@ic-reactor/react 3.7.0 → 3.9.0

package/src/auth/authentication-manager.ts

@@ -5,20 +5,25 @@ import type {
   AuthState,
   AuthenticationClientOptions,
   AuthenticationSignInOptions,
-} from "./types"
-import { ClientManager, isDev } from "@ic-reactor/core"
+} from "./types.js"
+import { ClientManager, isDev, isMainnetHost } from "@ic-reactor/core"
 
+import { Principal } from "@icp-sdk/core/principal"
 import { safeGetCanisterEnv } from "@icp-sdk/core/agent/canister-env"
 import {
   IC_INTERNET_IDENTITY_PROVIDER,
   INTERNET_IDENTITY_PROVIDER_ENV_KEY,
   localInternetIdentityProvider,
-} from "./constants"
+} from "./constants.js"
 
-export interface AuthenticationManagerParameters {
+export interface AuthenticationManagerParameters extends AuthenticationClientOptions {
   clientManager: ClientManager
+  /**
+   * Bring your own client instance. When provided, IC Reactor never constructs
+   * one and never applies the options below to it.
+   */
   authClient?: AuthClientLike
-  identityProvider?: string | URL
+  /** Canister ID of a locally deployed Internet Identity. */
   internetIdentityId?: string
 }
 
@@ -26,8 +31,6 @@ type AuthClientConstructor = {
   new (options?: AuthenticationClientOptions): AuthClientLike
 }
 
-const AUTH_CLIENT_MODULE = "@icp-sdk/auth/client"
-
 /**
  * Manages Internet Identity sign-in, session restoration, and authentication
  * state for a {@link ClientManager}.
@@ -49,6 +52,7 @@ export class AuthenticationManager {
     AuthClientConstructor | undefined
   >
   private authModuleMissing = false
+  private authClientOptions?: AuthenticationClientOptions
   private authStateValue: AuthState = {
     identity: null,
     isAuthenticating: false,
@@ -57,6 +61,7 @@ export class AuthenticationManager {
   }
   private readonly identityProvider?: string | URL
   private readonly internetIdentityId?: string
+  private readonly defaultClientOptions: AuthenticationClientOptions
   public readonly clientManager: ClientManager
 
   /** The current authentication state. */
@@ -69,19 +74,26 @@ export class AuthenticationManager {
     authClient,
     identityProvider,
     internetIdentityId,
+    ...clientOptions
   }: AuthenticationManagerParameters) {
     this.clientManager = clientManager
     const canisterEnv =
       typeof window !== "undefined" ? getAuthenticationCanisterEnv() : undefined
     this.identityProvider =
       identityProvider ||
-      canisterEnv?.[INTERNET_IDENTITY_PROVIDER_ENV_KEY] ||
-      canisterEnv?.["PUBLIC_INTERNET_IDENTITY_PROVIDER"]
+      acceptEnvIdentityProvider(
+        canisterEnv?.[INTERNET_IDENTITY_PROVIDER_ENV_KEY] ||
+          canisterEnv?.["PUBLIC_INTERNET_IDENTITY_PROVIDER"],
+        clientManager
+      )
     this.internetIdentityId =
       internetIdentityId ||
-      canisterEnv?.["internet_identity"] ||
-      canisterEnv?.["PUBLIC_CANISTER_ID:internet_identity"] ||
-      canisterEnv?.["CANISTER_ID_INTERNET_IDENTITY"]
+      acceptEnvCanisterId(
+        canisterEnv?.["internet_identity"] ||
+          canisterEnv?.["PUBLIC_CANISTER_ID:internet_identity"] ||
+          canisterEnv?.["CANISTER_ID_INTERNET_IDENTITY"]
+      )
+    this.defaultClientOptions = clientOptions
 
     if (authClient) {
       this.authClientWasProvided = true
@@ -111,28 +123,57 @@ export class AuthenticationManager {
   }
 
