@lushly-dev/afd-auth 1.0.0 → 2.1.0

package/dist/session-state.js

@@ -0,0 +1,42 @@
+/**
+ * @fileoverview Session state comparison and expiry helpers shared by the
+ * adapters, the middleware and the React hooks.
+ */
+export function areUsersEqual(left, right) {
+    return (left.id === right.id &&
+        left.email === right.email &&
+        left.name === right.name &&
+        left.image === right.image);
+}
+/**
+ * Compare two session states by value. Providers may allocate a new state
+ * object on every read, so identity is not a usable signal for "changed".
+ */
+export function areSessionStatesEqual(left, right) {
+    if (left.status !== right.status)
+        return false;
+    if (left.status !== 'authenticated' || right.status !== 'authenticated')
+        return true;
+    return (left.session.id === right.session.id &&
+        isSameInstant(left.session.expiresAt, right.session.expiresAt) &&
+        areUsersEqual(left.user, right.user));
+}
+function isSameInstant(left, right) {
+    if (left instanceof Date && right instanceof Date) {
+        return Object.is(left.getTime(), right.getTime());
+    }
+    return Object.is(left, right);
+}
+/**
+ * Whether a session has reached its expiry. A session without `expiresAt`
+ * does not expire here, because its provider manages the token lifetime. An
+ * `expiresAt` that is not a valid date counts as expired, so a malformed value
+ * fails closed.
+ */
+export function isSessionExpired(session, now = Date.now()) {
+    if (session.expiresAt === undefined)
+        return false;
+    const expiresAt = new Date(session.expiresAt).getTime();
+    return !(expiresAt > now);
+}
+//# sourceMappingURL=session-state.js.map

package/dist/session-state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-state.js","sourceRoot":"","sources":["../src/session-state.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,MAAM,UAAU,aAAa,CAAC,IAAU,EAAE,KAAW;IACpD,OAAO,CACN,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE;QACpB,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK;QAC1B,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;QACxB,IAAI,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAC1B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAsB,EAAE,KAAuB;IACpF,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,IAAI,CAAC,MAAM,KAAK,eAAe,IAAI,KAAK,CAAC,MAAM,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IAErF,OAAO,CACN,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,KAAK,CAAC,OAAO,CAAC,EAAE;QACpC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;QAC9D,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CACpC,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAsB,EAAE,KAAuB;IACrE,IAAI,IAAI,YAAY,IAAI,IAAI,KAAK,YAAY,IAAI,EAAE,CAAC;QACnD,OAAO,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IAC1E,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;IACxD,OAAO,CAAC,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;AAC3B,CAAC"}

package/dist/session-sync-message.d.ts

@@ -0,0 +1,29 @@
+/**
+ * @fileoverview Messages exchanged between tabs by SessionSync
+ */
+/**
+ * A session change broadcast to other tabs. `visibility-refresh` is also
+ * raised locally when a tab becomes visible after being hidden for
+ * `visibilityRefreshMs`.
+ */
+export type SessionSyncMessage = {
+    type: 'signed-in';
+    userId?: string;
+} | {
+    type: 'signed-out';
+} | {
+    type: 'session-refreshed';
+} | {
+    type: 'profile-updated';
+    userId?: string;
+} | {
+    type: 'visibility-refresh';
+};
+export type SessionSyncMessageType = SessionSyncMessage['type'];
+/**
+ * Validate a payload received from another tab (or passed by an untyped
+ * caller). Returns a copy that holds only the known fields, or `null` when
+ * the payload is not a valid message.
+ */
+export declare function parseSessionSyncMessage(value: unknown): SessionSyncMessage | null;
+//# sourceMappingURL=session-sync-message.d.ts.map

package/dist/session-sync-message.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-sync-message.d.ts","sourceRoot":"","sources":["../src/session-sync-message.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAC3B;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACtC;IAAE,IAAI,EAAE,YAAY,CAAA;CAAE,GACtB;IAAE,IAAI,EAAE,mBAAmB,CAAA;CAAE,GAC7B;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAElC,MAAM,MAAM,sBAAsB,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;AAEhE;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,kBAAkB,GAAG,IAAI,CAiBjF"}

package/dist/session-sync-message.js

@@ -0,0 +1,27 @@
+/**
+ * @fileoverview Messages exchanged between tabs by SessionSync
+ */
+/**
+ * Validate a payload received from another tab (or passed by an untyped
+ * caller). Returns a copy that holds only the known fields, or `null` when
+ * the payload is not a valid message.
+ */
+export function parseSessionSyncMessage(value) {
+    if (typeof value !== 'object' || value === null || !('type' in value))
+        return null;
+    const userId = 'userId' in value ? value.userId : undefined;
+    if (userId !== undefined && typeof userId !== 'string')
+        return null;
+    switch (value.type) {
+        case 'signed-in':
+        case 'profile-updated':
+            return userId === undefined ? { type: value.type } : { type: value.type, userId };
+        case 'signed-out':
+        case 'session-refreshed':
+        case 'visibility-refresh':
+            return { type: value.type };
+        default:
+            return null;
+    }
+}
+//# sourceMappingURL=session-sync-message.js.map

