@payez/next-mvp 4.8.1 → 4.8.3

package/src/lib/session.ts

@@ -1,34 +1,34 @@
-export type MinimalSession = {
-  user?: {
-    id?: string | null;
-    email?: string | null;
-  } | null;
-  accessToken?: string | null;
-  expires?: string;
-  [k: string]: any;
-};
-
-// AppSession is used by authStore - alias to MinimalSession for compatibility
-export type AppSession = MinimalSession;
-
-/**
- * Strict session validation for client-side guards.
- * A session is considered valid when:
- * - a user object exists with non-empty id and email
- * - an accessToken string exists
- */
-export function isValidSession(session: MinimalSession | null | undefined): boolean {
-  if (!session) return false;
-  const u = session.user as any;
-  const hasUser = !!u && typeof u.id === 'string' && u.id.length > 0 && typeof u.email === 'string' && u.email.length > 0;
-  const hasAccessToken = typeof session.accessToken === 'string' && session.accessToken.length > 0;
-  return hasUser && hasAccessToken;
-}
-
-/**
- * Sanitize session data - returns null if session is invalid
- */
-export function sanitizeSession(session: MinimalSession | null | undefined): MinimalSession | null {
-  if (!isValidSession(session)) return null;
-  return session as MinimalSession;
-}
+export type MinimalSession = {
+  user?: {
+    id?: string | null;
+    email?: string | null;
+  } | null;
+  accessToken?: string | null;
+  expires?: string;
+  [k: string]: any;
+};
+
+// AppSession is used by authStore - alias to MinimalSession for compatibility
+export type AppSession = MinimalSession;
+
+/**
+ * Strict session validation for client-side guards.
+ * A session is considered valid when:
+ * - a user object exists with non-empty id and email
+ * - an accessToken string exists
+ */
+export function isValidSession(session: MinimalSession | null | undefined): boolean {
+  if (!session) return false;
+  const u = session.user as any;
+  const hasUser = !!u && typeof u.id === 'string' && u.id.length > 0 && typeof u.email === 'string' && u.email.length > 0;
+  const hasAccessToken = typeof session.accessToken === 'string' && session.accessToken.length > 0;
+  return hasUser && hasAccessToken;
+}
+
+/**
+ * Sanitize session data - returns null if session is invalid
+ */
+export function sanitizeSession(session: MinimalSession | null | undefined): MinimalSession | null {
+  if (!isValidSession(session)) return null;
+  return session as MinimalSession;
+}

package/src/lib/single-flight.ts

@@ -1,64 +1,64 @@
-/**
- * Single-flight memoisation that does NOT memoise failure — card 244549.
- *
- * The bug this exists to prevent: caching an in-flight promise to de-duplicate
- * concurrent callers is correct, but if the cached promise REJECTS and is never
- * cleared, the rejection is memoised for the life of the process. Every later
- * caller re-awaits the same settled rejection and re-throws the same stale
- * error, long after the underlying dependency has recovered. Recovery becomes
- * restart-only, and — because the error text is identical every time — it looks
- * exactly like the dependency is still down.
- *
- * Measured instance: @payez/next-mvp getAuthInstance() memoised a failed IDP
- * config load. Re-injecting correct config into three running rigs on
- * 2026-08-23 did not heal them; the processes were replaying a cached
- * rejection rather than retrying.
- *
- * Contract:
- *  - concurrent callers during a successful load share ONE underlying call
- *  - a rejection is re-thrown to every caller awaiting that attempt (failures
- *    stay LOUD — this never converts an error into a silent retry)
- *  - the NEXT call after a failure starts a fresh attempt
- *  - a slow failure never clears a newer in-flight attempt
- *
- * Zero imports on purpose: this must be unit-testable without loading the
- * server auth stack, which is why the bug it fixes went untested for so long.
- */
-export interface SingleFlight<T> {
-  /** Run (or join) the in-flight attempt. Rejects if the attempt rejects. */
-  get(): Promise<T>;
-  /** Test/diagnostic seam: is an attempt currently cached? */
-  isPending(): boolean;
-  /** Drop any cached attempt. */
-  reset(): void;
-}
-
-export function createSingleFlight<T>(factory: () => Promise<T>): SingleFlight<T> {
-  let pending: Promise<T> | null = null;
-
-  return {
-    get(): Promise<T> {
-      if (pending) return pending;
-
-      const attempt = factory();
-
-      // Cleanup runs on a SIDE branch so the promise handed to callers is the
-      // original one and still rejects. The identity guard means only the
-      // attempt that actually failed clears itself: without it, a slow failure
-      // could evict a newer attempt a later caller had already installed, and
-      // that caller would be de-duplicated against a promise nobody owns.
-      attempt.catch(() => {
-        if (pending === attempt) pending = null;
-      });
-
-      pending = attempt;
-      return pending;
-    },
-    isPending(): boolean {
-      return pending !== null;
-    },
-    reset(): void {
-      pending = null;
-    },
-  };
-}
+/**
+ * Single-flight memoisation that does NOT memoise failure — card 244549.
+ *
+ * The bug this exists to prevent: caching an in-flight promise to de-duplicate
+ * concurrent callers is correct, but if the cached promise REJECTS and is never
+ * cleared, the rejection is memoised for the life of the process. Every later
+ * caller re-awaits the same settled rejection and re-throws the same stale
+ * error, long after the underlying dependency has recovered. Recovery becomes
+ * restart-only, and — because the error text is identical every time — it looks
+ * exactly like the dependency is still down.
+ *
+ * Measured instance: @payez/next-mvp getAuthInstance() memoised a failed IDP
+ * config load. Re-injecting correct config into three running rigs on
+ * 2026-08-23 did not heal them; the processes were replaying a cached
+ * rejection rather than retrying.
+ *
+ * Contract:
+ *  - concurrent callers during a successful load share ONE underlying call
+ *  - a rejection is re-thrown to every caller awaiting that attempt (failures
+ *    stay LOUD — this never converts an error into a silent retry)
+ *  - the NEXT call after a failure starts a fresh attempt
+ *  - a slow failure never clears a newer in-flight attempt
+ *
+ * Zero imports on purpose: this must be unit-testable without loading the
+ * server auth stack, which is why the bug it fixes went untested for so long.
+ */
+export interface SingleFlight<T> {
+  /** Run (or join) the in-flight attempt. Rejects if the attempt rejects. */
+  get(): Promise<T>;
+  /** Test/diagnostic seam: is an attempt currently cached? */
+  isPending(): boolean;
+  /** Drop any cached attempt. */
+  reset(): void;
+}
+
+export function createSingleFlight<T>(factory: () => Promise<T>): SingleFlight<T> {
+  let pending: Promise<T> | null = null;
+
+  return {
+    get(): Promise<T> {
+      if (pending) return pending;
+
+      const attempt = factory();
+
+      // Cleanup runs on a SIDE branch so the promise handed to callers is the
+      // original one and still rejects. The identity guard means only the
+      // attempt that actually failed clears itself: without it, a slow failure
+      // could evict a newer attempt a later caller had already installed, and
+      // that caller would be de-duplicated against a promise nobody owns.
+      attempt.catch(() => {
+        if (pending === attempt) pending = null;
+      });
+
+      pending = attempt;
+      return pending;
+    },
+    isPending(): boolean {
+      return pending !== null;
+    },
+    reset(): void {
+      pending = null;
+    },
+  };
+}