   /**
-   * Preloads and creates an AuthClient before a user gesture is needed.
+   * Preloads the auth module and creates an AuthClient ahead of time.
+   *
+   * Call (and await) this before wiring up a login button: it makes
+   * {@link login} and {@link IdentityAttributesManager.request} able to open
+   * the identity provider synchronously inside the click handler, which is
+   * what browser popup blockers and the ICRC-29 transport require.
    */
   public async prepareClient(options?: AuthenticationClientOptions) {
-    const clientOptions = getAuthClientOptions({
-      ...options,
-      identityProvider:
-        options?.identityProvider ?? this.getDefaultIdentityProvider(),
-    })
+    const clientOptions = this.resolveClientOptions(options)
 
-    if (
-      this.authClient &&
-      (!this.shouldRecreateClient(clientOptions) || this.authClientWasProvided)
-    ) {
+    if (this.authClient && !this.shouldRecreateClient(clientOptions)) {
       return this.authClient
     }
 
     return this.initializeClient(clientOptions)
   }
 
+  /**
+   * Returns an AuthClient without awaiting, or `undefined` when the auth
+   * module has not been loaded yet.
+   *
+   * Callers that must stay inside a user gesture use this instead of
+   * {@link ensureClient}; awaiting anything before opening the identity
+   * provider window loses the gesture.
+   */
+  public getPreparedClient(
+    options?: AuthenticationClientOptions
+  ): AuthClientLike | undefined {
+    return this.ensurePreparedClient(this.resolveClientOptions(options))
+  }
+
   public authenticate = async (): Promise<Identity | undefined> => {
     if (this.authState.isAuthenticated) {
-      return this.authState.identity || undefined
+      // Returning on the cached flag alone meant a delegation that expired
+      // mid-session was never re-observed: the UI kept rendering a signed-in
+      // state while every update call failed, and only a reload recovered.
+      // Re-ask the client, which reads the cached expiry rather than hitting
+      // storage. A throw here is treated as "still valid" so a transient
+      // failure cannot sign anyone out.
+      if (!this.authClient) {
+        return this.authState.identity || undefined
+      }
+      const stillValid = await Promise.resolve(
+        this.authClient.isAuthenticated()
+      ).catch(() => true)
+      if (stillValid) {
+        return this.authState.identity || undefined
+      }
+      // Expired — drop the stale flag and fall through to re-derive state,
+      // which resets the agent to the anonymous identity.
+      this.updateState({ isAuthenticated: false })
     }
     if (this.authPromise) {
       return this.authPromise
@@ -157,9 +198,7 @@ export class AuthenticationManager {
       try {
         if (!this.authClient) {
           const authClient = await this.initializeClient(
-            getAuthClientOptions({
-              identityProvider: this.getDefaultIdentityProvider(),
-            })
+            this.resolveClientOptions()
           )
           if (!authClient) {
             this.updateState({ isAuthenticating: false })
@@ -168,7 +207,12 @@ export class AuthenticationManager {
         }
         const identity = await this.authClient!.getIdentity()
         const isAuthenticated = await this.authClient!.isAuthenticated()
-        this.clientManager.updateAgent(identity)
+        // Restoring an anonymous session is the common first-load case; pushing
+        // it through updateAgent would invalidate the whole query cache on
+        // every mount for nothing.
+        if (isAuthenticated || !identity.getPrincipal().isAnonymous()) {
+          this.clientManager.updateAgent(identity)
+        }
         this.updateState({
           identity,
           isAuthenticated,
@@ -191,13 +235,10 @@ export class AuthenticationManager {
     let didCompleteSignIn = false
 
     try {
-      const identityProvider =
-        loginOptions?.identityProvider || this.getDefaultIdentityProvider()
-      const authClientOptions = getAuthClientOptions({
-        ...loginOptions,
-        identityProvider,
-      })
+      const authClientOptions = this.resolveClientOptions(loginOptions)
 
