@lushly-dev/afd-auth 1.0.0 → 2.0.0

package/README.md

@@ -0,0 +1,134 @@
+# @lushly-dev/afd-auth
+
+Provider-agnostic authentication adapters for AFD applications. The main
+entrypoint exposes the `AuthAdapter` contract, structured auth errors, the auth
+middleware, multi-tab session synchronization, and the Mock and Better Auth
+adapters.
+
+Auth command definitions are available from the optional commands subpath:
+
+```ts
+import { createAuthCommands } from '@lushly-dev/afd-auth/commands';
+
+const authCommands = createAuthCommands(adapter, { signInTimeoutMs: 10_000 });
+```
+
+React hooks are available from the optional `@lushly-dev/afd-auth/react`
+subpath:
+
+```ts
+import { createAuthHooks, useConvexAuthAdapter } from '@lushly-dev/afd-auth/react';
+
+const { useSession, useUser } = createAuthHooks(adapter);
+```
+
+The root import stays usable for server and non-React consumers without
+installing React, `@lushly-dev/afd-server`, or `zod`. Import
+`useConvexAuthAdapter` from `/react` and `createAuthCommands` from `/commands`
+when those integrations are needed.
+
+## Middleware
+
+```ts
+import { createAuthMiddleware } from '@lushly-dev/afd-auth';
+
+const middleware = createAuthMiddleware(adapter, { exclude: ['public-cmd'] });
+```
+
+| Adapter state | Result |
+| --- | --- |
+| `unauthenticated` | `UNAUTHORIZED`, not retryable |
+| `loading` | `UNAUTHORIZED`, retryable |
+| `authenticated`, `session.expiresAt` at or before now (or not a valid date) | `TOKEN_EXPIRED`, retryable |
+| `authenticated` | sets `context.auth` and runs the command |
+
+- The built-in commands `auth-sign-in`, `auth-sign-out` and `auth-session-get`
+  (`AUTH_COMMAND_NAMES`) always run, so a signed-out caller can sign in.
+  `exclude` adds more commands.
+- The middleware sets or deletes `context.auth` on every call, excluded
+  commands included. A handler never sees a `context.auth` that the caller
+  supplied.
+- Importing the package types `context.auth` as
+  `AuthenticatedSessionState | undefined` through a `CommandContext` module
+  augmentation.
+- `Session.expiresAt` is optional. A session without it (Convex) is never
+  rejected as expired; the provider manages the token lifetime.
+
+## Sign-in results
+
+`AuthAdapter.signIn()` may resolve with a `SignInOutcome`:
+`{ kind: 'signed-in' }`, `{ kind: 'redirect', url? }` (OAuth continues at the
+provider) or `{ kind: 'pending' }` (another step, such as email verification).
+Resolving with nothing is still allowed and counts as `signed-in`.
+
+`auth-sign-in` uses it to report what happened:
+
+- `redirect` / `pending`: returns the current (not yet signed-in) state with
+  "Not signed in yet" reasoning and a `SIGN_IN_REDIRECT` or `SIGN_IN_PENDING`
+  warning. The redirect URL is in the warning's `details.url`.
+- otherwise: waits for the next non-loading `onAuthStateChange`, up to
+  `signInTimeoutMs` (default 10 s), and returns the new session. If the wait
+  runs out it returns the current state with a `SIGN_IN_PENDING` warning; if
+  the adapter settles on no session it fails with `PROVIDER_ERROR`.
+
+## Adapters
+
+All adapters accept `onListenerError`. Each `onAuthStateChange` subscriber
+runs in its own `try/catch`: one that throws does not stop the others from
+seeing the change, and does not make `signIn()`/`signOut()` reject. The error
+goes to `onListenerError`, or is rethrown in a microtask when none is set.
