept then only while the
+     * record still names its account. One for any other account must not stay
+     * on the agent.
+     */
+    async readFollowedSession(client) {
+        try {
+            const { clientIdentity, isAuthenticated } = await this.readClientSession(client);
+            // The rule `authenticate()` applies to an identity the client no longer
+            // vouches for.
+            const identity = isAuthenticated || clientIdentity.getPrincipal().isAnonymous()
+                ? clientIdentity
+                : new AnonymousIdentity();
+            return { identity, isAuthenticated };
+        }
+        catch {
+            const { isAuthenticated, identity } = this.authState;
+            const held = isAuthenticated
+                ? identity?.getPrincipal().toText()
+                : undefined;
+            const named = client
+                .getPrincipal?.()
+                ?.toText();
+            if (held === undefined || held === named) {
+                return undefined;
+            }
+            return { identity: new AnonymousIdentity(), isAuthenticated: false };
+        }
     }
     /** @internal Used by IdentityAttributesManager. */
     async signInOrRecoverIdentity(options) {
-        if (!this.authClient) {
+        // Held, because `dispose()` can release it while the popup is open. The
+        // recovery below then failed with a TypeError instead of the client's own
+        // error.
+        const client = this.authClient;
+        if (!client) {
             throw new Error("Authentication module is missing or failed to initialize. To use login, install the optional auth peer: npm install @icp-sdk/auth. If it is already installed and your bundler could not resolve it, pass a pre-constructed client instead: new AuthenticationManager({ clientManager, authClient: new AuthClient(...) })");
         }
         try {
-            return await this.authClient.signIn(options);
+            return await client.signIn(toAuthClientSignInOptions(options, this.authClientFlavor));
         }
         catch (error) {
-            const identity = await Promise.resolve(this.authClient.getIdentity()).catch(() => null);
-            const isAuthenticated = await Promise.resolve(this.authClient.isAuthenticated()).catch(() => false);
-            if (identity && isAuthenticated) {
+            const identity = await Promise.resolve(client.getIdentity()).catch(() => null);
+            const isAuthenticated = await Promise.resolve(client.isAuthenticated()).catch(() => false);
+            if (identity && this.vouchesFor(identity, isAuthenticated)) {
                 return identity;
             }
             throw error;
@@ -419,15 +882,94 @@ export class AuthenticationManager {
     }
     ensurePreparedClient(options) {
         if (this.authClient && !this.shouldRecreateClient(options)) {
+            this.watchClient(this.authClient);
             return this.authClient;
         }
         const AuthClient = this.authClientConstructor;
         if (!AuthClient || this.authClientWasProvided) {
             return undefined;
         }
-        this.authClient = new AuthClient(options);
-        this.authClientOptions = options;
-        return this.authClient;
+        return this.installClient(new AuthClient(this.toClientOptions(options)), options);
+    }
+    /**
+     * Hands the installed client the option shape it actually accepts.
+     *
+     * `authClientOptions` keeps the untranslated values, and `shouldRecreateClient`
+     * compares them with the installed major in mind: two calls that differ only
+     * in a key that major drops count as the same options, so the client is not
+     * rebuilt for them.
+     */
+    toClientOptions(options) {
+        return toAuthClientConstructorOptions(this.authClientFlavor === "legacy"
+            ? withSharedIdleCallback(options)
+            : options, this.authClientFlavor, this.identityProviderPairing(options?.identityProvider), this.sessionAgentOptions());
+    }
+    /**
+     * Options for the agent a v9+ client mints delegations with, off mainnet.
+     *
+     * That client makes its own calls to the Internet Identity canister, through
+     * an agent built from these options alone. Without a root key it checks every
+     * certificate against mainnet's, which a local replica or testnet cannot
+     * satisfy, so sign-in would fail at the first mint. Off mainnet it gets the
+     * replica this app already talks to and fetches that network's root key, the
+     * same trust the app's own agent needs there. When the app passed its own
+     * `agentOptions.rootKey`, which its agent keeps, the minting agent gets that
+     * key instead and verifies against it too. On mainnet nothing is passed, and
+     * the client keeps its defaults.
+     */
+    sessionAgentOptions() {
+        if (!this.clientManager.isLocal) {
+            return undefined;
+        }
+        const host = this.clientManager.agentHost;
+        const rootKey = this.clientManager.explicitRootKey;
+        return {
+            ...(host ? { host: host.toString() } : {}),
+            ...(rootKey ? { rootKey } : { shouldFetchRootKey: true }),
+        };
+    }
+    /**
+     * Which canister a v9+ client should pair with `identityProvider`.
