@lushly-dev/afd-auth 1.0.0 → 2.1.0

package/dist/commands.js

@@ -3,20 +3,24 @@
  *
  * Requires optional peer dependencies: @lushly-dev/afd-server, zod
  */
-import { failure, success } from '@lushly-dev/afd-core';
-import { defineCommand } from '@lushly-dev/afd-server';
+// The transport-free entry keeps this module free of the MCP SDK and Node builtins.
+import { defineCommand, failure, success, } from '@lushly-dev/afd-server/define';
 import { z } from 'zod';
 import { AuthAdapterError } from './errors.js';
+import { areSessionStatesEqual } from './session-state.js';
+const DEFAULT_SIGN_IN_TIMEOUT_MS = 10_000;
+const SESSION_GET_SUGGESTION = 'Call auth-session-get to check whether the session is active';
 /**
  * Create AFD command definitions for auth operations.
  *
  * Returns ZodCommandDefinition[] that can be passed directly to `createMcpServer`.
  * Requires `@lushly-dev/afd-server` and `zod` as peer dependencies.
  */
-export function createAuthCommands(adapter) {
+export function createAuthCommands(adapter, options = {}) {
+    const signInTimeoutMs = options.signInTimeoutMs ?? DEFAULT_SIGN_IN_TIMEOUT_MS;
     const signIn = defineCommand({
         name: 'auth-sign-in',
-        description: 'Sign in with credentials or OAuth provider',
+        description: 'Sign in with credentials or OAuth provider. Returns the new session, or the current state with a warning when sign-in continues at the provider (redirect) or has not completed yet.',
         category: 'auth',
         tags: ['auth', 'session'],
         mutation: true,
@@ -35,12 +39,16 @@ export function createAuthCommands(adapter) {
             }),
         ]),
         async handler(input) {
+            const before = adapter.getSession();
+            // Subscribe before signIn() so a state change it triggers is not missed.
+            const watcher = watchAuthState(adapter);
             try {
-                await adapter.signIn(input);
-                const session = adapter.getSession();
-                return success(session, {
-                    reasoning: `Signed in via ${input.method}`,
-                });
+                const outcome = toOutcome(await adapter.signIn(input));
+                if (outcome?.kind === 'redirect' || outcome?.kind === 'pending') {
+                    return incompleteSignIn(adapter.getSession(), input, outcome);
+                }
+                const settled = await watcher.settle(before, signInTimeoutMs);
+                return settledSignIn(adapter.getSession(), settled, input, signInTimeoutMs);
             }
             catch (error) {
                 if (error instanceof AuthAdapterError) {
@@ -53,6 +61,9 @@ export function createAuthCommands(adapter) {
                 }
                 throw error;
             }
+            finally {
+                watcher.stop();
+            }
         },
     });
     const signOut = defineCommand({
@@ -103,4 +114,125 @@ export function createAuthCommands(adapter) {
     // Cast needed for heterogeneous generic command arrays (same pattern as todo example)
     return [signIn, signOut, sessionGet];
 }
+// ═══════════════════════════════════════════════════════════════════════════════
+// SIGN-IN RESULT
+// ═══════════════════════════════════════════════════════════════════════════════
+function describeMethod(input) {
+    return input.method === 'oauth' ? input.provider : 'credentials';
+}
+/**
+ * Read the adapter's sign-in outcome. Adapters written before SignInOutcome
+ * resolve with nothing, and untyped ones may resolve with a provider
+ * response; neither counts as an outcome.
+ */
+function toOutcome(value) {
+    if (typeof value !== 'object' || value === null || !('kind' in value))
+        return undefined;
+    switch (value.kind) {
+        case 'signed-in':
+            return { kind: 'signed-in' };
+        case 'pending':
+            return { kind: 'pending' };
+        case 'redirect':
+            return 'url' in value && typeof value.url === 'string'
+                ? { kind: 'redirect', url: value.url }
+                : { kind: 'redirect' };
+        default:
+            return undefined;
+    }
+}
+function incompleteSignIn(state, input, outcome) {
+    const via = describeMethod(input);
+    if (outcome.kind === 'redirect') {
+        return success(state, {
+            reasoning: `Not signed in yet: sign-in via ${via} continues at the provider, and the session starts after the provider redirects back`,
+            warnings: [
+                {
+                    code: 'SIGN_IN_REDIRECT',
+                    message: `Sign-in via ${via} continues at the provider`,
+                    severity: 'info',
+                    ...(outcome.url === undefined ? {} : { details: { url: outcome.url } }),
+                },
+            ],
+            suggestions: [
+                'Complete sign-in at the provider',
+                'After the provider redirects back, call auth-session-get to confirm the session',
+            ],
+        });
+    }
+    return success(state, {
+        reasoning: `Not signed in yet: sign-in via ${via} needs another step, such as email verification, before a session exists`,
+        warnings: [
+            {
+                code: 'SIGN_IN_PENDING',
+                message: `Sign-in via ${via} needs another step before a session exists`,
+                severity: 'warning',
+            },
+        ],
+        suggestions: ["Complete the provider's verification step", SESSION_GET_SUGGESTION],
+    });
+}
+function settledSignIn(current, settled, input, timeoutMs) {
+    const via = describeMethod(input);
+    const state = settled ?? current;
+    if (state.status === 'authenticated') {
+        return success(state, {
+            reasoning: `Signed in via ${via} as ${state.user.email}`,
+        });
+    }
+    if (settled?.status === 'unauthenticated') {
+        return failure({
+            code: 'PROVIDER_ERROR',
+            message: `Sign-in via ${via} completed, but the provider reports no active session`,
+            suggestion: 'Check that the provider can store its session (cookies or tokens) in this environment, then sign in again',
+            retryable: false,
+        });
+    }
+    return success(current, {
+        reasoning: `Not signed in yet: the sign-in via ${via} was accepted, but no session was confirmed within ${timeoutMs} ms (status: ${current.status})`,
+        warnings: [
+            {
+                code: 'SIGN_IN_PENDING',
+                message: `No session confirmed within ${timeoutMs} ms of sign-in`,
+                severity: 'warning',
+            },
+        ],
+        suggestions: [SESSION_GET_SUGGESTION],
+    });
+}
+function watchAuthState(adapter) {
+    let changed = false;
+    let onSettled = null;
+    const subscription = adapter.onAuthStateChange((state) => {
+        changed = true;
+        if (state.status !== 'loading' && onSettled) {
+            const resolve = onSettled;
+            onSettled = null;
+            resolve(state);
+        }
+    });
+    return {
+        settle(before, timeoutMs) {
+            const current = adapter.getSession();
+            if (current.status === 'authenticated' &&
+                (changed || !areSessionStatesEqual(before, current))) {
+                return Promise.resolve(current);
+            }
+            return new Promise((resolve) => {
+                const timer = setTimeout(() => {
+                    onSettled = null;
+                    resolve(null);
+                }, timeoutMs);
+                onSettled = (state) => {
+                    clearTimeout(timer);
+                    resolve(state);
+                };
+            });
+        },
+        stop() {
+            onSettled = null;
+            subscription.unsubscribe();
+        },
+    };
+}
 //# sourceMappingURL=commands.js.map