+
+### Convex
+
+```ts
+const adapter = useConvexAuthAdapter({
+  useAuthActions,
+  useConvexAuth,
+  meQuery: () => useQuery(api.users.me),
+  passwordProviderId: 'password', // default: the stock Password() provider
+});
+```
+
+- Credentials sign-in calls `signIn(passwordProviderId, { email, password, flow: 'signIn' })`.
+  A missing password is rejected with `INVALID_CREDENTIALS`.
+- OAuth sign-in forwards `redirectTo`. `scopes` are rejected with
+  `PROVIDER_ERROR`: Convex configures scopes on the provider in
+  `convex/auth.ts`.
+- Errors use the same codes as Better Auth: `InvalidAccountId`,
+  `InvalidSecret` and `Invalid credentials` become `INVALID_CREDENTIALS`, fetch
+  failures `NETWORK_ERROR`, everything else `PROVIDER_ERROR`. Production
+  Convex deployments hide server error text unless it is thrown as a
+  `ConvexError`, so there bad credentials surface as `PROVIDER_ERROR`.
+- The state is `loading` while `meQuery` returns `undefined`, and
+  `unauthenticated` when it returns `null`.
+- The session has no `expiresAt`, because Convex refreshes its token
+  internally.
+- The hook returns the same adapter object on every render.
+
+### Better Auth
+
+`BetterAuthAdapter` forwards OAuth `scopes` and `redirectTo` (as
+`callbackURL`) to `signIn.social`, and reports its redirect URL as a
+`redirect` outcome.
+
+## Session sync
+
+`SessionSync` exchanges typed `SessionSyncMessage` values: `signed-in`,
+`signed-out`, `session-refreshed`, `profile-updated` (both with an optional
+`userId`) and `visibility-refresh`. Received payloads are validated and reduced
+to those fields; `notifySessionChanged()` throws a `TypeError` for an invalid
+message.
+
+Received messages are debounced per type by `debounceMs`. `signed-out` is
+delivered at once and cancels older messages still waiting, so it is never
+coalesced away.
+
+`SessionSync.acquireRefreshLock()` and `releaseRefreshLock()` provide a
+synchronous best-effort fallback for coordinating refreshes between tabs. The
+fallback records an instance owner and only that owner can release its current
+lock. `acquireRefreshLockAsync()` waits `lockCheckDelayMs` after writing the
+lock and reads it back before claiming it, which catches most write races. A
+lock timestamp more than one second in the future counts as stale.
+`localStorage` does not provide compare-and-swap, so acquisition remains
+non-atomic under a simultaneous cross-tab race; applications that require
+stronger serialization should use a provider-level refresh mechanism.

package/dist/adapters/better-auth.d.ts

@@ -4,20 +4,38 @@
  * Bridges better-auth client to the AuthAdapter interface.
  * Types are defined locally to avoid hard dependency on better-auth.
  */
-import type { AuthAdapter, AuthSessionState, SignInOptions } from '../types.js';
+import { type ListenerErrorHandler } from '../listeners.js';
+import type { AuthAdapter, AuthSessionState, SignInOptions, SignInOutcome } from '../types.js';
 /** Minimal interface for better-auth client — avoids hard import */
+interface BetterAuthErrorResponse {
+    message?: string;
+    status?: number;
+    statusText?: string;
+    code?: string;
+}
+/**
+ * The small portion of Better Auth's response contract used by this adapter.
+ * Better Auth reports provider failures as resolved `{ data, error }` values;
+ * they do not necessarily reject the promise.