+     *
+     * v9+ names a provider by its authorize URL and the canister that mints its
+     * delegations, and nothing about the canister follows from the URL. The
+     * mainnet URL goes with mainnet's canister unless the caller named another.
+     * A canister read from the `ic_env` cookie belongs to a local deployment, so
+     * it never overrides that. Any other URL takes `internetIdentityId`, or the
+     * well-known local canister when the URL is one IC Reactor derived for a
+     * local deployment. A URL the caller set with no canister stays `unknown`.
+     */
+    identityProviderPairing(identityProvider) {
+        if (String(identityProvider) === IC_INTERNET_IDENTITY_PROVIDER) {
+            return this.internetIdentityIdIsExplicit && this.internetIdentityId
+                ? { kind: "pair", canisterId: this.internetIdentityId }
+                : { kind: "mainnet" };
+        }
+        if (this.internetIdentityId) {
+            return { kind: "pair", canisterId: this.internetIdentityId };
+        }
+        if (identityProvider !== undefined &&
+            this.isDerivedLocalProvider(identityProvider)) {
+            return { kind: "pair", canisterId: LOCAL_INTERNET_IDENTITY_CANISTER_ID };
+        }
+        return { kind: "unknown" };
+    }
+    /**
+     * Whether `identityProvider` is a local provider IC Reactor chose, from the
+     * `ic_env` cookie or built for the local replica, rather than one a caller
+     * configured.
+     */
+    isDerivedLocalProvider(identityProvider) {
+        if (this.envIdentityProvider !== undefined) {
+            return String(identityProvider) === String(this.envIdentityProvider);
+        }
+        if (this.identityProvider !== undefined ||
+            !this.clientManager.isLocal ||
+            this.localAuthorizePath === null) {
+            return false;
+        }
+        return (String(identityProvider) ===
+            localInternetIdentityProvider(Number(this.clientManager.agentHost?.port) || 4943, this.internetIdentityId, this.localAuthorizePath));
     }
     /**
      * Only rebuild the client when the effective options actually changed.
@@ -440,7 +982,7 @@ export class AuthenticationManager {
         if (this.authClientWasProvided) {
             return false;
         }
-        return !isSameAuthClientOptions(this.authClientOptions, options);
+        return !isSameAuthClientOptions(this.authClientOptions, options, this.authClientFlavor);
     }
     /**
      * Merges constructor-level defaults with per-call overrides and fills in the
@@ -462,18 +1004,69 @@ export class AuthenticationManager {
         return installed === undefined || installed.getPrincipal().isAnonymous();
     }
     /**
-     * End a session whose delegation has lapsed: ask the client to forget it,
-     * put the anonymous identity on the agent -- which also sweeps the previous
-     * user's caller-scoped cache entries and refetches the rest anonymously --
-     * and publish the signed-out state. `signOut` failing changes nothing here:
-     * the delegation is already unusable, and the agent must not keep it.
+     * @internal Used by IdentityAttributesManager.
+     *
+     * Whether the client vouches for `identity`, given what its
+     * `isAuthenticated()` answered.
+     *
+     * A v8 client's answer is not about the identity it holds. It reads the
+     * delegation expiry v8 keeps in the `localStorage` every tab shares, while
+     * `getIdentity()` returns the identity this client restored or signed in
+     * with, and v8 never reads storage again once it has loaded. When the session
+     * lapses and the user signs in again in another tab, that tab writes a new
+     * expiry, and the answer is yes again for the delegation this tab still
+     * holds, which the replica refuses. So a v8 identity whose own delegation
+     * has expired is not vouched for, whatever the answer. Nor is the anonymous
+     * identity, which a v8 client that loaded signed out, or signed out, goes on
+     * handing out once another tab signs in and the answer turns yes. It signs
+     * no one in.
+     *
+     * A v10 client's answer is about the session it holds, and its identity
+     * replaces its short-lived delegation as it ages, so the delegation it holds
+     * can be past its expiry while the session is live. The answer stands alone.
      */
-    async expireSession() {
-        try {
-            await this.authClient?.signOut();
-        }
-        catch {
-            // Nothing to keep; fall through to anonymous either way.
+    vouchesFor(identity, isAuthenticated) {
+        return (isAuthenticated &&
+            !(this.authClientFlavor === "legacy" &&
+                (identity?.getPrincipal().isAnonymous() ||
+                    hasExpiredDelegation(identity))));
+    }
+    /**
+     * End a session the client no longer vouches for: put the anonymous
+     * identity on the agent -- which also sweeps the previous user's
+     * caller-scoped cache entries and refetches the rest anonymously -- and
+     * publish the signed-out state.