package/dist/session-sync-message.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-sync-message.js","sourceRoot":"","sources":["../src/session-sync-message.ts"],"names":[],"mappings":"AAAA;;GAEG;AAgBH;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnF,MAAM,MAAM,GAAG,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5D,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAEpE,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,WAAW,CAAC;QACjB,KAAK,iBAAiB;YACrB,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QACnF,KAAK,YAAY,CAAC;QAClB,KAAK,mBAAmB,CAAC;QACzB,KAAK,oBAAoB;YACxB,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B;YACC,OAAO,IAAI,CAAC;IACd,CAAC;AACF,CAAC"}

package/dist/session-sync.d.ts

@@ -4,6 +4,7 @@
  * Uses BroadcastChannel (primary) with localStorage fallback.
  * All browser APIs are guarded with typeof checks for SSR safety.
  */
+import { type SessionSyncMessage } from './session-sync-message.js';
 export interface SessionSyncOptions {
     /** Channel name for BroadcastChannel (default: 'afd-auth-session') */
     channelName?: string;
@@ -13,9 +14,15 @@ export interface SessionSyncOptions {
     lockKey?: string;
     /** Lock timeout in ms (default: 10_000) */
     lockTimeoutMs?: number;
-    /** Double-check delay for lock acquisition in ms (default: 50) */
+    /**
+     * How long `acquireRefreshLockAsync()` waits after writing the lock before
+     * reading it back to confirm ownership, in ms (default: 50)
+     */
     lockCheckDelayMs?: number;
-    /** Debounce interval for state updates in ms (default: 100) */
+    /**
+     * Debounce interval for received messages of the same type, in ms
+     * (default: 100). `signed-out` is never debounced.
+     */
     debounceMs?: number;
     /** Re-check session after tab hidden for this long in ms (default: 300_000 = 5 min) */
     visibilityRefreshMs?: number;
@@ -23,21 +30,28 @@ export interface SessionSyncOptions {
 export declare class SessionSync {
     private readonly options;
     private channel;
-    private listeners;
-    private debounceTimer;
+    private readonly listeners;
+    private readonly pending;
     private hiddenAt;
     private visibilityHandler;
     private storageHandler;
     private disposed;
+    private readonly ownerId;
+    private heldLockId;
     constructor(options?: SessionSyncOptions);
     /**
      * Broadcast a session change to other tabs.
+     *
+     * @throws TypeError when `message` is not a valid {@link SessionSyncMessage}
      */
-    notifySessionChanged(data: unknown): void;
+    notifySessionChanged(message: SessionSyncMessage): void;
     /**
-     * Subscribe to session changes from other tabs.
+     * Subscribe to session changes from other tabs. Invalid payloads are
+     * dropped. Messages of one type are debounced by `debounceMs`; a
+     * `signed-out` message is delivered at once and cancels messages still
+     * waiting in the debounce, since it supersedes them.
      */
-    onSessionChanged(callback: (data: unknown) => void): {
+    onSessionChanged(callback: (message: SessionSyncMessage) => void): {
         unsubscribe: () => void;
     };
     /**
@@ -45,6 +59,13 @@ export declare class SessionSync {
      * Returns true if lock was acquired, false if another tab holds it.
      */
     acquireRefreshLock(): boolean;
+    /**
+     * Like {@link acquireRefreshLock}, but waits `lockCheckDelayMs` after
+     * writing the lock and reads it back before claiming it. A tab whose write
+     * raced another tab's then sees the other owner and declines. This narrows
+     * the race the synchronous check cannot see, but is still not atomic.
+     */
+    acquireRefreshLockAsync(): Promise<boolean>;
     /**
      * Release the refresh lock.
      */
@@ -54,8 +75,14 @@ export declare class SessionSync {
      */
     dispose(): void;
     private init;
+    private receive;
+    private cancelPending;
     private notifyViaStorage;
-    private debouncedNotify;
+    private writeRefreshLock;
+    private isLockLive;
+    private confirmRefreshLock;
+    private removeRefreshLock;
     private hasLocalStorage;
+    private readRefreshLock;
 }
 //# sourceMappingURL=session-sync.d.ts.map