+      // Stays synchronous when `prepareClient()` has already loaded the auth
+      // module, so `signIn()` still runs inside the caller's click handler.
       if (!this.ensurePreparedClient(authClientOptions)) {
         await this.initializeClient(authClientOptions)
       }
@@ -208,7 +249,7 @@ export class AuthenticationManager {
 
       if (!this.authClient) {
         throw new Error(
-          "Authentication module is missing or failed to initialize. To use login, please install the auth package: npm install @icp-sdk/auth"
+          "Authentication module is missing or failed to initialize. To use login, install the optional auth peer: npm install @icp-sdk/auth. If it is already installed and your bundler could not resolve it, pass a pre-constructed client instead: new AuthenticationManager({ clientManager, authClient: new AuthClient(...) })"
         )
       }
 
@@ -251,18 +292,26 @@ export class AuthenticationManager {
   public logout = async (options?: { returnTo?: string }) => {
     if (!this.authClient) {
       throw new Error(
-        "Authentication module is missing or failed to initialize. To use logout, please install the auth package: npm install @icp-sdk/auth"
+        "Authentication module is missing or failed to initialize. To use logout, install the optional auth peer: npm install @icp-sdk/auth. If it is already installed and your bundler could not resolve it, pass a pre-constructed client instead: new AuthenticationManager({ clientManager, authClient: new AuthClient(...) })"
       )
     }
     this.updateState({ isAuthenticating: true, error: undefined })
-    await this.authClient.signOut(options)
-    const identity = await this.authClient.getIdentity()
-    this.clientManager.updateAgent(identity)
-    this.updateState({
-      identity,
-      isAuthenticated: false,
-      isAuthenticating: false,
-    })
+    try {
+      await this.authClient.signOut(options)
+      const identity = await this.authClient.getIdentity()
+      this.clientManager.updateAgent(identity)
+      this.updateState({
+        identity,
+        isAuthenticated: false,
+        isAuthenticating: false,
+      })
+    } catch (error) {
+      // Without this the manager was left with `isAuthenticating: true` and no
+      // recorded error, so a button disabled on `isAuthenticating` stayed stuck
+      // and nothing told the app why.
+      this.updateState({ error: error as Error, isAuthenticating: false })
+      throw error
+    }
   }
 
   private async initializeClient(
@@ -275,6 +324,7 @@ export class AuthenticationManager {
     }
 
     this.authClient = new AuthClient(options)
+    this.authClientOptions = options
     return this.authClient
   }
 
@@ -284,7 +334,7 @@ export class AuthenticationManager {
   ): Promise<Identity> {
     if (!this.authClient) {
       throw new Error(
-        "Authentication module is missing or failed to initialize. To use login, please install the auth package: npm install @icp-sdk/auth"
+        "Authentication module is missing or failed to initialize. To use login, install the optional auth peer: npm install @icp-sdk/auth. If it is already installed and your bundler could not resolve it, pass a pre-constructed client instead: new AuthenticationManager({ clientManager, authClient: new AuthClient(...) })"
       )
     }
 
@@ -309,10 +359,7 @@ export class AuthenticationManager {
   private ensurePreparedClient(
     options?: AuthenticationClientOptions
   ): AuthClientLike | undefined {
-    if (
-      this.authClient &&
-      (!this.shouldRecreateClient(options) || this.authClientWasProvided)
-    ) {
+    if (this.authClient && !this.shouldRecreateClient(options)) {
       return this.authClient
     }
 
@@ -322,11 +369,41 @@ export class AuthenticationManager {
     }
 
     this.authClient = new AuthClient(options)
+    this.authClientOptions = options
     return this.authClient
   }
 