+ */
+interface BetterAuthMethodResult {
+    data?: unknown | null;
+    error?: BetterAuthErrorResponse | null;
+}
+type BetterAuthMethodResponse = BetterAuthMethodResult | undefined;
 interface BetterAuthClient {
     signIn: {
         social: (params: {
             provider: string;
             callbackURL?: string;
-        }) => Promise<unknown>;
+            scopes?: string[];
+        }) => Promise<BetterAuthMethodResponse>;
         email: (params: {
             email: string;
             password: string;
-        }) => Promise<unknown>;
+        }) => Promise<BetterAuthMethodResponse>;
     };
-    signOut: () => Promise<unknown>;
+    signOut: () => Promise<BetterAuthMethodResponse>;
     useSession: () => {
         subscribe: (callback: (value: {
             data: BetterAuthSessionData | null;
@@ -44,14 +62,20 @@ interface BetterAuthSessionData {
 export interface BetterAuthAdapterOptions {
     /** better-auth client instance */
     client: BetterAuthClient;
+    /**
+     * Receives errors thrown by `onAuthStateChange` subscribers. Without it,
+     * they are rethrown in a microtask. Either way the other subscribers still
+     * run.
+     */
+    onListenerError?: ListenerErrorHandler;
 }
 export declare class BetterAuthAdapter implements AuthAdapter {
     private readonly client;
-    private listeners;
+    private readonly listeners;
     private currentState;
     private unsubscribeStore;
     constructor(options: BetterAuthAdapterOptions);
-    signIn(options: SignInOptions): Promise<void>;
+    signIn(options: SignInOptions): Promise<SignInOutcome>;
     signOut(): Promise<void>;
     getSession(): AuthSessionState;
     onAuthStateChange(callback: (state: AuthSessionState) => void): {
@@ -62,6 +86,10 @@ export declare class BetterAuthAdapter implements AuthAdapter {
      */
     dispose(): void;
     private setupSubscription;
+    private updateState;
+    private getResolvedProviderError;
+    private describeError;
+    private mapThrownError;
     private mapToState;
 }
 export {};

package/dist/adapters/better-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"better-auth.d.ts","sourceRoot":"","sources":["../../src/adapters/better-auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGhF,oEAAoE;AACpE,UAAU,gBAAgB;IACzB,MAAM,EAAE;QACP,MAAM,EAAE,CAAC,MAAM,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,WAAW,CAAC,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QACjF,KAAK,EAAE,CAAC,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;KACzE,CAAC;IACF,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,UAAU,EAAE,MAAM;QACjB,SAAS,EAAE,CACV,QAAQ,EAAE,CAAC,KAAK,EAAE;YAAE,IAAI,EAAE,qBAAqB,GAAG,IAAI,CAAC;YAAC,SAAS,EAAE,OAAO,CAAA;SAAE,KAAK,IAAI,KACjF,MAAM,IAAI,CAAC;QAChB,GAAG,EAAE,MAAM;YAAE,IAAI,EAAE,qBAAqB,GAAG,IAAI,CAAC;YAAC,SAAS,EAAE,OAAO,CAAA;SAAE,CAAC;KACtE,CAAC;CACF;AAED,UAAU,qBAAqB;IAC9B,