+     *
+     * A v8 client is also asked to forget the session when its
+     * `isAuthenticated()` answered no, since it keeps handing out the lapsed
+     * delegation until `signOut()` runs. That answer reads the expiry kept in
+     * the `localStorage` every tab shares, so it is no only once the session
+     * stored for every tab is over, and v8's `signOut()` takes no lock and
+     * revokes nothing. `signOut` failing changes nothing here: the delegation is
+     * already unusable, and the agent must not keep it. When the answer was yes,
+     * the delegation this tab holds lapsed under a session another tab has
+     * signed in to since, and `signOut()` would delete that session from the
+     * storage every tab shares. The client is left alone, and `vouchesFor()`
+     * keeps the lapsed delegation it goes on handing out off the agent.
+     *
+     * A v10 client is left alone, as `commitSignedOut()` leaves it. Its
+     * `signOut()` ends the sign-in for every tab of the origin: it takes the
+     * sign-in lock from a sign-in another tab has in progress, which then fails,
+     * revokes whatever session the shared store holds, and removes the record
+     * every tab reads. Another tab may have signed in again since this one last
+     * looked, and finding a session over is not the user asking to sign out.
+     * The client already stopped vouching for the session on its own.
+     *
+     * @param isAuthenticated - What the client's `isAuthenticated()` answered.
+     */
+    async expireSession(isAuthenticated) {
+        if (this.authClientFlavor !== "session" && !isAuthenticated) {
+            try {
+                await this.authClient?.signOut();
+            }
+            catch {
+                // Nothing to keep; fall through to anonymous either way.
+            }
         }
         const identity = new AnonymousIdentity();
         this.clientManager.updateAgent(identity);
@@ -488,18 +1081,30 @@ export class AuthenticationManager {
         if (!this.authClient) {
             return;
         }
-        const identity = await this.authClient.getIdentity();
-        const isAuthenticated = await this.authClient.isAuthenticated();
-        if (revision !== this.authStateRevision) {
-            return;
+        try {
+            const clientIdentity = await this.authClient.getIdentity();
+            const isAuthenticated = this.vouchesFor(clientIdentity, await this.authClient.isAuthenticated());
+            if (revision !== this.authStateRevision) {
+                return;
+            }
+            // The rule `authenticate()` applies. A caller-built client can outlive
+            // the manager it was first given to, and once its session has lapsed it
+            // still hands out the lapsed identity while no longer vouching for it.
+            // Nothing may be signed with that.
+            const identity = isAuthenticated || clientIdentity.getPrincipal().isAnonymous()
+                ? clientIdentity
+                : new AnonymousIdentity();
+            this.clientManager.updateAgent(identity);
+            this.updateState({
+                identity,
+                isAuthenticated,
+                isAuthenticating: false,
+                error: undefined,
+            });
+        }
+        finally {
+            this.markSessionChecked();
         }
-        this.clientManager.updateAgent(identity);
-        this.updateState({
-            identity,
-            isAuthenticated,
-            isAuthenticating: false,
-            error: undefined,
-        });
     }
     /** @internal Used by IdentityAttributesManager. */
     async ensureClient(options) {
@@ -515,7 +1120,7 @@ export class AuthenticationManager {
             await this.clientManager.initializeAgent();
         }
         this.clientManager.updateAgent(identity);
-        this.updateState({ identity, isAuthenticated, isAuthenticating: false });
+        this.publishSession({ identity, isAuthenticated, isAuthenticating: false });
     }
     /** @internal Used by IdentityAttributesManager. */
     setAuthenticating() {
@@ -525,6 +1130,32 @@ export class AuthenticationManager {
     setAuthenticationError(error) {
         this.updateState({ error, isAuthenticating: false });
     }
+    /** @internal Used by IdentityAttributesManager. */
+    settleAuthenticating() {
+        this.updateState({ isAuthenticating: false });
+    }
+    /**
+     * @internal Used by IdentityAttributesManager.
+     *
+     * Signs this manager out after the client lost its session under it, as when
+     * another tab signed out. The client itself is left alone: a v10 sign-out
+     * clears the storage every tab shares and takes the sign-in lock, so it would
+     * also end a sign-in the other tab has made or started since.
+     */
+    commitSignedOut() {
+        const identity = new AnonymousIdentity();
+        // As in `authenticate()`, an agent that is anonymous already is left as it
+        // is: its cache holds no signed-in user's data, and re-installing it would
+        // only refetch every query.