package/dist/commands.js.map

@@ -1 +1 @@
-{"version":3,"file":"commands.js","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,aAAa,EAA6B,MAAM,wBAAwB,CAAC;AAClF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAG/C;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAoB;IACtD,MAAM,MAAM,GAAG,aAAa,CAAC;QAC5B,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,4CAA4C;QACzD,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;QACzB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE;QAC7D,KAAK,EAAE,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;YACrC,CAAC,CAAC,MAAM,CAAC;gBACR,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;gBAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;gBACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;aAC/B,CAAC;YACF,CAAC,CAAC,MAAM,CAAC;gBACR,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;gBAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;gBACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;gBACtC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;aACjC,CAAC;SACF,CAAC;QACF,KAAK,CAAC,OAAO,CAAC,KAAK;YAClB,IAAI,CAAC;gBACJ,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;gBACrC,OAAO,OAAO,CAAC,OAAO,EAAE;oBACvB,SAAS,EAAE,iBAAiB,KAAK,CAAC,MAAM,EAAE;iBAC1C,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;oBACvC,OAAO,OAAO,CAAC;wBACd,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,UAAU,EAAE,KAAK,CAAC,UAAU;wBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;qBAC1B,CAAC,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACb,CAAC;QACF,CAAC;KACD,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,aAAa,CAAC;QAC7B,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,iCAAiC;QAC9C,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;QACzB,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,IAAI;QACjB,aAAa,EAAE,2BAA2B;QAC1C,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE;QAC7D,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACnB,KAAK,CAAC,OAAO;YACZ,IAAI,CAAC;gBACJ,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;gBACxB,OAAO,OAAO,CAAC,IAAI,EAAE;oBACpB,SAAS,EAAE,yBAAyB;iBACpC,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;oBACvC,OAAO,OAAO,CAAC;wBACd,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,UAAU,EAAE,KAAK,CAAC,UAAU;wBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;qBAC1B,CAAC,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACb,CAAC;QACF,CAAC;KACD,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,aAAa,CAAC;QAChC,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,8CAA8C;QAC3D,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;QACzB,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE;QAC5D,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACnB,KAAK,CAAC,OAAO;YACZ,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;YACrC,OAAO,OAAO,CAAC,OAAO,EAAE;gBACvB,SAAS,EAAE,wBAAwB,OAAO,CAAC,MAAM,EAAE;aACnD,CAAC,CAAC;QACJ,CAAC;KACD,CAAC,CAAC;IAEH,sFAAsF;IACtF,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAsC,CAAC;AAC3E,CAAC"}
+{"version":3,"file":"commands.js","sourceRoot":"","sources":["../src/commands.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,oFAAoF;AACpF,OAAO,EACN,aAAa,EACb,OAAO,EACP,OAAO,GAEP,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAa3D,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,MAAM,sBAAsB,GAAG,8DAA8D,CAAC;AAE9F;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CACjC,OAAoB,EACpB,UAA+B,EAAE;IAEjC,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,0BAA0B,CAAC;IAE9E,MAAM,MAAM,GAAG,aAAa,CAAC;QAC5B,IAAI,EAAE,cAAc;QACpB,WAAW,EACV,sLAAsL;QACvL,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;QACzB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE;QAC7D,KAAK,EAAE,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;YACrC,CAAC,CAAC,MAAM,CAAC;gBACR,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;gBAChC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE;gBACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;aAC/B,CAAC;YACF,CAAC,CAAC,MAAM,CAAC;gBACR,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;gBAC1B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;gBACpB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;gBACtC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;aACjC,CAAC;SACF,CAAC;QACF,KAAK,CAAC,OAAO,CAAC,KAAK;YAClB,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;YACpC,yEAAyE;YACzE,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;YACxC,IAAI,CAAC;gBACJ,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBACvD,IAAI,OAAO,EAAE,IAAI,KAAK,UAAU,IAAI,OAAO,EAAE,IAAI,KAAK,SAAS,EAAE,CAAC;oBACjE,OAAO,gBAAgB,