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAClD,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACnE;AAED,MAAM,WAAW,wBAAwB;IACxC,kCAAkC;IAClC,MAAM,EAAE,gBAAgB,CAAC;CACzB;AAED,qBAAa,iBAAkB,YAAW,WAAW;IACpD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,SAAS,CAAgD;IACjE,OAAO,CAAC,YAAY,CAA6B;IACjD,OAAO,CAAC,gBAAgB,CAA6B;gBAEzC,OAAO,EAAE,wBAAwB;IAKvC,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAsB7C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAY9B,UAAU,IAAI,gBAAgB;IAI9B,iBAAiB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,GAAG;QAAE,WAAW,EAAE,MAAM,IAAI,CAAA;KAAE;IAS3F;;OAEG;IACH,OAAO,IAAI,IAAI;IAQf,OAAO,CAAC,iBAAiB;IAiBzB,OAAO,CAAC,UAAU;CA6BlB"}
+{"version":3,"file":"better-auth.d.ts","sourceRoot":"","sources":["../../src/adapters/better-auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,KAAK,oBAAoB,EAAe,MAAM,iBAAiB,CAAC;AAEzE,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAI/F,oEAAoE;AACpE,UAAU,uBAAuB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;GAIG;AACH,UAAU,sBAAsB;IAC/B,IAAI,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,uBAAuB,GAAG,IAAI,CAAC;CACvC;AAED,KAAK,wBAAwB,GAAG,sBAAsB,GAAG,SAAS,CAAC;AAEnE,UAAU,gBAAgB;IACzB,MAAM,EAAE;QACP,MAAM,EAAE,CAAC,MAAM,EAAE;YAChB,QAAQ,EAAE,MAAM,CAAC;YACjB,WAAW,CAAC,EAAE,MAAM,CAAC;YACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;SAClB,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;QACxC,KAAK,EAAE,CAAC,MAAM,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAA;SAAE,KAAK,OAAO,CAAC,wBAAwB,CAAC,CAAC;KAC1F,CAAC;IACF,OAAO,EAAE,MAAM,OAAO,CAAC,wBAAwB,CAAC,CAAC;IACjD,UAAU,EAAE,MAAM;QACjB,SAAS,EAAE,CACV,QAAQ,EAAE,CAAC,KAAK,EAAE;YAAE,IAAI,EAAE,qBAAqB,GAAG,IAAI,CAAC;YAAC,SAAS,EAAE,OAAO,CAAA;SAAE,KAAK,IAAI,KACjF,MAAM,IAAI,CAAC;QAChB,GAAG,EAAE,MAAM;YAAE,IAAI,EAAE,qBAAqB,GAAG,IAAI,CAAC;YAAC,SAAS,EAAE,OAAO,CAAA;SAAE,CAAC;KACtE,CAAC;CACF;AAED,UAAU,qBAAqB;IAC9B,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;IAClD,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACnE;AAED,MAAM,WAAW,wBAAwB;IACxC,kCAAkC;IAClC,MAAM,EAAE,gBAAgB,CAAC;IACzB;;;;OAIG;IACH,eAAe,CAAC,EAAE,oBAAoB,CAAC;CACvC;AAED,qBAAa,iBAAkB,YAAW,WAAW;IACpD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAmB;IAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgC;IAC1D,OAAO,CAAC,YAAY,CAA6B;IACjD,OAAO,CAAC,gBAAgB,CAA6B;gBAEzC,OAAO,EAAE,wBAAwB;IAMvC,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IA6BtD,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAY9B,UAAU,IAAI,gBAAgB;IAI9B,iBAAiB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,GAAG;QAAE,WAAW,EAAE,MAAM,IAAI,CAAA;KAAE;IAI3F;;OAEG;IACH,OAAO,IAAI,IAAI;IAQf,OAAO,CAAC,iBAAiB;IAgBzB,OAAO,CAAC,WAAW;IAQnB,OAAO,CAAC,wBAAwB;IAMhC,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,cAAc;IAWtB,OAAO,CAAC,UAAU;CA6BlB"}

package/dist/adapters/better-auth.js

@@ -5,57 +5,66 @@
  * Types are defined locally to avoid hard dependency on better-auth.