+        if (!this.agentIsAnonymous()) {
+            this.clientManager.updateAgent(identity);
+        }
+        this.publishSession({
+            identity,
+            isAuthenticated: false,
+            isAuthenticating: false,
+        });
+    }
     getDefaultIdentityProvider() {
         if (this.identityProvider) {
             return this.identityProvider;
@@ -538,16 +1169,68 @@ export class AuthenticationManager {
         // it, instead of opening a popup onto the gateway's verification-error page
         // and leaving the app waiting until the user closes it.
         if (this.localAuthorizePath === null) {
-            throw localInternetIdentityUnavailableError(canisterId);
+            throw localInternetIdentityUnavailableError(canisterId, this.authClientFlavor);
         }
         return localInternetIdentityProvider(Number(this.clientManager.agentHost?.port) || 4943, this.internetIdentityId, this.localAuthorizePath);
     }
+    /**
+     * Publishes what a check of the session found, then marks the session
+     * checked. In that order, so the auth hooks never take the state before it
+     * for the answer.
+     */
+    publishSession(newState) {
+        try {
+            this.updateState(newState);
+        }
+        finally {
+            this.markSessionChecked();
+        }
+    }
+    /**
+     * Records a change, then tells every subscriber about it.
+     *
+     * Every subscriber is called even when one throws, and the first error is
+     * rethrown once they all have been, so the caller still sees it. A throw
+     * used to end the loop: an app's subscriber registered at module scope comes
+     * before every `useAuth()`, and one that failed on a sign-in left them all
+     * showing `isAuthenticating: true` while the agent signed as the user.
+     *
+     * A subscriber that changes the state again from its callback has told every
+     * subscriber about that newer state, so the loop stops rather than deliver
+     * this older one after it. The list is copied first, so a subscriber added
+     * during the loop is first called for the next change. `ClientManager`
+     * notifies its subscribers the same way.
+     */
     updateState(newState) {
         if (isDev())
             console.debug("[ic-reactor] Updating Auth State:", newState);
-        this.authStateRevision += 1;
-        this.authStateValue = { ...this.authStateValue, ...newState };
-        this.authStateSubscribers.forEach((subscriber) => subscriber(this.authStateValue));
+        const revision = ++this.authStateRevision;
+        const state = { ...this.authStateValue, ...newState };
+        this.authStateValue = state;
+        let failure;
+        for (const subscriber of [...this.authStateSubscribers]) {
+            if (revision !== this.authStateRevision)
+                break;
+            try {
+                subscriber(state);
+            }
+            catch (error) {
+                failure ?? (failure = { error });
+            }
+        }
+        // The operation that held off `followClient()` is over: read the client
+        // again, once its caller has moved on.
+        const client = this.authClient;
+        if (this.clientChangedDuringOperation &&
+            !this.authStateValue.isAuthenticating &&
+            client) {
+            this.clientChangedDuringOperation = false;
+            void Promise.resolve()
+                .then(() => this.followClient(client))
+                .catch(() => undefined);
+        }
+        if (failure)
+            throw failure.error;
     }
     async loadAuthClientConstructor() {
         if (this.authClientConstructor) {
@@ -561,6 +1244,7 @@ export class AuthenticationManager {
                     throw new Error("@icp-sdk/auth/client did not export AuthClient");
                 }
                 this.authClientConstructor = AuthClient;
+                this.authClientFlavor = detectAuthClientFlavor(AuthClient);
                 return AuthClient;
             })
                 .catch((error) => {
@@ -607,6 +1291,70 @@ function importAuthClientModule() {
         return Promise.reject(error);
     }
 }
+/**
+ * Releases a client IC Reactor built and no longer uses. `dispose()` exists
+ * from `@icp-sdk/auth` v9; a v8 client has nothing to release. A throw is
+ * ignored: the client is being discarded either way.
+ */
+function disposeClient(client) {
+    try {
+        ;
+        client.dispose?.();
+    }
+    catch {
+        // Nothing more can be done for a client that failed to let go.
+    }
+}
+/** The wrapper each app `onIdle` gets; see {@link withSharedIdleCallback}. */
+const sharedIdleCallbacks = new WeakMap();
+/**
+ * Hands every v8 client the same wrapper around the app's `idleOptions.onIdle`.
+ *
+ * v8's `IdleManager` is one per page. Each client registers its `onIdle` on it
+ * once it signs in or restores a session, and a callback cannot be removed, so
+ * a manager that rebuilt its client for per-call options ran the app's `onIdle`
+ * once per client it had built on every idle period: three times after a
+ * sign-in, a one-click sign-in and another sign-in (#729). The `IdleManager`
+ * runs its callbacks in one synchronous loop, so the wrapper runs `onIdle` on
+ * the first call of a loop and skips the calls after it. The same function
+ * gets the same wrapper however many managers pass it.
