@nominalso/vibe-auth 0.2.0 → 0.2.2

package/dist/index.d.cts

@@ -222,7 +222,7 @@ interface AuthGateProps {
     children: ReactNode;
     /** Override the default sign-in screen (branding). Defaults to `DefaultSignInScreen`. */
     signInScreen?: ReactNode;
-    /** Override the default full-screen loader. Defaults to a bare "Signing you in…" spinner-less div. */
+    /** Override the default full-screen loader. Defaults to a bare "Fetching your data…" spinner-less div. */
     loader?: ReactNode;
 }
 interface AuthGateBundle {
@@ -278,8 +278,10 @@ interface VibeAuth {
     wireHostAuth(bridge: AuthBridgeLike): () => void;
     /**
      * Seed `{userId, tenant}` from `connect()`. Call from a **parent** of
-     * `AuthGate` after `connect()` resolves. The gate waits for this, then
-     * opens without rebind when the bound-user marker already matches.
+     * `AuthGate` after `connect()` resolves. Start `connect()` at module scope,
+     * not in a React effect, so the gate receives the live host principal as
+     * early as possible. It then opens without rebind when the bound-user
+     * marker already matches.
      */
     seedLastUserId(userId: string, tenant: string): void;
     /** The postMessage type relayed by `SilentCallback` — do not change if migrating an existing app. */
@@ -325,10 +327,12 @@ interface VibeAuth {
  * ```
  *
  * ```ts
- * // wire the host bridge before connect()
+ * // Start the host handshake at module scope, before React mounts.
  * const unsub = auth.wireHostAuth(bridge)
- * const ctx = await bridge.connect()
- * auth.seedLastUserId(ctx.user.id, ctx.tenant)
+ * export const hostContext = bridge.connect().then((ctx) => {
+ *   auth.seedLastUserId(ctx.user.id, ctx.tenant)
+ *   return ctx
+ * })
  * ```
  */
 declare function createVibeAuth(userConfig: VibeAuthConfig): VibeAuth;

package/dist/index.d.ts

@@ -222,7 +222,7 @@ interface AuthGateProps {
     children: ReactNode;
     /** Override the default sign-in screen (branding). Defaults to `DefaultSignInScreen`. */
     signInScreen?: ReactNode;
-    /** Override the default full-screen loader. Defaults to a bare "Signing you in…" spinner-less div. */
+    /** Override the default full-screen loader. Defaults to a bare "Fetching your data…" spinner-less div. */
     loader?: ReactNode;
 }
 interface AuthGateBundle {
@@ -278,8 +278,10 @@ interface VibeAuth {
     wireHostAuth(bridge: AuthBridgeLike): () => void;
     /**
      * Seed `{userId, tenant}` from `connect()`. Call from a **parent** of
-     * `AuthGate` after `connect()` resolves. The gate waits for this, then
-     * opens without rebind when the bound-user marker already matches.
+     * `AuthGate` after `connect()` resolves. Start `connect()` at module scope,
+     * not in a React effect, so the gate receives the live host principal as
+     * early as possible. It then opens without rebind when the bound-user
+     * marker already matches.
      */
     seedLastUserId(userId: string, tenant: string): void;
     /** The postMessage type relayed by `SilentCallback` — do not change if migrating an existing app. */
@@ -325,10 +327,12 @@ interface VibeAuth {
  * ```
  *
  * ```ts
- * // wire the host bridge before connect()
+ * // Start the host handshake at module scope, before React mounts.
  * const unsub = auth.wireHostAuth(bridge)
- * const ctx = await bridge.connect()
- * auth.seedLastUserId(ctx.user.id, ctx.tenant)
+ * export const hostContext = bridge.connect().then((ctx) => {
+ *   auth.seedLastUserId(ctx.user.id, ctx.tenant)
+ *   return ctx
+ * })
  * ```
  */
 declare function createVibeAuth(userConfig: VibeAuthConfig): VibeAuth;

package/dist/index.js

@@ -47,6 +47,7 @@ function assertPkce(supabase) {
 var RESULT_MESSAGE_TYPE = "silent-auth-result";
 