  */
 import { AuthAdapterError } from '../errors.js';
+import { ListenerSet } from '../listeners.js';
+import { areSessionStatesEqual } from '../session-state.js';
 import { LOADING, UNAUTHENTICATED } from '../types.js';
+import { isKnownNetworkFailure } from './provider-errors.js';
 export class BetterAuthAdapter {
     client;
-    listeners = new Set();
+    listeners;
     currentState = LOADING;
     unsubscribeStore = null;
     constructor(options) {
         this.client = options.client;
+        this.listeners = new ListenerSet(options.onListenerError);
         this.setupSubscription();
     }
     async signIn(options) {
         try {
+            let result;
             if (options.method === 'credentials') {
-                await this.client.signIn.email({
+                result = await this.client.signIn.email({
                     email: options.email,
                     password: options.password ?? '',
                 });
             }
             else {
-                await this.client.signIn.social({
+                result = await this.client.signIn.social({
                     provider: options.provider,
                     callbackURL: options.redirectTo,
+                    scopes: options.scopes,
                 });
             }
+            const providerError = this.getResolvedProviderError(result);
+            if (providerError) {
+                if (options.method === 'credentials' && providerError.status === 401) {
+                    throw AuthAdapterError.invalidCredentials();
+                }
+                throw AuthAdapterError.providerError('better-auth', this.describeError(providerError));
+            }
+            return toSignInOutcome(result);
         }
         catch (error) {
-            if (error instanceof AuthAdapterError)
-                throw error;
-            throw AuthAdapterError.providerError('better-auth', error instanceof Error ? error.message : String(error));
+            throw this.mapThrownError(error);
         }
     }
     async signOut() {
         try {
-            await this.client.signOut();
+            const result = await this.client.signOut();
+            const providerError = this.getResolvedProviderError(result);
+            if (providerError) {
+                throw AuthAdapterError.providerError('better-auth', this.describeError(providerError));
+            }
         }
         catch (error) {
-            if (error instanceof AuthAdapterError)
-                throw error;
-            throw AuthAdapterError.providerError('better-auth', error instanceof Error ? error.message : String(error));
+            throw this.mapThrownError(error);
         }
     }
     getSession() {
         return this.currentState;
     }
     onAuthStateChange(callback) {
-        this.listeners.add(callback);
-        return {
-            unsubscribe: () => {
-                this.listeners.delete(callback);
-            },
-        };
+        return this.listeners.add(callback);
     }
     /**
      * Clean up the nanostore subscription.
@@ -70,17 +79,44 @@ export class BetterAuthAdapter {
     setupSubscription() {
         // biome-ignore lint/correctness/useHookAtTopLevel: useSession is a better-auth store accessor, not a React hook
         const store = this.client.useSession();
+        // Read before subscribing so stores that invoke the callback immediately do
+        // not replace an equivalent initial snapshot with a new object.
+        this.currentState = this.mapToState(store.get());
         this.unsubscribeStore = store.subscribe((value) => {
-            const newState = this.mapToState(value);
-            if (newState.status !== this.currentState.status) {
-                this.currentState = newState;
-                for (const listener of this.listeners) {
-                    listener(newState);
-                }
-            }
+            this.updateState(value);
         });
-        // Initialize from current store value
-        this.currentState = this.mapToState(store.get());
+        // A store can change while subscribe() is being attached without calling
+        // the callback. Reconcile once more so the adapter never exposes a stale
+        // initial snapshot.
+        this.updateState(store.get());
+    }
+    updateState(value) {
+        const newState = this.mapToState(value);
+        if (areSessionStatesEqual(newState, this.currentState))
+            return;
+        this.currentState = newState;
+        this.listeners.emit(newState);
+    }
+    getResolvedProviderError(result) {
+        return result?.error ?? null;
+    }
+    describeError(error) {
+        if (error.message)
+            return error.message;
+        if (error.statusText)
+            return error.statusText;
+        if (error.code)
+            return error.code;
+        return error.status === undefined ? undefined : `status ${error.status}`;
+    }
+    mapThrownError(error) {
+        if (error instanceof AuthAdapterError)
+            return error;
+        const message = error instanceof Error ? error.message : String(error);
+        if (isKnownNetworkFailure(error, message)) {
+            return AuthAdapterError.networkError();
+        }
+        return AuthAdapterError.providerError('better-auth', message);
     }
     mapToState(value) {
         if (value.isPending) {
@@ -106,4 +142,16 @@ export class BetterAuthAdapter {
         };
     }
 }
+/**
+ * Better Auth answers a social sign-in with `{ url, redirect: true }` and
+ * navigates the browser there; the session exists only after the callback.