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;gBAC/D,CAAC;gBACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;gBAC9D,OAAO,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC;YAC7E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;oBACvC,OAAO,OAAO,CAAC;wBACd,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,UAAU,EAAE,KAAK,CAAC,UAAU;wBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;qBAC1B,CAAC,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACb,CAAC;oBAAS,CAAC;gBACV,OAAO,CAAC,IAAI,EAAE,CAAC;YAChB,CAAC;QACF,CAAC;KACD,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,aAAa,CAAC;QAC7B,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,iCAAiC;QAC9C,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;QACzB,QAAQ,EAAE,IAAI;QACd,WAAW,EAAE,IAAI;QACjB,aAAa,EAAE,2BAA2B;QAC1C,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE;QAC7D,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACnB,KAAK,CAAC,OAAO;YACZ,IAAI,CAAC;gBACJ,MAAM,OAAO,CAAC,OAAO,EAAE,CAAC;gBACxB,OAAO,OAAO,CAAC,IAAI,EAAE;oBACpB,SAAS,EAAE,yBAAyB;iBACpC,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;oBACvC,OAAO,OAAO,CAAC;wBACd,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,OAAO,EAAE,KAAK,CAAC,OAAO;wBACtB,UAAU,EAAE,KAAK,CAAC,UAAU;wBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;qBAC1B,CAAC,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACb,CAAC;QACF,CAAC;KACD,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,aAAa,CAAC;QAChC,IAAI,EAAE,kBAAkB;QACxB,WAAW,EAAE,8CAA8C;QAC3D,QAAQ,EAAE,MAAM;QAChB,IAAI,EAAE,CAAC,MAAM,EAAE,SAAS,CAAC;QACzB,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE;QAC5D,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACnB,KAAK,CAAC,OAAO;YACZ,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;YACrC,OAAO,OAAO,CAAC,OAAO,EAAE;gBACvB,SAAS,EAAE,wBAAwB,OAAO,CAAC,MAAM,EAAE;aACnD,CAAC,CAAC;QACJ,CAAC;KACD,CAAC,CAAC;IAEH,sFAAsF;IACtF,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAsC,CAAC;AAC3E,CAAC;AAED,kFAAkF;AAClF,iBAAiB;AACjB,kFAAkF;AAElF,SAAS,cAAc,CAAC,KAAoB;IAC3C,OAAO,KAAK,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC;AAClE,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACxF,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,WAAW;YACf,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;QAC9B,KAAK,SAAS;YACb,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC5B,KAAK,UAAU;YACd,OAAO,KAAK,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,GAAG,KAAK,QAAQ;gBACrD,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE;gBACtC,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QACzB;YACC,OAAO,SAAS,CAAC;IACnB,CAAC;AACF,CAAC;AAED,SAAS,gBAAgB,CACxB,KAAuB,EACvB,KAAoB,EACpB,OAAiE;IAEjE,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACjC,OAAO,OAAO,CAAC,KAAK,EAAE;YACrB,SAAS,EAAE,kCAAkC,GAAG,sFAAsF;YACtI,QAAQ,EAAE;gBACT;oBACC,IAAI,EAAE,kBAAkB;oBACxB,OAAO,EAAE,eAAe,GAAG,4BAA4B;oBACvD,QAAQ,EAAE,MAAM;oBAChB,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;iBACvE;aACD;YACD,WAAW,EAAE;gBACZ,kCAAkC;gBAClC,iFAAiF;aACjF;SACD,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,EAAE;QACrB,SAAS,EAAE,kCAAkC,GAAG,0EAA0E;QAC1H,QAAQ,EAAE;YACT;gBACC,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,eAAe,GAAG,6CAA6C;gBACxE,QAAQ,EAAE,SAAS;aACnB;SACD;QACD,WAAW,EAAE,CAAC,2CAA2C,EAAE,sBAAsB,CAAC;KAClF,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACrB,OAAyB,EACzB,OAAgC,EAChC,KAAoB,EACpB,SAAiB;IAEjB,MAAM,GAAG,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,IAAI,OAAO,CAAC;IAEjC,IAAI,KAAK,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;QACtC,OAAO,OAAO,CAAC,KAAK,EAAE;YACrB,SAAS,EAAE,iBAAiB,GAAG,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE;SACxD,CAAC,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,EAAE,MAAM,KAAK,iBAAiB,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC;YACd,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,eAAe,GAAG,wDAAwD;YACnF,UAAU,EACT,2GAA2G;YAC5G,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,OAAO,CAAC,OAAO,EAAE;QACvB,SAAS,EAAE,sCAAsC,GAAG,sDAAsD,SAAS,gBAAgB,OAAO,CAAC,MAAM,GAAG;QACpJ,QAAQ,EAAE;YACT;gBACC,IAAI,EAAE,iBAAiB;gBACvB,OAAO,EAAE,+BAA+B,SAAS,gBAAgB;gBACjE,QAAQ,EAAE,SAAS;aACnB;SACD;QACD,WAAW,EAAE,CAAC,sBAAsB,CAAC;KACrC,CAAC,CAAC;AACJ,CAAC;AAgBD,SAAS,cAAc,CAAC,OAAoB;IAC3C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,SAAS,GAA+C,IAAI,CAAC;IACjE,MAAM,YAAY,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,KAAK,EAAE,EAAE;QACxD,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,SAAS,EAAE,CAAC;YAC7C,MAAM,OAAO,GAAG,SAAS,CAAC;YAC1B,SAAS,GAAG,IAAI,CAAC;YACjB,OAAO,