package/dist/session-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-sync.d.ts","sourceRoot":"","sources":["../src/session-sync.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,kBAAkB;IAClC,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kEAAkE;IAClE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uFAAuF;IACvF,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAYD,qBAAa,WAAW;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA+B;IACvD,OAAO,CAAC,OAAO,CAAiC;IAChD,OAAO,CAAC,SAAS,CAAsC;IACvD,OAAO,CAAC,aAAa,CAA8C;IACnE,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,iBAAiB,CAA6B;IACtD,OAAO,CAAC,cAAc,CAA4C;IAClE,OAAO,CAAC,QAAQ,CAAS;gBAEb,OAAO,GAAE,kBAAuB;IAK5C;;OAEG;IACH,oBAAoB,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAezC;;OAEG;IACH,gBAAgB,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,IAAI,GAAG;QAAE,WAAW,EAAE,MAAM,IAAI,CAAA;KAAE;IAShF;;;OAGG;IACH,kBAAkB,IAAI,OAAO;IAiB7B;;OAEG;IACH,kBAAkB,IAAI,IAAI;IAK1B;;OAEG;IACH,OAAO,IAAI,IAAI;IA0Bf,OAAO,CAAC,IAAI;IA6CZ,OAAO,CAAC,gBAAgB;IAWxB,OAAO,CAAC,eAAe;IAYvB,OAAO,CAAC,eAAe;CAOvB"}
+{"version":3,"file":"session-sync.d.ts","sourceRoot":"","sources":["../src/session-sync.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAEN,KAAK,kBAAkB,EAEvB,MAAM,2BAA2B,CAAC;AAEnC,MAAM,WAAW,kBAAkB;IAClC,sEAAsE;IACtE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oEAAoE;IACpE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uFAAuF;IACvF,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAqCD,qBAAa,WAAW;IACvB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA+B;IACvD,OAAO,CAAC,OAAO,CAAiC;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAyC;IACnE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAoE;IAC5F,OAAO,CAAC,QAAQ,CAAuB;IACvC,OAAO,CAAC,iBAAiB,CAA6B;IACtD,OAAO,CAAC,cAAc,CAA4C;IAClE,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmB;IAC3C,OAAO,CAAC,UAAU,CAAuB;gBAE7B,OAAO,GAAE,kBAAuB;IAK5C;;;;OAIG;IACH,oBAAoB,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI;IAmBvD;;;;;OAKG;IACH,gBAAgB,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,kBAAkB,KAAK,IAAI,GAAG;QAAE,WAAW,EAAE,MAAM,IAAI,CAAA;KAAE;IAI9F;;;OAGG;IACH,kBAAkB,IAAI,OAAO;IAU7B;;;;;OAKG;IACG,uBAAuB,IAAI,OAAO,CAAC,OAAO,CAAC;IAYjD;;OAEG;IACH,kBAAkB,IAAI,IAAI;IAQ1B;;OAEG;IACH,OAAO,IAAI,IAAI;IAuBf,OAAO,CAAC,IAAI;IA4CZ,OAAO,CAAC,OAAO;IAsBf,OAAO,CAAC,aAAa;IAKrB,OAAO,CAAC,gBAAgB;IAWxB,OAAO,CAAC,gBAAgB;IAyBxB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,kBAAkB;IAe1B,OAAO,CAAC,iBAAiB;IAgBzB,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,eAAe;CAqBvB"}