+ */
+function toSignInOutcome(result) {
+    const data = result?.data;
+    if (typeof data === 'object' && data !== null && 'redirect' in data && data.redirect === true) {
+        const url = 'url' in data && typeof data.url === 'string' ? data.url : undefined;
+        return url === undefined ? { kind: 'redirect' } : { kind: 'redirect', url };
+    }
+    return { kind: 'signed-in' };
+}
 //# sourceMappingURL=better-auth.js.map

package/dist/adapters/better-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"better-auth.js","sourceRoot":"","sources":["../../src/adapters/better-auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AA2BvD,MAAM,OAAO,iBAAiB;IACZ,MAAM,CAAmB;IAClC,SAAS,GAAG,IAAI,GAAG,EAAqC,CAAC;IACzD,YAAY,GAAqB,OAAO,CAAC;IACzC,gBAAgB,GAAwB,IAAI,CAAC;IAErD,YAAY,OAAiC;QAC5C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAsB;QAClC,IAAI,CAAC;YACJ,IAAI,OAAO,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;gBACtC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;oBAC9B,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;iBAChC,CAAC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACP,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;oBAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,WAAW,EAAE,OAAO,CAAC,UAAU;iBAC/B,CAAC,CAAC;YACJ,CAAC;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,gBAAgB;gBAAE,MAAM,KAAK,CAAC;YACnD,MAAM,gBAAgB,CAAC,aAAa,CACnC,aAAa,EACb,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACtD,CAAC;QACH,CAAC;IACF,CAAC;IAED,KAAK,CAAC,OAAO;QACZ,IAAI,CAAC;YACJ,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,gBAAgB;gBAAE,MAAM,KAAK,CAAC;YACnD,MAAM,gBAAgB,CAAC,aAAa,CACnC,aAAa,EACb,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACtD,CAAC;QACH,CAAC;IACF,CAAC;IAED,UAAU;QACT,OAAO,IAAI,CAAC,YAAY,CAAC;IAC1B,CAAC;IAED,iBAAiB,CAAC,QAA2C;QAC5D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO;YACN,WAAW,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACjC,CAAC;SACD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,OAAO;QACN,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACxB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAEO,iBAAiB;QACxB,gHAAgH;QAChH,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvC,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;YACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;gBAClD,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC;gBAC7B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;oBACvC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACpB,CAAC;YACF,CAAC;QACF,CAAC,CAAC,CAAC;QAEH,sCAAsC;QACtC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAClD,CAAC;IAEO,UAAU,CAAC,KAGlB;QACA,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,OAAO,CAAC;QAChB,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,eAAe,CAAC;QACxB,CAAC;QAED,OAAO;YACN,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE;gBACR,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;gBACzB,SAAS,EACR,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,YAAY,IAAI;oBAC3C,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;oBAC9B,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;aAC1C;YACD,IAAI,EAAE;gBACL,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACtB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;gBAC5B,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAC1B,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;aAC5B;SACD,CAAC;IACH,CAAC;CACD"}
+{"version":3,"file":"better-auth.js","sourceRoot":"","sources":["../../src/adapters/better-auth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAA6B,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAwD7D,MAAM,OAAO,iBAAiB;IACZ,MAAM,CAAmB;IACzB,SAAS,CAAgC;IAClD,YAAY,GAAqB,OAAO,CAAC;IACzC,gBAAgB,GAAwB,IAAI,CAAC;IAErD,YAAY,OAAiC;QAC5C,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,WAAW,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC1D,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAAsB;QAClC,IAAI,CAAC;YACJ,IAAI,MAAgC,CAAC;YACrC,IAAI,OAAO,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;gBACtC,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;oBACvC,