 // src/silentAuth.ts
+var SIBLING_SESSION_SYNC_MS = 50;
 var AuthResultKind = /* @__PURE__ */ ((AuthResultKind2) => {
   AuthResultKind2["Code"] = "code";
   return AuthResultKind2;
@@ -59,7 +60,7 @@ function parseCallbackMessage(data) {
   }
   return null;
 }
-function createSilentAuth(config, getHostPrincipal) {
+function createSilentAuth(config, getHostPrincipal, onBound) {
   const { supabase, provider, callbackPath, timeouts, lockName, boundUserKey } = config;
   async function getSessionUserId() {
     const { data } = await supabase.auth.getSession();
@@ -68,6 +69,11 @@ function createSilentAuth(config, getHostPrincipal) {
   async function hasValidSession() {
     return await getSessionUserId() !== null;
   }
+  async function waitForSiblingSession() {
+    if (await hasValidSession()) return true;
+    await new Promise((resolve) => setTimeout(resolve, SIBLING_SESSION_SYNC_MS));
+    return hasValidSession();
+  }
   function readBoundMarker() {
     if (typeof window === "undefined") return null;
     try {
@@ -92,7 +98,10 @@ function createSilentAuth(config, getHostPrincipal) {
       if (priorUserId !== null && sessionUserId === priorUserId) return false;
     }
     const host = getHostPrincipal?.();
-    if (host) writeBoundMarker(host);
+    if (host) {
+      writeBoundMarker(host);
+      onBound?.(host);
+    }
     return true;
   }
   function runHiddenAuthFrame(url) {
@@ -190,7 +199,7 @@ function createSilentAuth(config, getHostPrincipal) {
     if (await hasValidSession()) return true;
     return withSsoLock(
       async () => {
-        if (await hasValidSession()) return true;
+        if (await waitForSiblingSession()) return true;
         if (await trySilentSignIn()) return true;
         return hasValidSession();
       },
@@ -202,7 +211,14 @@ function createSilentAuth(config, getHostPrincipal) {
     if (typeof window === "undefined") return false;
     const siblingRebound = async () => {
       const m = readBoundMarker();
-      return m?.userId === principal.userId && m?.tenant === principal.tenant && Date.now() - (m.at ?? 0) < timeouts.lockWaitMs && await hasValidSession();
+      if (m?.userId !== principal.userId) return false;
+      if (m.tenant !== principal.tenant) return false;
+      if (Date.now() - (m.at ?? 0) >= timeouts.lockWaitMs) return false;
+      if (!await waitForSiblingSession()) return false;
+      const confirmed = readBoundMarker();
+      if (confirmed?.userId !== principal.userId) return false;
+      if (confirmed.tenant !== principal.tenant) return false;
+      return Date.now() - (confirmed.at ?? 0) < timeouts.lockWaitMs;
     };
     return withSsoLock(
       async () => {
@@ -460,7 +476,7 @@ function createAuthGate(config, silentAuth, interactiveAuth, hostAuth) {
       "div",
       {
         style: { display: "grid", placeItems: "center", height: "100vh", fontFamily: "sans-serif" },
-        children: "Signing you in\u2026"
+        children: "Fetching your data\u2026"
       }
     );
   }
@@ -505,12 +521,19 @@ function createAuthGate(config, silentAuth, interactiveAuth, hostAuth) {
       let oauthTimer;
       let hostPrincipal;
       let applyGen = 0;
+      let pendingSessionRead;
       let acceptPrincipalUpdates = !hostAuth?.isHostWired();
       const applyPrincipal = async (principal) => {
         hostPrincipal = principal;
         const gen = ++applyGen;
         setStatus("checking" /* Checking */);
-        const sessionOk = await silentAuth.hasValidSession().catch(() => false);
+        const prefetchedSession = pendingSessionRead;
+        pendingSessionRead = void 0;
+        const inFlightPrefetch = prefetchedSession && !prefetchedSession.settled ? prefetchedSession : void 0;
+        let sessionOk = inFlightPrefetch ? await inFlightPrefetch.promise : await silentAuth.hasValidSession().catch(() => false);
+        if (inFlightPrefetch) {
+          sessionOk = await silentAuth.hasValidSession().catch(() => false);
+        }
         if (cancelled || gen !== applyGen) return;
         if (sessionOk && silentAuth.isBoundTo(principal)) {
           setStatus("authenticated" /* Authenticated */);
@@ -544,9 +567,18 @@ function createAuthGate(config, silentAuth, interactiveAuth, hostAuth) {
         }
         if (hostAuth?.isHostWired()) {
           acceptPrincipalUpdates = true;
+          const sessionRead = {
+            promise: silentAuth.hasValidSession().catch(() => false),
+            settled: false
+          };
+          void sessionRead.promise.finally(() => {
+            sessionRead.settled = true;
+          });
+          pendingSessionRead = sessionRead;
           const next = await hostAuth.waitForSeededPrincipal(timeouts.oauthCompletionMs);
           if (cancelled) return;
           if (next && applyGen === 0) await applyPrincipal(next);
+          if (pendingSessionRead === sessionRead) pendingSessionRead = void 0;
           if (applyGen === 0) setStatus("unauthenticated" /* Unauthenticated */);
           return;
         }
@@ -563,14 +595,19 @@ function createAuthGate(config, silentAuth, interactiveAuth, hostAuth) {
       });
       const onStorage = (e) => {
         if (cancelled) return;
-        if (!e.key?.endsWith("-auth-token") || !e.newValue) return;
+        if (!e.key?.endsWith("-auth-token")) return;
+        pendingSessionRead = void 0;
+        if (!e.newValue) return;
         void openIfBound();
       };
       window.addEventListener("storage", onStorage);
       const { data: sub } = supabase.auth.onAuthStateChange((event, session) => {
         if (cancelled || event === "INITIAL_SESSION") return;
         if (session) void openIfBound();
-        else setStatus((s) => s === "authenticated" /* Authenticated */ ? "unauthenticated" /* Unauthenticated */ : s);
+        else {
+          pendingSessionRead = void 0;
+          setStatus((s) => s === "authenticated" /* Authenticated */ ? "unauthenticated" /* Unauthenticated */ : s);
+        }
       });
       return () => {
         cancelled = true;
@@ -658,7 +695,11 @@ function createVibeAuth(userConfig) {
   const config = resolveConfig(userConfig);
   assertPkce(config.supabase);
   let hostAuth;
-  const silentAuth = createSilentAuth(config, () => hostAuth.getPrincipal());
+  const silentAuth = createSilentAuth(
+    config,
+    () => hostAuth.getPrincipal(),
+    (principal) => hostAuth.seedLastUserId(principal.userId, principal.tenant)
+  );
   const interactiveAuth = createInteractiveAuth(config, silentAuth);
   const { SilentCallback } = createCallbackHandler();
   hostAuth = createHostAuth(config, silentAuth);