+  /**
+   * Only rebuild the client when the effective options actually changed.
+   *
+   * Recreating on every call would discard the client warmed up by
+   * `prepareClient()` and register a duplicate sign-out callback on the
+   * shared IdleManager singleton each time.
+   */
   private shouldRecreateClient(options?: AuthenticationClientOptions): boolean {
-    return !this.authClientWasProvided && hasAuthClientOptions(options)
+    if (this.authClientWasProvided) {
+      return false
+    }
+    return !isSameAuthClientOptions(this.authClientOptions, options)
+  }
+
+  /**
+   * Merges constructor-level defaults with per-call overrides and fills in the
+   * network-appropriate identity provider.
+   */
+  private resolveClientOptions(
+    options?: AuthenticationClientOptions
+  ): AuthenticationClientOptions {
+    const merged = getAuthClientOptions({
+      ...this.defaultClientOptions,
+      ...options,
+    })
+
+    return {
+      ...merged,
+      identityProvider:
+        merged?.identityProvider ?? this.getDefaultIdentityProvider(),
+    }
   }
 
   private async syncStateFromClient(revision = this.authStateRevision) {
@@ -350,11 +427,7 @@ export class AuthenticationManager {
 
   /** @internal Used by IdentityAttributesManager. */
   public async ensureClient(options?: AuthenticationClientOptions) {
-    const clientOptions = getAuthClientOptions({
-      ...options,
-      identityProvider:
-        options?.identityProvider ?? this.getDefaultIdentityProvider(),
-    })
+    const clientOptions = this.resolveClientOptions(options)
     if (!this.ensurePreparedClient(clientOptions)) {
       await this.initializeClient(clientOptions)
     }
@@ -407,11 +480,7 @@ export class AuthenticationManager {
     }
 
     if (!this.authClientConstructorPromise) {
-      // Keep the optional auth peer out of non-auth bundles. Vite/Rollup/esbuild
-      // can otherwise try to resolve this package even when auth APIs are unused.
-      this.authClientConstructorPromise = import(
-        /* @vite-ignore */ AUTH_CLIENT_MODULE
-      )
+      this.authClientConstructorPromise = importAuthClientModule()
         .then((authModule) => {
           const AuthClient = (
             authModule as { AuthClient?: AuthClientConstructor }
@@ -441,6 +510,37 @@ export class AuthenticationManager {
   }
 }
 
+/**
+ * Loads the optional `@icp-sdk/auth` peer.
+ *
+ * The `try` is load-bearing, not defensive. webpack flags a dynamic import
+ * that sits lexically inside a `try` block as an *optional* dependency
+ * (`ImportParserPlugin`: `dep.optional = Boolean(parser.scope.inTry)`), and
+ * `Compilation` reports an unresolvable optional dependency as a build
+ * *warning* instead of a fatal "Module not found" error, emitting a module
+ * that rejects at runtime. Without the `try`, every webpack-based toolchain
+ * (webpack, `next build --webpack`, Rspack) fails to build for consumers who
+ * never touch authentication, because npm/pnpm do not install optional peers.
+ * Do not hoist this import out of the `try`, and do not wrap it in a nested
+ * function — webpack resets `inTry` at every function boundary.
+ *
+ * The specifier must also stay a literal: a variable specifier (or
+ * `@vite-ignore`) makes bundlers skip this import entirely, so the bare
+ * specifier survives into the browser, where it cannot be resolved without an
+ * import map and every login path fails. A literal lets Vite/Rollup/webpack
+ * code-split the optional peer, and lets them tree-shake it away for apps that
+ * never reference this class.
+ */
+function importAuthClientModule(): Promise<unknown> {
+  try {
+    return import("@icp-sdk/auth/client")
+  } catch (error) {
+    // Native ESM without an import map (and bundlers that neither resolve nor
+    // stub the specifier) throw synchronously rather than rejecting.
+    return Promise.reject(error)
+  }
+}
+
 function getAuthClientOptions(
   options?: AuthenticationClientOptions
 ): AuthenticationClientOptions | undefined {
@@ -452,6 +552,12 @@ function getAuthClientOptions(
     identityProvider: options.identityProvider,
     windowOpenerFeatures: options.windowOpenerFeatures,
     openIdProvider: getAuthClientOpenIdProvider(options.openIdProvider),
+    derivationOrigin: options.derivationOrigin,
+    storage: options.storage,
+    keyType: options.keyType,
+    idleOptions: options.idleOptions,
+    identity: options.identity,
+    transport: options.transport,
   }
 }
 