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC;IACF,CAAC,CAAC,CAAC;IAEH,OAAO;QACN,MAAM,CAAC,MAAM,EAAE,SAAS;YACvB,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;YACrC,IACC,OAAO,CAAC,MAAM,KAAK,eAAe;gBAClC,CAAC,OAAO,IAAI,CAAC,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EACnD,CAAC;gBACF,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACjC,CAAC;YACD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC9B,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC7B,SAAS,GAAG,IAAI,CAAC;oBACjB,OAAO,CAAC,IAAI,CAAC,CAAC;gBACf,CAAC,EAAE,SAAS,CAAC,CAAC;gBACd,SAAS,GAAG,CAAC,KAAK,EAAE,EAAE;oBACrB,YAAY,CAAC,KAAK,CAAC,CAAC;oBACpB,OAAO,CAAC,KAAK,CAAC,CAAC;gBAChB,CAAC,CAAC;YACH,CAAC,CAAC,CAAC;QACJ,CAAC;QACD,IAAI;YACH,SAAS,GAAG,IAAI,CAAC;YACjB,YAAY,CAAC,WAAW,EAAE,CAAC;QAC5B,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -5,16 +5,17 @@
  */
 export type { BetterAuthAdapterOptions } from './adapters/better-auth.js';
 export { BetterAuthAdapter } from './adapters/better-auth.js';
-export type { ConvexAuthAdapterOptions } from './adapters/convex.js';
-export { useConvexAuthAdapter } from './adapters/convex.js';
 export type { MockAuthAdapterOptions } from './adapters/mock.js';
 export { MockAuthAdapter } from './adapters/mock.js';
-export { createAuthCommands } from './commands.js';
+export { AUTH_COMMAND_NAMES } from './command-names.js';
 export type { AuthErrorCode } from './errors.js';
 export { AuthAdapterError } from './errors.js';
+export type { ListenerErrorHandler } from './listeners.js';
+export type { AuthMiddlewareOptions } from './middleware.js';
 export { createAuthMiddleware } from './middleware.js';
 export type { SessionSyncOptions } from './session-sync.js';
 export { SessionSync } from './session-sync.js';
-export type { AuthAdapter, AuthSessionState, CredentialsSignInOptions, OAuthSignInOptions, Provider, Session, SignInOptions, User, } from './types.js';
+export type { SessionSyncMessage, SessionSyncMessageType } from './session-sync-message.js';
+export type { AuthAdapter, AuthenticatedSessionState, AuthSessionState, CredentialsSignInOptions, OAuthSignInOptions, Provider, Session, SignInOptions, SignInOutcome, User, } from './types.js';
 export { LOADING, UNAUTHENTICATED } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,YAAY,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,YAAY,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,YAAY,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAEnD,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,YAAY,EACX,WAAW,EACX,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,QAAQ,EACR,OAAO,EACP,aAAa,EACb,IAAI,GACJ,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAC1E,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,YAAY,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAExD,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,YAAY,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,YAAY,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAC7D,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,YAAY,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,2BAA2B,CAAC;AAE5F,YAAY,EACX,WAAW,EACX,yBAAyB,EACzB,gBAAgB,EAChB,wBAAwB,EACxB,kBAAkB,EAClB,QAAQ,EACR,OAAO,EACP,aAAa,EACb,aAAa,EACb,IAAI,GACJ,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -4,15 +4,11 @@
  * @packageDocumentation
  */
 export { BetterAuthAdapter } from './adapters/better-auth.js';
-export { useConvexAuthAdapter } from './adapters/convex.js';
-// Adapters
 export { MockAuthAdapter } from './adapters/mock.js';
-// Commands
-export { createAuthCommands } from './commands.js';
+// Built-in command names (always allowed by the middleware)
+export { AUTH_COMMAND_NAMES } from './command-names.js';
 export { AuthAdapterError } from './errors.js';
-// Middleware
 export { createAuthMiddleware } from './middleware.js';
-// Session sync
 export { SessionSync } from './session-sync.js';
 export { LOADING, UNAUTHENTICATED } from './types.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,WAAW;AACX,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,WAAW;AACX,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAGnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,aAAa;AACb,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAEvD,eAAe;AACf,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAYhD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,4DAA4D;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAK/C,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAGvD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAehD,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC"}