package/dist/session-sync.js

@@ -4,6 +4,8 @@
  * Uses BroadcastChannel (primary) with localStorage fallback.
  * All browser APIs are guarded with typeof checks for SSR safety.
  */
+import { ListenerSet } from './listeners.js';
+import { parseSessionSyncMessage, } from './session-sync-message.js';
 const DEFAULTS = {
     channelName: 'afd-auth-session',
     storageKey: 'afd-auth-sync',
@@ -13,82 +15,108 @@ const DEFAULTS = {
     debounceMs: 100,
     visibilityRefreshMs: 300_000,
 };
+/**
+ * How far in the future a lock timestamp may be and still count as live.
+ * Tabs share one clock, so a later timestamp comes from a clock change or a
+ * corrupted value and must not block refresh until the clock catches up.
+ */
+const LOCK_CLOCK_SKEW_MS = 1_000;
+let ownerSequence = 0;
 export class SessionSync {
     options;
     channel = null;
-    listeners = new Set();
-    debounceTimer = null;
+    listeners = new ListenerSet();
+    pending = new Map();
     hiddenAt = null;
     visibilityHandler = null;
     storageHandler = null;
     disposed = false;
+    ownerId = createOwnerId();
+    heldLockId = null;
     constructor(options = {}) {
         this.options = { ...DEFAULTS, ...options };
         this.init();
     }
     /**
      * Broadcast a session change to other tabs.
+     *
+     * @throws TypeError when `message` is not a valid {@link SessionSyncMessage}
      */
-    notifySessionChanged(data) {
+    notifySessionChanged(message) {
+        const valid = parseSessionSyncMessage(message);
+        if (!valid) {
+            throw new TypeError(`Invalid session sync message: ${JSON.stringify(message)}`);
+        }
         if (this.disposed)
             return;
         if (this.channel) {
             try {
-                this.channel.postMessage(data);
+                this.channel.postMessage(valid);
                 return;
             }
             catch {
                 // Fall through to localStorage
             }
         }
-        this.notifyViaStorage(data);
+        this.notifyViaStorage(valid);
     }
     /**
-     * Subscribe to session changes from other tabs.
+     * Subscribe to session changes from other tabs. Invalid payloads are
+     * dropped. Messages of one type are debounced by `debounceMs`; a
+     * `signed-out` message is delivered at once and cancels messages still
+     * waiting in the debounce, since it supersedes them.
      */
     onSessionChanged(callback) {
-        this.listeners.add(callback);
-        return {
-            unsubscribe: () => {
-                this.listeners.delete(callback);
-            },
-        };
+        return this.listeners.add(callback);
     }
     /**
      * Attempt to acquire a refresh lock to coordinate token refresh across tabs.
      * Returns true if lock was acquired, false if another tab holds it.
      */
     acquireRefreshLock() {
-        if (!this.hasLocalStorage())
-            return true;
-        const now = Date.now();
-        const existing = localStorage.getItem(this.options.lockKey);
-        if (existing) {
-            const timestamp = Number.parseInt(existing, 10);
-            if (now - timestamp < this.options.lockTimeoutMs) {
-                return false; // Another tab holds a valid lock
-            }
+        const attempt = this.writeRefreshLock();
+        if (attempt.kind !== 'written')
+            return attempt.kind === 'uncoordinated';
+        // localStorage has no compare-and-swap. The immediate read makes the
+        // synchronous fallback best-effort: if another tab won the write race,
+        // this instance declines the lock. It cannot make the operation atomic.
+        return this.confirmRefreshLock(attempt.lockId);
+    }
+    /**
+     * Like {@link acquireRefreshLock}, but waits `lockCheckDelayMs` after
+     * writing the lock and reads it back before claiming it. A tab whose write
+     * raced another tab's then sees the other owner and declines. This narrows
+     * the race the synchronous check cannot see, but is still not atomic.
+     */
+    async acquireRefreshLockAsync() {
+        const attempt = this.writeRefreshLock();
+        if (attempt.kind !== 'written')
+            return attempt.kind === 'uncoordinated';
+        await new Promise((resolve) => setTimeout(resolve, this.options.lockCheckDelayMs));
+        if (this.disposed) {
+            this.removeRefreshLock(attempt.lockId);
+            return false;
         }
-        localStorage.setItem(this.options.lockKey, String(now));
-        return true;
+        return this.confirmRefreshLock(attempt.lockId);
     }
     /**
      * Release the refresh lock.
      */
     releaseRefreshLock() {
-        if (!this.hasLocalStorage())
-            return;
-        localStorage.removeItem(this.options.lockKey);
+        const heldLockId = this.heldLockId;
+        this.heldLockId = null;
+        // A stale owner must never retain permission to release a later owner's
+        // lock through this instance.
+        if (heldLockId !== null)
+            this.removeRefreshLock(heldLockId);
     }
     /**
      * Clean up all resources.
      */
     dispose() {
+        this.releaseRefreshLock();
         this.disposed = true;
-        if (this.debounceTimer !== null) {
-            clearTimeout(this.debounceTimer);
-            this.debounceTimer = null;
-        }
+        this.cancelPending();
         if (this.channel) {
             this.channel.close();
             this.channel = null;
@@ -109,7 +137,7 @@ export class SessionSync {
             try {
                 this.channel = new BroadcastChannel(this.options.channelName);
                 this.channel.onmessage = (event) => {
-                    this.debouncedNotify(event.data);
+                    this.receive(event.data);
                 };
             }
             catch {
@@ -121,8 +149,7 @@ export class SessionSync {
             this.storageHandler = (e) => {
                 if (e.key === this.options.storageKey && e.newValue) {
                     try {
-                        const data = JSON.parse(e.newValue);
-                        this.debouncedNotify(data);