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;iBAChC,CAAC,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACP,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;oBACxC,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,WAAW,EAAE,OAAO,CAAC,UAAU;oBAC/B,MAAM,EAAE,OAAO,CAAC,MAAM;iBACtB,CAAC,CAAC;YACJ,CAAC;YAED,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;YAC5D,IAAI,aAAa,EAAE,CAAC;gBACnB,IAAI,OAAO,CAAC,MAAM,KAAK,aAAa,IAAI,aAAa,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBACtE,MAAM,gBAAgB,CAAC,kBAAkB,EAAE,CAAC;gBAC7C,CAAC;gBACD,MAAM,gBAAgB,CAAC,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC;YACxF,CAAC;YACD,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;IACF,CAAC;IAED,KAAK,CAAC,OAAO;QACZ,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;YAC5D,IAAI,aAAa,EAAE,CAAC;gBACnB,MAAM,gBAAgB,CAAC,aAAa,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC;YACxF,CAAC;QACF,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAClC,CAAC;IACF,CAAC;IAED,UAAU;QACT,OAAO,IAAI,CAAC,YAAY,CAAC;IAC1B,CAAC;IAED,iBAAiB,CAAC,QAA2C;QAC5D,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,OAAO;QACN,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3B,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACxB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC9B,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAEO,iBAAiB;QACxB,gHAAgH;QAChH,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QAEvC,4EAA4E;QAC5E,gEAAgE;QAChE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,gBAAgB,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;YACjD,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;QACH,yEAAyE;QACzE,yEAAyE;QACzE,oBAAoB;QACpB,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/B,CAAC;IAEO,WAAW,CAAC,KAAiE;QACpF,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QACxC,IAAI,qBAAqB,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC;YAAE,OAAO;QAE/D,IAAI,CAAC,YAAY,GAAG,QAAQ,CAAC;QAC7B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/B,CAAC;IAEO,wBAAwB,CAC/B,MAAgC;QAEhC,OAAO,MAAM,EAAE,KAAK,IAAI,IAAI,CAAC;IAC9B,CAAC;IAEO,aAAa,CAAC,KAA8B;QACnD,IAAI,KAAK,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC,OAAO,CAAC;QACxC,IAAI,KAAK,CAAC,UAAU;YAAE,OAAO,KAAK,CAAC,UAAU,CAAC;QAC9C,IAAI,KAAK,CAAC,IAAI;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC;QAClC,OAAO,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,MAAM,EAAE,CAAC;IAC1E,CAAC;IAEO,cAAc,CAAC,KAAc;QACpC,IAAI,KAAK,YAAY,gBAAgB;YAAE,OAAO,KAAK,CAAC;QAEpD,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,IAAI,qBAAqB,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;YAC3C,OAAO,gBAAgB,CAAC,YAAY,EAAE,CAAC;QACxC,CAAC;QAED,OAAO,gBAAgB,CAAC,aAAa,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IAEO,UAAU,CAAC,KAGlB;QACA,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,OAAO,CAAC;QAChB,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,eAAe,CAAC;QACxB,CAAC;QAED,OAAO;YACN,MAAM,EAAE,eAAe;YACvB,OAAO,EAAE;gBACR,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE;gBACzB,SAAS,EACR,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,YAAY,IAAI;oBAC3C,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS;oBAC9B,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;aAC1C;YACD,IAAI,EAAE;gBACL,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBACtB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;gBAC5B,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;gBAC1B,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;aAC5B;SACD,CAAC;IACH,CAAC;CACD;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,MAAgC;IACxD,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,CAAC;IAC1B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,UAAU,IAAI,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC/F,MAAM,GAAG,GAAG,KAAK,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;QACjF,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC7E,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;AAC9B,CAAC"}

package/dist/adapters/convex.d.ts

@@ -4,25 +4,48 @@
  * Bridges @convex-dev/auth React hooks to the AuthAdapter interface.
  * This is a React hook — must be called inside a component.