package/dist/listeners.d.ts

@@ -0,0 +1,39 @@
+/**
+ * @fileoverview Listener fan-out with per-listener error isolation
+ *
+ * Shared by every adapter and by SessionSync so that one throwing subscriber
+ * cannot stop later subscribers from seeing a state change (for example a
+ * sign-out), and cannot make the operation that triggered the change reject.
+ */
+/**
+ * Receives an error thrown by a subscriber. When no handler is configured the
+ * error is rethrown in a microtask, so it still reaches the host's uncaught
+ * error reporting (`window.onerror`, `process.on('uncaughtException')`).
+ */
+export type ListenerErrorHandler = (error: unknown) => void;
+/**
+ * Report a subscriber error without interrupting the caller.
+ *
+ * The error goes to `onListenerError` when one is given. If there is none, or
+ * the handler itself throws, the error is rethrown asynchronously.
+ */
+export declare function reportListenerError(error: unknown, onListenerError?: ListenerErrorHandler): void;
+/**
+ * A set of subscribers that are each called in isolation.
+ */
+export declare class ListenerSet<T> {
+    private readonly listeners;
+    private readonly onListenerError;
+    constructor(onListenerError?: ListenerErrorHandler);
+    get size(): number;
+    add(listener: (value: T) => void): {
+        unsubscribe: () => void;
+    };
+    /**
+     * Call every subscriber with `value`. A subscriber that throws is reported
+     * and skipped; the remaining subscribers still run and `emit` never throws.
+     */
+    emit(value: T): void;
+    clear(): void;
+}
+//# sourceMappingURL=listeners.d.ts.map

package/dist/listeners.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"listeners.d.ts","sourceRoot":"","sources":["../src/listeners.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH;;;;GAIG;AACH,MAAM,MAAM,oBAAoB,GAAG,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC;AAE5D;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAahG;AAED;;GAEG;AACH,qBAAa,WAAW,CAAC,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiC;IAC3D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAmC;gBAEvD,eAAe,CAAC,EAAE,oBAAoB;IAIlD,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,GAAG,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,CAAC,KAAK,IAAI,GAAG;QAAE,WAAW,EAAE,MAAM,IAAI,CAAA;KAAE;IAS9D;;;OAGG;IACH,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI;IAcpB,KAAK,IAAI,IAAI;CAGb"}

package/dist/listeners.js

@@ -0,0 +1,72 @@
+/**
+ * @fileoverview Listener fan-out with per-listener error isolation
+ *
+ * Shared by every adapter and by SessionSync so that one throwing subscriber
+ * cannot stop later subscribers from seeing a state change (for example a
+ * sign-out), and cannot make the operation that triggered the change reject.
+ */
+/**
+ * Report a subscriber error without interrupting the caller.
+ *
+ * The error goes to `onListenerError` when one is given. If there is none, or
+ * the handler itself throws, the error is rethrown asynchronously.
+ */
+export function reportListenerError(error, onListenerError) {
+    let unhandled = error;
+    if (onListenerError) {
+        try {
+            onListenerError(error);
+            return;
+        }
+        catch (handlerError) {
+            unhandled = handlerError;
+        }
+    }
+    queueMicrotask(() => {
+        throw unhandled;
+    });
+}
+/**
+ * A set of subscribers that are each called in isolation.
+ */
+export class ListenerSet {
+    listeners = new Set();
+    onListenerError;
+    constructor(onListenerError) {
+        this.onListenerError = onListenerError;
+    }
+    get size() {
+        return this.listeners.size;
+    }
+    add(listener) {
+        this.listeners.add(listener);
+        return {
+            unsubscribe: () => {
+                this.listeners.delete(listener);
+            },
+        };
+    }
+    /**
+     * Call every subscriber with `value`. A subscriber that throws is reported
+     * and skipped; the remaining subscribers still run and `emit` never throws.
+     */
+    emit(value) {
+        // Iterate a snapshot so a subscriber added during this emit waits for the
+        // next one, and re-check membership so a subscriber removed by an earlier
+        // one is not called.
+        for (const listener of Array.from(this.listeners)) {
+            if (!this.listeners.has(listener))
+                continue;
+            try {
+                listener(value);
+            }
+            catch (error) {
+                reportListenerError(error, this.onListenerError);
+            }
+        }
+    }
+    clear() {
+        this.listeners.clear();
+    }
+}
+//# sourceMappingURL=listeners.js.map