+                        this.receive(JSON.parse(e.newValue));
                     }
                     catch {
                         // Ignore malformed data
@@ -141,18 +168,42 @@ export class SessionSync {
                     const elapsed = Date.now() - this.hiddenAt;
                     this.hiddenAt = null;
                     if (elapsed >= this.options.visibilityRefreshMs) {
-                        this.debouncedNotify({ type: 'visibility-refresh' });
+                        this.receive({ type: 'visibility-refresh' });
                     }
                 }
             };
             document.addEventListener('visibilitychange', this.visibilityHandler);
         }
     }
-    notifyViaStorage(data) {
+    receive(payload) {
+        if (this.disposed)
+            return;
+        const message = parseSessionSyncMessage(payload);
+        if (!message)
+            return;
+        if (message.type === 'signed-out') {
+            this.cancelPending();
+            this.listeners.emit(message);
+            return;
+        }
+        const existing = this.pending.get(message.type);
+        if (existing !== undefined)
+            clearTimeout(existing);
+        this.pending.set(message.type, setTimeout(() => {
+            this.pending.delete(message.type);
+            this.listeners.emit(message);
+        }, this.options.debounceMs));
+    }
+    cancelPending() {
+        for (const timer of this.pending.values())
+            clearTimeout(timer);
+        this.pending.clear();
+    }
+    notifyViaStorage(message) {
         if (!this.hasLocalStorage())
             return;
         try {
-            localStorage.setItem(this.options.storageKey, JSON.stringify(data));
+            localStorage.setItem(this.options.storageKey, JSON.stringify(message));
             // Clean up immediately — the storage event fires in other tabs
             localStorage.removeItem(this.options.storageKey);
         }
@@ -160,16 +211,59 @@ export class SessionSync {
             // localStorage full or unavailable
         }
     }
-    debouncedNotify(data) {
-        if (this.debounceTimer !== null) {
-            clearTimeout(this.debounceTimer);
+    writeRefreshLock() {
+        if (this.disposed)
+            return { kind: 'declined' };
+        if (!this.hasLocalStorage())
+            return { kind: 'uncoordinated' };
+        const now = Date.now();
+        const existing = this.readRefreshLock();
+        if (!existing.available)
+            return { kind: 'uncoordinated' };
+        if (existing.value && this.isLockLive(existing.value.timestamp, now)) {
+            return { kind: 'declined' }; // Another tab holds a valid lock
+        }
+        const lockId = createLockId();
+        const lock = { ownerId: this.ownerId, lockId, timestamp: now };
+        try {
+            localStorage.setItem(this.options.lockKey, JSON.stringify(lock));
+        }
+        catch {
+            // Storage can be present but denied (private browsing, blocked cookies,
+            // quota). Proceed without coordination rather than failing auth refresh.
+            this.heldLockId = null;
+            return { kind: 'uncoordinated' };
+        }
+        return { kind: 'written', lockId };
+    }
+    isLockLive(timestamp, now) {
+        return timestamp <= now + LOCK_CLOCK_SKEW_MS && now - timestamp < this.options.lockTimeoutMs;
+    }
+    confirmRefreshLock(lockId) {
+        const observed = this.readRefreshLock();
+        if (observed.available &&
+            observed.value?.ownerId === this.ownerId &&
+            observed.value.lockId === lockId) {
+            this.heldLockId = lockId;
+            return true;
         }
-        this.debounceTimer = setTimeout(() => {
-            this.debounceTimer = null;
-            for (const listener of this.listeners) {
-                listener(data);
+        this.heldLockId = null;
+        return false;
+    }
+    removeRefreshLock(lockId) {
+        if (!this.hasLocalStorage())
+            return;
+        const current = this.readRefreshLock();
+        if (current.available &&
+            current.value?.ownerId === this.ownerId &&
+            current.value.lockId === lockId) {
+            try {
+                localStorage.removeItem(this.options.lockKey);
             }
-        }, this.options.debounceMs);
+            catch {
+                // Storage became unavailable; there is nothing safe to release.
+            }
+        }
     }
     hasLocalStorage() {
         try {
@@ -179,5 +273,45 @@ export class SessionSync {
             return false;
         }
     }
+    readRefreshLock() {
+        try {
+            const raw = localStorage.getItem(this.options.lockKey);
+            if (!raw)
+                return { available: true, value: null };
+            const parsed = JSON.parse(raw);
+            if (isRefreshLockRecord(parsed))
+                return { available: true, value: parsed };
+            // Read locks written by older versions so they expire normally. A
+            // legacy lock has no owner and therefore cannot be released by us.
+            const timestamp = Number.parseInt(raw, 10);
+            return Number.isFinite(timestamp)
+                ? {
+                    available: true,
+                    value: { ownerId: '', lockId: '', timestamp },
+                }
+                : { available: true, value: null };
+        }
+        catch {
+            return { available: false, value: null };
+        }
+    }
+}
+function createOwnerId() {
+    ownerSequence += 1;
+    return `afd-auth-${Date.now().toString(36)}-${ownerSequence.toString(36)}-${Math.random()
+        .toString(36)
+        .slice(2)}`;
+}
+function createLockId() {
+    return `${Date.now().toString(36)}-${Math.random().toString(36).slice(2)}`;
+}
+function isRefreshLockRecord(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const record = value;
+    return (typeof record.ownerId === 'string' &&
+        typeof record.lockId === 'string' &&
+        typeof record.timestamp === 'number' &&
+        Number.isFinite(record.timestamp));
 }
 //# sourceMappingURL=session-sync.js.map