@@ -465,14 +571,111 @@ function getAuthClientOpenIdProvider(
     : undefined
 }
 
-function hasAuthClientOptions(options?: AuthenticationClientOptions): boolean {
-  return Boolean(
-    options?.identityProvider ||
-    options?.windowOpenerFeatures ||
-    options?.openIdProvider
+/**
+ * Compares the options two AuthClients would be built from. Object-valued
+ * options (`storage`, `identity`, `idleOptions`) are compared by reference,
+ * which is what module-scoped configuration produces.
+ */
+function isSameAuthClientOptions(
+  current?: AuthenticationClientOptions,
+  next?: AuthenticationClientOptions
+): boolean {
+  if (current === next) {
+    return true
+  }
+  if (!current || !next) {
+    return false
+  }
+
+  return (
+    String(current.identityProvider ?? "") ===
+      String(next.identityProvider ?? "") &&
+    current.windowOpenerFeatures === next.windowOpenerFeatures &&
+    current.openIdProvider === next.openIdProvider &&
+    String(current.derivationOrigin ?? "") ===
+      String(next.derivationOrigin ?? "") &&
+    current.storage === next.storage &&
+    current.keyType === next.keyType &&
+    current.idleOptions === next.idleOptions &&
+    current.identity === next.identity &&
+    current.transport === next.transport
   )
 }
 
+/**
+ * Decides whether an Internet Identity provider carried by the `ic_env` cookie
+ * may be used.
+ *
+ * The cookie is written by the replica serving a local or testnet deployment,
+ * and it is only authoritative in that setting: cookies are not origin-isolated
+ * the way script-accessible storage is, so on a mainnet deployment the identity
+ * provider is configuration that belongs in code rather than something read
+ * back out of the environment at runtime. `AuthClient` treats `identityProvider`
+ * as trusted developer configuration and does not re-check it.
+ *
+ * This mirrors the root-key guard in `ClientManager` (see `packages/core`):
+ * both values arrive from the same cookie and get the same treatment — adopted
+ * off-mainnet, ignored on mainnet in favour of the pinned default.
+ *
+ * A provider on the app's own origin is always accepted: it is exactly as
+ * trustworthy as the page doing the asking. Callers that need a custom provider
+ * on mainnet pass `identityProvider` explicitly.
+ */
+function acceptEnvIdentityProvider(
+  value: string | undefined,
+  clientManager: ClientManager
+): string | undefined {
+  if (!value) return undefined
+
+  const pageOrigin =
+    typeof window !== "undefined" ? window.location?.origin : undefined
+
+  let url: URL
+  try {
+    url = new URL(value, pageOrigin)
+  } catch {
+    return undefined
+  }
+
+  if (pageOrigin && url.origin === pageOrigin) {
+    return url.toString()
+  }
+
+  // `isMainnetHost` matches only the real boundary domains and defaults to true
+  // for an unknown host, so custom testnets keep working while anything that
+  // looks like mainnet fails closed. `clientManager.isLocal` would be wrong
+  // here: it treats every unrecognized hostname as "ic".
+  if (isMainnetHost(clientManager.agentHost?.toString())) {
+    console.warn(
+      `[ic-reactor] Ignoring the Internet Identity provider from the ic_env cookie ` +
+        `("${url.origin}") because this reactor targets mainnet, where the provider ` +
+        `is taken from configuration rather than the environment. Pass ` +
+        `\`identityProvider\` to AuthenticationManager to use a custom provider on mainnet.`
+    )
+    return undefined
+  }
+
+  return url.toString()
+}
+
+/**
+ * Accepts an Internet Identity canister ID from `ic_env` only when it parses as
+ * a principal.
+ *
+ * The value is interpolated into a provider URL
+ * (`http://<id>.localhost:<port>/authorize`), so anything that is not a bare
+ * principal can change the shape of that URL rather than just its subdomain.
+ * Only reachable on local networks, since mainnet uses the pinned provider.
+ */
+function acceptEnvCanisterId(value: string | undefined): string | undefined {
+  if (!value) return undefined
+  try {
+    return Principal.fromText(value).toText()
+  } catch {
+    return undefined
+  }
+}
+
 function getAuthenticationCanisterEnv(): Record<string, string> | undefined {
   const canisterEnv = safeGetCanisterEnv<Record<string, string>>()
   if (canisterEnv) {