package/dist/listeners.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"listeners.js","sourceRoot":"","sources":["../src/listeners.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc,EAAE,eAAsC;IACzF,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,eAAe,EAAE,CAAC;QACrB,IAAI,CAAC;YACJ,eAAe,CAAC,KAAK,CAAC,CAAC;YACvB,OAAO;QACR,CAAC;QAAC,OAAO,YAAY,EAAE,CAAC;YACvB,SAAS,GAAG,YAAY,CAAC;QAC1B,CAAC;IACF,CAAC;IACD,cAAc,CAAC,GAAG,EAAE;QACnB,MAAM,SAAS,CAAC;IACjB,CAAC,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,WAAW;IACN,SAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC1C,eAAe,CAAmC;IAEnE,YAAY,eAAsC;QACjD,IAAI,CAAC,eAAe,GAAG,eAAe,CAAC;IACxC,CAAC;IAED,IAAI,IAAI;QACP,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED,GAAG,CAAC,QAA4B;QAC/B,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO;YACN,WAAW,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACjC,CAAC;SACD,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,IAAI,CAAC,KAAQ;QACZ,0EAA0E;QAC1E,0EAA0E;QAC1E,qBAAqB;QACrB,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAC5C,IAAI,CAAC;gBACJ,QAAQ,CAAC,KAAK,CAAC,CAAC;YACjB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,mBAAmB,CAAC,KAAK,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;YAClD,CAAC;QACF,CAAC;IACF,CAAC;IAED,KAAK;QACJ,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;CACD"}

package/dist/middleware.d.ts

@@ -2,9 +2,24 @@
  * @fileoverview Auth middleware for gating commands behind authentication
  */
 import type { CommandMiddleware } from '@lushly-dev/afd-core';
-import type { AuthAdapter } from './types.js';
+import type { AuthAdapter, AuthenticatedSessionState } from './types.js';
+declare module '@lushly-dev/afd-core' {
+    interface CommandContext {
+        /**
+         * The verified, unexpired session, set by `createAuthMiddleware`.
+         *
+         * The middleware sets or deletes this on every call, excluded commands
+         * included, so a value supplied by the caller never reaches a handler.
+         */
+        auth?: AuthenticatedSessionState;
+    }
+}
 export interface AuthMiddlewareOptions {
-    /** Command names that bypass auth checks */
+    /**
+     * Command names that bypass auth checks. The built-in auth commands
+     * (`auth-sign-in`, `auth-sign-out`, `auth-session-get`) always bypass them
+     * and do not need to be listed.
+     */
     exclude?: string[];
 }
 /**
@@ -12,7 +27,11 @@ export interface AuthMiddlewareOptions {
  *
  * - Unauthenticated → failure with UNAUTHORIZED
  * - Loading → failure with UNAUTHORIZED (retryable)
- * - Authenticated → injects `context.auth` and calls next()
+ * - Authenticated but `expiresAt` reached → failure with TOKEN_EXPIRED (retryable)
+ * - Authenticated → sets `context.auth` and calls next()
+ *
+ * Excluded commands, and the built-in auth commands, always run. They see
+ * `context.auth` only when the adapter holds an unexpired session.
  */
 export declare function createAuthMiddleware(adapter: AuthAdapter, options?: AuthMiddlewareOptions): CommandMiddleware;
 //# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,MAAM,WAAW,qBAAqB;IACrC,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,qBAA0B,GACjC,iBAAiB,CA+BnB"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAI9D,OAAO,KAAK,EAAE,WAAW,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAEzE,OAAO,QAAQ,sBAAsB,CAAC;IACrC,UAAU,cAAc;QACvB;;;;;WAKG;QACH,IAAI,CAAC,EAAE,yBAAyB,CAAC;KACjC;CACD;AAED,MAAM,WAAW,qBAAqB;IACrC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,oBAAoB,CACnC,OAAO,EAAE,WAAW,EACpB,OAAO,GAAE,qBAA0B,GACjC,iBAAiB,CA6CnB"}