package/dist/session-sync.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-sync.js","sourceRoot":"","sources":["../src/session-sync.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAmBH,MAAM,QAAQ,GAAiC;IAC9C,WAAW,EAAE,kBAAkB;IAC/B,UAAU,EAAE,eAAe;IAC3B,OAAO,EAAE,uBAAuB;IAChC,aAAa,EAAE,MAAM;IACrB,gBAAgB,EAAE,EAAE;IACpB,UAAU,EAAE,GAAG;IACf,mBAAmB,EAAE,OAAO;CAC5B,CAAC;AAEF,MAAM,OAAO,WAAW;IACN,OAAO,CAA+B;IAC/C,OAAO,GAA4B,IAAI,CAAC;IACxC,SAAS,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC/C,aAAa,GAAyC,IAAI,CAAC;IAC3D,QAAQ,GAAkB,IAAI,CAAC;IAC/B,iBAAiB,GAAwB,IAAI,CAAC;IAC9C,cAAc,GAAuC,IAAI,CAAC;IAC1D,QAAQ,GAAG,KAAK,CAAC;IAEzB,YAAY,UAA8B,EAAE;QAC3C,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC;QAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;IACb,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,IAAa;QACjC,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAE1B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC;gBACJ,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;gBAC/B,OAAO;YACR,CAAC;YAAC,MAAM,CAAC;gBACR,+BAA+B;YAChC,CAAC;QACF,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,QAAiC;QACjD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7B,OAAO;YACN,WAAW,EAAE,GAAG,EAAE;gBACjB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YACjC,CAAC;SACD,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,kBAAkB;QACjB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YAAE,OAAO,IAAI,CAAC;QAEzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE5D,IAAI,QAAQ,EAAE,CAAC;YACd,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAChD,IAAI,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;gBAClD,OAAO,KAAK,CAAC,CAAC,iCAAiC;YAChD,CAAC;QACF,CAAC;QAED,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACb,CAAC;IAED;;OAEG;IACH,kBAAkB;QACjB,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YAAE,OAAO;QACpC,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,OAAO;QACN,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QAErB,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YACjC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACjC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC3B,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACrB,CAAC;QAED,IAAI,IAAI,CAAC,cAAc,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YAC1D,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;YAC3D,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC5B,CAAC;QAED,IAAI,IAAI,CAAC,iBAAiB,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC/D,QAAQ,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACzE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC/B,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAEO,IAAI;QACX,6BAA6B;QAC7B,IAAI,OAAO,gBAAgB,KAAK,WAAW,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACJ,IAAI,CAAC,OAAO,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;gBAC9D,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,KAAmB,EAAE,EAAE;oBAChD,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAClC,CAAC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACR,6DAA6D;YAC9D,CAAC;QACF,CAAC;QAED,2CAA2C;QAC3C,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,eAAe,EAAE,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YAC9E,IAAI,CAAC,cAAc,GAAG,CAAC,CAAe,EAAE,EAAE;gBACzC,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;oBACrD,IAAI,CAAC;wBACJ,MAAM,IAAI,GAAY,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;wBAC7C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;oBAC5B,CAAC;oBAAC,MAAM,CAAC;wBACR,wBAAwB;oBACzB,CAAC;gBACF,CAAC;YACF,CAAC,CAAC;YACF,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACzD,CAAC;QAED,4BAA4B;QAC5B,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;YACrC,IAAI,CAAC,iBAAiB,GAAG,GAAG,EAAE;gBAC7B,IAAI,QAAQ,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;oBAC3C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC5B,CAAC;qBAAM,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;oBAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;oBAC3C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;oBACrB,IAAI,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;wBACjD,IAAI,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;oBACtD,CAAC;gBACF,CAAC;YACF,CAAC,CAAC;YACF,QAAQ,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACvE,CAAC;IACF,CAAC;IAEO,gBAAgB,CAAC,IAAa;QACrC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YAAE,OAAO;QACpC,IAAI,CAAC;YACJ,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YACpE,+DAA+D;YAC/D,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACR,mCAAmC;QACpC,CAAC;IACF,CAAC;IAEO,eAAe,CAAC,IAAa;QACpC,IAAI,IAAI,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;YACjC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;YACpC,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;YAC1B,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;gBACvC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;QACF,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC7B,CAAC;IAEO,eAAe;QACtB,IAAI,CAAC;YACJ,OAAO,OAAO,YAAY,KAAK,WAAW,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;CACD"}
+{"version":3,"file":"session-sync.js","sourceRoot":"","sources":["../src/session-sync.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EACN,uBAAuB,GAGvB,MAAM,2BAA2B,CAAC;AAyBnC,MAAM,QAAQ,GAAiC;IAC9C,WAAW,EAAE,kBAAkB;IAC/B,UAAU,EAAE,eAAe;IAC3B,OAAO,EAAE,uBAAuB;IAChC,aAAa,EAAE,MAAM;IACrB,gBAAgB,EAAE,EAAE;IACpB,UAAU,EAAE,GAAG;IACf,mBAAmB,EAAE,OAAO;CAC5B,CAAC;AAEF;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAkBjC,IAAI,aAAa,GAAG,CAAC,CAAC;AAEtB,MAAM,OAAO,WAAW;IACN,OAAO,CAA+B;IAC/C,OAAO,GAA4B,IAAI,CAAC;IAC/B,SAAS,GAAG,IAAI,WAAW,EAAsB,CAAC;IAClD,OAAO,GAAG,IAAI,GAAG,EAAyD,CAAC;IACpF,QAAQ,GAAkB,IAAI,CAAC;IAC/B,iBAAiB,GAAwB,IAAI,CAAC;IAC9C,cAAc,GAAuC,IAAI,CAAC;IAC1D,QAAQ,GAAG,KAAK,CAAC;IACR,OAAO,GAAG,aAAa,EAAE,CAAC;IACnC,UAAU,GAAkB,IAAI,CAAC;IAEzC,YAAY,UAA8B,EAAE;QAC3C,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC;QAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,oBAAoB,CAAC,OAA2B;QAC/C,MAAM,KAAK,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACZ,MAAM,IAAI,SAAS,CAAC,iCAAiC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAE1B,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC;gBACJ,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;gBAChC,OAAO;YACR,CAAC;YAAC,MAAM,CAAC;gBACR,+BAA+B;YAChC,CAAC;QACF,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;OAKG;IACH,gBAAgB,CAAC,QAA+C;QAC/D,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,kBAAkB;QACjB,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,IAAI,KAAK,eAAe,CAAC;QAExE,qEAAqE;QACrE,uEAAuE;QACvE,wEAAwE;QACxE,