+ */
+function withSharedIdleCallback(options) {
+    const onIdle = options?.idleOptions?.onIdle;
+    if (!onIdle) {
+        return options;
+    }
+    let shared = sharedIdleCallbacks.get(onIdle);
+    if (!shared) {
+        let running = false;
+        shared = () => {
+            if (running)
+                return undefined;
+            running = true;
+            // Cleared once the loop that called it is over, so the next idle period
+            // runs `onIdle` again.
+            queueMicrotask(() => {
+                running = false;
+            });
+            return onIdle();
+        };
+        sharedIdleCallbacks.set(onIdle, shared);
+    }
+    return { ...options, idleOptions: { ...options.idleOptions, onIdle: shared } };
+}
+/**
+ * Whether `identity` signs with a delegation chain that has expired, as a
+ * `DelegationIdentity` or `PartialDelegationIdentity` does once its session
+ * lapses. Read by shape rather than `instanceof`, which a second copy of
+ * `@icp-sdk/core` in the app would defeat.
+ */
+function hasExpiredDelegation(identity) {
+    const delegated = identity;
+    if (typeof delegated?.getDelegation !== "function") {
+        return false;
+    }
+    return !isDelegationValid(delegated.getDelegation());
+}
 function getAuthClientOptions(options) {
     if (!options) {
         return undefined;
@@ -621,6 +1369,7 @@ function getAuthClientOptions(options) {
         idleOptions: options.idleOptions,
         identity: options.identity,
         transport: options.transport,
+        disableBrowserActivity: options.disableBrowserActivity,
     };
 }
 function getAuthClientOpenIdProvider(openIdProvider) {
@@ -635,24 +1384,35 @@ function getAuthClientOpenIdProvider(openIdProvider) {
  * options (`storage`, `identity`, `idleOptions`) are compared by reference,
  * which is what module-scoped configuration produces.
  */
-function isSameAuthClientOptions(current, next) {
+/**
+ * Whether two option sets build the same client on the installed major.
+ *
+ * A key that major drops cannot change the client it builds, so a difference
+ * there must not cause a rebuild, which would throw away the prepared client:
+ * the v8-only `storage`, `keyType`, `idleOptions` and `identity` on v10, and the
+ * v10-only `disableBrowserActivity` on v8.
+ */
+function isSameAuthClientOptions(current, next, flavor) {
     if (current === next) {
         return true;
     }
     if (!current || !next) {
         return false;
     }
-    return (String(current.identityProvider ?? "") ===
+    const sameShared = String(current.identityProvider ?? "") ===
         String(next.identityProvider ?? "") &&
         current.windowOpenerFeatures === next.windowOpenerFeatures &&
         current.openIdProvider === next.openIdProvider &&
         String(current.derivationOrigin ?? "") ===
             String(next.derivationOrigin ?? "") &&
-        current.storage === next.storage &&
-        current.keyType === next.keyType &&
-        current.idleOptions === next.idleOptions &&
-        current.identity === next.identity &&
-        current.transport === next.transport);
+        current.transport === next.transport;
+    const sameForFlavor = flavor === "session"
+        ? current.disableBrowserActivity === next.disableBrowserActivity
+        : current.storage === next.storage &&
+            current.keyType === next.keyType &&
+            current.idleOptions === next.idleOptions &&
+            current.identity === next.identity;
+    return sameShared && sameForFlavor;
 }
 /**
  * Decides whether an Internet Identity provider carried by the `ic_env` cookie
@@ -745,9 +1505,18 @@ function getAuthenticationCanisterEnv() {
     if (!encodedValue) {
         return undefined;
     }
-    const env = Object.fromEntries(decodeURIComponent(encodedValue)
-        .split("&")
-        .map((entry) => {
+    // Anything able to set a cookie here can write this one, a sibling subdomain
+    // or, on localhost, an app on another port. A value that is not valid
+    // percent-encoding is ignored, as `safeGetCanisterEnv` ignores it: throwing
+    // would fail the constructor, and every `useAuth()` render with it.
+    let decodedValue;
+    try {
+        decodedValue = decodeURIComponent(encodedValue);
+    }
+    catch {
+        return undefined;
+    }
+    const env = Object.fromEntries(decodedValue.split("&").map((entry) => {
         const separatorIndex = entry.indexOf("=");
         return separatorIndex === -1
             ? [entry, ""]
@@ -761,6 +1530,7 @@ function getSignInOptions(options) {
     }
     return {
         maxTimeToLive: options.maxTimeToLive,
+        maxTimeToIdle: options.maxTimeToIdle,
         targets: options.targets,
     };
 }