package/dist/middleware.js

@@ -2,27 +2,33 @@
  * @fileoverview Auth middleware for gating commands behind authentication
  */
 import { failure } from '@lushly-dev/afd-core';
+import { AUTH_COMMAND_NAMES } from './command-names.js';
+import { isSessionExpired } from './session-state.js';
 /**
  * Create middleware that gates commands behind authentication.
  *
  * - Unauthenticated → failure with UNAUTHORIZED
  * - Loading → failure with UNAUTHORIZED (retryable)
- * - Authenticated → injects `context.auth` and calls next()
+ * - Authenticated but `expiresAt` reached → failure with TOKEN_EXPIRED (retryable)
+ * - Authenticated → sets `context.auth` and calls next()
+ *
+ * Excluded commands, and the built-in auth commands, always run. They see
+ * `context.auth` only when the adapter holds an unexpired session.
  */
 export function createAuthMiddleware(adapter, options = {}) {
-    const excluded = new Set(options.exclude ?? []);
+    const excluded = new Set([...AUTH_COMMAND_NAMES, ...(options.exclude ?? [])]);
     return async (commandName, _input, context, next) => {
-        if (excluded.has(commandName)) {
-            return next();
-        }
         const state = adapter.getSession();
-        if (state.status === 'unauthenticated') {
-            return failure({
-                code: 'UNAUTHORIZED',
-                message: 'Authentication required',
-                suggestion: 'Sign in to access this command',
-                retryable: false,
-            });
+        const verified = state.status === 'authenticated' && !isSessionExpired(state.session) ? state : undefined;
+        // Overwrite or remove whatever the caller put in the context.
+        if (verified) {
+            context.auth = verified;
+        }
+        else {
+            delete context.auth;
+        }
+        if (excluded.has(commandName) || verified) {
+            return next();
         }
         if (state.status === 'loading') {
             return failure({
@@ -32,8 +38,20 @@ export function createAuthMiddleware(adapter, options = {}) {
                 retryable: true,
             });
         }
-        context.auth = state;
-        return next();
+        if (state.status === 'authenticated') {
+            return failure({
+                code: 'TOKEN_EXPIRED',
+                message: 'Session has expired',
+                suggestion: 'Try again once the auth provider has refreshed the session, or sign in again with auth-sign-in',
+                retryable: true,
+            });
+        }
+        return failure({
+            code: 'UNAUTHORIZED',
+            message: 'Authentication required',
+            suggestion: 'Sign in with auth-sign-in to access this command',
+            retryable: false,
+        });
     };
 }
 //# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAQ/C;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CACnC,OAAoB,EACpB,UAAiC,EAAE;IAEnC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAEhD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACnD,IAAI,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,OAAO,IAAI,EAAE,CAAC;QACf,CAAC;QAED,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;QAEnC,IAAI,KAAK,CAAC,MAAM,KAAK,iBAAiB,EAAE,CAAC;YACxC,OAAO,OAAO,CAAC;gBACd,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,yBAAyB;gBAClC,UAAU,EAAE,gCAAgC;gBAC5C,SAAS,EAAE,KAAK;aAChB,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC;gBACd,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,iCAAiC;gBAC1C,UAAU,EAAE,mDAAmD;gBAC/D,SAAS,EAAE,IAAI;aACf,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC;QACrB,OAAO,IAAI,EAAE,CAAC;IACf,CAAC,CAAC;AACH,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAwBtD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CACnC,OAAoB,EACpB,UAAiC,EAAE;IAEnC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,kBAAkB,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAEtF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE;QACnD,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;QACnC,MAAM,QAAQ,GACb,KAAK,CAAC,MAAM,KAAK,eAAe,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QAE1F,8DAA8D;QAC9D,IAAI,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC;QACzB,CAAC;aAAM,CAAC;YACP,OAAO,OAAO,CAAC,IAAI,CAAC;QACrB,CAAC;QAED,IAAI,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,QAAQ,EAAE,CAAC;YAC3C,OAAO,IAAI,EAAE,CAAC;QACf,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAChC,OAAO,OAAO,CAAC;gBACd,IAAI,EAAE,cAAc;gBACpB,OAAO,EAAE,iCAAiC;gBAC1C,UAAU,EAAE,mDAAmD;gBAC/D,SAAS,EAAE,IAAI;aACf,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;YACtC,OAAO,OAAO,CAAC;gBACd,IAAI,EAAE,eAAe;gBACrB,OAAO,EAAE,qBAAqB;gBAC9B,UAAU,EACT,gGAAgG;gBACjG,SAAS,EAAE,IAAI;aACf,CAAC,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC;YACd,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,yBAAyB;YAClC,UAAU,EAAE,kDAAkD;YAC9D,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC,CAAC;AACH,CAAC"}

package/dist/react.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../src/react.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAGtE,YAAY,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,MAAM,WAAW,SAAS;IACzB,OAAO,EAAE,MAAM,WAAW,CAAC;IAC3B,UAAU,EAAE,MAAM,gBAAgB,CAAC;IACnC,OAAO,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;CAC3B;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,SAAS,CA4B/D"}
+{"version":3,"file":"react.d.ts","sourceRoot":"","sources":["../src/react.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAGtE,YAAY,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,MAAM,WAAW,SAAS;IACzB,OAAO,EAAE,MAAM,WAAW,CAAC;IAC3B,UAAU,EAAE,MAAM,gBAAgB,CAAC;IACnC,OAAO,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;CAC3B;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,WAAW,GAAG,SAAS,CAyC/D"}