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,uBAAuB;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,OAAO,CAAC,IAAI,KAAK,eAAe,CAAC;QAExE,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACnF,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACvC,OAAO,KAAK,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACH,kBAAkB;QACjB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,wEAAwE;QACxE,8BAA8B;QAC9B,IAAI,UAAU,KAAK,IAAI;YAAE,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAC7D,CAAC;IAED;;OAEG;IACH,OAAO;QACN,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC1B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,aAAa,EAAE,CAAC;QAErB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACrB,CAAC;QAED,IAAI,IAAI,CAAC,cAAc,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YAC1D,MAAM,CAAC,mBAAmB,CAAC,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;YAC3D,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC5B,CAAC;QAED,IAAI,IAAI,CAAC,iBAAiB,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC/D,QAAQ,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;YACzE,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAC;QAC/B,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACxB,CAAC;IAEO,IAAI;QACX,6BAA6B;QAC7B,IAAI,OAAO,gBAAgB,KAAK,WAAW,EAAE,CAAC;YAC7C,IAAI,CAAC;gBACJ,IAAI,CAAC,OAAO,GAAG,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;gBAC9D,IAAI,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,KAAmB,EAAE,EAAE;oBAChD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC1B,CAAC,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACR,6DAA6D;YAC9D,CAAC;QACF,CAAC;QAED,2CAA2C;QAC3C,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,eAAe,EAAE,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YAC9E,IAAI,CAAC,cAAc,GAAG,CAAC,CAAe,EAAE,EAAE;gBACzC,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;oBACrD,IAAI,CAAC;wBACJ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;oBACtC,CAAC;oBAAC,MAAM,CAAC;wBACR,wBAAwB;oBACzB,CAAC;gBACF,CAAC;YACF,CAAC,CAAC;YACF,MAAM,CAAC,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;QACzD,CAAC;QAED,4BAA4B;QAC5B,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;YACrC,IAAI,CAAC,iBAAiB,GAAG,GAAG,EAAE;gBAC7B,IAAI,QAAQ,CAAC,eAAe,KAAK,QAAQ,EAAE,CAAC;oBAC3C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC5B,CAAC;qBAAM,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;oBAC7E,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;oBAC3C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;oBACrB,IAAI,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,mBAAmB,EAAE,CAAC;wBACjD,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;oBAC9C,CAAC;gBACF,CAAC;YACF,CAAC,CAAC;YACF,QAAQ,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACvE,CAAC;IACF,CAAC;IAEO,OAAO,CAAC,OAAgB;QAC/B,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,MAAM,OAAO,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO;YAAE,OAAO;QAErB,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACnC,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7B,OAAO;QACR,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,QAAQ,KAAK,SAAS;YAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,GAAG,CACf,OAAO,CAAC,IAAI,EACZ,UAAU,CAAC,GAAG,EAAE;YACf,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAC3B,CAAC;IACH,CAAC;IAEO,aAAa;QACpB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAEO,gBAAgB,CAAC,OAA2B;QACnD,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YAAE,OAAO;QACpC,IAAI,CAAC;YACJ,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACvE,+DAA+D;YAC/D,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACR,mCAAmC;QACpC,CAAC;IACF,CAAC;IAEO,gBAAgB;QACvB,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;QAE9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACxC,IAAI,CAAC,QAAQ,CAAC,SAAS;YAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;QAE1D,IAAI,QAAQ,CAAC,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;YACtE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,iCAAiC;QAC/D,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAsB,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QAClF,IAAI,CAAC;YACJ,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACR,wEAAwE;YACxE,yEAAyE;YACzE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;YACvB,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;QAClC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpC,CAAC;IAEO,UAAU,CAAC,SAAiB,EAAE,GAAW;QAChD,OAAO,SAAS,IAAI,GAAG,GAAG,kBAAkB,IAAI,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;IAC9F,CAAC;IAEO,kBAAkB,CAAC,MAAc;QACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACxC,IACC,QAAQ,CAAC,SAAS;YAClB,QAAQ,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC,OAAO;YACxC,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,EAC/B,CAAC;YACF,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC;YACzB,OAAO,IAAI,CAAC;QACb,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACvB,OAAO,KAAK,CAAC;IACd,CAAC;IAEO,iBAAiB,CAAC,MAAc;QACvC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE;YAAE,OAAO;QACpC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QACvC,IACC,OAAO,CAAC,SAAS;YACjB,OAAO,CAAC,KAAK,EAAE,OAAO,KAAK,IAAI,CAAC,OAAO;YACvC,OAAO,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,EAC9B,CAAC;YACF,IAAI,CAAC;gBACJ,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACR,gEAAgE;YACjE,CAAC;QACF,CAAC;IACF,CAAC;IAEO,eAAe;QACtB,IAAI,CAAC;YACJ,OAAO,OAAO,YAAY,KAAK,WAAW,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IAEO,eAAe;QACtB,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACvD,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YAElD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,mBAAmB,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAE3E,kEAAkE;YAClE,mEAAmE;YACnE,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3C,OAAO,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;gBAChC,CAAC,CAAC;oBACA,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE;iBAC7C;gBACF,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC1C,CAAC;IACF,CAAC;CACD;AAED,SAAS,aAAa;IACrB,aAAa,IAAI,CAAC,CAAC;IACnB,OAAO,YAAY,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE;SACvF,QAAQ,CAAC,EAAE,CAAC;SACZ,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AACd,CAAC;AAED,SAAS,YAAY;IACpB,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;AAC5E,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,OAAO,CACN,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;QAClC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;QACjC,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ;QACpC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CACjC,CAAC;AACH,CAAC"}