package/src/auth/createIdentityAttributeHooks.ts

@@ -1,10 +1,10 @@
 import { useCallback, useState } from "react"
-import type { IdentityAttributesManager } from "./identity-attributes-manager"
+import type { IdentityAttributesManager } from "./identity-attributes-manager.js"
 import type {
   IdentityAttributeResult,
   RequestIdentityAttributesParameters,
   RequestOpenIdIdentityAttributesParameters,
-} from "./types"
+} from "./types.js"
 
 export interface UseIdentityAttributesReturn {
   requestAttributes: (

package/src/auth/identity-attributes-manager.ts

@@ -1,25 +1,33 @@
 import type {
-  AuthenticationClientOptions,
+  AuthClientLike,
+  IdentityAttributeNonce,
   IdentityAttributeResult,
   RequestIdentityAttributesParameters,
   RequestOpenIdIdentityAttributesParameters,
-} from "./types"
+} from "./types.js"
 
-import { AuthenticationManager } from "./authentication-manager"
+import { AuthenticationManager } from "./authentication-manager.js"
 import {
   decodeIdentityAttributeValues,
   identityAttributeKeys,
   normalizeSignedIdentityAttributes,
-} from "./identity-attributes"
+} from "./identity-attributes.js"
 
 /**
  * Requests and decodes signed identity attributes for an authenticated
  * Internet Identity session.
  *
+ * Await `authentication.prepareClient()` once during startup (the `useAuth`
+ * hook already does) so that {@link request} can open the identity provider
+ * window synchronously from a click handler.
+ *
  * @example
  * ```ts
  * const attributes = new IdentityAttributesManager(authentication)
- * const result = await attributes.request({ keys: ["name"] })
+ * const result = await attributes.request({
+ *   keys: ["name"],
+ *   nonce: () => fetchNonceFromCanister(),
+ * })
  * ```
  */
 export class IdentityAttributesManager {
@@ -28,37 +36,40 @@ export class IdentityAttributesManager {
   public request = async ({
     keys,
     nonce,
-    identityProvider,
-    openIdProvider,
-    windowOpenerFeatures,
     signIn = true,
     maxTimeToLive,
     targets,
+    ...clientOptions
   }: RequestIdentityAttributesParameters): Promise<IdentityAttributeResult> => {
-    const authClient = await this.authentication.ensureClient(
-      getAuthClientOptions({
-        identityProvider,
-        windowOpenerFeatures,
-        openIdProvider,
-      })
-    )
+    // Nothing may be awaited before `requestAttributes` / `signIn` are invoked:
+    // the ICRC-29 transport only opens the identity provider window while the
+    // browser still considers us inside the user gesture. `getPreparedClient`
+    // is synchronous whenever `prepareClient()` has run.
+    const preparedClient = this.authentication.getPreparedClient(clientOptions)
+    const authClient =
+      preparedClient ?? (await this.authentication.ensureClient(clientOptions))
 