package/dist/react.js

@@ -3,26 +3,40 @@
  *
  * Sub-path export: import from '@lushly-dev/afd-auth/react'
  */
-import { useCallback, useRef, useSyncExternalStore } from 'react';
+import { useCallback, useSyncExternalStore } from 'react';
+import { areSessionStatesEqual } from './session-state.js';
 import { LOADING } from './types.js';
 export { useConvexAuthAdapter } from './adapters/convex.js';
 /**
  * Create React hooks bound to an auth adapter instance.
  */
 export function createAuthHooks(adapter) {
+    // Providers may return a new object from getSession() on every read, but
+    // React's external-store contract requires the snapshot itself to be cached,
+    // so compare the session's values before replacing it.
+    let cachedSnapshot;
+    const readSnapshot = () => {
+        const nextSnapshot = adapter.getSession();
+        if (cachedSnapshot && areSessionStatesEqual(cachedSnapshot, nextSnapshot)) {
+            return cachedSnapshot;
+        }
+        cachedSnapshot = nextSnapshot;
+        return nextSnapshot;
+    };
     function useAuth() {
         return adapter;
     }
     function useSession() {
-        const snapshotRef = useRef(adapter.getSession());
         const subscribe = useCallback((onStoreChange) => {
-            const { unsubscribe } = adapter.onAuthStateChange((state) => {
-                snapshotRef.current = state;
+            const { unsubscribe } = adapter.onAuthStateChange(() => {
                 onStoreChange();
             });
             return unsubscribe;
         }, []);
-        const getSnapshot = useCallback(() => snapshotRef.current, []);
+        // Read the adapter at snapshot time. useSyncExternalStore checks this
+        // value again immediately after subscribing, which closes the render to
+        // subscription race where an auth event arrives between those phases.
+        const getSnapshot = useCallback(readSnapshot, []);
         const getServerSnapshot = useCallback(() => LOADING, []);
         return useSyncExternalStore(subscribe, getSnapshot, getServerSnapshot);
     }

package/dist/react.js.map

@@ -1 +1 @@
-{"version":3,"file":"react.js","sourceRoot":"","sources":["../src/react.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAElE,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAGrC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAQ5D;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAAoB;IACnD,SAAS,OAAO;QACf,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,SAAS,UAAU;QAClB,MAAM,WAAW,GAAG,MAAM,CAAmB,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QAEnE,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,aAAyB,EAAE,EAAE;YAC3D,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC3D,WAAW,CAAC,OAAO,GAAG,KAAK,CAAC;gBAC5B,aAAa,EAAE,CAAC;YACjB,CAAC,CAAC,CAAC;YACH,OAAO,WAAW,CAAC;QACpB,CAAC,EAAE,EAAE,CAAC,CAAC;QAEP,MAAM,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC/D,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAEzD,OAAO,oBAAoB,CAAC,SAAS,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;IACxE,CAAC;IAED,SAAS,OAAO;QACf,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC"}
+{"version":3,"file":"react.js","sourceRoot":"","sources":["../src/react.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAGrC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAQ5D;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,OAAoB;IACnD,yEAAyE;IACzE,6EAA6E;IAC7E,uDAAuD;IACvD,IAAI,cAA4C,CAAC;IACjD,MAAM,YAAY,GAAG,GAAqB,EAAE;QAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;QAC1C,IAAI,cAAc,IAAI,qBAAqB,CAAC,cAAc,EAAE,YAAY,CAAC,EAAE,CAAC;YAC3E,OAAO,cAAc,CAAC;QACvB,CAAC;QACD,cAAc,GAAG,YAAY,CAAC;QAC9B,OAAO,YAAY,CAAC;IACrB,CAAC,CAAC;IAEF,SAAS,OAAO;QACf,OAAO,OAAO,CAAC;IAChB,CAAC;IAED,SAAS,UAAU;QAClB,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,aAAyB,EAAE,EAAE;YAC3D,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,GAAG,EAAE;gBACtD,aAAa,EAAE,CAAC;YACjB,CAAC,CAAC,CAAC;YACH,OAAO,WAAW,CAAC;QACpB,CAAC,EAAE,EAAE,CAAC,CAAC;QAEP,sEAAsE;QACtE,wEAAwE;QACxE,sEAAsE;QACtE,MAAM,WAAW,GAAG,WAAW,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QAClD,MAAM,iBAAiB,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAEzD,OAAO,oBAAoB,CAAC,SAAS,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC;IACxE,CAAC;IAED,SAAS,OAAO;QACf,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC"}

package/dist/session-state.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @fileoverview Session state comparison and expiry helpers shared by the
+ * adapters, the middleware and the React hooks.
+ */
+import type { AuthSessionState, Session, User } from './types.js';
+export declare function areUsersEqual(left: User, right: User): boolean;
+/**
+ * Compare two session states by value. Providers may allocate a new state
+ * object on every read, so identity is not a usable signal for "changed".
+ */
+export declare function areSessionStatesEqual(left: AuthSessionState, right: AuthSessionState): boolean;
+/**
+ * Whether a session has reached its expiry. A session without `expiresAt`
+ * does not expire here, because its provider manages the token lifetime. An
+ * `expiresAt` that is not a valid date counts as expired, so a malformed value
+ * fails closed.
+ */
+export declare function isSessionExpired(session: Session, now?: number): boolean;
+//# sourceMappingURL=session-state.d.ts.map

package/dist/session-state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-state.d.ts","sourceRoot":"","sources":["../src/session-state.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAElE,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,OAAO,CAO9D;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAS9F;AASD;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO,CAIpF"}