package/dist/types.d.ts

@@ -6,7 +6,13 @@
  */
 export interface Session {
     id: string;
-    expiresAt: Date;
+    /**
+     * When the session stops being valid. Omitted when the provider manages the
+     * token lifetime itself and does not report an expiry (Convex).
+     * `createAuthMiddleware` rejects a session whose `expiresAt` is at or before
+     * the current time.
+     */
+    expiresAt?: Date;
 }
 export interface User {
     id: string;
@@ -27,6 +33,24 @@ export interface OAuthSignInOptions {
     redirectTo?: string;
 }
 export type SignInOptions = CredentialsSignInOptions | OAuthSignInOptions;
+/**
+ * What an adapter knows about a sign-in when `signIn()` resolves.
+ *
+ * - `signed-in`: the provider accepted the sign-in. The new session can still
+ *   reach `getSession()` later, through `onAuthStateChange`.
+ * - `redirect`: sign-in continues at the provider (OAuth). No session exists
+ *   until the provider redirects back to the app.
+ * - `pending`: the provider needs another step first, such as email
+ *   verification.
+ */
+export type SignInOutcome = {
+    kind: 'signed-in';
+} | {
+    kind: 'redirect';
+    url?: string;
+} | {
+    kind: 'pending';
+};
 export type AuthSessionState = {
     status: 'unauthenticated';
     session: null;
@@ -40,6 +64,10 @@ export type AuthSessionState = {
     session: Session;
     user: User;
 };
+/** The `authenticated` member of {@link AuthSessionState}. */
+export type AuthenticatedSessionState = Extract<AuthSessionState, {
+    status: 'authenticated';
+}>;
 /**
  * Constant for the unauthenticated state.
  * Reuse this to avoid object allocation on every check.
@@ -51,7 +79,12 @@ export declare const UNAUTHENTICATED: AuthSessionState;
  */
 export declare const LOADING: AuthSessionState;
 export interface AuthAdapter {
-    signIn(options: SignInOptions): Promise<void>;
+    /**
+     * Start a sign-in. Resolve with a {@link SignInOutcome} when the provider
+     * says how the sign-in continues. Resolving with nothing is still allowed
+     * and is treated like `signed-in`.
+     */
+    signIn(options: SignInOptions): Promise<SignInOutcome | void>;
     signOut(): Promise<void>;
     getSession(): AuthSessionState;
     onAuthStateChange(callback: (state: AuthSessionState) => void): {

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,WAAW,OAAO;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,IAAI;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAMD,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAErE,MAAM,WAAW,wBAAwB;IACxC,MAAM,EAAE,aAAa,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GAAG,wBAAwB,GAAG,kBAAkB,CAAC;AAM1E,MAAM,MAAM,gBAAgB,GACzB;IAAE,MAAM,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GACxD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GAChD;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,gBAI5B,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,OAAO,EAAE,gBAIpB,CAAC;AAMH,MAAM,WAAW,WAAW;IAC3B,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,UAAU,IAAI,gBAAgB,CAAC;IAC/B,iBAAiB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,GAAG;QAAE,WAAW,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC;CAC5F"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,WAAW,OAAO;IACvB,EAAE,EAAE,MAAM,CAAC;IACX;;;;;OAKG;IACH,SAAS,CAAC,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,IAAI;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAMD,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAErE,MAAM,WAAW,wBAAwB;IACxC,MAAM,EAAE,aAAa,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IAClC,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,aAAa,GAAG,wBAAwB,GAAG,kBAAkB,CAAC;AAE1E;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GACtB;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAE,GAClC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC;AAMvB,MAAM,MAAM,gBAAgB,GACzB;IAAE,MAAM,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GACxD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GAChD;IAAE,MAAM,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,CAAC;AAE7D,8DAA8D;AAC9D,MAAM,MAAM,yBAAyB,GAAG,OAAO,CAAC,gBAAgB,EAAE;IAAE,MAAM,EAAE,eAAe,CAAA;CAAE,CAAC,CAAC;AAE/F;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,gBAI5B,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,OAAO,EAAE,gBAIpB,CAAC;AAMH,MAAM,WAAW,WAAW;IAC3B;;;;OAIG;IAEH,MAAM,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACzB,UAAU,IAAI,gBAAgB,CAAC;IAC/B,iBAAiB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,GAAG;QAAE,WAAW,EAAE,MAAM,IAAI,CAAA;KAAE,CAAC;CAC5F"}

package/dist/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAgDH;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAqB,MAAM,CAAC,MAAM,CAAC;IAC9D,MAAM,EAAE,iBAA0B;IAClC,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,IAAI;CACV,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAqB,MAAM,CAAC,MAAM,CAAC;IACtD,MAAM,EAAE,SAAkB;IAC1B,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,IAAI;CACV,CAAC,CAAC"}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAwEH;;;GAGG;AACH,MAAM,CAAC,MAAM,eAAe,GAAqB,MAAM,CAAC,MAAM,CAAC;IAC9D,MAAM,EAAE,iBAA0B;IAClC,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,IAAI;CACV,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAqB,MAAM,CAAC,MAAM,CAAC;IACtD,MAAM,EAAE,SAAkB;IAC1B,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,IAAI;CACV,CAAC,CAAC"}