     if (!authClient) {
       throw new Error(
-        "Authentication module is missing or failed to initialize. To request identity attributes, please install @icp-sdk/auth v7 or provide a compatible authClient."
+        "Authentication module is missing or failed to initialize. To request identity attributes, please install @icp-sdk/auth v7 or later, or provide a compatible authClient."
       )
     }
 
     this.authentication.setAuthenticating()
 
     try {
+      // `signIn` first: it opens the transport channel synchronously, and the
+      // attribute request then reuses that same channel and window.
       const identityPromise = signIn
         ? this.authentication.signInOrRecoverIdentity({
             maxTimeToLive,
             targets,
           })
         : Promise.resolve(authClient.getIdentity())
-      const requestPromise = authClient.requestAttributes({ keys, nonce })
+      const requestPromise = authClient.requestAttributes({
+        keys,
+        nonce: toAuthClientNonce(authClient, nonce),
+      })
 
       const [signedAttributes, identity] = await Promise.all([
         requestPromise,
@@ -88,40 +99,38 @@ export class IdentityAttributesManager {
     }
   }
 
-  public requestOpenId = async ({
-    nonce,
-    openIdProvider,
+  public requestOpenId = ({
     keys,
-    identityProvider,
-    windowOpenerFeatures,
-    signIn,
-    maxTimeToLive,
-    targets,
+    openIdProvider,
+    ...rest
   }: RequestOpenIdIdentityAttributesParameters): Promise<IdentityAttributeResult> => {
+    // Called (not awaited) synchronously so the user gesture is preserved.
     return this.request({
-      keys: identityAttributeKeys({ openIdProvider, keys }),
-      nonce,
-      identityProvider,
+      ...rest,
       openIdProvider,
-      windowOpenerFeatures,
-      signIn,
-      maxTimeToLive,
-      targets,
+      keys: identityAttributeKeys({ openIdProvider, keys }),
     })
   }
 }
 
-function getAuthClientOptions(
-  options: AuthenticationClientOptions
-): AuthenticationClientOptions {
-  return {
-    identityProvider: options.identityProvider,
-    windowOpenerFeatures: options.windowOpenerFeatures,
-    openIdProvider:
-      options.openIdProvider === "google" ||
-      options.openIdProvider === "apple" ||
-      options.openIdProvider === "microsoft"
-        ? options.openIdProvider
-        : undefined,
+/**
+ * Bridges the two `@icp-sdk/auth` nonce contracts.
+ *
+ * v8 takes `() => Promise<Uint8Array>` (it journals the value so a redirect
+ * flow replays the same bytes); v7 takes `Uint8Array | Promise<Uint8Array>`.
+ * Both open the transport channel synchronously for the deferred forms, so we
+ * always hand over the deferred shape the installed client understands.
+ * `memoize` only exists from v8 onwards, which makes it a reliable marker.
+ */
+function toAuthClientNonce(
+  authClient: AuthClientLike,
+  nonce: IdentityAttributeNonce
+): Uint8Array | Promise<Uint8Array> | (() => Promise<Uint8Array>) {
+  const supportsNonceThunk = typeof authClient.memoize === "function"
+
+  if (supportsNonceThunk) {
+    return () => Promise.resolve(typeof nonce === "function" ? nonce() : nonce)
   }
+
+  return Promise.resolve(typeof nonce === "function" ? nonce() : nonce)
 }

package/src/auth/identity-attributes.ts

@@ -4,8 +4,8 @@ import type {
   IdentityAttributeOpenIdProvider,
   IdentityAttributeValues,
   SignedIdentityAttributes,
-} from "./types"
-import { IC_INTERNET_IDENTITY_PROVIDER } from "./constants"
+} from "./types.js"
+import { IC_INTERNET_IDENTITY_PROVIDER } from "./constants.js"
 
 export const IDENTITY_ATTRIBUTES_PROVIDER = IC_INTERNET_IDENTITY_PROVIDER