  */
+import { type ListenerErrorHandler } from '../listeners.js';
 import type { AuthAdapter, User } from '../types.js';
+/** The part of `useAuthActions()` from `@convex-dev/auth/react` that the adapter calls. */
+export interface ConvexAuthActions {
+    /** Resolves with `{ signingIn, redirect? }` in @convex-dev/auth. */
+    signIn: (provider: string, params?: Record<string, string>) => Promise<unknown>;
+    signOut: () => Promise<void>;
+}
 export interface ConvexAuthAdapterOptions {
     /** Return value of useAuthActions() from @convex-dev/auth/react */
-    useAuthActions: () => {
-        signIn: (provider: string, params?: Record<string, unknown>) => Promise<void>;
-        signOut: () => Promise<void>;
-    };
+    useAuthActions: () => ConvexAuthActions;
     /** Return value of useConvexAuth() from convex/react */
     useConvexAuth: () => {
         isAuthenticated: boolean;
         isLoading: boolean;
     };
-    /** A Convex query hook that returns the current user, e.g. useQuery(api.users.me) */
+    /**
+     * A Convex query hook that returns the current user, e.g. useQuery(api.users.me).
+     * While it returns `undefined` (still loading) the adapter reports `loading`.
+     * `null` while Convex is authenticated (no user document) is reported as
+     * `unauthenticated`.
+     */
     meQuery: () => User | null | undefined;
+    /**
+     * Id of the Password provider used for `credentials` sign-in (default:
+     * `'password'`, the id of the stock `Password()` provider). Set it when the
+     * provider is configured with a custom `id`.
+     */
+    passwordProviderId?: string;
+    /**
+     * Receives errors thrown by `onAuthStateChange` subscribers. Without it,
+     * they are rethrown in a microtask. Either way the other subscribers still
+     * run.
+     */
+    onListenerError?: ListenerErrorHandler;
 }
 /**
  * React hook that creates an AuthAdapter backed by Convex.
  *
- * Must be called inside a ConvexProvider + ConvexAuthProvider tree.
+ * Must be called inside a ConvexProvider + ConvexAuthProvider tree. It returns
+ * the same adapter object on every render; the adapter always uses the latest
+ * actions and options passed to the hook.
  */
 export declare function useConvexAuthAdapter(options: ConvexAuthAdapterOptions): AuthAdapter;
 //# sourceMappingURL=convex.d.ts.map

package/dist/adapters/convex.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"convex.d.ts","sourceRoot":"","sources":["../../src/adapters/convex.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAmC,IAAI,EAAE,MAAM,aAAa,CAAC;AAGtF,MAAM,WAAW,wBAAwB;IACxC,mEAAmE;IACnE,cAAc,EAAE,MAAM;QACrB,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9E,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;KAC7B,CAAC;IACF,wDAAwD;IACxD,aAAa,EAAE,MAAM;QAAE,eAAe,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IACtE,qFAAqF;IACrF,OAAO,EAAE,MAAM,IAAI,GAAG,IAAI,GAAG,SAAS,CAAC;CACvC;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,wBAAwB,GAAG,WAAW,CA4EnF"}
+{"version":3,"file":"convex.d.ts","sourceRoot":"","sources":["../../src/adapters/convex.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,KAAK,oBAAoB,EAAoC,MAAM,iBAAiB,CAAC;AAE9F,OAAO,KAAK,EACX,WAAW,EAIX,IAAI,EACJ,MAAM,aAAa,CAAC;AAOrB,2FAA2F;AAC3F,MAAM,WAAW,iBAAiB;IACjC,oEAAoE;IACpE,MAAM,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAChF,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,wBAAwB;IACxC,mEAAmE;IACnE,cAAc,EAAE,MAAM,iBAAiB,CAAC;IACxC,wDAAwD;IACxD,aAAa,EAAE,MAAM;QAAE,eAAe,EAAE,OAAO,CAAC;QAAC,SAAS,EAAE,OAAO,CAAA;KAAE,CAAC;IACtE;;;;;OAKG;IACH,OAAO,EAAE,MAAM,IAAI,GAAG,IAAI,GAAG,SAAS,CAAC;IACvC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;OAIG;IACH,eAAe,CAAC,EAAE,oBAAoB,CAAC;CACvC;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,wBAAwB,GAAG,WAAW,CAmDnF"}